)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"c36d20f98a526b0a36bcda30390d5cc2e62439e8","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Current policy allow \"admin_or_network_owner\" to create subnet,"},{"line_number":10,"context_line":"but only allow \"admin_or_owner\" to get network. This will stop"},{"line_number":11,"context_line":"network owner to get a subnet created by admin."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"This stop network owner to have total control to her/his network."},{"line_number":14,"context_line":"Such as, network owner cannot create port on her/his network,"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"9a68dd71_0900c933","line":11,"range":{"start_line":11,"start_character":40,"end_line":11,"end_character":41},"updated":"2016-01-20 21:26:39.000000000","message":"That\u0027s false in general because an admin can specify which tenant owns a resource so if an admin creates a subnet not owned by the network owner than it\u0027s on purpose or a mistake BUT in both cases the admin has to handle subnet delete.","commit_id":"7498311a105d75433b84e6a7947811d348aad117"},{"author":{"_account_id":13667,"name":"ZongKai LI","email":"onionpiece@163.com","username":"lzklibj"},"change_message_id":"15dd9512281746b4beafa8a85b4e9d9cdf0e79ec","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Current policy allow \"admin_or_network_owner\" to create subnet,"},{"line_number":10,"context_line":"but only allow \"admin_or_owner\" to get network. This will stop"},{"line_number":11,"context_line":"network owner to get a subnet created by admin."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"This stop network owner to have total control to her/his network."},{"line_number":14,"context_line":"Such as, network owner cannot create port on her/his network,"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"9a68dd71_1549ae5f","line":11,"range":{"start_line":11,"start_character":40,"end_line":11,"end_character":41},"in_reply_to":"9a68dd71_0900c933","updated":"2016-01-21 04:17:59.000000000","message":"Well, I think I can your point, Cedric. I don\u0027t have any good idea to follow your points or disagree now.","commit_id":"7498311a105d75433b84e6a7947811d348aad117"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"c36d20f98a526b0a36bcda30390d5cc2e62439e8","unresolved":false,"context_lines":[{"line_number":10,"context_line":"but only allow \"admin_or_owner\" to get network. This will stop"},{"line_number":11,"context_line":"network owner to get a subnet created by admin."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"This stop network owner to have total control to her/his network."},{"line_number":14,"context_line":"Such as, network owner cannot create port on her/his network,"},{"line_number":15,"context_line":"cannot add this subnet onto a router as interface."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"9a68dd71_e9b0d58d","line":13,"range":{"start_line":13,"start_character":10,"end_line":13,"end_character":17},"updated":"2016-01-20 21:26:39.000000000","message":"IMO, it seems to be the expected behavior (perhaps it\u0027s no more the case with RBAC), so i let Kevin decides!","commit_id":"7498311a105d75433b84e6a7947811d348aad117"},{"author":{"_account_id":13667,"name":"ZongKai LI","email":"onionpiece@163.com","username":"lzklibj"},"change_message_id":"a7d3b9e2a87024e641ddc44028968fc13bf5bf6f","unresolved":false,"context_lines":[{"line_number":10,"context_line":"but only allow \"admin_or_owner\" to get network. This will stop"},{"line_number":11,"context_line":"network owner to get a subnet created by admin."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"This stop network owner to have total control to her/his network."},{"line_number":14,"context_line":"Such as, network owner cannot create port on her/his network,"},{"line_number":15,"context_line":"cannot add this subnet onto a router as interface."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"9a68dd71_6c058178","line":13,"range":{"start_line":13,"start_character":10,"end_line":13,"end_character":17},"in_reply_to":"9a68dd71_5e309101","updated":"2016-01-22 08:11:08.000000000","message":"1. that isn\u0027t a clear reason to explain, please check rule [1], Or do you mean the rule here is not explained enough.\n2. Per [2] and [3], network owner should have ability to delete that can of port. So it still block here.\n3. OK, that should be think about.