)]}'
{"specs/kilo/approved/nova-api-policy.rst":[{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"f1539cf841e6de650d32c91e3559072ed91000c3","unresolved":false,"context_lines":[{"line_number":191,"context_line":""},{"line_number":192,"context_line":"Every effort will be made to keep all existing policy permission"},{"line_number":193,"context_line":"settings backwards compatible. Where this is not possible or too"},{"line_number":194,"context_line":"impractical the policy file changes required to keep the existing"},{"line_number":195,"context_line":"behaviour will be very clearly documented in upgrade documentation."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"baa201ad_367ff567","line":194,"updated":"2014-10-15 07:04:39.000000000","message":"Alex - do we have any examples of where it won\u0027t be possible to keep backwards compatibility? Or is this just something we were concerned about?","commit_id":"855ea619037b0fab5fb5853718853b897d96f71f"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"00820652e02af01b81b2ac5e9cacc1284b31d2f5","unresolved":false,"context_lines":[{"line_number":191,"context_line":""},{"line_number":192,"context_line":"Every effort will be made to keep all existing policy permission"},{"line_number":193,"context_line":"settings backwards compatible. Where this is not possible or too"},{"line_number":194,"context_line":"impractical the policy file changes required to keep the existing"},{"line_number":195,"context_line":"behaviour will be very clearly documented in upgrade documentation."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"baa201ad_f1057711","line":194,"in_reply_to":"baa201ad_367ff567","updated":"2014-10-15 07:46:10.000000000","message":"I can list more detail what won\u0027t keep backwards compatibility. \nBreak the back-compatibility cases are:\nThe remove db hard-code permission.\nChange rule name for EC2 and V2.1 API.\n\nFor v2.1 api, I think it\u0027s fine for not back-compatible, there isn\u0027t anyone use it yet.","commit_id":"855ea619037b0fab5fb5853718853b897d96f71f"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"830e2f9c4bac1df9152f236a8fd0ebebf0a25bbe","unresolved":false,"context_lines":[{"line_number":192,"context_line":"Every effort will be made to keep all existing policy permission"},{"line_number":193,"context_line":"settings backwards compatible. Where this is not possible or too"},{"line_number":194,"context_line":"impractical the policy file changes required to keep the existing"},{"line_number":195,"context_line":"behaviour will be very clearly documented in upgrade documentation."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":4,"id":"baa201ad_2337f2b1","line":195,"updated":"2014-10-13 16:08:58.000000000","message":"So this is my biggest worry.\n\nSeems we might want to give people a tool to help with the upgrade.\n\nGetting this wrong would be a massive issue.\n\nI think we need to look at this in concert with making it easier to deployers to change their policy settings.","commit_id":"855ea619037b0fab5fb5853718853b897d96f71f"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"49eb0106008708574afb7fd87922235032ecdc83","unresolved":false,"context_lines":[{"line_number":192,"context_line":"Every effort will be made to keep all existing policy permission"},{"line_number":193,"context_line":"settings backwards compatible. Where this is not possible or too"},{"line_number":194,"context_line":"impractical the policy file changes required to keep the existing"},{"line_number":195,"context_line":"behaviour will be very clearly documented in upgrade documentation."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":4,"id":"baa201ad_315a9f2a","line":195,"in_reply_to":"baa201ad_166cb1cf","updated":"2014-10-15 07:48:07.000000000","message":"I will try to keep the V2 API back-compatibile (except remove the db layer hard-code permission).  For EC2/V2.1, I want to change it\u0027s rule name prefix. EC2 api is small, so I think it\u0027s fine. V2.1 API didn\u0027t have actually user yet, so it won\u0027t problem also.","commit_id":"855ea619037b0fab5fb5853718853b897d96f71f"},{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"f1539cf841e6de650d32c91e3559072ed91000c3","unresolved":false,"context_lines":[{"line_number":192,"context_line":"Every effort will be made to keep all existing policy permission"},{"line_number":193,"context_line":"settings backwards compatible. Where this is not possible or too"},{"line_number":194,"context_line":"impractical the policy file changes required to keep the existing"},{"line_number":195,"context_line":"behaviour will be very clearly documented in upgrade documentation."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":4,"id":"baa201ad_166cb1cf","line":195,"in_reply_to":"baa201ad_2337f2b1","updated":"2014-10-15 07:04:39.000000000","message":"I don\u0027t think a tool is the answer - too much chance of getting it wrong. But very clear documentation on what has changed is very important","commit_id":"855ea619037b0fab5fb5853718853b897d96f71f"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"743b78ccb5467e324edb903f21589142d3b142ce","unresolved":false,"context_lines":[{"line_number":169,"context_line":"These patches will require very rigorous double checking and high"},{"line_number":170,"context_line":"quality reviews to ensure that security bugs are not introduced as the"},{"line_number":171,"context_line":"nova internal calls can be called from quite a few different code"},{"line_number":172,"context_line":"paths (Ec2, V2 API, V2.1 API and other internals)."