)]}'
{"specs/newton/approved/validate-tenant-user-with-keystone.rst":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"fa2a0ed1faf6448cfd697d6fda59ac2aad7c356b","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Validate project with Keystone"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/validate-project-with-keystone"},{"line_number":12,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a18252c_57424c11","line":9,"range":{"start_line":9,"start_character":31,"end_line":9,"end_character":42},"updated":"2016-04-13 06:12:21.000000000","message":"nit: these should match the title length","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"75229c9dd013ee6a233d675ceca290c113076c8d","unresolved":false,"context_lines":[{"line_number":26,"context_line":"that is outside of quota and flavor management."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"It is important to note that this implementation does not support"},{"line_number":29,"context_line":"validating the user ID.  Federated users are not mirrored in the Keystone"},{"line_number":30,"context_line":"identity backend, i.e. SQL.  An external Identity Provider is responsible for"},{"line_number":31,"context_line":"authenticating users and communicates the result of authentication to Keystone"},{"line_number":32,"context_line":"using SAML assertions."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_b55d5349","line":30,"range":{"start_line":29,"start_character":25,"end_line":30,"end_character":26},"updated":"2016-04-06 13:53:02.000000000","message":"this is no longer true. Federated users now have shadow users and actually show up in the list of users.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":35,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"The quota management feature of Nova requires a project ID to be specified as"},{"line_number":38,"context_line":"part of the CLI.  This affects nova quota-show and quota-update.  When a"},{"line_number":39,"context_line":"project is specified in one of the quota actions above, they are not checked"},{"line_number":40,"context_line":"against Keystone to validate their IDs."},{"line_number":41,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_d18d34d4","line":38,"range":{"start_line":38,"start_character":51,"end_line":38,"end_character":63},"updated":"2016-04-01 00:19:01.000000000","message":"quota-update yeah because that will try to create the quota and the if there is a duplicate than it updates it, so it\u0027s a create-or-update operation:\n\nhttps://github.com/openstack/nova/blob/master/nova/api/openstack/compute/quota_sets.py#L140","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"40201f08af5bbb773280c45dc0c5c12a0d94ac3d","unresolved":false,"context_lines":[{"line_number":40,"context_line":"against Keystone to validate their IDs."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"A user could specify a project name instead of the project ID, e.g."},{"line_number":43,"context_line":"nova quota-update --instances 9 demo.  Since no checks are done, an entry"},{"line_number":44,"context_line":"is created in Nova\u0027s project_user_quotas table where the project_id is set to"},{"line_number":45,"context_line":"the project name.  This causes invalid quotas to be set and returned if the"},{"line_number":46,"context_line":"project ID does not match what is in the project_user_quotas table."}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_1b253208","line":43,"updated":"2016-04-06 22:36:25.000000000","message":"the nova command could also validate the argument. Also, you should switch to the openstack CLI so you don\u0027t have to duplicate.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a70882ac4ef4c18d7c9525ee99560c19d79c4e45","unresolved":false,"context_lines":[{"line_number":40,"context_line":"against Keystone to validate their IDs."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"A user could specify a project name instead of the project ID, e.g."},{"line_number":43,"context_line":"nova quota-update --instances 9 demo.  Since no checks are done, an entry"},{"line_number":44,"context_line":"is created in Nova\u0027s project_user_quotas table where the project_id is set to"},{"line_number":45,"context_line":"the project name.  This causes invalid quotas to be set and returned if the"},{"line_number":46,"context_line":"project ID does not match what is in the project_user_quotas table."}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a18252c_f3ac59ef","line":43,"in_reply_to":"5a18252c_504c2370","updated":"2016-04-12 20:41:25.000000000","message":"The CLIs typically check if the thing exists by ID (GET /v3/projects/\u003cwhatever\u003e) and if that returns 404 does a search by name (with v3 if the search is by name the client needs to specify the domain, too). (also, it might be the other way around where it searches by name first?)","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"28a1bbcb22120c35ae46789b8859582049200bc4","unresolved":false,"context_lines":[{"line_number":40,"context_line":"against Keystone to validate their IDs."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"A user could specify a project name instead of the project ID, e.g."},{"line_number":43,"context_line":"nova quota-update --instances 9 demo.  Since no checks are done, an entry"},{"line_number":44,"context_line":"is created in Nova\u0027s project_user_quotas table where the project_id is set to"},{"line_number":45,"context_line":"the project name.  This causes invalid quotas to be set and returned if the"},{"line_number":46,"context_line":"project ID does not match what is in the project_user_quotas table."}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a18252c_504c2370","line":43,"in_reply_to":"9a061dce_1b253208","updated":"2016-04-12 20:23:45.000000000","message":"Validate it how? That it\u0027s a UUID? We allow non-UUID project IDs so that\u0027s a no-go (already been proposed a few times in python-novaclient).","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":46,"context_line":"project ID does not match what is in the project_user_quotas table."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"It also affects flavor management.  More specifically, nova flavor-access-add"},{"line_number":49,"context_line":"and flavor-access-list.  When a project is specified in one of the flavor"},{"line_number":50,"context_line":"actions above, they are not checked against Keystone to validate their IDs."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Use Cases"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_71d0a8c9","line":49,"range":{"start_line":49,"start_character":4,"end_line":49,"end_character":22},"updated":"2016-04-01 00:19:01.000000000","message":"I don\u0027t think this matters here, I think the API docs are wrong, they say to pass a tenant_id but the API code just takes a flavor_id:\n\nhttps://github.com/openstack/nova/blob/master/nova/api/openstack/compute/flavor_access.py#L55\n\nAnd then lists the projects for that flavor. The only one I see for flavor-access that really matters is flavor-access-add.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"28a1bbcb22120c35ae46789b8859582049200bc4","unresolved":false,"context_lines":[{"line_number":46,"context_line":"project ID does not match what is in the project_user_quotas table."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"It also affects flavor management.  More specifically, nova flavor-access-add"},{"line_number":49,"context_line":"and flavor-access-list.  When a project is specified in one of the flavor"},{"line_number":50,"context_line":"actions above, they are not checked against Keystone to validate their IDs."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Use Cases"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a18252c_104c6b41","line":49,"range":{"start_line":49,"start_character":4,"end_line":49,"end_character":22},"in_reply_to":"9a061dce_3172bb11","updated":"2016-04-12 20:23:45.000000000","message":"I\u0027ve reported a bug against the docs:\n\nhttps://bugs.launchpad.net/openstack-api-site/+bug/1569555","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"9193115382def635a7f3d960ff34666ca0b29325","unresolved":false,"context_lines":[{"line_number":46,"context_line":"project ID does not match what is in the project_user_quotas table."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"It also affects flavor management.  More specifically, nova flavor-access-add"},{"line_number":49,"context_line":"and flavor-access-list.  When a project is specified in one of the flavor"},{"line_number":50,"context_line":"actions above, they are not checked against Keystone to validate their IDs."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Use Cases"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_3172bb11","line":49,"range":{"start_line":49,"start_character":4,"end_line":49,"end_character":22},"in_reply_to":"ba0121b8_71d0a8c9","updated":"2016-04-07 11:55:07.000000000","message":"yeah, only flavor-access need it","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":61,"context_line":"quota and flavor management.  Invalid project ID provided by an end user are"},{"line_number":62,"context_line":"rejected and would not create an invalid entry in the database."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Project Priority"},{"line_number":65,"context_line":"-----------------"},{"line_number":66,"context_line":"The priority is undefined at the moment.  This implementation provides a layer"},{"line_number":67,"context_line":"of validation, such that the project ID provided by an end user are correctly"},{"line_number":68,"context_line":"validated against Keystone for quota and flavor management."