)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e7df5627689fd6a0cd070c3da8d6120f909030f9","unresolved":false,"context_lines":[{"line_number":12,"context_line":"There are elevated contexts in the code used to call those methods which"},{"line_number":13,"context_line":"aren\u0027t removed in this patch. The elevated context will be cleaned up in"},{"line_number":14,"context_line":"last step. This is safe if we forget removing some hard-code permission."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Partially implements bp nova-api-policy-final-part"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Change-Id: I06c90564e32a89761b752782d3fb74da9cc4d343"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"bab921fb_b2a3704f","line":15,"updated":"2015-04-22 20:05:15.000000000","message":"Does this also fix bug 1447084 and therefore need to be backported to stable/kilo as a regression from Juno?","commit_id":"16ec81297971fc9579657b81ae6d11ad0b0522a9"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"11565de64837e80c4b364c573e727e8ab7665cbe","unresolved":false,"context_lines":[{"line_number":12,"context_line":"There are elevated contexts in the code used to call those methods which"},{"line_number":13,"context_line":"aren\u0027t removed in this patch. The elevated context will be cleaned up in"},{"line_number":14,"context_line":"last step. This is safe if we forget removing some hard-code permission."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Partially implements bp nova-api-policy-final-part"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Change-Id: I06c90564e32a89761b752782d3fb74da9cc4d343"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"9abe1de1_36d8711d","line":15,"in_reply_to":"9abe1de1_ab2421af","updated":"2015-04-27 12:35:19.000000000","message":"Do we back-port this to rc? If yes, I just want to backport https://review.openstack.org/#/c/176651/, because it only fix the API which bug description. This patch need touch evacuate and aggregate API.\n\nIf not, I\u0027m ok back-port this patch.","commit_id":"16ec81297971fc9579657b81ae6d11ad0b0522a9"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"ac541c78c0f6d7eb1857887991c54fb06383b3b2","unresolved":false,"context_lines":[{"line_number":12,"context_line":"There are elevated contexts in the code used to call those methods which"},{"line_number":13,"context_line":"aren\u0027t removed in this patch. The elevated context will be cleaned up in"},{"line_number":14,"context_line":"last step. This is safe if we forget removing some hard-code permission."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Partially implements bp nova-api-policy-final-part"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Change-Id: I06c90564e32a89761b752782d3fb74da9cc4d343"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"bab921fb_8dbe07fe","line":15,"in_reply_to":"bab921fb_7f86c0ba","updated":"2015-04-23 02:13:22.000000000","message":"yea, that\u0027s good idea","commit_id":"16ec81297971fc9579657b81ae6d11ad0b0522a9"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"af847fc2ed9b9637c5b482b9d38332ff3f0fea1c","unresolved":false,"context_lines":[{"line_number":12,"context_line":"There are elevated contexts in the code used to call those methods which"},{"line_number":13,"context_line":"aren\u0027t removed in this patch. The elevated context will be cleaned up in"},{"line_number":14,"context_line":"last step. This is safe if we forget removing some hard-code permission."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Partially implements bp nova-api-policy-final-part"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Change-Id: I06c90564e32a89761b752782d3fb74da9cc4d343"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"bab921fb_a9bc096d","line":15,"in_reply_to":"bab921fb_8dbe07fe","updated":"2015-04-23 14:16:17.000000000","message":"In progress here:\n\nhttps://review.openstack.org/#/c/176651/","commit_id":"16ec81297971fc9579657b81ae6d11ad0b0522a9"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"f8b2dc9662c8649ee6f704f35cf3ce4461750aba","unresolved":false,"context_lines":[{"line_number":12,"context_line":"There are elevated contexts in the code used to call those methods which"},{"line_number":13,"context_line":"aren\u0027t removed in this patch. The elevated context will be cleaned up in"},{"line_number":14,"context_line":"last step. This is safe if we forget removing some hard-code permission."