},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"Notifications impact"},{"line_number":175,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_6729769a","line":172,"updated":"2014-10-28 07:23:18.000000000","message":"I think it might lead to some concerns from security guys :(","commit_id":"d96738c5d02795325702814cfbd28c878faf2983"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"c4403ffda885ea8abc2fbae5c929b4d8a40203c7","unresolved":false,"context_lines":[{"line_number":169,"context_line":"These patches will require very rigorous double checking and high"},{"line_number":170,"context_line":"quality reviews to ensure that security bugs are not introduced as the"},{"line_number":171,"context_line":"nova internal calls can be called from quite a few different code"},{"line_number":172,"context_line":"paths (Ec2, V2 API, V2.1 API and other internals)."},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"Notifications impact"},{"line_number":175,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a8c0949_2382d852","line":172,"in_reply_to":"9aa7fdbe_6729769a","updated":"2014-10-30 06:17:38.000000000","message":"we need review those patch very becareful","commit_id":"d96738c5d02795325702814cfbd28c878faf2983"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"743b78ccb5467e324edb903f21589142d3b142ce","unresolved":false,"context_lines":[{"line_number":235,"context_line":"  Alex Xu \u003cxuhj@linux.vnet.ibm.com\u003e"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"Other contributors:"},{"line_number":238,"context_line":"  Ivan Zhu \u003cbozhu@linux.vnet.ibm.com\u003e"},{"line_number":239,"context_line":"  Ji Chen \u003cjichenjc@cn.ibm.com\u003e"},{"line_number":240,"context_line":"  Shuangtai Tian \u003cshuangtai.tian@intel.com\u003e"},{"line_number":241,"context_line":"  Chris Yeoh \u003ccyeoh@au1.ibm.com\u003e"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_874d7a9c","line":238,"updated":"2014-10-28 07:23:18.000000000","message":"need update :)","commit_id":"d96738c5d02795325702814cfbd28c878faf2983"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"c4403ffda885ea8abc2fbae5c929b4d8a40203c7","unresolved":false,"context_lines":[{"line_number":235,"context_line":"  Alex Xu \u003cxuhj@linux.vnet.ibm.com\u003e"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"Other contributors:"},{"line_number":238,"context_line":"  Ivan Zhu \u003cbozhu@linux.vnet.ibm.com\u003e"},{"line_number":239,"context_line":"  Ji Chen \u003cjichenjc@cn.ibm.com\u003e"},{"line_number":240,"context_line":"  Shuangtai Tian \u003cshuangtai.tian@intel.com\u003e"},{"line_number":241,"context_line":"  Chris Yeoh \u003ccyeoh@au1.ibm.com\u003e"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a8c0949_4387e461","line":238,"in_reply_to":"9aa7fdbe_874d7a9c","updated":"2014-10-30 06:17:38.000000000","message":":)","commit_id":"d96738c5d02795325702814cfbd28c878faf2983"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"743b78ccb5467e324edb903f21589142d3b142ce","unresolved":false,"context_lines":[{"line_number":255,"context_line":"Dependencies"},{"line_number":256,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"None"},{"line_number":259,"context_line":""},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"Testing"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_a737defd","line":258,"updated":"2014-10-28 07:23:18.000000000","message":"will this bp still depends on v3 API (micro-version)","commit_id":"d96738c5d02795325702814cfbd28c878faf2983"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"c4403ffda885ea8abc2fbae5c929b4d8a40203c7","unresolved":false,"context_lines":[{"line_number":255,"context_line":"Dependencies"},{"line_number":256,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"None"},{"line_number":259,"context_line":""},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"Testing"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a8c0949_038ddc7b","line":258,"in_reply_to":"9aa7fdbe_a737defd","updated":"2014-10-30 06:17:38.000000000","message":"It didn\u0027t depend on v3 api and micro-version, and v2.1 works is almost done.","commit_id":"d96738c5d02795325702814cfbd28c878faf2983"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"743b78ccb5467e324edb903f21589142d3b142ce","unresolved":false,"context_lines":[{"line_number":267,"context_line":"Documentation Impact"},{"line_number":268,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":269,"context_line":"The db layer permission checks will be deleted, this should be document at"},{"line_number":270,"context_line":"upgrade documentation."},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"All the policy should enforce at API layer, this should be document at"},{"line_number":273,"context_line":"developer documentation."}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_e746467a","line":270,"updated":"2014-10-28 07:23:18.000000000","message":"I don\u0027t know why we need to expose this \u0027internal\u0027 stuffs?","commit_id":"d96738c5d02795325702814cfbd28c878faf2983"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"c4403ffda885ea8abc2fbae5c929b4d8a40203c7","unresolved":false,"context_lines":[{"line_number":267,"context_line":"Documentation Impact"},{"line_number":268,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":269,"context_line":"The db layer permission checks will be deleted, this should be document at"},{"line_number":270,"context_line":"upgrade documentation."