)]}'
{"specs/kilo/approved/separated-policy-rule-v3-api.rst":[{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"0174c4b979ec2689850392feea34b69d5d4fe780","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"If the deployer have changed default rules for extensions that added"},{"line_number":104,"context_line":"separated in this BP, deployer need update their rules into those new"},{"line_number":105,"context_line":"separated rules."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Developer impact"},{"line_number":108,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baa201ad_a3f7628b","line":105,"updated":"2014-10-13 16:18:53.000000000","message":"We need to give them more help.","commit_id":"831fae7fa4688baddcfd822dd68d92d0b3082cbe"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"cd0a62d1afe7ec720677dc9b440cf9b5bedea225","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"If the deployer have changed default rules for extensions that added"},{"line_number":104,"context_line":"separated in this BP, deployer need update their rules into those new"},{"line_number":105,"context_line":"separated rules."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Developer impact"},{"line_number":108,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_e46769b5","line":105,"in_reply_to":"9aa7fdbe_e9010207","updated":"2014-10-24 08:22:31.000000000","message":"Emm... actually John have concern about that idea will be confuse the policy.d  at https://review.openstack.org/#/c/92325/\n\nAnother way is add default rule as below:\n\n\"compute_extension:v3:os-aggregates\": \"rule:admin_api\",\n\n\"compute_extension:v3:os-aggregates:create\": \"rule:compute_extension:v3:os-aggregates\",\n\n\"compute_extension:v3:os-aggregates:show\": \"rule:compute_extension:v3:os-aggregates\",\n\n\nThen user old policy config will be as below:\n\"compute_extension:v3:os-aggregates\": \"role: aggregate_manager\",\n\nUser put his old policy config in the policy.d directory, it override the default rule \"compute_extension:v3:os-aggregates\": \"rule:admin_api\",","commit_id":"831fae7fa4688baddcfd822dd68d92d0b3082cbe"},{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"3054ea507f5131271053781fafe6cfaa17decbba","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"If the deployer have changed default rules for extensions that added"},{"line_number":104,"context_line":"separated in this BP, deployer need update their rules into those new"},{"line_number":105,"context_line":"separated rules."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Developer impact"},{"line_number":108,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baa201ad_a0ec7fbc","line":105,"in_reply_to":"baa201ad_552396bc","updated":"2014-10-15 05:28:56.000000000","message":"So I think having a policy rule which covers the whole extension with more specific ones overriding it would be very useful. It would also make upgrades where policies are added easier.","commit_id":"831fae7fa4688baddcfd822dd68d92d0b3082cbe"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"5cba6391f285fc8336ea697127d09fe6d7ac1a0c","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"If the deployer have changed default rules for extensions that added"},{"line_number":104,"context_line":"separated in this BP, deployer need update their rules into those new"},{"line_number":105,"context_line":"separated rules."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Developer impact"},{"line_number":108,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_e9010207","line":105,"in_reply_to":"baa201ad_a0ec7fbc","updated":"2014-10-24 08:09:30.000000000","message":"so let me restore that propose.","commit_id":"831fae7fa4688baddcfd822dd68d92d0b3082cbe"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"7a5d1249eecfb4e1c98aa05cec443b93a4599e71","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"If the deployer have changed default rules for extensions that added"},{"line_number":104,"context_line":"separated in this BP, deployer need update their rules into those new"},{"line_number":105,"context_line":"separated rules."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Developer impact"},{"line_number":108,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baa201ad_552396bc","line":105,"in_reply_to":"baa201ad_a3f7628b","updated":"2014-10-15 01:16:59.000000000","message":"There is one way I proposed before https://review.openstack.org/92325, that make this change needn\u0027t update their policy config.