)]}'
{"specs/kilo/approved/the-end-goal-of-api-policy.rst":[{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"69d3c90ad77737edb37bb9f0f1785b6a596f3c8e","unresolved":false,"context_lines":[{"line_number":55,"context_line":"The kilo priorities list is currently not defined. However under the"},{"line_number":56,"context_line":"currently proposed list of priorities it would fall under \"User"},{"line_number":57,"context_line":"Experience\" as it significantly increases the ability for us to"},{"line_number":58,"context_line":"improve the Nova API."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"Proposed change"},{"line_number":61,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_91af5e2b","line":58,"updated":"2014-10-29 23:16:14.000000000","message":"I think thats a bit of a stretch :-)\n\nIt definitely makes life a lot easier for operators though. It will simplify the setting up of policies as well as what needs to be done during upgrades (less merging).","commit_id":"f6a9f63a2a825ad37db3132034622942368c56c1"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"c0f9bf5cb65f92567c503a4ce12c8cf84e02273f","unresolved":false,"context_lines":[{"line_number":55,"context_line":"The kilo priorities list is currently not defined. However under the"},{"line_number":56,"context_line":"currently proposed list of priorities it would fall under \"User"},{"line_number":57,"context_line":"Experience\" as it significantly increases the ability for us to"},{"line_number":58,"context_line":"improve the Nova API."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"Proposed change"},{"line_number":61,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_03487c5a","line":58,"in_reply_to":"7a8c0949_91af5e2b","updated":"2014-10-30 06:14:19.000000000","message":"actually I just copy from your spec :)","commit_id":"f6a9f63a2a825ad37db3132034622942368c56c1"},{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"69d3c90ad77737edb37bb9f0f1785b6a596f3c8e","unresolved":false,"context_lines":[{"line_number":61,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"The generic rule for all the improvement is keep V2 API back-compatible. The"},{"line_number":64,"context_line":"improvement just for EC2 and V2.1 API. Because V2 API may be depreciated after"},{"line_number":65,"context_line":"V2.1 parity with V2. And reduce the risk of broken what we have for now."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"* Enforcement policy at REST API layer and remove hard-code permission"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_11636e1b","line":64,"updated":"2014-10-29 23:16:14.000000000","message":"depreciated -\u003e deprecated","commit_id":"f6a9f63a2a825ad37db3132034622942368c56c1"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"c0f9bf5cb65f92567c503a4ce12c8cf84e02273f","unresolved":false,"context_lines":[{"line_number":61,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"The generic rule for all the improvement is keep V2 API back-compatible. The"},{"line_number":64,"context_line":"improvement just for EC2 and V2.1 API. Because V2 API may be depreciated after"},{"line_number":65,"context_line":"V2.1 parity with V2. And reduce the risk of broken what we have for now."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"* Enforcement policy at REST API layer and remove hard-code permission"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_e34a9054","line":64,"in_reply_to":"7a8c0949_11636e1b","updated":"2014-10-30 06:14:19.000000000","message":"done, thanks","commit_id":"f6a9f63a2a825ad37db3132034622942368c56c1"},{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"69d3c90ad77737edb37bb9f0f1785b6a596f3c8e","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  share some policy enforcement in the compute API layer. So it\u0027s time"},{"line_number":78,"context_line":"  group them. We can provide different prefix in rule name for each API."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  * EC2 API: We name the policy rule as \"ec2_api:[action]\""},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"  * Nova V2 API: After we move to V2.1, we needn\u0027t spend time to change V2"},{"line_number":83,"context_line":"    api rule, and needn\u0027t to bother deployer upgrade their policy config. So"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_91767ed7","line":80,"updated":"2014-10-29 23:16:14.000000000","message":"So this isn\u0027t backwards compatible. We need some definite feedback from operators as to how much pain this will cause and whether they\u0027re willing to endure it to get us to a better place overall.","commit_id":"f6a9f63a2a825ad37db3132034622942368c56c1"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"c0f9bf5cb65f92567c503a4ce12c8cf84e02273f","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  share some policy enforcement in the compute API layer. So it\u0027s time"},{"line_number":78,"context_line":"  group them. We can provide different prefix in rule name for each API."