)]}'
{"specs/pike/approved/glance/policies-over-show-multiple-locations.rst":[{"author":{"_account_id":12807,"name":"Steve Lewis (stevelle)","email":"stevelle@gmail.com","username":"stevelle"},"change_message_id":"bc944784db23c342e694a84ef6d69332f38c9014","unresolved":false,"context_lines":[{"line_number":42,"context_line":"(irrespective of their roles in keystone) viz. ``show_multiple_locations``"},{"line_number":43,"context_line":"configuration option and default policies (or in general any policy) set up"},{"line_number":44,"context_line":"using the policy.json file (stored under the ``etc`` folder in glance repo for"},{"line_number":45,"context_line":"devstack and vanilla deployments). This results into confusion for operators, "},{"line_number":46,"context_line":"glance developers, other openstack projects alike for having a coherent way to"},{"line_number":47,"context_line":"assess the viability of using this feature without breaking changes. Most often"},{"line_number":48,"context_line":"the breaking changes are security or privacy issues exposing sensitive location"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ffe62b97_2148c12a","line":45,"range":{"start_line":45,"start_character":48,"end_line":45,"end_character":52},"updated":"2017-03-29 21:45:13.000000000","message":"in","commit_id":"2fd259ea52c0542e46dcda8323e5c176d31a1d77"},{"author":{"_account_id":12807,"name":"Steve Lewis (stevelle)","email":"stevelle@gmail.com","username":"stevelle"},"change_message_id":"bc944784db23c342e694a84ef6d69332f38c9014","unresolved":false,"context_lines":[{"line_number":85,"context_line":""},{"line_number":86,"context_line":"* There are numerous instances where image locations are being modified. For"},{"line_number":87,"context_line":"  example, the simplest cases are image-create (upload and activate),"},{"line_number":88,"context_line":"  image-update, etc. In many cases, image locations are being used underneath"},{"line_number":89,"context_line":"  and the access restrictions implied indirectly affect those features"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"* Notification system may need to be realigned to accomodate for locations"},{"line_number":92,"context_line":"  being publicly exposed in those cases for a complete support for indexing and"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ffe62b97_97d58c1e","line":89,"range":{"start_line":88,"start_character":21,"end_line":89,"end_character":70},"updated":"2017-03-29 21:45:13.000000000","message":"we will need to solve this up front. It seems like doing so and updating this spec to include that information makes the rest of the spec much clearer.","commit_id":"2fd259ea52c0542e46dcda8323e5c176d31a1d77"},{"author":{"_account_id":12807,"name":"Steve Lewis (stevelle)","email":"stevelle@gmail.com","username":"stevelle"},"change_message_id":"bc944784db23c342e694a84ef6d69332f38c9014","unresolved":false,"context_lines":[{"line_number":88,"context_line":"  image-update, etc. In many cases, image locations are being used underneath"},{"line_number":89,"context_line":"  and the access restrictions implied indirectly affect those features"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"* Notification system may need to be realigned to accomodate for locations"},{"line_number":92,"context_line":"  being publicly exposed in those cases for a complete support for indexing and"},{"line_number":93,"context_line":"  consumer services like Searchlight "},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"* Instead of the ``show_multiple_locations`` configuration option, now opt"},{"line_number":96,"context_line":"  ``store_type_location_strategy`` will need to depend on the values set in the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ffe62b97_b7fbf0bb","line":93,"range":{"start_line":91,"start_character":0,"end_line":93,"end_character":37},"updated":"2017-03-29 21:45:13.000000000","message":"it seems like the glance plugin for searchlight would need to know what the glance policies look like in order to encode the right metadata, or the related parts of policy need to be added as metadata to the notification for the searchlight plugin to properly filter and encode.