)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"87be70bb25236711344c20e028a89d1029ba0a96","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"8da82cb7_a019a7c8","updated":"2026-10-19 20:27:55.000000000","message":"Doug helped me in IRC, I understand now am I\u0027m OK with the implementation except for the change of arg I\u0027m asking for\n\nIdeally we\u0027d also add some of the yaml data-based tests to validate that runbooks operate as expected now. If you don\u0027t add that here, or in a follow-up, please at least file it as a bug so it can be followed-up on.","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"},{"author":{"_account_id":36770,"name":"cid","display_name":"cid","email":"cid@gr-oss.io","username":"cidelight","status":"@gr-oss upstream: Doing good IRONIC things..."},"change_message_id":"0f01f8ed8a3dd3e0da89ddbe2be9bb6bc3f6543f","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"3024ca53_a2fb17a0","updated":"2026-10-20 13:19:39.000000000","message":"Since this is getting another revision, let\u0027s add some RBAC YAML test as part of this change.","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"},{"author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"change_message_id":"01fa724abe4f960ea77828b71d1001d6e4d96cad","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"65657d9e_6d5af05f","in_reply_to":"3024ca53_a2fb17a0","updated":"2026-10-28 14:48:25.000000000","message":"Done","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"},{"author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"change_message_id":"01fa724abe4f960ea77828b71d1001d6e4d96cad","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"f95d6b82_f7675836","in_reply_to":"8da82cb7_a019a7c8","updated":"2026-10-28 14:48:25.000000000","message":"Done","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"71a99897016ccfa2eef38a05b4b4b3402742b9ce","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"30051c9e_c9922606","updated":"2026-10-28 21:33:56.000000000","message":"Okay, I had to dig into this, we do actually apply the policies. The oddity here is more framing and just how complex that surface has become. Anyway, my grumpiness regarding policy descriptions is not a blocker.","commit_id":"f7709e32a0e86312d5c27b8855f3ce392516d9e7"}],"ironic/api/controllers/v1/node.py":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"9799f8627e5c4671842dc266f19aa32d4c5c42d5","unresolved":true,"context_lines":[{"line_number":1299,"context_line":"        api_utils.check_allow_configdrive(target, configdrive)"},{"line_number":1300,"context_line":""},{"line_number":1301,"context_line":"        if runbook:"},{"line_number":1302,"context_line":"            clean_steps, service_steps, disable_ramdisk \u003d self._handle_runbook("},{"line_number":1303,"context_line":"                rpc_node, target, runbook, clean_steps, service_steps"},{"line_number":1304,"context_line":"            )"},{"line_number":1305,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"c6245743_69b51737","line":1302,"updated":"2026-10-19 20:19:17.000000000","message":"This is a case where it seems like public should be false, but it\u0027s going to be true. We shouldn\u0027t let the runbook be used for provisioning unless it\u0027s either: public OR rb.owner\u003dnode.owner -- I think we\u0027re losing that check here?","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"},{"author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"change_message_id":"01fa724abe4f960ea77828b71d1001d6e4d96cad","unresolved":false,"context_lines":[{"line_number":1299,"context_line":"        api_utils.check_allow_configdrive(target, configdrive)"},{"line_number":1300,"context_line":""},{"line_number":1301,"context_line":"        if runbook:"},{"line_number":1302,"context_line":"            clean_steps, service_steps, disable_ramdisk \u003d self._handle_runbook("},{"line_number":1303,"context_line":"                rpc_node, target, runbook, clean_steps, service_steps"},{"line_number":1304,"context_line":"            )"},{"line_number":1305,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"ef33b715_8e45107f","line":1302,"in_reply_to":"5110890d_7e598d91","updated":"2026-10-28 14:48:25.000000000","message":"Done","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"},{"author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"change_message_id":"a3bdf3ee40e1df895d0ca3261e697530a77823f0","unresolved":true,"context_lines":[{"line_number":1299,"context_line":"        api_utils.check_allow_configdrive(target, configdrive)"},{"line_number":1300,"context_line":""},{"line_number":1301,"context_line":"        if runbook:"},{"line_number":1302,"context_line":"            clean_steps, service_steps, disable_ramdisk \u003d self._handle_runbook("},{"line_number":1303,"context_line":"                rpc_node, target, runbook, clean_steps, service_steps"},{"line_number":1304,"context_line":"            )"},{"line_number":1305,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"5110890d_7e598d91","line":1302,"in_reply_to":"bb6c4169_d1764361","updated":"2026-10-28 14:47:56.000000000","message":"There\u0027s another policy check much higher up that\u0027s checking the current person running this is","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"},{"author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"change_message_id":"6dec91364be6d480a3b8cc54d21143d2e7ada70e","unresolved":true,"context_lines":[{"line_number":1299,"context_line":"        api_utils.check_allow_configdrive(target, configdrive)"},{"line_number":1300,"context_line":""},{"line_number":1301,"context_line":"        if runbook:"},{"line_number":1302,"context_line":"            clean_steps, service_steps, disable_ramdisk \u003d self._handle_runbook("},{"line_number":1303,"context_line":"                rpc_node, target, runbook, clean_steps, service_steps"},{"line_number":1304,"context_line":"            )"},{"line_number":1305,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"bb6c4169_d1764361","line":1302,"in_reply_to":"c6245743_69b51737","updated":"2026-10-19 20:21:32.000000000","message":"We\u0027ve never had that check. The check has been rb.owner only.","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"}],"ironic/api/controllers/v1/runbook.py":[{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"34c8f7a989c666f56fd40ca245437c78500e3d12","unresolved":true,"context_lines":[{"line_number":207,"context_line":"        \"\"\"List runbook traits.\"\"\""},{"line_number":208,"context_line":"        rpc_runbook \u003d api_utils.check_runbook_policy_and_retrieve("},{"line_number":209,"context_line":"            \u0027baremetal:runbook:get\u0027, self.runbook_ident,"},{"line_number":210,"context_line":"            public_runbook_ok\u003dTrue)"},{"line_number":211,"context_line":"        return {\u0027traits\u0027: rpc_runbook.traits}"},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"    @METRICS.timer(\u0027RunbookTraitsController.put\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"2fa2a55b_61a98e01","line":210,"updated":"2026-10-28 21:10:47.000000000","message":"So, basically, here is my problem with this. We\u0027re applying baremetal:runbook:get here, when the actual front-line policy should be baremetal:runbook:list or baremetal:runboo:list_all. In the rbac patterning elsewhere, we do a two step graduated check to determine if entries are visible or not. That got copy-pasta\u0027ed it appears.\n\nAs a note, nowhere hear we\u0027re applying baremetal:runbook:list or baremetal:runbook:list_all.","commit_id":"f7709e32a0e86312d5c27b8855f3ce392516d9e7"}],"ironic/api/controllers/v1/utils.py":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"87be70bb25236711344c20e028a89d1029ba0a96","unresolved":true,"context_lines":[{"line_number":730,"context_line":""},{"line_number":731,"context_line":""},{"line_number":732,"context_line":"def check_runbook_policy_and_retrieve(policy_name, runbook_ident,"},{"line_number":733,"context_line":"                                      public\u003dFalse):"},{"line_number":734,"context_line":"    \"\"\"Check if the specified policy authorizes this request on a node."