)]}'
{"neutron/conf/policies/floatingip_port_forwarding.py":[{"author":{"_account_id":21798,"name":"Bernard Cafarelli","email":"bcafarel@redhat.com","username":"bcafarel"},"change_message_id":"9b3906d4dbf339c409b5ed5f8224cf4c2b57c8b0","unresolved":true,"context_lines":[{"line_number":31,"context_line":"        name\u003d\u0027create_floatingip_port_forwarding\u0027,"},{"line_number":32,"context_line":"        check_str\u003dbase.policy_or("},{"line_number":33,"context_line":"            base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,"},{"line_number":34,"context_line":"            base.RULE_ADMIN_OR_PARENT_OWNER),"},{"line_number":35,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":36,"context_line":"        description\u003d\u0027Create a floating IP port forwarding\u0027,"},{"line_number":37,"context_line":"        operations\u003d["}],"source_content_type":"text/x-python","patch_set":4,"id":"c68b9a9d_26dcb716","line":34,"range":{"start_line":34,"start_character":12,"end_line":34,"end_character":43},"updated":"2021-01-27 13:51:22.000000000","message":"Generic question on this patch, this one keeps old rule in check_str while others I went through dropped it (and had it only in deprecated_rule). Same end result I suppose, but maybe better to have similar changes","commit_id":"b4185d8aa2b48578d0d9351ea9f29caea0767f86"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b0e209aae2b4f6ff70582c2f7c2ce3de0f68239e","unresolved":true,"context_lines":[{"line_number":31,"context_line":"        name\u003d\u0027create_floatingip_port_forwarding\u0027,"},{"line_number":32,"context_line":"        check_str\u003dbase.policy_or("},{"line_number":33,"context_line":"            base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,"},{"line_number":34,"context_line":"            base.RULE_ADMIN_OR_PARENT_OWNER),"},{"line_number":35,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":36,"context_line":"        description\u003d\u0027Create a floating IP port forwarding\u0027,"},{"line_number":37,"context_line":"        operations\u003d["}],"source_content_type":"text/x-python","patch_set":4,"id":"268e5f5d_6ea50ab4","line":34,"range":{"start_line":34,"start_character":12,"end_line":34,"end_character":43},"in_reply_to":"119c8db4_685004df","updated":"2021-02-19 17:34:20.000000000","message":"I think the ownership check should be happening in SYSTEM_ADMIN_OR_PROJECT_MEMBER, which might negate the need to have a separate OWNER check?\n\nIs a PARENT_OWNER something different from PROJECT_MEMBER?","commit_id":"b4185d8aa2b48578d0d9351ea9f29caea0767f86"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"4dc94f2ca25af49bea22858c53149b03d465868a","unresolved":true,"context_lines":[{"line_number":31,"context_line":"        name\u003d\u0027create_floatingip_port_forwarding\u0027,"},{"line_number":32,"context_line":"        check_str\u003dbase.policy_or("},{"line_number":33,"context_line":"            base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,"},{"line_number":34,"context_line":"            base.RULE_ADMIN_OR_PARENT_OWNER),"},{"line_number":35,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":36,"context_line":"        description\u003d\u0027Create a floating IP port forwarding\u0027,"},{"line_number":37,"context_line":"        operations\u003d["}],"source_content_type":"text/x-python","patch_set":4,"id":"2a6696ff_2dc545bb","line":34,"range":{"start_line":34,"start_character":12,"end_line":34,"end_character":43},"in_reply_to":"1e6d8566_f9adc2e1","updated":"2021-03-05 13:50:26.000000000","message":"I just updated this patch to use new rule","commit_id":"b4185d8aa2b48578d0d9351ea9f29caea0767f86"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"963d3265f2fa62b807ca8fe7e5be6366dd4e573a","unresolved":true,"context_lines":[{"line_number":31,"context_line":"        