)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"63f7e3163b8397ed0c285286c1a66b94c86c4509","unresolved":true,"context_lines":[{"line_number":10,"context_line":"secret:delete policies contained a standalone role:admin check"},{"line_number":11,"context_line":"without a project scope constraint (rule:secret_project_match)."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"This allowed any admin-role holder to access or delete secrets"},{"line_number":14,"context_line":"from other projects."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Fix: remove standalone role:admin; add role:service to preserve"},{"line_number":17,"context_line":"legitimate cross-project access for service accounts (e.g., Nova"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"eaec55a6_9efde51f","line":14,"range":{"start_line":13,"start_character":0,"end_line":14,"end_character":20},"updated":"2026-09-29 20:22:45.000000000","message":"That is what we have in current OpenStack RBAC, admin is a global admin and not specific to any projects. For example, any admin role user created in any project can write/read things across projects resources.\n\n- https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#legacy-admin-continues-to-work-as-it-is\n\nIf you want to have a admin level users at project level then project manager is the right one.\n- https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#project-manager","commit_id":"7ce3a5f632bc32e3376ca9bc749c44b92393f974"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"63f7e3163b8397ed0c285286c1a66b94c86c4509","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"33034355_712e474f","updated":"2026-09-29 20:22:45.000000000","message":"from RBAC perspective, it seems odd to restrict access from admin but give to memeber role users.","commit_id":"7ce3a5f632bc32e3376ca9bc749c44b92393f974"},{"author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"change_message_id":"9aded611bf48905197349193762e291320d4ad15","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"b5a7e183_375430c2","updated":"2026-09-29 17:26:47.000000000","message":"recheck","commit_id":"7ce3a5f632bc32e3376ca9bc749c44b92393f974"}],"barbican/common/policies/secrets.py":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"63f7e3163b8397ed0c285286c1a66b94c86c4509","unresolved":true,"context_lines":[{"line_number":81,"context_line":"    ),"},{"line_number":82,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":83,"context_line":"        name\u003d\u0027secret:get\u0027,"},{"line_number":84,"context_line":"        check_str\u003d("},{"line_number":85,"context_line":"            \"True:%(enforce_new_defaults)s and \""},{"line_number":86,"context_line":"            \"(rule:secret_project_admin or \""},{"line_number":87,"context_line":"            \"(rule:secret_project_member and rule:secret_owner) or \""},{"line_number":88,"context_line":"            \"(rule:secret_project_member and rule:secret_is_not_private) or \""},{"line_number":89,"context_line":"            \"rule:secret_acl_read or \""},{"line_number":90,"context_line":"            \"role:service)\"),"},{"line_number":91,"context_line":"        scope_types\u003d[\u0027project\u0027],"},{"line_number":92,"context_line":"        description\u003d\"Retrieve a secret\u0027s metadata.\","},{"line_number":93,"context_line":"        operations\u003d["}],"source_content_type":"text/x-python","patch_set":2,"id":"9ad9e45f_e6483315","line":90,"range":{"start_line":84,"start_character":0,"end_line":90,"end_character":29},"updated":"2026-09-29 20:22:45.000000000","message":"adding service role seems good idea here as this is used for openstack services also. But seeing the other role \u0027secret_project_member; having access seems like this is not only service-api and used by users. In that case, removing the admin access from it does not make sense.\n\nadmin (which is global admin not specific to projects) should have all access to the things a project member can have. Removing admin from access seems to be breaking change for global admin without any solid reason.","commit_id":"7ce3a5f632bc32e3376ca9bc749c44b92393f974"}]}