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Partially implements bp nova-api-policy-final-part"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Change-Id: I06c90564e32a89761b752782d3fb74da9cc4d343"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"9abe1de1_ab2421af","line":15,"in_reply_to":"bab921fb_a9bc096d","updated":"2015-04-27 09:57:36.000000000","message":"Why not considering to only remove the DB decorator in that patch (without providing the context checks at the API level) and only backport that change ?","commit_id":"16ec81297971fc9579657b81ae6d11ad0b0522a9"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"bb5d93a2e6e49b76f6b0af5241058f1add9aedec","unresolved":false,"context_lines":[{"line_number":12,"context_line":"There are elevated contexts in the code used to call those methods which"},{"line_number":13,"context_line":"aren\u0027t removed in this patch. The elevated context will be cleaned up in"},{"line_number":14,"context_line":"last step. This is safe if we forget removing some hard-code permission."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Partially implements bp nova-api-policy-final-part"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Change-Id: I06c90564e32a89761b752782d3fb74da9cc4d343"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"bab921fb_dfe6ece7","line":15,"in_reply_to":"bab921fb_b2a3704f","updated":"2015-04-22 20:43:52.000000000","message":"Nevermind, reading this again:\n\nhttps://bugs.launchpad.net/nova/+bug/1447084/comments/4\n\nIt sounds like we need a separate \u0027tactical\u0027 fix just for stable/kilo to pass an elevated context to db.service_get_by_compute_host which was introduced with this change:\n\nhttps://review.openstack.org/#/c/150568","commit_id":"16ec81297971fc9579657b81ae6d11ad0b0522a9"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c621437d8bf57ce539bf8ea76a4522cf0962b89f","unresolved":false,"context_lines":[{"line_number":12,"context_line":"There are elevated contexts in the code used to call those methods which"},{"line_number":13,"context_line":"aren\u0027t removed in this patch. The elevated context will be cleaned up in"},{"line_number":14,"context_line":"last step. This is safe if we forget removing some hard-code permission."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Partially implements bp nova-api-policy-final-part"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Change-Id: I06c90564e32a89761b752782d3fb74da9cc4d343"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":10,"id":"bab921fb_7f86c0ba","line":15,"in_reply_to":"bab921fb_dfe6ece7","updated":"2015-04-22 20:51:03.000000000","message":"Can we slip a tactical fix for bug 1447084 into master which passes an elevated context to service_get_by_compute_host and then rebase this change on top of that which removes the db api require_admin_context() decorator?  Then we backport the tactical fix to stable/kilo and it\u0027s removed in an updated version of this change on master.","commit_id":"16ec81297971fc9579657b81ae6d11ad0b0522a9"}],"etc/nova/policy.json":[{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"f8b2dc9662c8649ee6f704f35cf3ce4461750aba","unresolved":false,"context_lines":[{"line_number":42,"context_line":"    \"compute_extension:admin_actions:migrateLive\": \"rule:admin_api\","},{"line_number":43,"context_line":"    \"compute_extension:admin_actions:resetState\": \"rule:admin_api\","},{"line_number":44,"context_line":"    \"compute_extension:admin_actions:migrate\": \"rule:admin_api\","},{"line_number":45,"context_line":"    \"compute_extension:aggregates\": \"rule:admin_api\","},{"line_number":46,"context_line":"    \"compute_extension:agents\": \"rule:admin_api\","},{"line_number":47,"context_line":"    \"compute_extension:attach_interfaces\": \"\","},{"line_number":48,"context_line":"    \"compute_extension:baremetal_nodes\": \"rule:admin_api\","}],"source_content_type":"application/json","patch_set":10,"id":"9abe1de1_0b742d9a","line":45,"updated":"2015-04-27 09:57:36.000000000","message":"That\u0027s OK here","commit_id":"16ec81297971fc9579657b81ae6d11ad0b0522a9"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"f8b2dc9662c8649ee6f704f35cf3ce4461750aba","unresolved":false,"context_lines":[{"line_number":59,"context_line":"    \"compute_extension:createserverext\": \"\","},{"line_number":60,"context_line":"    \"compute_extension:deferred_delete\": \"\","},{"line_number":61,"context_line":"    \"compute_extension:disk_config\": \"\","},{"line_number":62,"context_line":"    \"compute_extension:evacuate\": \"rule:admin_api\","},{"line_number":63,"context_line":"    \"compute_extension:extended_server_attributes\": \"rule:admin_api\","},{"line_number":64,"context_line":"    \"compute_extension:extended_status\": \"\","},{"line_number":65,"context_line":"    \"compute_extension:extended_availability_zone\": \"\","}],"source_content_type":"application/json","patch_set":10,"id":"9abe1de1_6b65e9df","line":62,"updated":"2015-04-27 09:57:36.000000000","message":"That\u0027s OK here too","commit_id":"16ec81297971fc9579657b81ae6d11ad0b0522a9"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"f8b2dc9662c8649ee6f704f35cf3ce4461750aba","unresolved":false,"context_lines":[{"line_number":88,"context_line":"    \"compute_extension:fping\": \"\","},{"line_number":89,"context_line":"    \"compute_extension:fping:all_tenants\": \"rule:admin_api\","},{"line_number":90,"context_line":"    \"compute_extension:hide_server_addresses\": \"is_admin:False\","},{"line_number":91,"context_line":"    \"compute_extension:hosts\": \"rule:admin_api\","},{"line_number":92,"context_line":"    \"compute_extension:hypervisors\": \"rule:admin_api\","},{"line_number":93,"context_line":"    \"compute_extension:image_size\": \"\","},{"line_number":94,"context_line":"    \"compute_extension:instance_actions\": \"\","}],"source_content_type":"application/json","patch_set":10,"id":"9abe1de1_eb9fb9b2","line":91,"updated":"2015-04-27 09:57:36.000000000","message":"That\u0027s OK here too (bis)","commit_id":"16ec81297971fc9579657b81ae6d11ad0b0522a9"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"b356b42b07e6ea974cd815b2fddeda7dcdfa97e6","unresolved":false,"context_lines":[{"line_number":203,"context_line":"    \"os_compute_api:os-aggregates:delete\": \"rule:admin_api\","},{"line_number":204,"context_line":"    \"os_compute_api:os-aggregates:add_host\": \"rule:admin_api\","},{"line_number":205,"context_line":"    \"os_compute_api:os-aggregates:remove_host\": \"rule:admin_api\","},{"line_number":206,"context_line":"    \"os_compute_api:os-aggregates:set_metadata\": \"rule:admin_api\","},{"line_number":207,"context_line":"    \"os_compute_api:os-agents\": \"rule:admin_api\","},{"line_number":208,"context_line":"    \"os_compute_api:os-agents:discoverable\": \"\","},{"line_number":209,"context_line":"    \"os_compute_api:os-attach-interfaces\": \"\","}],"source_content_type":"application/json","patch_set":10,"id":"9abe1de1_46557cc4","line":206,"updated":"2015-04-27 10:22:15.000000000","message":"for v2.1 that\u0027s OK too","commit_id":"16ec81297971fc9579657b81ae6d11ad0b0522a9"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"b356b42b07e6ea974cd815b2fddeda7dcdfa97e6","unresolved":false,"context_lines":[{"line_number":237,"context_line":"    \"os_compute_api:os-deferred-delete:discoverable\": \"\","},{"line_number":238,"context_line":"    \"os_compute_api:os-disk-config\": \"\","},{"line_number":239,"context_line":"    \"os_compute_api:os-disk-config:discoverable\": \"\","},{"line_number":240,"context_line":"    \"os_compute_api:os-evacuate\": \"rule:admin_api\","},{"line_number":241,"context_line":"    \"os_compute_api:os-evacuate:discoverable\": \"\","},{"line_number":242,"context_line":"    \"os_compute_api:os-extended-server-attributes\": \"rule:admin_api\","},{"line_number":243,"context_line":"    \"os_compute_api:os-extended-server-attributes:discoverable\": \"\","}],"source_content_type":"application/json","patch_set":10,"id":"9abe1de1_666f6093","line":240,"updated":"2015-04-27 10:22:15.000000000","message":"OK again for v2.1","commit_id":"16ec81297971fc9579657b81ae6d11ad0b0522a9"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"b356b42b07e6ea974cd815b2fddeda7dcdfa97e6","unresolved":false,"context_lines":[{"line_number":278,"context_line":"    \"os_compute_api:os-fping:all_tenants\": \"rule:admin_api\","},{"line_number":279,"context_line":"    \"os_compute_api:os-hide-server-addresses\": \"is_admin:False\","},{"line_number":280,"context_line":"    \"os_compute_api:os-hide-server-addresses:discoverable\": \"\","},{"line_number":281,"context_line":"    \"os_compute_api:os-hosts\": \"rule:admin_api\","},{"line_number":282,"context_line":"    \"os_compute_api:os-hosts:discoverable\": \"\","},{"line_number":283,"context_line":"    \"os_compute_api:os-hypervisors\": \"rule:admin_api\","},{"line_number":284,"context_line":"    \"os_compute_api:os-hypervisors:discoverable\": \"\","}],"source_content_type":"application/json","patch_set":10,"id":"9abe1de1_c60e2ce5","line":281,"updated":"2015-04-27 10:22:15.000000000","message":"and last but not the least, OK finally","commit_id":"16ec81297971fc9579657b81ae6d11ad0b0522a9"}],"nova/api/openstack/compute/contrib/aggregates.py":[{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"22142fed1b2bc16da4dd7ff87506bd6ea54f5945","unresolved":false,"context_lines":[{"line_number":188,"context_line":""},{"line_number":189,"context_line":"        # NOTE(alex_xu): back-compatible with db layer hard-code admin"},{"line_number":190,"context_line":"        # permission checks"},{"line_number":191,"context_line":"        nova_context.require_admin_context(context)"},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"        try:"},{"line_number":194,"context_line":"            aggregate \u003d self.api.add_host_to_aggregate(context, id, host)"}],"source_content_type":"text/x-python","patch_set":11,"id":"3acd31a7_c4958e87","line":191,"updated":"2015-05-04 20:01:53.000000000","message":"Fair enough... Just wonder if we should add more comments saing why it\u0027s needed to be added (and so leaving a bug...)\n\nSomething like :\n\"This has to be left only for API v2.0 because this version has to be stable even if it means that only admins can call this method while the policy could be changed\"","commit_id":"47bf48a94bfde75107dfbb36655d428b3fc813f8"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"59d370fa33dcd2aa81aeaa134908c689be2fd926","unresolved":false,"context_lines":[{"line_number":188,"context_line":""},{"line_number":189,"context_line":"        # NOTE(alex_xu): back-compatible with db layer hard-code admin"},{"line_number":190,"context_line":"        # permission checks"},{"line_number":191,"context_line":"        nova_context.require_admin_context(context)"},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"        try:"},{"line_number":194,"context_line":"            aggregate \u003d self.api.add_host_to_aggregate(context, id, host)"}],"source_content_type":"text/x-python","patch_set":11,"id":"3acd31a7_19ebe779","line":191,"in_reply_to":"3acd31a7_c4958e87","updated":"2015-05-05 00:24:40.000000000","message":"yea, thanks, more explain sounds better. will update soon","commit_id":"47bf48a94bfde75107dfbb36655d428b3fc813f8"}],"nova/api/openstack/compute/contrib/hosts.py":[{"author":{"_account_id":6167,"name":"Ken\u0027ichi Ohmichi","email":"ken1ohmichi@gmail.com","username":"oomichi"},"change_message_id":"8ee3aa35cafe234dc71fb1dec58eac9c7eaced8a","unresolved":false,"context_lines":[{"line_number":138,"context_line":"            