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_d1a4144c","line":68,"range":{"start_line":64,"start_character":0,"end_line":68,"end_character":59},"updated":"2016-04-01 00:19:01.000000000","message":"We can drop this section, it\u0027s no longer in the template.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":71,"context_line":"Proposed change"},{"line_number":72,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"The proposed solution is to expose a Keystone client in Nova, similar to the"},{"line_number":75,"context_line":"cinder client that exists today in nova/volume/cinder.py.  Methods to get the"},{"line_number":76,"context_line":"project by their ID would be implemented.  When a project ID is specified,"},{"line_number":77,"context_line":"it would be queried against the Keystone client and validated."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"Alternatives"},{"line_number":80,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_314d909a","line":77,"range":{"start_line":74,"start_character":0,"end_line":77,"end_character":62},"updated":"2016-04-01 00:19:01.000000000","message":"Does python-keystoneclient do this for us still or do we use keystoneauth1?  I think keystoneclient is still probably the python API binding but wanted to ask.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"fa2a0ed1faf6448cfd697d6fda59ac2aad7c356b","unresolved":false,"context_lines":[{"line_number":71,"context_line":"Proposed change"},{"line_number":72,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"The proposed solution is to expose a Keystone client in Nova, similar to the"},{"line_number":75,"context_line":"cinder client that exists today in nova/volume/cinder.py.  Methods to get the"},{"line_number":76,"context_line":"project by their ID would be implemented.  When a project ID is specified,"},{"line_number":77,"context_line":"it would be queried against the Keystone client and validated."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"Alternatives"},{"line_number":80,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a18252c_175f34e6","line":77,"range":{"start_line":74,"start_character":0,"end_line":77,"end_character":62},"in_reply_to":"9a061dce_5906b11d","updated":"2016-04-13 06:12:21.000000000","message":"yes, keystoneclient is what you would use to check if a project exists","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"75229c9dd013ee6a233d675ceca290c113076c8d","unresolved":false,"context_lines":[{"line_number":71,"context_line":"Proposed change"},{"line_number":72,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"The proposed solution is to expose a Keystone client in Nova, similar to the"},{"line_number":75,"context_line":"cinder client that exists today in nova/volume/cinder.py.  Methods to get the"},{"line_number":76,"context_line":"project by their ID would be implemented.  When a project ID is specified,"},{"line_number":77,"context_line":"it would be queried against the Keystone client and validated."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"Alternatives"},{"line_number":80,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_5906b11d","line":77,"range":{"start_line":74,"start_character":0,"end_line":77,"end_character":62},"in_reply_to":"ba0121b8_314d909a","updated":"2016-04-06 13:53:02.000000000","message":"You need to use python-keystoneclient","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":78,"context_line":""},{"line_number":79,"context_line":"Alternatives"},{"line_number":80,"context_line":"------------"},{"line_number":81,"context_line":"The existing behavior, where the project ID is not validated, could be left"},{"line_number":82,"context_line":"as-is.  It would be up to the user to figure out the appropriate project ID"},{"line_number":83,"context_line":"from \"keystone tenant-list\".  However, this alternative presents user errors,"},{"line_number":84,"context_line":"where the user could mistakenly specify the project name instead of the"},{"line_number":85,"context_line":"project ID for nova quota-show or quota-update.  If this occurs, the quota"},{"line_number":86,"context_line":"would not be set correctly."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Another alternative is to have the python-novaclient validate the project ID"},{"line_number":89,"context_line":"and expect other clients (e.g. third party) to do the same.  However, it"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_713a68e8","line":86,"range":{"start_line":81,"start_character":0,"end_line":86,"end_character":27},"updated":"2016-04-01 00:19:01.000000000","message":"We don\u0027t want to do this given the confusion it causes, you can just see by the number of bugs linked to the blueprint in Launchpad.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":85,"context_line":"project ID for nova quota-show or quota-update.  If this occurs, the quota"},{"line_number":86,"context_line":"would not be set correctly."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Another alternative is to have the python-novaclient validate the project ID"},{"line_number":89,"context_line":"and expect other clients (e.g. third party) to do the same.  However, it"},{"line_number":90,"context_line":"does not prevent wrong data from being inserted into Nova if other clients do"},{"line_number":91,"context_line":"not do the validation before calling Nova."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Data model impact"},{"line_number":94,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_f1579823","line":91,"range":{"start_line":88,"start_character":0,"end_line":91,"end_character":42},"updated":"2016-04-01 00:19:01.000000000","message":"There have been attempts at doing this by validating that the project ID provided is at least a UUID, but we don\u0027t require that projects be UUIDs today so we\u0027ve rejected those changes.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Data model impact"},{"line_number":94,"context_line":"-----------------"},{"line_number":95,"context_line":"It may be possible that there are entries in Nova\u0027s project_user_quotas table,"},{"line_number":96,"context_line":"where the project_id is set to an invalid ID.  However, these entries do not"},{"line_number":97,"context_line":"hold any significant value, since no actual project is tied to them.  In such"},{"line_number":98,"context_line":"case, the quota-delete command can still be used to delete the invalid"},{"line_number":99,"context_line":"entries, since no project_id validation are done against delete operations."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"REST API impact"},{"line_number":102,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_d129b49c","line":99,"range":{"start_line":95,"start_character":0,"end_line":99,"end_character":75},"updated":"2016-04-01 00:19:01.000000000","message":"I think this is saying there is no data model impact, and then trying to reassure us. Maybe just prefix the first sentence with \"None; it maybe be possible...\".","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":101,"context_line":"REST API impact"},{"line_number":102,"context_line":"---------------"},{"line_number":103,"context_line":"Previously, a POST and GET request using an invalid project ID would create an"},{"line_number":104,"context_line":"entry in Nova\u0027s project_user_quotas table or return the quota value (if any)"},{"line_number":105,"context_line":"for the project.  With this proposal, if a Keystone service account exists to"},{"line_number":106,"context_line":"validate the project ID, HTTPBadRequest (code 400) will be returned from the"},{"line_number":107,"context_line":"POST and GET requests for an invalid project.  If a Keystone service account"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_b10fe035","line":104,"range":{"start_line":104,"start_character":56,"end_line":104,"end_character":61},"updated":"2016-04-01 00:19:01.000000000","message":"default quota","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"75229c9dd013ee6a233d675ceca290c113076c8d","unresolved":false,"context_lines":[{"line_number":102,"context_line":"---------------"},{"line_number":103,"context_line":"Previously, a POST and GET request using an invalid project ID would create an"},{"line_number":104,"context_line":"entry in Nova\u0027s project_user_quotas table or return the quota value (if any)"},{"line_number":105,"context_line":"for the project.  With this proposal, if a Keystone service account exists to"},{"line_number":106,"context_line":"validate the project ID, HTTPBadRequest (code 400) will be returned from the"},{"line_number":107,"context_line":"POST and GET requests for an invalid project.  If a Keystone service account"},{"line_number":108,"context_line":"does not exist, the functionality would continue to function as before and"},{"line_number":109,"context_line":"only a warning message would be logged (not returned via the POST or GET"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_99cde9b9","line":106,"range":{"start_line":105,"start_character":38,"end_line":106,"end_character":23},"updated":"2016-04-06 13:53:02.000000000","message":"this is bad. This would mean that service user will have an access to the project.\n\nI suggest to use the token that came with request to authenticate at keystone. This would also exclude a trip to keystone to authenticate service users.