)]}'
{"id":"openstack%2Fdesignate~763877","triplet_id":"openstack%2Fdesignate~master~I9b6bce0c43720f61cdebfa416d953e5a2b920e87","project":"openstack/designate","branch":"master","topic":"secure-rbac","hashtags":[],"change_id":"I9b6bce0c43720f61cdebfa416d953e5a2b920e87","subject":"Implement secure RBAC for tenant policies","status":"MERGED","created":"2020-11-23 22:49:51.000000000","updated":"2020-11-27 00:47:02.000000000","submitted":"2020-11-27 00:47:02.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"763877-secure-rbac","meta_rev_id":"a1a7a149aacdef80c05a87b50fa8bfc4a7a7910b","_number":763877,"virtual_id_number":763877,"owner":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":19298,"name":"Nicolas Bock","email":"nicolas.bock@canonical.com","username":"nicolasbock"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2020-11-27 00:47:01.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":19298,"name":"Nicolas Bock","email":"nicolas.bock@canonical.com","username":"nicolasbock"},"all":[{"value":2,"date":"2020-11-24 21:58:43.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":19298,"name":"Nicolas Bock","email":"nicolas.bock@canonical.com","username":"nicolasbock"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2020-11-26 22:36:58.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"},"all":[{"value":0,"_account_id":19298,"name":"Nicolas Bock","email":"nicolas.bock@canonical.com","username":"nicolasbock"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2020-11-26 22:36:58.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Review-Priority":{"all":[{"value":0,"_account_id":19298,"name":"Nicolas Bock","email":"nicolas.bock@canonical.com","username":"nicolasbock"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"}],"values":{"-1":"Branch Freeze"," 0":"No Priority","+1":"Important Change","+2":"Gate Blocker Fix / Urgent Change"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":19298,"name":"Nicolas Bock","email":"nicolas.bock@canonical.com","username":"nicolasbock"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2020-11-24 00:20:19.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2020-11-24 00:50:53.000000000","updated_by":{"_account_id":19298,"name":"Nicolas Bock","email":"nicolas.bock@canonical.com","username":"nicolasbock"},"reviewer":{"_account_id":19298,"name":"Nicolas Bock","email":"nicolas.bock@canonical.com","username":"nicolasbock"},"state":"REVIEWER"},{"updated":"2020-11-26 22:36:58.000000000","updated_by":{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"},"reviewer":{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"},"state":"REVIEWER"}],"messages":[{"id":"59e229c0540c8fb3bc39f15ad556017337ec62c6","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-23 22:49:51.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"5f6cff7922dc913dffb3b66e4ade5968e145d32a","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-23 22:53:42.000000000","message":"Topic set to secure-rbac","accounts_in_message":[],"_revision_number":1},{"id":"c7b4b346f1e3cdaef508a5cfb409b97125848a3d","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-11-24 00:20:19.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- designate-bind9 https://zuul.opendev.org/t/openstack/build/66142c831eb74cc4b36161a9e0be229e : SUCCESS in 36m 43s\n- designate-pdns4 https://zuul.opendev.org/t/openstack/build/a72a2bba21414085b6ca2e7c7d855cb5 : SUCCESS in 44m 59s\n- designate-grenade-pdns4 https://zuul.opendev.org/t/openstack/build/a445492f759c4980bb145585825b264a : SUCCESS in 46m 14s\n- designate-ipv6-only-pdns4 https://zuul.opendev.org/t/openstack/build/6befed136994483b80f21258d0798d3c : SUCCESS in 1h 08m 50s\n- designate-ipv6-only-bind9 https://zuul.opendev.org/t/openstack/build/01994f0446844995a4ea846c890a3a48 : SUCCESS in 41m 09s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/f737d6d7f3a1499b8bb9dd8540683a04 : SUCCESS in 4m 45s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/cf7251dc7f8f43a9beec2218dbcfe5b0 : FAILURE in 3m 40s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/336329ff708544eabc68084a67b6e4b5 : SUCCESS in 3m 50s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/6df12e3e07934323a512ffceff20e894 : SUCCESS in 4m 49s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/d79a5c51b0114ef4a8a2adac5f1232b5 : SUCCESS in 4m 30s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/e361f8a74c594023a721154140d6acb6 : SUCCESS in 5m 15s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/191c898d6e024fe9a6827fc237544f1c : SUCCESS in 7m 29s\n- neutron-tempest-plugin-designate-scenario https://zuul.opendev.org/t/openstack/build/68ef0f478c204a75bde019aef48b9b61 : SUCCESS in 34m 46s","accounts_in_message":[],"_revision_number":1},{"id":"5d7bd4a37351443774b8012ecd2ca2d3f17ec5e0","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":19298,"name":"Nicolas Bock","email":"nicolas.bock@canonical.com","username":"nicolasbock"},"date":"2020-11-24 00:50:53.