name\u003d\u0027create_floatingip_port_forwarding\u0027,"},{"line_number":32,"context_line":"        check_str\u003dbase.policy_or("},{"line_number":33,"context_line":"            base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,"},{"line_number":34,"context_line":"            base.RULE_ADMIN_OR_PARENT_OWNER),"},{"line_number":35,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":36,"context_line":"        description\u003d\u0027Create a floating IP port forwarding\u0027,"},{"line_number":37,"context_line":"        operations\u003d["}],"source_content_type":"text/x-python","patch_set":4,"id":"f659b590_bf1e028b","line":34,"range":{"start_line":34,"start_character":12,"end_line":34,"end_character":43},"in_reply_to":"268e5f5d_6ea50ab4","updated":"2021-02-22 09:21:34.000000000","message":"Yes, PARENT_OWNER can be something completely different than PROJECT_MEMBER. Such PARENT can be e.g. Network resource and it can be shared with all tenants or with some specific tenant through RBAC API which we have in Neutron.","commit_id":"b4185d8aa2b48578d0d9351ea9f29caea0767f86"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"c302a2c66dca8d77ee4df8f51bb03be63c4e5bfa","unresolved":true,"context_lines":[{"line_number":31,"context_line":"        name\u003d\u0027create_floatingip_port_forwarding\u0027,"},{"line_number":32,"context_line":"        check_str\u003dbase.policy_or("},{"line_number":33,"context_line":"            base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,"},{"line_number":34,"context_line":"            base.RULE_ADMIN_OR_PARENT_OWNER),"},{"line_number":35,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":36,"context_line":"        description\u003d\u0027Create a floating IP port forwarding\u0027,"},{"line_number":37,"context_line":"        operations\u003d["}],"source_content_type":"text/x-python","patch_set":4,"id":"119c8db4_685004df","line":34,"range":{"start_line":34,"start_character":12,"end_line":34,"end_character":43},"in_reply_to":"411359d9_c0f155ba","updated":"2021-02-19 08:33:50.000000000","message":"My understanding was that deprecated rule will be removed at some point but I think that things like RULE_ADMIN_OR_PARENT_OWNER should be kept by us.\nMaybe we should introduce only PARENT_OWNER rule, without ADMIN_OR there and add it to the new rule. Wdyt?","commit_id":"b4185d8aa2b48578d0d9351ea9f29caea0767f86"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3ef46d68adfdf5d30699583515b5837068607043","unresolved":true,"context_lines":[{"line_number":31,"context_line":"        name\u003d\u0027create_floatingip_port_forwarding\u0027,"},{"line_number":32,"context_line":"        check_str\u003dbase.policy_or("},{"line_number":33,"context_line":"            base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,"},{"line_number":34,"context_line":"            base.RULE_ADMIN_OR_PARENT_OWNER),"},{"line_number":35,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":36,"context_line":"        description\u003d\u0027Create a floating IP port forwarding\u0027,"},{"line_number":37,"context_line":"        operations\u003d["}],"source_content_type":"text/x-python","patch_set":4,"id":"1e6d8566_f9adc2e1","line":34,"range":{"start_line":34,"start_character":12,"end_line":34,"end_character":43},"in_reply_to":"55fa6c21_a52695c5","updated":"2021-03-03 13:14:22.000000000","message":"Nice - I think that looks good. But, I haven\u0027t tested any of it yet.