)]}'
{"releasenotes/notes/bp-policy-in-code-722372a27291b9cd.yaml":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"b69632615328e5728b3d7bba7b4bf89f2f34a88b","unresolved":false,"context_lines":[{"line_number":7,"context_line":"    policies to be removed from the policy file. The only policies that should"},{"line_number":8,"context_line":"    exist within a deployment\u0027s policy file after Pike should be policy"},{"line_number":9,"context_line":"    overrides. Note that there is no longer a default value for the default"},{"line_number":10,"context_line":"    rule. That rule is only checked when the more specific rule cannot be"},{"line_number":11,"context_line":"    found, and with policy in code all rules should be found in code even if"},{"line_number":12,"context_line":"    they are not in the policy file. To generate sample policy files from"},{"line_number":13,"context_line":"    default values, prune default policies from existing policy files, or"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f1a1f67_3b8b56c3","line":10,"range":{"start_line":10,"start_character":64,"end_line":10,"end_character":70},"updated":"2017-07-19 13:57:12.000000000","message":"could not?","commit_id":"fbec8573840c2bf9279c9e955f3fa41f8a788fbb"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"b69632615328e5728b3d7bba7b4bf89f2f34a88b","unresolved":false,"context_lines":[{"line_number":7,"context_line":"    policies to be removed from the policy file. The only policies that should"},{"line_number":8,"context_line":"    exist within a deployment\u0027s policy file after Pike should be policy"},{"line_number":9,"context_line":"    overrides. Note that there is no longer a default value for the default"},{"line_number":10,"context_line":"    rule. That rule is only checked when the more specific rule cannot be"},{"line_number":11,"context_line":"    found, and with policy in code all rules should be found in code even if"},{"line_number":12,"context_line":"    they are not in the policy file. To generate sample policy files from"},{"line_number":13,"context_line":"    default values, prune default policies from existing policy files, or"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f1a1f67_9b9a6a11","line":10,"range":{"start_line":10,"start_character":20,"end_line":10,"end_character":22},"updated":"2017-07-19 13:57:12.000000000","message":"was?","commit_id":"fbec8573840c2bf9279c9e955f3fa41f8a788fbb"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"526942392ea10380b4286026241c7cac3b401011","unresolved":false,"context_lines":[{"line_number":7,"context_line":"    policies to be removed from the policy file. The only policies that should"},{"line_number":8,"context_line":"    exist within a deployment\u0027s policy file after Pike should be policy"},{"line_number":9,"context_line":"    overrides. Note that there is no longer a default value for the default"},{"line_number":10,"context_line":"    rule. That rule is only checked when the more specific rule cannot be"},{"line_number":11,"context_line":"    found, and with policy in code all rules should be found in code even if"},{"line_number":12,"context_line":"    they are not in the policy file. To generate sample policy files from"},{"line_number":13,"context_line":"    default values, prune default policies from existing policy files, or"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f1a1f67_6e558ef9","line":10,"range":{"start_line":10,"start_character":64,"end_line":10,"end_character":70},"in_reply_to":"1f1a1f67_3b8b56c3","updated":"2017-07-19 14:07:47.000000000","message":"no, cannot is the correct verb tense here.","commit_id":"fbec8573840c2bf9279c9e955f3fa41f8a788fbb"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"526942392ea10380b4286026241c7cac3b401011","unresolved":false,"context_lines":[{"line_number":7,"context_line":"    policies to be removed from the policy file. The only policies that should"},{"line_number":8,"context_line":"    exist within a deployment\u0027s policy file after Pike should be policy"},{"line_number":9,"context_line":"    overrides. Note that there is no longer a default value for the default"},{"line_number":10,"context_line":"    rule. That rule is only checked when the more specific rule cannot be"},{"line_number":11,"context_line":"    found, and with policy in code all rules should be found in code even if"},{"line_number":12,"context_line":"    they are not in the policy file. To generate sample policy files from"},{"line_number":13,"context_line":"    default values, prune default policies from existing policy files, or"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f1a1f67_ce2ee28a","line":10,"range":{"start_line":10,"start_character":20,"end_line":10,"end_character":22},"in_reply_to":"1f1a1f67_9b9a6a11","updated":"2017-07-19 14:07:47.000000000","message":"\u0027is\u0027 is actually correct, since oslo_policy still has a default rule. I was careful to say that there\u0027s no longer a default value for the default rule, not that the rule itself no longer applies. It still does. See https://github.com/openstack/oslo.policy/blob/master/oslo_policy/policy.py#L213-L221","commit_id":"fbec8573840c2bf9279c9e955f3fa41f8a788fbb"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"b69632615328e5728b3d7bba7b4bf89f2f34a88b","unresolved":false,"context_lines":[{"line_number":23,"context_line":"    This makes policy file maintenance easier by allowing duplicated default"},{"line_number":24,"context_line":"    policies