raise webob.exc.HTTPBadRequest(explanation\u003dexplanation)"},{"line_number":139,"context_line":"        # NOTE(alex_xu): back-compatible with db layer hard-code admin"},{"line_number":140,"context_line":"        # permission checks"},{"line_number":141,"context_line":"        nova_context.require_admin_context(context)"},{"line_number":142,"context_line":"        # Make the calls and merge the results"},{"line_number":143,"context_line":"        result \u003d {\u0027host\u0027: id}"},{"line_number":144,"context_line":"        if status is not None:"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a80dd14_bd3c7ce2","line":141,"updated":"2015-03-19 22:45:21.000000000","message":"Why we need to check it here?\nWe can check the context at line 122 and if doing that, we can avoid unnecessary operations.","commit_id":"9f71840ad08d10b909f60de194c25757d7ec610e"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"757a6247696c545c5d1d056047e09daed7ab09c0","unresolved":false,"context_lines":[{"line_number":201,"context_line":"        try:"},{"line_number":202,"context_line":"            # NOTE(alex_xu): back-compatible with db layer hard-code admin"},{"line_number":203,"context_line":"            # permission checks"},{"line_number":204,"context_line":"            nova_context.require_admin_context(context)"},{"line_number":205,"context_line":"            result \u003d self.api.host_power_action(context, host_name\u003dhost_name,"},{"line_number":206,"context_line":"                    action\u003daction)"},{"line_number":207,"context_line":"        except NotImplementedError:"}],"source_content_type":"text/x-python","patch_set":10,"id":"dac4157f_27d10b58","line":204,"updated":"2015-04-21 18:08:36.000000000","message":"This should probably not be in this try block, right? Doesn\u0027t look like we catch this exception and handle it or anything...","commit_id":"16ec81297971fc9579657b81ae6d11ad0b0522a9"}],"nova/api/openstack/compute/contrib/hypervisors.py":[{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"712661b2ec9a2dbea7b2627412db555b273b30b7","unresolved":false,"context_lines":[{"line_number":113,"context_line":"        except (ValueError, exception.ComputeHostNotFound):"},{"line_number":114,"context_line":"            msg \u003d _(\"Hypervisor with ID \u0027%s\u0027 could not be found.\") % id"},{"line_number":115,"context_line":"            raise webob.exc.HTTPNotFound(explanation\u003dmsg)"},{"line_number":116,"context_line":"        service \u003d self.host_api.service_get_by_compute_host("},{"line_number":117,"context_line":"            context, hyp.host)"},{"line_number":118,"context_line":"        return dict(hypervisor\u003dself._view_hypervisor(hyp, service, True))"},{"line_number":119,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"5ad58531_bc81edfd","line":116,"updated":"2015-05-11 21:43:04.000000000","message":"Doesn\u0027t this need a:\n\n nova_context.require_admin_context(context)\n\n?","commit_id":"e6c8d624e92dc1c0312e49ba785bd2debd20f254"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"821764d180f9f385d39d38dddf3a8e7857495838","unresolved":false,"context_lines":[{"line_number":113,"context_line":"        except (ValueError, exception.ComputeHostNotFound):"},{"line_number":114,"context_line":"            msg \u003d _(\"Hypervisor with ID \u0027%s\u0027 could not be found.