},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"All the policy should enforce at API layer, this should be document at"},{"line_number":273,"context_line":"developer documentation."}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a8c0949_a3dc0876","line":270,"in_reply_to":"9aa7fdbe_e746467a","updated":"2014-10-30 06:17:38.000000000","message":"Maybe some deployer didn\u0027t write any rule for an API, and the permission check is done by db layer, after db layer removed, we need notify depoyer update their policy config to add a rule for that API.","commit_id":"d96738c5d02795325702814cfbd28c878faf2983"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"d4069036c73ed616b0cc1cc4abc66d6c3edef741","unresolved":false,"context_lines":[{"line_number":110,"context_line":"    V2.1 API."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"  * For V2 API, we want to keep the backwards-compatibility. So we won\u0027t move"},{"line_number":113,"context_line":"    the compute API layer policy checking into REST API layer. We will set"},{"line_number":114,"context_line":"    compute API\u0027s parameter skip_policy_check to False, that means still"},{"line_number":115,"context_line":"    doing policy checking at compute API layer. It\u0027s because V2 API will be"},{"line_number":116,"context_line":"    depreciated. Before V2 API removed, we needn\u0027t take risk of breaking"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a961159_c2fd393d","line":113,"updated":"2014-12-10 03:50:06.000000000","message":"Compute API layer is shared between v2 and v2.1 API.\nSo if removing policy check from compute API layer as line 99, I think we need to implement policy check at REST API layer.\nHowever, this line shows v2 REST API layer doesn\u0027t do it.\nI guess v2 REST API will not check policy on this plan.","commit_id":"5f4ab1b73792651882eaa2f6f17c5557197d7a5a"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"6617326b2f95a0f038805294ef8186e3fe5a3cb3","unresolved":false,"context_lines":[{"line_number":110,"context_line":"    V2.1 API."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"  * For V2 API, we want to keep the backwards-compatibility. So we won\u0027t move"},{"line_number":113,"context_line":"    the compute API layer policy checking into REST API layer. We will set"},{"line_number":114,"context_line":"    compute API\u0027s parameter skip_policy_check to False, that means still"},{"line_number":115,"context_line":"    doing policy checking at compute API layer. It\u0027s because V2 API will be"},{"line_number":116,"context_line":"    depreciated. Before V2 API removed, we needn\u0027t take risk of breaking"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a961159_a8f3af9c","line":113,"in_reply_to":"3a961159_c2fd393d","updated":"2014-12-10 04:22:27.000000000","message":"yes, only remove comptue api layer check for v2.1 and ec2. not the v2, I will update the line 99","commit_id":"5f4ab1b73792651882eaa2f6f17c5557197d7a5a"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"d4069036c73ed616b0cc1cc4abc66d6c3edef741","unresolved":false,"context_lines":[{"line_number":130,"context_line":"  * Update policy configuration file to match the existing behavior for"},{"line_number":131,"context_line":"    EC2 and V2.1 API."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"* Correct the policy rule name specification for the v2.1 api and ec2 api"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"  The policy naming style as below:"},{"line_number":136,"context_line":"    For V2.1: api:[extension_alias]:[action]"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a961159_0804c313","line":133,"updated":"2014-12-10 03:50:06.000000000","message":"I much prefer policy checks are implemented at REST API layer, that would be nice for deployers. and I agree with renaming policy rule names of v2.1 API because v2.1 API is new and the changes don\u0027t affect deployers actually.\n\nHowever, ec2 policy rule changes affect production environments. So I\u0027d like to suggest this spec renames v2.1 rule changes only.","commit_id":"5f4ab1b73792651882eaa2f6f17c5557197d7a5a"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"6617326b2f95a0f038805294ef8186e3fe5a3cb3","unresolved":false,"context_lines":[{"line_number":130,"context_line":"  * Update policy configuration file to match the existing behavior for"},{"line_number":131,"context_line":"    EC2 and V2.1 API."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"* Correct the policy rule name specification for the v2.1 api and ec2 api"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"  The policy naming style as below:"},{"line_number":136,"context_line":"    For V2.1: api:[extension_alias]:[action]"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a961159_08304355","line":133,"in_reply_to":"3a961159_0804c313","updated":"2014-12-10 04:22:27.000000000","message":"if we didn\u0027t change ec2, we can remove comptue api layer checks, because only v2 will be removed in the future. I think ec2 user is more less, and ec2 api is less also. Fix ec2 api, will affect less user, and give user better policy configuration.","commit_id":"5f4ab1b73792651882eaa2f6f17c5557197d7a5a"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"f442ab3602b6ff334fe20d79c1869c323b2b2382","unresolved":false,"context_lines":[{"line_number":130,"context_line":"  * Update policy configuration file to match the existing behavior for"},{"line_number":131,"context_line":"    EC2 and V2.1 API."