\n\nBut actually this spec just for v2.1, I guess nobody use v2.1 yet. So this affect for deployer is very small.","commit_id":"831fae7fa4688baddcfd822dd68d92d0b3082cbe"},{"author":{"_account_id":12175,"name":"Eli Qiao","email":"qiaoliyong@gmail.com","username":"Eli"},"change_message_id":"e241de2b73c6a80091037c530e7e41adcb43dea9","unresolved":false,"context_lines":[{"line_number":60,"context_line":"permission control. And Cloud Operator is easy to know how to write a"},{"line_number":61,"context_line":"policy rule. Because all the policy rule follow the pattern:"},{"line_number":62,"context_line":"[prefix]:[extension_name]:[action_name]"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Alternatives"},{"line_number":65,"context_line":"------------"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_efcb821b","line":63,"updated":"2014-12-04 05:41:39.000000000","message":"it will be more clear what prefix stands for.\nsuch as api_name_prefix or others.\nand a example will be better:\n\n\"os_compute_api:os-lock-server:lock\": \"rule:admin_or_owner\"","commit_id":"abaaa8c56136f24479b89fa49d64d9319343587b"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"d372fbd32e0c77974cc9b73222217420fc5af28e","unresolved":false,"context_lines":[{"line_number":60,"context_line":"permission control. And Cloud Operator is easy to know how to write a"},{"line_number":61,"context_line":"policy rule. Because all the policy rule follow the pattern:"},{"line_number":62,"context_line":"[prefix]:[extension_name]:[action_name]"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Alternatives"},{"line_number":65,"context_line":"------------"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a961159_6718be75","line":63,"in_reply_to":"5a890539_efcb821b","updated":"2014-12-12 07:05:34.000000000","message":"++","commit_id":"abaaa8c56136f24479b89fa49d64d9319343587b"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"db306f367c7876ca6c8bc5c75d2d493d85a889c3","unresolved":false,"context_lines":[{"line_number":60,"context_line":"permission control. And Cloud Operator is easy to know how to write a"},{"line_number":61,"context_line":"policy rule. Because all the policy rule follow the pattern:"},{"line_number":62,"context_line":"[prefix]:[extension_name]:[action_name]"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Alternatives"},{"line_number":65,"context_line":"------------"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a961159_07dffa69","line":63,"in_reply_to":"5a890539_efcb821b","updated":"2014-12-12 06:59:05.000000000","message":"Done","commit_id":"abaaa8c56136f24479b89fa49d64d9319343587b"},{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"7f78531e8c4b3a0276c73456e513315b593a3513","unresolved":false,"context_lines":[{"line_number":105,"context_line":""},{"line_number":106,"context_line":"If the deployer have changed default rules for extensions that added"},{"line_number":107,"context_line":"separated in this BP, deployer need update their rules into those new"},{"line_number":108,"context_line":"separated rules."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Developer impact"},{"line_number":111,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a961159_8162fa3b","line":108,"updated":"2014-12-12 05:36:26.000000000","message":"Unfortunately I think we will have to support one cycle of backwards compatibility. It makes things a bit awkward but a backwards comaptibility library might help?","commit_id":"abaaa8c56136f24479b89fa49d64d9319343587b"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"efb0e874d10bd63b6031eebb47b32d0e17175898","unresolved":false,"context_lines":[{"line_number":105,"context_line":""},{"line_number":106,"context_line":"If the deployer have changed default rules for extensions that added"},{"line_number":107,"context_line":"separated in this BP, deployer need update their rules into those new"},{"line_number":108,"context_line":"separated rules."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Developer impact"},{"line_number":111,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a961159_0779bac7","line":108,"in_reply_to":"3a961159_675d1e15","updated":"2014-12-12 07:46:39.000000000","message":"jichenjc, it\u0027s about this https://review.openstack.org/#/c/92325/","commit_id":"abaaa8c56136f24479b89fa49d64d9319343587b"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"efb0e874d10bd63b6031eebb47b32d0e17175898","unresolved":false,"context_lines":[{"line_number":105,"context_line":""},{"line_number":106,"context_line":"If the deployer have changed default rules for extensions that added"},{"line_number":107,"context_line":"separated in this BP, deployer need update their rules into those new"},{"line_number":108,"context_line":"separated rules."