)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"192e8bf03612e538fd29e56940ad525cadea28d0","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"https://blueprints.launchpad.net/nova/+spec/discoverable-policy-api"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Not all users have the same set of priviledges. Not all API endpoints are"},{"line_number":12,"context_line":"enabled. Because of this, adding an API endpoint that lists the operations"},{"line_number":13,"context_line":"an user is allowed to use can be helpful."},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1a122d0e_31c805a8","line":11,"range":{"start_line":11,"start_character":35,"end_line":11,"end_character":46},"updated":"2016-04-21 09:43:26.000000000","message":"nit: check your privilege","commit_id":"156a6f60b2392993f7bf3e3cca0916a02d3a0023"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"deb5df7e35f6c3a7dc25eea222dac98919b01d19","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"https://blueprints.launchpad.net/nova/+spec/discoverable-policy-api"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Not all users have the same set of priviledges. Not all API endpoints"},{"line_number":12,"context_line":"are enabled. Because of this, adding an API endpoint that lists the"},{"line_number":13,"context_line":"operations an user is allowed to use can be helpful. This spec"},{"line_number":14,"context_line":"describes phase one of a two phased implementation. The first phase"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"1a122d0e_b17507fb","line":11,"range":{"start_line":11,"start_character":35,"end_line":11,"end_character":46},"updated":"2016-04-29 12:10:24.000000000","message":"nit","commit_id":"2ab8e0019ec2cb49e3a8395fa19e92e00002d4c6"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"b7d522b6ee2ee43ebd10a8ef696c117731c7d9bc","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"https://blueprints.launchpad.net/nova/+spec/discoverable-policy-api"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Not all users have the same set of priviledges. Not all API endpoints"},{"line_number":12,"context_line":"are enabled. Because of this, adding an API endpoint that lists the"},{"line_number":13,"context_line":"operations an user is allowed to use can be helpful. This spec"},{"line_number":14,"context_line":"describes phase one of a two phased implementation. The first phase"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"1a122d0e_6ce4360c","line":11,"in_reply_to":"1a122d0e_b17507fb","updated":"2016-04-29 12:39:23.000000000","message":"Done","commit_id":"2ab8e0019ec2cb49e3a8395fa19e92e00002d4c6"}],"specs/newton/approved/discoverable-policy-api.rst":[{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"1d4af8dede5151dbc22f5e9c31324d22c0a5e735","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Nova discoverable policy API"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/discoverable-policy-api"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Not all users have the same set of priviledges. Not all API endpoints are"},{"line_number":14,"context_line":"enabled. Because of this, adding an API endpoint that lists the operations an"}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa0719c6_3cf35d75","line":11,"range":{"start_line":11,"start_character":44,"end_line":11,"end_character":56},"updated":"2016-03-21 14:12:17.000000000","message":"seems discoverable can be changed to get-policy-setting-api or similar?","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"acd2e291e7f96146e9856b460839f80aa6dd9804","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Nova discoverable policy API"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/discoverable-policy-api"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Not all users have the same set of priviledges. Not all API endpoints are"},{"line_number":14,"context_line":"enabled. Because of this, adding an API endpoint that lists the operations an"}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa0719c6_9fca5ba0","line":11,"range":{"start_line":11,"start_character":44,"end_line":11,"end_character":56},"in_reply_to":"fa0719c6_3cf35d75","updated":"2016-03-21 14:30:20.000000000","message":"Sure, can do.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"afaeb8505789f4d271f7fe647e062a09e42ee495","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/discoverable-policy-api"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Not all users have the same set of priviledges. Not all API endpoints are"},{"line_number":14,"context_line":"enabled. Because of this, adding an API endpoint that lists the operations an"},{"line_number":15,"context_line":"user is allowed to use can be helpful."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_90b1164a","line":14,"range":{"start_line":13,"start_character":48,"end_line":14,"end_character":7},"updated":"2016-03-31 14:01:16.000000000","message":"the ability to turn endpoints off is deprecated now.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"23f7086efbb42caddee0e2e8f8634c54f0feda6f","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/discoverable-policy-api"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Not all users have the same set of priviledges. Not all API endpoints are"},{"line_number":14,"context_line":"enabled. Because of this, adding an API endpoint that lists the operations an"},{"line_number":15,"context_line":"user is allowed to use can be helpful."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_f61327b6","line":14,"range":{"start_line":13,"start_character":48,"end_line":14,"end_character":7},"in_reply_to":"ba0121b8_90b1164a","updated":"2016-03-31 15:55:44.000000000","message":"Done","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"afaeb8505789f4d271f7fe647e062a09e42ee495","unresolved":false,"context_lines":[{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Currently, users have no direct way of knowing which APIs they are allowed to"},{"line_number":21,"context_line":"use or which APIs are enabled by policy. This spec will add an API endpoint"},{"line_number":22,"context_line":"that will return a list of available APIs and operations usable by the user."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Use Cases"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_f0e332d7","line":21,"updated":"2016-03-31 14:01:16.000000000","message":"what about things that are not possible due to your technology choice?\n\nI guess we should be clear this is only things disabled by policy, not a statement on a specific server or flavor an what is possible. Thats a separate problem.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"5c3da8a82a49db3c710cd3324584af874baf581b","unresolved":false,"context_lines":[{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Currently, users have no direct way of knowing which APIs they are allowed to"},{"line_number":21,"context_line":"use or which APIs are enabled by policy. This spec will add an API endpoint"},{"line_number":22,"context_line":"that will return a list of available APIs and operations usable by the user."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Use Cases"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a122d0e_d9ba536e","line":21,"in_reply_to":"ba0121b8_6ccc6a6a","updated":"2016-04-15 11:49:56.000000000","message":"I am wondering if this still applies. In the last nova-api meeting, we\u0027ve decided that this new API should pretty much just tell us what policies we\u0027re passing. I don\u0027t think our technology choises should be reflected on the new API\u0027s returned data.\n\nhttp://eavesdrop.openstack.org/meetings/nova_api/2016/nova_api.2016-04-13-13.00.log.html","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"23f7086efbb42caddee0e2e8f8634c54f0feda6f","unresolved":false,"context_lines":[{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Currently, users have no direct way of knowing which APIs they are allowed to"},{"line_number":21,"context_line":"use or which APIs are enabled by policy. This spec will add an API endpoint"},{"line_number":22,"context_line":"that will return a list of available APIs and operations usable by the user."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Use Cases"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_6ccc6a6a","line":21,"in_reply_to":"ba0121b8_f0e332d7","updated":"2016-03-31 15:55:44.000000000","message":"Do you mean that some operations not being possible, like live-resize (can\u0027t be done on older hypervisors)? \n\nI guess this can be tied to the HostCapabilities: check whether there are compute_nodes with os_live_resize capability.\n\nindeed, this is something that should be addressed. I\u0027m thinking that we should cache the result (+ reasonable cache timeout) for certain capabilities like live-resize. It is unnecessary to query all the compute nodes every single time to check for them.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"afaeb8505789f4d271f7fe647e062a09e42ee495","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Currently, users have no direct way of knowing which APIs they are allowed to"},{"line_number":21,"context_line":"use or which APIs are enabled by policy. This spec will add an API endpoint"},{"line_number":22,"context_line":"that will return a list of available APIs and operations usable by the user."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Use Cases"},{"line_number":25,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_70e60216","line":22,"updated":"2016-03-31 14:01:16.000000000","message":"So I think we are missing a bit here:\n\nAPI users should know what the policy means without reading the source code.\n\nOperators should be know how the API policies map to the configuration options they are allowed to change.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"5c3da8a82a49db3c710cd3324584af874baf581b","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Currently, users have no direct way of knowing which APIs they are allowed to"},{"line_number":21,"context_line":"use or which APIs are enabled by policy. This spec will add an API endpoint"},{"line_number":22,"context_line":"that will return a list of available APIs and operations usable by the user."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Use Cases"},{"line_number":25,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a122d0e_1c10394e","line":22,"in_reply_to":"ba0121b8_6cb2aa95","updated":"2016-04-15 11:49:56.000000000","message":"we\u0027re going to limit this API to just passing policies. The list of available / passing APIs should be a new API on it\u0027s own, IMO.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"23f7086efbb42caddee0e2e8f8634c54f0feda6f","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Currently, users have no direct way of knowing which APIs they are allowed to"},{"line_number":21,"context_line":"use or which APIs are enabled by policy. This spec will add an API endpoint"},{"line_number":22,"context_line":"that will return a list of available APIs and operations usable by the user."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Use Cases"},{"line_number":25,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_6cb2aa95","line":22,"in_reply_to":"ba0121b8_70e60216","updated":"2016-03-31 15:55:44.000000000","message":"True, we\u0027ll have to make a doc for them.\n\nAs for the Operators part, I\u0027m not sure I follow.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"afaeb8505789f4d271f7fe647e062a09e42ee495","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Proposed change"},{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"The discoverable policy will be exposed through the ``os-policy`` API endpoint."