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.","accounts_in_message":[],"_revision_number":2},{"id":"22c603492ee2ce8365a0b8bc8bb4b54a535f0a91","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":19298,"name":"Nicolas Bock","email":"nicolas.bock@canonical.com","username":"nicolasbock"},"date":"2020-11-24 01:04:14.000000000","message":"Uploaded patch set 3.","accounts_in_message":[],"_revision_number":3},{"id":"54fb60ee3dee09cec70b054883ac58c8e805f138","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-11-24 02:11:13.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\n\n- designate-bind9 https://zuul.opendev.org/t/openstack/build/af00d1b98b50414b88c63d1931046e73 : SUCCESS in 33m 20s\n- designate-pdns4 https://zuul.opendev.org/t/openstack/build/79be17c0255d47139d688e97f83180ca : SUCCESS in 36m 37s\n- designate-grenade-pdns4 https://zuul.opendev.org/t/openstack/build/0ffb4957c11b4dde975334ebc0e6d6e1 : SUCCESS in 58m 42s\n- designate-ipv6-only-pdns4 https://zuul.opendev.org/t/openstack/build/c4f3cd8013564e5a84c13ad070a94729 : SUCCESS in 44m 56s\n- designate-ipv6-only-bind9 https://zuul.opendev.org/t/openstack/build/96aa6b0b4bc64101ae0bb455b91b8719 : SUCCESS in 41m 45s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/ea3a9e2ed8064fc09431467be2e399ab : SUCCESS in 5m 29s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/2cdf512d1dfe45dea33c7d4d8f1456c7 : SUCCESS in 4m 51s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/cf9dada0f2384d7bb6b0b9174fda3397 : SUCCESS in 4m 22s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/46a8bb38edd44549883a903ccad1080e : SUCCESS in 4m 48s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/ee2edbbb65fd4e35aafd92ae65851d4c : SUCCESS in 4m 20s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/7b6ba8767f8a493ebc45df41c6ba95a0 : SUCCESS in 5m 10s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/7a584e99e44444a691f6b0a807816490 : SUCCESS in 7m 16s\n- neutron-tempest-plugin-designate-scenario https://zuul.opendev.org/t/openstack/build/2e24658915c840408be05f845825904f : SUCCESS in 36m 13s","accounts_in_message":[],"_revision_number":3},{"id":"b179066fd923b3a6091bb7d37adab5aebd537ee9","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-24 04:11:24.000000000","message":"Uploaded patch set 4: Patch Set 3 was rebased.","accounts_in_message":[],"_revision_number":4},{"id":"775918773a298df804dfd1f91f9e15a9ee2373e2","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-11-24 05:20:22.000000000","message":"Patch Set 4: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- designate-bind9 https://zuul.opendev.org/t/openstack/build/5e5a1ec7d8a3425a829a99ca2874d704 : SUCCESS in 29m 24s\n- designate-pdns4 https://zuul.opendev.org/t/openstack/build/b765f8dfd30d46afa9321eaef9ff8281 : SUCCESS in 37m 22s\n- designate-grenade-pdns4 https://zuul.opendev.org/t/openstack/build/fd7497c300114edc8759208e03152d92 : SUCCESS in 1h 00m 10s\n- designate-ipv6-only-pdns4 https://zuul.opendev.org/t/openstack/build/fa7fd1060c2c4f709e49b564d5f08d2a : SUCCESS in 41m 59s\n- designate-ipv6-only-bind9 https://zuul.opendev.org/t/openstack/build/8fb262fa0f3d4f92a93d3bbec064c809 : SUCCESS in 42m 56s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/99e945aae5594fc1b4ae9ac62d5a6994 : SUCCESS in 5m 04s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/40fe1a36a548436ca1eae530d0aeef76 : SUCCESS in 4m 55s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/58697dd1d10a43cc86b4c7b13f0d8dd4 : SUCCESS in 3m 29s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/471a023eea3b42df8bee5f49abe966b5 : SUCCESS in 4m 31s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/7e453e2a0c51469ab94db26d86db4d16 : SUCCESS in 4m 08s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/25db84ed419348edbb2d6e0f2c1896e8 : SUCCESS in 5m 08s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/2fa1b868bfc746c9a7bc081341e85c15 : SUCCESS in 9m 15s\n- neutron-tempest-plugin-designate-scenario https://zuul.opendev.org/t/openstack/build/4cc44739a5c14688af662732b2db578e : FAILURE in 37m 47s","accounts_in_message":[],"_revision_number":4},{"id":"2e1d361ea8ad0618f7961084d1f4555889d060c2","author":{"_account_id":19298,"name":"Nicolas Bock","email":"nicolas.bock@canonical.com","username":"nicolasbock"},"date":"2020-11-24 13:23:14.000000000","message":"Patch Set 4:\n\nrecheck","accounts_in_message":[],"_revision_number":4},{"id":"633171213305ac61eabbaa6527cd61500acd65aa","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-11-24 14:37:07.000000000","message":"Patch Set 4: Verified+1\n\nBuild succeeded (check pipeline).