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"* Correct the policy rule name specification for the v2.1 api and ec2 api"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"  The policy naming style as below:"},{"line_number":136,"context_line":"    For V2.1: api:[extension_alias]:[action]"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a961159_28141f4d","line":133,"in_reply_to":"3a961159_08304355","updated":"2014-12-10 04:38:08.000000000","message":"I just wanted to say about \"it is better to avoid renaming ec2 policy rules\".\nI agree with changing ec2 API layer.","commit_id":"5f4ab1b73792651882eaa2f6f17c5557197d7a5a"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"5c7ab6fbb9658b468610d22d40045b7a09fe8d9c","unresolved":false,"context_lines":[{"line_number":130,"context_line":"  * Update policy configuration file to match the existing behavior for"},{"line_number":131,"context_line":"    EC2 and V2.1 API."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"* Correct the policy rule name specification for the v2.1 api and ec2 api"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"  The policy naming style as below:"},{"line_number":136,"context_line":"    For V2.1: api:[extension_alias]:[action]"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a961159_8b0fcd2d","line":133,"in_reply_to":"3a961159_28141f4d","updated":"2014-12-10 04:41:06.000000000","message":"emm....ec2 api is totally depend on compute api policy...there isn\u0027t any policy for ec2","commit_id":"5f4ab1b73792651882eaa2f6f17c5557197d7a5a"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"ba51724bcd6f85165823694c3525eacde79260b3","unresolved":false,"context_lines":[{"line_number":124,"context_line":"  * For the v2.1 API, we remove all the hard-code permission check from DB"},{"line_number":125,"context_line":"    layer. And we should ensure we have policy check at REST API layer."},{"line_number":126,"context_line":"  * For the v2 API, we remove all the hard-code permission check from DB"},{"line_number":127,"context_line":"    layer, and move the hard-code permission checks into API layer to"},{"line_number":128,"context_line":"    keep back-compatibility. V2 API will removed once V2.1 ready, this"},{"line_number":129,"context_line":"    can reduce the risk we break something existed."},{"line_number":130,"context_line":"  * Update policy configuration file to match the existing behavior for"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_48221c53","line":127,"updated":"2014-12-11 08:16:29.000000000","message":"does that means we need to first remove policy in db layer and add them into compute API layer\nand later remove from compute API layer because v2.1 API onboard?","commit_id":"187cf6e348ae08436e40d9e3096ade3a206cb989"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"d5c879dbe1301987d3ce031dbe04f1e1a25403e6","unresolved":false,"context_lines":[{"line_number":124,"context_line":"  * For the v2.1 API, we remove all the hard-code permission check from DB"},{"line_number":125,"context_line":"    layer. And we should ensure we have policy check at REST API layer."},{"line_number":126,"context_line":"  * For the v2 API, we remove all the hard-code permission check from DB"},{"line_number":127,"context_line":"    layer, and move the hard-code permission checks into API layer to"},{"line_number":128,"context_line":"    keep back-compatibility. V2 API will removed once V2.1 ready, this"},{"line_number":129,"context_line":"    can reduce the risk we break something existed."},{"line_number":130,"context_line":"  * Update policy configuration file to match the existing behavior for"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_78d6a3f2","line":127,"in_reply_to":"3a961159_48221c53","updated":"2014-12-12 02:31:48.000000000","message":"It means we remove policy in db layer at sametime add it into REST API layer for V2 API.\n\nI should clear the word, thanks","commit_id":"187cf6e348ae08436e40d9e3096ade3a206cb989"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"ba51724bcd6f85165823694c3525eacde79260b3","unresolved":false,"context_lines":[{"line_number":234,"context_line":"pci"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"For v2.1 and ec2 api, the policy rule name prefix is changed. So it need"},{"line_number":237,"context_line":"Deployer update their policy config."},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"Developer impact"},{"line_number":240,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_884c04ca","line":237,"updated":"2014-12-11 08:16:29.000000000","message":"should we consider some migration issue? \n\ne.g. end user changed their policy file a lot , we don\u0027t have other method but need them manually edit the policy file?","commit_id":"187cf6e348ae08436e40d9e3096ade3a206cb989"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"d5c879dbe1301987d3ce031dbe04f1e1a25403e6","unresolved":false,"context_lines":[{"line_number":234,"context_line":"pci"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"For v2.1 and ec2 api, the policy rule name prefix is changed. So it need"},{"line_number":237,"context_line":"Deployer update their policy config."