to be removed from the policy file. The only policies that should"},{"line_number":25,"context_line":"    exist within a deployment\u0027s policy file after Pike should be policy"},{"line_number":26,"context_line":"    overrides. Note that there is no longer a default value for the default"},{"line_number":27,"context_line":"    rule. That rule is only checked when the more specific rule cannot be"},{"line_number":28,"context_line":"    found, and with policy in code all rules should be found in code even if"},{"line_number":29,"context_line":"    they are not in the policy file. To generate sample policy files from"},{"line_number":30,"context_line":"    default values, prune default policies from existing policy files, or"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f1a1f67_7bcf8e28","line":27,"range":{"start_line":26,"start_character":25,"end_line":27,"end_character":9},"updated":"2017-07-19 13:57:12.000000000","message":"in fact the default rule does not exist (and should not exist in deployments) anymore, I think explaining + advising them to remove from deployments would be better/more direct advice.","commit_id":"fbec8573840c2bf9279c9e955f3fa41f8a788fbb"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"526942392ea10380b4286026241c7cac3b401011","unresolved":false,"context_lines":[{"line_number":23,"context_line":"    This makes policy file maintenance easier by allowing duplicated default"},{"line_number":24,"context_line":"    policies to be removed from the policy file. The only policies that should"},{"line_number":25,"context_line":"    exist within a deployment\u0027s policy file after Pike should be policy"},{"line_number":26,"context_line":"    overrides. Note that there is no longer a default value for the default"},{"line_number":27,"context_line":"    rule. That rule is only checked when the more specific rule cannot be"},{"line_number":28,"context_line":"    found, and with policy in code all rules should be found in code even if"},{"line_number":29,"context_line":"    they are not in the policy file. To generate sample policy files from"},{"line_number":30,"context_line":"    default values, prune default policies from existing policy files, or"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f1a1f67_ae3966a4","line":27,"range":{"start_line":26,"start_character":25,"end_line":27,"end_character":9},"in_reply_to":"1f1a1f67_7bcf8e28","updated":"2017-07-19 14:07:47.000000000","message":"this is not true, as explained above. There is still a default rule, we\u0027re just not configuring a default value for it because we don\u0027t care about/use it. If an operator is extending keystone APIs with their own custom APIs, or monkey-patching keystone code to do additional policy checks, or something funky like that, and they don\u0027t code default values for those checks they are introducing, they may (and still can) want to use the default rule. But that\u0027s totally on them and not something we care about or need to address.","commit_id":"fbec8573840c2bf9279c9e955f3fa41f8a788fbb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0aafec715918baa2bbd0a82bf7a2b9f6ba3ea345","unresolved":false,"context_lines":[{"line_number":24,"context_line":"    policies to be removed from the policy file. The only policies that should"},{"line_number":25,"context_line":"    exist within a deployment\u0027s policy file after Pike should be policy"},{"line_number":26,"context_line":"    overrides. Note that there is no longer a default value for the default"},{"line_number":27,"context_line":"    rule. That rule is only checked when the more specific rule cannot be"},{"line_number":28,"context_line":"    found, and with policy in code all rules should be found in code even if"},{"line_number":29,"context_line":"    they are not in the policy file. To generate sample policy files from"},{"line_number":30,"context_line":"    default values, prune default policies from existing policy files, or"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f1a1f67_d1dfa363","line":27,"in_reply_to":"1f1a1f67_ae3966a4","updated":"2017-07-19 14:33:03.000000000","message":"Matt\u0027s comment would make a good addition to the docs. Just a section somewhere in the operator guide or the configuration guide that says \"Hey, if you\u0027re looking to implement a default rule, here is how you would do it\".","commit_id":"fbec8573840c2bf9279c9e955f3fa41f8a788fbb"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"b69632615328e5728b3d7bba7b4bf89f2f34a88b","unresolved":false,"context_lines":[{"line_number":26,"context_line":"    overrides. Note that there is no longer a default value for the default"},{"line_number":27,"context_line":"    rule. That rule is only checked when the more specific rule cannot be"},{"line_number":28,"context_line":"    found, and with policy in code all rules should be found in code even if"},{"line_number":29,"context_line":"    they are not in the policy file. To generate sample policy files from"},{"line_number":30,"context_line":"    default values, prune default policies from existing policy files, or"},{"line_number":31,"context_line":"    familiarize yourself with general policy usage, please see the"},{"line_number":32,"context_line":"    `usage documentation"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f1a1f67_fbe27e9f","line":29,"updated":"2017-07-19 13:57:12.000000000","message":"this overall statement is a bit confusing to me","commit_id":"fbec8573840c2bf9279c9e955f3fa41f8a788fbb"}]}