\n\n- designate-bind9 https://zuul.opendev.org/t/openstack/build/9743f7386d65430a90b08dd98241f85d : SUCCESS in 42m 28s\n- designate-pdns4 https://zuul.opendev.org/t/openstack/build/5093b9b2a82a460bb2093f1efa10bb28 : SUCCESS in 38m 00s\n- designate-grenade-pdns4 https://zuul.opendev.org/t/openstack/build/6ea68bece4cf4210a500623c6161e3b9 : SUCCESS in 1h 00m 54s\n- designate-ipv6-only-pdns4 https://zuul.opendev.org/t/openstack/build/dc00048271ab4b898ca4e91d73ff4e4f : SUCCESS in 37m 00s\n- designate-ipv6-only-bind9 https://zuul.opendev.org/t/openstack/build/b244ac18026e4ae6a342c4c1a66c8cde : SUCCESS in 35m 58s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/9b4cd7a385f4472587a90ce5e91cdf80 : SUCCESS in 4m 41s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/f0395fdb7eda41eba43af8d681e99c0b : SUCCESS in 4m 36s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/eaa8ec7c0b384dcfab6cfad5726c8725 : SUCCESS in 4m 40s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/6206ff6e7cf049488c6feb9f8b1e41a9 : SUCCESS in 5m 33s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/9d24079387264dad9f9b7396c543fb1a : SUCCESS in 3m 52s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/bdc5ac4a26cf454fabac236817c331e2 : SUCCESS in 4m 51s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/9e9b356ec4774b45b879ba2d0ac1e049 : SUCCESS in 7m 01s\n- neutron-tempest-plugin-designate-scenario https://zuul.opendev.org/t/openstack/build/92e1a76e13914bc3b00e632902d97702 : SUCCESS in 39m 25s","accounts_in_message":[],"_revision_number":4},{"id":"9574fdb7eeb2c99199fc28439a5d18a43a5c45e6","author":{"_account_id":19298,"name":"Nicolas Bock","email":"nicolas.bock@canonical.com","username":"nicolasbock"},"date":"2020-11-24 21:58:43.000000000","message":"Patch Set 4: Code-Review+2\n\nThanks!","accounts_in_message":[],"_revision_number":4},{"id":"03afb70b664c64ef5e552b1da350594133908c20","author":{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"},"date":"2020-11-26 22:36:58.000000000","message":"Patch Set 4: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":4},{"id":"c23f2625674fe12e28f018884b886c112058f7ff","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-11-26 23:34:53.000000000","message":"Patch Set 4: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":4},{"id":"287bb6eed6ccaebbe0985fc27d900649dbe10ea3","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-11-27 00:47:01.000000000","message":"Patch Set 4: Verified+2\n\nBuild succeeded (gate pipeline).\n\n- designate-bind9 https://zuul.opendev.org/t/openstack/build/b3c587abc63040dc8fa296ef045c2bb6 : SUCCESS in 42m 04s\n- designate-pdns4 https://zuul.opendev.org/t/openstack/build/cd87d904fccb4f9ba7ad66eae62c151b : SUCCESS in 45m 05s\n- designate-grenade-pdns4 https://zuul.opendev.org/t/openstack/build/44751e49acd2447a9ec542be3745385f : SUCCESS in 59m 34s\n- designate-ipv6-only-pdns4 https://zuul.opendev.org/t/openstack/build/4f54c9bd1c7342d792be6b3f8dc2cfd5 : SUCCESS in 44m 57s\n- designate-ipv6-only-bind9 https://zuul.opendev.org/t/openstack/build/7dbc0e88cdfe42c584066f9b4ca92b65 : SUCCESS in 43m 22s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/5e31f65406d84567a3d2f7b841a5d454 : SUCCESS in 4m 41s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/723b976237024c6ab0201a8b69ae1c5b : SUCCESS in 3m 11s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/aa575645dba94510975bb4aecb419518 : SUCCESS in 4m 17s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/ddb0c65c9acc4d44b329e24d0f7a159b : SUCCESS in 4m 01s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/f25af34cfa5b488baca99e2567481a7e : SUCCESS in 6m 51s","accounts_in_message":[],"_revision_number":4},{"id":"a1a7a149aacdef80c05a87b50fa8bfc4a7a7910b","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-11-27 00:47:02.000000000","message":"Change has been successfully merged by Zuul","accounts_in_message":[],"_revision_number":4}],"current_revision_number":4,"current_revision":"e477cf33b4efd3d898b3698dacac5bbf0112d93c","revisions":{"428a29f431c5e4045e7e1ee785f8e8292ee9c174":{"kind":"REWORK","_number":1,"created":"2020-11-23 22:49:51.