},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"Developer impact"},{"line_number":240,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"3a961159_b832cb5c","line":237,"in_reply_to":"3a961159_884c04ca","updated":"2014-12-12 02:31:48.000000000","message":"There isn\u0027t any user for v2.1 for now. And for ec2 api, it need user to update their policy, I choice not back-compatible for ec2 is because it\u0027s small. about the upgrade there is some discussion at https://review.openstack.org/#/c/127160/4/specs/kilo/approved/nova-api-policy.rst","commit_id":"187cf6e348ae08436e40d9e3096ade3a206cb989"},{"author":{"_account_id":1849,"name":"Joe Gordon","email":"joe.gordon0@gmail.com","username":"jogo"},"change_message_id":"faa9178bf74fe8225c728099505868fb263aab47","unresolved":false,"context_lines":[{"line_number":85,"context_line":"----------------"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"The kilo priorities list is currently not defined. However under the"},{"line_number":88,"context_line":"currently proposed list of priorities it would fall under \"User"},{"line_number":89,"context_line":"Experience\" as it significantly increases the ability for us to"},{"line_number":90,"context_line":"improve the Nova API."},{"line_number":91,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3a961159_4623acbc","line":88,"updated":"2014-12-12 19:55:08.000000000","message":"http://specs.openstack.org/openstack/nova-specs/priorities/kilo-priorities.html#scheduler\n\nMaybe this falls under v2.1? Otherwise this should just be \u0027None\u0027","commit_id":"410c2553da0fe8bb5e3362d4b7eb1387b7d3e1b3"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"fc6fd5064103460a96fac8c74b4af68f4df1b794","unresolved":false,"context_lines":[{"line_number":85,"context_line":"----------------"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"The kilo priorities list is currently not defined. However under the"},{"line_number":88,"context_line":"currently proposed list of priorities it would fall under \"User"},{"line_number":89,"context_line":"Experience\" as it significantly increases the ability for us to"},{"line_number":90,"context_line":"improve the Nova API."},{"line_number":91,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"3a961159_cd77b49e","line":88,"in_reply_to":"3a961159_4623acbc","updated":"2014-12-13 00:04:33.000000000","message":"actually I\u0027m waiting for other people told this me fall under where...Anyone can decide it? So I just change to None first.","commit_id":"410c2553da0fe8bb5e3362d4b7eb1387b7d3e1b3"},{"author":{"_account_id":100,"name":"Johannes Erdfelt","email":"johannes@erdfelt.com","username":"johannes.erdfelt"},"change_message_id":"60f5d589c8b704925e7ab3debf9d179ec17168b2","unresolved":false,"context_lines":[{"line_number":234,"context_line":"pci"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"For v2.1 and ec2 api, the policy rule name prefix is changed. So it need"},{"line_number":237,"context_line":"Deployer update their policy config."},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"Developer impact"},{"line_number":240,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3a961159_c9188fd5","line":237,"updated":"2014-12-12 20:12:04.000000000","message":"Is there any way we can add a command to nova-manage to make this process easier for deployers?","commit_id":"410c2553da0fe8bb5e3362d4b7eb1387b7d3e1b3"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"fc6fd5064103460a96fac8c74b4af68f4df1b794","unresolved":false,"context_lines":[{"line_number":234,"context_line":"pci"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"For v2.1 and ec2 api, the policy rule name prefix is changed. So it need"},{"line_number":237,"context_line":"Deployer update their policy config."},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"Developer impact"},{"line_number":240,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":12,"id":"3a961159_ed539014","line":237,"in_reply_to":"3a961159_c9188fd5","updated":"2014-12-13 00:04:33.000000000","message":"Actually there have discussion about this at ps4 https://review.openstack.org/#/c/127160/4/specs/kilo/approved/nova-api-policy.rst\n\nFor v2.1 there isn\u0027t any user yet, so we needn\u0027t worry about it. For ec2 api, actually there isn\u0027t any policy rule, the ec2 totally depend on compute api layer policy, but I think never has user use it, for example there are two compute api and mean two policy rule at line 1892 and 1904 https://github.com/openstack/nova/blob/master/nova/api/ec2/cloud.py#L1892\n\nIf we have tools we load from which policy? So as the ps4 said, it can make more error.\n\nAnd another good news is ec2 is small, just about 29 api without volume and image related.","commit_id":"410c2553da0fe8bb5e3362d4b7eb1387b7d3e1b3"},{"author":{"_account_id":100,"name":"Johannes Erdfelt","email":"johannes@erdfelt.com","username":"johannes.erdfelt"},"change_message_id":"60f5d589c8b704925e7ab3debf9d179ec17168b2","unresolved":false,"context_lines":[{"line_number":260,"context_line":"----------"},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"* Add parameter to compute and network API to skip policy checks."},{"line_number":263,"context_line":"* Imporve the EC2 API policy enforcement"},{"line_number":264,"context_line":"  * Remove compute API and network API layer policy enforcement"},{"line_number":265,"context_line":"  * Rename EC2 API rules"},{"line_number":266,"context_line":"  * Move EC2 API rules into separated file."