},{"line_number":735,"context_line":""},{"line_number":736,"context_line":"    :param: policy_name: Name of the policy to check."}],"source_content_type":"text/x-python","patch_set":1,"id":"171f15fb_937fb80a","line":733,"updated":"2026-10-19 20:27:55.000000000","message":"In order to prevent other folks from being as far confused as I was, can we make this \"public_runbook_ok\" or something else, to indicate we\u0027re saying \"the caller of this method is OK with a public runbook passing the check\" vs \"the runbook itself is public\"","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"},{"author":{"_account_id":36770,"name":"cid","display_name":"cid","email":"cid@gr-oss.io","username":"cidelight","status":"@gr-oss upstream: Doing good IRONIC things..."},"change_message_id":"0f01f8ed8a3dd3e0da89ddbe2be9bb6bc3f6543f","unresolved":true,"context_lines":[{"line_number":742,"context_line":"    :return: a runbook object"},{"line_number":743,"context_line":"    \"\"\""},{"line_number":744,"context_line":"    rpc_runbook \u003d get_rpc_runbook(runbook_ident)"},{"line_number":745,"context_line":"    if public and rpc_runbook.public:"},{"line_number":746,"context_line":"        return rpc_runbook"},{"line_number":747,"context_line":"    check_owner_policy(object_type\u003d\u0027runbook\u0027, policy_name\u003dpolicy_name,"},{"line_number":748,"context_line":"                       owner\u003drpc_runbook[\u0027owner\u0027])"}],"source_content_type":"text/x-python","patch_set":1,"id":"c1271dda_870bc027","line":745,"range":{"start_line":745,"start_character":0,"end_line":745,"end_character":37},"updated":"2026-10-20 13:19:39.000000000","message":"Whatever an operator sets for `baremetal:runbook:get` / `baremetal:runbook:use` in policy.yaml can\u0027t restrict who reads or uses public runbooks. That\u0027s a valid choice, just want to make sure it\u0027s deliberate.","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"f064c4a30925c94e791f44455b10e2be82ac9548","unresolved":true,"context_lines":[{"line_number":742,"context_line":"    :return: a runbook object"},{"line_number":743,"context_line":"    \"\"\""},{"line_number":744,"context_line":"    rpc_runbook \u003d get_rpc_runbook(runbook_ident)"},{"line_number":745,"context_line":"    if public and rpc_runbook.public:"},{"line_number":746,"context_line":"        return rpc_runbook"},{"line_number":747,"context_line":"    check_owner_policy(object_type\u003d\u0027runbook\u0027, policy_name\u003dpolicy_name,"},{"line_number":748,"context_line":"                       owner\u003drpc_runbook[\u0027owner\u0027])"}],"source_content_type":"text/x-python","patch_set":1,"id":"95156778_634107ef","line":745,"range":{"start_line":745,"start_character":0,"end_line":745,"end_character":37},"in_reply_to":"c1271dda_870bc027","updated":"2026-10-28 13:47:19.000000000","message":"As someone who had their hands in RBAC, I would minimally expect we have a fallback policy rule which can be customized as opposed to wide open \"public\". \n\nThat just seems like the wrong approach because then we\u0027re giving the \"public\" list to anyone who has authenticated but not even determined to have a generalized reader role.  It sort of creates a weird inconsistency in the model.\n\nI guess i\u0027d execute a secondary policy check here, or in the caller to at least see if the user had *any* reader role.","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"},{"author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"change_message_id":"a3bdf3ee40e1df895d0ca3261e697530a77823f0","unresolved":true,"context_lines":[{"line_number":742,"context_line":"    :return: a runbook object"},{"line_number":743,"context_line":"    \"\"\""},{"line_number":744,"context_line":"    rpc_runbook \u003d get_rpc_runbook(runbook_ident)"},{"line_number":745,"context_line":"    if public and rpc_runbook.public:"},{"line_number":746,"context_line":"        return rpc_runbook"},{"line_number":747,"context_line":"    check_owner_policy(object_type\u003d\u0027runbook\u0027, policy_name\u003dpolicy_name,"},{"line_number":748,"context_line":"                       