},{"line_number":35,"context_line":"For this, an API Controller will have to be created, as well as the"},{"line_number":36,"context_line":"python-novaclient implementation and tempest test for it."},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_d0e54e38","line":34,"range":{"start_line":34,"start_character":54,"end_line":34,"end_character":57},"updated":"2016-03-31 14:01:16.000000000","message":"I thought we could just go for /policy now, to match /servers","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"23f7086efbb42caddee0e2e8f8634c54f0feda6f","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Proposed change"},{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"The discoverable policy will be exposed through the ``os-policy`` API endpoint."},{"line_number":35,"context_line":"For this, an API Controller will have to be created, as well as the"},{"line_number":36,"context_line":"python-novaclient implementation and tempest test for it."},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_7679d7c7","line":34,"range":{"start_line":34,"start_character":54,"end_line":34,"end_character":57},"in_reply_to":"ba0121b8_d0e54e38","updated":"2016-03-31 15:55:44.000000000","message":"Done","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"afaeb8505789f4d271f7fe647e062a09e42ee495","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"The API will return a list of operations currently available to the requesting"},{"line_number":39,"context_line":"user. It cannot be used to determine the list of available operations usable"},{"line_number":40,"context_line":"by other users."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"The returned operations will have to fulfill the following criteria:"},{"line_number":43,"context_line":"* The requesting user will pass the operation\u0027s policy rule. For example, if"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_d06a6e80","line":40,"updated":"2016-03-31 14:01:16.000000000","message":"Honestly, I would rather we had a list with True/False values, so every user gets the same response. It seems cleaner.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"87ce08f83da812d6556ee18b84d7ef0bc87accfb","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"The API will return a list of operations currently available to the requesting"},{"line_number":39,"context_line":"user. It cannot be used to determine the list of available operations usable"},{"line_number":40,"context_line":"by other users."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"The returned operations will have to fulfill the following criteria:"},{"line_number":43,"context_line":"* The requesting user will pass the operation\u0027s policy rule. For example, if"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a061dce_44ac3d35","line":40,"in_reply_to":"ba0121b8_113ea5d9","updated":"2016-04-05 17:15:31.000000000","message":"While it may be cleaner to return everything for every user I don\u0027t see the advantage. It\u0027s easy enough to assume that not returned capabilities are False, and a much smaller payload in some cases.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"23f7086efbb42caddee0e2e8f8634c54f0feda6f","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"The API will return a list of operations currently available to the requesting"},{"line_number":39,"context_line":"user. It cannot be used to determine the list of available operations usable"},{"line_number":40,"context_line":"by other users."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"The returned operations will have to fulfill the following criteria:"},{"line_number":43,"context_line":"* The requesting user will pass the operation\u0027s policy rule. For example, if"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_113ea5d9","line":40,"in_reply_to":"ba0121b8_d06a6e80","updated":"2016-03-31 15:55:44.000000000","message":"yeah, sounds good. Although, there\u0027s one small item that is debatable: whether the False values are worth returning.\n\none one side, returning capabilities with False values can avoid certain confusions, like \"Why can\u0027t I find the X capability?\"\n\non the other side, depending on how atomic the capabilities are, we can end up reporting hundreds of capabilities, which can be a burden to look through. Sure, grep is an option, but still..\n\nI propose that we only return the \"True\" capabilities by default, unless the user passes in some --all flag.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"a541cf2e09656d2d29d1e04108a052e3d4c90872","unresolved":false,"context_lines":[{"line_number":52,"context_line":"Alternatives"},{"line_number":53,"context_line":"------------"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"None"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Data model impact"},{"line_number":58,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a061dce_5e644fe4","line":55,"updated":"2016-04-08 13:55:11.000000000","message":"JSON home is an interesting alternative.\n\nIt could only list API endpoints and actions that are available to the user requesting the JSON home info.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"f5948149228f6f8fe53165a6de0d76b32d16ebcd","unresolved":false,"context_lines":[{"line_number":52,"context_line":"Alternatives"},{"line_number":53,"context_line":"------------"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"None"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Data model impact"},{"line_number":58,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a061dce_f3c3b588","line":55,"in_reply_to":"9a061dce_5e644fe4","updated":"2016-04-10 07:18:24.000000000","message":"I much prefer this John\u0027s alternative idea.\nThis seems more standard/generic way to notify what is available APIs for each user.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"1d4af8dede5151dbc22f5e9c31324d22c0a5e735","unresolved":false,"context_lines":[{"line_number":62,"context_line":"REST API impact"},{"line_number":63,"context_line":"---------------"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"The discoverable policy will be exposed through the ``os-policy`` API. The"},{"line_number":66,"context_line":"expected response codes are:"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"* 200 OK, if the request succeeded."}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa0719c6_fcef25ae","line":65,"range":{"start_line":65,"start_character":57,"end_line":65,"end_character":63},"updated":"2016-03-21 14:12:17.000000000","message":"looks like microversion is needed","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"acd2e291e7f96146e9856b460839f80aa6dd9804","unresolved":false,"context_lines":[{"line_number":62,"context_line":"REST API impact"},{"line_number":63,"context_line":"---------------"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"The discoverable policy will be exposed through the ``os-policy`` API. The"},{"line_number":66,"context_line":"expected response codes are:"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"* 200 OK, if the request succeeded."}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa0719c6_bf48ff2e","line":65,"range":{"start_line":65,"start_character":57,"end_line":65,"end_character":63},"in_reply_to":"fa0719c6_fcef25ae","updated":"2016-03-21 14:30:20.000000000","message":"Yeah, forgot to mention it.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"afaeb8505789f4d271f7fe647e062a09e42ee495","unresolved":false,"context_lines":[{"line_number":66,"context_line":"expected response codes are:"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"* 200 OK, if the request succeeded."},{"line_number":69,"context_line":"* 401 Unauthorized, if the user is not authorized to use the ``os-policy`` API."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"The data returned from the ``os-policy`` API will be as follows:"},{"line_number":72,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_d0c6ee66","line":69,"updated":"2016-03-31 14:01:16.000000000","message":"I am not sure we can have a policy about being able to check your policy, I think we want everyone to be able to check their policy.\n\nBut the keystone middleware could generate a 401","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"23f7086efbb42caddee0e2e8f8634c54f0feda6f","unresolved":false,"context_lines":[{"line_number":66,"context_line":"expected response codes are:"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"* 200 OK, if the request succeeded."},{"line_number":69,"context_line":"* 401 Unauthorized, if the user is not authorized to use the ``os-policy`` API."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"The data returned from the ``os-policy`` API will be as follows:"},{"line_number":72,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_b11ed9b8","line":69,"in_reply_to":"ba0121b8_d0c6ee66","updated":"2016-03-31 15:55:44.000000000","message":"\"Oh, you want to check your policy? Too bad, you don\u0027t have the policy to do that.\" - That would be an excellent error message. :D\n\nBut yeah, makes sense.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"7f1742aec144361a40310bbb602492d257c977c6","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"The data returned from the ``os-policy`` API will be as follows:"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"`GET /os-policy/`"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Response body::"},{"line_number":76,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1af94dfe_f771490d","line":73,"updated":"2016-03-18 19:44:41.000000000","message":"we should call it /policy","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"acd2e291e7f96146e9856b460839f80aa6dd9804","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"The data returned from the ``os-policy`` API will be as follows:"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"`GET /os-policy/`"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Response body::"},{"line_number":76,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa0719c6_7e6af01b","line":73,"in_reply_to":"1af94dfe_f771490d","updated":"2016-03-21 14:30:20.000000000","message":"Done","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"afaeb8505789f4d271f7fe647e062a09e42ee495","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"  {"},{"line_number":78,"context_line":"      \"policy\": {"},{"line_number":79,"context_line":"          \"operations\": ["},{"line_number":80,"context_line":"              \"os_compute_api:os-policy:index\","},{"line_number":81,"context_line":"              \"os_compute_api:os-quota-sets:show\","},{"line_number":82,"context_line":"              ..."}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_f03212a6","line":79,"range":{"start_line":79,"start_character":11,"end_line":79,"end_character":21},"updated":"2016-03-31 14:01:16.000000000","message":"maybe capabilities? \n\nI would prefer a dict of policies with True/False for each rule.\n\nThat feels a more well defined API.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"5c3da8a82a49db3c710cd3324584af874baf581b","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"  {"},{"line_number":78,"context_line":"      \"policy\": {"},{"line_number":79,"context_line":"          \"operations\": ["},{"line_number":80,"context_line":"              \"os_compute_api:os-policy:index\","},{"line_number":81,"context_line":"              \"os_compute_api:os-quota-sets:show\","},{"line_number":82,"context_line":"              ..."