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"727eaa27fd560a59051c9835737d4838fc7decfc","unresolved":false,"context_lines":[{"line_number":102,"context_line":"---------------"},{"line_number":103,"context_line":"Previously, a POST and GET request using an invalid project ID would create an"},{"line_number":104,"context_line":"entry in Nova\u0027s project_user_quotas table or return the quota value (if any)"},{"line_number":105,"context_line":"for the project.  With this proposal, if a Keystone service account exists to"},{"line_number":106,"context_line":"validate the project ID, HTTPBadRequest (code 400) will be returned from the"},{"line_number":107,"context_line":"POST and GET requests for an invalid project.  If a Keystone service account"},{"line_number":108,"context_line":"does not exist, the functionality would continue to function as before and"},{"line_number":109,"context_line":"only a warning message would be logged (not returned via the POST or GET"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_1ce38734","line":106,"range":{"start_line":105,"start_character":38,"end_line":106,"end_character":23},"in_reply_to":"9a061dce_79be1566","updated":"2016-04-06 14:02:16.000000000","message":"\u003e and the admin could pass auth but be passing a garbage project id - that\u0027s the thing we need to validate.\n\nYou suggest to create another user that would authenticate at keystone using username and password (trip 1), validate the project id (trip 2).\n\nI suggest to take user\u0027s token and using it validate the project id at keystone (1). That\u0027s one less trip to keystone, one less credential to manage, one less thing to change in keystone.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"6da9da1603f85d6d032be4cb2358432ea790855a","unresolved":false,"context_lines":[{"line_number":102,"context_line":"---------------"},{"line_number":103,"context_line":"Previously, a POST and GET request using an invalid project ID would create an"},{"line_number":104,"context_line":"entry in Nova\u0027s project_user_quotas table or return the quota value (if any)"},{"line_number":105,"context_line":"for the project.  With this proposal, if a Keystone service account exists to"},{"line_number":106,"context_line":"validate the project ID, HTTPBadRequest (code 400) will be returned from the"},{"line_number":107,"context_line":"POST and GET requests for an invalid project.  If a Keystone service account"},{"line_number":108,"context_line":"does not exist, the functionality would continue to function as before and"},{"line_number":109,"context_line":"only a warning message would be logged (not returned via the POST or GET"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_799735ec","line":106,"range":{"start_line":105,"start_character":38,"end_line":106,"end_character":23},"in_reply_to":"9a061dce_99cde9b9","updated":"2016-04-06 13:55:24.000000000","message":"I don\u0027t understand how that helps. If the nova user is admin, it doesn\u0027t mean it\u0027s the keystone admin. So it\u0027s token is not useful to figure out this information.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"08a7e265977f00c00d2ace896d98ffef70b95ceb","unresolved":false,"context_lines":[{"line_number":102,"context_line":"---------------"},{"line_number":103,"context_line":"Previously, a POST and GET request using an invalid project ID would create an"},{"line_number":104,"context_line":"entry in Nova\u0027s project_user_quotas table or return the quota value (if any)"},{"line_number":105,"context_line":"for the project.  With this proposal, if a Keystone service account exists to"},{"line_number":106,"context_line":"validate the project ID, HTTPBadRequest (code 400) will be returned from the"},{"line_number":107,"context_line":"POST and GET requests for an invalid project.  If a Keystone service account"},{"line_number":108,"context_line":"does not exist, the functionality would continue to function as before and"},{"line_number":109,"context_line":"only a warning message would be logged (not returned via the POST or GET"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_79be1566","line":106,"range":{"start_line":105,"start_character":38,"end_line":106,"end_character":23},"in_reply_to":"9a061dce_99cde9b9","updated":"2016-04-06 13:55:58.000000000","message":"I\u0027m not sure how this fixes the problem. Most of the cases here are an admin user listing and changing quotas for project users, and the admin could pass auth but be passing a garbage project id - that\u0027s the thing we need to validate.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":102,"context_line":"---------------"},{"line_number":103,"context_line":"Previously, a POST and GET request using an invalid project ID would create an"},{"line_number":104,"context_line":"entry in Nova\u0027s project_user_quotas table or return the quota value (if any)"},{"line_number":105,"context_line":"for the project.  With this proposal, if a Keystone service account exists to"},{"line_number":106,"context_line":"validate the project ID, HTTPBadRequest (code 400) will be returned from the"},{"line_number":107,"context_line":"POST and GET requests for an invalid project.  If a Keystone service account"},{"line_number":108,"context_line":"does not exist, the functionality would continue to function as before and"},{"line_number":109,"context_line":"only a warning message would be logged (not returned via the POST or GET"},{"line_number":110,"context_line":"request)."}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_3c02870a","line":107,"range":{"start_line":105,"start_character":18,"end_line":107,"end_character":45},"updated":"2016-04-01 00:19:01.000000000","message":"We should probably talk to the API subteam (sdague, alex_xu) if this requires a microversion. This does change a successful scenario into an error, which is generally bad, but the success is really a false positive (and has generated a lot of duplicate bugs).","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"40201f08af5bbb773280c45dc0c5c12a0d94ac3d","unresolved":false,"context_lines":[{"line_number":107,"context_line":"POST and GET requests for an invalid project.  If a Keystone service account"},{"line_number":108,"context_line":"does not exist, the functionality would continue to function as before and"},{"line_number":109,"context_line":"only a warning message would be logged (not returned via the POST or GET"},{"line_number":110,"context_line":"request)."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"Security impact"},{"line_number":113,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_5ba5ea44","line":110,"updated":"2016-04-06 22:36:25.000000000","message":"I don\u0027t think this should be documented as a REST API impact. There is no change to the API.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"75229c9dd013ee6a233d675ceca290c113076c8d","unresolved":false,"context_lines":[{"line_number":111,"context_line":""},{"line_number":112,"context_line":"Security impact"},{"line_number":113,"context_line":"---------------"},{"line_number":114,"context_line":"To properly validate a project ID, a Keystone service account with enough"},{"line_number":115,"context_line":"privileges to lookup a project needs to be created.  The account should have"},{"line_number":116,"context_line":"limited access to Keystone and not any other services.  This can be done by"},{"line_number":117,"context_line":"creating the appropriate role-based rules in /etc/keystone/policy.json and"},{"line_number":118,"context_line":"granting the ability to lookup projects to a role."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"For example, an admin can create a user (e.g. validator) and add a role to it"},{"line_number":121,"context_line":"(e.g. validation).  Under /etc/keystone/policy.json, the admin would add these"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_b9db8d4e","line":118,"range":{"start_line":114,"start_character":35,"end_line":118,"end_character":50},"updated":"2016-04-06 13:53:02.000000000","message":"please see my suggestion above. With it you won\u0027t have to make modifications to keystone.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"40201f08af5bbb773280c45dc0c5c12a0d94ac3d","unresolved":false,"context_lines":[{"line_number":121,"context_line":"(e.g. validation).  Under /etc/keystone/policy.json, the admin would add these"},{"line_number":122,"context_line":"rules::"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"  \"identity:get_project\": \"rule:admin_required or role:validation\","},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Under /etc/nova/nova.conf, the admin would add these credentials::"},{"line_number":127,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_1b5d3247","line":124,"updated":"2016-04-06 22:36:25.000000000","message":"keystone\u0027s policy already defines a \"service\" role that I think will work fine for this. The nova service user should have the service role.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"833712d88c22752ffdf443ce0e9b71b11c18b6c4","unresolved":false,"context_lines":[{"line_number":121,"context_line":"(e.g. validation).  Under /etc/keystone/policy.json, the admin would add these"},{"line_number":122,"context_line":"rules::"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"  \"identity:get_project\": \"rule:admin_required or role:validation\","},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Under /etc/nova/nova.conf, the admin would add these credentials::"},{"line_number":127,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a122d0e_130f282f","line":124,"in_reply_to":"5a18252c_d7049cc1","updated":"2016-04-24 15:29:48.000000000","message":"Is this a devstack-only thing? Or is setting up a nova service account part of the install guide for keystone/nova? In other words, can we assume it exists? What does using it look like? Or I guess are you saying we\u0027d still need to configure these credentials in nova.conf but we can use a nova service account rather than an admin as proposed in this spec? Because we still have to currently configure nova to talk to cinder/glance/neutron via user/password in nova.conf so I\u0027d expect the same for keystone.