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  * EC2 API: We name the policy rule as \"ec2_api:[action]\""},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"  * Nova V2 API: After we move to V2.1, we needn\u0027t spend time to change V2"},{"line_number":83,"context_line":"    api rule, and needn\u0027t to bother deployer upgrade their policy config. So"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_c364b4e7","line":80,"in_reply_to":"7a8c0949_91767ed7","updated":"2014-10-30 06:14:19.000000000","message":"ok, got it, I will send email to describe this.","commit_id":"f6a9f63a2a825ad37db3132034622942368c56c1"},{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"69d3c90ad77737edb37bb9f0f1785b6a596f3c8e","unresolved":false,"context_lines":[{"line_number":81,"context_line":""},{"line_number":82,"context_line":"  * Nova V2 API: After we move to V2.1, we needn\u0027t spend time to change V2"},{"line_number":83,"context_line":"    api rule, and needn\u0027t to bother deployer upgrade their policy config. So"},{"line_number":84,"context_line":"    just keep V2 API poicy rule named as before."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"  * Nova V2.1 API: We name the policy rule as"},{"line_number":87,"context_line":"    \"os_compute_api:[extension]:[action]\". The core API may be changed in"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_b1737ae6","line":84,"updated":"2014-10-29 23:16:14.000000000","message":"agreed","commit_id":"f6a9f63a2a825ad37db3132034622942368c56c1"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"851cc25df83d6906458f345de158008ab3ec6e22","unresolved":false,"context_lines":[{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/v3-api-policy"},{"line_number":12,"context_line":"https://blueprints.launchpad.net/openstack/?searchtext\u003dseparated-policy-rule-v3-api"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"There are some of ideas and requirements from Icehouse summit to improve"},{"line_number":15,"context_line":"the current nova API policy. This spec aims to provide a full view for the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_2abe8fae","line":12,"updated":"2014-11-24 10:45:08.000000000","message":"I wonder if this is better going into the Nova tree in the devref, rather than a spec like this?\n\nWe really work on one spec for one blueprint.\n\nMaybe we could add this in as a backlog spec, but I think Nova devref to describe our \"vision\" would be better.","commit_id":"1ec0c08d1eea8097bee49ed8ef0ad4f53016beea"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"6d0be205808730cd57b95fd5f0d747bebdcf0b41","unresolved":false,"context_lines":[{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/v3-api-policy"},{"line_number":12,"context_line":"https://blueprints.launchpad.net/openstack/?searchtext\u003dseparated-policy-rule-v3-api"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"There are some of ideas and requirements from Icehouse summit to improve"},{"line_number":15,"context_line":"the current nova API policy. This spec aims to provide a full view for the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_27b2fc48","line":12,"in_reply_to":"5a890539_2abe8fae","updated":"2014-12-02 06:15:09.000000000","message":"ok, got it","commit_id":"1ec0c08d1eea8097bee49ed8ef0ad4f53016beea"},{"author":{"_account_id":9060,"name":"Mike Dorman","email":"dorm@dorm.org","username":"gd-mdorman"},"change_message_id":"fdd418555aedd7d3845f11f8297115b62855dd32","unresolved":false,"context_lines":[{"line_number":39,"context_line":"---------"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"1. Operator want to specified role can access service API, but it\u0027s hard-code"},{"line_number":42,"context_line":"as only admin can operator those API."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"2. One policy rule for one API at REST API layer. Multiple rules in different"},{"line_number":45,"context_line":"layer really confuse the developer and deployer."}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_6e97dd48","line":42,"updated":"2014-11-14 05:09:53.000000000","message":"As an operator, I can confirm this one.  Had just this problem a while back when trying to allow access to an admin-only API call with another role.","commit_id":"1ec0c08d1eea8097bee49ed8ef0ad4f53016beea"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"851cc25df83d6906458f345de158008ab3ec6e22","unresolved":false,"context_lines":[{"line_number":55,"context_line":"The kilo priorities list is currently not defined. However under the"},{"line_number":56,"context_line":"currently proposed list of priorities it would fall under \"User"},{"line_number":57,"context_line":"Experience\" as it significantly increases the ability for us to"},{"line_number":58,"context_line":"improve the Nova API."