\n\nThanks Slawek","commit_id":"b4185d8aa2b48578d0d9351ea9f29caea0767f86"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9d40f153905a0ba76be44faf585c985d073b3b9e","unresolved":true,"context_lines":[{"line_number":31,"context_line":"        name\u003d\u0027create_floatingip_port_forwarding\u0027,"},{"line_number":32,"context_line":"        check_str\u003dbase.policy_or("},{"line_number":33,"context_line":"            base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,"},{"line_number":34,"context_line":"            base.RULE_ADMIN_OR_PARENT_OWNER),"},{"line_number":35,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":36,"context_line":"        description\u003d\u0027Create a floating IP port forwarding\u0027,"},{"line_number":37,"context_line":"        operations\u003d["}],"source_content_type":"text/x-python","patch_set":4,"id":"411359d9_c0f155ba","line":34,"range":{"start_line":34,"start_character":12,"end_line":34,"end_character":43},"in_reply_to":"c68b9a9d_26dcb716","updated":"2021-02-01 20:13:16.000000000","message":"I think the old rule (base.RULE_ADMIN_OR_PARENT_OWNER) can be removed since oslo.policy will logically OR the deprecated check string with the new default to make upgrades easier. I\u0027m assuming that\u0027s the reason for using base.policy_or here?","commit_id":"b4185d8aa2b48578d0d9351ea9f29caea0767f86"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"06c797a95259206d074ff37364f12aefc3fbb81f","unresolved":true,"context_lines":[{"line_number":31,"context_line":"        name\u003d\u0027create_floatingip_port_forwarding\u0027,"},{"line_number":32,"context_line":"        check_str\u003dbase.policy_or("},{"line_number":33,"context_line":"            base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,"},{"line_number":34,"context_line":"            base.RULE_ADMIN_OR_PARENT_OWNER),"},{"line_number":35,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":36,"context_line":"        description\u003d\u0027Create a floating IP port forwarding\u0027,"},{"line_number":37,"context_line":"        operations\u003d["}],"source_content_type":"text/x-python","patch_set":4,"id":"55fa6c21_a52695c5","line":34,"range":{"start_line":34,"start_character":12,"end_line":34,"end_character":43},"in_reply_to":"e93cfeb3_8255637b","updated":"2021-03-03 09:34:27.000000000","message":"Thx. I think I understood it now. I proposed https://review.opendev.org/c/openstack/neutron/+/778391 which adds new rules for PARENT_OWNER and NET_OWNER (without ADMIN). I hope I didn\u0027t misunderstood You :)","commit_id":"b4185d8aa2b48578d0d9351ea9f29caea0767f86"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8e926c88a4843cb9035e7280128cdc75db7e1d24","unresolved":true,"context_lines":[{"line_number":31,"context_line":"        name\u003d\u0027create_floatingip_port_forwarding\u0027,"},{"line_number":32,"context_line":"        check_str\u003dbase.policy_or("},{"line_number":33,"context_line":"            base.SYSTEM_ADMIN_OR_PROJECT_MEMBER,"},{"line_number":34,"context_line":"            base.RULE_ADMIN_OR_PARENT_OWNER),"},{"line_number":35,"context_line":"        scope_types\u003d[\u0027system\u0027, \u0027project\u0027],"},{"line_number":36,"context_line":"        description\u003d\u0027Create a floating IP port forwarding\u0027,"},{"line_number":37,"context_line":"        operations\u003d["}],"source_content_type":"text/x-python","patch_set":4,"id":"e93cfeb3_8255637b","line":34,"range":{"start_line":34,"start_character":12,"end_line":34,"end_character":43},"in_reply_to":"f659b590_bf1e028b","updated":"2021-03-02 22:17:03.000000000","message":"Ok - I think I\u0027m following you now. In that case, maybe isolating the PARENT_OWNER bit into it\u0027s own check makes sense because the \"admin\" functionality should move to system-admin (e.g., SYSTEM_ADMIN).\n\nTraditionally, the RULE_ADMIN check just ensures the user has the \u0027admin\u0027 role on something, but in the future we want that to be the system. I think I\u0027d try to find a way to move the \"admin-ness\" out of the check into the system-admin persona, then keep the PROJECT_OWNER check separate.\n\nDoes that help?\n\nhttps://github.com/openstack/neutron/blob/master/neutron/conf/policies/base.py#L128-L131","commit_id":"b4185d8aa2b48578d0d9351ea9f29caea0767f86"}]}