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"fa2a0ed1faf6448cfd697d6fda59ac2aad7c356b","unresolved":false,"context_lines":[{"line_number":121,"context_line":"(e.g. validation).  Under /etc/keystone/policy.json, the admin would add these"},{"line_number":122,"context_line":"rules::"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"  \"identity:get_project\": \"rule:admin_required or role:validation\","},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Under /etc/nova/nova.conf, the admin would add these credentials::"},{"line_number":127,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a18252c_d7049cc1","line":124,"in_reply_to":"9a061dce_1b5d3247","updated":"2016-04-13 06:12:21.000000000","message":"++, the existing nova service user should have enough privs to check this, no need to create yet another service user","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Under /etc/nova/nova.conf, the admin would add these credentials::"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"  keystone_service_project_name \u003d service"},{"line_number":129,"context_line":"  keystone_service_user \u003d validator"},{"line_number":130,"context_line":"  keystone_service_password \u003d keystone"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"A Keystone client would be instantiated using the credentials above, if they"},{"line_number":133,"context_line":"exists."}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_bc169749","line":130,"range":{"start_line":128,"start_character":2,"end_line":130,"end_character":38},"updated":"2016-04-01 00:19:01.000000000","message":"Sean Dague might have input here given the long-term move to using the service catalog for everything so we don\u0027t have to hard-code other service information in nova configs.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"40201f08af5bbb773280c45dc0c5c12a0d94ac3d","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Under /etc/nova/nova.conf, the admin would add these credentials::"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"  keystone_service_project_name \u003d service"},{"line_number":129,"context_line":"  keystone_service_user \u003d validator"},{"line_number":130,"context_line":"  keystone_service_password \u003d keystone"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"A Keystone client would be instantiated using the credentials above, if they"},{"line_number":133,"context_line":"exists."}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_9b3782fe","line":130,"range":{"start_line":128,"start_character":2,"end_line":130,"end_character":38},"in_reply_to":"ba0121b8_bc169749","updated":"2016-04-06 22:36:25.000000000","message":"use the auth plugin options for the config options. The auth plugin to use will probably be the same as the one used for the auth_token middleware so it will be an easier configuration.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"40201f08af5bbb773280c45dc0c5c12a0d94ac3d","unresolved":false,"context_lines":[{"line_number":130,"context_line":"  keystone_service_password \u003d keystone"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"A Keystone client would be instantiated using the credentials above, if they"},{"line_number":133,"context_line":"exists."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"If Nova is not configured to perform the lookup, the operation should not be"},{"line_number":136,"context_line":"blocked.  Instead, a warning message should be logged stating that Nova is"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_1b2412c3","line":133,"updated":"2016-04-06 22:36:25.000000000","message":"This should say that an auth plugin and session will be instantiated along with a keystone client.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":133,"context_line":"exists."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"If Nova is not configured to perform the lookup, the operation should not be"},{"line_number":136,"context_line":"blocked.  Instead, a warning message should be logged stating that Nova is"},{"line_number":137,"context_line":"not configured to perform the lookup.  If Nova is configured to perform the"},{"line_number":138,"context_line":"lookup, but the Keystone service account is invalid, the operation should be"},{"line_number":139,"context_line":"blocked and an error should be reported."},{"line_number":140,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_3c29e78a","line":137,"range":{"start_line":136,"start_character":10,"end_line":137,"end_character":37},"updated":"2016-04-01 00:19:01.000000000","message":"This is an implementation detail (nit) but I\u0027d think we should only log this warning once rather than on every API call.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":135,"context_line":"If Nova is not configured to perform the lookup, the operation should not be"},{"line_number":136,"context_line":"blocked.  Instead, a warning message should be logged stating that Nova is"},{"line_number":137,"context_line":"not configured to perform the lookup.  If Nova is configured to perform the"},{"line_number":138,"context_line":"lookup, but the Keystone service account is invalid, the operation should be"},{"line_number":139,"context_line":"blocked and an error should be reported."},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"Notifications impact"},{"line_number":142,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_dc2eeb8a","line":139,"range":{"start_line":138,"start_character":8,"end_line":139,"end_character":40},"updated":"2016-04-01 00:19:01.000000000","message":"Hmm, I\u0027m not sure about this. Misconfiguration is really the deployers problem, do we want to block the API user? Probably another question for the API subteam.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":146,"context_line":"---------------------"},{"line_number":147,"context_line":"If a Keystone service account exists to validate the project ID,"},{"line_number":148,"context_line":"HTTPBadRequest will be returned from the POST and GET requests for an invalid"},{"line_number":149,"context_line":"project.  The explaination would be:"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"* The specified project ID is not valid."},{"line_number":152,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_1c534318","line":149,"range":{"start_line":149,"start_character":14,"end_line":149,"end_character":26},"updated":"2016-04-01 00:19:01.000000000","message":"explanation","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Performance Impact"},{"line_number":154,"context_line":"------------------"},{"line_number":155,"context_line":"There will be minor impact to performance.  A connection to Keystone is"},{"line_number":156,"context_line":"required to validate the project ID.  However, it would be a"},{"line_number":157,"context_line":"low-frequency operation because quotas/flavor access are not often changed."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"Other deployer impact"},{"line_number":160,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_bc6b37b6","line":157,"range":{"start_line":155,"start_character":44,"end_line":157,"end_character":75},"updated":"2016-04-01 00:19:01.000000000","message":"Just a thought, but we could cache the results of the validation if the project does exist so we don\u0027t go back and check again, at least within some time window (1 hour?). Could be a later addition to.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":158,"context_line":""},{"line_number":159,"context_line":"Other deployer impact"},{"line_number":160,"context_line":"---------------------"},{"line_number":161,"context_line":"None"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"Developer impact"},{"line_number":164,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_dc5c2b1b","line":161,"range":{"start_line":161,"start_character":0,"end_line":161,"end_character":4},"updated":"2016-04-01 00:19:01.000000000","message":"Well, the deployment impact, specifically, is creating the validation account in keystone and configuring that in nova.conf, right? We should probably be explicit about that.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":162,"context_line":""},{"line_number":163,"context_line":"Developer impact"},{"line_number":164,"context_line":"----------------"},{"line_number":165,"context_line":"To properly validate a project ID, a Keystone service account needs to be"},{"line_number":166,"context_line":"created.  If a Keystone service account does not exist, the quota and flavor"},{"line_number":167,"context_line":"operation should not be blocked.  Instead, a warning message should be"},{"line_number":168,"context_line":"logged stating that the Keystone service account does not exist.  This will"},{"line_number":169,"context_line":"allow existing deployments to continue to work."},{"line_number":170,"context_line":""},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_1ca183f8","line":169,"range":{"start_line":165,"start_character":0,"end_line":169,"end_character":47},"updated":"2016-04-01 00:19:01.000000000","message":"This should be in the \u0027Other deployer impact\u0027 section, and the Developer impact section should just say None.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":189,"context_line":"* Implement methods to get the project by a given ID."