)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"4044480e6764722b94a43b90225c469f672fbece","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"5d8fdf6f_0e295f1e","updated":"2026-07-21 02:12:03.000000000","message":"moving to yaml is good but I think we should remove the customized policy file for neutron and things should work with the defaults.","commit_id":"2d6be721c67a6e71de51b13ed261da16d3cd4ecc"}],"lib/neutron":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"4044480e6764722b94a43b90225c469f672fbece","unresolved":true,"context_lines":[{"line_number":880,"context_line":"    Q_POLICY_FILE\u003d$NEUTRON_CONF_DIR/policy.yaml"},{"line_number":881,"context_line":""},{"line_number":882,"context_line":"    # allow neutron user to administer neutron to match neutron account"},{"line_number":883,"context_line":"    # NOTE(amotoki): This is required for nova works correctly with neutron."},{"line_number":884,"context_line":"    if [ -f $Q_POLICY_FILE ]; then"},{"line_number":885,"context_line":"        if ! grep -q \u0027context_is_admin\u0027 $Q_POLICY_FILE; then"},{"line_number":886,"context_line":"            echo \u0027\"context_is_admin\": \"role:admin or user_name:neutron\"\u0027 \u003e\u003e $Q_POLICY_FILE"}],"source_content_type":"application/x-shellscript","patch_set":1,"id":"052d2aca_93d6a5b4","line":883,"range":{"start_line":883,"start_character":3,"end_line":883,"end_character":76},"updated":"2026-07-21 02:12:03.000000000","message":"This actually strange that we need to generate the costumized policy file and CI does not work with defaults. I am not 100% sure why we need this and whether we need this with new defaults or not? maybe neutron folks can comment if this is still needed. @skaplons@redhat.com might know?\n\nIMO, we should remove generating it and fill the gap in current defaults only.","commit_id":"2d6be721c67a6e71de51b13ed261da16d3cd4ecc"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"cb9bad21302e0094e8a90d6f6a9284e791d6eccf","unresolved":true,"context_lines":[{"line_number":880,"context_line":"    Q_POLICY_FILE\u003d$NEUTRON_CONF_DIR/policy.yaml"},{"line_number":881,"context_line":""},{"line_number":882,"context_line":"    # allow neutron user to administer neutron to match neutron account"},{"line_number":883,"context_line":"    # NOTE(amotoki): This is required for nova works correctly with neutron."},{"line_number":884,"context_line":"    if [ -f $Q_POLICY_FILE ]; then"},{"line_number":885,"context_line":"        if ! grep -q \u0027context_is_admin\u0027 $Q_POLICY_FILE; then"},{"line_number":886,"context_line":"            echo \u0027\"context_is_admin\": \"role:admin or user_name:neutron\"\u0027 \u003e\u003e $Q_POLICY_FILE"}],"source_content_type":"application/x-shellscript","patch_set":1,"id":"f343dd2f_f1968646","line":883,"range":{"start_line":883,"start_character":3,"end_line":883,"end_character":76},"in_reply_to":"052d2aca_93d6a5b4","updated":"2026-07-21 19:04:57.000000000","message":"Interesting point ... I looked into this and it looks like this is needed only when `enforce_new_defaults\u003dFalse` because the older policy rules required the `admin` role and Devstack does _not_ give the `neutron` service user the `admin` role (unlike the `nova`, `placement\u0027, and `glance` users who get the `admin` role still):\n\n```\n$ openstack --os-cloud devstack-admin role assignment list --name\n+-------------+-------------------------+-------------------+----------------------------+---------+--------+-----------+\n| Role        | User                    | Group             | Project                    | Domain  | System | Inherited |\n+-------------+-------------------------+-------------------+----------------------------+---------+--------+-----------+\n| service     | nova@Default            |                   | service@Default            |         |        | False     |\n| admin       | nova@Default            |                   | service@Default            |         |        | False     |\n| service     | glance@Default          |                   | service@Default            |         |        | False     |\n| admin       | glance@Default          |                   | service@Default            |         |        | False     |\n| service     | neutron@Default         |                   | service@Default            |         |        | False     |\n| service     | placement@Default       |                   | service@Default            |         |        | False     |\n| admin       | placement@Default       |                   | service@Default            |         |        | False     |\n+-------------+-------------------------+-------------------+----------------------------+---------+--------+-----------+\n```\n\nSo because the `neutron` user has only the `service` role, this policy override was needed to treat the user as `admin` when `enforce_new_defaults\u003dFalse`.