\n4. Oops, I don\u0027t think rbac rule action \"access_as_shared\" means totally use/control to other tenants. At least, for subnets, the privilege is still owned by admin and network owner [4]. And for [5], I think it should mean that, network should be consider as \"shared\" to other tenants even its not shared indeed. It may be OK for other tenants to get all subnets, but it seems odd to network owner.\n\n[1] \"create_port:fixed_ips\": \"rule:admin_or_network_owner or rule:context_is_advsvc\"\n[2] \"Tenants will be able to delete ports on networks they own even if the port does not belong to them. This is to allow tenants to have final say over networks they own.\" \"Proposed Change\" section in http://specs.openstack.org/openstack/neutron-specs/specs/liberty/rbac-networks.html.\n[3] \"delete_port\": \"rule:admin_owner_or_network_owner or rule:context_is_advsvc\"\n[4] \"create_subnet\": \"rule:admin_or_network_owner\"\n[5] \"‘access_as_shared’ to indicate that the tenant can access it like it would a shared network\" \"Data Model Impact\" section in http://specs.openstack.org/openstack/neutron-specs/specs/liberty/rbac-networks.html","commit_id":"7498311a105d75433b84e6a7947811d348aad117"},{"author":{"_account_id":8124,"name":"cbrandily","email":"zzelle@gmail.com","username":"cbrandily"},"change_message_id":"2ee750b31b9ea886164eb8e721a0ea7450dde61c","unresolved":false,"context_lines":[{"line_number":10,"context_line":"but only allow \"admin_or_owner\" to get network. This will stop"},{"line_number":11,"context_line":"network owner to get a subnet created by admin."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"This stop network owner to have total control to her/his network."},{"line_number":14,"context_line":"Such as, network owner cannot create port on her/his network,"},{"line_number":15,"context_line":"cannot add this subnet onto a router as interface."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"9a68dd71_5e309101","line":13,"range":{"start_line":13,"start_character":10,"end_line":13,"end_character":17},"in_reply_to":"9a68dd71_b5c78211","updated":"2016-01-21 13:09:27.000000000","message":"1. the network owner doesn\u0027t own the subnet so there is no reason he can create a port on this subnet BUT he can its own subnet!\n2. see 1.\n3. you have exactly the same trouble if you set allow_overlapping_ips \u003d\u003d False\n4. it doesn\u0027t look like a trouble: the network owner allows other tenants to use its networks so they can create their own subnets on it like network owner can create \"private\" subnets\" on it.","commit_id":"7498311a105d75433b84e6a7947811d348aad117"},{"author":{"_account_id":13667,"name":"ZongKai LI","email":"onionpiece@163.com","username":"lzklibj"},"change_message_id":"15dd9512281746b4beafa8a85b4e9d9cdf0e79ec","unresolved":false,"context_lines":[{"line_number":10,"context_line":"but only allow \"admin_or_owner\" to get network. This will stop"},{"line_number":11,"context_line":"network owner to get a subnet created by admin."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"This stop network owner to have total control to her/his network."},{"line_number":14,"context_line":"Such as, network owner cannot create port on her/his network,"},{"line_number":15,"context_line":"cannot add this subnet onto a router as interface."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"9a68dd71_b5c78211","line":13,"range":{"start_line":13,"start_character":10,"end_line":13,"end_character":17},"in_reply_to":"9a68dd71_e9b0d58d","updated":"2016-01-21 04:17:59.000000000","message":"Yes, I\u0027d like to Kevin to discuss here and give his points.\n\nBTW, I want to share some points from mine, hope this will help people to understand the purpose of this patch.\nWhen network owner doesn\u0027t have ability to get all subnets in its network:\n1, network owner will fail to create a port on that subnet, even subnet_id can be get from \"net-list\" results;\n2, when that subnet owner attach subnet to a router as interface, it needs to update interface port device_owner to deleteable device_owner type first. while this needs https://review.openstack.org/#/c/255285/ and https://review.openstack.org/#/c/268677/ get merged first.\n3, for network owner will not know cidrs of subnets not belong to it, when it create new subnet, cidr conflict may happen.\n4, if network owner create rbac rules for other tenant, some other tenant may see more subnets than network owner can get.\n5, if network owner doesn\u0027t create rbac rule for a third tenant, and admin create subnet for that third tenant, I\u0027m not sure what kind of unexpected behavior will raise.\n\nThanks.","commit_id":"7498311a105d75433b84e6a7947811d348aad117"}]}