},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"* Modify QuotaSetsController class in"},{"line_number":192,"context_line":"  nova/api/openstack/compute/contrib/quotas.py to validate the project ID, if"},{"line_number":193,"context_line":"  any."},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"* Modify FlavorActionController class in"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_9cad93eb","line":192,"range":{"start_line":192,"start_character":2,"end_line":192,"end_character":46},"updated":"2016-04-01 00:19:01.000000000","message":"This path has changed for v2.1.\n\nWe might also want to point out somewhere that this is going to be a v2.1 API implementation only, we aren\u0027t doing anything for the legacy v2.0 API.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":193,"context_line":"  any."},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"* Modify FlavorActionController class in"},{"line_number":196,"context_line":"  nova/api/openstack/compute/contrib/flavor_access.py to validate the project"},{"line_number":197,"context_line":"  ID, if any."},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"* Modify devstack to create the Keystone service account, saving its"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_3c856759","line":196,"range":{"start_line":196,"start_character":2,"end_line":196,"end_character":53},"updated":"2016-04-01 00:19:01.000000000","message":"This has changed for v2.1.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"40201f08af5bbb773280c45dc0c5c12a0d94ac3d","unresolved":false,"context_lines":[{"line_number":196,"context_line":"  nova/api/openstack/compute/contrib/flavor_access.py to validate the project"},{"line_number":197,"context_line":"  ID, if any."},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"* Modify devstack to create the Keystone service account, saving its"},{"line_number":200,"context_line":"  credentials in /etc/nova/nova.conf, and limiting its access in"},{"line_number":201,"context_line":"  /etc/keystone/policy.json."},{"line_number":202,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_d659d136","line":199,"updated":"2016-04-06 22:36:25.000000000","message":"devstack already creates a service account for nova.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"40201f08af5bbb773280c45dc0c5c12a0d94ac3d","unresolved":false,"context_lines":[{"line_number":198,"context_line":""},{"line_number":199,"context_line":"* Modify devstack to create the Keystone service account, saving its"},{"line_number":200,"context_line":"  credentials in /etc/nova/nova.conf, and limiting its access in"},{"line_number":201,"context_line":"  /etc/keystone/policy.json."},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"* Create tempest test cases and Nova unit test cases to verify functionality."},{"line_number":204,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a061dce_f66b35b7","line":201,"updated":"2016-04-06 22:36:25.000000000","message":"please don\u0027t modify our policy.json file. Change the sample/default so that it works for what we need to do.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"be22a2a833a1dfb3180db458fd7af048912bed0b","unresolved":false,"context_lines":[{"line_number":215,"context_line":"quota-update.  More specifically, the --tenant options need to be specified"},{"line_number":216,"context_line":"with the proper ID for positive test cases, and invalid IDs for negative test"},{"line_number":217,"context_line":"cases.  The following commands should also be tested: flavor-access-add and"},{"line_number":218,"context_line":"flavor-access-list.  The tenant_id needs to be specified with the proper ID"},{"line_number":219,"context_line":"for positive test cases, and invalid IDs for negative test cases."},{"line_number":220,"context_line":""},{"line_number":221,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_bc9977c6","line":218,"range":{"start_line":218,"start_character":0,"end_line":218,"end_character":18},"updated":"2016-04-01 00:19:01.000000000","message":"Again, I think this is probably wrong or confused.","commit_id":"aa8c83dbb4cb2815b047899bcb28a017d550d530"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"b0ef401b9531d29193141a27712613d6658302b9","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/validate-project-with-keystone"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Currently, Nova does not check the validity of a project when the id or name is"},{"line_number":14,"context_line":"provided by the end user."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"The scope of this blueprint is to add project id validation to quota management"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a122d0e_cb6a9eb2","line":13,"updated":"2016-04-28 21:52:30.000000000","message":"Be more specific - admin user and that the project id is not their own.","commit_id":"1f0a533b895a49d1064717503b719046ca622dfb"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"8058351da3b59eed176faf71e374b6726e3fc433","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/validate-project-with-keystone"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Currently, Nova does not check the validity of a project when the id or name is"},{"line_number":14,"context_line":"provided by the end user."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"The scope of this blueprint is to add project id validation to quota management"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a122d0e_4dd32a04","line":13,"in_reply_to":"1a122d0e_cb6a9eb2","updated":"2016-04-29 17:25:11.000000000","message":"Done","commit_id":"1f0a533b895a49d1064717503b719046ca622dfb"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e85103185d929cd9d0e1304781ed3d5aa5a8d486","unresolved":false,"context_lines":[{"line_number":15,"context_line":"of this administrator-provided project id."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"The scope of this blueprint is to add project id validation to quota management"},{"line_number":18,"context_line":"(i.e. quota-defaults, quota-show, quota-update) and to flavor access management"},{"line_number":19,"context_line":"(i.e. flavor-access-add, flavor-access-list). Adding project id validation to"},{"line_number":20,"context_line":"any functionality outside of quota and flavor management is beyond the scope of"},{"line_number":21,"context_line":"this blueprint."}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_26f74bd4","line":18,"range":{"start_line":18,"start_character":22,"end_line":18,"end_character":32},"updated":"2016-05-16 15:49:42.000000000","message":"And quota-detail I suppose since that\u0027s the same as quota-show except it includes usages in the response:\n\nhttps://github.com/openstack/nova/blob/67af54deb38d6a8e9c937e60de2deeecfcc2599e/nova/api/openstack/compute/quota_sets.py#L95\n\nNote also that show and detail behave differently based on whether or not a user_id is passed in on the request, so we might need to also validate the user_id in those cases.","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e85103185d929cd9d0e1304781ed3d5aa5a8d486","unresolved":false,"context_lines":[{"line_number":15,"context_line":"of this administrator-provided project id."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"The scope of this blueprint is to add project id validation to quota management"},{"line_number":18,"context_line":"(i.e. quota-defaults, quota-show, quota-update) and to flavor access management"},{"line_number":19,"context_line":"(i.e. flavor-access-add, flavor-access-list). Adding project id validation to"},{"line_number":20,"context_line":"any functionality outside of quota and flavor management is beyond the scope of"},{"line_number":21,"context_line":"this blueprint."}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_a687bb5f","line":18,"range":{"start_line":18,"start_character":6,"end_line":18,"end_character":20},"updated":"2016-05-16 15:49:42.000000000","message":"Defaults doesn\u0027t create anything in the DB as far as I know, but it would just return the defaults if the project ID passed in doesn\u0027t exist:\n\nhttps://github.com/openstack/nova/blob/67af54deb38d6a8e9c937e60de2deeecfcc2599e/nova/api/openstack/compute/quota_sets.py#L151\n\nWhich is misleading.","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":15,"context_line":"of this administrator-provided project id."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"The scope of this blueprint is to add project id validation to quota management"},{"line_number":18,"context_line":"(i.e. quota-defaults, quota-show, quota-update) and to flavor access management"},{"line_number":19,"context_line":"(i.e. flavor-access-add, flavor-access-list). Adding project id validation to"},{"line_number":20,"context_line":"any functionality outside of quota and flavor management is beyond the scope of"},{"line_number":21,"context_line":"this blueprint."}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_40f506eb","line":18,"in_reply_to":"dab17558_26f74bd4","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":15,"context_line":"of this administrator-provided project id."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"The scope of this blueprint is to add project id validation to quota management"},{"line_number":18,"context_line":"(i.e. quota-defaults, quota-show, quota-update) and to flavor access management"},{"line_number":19,"context_line":"(i.e. flavor-access-add, flavor-access-list). Adding project id validation to"},{"line_number":20,"context_line":"any functionality outside of quota and flavor management is beyond the scope of"},{"line_number":21,"context_line":"this blueprint."