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Developer impact"},{"line_number":111,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a961159_e7474e75","line":108,"in_reply_to":"3a961159_8162fa3b","updated":"2014-12-12 07:46:39.000000000","message":"Chris, I still not quite understand you say \u0027backwards comaptibility library\u0027. And I want to say this is just for v2.1, so we needn\u0027t worry about back-compatibility a lot, does make sense?","commit_id":"abaaa8c56136f24479b89fa49d64d9319343587b"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"4c29eea68841eaa03a3566e6523f5f0b65670371","unresolved":false,"context_lines":[{"line_number":105,"context_line":""},{"line_number":106,"context_line":"If the deployer have changed default rules for extensions that added"},{"line_number":107,"context_line":"separated in this BP, deployer need update their rules into those new"},{"line_number":108,"context_line":"separated rules."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Developer impact"},{"line_number":111,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a961159_acf52d58","line":108,"in_reply_to":"3a961159_8162fa3b","updated":"2014-12-12 06:36:39.000000000","message":"The extension level policy can resolve this, it describe at line 163 at https://review.openstack.org/#/c/138270/8/doc/source/devref/policy_enforcement.rst\n\nBut I\u0027m not sure we land it in K, I think it should be implemented in the oslo first.","commit_id":"abaaa8c56136f24479b89fa49d64d9319343587b"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"db306f367c7876ca6c8bc5c75d2d493d85a889c3","unresolved":false,"context_lines":[{"line_number":105,"context_line":""},{"line_number":106,"context_line":"If the deployer have changed default rules for extensions that added"},{"line_number":107,"context_line":"separated in this BP, deployer need update their rules into those new"},{"line_number":108,"context_line":"separated rules."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Developer impact"},{"line_number":111,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a961159_2795d686","line":108,"in_reply_to":"3a961159_acf52d58","updated":"2014-12-12 06:59:05.000000000","message":"And if we add that into oslo, I think it need more discussion and investigate cross project, it will affect other project also.","commit_id":"abaaa8c56136f24479b89fa49d64d9319343587b"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"d372fbd32e0c77974cc9b73222217420fc5af28e","unresolved":false,"context_lines":[{"line_number":105,"context_line":""},{"line_number":106,"context_line":"If the deployer have changed default rules for extensions that added"},{"line_number":107,"context_line":"separated in this BP, deployer need update their rules into those new"},{"line_number":108,"context_line":"separated rules."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Developer impact"},{"line_number":111,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a961159_675d1e15","line":108,"in_reply_to":"3a961159_acf52d58","updated":"2014-12-12 07:05:34.000000000","message":"Line 163: Enable action level rule override extension level rule\n\nis this the bp we talked before? make a policy.d/xxx to override policy.json? \n\nIf it\u0027s true, I think those info is worthy to be mentioned here","commit_id":"abaaa8c56136f24479b89fa49d64d9319343587b"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"d372fbd32e0c77974cc9b73222217420fc5af28e","unresolved":false,"context_lines":[{"line_number":111,"context_line":"----------------"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"When developer add new extension, developer should provide policy rule"},{"line_number":114,"context_line":"for each API, not share an policy rule for the API in that extension."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"Implementation"},{"line_number":117,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a961159_27aeb6e6","line":114,"updated":"2014-12-12 07:05:34.000000000","message":"s/each API /each action/","commit_id":"abaaa8c56136f24479b89fa49d64d9319343587b"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"efb0e874d10bd63b6031eebb47b32d0e17175898","unresolved":false,"context_lines":[{"line_number":111,"context_line":"----------------"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"When developer add new extension, developer should provide policy rule"},{"line_number":114,"context_line":"for each API, not share an policy rule for the API in that extension."