}],"source_content_type":"text/x-rst","patch_set":12,"id":"3a961159_49cf3f56","line":263,"updated":"2014-12-12 20:12:04.000000000","message":"s/Imporve/Improve/","commit_id":"410c2553da0fe8bb5e3362d4b7eb1387b7d3e1b3"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"fc6fd5064103460a96fac8c74b4af68f4df1b794","unresolved":false,"context_lines":[{"line_number":260,"context_line":"----------"},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"* Add parameter to compute and network API to skip policy checks."},{"line_number":263,"context_line":"* Imporve the EC2 API policy enforcement"},{"line_number":264,"context_line":"  * Remove compute API and network API layer policy enforcement"},{"line_number":265,"context_line":"  * Rename EC2 API rules"},{"line_number":266,"context_line":"  * Move EC2 API rules into separated file."}],"source_content_type":"text/x-rst","patch_set":12,"id":"3a961159_3b0a3126","line":263,"in_reply_to":"3a961159_49cf3f56","updated":"2014-12-13 00:04:33.000000000","message":"Done","commit_id":"410c2553da0fe8bb5e3362d4b7eb1387b7d3e1b3"},{"author":{"_account_id":9420,"name":"Matthew Gilliard","email":"matthew.gilliard@hp.com","username":"gilliard"},"change_message_id":"d23933cc5ad0c6e48a00bb335dd5481e7aa3e98a","unresolved":false,"context_lines":[{"line_number":21,"context_line":"https://etherpad.openstack.org/p/icehouse-summit-nova-v3-api"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"This is part of policy improvement, the full view describe of those"},{"line_number":24,"context_line":"improvement at: https://review.openstack.org/#/c/128560"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Problem description"},{"line_number":27,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":13,"id":"3a961159_7f6c8508","line":24,"updated":"2014-12-16 08:18:30.000000000","message":"This spec has been abandoned, so remove this.","commit_id":"127d4f7fa5a32adaf26d260c787d15be9c22de9d"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"6b95947eb8ec7bea812623c20dd97ebb0bfb5258","unresolved":false,"context_lines":[{"line_number":21,"context_line":"https://etherpad.openstack.org/p/icehouse-summit-nova-v3-api"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"This is part of policy improvement, the full view describe of those"},{"line_number":24,"context_line":"improvement at: https://review.openstack.org/#/c/128560"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Problem description"},{"line_number":27,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":13,"id":"3a961159_4d49c78d","line":24,"in_reply_to":"3a961159_7f6c8508","updated":"2014-12-16 08:20:31.000000000","message":"Done","commit_id":"127d4f7fa5a32adaf26d260c787d15be9c22de9d"},{"author":{"_account_id":12175,"name":"Eli Qiao","email":"qiaoliyong@gmail.com","username":"Eli"},"change_message_id":"4b47bca8abe68c6e6d57cbfe53f4d773f3ddf41f","unresolved":false,"context_lines":[{"line_number":21,"context_line":"https://etherpad.openstack.org/p/icehouse-summit-nova-v3-api"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"This is part of policy improvement, the full view describe of those"},{"line_number":24,"context_line":"improvement at: https://review.openstack.org/#/c/128560"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Problem description"},{"line_number":27,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":13,"id":"3a961159_6d35a3f6","line":24,"in_reply_to":"3a961159_7f6c8508","updated":"2014-12-16 08:22:34.000000000","message":"Done","commit_id":"127d4f7fa5a32adaf26d260c787d15be9c22de9d"},{"author":{"_account_id":9420,"name":"Matthew Gilliard","email":"matthew.gilliard@hp.com","username":"gilliard"},"change_message_id":"d23933cc5ad0c6e48a00bb335dd5481e7aa3e98a","unresolved":false,"context_lines":[{"line_number":79,"context_line":"as only admin can operator those API."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"2. As developer view, Only one rule for pause server API at REST API layer."},{"line_number":82,"context_line":"Developer needn\u0027t confuse how to process permission checks in the nova."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Project Priority"},{"line_number":85,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":13,"id":"3a961159_df09f931","line":82,"updated":"2014-12-16 08:18:30.000000000","message":"nit: ...needn\u0027t be confused how....","commit_id":"127d4f7fa5a32adaf26d260c787d15be9c22de9d"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"6b95947eb8ec7bea812623c20dd97ebb0bfb5258","unresolved":false,"context_lines":[{"line_number":79,"context_line":"as only admin can operator those API."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"2. As developer view, Only one rule for pause server API at REST API layer."},{"line_number":82,"context_line":"Developer needn\u0027t confuse how to process permission checks in the nova."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Project Priority"},{"line_number":85,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":13,"id":"3a961159_6d4e8398","line":82,"in_reply_to":"3a961159_df09f931","updated":"2014-12-16 08:20:31.000000000","message":"Done","commit_id":"127d4f7fa5a32adaf26d260c787d15be9c22de9d"},{"author":{"_account_id":12175,"name":"Eli Qiao","email":"qiaoliyong@gmail.com","username":"Eli"},"change_message_id":"4b47bca8abe68c6e6d57cbfe53f4d773f3ddf41f","unresolved":false,"context_lines":[{"line_number":79,"context_line":"as only admin can operator those API."