}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_20d1e257","line":18,"in_reply_to":"dab17558_a687bb5f","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e85103185d929cd9d0e1304781ed3d5aa5a8d486","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"The scope of this blueprint is to add project id validation to quota management"},{"line_number":18,"context_line":"(i.e. quota-defaults, quota-show, quota-update) and to flavor access management"},{"line_number":19,"context_line":"(i.e. flavor-access-add, flavor-access-list). Adding project id validation to"},{"line_number":20,"context_line":"any functionality outside of quota and flavor management is beyond the scope of"},{"line_number":21,"context_line":"this blueprint."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_26f62b8f","line":19,"range":{"start_line":19,"start_character":25,"end_line":19,"end_character":43},"updated":"2016-05-16 15:49:42.000000000","message":"I think the CLI for flavor-access-list is wrong, the API doesn\u0027t take a tenant:\n\nhttp://docs.openstack.org/cli-reference/nova.html#nova-flavor-access-list\n\nhttps://github.com/openstack/nova/blob/67af54deb38d6a8e9c937e60de2deeecfcc2599e/nova/api/openstack/compute/flavor_access.py#L51\n\nIt just takes the flavor and lists the tenants that have access to that flavor.\n\nSo flavor-access-list doesn\u0027t need to be in this list of changes, I\u0027ll push a patch to fix the novaclient help.","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cd87ec0dfa0a9608bb10dbfd11d831cd54a505","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"The scope of this blueprint is to add project id validation to quota management"},{"line_number":18,"context_line":"(i.e. quota-defaults, quota-show, quota-update) and to flavor access management"},{"line_number":19,"context_line":"(i.e. flavor-access-add, flavor-access-list). Adding project id validation to"},{"line_number":20,"context_line":"any functionality outside of quota and flavor management is beyond the scope of"},{"line_number":21,"context_line":"this blueprint."},{"line_number":22,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_0b55e8c0","line":19,"range":{"start_line":19,"start_character":25,"end_line":19,"end_character":43},"in_reply_to":"dab17558_26f62b8f","updated":"2016-05-16 17:44:14.000000000","message":"https://review.openstack.org/#/c/316972/\n\nhttps://review.openstack.org/#/c/316969/","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cd87ec0dfa0a9608bb10dbfd11d831cd54a505","unresolved":false,"context_lines":[{"line_number":47,"context_line":"Flavor access management is affected the same way. The result of providing an"},{"line_number":48,"context_line":"invalid project id is that a project won\u0027t have access to a private flavor that"},{"line_number":49,"context_line":"it should have access to, potentially creating more work for"},{"line_number":50,"context_line":"administrators. Additionally, using flavor-access-list as a source for project"},{"line_number":51,"context_line":"id\u0027s could create bugs as there is no guarantee that the project id returned by"},{"line_number":52,"context_line":"this command actually exists."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Use Cases"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_8b73984d","line":52,"range":{"start_line":50,"start_character":16,"end_line":52,"end_character":29},"updated":"2016-05-16 17:44:14.000000000","message":"While true, I don\u0027t think we\u0027re validating existing busted stuff that comes out of flavor-access-list, we\u0027re just fixing addFlavorAccess so that new broken isn\u0027t introduced.","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":49,"context_line":"it should have access to, potentially creating more work for"},{"line_number":50,"context_line":"administrators. Additionally, using flavor-access-list as a source for project"},{"line_number":51,"context_line":"id\u0027s could create bugs as there is no guarantee that the project id returned by"},{"line_number":52,"context_line":"this command actually exists."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Use Cases"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_c04f3632","line":52,"in_reply_to":"dab17558_8b73984d","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cd87ec0dfa0a9608bb10dbfd11d831cd54a505","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"If the requestor passes the authorization check:"},{"line_number":74,"context_line":"* if the project exists, they will recieve a 200 response"},{"line_number":75,"context_line":"* if the project does not exist, they will receive a 400 response"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"If the requestor does not pass the authorization check, they will receive a 403"},{"line_number":78,"context_line":"response indicating they are not authorized to know whether or not the project"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_ebffc463","line":75,"range":{"start_line":75,"start_character":53,"end_line":75,"end_character":56},"updated":"2016-05-16 17:44:14.000000000","message":"404 from keystone, which in turns means a 400 to the nova requester.","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"If the requestor passes the authorization check:"},{"line_number":74,"context_line":"* if the project exists, they will recieve a 200 response"},{"line_number":75,"context_line":"* if the project does not exist, they will receive a 400 response"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"If the requestor does not pass the authorization check, they will receive a 403"},{"line_number":78,"context_line":"response indicating they are not authorized to know whether or not the project"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_60964a3f","line":75,"in_reply_to":"dab17558_ebffc463","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cd87ec0dfa0a9608bb10dbfd11d831cd54a505","unresolved":false,"context_lines":[{"line_number":83,"context_line":"this policy. This update will require a release note and a documentation"},{"line_number":84,"context_line":"update."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"API changes will only impact API 2.1 as API 2.0 is slated for removal during"},{"line_number":87,"context_line":"this release cycle."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Alternatives"},{"line_number":90,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_8b1d58c0","line":87,"range":{"start_line":86,"start_character":37,"end_line":87,"end_character":19},"updated":"2016-05-16 17:44:14.000000000","message":"This is misleading. The v2.0 API is still available, but it\u0027s proxied through the v2.1 compat mode. However, the v2.0 code will be deleted. And the v2.0 API is frozen so we wouldn\u0027t add this support to v2.0 anyway.","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":84,"context_line":"update."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"API changes will only impact API 2.1 as API 2.0 is slated for removal during"},{"line_number":87,"context_line":"this release cycle."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Alternatives"},{"line_number":90,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_0095be31","line":87,"in_reply_to":"dab17558_8b1d58c0","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cd87ec0dfa0a9608bb10dbfd11d831cd54a505","unresolved":false,"context_lines":[{"line_number":101,"context_line":"as this change would only apply to project id verification."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"An alternative discussed during the cross-project session at the Newton summit"},{"line_number":104,"context_line":"was to use the Nova admin token to access the data from Keystone. This was"},{"line_number":105,"context_line":"dismissed because it obfuscates what users have access to what resources and"},{"line_number":106,"context_line":"could present a potential security risk."},{"line_number":107,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_ab65bc45","line":104,"range":{"start_line":104,"start_character":20,"end_line":104,"end_character":25},"updated":"2016-05-16 17:44:14.000000000","message":"s/admin/service user/ token I think.","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":101,"context_line":"as this change would only apply to project id verification."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"An alternative discussed during the cross-project session at the Newton summit"},{"line_number":104,"context_line":"was to use the Nova admin token to access the data from Keystone. This was"},{"line_number":105,"context_line":"dismissed because it obfuscates what users have access to what resources and"},{"line_number":106,"context_line":"could present a potential security risk."},{"line_number":107,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_2090c242","line":104,"in_reply_to":"dab17558_ab65bc45","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cd87ec0dfa0a9608bb10dbfd11d831cd54a505","unresolved":false,"context_lines":[{"line_number":119,"context_line":"REST API impact"},{"line_number":120,"context_line":"---------------"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"Project id validation would create a new error condition for certain api"},{"line_number":123,"context_line":"methods."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"If a Keystone service account exists to validate the project id, and the"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_cbc76010","line":122,"range":{"start_line":122,"start_character":69,"end_line":122,"end_character":72},"updated":"2016-05-16 17:44:14.000000000","message":"API","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":119,"context_line":"REST API impact"},{"line_number":120,"context_line":"---------------"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"Project id validation would create a new error condition for certain api"},{"line_number":123,"context_line":"methods."