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a122d0e_5cbbd10e","line":79,"range":{"start_line":79,"start_character":11,"end_line":79,"end_character":21},"in_reply_to":"9a061dce_7f190879","updated":"2016-04-15 11:49:56.000000000","message":"since we\u0027re pretty much going to return passing policy rules, I think something like this is more appropriate:\n\n    {\n        \"policy\": {\n            \"rules\": {\n                 ...\n             }\n        }\n    }","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"87ce08f83da812d6556ee18b84d7ef0bc87accfb","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"  {"},{"line_number":78,"context_line":"      \"policy\": {"},{"line_number":79,"context_line":"          \"operations\": ["},{"line_number":80,"context_line":"              \"os_compute_api:os-policy:index\","},{"line_number":81,"context_line":"              \"os_compute_api:os-quota-sets:show\","},{"line_number":82,"context_line":"              ..."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a061dce_7f190879","line":79,"range":{"start_line":79,"start_character":11,"end_line":79,"end_character":21},"in_reply_to":"ba0121b8_d150ad34","updated":"2016-04-05 17:15:31.000000000","message":"Semantically \n\n    {\u0027policy1\u0027: True, \u0027policy2\u0027: False, \u0027policy3\u0027: False}\n\nis equivalent to \n\n    [\u0027policy1\u0027]\n\nwhile the latter is much more compact and I don\u0027t think it\u0027s any more difficult to parse. The client needs to have a full list of capabilities already so there\u0027s not a discoverability concern here. So why provide False entries?","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"23f7086efbb42caddee0e2e8f8634c54f0feda6f","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"  {"},{"line_number":78,"context_line":"      \"policy\": {"},{"line_number":79,"context_line":"          \"operations\": ["},{"line_number":80,"context_line":"              \"os_compute_api:os-policy:index\","},{"line_number":81,"context_line":"              \"os_compute_api:os-quota-sets:show\","},{"line_number":82,"context_line":"              ..."}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_d150ad34","line":79,"range":{"start_line":79,"start_character":11,"end_line":79,"end_character":21},"in_reply_to":"ba0121b8_f03212a6","updated":"2016-03-31 15:55:44.000000000","message":"Done","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"afaeb8505789f4d271f7fe647e062a09e42ee495","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  {"},{"line_number":78,"context_line":"      \"policy\": {"},{"line_number":79,"context_line":"          \"operations\": ["},{"line_number":80,"context_line":"              \"os_compute_api:os-policy:index\","},{"line_number":81,"context_line":"              \"os_compute_api:os-quota-sets:show\","},{"line_number":82,"context_line":"              ..."},{"line_number":83,"context_line":"          ]"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_50ae5e81","line":80,"updated":"2016-03-31 14:01:16.000000000","message":"so here is the rub, I think this version of the API needs to defined exactly what \"operations\" are possible in this list.\n\nThis is the hard part of this spec, working out how to represent these, and document them against the API calls they relate to, and the configuration options the user has, without reading the code base.\n\nI suspect we get things like:\n\n* os_compute_api:network (includes attach/detach port, etc)\n* os_compute_api:volume (include attach/detach volume)","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"4d72e0140c472d50fdf96e0488afe4bedc268211","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  {"},{"line_number":78,"context_line":"      \"policy\": {"},{"line_number":79,"context_line":"          \"operations\": ["},{"line_number":80,"context_line":"              \"os_compute_api:os-policy:index\","},{"line_number":81,"context_line":"              \"os_compute_api:os-quota-sets:show\","},{"line_number":82,"context_line":"              ..."},{"line_number":83,"context_line":"          ]"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a1b2928_93bef3fd","line":80,"in_reply_to":"7a1b2928_3dced05a","updated":"2016-04-11 07:04:58.000000000","message":"Just a small update, it turns out a tuple like (HTTP_ACTION, URL, DETAILS) is not enough. We also have to include HTTP_BODY in there, somehow, so it will be: (HTTP_ACTION, URL, HTTP_BODY, DETAILS)\n\nI have to make the distinction between HTTP_BODY and DETAILS.\nA lot of actions work as follows:\n\n    POST /servers/%(id)s/action {\u0027action_name\u0027: null}\n\nBasically, the action that is to be executed is passed in the HTTP_BODY. And no, this doesn\u0027t work:\n\n    POST /servers/%(id)s/action_name\n\n, although, I have no idea why it shouldn\u0027t. This just makes things harder overall. Can we add some changes so that the above also works? IMO, it makes a lot more sense and it\u0027s cleaner (separate blueprint, ofc).\n\nAs for DETAILS, as I\u0027ve mentioned in my previous comment, it can be used to specify extra permissions for some operations (e.g. creating instances + volumes attached).","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"cd3e67f698656377c7be3b1547a52e758028d257","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  {"},{"line_number":78,"context_line":"      \"policy\": {"},{"line_number":79,"context_line":"          \"operations\": ["},{"line_number":80,"context_line":"              \"os_compute_api:os-policy:index\","},{"line_number":81,"context_line":"              \"os_compute_api:os-quota-sets:show\","},{"line_number":82,"context_line":"              ..."},{"line_number":83,"context_line":"          ]"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a1b2928_ce6547e2","line":80,"in_reply_to":"7a1b2928_7a79582f","updated":"2016-04-11 14:34:28.000000000","message":"It would be nice to be able to collapse HTTP_BODY and DETAILS into the same thing. I think to a large extent they\u0027re the same, but there\u0027s a distinction we need to make with the checks. Taking some of the examples above:\n\ncreate:attach_network and create:forced_host can be checked based on the presence of that information in the HTTP body. create:attach_volume can\u0027t because the API doesn\u0027t know if the block device passed in is a volume or an image so further resolution is necessary before making a decision. However, that information is only necessary for Nova to do the policy check, from a user point of view it may be enough to say that the HTTP_BODY can\u0027t contain a volume if create:attach_volume fails the policy check.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"782718a2d5834d3694bf82393368bb800e699342","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  {"},{"line_number":78,"context_line":"      \"policy\": {"},{"line_number":79,"context_line":"          \"operations\": ["},{"line_number":80,"context_line":"              \"os_compute_api:os-policy:index\","},{"line_number":81,"context_line":"              \"os_compute_api:os-quota-sets:show\","},{"line_number":82,"context_line":"              ..."},{"line_number":83,"context_line":"          ]"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a1b2928_e1b93f30","line":80,"in_reply_to":"7a1b2928_93bef3fd","updated":"2016-04-11 12:11:11.000000000","message":"is HTTP_BODY and DETAILS both act like body? \nthe actions in above sample only accept body and no detail needed (http://developer.openstack.org/api-ref-compute-v2.1.html) ?\n\nmaybe the /action is used for easy extend of supported actions , no need to add resource, just update request body is fine, if we need to change, guess that\u0027s a big change","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"5c3da8a82a49db3c710cd3324584af874baf581b","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  {"},{"line_number":78,"context_line":"      \"policy\": {"},{"line_number":79,"context_line":"          \"operations\": ["},{"line_number":80,"context_line":"              \"os_compute_api:os-policy:index\","},{"line_number":81,"context_line":"              \"os_compute_api:os-quota-sets:show\","},{"line_number":82,"context_line":"              ..."},{"line_number":83,"context_line":"          ]"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a122d0e_1cf5d982","line":80,"in_reply_to":"7a1b2928_ce6547e2","updated":"2016-04-15 11:49:56.000000000","message":"In the nova-api meeting [1], we\u0027ve decided to have this API simply return the list of passing policies. Still, the idea of listing the available endpoints to a user is a good idea (based on policies, technology choices, etc.) and we should still do it. We\u0027ll have to propose a spec for it. This is a bit challenging at the moment, since not all policy rules names match the API endpoint names. Those policies will be aliased in the future, after Alaski\u0027s blueprint, which will solve this issue.\n\n[1] http://eavesdrop.openstack.org/meetings/nova_api/2016/nova_api.2016-04-13-13.00.log.html","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"ef72a5182e59c3059dbcb3a4377b664eaef1e064","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  {"},{"line_number":78,"context_line":"      \"policy\": {"},{"line_number":79,"context_line":"          \"operations\": ["},{"line_number":80,"context_line":"              \"os_compute_api:os-policy:index\","},{"line_number":81,"context_line":"              \"os_compute_api:os-quota-sets:show\","},{"line_number":82,"context_line":"              ..."},{"line_number":83,"context_line":"          ]"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a1b2928_7a79582f","line":80,"in_reply_to":"7a1b2928_e1b93f30","updated":"2016-04-11 13:06:06.000000000","message":"HTTP_BODY and DETAILS are not the same thing, HTTP_BODY will be some json data that will have to be sent by the user in order to use a specific API. For example, if a user wants to stop a VM, they will have to call the /servers/%(id)s/action API with the HTTP_BODY: {\"os-stop\": null}.\n\nBasically, it will be something like this:\n\n    POST /servers/%(id)s/action {\"confirmResize\": null}\n    POST /servers/%(id)s/action {\"restore\": null}\n    POST /servers/%(id)s/action {\"resume\": null}\n    POST /servers/%(id)s/action {\"removeSecurityGroup\": { \"name\": \"default\"}}\n    ...\n\nAs for DETAILS, they will contain simple, useful information for the user (e.g. extra permissions on an API). For example, the following rules in the policy.json file:\n\n    \"os_compute_api:servers:create\": \"rule:admin_or_owner\",\n    \"os_compute_api:servers:create:attach_network\": \"rule:admin_or_owner\",\n    \"os_compute_api:servers:create:attach_volume\": \"rule:admin_or_owner\",\n    \"os_compute_api:servers:create:forced_host\": \"rule:admin_api\",\n\nare all related to the instance creation API, but the last 3 represent extra priviledges during creation. For example, a normal user may create a server (passes the 1st rule), but he cannot force the host on which it will be spawned (fails 4th rule).","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"7239b99f53016ff25251b95d70b5293d3df2b17d","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  {"},{"line_number":78,"context_line":"      \"policy\": {"},{"line_number":79,"context_line":"          \"operations\": ["},{"line_number":80,"context_line":"              \"os_compute_api:os-policy:index\","},{"line_number":81,"context_line":"              \"os_compute_api:os-quota-sets:show\","},{"line_number":82,"context_line":"              ..."