)]}'
{"specs/juno/nova-api-policy.rst":[{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"76d22229cc3ac429b3a204a6df81b0115be1562b","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Currently the permission checking spread in different level of nova code."},{"line_number":14,"context_line":"There are cases for one api have multiple policy rule both in nova rest"},{"line_number":15,"context_line":"api layer and nova compute api layer. Also some cases for hard code"},{"line_number":16,"context_line":"permission checking in db layer. That make api policy hard to use in nova."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"This BP want to enforce all policy at nova rest API layer, and remove all"},{"line_number":19,"context_line":"the extra permission checking in nova compute API layer or db layer. And"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9ad9bd40_e82f79f4","line":16,"updated":"2014-05-05 06:13:25.000000000","message":"Do we need to consider following cases:\n\n1) service_get_all in db layer require admin context now\n2) if will not only be called by REST API layer, but also some compute layer code also use it\n3) should we consider the REST API code which might call \nthe code which will call \u0027service_get_all \u0027\ne.g conductor/manager.py service_get_all_by?","commit_id":"6eddb5865c2e3d40cb0d6fbd1d606eaf7913ff01"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"b5bc903497f53917a977c9c583e43443fa603624","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Currently the permission checking spread in different level of nova code."},{"line_number":14,"context_line":"There are cases for one api have multiple policy rule both in nova rest"},{"line_number":15,"context_line":"api layer and nova compute api layer. Also some cases for hard code"},{"line_number":16,"context_line":"permission checking in db layer. That make api policy hard to use in nova."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"This BP want to enforce all policy at nova rest API layer, and remove all"},{"line_number":19,"context_line":"the extra permission checking in nova compute API layer or db layer. And"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9ad9bd40_c418c277","line":16,"in_reply_to":"9ad9bd40_e82f79f4","updated":"2014-05-06 02:45:29.000000000","message":"Emm... I\u0027m not sure I quite understand what you said. If service_get_all is not called by user, the context is constructed by the code. For admin context, it is just set admin\u003dTrue. So I\u0027m not sure there is any meaning for the context","commit_id":"6eddb5865c2e3d40cb0d6fbd1d606eaf7913ff01"},{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"b1df2a652250e4ed25e09666142ebd1da1d45e77","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Currently the permission checking spread in different level of nova code."},{"line_number":14,"context_line":"There are cases for one api have multiple policy rule both in nova rest"},{"line_number":15,"context_line":"api layer and nova compute api layer. Also some cases for hard code"},{"line_number":16,"context_line":"permission checking in db layer. That make api policy hard to use in nova."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"This BP want to enforce all policy at nova rest API layer, and remove all"},{"line_number":19,"context_line":"the extra permission checking in nova compute API layer or db layer. And"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9ad9bd40_0197fc3b","line":16,"in_reply_to":"9ad9bd40_e82f79f4","updated":"2014-05-06 02:16:17.000000000","message":"These sorts of changes certainly require very close analysis re: admin context and all possible call chains. That being said I think its still a very important change. The implicit complexity of permissions is both confusing for operators and when modifications are made which has led in to the past to security bugs","commit_id":"6eddb5865c2e3d40cb0d6fbd1d606eaf7913ff01"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"76d22229cc3ac429b3a204a6df81b0115be1562b","unresolved":false,"context_lines":[{"line_number":80,"context_line":"    development configuration."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"* Add separated policy rule for each v3 api"},{"line_number":83,"context_line":"  * https://review.openstack.org/#/c/67749/4/nova/api/openstack/compute/plugins/v3/agents.py"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"* Correct the policy rule name specification for v3 api"},{"line_number":86,"context_line":"  * Core API rule scope: \"compute:v3:[core_api]:[action]\""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9ad9bd40_e8e139d1","line":83,"updated":"2014-05-05 06:13:25.000000000","message":"should we make a separated bp for this feature?\n\nlooks to me it\u0027s not related to remove db layer or api layer policy","commit_id":"6eddb5865c2e3d40cb0d6fbd1d606eaf7913ff01"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"b5bc903497f53917a977c9c583e43443fa603624","unresolved":false,"context_lines":[{"line_number":80,"context_line":"    development configuration."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"* Add separated policy rule for each v3 api"},{"line_number":83,"context_line":"  * https://review.openstack.org/#/c/67749/4/nova/api/openstack/compute/plugins/v3/agents.py"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"* Correct the policy rule name specification for v3 api"},{"line_number":86,"context_line":"  * Core API rule scope: \"compute:v3:[core_api]:[action]\""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9ad9bd40_2111605d","line":83,"in_reply_to":"9ad9bd40_01e53cdc","updated":"2014-05-06 02:45:29.000000000","message":"@jichenjc, @Chris, I will do it separated blueprint, thanks","commit_id":"6eddb5865c2e3d40cb0d6fbd1d606eaf7913ff01"},{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"b1df2a652250e4ed25e09666142ebd1da1d45e77","unresolved":false,"context_lines":[{"line_number":80,"context_line":"    development configuration."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"* Add separated policy rule for each v3 api"},{"line_number":83,"context_line":"  * https://review.openstack.org/#/c/67749/4/nova/api/openstack/compute/plugins/v3/agents.py"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"* Correct the policy rule name specification for v3 api"},{"line_number":86,"context_line":"  * Core API rule scope: \"compute:v3:[core_api]:[action]\""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9ad9bd40_01e53cdc","line":83,"in_reply_to":"9ad9bd40_e8e139d1","updated":"2014-05-06 02:16:17.000000000","message":"yes I think this should be a separate blueprint","commit_id":"6eddb5865c2e3d40cb0d6fbd1d606eaf7913ff01"},{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"b1df2a652250e4ed25e09666142ebd1da1d45e77","unresolved":false,"context_lines":[{"line_number":86,"context_line":"  * Core API rule scope: \"compute:v3:[core_api]:[action]\""},{"line_number":87,"context_line":"  * Extension api rule scope: \"compute_extension:v3:[core_api]:[action]\""},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"* Enable extension level policy rule as default of action level policy rule"},{"line_number":90,"context_line":"  After we provide separated policy rule for each v3 API, there will be a lot"},{"line_number":91,"context_line":"  of policy rules. For ease the burden of deployer, we enable extension level"},{"line_number":92,"context_line":"  policy rule as default of action level rule, the action level policy rule can"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9ad9bd40_011a9ccb","line":89,"updated":"2014-05-06 02:16:17.000000000","message":"This is fine for general V3 API development but I think we should split this into a separate blueprint","commit_id":"6eddb5865c2e3d40cb0d6fbd1d606eaf7913ff01"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"b5bc903497f53917a977c9c583e43443fa603624","unresolved":false,"context_lines":[{"line_number":86,"context_line":"  * Core API rule scope: \"compute:v3:[core_api]:[action]\""},{"line_number":87,"context_line":"  * Extension api rule scope: \"compute_extension:v3:[core_api]:[action]\""},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"* Enable extension level policy rule as default of action level policy rule"},{"line_number":90,"context_line":"  After we provide separated policy rule for each v3 API, there will be a lot"},{"line_number":91,"context_line":"  of policy rules. For ease the burden of deployer, we enable extension level"},{"line_number":92,"context_line":"  policy rule as default of action level rule, the action level policy rule can"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9ad9bd40_41166456","line":89,"in_reply_to":"9ad9bd40_011a9ccb","updated":"2014-05-06 02:45:29.000000000","message":"Done","commit_id":"6eddb5865c2e3d40cb0d6fbd1d606eaf7913ff01"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"76d22229cc3ac429b3a204a6df81b0115be1562b","unresolved":false,"context_lines":[{"line_number":121,"context_line":"---------------"},{"line_number":122,"context_line":"This BP will clear up the permission check in compute API layer and DB layer."},{"line_number":123,"context_line":"So we should ensure there isn\u0027t any API loss the permission checks before"},{"line_number":124,"context_line":"we delete those."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Notifications impact"},{"line_number":127,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9ad9bd40_a8e3b131","line":124,"updated":"2014-05-05 06:13:25.000000000","message":"should we also mention something like:\nwe will leave those permission check to cloud operator\nso that they should manage their policies for each API","commit_id":"6eddb5865c2e3d40cb0d6fbd1d606eaf7913ff01"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"b5bc903497f53917a977c9c583e43443fa603624","unresolved":false,"context_lines":[{"line_number":121,"context_line":"---------------"},{"line_number":122,"context_line":"This BP will clear up the permission check in compute API layer and DB layer."},{"line_number":123,"context_line":"So we should ensure there isn\u0027t any API loss the permission checks before"},{"line_number":124,"context_line":"we delete those."