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"If a Keystone service account exists to validate the project id, and the"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_c070d642","line":122,"in_reply_to":"dab17558_cbc76010","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cd87ec0dfa0a9608bb10dbfd11d831cd54a505","unresolved":false,"context_lines":[{"line_number":124,"context_line":""},{"line_number":125,"context_line":"If a Keystone service account exists to validate the project id, and the"},{"line_number":126,"context_line":"project id is invalid, the API will return an HTTPBadRequest from the POST and"},{"line_number":127,"context_line":"GET requests. The error text will say:"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"* The specified project id is not valid."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"The following API methods would be impacted:"},{"line_number":132,"context_line":"* quota-show"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_abf3fc71","line":129,"range":{"start_line":127,"start_character":14,"end_line":129,"end_character":40},"updated":"2016-05-16 17:44:14.000000000","message":"This is pretty low level implementation detail that we can hash out in the review, but OK.","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":126,"context_line":"project id is invalid, the API will return an HTTPBadRequest from the POST and"},{"line_number":127,"context_line":"GET requests. The error text will say:"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"* The specified project id is not valid."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"The following API methods would be impacted:"},{"line_number":132,"context_line":"* quota-show"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_e0735a4c","line":129,"in_reply_to":"dab17558_abf3fc71","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cd87ec0dfa0a9608bb10dbfd11d831cd54a505","unresolved":false,"context_lines":[{"line_number":128,"context_line":""},{"line_number":129,"context_line":"* The specified project id is not valid."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"The following API methods would be impacted:"},{"line_number":132,"context_line":"* quota-show"},{"line_number":133,"context_line":"* quota-update"},{"line_number":134,"context_line":"* flavor-access-add"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_0bb3289b","line":131,"updated":"2016-05-16 17:44:14.000000000","message":"You don\u0027t have quota defaults in this list.","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":128,"context_line":""},{"line_number":129,"context_line":"* The specified project id is not valid."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"The following API methods would be impacted:"},{"line_number":132,"context_line":"* quota-show"},{"line_number":133,"context_line":"* quota-update"},{"line_number":134,"context_line":"* flavor-access-add"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_a0a4b2a5","line":131,"in_reply_to":"dab17558_0bb3289b","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cd87ec0dfa0a9608bb10dbfd11d831cd54a505","unresolved":false,"context_lines":[{"line_number":129,"context_line":"* The specified project id is not valid."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"The following API methods would be impacted:"},{"line_number":132,"context_line":"* quota-show"},{"line_number":133,"context_line":"* quota-update"},{"line_number":134,"context_line":"* flavor-access-add"},{"line_number":135,"context_line":"* flavor-access-list"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_cbbc806e","line":132,"range":{"start_line":132,"start_character":8,"end_line":132,"end_character":12},"updated":"2016-05-16 17:44:14.000000000","message":"And detail, see above. At least that\u0027s the API, maybe not the same as the CLI.","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":129,"context_line":"* The specified project id is not valid."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"The following API methods would be impacted:"},{"line_number":132,"context_line":"* quota-show"},{"line_number":133,"context_line":"* quota-update"},{"line_number":134,"context_line":"* flavor-access-add"},{"line_number":135,"context_line":"* flavor-access-list"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_80a1ae96","line":132,"in_reply_to":"dab17558_cbbc806e","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cd87ec0dfa0a9608bb10dbfd11d831cd54a505","unresolved":false,"context_lines":[{"line_number":132,"context_line":"* quota-show"},{"line_number":133,"context_line":"* quota-update"},{"line_number":134,"context_line":"* flavor-access-add"},{"line_number":135,"context_line":"* flavor-access-list"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"Security impact"},{"line_number":138,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_8bf9d850","line":135,"range":{"start_line":135,"start_character":2,"end_line":135,"end_character":20},"updated":"2016-05-16 17:44:14.000000000","message":"I don\u0027t think so, see above.","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":132,"context_line":"* quota-show"},{"line_number":133,"context_line":"* quota-update"},{"line_number":134,"context_line":"* flavor-access-add"},{"line_number":135,"context_line":"* flavor-access-list"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"Security impact"},{"line_number":138,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_e0aa3a70","line":135,"in_reply_to":"dab17558_8bf9d850","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cd87ec0dfa0a9608bb10dbfd11d831cd54a505","unresolved":false,"context_lines":[{"line_number":152,"context_line":"required to validate the project id, it would be a low-frequency operation"},{"line_number":153,"context_line":"because quotas/flavor access are not often changed."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"Profiling should be done to ensure there is no significant performance impact."},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"Other end user impact"},{"line_number":158,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_2b754cca","line":155,"updated":"2016-05-16 17:44:14.000000000","message":"orly - are you going to do that? I\u0027d probably omit this, we don\u0027t run Rally on Nova. Someone is free to test the performance hit of this, but I don\u0027t think we want to call it out here.","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":152,"context_line":"required to validate the project id, it would be a low-frequency operation"},{"line_number":153,"context_line":"because quotas/flavor access are not often changed."},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"Profiling should be done to ensure there is no significant performance impact."},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"Other end user impact"},{"line_number":158,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_00bc9eb9","line":155,"in_reply_to":"dab17558_2b754cca","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cd87ec0dfa0a9608bb10dbfd11d831cd54a505","unresolved":false,"context_lines":[{"line_number":169,"context_line":""},{"line_number":170,"context_line":"The quota and flavor operations should not be blocked if either Keystone does"},{"line_number":171,"context_line":"not exist or if the Keystone policy is not set up correctly for project id"},{"line_number":172,"context_line":"validation. In this case, a warning message should be logged indicating that"},{"line_number":173,"context_line":"project id validation is unavailable."},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"Developer impact"},{"line_number":176,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_2b238cbe","line":173,"range":{"start_line":172,"start_character":12,"end_line":173,"end_character":37},"updated":"2016-05-16 17:44:14.000000000","message":"I\u0027m not sure if we should log each time or only once for instance of the nova-api process, it probably doesn\u0027t really matter. And actually warning each time for something like this is probably better so the operator can see it and fix their policy.","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":170,"context_line":"The quota and flavor operations should not be blocked if either Keystone does"},{"line_number":171,"context_line":"not exist or if the Keystone policy is not set up correctly for project id"},{"line_number":172,"context_line":"validation. In this case, a warning message should be logged indicating that"},{"line_number":173,"context_line":"project id validation is unavailable."},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"Developer impact"},{"line_number":176,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_40006666","line":173,"in_reply_to":"dab17558_2b238cbe","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cd87ec0dfa0a9608bb10dbfd11d831cd54a505","unresolved":false,"context_lines":[{"line_number":203,"context_line":"  nova/api/openstack/compute/flavor_access.py to validate the project id, if"},{"line_number":204,"context_line":"  provided."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"* Create tempest test cases and Nova unit and functional test cases to verify"},{"line_number":207,"context_line":"  functionality."