)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"f56f27b1bcaf69e923a37b15803af0428c2ed803","unresolved":true,"context_lines":[{"line_number":13,"context_line":"in commit 9dfb500d5 :"},{"line_number":14,"context_line":"   https://github.com/openstack/cinder/commit/"},{"line_number":15,"context_line":"     9dfb500d5bb4fb6523731d7053a0424280d11da2"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Affected policies:"},{"line_number":18,"context_line":"- fetch_image_location: service-only (no change)"},{"line_number":19,"context_line":"- add_image_location: admins must now be image owner"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"577ba388_6099b09e","line":16,"updated":"2026-09-10 07:26:16.000000000","message":"Have you confirmed nova also passes service user to glance? IF not then we can not remove until nova supports it. IF yes then mention about nova change as well.","commit_id":"ae06c156bac0859128fb26fd576ed45d69aae884"},{"author":{"_account_id":34510,"name":"Maxim Sava","email":"msava@redhat.com","username":"msava@redhat.com"},"change_message_id":"efd0d912b1b87d74836232a0418c64b842aa87ed","unresolved":true,"context_lines":[{"line_number":13,"context_line":"in commit 9dfb500d5 :"},{"line_number":14,"context_line":"   https://github.com/openstack/cinder/commit/"},{"line_number":15,"context_line":"     9dfb500d5bb4fb6523731d7053a0424280d11da2"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Affected policies:"},{"line_number":18,"context_line":"- fetch_image_location: service-only (no change)"},{"line_number":19,"context_line":"- add_image_location: admins must now be image owner"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"8586f260_07dd15e2","line":16,"in_reply_to":"577ba388_6099b09e","updated":"2026-09-10 09:46:10.000000000","message":"I updated commit message with nova service user support","commit_id":"ae06c156bac0859128fb26fd576ed45d69aae884"},{"author":{"_account_id":34510,"name":"Maxim Sava","email":"msava@redhat.com","username":"msava@redhat.com"},"change_message_id":"efd0d912b1b87d74836232a0418c64b842aa87ed","unresolved":true,"context_lines":[{"line_number":13,"context_line":"in commit 9dfb500d5 :"},{"line_number":14,"context_line":"   https://github.com/openstack/cinder/commit/"},{"line_number":15,"context_line":"     9dfb500d5bb4fb6523731d7053a0424280d11da2"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Affected policies:"},{"line_number":18,"context_line":"- fetch_image_location: service-only (no change)"},{"line_number":19,"context_line":"- add_image_location: admins must now be image owner"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"a259fc4c_4fc3aa76","line":16,"in_reply_to":"577ba388_6099b09e","updated":"2026-09-10 09:46:10.000000000","message":"UpdatedgC","commit_id":"ae06c156bac0859128fb26fd576ed45d69aae884"},{"author":{"_account_id":34510,"name":"Maxim Sava","email":"msava@redhat.com","username":"msava@redhat.com"},"change_message_id":"d16af3363880e84234efd5be85c1a860bf5afb61","unresolved":false,"context_lines":[{"line_number":13,"context_line":"in commit 9dfb500d5 :"},{"line_number":14,"context_line":"   https://github.com/openstack/cinder/commit/"},{"line_number":15,"context_line":"     9dfb500d5bb4fb6523731d7053a0424280d11da2"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Affected policies:"},{"line_number":18,"context_line":"- fetch_image_location: service-only (no change)"},{"line_number":19,"context_line":"- add_image_location: admins must now be image owner"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"02830a53_135875c4","line":16,"in_reply_to":"a259fc4c_4fc3aa76","updated":"2026-09-17 11:03:46.000000000","message":"Done","commit_id":"ae06c156bac0859128fb26fd576ed45d69aae884"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"df7aaaad55d00fd4d887bb1287e79419497818d4","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"c4587f02_d006ae9f","updated":"2026-09-10 11:45:53.000000000","message":"Not sure whether we need to follow the process or not on this. Adding -11 till then, you can bring this for discussion in weekly meeting.","commit_id":"11378ec387ab73bb91061e0ca1215c2966300412"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"e0bd9c835cfeb291b46f24bb160960727291fae8","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"4e524bb8_b4f6f518","updated":"2026-10-26 07:31:43.000000000","message":"As per the discussion with this patch I tried testing the add_location api by admin, so for the image owned by another project, the policy rejected the admin with 403 and for admin\u0027s own project, the policy was passed because the admin user also has the member role and that project owns the image. \n\n\n@msava@redhat.com adding a release note would be helpful here.