)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"d3cc8a7ef316805fa94912739933c76b99ebd1ab","unresolved":false,"context_lines":[{"line_number":14,"context_line":"Given an authenticated request context it is not possible to determine"},{"line_number":15,"context_line":"which policies will pass. This is because policy checks are ad hoc"},{"line_number":16,"context_line":"throughout the code with no central registry of all possible checks."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Change-Id: I4e2209f85725535a724e83c576dc07e6df05f439"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"1a122d0e_765d6a14","line":17,"updated":"2016-04-20 00:49:14.000000000","message":"nit: link to the blueprint newton_policy_in_code","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"}],"specs/newton/approved/policy-in-code.rst":[{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"fd56e4a5f1c672c73469ddccabdbe722d0beb32a","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        (\"os_compute_api:servers:index\", \"rule:admin_or_owner\","},{"line_number":79,"context_line":"            [\u0027display_servers\u0027]),"},{"line_number":80,"context_line":"        (\"os_compute_api:servers:detail\", \"rule:admin_or_owner\","},{"line_number":81,"context_line":"            [\u0027display_servers\u0027]),"},{"line_number":82,"context_line":"    ]"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"    POLICY \u003d policy.POLICY"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5aef4532_5c5d9447","line":81,"updated":"2016-03-11 10:44:10.000000000","message":"should index and detail have the same capability name, or should we have a distinction between them? \n\nFor example, a user might have the right to list the servers, but not see their details.\n\nOr does this mean that both index and detail policies must pass in order to have the \u0027display_servers\u0027 capability?","commit_id":"12a8ac5653ca8498dc9628e24e02236e9a6449c8"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"e1b070932e249294a3a906de04cb45aef465eb83","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        (\"os_compute_api:servers:index\", \"rule:admin_or_owner\","},{"line_number":79,"context_line":"            [\u0027display_servers\u0027]),"},{"line_number":80,"context_line":"        (\"os_compute_api:servers:detail\", \"rule:admin_or_owner\","},{"line_number":81,"context_line":"            [\u0027display_servers\u0027]),"},{"line_number":82,"context_line":"    ]"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"    POLICY \u003d policy.POLICY"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3afc51ec_06b0dbf3","line":81,"in_reply_to":"5aef4532_5c5d9447","updated":"2016-03-11 13:39:59.000000000","message":"This means that both must pass in order to have \u0027display_servers\u0027 capabilities. Effectively it\u0027s saying that if a user can do one they need to be able to do the other, and deployers shouldn\u0027t block one.\n\nIt\u0027s possible that this sort of aggregation doesn\u0027t make sense and each of these should be separate capabilities.","commit_id":"12a8ac5653ca8498dc9628e24e02236e9a6449c8"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"fd56e4a5f1c672c73469ddccabdbe722d0beb32a","unresolved":false,"context_lines":[{"line_number":85,"context_line":"    POLICY.register(server_policies)"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"    def index():"},{"line_number":88,"context_line":"        POLICY.authorize(\u0027os_compute_api:servers:index\u0027, context)"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"In this example the same policy check could be used for both create and"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5aef4532_06d57bb8","line":88,"updated":"2016-03-11 10:44:10.000000000","message":"was wondering if this would also have to be done for the old v2.0 api. There doesn\u0027t seem to be any sort of authorization there, or at least, it\u0027s not as obvious as v2.1.\n\nalso, just a nit: according to the POC code you\u0027ve submitted, the arguments should be:\n\n    POLICY.authorize(context, \u0027os_compute_api:servers:index\u0027)\n\nalso, the context argument is typically the 1st argument, so this way it\u0027ll be more consistent.","commit_id":"12a8ac5653ca8498dc9628e24e02236e9a6449c8"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"e1b070932e249294a3a906de04cb45aef465eb83","unresolved":false,"context_lines":[{"line_number":85,"context_line":"    POLICY.register(server_policies)"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"    def index():"},{"line_number":88,"context_line":"        POLICY.authorize(\u0027os_compute_api:servers:index\u0027, context)"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"In this example the same policy check could be used for both create and"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3afc51ec_a6c48740","line":88,"in_reply_to":"3afc51ec_d02b4c32","updated":"2016-03-11 13:39:59.000000000","message":"Those would be removed after everything is switched over, or converted to authorize through the policy object.","commit_id":"12a8ac5653ca8498dc9628e24e02236e9a6449c8"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"0fe9d928f09333a2491208de5fdb209f8a510de0","unresolved":false,"context_lines":[{"line_number":85,"context_line":"    POLICY.register(server_policies)"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"    def index():"},{"line_number":88,"context_line":"        POLICY.authorize(\u0027os_compute_api:servers:index\u0027, context)"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"In this example the same policy check could be used for both create and"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3afc51ec_d02b4c32","line":88,"in_reply_to":"5aef4532_06d57bb8","updated":"2016-03-11 12:03:07.000000000","message":"Also, if this is going to be the prefered authorization method, what are we going to do with the authorizers from nova.api.openstack.extensions?","commit_id":"12a8ac5653ca8498dc9628e24e02236e9a6449c8"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"e1b070932e249294a3a906de04cb45aef465eb83","unresolved":false,"context_lines":[{"line_number":85,"context_line":"    POLICY.register(server_policies)"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"    def index():"},{"line_number":88,"context_line":"        POLICY.authorize(\u0027os_compute_api:servers:index\u0027, context)"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"In this example the same policy check could be used for both create and"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3afc51ec_86734b4d","line":88,"in_reply_to":"5aef4532_06d57bb8","updated":"2016-03-11 13:39:59.000000000","message":"Good catch, context should be first. \n\nThe v2 api policy checks are mostly in compute/api.py and those would need to be switched over as well.","commit_id":"12a8ac5653ca8498dc9628e24e02236e9a6449c8"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"fd56e4a5f1c672c73469ddccabdbe722d0beb32a","unresolved":false,"context_lines":[{"line_number":97,"context_line":"    ]"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"    def create():"},{"line_number":100,"context_line":"        POLICY.authorize(\u0027compute:attach_volume\u0027, context, target)"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"    def rebuild():"},{"line_number":103,"context_line":"        POLICY.authorize(\u0027compute:attach_volume\u0027, context, target)"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5aef4532_69aed0e8","line":100,"updated":"2016-03-11 10:44:10.000000000","message":"who / what is target in this call? there is no mention about it.","commit_id":"12a8ac5653ca8498dc9628e24e02236e9a6449c8"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"e1b070932e249294a3a906de04cb45aef465eb83","unresolved":false,"context_lines":[{"line_number":97,"context_line":"    ]"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"    def create():"},{"line_number":100,"context_line":"        POLICY.authorize(\u0027compute:attach_volume\u0027, context, target)"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"    def rebuild():"},{"line_number":103,"context_line":"        POLICY.authorize(\u0027compute:attach_volume\u0027, context, target)"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3afc51ec_26feb76b","line":100,"in_reply_to":"5aef4532_69aed0e8","updated":"2016-03-11 13:39:59.000000000","message":"I left that out in order to keep the example small. It would be whatever the current target is for that call.","commit_id":"12a8ac5653ca8498dc9628e24e02236e9a6449c8"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3bad2ed30ff12514064198326278b3f1d801005f","unresolved":false,"context_lines":[{"line_number":30,"context_line":"Given a deployed policy file it is not trivial to determine how much it"},{"line_number":31,"context_line":"differs from the defaults that Nova expects. This is due to the provided sample"},{"line_number":32,"context_line":"file not having an exhaustive list of all configurable policies, and the"},{"line_number":33,"context_line":"expected defaults are not contained in the Nova codebase."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Given an authenticated request context it is not possible to determine which"},{"line_number":36,"context_line":"policies will pass. This is because policy checks are ad hoc throughout the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_76d0c2f6","line":33,"updated":"2016-03-31 13:45:05.000000000","message":"I think its worth talking about maintaining the file across upgrades.\n\nMaybe we should just focus on this one problem for this spec?","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"b0de46da1bc8180768c71e5697398c4595e57f8b","unresolved":false,"context_lines":[{"line_number":30,"context_line":"Given a deployed policy file it is not trivial to determine how much it"},{"line_number":31,"context_line":"differs from the defaults that Nova expects. This is due to the provided sample"},{"line_number":32,"context_line":"file not having an exhaustive list of all configurable policies, and the"},{"line_number":33,"context_line":"expected defaults are not contained in the Nova codebase."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Given an authenticated request context it is not possible to determine which"},{"line_number":36,"context_line":"policies will pass. This is because policy checks are ad hoc throughout the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a061dce_9251bb65","line":33,"in_reply_to":"ba0121b8_76d0c2f6","updated":"2016-04-04 15:48:40.000000000","message":"What are your concerns about upgrades? I don\u0027t think what I\u0027m proposing changes upgrades in any way from the current way policy.json is handled across upgrades. But it would be good for you to list out the problems you see, maybe in a backlog spec.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3bad2ed30ff12514064198326278b3f1d801005f","unresolved":false,"context_lines":[{"line_number":38,"context_line":"allowable policies were know it still provides little information to a user"},{"line_number":39,"context_line":"about whether or not something like booting an instance is allowed because"},{"line_number":40,"context_line":"there are multiple policy checks that occur. This spec is proposing work that"},{"line_number":41,"context_line":"can be built upon to solve this issue."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Use Cases"},{"line_number":44,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_56b49e80","line":41,"updated":"2016-03-31 13:45:05.000000000","message":"I think there are two sides to this:\n\nDeployers trying to customize policy need to work out how an API call maps to the policy config. They should not need to read the code to work that out, just like with config options.\n\nAPI users also want to discover what policy allows them to do, and work out what that means without reading the source code for the API.\n\nBut I think we should first simplify our policy, rather than attempting to document our current massively fine grained policy rules. So maybe lets focus here on things to allow us to make these kinds of changes.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"b0de46da1bc8180768c71e5697398c4595e57f8b","unresolved":false,"context_lines":[{"line_number":38,"context_line":"allowable policies were know it still provides little information to a user"},{"line_number":39,"context_line":"about whether or not something like booting an instance is allowed because"},{"line_number":40,"context_line":"there are multiple policy checks that occur. This spec is proposing work that"},{"line_number":41,"context_line":"can be built upon to solve this issue."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Use Cases"},{"line_number":44,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a061dce_5240c356","line":41,"in_reply_to":"ba0121b8_56b49e80","updated":"2016-04-04 15:48:40.000000000","message":"Right, it would be too much to tackle adding a new policy framework and also simplifying policy mappings. This is just focused on the API user right now by providing a means for devs to link policies together into capabilities that users can check against. Addressing the deployer side is going to be an effort around renaming policies and coming up with some standards on naming and usage.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"38f48ebe27384c35b8570eadda0f0b8811717527","unresolved":false,"context_lines":[{"line_number":46,"context_line":"As a deployer I would like to configure only policies that differ from the"},{"line_number":47,"context_line":"default."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"As an end user I would like to know whether or not I am allowed to perform an"},{"line_number":50,"context_line":"action before I attempt to do it. This spec is proposing work that will lead"},{"line_number":51,"context_line":"into a full solution for this case."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa0719c6_1183be57","line":50,"range":{"start_line":49,"start_character":36,"end_line":50,"end_character":6},"updated":"2016-03-22 07:40:44.000000000","message":"Whether or not allowed to perform an action, sometime based on the target, and sometime based on the parameter in nova.\n\nFor based on target, there is mess around whether we pass \u0027target\u0027 in the policy enforcement function. Currently some of APIs pass the target, some of APIs not. For example, start/stop passed, pause/unpause didn\u0027t.