\n\nWith `enforce_new_defaults\u003dTrue`, the API policies allow the `admin` or the `service` role, so things work fine.\n\nGiven this, what do you think we should do here? I have a feeling the `admin` role added to some of the service users is maybe something we shouldn\u0027t be doing either ... but if we removed that then we would have to again think how to handle the situation when `enforce_new_defaults\u003dFalse`.","commit_id":"2d6be721c67a6e71de51b13ed261da16d3cd4ecc"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"1352d068f13c66528fbd5d6f6c6cab40ecb6f17d","unresolved":true,"context_lines":[{"line_number":880,"context_line":"    Q_POLICY_FILE\u003d$NEUTRON_CONF_DIR/policy.yaml"},{"line_number":881,"context_line":""},{"line_number":882,"context_line":"    # allow neutron user to administer neutron to match neutron account"},{"line_number":883,"context_line":"    # NOTE(amotoki): This is required for nova works correctly with neutron."},{"line_number":884,"context_line":"    if [ -f $Q_POLICY_FILE ]; then"},{"line_number":885,"context_line":"        if ! grep -q \u0027context_is_admin\u0027 $Q_POLICY_FILE; then"},{"line_number":886,"context_line":"            echo \u0027\"context_is_admin\": \"role:admin or user_name:neutron\"\u0027 \u003e\u003e $Q_POLICY_FILE"}],"source_content_type":"application/x-shellscript","patch_set":1,"id":"6e853f66_252abda3","line":883,"range":{"start_line":883,"start_character":3,"end_line":883,"end_character":76},"in_reply_to":"51aa51f1_23f726e8","updated":"2026-07-28 16:50:47.000000000","message":"Yeah, we do not need to change old defaults (as they are going to be removed soon) if new defaults work fine. Let\u0027s have a check for enforce_new_defaults here and a NOTE to remove this once old defaults are gone.\n\n    if [[ \"$NEUTRON_ENFORCE_NEW_DEFAULTS\" \u003d\u003d \"False\" || \"$ENFORCE_NEW_DEFAULTS\" \u003d\u003d False]]; then","commit_id":"2d6be721c67a6e71de51b13ed261da16d3cd4ecc"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8189cd60d4232955072018ce1bb3dba3755c244b","unresolved":true,"context_lines":[{"line_number":880,"context_line":"    Q_POLICY_FILE\u003d$NEUTRON_CONF_DIR/policy.yaml"},{"line_number":881,"context_line":""},{"line_number":882,"context_line":"    # allow neutron user to administer neutron to match neutron account"},{"line_number":883,"context_line":"    # NOTE(amotoki): This is required for nova works correctly with neutron."},{"line_number":884,"context_line":"    if [ -f $Q_POLICY_FILE ]; then"},{"line_number":885,"context_line":"        if ! grep -q \u0027context_is_admin\u0027 $Q_POLICY_FILE; then"},{"line_number":886,"context_line":"            echo \u0027\"context_is_admin\": \"role:admin or user_name:neutron\"\u0027 \u003e\u003e $Q_POLICY_FILE"}],"source_content_type":"application/x-shellscript","patch_set":1,"id":"51aa51f1_23f726e8","line":883,"range":{"start_line":883,"start_character":3,"end_line":883,"end_character":76},"in_reply_to":"f343dd2f_f1968646","updated":"2026-07-28 11:41:49.000000000","message":"neutron shudl not be calling its own rest api.\n\nso its policy shoudl not need to special case the neutron user for anything.\n\nwild guess but i wsould assome this is realted in some way to howhow they are deploying ovn? i know it has a webhooks endpoint and they may be incorrectly reuseing the neturon user in ovn config to call that webhook?\n\nif that is the case tehy shoudl be assigning the admin role until they can move the webhook endpoitn to the service role.\n\ni agree with gmann that modifying the policy file is not the right approch here.\n\nwe shoudl either assing the role properly to the neutron user or use a diffent dedicate user for whatever is calling neutron api as neutron.","commit_id":"2d6be721c67a6e71de51b13ed261da16d3cd4ecc"}]}