\n\ndo I understand correctly?","commit_id":"2fd259ea52c0542e46dcda8323e5c176d31a1d77"},{"author":{"_account_id":12807,"name":"Steve Lewis (stevelle)","email":"stevelle@gmail.com","username":"stevelle"},"change_message_id":"bc944784db23c342e694a84ef6d69332f38c9014","unresolved":false,"context_lines":[{"line_number":93,"context_line":"  consumer services like Searchlight "},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"* Instead of the ``show_multiple_locations`` configuration option, now opt"},{"line_number":96,"context_line":"  ``store_type_location_strategy`` will need to depend on the values set in the"},{"line_number":97,"context_line":"  policy making it a difficult operator experience"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"* Testing and setting up of scrubber could be conveniently done before by"},{"line_number":100,"context_line":"  enabling the configuration option. Now, however, we will need to explicitly"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ffe62b97_979d8cbd","line":97,"range":{"start_line":96,"start_character":35,"end_line":97,"end_character":50},"updated":"2017-03-29 21:45:13.000000000","message":"could expand on this to make it clearer what is more difficult.","commit_id":"2fd259ea52c0542e46dcda8323e5c176d31a1d77"},{"author":{"_account_id":2537,"name":"Nikhil Komawar","email":"nik.komawar@gmail.com","username":"nikhil-komawar"},"change_message_id":"9e9611e31a3d3311a31672211bf668a6039110f3","unresolved":false,"context_lines":[{"line_number":237,"context_line":"References"},{"line_number":238,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":239,"context_line":""},{"line_number":240,"context_line":"Should be a few :-)"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ffe62b97_d629b6f2","line":240,"range":{"start_line":240,"start_character":0,"end_line":240,"end_character":6},"updated":"2017-03-30 14:49:35.000000000","message":"https://review.openstack.org/#/c/444540","commit_id":"2fd259ea52c0542e46dcda8323e5c176d31a1d77"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"25e07af96741c1fe26c55d1482700b346796f1b5","unresolved":false,"context_lines":[{"line_number":12,"context_line":"information to the user using a top level switch of"},{"line_number":13,"context_line":"``show_multiple_locations`` configuration option. However, there is another"},{"line_number":14,"context_line":"way operators can choose to control the fine grained access to the locations,"},{"line_number":15,"context_line":"using policies. This spec proposes a scheme where the use of later will be the"},{"line_number":16,"context_line":"only way for glance team to support this feature. Registered blueprint for"},{"line_number":17,"context_line":"tracking:-"},{"line_number":18,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_344d259a","line":15,"range":{"start_line":15,"start_character":16,"end_line":15,"end_character":20},"updated":"2017-04-03 22:15:34.000000000","message":"Should probably add a reference here to the spec-lite that deprecated the option in Newton: http://specs.openstack.org/openstack/glance-specs/specs/newton/approved/glance/lite-specs.html#deprecate-show-multiple-locations-configuration-option","commit_id":"973d9070c6e627db437242db52d4c46fcc2ff03e"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"25e07af96741c1fe26c55d1482700b346796f1b5","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Additionally some of the bugs (including security bugs) reported previously"},{"line_number":32,"context_line":"and having a OSSN associated with them, have emerged out of incorrect or"},{"line_number":33,"context_line":"inadvertent use of the ``show_multiple_locations`` configuration option for"},{"line_number":34,"context_line":"the end users. This change will help relieve some pain caused by them and"},{"line_number":35,"context_line":"operators will be able to assert on the outcome of the results based on more"},{"line_number":36,"context_line":"practical policy based control."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_379c07bf","line":36,"range":{"start_line":34,"start_character":15,"end_line":36,"end_character":31},"updated":"2017-04-03 22:15:34.000000000","message":"Maybe instead:\n\nBy moving the control of this feature strictly to policies, we aim to make the feature easier to configure and therefore easier for operators to anticipate the effects of configuration changes.","commit_id":"973d9070c6e627db437242db52d4c46fcc2ff03e"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"25e07af96741c1fe26c55d1482700b346796f1b5","unresolved":false,"context_lines":[{"line_number":40,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Glance has two ways to control mutliple locations feature use for users"},{"line_number":43,"context_line":"(irrespective of their roles in keystone) viz. ``show_multiple_locations``"},{"line_number":44,"context_line":"configuration option and default policies (or in general any policy) set up"},{"line_number":45,"context_line":"using the policy.json file (stored under the ``etc`` folder