\") % id"},{"line_number":115,"context_line":"            raise webob.exc.HTTPNotFound(explanation\u003dmsg)"},{"line_number":116,"context_line":"        service \u003d self.host_api.service_get_by_compute_host("},{"line_number":117,"context_line":"            context, hyp.host)"},{"line_number":118,"context_line":"        return dict(hypervisor\u003dself._view_hypervisor(hyp, service, True))"},{"line_number":119,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"9a0c5dc1_191da973","line":116,"in_reply_to":"5ad58531_bc81edfd","updated":"2015-05-12 11:15:01.000000000","message":"It needn\u0027t. Because this method allow policy configurable before. With elevated context, the db call always success before.","commit_id":"e6c8d624e92dc1c0312e49ba785bd2debd20f254"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"aeb632e10882d621f43ab3029ebcf408a6329f1e","unresolved":false,"context_lines":[{"line_number":113,"context_line":"        except (ValueError, exception.ComputeHostNotFound):"},{"line_number":114,"context_line":"            msg \u003d _(\"Hypervisor with ID \u0027%s\u0027 could not be found.\") % id"},{"line_number":115,"context_line":"            raise webob.exc.HTTPNotFound(explanation\u003dmsg)"},{"line_number":116,"context_line":"        service \u003d self.host_api.service_get_by_compute_host("},{"line_number":117,"context_line":"            context, hyp.host)"},{"line_number":118,"context_line":"        return dict(hypervisor\u003dself._view_hypervisor(hyp, service, True))"},{"line_number":119,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"7a016987_4f4c6c76","line":116,"in_reply_to":"7a016987_34998720","updated":"2015-05-26 13:59:14.000000000","message":"This comment in bug 1447084 explains the regression and the short term fix for kilo:\n\nhttps://bugs.launchpad.net/nova/+bug/1447084/comments/5\n\nBasically, we regressed the API in kilo - hypervisor:show was configurable before the regression which added a DB API call that required an admin context.  To fix that for kilo, we elevated the context and backported that to stable/kilo.  This change removes that elevated context workaround (we should have had a TODO in the short term fix wokaround code to make it clear we would remove it later in this change) so that access is still controlled via the policy file since the require_admin_context() checks are gone from the DB API for this call.","commit_id":"e6c8d624e92dc1c0312e49ba785bd2debd20f254"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"1f14b96e1bfbb2f4bfce0c64c8849fb970df43b2","unresolved":false,"context_lines":[{"line_number":113,"context_line":"        except (ValueError, exception.ComputeHostNotFound):"},{"line_number":114,"context_line":"            msg \u003d _(\"Hypervisor with ID \u0027%s\u0027 could not be found.\") % id"},{"line_number":115,"context_line":"            raise webob.exc.HTTPNotFound(explanation\u003dmsg)"},{"line_number":116,"context_line":"        service \u003d self.host_api.service_get_by_compute_host("},{"line_number":117,"context_line":"            context, hyp.host)"},{"line_number":118,"context_line":"        return dict(hypervisor\u003dself._view_hypervisor(hyp, service, True))"},{"line_number":119,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"7a016987_862a062b","line":116,"in_reply_to":"7a016987_356ffe93","updated":"2015-05-17 13:18:18.000000000","message":"yes, because the hardcoding context.elevated(), so there isn\u0027t anything can stop the request :)","commit_id":"e6c8d624e92dc1c0312e49ba785bd2debd20f254"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"65f7ea8f146cda962d2f21939fb4cd2bb82ca600","unresolved":false,"context_lines":[{"line_number":113,"context_line":"        except (ValueError, exception.ComputeHostNotFound):"},{"line_number":114,"context_line":"            msg \u003d _(\"Hypervisor with ID \u0027%s\u0027 could not be found.\") % id"},{"line_number":115,"context_line":"            raise webob.exc.HTTPNotFound(explanation\u003dmsg)"},{"line_number":116,"context_line":"        service \u003d self.host_api.service_get_by_compute_host("},{"line_number":117,"context_line":"            context, hyp.host)"},{"line_number":118,"context_line":"        return dict(hypervisor\u003dself._view_hypervisor(hyp, service, True))"},{"line_number":119,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"7a016987_8a25afaf","line":116,"in_reply_to":"7a016987_4f4c6c76","updated":"2015-05-26 15:17:40.000000000","message":"Sylvain, Matt, thanks for the explain!","commit_id":"e6c8d624e92dc1c0312e49ba785bd2debd20f254"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"6be9507bc147854931101a75a48ea2ebd1b77773","unresolved":false,"context_lines":[{"line_number":113,"context_line":"        except (ValueError, exception.ComputeHostNotFound):"},{"line_number":114,"context_line":"            msg \u003d _(\"Hypervisor with ID \u0027%s\u0027 could not be found.