\n\nIf we decide to not pass the target, looks like everything is fine. If we decide to pass the target, there will be a use-case: With custom policy.conf, admin user can list normal user\u0027s server, but admin can\u0027t start/stop/pause/unpause that server. So this capability is pre-server. \n\nOne more case close to this: In v2.10 API, I was allowed to perform a keypair show which owned by me, but I was disallowed to perform a show on which owned by others.\n\nSo maybe we should say \"whether or not I am allowed to perform an action on specific resource\". This change some capabilities as per-resource. \n\nFor based on parameter, the case is https://github.com/openstack/nova/blob/master/nova/api/openstack/compute/servers.py#L353, I was allowed to perform a list of servers, but I can\u0027t perform a list of deleted servers. For this maybe we should use separated capability for different parameter.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"b0de46da1bc8180768c71e5697398c4595e57f8b","unresolved":false,"context_lines":[{"line_number":46,"context_line":"As a deployer I would like to configure only policies that differ from the"},{"line_number":47,"context_line":"default."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"As an end user I would like to know whether or not I am allowed to perform an"},{"line_number":50,"context_line":"action before I attempt to do it. This spec is proposing work that will lead"},{"line_number":51,"context_line":"into a full solution for this case."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a061dce_0b2bb683","line":50,"range":{"start_line":49,"start_character":36,"end_line":50,"end_character":6},"in_reply_to":"fa0719c6_1183be57","updated":"2016-04-04 15:48:40.000000000","message":"That\u0027s a really good distinction that I had not considered. It\u0027s not possible to tell a user if they can start/stop unless they\u0027ve passed a specific instance in.\n\nDue to the flexibility of the policy language this greatly reduces how precise we can be in answering the \"am I allowed to do this\" question. The complication here means we should split the capability proposal out into a separate spec for discussion, which I know John would like anyways.\n\nMy first thought would be to introduce some vagueness in the response and have API responses like \"Yes\", \"Yes, if you\u0027re allowed to act on the resource\", \"No\". \"Yes\" and \"No\" should be easy to answer and then when a target is involved we use the yes-with-conditions response.\n\nAnother approach would be to scope the policies so that the API indicates when it\u0027s conditional and requires checking a specific resource. Something like /capabilities returns a list of what you can/can\u0027t do generally. And then /servers/\u003cuuid\u003e/capabilities would return a list of what you\u0027re allowed to do with that instance.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3bad2ed30ff12514064198326278b3f1d801005f","unresolved":false,"context_lines":[{"line_number":62,"context_line":""},{"line_number":63,"context_line":"1. The rule name, e.g. \"compute:get\" or \"os_compute_api:servers:index\""},{"line_number":64,"context_line":"2. The rule, e.g. \"rule:admin_or_owner\" or \"role:admin\""},{"line_number":65,"context_line":"3. A list of capabilities associated with that rule name."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"The rule name is needed for later lookups. The rule is necessary in order to"},{"line_number":68,"context_line":"set the defaults and generate a sample file. The list of capabilities will be"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_4a56b1ce","line":65,"updated":"2016-03-31 13:45:05.000000000","message":"I think we should think more about the capabilities are used before we start defining them.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"ce7eeb4440fedd89a19f6f14fb06504859180b1a","unresolved":false,"context_lines":[{"line_number":65,"context_line":"3. A list of capabilities associated with that rule name."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"The rule name is needed for later lookups. The rule is necessary in order to"},{"line_number":68,"context_line":"set the defaults and generate a sample file. The list of capabilities will be"},{"line_number":69,"context_line":"used to aggregate policy checks behind a user friendly name."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"As an example. Note that \u0027os_compute_api:servers:create\u0027 is needed for each of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afc51ec_a001923a","line":68,"range":{"start_line":68,"start_character":21,"end_line":68,"end_character":43},"updated":"2016-03-15 07:57:44.000000000","message":"What we can do for legacy v2 API? They have different rule name than v2.1 API, and they still write default rule in the policy.json. We probably need handle that I guess","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"38f48ebe27384c35b8570eadda0f0b8811717527","unresolved":false,"context_lines":[{"line_number":65,"context_line":"3. A list of capabilities associated with that rule name."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"The rule name is needed for later lookups. The rule is necessary in order to"},{"line_number":68,"context_line":"set the defaults and generate a sample file. The list of capabilities will be"},{"line_number":69,"context_line":"used to aggregate policy checks behind a user friendly name."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"As an example. Note that \u0027os_compute_api:servers:create\u0027 is needed for each of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa0719c6_f6bf205e","line":68,"range":{"start_line":68,"start_character":21,"end_line":68,"end_character":43},"in_reply_to":"1af94dfe_72df073a","updated":"2016-03-22 07:40:44.000000000","message":"yeah, that probably works, v2 and v2.1 keep the same rule sounds make sense also.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"0d96a205a46352105a6e5a38a99cf62bc1b2f46e","unresolved":false,"context_lines":[{"line_number":65,"context_line":"3. A list of capabilities associated with that rule name."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"The rule name is needed for later lookups. The rule is necessary in order to"},{"line_number":68,"context_line":"set the defaults and generate a sample file. The list of capabilities will be"},{"line_number":69,"context_line":"used to aggregate policy checks behind a user friendly name."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"As an example. Note that \u0027os_compute_api:servers:create\u0027 is needed for each of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1af94dfe_72df073a","line":68,"range":{"start_line":68,"start_character":21,"end_line":68,"end_character":43},"in_reply_to":"3afc51ec_a001923a","updated":"2016-03-18 19:57:15.000000000","message":"My thinking is that the policies for both API versions would need to be combined under the same capability. For instance if we have \"os_compute_api:servers:create\" for V2.1 and \"compute:create\" for V2 those would both be linked to the \"server_create\" policy. This means that server create would need to be allowed for both V2 and V2.1 in order to be listed as allowed, but I think it\u0027s reasonable to expect that.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3bad2ed30ff12514064198326278b3f1d801005f","unresolved":false,"context_lines":[{"line_number":75,"context_line":""},{"line_number":76,"context_line":"    # (rule_name, rule, capabilities)"},{"line_number":77,"context_line":"    server_policies \u003d ["},{"line_number":78,"context_line":"      (\"os_compute_api:servers:create\", \"rule:admin_or_owner\","},{"line_number":79,"context_line":"          [\u0027server_create\u0027, \u0027server_create_forced_host\u0027,"},{"line_number":80,"context_line":"              \u0027server_create_attach_volume\u0027, \u0027server_create_attach_network\u0027]),"},{"line_number":81,"context_line":"      (\"os_compute_api:servers:create:forced_host\", \"rule:admin_or_owner\","}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_c5a8f222","line":78,"range":{"start_line":78,"start_character":7,"end_line":78,"end_character":38},"updated":"2016-03-31 13:45:05.000000000","message":"I hate having this string in more than one place.\n\nIf this was copying oslo_config, passing in a definition object, then we call POLICY.servers.create.attach_volume(context) or similar, I think this would be great.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"b0de46da1bc8180768c71e5697398c4595e57f8b","unresolved":false,"context_lines":[{"line_number":75,"context_line":""},{"line_number":76,"context_line":"    # (rule_name, rule, capabilities)"},{"line_number":77,"context_line":"    server_policies \u003d ["},{"line_number":78,"context_line":"      (\"os_compute_api:servers:create\", \"rule:admin_or_owner\","},{"line_number":79,"context_line":"          [\u0027server_create\u0027, \u0027server_create_forced_host\u0027,"},{"line_number":80,"context_line":"              \u0027server_create_attach_volume\u0027, \u0027server_create_attach_network\u0027]),"},{"line_number":81,"context_line":"      (\"os_compute_api:servers:create:forced_host\", \"rule:admin_or_owner\","}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a061dce_2bd03a53","line":78,"range":{"start_line":78,"start_character":7,"end_line":78,"end_character":38},"in_reply_to":"ba0121b8_c5a8f222","updated":"2016-04-04 15:48:40.000000000","message":"I addressed this on line 125. It\u0027s not overly difficult to accomplish that, but I more wanted to move forward with something simple and then iterate.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"424c80217fde7253adcd33e72b1a3749122b5a9d","unresolved":false,"context_lines":[{"line_number":83,"context_line":"      (\"os_compute_api:servers:create:attach_volume\", \"rule:admin_or_owner\","},{"line_number":84,"context_line":"          [\u0027server_create_attach_volume\u0027]),"},{"line_number":85,"context_line":"      (\"os_compute_api:servers:create:attach_network\", \"rule:admin_or_owner\","},{"line_number":86,"context_line":"          [\u0027server_create_attach_network\u0027]),"},{"line_number":87,"context_line":"    ]"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_eba7c7ba","line":86,"updated":"2016-03-31 14:04:27.000000000","message":"As an example, I think the discussion around the number of default roles we should support (including project and servers wide observer roles, for example), would change how we group these capabilities.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"b0de46da1bc8180768c71e5697398c4595e57f8b","unresolved":false,"context_lines":[{"line_number":83,"context_line":"      (\"os_compute_api:servers:create:attach_volume\", \"rule:admin_or_owner\","},{"line_number":84,"context_line":"          [\u0027server_create_attach_volume\u0027]),"},{"line_number":85,"context_line":"      (\"os_compute_api:servers:create:attach_network\", \"rule:admin_or_owner\","},{"line_number":86,"context_line":"          [\u0027server_create_attach_network\u0027]),"},{"line_number":87,"context_line":"    ]"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a061dce_abf9eaca","line":86,"in_reply_to":"ba0121b8_eba7c7ba","updated":"2016-04-04 15:48:40.000000000","message":"I don\u0027t understand this. The capabilities are grouped on which policy checks happen for an API request. This wouldn\u0027t differ if there were more roles. The default policies would potentially change though.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3bad2ed30ff12514064198326278b3f1d801005f","unresolved":false,"context_lines":[{"line_number":91,"context_line":"    POLICY.register(server_policies)"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    def create():"},{"line_number":94,"context_line":"        POLICY.authorize(\u0027os_compute_api:servers:create\u0027, context)"},{"line_number":95,"context_line":"        if volume_to_attach:"},{"line_number":96,"context_line":"            POLICY.authorize(\u0027os_compute_api:servers:create:attach_volume\u0027)"},{"line_number":97,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_85fa7a73","line":94,"updated":"2016-03-31 13:45:05.000000000","message":"Nit: should this fail for any unregistered policy name?","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"b0de46da1bc8180768c71e5697398c4595e57f8b","unresolved":false,"context_lines":[{"line_number":91,"context_line":"    POLICY.register(server_policies)"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    def create():"},{"line_number":94,"context_line":"        POLICY.authorize(\u0027os_compute_api:servers:create\u0027, context)"},{"line_number":95,"context_line":"        if volume_to_attach:"},{"line_number":96,"context_line":"            POLICY.authorize(\u0027os_compute_api:servers:create:attach_volume\u0027)"},{"line_number":97,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a061dce_8bf6a6d5","line":94,"in_reply_to":"ba0121b8_85fa7a73","updated":"2016-04-04 15:48:40.000000000","message":"Yes. I should specify that.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"e2ff61da81c8b0fa4f989caf487fd3869b7935d7","unresolved":false,"context_lines":[{"line_number":93,"context_line":"    def create():"},{"line_number":94,"context_line":"        POLICY.authorize(\u0027os_compute_api:servers:create\u0027, context)"},{"line_number":95,"context_line":"        if volume_to_attach:"},{"line_number":96,"context_line":"            POLICY.authorize(\u0027os_compute_api:servers:create:attach_volume\u0027)"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"The current proposal would have policy registration happen near its usage, much"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1af94dfe_f2c2f751","line":96,"updated":"2016-03-18 19:58:30.000000000","message":"it\u0027s a bit more like jsonschema validation, right? I\u0027m not sure it\u0027s a bad idea to have these centralized for defaults purposes honestly.