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"Proposed change"},{"line_number":61,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_4a13dbb7","line":58,"updated":"2014-11-24 10:45:08.000000000","message":"Thats not on the current list. We have API micro versions on there, and this kinda fits in there, if you squint. But I am not sure this can be high priority in kilo.","commit_id":"1ec0c08d1eea8097bee49ed8ef0ad4f53016beea"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"6d0be205808730cd57b95fd5f0d747bebdcf0b41","unresolved":false,"context_lines":[{"line_number":55,"context_line":"The kilo priorities list is currently not defined. However under the"},{"line_number":56,"context_line":"currently proposed list of priorities it would fall under \"User"},{"line_number":57,"context_line":"Experience\" as it significantly increases the ability for us to"},{"line_number":58,"context_line":"improve the Nova API."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"Proposed change"},{"line_number":61,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_873f3086","line":58,"in_reply_to":"5a890539_4a13dbb7","updated":"2014-12-02 06:15:09.000000000","message":"I understand that. Actually I never didn\u0027t expect it high priority. But this is something come from Icehouse, and there are some complain about policy at Atlanta...","commit_id":"1ec0c08d1eea8097bee49ed8ef0ad4f53016beea"},{"author":{"_account_id":9060,"name":"Mike Dorman","email":"dorm@dorm.org","username":"gd-mdorman"},"change_message_id":"35cc858905efd37badb87f827daea01748bb9aae","unresolved":false,"context_lines":[{"line_number":70,"context_line":"  Remove the permission checking from low layers of nova. This make"},{"line_number":71,"context_line":"  better usability for API policy. The detail describes at:"},{"line_number":72,"context_line":"  https://review.openstack.org/127160"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"* Use different prefix in policy rule name for EC2/V2/V2.1 API."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"  After move all the policy into REST API layer, then all the API won\u0027t"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_0ef65963","line":73,"updated":"2014-11-14 05:11:55.000000000","message":"Totally agree with this.  Hard coded permissions checks are confusing and non-obvious when you expect policy.json to be authoritative.","commit_id":"1ec0c08d1eea8097bee49ed8ef0ad4f53016beea"},{"author":{"_account_id":9060,"name":"Mike Dorman","email":"dorm@dorm.org","username":"gd-mdorman"},"change_message_id":"35cc858905efd37badb87f827daea01748bb9aae","unresolved":false,"context_lines":[{"line_number":97,"context_line":"  When nova default policy config changed, deployer only need replace default"},{"line_number":98,"context_line":"  policy config files with new one. It won\u0027t affect his own policy config in"},{"line_number":99,"context_line":"  other files."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"* Group the policy rules into different policy files."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"  After support policy.d we can separated the policy rules as separated"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_4eece18f","line":100,"updated":"2014-11-14 05:11:55.000000000","message":"Much prefer the policy.d model to the single policy.json file.","commit_id":"1ec0c08d1eea8097bee49ed8ef0ad4f53016beea"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"851cc25df83d6906458f345de158008ab3ec6e22","unresolved":false,"context_lines":[{"line_number":116,"context_line":"  * policy.d/00-v2-api.conf: It contains all the policy rules for nova V2 API."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"  * policy.d/00-v2.1-api.conf: It contains all the policy rules for nova v2.1"},{"line_number":119,"context_line":"    API."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"* Add separated rule for each API in extension."},{"line_number":122,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_4a32fb10","line":119,"updated":"2014-11-24 10:45:08.000000000","message":"I think its more important that users can add additional policy files to do the override.\n\nIn addition, I think we want the ability to have a \"rule\" for each extension, so you can override something for all actions on that extension, or just override a specific bit of that extension.","commit_id":"1ec0c08d1eea8097bee49ed8ef0ad4f53016beea"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"6d0be205808730cd57b95fd5f0d747bebdcf0b41","unresolved":false,"context_lines":[{"line_number":116,"context_line":"  * policy.d/00-v2-api.conf: It contains all the policy rules for nova V2 API."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"  * policy.d/00-v2.1-api.conf: It contains all the policy rules for nova v2.1"},{"line_number":119,"context_line":"    API."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"* Add separated rule for each API in extension."},{"line_number":122,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_2b716377","line":119,"in_reply_to":"5a890539_4a32fb10","updated":"2014-12-02 06:15:09.000000000","message":"ok, I will think about it. But that may need push into oslo first?","commit_id":"1ec0c08d1eea8097bee49ed8ef0ad4f53016beea"}]}