\") % id"},{"line_number":115,"context_line":"            raise webob.exc.HTTPNotFound(explanation\u003dmsg)"},{"line_number":116,"context_line":"        service \u003d self.host_api.service_get_by_compute_host("},{"line_number":117,"context_line":"            context, hyp.host)"},{"line_number":118,"context_line":"        return dict(hypervisor\u003dself._view_hypervisor(hyp, service, True))"},{"line_number":119,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"7a016987_e5e63014","line":116,"in_reply_to":"7a016987_862a062b","updated":"2015-05-19 07:59:37.000000000","message":"Jay, the issue was that the RBAC policy was just hijacked by the context.require_admin_context() stuff in the DB and later on, in the API.\n\nLong story short, you\u0027re an operator that knows what you do and change the policy to leave that API method to be accessible for any user, it still doesn\u0027t work because of that Keystone admin context which is hard-checked.","commit_id":"e6c8d624e92dc1c0312e49ba785bd2debd20f254"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"0acf311b4662e5990c1133d3b82f927cccf05cbe","unresolved":false,"context_lines":[{"line_number":113,"context_line":"        except (ValueError, exception.ComputeHostNotFound):"},{"line_number":114,"context_line":"            msg \u003d _(\"Hypervisor with ID \u0027%s\u0027 could not be found.\") % id"},{"line_number":115,"context_line":"            raise webob.exc.HTTPNotFound(explanation\u003dmsg)"},{"line_number":116,"context_line":"        service \u003d self.host_api.service_get_by_compute_host("},{"line_number":117,"context_line":"            context, hyp.host)"},{"line_number":118,"context_line":"        return dict(hypervisor\u003dself._view_hypervisor(hyp, service, True))"},{"line_number":119,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"7a016987_34998720","line":116,"in_reply_to":"7a016987_e5e63014","updated":"2015-05-26 13:52:29.000000000","message":"There is also some context here:\n\nhttps://review.openstack.org/#/c/176651/\n\n^ was a last minute short term tactical fix for kilo rc b/c of a regression in kilo - as part of that change we said we\u0027d undo it here in this change (because we didn\u0027t want to backport this entire change to stable/kilo).","commit_id":"e6c8d624e92dc1c0312e49ba785bd2debd20f254"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"fb97ebbb3c45fbce7cfa4d1cd0c9759e271493d8","unresolved":false,"context_lines":[{"line_number":113,"context_line":"        except (ValueError, exception.ComputeHostNotFound):"},{"line_number":114,"context_line":"            msg \u003d _(\"Hypervisor with ID \u0027%s\u0027 could not be found.\") % id"},{"line_number":115,"context_line":"            raise webob.exc.HTTPNotFound(explanation\u003dmsg)"},{"line_number":116,"context_line":"        service \u003d self.host_api.service_get_by_compute_host("},{"line_number":117,"context_line":"            context, hyp.host)"},{"line_number":118,"context_line":"        return dict(hypervisor\u003dself._view_hypervisor(hyp, service, True))"},{"line_number":119,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"7a016987_356ffe93","line":116,"in_reply_to":"9a0c5dc1_191da973","updated":"2015-05-16 23:45:54.000000000","message":"How did this API extension allow policy configuration before? It was hardcoding the context.elevated() call below.","commit_id":"e6c8d624e92dc1c0312e49ba785bd2debd20f254"}],"nova/api/openstack/compute/plugins/v3/hypervisors.py":[{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"712661b2ec9a2dbea7b2627412db555b273b30b7","unresolved":false,"context_lines":[{"line_number":110,"context_line":"            msg \u003d _(\"Hypervisor with ID \u0027%s\u0027 could not be found.