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3bad2ed30ff12514064198326278b3f1d801005f","unresolved":false,"context_lines":[{"line_number":93,"context_line":"    def create():"},{"line_number":94,"context_line":"        POLICY.authorize(\u0027os_compute_api:servers:create\u0027, context)"},{"line_number":95,"context_line":"        if volume_to_attach:"},{"line_number":96,"context_line":"            POLICY.authorize(\u0027os_compute_api:servers:create:attach_volume\u0027)"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"The current proposal would have policy registration happen near its usage, much"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_c5d91224","line":96,"in_reply_to":"1af94dfe_081ad416","updated":"2016-03-31 13:45:05.000000000","message":"So if we had POLICY.servers.create.attach_volume(context) or similar, I would push for centralizing it.\n\nWhile we have those policy strings scattered around, I like them being in the same file.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"afe42adf5d1a88dc50b1744d3be8c3c6c3248de0","unresolved":false,"context_lines":[{"line_number":93,"context_line":"    def create():"},{"line_number":94,"context_line":"        POLICY.authorize(\u0027os_compute_api:servers:create\u0027, context)"},{"line_number":95,"context_line":"        if volume_to_attach:"},{"line_number":96,"context_line":"            POLICY.authorize(\u0027os_compute_api:servers:create:attach_volume\u0027)"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"The current proposal would have policy registration happen near its usage, much"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1af94dfe_081ad416","line":96,"in_reply_to":"1af94dfe_f2c2f751","updated":"2016-03-18 20:46:59.000000000","message":"Centralize the policy definitions, or the enforcement? It\u0027s a bit different than jsonschema validation because the enforcement looks at information that is not readily available in the API request. This example doesn\u0027t show it but there\u0027s a target used in many of the calls that might be something like an instance or keypair so we would need to embed rules on what the target is and how to look it up in order to do that centrally.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"b0de46da1bc8180768c71e5697398c4595e57f8b","unresolved":false,"context_lines":[{"line_number":93,"context_line":"    def create():"},{"line_number":94,"context_line":"        POLICY.authorize(\u0027os_compute_api:servers:create\u0027, context)"},{"line_number":95,"context_line":"        if volume_to_attach:"},{"line_number":96,"context_line":"            POLICY.authorize(\u0027os_compute_api:servers:create:attach_volume\u0027)"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"The current proposal would have policy registration happen near its usage, much"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a061dce_cbd89e20","line":96,"in_reply_to":"ba0121b8_c5d91224","updated":"2016-04-04 15:48:40.000000000","message":"We can certainly centralize the registration of policies. I\u0027ll update with that.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3bad2ed30ff12514064198326278b3f1d801005f","unresolved":false,"context_lines":[{"line_number":120,"context_line":"    ]"},{"line_number":121,"context_line":"    POLICY \u003d policy.POLICY"},{"line_number":122,"context_line":"    POLICY.register(create_policies)"},{"line_number":123,"context_line":"    POLICY.register(rebuild_policies)"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"There are a lot of interface changes that could be discussed/made such as"},{"line_number":126,"context_line":"changing authorize to work like::"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_458062f7","line":123,"updated":"2016-03-31 13:45:05.000000000","message":"I feel we should more directly copy oslo_config, so you have named params to an object you create, rather than a tuple, because I can see that growing in size.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"b0de46da1bc8180768c71e5697398c4595e57f8b","unresolved":false,"context_lines":[{"line_number":120,"context_line":"    ]"},{"line_number":121,"context_line":"    POLICY \u003d policy.POLICY"},{"line_number":122,"context_line":"    POLICY.register(create_policies)"},{"line_number":123,"context_line":"    POLICY.register(rebuild_policies)"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"There are a lot of interface changes that could be discussed/made such as"},{"line_number":126,"context_line":"changing authorize to work like::"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a061dce_2b2b1aed","line":123,"in_reply_to":"ba0121b8_458062f7","updated":"2016-04-04 15:48:40.000000000","message":"Yeah. I\u0027ll update this.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"e2ff61da81c8b0fa4f989caf487fd3869b7935d7","unresolved":false,"context_lines":[{"line_number":200,"context_line":"Work Items"},{"line_number":201,"context_line":"----------"},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"* Add a Policy class to handle registration of policies."},{"line_number":204,"context_line":"* Define and register all policies."},{"line_number":205,"context_line":"* Update all policy checks to use the new Policy class."},{"line_number":206,"context_line":"* Update Devstack to only configure non default policies."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1af94dfe_b2498f33","line":203,"updated":"2016-03-18 19:58:30.000000000","message":"Can we do this back in oslo.policy? It is already merging from multiple places, and that would be a good place to have this happening so that it could more naturally expand to other projects?","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"3bad2ed30ff12514064198326278b3f1d801005f","unresolved":false,"context_lines":[{"line_number":200,"context_line":"Work Items"},{"line_number":201,"context_line":"----------"},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"* Add a Policy class to handle registration of policies."},{"line_number":204,"context_line":"* Define and register all policies."},{"line_number":205,"context_line":"* Update all policy checks to use the new Policy class."},{"line_number":206,"context_line":"* Update Devstack to only configure non default policies."}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_0ad5d91a","line":203,"in_reply_to":"1af94dfe_68e9d8b6","updated":"2016-03-31 13:45:05.000000000","message":"if we could get POLICY.servers.create.attach_volume(context) working in olso.policy, that would be a huge win.\n\nI guess if we go for a pattern when we can do a drop in replacement, that seems OK.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"afe42adf5d1a88dc50b1744d3be8c3c6c3248de0","unresolved":false,"context_lines":[{"line_number":200,"context_line":"Work Items"},{"line_number":201,"context_line":"----------"},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"* Add a Policy class to handle registration of policies."},{"line_number":204,"context_line":"* Define and register all policies."},{"line_number":205,"context_line":"* Update all policy checks to use the new Policy class."},{"line_number":206,"context_line":"* Update Devstack to only configure non default policies."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1af94dfe_68e9d8b6","line":203,"in_reply_to":"1af94dfe_b2498f33","updated":"2016-03-18 20:46:59.000000000","message":"Yes. I would like to do this in oslo.policy. I proofed it out here because it\u0027s easier to discuss and suss out details on this end before talking about something generic in oslo.policy.\n\nBut, I also would like to be able to move forward on this within Nova if the discussion in oslo gets quagmired as it has in the past. Doing something concrete within a project and then porting it to oslo has been the typical process in the past.","commit_id":"aec98be3fa4561c6daf07fd4719d0c0de08e9867"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"a479c934b06e037cca141fc8550f4c42c97b30c0","unresolved":false,"context_lines":[{"line_number":36,"context_line":"---------"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"As a deployer I would like to configure only policies that differ from the"},{"line_number":39,"context_line":"default."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a061dce_7d55984e","line":39,"updated":"2016-04-05 15:44:47.000000000","message":"\\o/","commit_id":"0fe13e2b18f2ff71c25b2568d1b51c4247f9d41b"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"512d0731588b510a8ca66daa5952be3b97ff34f5","unresolved":false,"context_lines":[{"line_number":36,"context_line":"---------"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"As a deployer I would like to configure only policies that differ from the"},{"line_number":39,"context_line":"default."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a061dce_e1de0c6c","line":39,"in_reply_to":"9a061dce_7d55984e","updated":"2016-04-06 04:05:58.000000000","message":"Yeah, this change seems very natural for me. It is nice to know easily what is intentional policies which are different from the default for each production cloud.","commit_id":"0fe13e2b18f2ff71c25b2568d1b51c4247f9d41b"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"c11ff5a0011e82c9ad58c8719be719122da339f1","unresolved":false,"context_lines":[{"line_number":73,"context_line":"        policy.PolicyCheck(name\u003d\"os_compute_api:servers:create:attach_network\","},{"line_number":74,"context_line":"            rule\u003d\"rule:admin_or_owner\"),"},{"line_number":75,"context_line":"        policy.PolicyCheck(name\u003d\"os_compute_api:servers:create\","},{"line_number":76,"context_line":"            rule\u003d\"rule:admin_or_owner\"),"},{"line_number":77,"context_line":"    ]"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a061dce_b68ba6c2","line":76,"range":{"start_line":76,"start_character":23,"end_line":76,"end_character":37},"updated":"2016-04-06 11:14:38.000000000","message":"guess this is a typo? no need to create identical policy (line #67- #68)?","commit_id":"0fe13e2b18f2ff71c25b2568d1b51c4247f9d41b"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"8d1f44e046ba5373dffc043467a3bce4288c747b","unresolved":false,"context_lines":[{"line_number":73,"context_line":"        policy.PolicyCheck(name\u003d\"os_compute_api:servers:create:attach_network\","},{"line_number":74,"context_line":"            rule\u003d\"rule:admin_or_owner\"),"},{"line_number":75,"context_line":"        policy.PolicyCheck(name\u003d\"os_compute_api:servers:create\","},{"line_number":76,"context_line":"            rule\u003d\"rule:admin_or_owner\"),"},{"line_number":77,"context_line":"    ]"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a061dce_51bddd00","line":76,"range":{"start_line":76,"start_character":23,"end_line":76,"end_character":37},"in_reply_to":"9a061dce_a8c855a9","updated":"2016-04-06 16:20:07.000000000","message":"Going with a tuple of (name, rule) is a reasonable starting point. I had proposed something like that originally and was asked for the wrapping object in order to be more extensible later. But that can be grafted on later if desired.\n\nI don\u0027t really like registering aliases separately from the rules though. Having the aliases defined with the rules makes it immediately obvious that it exists. If someone is trying to track down where a rule is defined the separate aliases means they need to check two places. The benefit of the PolicyCheck object is that it\u0027s easy to add that in at the rule definition point.","commit_id":"0fe13e2b18f2ff71c25b2568d1b51c4247f9d41b"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"bdd0a9c814d66a4deef26c83b58db2f54136e638","unresolved":false,"context_lines":[{"line_number":73,"context_line":"        policy.PolicyCheck(name\u003d\"os_compute_api:servers:create:attach_network\","},{"line_number":74,"context_line":"            rule\u003d\"rule:admin_or_owner\"),"},{"line_number":75,"context_line":"        policy.PolicyCheck(name\u003d\"os_compute_api:servers:create\","},{"line_number":76,"context_line":"            rule\u003d\"rule:admin_or_owner\"),"},{"line_number":77,"context_line":"    ]"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a061dce_a8c855a9","line":76,"range":{"start_line":76,"start_character":23,"end_line":76,"end_character":37},"in_reply_to":"9a061dce_b68ba6c2","updated":"2016-04-06 14:46:39.000000000","message":"Honestly, I feel like this ends up being the kind of rote that ends up causing bugs (as seen by the duplication here).\n\nCan we instead just take a set name, rule pairs.\n\n rules \u003d [\n  \"os_compute_api:servers:create\": \"rule:admin_or_owner\",\n  \"os_compute_api:servers:create:forced_host\": \"rule:admin_or_owner\"\n   ...\n  ]\n\n POLICY.register_rules(rules)\n\n # warn / error if there are overlaps for existing rules\n\n aliases \u003d [\n   \"servers|post\": \"os_compute_api:servers:create\"\n ]\n\n POLICY.register_aliases(aliases)","commit_id":"0fe13e2b18f2ff71c25b2568d1b51c4247f9d41b"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"6708d1a0b79c82ea3d6896bc1a09616ee6fb0e3b","unresolved":false,"context_lines":[{"line_number":73,"context_line":"        policy.PolicyCheck(name\u003d\"os_compute_api:servers:create:attach_network\","},{"line_number":74,"context_line":"            rule\u003d\"rule:admin_or_owner\"),"},{"line_number":75,"context_line":"        policy.PolicyCheck(name\u003d\"os_compute_api:servers:create\","},{"line_number":76,"context_line":"            rule\u003d\"rule:admin_or_owner\"),"},{"line_number":77,"context_line":"    ]"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a061dce_e2254e09","line":76,"range":{"start_line":76,"start_character":23,"end_line":76,"end_character":37},"in_reply_to":"9a061dce_b68ba6c2","updated":"2016-04-06 14:46:22.000000000","message":"Yeah, this is left over from copy/paste and should be removed.","commit_id":"0fe13e2b18f2ff71c25b2568d1b51c4247f9d41b"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"a479c934b06e037cca141fc8550f4c42c97b30c0","unresolved":false,"context_lines":[{"line_number":78,"context_line":""},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    POLICY \u003d policy.POLICY"},{"line_number":81,"context_line":"    POLICY.register(server_policies)"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"    nova/api/openstack/servers.py"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a061dce_30586732","line":81,"updated":"2016-04-05 15:44:47.000000000","message":"Must we replicate the ignominy of oslo config and externalized globals? How about at least a singleton or something that facades the global?","commit_id":"0fe13e2b18f2ff71c25b2568d1b51c4247f9d41b"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"b28ba226eacc30a9a6e42f555eb47283dec11401","unresolved":false,"context_lines":[{"line_number":78,"context_line":""},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    POLICY \u003d policy.POLICY"},{"line_number":81,"context_line":"    POLICY.register(server_policies)"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"    nova/api/openstack/servers.py"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a061dce_d0076b7f","line":81,"in_reply_to":"9a061dce_30586732","updated":"2016-04-05 15:48:24.000000000","message":"This does end up being a singleton right? I don\u0027t know how much effort would be involved in actually instantiating it on startup and then passing it around to consuming classes, but I can investigate it.","commit_id":"0fe13e2b18f2ff71c25b2568d1b51c4247f9d41b"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"bdd0a9c814d66a4deef26c83b58db2f54136e638","unresolved":false,"context_lines":[{"line_number":84,"context_line":"    nova/api/openstack/servers.py"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"    def create():"},{"line_number":87,"context_line":"        POLICY.authorize(\u0027os_compute_api:servers:create\u0027, context)"},{"line_number":88,"context_line":"        if volume_to_attach:"},{"line_number":89,"context_line":"            POLICY.authorize(\u0027os_compute_api:servers:create:attach_volume\u0027)"},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a061dce_e8d08d21","line":87,"updated":"2016-04-06 14:46:39.000000000","message":"given that context is always required I think this becomes more crisp with\n\n  context.can(\u0027os_compute_api:servers:create\u0027) \n\nThere might even be a version which is fatal and one that is not (can vs. must) for times that we care to do something before throwing the unauth.