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Notifications impact"},{"line_number":127,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9ad9bd40_59acb535","line":124,"in_reply_to":"9ad9bd40_a8e3b131","updated":"2014-05-06 02:45:29.000000000","message":"I wrote some impact for deployer after line 138. At here I just write the security impact.","commit_id":"6eddb5865c2e3d40cb0d6fbd1d606eaf7913ff01"},{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"b1df2a652250e4ed25e09666142ebd1da1d45e77","unresolved":false,"context_lines":[{"line_number":142,"context_line":"  Core API rule scope: \"compute:v3:[core_api]:[action]\""},{"line_number":143,"context_line":"  Extension api rule scope: \"compute_extension:v3:[core_api]:[action]\""},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"* Split policy rule for each action in v3 API"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"* Compute API layer policy checks(compute:[action]) removed in v3 API"},{"line_number":148,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9ad9bd40_c11b54c8","line":145,"updated":"2014-05-06 02:16:17.000000000","message":"Separate this into a separate blueprint I think","commit_id":"6eddb5865c2e3d40cb0d6fbd1d606eaf7913ff01"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"b5bc903497f53917a977c9c583e43443fa603624","unresolved":false,"context_lines":[{"line_number":142,"context_line":"  Core API rule scope: \"compute:v3:[core_api]:[action]\""},{"line_number":143,"context_line":"  Extension api rule scope: \"compute_extension:v3:[core_api]:[action]\""},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"* Split policy rule for each action in v3 API"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"* Compute API layer policy checks(compute:[action]) removed in v3 API"},{"line_number":148,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9ad9bd40_610e083d","line":145,"in_reply_to":"9ad9bd40_c11b54c8","updated":"2014-05-06 02:45:29.000000000","message":"Done","commit_id":"6eddb5865c2e3d40cb0d6fbd1d606eaf7913ff01"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"76d22229cc3ac429b3a204a6df81b0115be1562b","unresolved":false,"context_lines":[{"line_number":184,"context_line":"Testing"},{"line_number":185,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"None"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9ad9bd40_48c5c58c","line":187,"updated":"2014-05-05 06:13:25.000000000","message":"of course we need UT\nshould we also mention some tempest cases?","commit_id":"6eddb5865c2e3d40cb0d6fbd1d606eaf7913ff01"},{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"b1df2a652250e4ed25e09666142ebd1da1d45e77","unresolved":false,"context_lines":[{"line_number":184,"context_line":"Testing"},{"line_number":185,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"None"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9ad9bd40_616fe82b","line":187,"in_reply_to":"9ad9bd40_48c5c58c","updated":"2014-05-06 02:16:17.000000000","message":"I think we\u0027ll probably have to cover the testing here with just unit tests because of the difficulty of configuring policy in tempest","commit_id":"6eddb5865c2e3d40cb0d6fbd1d606eaf7913ff01"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"76d22229cc3ac429b3a204a6df81b0115be1562b","unresolved":false,"context_lines":[{"line_number":191,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"None"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":""},{"line_number":196,"context_line":"References"},{"line_number":197,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9ad9bd40_88bfcdfa","line":194,"updated":"2014-05-05 06:13:25.000000000","message":"we may need some doc update especially for those leave policy to cloud operators?","commit_id":"6eddb5865c2e3d40cb0d6fbd1d606eaf7913ff01"},{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"b1df2a652250e4ed25e09666142ebd1da1d45e77","unresolved":false,"context_lines":[{"line_number":191,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"None"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":""},{"line_number":196,"context_line":"References"},{"line_number":197,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9ad9bd40_0168dc1b","line":194,"in_reply_to":"9ad9bd40_88bfcdfa","updated":"2014-05-06 02:16:17.000000000","message":"yea we\u0027re going to need quite a bit of upgrade documentation here I think","commit_id":"6eddb5865c2e3d40cb0d6fbd1d606eaf7913ff01"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"96eee5d46e87452bc4e3fab4d31b72f75c87f3b3","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Policy should be enforced at API layer where possible"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/v3-api-policy"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9ad9bd40_46d9f620","line":8,"updated":"2014-05-07 05:38:31.000000000","message":"In this document, there are many \"API\" words, so here should be \".. at REST API layer ..\" I feel.","commit_id":"a7d75a0580f0ccd64b94aa0f143ea506b4c63be1"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"d5370cbc321c68a454d90e7dad5e70ee843bd45c","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Policy should be enforced at API layer where possible"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/v3-api-policy"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9ad9bd40_7184f25d","line":8,"in_reply_to":"9ad9bd40_46d9f620","updated":"2014-05-07 06:20:45.000000000","message":"Done","commit_id":"a7d75a0580f0ccd64b94aa0f143ea506b4c63be1"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"04c15524d1a7723baa7f5053a8123866fa1b3ee5","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Currently policy permission checking is spread through the various"},{"line_number":14,"context_line":"levels of the Nova code.  There are also duplicated checks where"},{"line_number":15,"context_line":"effectively the same sort of policy check under different names is"},{"line_number":16,"context_line":"done at different levels such as both at at the Nova REST API layer"},{"line_number":17,"context_line":"and the Nova Compute API layer. In addition to this there are also"},{"line_number":18,"context_line":"some cases where there are hard coded permission checks in the db"},{"line_number":19,"context_line":"layer."}],"source_content_type":"text/x-rst","patch_set":3,"id":"9ad9bd40_6eb26307","line":16,"updated":"2014-05-07 02:28:00.000000000","message":"double \u0027at\u0027 at here","commit_id":"a7d75a0580f0ccd64b94aa0f143ea506b4c63be1"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"96eee5d46e87452bc4e3fab4d31b72f75c87f3b3","unresolved":false,"context_lines":[{"line_number":41,"context_line":"* Permission checking spread in different level of nova code"},{"line_number":42,"context_line":"  Example:"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"  * API layer: https://github.com/openstack/nova/blob/master/nova/api/openstack/compute/contrib/admin_actions.py#L53"},{"line_number":45,"context_line":"  * Compute API layer: https://github.com/openstack/nova/blob/master/nova/compute/api.py#L2521"},{"line_number":46,"context_line":"  * DB layer: https://github.com/openstack/nova/blob/master/nova/db/sqlalchemy/api.py#L445"},{"line_number":47,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9ad9bd40_e6012a6b","line":44,"updated":"2014-05-07 05:38:31.000000000","message":"s/API layer/REST API layer/","commit_id":"a7d75a0580f0ccd64b94aa0f143ea506b4c63be1"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"d5370cbc321c68a454d90e7dad5e70ee843bd45c","unresolved":false,"context_lines":[{"line_number":41,"context_line":"* Permission checking spread in different level of nova code"},{"line_number":42,"context_line":"  Example:"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"  * API layer: https://github.com/openstack/nova/blob/master/nova/api/openstack/compute/contrib/admin_actions.py#L53"},{"line_number":45,"context_line":"  * Compute API layer: https://github.com/openstack/nova/blob/master/nova/compute/api.py#L2521"},{"line_number":46,"context_line":"  * DB layer: https://github.com/openstack/nova/blob/master/nova/db/sqlalchemy/api.py#L445"},{"line_number":47,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9ad9bd40_b17afa74","line":44,"in_reply_to":"9ad9bd40_e6012a6b","updated":"2014-05-07 06:20:45.000000000","message":"Done","commit_id":"a7d75a0580f0ccd64b94aa0f143ea506b4c63be1"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"96eee5d46e87452bc4e3fab4d31b72f75c87f3b3","unresolved":false,"context_lines":[{"line_number":48,"context_line":"* Duplicated policy checking for same API. Example:"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"  * For server\u0027s pause action:"},{"line_number":51,"context_line":"  * API layer: \"compute_extension:admin_actions:pause\": \"rule:admin_or_owner\""},{"line_number":52,"context_line":"  * Compute API layer: \"compute:pause\": \"\""},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"* Hard code policy check at db layer"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9ad9bd40_06fa8e74","line":51,"updated":"2014-05-07 05:38:31.000000000","message":"ditto","commit_id":"a7d75a0580f0ccd64b94aa0f143ea506b4c63be1"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"d5370cbc321c68a454d90e7dad5e70ee843bd45c","unresolved":false,"context_lines":[{"line_number":48,"context_line":"* Duplicated policy checking for same API. Example:"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"  * For server\u0027s pause action:"},{"line_number":51,"context_line":"  * API layer: \"compute_extension:admin_actions:pause\": \"rule:admin_or_owner\""},{"line_number":52,"context_line":"  * Compute API layer: \"compute:pause\": \"\""},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"* Hard code policy check at db layer"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9ad9bd40_f197228e","line":51,"in_reply_to":"9ad9bd40_06fa8e74","updated":"2014-05-07 06:20:45.000000000","message":"Done","commit_id":"a7d75a0580f0ccd64b94aa0f143ea506b4c63be1"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"96eee5d46e87452bc4e3fab4d31b72f75c87f3b3","unresolved":false,"context_lines":[{"line_number":66,"context_line":"    * https://review.openstack.org/#/c/65071/5/nova/api/openstack/compute/plugins/v3/shelve.py"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"  * For Ec2 and V2 api, we just want to keep backwards compatibility. So just"},{"line_number":69,"context_line":"    move the compute API layer into rest api layer, there will be two policy"},{"line_number":70,"context_line":"    checks in v2 rest api layer:"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    * https://review.openstack.org/#/c/65071/5/nova/api/openstack/compute/contrib/shelve.py"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9ad9bd40_66443ab7","line":69,"updated":"2014-05-07 05:38:31.000000000","message":"s/rest api layer/REST API layer/ for consistent keywords","commit_id":"a7d75a0580f0ccd64b94aa0f143ea506b4c63be1"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"d5370cbc321c68a454d90e7dad5e70ee843bd45c","unresolved":false,"context_lines":[{"line_number":66,"context_line":"    * https://review.openstack.org/#/c/65071/5/nova/api/openstack/compute/plugins/v3/shelve.py"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"  * For Ec2 and V2 api, we just want to keep backwards compatibility. So just"},{"line_number":69,"context_line":"    move the compute API layer into rest api layer, there will be two policy"},{"line_number":70,"context_line":"    checks in v2 rest api layer:"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    * https://review.openstack.org/#/c/65071/5/nova/api/openstack/compute/contrib/shelve.py"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9ad9bd40_11956686","line":69,"in_reply_to":"9ad9bd40_66443ab7","updated":"2014-05-07 06:20:45.000000000","message":"Done","commit_id":"a7d75a0580f0ccd64b94aa0f143ea506b4c63be1"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"96eee5d46e87452bc4e3fab4d31b72f75c87f3b3","unresolved":false,"context_lines":[{"line_number":67,"context_line":""},{"line_number":68,"context_line":"  * For Ec2 and V2 api, we just want to keep backwards compatibility. So just"},{"line_number":69,"context_line":"    move the compute API layer into rest api layer, there will be two policy"},{"line_number":70,"context_line":"    checks in v2 rest api layer:"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    * https://review.openstack.org/#/c/65071/5/nova/api/openstack/compute/contrib/shelve.py"},{"line_number":73,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9ad9bd40_c60a6678","line":70,"updated":"2014-05-07 05:38:31.000000000","message":"ditto","commit_id":"a7d75a0580f0ccd64b94aa0f143ea506b4c63be1"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"04c15524d1a7723baa7f5053a8123866fa1b3ee5","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  * For the v3 API, we remove all the hard-code permission check from DB layer."