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/77/763877/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/designate","ref":"refs/changes/77/763877/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/designate refs/changes/77/763877/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/designate refs/changes/77/763877/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/designate refs/changes/77/763877/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/designate refs/changes/77/763877/1"}}},"commit":{"parents":[{"commit":"5be3d2c5ac263427cee230765fe70529823a6485","subject":"Implement secure RBAC for service status","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/5be3d2c5ac263427cee230765fe70529823a6485"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 21:47:53.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 21:47:53.000000000","tz":0},"subject":"Implement secure RBAC for tenant policies","message":"Implement secure RBAC for tenant policies\n\nThis commit updates the tenant policies to understand scope checking and\naccount for a read-only role. This is part of a broader series of changes\nacross OpenStack to provide a consistent RBAC experience and improve security.\n\nI\u0027m not entirely sure I understand these policies. It\u0027ll be good to work\nthrough these policy changes with someone more familiar with desginate and why\nthese policies exist.\n\nChange-Id: I9b6bce0c43720f61cdebfa416d953e5a2b920e87\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/428a29f431c5e4045e7e1ee785f8e8292ee9c174"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/428a29f431c5e4045e7e1ee785f8e8292ee9c174"}]},"branch":"refs/heads/master"},"f38b0c2089b14b380b759301cd3d47e5f3186236":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2020-11-24 00:50:53.000000000","uploader":{"_account_id":19298,"name":"Nicolas Bock","email":"nicolas.bock@canonical.com","username":"nicolasbock"},"ref":"refs/changes/77/763877/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/designate","ref":"refs/changes/77/763877/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/designate refs/changes/77/763877/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/designate refs/changes/77/763877/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/designate refs/changes/77/763877/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/designate refs/changes/77/763877/2"}}},"commit":{"parents":[{"commit":"2812376dc1bbacfcbb61d8b9503606f76ef10542","subject":"Implement secure RBAC for service status","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/2812376dc1bbacfcbb61d8b9503606f76ef10542"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 21:47:53.000000000","tz":0},"committer":{"name":"Nicolas Bock","email":"nicolas.bock@canonical.com","date":"2020-11-24 00:49:29.000000000","tz":-420},"subject":"Implement secure RBAC for tenant policies","message":"Implement secure RBAC for tenant policies\n\nThis commit updates the tenant policies to understand scope checking and\naccount for a read-only role. This is part of a broader series of changes\nacross OpenStack to provide a consistent RBAC experience and improve security.\n\nI\u0027m not entirely sure I understand these policies. It\u0027ll be good to work\nthrough these policy changes with someone more familiar with desginate and why\nthese policies exist.\n\nChange-Id: I9b6bce0c43720f61cdebfa416d953e5a2b920e87\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/f38b0c2089b14b380b759301cd3d47e5f3186236"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/f38b0c2089b14b380b759301cd3d47e5f3186236"}]},"branch":"refs/heads/master"},"e0748fc59ae664e59383594206a2c3701f4b9eb5":{"kind":"TRIVIAL_REBASE_WITH_MESSAGE_UPDATE","_number":3,"created":"2020-11-24 01:04:14.000000000","uploader":{"_account_id":19298,"name":"Nicolas Bock","email":"nicolas.bock@canonical.com","username":"nicolasbock"},"ref":"refs/changes/77/763877/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/designate","ref":"refs/changes/77/763877/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/designate refs/changes/77/763877/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/designate