},{"line_number":83,"context_line":"          ]"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a061dce_d5ebd0ae","line":80,"in_reply_to":"9a061dce_3b5203de","updated":"2016-04-05 19:25:17.000000000","message":"@Alex: I think it makes sense for /servers/{id}/policy and maybe for some other APIs as well. For example, this might be useful for some instances, to see what you can do with it, some of the operations might not be allowed because of certain limitations (live-resize - host / guest doesn\u0027t support it, etc.). \n\nFor other APIs, not really sure it\u0027s worth it, if we are to do it for every API, it would end up being very large and not particularly useful.\n\n@Andrew, Yeah, I think this is a good choice. Users will receive the endpoints available to him, he won\u0027t have to know what those policy rules mean and / or what they map to.\n\nI\u0027m not really sure how to figure out the HTTP_ACTION per endpoint at the moment, but for the rest, seems pretty nice. It seems that DETAILS can map to certain extra capabilities for that endpoint (e.g. create instance with volume attached).\n\nStill some questions though.\n\nlet\u0027s say we have those rules:\n    \n    \"os_compute_api:servers:create\": \"rule:admin_or_owner\",\n    \"os_compute_api:servers:create:attach_network\": \"rule:admin_or_owner\",\n    \"os_compute_api:servers:create:attach_volume\": \"rule:admin_or_owner\",\n    \"os_compute_api:servers:create:forced_host\": \"rule:admin_api\",\n\nshould we return something like:\n\n    POST /servers\n    POST /servers attach_network\n    POST /servers attach_volume\n    POST /servers forced_host\n\nor::\n\n    POST /servers attach_network,attach_volume,forced_host\n\n?\n\nFor most of the actions, it\u0027s pretty straightforward:\n\n    \"os_compute_api:servers:resize\": \"rule:admin_or_owner\",\n\nwould be:\n\n    POST /servers/{id}/resize\n\nanyways, for those it is quite easy to see what their endpoint is. But for others, it\u0027s not that simple.\n\nalso, for the rule: \n\n   \"os_compute_api:os-admin-actions:reset_network\"\n\nthe endpoint would still be:\n\n   POST /servers/{id}/resetNetwork\n\nAnd there is no pattern for rules like this. Another example would be:\n\n   \"os_compute_api:os-migrate-server:migrate_live\"\n\nmapping to:\n\n   POST /servers/{id}/os-migrateLive\n\nAnyways, I am a fan of this format, but if we are to go forward with this, we must find a solution for this issue.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"87ce08f83da812d6556ee18b84d7ef0bc87accfb","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  {"},{"line_number":78,"context_line":"      \"policy\": {"},{"line_number":79,"context_line":"          \"operations\": ["},{"line_number":80,"context_line":"              \"os_compute_api:os-policy:index\","},{"line_number":81,"context_line":"              \"os_compute_api:os-quota-sets:show\","},{"line_number":82,"context_line":"              ..."},{"line_number":83,"context_line":"          ]"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a061dce_3b5203de","line":80,"in_reply_to":"9a061dce_7d2654bb","updated":"2016-04-05 17:15:31.000000000","message":"The suggestion from Alex encompasses what I think we need here though I think the form needs to be a bit different. The information that needs to be provided is HTTP_ACTION, URL, DETAILS. HTTP_ACTION and URL are self explanatory but with those you can map policies like:\n\nGET /servers -\u003e \"os_compute_api:servers:list\"\nGET /servers/detail -\u003e \"os_compute_api:servers:detail\" -\u003e \nPOST /servers -\u003e \"os_compute_api:servers:create\"\n\nDETAILS is necessary to distinguish things like booting an instance with an attached volume so you get something like\n\nPOST /servers attach_volume -\u003e \"os_compute_api:servers:create\" and \"os_compute_api:servers:attach_volume\"\n\nHow that tuple of (HTTP_ACTION, URL, DETAILS) is presented is a topic on its own, but I think we need at least that info.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"3b292c38e6362d68261884ed75b758011d338c47","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  {"},{"line_number":78,"context_line":"      \"policy\": {"},{"line_number":79,"context_line":"          \"operations\": ["},{"line_number":80,"context_line":"              \"os_compute_api:os-policy:index\","},{"line_number":81,"context_line":"              \"os_compute_api:os-quota-sets:show\","},{"line_number":82,"context_line":"              ..."},{"line_number":83,"context_line":"          ]"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a1b2928_3dced05a","line":80,"in_reply_to":"9a061dce_d5ebd0ae","updated":"2016-04-11 05:47:50.000000000","message":"@Andrew @Claudiu, thanks for the reply,\n\nYes, I agree with Claudiu, capability per-resource is useless for some resource. I\u0027m also thinking of if we didn\u0027t have strong use-cases for the authorize with the target, I think we can get rid of it. Then let us just provide the authorize based on \u0027role\u0027. For the resource which is per-tenant, it\u0027s just a hard-code rule in the nova. For cross-project resource access is hard-code permission for super user \u0027admin\u0027. Then we can just use /policy at here.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"23f7086efbb42caddee0e2e8f8634c54f0feda6f","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  {"},{"line_number":78,"context_line":"      \"policy\": {"},{"line_number":79,"context_line":"          \"operations\": ["},{"line_number":80,"context_line":"              \"os_compute_api:os-policy:index\","},{"line_number":81,"context_line":"              \"os_compute_api:os-quota-sets:show\","},{"line_number":82,"context_line":"              ..."},{"line_number":83,"context_line":"          ]"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_a71e9bb8","line":80,"in_reply_to":"ba0121b8_50ae5e81","updated":"2016-03-31 15:55:44.000000000","message":"Indeed. \n\nI think we first have to decide how fine grained we want to go.\n\nOne proposal was to have something like:\n\n    \"os_compute_api:servers\": True\n\nThat would mean all the all the ``servers`` API operations are available: list, show, detail, create, delete, etc. But, a user might not have the policy for one of the operations. In this case, the reported capability is too coarse grained, we cannot report it as either True or False.\n\nAlternatively, we can have:\n\n    \"os_compute_api:servers:list\": True,\n    \"os_compute_api:servers:detail\": True,\n    \"os_compute_api:servers:create\": False,\n    ...\n\nThis can end up returning hundreds of entries, which can be a bit much for human eyes to process (unless grep is available).\nMight be a good idea not to return the \"False\" capabilities.\n\nWe could also:\n\n   \"os_compute_api:servers\": [\u0027list\u0027, \u0027detail\u0027, \u0027create\u0027, ...],\n\nWe could also skip capabilities if the user doesn\u0027t have the policy for them (will have empty arrays).\n\nAs for the capabilities naming, there was an alternative suggestion to have something like:\n\n    \"create_servers\": True,\n\nNow, what if the user can create servers by policy, but the legacy_v2 APIs are disabled? The reported capability doesn\u0027t reflect this.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"30fe0b39f50e6add84d1eb0004b014dda8e17fc2","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  {"},{"line_number":78,"context_line":"      \"policy\": {"},{"line_number":79,"context_line":"          \"operations\": ["},{"line_number":80,"context_line":"              \"os_compute_api:os-policy:index\","},{"line_number":81,"context_line":"              \"os_compute_api:os-quota-sets:show\","},{"line_number":82,"context_line":"              ..."},{"line_number":83,"context_line":"          ]"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a061dce_7d2654bb","line":80,"in_reply_to":"ba0121b8_a71e9bb8","updated":"2016-04-05 08:15:41.000000000","message":"For against the API, one idea is we define the API like this:\n\nGET /servers/policy\n\n{\n     \"list\": True\n     \"detail\": True\n     \"create\": True\n}\n\nGET /servers/{id}/policy\n\n{\n     \"show\": True\n     \"delete\": True\n     \"action_live_migration\": False\n     .....\n}\n\nGET /aggregates/policy\n\n{\n     \"list\": True\n     .....\n}\n\n\nThis resolves the problem of mapping the rule name to the API from API user side. This also sounds make sense from the UI developer view, when user switch to \u0027aggregate\u0027 page, the UI send request to the /aggregates/policy to get the ability about \u0027create\u0027, then decide whether the \u0027create\u0027 button available for user. When user click the dropdown menu of one specific aggregate, UI request to /aggregates/{id}/policy to check each action wehther available on this aggregate.\n\nAnd for GET /servers/{id}/policy is also related the comment I wrote at https://review.openstack.org/#/c/290155/2/specs/newton/approved/policy-in-code.rst@50","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"7f1742aec144361a40310bbb602492d257c977c6","unresolved":false,"context_lines":[{"line_number":127,"context_line":"Work Items"},{"line_number":128,"context_line":"----------"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"* nova ``os-policy`` API implementation."},{"line_number":131,"context_line":"* python-novaclient implementation."},{"line_number":132,"context_line":"* tempest test for the new nova API."},{"line_number":133,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1af94dfe_d7b36d96","line":130,"updated":"2016-03-18 19:44:41.000000000","message":"I think that ideally we should put the code together that does this into oslo.policy. Policy can come from multiple files and needs to be merged. If oslo.policy has the code that takes the merged results and turns them into a REST dump, then future things like embedding policy in code, just works.\n\nIt also means that the only project specific bits of this would be linking that rest structure dump to our rest API, and thus, doing it in other projects, also on a /policy endpoint, would be super easy.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"1d4af8dede5151dbc22f5e9c31324d22c0a5e735","unresolved":false,"context_lines":[{"line_number":127,"context_line":"Work Items"},{"line_number":128,"context_line":"----------"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"* nova ``os-policy`` API implementation."},{"line_number":131,"context_line":"* python-novaclient implementation."},{"line_number":132,"context_line":"* tempest test for the new nova API."},{"line_number":133,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa0719c6_5c1291b5","line":130,"in_reply_to":"1af94dfe_d7b36d96","updated":"2016-03-21 14:12:17.000000000","message":"+1, seems oslo has major code base might be a good iea","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"acd2e291e7f96146e9856b460839f80aa6dd9804","unresolved":false,"context_lines":[{"line_number":127,"context_line":"Work Items"},{"line_number":128,"context_line":"----------"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"* nova ``os-policy`` API implementation."},{"line_number":131,"context_line":"* python-novaclient implementation."},{"line_number":132,"context_line":"* tempest test for the new nova API."},{"line_number":133,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa0719c6_6a74e39b","line":130,"in_reply_to":"fa0719c6_5c1291b5","updated":"2016-03-21 14:30:20.000000000","message":"Sure, but this spec only adds a nova api endpoint + microversion through which a user will get his set of permissions / allowed operations. This blueprint will be based on Alaski\u0027s work regading policies (see his blueprint: https://review.openstack.org/#/c/290155/), which means that the implementation for this blueprint will be fairly simple and straight-forward.