},{"line_number":78,"context_line":"    And we should ensure we have policy check at REST API layer."},{"line_number":79,"context_line":"  * For the v2 API, we remove all the hard-code permission check from DB layer."},{"line_number":80,"context_line":"    And with UpgradeImapct flags that notify deployer to update their"},{"line_number":81,"context_line":"    development configuration."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"* Correct the policy rule name specification for the v3 api"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9ad9bd40_4ee4bfe0","line":80,"updated":"2014-05-07 02:28:00.000000000","message":"s/UpgradeImapct/UpgradeImpact","commit_id":"a7d75a0580f0ccd64b94aa0f143ea506b4c63be1"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"04c15524d1a7723baa7f5053a8123866fa1b3ee5","unresolved":false,"context_lines":[{"line_number":83,"context_line":"* Correct the policy rule name specification for the v3 api"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"  * Core API rule scope: \"compute:v3:[core_api]:[action]\""},{"line_number":86,"context_line":"  * Extension api rule scope: \"compute_extension:v3:[core_api]:[action]\""},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Alternatives"},{"line_number":89,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9ad9bd40_4e0bdf8d","line":86,"updated":"2014-05-07 02:28:00.000000000","message":"s/core_api/extension_api/","commit_id":"a7d75a0580f0ccd64b94aa0f143ea506b4c63be1"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"96eee5d46e87452bc4e3fab4d31b72f75c87f3b3","unresolved":false,"context_lines":[{"line_number":83,"context_line":"* Correct the policy rule name specification for the v3 api"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"  * Core API rule scope: \"compute:v3:[core_api]:[action]\""},{"line_number":86,"context_line":"  * Extension api rule scope: \"compute_extension:v3:[core_api]:[action]\""},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Alternatives"},{"line_number":89,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9ad9bd40_e6ea0aab","line":86,"in_reply_to":"9ad9bd40_4e0bdf8d","updated":"2014-05-07 05:38:31.000000000","message":"I\u0027d like to clarify here more.\n\nOn v3 API, I guess the above [extension_api] represents alias name, right?\n\nI\u0027d like to make whole of nova settings more consistent.","commit_id":"a7d75a0580f0ccd64b94aa0f143ea506b4c63be1"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"d5370cbc321c68a454d90e7dad5e70ee843bd45c","unresolved":false,"context_lines":[{"line_number":83,"context_line":"* Correct the policy rule name specification for the v3 api"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"  * Core API rule scope: \"compute:v3:[core_api]:[action]\""},{"line_number":86,"context_line":"  * Extension api rule scope: \"compute_extension:v3:[core_api]:[action]\""},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Alternatives"},{"line_number":89,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9ad9bd40_318eea79","line":86,"in_reply_to":"9ad9bd40_e6ea0aab","updated":"2014-05-07 06:20:45.000000000","message":"yes, you are right","commit_id":"a7d75a0580f0ccd64b94aa0f143ea506b4c63be1"},{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"e190ed7ae93990026d79cdba2b2ebbb5ec4beded","unresolved":false,"context_lines":[{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Performance Impact"},{"line_number":121,"context_line":"------------------"},{"line_number":122,"context_line":"None"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Other deployer impact"},{"line_number":125,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7adec928_e0c9a85b","line":122,"updated":"2014-05-08 01:03:45.000000000","message":"I think this BP improves error handling performance, because Nova will be able to avoid unnecessary operations by detecting permission errors more fast.","commit_id":"886b7aef3d14b0a9d4180035c3c70ae9939a779e"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"79f322f2ce9c2e1db11bfa2f831346df7f1a5bff","unresolved":false,"context_lines":[{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Performance Impact"},{"line_number":121,"context_line":"------------------"},{"line_number":122,"context_line":"None"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Other deployer impact"},{"line_number":125,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7adec928_b6742ed0","line":122,"in_reply_to":"7adec928_53aa351a","updated":"2014-05-09 01:57:39.000000000","message":"cool, thanks, one more benefit from this bp","commit_id":"886b7aef3d14b0a9d4180035c3c70ae9939a779e"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"9b90d67624def2d305a9fc25469e98bcc15f1fcd","unresolved":false,"context_lines":[{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Performance Impact"},{"line_number":121,"context_line":"------------------"},{"line_number":122,"context_line":"None"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Other deployer impact"},{"line_number":125,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7adec928_53aa351a","line":122,"in_reply_to":"7adec928_e0c9a85b","updated":"2014-05-08 06:04:03.000000000","message":"Agree","commit_id":"886b7aef3d14b0a9d4180035c3c70ae9939a779e"},{"author":{"_account_id":9847,"name":"ricky.bo","email":"boh.ricky@gmail.com","username":"boh.ricky"},"change_message_id":"a7e33fea15f77d40106f51ab269769adf3c8539b","unresolved":false,"context_lines":[{"line_number":134,"context_line":"----------------"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"When a developer adds a new REST API for nova policy permission checks"},{"line_number":137,"context_line":"will only be added at the REST API layer."},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Implementation"},{"line_number":140,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7adec928_450dea8f","line":137,"updated":"2014-05-09 08:23:11.000000000","message":"Is it possible to be transparent to the developer to avoid the things?","commit_id":"886b7aef3d14b0a9d4180035c3c70ae9939a779e"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"64309018cbfcb335612eab523cd901fac7e71600","unresolved":false,"context_lines":[{"line_number":134,"context_line":"----------------"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"When a developer adds a new REST API for nova policy permission checks"},{"line_number":137,"context_line":"will only be added at the REST API layer."},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Implementation"},{"line_number":140,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7adec928_9a791032","line":137,"in_reply_to":"7adec928_450dea8f","updated":"2014-05-26 08:33:10.000000000","message":"Actually it good idea. But with current framework, it need extra db call.\n\nThe signature of policy check function is \u0027def authorize(context, target\u003dNone, action\u003dNone):\u0027\n\nIt need \u0027target\u0027 to auth. The target is the resource object. If we want to get the resource object transparently, it will need extra db call to get it, then we can\u0027t share same db call with API logic code.","commit_id":"886b7aef3d14b0a9d4180035c3c70ae9939a779e"},{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"5324e3b612c1ea4e4993e9327038452c57358524","unresolved":false,"context_lines":[{"line_number":134,"context_line":"----------------"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"When a developer adds a new REST API for nova policy permission checks"},{"line_number":137,"context_line":"will only be added at the REST API layer."},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Implementation"},{"line_number":140,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5adbc538_504dd571","line":137,"in_reply_to":"7adec928_450dea8f","updated":"2014-05-26 03:58:13.000000000","message":"No developers will need to explicitly call the policy check code and every policy should be listed in the policy.json file so deployers know what options are available without having to read the nova api code","commit_id":"886b7aef3d14b0a9d4180035c3c70ae9939a779e"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"9b90d67624def2d305a9fc25469e98bcc15f1fcd","unresolved":false,"context_lines":[{"line_number":165,"context_line":"Testing"},{"line_number":166,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"None"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7adec928_d609d32d","line":168,"updated":"2014-05-08 06:04:03.000000000","message":"mentioned UT here, according to review patch #2 comments, no tempest cases ...","commit_id":"886b7aef3d14b0a9d4180035c3c70ae9939a779e"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"79f322f2ce9c2e1db11bfa2f831346df7f1a5bff","unresolved":false,"context_lines":[{"line_number":165,"context_line":"Testing"},{"line_number":166,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"None"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7adec928_d681ba90","line":168,"in_reply_to":"7adec928_d609d32d","updated":"2014-05-09 01:57:39.000000000","message":"Done","commit_id":"886b7aef3d14b0a9d4180035c3c70ae9939a779e"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"9b90d67624def2d305a9fc25469e98bcc15f1fcd","unresolved":false,"context_lines":[{"line_number":171,"context_line":"Documentation Impact"},{"line_number":172,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"None"},{"line_number":175,"context_line":""},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7adec928_5306b521","line":174,"updated":"2014-05-08 06:04:03.000000000","message":"please mentioned document update here","commit_id":"886b7aef3d14b0a9d4180035c3c70ae9939a779e"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"64309018cbfcb335612eab523cd901fac7e71600","unresolved":false,"context_lines":[{"line_number":171,"context_line":"Documentation Impact"},{"line_number":172,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"None"},{"line_number":175,"context_line":""},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5adbc538_91175ea3","line":174,"in_reply_to":"5adbc538_f03d01bd","updated":"2014-05-26 08:33:10.000000000","message":"Yea, we should figure this.","commit_id":"886b7aef3d14b0a9d4180035c3c70ae9939a779e"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"79f322f2ce9c2e1db11bfa2f831346df7f1a5bff","unresolved":false,"context_lines":[{"line_number":171,"context_line":"Documentation Impact"},{"line_number":172,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"None"},{"line_number":175,"context_line":""},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7adec928_f67eb6ad","line":174,"in_reply_to":"7adec928_5306b521","updated":"2014-05-09 01:57:39.000000000","message":"Done","commit_id":"886b7aef3d14b0a9d4180035c3c70ae9939a779e"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"64309018cbfcb335612eab523cd901fac7e71600","unresolved":false,"context_lines":[{"line_number":171,"context_line":"Documentation Impact"},{"line_number":172,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"None"},{"line_number":175,"context_line":""},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5adbc538_b1353a48","line":174,"in_reply_to":"7adec928_eb9b24c7","updated":"2014-05-26 08:33:10.000000000","message":"Done, thanks Anne","commit_id":"886b7aef3d14b0a9d4180035c3c70ae9939a779e"},{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"5324e3b612c1ea4e4993e9327038452c57358524","unresolved":false,"context_lines":[{"line_number":171,"context_line":"Documentation Impact"},{"line_number":172,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"None"},{"line_number":175,"context_line":""},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5adbc538_f03d01bd","line":174,"in_reply_to":"7adec928_eb9b24c7","updated":"2014-05-26 