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"Implementation"},{"line_number":117,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a961159_2776b6d7","line":114,"in_reply_to":"3a961159_27aeb6e6","updated":"2014-12-12 07:46:39.000000000","message":"Done","commit_id":"abaaa8c56136f24479b89fa49d64d9319343587b"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"d372fbd32e0c77974cc9b73222217420fc5af28e","unresolved":false,"context_lines":[{"line_number":151,"context_line":"server_metadata"},{"line_number":152,"context_line":"server_password"},{"line_number":153,"context_line":"services"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"Working list:"},{"line_number":156,"context_line":"https://etherpad.openstack.org/p/separated_policy_rule"},{"line_number":157,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a961159_e744ae1c","line":154,"updated":"2014-12-12 07:05:34.000000000","message":"Do we need to bump micro version for each changes we made?","commit_id":"abaaa8c56136f24479b89fa49d64d9319343587b"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"efb0e874d10bd63b6031eebb47b32d0e17175898","unresolved":false,"context_lines":[{"line_number":151,"context_line":"server_metadata"},{"line_number":152,"context_line":"server_password"},{"line_number":153,"context_line":"services"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"Working list:"},{"line_number":156,"context_line":"https://etherpad.openstack.org/p/separated_policy_rule"},{"line_number":157,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a961159_a719c6d8","line":154,"in_reply_to":"3a961159_e744ae1c","updated":"2014-12-12 07:46:39.000000000","message":"I think we needn\u0027t, it isn\u0027t api change","commit_id":"abaaa8c56136f24479b89fa49d64d9319343587b"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"8530dd22c9a80f9c077f13de614105ef89f20253","unresolved":false,"context_lines":[{"line_number":44,"context_line":"delete service."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"2. Confuse for operator and developer, some of extensions have separated"},{"line_number":47,"context_line":"rule for each API, some of them is not."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Project Priority"},{"line_number":50,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_302015f7","line":47,"updated":"2015-01-13 10:34:00.000000000","message":"This should really think about deployer use cases, maybe like this:\n\n 1. restrict a single API action\n 2. restrict the full API extension\n 3. upgrade from kilo to L and easily see what new API rules might be needed\n\nI think given that view of the world, we need to look at actually having some kind of hierarchy.\n\nWe want a default rule for the extension, and all the extensions default to that per extension default.\n\nThat way, the deployer could override either the specific API request, or lock down the full extension.\n\nWhat do you think?","commit_id":"f7d89f264c86545cfec39297eac22ded66161d2c"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"5b8acdcc5419b125fd269ad758fac60ae08a4203","unresolved":false,"context_lines":[{"line_number":44,"context_line":"delete service."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"2. Confuse for operator and developer, some of extensions have separated"},{"line_number":47,"context_line":"rule for each API, some of them is not."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Project Priority"},{"line_number":50,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_bca77f08","line":47,"in_reply_to":"3a961159_302015f7","updated":"2015-01-13 11:56:19.000000000","message":"yes, I already add that in the vision devref https://review.openstack.org/#/c/138270/11/doc/source/devref/policy_enforcement.rst at line 163.\n\nI think that should be implement at oslo. Just didn\u0027t get time to do it yet. I will begin that later.","commit_id":"f7d89f264c86545cfec39297eac22ded66161d2c"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"dd72f1eedf90d9b91e2e903736ca0ab73b2e92c9","unresolved":false,"context_lines":[{"line_number":44,"context_line":"delete service."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"2. Confuse for operator and developer, some of extensions have separated"},{"line_number":47,"context_line":"rule for each API, some of them is not."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Project Priority"},{"line_number":50,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_36211cb6","line":47,"in_reply_to":"3a961159_b808d227","updated":"2015-01-21 15:04:40.000000000","message":"yes, I have one, https://review.openstack.org/#/c/92325/, thinking of moving this into oslo","commit_id":"f7d89f264c86545cfec39297eac22ded66161d2c"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"34a0157d749644ff7a31d73d59dc85195dedde10","unresolved":false,"context_lines":[{"line_number":44,"context_line":"delete service."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"2. Confuse for operator and developer, some of extensions have separated"},{"line_number":47,"context_line":"rule for each API, some of them is not."