refs/changes/77/763877/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/designate refs/changes/77/763877/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/designate refs/changes/77/763877/3"}}},"commit":{"parents":[{"commit":"e63abcf4b7fdc0fcd3c0ca7fb76e8e87a459c5cd","subject":"Implement secure RBAC for service status","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/e63abcf4b7fdc0fcd3c0ca7fb76e8e87a459c5cd"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 21:47:53.000000000","tz":0},"committer":{"name":"Nicolas Bock","email":"nicolas.bock@canonical.com","date":"2020-11-24 01:03:26.000000000","tz":-420},"subject":"Implement secure RBAC for tenant policies","message":"Implement secure RBAC for tenant policies\n\nThis commit updates the tenant policies to understand scope checking\nand account for a read-only role. This is part of a broader series of\nchanges across OpenStack to provide a consistent RBAC experience and\nimprove security.\n\nI\u0027m not entirely sure I understand these policies. It\u0027ll be good to\nwork through these policy changes with someone more familiar with\ndesginate and why these policies exist.\n\nChange-Id: I9b6bce0c43720f61cdebfa416d953e5a2b920e87\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/e0748fc59ae664e59383594206a2c3701f4b9eb5"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/e0748fc59ae664e59383594206a2c3701f4b9eb5"}]},"branch":"refs/heads/master"},"e477cf33b4efd3d898b3698dacac5bbf0112d93c":{"kind":"TRIVIAL_REBASE","_number":4,"created":"2020-11-24 04:11:24.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/77/763877/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/designate","ref":"refs/changes/77/763877/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/designate refs/changes/77/763877/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/designate refs/changes/77/763877/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/designate refs/changes/77/763877/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/designate refs/changes/77/763877/4"}}},"commit":{"parents":[{"commit":"d9360b35fe96d26d606759c32a9021df10c1cd11","subject":"Implement secure RBAC for service status","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/d9360b35fe96d26d606759c32a9021df10c1cd11"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 21:47:53.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-24 04:08:05.000000000","tz":0},"subject":"Implement secure RBAC for tenant policies","message":"Implement secure RBAC for tenant policies\n\nThis commit updates the tenant policies to understand scope checking\nand account for a read-only role. This is part of a broader series of\nchanges across OpenStack to provide a consistent RBAC experience and\nimprove security.\n\nI\u0027m not entirely sure I understand these policies. It\u0027ll be good to\nwork through these policy changes with someone more familiar with\ndesginate and why these policies exist.\n\nChange-Id: I9b6bce0c43720f61cdebfa416d953e5a2b920e87\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/e477cf33b4efd3d898b3698dacac5bbf0112d93c"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/designate/commit/e477cf33b4efd3d898b3698dacac5bbf0112d93c"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"status":"CLOSED","labels":[{"label":"Verified","status":"OK","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"OK","applied_by":{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"}},{"label":"Workflow","status":"OK","applied_by":{"_account_id":22623,"name":"Erik Olof Gunnar Andersson","email":"eandersson@blizzard.com","username":"eoandersson"}},{"label":"Review-Priority","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","status":"SATISFIED","is_legacy":true,"submittability_expression_result":{"expression":"label:Verified\u003dCustom-Rule","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dCustom-Rule"],"failing_atoms":[],"atom_explanations":{}}},{"name":"Workflow","status":"SATISFIED","is_legacy":true,"submittability_expression_result":{"expression":"label:Workflow\u003dCustom-Rule","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dCustom-Rule"],"failing_atoms":[],"atom_explanations":{}}},{"name":"Code-Review","status":"SATISFIED","is_legacy":true,"submittability_expression_result":{"expression":"label:Code-Review\u003dCustom-Rule","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dCustom-Rule"],"failing_atoms":[],"atom_explanations":{}}}]}