03:58:13.000000000","message":"Given decisions made around microversions versus an explicit v2-\u003ev3 upgrade we will need very good upgrade impact documentation here - depending on how these policy changes are rolled out (eg big bang in one microversion or gradually).","commit_id":"886b7aef3d14b0a9d4180035c3c70ae9939a779e"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"ba03bcabe2b0b995109e1df15b99f7a4665b70e6","unresolved":false,"context_lines":[{"line_number":171,"context_line":"Documentation Impact"},{"line_number":172,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"None"},{"line_number":175,"context_line":""},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7adec928_eb9b24c7","line":174,"in_reply_to":"7adec928_f67eb6ad","updated":"2014-05-09 13:20:30.000000000","message":"This section needs to be filled out so that both devs and deployers understand which docs will be updated. I\u0027d suggest the Cloud Admin Guide as well as the nova dev docs.","commit_id":"886b7aef3d14b0a9d4180035c3c70ae9939a779e"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"1ea4564d1124b7bf92815a7d32b6ddc291475da7","unresolved":false,"context_lines":[{"line_number":26,"context_line":"This BP proposes enforcing all policy checks only at the Nova REST API"},{"line_number":27,"context_line":"layer. The extra permission checks at the lower layers of Nova will be"},{"line_number":28,"context_line":"removed. There will be consistent policy naming for the V3 API and"},{"line_number":29,"context_line":"backwards compatibility will be retained for existing policy checks"},{"line_number":30,"context_line":"related to the V2 API so that the policy checks remain effectively the"},{"line_number":31,"context_line":"same, even though they may in practice be implemented at different points."},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_58dc1c19","line":29,"updated":"2014-06-06 20:19:32.000000000","message":"Since our config options support deprecated names I would love to see everything eventually get updated to a consistent scheme, while retaining backwards compatibility.  But that\u0027s outside of this scope, just mentioning it.","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"5e578aaaabbff96fcfc0465fc6bdbce8dcf7dc4d","unresolved":false,"context_lines":[{"line_number":26,"context_line":"This BP proposes enforcing all policy checks only at the Nova REST API"},{"line_number":27,"context_line":"layer. The extra permission checks at the lower layers of Nova will be"},{"line_number":28,"context_line":"removed. There will be consistent policy naming for the V3 API and"},{"line_number":29,"context_line":"backwards compatibility will be retained for existing policy checks"},{"line_number":30,"context_line":"related to the V2 API so that the policy checks remain effectively the"},{"line_number":31,"context_line":"same, even though they may in practice be implemented at different points."},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_9cc92faf","line":29,"in_reply_to":"1ae5cdf2_58dc1c19","updated":"2014-06-07 09:35:51.000000000","message":"yeah, the policy file doesn\u0027t support deprecated names yet.","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"1ea4564d1124b7bf92815a7d32b6ddc291475da7","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"  * REST API layer: https://github.com/openstack/nova/blob/master/nova/api/openstack/compute/contrib/admin_actions.py#L53"},{"line_number":45,"context_line":"  * Compute API layer: https://github.com/openstack/nova/blob/master/nova/compute/api.py#L2521"},{"line_number":46,"context_line":"  * DB layer: https://github.com/openstack/nova/blob/master/nova/db/sqlalchemy/api.py#L445"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"* Duplicated policy checking for same API. Example:"},{"line_number":49,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_b802806d","line":46,"updated":"2014-06-06 20:19:32.000000000","message":"While it\u0027s useful to link directly to examples, these are going to go out of date.  Especially since you linked to master.  Perhaps just mention specific methods or leave out the specific example entirely.","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"5e578aaaabbff96fcfc0465fc6bdbce8dcf7dc4d","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"  * REST API layer: https://github.com/openstack/nova/blob/master/nova/api/openstack/compute/contrib/admin_actions.py#L53"},{"line_number":45,"context_line":"  * Compute API layer: https://github.com/openstack/nova/blob/master/nova/compute/api.py#L2521"},{"line_number":46,"context_line":"  * DB layer: https://github.com/openstack/nova/blob/master/nova/db/sqlalchemy/api.py#L445"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"* Duplicated policy checking for same API. Example:"},{"line_number":49,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_dcc2d785","line":46,"in_reply_to":"1ae5cdf2_b802806d","updated":"2014-06-07 09:35:51.000000000","message":"yeah, I will update","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"4a85748d272a01ad68ace56c70a89822b63c742d","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"  * For Ec2 and V2 api, we just want to keep backwards compatibility. So just"},{"line_number":70,"context_line":"    move the compute API layer into REST API layer, there will be two policy"},{"line_number":71,"context_line":"    checks in v2 REST API layer:"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"    * https://review.openstack.org/#/c/65071/5/nova/api/openstack/compute/contrib/shelve.py"},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"3ae8d1ca_366821ba","line":71,"updated":"2014-05-28 03:16:30.000000000","message":"There is another option. For v2 api, if we want to keep all the thing is same, that will make the code looks mess(you will find two policy check in same api code). So we can clear for v2 same as v3 and with UpgradeImpact flags to notice deployer upgrade their policy configuration file. Let me know your guys suggestion.\n\nThanks,\nAlex","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"4dabc5e258fb98de2c72a4748f1fe9878b18ee12","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"  * For Ec2 and V2 api, we just want to keep backwards compatibility. So just"},{"line_number":70,"context_line":"    move the compute API layer into REST API layer, there will be two policy"},{"line_number":71,"context_line":"    checks in v2 REST API layer:"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"    * https://review.openstack.org/#/c/65071/5/nova/api/openstack/compute/contrib/shelve.py"},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_8a08aa2e","line":71,"in_reply_to":"1ae5cdf2_69a02cf5","updated":"2014-06-03 01:57:18.000000000","message":"yes, Kevin, if we still want to keep v2 api is same, that is good choice. We can keep v2 code untouch, that  is also a safe choice","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":1501,"name":"Phil Day","email":"philip.day@hp.com","username":"philip-day"},"change_message_id":"fb87d0f84fa8025bbf5a3ccfd5e180b7db81633b","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"  * For Ec2 and V2 api, we just want to keep backwards compatibility. So just"},{"line_number":70,"context_line":"    move the compute API layer into REST API layer, there will be two policy"},{"line_number":71,"context_line":"    checks in v2 REST API layer:"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"    * https://review.openstack.org/#/c/65071/5/nova/api/openstack/compute/contrib/shelve.py"},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_b0d9bef6","line":71,"in_reply_to":"1ae5cdf2_8a08aa2e","updated":"2014-06-06 17:00:31.000000000","message":"I like the sound of this approach","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"1ea4564d1124b7bf92815a7d32b6ddc291475da7","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"  * For Ec2 and V2 api, we just want to keep backwards compatibility. So just"},{"line_number":70,"context_line":"    move the compute API layer into REST API layer, there will be two policy"},{"line_number":71,"context_line":"    checks in v2 REST API layer:"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"    * https://review.openstack.org/#/c/65071/5/nova/api/openstack/compute/contrib/shelve.py"},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_d824ac10","line":71,"in_reply_to":"1ae5cdf2_b0d9bef6","updated":"2014-06-06 20:19:32.000000000","message":"Phil, you like the sound of the approach in the spec or the one in these comments?\n\nI have a preference for moving them into the v2 api so it\u0027s clear that we want to deprecate and remove them.  But either way works.","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"5e578aaaabbff96fcfc0465fc6bdbce8dcf7dc4d","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"  * For Ec2 and V2 api, we just want to keep backwards compatibility. So just"},{"line_number":70,"context_line":"    move the compute API layer into REST API layer, there will be two policy"},{"line_number":71,"context_line":"    checks in v2 REST API layer:"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"    * https://review.openstack.org/#/c/65071/5/nova/api/openstack/compute/contrib/shelve.py"},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_5c7327b4","line":71,"in_reply_to":"1ae5cdf2_d824ac10","updated":"2014-06-07 09:35:51.000000000","message":"Phil, I\u0027m not sure which one like also :)","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"0469419d1459e67442fe5baa8c8d0aec4f8f463e","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"  * For Ec2 and V2 api, we just want to keep backwards compatibility. So just"},{"line_number":70,"context_line":"    move the compute API layer into REST API layer, there will be two policy"},{"line_number":71,"context_line":"    checks in v2 REST API layer:"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"    * https://review.openstack.org/#/c/65071/5/nova/api/openstack/compute/contrib/shelve.py"},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_69a02cf5","line":71,"in_reply_to":"3ae8d1ca_165ec5e6","updated":"2014-05-30 07:50:06.000000000","message":"guess skip policy check for different version might be a good choice...","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"1a993ce55f69644e3c3dc32b583c99940940235a","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"  * For Ec2 and V2 api, we just want to keep backwards compatibility. So just"},{"line_number":70,"context_line":"    move the compute API layer into REST API layer, there will be two policy"},{"line_number":71,"context_line":"    checks in v2 REST API layer:"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"    * https://review.openstack.org/#/c/65071/5/nova/api/openstack/compute/contrib/shelve.py"},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"3ae8d1ca_165ec5e6","line":71,"in_reply_to":"3ae8d1ca_366821ba","updated":"2014-05-28 03:23:40.000000000","message":"One more option for this. If we want to v2 policy check is same as before,\nwe can add parameter for compute api to control whether running the policy checks. When running v2 api, the compute api policy checks is valid. When running v2.1 or v3 code the compute api poilcy checks will skip. Then the v2 api code won\u0027t looks mess anymore. After v2 api code depreciated, the compute api layer policy checks can be removed.","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":5174,"name":"Mauro Sergio Martins Rodrigues","email":"maurosr@linux.vnet.ibm.com","username":"maurosr"},"change_message_id":"e07e17292f5c4d4d65806999f1af1b81a81250f0","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    And we should ensure we have policy check at REST API layer."