\n\nThis moves the details of POLICY global / singleton back to the nova.context space, which I think will make evolution easier.","commit_id":"0fe13e2b18f2ff71c25b2568d1b51c4247f9d41b"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"512d0731588b510a8ca66daa5952be3b97ff34f5","unresolved":false,"context_lines":[{"line_number":87,"context_line":"        POLICY.authorize(\u0027os_compute_api:servers:create\u0027, context)"},{"line_number":88,"context_line":"        if volume_to_attach:"},{"line_number":89,"context_line":"            POLICY.authorize(\u0027os_compute_api:servers:create:attach_volume\u0027)"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"The current proposal would have policy registration happen in a centralized"},{"line_number":93,"context_line":"place, like configuration is."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a061dce_e1272c10","line":90,"updated":"2016-04-06 04:05:58.000000000","message":"How about putting default value in current authorize() calls?\n\n eg:\n\n    @extensions.expected_errors((400, 403))\n    def index(self, req):\n        \"\"\"Returns a list of server names and ids for a given user.\"\"\"\n        context \u003d req.environ[\u0027nova.context\u0027]\n -      authorize(context, action\u003d\"index\")\n +      authorize(context, action\u003d\"index\", rule\u003d\"admin_or_owner\")\n        try:\n            servers \u003d self._get_servers(req, is_detail\u003dFalse)\n        ...\n\nIt would be easy to know which policy is applied to each API.","commit_id":"0fe13e2b18f2ff71c25b2568d1b51c4247f9d41b"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"95c47306b0f55ff39f2e21758f96985e3de333fb","unresolved":false,"context_lines":[{"line_number":87,"context_line":"        POLICY.authorize(\u0027os_compute_api:servers:create\u0027, context)"},{"line_number":88,"context_line":"        if volume_to_attach:"},{"line_number":89,"context_line":"            POLICY.authorize(\u0027os_compute_api:servers:create:attach_volume\u0027)"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"The current proposal would have policy registration happen in a centralized"},{"line_number":93,"context_line":"place, like configuration is."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a061dce_7f577eca","line":90,"in_reply_to":"9a061dce_2e1f2db8","updated":"2016-04-08 19:06:49.000000000","message":"Thanks for your try :-)\n\nOK. After setting policy on the code, we can change it for more readability if we find it because we don\u0027t need to consider backwards compatibility.","commit_id":"0fe13e2b18f2ff71c25b2568d1b51c4247f9d41b"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"d4ba63b3efd6d4f6236d0a96191537f8ce82e011","unresolved":false,"context_lines":[{"line_number":87,"context_line":"        POLICY.authorize(\u0027os_compute_api:servers:create\u0027, context)"},{"line_number":88,"context_line":"        if volume_to_attach:"},{"line_number":89,"context_line":"            POLICY.authorize(\u0027os_compute_api:servers:create:attach_volume\u0027)"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"The current proposal would have policy registration happen in a centralized"},{"line_number":93,"context_line":"place, like configuration is."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a061dce_2e1f2db8","line":90,"in_reply_to":"9a061dce_e1272c10","updated":"2016-04-06 15:10:19.000000000","message":"There\u0027s no easy way to traverse the code and find all of the authorize calls in order to generate a list of policy options. I tried :)\n\nThe defaults need to be configured in code that will run at import or startup time.","commit_id":"0fe13e2b18f2ff71c25b2568d1b51c4247f9d41b"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"d3cc8a7ef316805fa94912739933c76b99ebd1ab","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Policy in code"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/policy-in-code"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"For a while now there has been a desire to embed sane policy defaults in code"},{"line_number":14,"context_line":"and allow for a policy file to override them. This would allow deployers to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_36ae52e6","line":11,"updated":"2016-04-20 00:49:14.000000000","message":"Hasn\u0027t been created yet?","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"149d3d68b9fb9729d4f40a7bc40579e5e83d240c","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Policy in code"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/policy-in-code"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"For a while now there has been a desire to embed sane policy defaults in code"},{"line_number":14,"context_line":"and allow for a policy file to override them. This would allow deployers to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_367b962b","line":11,"in_reply_to":"1a122d0e_36ae52e6","updated":"2016-04-21 12:33:49.000000000","message":"Not yet, I tend to lazily create these after spec approval.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"c7e1b26224e82f4c63345117a5178dd72202a5ca","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Given an authenticated request context it is not possible to determine which"},{"line_number":32,"context_line":"policies will pass. This is because policy checks are ad hoc throughout the"},{"line_number":33,"context_line":"code with no central registry of all possible checks."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Use Cases"},{"line_number":36,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_d807d77f","line":33,"updated":"2016-04-08 13:23:04.000000000","message":"Nit: its tempting to mention about upgrades","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"6e34eedbe80703a4beca44d2c0458c1ff943e2eb","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Given an authenticated request context it is not possible to determine which"},{"line_number":32,"context_line":"policies will pass. This is because policy checks are ad hoc throughout the"},{"line_number":33,"context_line":"code with no central registry of all possible checks."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Use Cases"},{"line_number":36,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_017ced1e","line":33,"in_reply_to":"1a122d0e_16c876a7","updated":"2016-05-05 11:39:44.000000000","message":"What they said. Would be nice to have that here, but it not being here is not a blocker for me.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"d3cc8a7ef316805fa94912739933c76b99ebd1ab","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Given an authenticated request context it is not possible to determine which"},{"line_number":32,"context_line":"policies will pass. This is because policy checks are ad hoc throughout the"},{"line_number":33,"context_line":"code with no central registry of all possible checks."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Use Cases"},{"line_number":36,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_16c876a7","line":33,"in_reply_to":"9a061dce_1e2ad72c","updated":"2016-04-20 00:49:14.000000000","message":"+1 to what Sean said. If you\u0027re upgrading to this, then you already have a policy file with lots of stuff in it. For anything you don\u0027t, you get the defaults in code. For anything you do, you override the defaults. But for new deployments, the default policy file should be much simpler to deal with and tweak as needed.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"4a8c3ada8c6a94d2c17b7383c0577035b5903062","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Given an authenticated request context it is not possible to determine which"},{"line_number":32,"context_line":"policies will pass. This is because policy checks are ad hoc throughout the"},{"line_number":33,"context_line":"code with no central registry of all possible checks."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Use Cases"},{"line_number":36,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_1e2ad72c","line":33,"in_reply_to":"9a061dce_43591c8e","updated":"2016-04-08 13:44:54.000000000","message":"If we have sane defaults in code, and we are able to have most people run with an empty policy.json file, that makes upgrades better. \n\nThe goal being that the majority of Nova deploys can run without any policy overrides.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"3b845dcadc175cc414ffe9c31e374ff043eedb7b","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Given an authenticated request context it is not possible to determine which"},{"line_number":32,"context_line":"policies will pass. This is because policy checks are ad hoc throughout the"},{"line_number":33,"context_line":"code with no central registry of all possible checks."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Use Cases"},{"line_number":36,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_43591c8e","line":33,"in_reply_to":"9a061dce_d807d77f","updated":"2016-04-08 13:35:32.000000000","message":"I\u0027m still not clear what your concerns are about upgrades. This doesn\u0027t make upgrades harder nor does it fix anything.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"d3cc8a7ef316805fa94912739933c76b99ebd1ab","unresolved":false,"context_lines":[{"line_number":59,"context_line":"As an example. Note that \u0027os_compute_api:servers:create\u0027 is needed for each of"},{"line_number":60,"context_line":"the capabilities below::"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"    nova/policy/create.py"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"    from nova import policy"},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_f6adfa9b","line":62,"updated":"2016-04-20 00:49:14.000000000","message":"So this in a centrally located piece of code, like the nova/conf and opts stuff?\n\nI guess I was envisioning the policy defaults would be defined where the actual rule names were defined, like the REST API methods where we check the policy.\n\nMy worry is missing something when adding new REST API methods and we forget to update the central location, but I guess if we raise an exception on checking a rule name that isn\u0027t registered, that should handle it.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"149d3d68b9fb9729d4f40a7bc40579e5e83d240c","unresolved":false,"context_lines":[{"line_number":59,"context_line":"As an example. Note that \u0027os_compute_api:servers:create\u0027 is needed for each of"},{"line_number":60,"context_line":"the capabilities below::"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"    nova/policy/create.py"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"    from nova import policy"},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_36f7168e","line":62,"in_reply_to":"1a122d0e_20f7d5d3","updated":"2016-04-21 12:33:49.000000000","message":"I lean towards having registration near usage and that\u0027s how I wrote this originally. But the majority seems to favor centralization so that\u0027s the current plan.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"ffc5469aec8d9d380fb1e8f42218c027d349029a","unresolved":false,"context_lines":[{"line_number":59,"context_line":"As an example. Note that \u0027os_compute_api:servers:create\u0027 is needed for each of"},{"line_number":60,"context_line":"the capabilities below::"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"    nova/policy/create.py"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"    from nova import policy"},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_dd6184d5","line":62,"in_reply_to":"1a122d0e_36f7168e","updated":"2016-04-21 21:31:34.000000000","message":"As long as we raise an error when checking a rule that isn\u0027t registered, I\u0027m fine with centralization.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"6e34eedbe80703a4beca44d2c0458c1ff943e2eb","unresolved":false,"context_lines":[{"line_number":59,"context_line":"As an example. Note that \u0027os_compute_api:servers:create\u0027 is needed for each of"},{"line_number":60,"context_line":"the capabilities below::"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"    nova/policy/create.py"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"    from nova import policy"},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_81dc7d19","line":62,"in_reply_to":"1a122d0e_dd6184d5","updated":"2016-05-05 11:39:44.000000000","message":"So like config, having them together will help get the docs better, as we add descriptions.