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"2. As developer view, Only one rule for pause server API at REST API layer."},{"line_number":82,"context_line":"Developer needn\u0027t confuse how to process permission checks in the nova."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Project Priority"},{"line_number":85,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":13,"id":"3a961159_cd23f7bc","line":82,"in_reply_to":"3a961159_df09f931","updated":"2014-12-16 08:22:34.000000000","message":"Done","commit_id":"127d4f7fa5a32adaf26d260c787d15be9c22de9d"},{"author":{"_account_id":9420,"name":"Matthew Gilliard","email":"matthew.gilliard@hp.com","username":"gilliard"},"change_message_id":"d23933cc5ad0c6e48a00bb335dd5481e7aa3e98a","unresolved":false,"context_lines":[{"line_number":111,"context_line":"    compute API\u0027s parameter skip_policy_check to False, that means still"},{"line_number":112,"context_line":"    doing policy checking at compute API layer. It\u0027s because V2 API will be"},{"line_number":113,"context_line":"    depreciated. Before V2 API removed, we needn\u0027t take risk of breaking"},{"line_number":114,"context_line":"    existed code."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"    https://review.openstack.org/#/c/100408/2/nova/compute/api.py"},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"3a961159_3129518a","line":114,"updated":"2014-12-16 08:18:30.000000000","message":"nit: ...existing code.","commit_id":"127d4f7fa5a32adaf26d260c787d15be9c22de9d"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"6b95947eb8ec7bea812623c20dd97ebb0bfb5258","unresolved":false,"context_lines":[{"line_number":111,"context_line":"    compute API\u0027s parameter skip_policy_check to False, that means still"},{"line_number":112,"context_line":"    doing policy checking at compute API layer. It\u0027s because V2 API will be"},{"line_number":113,"context_line":"    depreciated. Before V2 API removed, we needn\u0027t take risk of breaking"},{"line_number":114,"context_line":"    existed code."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"    https://review.openstack.org/#/c/100408/2/nova/compute/api.py"},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"3a961159_2d7d5bb2","line":114,"in_reply_to":"3a961159_3129518a","updated":"2014-12-16 08:20:31.000000000","message":"Done","commit_id":"127d4f7fa5a32adaf26d260c787d15be9c22de9d"},{"author":{"_account_id":12175,"name":"Eli Qiao","email":"qiaoliyong@gmail.com","username":"Eli"},"change_message_id":"4b47bca8abe68c6e6d57cbfe53f4d773f3ddf41f","unresolved":false,"context_lines":[{"line_number":111,"context_line":"    compute API\u0027s parameter skip_policy_check to False, that means still"},{"line_number":112,"context_line":"    doing policy checking at compute API layer. It\u0027s because V2 API will be"},{"line_number":113,"context_line":"    depreciated. Before V2 API removed, we needn\u0027t take risk of breaking"},{"line_number":114,"context_line":"    existed code."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"    https://review.openstack.org/#/c/100408/2/nova/compute/api.py"},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"3a961159_ad3f8bd5","line":114,"in_reply_to":"3a961159_3129518a","updated":"2014-12-16 08:22:34.000000000","message":"Done","commit_id":"127d4f7fa5a32adaf26d260c787d15be9c22de9d"},{"author":{"_account_id":9420,"name":"Matthew Gilliard","email":"matthew.gilliard@hp.com","username":"gilliard"},"change_message_id":"d23933cc5ad0c6e48a00bb335dd5481e7aa3e98a","unresolved":false,"context_lines":[{"line_number":146,"context_line":"  For nova-network, move all the policy enforcement into REST API layer from"},{"line_number":147,"context_line":"  network API, and remove the db layer hard-code permission checks."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"  For neutron, we didn\u0027t have too much can do, neutron have his own policy"},{"line_number":150,"context_line":"  enforcement. We just need ensure we have policy enforcement at nova REST"},{"line_number":151,"context_line":"  API layer."},{"line_number":152,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"3a961159_7b3d72dc","line":149,"updated":"2014-12-16 08:18:30.000000000","message":"nit: ...neutron has its own...","commit_id":"127d4f7fa5a32adaf26d260c787d15be9c22de9d"},{"author":{"_account_id":12175,"name":"Eli Qiao","email":"qiaoliyong@gmail.com","username":"Eli"},"change_message_id":"4b47bca8abe68c6e6d57cbfe53f4d773f3ddf41f","unresolved":false,"context_lines":[{"line_number":146,"context_line":"  For nova-network, move all the policy enforcement into REST API layer from"},{"line_number":147,"context_line":"  network API, and remove the db layer hard-code permission checks."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"  For neutron, we didn\u0027t have too much can do, neutron have his own policy"},{"line_number":150,"context_line":"  enforcement. We just need ensure we have policy enforcement at nova REST"},{"line_number":151,"context_line":"  API layer."},{"line_number":152,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"3a961159_4d170755","line":149,"in_reply_to":"3a961159_7b3d72dc","updated":"2014-12-16 08:22:34.000000000","message":"Done","commit_id":"127d4f7fa5a32adaf26d260c787d15be9c22de9d"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"6b95947eb8ec7bea812623c20dd97ebb0bfb5258","unresolved":false,"context_lines":[{"line_number":146,"context_line":"  For nova-network, move all the policy enforcement into REST API layer from"},{"line_number":147,"context_line":"  network API, and remove the db layer hard-code permission checks."