\n\nYou can take a look what the new API Controller would look like, based on Alaski\u0027s work: https://review.openstack.org/#/c/289596/1/nova/api/openstack/compute/policy.py\n\nAnyways, will add Alaski\u0027s spec as a dependency.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"87ce08f83da812d6556ee18b84d7ef0bc87accfb","unresolved":false,"context_lines":[{"line_number":127,"context_line":"Work Items"},{"line_number":128,"context_line":"----------"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"* nova ``os-policy`` API implementation."},{"line_number":131,"context_line":"* python-novaclient implementation."},{"line_number":132,"context_line":"* tempest test for the new nova API."},{"line_number":133,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a061dce_1b229f52","line":130,"in_reply_to":"fa0719c6_6a74e39b","updated":"2016-04-05 17:15:31.000000000","message":"Right. My spec encompasses the work that should/could go into oslo.policy and this is purely about taking that output and presenting it in the API. I don\u0027t think there\u0027s anything here to push into the oslo layer.","commit_id":"c4df841a97a7ec547d2e60c90f3b7c9166e1b14e"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"192e8bf03612e538fd29e56940ad525cadea28d0","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/get-policy-settings-api"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Not all users have the same set of priviledges. Because of this, adding an API"},{"line_number":14,"context_line":"endpoint that lists the policy rules the user passes can be helpful."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_d13d5190","line":13,"range":{"start_line":13,"start_character":35,"end_line":13,"end_character":46},"updated":"2016-04-21 09:43:26.000000000","message":"nit","commit_id":"156a6f60b2392993f7bf3e3cca0916a02d3a0023"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"bd7578687cf6677b58e17b85731cc4c633cbd909","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Currently, users have no direct way of knowing which APIs they are allowed to"},{"line_number":21,"context_line":"use or which APIs are enabled by policy. This spec will add an API endpoint"},{"line_number":22,"context_line":"that will return a list of available operations usable by the user."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Use Cases"},{"line_number":25,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_9d735e80","line":22,"updated":"2016-04-18 11:55:17.000000000","message":"I think this problem description needs to be expanded. It\u0027s clear that a user wants to know what things they can do by policy, but the spec then goes on to provide information that is only meaningful to someone who understands (and _wants_ to understand) openstack policies.","commit_id":"156a6f60b2392993f7bf3e3cca0916a02d3a0023"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"fe23fa4e64b872c01b7d802e91c94070a2c4b389","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Currently, users have no direct way of knowing which APIs they are allowed to"},{"line_number":21,"context_line":"use or which APIs are enabled by policy. This spec will add an API endpoint"},{"line_number":22,"context_line":"that will return a list of available operations usable by the user."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Use Cases"},{"line_number":25,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_b8faa8bb","line":22,"in_reply_to":"1a122d0e_9d735e80","updated":"2016-04-18 12:24:34.000000000","message":"Which is fine for an incremental step 1. What we have today is information that people would like access to. It\u0027s in a pretty raw format. But exposing that raw format over the wire makes it possible to get some idea of what\u0027s going on.\n\nThere is still the intent to make policy look/act more like urls. But that structural change isn\u0027t in the cards this cycle. And waiting until we have that completely perfect before exposing this seems unwise.","commit_id":"156a6f60b2392993f7bf3e3cca0916a02d3a0023"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"192e8bf03612e538fd29e56940ad525cadea28d0","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Currently, users have no direct way of knowing which APIs they are allowed to"},{"line_number":21,"context_line":"use or which APIs are enabled by policy. This spec will add an API endpoint"},{"line_number":22,"context_line":"that will return a list of available operations usable by the user."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Use Cases"},{"line_number":25,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_a0add89c","line":22,"in_reply_to":"1a122d0e_b8faa8bb","updated":"2016-04-21 09:43:26.000000000","message":"When we introduce the URL version, will that just be a microversion of the same endpoint? Does that mean we won\u0027t be able to make maintenance updates to the original version? Should we use a less-desirable URL for the original version since we know it\u0027ll be deprecated later? This would help us maintain them in parallel for a transition period.\n\nPlease could some detail on this be included in the spec?","commit_id":"156a6f60b2392993f7bf3e3cca0916a02d3a0023"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"192e8bf03612e538fd29e56940ad525cadea28d0","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"The API will return a list of policy rule names to the requesting user. It"},{"line_number":39,"context_line":"will not return the authorization conditions required to pass the policy"},{"line_number":40,"context_line":"rules. It cannot be used to determine the list the policy rules passed by"},{"line_number":41,"context_line":"other users."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"The returned operations will have to fulfill the following criteria:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_bfb5f77e","line":40,"range":{"start_line":40,"start_character":38,"end_line":40,"end_character":50},"updated":"2016-04-21 09:43:26.000000000","message":"or list?","commit_id":"156a6f60b2392993f7bf3e3cca0916a02d3a0023"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"192e8bf03612e538fd29e56940ad525cadea28d0","unresolved":false,"context_lines":[{"line_number":50,"context_line":"  are discoverable [1]. For example, having the following policy rule:"},{"line_number":51,"context_line":"  ``os_compute_api:servers:discoverable\": \"is_admin:True`` means that the"},{"line_number":52,"context_line":"  ``servers`` API and its operations is discoverable only by an admin and will"},{"line_number":53,"context_line":"  not be returned to any other users."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"The mentioned API Controller can added as an extension to other API endpoints."},{"line_number":56,"context_line":"This means that it can be used to list the passing policy rules on certain"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_ba56a503","line":53,"updated":"2016-04-21 09:43:26.000000000","message":"This criterion seems unnecessary and to encourage security-by-obscurity, why is it needed please?","commit_id":"156a6f60b2392993f7bf3e3cca0916a02d3a0023"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"bd7578687cf6677b58e17b85731cc4c633cbd909","unresolved":false,"context_lines":[{"line_number":56,"context_line":"This means that it can be used to list the passing policy rules on certain"},{"line_number":57,"context_line":"API endpoints and their extensions. For example, requesting the following:"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"  `GET /servers/policy`"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"will return the following policy rules:"},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_ddbaf622","line":59,"updated":"2016-04-18 11:55:17.000000000","message":"I think the alternative below (/policy/servers) is better. I don\u0027t think it appropriate to co-mingle policy information with the \"real\" API resources.","commit_id":"156a6f60b2392993f7bf3e3cca0916a02d3a0023"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"192e8bf03612e538fd29e56940ad525cadea28d0","unresolved":false,"context_lines":[{"line_number":56,"context_line":"This means that it can be used to list the passing policy rules on certain"},{"line_number":57,"context_line":"API endpoints and their extensions. For example, requesting the following:"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"  `GET /servers/policy`"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"will return the following policy rules:"},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_9a7e4968","line":59,"in_reply_to":"1a122d0e_ddbaf622","updated":"2016-04-21 09:43:26.000000000","message":"+1","commit_id":"156a6f60b2392993f7bf3e3cca0916a02d3a0023"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"c3ef490bf1035291c88886b5ed694b492d81df4e","unresolved":false,"context_lines":[{"line_number":56,"context_line":"This means that it can be used to list the passing policy rules on certain"},{"line_number":57,"context_line":"API endpoints and their extensions. For example, requesting the following:"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"  `GET /servers/policy`"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"will return the following policy rules:"},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_6e5b2a88","line":59,"in_reply_to":"1a122d0e_ddbaf622","updated":"2016-04-18 12:55:38.000000000","message":"+1, seems /servers/servers is clearer","commit_id":"156a6f60b2392993f7bf3e3cca0916a02d3a0023"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"bd7578687cf6677b58e17b85731cc4c633cbd909","unresolved":false,"context_lines":[{"line_number":64,"context_line":"  \"os_compute_api:servers:create:attach_network\""},{"line_number":65,"context_line":"  ..."},{"line_number":66,"context_line":"  \"os_compute_api:os-admin-actions\""},{"line_number":67,"context_line":"  \"os_compute_api:os-admin-actions:reset_network\""},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"``os-admin-actions`` API is defined as an extension of the ``servers`` API,"},{"line_number":70,"context_line":"thus, the passing rules will be included in the result."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_1dd10e58","line":67,"updated":"2016-04-18 11:55:17.000000000","message":"As I said in the earlier revision: this is a strong coupling with server side details of the API which are effectively meaingless to a naive user of the api.\n\nI don\u0027t \"POST os_compute_api:servers:create\". I \"POST /servers\". The former makes me know something I (as an API user) really don\u0027t want to care about.\n\nIn addition it is contrary to how a REST API should work. A REST API should make references to thinks by their URI.","commit_id":"156a6f60b2392993f7bf3e3cca0916a02d3a0023"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"fe23fa4e64b872c01b7d802e91c94070a2c4b389","unresolved":false,"context_lines":[{"line_number":64,"context_line":"  \"os_compute_api:servers:create:attach_network\""},{"line_number":65,"context_line":"  ..."},{"line_number":66,"context_line":"  \"os_compute_api:os-admin-actions\""},{"line_number":67,"context_line":"  \"os_compute_api:os-admin-actions:reset_network\""},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"``os-admin-actions`` API is defined as an extension of the ``servers`` API,"},{"line_number":70,"context_line":"thus, the passing rules will be included in the result."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_d8c0442d","line":67,"in_reply_to":"1a122d0e_1dd10e58","updated":"2016-04-18 12:24:34.000000000","message":"Yes, we should get to URI like definitions. That\u0027s going to take time and an aliasing mechanism which is going to be started next cycle. The discoverability gap today is an issue for anyone writing something like a Web UI, and for features like live-resize which are pretty much blocked until we have some discovery mechanism.