},{"line_number":80,"context_line":"  * For the v2 API, we remove all the hard-code permission check from DB layer."},{"line_number":81,"context_line":"    And with UpgradeImpact flags that notify deployer to update their"},{"line_number":82,"context_line":"    development configuration."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"* Correct the policy rule name specification for the v3 api"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_1d2b1495","line":82,"updated":"2014-06-02 15:26:15.000000000","message":"suggestion: we can update the v2 api policies to reflect how db was behaving, so supposing pause action:\n\n* Currently:\n - db already enforces it as admin only\n - api says admin or owner, so if api authorizes it, the action is blocked at db layer.\n\nAfter:\n - change api to admin only and the behavior stays the same.\n\nAt least it doesn\u0027t change how the things currently work, maybe if we\u0027re planning to keep api v2 as it is, mark the policy as deprecated or something that will need deployer\u0027s attention in the future.","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"c542d4c5e70ffeb7c5359e088dfdb760a93faddc","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    And we should ensure we have policy check at REST API layer."},{"line_number":80,"context_line":"  * For the v2 API, we remove all the hard-code permission check from DB layer."},{"line_number":81,"context_line":"    And with UpgradeImpact flags that notify deployer to update their"},{"line_number":82,"context_line":"    development configuration."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"* Correct the policy rule name specification for the v3 api"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_a008622e","line":82,"in_reply_to":"1ae5cdf2_1ce6ff44","updated":"2014-06-09 15:04:28.000000000","message":"Yes, that\u0027s what I\u0027m suggesting.","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"a1fd777a4d8a5dff72766aca789427558103d8ef","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    And we should ensure we have policy check at REST API layer."},{"line_number":80,"context_line":"  * For the v2 API, we remove all the hard-code permission check from DB layer."},{"line_number":81,"context_line":"    And with UpgradeImpact flags that notify deployer to update their"},{"line_number":82,"context_line":"    development configuration."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"* Correct the policy rule name specification for the v3 api"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_4a49428a","line":82,"in_reply_to":"1ae5cdf2_1d2b1495","updated":"2014-06-03 01:48:41.000000000","message":"Mauro, thanks, you are right, I\u0027m use that way in the beginning. In the review, Chris suggest me use UpgradeImpact. I think the reason is the db layer permission check is hardcode, that different with compute api layer.","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"1ea4564d1124b7bf92815a7d32b6ddc291475da7","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    And we should ensure we have policy check at REST API layer."},{"line_number":80,"context_line":"  * For the v2 API, we remove all the hard-code permission check from DB layer."},{"line_number":81,"context_line":"    And with UpgradeImpact flags that notify deployer to update their"},{"line_number":82,"context_line":"    development configuration."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"* Correct the policy rule name specification for the v3 api"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_58941ce8","line":82,"in_reply_to":"1ae5cdf2_30bbee76","updated":"2014-06-06 20:19:32.000000000","message":"I think it\u0027s useful to use the policy file to indicate which calls are meant to be admin only.  So if a call that\u0027s restricted to admin via a db check currently doesn\u0027t have an admin policy set in the sample policy file I think it\u0027s worth updating it.","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":1501,"name":"Phil Day","email":"philip.day@hp.com","username":"philip-day"},"change_message_id":"fb87d0f84fa8025bbf5a3ccfd5e180b7db81633b","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    And we should ensure we have policy check at REST API layer."},{"line_number":80,"context_line":"  * For the v2 API, we remove all the hard-code permission check from DB layer."},{"line_number":81,"context_line":"    And with UpgradeImpact flags that notify deployer to update their"},{"line_number":82,"context_line":"    development configuration."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"* Correct the policy rule name specification for the v3 api"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_30bbee76","line":82,"in_reply_to":"1ae5cdf2_4a49428a","updated":"2014-06-06 17:00:31.000000000","message":"I\u0027m not sure we need to change the policy file to match the existing behaviour - I see it more of a bug that the code doesn\u0027t currently allow the policy to be implemented, and this change helps to fix that","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"5e578aaaabbff96fcfc0465fc6bdbce8dcf7dc4d","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    And we should ensure we have policy check at REST API layer."},{"line_number":80,"context_line":"  * For the v2 API, we remove all the hard-code permission check from DB layer."},{"line_number":81,"context_line":"    And with UpgradeImpact flags that notify deployer to update their"},{"line_number":82,"context_line":"    development configuration."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"* Correct the policy rule name specification for the v3 api"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_1ce6ff44","line":82,"in_reply_to":"1ae5cdf2_58941ce8","updated":"2014-06-07 09:35:51.000000000","message":"Andrew, if understand correctly, you means we should move the db layer hardcode check, and also update the policy file to admin only if that didn\u0027t match before. I agree with this.","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"1ea4564d1124b7bf92815a7d32b6ddc291475da7","unresolved":false,"context_lines":[{"line_number":120,"context_line":"Performance Impact"},{"line_number":121,"context_line":"------------------"},{"line_number":122,"context_line":"This BP improve the error handling performance. Because the permission"},{"line_number":123,"context_line":"checking needn\u0027t down to nova low layer code. The permission error will"},{"line_number":124,"context_line":"get back to user early."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Other deployer impact"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_1880d48a","line":123,"updated":"2014-06-06 20:19:32.000000000","message":"s/needn\u0027t/will not go/","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"5e578aaaabbff96fcfc0465fc6bdbce8dcf7dc4d","unresolved":false,"context_lines":[{"line_number":120,"context_line":"Performance Impact"},{"line_number":121,"context_line":"------------------"},{"line_number":122,"context_line":"This BP improve the error handling performance. Because the permission"},{"line_number":123,"context_line":"checking needn\u0027t down to nova low layer code. The permission error will"},{"line_number":124,"context_line":"get back to user early."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Other deployer impact"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_3ce3bb34","line":123,"in_reply_to":"1ae5cdf2_1880d48a","updated":"2014-06-07 09:35:51.000000000","message":"done, thanks","commit_id":"65789a897b5dbf5a44734b5f917815cbf809a403"},{"author":{"_account_id":1501,"name":"Phil Day","email":"philip.day@hp.com","username":"philip-day"},"change_message_id":"64ed151b783a1c26148b902a79ca918a8bcea791","unresolved":false,"context_lines":[{"line_number":62,"context_line":""},{"line_number":63,"context_line":"* Remove policy check from compute API layer"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"  * For V3 API, there will be only one policy rule for the API in the"},{"line_number":66,"context_line":"    extensions. There will be a parameter \u0027skip_policy_check\u0027 for compute API"},{"line_number":67,"context_line":"    to control whether doing the policy checks. For V3 API, skip_policy_check"},{"line_number":68,"context_line":"    will be True."}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_f49d270b","line":65,"updated":"2014-06-13 10:52:07.000000000","message":"Might be better to say \"there will only be policy checks in the nova/api code\" or something like that.  \n\nI think you mean only one rule per API operation - not only one rule in the API as a whole ?","commit_id":"4f78d0ee9b6d80295640ccd1aac92e394dba6651"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"c7bd1460812aac98ee6244f448c69071f27ee869","unresolved":false,"context_lines":[{"line_number":62,"context_line":""},{"line_number":63,"context_line":"* Remove policy check from compute API layer"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"  * For V3 API, there will be only one policy rule for the API in the"},{"line_number":66,"context_line":"    extensions. There will be a parameter \u0027skip_policy_check\u0027 for compute API"},{"line_number":67,"context_line":"    to control whether doing the policy checks. For V3 API, skip_policy_check"},{"line_number":68,"context_line":"    will be True."}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_776af981","line":65,"in_reply_to":"1ae5cdf2_f49d270b","updated":"2014-06-13 11:19:47.000000000","message":"yeah, that\u0027s what I mean, will update, thanks","commit_id":"4f78d0ee9b6d80295640ccd1aac92e394dba6651"},{"author":{"_account_id":1501,"name":"Phil Day","email":"philip.day@hp.com","username":"philip-day"},"change_message_id":"64ed151b783a1c26148b902a79ca918a8bcea791","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    to control whether doing the policy checks. For V3 API, skip_policy_check"},{"line_number":68,"context_line":"    will be True."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"    * https://review.openstack.org/#/c/65071/5/nova/api/openstack/compute/plugins/v3/shelve.py"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"  * For Ec2, we also want to keep backwards compatibility. we will move the"},{"line_number":73,"context_line":"    compute API layer policy checking into REST API layer."}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_b4147fa0","line":70,"updated":"2014-06-13 10:52:07.000000000","message":"Is this being included just as an example ?  Its kind of confusing when the text above says there \"will only be one policy rule\" - as if this one in shelve is it ?","commit_id":"4f78d0ee9b6d80295640ccd1aac92e394dba6651"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"c7bd1460812aac98ee6244f448c69071f27ee869","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    to control whether doing the policy checks. For V3 API, skip_policy_check"},{"line_number":68,"context_line":"    will be True."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"    * https://review.openstack.org/#/c/65071/5/nova/api/openstack/compute/plugins/v3/shelve.py"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"  * For Ec2, we also want to keep backwards compatibility. we will move the"},{"line_number":73,"context_line":"    compute API layer policy checking into REST API layer."