)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":12356,"name":"Vladyslav Drok","email":"vdrok@mirantis.com","username":"vdrok"},"change_message_id":"17dde39675152d3145f62028ac9756f83c9f4d9e","unresolved":false,"context_lines":[{"line_number":10,"context_line":"operations like (create provisioning/cleaning ports, unbind port,"},{"line_number":11,"context_line":"update mac_address). Previously only admins were able to use ironic,"},{"line_number":12,"context_line":"with keystone policy implementation it is possible that baremetal"},{"line_number":13,"context_line":"admin doesn\u0027t have enough rights (admin rights) in Neutron with leads"},{"line_number":14,"context_line":"to neutron operations failures."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"This patch ensures that we do not pass user token to neutron client,"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"5a3905b3_53ac9c8c","line":13,"range":{"start_line":13,"start_character":59,"end_line":13,"end_character":63},"updated":"2017-01-24 18:11:03.000000000","message":"which","commit_id":"7bfd88aa37d414d437dae9125a91bbc036eff059"}],"ironic/drivers/modules/network/neutron.py":[{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"28d88136cf4047c79b9a4692270ab6446ba8f6b4","unresolved":false,"context_lines":[{"line_number":162,"context_line":""},{"line_number":163,"context_line":"        portmap \u003d neutron.get_node_portmap(task)"},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"        client \u003d neutron.get_client()"},{"line_number":166,"context_line":"        pobj_without_vif \u003d 0"},{"line_number":167,"context_line":"        for port_like_obj in ports + portgroups:"},{"line_number":168,"context_line":"            vif_port_id \u003d ("}],"source_content_type":"text/x-python","patch_set":2,"id":"5a3905b3_c28326cb","line":165,"updated":"2017-01-19 18:41:00.000000000","message":"Slightly theoretical conundrum.\n\nIf we add tenant level access to control nodes in ironic at some point and/or ironic is somehow compromised, access or data wise, by using admin for everything, don\u0027t we risk the ability to allow a potentially unauthorized port attachment?","commit_id":"7bfd88aa37d414d437dae9125a91bbc036eff059"},{"author":{"_account_id":14525,"name":"Vasyl Saienko","email":"vsaienko@mirantis.com","username":"vsaienko"},"change_message_id":"6c508f6b371f1b3779dbd87aceeac59494d5a187","unresolved":false,"context_lines":[{"line_number":162,"context_line":""},{"line_number":163,"context_line":"        portmap \u003d neutron.get_node_portmap(task)"},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"        client \u003d neutron.get_client()"},{"line_number":166,"context_line":"        pobj_without_vif \u003d 0"},{"line_number":167,"context_line":"        for port_like_obj in ports + portgroups:"},{"line_number":168,"context_line":"            vif_port_id \u003d ("}],"source_content_type":"text/x-python","patch_set":2,"id":"5a3905b3_e872bc7b","line":165,"in_reply_to":"5a3905b3_c28326cb","updated":"2017-01-19 21:09:51.000000000","message":"There are certain number of Neutron port fields that  may be updated only by admin like binding_profile [0]. Allowing even port owner set them may lead to big security issues in the cloud.\n\nFor example even port owner shouldn\u0027t have access to binding_profile, since user may set spoof local_link_information and plug another\u0027s user  server to his network.\n\n[0] https://github.com/openstack/neutron/blob/49d614895f44c44f9e1735210498facf1886c404/etc/policy.json#L78","commit_id":"7bfd88aa37d414d437dae9125a91bbc036eff059"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"025507ae7eee3a98d6f6f07ed9c58c2475ea1bdc","unresolved":false,"context_lines":[{"line_number":162,"context_line":""},{"line_number":163,"context_line":"        portmap \u003d neutron.get_node_portmap(task)"},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"        client \u003d neutron.get_client()"},{"line_number":166,"context_line":"        pobj_without_vif \u003d 0"},{"line_number":167,"context_line":"        for port_like_obj in ports + portgroups:"},{"line_number":168,"context_line":"            vif_port_id \u003d ("}],"source_content_type":"text/x-python","patch_set":2,"id":"5a3905b3_fa839e00","line":165,"in_reply_to":"5a3905b3_e872bc7b","updated":"2017-01-24 16:54:01.000000000","message":"Lovely.  I guess this is something that we are going to need to keep in mind as we move forward, specifically becoming more tenant aware. I can\u0027t help but wonder if we need to add a note into the neutron integration docs indicating that we need to utilize administrative rights.","commit_id":"7bfd88aa37d414d437dae9125a91bbc036eff059"}]}