\n\nThis is incremental progress.","commit_id":"156a6f60b2392993f7bf3e3cca0916a02d3a0023"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"192e8bf03612e538fd29e56940ad525cadea28d0","unresolved":false,"context_lines":[{"line_number":64,"context_line":"  \"os_compute_api:servers:create:attach_network\""},{"line_number":65,"context_line":"  ..."},{"line_number":66,"context_line":"  \"os_compute_api:os-admin-actions\""},{"line_number":67,"context_line":"  \"os_compute_api:os-admin-actions:reset_network\""},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"``os-admin-actions`` API is defined as an extension of the ``servers`` API,"},{"line_number":70,"context_line":"thus, the passing rules will be included in the result."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a122d0e_4077a401","line":67,"in_reply_to":"1a122d0e_d8c0442d","updated":"2016-04-21 09:43:26.000000000","message":"I don\u0027t know that building one thing, letting people tool on that then immediately replacing it is a great experience. Even if we warn them that\u0027s what we\u0027re doing. There\u0027d be a great temptation to not retool, in which case Nova might get stuck with the original version for some time. Conversely some will just wait for the real version, in which case what has building the first one gained you?","commit_id":"156a6f60b2392993f7bf3e3cca0916a02d3a0023"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"192e8bf03612e538fd29e56940ad525cadea28d0","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"1a122d0e_aa1d8474","line":217,"updated":"2016-04-21 09:43:26.000000000","message":"shouldn\u0027t there be a little table here saying \"1.0 initial version\"?","commit_id":"156a6f60b2392993f7bf3e3cca0916a02d3a0023"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"deb5df7e35f6c3a7dc25eea222dac98919b01d19","unresolved":false,"context_lines":[{"line_number":87,"context_line":""},{"line_number":88,"context_line":"At phase one the API will not be exposed in documentation. It will not"},{"line_number":89,"context_line":"require a microversion bump. It will only be active in a deployment if"},{"line_number":90,"context_line":"a configuration setting that defaults to False is set to True."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"This will allow testing of all the moving parts, notably user"},{"line_number":93,"context_line":"permissions."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_51f59380","line":90,"updated":"2016-04-29 12:10:24.000000000","message":"Will we support this? If not will there be a fat warning next to the config setting that says so?","commit_id":"2ab8e0019ec2cb49e3a8395fa19e92e00002d4c6"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"b7d522b6ee2ee43ebd10a8ef696c117731c7d9bc","unresolved":false,"context_lines":[{"line_number":87,"context_line":""},{"line_number":88,"context_line":"At phase one the API will not be exposed in documentation. It will not"},{"line_number":89,"context_line":"require a microversion bump. It will only be active in a deployment if"},{"line_number":90,"context_line":"a configuration setting that defaults to False is set to True."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"This will allow testing of all the moving parts, notably user"},{"line_number":93,"context_line":"permissions."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_ac65aeaf","line":90,"in_reply_to":"1a122d0e_51f59380","updated":"2016-04-29 12:39:23.000000000","message":"Done","commit_id":"2ab8e0019ec2cb49e3a8395fa19e92e00002d4c6"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"deb5df7e35f6c3a7dc25eea222dac98919b01d19","unresolved":false,"context_lines":[{"line_number":221,"context_line":"* Phase one of nova ``policy`` API implementation."},{"line_number":222,"context_line":"* python-novaclient implementation."},{"line_number":223,"context_line":"* tempest test for the new nova API."},{"line_number":224,"context_line":""},{"line_number":225,"context_line":""},{"line_number":226,"context_line":"Dependencies"},{"line_number":227,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_f17adfef","line":224,"updated":"2016-04-29 12:10:24.000000000","message":"no work item for phase 2? If you want that under a separate spec, it should be clear","commit_id":"2ab8e0019ec2cb49e3a8395fa19e92e00002d4c6"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"b7d522b6ee2ee43ebd10a8ef696c117731c7d9bc","unresolved":false,"context_lines":[{"line_number":221,"context_line":"* Phase one of nova ``policy`` API implementation."},{"line_number":222,"context_line":"* python-novaclient implementation."},{"line_number":223,"context_line":"* tempest test for the new nova API."},{"line_number":224,"context_line":""},{"line_number":225,"context_line":""},{"line_number":226,"context_line":"Dependencies"},{"line_number":227,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_2cdebe3d","line":224,"in_reply_to":"1a122d0e_f17adfef","updated":"2016-04-29 12:39:23.000000000","message":"Done","commit_id":"2ab8e0019ec2cb49e3a8395fa19e92e00002d4c6"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"deb5df7e35f6c3a7dc25eea222dac98919b01d19","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"1a122d0e_71288fe2","line":257,"updated":"2016-04-29 12:10:24.000000000","message":"still missing the table, please copy from template","commit_id":"2ab8e0019ec2cb49e3a8395fa19e92e00002d4c6"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"f532b481e05f322cc7e4e6e2371bd211f8c9b504","unresolved":false,"context_lines":[{"line_number":40,"context_line":"API."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Phase one"},{"line_number":43,"context_line":"~~~~~~~~~"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"The discoverable policy will be exposed through the ``policy`` API endpoint."},{"line_number":46,"context_line":"For this, an API Controller will have to be created, as well as the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_6ab25195","line":43,"updated":"2016-04-29 15:19:43.000000000","message":"this causes a formatting error.\n\nyou can\u0027t have a sub-sub-section without a sub-section first.\n\nThe section order is:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\n------\n\n~~~~~~","commit_id":"fcdb57a918802a7027e6c0c1e112eed8d1c859b9"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"6981d842339ebce7fcfba766f196e773c8255d89","unresolved":false,"context_lines":[{"line_number":40,"context_line":"API."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Phase one"},{"line_number":43,"context_line":"~~~~~~~~~"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"The discoverable policy will be exposed through the ``policy`` API endpoint."},{"line_number":46,"context_line":"For this, an API Controller will have to be created, as well as the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_9549ce62","line":43,"in_reply_to":"1a122d0e_6ab25195","updated":"2016-04-29 15:24:26.000000000","message":"Thanks for catching that.","commit_id":"fcdb57a918802a7027e6c0c1e112eed8d1c859b9"}],"specs/newton/approved/discoverable-policy-cli.rst":[{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"6a94f4f3f18fbbdd1846860301416cf3ae401ce6","unresolved":false,"context_lines":[{"line_number":47,"context_line":"The discoverable policy will be exposed through the ``policy-list``"},{"line_number":48,"context_line":"nova-manage CLI subcommand."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"The subcommand will return a list of policy rule names to the requesting user."},{"line_number":51,"context_line":"It will not return the authorization conditions required to pass the policy"},{"line_number":52,"context_line":"rules. It cannot be used to determine the list of policy rules passed by"},{"line_number":53,"context_line":"other users."}],"source_content_type":"text/x-rst","patch_set":7,"id":"bab6814e_947b12f4","line":50,"range":{"start_line":50,"start_character":62,"end_line":50,"end_character":77},"updated":"2016-05-25 08:10:03.000000000","message":"The nova-manage only run as fake admin context. how we specifiy the requesting user? or we just input the roles, then nova-manage policy-list return a list of rules allowed for this role?","commit_id":"846853fd05e5a111d5c2f9d139a4cb3e42d87a47"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"82ad8ab23029facc24483d7da7f326e5d4615692","unresolved":false,"context_lines":[{"line_number":47,"context_line":"The discoverable policy will be exposed through the ``policy-list``"},{"line_number":48,"context_line":"nova-manage CLI subcommand."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"The subcommand will return a list of policy rule names to the requesting user."},{"line_number":51,"context_line":"It will not return the authorization conditions required to pass the policy"},{"line_number":52,"context_line":"rules. It cannot be used to determine the list of policy rules passed by"},{"line_number":53,"context_line":"other users."}],"source_content_type":"text/x-rst","patch_set":7,"id":"bab6814e_f82b1080","line":50,"range":{"start_line":50,"start_character":62,"end_line":50,"end_character":77},"in_reply_to":"bab6814e_817101ab","updated":"2016-05-26 17:49:38.000000000","message":"yep, it should be done just like python-novaclient does it.","commit_id":"846853fd05e5a111d5c2f9d139a4cb3e42d87a47"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"033569f55ea4183386b565a1a916e526c6e9a8c3","unresolved":false,"context_lines":[{"line_number":47,"context_line":"The discoverable policy will be exposed through the ``policy-list``"},{"line_number":48,"context_line":"nova-manage CLI subcommand."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"The subcommand will return a list of policy rule names to the requesting user."},{"line_number":51,"context_line":"It will not return the authorization conditions required to pass the policy"},{"line_number":52,"context_line":"rules. It cannot be used to determine the list of policy rules passed by"},{"line_number":53,"context_line":"other users."}],"source_content_type":"text/x-rst","patch_set":7,"id":"bab6814e_817101ab","line":50,"range":{"start_line":50,"start_character":62,"end_line":50,"end_character":77},"in_reply_to":"bab6814e_947b12f4","updated":"2016-05-25 13:20:05.000000000","message":"+1 on the question.\n\nI think we should do the full keystone auth, just like python-novaclient would, and the keystone middlewear does.","commit_id":"846853fd05e5a111d5c2f9d139a4cb3e42d87a47"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"033569f55ea4183386b565a1a916e526c6e9a8c3","unresolved":false,"context_lines":[{"line_number":116,"context_line":"Other end user impact"},{"line_number":117,"context_line":"---------------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The nova-manage ``policy-list`` subcommand will return as follows, depending"},{"line_number":120,"context_line":"on the arguments given:"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"* No args. The subcommand will return all passing policy rule names."}],"source_content_type":"text/x-rst","patch_set":7,"id":"bab6814e_8123c1a6","line":119,"range":{"start_line":119,"start_character":4,"end_line":119,"end_character":15},"updated":"2016-05-25 13:20:05.000000000","message":"sdague made a good point in the API meeting just now, lets try do this as a separate CLI command.\n\n\"nova-policy-check\" seemed popular, but others could work.