}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_d70aedd0","line":70,"in_reply_to":"1ae5cdf2_b4147fa0","updated":"2014-06-13 11:19:47.000000000","message":"yes, this is just as an example.","commit_id":"4f78d0ee9b6d80295640ccd1aac92e394dba6651"},{"author":{"_account_id":1501,"name":"Phil Day","email":"philip.day@hp.com","username":"philip-day"},"change_message_id":"64ed151b783a1c26148b902a79ca918a8bcea791","unresolved":false,"context_lines":[{"line_number":72,"context_line":"  * For Ec2, we also want to keep backwards compatibility. we will move the"},{"line_number":73,"context_line":"    compute API layer policy checking into REST API layer."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"    * https://review.openstack.org/#/c/63690/13/nova/api/ec2/cloud.py"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"  * For V2 API, we want to keep the backwards-compatibility. But we won\u0027t move"},{"line_number":78,"context_line":"    the compute API layer policy checking into REST API layer. We will set"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_749117f0","line":75,"updated":"2014-06-13 10:52:07.000000000","message":"Maybe add a para to explain where the V2.1 API fits into this ?","commit_id":"4f78d0ee9b6d80295640ccd1aac92e394dba6651"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"c7bd1460812aac98ee6244f448c69071f27ee869","unresolved":false,"context_lines":[{"line_number":72,"context_line":"  * For Ec2, we also want to keep backwards compatibility. we will move the"},{"line_number":73,"context_line":"    compute API layer policy checking into REST API layer."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"    * https://review.openstack.org/#/c/63690/13/nova/api/ec2/cloud.py"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"  * For V2 API, we want to keep the backwards-compatibility. But we won\u0027t move"},{"line_number":78,"context_line":"    the compute API layer policy checking into REST API layer. We will set"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_57f6ddd7","line":75,"in_reply_to":"1ae5cdf2_749117f0","updated":"2014-06-13 11:19:47.000000000","message":"V2.1 is same with V3, I will update the V3 para.","commit_id":"4f78d0ee9b6d80295640ccd1aac92e394dba6651"},{"author":{"_account_id":1501,"name":"Phil Day","email":"philip.day@hp.com","username":"philip-day"},"change_message_id":"4fc4eaa111640d4b1612e96d16dd8c6f5c17b6ab","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    control whether doing the policy checks. For V2.1/V3 API,"},{"line_number":68,"context_line":"    skip_policy_check will be True."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"    * https://review.openstack.org/#/c/65071/5/nova/api/openstack/compute/plugins/v3/shelve.py"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"  * For Ec2, we also want to keep backwards compatibility. we will move the"},{"line_number":73,"context_line":"    compute API layer policy checking into REST API layer."}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_d3448a1d","line":70,"updated":"2014-06-16 10:39:51.000000000","message":"Still not really clear to me what this example adds by way of clarification - the specific change seems to be just a tidy-up of the code ?    In its current position in here I was expecting to see an example of skip_policy_check.\n\nAs it stands I\u0027m not sure its adding anything to this spec.","commit_id":"a1824f7b4efb311aee855f8235fb37171d3b4e7b"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"9bff5ea81b18fb0db777de6262109fc546e47873","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    control whether doing the policy checks. For V2.1/V3 API,"},{"line_number":68,"context_line":"    skip_policy_check will be True."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"    * https://review.openstack.org/#/c/65071/5/nova/api/openstack/compute/plugins/v3/shelve.py"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"  * For Ec2, we also want to keep backwards compatibility. we will move the"},{"line_number":73,"context_line":"    compute API layer policy checking into REST API layer."}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_01d85c7e","line":70,"in_reply_to":"1ae5cdf2_d3448a1d","updated":"2014-06-16 11:23:40.000000000","message":"oops, I understand the problem now. This patch is using the method that I proposed initially. That is showing the compute api layer checking is removed, and only have policy checking in REST API layer. It didn\u0027t use skip_policy_check method. I just propose the skip_policy_check method in previous patchset. I should update one patch as example. Thanks.","commit_id":"a1824f7b4efb311aee855f8235fb37171d3b4e7b"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1b2b7d67dbe5542be47947d6c5c109e0c35cc0f7","unresolved":false,"context_lines":[{"line_number":31,"context_line":"same, even though they may in practice be implemented at different points."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"This BP is already discussed at Icehouse summit:"},{"line_number":34,"context_line":"https://etherpad.openstack.org/p/icehouse-summit-nova-v3-api"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Problem description"},{"line_number":37,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_a8efc085","line":34,"updated":"2014-06-20 14:23:12.000000000","message":"NIT: this summary section is too long, it should mostly be in Problem description, but I will ignore that for now.","commit_id":"64504d455094658ad9b05d24e7f0567680018df2"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"6d6752493cf289a89593b2027f201a7f5fa586c4","unresolved":false,"context_lines":[{"line_number":31,"context_line":"same, even though they may in practice be implemented at different points."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"This BP is already discussed at Icehouse summit:"},{"line_number":34,"context_line":"https://etherpad.openstack.org/p/icehouse-summit-nova-v3-api"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Problem description"},{"line_number":37,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_03833703","line":34,"in_reply_to":"1ae5cdf2_a8efc085","updated":"2014-06-20 14:36:25.000000000","message":"let me doing some adjust.","commit_id":"64504d455094658ad9b05d24e7f0567680018df2"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"76ed66aef556c9e812dc006237886007356d4a5d","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    checking at compute API layer. It\u0027s because V2 API will be depreciated"},{"line_number":80,"context_line":"    After V2.1 released, we needn\u0027t take risk of breaking existed code."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"    https://review.openstack.org/#/c/100408/2/nova/compute/api.py"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"* Remove hard-code permission check from db layer"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_c8110306","line":82,"updated":"2014-06-17 12:31:19.000000000","message":"I think this is the new proposal I need to catch up :)\n\nseveral questions:\nwhy we only move compute  and remove db layer? any criteria?\nand looks to me add some check at compute layer based on API layer is a little bit hack because IMHO lower level code based on upper layer definition is a little bit ugly...","commit_id":"64504d455094658ad9b05d24e7f0567680018df2"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"92c6f85a9c7619940ba79b14652fcb12e8fc16ae","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    checking at compute API layer. It\u0027s because V2 API will be depreciated"},{"line_number":80,"context_line":"    After V2.1 released, we needn\u0027t take risk of breaking existed code."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"    https://review.openstack.org/#/c/100408/2/nova/compute/api.py"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"* Remove hard-code permission check from db layer"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_3f1ffab8","line":82,"in_reply_to":"1ae5cdf2_c8110306","updated":"2014-06-17 13:32:01.000000000","message":"hi, jichenjc, we only keep compute layer checks for v2 api is for keep back-compatibility, that because there is maybe some deployer already change the compute layer policy rules. The db layer permission check is different situation. All the db layer permission check is hard-code. That make the REST API layer and compute API layer policy checks doesn\u0027t work. So we prefer to remove them, make the policy checks works.\n\nSorry, I\u0027m not quite understand the meaning \u0027add some check at compute layer based on API layer\u0027. Could you clarify it again?\n\nThanks\nAlex","commit_id":"64504d455094658ad9b05d24e7f0567680018df2"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1b2b7d67dbe5542be47947d6c5c109e0c35cc0f7","unresolved":false,"context_lines":[{"line_number":185,"context_line":""},{"line_number":186,"context_line":"Testing"},{"line_number":187,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":188,"context_line":"For unittest, it will ensure the policy existed and works."},{"line_number":189,"context_line":"For tempest test, there won\u0027t test it because of the difficulty of configuring"},{"line_number":190,"context_line":"policy in tempest."},{"line_number":191,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_0845146e","line":188,"updated":"2014-06-20 14:23:12.000000000","message":"NIT: No need for unit tests to get mentioned, they are assumed.","commit_id":"64504d455094658ad9b05d24e7f0567680018df2"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"6d6752493cf289a89593b2027f201a7f5fa586c4","unresolved":false,"context_lines":[{"line_number":185,"context_line":""},{"line_number":186,"context_line":"Testing"},{"line_number":187,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":188,"context_line":"For unittest, it will ensure the policy existed and works."},{"line_number":189,"context_line":"For tempest test, there won\u0027t test it because of the difficulty of configuring"},{"line_number":190,"context_line":"policy in tempest."},{"line_number":191,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_43e37f04","line":188,"in_reply_to":"1ae5cdf2_0845146e","updated":"2014-06-20 14:36:25.000000000","message":"Done","commit_id":"64504d455094658ad9b05d24e7f0567680018df2"},{"author":{"_account_id":1849,"name":"Joe Gordon","email":"joe.gordon0@gmail.com","username":"jogo"},"change_message_id":"7164837775346f9f0a835f8729f5edf434cf22b7","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Proposed change"},{"line_number":61,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"This BP propose enforce policy at REST API layer. Because REST API will access"},{"line_number":64,"context_line":"different internal API, like compute API, DB API or other internal API, the"},{"line_number":65,"context_line":"REST API layer is the place to enforce policy consistently."},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_12579528","line":63,"updated":"2014-06-24 18:16:51.000000000","message":"You can drop the \"This BP propose\" wording and start at \u0027Enforce policy at the REST API layer\u0027","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"83aac809fea14de33a6afa4701287fe5cda04d74","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Proposed change"},{"line_number":61,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"This BP propose enforce policy at REST API layer. Because REST API will access"},{"line_number":64,"context_line":"different internal API, like compute API, DB API or other internal API, the"},{"line_number":65,"context_line":"REST API layer is the place to enforce policy consistently."