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Project Priority"},{"line_number":50,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_b808d227","line":47,"in_reply_to":"3a961159_bca77f08","updated":"2015-01-17 00:21:51.000000000","message":"@Alex, I remember you have a bp that an action\u0027s policy can overwrite the API extension\u0027s policy when we first talk about policy separation?","commit_id":"f7d89f264c86545cfec39297eac22ded66161d2c"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"8530dd22c9a80f9c077f13de614105ef89f20253","unresolved":false,"context_lines":[{"line_number":51,"context_line":"The kilo priorities list is currently not defined. However under the"},{"line_number":52,"context_line":"currently proposed list of priorities it would fall under \"User"},{"line_number":53,"context_line":"Experience\" as it significantly increases the ability for us to"},{"line_number":54,"context_line":"improve the Nova API."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Proposed change"},{"line_number":57,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_10687920","line":54,"updated":"2015-01-13 10:34:00.000000000","message":"It is defined now, microversions is there, but this is not really microversions.","commit_id":"f7d89f264c86545cfec39297eac22ded66161d2c"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"5b8acdcc5419b125fd269ad758fac60ae08a4203","unresolved":false,"context_lines":[{"line_number":51,"context_line":"The kilo priorities list is currently not defined. However under the"},{"line_number":52,"context_line":"currently proposed list of priorities it would fall under \"User"},{"line_number":53,"context_line":"Experience\" as it significantly increases the ability for us to"},{"line_number":54,"context_line":"improve the Nova API."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Proposed change"},{"line_number":57,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_b91dd179","line":54,"in_reply_to":"3a961159_10687920","updated":"2015-01-13 11:56:19.000000000","message":"ok, will change this to None.","commit_id":"f7d89f264c86545cfec39297eac22ded66161d2c"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"8530dd22c9a80f9c077f13de614105ef89f20253","unresolved":false,"context_lines":[{"line_number":60,"context_line":"permission control. And Cloud Operator is easy to know how to write a"},{"line_number":61,"context_line":"policy rule. Because all the policy rule follow the pattern:"},{"line_number":62,"context_line":"[prefix]:[extension_name]:[action_name] like"},{"line_number":63,"context_line":"\u0027os_compute_api:os-lock-server:lock\u0027."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Alternatives"},{"line_number":66,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_50984175","line":63,"updated":"2015-01-13 10:34:00.000000000","message":"do we want a version in the prefix like _v2_1 ?","commit_id":"f7d89f264c86545cfec39297eac22ded66161d2c"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"5b8acdcc5419b125fd269ad758fac60ae08a4203","unresolved":false,"context_lines":[{"line_number":60,"context_line":"permission control. And Cloud Operator is easy to know how to write a"},{"line_number":61,"context_line":"policy rule. Because all the policy rule follow the pattern:"},{"line_number":62,"context_line":"[prefix]:[extension_name]:[action_name] like"},{"line_number":63,"context_line":"\u0027os_compute_api:os-lock-server:lock\u0027."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Alternatives"},{"line_number":66,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_b96f91f9","line":63,"in_reply_to":"3a961159_50984175","updated":"2015-01-13 11:56:19.000000000","message":"We can\u0027t have version in the prefix, because we have micro-version now, the version always changing.","commit_id":"f7d89f264c86545cfec39297eac22ded66161d2c"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"8530dd22c9a80f9c077f13de614105ef89f20253","unresolved":false,"context_lines":[{"line_number":114,"context_line":"There will be more configurable API policy rules for the operator. But"},{"line_number":115,"context_line":"the Operator should only make the policy rule more permissive, not to"},{"line_number":116,"context_line":"be more restricted. If the API permission is become more restricted, that"},{"line_number":117,"context_line":"will break back-compatibility."