\") % id"},{"line_number":111,"context_line":"            raise webob.exc.HTTPNotFound(explanation\u003dmsg)"},{"line_number":112,"context_line":"        service \u003d self.host_api.service_get_by_compute_host("},{"line_number":113,"context_line":"            context, hyp.host)"},{"line_number":114,"context_line":"        return dict(hypervisor\u003dself._view_hypervisor(hyp, service, True))"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"    @extensions.expected_errors((404, 501))"}],"source_content_type":"text/x-python","patch_set":13,"id":"5ad58531_7c7ca520","line":113,"updated":"2015-05-11 21:43:04.000000000","message":"Doesn\u0027t this need a:\n\n nova_context.require_admin_context(context)\n\n?","commit_id":"e6c8d624e92dc1c0312e49ba785bd2debd20f254"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"821764d180f9f385d39d38dddf3a8e7857495838","unresolved":false,"context_lines":[{"line_number":110,"context_line":"            msg \u003d _(\"Hypervisor with ID \u0027%s\u0027 could not be found.\") % id"},{"line_number":111,"context_line":"            raise webob.exc.HTTPNotFound(explanation\u003dmsg)"},{"line_number":112,"context_line":"        service \u003d self.host_api.service_get_by_compute_host("},{"line_number":113,"context_line":"            context, hyp.host)"},{"line_number":114,"context_line":"        return dict(hypervisor\u003dself._view_hypervisor(hyp, service, True))"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"    @extensions.expected_errors((404, 501))"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a0c5dc1_fc08832a","line":113,"in_reply_to":"5ad58531_7c7ca520","updated":"2015-05-12 11:15:01.000000000","message":"We want to make the API permission is configured by policy rule for v2.1 API. So we needn\u0027t that hard-code permission checks at here.","commit_id":"e6c8d624e92dc1c0312e49ba785bd2debd20f254"}],"nova/db/sqlalchemy/api.py":[{"author":{"_account_id":9459,"name":".Haifeng Yan","email":"yanheven@qq.com","username":"yan"},"change_message_id":"6e53cc2ed2683d8ab464be44a3a2ae511cf0c180","unresolved":false,"context_lines":[{"line_number":499,"context_line":"                all()"},{"line_number":500,"context_line":""},{"line_number":501,"context_line":""},{"line_number":502,"context_line":"@require_admin_context"},{"line_number":503,"context_line":"def service_get_by_compute_host(context, host, use_slave\u003dFalse):"},{"line_number":504,"context_line":"    result \u003d model_query(context, models.Service, read_deleted\u003d\"no\","},{"line_number":505,"context_line":"                         use_slave\u003duse_slave).\\"}],"source_content_type":"text/x-python","patch_set":13,"id":"7a016987_9b6f03c5","side":"PARENT","line":502,"updated":"2015-05-17 06:05:06.000000000","message":"how about modify it to @require_context","commit_id":"2a5b1db132a9ae6c0b37f8e1854d7e23991720a4"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"1f14b96e1bfbb2f4bfce0c64c8849fb970df43b2","unresolved":false,"context_lines":[{"line_number":499,"context_line":"                all()"},{"line_number":500,"context_line":""},{"line_number":501,"context_line":""},{"line_number":502,"context_line":"@require_admin_context"},{"line_number":503,"context_line":"def service_get_by_compute_host(context, host, use_slave\u003dFalse):"},{"line_number":504,"context_line":"    result \u003d model_query(context, models.Service, read_deleted\u003d\"no\","},{"line_number":505,"context_line":"                         use_slave\u003duse_slave).\\"}],"source_content_type":"text/x-python","patch_set":13,"id":"7a016987_86e1e600","side":"PARENT","line":502,"in_reply_to":"7a016987_9b6f03c5","updated":"2015-05-17 13:18:18.000000000","message":"I think it\u0027s fine, \u0027require_context\u0027 is used by db call which filter result based on user or admin. This db call won\u0027t filter anything.","commit_id":"2a5b1db132a9ae6c0b37f8e1854d7e23991720a4"}]}