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"079a1ff537c5bc952b2dff41655ccac62beb1621","unresolved":false,"context_lines":[{"line_number":59,"context_line":"As an example. Note that \u0027os_compute_api:servers:create\u0027 is needed for each of"},{"line_number":60,"context_line":"the capabilities below::"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"    nova/policy/create.py"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"    from nova import policy"},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_20f7d5d3","line":62,"in_reply_to":"1a122d0e_f6adfa9b","updated":"2016-04-21 10:14:25.000000000","message":"I\u0027d like having it in a central location. Like config options, this forms a contract with operators, so it\u0027s important to be able to see it in one place and prevent proliferation.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"0b3dfd891c56aa8b5026946a94c17fe8a1255a45","unresolved":false,"context_lines":[{"line_number":64,"context_line":"    from nova import policy"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"    server_policies \u003d ["},{"line_number":67,"context_line":"        (\"os_compute_api:servers:create\", \"rule:admin_or_owner\"),"},{"line_number":68,"context_line":"        (\"os_compute_api:servers:create:forced_host\", \"rule:admin_or_owner\"),"},{"line_number":69,"context_line":"        (\"os_compute_api:servers:create:attach_volume\", \"rule:admin_or_owner\"),"},{"line_number":70,"context_line":"        (\"os_compute_api:servers:create:attach_network\","}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_e1b588ed","line":67,"updated":"2016-05-04 00:18:59.000000000","message":"we\u0027ve already got support for yaml policy file, so if you want to take advantage of that and put a comment in there (for example to explain what the resource path and operation are that correspond to the rule) that can be done.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"079a1ff537c5bc952b2dff41655ccac62beb1621","unresolved":false,"context_lines":[{"line_number":69,"context_line":"        (\"os_compute_api:servers:create:attach_volume\", \"rule:admin_or_owner\"),"},{"line_number":70,"context_line":"        (\"os_compute_api:servers:create:attach_network\","},{"line_number":71,"context_line":"            \"rule:admin_or_owner\"),"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    policy_engine \u003d policy.get_policy()"},{"line_number":75,"context_line":"    # registration will error if a duplicate policy is defined"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_40d491ea","line":72,"updated":"2016-04-21 10:14:25.000000000","message":"end list? also why a list not a dict please? We\u0027ll be looking up rules by name frequently iiuc","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"149d3d68b9fb9729d4f40a7bc40579e5e83d240c","unresolved":false,"context_lines":[{"line_number":69,"context_line":"        (\"os_compute_api:servers:create:attach_volume\", \"rule:admin_or_owner\"),"},{"line_number":70,"context_line":"        (\"os_compute_api:servers:create:attach_network\","},{"line_number":71,"context_line":"            \"rule:admin_or_owner\"),"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    policy_engine \u003d policy.get_policy()"},{"line_number":75,"context_line":"    # registration will error if a duplicate policy is defined"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_d65d027b","line":72,"in_reply_to":"1a122d0e_40d491ea","updated":"2016-04-21 12:33:49.000000000","message":"Woops, I do need to end the list. It could be done as a dict, but I\u0027m not sure I see the benefit. The only use of this is to pass it to the policy engine which is just going to iterate over this. So it\u0027s just the difference between iterating a list of tuples and iterating a dict. I don\u0027t have a strong feeling here.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":7789,"name":"John Wood","email":"john.wood@rackspace.com","username":"woodster"},"change_message_id":"fe6d9b1741414208fdd1edf99a8e19d16aa3e9a4","unresolved":false,"context_lines":[{"line_number":69,"context_line":"        (\"os_compute_api:servers:create:attach_volume\", \"rule:admin_or_owner\"),"},{"line_number":70,"context_line":"        (\"os_compute_api:servers:create:attach_network\","},{"line_number":71,"context_line":"            \"rule:admin_or_owner\"),"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    policy_engine \u003d policy.get_policy()"},{"line_number":75,"context_line":"    # registration will error if a duplicate policy is defined"}],"source_content_type":"text/x-rst","patch_set":5,"id":"dab17558_db9052ef","line":72,"in_reply_to":"1a122d0e_99661b28","updated":"2016-05-06 19:39:34.000000000","message":"I suppose if someone adds a duplicate rule name by mistake, the policy engine could trap it if a list, rather than as a mapping.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"2de54cb536d35b0a96c954fbcfa55e30a15ab622","unresolved":false,"context_lines":[{"line_number":69,"context_line":"        (\"os_compute_api:servers:create:attach_volume\", \"rule:admin_or_owner\"),"},{"line_number":70,"context_line":"        (\"os_compute_api:servers:create:attach_network\","},{"line_number":71,"context_line":"            \"rule:admin_or_owner\"),"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    policy_engine \u003d policy.get_policy()"},{"line_number":75,"context_line":"    # registration will error if a duplicate policy is defined"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_99661b28","line":72,"in_reply_to":"1a122d0e_d65d027b","updated":"2016-04-21 12:46:58.000000000","message":"OK, whichever then","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":1063,"name":"Ed Leafe","email":"ed@leafe.com","username":"ed-leafe"},"change_message_id":"119304cd3b9604821856821c24f97eb2fff29a61","unresolved":false,"context_lines":[{"line_number":71,"context_line":"            \"rule:admin_or_owner\"),"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    policy_engine \u003d policy.get_policy()"},{"line_number":75,"context_line":"    # registration will error if a duplicate policy is defined"},{"line_number":76,"context_line":"    policy_engine.register(server_policies)"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a18252c_aa61973b","line":74,"range":{"start_line":74,"start_character":20,"end_line":74,"end_character":39},"updated":"2016-04-13 14:30:21.000000000","message":"What exactly would this do? IOW, if there are more than one policy, how would the appropriate one be returned?","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"149d3d68b9fb9729d4f40a7bc40579e5e83d240c","unresolved":false,"context_lines":[{"line_number":71,"context_line":"            \"rule:admin_or_owner\"),"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    policy_engine \u003d policy.get_policy()"},{"line_number":75,"context_line":"    # registration will error if a duplicate policy is defined"},{"line_number":76,"context_line":"    policy_engine.register(server_policies)"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_b6932600","line":74,"range":{"start_line":74,"start_character":20,"end_line":74,"end_character":39},"in_reply_to":"1a122d0e_00b3b90a","updated":"2016-04-21 12:33:49.000000000","message":"It\u0027s already implicit in policy being imported from nova. If I were to add a slug I would do it as \"from nova import policy as nova_policy\" above. I don\u0027t think get_policy needs to be more specific.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"2de54cb536d35b0a96c954fbcfa55e30a15ab622","unresolved":false,"context_lines":[{"line_number":71,"context_line":"            \"rule:admin_or_owner\"),"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    policy_engine \u003d policy.get_policy()"},{"line_number":75,"context_line":"    # registration will error if a duplicate policy is defined"},{"line_number":76,"context_line":"    policy_engine.register(server_policies)"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_19732be9","line":74,"range":{"start_line":74,"start_character":20,"end_line":74,"end_character":39},"in_reply_to":"1a122d0e_b6932600","updated":"2016-04-21 12:46:58.000000000","message":"Right, got it","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"cef119a8c27bb61c2c81db280e7a7a2d0e25ed2e","unresolved":false,"context_lines":[{"line_number":71,"context_line":"            \"rule:admin_or_owner\"),"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    policy_engine \u003d policy.get_policy()"},{"line_number":75,"context_line":"    # registration will error if a duplicate policy is defined"},{"line_number":76,"context_line":"    policy_engine.register(server_policies)"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a18252c_af9d1c5b","line":74,"range":{"start_line":74,"start_character":20,"end_line":74,"end_character":39},"in_reply_to":"5a18252c_aa61973b","updated":"2016-04-13 17:23:07.000000000","message":"This assumes that policy is stored on a singleton object, like CONF for config. This just adds a nice facade over it rather than saying policy_engine \u003d policy.POLICY.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"079a1ff537c5bc952b2dff41655ccac62beb1621","unresolved":false,"context_lines":[{"line_number":71,"context_line":"            \"rule:admin_or_owner\"),"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    policy_engine \u003d policy.get_policy()"},{"line_number":75,"context_line":"    # registration will error if a duplicate policy is defined"},{"line_number":76,"context_line":"    policy_engine.register(server_policies)"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_00b3b90a","line":74,"range":{"start_line":74,"start_character":20,"end_line":74,"end_character":39},"in_reply_to":"5a18252c_af9d1c5b","updated":"2016-04-21 10:14:25.000000000","message":"Can we add a slug EG \"nova\"? Singleton assumptions often get overturned","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"cb5fbc021b025f9c4322b196b57a28e3bb77f67a","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    policy_engine \u003d policy.get_policy()"},{"line_number":75,"context_line":"    # registration will error if a duplicate policy is defined"},{"line_number":76,"context_line":"    policy_engine.register(server_policies)"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    nova/api/openstack/servers.py"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a18252c_dcf721d1","line":76,"range":{"start_line":76,"start_character":3,"end_line":76,"end_character":43},"updated":"2016-04-15 01:14:26.000000000","message":"do we want to raise error/soft warning if overridden policy.json has same rules as default?\n\nJust wondering if people start using complete generated sample file(with default from code) and just change some policy there and others as it is.\n\nBut anyways that\u0027s more on better usage of policy file, we can leave that with good documentation .","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"079a1ff537c5bc952b2dff41655ccac62beb1621","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    policy_engine \u003d policy.get_policy()"},{"line_number":75,"context_line":"    # registration will error if a duplicate policy is defined"},{"line_number":76,"context_line":"    policy_engine.register(server_policies)"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    nova/api/openstack/servers.py"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_e09afd60","line":76,"range":{"start_line":76,"start_character":3,"end_line":76,"end_character":43},"in_reply_to":"1a122d0e_361f7209","updated":"2016-04-21 10:14:25.000000000","message":"Yeah, seems better for a separate tool","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"149d3d68b9fb9729d4f40a7bc40579e5e83d240c","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    policy_engine \u003d policy.get_policy()"},{"line_number":75,"context_line":"    # registration will error if a duplicate policy is defined"},{"line_number":76,"context_line":"    policy_engine.register(server_policies)"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    nova/api/openstack/servers.py"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_1673fae8","line":76,"range":{"start_line":76,"start_character":3,"end_line":76,"end_character":43},"in_reply_to":"1a122d0e_e09afd60","updated":"2016-04-21 12:33:49.000000000","message":"Sorry, I should have been more clear here. Having a rule defined in both a policy file and code is not an error. Having the same rule defined twice in code is.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"d3cc8a7ef316805fa94912739933c76b99ebd1ab","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    policy_engine \u003d policy.get_policy()"},{"line_number":75,"context_line":"    # registration will error if a duplicate policy is defined"},{"line_number":76,"context_line":"    policy_engine.register(server_policies)"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    nova/api/openstack/servers.py"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_361f7209","line":76,"range":{"start_line":76,"start_character":3,"end_line":76,"end_character":43},"in_reply_to":"5a18252c_dcf721d1","updated":"2016-04-20 00:49:14.000000000","message":"I don\u0027t think you\u0027d want to start warning because of the upgrade case, all of a sudden you start getting warnings when you upgrade to this. Maybe that\u0027s a good thing so you clean out the redundancy from your policy.json file in your deployment, but it seems harsh to me on the first upgrade.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"e66b7b8733cc21d564825100d7e9e768270ef5dd","unresolved":false,"context_lines":[{"line_number":74,"context_line":"    policy_engine \u003d policy.get_policy()"},{"line_number":75,"context_line":"    # registration will error if a duplicate policy is defined"},{"line_number":76,"context_line":"    policy_engine.register(server_policies)"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    nova/api/openstack/servers.py"},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_ed068884","line":77,"updated":"2016-04-07 19:24:27.000000000","message":"We also need a load and merge of policy.json right? And it\u0027s ok if those rules overwrite these rules.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"4a8c3ada8c6a94d2c17b7383c0577035b5903062","unresolved":false,"context_lines":[{"line_number":74,"context_line":"    policy_engine \u003d policy.get_policy()"},{"line_number":75,"context_line":"    # registration will error if a duplicate policy is defined"},{"line_number":76,"context_line":"    policy_engine.register(server_policies)"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    nova/api/openstack/servers.py"},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_debdffd8","line":77,"in_reply_to":"9a061dce_a3ee38b2","updated":"2016-04-08 13:44:54.000000000","message":"Ok, as long as we get a merge, and the file trumps things, we\u0027re good.