in glance repo for"},{"line_number":46,"context_line":"devstack and vanilla deployments). This results in confusion for operators,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_92ac0135","line":43,"range":{"start_line":43,"start_character":42,"end_line":43,"end_character":46},"updated":"2017-04-03 22:15:34.000000000","message":"s/ viz. /, namely, /","commit_id":"973d9070c6e627db437242db52d4c46fcc2ff03e"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"25e07af96741c1fe26c55d1482700b346796f1b5","unresolved":false,"context_lines":[{"line_number":48,"context_line":"assess the viability of using this feature without breaking changes. Most often"},{"line_number":49,"context_line":"the breaking changes are security or privacy issues exposing sensitive location"},{"line_number":50,"context_line":"data. One such example is OSSN-0065. Nevertheless, the ramifications of turning"},{"line_number":51,"context_line":"on the config option (i.e., ``show_multiple_locations\u003dTrue``) are not unknown."},{"line_number":52,"context_line":"Glance team needs a definitive way to support exposing the sensitive locations"},{"line_number":53,"context_line":"to the concerned openstack projects wihout affecting the standard deployment"},{"line_number":54,"context_line":"model (which considers in-tree policy setup) for setting up end user public,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_32677528","line":51,"range":{"start_line":51,"start_character":22,"end_line":51,"end_character":26},"updated":"2017-04-03 22:15:34.000000000","message":"s/i.e./that is/","commit_id":"973d9070c6e627db437242db52d4c46fcc2ff03e"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"25e07af96741c1fe26c55d1482700b346796f1b5","unresolved":false,"context_lines":[{"line_number":52,"context_line":"Glance team needs a definitive way to support exposing the sensitive locations"},{"line_number":53,"context_line":"to the concerned openstack projects wihout affecting the standard deployment"},{"line_number":54,"context_line":"model (which considers in-tree policy setup) for setting up end user public,"},{"line_number":55,"context_line":"private and hybrid clouds. A few more things to note:-"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"* ``show_multiple_locations`` configuration option has been deprecated in"},{"line_number":58,"context_line":"  Newton"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_2d1ef46f","line":55,"range":{"start_line":55,"start_character":26,"end_line":55,"end_character":27},"updated":"2017-04-03 22:15:34.000000000","message":"Before the \"A few more things to note\" sentence, I think we need a new paragraph explaining the \"screening\" problem.  What I mean is something like this:\n\nThe primary challenge in removing the ``show_multiple_locations`` configuration option is that the option had a \"screening\" effect on the {get|set|delete}_image_location policies in the sense that if a pre-Pike deployment has ``show_multiple_locations\u003dFalse``, it is possible to have very permissive policies without locations information being exposed.  Further, pre-Pike Glance *requires* these policies to be permissive in order to perform operations that indirectly require access to image locations.  For example, the normal image-upload workflow, in order to succeed, must allow the user performing the upload to have the set_image_location permission, or else the upload will fail.  Similarly, the image-download operation cannot succeed unless the requestor has the get_image_location permission.  Likewise the normal image-delete operation cannot succeed unless the requestor has the delete_image_location permission.\n\nThus, in pre-Pike Glance, an operator could keep the {get|set|delete}_image_location policies permissive (in fact, completely unrestricted in the default configuration), but the default setting of ``show_multiple_locations\u003dFalse`` would prevent end users from actually seeing the locations.  