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Developer impact"},{"line_number":120,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_104f99bf","line":117,"updated":"2015-01-13 10:34:00.000000000","message":"I do wonder about keeping the old and new rules to ease the transition, at least for v2.","commit_id":"f7d89f264c86545cfec39297eac22ded66161d2c"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"34a0157d749644ff7a31d73d59dc85195dedde10","unresolved":false,"context_lines":[{"line_number":114,"context_line":"There will be more configurable API policy rules for the operator. But"},{"line_number":115,"context_line":"the Operator should only make the policy rule more permissive, not to"},{"line_number":116,"context_line":"be more restricted. If the API permission is become more restricted, that"},{"line_number":117,"context_line":"will break back-compatibility."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Developer impact"},{"line_number":120,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_55633719","line":117,"in_reply_to":"3a961159_104f99bf","updated":"2015-01-17 00:21:51.000000000","message":"Guess this is bp only for v2.1 , then we won\u0027t affect v2 ?","commit_id":"f7d89f264c86545cfec39297eac22ded66161d2c"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"dd72f1eedf90d9b91e2e903736ca0ab73b2e92c9","unresolved":false,"context_lines":[{"line_number":114,"context_line":"There will be more configurable API policy rules for the operator. But"},{"line_number":115,"context_line":"the Operator should only make the policy rule more permissive, not to"},{"line_number":116,"context_line":"be more restricted. If the API permission is become more restricted, that"},{"line_number":117,"context_line":"will break back-compatibility."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Developer impact"},{"line_number":120,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1a930d6b_d517f54f","line":117,"in_reply_to":"3a961159_55633719","updated":"2015-01-21 15:04:40.000000000","message":"yes, only affect v2.1","commit_id":"f7d89f264c86545cfec39297eac22ded66161d2c"}],"specs/liberty/approved/separated-policy-rule-v3-api.rst":[{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"8f6e9e2949383c6c98e6ef59b2432846ccb6098c","unresolved":false,"context_lines":[{"line_number":32,"context_line":"documentation to mention that how to write a policy rule for each API. But"},{"line_number":33,"context_line":"there are some extensions only have one rule for all the API, and some"},{"line_number":34,"context_line":"extension is not. Cloud operator need to check the source code to know How"},{"line_number":35,"context_line":"to write poliry rule for a specific API."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Use Cases"},{"line_number":38,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3acd31a7_b951a2da","line":35,"updated":"2015-05-04 16:03:00.000000000","message":"s/poliry/policy","commit_id":"170f6ddccaef45b81371d247652285aafd727cc4"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"8e33d4a3601c32be3803119cd62ff026060227c3","unresolved":false,"context_lines":[{"line_number":32,"context_line":"documentation to mention that how to write a policy rule for each API. But"},{"line_number":33,"context_line":"there are some extensions only have one rule for all the API, and some"},{"line_number":34,"context_line":"extension is not. Cloud operator need to check the source code to know How"},{"line_number":35,"context_line":"to write poliry rule for a specific API."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Use Cases"},{"line_number":38,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3acd31a7_99713747","line":35,"in_reply_to":"3acd31a7_b951a2da","updated":"2015-05-05 00:17:10.000000000","message":"Done","commit_id":"170f6ddccaef45b81371d247652285aafd727cc4"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"8f6e9e2949383c6c98e6ef59b2432846ccb6098c","unresolved":false,"context_lines":[{"line_number":118,"context_line":"There will be more configurable API policy rules for the operator. But"},{"line_number":119,"context_line":"the Operator should only make the policy rule more permissive, not to"},{"line_number":120,"context_line":"be more restricted. If the API permission is become more restricted, that"},{"line_number":121,"context_line":"will break back-compatibility."},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"Developer impact"},{"line_number":124,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3acd31a7_d977be38","line":121,"updated":"2015-05-04 16:03:00.000000000","message":"this means we support user to have more right than before\n\ne.g I can\u0027t do something that it can be done \nfor all the users and I now only allow part of them to be used \n\nI am not sure whether we have use case like that \ndo we have a plan to do back-incompatiblie changes? \n\nJust curious...","commit_id":"170f6ddccaef45b81371d247652285aafd727cc4"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"8e33d4a3601c32be3803119cd62ff026060227c3","unresolved":false,"context_lines":[{"line_number":118,"context_line":"There will be more configurable API policy rules for the operator. But"},{"line_number":119,"context_line":"the Operator should only make the policy rule more permissive, not to"},{"line_number":120,"context_line":"be more restricted. If the API permission is become more restricted, that"},{"line_number":121,"context_line":"will break back-compatibility."