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"c7e1b26224e82f4c63345117a5178dd72202a5ca","unresolved":false,"context_lines":[{"line_number":74,"context_line":"    policy_engine \u003d policy.get_policy()"},{"line_number":75,"context_line":"    # registration will error if a duplicate policy is defined"},{"line_number":76,"context_line":"    policy_engine.register(server_policies)"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    nova/api/openstack/servers.py"},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_f8b8dbea","line":77,"in_reply_to":"9a061dce_ed068884","updated":"2016-04-08 13:23:04.000000000","message":"+1","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"3b845dcadc175cc414ffe9c31e374ff043eedb7b","unresolved":false,"context_lines":[{"line_number":74,"context_line":"    policy_engine \u003d policy.get_policy()"},{"line_number":75,"context_line":"    # registration will error if a duplicate policy is defined"},{"line_number":76,"context_line":"    policy_engine.register(server_policies)"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    nova/api/openstack/servers.py"},{"line_number":80,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_a3ee38b2","line":77,"in_reply_to":"9a061dce_ed068884","updated":"2016-04-08 13:35:32.000000000","message":"The way I did it in my PoC is that the policy file is read first and then nothing is overwritten when these are registered. Flipping the ordering is a bit more effort due to how the current code is setup. The result should be equivalent either way so doing that flip could be a later optimization.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"d3cc8a7ef316805fa94912739933c76b99ebd1ab","unresolved":false,"context_lines":[{"line_number":76,"context_line":"    policy_engine.register(server_policies)"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    nova/api/openstack/servers.py"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"    def create(self, context):"},{"line_number":82,"context_line":"        context.can(\u0027os_compute_api:servers:create\u0027)"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_36a2d299","line":79,"range":{"start_line":79,"start_character":4,"end_line":79,"end_character":33},"updated":"2016-04-20 00:49:14.000000000","message":"nit: nova/api/openstack/compute/servers.py :)","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"03ed7cc2817c085693eda1a1c9f249eb1e8b99ea","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    nova/api/openstack/servers.py"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"    def create(self, context):"},{"line_number":82,"context_line":"        context.can(\u0027os_compute_api:servers:create\u0027)"},{"line_number":83,"context_line":"        if volume_to_attach:"},{"line_number":84,"context_line":"            context.can(\u0027os_compute_api:servers:create:attach_volume\u0027)"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_7ae67b17","line":82,"updated":"2016-04-21 18:35:10.000000000","message":"It looks like this is going to tie oslo.context to oslo.policy. Because of the existing dependency graph for those libs, it would be better to do something like:\n\n  policy_engine.can(context, \u0027policy-name\u0027)","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"ffc5469aec8d9d380fb1e8f42218c027d349029a","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    nova/api/openstack/servers.py"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"    def create(self, context):"},{"line_number":82,"context_line":"        context.can(\u0027os_compute_api:servers:create\u0027)"},{"line_number":83,"context_line":"        if volume_to_attach:"},{"line_number":84,"context_line":"            context.can(\u0027os_compute_api:servers:create:attach_volume\u0027)"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_9d3eec27","line":82,"range":{"start_line":82,"start_character":16,"end_line":82,"end_character":19},"updated":"2016-04-21 21:31:34.000000000","message":"nit: I might name the method \u0027check\u0027 or something, since \u0027can\u0027 is a bit weird to me. There might be other name suggestions, like \u0027validate\u0027 or something?","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"67db25e4b96f5431e4481761aad57df367f21a52","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    nova/api/openstack/servers.py"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"    def create(self, context):"},{"line_number":82,"context_line":"        context.can(\u0027os_compute_api:servers:create\u0027)"},{"line_number":83,"context_line":"        if volume_to_attach:"},{"line_number":84,"context_line":"            context.can(\u0027os_compute_api:servers:create:attach_volume\u0027)"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_f97c0b74","line":82,"range":{"start_line":82,"start_character":16,"end_line":82,"end_character":19},"in_reply_to":"1a122d0e_9d3eec27","updated":"2016-04-24 18:51:07.000000000","message":"Doug: the intention here is to add this method just to the Nova subclass of RequestContext. There is no intent to tie those two project together.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"6e34eedbe80703a4beca44d2c0458c1ff943e2eb","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    nova/api/openstack/servers.py"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"    def create(self, context):"},{"line_number":82,"context_line":"        context.can(\u0027os_compute_api:servers:create\u0027)"},{"line_number":83,"context_line":"        if volume_to_attach:"},{"line_number":84,"context_line":"            context.can(\u0027os_compute_api:servers:create:attach_volume\u0027)"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_08fa1cbd","line":82,"range":{"start_line":82,"start_character":16,"end_line":82,"end_character":19},"in_reply_to":"1a122d0e_da777339","updated":"2016-05-05 11:39:44.000000000","message":"The aim here is to make quick progress, that probably means do it in Nova, then rework it into the more standard oslo form.\n\nBut its a good idea to do it in a way thats quick to convert, if thats easy.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"cb3898d214a114618555ba71be01c0f64c31d889","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    nova/api/openstack/servers.py"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"    def create(self, context):"},{"line_number":82,"context_line":"        context.can(\u0027os_compute_api:servers:create\u0027)"},{"line_number":83,"context_line":"        if volume_to_attach:"},{"line_number":84,"context_line":"            context.can(\u0027os_compute_api:servers:create:attach_volume\u0027)"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_da777339","line":82,"range":{"start_line":82,"start_character":16,"end_line":82,"end_character":19},"in_reply_to":"1a122d0e_f97c0b74","updated":"2016-04-25 13:03:33.000000000","message":"@Andrew, that\u0027s even worse. That means both that Nova\u0027s policy enforcement would work differently than all other projects and that the feature could never be moved into the libraries as written in nova. So you would either have to go through and change it in nova after we put it in the libraries, or maintain a different API indefinitely.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"d3cc8a7ef316805fa94912739933c76b99ebd1ab","unresolved":false,"context_lines":[{"line_number":84,"context_line":"            context.can(\u0027os_compute_api:servers:create:attach_volume\u0027)"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"The current proposal would have policy registration happen in a centralized"},{"line_number":88,"context_line":"place, like configuration is."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Alternatives"},{"line_number":91,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_b6e382d8","line":88,"range":{"start_line":87,"start_character":0,"end_line":88,"end_character":29},"updated":"2016-04-20 00:49:14.000000000","message":"I guess this answer my previous question.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"0b3dfd891c56aa8b5026946a94c17fe8a1255a45","unresolved":false,"context_lines":[{"line_number":142,"context_line":""},{"line_number":143,"context_line":"The performance cost of this will be in doing policy registration at service"},{"line_number":144,"context_line":"startup time. It will be similar in mechanism to configuration registration"},{"line_number":145,"context_line":"which has a negligible impact."},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"Other deployer impact"},{"line_number":148,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_c1996cd2","line":145,"updated":"2016-05-04 00:18:59.000000000","message":"should be more efficient since the policy file will be smaller.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"d3cc8a7ef316805fa94912739933c76b99ebd1ab","unresolved":false,"context_lines":[{"line_number":144,"context_line":"startup time. It will be similar in mechanism to configuration registration"},{"line_number":145,"context_line":"which has a negligible impact."},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"Other deployer impact"},{"line_number":148,"context_line":"---------------------"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"Nothing will need to change. However deployers may wish to remove configured"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_964c86c9","line":147,"updated":"2016-04-20 00:49:14.000000000","message":"So what happens with deployments that have out of tree policy to limit things? Doesn\u0027t Rackspace do a lot of feature toggling via policy because of things that the XenAPI driver can\u0027t support? Just wondering because if you have an out of tree policy rule and upgrade to this, and that rule isn\u0027t in the global registry, then I think it is supposed to raise an exception. I guess if you\u0027re doing out of tree policy rules then it\u0027s for out of tree API extensions, and in that case you already have policy checks in your API extensions and you\u0027d have to define those rules in the central registry code now too.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"ffc5469aec8d9d380fb1e8f42218c027d349029a","unresolved":false,"context_lines":[{"line_number":144,"context_line":"startup time. It will be similar in mechanism to configuration registration"},{"line_number":145,"context_line":"which has a negligible impact."},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"Other deployer impact"},{"line_number":148,"context_line":"---------------------"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"Nothing will need to change. However deployers may wish to remove configured"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_bde1289d","line":147,"in_reply_to":"1a122d0e_39126759","updated":"2016-04-21 21:31:34.000000000","message":"Yup, that\u0027s the same conclusion I came to.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"149d3d68b9fb9729d4f40a7bc40579e5e83d240c","unresolved":false,"context_lines":[{"line_number":144,"context_line":"startup time. It will be similar in mechanism to configuration registration"},{"line_number":145,"context_line":"which has a negligible impact."},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"Other deployer impact"},{"line_number":148,"context_line":"---------------------"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"Nothing will need to change. However deployers may wish to remove configured"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_39126759","line":147,"in_reply_to":"1a122d0e_964c86c9","updated":"2016-04-21 12:33:49.000000000","message":"Having written a lot of those out of tree checks I can say that most of them ended up in compute/api.py. In that case those policies will need to be registered in the central location as well, but since code already had to be added downstream for the additional checks requiring there to be code for the policy registration seems fine to me. It\u0027s pretty much the same as adding custom configuration.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":11803,"name":"Ryan Rossiter","email":"rlrossit@us.ibm.com","username":"rlrossiter"},"change_message_id":"8386af399b376786d3c24a4db6854c84c4078825","unresolved":false,"context_lines":[{"line_number":149,"context_line":""},{"line_number":150,"context_line":"Nothing will need to change. However deployers may wish to remove configured"},{"line_number":151,"context_line":"policies from their policy.json which do not differ from the defaults. A sample"},{"line_number":152,"context_line":"file should be generated with the defaults to aid in this process."},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"Developer impact"},{"line_number":155,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"dab17558_908196fe","line":152,"updated":"2016-05-12 16:31:10.000000000","message":"We need to maintain a way to keep the old default mechanism around. If I\u0027m an operator that doesn\u0027t have something listed in my policy file, I assume it will be covered by my default: \"\u003crule\u003e\" in my policy file. From the sound of this spec, Nova will now be ignoring that entry and just use its own defaults, which would break a deployer on an upgrade.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"03ed7cc2817c085693eda1a1c9f249eb1e8b99ea","unresolved":false,"context_lines":[{"line_number":155,"context_line":"----------------"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"Any policies added to the code will need to be registered before they can be"},{"line_number":158,"context_line":"used."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_7aa2fb9b","line":158,"updated":"2016-04-21 18:35:10.000000000","message":"That sort of API change needs a roll-out strategy. We can\u0027t release an oslo.policy that enforces that rule without breaking apps that don\u0027t have the policies registered. So, we should say explicitly that the pre-registration rule will only be enforced by the new can() API on the policy engine, and the existing API of oslo.policy will remain unchanged (at least in that respect).","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"67db25e4b96f5431e4481761aad57df367f21a52","unresolved":false,"context_lines":[{"line_number":155,"context_line":"----------------"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"Any policies added to the code will need to be registered before they can be"},{"line_number":158,"context_line":"used."