},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_5a0da7e7","line":63,"in_reply_to":"1ae5cdf2_12579528","updated":"2014-06-25 01:36:03.000000000","message":"Done","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":1849,"name":"Joe Gordon","email":"joe.gordon0@gmail.com","username":"jogo"},"change_message_id":"7164837775346f9f0a835f8729f5edf434cf22b7","unresolved":false,"context_lines":[{"line_number":61,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"This BP propose enforce policy at REST API layer. Because REST API will access"},{"line_number":64,"context_line":"different internal API, like compute API, DB API or other internal API, the"},{"line_number":65,"context_line":"REST API layer is the place to enforce policy consistently."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"* Remove policy check from compute API layer"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_52511d2f","line":64,"updated":"2014-06-24 18:16:51.000000000","message":"internal APIs","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"83aac809fea14de33a6afa4701287fe5cda04d74","unresolved":false,"context_lines":[{"line_number":61,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"This BP propose enforce policy at REST API layer. Because REST API will access"},{"line_number":64,"context_line":"different internal API, like compute API, DB API or other internal API, the"},{"line_number":65,"context_line":"REST API layer is the place to enforce policy consistently."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"* Remove policy check from compute API layer"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_7a10a300","line":64,"in_reply_to":"1ae5cdf2_52511d2f","updated":"2014-06-25 01:36:03.000000000","message":"Done","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":1849,"name":"Joe Gordon","email":"joe.gordon0@gmail.com","username":"jogo"},"change_message_id":"7164837775346f9f0a835f8729f5edf434cf22b7","unresolved":false,"context_lines":[{"line_number":66,"context_line":""},{"line_number":67,"context_line":"* Remove policy check from compute API layer"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"  * For V2.1/V3 API, there will only be policy checks in the nova API REST API"},{"line_number":70,"context_line":"    layer. There will be a parameter \u0027skip_policy_check\u0027 for compute API to"},{"line_number":71,"context_line":"    control whether doing the policy checks. For V2.1/V3 API,"},{"line_number":72,"context_line":"    skip_policy_check will be True."}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_322d71a9","line":69,"updated":"2014-06-24 18:16:51.000000000","message":"\"API REST API\"","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"83aac809fea14de33a6afa4701287fe5cda04d74","unresolved":false,"context_lines":[{"line_number":66,"context_line":""},{"line_number":67,"context_line":"* Remove policy check from compute API layer"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"  * For V2.1/V3 API, there will only be policy checks in the nova API REST API"},{"line_number":70,"context_line":"    layer. There will be a parameter \u0027skip_policy_check\u0027 for compute API to"},{"line_number":71,"context_line":"    control whether doing the policy checks. For V2.1/V3 API,"},{"line_number":72,"context_line":"    skip_policy_check will be True."}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_9a1d6f13","line":69,"in_reply_to":"1ae5cdf2_322d71a9","updated":"2014-06-25 01:36:03.000000000","message":"Done","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":1849,"name":"Joe Gordon","email":"joe.gordon0@gmail.com","username":"jogo"},"change_message_id":"7164837775346f9f0a835f8729f5edf434cf22b7","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    https://review.openstack.org/#/c/100408/2/nova/api/openstack/compute/plugins/v3/shelve.py"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"  * For Ec2, we also want to keep backwards compatibility. we will move the"},{"line_number":77,"context_line":"    compute API layer policy checking into REST API layer, that same as"},{"line_number":78,"context_line":"    V2.1/V3 API."},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_75fd2308","line":76,"updated":"2014-06-24 18:16:51.000000000","message":"s/we/We/","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"83aac809fea14de33a6afa4701287fe5cda04d74","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    https://review.openstack.org/#/c/100408/2/nova/api/openstack/compute/plugins/v3/shelve.py"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"  * For Ec2, we also want to keep backwards compatibility. we will move the"},{"line_number":77,"context_line":"    compute API layer policy checking into REST API layer, that same as"},{"line_number":78,"context_line":"    V2.1/V3 API."},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_da17f7ec","line":76,"in_reply_to":"1ae5cdf2_75fd2308","updated":"2014-06-25 01:36:03.000000000","message":"Done","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":1849,"name":"Joe Gordon","email":"joe.gordon0@gmail.com","username":"jogo"},"change_message_id":"7164837775346f9f0a835f8729f5edf434cf22b7","unresolved":false,"context_lines":[{"line_number":74,"context_line":"    https://review.openstack.org/#/c/100408/2/nova/api/openstack/compute/plugins/v3/shelve.py"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"  * For Ec2, we also want to keep backwards compatibility. we will move the"},{"line_number":77,"context_line":"    compute API layer policy checking into REST API layer, that same as"},{"line_number":78,"context_line":"    V2.1/V3 API."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  * For V2 API, we want to keep the backwards-compatibility. But we won\u0027t move"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_b507ab17","line":77,"updated":"2014-06-24 18:16:51.000000000","message":"\"into the REST API layer, the same as V2.1\"...","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"83aac809fea14de33a6afa4701287fe5cda04d74","unresolved":false,"context_lines":[{"line_number":74,"context_line":"    https://review.openstack.org/#/c/100408/2/nova/api/openstack/compute/plugins/v3/shelve.py"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"  * For Ec2, we also want to keep backwards compatibility. we will move the"},{"line_number":77,"context_line":"    compute API layer policy checking into REST API layer, that same as"},{"line_number":78,"context_line":"    V2.1/V3 API."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  * For V2 API, we want to keep the backwards-compatibility. But we won\u0027t move"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_3ad45b1e","line":77,"in_reply_to":"1ae5cdf2_b507ab17","updated":"2014-06-25 01:36:03.000000000","message":"Done","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":1849,"name":"Joe Gordon","email":"joe.gordon0@gmail.com","username":"jogo"},"change_message_id":"7164837775346f9f0a835f8729f5edf434cf22b7","unresolved":false,"context_lines":[{"line_number":77,"context_line":"    compute API layer policy checking into REST API layer, that same as"},{"line_number":78,"context_line":"    V2.1/V3 API."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  * For V2 API, we want to keep the backwards-compatibility. But we won\u0027t move"},{"line_number":81,"context_line":"    the compute API layer policy checking into REST API layer. We will set"},{"line_number":82,"context_line":"    parameter skip_policy_check to False, that means still doing policy"},{"line_number":83,"context_line":"    checking at compute API layer. It\u0027s because V2 API will be depreciated"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_d50a771f","line":80,"updated":"2014-06-24 18:16:51.000000000","message":"So we won\u0027t move","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"83aac809fea14de33a6afa4701287fe5cda04d74","unresolved":false,"context_lines":[{"line_number":77,"context_line":"    compute API layer policy checking into REST API layer, that same as"},{"line_number":78,"context_line":"    V2.1/V3 API."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  * For V2 API, we want to keep the backwards-compatibility. But we won\u0027t move"},{"line_number":81,"context_line":"    the compute API layer policy checking into REST API layer. We will set"},{"line_number":82,"context_line":"    parameter skip_policy_check to False, that means still doing policy"},{"line_number":83,"context_line":"    checking at compute API layer. It\u0027s because V2 API will be depreciated"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_5adbe74e","line":80,"in_reply_to":"1ae5cdf2_d50a771f","updated":"2014-06-25 01:36:03.000000000","message":"Done","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":1849,"name":"Joe Gordon","email":"joe.gordon0@gmail.com","username":"jogo"},"change_message_id":"7164837775346f9f0a835f8729f5edf434cf22b7","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  * For V2 API, we want to keep the backwards-compatibility. But we won\u0027t move"},{"line_number":81,"context_line":"    the compute API layer policy checking into REST API layer. We will set"},{"line_number":82,"context_line":"    parameter skip_policy_check to False, that means still doing policy"},{"line_number":83,"context_line":"    checking at compute API layer. It\u0027s because V2 API will be depreciated"},{"line_number":84,"context_line":"    After V2.1 released, we needn\u0027t take risk of breaking existed code."},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_351b9b74","line":82,"updated":"2014-06-24 18:16:51.000000000","message":"the skip_policy_check flag sounds a little misleading. isn\u0027t this flag either check policy in current locations or just check in the API?","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"83aac809fea14de33a6afa4701287fe5cda04d74","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  * For V2 API, we want to keep the backwards-compatibility. But we won\u0027t move"},{"line_number":81,"context_line":"    the compute API layer policy checking into REST API layer. We will set"},{"line_number":82,"context_line":"    parameter skip_policy_check to False, that means still doing policy"},{"line_number":83,"context_line":"    checking at compute API layer. It\u0027s because V2 API will be depreciated"},{"line_number":84,"context_line":"    After V2.1 released, we needn\u0027t take risk of breaking existed code."},{"line_number":85,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_9acbaf72","line":82,"in_reply_to":"1ae5cdf2_351b9b74","updated":"2014-06-25 01:36:03.000000000","message":"skip_policy_check flag is a parameter for compute.API. It means still keep the compute api layer policy checks.","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":1849,"name":"Joe Gordon","email":"joe.gordon0@gmail.com","username":"jogo"},"change_message_id":"7164837775346f9f0a835f8729f5edf434cf22b7","unresolved":false,"context_lines":[{"line_number":135,"context_line":"------------------"},{"line_number":136,"context_line":"This BP improve the error handling performance. Because the permission"},{"line_number":137,"context_line":"checking will not go down to nova low layer code. The permission error will"},{"line_number":138,"context_line":"get back to user early."