\nAlso the test updates only cover get location, and that admin case returns 404 because the test hides the image from admin. I think there should also be a check that an admin cannot add a location to another project\u0027s image, while a member of the owning project still can.","commit_id":"209d3a3c3b5a68294aa26043fd9ee4643afdb4d0"},{"author":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"change_message_id":"9e281f4f3b9133955fc0e8c327d6566006b0c378","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"a80d1567_c21a4537","updated":"2026-09-22 18:29:33.000000000","message":"Just a question about whether or not it\u0027s deprecated.","commit_id":"209d3a3c3b5a68294aa26043fd9ee4643afdb4d0"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"9588db5ea208a16a71a4e5a1483f852362bcc650","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"8eb561a4_8b49a2f3","updated":"2026-09-21 06:07:20.000000000","message":"recheck","commit_id":"209d3a3c3b5a68294aa26043fd9ee4643afdb4d0"}],"glance/policies/base.py":[{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"df7aaaad55d00fd4d887bb1287e79419497818d4","unresolved":true,"context_lines":[{"line_number":113,"context_line":"    policy.RuleDefault(name\u003d\u0027context_is_admin\u0027, check_str\u003d\u0027role:admin\u0027,"},{"line_number":114,"context_line":"                       description\u003d\u0027Defines the rule for the is_admin:True \u0027"},{"line_number":115,"context_line":"                                   \u0027check.\u0027),"},{"line_number":116,"context_line":"    policy.RuleDefault(name\u003d\u0027service_api\u0027,"},{"line_number":117,"context_line":"                       check_str\u003d\u0027role:service\u0027,"},{"line_number":118,"context_line":"                       description\u003d\u0027Default rule for the service-to-service \u0027"},{"line_number":119,"context_line":"                       \u0027API.\u0027),"},{"line_number":120,"context_line":"]"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"f248f812_eb0fa03a","line":119,"range":{"start_line":116,"start_character":0,"end_line":119,"end_character":31},"updated":"2026-09-10 11:45:53.000000000","message":"I think we need to follow policy.DeprecatedRule process like it is done at line 96","commit_id":"11378ec387ab73bb91061e0ca1215c2966300412"},{"author":{"_account_id":34510,"name":"Maxim Sava","email":"msava@redhat.com","username":"msava@redhat.com"},"change_message_id":"e6d0e04488b8afbe7d331a363bf738bc29ae97ab","unresolved":false,"context_lines":[{"line_number":113,"context_line":"    policy.RuleDefault(name\u003d\u0027context_is_admin\u0027, check_str\u003d\u0027role:admin\u0027,"},{"line_number":114,"context_line":"                       description\u003d\u0027Defines the rule for the is_admin:True \u0027"},{"line_number":115,"context_line":"                                   \u0027check.\u0027),"},{"line_number":116,"context_line":"    policy.RuleDefault(name\u003d\u0027service_api\u0027,"},{"line_number":117,"context_line":"                       check_str\u003d\u0027role:service\u0027,"},{"line_number":118,"context_line":"                       description\u003d\u0027Default rule for the service-to-service \u0027"},{"line_number":119,"context_line":"                       \u0027API.\u0027),"},{"line_number":120,"context_line":"]"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"4aae29c8_efce8abb","line":119,"range":{"start_line":116,"start_character":0,"end_line":119,"end_character":31},"in_reply_to":"f248f812_eb0fa03a","updated":"2026-09-14 15:00:15.000000000","message":"Updated","commit_id":"11378ec387ab73bb91061e0ca1215c2966300412"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"bcb97053ac0e1a3324607f0d946e2dbd5f54cd07","unresolved":true,"context_lines":[{"line_number":119,"context_line":"                       \u0027API.\u0027,"},{"line_number":120,"context_line":"                       deprecated_rule\u003dpolicy.DeprecatedRule("},{"line_number":121,"context_line":"                           name\u003d\u0027service_api\u0027,"},{"line_number":122,"context_line":"                           check_str\u003d\u0027role:admin\u0027,"},{"line_number":123,"context_line":"                           deprecated_reason\u003d\u0027The admin role access is added \u0027"},{"line_number":124,"context_line":"                           \u0027for backward compatibility because some services \u0027"},{"line_number":125,"context_line":"                           \u0027do not send the service role token to Glance. \u0027"}],"source_content_type":"text/x-python","patch_set":5,"id":"de8c602b_324fb700","line":122,"range":{"start_line":122,"start_character":27,"end_line":122,"end_character":50},"updated":"2026-09-15 06:50:41.000000000","message":"here old policy rule should be same `role:service or role:admin`","commit_id":"4cd20183d14bbf885905ee9bd1bbf22e7e49d16c"},{"author":{"_account_id":34510,"name":"Maxim Sava","email":"msava@redhat.com","username":"msava@redhat.com"},"change_message_id":"d16af3363880e84234efd5be85c1a860bf5afb61","unresolved":false,"context_lines":[{"line_number":119,"context_line":"                       \u0027API.