\n\nFor passing the credentials in, it was suggested we consider using keystoneauth1 just like python-novaclient does.","commit_id":"846853fd05e5a111d5c2f9d139a4cb3e42d87a47"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"82ad8ab23029facc24483d7da7f326e5d4615692","unresolved":false,"context_lines":[{"line_number":116,"context_line":"Other end user impact"},{"line_number":117,"context_line":"---------------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The nova-manage ``policy-list`` subcommand will return as follows, depending"},{"line_number":120,"context_line":"on the arguments given:"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"* No args. The subcommand will return all passing policy rule names."}],"source_content_type":"text/x-rst","patch_set":7,"id":"bab6814e_d503750e","line":119,"range":{"start_line":119,"start_character":4,"end_line":119,"end_character":15},"in_reply_to":"bab6814e_8123c1a6","updated":"2016-05-26 17:49:38.000000000","message":"sure, will do a new CLI command.\n\nAs for credentials, yeah, I was thinking of having it just like python-novaclient, including looking in the env for them.","commit_id":"846853fd05e5a111d5c2f9d139a4cb3e42d87a47"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"87b407c31d1c10c577e14b84b36c7aa751fe2279","unresolved":false,"context_lines":[{"line_number":132,"context_line":"* ``policy-file``. The command loads all the policy rules from the given file"},{"line_number":133,"context_line":"  and will return all passing policy rule names. For example::"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"    nova policy-check --policy-file /path/to/policy.json"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"  If the file was not found, couldn\u0027t be read, or couldn\u0027t be parsed, an error"},{"line_number":138,"context_line":"  will be raised."}],"source_content_type":"text/x-rst","patch_set":9,"id":"9abb7d3a_b98eaccd","line":135,"range":{"start_line":135,"start_character":22,"end_line":135,"end_character":56},"updated":"2016-06-01 06:34:49.000000000","message":"I don\u0027t think we need specify the policy file. We probably can call the code which used by nova-api in reality to get final policy rule sets.","commit_id":"c34efa66e07d9d1ea32d96d60596b96765671a46"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"a87e8ffbcef583110bceb94ffa0af3d1c7a38163","unresolved":false,"context_lines":[{"line_number":132,"context_line":"* ``policy-file``. The command loads all the policy rules from the given file"},{"line_number":133,"context_line":"  and will return all passing policy rule names. For example::"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"    nova policy-check --policy-file /path/to/policy.json"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"  If the file was not found, couldn\u0027t be read, or couldn\u0027t be parsed, an error"},{"line_number":138,"context_line":"  will be raised."}],"source_content_type":"text/x-rst","patch_set":9,"id":"9abb7d3a_c4725cb0","line":135,"range":{"start_line":135,"start_character":22,"end_line":135,"end_character":56},"in_reply_to":"9abb7d3a_6e8a7c65","updated":"2016-06-02 11:46:22.000000000","message":"Indeed. The config file is going to be parsed by oslo.config, and the policy file defined in it is probably going to be parsed by oslo.policy, so there shouldn\u0027t be any concerns on how the files are loaded. \n\nThe --config-file option should still be there though.","commit_id":"c34efa66e07d9d1ea32d96d60596b96765671a46"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"470d2e2b80ade1233e8f980c9cefdf68f45f996e","unresolved":false,"context_lines":[{"line_number":132,"context_line":"* ``policy-file``. The command loads all the policy rules from the given file"},{"line_number":133,"context_line":"  and will return all passing policy rule names. For example::"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"    nova policy-check --policy-file /path/to/policy.json"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"  If the file was not found, couldn\u0027t be read, or couldn\u0027t be parsed, an error"},{"line_number":138,"context_line":"  will be raised."}],"source_content_type":"text/x-rst","patch_set":9,"id":"9abb7d3a_761eea0c","line":135,"range":{"start_line":135,"start_character":22,"end_line":135,"end_character":56},"in_reply_to":"9abb7d3a_6f0bd62a","updated":"2016-06-01 17:33:14.000000000","message":"I think what Alex is saying is that you shouldn\u0027t need to pass this policy file in, just use whatever Nova is configured to use already.\n\nI agree that nova-policy-check should configure policy exactly as Nova would.","commit_id":"c34efa66e07d9d1ea32d96d60596b96765671a46"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"bc687d6c84d0b5ca5cd015bf2137522882f49cea","unresolved":false,"context_lines":[{"line_number":132,"context_line":"* ``policy-file``. The command loads all the policy rules from the given file"},{"line_number":133,"context_line":"  and will return all passing policy rule names. For example::"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"    nova policy-check --policy-file /path/to/policy.json"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"  If the file was not found, couldn\u0027t be read, or couldn\u0027t be parsed, an error"},{"line_number":138,"context_line":"  will be raised."}],"source_content_type":"text/x-rst","patch_set":9,"id":"9abb7d3a_bcdf91d4","line":135,"range":{"start_line":135,"start_character":22,"end_line":135,"end_character":56},"in_reply_to":"9abb7d3a_761eea0c","updated":"2016-06-01 18:24:32.000000000","message":"As far as I know, policy_file is given as a config option in nova.conf, which could vary from the standard /etc/nova/policy.json.\n\nOr, if there\u0027s no config option, I think nova loads the policy.json file from the same folder as the config-file. Nova services can receive a --config-file arg option, specifying some other nova.conf file in another folder (and thus, load another policy.json file).\n\nThis is why I thought that this option would be useful.","commit_id":"c34efa66e07d9d1ea32d96d60596b96765671a46"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"2c23910385c5f26f8f5b8acfde321d09202480df","unresolved":false,"context_lines":[{"line_number":132,"context_line":"* ``policy-file``. The command loads all the policy rules from the given file"},{"line_number":133,"context_line":"  and will return all passing policy rule names. For example::"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"    nova policy-check --policy-file /path/to/policy.json"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"  If the file was not found, couldn\u0027t be read, or couldn\u0027t be parsed, an error"},{"line_number":138,"context_line":"  will be raised."}],"source_content_type":"text/x-rst","patch_set":9,"id":"9abb7d3a_6f0bd62a","line":135,"range":{"start_line":135,"start_character":22,"end_line":135,"end_character":56},"in_reply_to":"9abb7d3a_b98eaccd","updated":"2016-06-01 07:42:26.000000000","message":"I\u0027m not sure I understand.\n\nIn the near future, nova will be able to start without a policy file, as the default policy rules will be in code. Checking those default policy rules case is already covered by the \"no args\" case.\n\nNow, while nova will be able to work without a policy file, one such file can be given to override some of the default policy rules. In order to test against the policy rules that nova-api is using, this option has to be specified, assuming that \"/path/to/policy.json\" is loaded into nova-api.","commit_id":"c34efa66e07d9d1ea32d96d60596b96765671a46"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"34a37a19bde89b64b4973e5cd376aad99d351e39","unresolved":false,"context_lines":[{"line_number":132,"context_line":"* ``policy-file``. The command loads all the policy rules from the given file"},{"line_number":133,"context_line":"  and will return all passing policy rule names. For example::"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"    nova policy-check --policy-file /path/to/policy.json"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"  If the file was not found, couldn\u0027t be read, or couldn\u0027t be parsed, an error"},{"line_number":138,"context_line":"  will be raised."}],"source_content_type":"text/x-rst","patch_set":9,"id":"9abb7d3a_ed0205b3","line":135,"range":{"start_line":135,"start_character":22,"end_line":135,"end_character":56},"in_reply_to":"9abb7d3a_bcdf91d4","updated":"2016-06-01 18:58:12.000000000","message":"I think it would be better to take a --config-file option and use the policy file specified there. It would be best to minimize the differences in loading policy files between this nova policy-check command and the nova services.","commit_id":"c34efa66e07d9d1ea32d96d60596b96765671a46"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"0d2ccaa274a2cff2a55ed3c382cb57d484567764","unresolved":false,"context_lines":[{"line_number":132,"context_line":"* ``policy-file``. The command loads all the policy rules from the given file"},{"line_number":133,"context_line":"  and will return all passing policy rule names. For example::"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"    nova policy-check --policy-file /path/to/policy.json"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"  If the file was not found, couldn\u0027t be read, or couldn\u0027t be parsed, an error"},{"line_number":138,"context_line":"  will be raised."}],"source_content_type":"text/x-rst","patch_set":9,"id":"9abb7d3a_6e8a7c65","line":135,"range":{"start_line":135,"start_character":22,"end_line":135,"end_character":56},"in_reply_to":"9abb7d3a_ed0205b3","updated":"2016-06-02 03:23:09.000000000","message":"@Andrew, thanks, that is what i mean.\n\n@Claudiu, The oslo.policy code will parse the config file i think. So i guess we needn\u0027t worry about it?","commit_id":"c34efa66e07d9d1ea32d96d60596b96765671a46"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"470d2e2b80ade1233e8f980c9cefdf68f45f996e","unresolved":false,"context_lines":[{"line_number":137,"context_line":"  If the file was not found, couldn\u0027t be read, or couldn\u0027t be parsed, an error"},{"line_number":138,"context_line":"  will be raised."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"* ``api-name`` argument given. The command will only list passing policies"},{"line_number":141,"context_line":"  for the given API name. For example::"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"    nova-policy-check --api-name os-keypairs"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9abb7d3a_36b622f9","line":140,"updated":"2016-06-01 17:33:14.000000000","message":"How is this matching done? Does it need to be an exact match or is it a substring match? For example would os-keyp provide the same results? This is a minor question and could be deferred to actual code reviews.","commit_id":"c34efa66e07d9d1ea32d96d60596b96765671a46"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"bc687d6c84d0b5ca5cd015bf2137522882f49cea","unresolved":false,"context_lines":[{"line_number":137,"context_line":"  If the file was not found, couldn\u0027t be read, or couldn\u0027t be parsed, an error"},{"line_number":138,"context_line":"  will be raised."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"* ``api-name`` argument given. The command will only list passing policies"},{"line_number":141,"context_line":"  for the given API name. For example::"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"    nova-policy-check --api-name os-keypairs"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9abb7d3a_7c2369bd","line":140,"in_reply_to":"9abb7d3a_36b622f9","updated":"2016-06-01 18:24:32.000000000","message":"Hm, I was thinking exact match. But I think both could work.