In Pike, we want to preserve image locations being usable by those Glance operations that need to access them, **and** we want to preserve the behavior of not exposing them to end users unless the operator explicitly chooses to so expose them.","commit_id":"973d9070c6e627db437242db52d4c46fcc2ff03e"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"c74ae5f98efb1561815ac518aa27431da836cfbc","unresolved":false,"context_lines":[{"line_number":52,"context_line":"Glance team needs a definitive way to support exposing the sensitive locations"},{"line_number":53,"context_line":"to the concerned openstack projects wihout affecting the standard deployment"},{"line_number":54,"context_line":"model (which considers in-tree policy setup) for setting up end user public,"},{"line_number":55,"context_line":"private and hybrid clouds. A few more things to note:-"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"* ``show_multiple_locations`` configuration option has been deprecated in"},{"line_number":58,"context_line":"  Newton"}],"source_content_type":"text/x-rst","patch_set":4,"id":"bff0334d_381ba4d0","line":55,"range":{"start_line":55,"start_character":26,"end_line":55,"end_character":27},"in_reply_to":"dfeb2761_2d1ef46f","updated":"2017-04-10 15:20:34.000000000","message":"This is the reason I think we should not do this change at all. Honestly while the current behavior is messy, the transition and behavioral changes are even worse than just stayin in the current state.","commit_id":"973d9070c6e627db437242db52d4c46fcc2ff03e"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"25e07af96741c1fe26c55d1482700b346796f1b5","unresolved":false,"context_lines":[{"line_number":53,"context_line":"to the concerned openstack projects wihout affecting the standard deployment"},{"line_number":54,"context_line":"model (which considers in-tree policy setup) for setting up end user public,"},{"line_number":55,"context_line":"private and hybrid clouds. A few more things to note:-"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"* ``show_multiple_locations`` configuration option has been deprecated in"},{"line_number":58,"context_line":"  Newton"},{"line_number":59,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_0d15704a","line":56,"updated":"2017-04-03 22:15:34.000000000","message":"And then you\u0027re going to need to explain the plan for addressing the above.","commit_id":"973d9070c6e627db437242db52d4c46fcc2ff03e"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"25e07af96741c1fe26c55d1482700b346796f1b5","unresolved":false,"context_lines":[{"line_number":74,"context_line":"  glance source tree including tests, documentation, notes, etc."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"* ``show_multiple_locations`` configuration option will be asked to be removed"},{"line_number":77,"context_line":"  from the devstack gates, devstack feature branches (like one for ceph)"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"* ``policy.json`` file in glance source tree will be modified to set the"},{"line_number":80,"context_line":"  following defaults:-"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_321e5570","line":77,"updated":"2017-04-03 22:15:34.000000000","message":"We probably need a work item to see if this will have an effect on any tempest tests, and if so, put up a patch to modify them.  (Hopefully this isn\u0027t being tested by tempest.)","commit_id":"973d9070c6e627db437242db52d4c46fcc2ff03e"},{"author":{"_account_id":12807,"name":"Steve Lewis (stevelle)","email":"stevelle@gmail.com","username":"stevelle"},"change_message_id":"2ed9fceb6a7b547cd62ec05961611314997794f2","unresolved":false,"context_lines":[{"line_number":81,"context_line":""},{"line_number":82,"context_line":"    - \"get_image_location\": \"role:admin\""},{"line_number":83,"context_line":"    - \"set_image_location\": \"role:admin\""},{"line_number":84,"context_line":"    - \"delete_image_location\": \"role:admin\""},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"* There are numerous instances where image locations are being modified. For"},{"line_number":87,"context_line":"  example, the simplest cases are image-create (upload and activate),"}],"source_content_type":"text/x-rst","patch_set":4,"id":"bff0334d_f4587531","line":84,"updated":"2017-04-11 20:01:22.000000000","message":"I suspect this is too-simple, as noted below. An additional service role may be needed, with the policy allowing either. Keystone is currently working with Nova on breaking down smaller operational role mapping ideas, so probably worth looking at that for ideas too.","commit_id":"973d9070c6e627db437242db52d4c46fcc2ff03e"},{"author":{"_account_id":12807,"name":"Steve Lewis (stevelle)","email":"stevelle@gmail.com","username":"stevelle"},"change_message_id":"2ed9fceb6a7b547cd62ec05961611314997794f2","unresolved":false,"context_lines":[{"line_number":91,"context_line":"  obtained, an attempt to set a location for that image happens. If this"},{"line_number":92,"context_line":"  request was from any non admin role, the image creation would fail due"},{"line_number":93,"context_line":"  to the access restriction for setting an image location for that image"},{"line_number":94,"context_line":"  with the \u0027set_image_locations\u0027 being \"role:admin\"."