},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"* Update the DocImpact bug with policy examples so the documentation can be"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_0b2cc797","line":206,"range":{"start_line":206,"start_character":9,"end_line":206,"end_character":16},"updated":"2016-05-16 17:44:14.000000000","message":"At first I was thinking we didn\u0027t need Tempest testing for this given it\u0027s mostly just API and DB in Nova which could be handled by functional tests, but we do need to validate the keystone side of this, which would mean a Tempest test is probably necessary. That would also mean we\u0027d probably need a feature toggle in Tempest to tell it if Keystone is configured properly (in devstack) for the policy to work.","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":203,"context_line":"  nova/api/openstack/compute/flavor_access.py to validate the project id, if"},{"line_number":204,"context_line":"  provided."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"* Create tempest test cases and Nova unit and functional test cases to verify"},{"line_number":207,"context_line":"  functionality."},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"* Update the DocImpact bug with policy examples so the documentation can be"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_00cdbe30","line":206,"in_reply_to":"dab17558_0b2cc797","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cd87ec0dfa0a9608bb10dbfd11d831cd54a505","unresolved":false,"context_lines":[{"line_number":206,"context_line":"* Create tempest test cases and Nova unit and functional test cases to verify"},{"line_number":207,"context_line":"  functionality."},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"* Update the DocImpact bug with policy examples so the documentation can be"},{"line_number":210,"context_line":"  updated."},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_eb48635e","line":209,"range":{"start_line":209,"start_character":13,"end_line":209,"end_character":26},"updated":"2016-05-16 17:44:14.000000000","message":"I guess this bug would go to Keystone, unless there is something in the docs/manuals repo.","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":206,"context_line":"* Create tempest test cases and Nova unit and functional test cases to verify"},{"line_number":207,"context_line":"  functionality."},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"* Update the DocImpact bug with policy examples so the documentation can be"},{"line_number":210,"context_line":"  updated."},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_60ce4a2e","line":209,"in_reply_to":"dab17558_eb48635e","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cd87ec0dfa0a9608bb10dbfd11d831cd54a505","unresolved":false,"context_lines":[{"line_number":221,"context_line":"created to verify project id verification."},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"Commands to be tested with validation:"},{"line_number":224,"context_line":"* quota-show"},{"line_number":225,"context_line":"* quota-update"},{"line_number":226,"context_line":"* flavor-access-add"},{"line_number":227,"context_line":"* flavor-access-list"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_0b7a0788","line":224,"range":{"start_line":224,"start_character":8,"end_line":224,"end_character":12},"updated":"2016-05-16 17:44:14.000000000","message":"detail","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":221,"context_line":"created to verify project id verification."},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"Commands to be tested with validation:"},{"line_number":224,"context_line":"* quota-show"},{"line_number":225,"context_line":"* quota-update"},{"line_number":226,"context_line":"* flavor-access-add"},{"line_number":227,"context_line":"* flavor-access-list"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_40d346d5","line":224,"in_reply_to":"dab17558_0b7a0788","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cd87ec0dfa0a9608bb10dbfd11d831cd54a505","unresolved":false,"context_lines":[{"line_number":224,"context_line":"* quota-show"},{"line_number":225,"context_line":"* quota-update"},{"line_number":226,"context_line":"* flavor-access-add"},{"line_number":227,"context_line":"* flavor-access-list"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"Test cases for each command:"},{"line_number":230,"context_line":"* valid project id - 200"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_6b6bd3b9","line":227,"range":{"start_line":227,"start_character":2,"end_line":227,"end_character":20},"updated":"2016-05-16 17:44:14.000000000","message":"nope","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":224,"context_line":"* quota-show"},{"line_number":225,"context_line":"* quota-update"},{"line_number":226,"context_line":"* flavor-access-add"},{"line_number":227,"context_line":"* flavor-access-list"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"Test cases for each command:"},{"line_number":230,"context_line":"* valid project id - 200"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_a0dcb2e4","line":227,"in_reply_to":"dab17558_6b6bd3b9","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f9cd87ec0dfa0a9608bb10dbfd11d831cd54a505","unresolved":false,"context_lines":[{"line_number":237,"context_line":"* quota-delete"},{"line_number":238,"context_line":"* flavor-access-delete"},{"line_number":239,"context_line":""},{"line_number":240,"context_line":"Test cases for each command:"},{"line_number":241,"context_line":"* pre-existing invalid project id - 200"},{"line_number":242,"context_line":"* new invalid project id - 200 (current behavior)"},{"line_number":243,"context_line":" * a new entry should not be created and then deleted"},{"line_number":244,"context_line":""},{"line_number":245,"context_line":"Documentation Impact"},{"line_number":246,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_2b38ab9f","line":243,"range":{"start_line":240,"start_character":0,"end_line":243,"end_character":53},"updated":"2016-05-16 17:44:14.000000000","message":"nit: the bullet formatting isn\u0027t really working here and in some other sections, I think you need a blank line between the title and the bullets, or to indent the bullets:\n\nhttp://docs-draft.openstack.org/37/294337/11/check/gate-nova-specs-docs/efaff3a//doc/build/html/specs/newton/approved/validate-tenant-user-with-keystone.html#testing","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":17714,"name":"Augustina Ragwitz","email":"auggy@cpan.org","username":"mmmpork"},"change_message_id":"a5ab3e9757a21cd5bb3214254d218ea81e756e52","unresolved":false,"context_lines":[{"line_number":240,"context_line":"Test cases for each command:"},{"line_number":241,"context_line":"* pre-existing invalid project id - 200"},{"line_number":242,"context_line":"* new invalid project id - 200 (current behavior)"},{"line_number":243,"context_line":" * a new entry should not be created and then deleted"},{"line_number":244,"context_line":""},{"line_number":245,"context_line":"Documentation Impact"},{"line_number":246,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":11,"id":"dab17558_20ef2288","line":243,"in_reply_to":"dab17558_2b38ab9f","updated":"2016-05-16 21:13:19.000000000","message":"Done","commit_id":"4cb485bad78cbfd07f41b81104338fffc8e5bf85"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"0309cc5cbcd8b4c204028aff17b17f7bea9e098e","unresolved":false,"context_lines":[{"line_number":43,"context_line":"additional floating ip addresses will unexpectedly fail. Historically,"},{"line_number":44,"context_line":"administrators debugging this issue have filed invalid bugs against Nova quota"},{"line_number":45,"context_line":"management."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Use Cases"},{"line_number":49,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":13,"id":"bab6814e_b273eab0","line":46,"updated":"2016-05-18 18:18:16.000000000","message":"FWIW, I think the wording from the previous patch set about flavor access management was probably OK here.","commit_id":"5d0c84583fa4f534bda813432674184e38cf32c7"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"798bbbe5d6879c648f3a8a6a10b84ce55c5c1183","unresolved":false,"context_lines":[{"line_number":139,"context_line":"---------------"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"None. This is using existing authorization mechanisms and doesn\u0027t present any"},{"line_number":142,"context_line":"new logic."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"Notifications impact"},{"line_number":145,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":13,"id":"bab6814e_334b3989","line":142,"updated":"2016-05-19 20:41:23.000000000","message":"There\u0027s still a security aspect to this, which is \"actually check access to the project by the requestor\".","commit_id":"5d0c84583fa4f534bda813432674184e38cf32c7"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"0309cc5cbcd8b4c204028aff17b17f7bea9e098e","unresolved":false,"context_lines":[{"line_number":263,"context_line":""},{"line_number":264,"context_line":"* new invalid project id - 200 (current behavior)"},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"  ** a new entry should not be created and then deleted"},{"line_number":267,"context_line":""},{"line_number":268,"context_line":"Documentation Impact"},{"line_number":269,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":13,"id":"bab6814e_52e8be10","line":266,"range":{"start_line":266,"start_character":2,"end_line":266,"end_character":4},"updated":"2016-05-18 18:18:16.000000000","message":"nit: something doesn\u0027t format properly with this as a sub-bullet, but meh. Fix if you respin.","commit_id":"5d0c84583fa4f534bda813432674184e38cf32c7"}]}