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Other deployer impact"},{"line_number":141,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_954e2f6d","line":138,"updated":"2014-06-24 18:16:51.000000000","message":"can you elaborate on this point, I am unclear on what you mean about error handling performance. Do you mean policy errors will happen faster since they are higher up the stack?","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"83aac809fea14de33a6afa4701287fe5cda04d74","unresolved":false,"context_lines":[{"line_number":135,"context_line":"------------------"},{"line_number":136,"context_line":"This BP improve the error handling performance. Because the permission"},{"line_number":137,"context_line":"checking will not go down to nova low layer code. The permission error will"},{"line_number":138,"context_line":"get back to user early."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Other deployer impact"},{"line_number":141,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_fac0334c","line":138,"in_reply_to":"1ae5cdf2_954e2f6d","updated":"2014-06-25 01:36:03.000000000","message":"Yeah, that is what I mean.","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":1849,"name":"Joe Gordon","email":"joe.gordon0@gmail.com","username":"jogo"},"change_message_id":"7164837775346f9f0a835f8729f5edf434cf22b7","unresolved":false,"context_lines":[{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Testing"},{"line_number":191,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":192,"context_line":"For tempest test, there won\u0027t test it because of the difficulty of configuring"},{"line_number":193,"context_line":"policy in tempest."},{"line_number":194,"context_line":""},{"line_number":195,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_5544a746","line":192,"updated":"2014-06-24 18:16:51.000000000","message":"I think this section can be rephrased. Hopefully tempest already has some policy checks to make sure there are no regressions bugs etc. As this is mostly an internal nova blueprint","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"83aac809fea14de33a6afa4701287fe5cda04d74","unresolved":false,"context_lines":[{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Testing"},{"line_number":191,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":192,"context_line":"For tempest test, there won\u0027t test it because of the difficulty of configuring"},{"line_number":193,"context_line":"policy in tempest."},{"line_number":194,"context_line":""},{"line_number":195,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_7aac23a0","line":192,"in_reply_to":"1ae5cdf2_5544a746","updated":"2014-06-25 01:36:03.000000000","message":"Done","commit_id":"85bac0650d1606d9b9a5d8c426ebfe2d6edf92c5"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"9f25796f8625b46db21517f9d0c218557c4b9daa","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"  * REST API layer: https://github.com/openstack/nova/blob/e32b7573395aec06af5ae8d14cd151f76382d896/nova/api/openstack/compute/contrib/admin_actions.py#L53"},{"line_number":45,"context_line":"  * Compute API layer: https://github.com/openstack/nova/blob/e32b7573395aec06af5ae8d14cd151f76382d896/nova/compute/api.py#L2519"},{"line_number":46,"context_line":"  * DB layer: https://github.com/openstack/nova/blob/e32b7573395aec06af5ae8d14cd151f76382d896/nova/db/sqlalchemy/api.py#L444"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"* Duplicated policy checking for same API. Example:"},{"line_number":49,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"1ae5cdf2_f283e052","line":46,"updated":"2014-06-25 16:19:00.000000000","message":"I think it\u0027s fine to just mention that there are checks at the compute and db layer without needing to link to them.","commit_id":"4c2f2782dcb89902f858c5fc8440c0601c521389"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"fa515b8675a5bbfbd8878ed6fe7e61109b086fe8","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"  * REST API layer: https://github.com/openstack/nova/blob/e32b7573395aec06af5ae8d14cd151f76382d896/nova/api/openstack/compute/contrib/admin_actions.py#L53"},{"line_number":45,"context_line":"  * Compute API layer: https://github.com/openstack/nova/blob/e32b7573395aec06af5ae8d14cd151f76382d896/nova/compute/api.py#L2519"},{"line_number":46,"context_line":"  * DB layer: https://github.com/openstack/nova/blob/e32b7573395aec06af5ae8d14cd151f76382d896/nova/db/sqlalchemy/api.py#L444"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"* Duplicated policy checking for same API. Example:"},{"line_number":49,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"1ae5cdf2_714180a5","line":46,"in_reply_to":"1ae5cdf2_f283e052","updated":"2014-06-26 10:02:18.000000000","message":"Done","commit_id":"4c2f2782dcb89902f858c5fc8440c0601c521389"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"9f25796f8625b46db21517f9d0c218557c4b9daa","unresolved":false,"context_lines":[{"line_number":99,"context_line":"* Correct the policy rule name specification for the v3 api"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"  * Core API rule scope: \"compute:v3:[core_alias]:[action]\""},{"line_number":102,"context_line":"  * Extension api rule scope: \"compute_extension:v3:[extension_alias]:[action]\""},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Alternatives"},{"line_number":105,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":13,"id":"1ae5cdf2_52701473","line":102,"updated":"2014-06-25 16:19:00.000000000","message":"I disagree with this.  The core API may change over time and I don\u0027t think we should have to update policies when that happens.  Unless I\u0027m misunderstanding what this is saying.","commit_id":"4c2f2782dcb89902f858c5fc8440c0601c521389"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"fa515b8675a5bbfbd8878ed6fe7e61109b086fe8","unresolved":false,"context_lines":[{"line_number":99,"context_line":"* Correct the policy rule name specification for the v3 api"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"  * Core API rule scope: \"compute:v3:[core_alias]:[action]\""},{"line_number":102,"context_line":"  * Extension api rule scope: \"compute_extension:v3:[extension_alias]:[action]\""},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Alternatives"},{"line_number":105,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":13,"id":"1ae5cdf2_bec66814","line":102,"in_reply_to":"1ae5cdf2_52701473","updated":"2014-06-26 10:02:18.000000000","message":"I\u0027m not sure whether micro-version can promote api to core. But it sound make sense.\n\nHow about naming as below:\napi:[core_alias/extension_alias]:[action]\n\nWe drop the version now. Because the version may often changed by micro-version.","commit_id":"4c2f2782dcb89902f858c5fc8440c0601c521389"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"89d4a44cbc9e5b522f64abb2a9e38e2c71718726","unresolved":false,"context_lines":[{"line_number":99,"context_line":"* Correct the policy rule name specification for the v3 api"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"  * Core API rule scope: \"compute:v3:[core_alias]:[action]\""},{"line_number":102,"context_line":"  * Extension api rule scope: \"compute_extension:v3:[extension_alias]:[action]\""},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Alternatives"},{"line_number":105,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":13,"id":"1ae5cdf2_9c644ae6","line":102,"in_reply_to":"1ae5cdf2_bec66814","updated":"2014-06-26 13:28:01.000000000","message":"I think it should just be api:[extension_alias]:[action].  The concept of whether or not an extension is considered core should have no bearing on the policy name.  I don\u0027t think it\u0027s valuable to make a distinction there and I think it will lead to unnecessary work down the road when we have to deprecate an option and make a new one just because we want to promote an extension to core.","commit_id":"4c2f2782dcb89902f858c5fc8440c0601c521389"},{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"3e20b5721c1da6ed5fa66c39db6742d4f66c6064","unresolved":false,"context_lines":[{"line_number":110,"context_line":"  should be enforce by cinder API."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"* For network related extensions, we will doing same improvement for"},{"line_number":113,"context_line":"  nova-network. And skip any policy enforcement for neutron. And because"},{"line_number":114,"context_line":"  network related extensions didn\u0027t port into v2.1/v3 yet, so it will be"},{"line_number":115,"context_line":"  improved after those extensions ported."},{"line_number":116,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"1ae5cdf2_8a178553","line":113,"updated":"2014-06-27 04:06:58.000000000","message":"why do we skip policy enforcement for neutron?","commit_id":"b9ab7f90d3b71138c2d7aab515dafa12cc3dafe9"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"e2ad864975a1701452e4308b182643918680675b","unresolved":false,"context_lines":[{"line_number":110,"context_line":"  should be enforce by cinder API."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"* For network related extensions, we will doing same improvement for"},{"line_number":113,"context_line":"  nova-network. And skip any policy enforcement for neutron. And because"},{"line_number":114,"context_line":"  network related extensions didn\u0027t port into v2.1/v3 yet, so it will be"},{"line_number":115,"context_line":"  improved after those extensions ported."},{"line_number":116,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"1ae5cdf2_f611d053","line":113,"in_reply_to":"1ae5cdf2_8a178553","updated":"2014-06-27 06:04:38.000000000","message":"Because that should be done by neutron API. I will add note at here.","commit_id":"b9ab7f90d3b71138c2d7aab515dafa12cc3dafe9"},{"author":{"_account_id":5292,"name":"Christopher Yeoh","email":"cbkyeoh@gmail.com","username":"cyeoh-0"},"change_message_id":"3e20b5721c1da6ed5fa66c39db6742d4f66c6064","unresolved":false,"context_lines":[{"line_number":149,"context_line":"------------------"},{"line_number":150,"context_line":"This BP improve the error handling performance. Because the permission"},{"line_number":151,"context_line":"checking will not go down to nova low layer code. The permission error will"},{"line_number":152,"context_line":"get back to user early."},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"Other deployer impact"},{"line_number":155,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1ae5cdf2_358b326a","line":152,"updated":"2014-06-27 04:06:58.000000000","message":"How about rephrasing this as :\n\nThis BP will improve the error handling performance. Because the permission checking occurs at the API level rather than at a lower level in Nova less processing will occur before a request is rejected. Also potentially for newer versions of the API redundant policy checks are removed which will also improve performance.","commit_id":"b9ab7f90d3b71138c2d7aab515dafa12cc3dafe9"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"e2ad864975a1701452e4308b182643918680675b","unresolved":false,"context_lines":[{"line_number":149,"context_line":"------------------"},{"line_number":150,"context_line":"This BP improve the error handling performance. Because the permission"},{"line_number":151,"context_line":"checking will not go down to nova low layer code. The permission error will"},{"line_number":152,"context_line":"get back to user early."},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"Other deployer impact"},{"line_number":155,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1ae5cdf2_b61bc86d","line":152,"in_reply_to":"1ae5cdf2_358b326a","updated":"2014-06-27 06:04:38.000000000","message":"Thanks!","commit_id":"b9ab7f90d3b71138c2d7aab515dafa12cc3dafe9"}]}