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_d97f8f64","line":158,"in_reply_to":"1a122d0e_7aa2fb9b","updated":"2016-04-24 18:51:07.000000000","message":"I will update to be explicit about this.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"c7e1b26224e82f4c63345117a5178dd72202a5ca","unresolved":false,"context_lines":[{"line_number":168,"context_line":"  alaski"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"Other contributors:"},{"line_number":171,"context_line":"  claudiub"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Work Items"},{"line_number":174,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_7894cb43","line":171,"updated":"2016-04-08 13:23:04.000000000","message":"I should be able to help, or get help, with this if that helps speed things up.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"4a8c3ada8c6a94d2c17b7383c0577035b5903062","unresolved":false,"context_lines":[{"line_number":168,"context_line":"  alaski"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"Other contributors:"},{"line_number":171,"context_line":"  claudiub"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Work Items"},{"line_number":174,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_fe8d632b","line":171,"in_reply_to":"9a061dce_4398fc6a","updated":"2016-04-08 13:44:54.000000000","message":"Ok, great, as this is basically the #2 API subteam priority for the cycle, we should be able to carve this up and get it done in short order.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"3b845dcadc175cc414ffe9c31e374ff043eedb7b","unresolved":false,"context_lines":[{"line_number":168,"context_line":"  alaski"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"Other contributors:"},{"line_number":171,"context_line":"  claudiub"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Work Items"},{"line_number":174,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_4398fc6a","line":171,"in_reply_to":"9a061dce_7894cb43","updated":"2016-04-08 13:35:32.000000000","message":"I am likely going to focus on the changes in oslo.policy, or in Nova to wrap oslo.policy. But hunting down all of our policy checks and registering those would be a great thing to get people involved with.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"6e34eedbe80703a4beca44d2c0458c1ff943e2eb","unresolved":false,"context_lines":[{"line_number":168,"context_line":"  alaski"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"Other contributors:"},{"line_number":171,"context_line":"  claudiub"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Work Items"},{"line_number":174,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_c8b02400","line":171,"in_reply_to":"9a061dce_fe8d632b","updated":"2016-05-05 11:39:44.000000000","message":"Cool, sounds good.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"d3cc8a7ef316805fa94912739933c76b99ebd1ab","unresolved":false,"context_lines":[{"line_number":174,"context_line":"----------"},{"line_number":175,"context_line":""},{"line_number":176,"context_line":"* Add a Policy class to handle registration of policies."},{"line_number":177,"context_line":"* Define and register all policies."},{"line_number":178,"context_line":"* Update all policy checks to use the new Policy class."},{"line_number":179,"context_line":"* Update Devstack to only configure non default policies."},{"line_number":180,"context_line":"* Update deployer documentation."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_96fac641","line":177,"updated":"2016-04-20 00:49:14.000000000","message":"Does the central registration work all need to happen in one big change or can people work on this piece meal like the config option work that\u0027s been going on?","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"149d3d68b9fb9729d4f40a7bc40579e5e83d240c","unresolved":false,"context_lines":[{"line_number":174,"context_line":"----------"},{"line_number":175,"context_line":""},{"line_number":176,"context_line":"* Add a Policy class to handle registration of policies."},{"line_number":177,"context_line":"* Define and register all policies."},{"line_number":178,"context_line":"* Update all policy checks to use the new Policy class."},{"line_number":179,"context_line":"* Update Devstack to only configure non default policies."},{"line_number":180,"context_line":"* Update deployer documentation."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_f97aaf76","line":177,"in_reply_to":"1a122d0e_96fac641","updated":"2016-04-21 12:33:49.000000000","message":"It can happen piecemeal. The current mechanism for calling policy won\u0027t change, but as new policies are registered the enforcement can be switched to context.can(). Eventually we\u0027ll add some warning to the old calling style to track down anything that might have been missed and then require all policy checks to use the new style.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"c7e1b26224e82f4c63345117a5178dd72202a5ca","unresolved":false,"context_lines":[{"line_number":176,"context_line":"* Add a Policy class to handle registration of policies."},{"line_number":177,"context_line":"* Define and register all policies."},{"line_number":178,"context_line":"* Update all policy checks to use the new Policy class."},{"line_number":179,"context_line":"* Update Devstack to only configure non default policies."},{"line_number":180,"context_line":"* Update deployer documentation."},{"line_number":181,"context_line":"* Add sample file generation."},{"line_number":182,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_f861fb12","line":179,"updated":"2016-04-08 13:23:04.000000000","message":"non-default policies? shouldn\u0027t it work with an empty file?","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"4a8c3ada8c6a94d2c17b7383c0577035b5903062","unresolved":false,"context_lines":[{"line_number":176,"context_line":"* Add a Policy class to handle registration of policies."},{"line_number":177,"context_line":"* Define and register all policies."},{"line_number":178,"context_line":"* Update all policy checks to use the new Policy class."},{"line_number":179,"context_line":"* Update Devstack to only configure non default policies."},{"line_number":180,"context_line":"* Update deployer documentation."},{"line_number":181,"context_line":"* Add sample file generation."},{"line_number":182,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_9e9b8772","line":179,"in_reply_to":"9a061dce_2386a813","updated":"2016-04-08 13:44:54.000000000","message":"I does run with all defaults atm","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"3b845dcadc175cc414ffe9c31e374ff043eedb7b","unresolved":false,"context_lines":[{"line_number":176,"context_line":"* Add a Policy class to handle registration of policies."},{"line_number":177,"context_line":"* Define and register all policies."},{"line_number":178,"context_line":"* Update all policy checks to use the new Policy class."},{"line_number":179,"context_line":"* Update Devstack to only configure non default policies."},{"line_number":180,"context_line":"* Update deployer documentation."},{"line_number":181,"context_line":"* Add sample file generation."},{"line_number":182,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_2386a813","line":179,"in_reply_to":"9a061dce_f861fb12","updated":"2016-04-08 13:35:32.000000000","message":"I am not sure if devstack runs with all defaults right now. If so then yes it would be an empty file.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"e66b7b8733cc21d564825100d7e9e768270ef5dd","unresolved":false,"context_lines":[{"line_number":195,"context_line":""},{"line_number":196,"context_line":"Since it will embed policy defaults within code Devstack can be updated to"},{"line_number":197,"context_line":"configuring a smaller nova policy file as a way to ensure the defaults are"},{"line_number":198,"context_line":"used."},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"Documentation Impact"},{"line_number":201,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_eddfa80a","line":198,"updated":"2016-04-07 19:24:27.000000000","message":"The only thing I might add is the testing will include running devstack with an empty policy.json file.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"4a8c3ada8c6a94d2c17b7383c0577035b5903062","unresolved":false,"context_lines":[{"line_number":195,"context_line":""},{"line_number":196,"context_line":"Since it will embed policy defaults within code Devstack can be updated to"},{"line_number":197,"context_line":"configuring a smaller nova policy file as a way to ensure the defaults are"},{"line_number":198,"context_line":"used."},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"Documentation Impact"},{"line_number":201,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_1e9db759","line":198,"in_reply_to":"9a061dce_23afc895","updated":"2016-04-08 13:44:54.000000000","message":"It does by default. So yes.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"3b845dcadc175cc414ffe9c31e374ff043eedb7b","unresolved":false,"context_lines":[{"line_number":195,"context_line":""},{"line_number":196,"context_line":"Since it will embed policy defaults within code Devstack can be updated to"},{"line_number":197,"context_line":"configuring a smaller nova policy file as a way to ensure the defaults are"},{"line_number":198,"context_line":"used."},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"Documentation Impact"},{"line_number":201,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_23afc895","line":198,"in_reply_to":"9a061dce_d8e077cf","updated":"2016-04-08 13:35:32.000000000","message":"Okay. I wasn\u0027t sure if devstack could run with just defaults, but that\u0027s probably a goal of it so I can be explicit here.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"c7e1b26224e82f4c63345117a5178dd72202a5ca","unresolved":false,"context_lines":[{"line_number":195,"context_line":""},{"line_number":196,"context_line":"Since it will embed policy defaults within code Devstack can be updated to"},{"line_number":197,"context_line":"configuring a smaller nova policy file as a way to ensure the defaults are"},{"line_number":198,"context_line":"used."},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"Documentation Impact"},{"line_number":201,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_d8e077cf","line":198,"in_reply_to":"9a061dce_eddfa80a","updated":"2016-04-08 13:23:04.000000000","message":"+1","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"d3cc8a7ef316805fa94912739933c76b99ebd1ab","unresolved":false,"context_lines":[{"line_number":202,"context_line":""},{"line_number":203,"context_line":"Documentation for deployers about the policy file will be updated to mention"},{"line_number":204,"context_line":"that only policies which differ from the default will need to be included."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"References"},{"line_number":207,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":208,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_768e0ad1","line":205,"updated":"2016-04-20 00:49:14.000000000","message":"It\u0027d be cool if we could post the sample generated policy file in the nova devref like we do for the config options, but that\u0027s probably extra credit.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"149d3d68b9fb9729d4f40a7bc40579e5e83d240c","unresolved":false,"context_lines":[{"line_number":202,"context_line":""},{"line_number":203,"context_line":"Documentation for deployers about the policy file will be updated to mention"},{"line_number":204,"context_line":"that only policies which differ from the default will need to be included."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"References"},{"line_number":207,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":208,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_39dc2774","line":205,"in_reply_to":"1a122d0e_768e0ad1","updated":"2016-04-21 12:33:49.000000000","message":"Yeah. I already have the sample file generation working in my PoC, I just don\u0027t know anything about the publishing side of it.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"d3cc8a7ef316805fa94912739933c76b99ebd1ab","unresolved":false,"context_lines":[{"line_number":212,"context_line":"History"},{"line_number":213,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"Optional section for intended to be used each time the spec"},{"line_number":216,"context_line":"is updated to describe new design, API or any database schema"},{"line_number":217,"context_line":"updated. Useful to let reader understand what\u0027s happened along the"},{"line_number":218,"context_line":"time."},{"line_number":219,"context_line":""},{"line_number":220,"context_line":".. list-table:: Revisions"},{"line_number":221,"context_line":"   :header-rows: 1"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_16b4f67f","line":218,"range":{"start_line":215,"start_character":0,"end_line":218,"end_character":5},"updated":"2016-04-20 00:49:14.000000000","message":"You can probably omit this template wording.","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"149d3d68b9fb9729d4f40a7bc40579e5e83d240c","unresolved":false,"context_lines":[{"line_number":212,"context_line":"History"},{"line_number":213,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"Optional section for intended to be used each time the spec"},{"line_number":216,"context_line":"is updated to describe new design, API or any database schema"},{"line_number":217,"context_line":"updated. Useful to let reader understand what\u0027s happened along the"},{"line_number":218,"context_line":"time."},{"line_number":219,"context_line":""},{"line_number":220,"context_line":".. list-table:: Revisions"},{"line_number":221,"context_line":"   :header-rows: 1"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_19920ba0","line":218,"range":{"start_line":215,"start_character":0,"end_line":218,"end_character":5},"in_reply_to":"1a122d0e_16b4f67f","updated":"2016-04-21 12:33:49.000000000","message":"Can do","commit_id":"4e0eb837d00c5af8d17b771c7f6ebfe572ee126a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"acffaf2041528e74b8c0e9ad90e21ae737445a44","unresolved":false,"context_lines":[{"line_number":64,"context_line":"set the defaults and generate a sample file."