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"  For neutron, we didn\u0027t have too much can do, neutron have his own policy"},{"line_number":150,"context_line":"  enforcement. We just need ensure we have policy enforcement at nova REST"},{"line_number":151,"context_line":"  API layer."},{"line_number":152,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"3a961159_8d43af6b","line":149,"in_reply_to":"3a961159_7b3d72dc","updated":"2014-12-16 08:20:31.000000000","message":"Done","commit_id":"127d4f7fa5a32adaf26d260c787d15be9c22de9d"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"cecfc397173e6a4ef8007db1e22d290358c59dd7","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"    https://review.openstack.org/#/c/100408/2/nova/api/openstack/compute/plugins/v3/shelve.py"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"  * For Ec2, We also want to keep backwards compatibility. we will move the"},{"line_number":103,"context_line":"    compute API layer policy checking into REST API layer, the same as"},{"line_number":104,"context_line":"    V2.1 API."},{"line_number":105,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a961159_b0b514d2","line":102,"updated":"2014-12-16 14:19:03.000000000","message":"I feel like this contradicts what is written below about the ec2 policy checks.  Further down it sounds like these policies will be renamed for the ec2 layer so it will not actually be backwards compatible.","commit_id":"8da6992f90c199dca78bfd81db9c543e9acbd676"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"30c255f68247e98d2c4d9ddf913364881a860cfb","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"    https://review.openstack.org/#/c/100408/2/nova/api/openstack/compute/plugins/v3/shelve.py"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"  * For Ec2, We also want to keep backwards compatibility. we will move the"},{"line_number":103,"context_line":"    compute API layer policy checking into REST API layer, the same as"},{"line_number":104,"context_line":"    V2.1 API."},{"line_number":105,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"3a961159_d07d40e9","line":102,"in_reply_to":"3a961159_b0b514d2","updated":"2014-12-16 14:23:57.000000000","message":"oops, sorry, I should remove \u0027We also want to keep backwards compatibility\u0027","commit_id":"8da6992f90c199dca78bfd81db9c543e9acbd676"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"75ab0214fcfe4c8eade23a9d7504e1bc3653e228","unresolved":false,"context_lines":[{"line_number":202,"context_line":"really confuse for developer maintain the old code. And EC2 API is really"},{"line_number":203,"context_line":"small than Nova API, it\u0027s about 29 APIs without volume and image related API"},{"line_number":204,"context_line":"(Those policy will be enforced by cinder and glance). It will affect user"},{"line_number":205,"context_line":"less."},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"The extension will be affect by remove db layer hard-code permission checks"},{"line_number":208,"context_line":"as below:"}],"source_content_type":"text/x-rst","patch_set":16,"id":"3a961159_19ec53c7","line":205,"updated":"2014-12-16 15:33:10.000000000","message":"I think we could keep the backwards compatibility in EC2 for one release, then remove that code the follow release.","commit_id":"9ba95aef77fc7a5d06ef1b73581fd4a6bbcfc5ba"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"5f91791d9709be1dee33b3cbacf106519691c7a9","unresolved":false,"context_lines":[{"line_number":255,"context_line":"* Add parameter to compute and network API to skip policy checks."},{"line_number":256,"context_line":"* Improve the EC2 API policy enforcement"},{"line_number":257,"context_line":"  * Add new policy rules at REST API layer"},{"line_number":258,"context_line":"  * Rename EC2 API rules"},{"line_number":259,"context_line":"  * Move EC2 API rules into separated file."},{"line_number":260,"context_line":"* Improve the V2.1 API policy enforcement"},{"line_number":261,"context_line":"  * Remove compute API and network API layer policy enforcement"}],"source_content_type":"text/x-rst","patch_set":19,"id":"3a961159_c15d4d7b","line":258,"updated":"2014-12-17 14:29:46.000000000","message":"It won\u0027t be renaming EC2 API rules, instead new EC2 API rules will be added.","commit_id":"5578aa72532b35e473038fa44efb09ba3b2a8a99"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"bda88ed90e2d53e3e09036c49906a4f24205761d","unresolved":false,"context_lines":[{"line_number":255,"context_line":"* Add parameter to compute and network API to skip policy checks."},{"line_number":256,"context_line":"* Improve the EC2 API policy enforcement"},{"line_number":257,"context_line":"  * Add new policy rules at REST API layer"},{"line_number":258,"context_line":"  * Rename EC2 API rules"},{"line_number":259,"context_line":"  * Move EC2 API rules into separated file."},{"line_number":260,"context_line":"* Improve the V2.1 API policy enforcement"},{"line_number":261,"context_line":"  * Remove compute API and network API layer policy enforcement"}],"source_content_type":"text/x-rst","patch_set":19,"id":"3a961159_24937ffb","line":258,"in_reply_to":"3a961159_c15d4d7b","updated":"2014-12-17 15:02:27.000000000","message":"yes, you are right","commit_id":"5578aa72532b35e473038fa44efb09ba3b2a8a99"}]}