owner\u003drpc_runbook[\u0027owner\u0027])"}],"source_content_type":"text/x-python","patch_set":1,"id":"c16db2b3_ea708277","line":745,"range":{"start_line":745,"start_character":0,"end_line":745,"end_character":37},"in_reply_to":"c1271dda_870bc027","updated":"2026-10-28 14:47:56.000000000","message":"I think it is.","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"5edd0171092abe0d0cfdf0b7ff4bcd46dd7205f4","unresolved":true,"context_lines":[{"line_number":743,"context_line":"    \"\"\""},{"line_number":744,"context_line":"    rpc_runbook \u003d get_rpc_runbook(runbook_ident)"},{"line_number":745,"context_line":"    if public and rpc_runbook.public:"},{"line_number":746,"context_line":"        return rpc_runbook"},{"line_number":747,"context_line":"    check_owner_policy(object_type\u003d\u0027runbook\u0027, policy_name\u003dpolicy_name,"},{"line_number":748,"context_line":"                       owner\u003drpc_runbook[\u0027owner\u0027])"},{"line_number":749,"context_line":"    return rpc_runbook"}],"source_content_type":"text/x-python","patch_set":1,"id":"c6d6b270_33ed6f04","line":746,"updated":"2026-10-14 18:15:44.000000000","message":"I\u0027m confused as to why we\u0027re passing in a `public` and not just keying on rpc_runbook.public?","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"},{"author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"change_message_id":"72fbd738f1a4152393cfe23060da858388104cf6","unresolved":true,"context_lines":[{"line_number":743,"context_line":"    \"\"\""},{"line_number":744,"context_line":"    rpc_runbook \u003d get_rpc_runbook(runbook_ident)"},{"line_number":745,"context_line":"    if public and rpc_runbook.public:"},{"line_number":746,"context_line":"        return rpc_runbook"},{"line_number":747,"context_line":"    check_owner_policy(object_type\u003d\u0027runbook\u0027, policy_name\u003dpolicy_name,"},{"line_number":748,"context_line":"                       owner\u003drpc_runbook[\u0027owner\u0027])"},{"line_number":749,"context_line":"    return rpc_runbook"}],"source_content_type":"text/x-python","patch_set":1,"id":"890b9e3b_5bea3bbf","line":746,"in_reply_to":"c6d6b270_33ed6f04","updated":"2026-10-14 23:10:56.000000000","message":"Because a handful of places only want a runbook that passes the OWNER check and there\u0027s other places that we caught the forbidden exception and then checked if it was public using another `get_rpc_runbook(runbook_ident)` call and then returned it. This change saves the extra call and is cleaner.\n\nIt also fixes the place that we were suppose to catch the forbidden exception and look the runbook up again and use it if it was public return the runbook and someone forgot to do that.\n\nSo it\u0027s more defensive to have that clearly defined in a function like this.","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"},{"author":{"_account_id":36770,"name":"cid","display_name":"cid","email":"cid@gr-oss.io","username":"cidelight","status":"@gr-oss upstream: Doing good IRONIC things..."},"change_message_id":"0f01f8ed8a3dd3e0da89ddbe2be9bb6bc3f6543f","unresolved":true,"context_lines":[{"line_number":1782,"context_line":"            raise"},{"line_number":1783,"context_line":""},{"line_number":1784,"context_line":""},{"line_number":1785,"context_line":"def check_and_retrieve_public_runbook(runbook_ident):"},{"line_number":1786,"context_line":"    \"\"\"If policy authorization check fails, check if runbook is public."},{"line_number":1787,"context_line":""},{"line_number":1788,"context_line":"    :param: runbook_ident: the UUID or logical name of a runbook."}],"source_content_type":"text/x-python","patch_set":1,"id":"b3bce616_595f335a","line":1785,"range":{"start_line":1785,"start_character":0,"end_line":1785,"end_character":53},"updated":"2026-10-20 13:19:39.000000000","message":"This looks unused now.","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"34c8f7a989c666f56fd40ca245437c78500e3d12","unresolved":true,"context_lines":[{"line_number":1782,"context_line":"            raise"},{"line_number":1783,"context_line":""},{"line_number":1784,"context_line":""},{"line_number":1785,"context_line":"def check_and_retrieve_public_runbook(runbook_ident):"},{"line_number":1786,"context_line":"    \"\"\"If policy authorization check fails, check if runbook is public."