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"* Notification system may need to be realigned to accomodate locations"},{"line_number":97,"context_line":"  being publicly exposed in those cases for a complete support for indexing and"}],"source_content_type":"text/x-rst","patch_set":4,"id":"bff0334d_b4678de9","line":94,"updated":"2017-04-11 20:01:22.000000000","message":"This absolutely must be accounted for in the solution. A clear and holistic solution is needed to allow the service to indirectly affect those features (say, with a service key granted a service role). Users need to be able to create snapshots, which implies a non-admin role.","commit_id":"973d9070c6e627db437242db52d4c46fcc2ff03e"},{"author":{"_account_id":12807,"name":"Steve Lewis (stevelle)","email":"stevelle@gmail.com","username":"stevelle"},"change_message_id":"2ed9fceb6a7b547cd62ec05961611314997794f2","unresolved":false,"context_lines":[{"line_number":109,"context_line":"* Testing and setting up of scrubber could have been conveniently done before"},{"line_number":110,"context_line":"  by enabling the configuration option. Now, however, we will need to"},{"line_number":111,"context_line":"  explicitly change the policies for the same to be able to successfully get"},{"line_number":112,"context_line":"  and scrub all locations associated with an image."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"* A significant change will be made to refactor the \u0027ImageLocationsProxy\u0027"},{"line_number":115,"context_line":"  class to work with the add, remove, replace operations at the top level"}],"source_content_type":"text/x-rst","patch_set":4,"id":"bff0334d_d43e91bf","line":112,"updated":"2017-04-11 20:01:22.000000000","message":"This absolutely must be accounted for in the solution.","commit_id":"973d9070c6e627db437242db52d4c46fcc2ff03e"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"25e07af96741c1fe26c55d1482700b346796f1b5","unresolved":false,"context_lines":[{"line_number":122,"context_line":""},{"line_number":123,"context_line":"   * Remove the configuration option ``show_multiple_locations`` from glance"},{"line_number":124,"context_line":"     source tree including tests, documentations, notes, etc."},{"line_number":125,"context_line":"   "},{"line_number":126,"context_line":"   * Edit the rules in policy.json to the following:"},{"line_number":127,"context_line":"     "},{"line_number":128,"context_line":"     ::"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_0d29f036","line":125,"updated":"2017-04-03 22:15:34.000000000","message":"The extra whitespace in this section is my fault.  Apologies to the person who puts up the next patch set and has to clean this up.","commit_id":"973d9070c6e627db437242db52d4c46fcc2ff03e"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"25e07af96741c1fe26c55d1482700b346796f1b5","unresolved":false,"context_lines":[{"line_number":161,"context_line":"     **Get**"},{"line_number":162,"context_line":"       Preserving current behavior, the response will NOT include the"},{"line_number":163,"context_line":"       \"locations\" field if there is no ”get_image_locations\" permission. This"},{"line_number":164,"context_line":"       is what was done if \"show_multiple_locations\" was set to False. However,"},{"line_number":165,"context_line":"       with the configuration option, one could choose whether they wanted"},{"line_number":166,"context_line":"       their response to include the locations irrespective of the policy"},{"line_number":167,"context_line":"       rules. We remove the choice and display locations to anybody who has the"},{"line_number":168,"context_line":"       right permission.  This will also preserve the current behaviour of the"},{"line_number":169,"context_line":"       configuration option \"show_image_direct_url\" as it depends on the policy"},{"line_number":170,"context_line":"       rule \"get_image_locations\" too."}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_8d6e2093","line":167,"range":{"start_line":164,"start_character":71,"end_line":167,"end_character":13},"updated":"2017-04-03 22:15:34.000000000","message":"This is a bit unclear.  The with show_multiple_locations\u003dTrue, the old behavior is that you are guaranteed that your Image response will contain a \u0027locations\u0027 field, but it will be an empty list if you don\u0027t have permissions to get_locations, so even though you have \u0027locations\u0027, the response doesn\u0027t actually include the locations.  So the policy rules actually were respected.","commit_id":"973d9070c6e627db437242db52d4c46fcc2ff03e"}]}