},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"Developer impact"},{"line_number":124,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3acd31a7_59e4bfdf","line":121,"in_reply_to":"3acd31a7_d977be38","updated":"2015-05-05 00:17:10.000000000","message":"Emm.....maybe the last section at https://github.com/openstack/nova/blob/master/doc/source/devref/policy_enforcement.rst can resolve some of your confuse.","commit_id":"170f6ddccaef45b81371d247652285aafd727cc4"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"8f6e9e2949383c6c98e6ef59b2432846ccb6098c","unresolved":false,"context_lines":[{"line_number":124,"context_line":"----------------"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"When developer add new extension, developer should provide policy rule"},{"line_number":127,"context_line":"for each action, not share an policy rule for the API in that extension."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Implementation"},{"line_number":130,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3acd31a7_d9ae9e84","line":127,"updated":"2015-05-04 16:03:00.000000000","message":"do we need to have a test cases for this ?","commit_id":"170f6ddccaef45b81371d247652285aafd727cc4"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"8e33d4a3601c32be3803119cd62ff026060227c3","unresolved":false,"context_lines":[{"line_number":124,"context_line":"----------------"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"When developer add new extension, developer should provide policy rule"},{"line_number":127,"context_line":"for each action, not share an policy rule for the API in that extension."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Implementation"},{"line_number":130,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3acd31a7_f9fa6b74","line":127,"in_reply_to":"3acd31a7_d9ae9e84","updated":"2015-05-05 00:17:10.000000000","message":"Emm....thinking of how to test it....","commit_id":"170f6ddccaef45b81371d247652285aafd727cc4"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"8f6e9e2949383c6c98e6ef59b2432846ccb6098c","unresolved":false,"context_lines":[{"line_number":163,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"For a cloud deployer, they can set policy rule for each API."},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"References"},{"line_number":168,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":169,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3acd31a7_b9c0822b","line":166,"updated":"2015-05-04 16:03:00.000000000","message":"I think we need to say default policy changes","commit_id":"170f6ddccaef45b81371d247652285aafd727cc4"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"8e33d4a3601c32be3803119cd62ff026060227c3","unresolved":false,"context_lines":[{"line_number":163,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"For a cloud deployer, they can set policy rule for each API."},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"References"},{"line_number":168,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":169,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3acd31a7_b9f07392","line":166,"in_reply_to":"3acd31a7_b9c0822b","updated":"2015-05-05 00:17:10.000000000","message":"Done","commit_id":"170f6ddccaef45b81371d247652285aafd727cc4"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"80963370ba2856ad7e97430909a7f2d729c9597d","unresolved":false,"context_lines":[{"line_number":163,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"For a cloud deployer, they can set policy rule for each API."},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"References"},{"line_number":168,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":169,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3acd31a7_79141b9f","line":166,"in_reply_to":"3acd31a7_b9f07392","updated":"2015-05-05 00:19:53.000000000","message":"I may misunderstand your words, there isn\u0027t any default policy changes?","commit_id":"170f6ddccaef45b81371d247652285aafd727cc4"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"276f7429345c9c2609ab2b2b7515ade034ee26ef","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Add separated policy rule for each v2.1 api"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/separated-policy-rule-v3-api"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"There are different ways to add policy rule for an API in the v2.1 extension."