},{"line_number":1787,"context_line":""},{"line_number":1788,"context_line":"    :param: runbook_ident: the UUID or logical name of a runbook."}],"source_content_type":"text/x-python","patch_set":1,"id":"2a39bb4a_aae25d07","line":1785,"range":{"start_line":1785,"start_character":0,"end_line":1785,"end_character":53},"in_reply_to":"b3bce616_595f335a","updated":"2026-10-28 21:10:47.000000000","message":"Yeah, indeed, it is no logner used now.","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"34c8f7a989c666f56fd40ca245437c78500e3d12","unresolved":true,"context_lines":[{"line_number":744,"context_line":"    \"\"\""},{"line_number":745,"context_line":"    rpc_runbook \u003d get_rpc_runbook(runbook_ident)"},{"line_number":746,"context_line":"    if public_runbook_ok and rpc_runbook.public:"},{"line_number":747,"context_line":"        return rpc_runbook"},{"line_number":748,"context_line":"    check_owner_policy(object_type\u003d\u0027runbook\u0027, policy_name\u003dpolicy_name,"},{"line_number":749,"context_line":"                       owner\u003drpc_runbook[\u0027owner\u0027])"},{"line_number":750,"context_line":"    return rpc_runbook"}],"source_content_type":"text/x-python","patch_set":2,"id":"94b4cfdb_2e1fcee3","line":747,"updated":"2026-10-28 21:10:47.000000000","message":"So I get why this is, but we should still be leveraging baremetal:runbook:list and if the runbook is public.","commit_id":"f7709e32a0e86312d5c27b8855f3ce392516d9e7"}],"releasenotes/notes/runbook-public-access-policy-3b7c1d9e5a2f4c68.yaml":[{"author":{"_account_id":36770,"name":"cid","display_name":"cid","email":"cid@gr-oss.io","username":"cidelight","status":"@gr-oss upstream: Doing good IRONIC things..."},"change_message_id":"0f01f8ed8a3dd3e0da89ddbe2be9bb6bc3f6543f","unresolved":true,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"fixes:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Fixes an issue where public runbooks could only be retrieved by their"},{"line_number":5,"context_line":"    owner. Any user can now retrieve a public runbook and its traits, and"},{"line_number":6,"context_line":"    use it when requesting a node ``clean`` or ``service`` provision state"},{"line_number":7,"context_line":"    change, regardless of the ``baremetal:runbook:get`` and"},{"line_number":8,"context_line":"    ``baremetal:runbook:use`` policies. Operations that modify a runbook,"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"2b602da7_8a06425b","line":5,"range":{"start_line":4,"start_character":4,"end_line":5,"end_character":53},"updated":"2026-10-20 13:19:39.000000000","message":"I tried before/after, and GET on a public runbook already worked for other projects (via the old fallback). Only traits GET and using it for clean/service failed, as in the bug. Could the note and commit message say that instead of \"could only be retrieved by their owner\"?","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"},{"author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"change_message_id":"01fa724abe4f960ea77828b71d1001d6e4d96cad","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"fixes:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Fixes an issue where public runbooks could only be retrieved by their"},{"line_number":5,"context_line":"    owner. Any user can now retrieve a public runbook and its traits, and"},{"line_number":6,"context_line":"    use it when requesting a node ``clean`` or ``service`` provision state"},{"line_number":7,"context_line":"    change, regardless of the ``baremetal:runbook:get`` and"},{"line_number":8,"context_line":"    ``baremetal:runbook:use`` policies. Operations that modify a runbook,"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"91c4aea7_60023e0f","line":5,"range":{"start_line":4,"start_character":4,"end_line":5,"end_character":53},"in_reply_to":"2b602da7_8a06425b","updated":"2026-10-28 14:48:25.000000000","message":"Done","commit_id":"72d7cd8cb91a074ef3aaff652615c011fd2a16f4"}]}