\u0027,"},{"line_number":120,"context_line":"                       deprecated_rule\u003dpolicy.DeprecatedRule("},{"line_number":121,"context_line":"                           name\u003d\u0027service_api\u0027,"},{"line_number":122,"context_line":"                           check_str\u003d\u0027role:admin\u0027,"},{"line_number":123,"context_line":"                           deprecated_reason\u003d\u0027The admin role access is added \u0027"},{"line_number":124,"context_line":"                           \u0027for backward compatibility because some services \u0027"},{"line_number":125,"context_line":"                           \u0027do not send the service role token to Glance. \u0027"}],"source_content_type":"text/x-python","patch_set":5,"id":"eb7e91cd_f511ce66","line":122,"range":{"start_line":122,"start_character":27,"end_line":122,"end_character":50},"in_reply_to":"de8c602b_324fb700","updated":"2026-09-17 11:03:46.000000000","message":"Done","commit_id":"4cd20183d14bbf885905ee9bd1bbf22e7e49d16c"},{"author":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"change_message_id":"9e281f4f3b9133955fc0e8c327d6566006b0c378","unresolved":true,"context_lines":[{"line_number":125,"context_line":"                           \u0027do not send the service role token to Glance. \u0027"},{"line_number":126,"context_line":"                           \u0027Cinder and Nova use the Glance service user to \u0027"},{"line_number":127,"context_line":"                           \u0027access Glance, so the admin role is not required\u0027,"},{"line_number":128,"context_line":"                           deprecated_since\u003d\u0027Mitaka\u0027)),"},{"line_number":129,"context_line":"]"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"a884a846_afa96fb7","line":128,"range":{"start_line":128,"start_character":27,"end_line":128,"end_character":43},"updated":"2026-09-22 18:29:33.000000000","message":"Is this rule truly deprecated? Do we expect to remove it at some point? Or should we just keep it, with \"role:service\" as the default?","commit_id":"209d3a3c3b5a68294aa26043fd9ee4643afdb4d0"},{"author":{"_account_id":34510,"name":"Maxim Sava","email":"msava@redhat.com","username":"msava@redhat.com"},"change_message_id":"53f39b6a40ee97e101f2bbf2e335a328b67584ca","unresolved":false,"context_lines":[{"line_number":125,"context_line":"                           \u0027do not send the service role token to Glance. \u0027"},{"line_number":126,"context_line":"                           \u0027Cinder and Nova use the Glance service user to \u0027"},{"line_number":127,"context_line":"                           \u0027access Glance, so the admin role is not required\u0027,"},{"line_number":128,"context_line":"                           deprecated_since\u003d\u0027Mitaka\u0027)),"},{"line_number":129,"context_line":"]"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"23d22e13_0ec6fec1","line":128,"range":{"start_line":128,"start_character":27,"end_line":128,"end_character":43},"in_reply_to":"4ff85a3f_4bce114d","updated":"2026-10-26 19:21:43.000000000","message":"Done","commit_id":"209d3a3c3b5a68294aa26043fd9ee4643afdb4d0"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"e0bd9c835cfeb291b46f24bb160960727291fae8","unresolved":true,"context_lines":[{"line_number":125,"context_line":"                           \u0027do not send the service role token to Glance. \u0027"},{"line_number":126,"context_line":"                           \u0027Cinder and Nova use the Glance service user to \u0027"},{"line_number":127,"context_line":"                           \u0027access Glance, so the admin role is not required\u0027,"},{"line_number":128,"context_line":"                           deprecated_since\u003d\u0027Mitaka\u0027)),"},{"line_number":129,"context_line":"]"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"4ff85a3f_4bce114d","line":128,"range":{"start_line":128,"start_character":27,"end_line":128,"end_character":43},"in_reply_to":"565c1139_716b772b","updated":"2026-10-26 07:31:43.000000000","message":"The service_api rule is not going away. We are only changing its default from \"role:service or role:admin\" to \"role:service\".\n\nDeprecatedRule just records the old check, so deployments with enforce_new_defaults\u003dfalse keep working. @msava@redhat.com Please set deprecated_since to 2026.2 or 2027.1 instead of Mitaka.","commit_id":"209d3a3c3b5a68294aa26043fd9ee4643afdb4d0"},{"author":{"_account_id":34510,"name":"Maxim Sava","email":"msava@redhat.com","username":"msava@redhat.com"},"change_message_id":"355b2408e8a4cb66d3e3d7c880e6e2d52a951bea","unresolved":true,"context_lines":[{"line_number":125,"context_line":"                           \u0027do not send the service role token to Glance. \u0027"},{"line_number":126,"context_line":"                           \u0027Cinder and Nova use the Glance service user to \u0027"},{"line_number":127,"context_line":"                           \u0027access Glance, so the admin role is not required\u0027,"},{"line_number":128,"context_line":"                           deprecated_since\u003d\u0027Mitaka\u0027)),"},{"line_number":129,"context_line":"]"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"565c1139_716b772b","line":128,"range":{"start_line":128,"start_character":27,"end_line":128,"end_character":43},"in_reply_to":"a884a846_afa96fb7","updated":"2026-09-30 08:24:58.000000000","message":"Yes deprecated.\n1.The `deprecated_since` value is incorrect should be 2026.2 or 2027.1\n2.The deprecated_rule shows the COMPLETE old value (\u0027role:service or role:admin\u0027),\nnot just the removed part (\u0027role:admin\u0027). This is how the deprecation system\nworks - it needs to match the full old rule to detect operator overrides and\nhow proper migration warnings.It was a bit confusing to me at first as well. ))\nWould keeping service_api go against the original TODO intent to remove admin access?","commit_id":"209d3a3c3b5a68294aa26043fd9ee4643afdb4d0"}]}