},{"line_number":14,"context_line":"In some extensions, there is only one policy rule for all the APIs in that"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1af86dd1_091424f3","line":11,"updated":"2015-06-12 19:41:32.000000000","message":"The blueprint and spec name should reference v2.1 rather than 3.","commit_id":"7505faa40ed273738c84f3ad9c023c299bc993c4"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"97ce705c6579f3dddc4dda5b7a351833bb735abc","unresolved":false,"context_lines":[{"line_number":113,"context_line":"The propose of propagate enforcement"},{"line_number":114,"context_line":"`https://blueprints.launchpad.net/oslo.policy/+spec/propagate-enforcement`"},{"line_number":115,"context_line":"can help for keeping the policy behavior back-compatible and ease the"},{"line_number":116,"context_line":"workload when operator configure the policy."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"There will be more configurable API policy rules for the operator. But"},{"line_number":119,"context_line":"the Operator should only make the policy rule more permissive, not to"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a016987_e90b1b7c","line":116,"updated":"2015-05-14 13:57:47.000000000","message":"I need update this.  Propagate enforcement involve another upgrade impact. The rule not in policy.json will use default rule before. After enable propagate enforcement, the rule will use the parent level rule. The behavior is changed. This need deployer notice after upgrade.","commit_id":"7505faa40ed273738c84f3ad9c023c299bc993c4"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"33d388388732a71638e76a737ce510417f03a3bd","unresolved":false,"context_lines":[{"line_number":123,"context_line":"Developer impact"},{"line_number":124,"context_line":"----------------"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"When developer add new extension, developer should provide policy rule"},{"line_number":127,"context_line":"for each action, not share an policy rule for the API in that extension."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1aca2d91_9b0f332e","line":126,"updated":"2015-05-07 09:47:48.000000000","message":"I think we need to avoid extension here ...","commit_id":"7505faa40ed273738c84f3ad9c023c299bc993c4"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"97ce705c6579f3dddc4dda5b7a351833bb735abc","unresolved":false,"context_lines":[{"line_number":123,"context_line":"Developer impact"},{"line_number":124,"context_line":"----------------"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"When developer add new extension, developer should provide policy rule"},{"line_number":127,"context_line":"for each action, not share an policy rule for the API in that extension."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a016987_49746ffc","line":126,"in_reply_to":"1aca2d91_9b0f332e","updated":"2015-05-14 13:57:47.000000000","message":"good point, will update thanks","commit_id":"7505faa40ed273738c84f3ad9c023c299bc993c4"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"33d388388732a71638e76a737ce510417f03a3bd","unresolved":false,"context_lines":[{"line_number":155,"context_line":"Testing"},{"line_number":156,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"For unittest, it will add to ensure the policy rule existed and works."},{"line_number":159,"context_line":"For tempest, because of the difficulty of configuring policy in tempest, so it"},{"line_number":160,"context_line":"won\u0027t test in tempest."},{"line_number":161,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"1aca2d91_7be8d710","line":158,"updated":"2015-05-07 09:47:48.000000000","message":"I remember that we have some discussions \nare we able to use functional test for all the policies \nwe listed in etc/nova/policy.conf to make sure they \nexists by default?","commit_id":"7505faa40ed273738c84f3ad9c023c299bc993c4"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"97ce705c6579f3dddc4dda5b7a351833bb735abc","unresolved":false,"context_lines":[{"line_number":155,"context_line":"Testing"},{"line_number":156,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"For unittest, it will add to ensure the policy rule existed and works."},{"line_number":159,"context_line":"For tempest, because of the difficulty of configuring policy in tempest, so it"},{"line_number":160,"context_line":"won\u0027t test in tempest."},{"line_number":161,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a016987_c95e1f76","line":158,"in_reply_to":"1aca2d91_7be8d710","updated":"2015-05-14 13:57:47.000000000","message":"yes, we didn\u0027t have decided where we can test policy.json yet. hope we can get answer from summit","commit_id":"7505faa40ed273738c84f3ad9c023c299bc993c4"}]}