},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"An optional description can also be provided. This will be available in a"},{"line_number":67,"context_line":"sample policy file which can be generated from these registered rules. It"},{"line_number":68,"context_line":"should be noted that the sample file will be generated as yaml, which"},{"line_number":69,"context_line":"oslo.policy can now take as input."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"As an example::"},{"line_number":72,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"dab17558_00313e5a","line":69,"range":{"start_line":67,"start_character":71,"end_line":69,"end_character":34},"updated":"2016-05-16 21:06:47.000000000","message":"It might be nice to provide a json to yaml converter tool, but someone could easily write that themselves.","commit_id":"8b42558cf676f3948090b6bb85395fe7d9a92b11"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"48dec201cca45aa1575bbfdd70980f0df69235a6","unresolved":false,"context_lines":[{"line_number":64,"context_line":"set the defaults and generate a sample file."},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"An optional description can also be provided. This will be available in a"},{"line_number":67,"context_line":"sample policy file which can be generated from these registered rules. It"},{"line_number":68,"context_line":"should be noted that the sample file will be generated as yaml, which"},{"line_number":69,"context_line":"oslo.policy can now take as input."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"As an example::"},{"line_number":72,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"dab17558_94b0d344","line":69,"range":{"start_line":67,"start_character":71,"end_line":69,"end_character":34},"in_reply_to":"dab17558_00313e5a","updated":"2016-05-16 21:14:43.000000000","message":"Supposedly yaml is a superset of json. In my limited experience with yaml it seems like dropping the enclosing braces and commas is all that\u0027s necessary to convert.\n\n    {\u0027foo\u0027: \u0027bar\u0027,\n     \u0027baz\u0027: \u0027meh\u0027}\n\nbecomes\n\n    \u0027foo\u0027: \u0027bar\u0027\n    \u0027baz\u0027: \u0027meh\u0027","commit_id":"8b42558cf676f3948090b6bb85395fe7d9a92b11"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"acffaf2041528e74b8c0e9ad90e21ae737445a44","unresolved":false,"context_lines":[{"line_number":155,"context_line":"Other deployer impact"},{"line_number":156,"context_line":"---------------------"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"When all policies are registered there will no longer be a fallback to the"},{"line_number":159,"context_line":"default rule. Deployers who are currently reliant on it for setting multiple"},{"line_number":160,"context_line":"policies will need to explicitly define policy overrides for those policies."},{"line_number":161,"context_line":"This will be covered in reno upgrade notes."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"Developer impact"},{"line_number":164,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"dab17558_60fbea7b","line":161,"range":{"start_line":158,"start_character":0,"end_line":161,"end_character":43},"updated":"2016-05-16 21:06:47.000000000","message":"aka the rlrossit scenario\n\nSo I think in his case the default rule is to block anything new and only expose it once they know they can or will support it.\n\nI think we also agreed that in his case he can just do some CI/CD testing where he checkpoints the generated policy between test runs and if the generated policy changes, his test fails and he has to check if the policy change is OK, and handle it before proceeding with deploying that change. I don\u0027t think any of this breaks that.","commit_id":"8b42558cf676f3948090b6bb85395fe7d9a92b11"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"48dec201cca45aa1575bbfdd70980f0df69235a6","unresolved":false,"context_lines":[{"line_number":155,"context_line":"Other deployer impact"},{"line_number":156,"context_line":"---------------------"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"When all policies are registered there will no longer be a fallback to the"},{"line_number":159,"context_line":"default rule. Deployers who are currently reliant on it for setting multiple"},{"line_number":160,"context_line":"policies will need to explicitly define policy overrides for those policies."},{"line_number":161,"context_line":"This will be covered in reno upgrade notes."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"Developer impact"},{"line_number":164,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"dab17558_94c5738f","line":161,"range":{"start_line":158,"start_character":0,"end_line":161,"end_character":43},"in_reply_to":"dab17558_60fbea7b","updated":"2016-05-16 21:14:43.000000000","message":"Right, this doesn\u0027t break that. This actually enables that.\n\nWhat makes this tricky is that what rlrossit is doing, and many others, is in conflict with the move towards interoperability. The policy changes here help with interoperability but at the expense of easy deployer customizations.\n\nUpstream what I\u0027d like to see in place is a similar check for additional policies being added to ensure there is a reno calling it out.","commit_id":"8b42558cf676f3948090b6bb85395fe7d9a92b11"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"96aac687252a28315e4af26277aa76db54c6715b","unresolved":false,"context_lines":[{"line_number":155,"context_line":"Other deployer impact"},{"line_number":156,"context_line":"---------------------"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"When all policies are registered there will no longer be a fallback to the"},{"line_number":159,"context_line":"default rule. Deployers who are currently reliant on it for setting multiple"},{"line_number":160,"context_line":"policies will need to explicitly define policy overrides for those policies."},{"line_number":161,"context_line":"This will be covered in reno upgrade notes."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"Developer impact"},{"line_number":164,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"dab17558_f72b2180","line":161,"range":{"start_line":158,"start_character":0,"end_line":161,"end_character":43},"in_reply_to":"dab17558_94c5738f","updated":"2016-05-16 21:35:18.000000000","message":"Good point on interop.","commit_id":"8b42558cf676f3948090b6bb85395fe7d9a92b11"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"acffaf2041528e74b8c0e9ad90e21ae737445a44","unresolved":false,"context_lines":[{"line_number":191,"context_line":"* Add hacking check to disallow oslo_policy.policy.Enforcer.enforce()."},{"line_number":192,"context_line":"* Update Devstack to have an empty/no policy file."},{"line_number":193,"context_line":"* Update deployer documentation."},{"line_number":194,"context_line":"* Add sample file generation configuration and tox target."},{"line_number":195,"context_line":""},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":7,"id":"dab17558_00377eff","line":194,"updated":"2016-05-16 21:06:47.000000000","message":"At the summit we talked about a policy validation nova-manage CLI or something that would tell you which policy.json entries you have in your deployment that are duplicates of what\u0027s the default in code. That would help people trim their existing policies down to only the overrides they care about. That\u0027s a convenience so not a blocker for this work, but might be worth mentioning.","commit_id":"8b42558cf676f3948090b6bb85395fe7d9a92b11"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"48dec201cca45aa1575bbfdd70980f0df69235a6","unresolved":false,"context_lines":[{"line_number":191,"context_line":"* Add hacking check to disallow oslo_policy.policy.Enforcer.enforce()."},{"line_number":192,"context_line":"* Update Devstack to have an empty/no policy file."},{"line_number":193,"context_line":"* Update deployer documentation."},{"line_number":194,"context_line":"* Add sample file generation configuration and tox target."},{"line_number":195,"context_line":""},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":7,"id":"dab17558_3443e714","line":194,"in_reply_to":"dab17558_00377eff","updated":"2016-05-16 21:14:43.000000000","message":"Yep, just forgot to mention it. I\u0027ll add that in.","commit_id":"8b42558cf676f3948090b6bb85395fe7d9a92b11"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"acffaf2041528e74b8c0e9ad90e21ae737445a44","unresolved":false,"context_lines":[{"line_number":197,"context_line":"Dependencies"},{"line_number":198,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"https://review.openstack.org/#/c/309152/"},{"line_number":201,"context_line":"https://review.openstack.org/#/c/309153/"},{"line_number":202,"context_line":""},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"Testing"}],"source_content_type":"text/x-rst","patch_set":7,"id":"dab17558_e04b5aaf","line":201,"range":{"start_line":200,"start_character":0,"end_line":201,"end_character":40},"updated":"2016-05-16 21:06:47.000000000","message":"Would be nice to provide titles for these so I don\u0027t have to click on them to find out. I\u0027m what some might call \u0027lazy\u0027.\n\nWe might also want to point out that the first one, which is already merged, is a hard functional dependency, the second one is a nice to have, but not a hard stop for the nova changes, at least I don\u0027t think they are.","commit_id":"8b42558cf676f3948090b6bb85395fe7d9a92b11"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"48dec201cca45aa1575bbfdd70980f0df69235a6","unresolved":false,"context_lines":[{"line_number":197,"context_line":"Dependencies"},{"line_number":198,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"https://review.openstack.org/#/c/309152/"},{"line_number":201,"context_line":"https://review.openstack.org/#/c/309153/"},{"line_number":202,"context_line":""},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"Testing"}],"source_content_type":"text/x-rst","patch_set":7,"id":"dab17558_7449ef30","line":201,"range":{"start_line":200,"start_character":0,"end_line":201,"end_character":40},"in_reply_to":"dab17558_e04b5aaf","updated":"2016-05-16 21:14:43.000000000","message":"Can do.","commit_id":"8b42558cf676f3948090b6bb85395fe7d9a92b11"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"acffaf2041528e74b8c0e9ad90e21ae737445a44","unresolved":false,"context_lines":[{"line_number":208,"context_line":"be limited to in tree unit and functional tests."},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"A new tox target will be added for sample policy file generation and that can"},{"line_number":211,"context_line":"be used to test that the generation works. A new job could be configured for"},{"line_number":212,"context_line":"this if desirable."},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"Devstack will be updated to run Nova without a policy file as a way to check"},{"line_number":215,"context_line":"that the defaults are used, and sane."}],"source_content_type":"text/x-rst","patch_set":7,"id":"dab17558_00693ef9","line":212,"range":{"start_line":211,"start_character":43,"end_line":212,"end_character":18},"updated":"2016-05-16 21:06:47.000000000","message":"I think we should just build it into the docs generation like we have for the config options. Then we don\u0027t need a new job.","commit_id":"8b42558cf676f3948090b6bb85395fe7d9a92b11"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"48dec201cca45aa1575bbfdd70980f0df69235a6","unresolved":false,"context_lines":[{"line_number":208,"context_line":"be limited to in tree unit and functional tests."},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"A new tox target will be added for sample policy file generation and that can"},{"line_number":211,"context_line":"be used to test that the generation works. A new job could be configured for"},{"line_number":212,"context_line":"this if desirable."},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"Devstack will be updated to run Nova without a policy file as a way to check"},{"line_number":215,"context_line":"that the defaults are used, and sane."}],"source_content_type":"text/x-rst","patch_set":7,"id":"dab17558_d4525bdd","line":212,"range":{"start_line":211,"start_character":43,"end_line":212,"end_character":18},"in_reply_to":"dab17558_00693ef9","updated":"2016-05-16 21:14:43.000000000","message":"Gotcha.","commit_id":"8b42558cf676f3948090b6bb85395fe7d9a92b11"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"5f2eab092bab775f0092fe17892c2870d8e61834","unresolved":false,"context_lines":[{"line_number":108,"context_line":"policy.authorize()."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"The current proposal would have policy registration happen in a centralized"},{"line_number":111,"context_line":"place, like configuration is."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"Alternatives"},{"line_number":114,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"dab17558_99176444","line":111,"updated":"2016-05-17 01:16:55.000000000","message":"Ahhh yes, I was going to ask about this a few lines above. I think this is important, because I think we want to have pretty meaningful (and therefore long) help strings for these.\n\nI don\u0027t see help strings in your examples. Can we do those as well? Or is that what \"description\" is expected to be?","commit_id":"86e112284670b13880a1fdf2fd5844a119f71050"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"4d5117f02e32076a6fdcacf529ca1dfdf7d73b54","unresolved":false,"context_lines":[{"line_number":108,"context_line":"policy.authorize()."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"The current proposal would have policy registration happen in a centralized"},{"line_number":111,"context_line":"place, like configuration is."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"Alternatives"},{"line_number":114,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"bab6814e_36d09953","line":111,"in_reply_to":"dab17558_99176444","updated":"2016-05-18 15:10:17.000000000","message":"That is what description is expected to be. I was just too lazy to make those long and thought out for demonstration purposes.","commit_id":"86e112284670b13880a1fdf2fd5844a119f71050"}]}