\n\nI\u0027m fine either way.","commit_id":"c34efa66e07d9d1ea32d96d60596b96765671a46"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"34a37a19bde89b64b4973e5cd376aad99d351e39","unresolved":false,"context_lines":[{"line_number":137,"context_line":"  If the file was not found, couldn\u0027t be read, or couldn\u0027t be parsed, an error"},{"line_number":138,"context_line":"  will be raised."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"* ``api-name`` argument given. The command will only list passing policies"},{"line_number":141,"context_line":"  for the given API name. For example::"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"    nova-policy-check --api-name os-keypairs"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9abb7d3a_4db6b1f9","line":140,"in_reply_to":"9abb7d3a_7c2369bd","updated":"2016-06-01 18:58:12.000000000","message":"I am as well, though I think substring matching would be better.","commit_id":"c34efa66e07d9d1ea32d96d60596b96765671a46"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"470d2e2b80ade1233e8f980c9cefdf68f45f996e","unresolved":false,"context_lines":[{"line_number":151,"context_line":"    \"os_compute_api:os-keypairs:create\": \"rule:admin_api or user_id:%(user_id)s\""},{"line_number":152,"context_line":"    \"os_compute_api:os-keypairs:delete\": \"rule:admin_api or user_id:%(user_id)s\""},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"* ``target-type`` and ``target`` arguments given. The command will only"},{"line_number":155,"context_line":"  list passing policies for the given target. For example::"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"    nova-policy-check --target-type server --target \u003cinstance_uuid\u003e"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9abb7d3a_96d42eec","line":154,"updated":"2016-06-01 17:33:14.000000000","message":"Not every policy check takes a target. Will policy checks that pass but do not take a target be listed in this output? And how will you know when to pass a target in to a policy check?","commit_id":"c34efa66e07d9d1ea32d96d60596b96765671a46"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"e3c570283df645d649be0dd0c760b7c03e1d33c8","unresolved":false,"context_lines":[{"line_number":151,"context_line":"    \"os_compute_api:os-keypairs:create\": \"rule:admin_api or user_id:%(user_id)s\""},{"line_number":152,"context_line":"    \"os_compute_api:os-keypairs:delete\": \"rule:admin_api or user_id:%(user_id)s\""},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"* ``target-type`` and ``target`` arguments given. The command will only"},{"line_number":155,"context_line":"  list passing policies for the given target. For example::"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"    nova-policy-check --target-type server --target \u003cinstance_uuid\u003e"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9abb7d3a_5780bb46","line":154,"in_reply_to":"9abb7d3a_160da837","updated":"2016-06-02 18:47:24.000000000","message":"yes, I agree no harm and maybe some special case still need it","commit_id":"c34efa66e07d9d1ea32d96d60596b96765671a46"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"a87e8ffbcef583110bceb94ffa0af3d1c7a38163","unresolved":false,"context_lines":[{"line_number":151,"context_line":"    \"os_compute_api:os-keypairs:create\": \"rule:admin_api or user_id:%(user_id)s\""},{"line_number":152,"context_line":"    \"os_compute_api:os-keypairs:delete\": \"rule:admin_api or user_id:%(user_id)s\""},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"* ``target-type`` and ``target`` arguments given. The command will only"},{"line_number":155,"context_line":"  list passing policies for the given target. For example::"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"    nova-policy-check --target-type server --target \u003cinstance_uuid\u003e"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9abb7d3a_c285275a","line":154,"in_reply_to":"9abb7d3a_67b3d60a","updated":"2016-06-02 11:46:22.000000000","message":"Soo, the purpose of this tool is to be able see what policy rules you are passing with the given user / credentials. With this sort of information, you can determine whether you can or cannot use a Nova API that uses those policy rules.\n\nBased on this, this tool will verify the policy rules pretty much the same way nova-api does. Looking through the code, it seems that in ~97% of the cases, all is needed is the context and action.\nIn those cases, even if the target is None, the following target is given anyways:\n\n    target\u003d{\u0027user_id\u0027: context.user_id, \u0027project_id\u0027: context.project_id}\n\nIn the rest of the cases, where the target is not None, in a lot of cases \u0027user_id\u0027 and / or \u0027project_id\u0027 is given. IMO, the policy rule checks can still run on all the policies in this case.\n\nSo, my suggestion is this:\n\nGive up the --target-type argument.\nHave --target as an argument list (multiple --target args can be specified). If not --target is given, use the default one instead:\n\n    target\u003d{\u0027user_id\u0027: context.user_id, \u0027project_id\u0027: context.project_id}\n\nIf --target arguments are given, use only them:\n\n    nova-policy-check --target user_id:\u003cuser_id\u003e --target project_id:\u003cproject_id\u003e\n\nThe results can be filtered using the --api-name argument.\n\nAcceptable targets: user_id, project_id, quota_class, instance (only those are being used in nova-api, it seems). Any other target will cause an exception.\n\nFor quota_class, we can assume the --api-name, it is only used in the os-quota-class-sets API. We can simply check the policy rules for it.\n\nFor instance, I think we can do the same thing. From what I saw, an instance is passed as a target in the following: instance_actions, lock_server (I was expecting it to be used in servers as well).\n\nWith this, nova-policy-check CLI should be able to check policy rules pretty much the same way nova-api does.\n\nThis where I found target to be used:\n\n    # keypairs\n    target\u003d{\u0027user_id\u0027: user_id or context.user_id, \u0027project_id\u0027: context.project_id}\n\n    # tenant_id given in the request. (used_tenants)\n    target\u003d{\u0027user_id\u0027: context.user_id\u0027, \u0027project_id: tenant_id}\n\n    # id is given as argument. (quota_sets)\n    target\u003d{\u0027project_id\u0027: id}\n\n    # tenant_id is given as argument. (simple_tenant_usage)\n    target\u003d{\u0027project_id\u0027: tenant_id}\n\n    # used in: quota_classes\n    target\u003d{\u0027quota_class\u0027: quota_class}\n\n    # used in: instance_actions, lock_server\n    target\u003dinstance","commit_id":"c34efa66e07d9d1ea32d96d60596b96765671a46"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"bc687d6c84d0b5ca5cd015bf2137522882f49cea","unresolved":false,"context_lines":[{"line_number":151,"context_line":"    \"os_compute_api:os-keypairs:create\": \"rule:admin_api or user_id:%(user_id)s\""},{"line_number":152,"context_line":"    \"os_compute_api:os-keypairs:delete\": \"rule:admin_api or user_id:%(user_id)s\""},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"* ``target-type`` and ``target`` arguments given. The command will only"},{"line_number":155,"context_line":"  list passing policies for the given target. For example::"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"    nova-policy-check --target-type server --target \u003cinstance_uuid\u003e"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9abb7d3a_67b3d60a","line":154,"in_reply_to":"9abb7d3a_96d42eec","updated":"2016-06-01 18:24:32.000000000","message":"Indeed, you are right about this. I\u0027ll give it some thought.","commit_id":"c34efa66e07d9d1ea32d96d60596b96765671a46"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"855b9f4485d9c4e9e6788b8d55da949162277ff4","unresolved":false,"context_lines":[{"line_number":151,"context_line":"    \"os_compute_api:os-keypairs:create\": \"rule:admin_api or user_id:%(user_id)s\""},{"line_number":152,"context_line":"    \"os_compute_api:os-keypairs:delete\": \"rule:admin_api or user_id:%(user_id)s\""},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"* ``target-type`` and ``target`` arguments given. The command will only"},{"line_number":155,"context_line":"  list passing policies for the given target. For example::"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"    nova-policy-check --target-type server --target \u003cinstance_uuid\u003e"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9abb7d3a_160da837","line":154,"in_reply_to":"9abb7d3a_c1752433","updated":"2016-06-02 14:05:41.000000000","message":"well, that would mean that the user_id would be pointless, IMO. But I don\u0027t think having it in the target would cause any problem.","commit_id":"c34efa66e07d9d1ea32d96d60596b96765671a46"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"b455874077166114d5a574cfd8e980a768780c44","unresolved":false,"context_lines":[{"line_number":151,"context_line":"    \"os_compute_api:os-keypairs:create\": \"rule:admin_api or user_id:%(user_id)s\""},{"line_number":152,"context_line":"    \"os_compute_api:os-keypairs:delete\": \"rule:admin_api or user_id:%(user_id)s\""},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"* ``target-type`` and ``target`` arguments given. The command will only"},{"line_number":155,"context_line":"  list passing policies for the given target. For example::"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"    nova-policy-check --target-type server --target \u003cinstance_uuid\u003e"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9abb7d3a_c1752433","line":154,"in_reply_to":"9abb7d3a_c285275a","updated":"2016-06-02 12:26:13.000000000","message":"not sure the recently proposed deprecating user_id support in policy in nova will have some effect on the \u0027user_id\u0027 in the target param?","commit_id":"c34efa66e07d9d1ea32d96d60596b96765671a46"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"3d39e2b56aad7e3beb54c7fe93ea318a799a0976","unresolved":false,"context_lines":[{"line_number":145,"context_line":""},{"line_number":146,"context_line":"    or"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"    nova-policy-check --api-name os-keyp"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"  This command will only list the passing policies for ``os-keypairs``::"},{"line_number":151,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"9abb7d3a_7d679925","line":148,"updated":"2016-06-02 21:17:51.000000000","message":"Just to be clear this would work because it\u0027s a substring match.","commit_id":"58e40e9206c6f17a3faf00b4a29bbc5e9c45945e"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"3d39e2b56aad7e3beb54c7fe93ea318a799a0976","unresolved":false,"context_lines":[{"line_number":156,"context_line":"    \"os_compute_api:os-keypairs:create\": \"rule:admin_api or user_id:%(user_id)s\""},{"line_number":157,"context_line":"    \"os_compute_api:os-keypairs:delete\": \"rule:admin_api or user_id:%(user_id)s\""},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"* ``target`` arguments given. The command will only list passing policies for"},{"line_number":160,"context_line":"  the given targets. For example::"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"    nova-policy-check --target instance:\u003cinstance_uuid\u003e"}],"source_content_type":"text/x-rst","patch_set":10,"id":"9abb7d3a_5d58d556","line":159,"updated":"2016-06-02 21:17:51.000000000","message":"I think this spec is useful without this part. I mention that because I\u0027m still a bit reserved on this direction and think we may want to modify this once the implementation starts. However I don\u0027t want to hold up the spec to determine all of those details.","commit_id":"58e40e9206c6f17a3faf00b4a29bbc5e9c45945e"}]}