)]}'
{"id":"openstack%2Fnova~3021","triplet_id":"openstack%2Fnova~master~Ib93d854ee1a7f22f4e7f313a9d50300df8b8596b","project":"openstack/nova","branch":"master","topic":"bp/interim-nova-authz-service","hashtags":[],"change_id":"Ib93d854ee1a7f22f4e7f313a9d50300df8b8596b","subject":"Add policy checking to nova.network.api.API","status":"MERGED","created":"2012-01-13 00:15:52.000000000","updated":"2012-01-17 17:17:04.000000000","submitted":"2012-01-17 17:13:50.000000000","submitter":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"total_comment_count":5,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"5ca9b8656fc3a3c64117055121328aba155c9f15","_number":3021,"virtual_id_number":3021,"owner":{"_account_id":1132,"name":"Brian Waldon","email":"brian@waldon.cc","username":"bcwaldon"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"all":[{"value":0,"_account_id":34,"name":"Todd Willey","email":"todd@ansolabs.com","username":"xtoddx"},{"value":0,"_account_id":67,"name":"Vish Ishaya","email":"vishvananda@gmail.com","username":"vishvananda"},{"value":1,"date":"2012-01-17 17:13:50.000000000","_account_id":3,"name":"Jenkins","username":"jenkins"},{"value":0,"_account_id":679,"name":"Kevin L. Mitchell","email":"klmitch@mit.edu","username":"klmitch"},{"value":0,"_account_id":1132,"name":"Brian Waldon","email":"brian@waldon.cc","username":"bcwaldon"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":67,"name":"Vish Ishaya","email":"vishvananda@gmail.com","username":"vishvananda"},"all":[{"value":0,"_account_id":34,"name":"Todd Willey","email":"todd@ansolabs.com","username":"xtoddx"},{"value":2,"date":"2012-01-17 00:24:59.000000000","_account_id":67,"name":"Vish Ishaya","email":"vishvananda@gmail.com","username":"vishvananda"},{"value":0,"date":"2012-01-17 17:13:50.000000000","permitted_voting_range":{"min":0,"max":1},"_account_id":3,"name":"Jenkins","username":"jenkins"},{"value":2,"date":"2012-01-17 16:43:42.000000000","_account_id":679,"name":"Kevin L. Mitchell","email":"klmitch@mit.edu","username":"klmitch"},{"value":0,"_account_id":1132,"name":"Brian Waldon","email":"brian@waldon.cc","username":"bcwaldon"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":679,"name":"Kevin L. Mitchell","email":"klmitch@mit.edu","username":"klmitch"},"all":[{"value":0,"_account_id":34,"name":"Todd Willey","email":"todd@ansolabs.com","username":"xtoddx"},{"value":0,"date":"2012-01-17 00:24:59.000000000","_account_id":67,"name":"Vish Ishaya","email":"vishvananda@gmail.com","username":"vishvananda"},{"value":0,"_account_id":3,"name":"Jenkins","username":"jenkins"},{"value":1,"date":"2012-01-17 16:43:42.000000000","_account_id":679,"name":"Kevin L. Mitchell","email":"klmitch@mit.edu","username":"klmitch"},{"value":0,"_account_id":1132,"name":"Brian Waldon","email":"brian@waldon.cc","username":"bcwaldon"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Review-Priority":{"all":[{"value":0,"_account_id":34,"name":"Todd Willey","email":"todd@ansolabs.com","username":"xtoddx"},{"value":0,"_account_id":67,"name":"Vish Ishaya","email":"vishvananda@gmail.com","username":"vishvananda"},{"value":0,"_account_id":3,"name":"Jenkins","username":"jenkins"},{"value":0,"_account_id":679,"name":"Kevin L. Mitchell","email":"klmitch@mit.edu","username":"klmitch"},{"value":0,"_account_id":1132,"name":"Brian Waldon","email":"brian@waldon.cc","username":"bcwaldon"}],"values":{" 0":"Default Priority","+1":"Contributor Review Promise","+2":"Core Review Promise"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":3,"name":"Jenkins","username":"jenkins"},{"_account_id":34,"name":"Todd Willey","email":"todd@ansolabs.com","username":"xtoddx"},{"_account_id":67,"name":"Vish Ishaya","email":"vishvananda@gmail.com","username":"vishvananda"},{"_account_id":679,"name":"Kevin L. Mitchell","email":"klmitch@mit.edu","username":"klmitch"},{"_account_id":1132,"name":"Brian Waldon","email":"brian@waldon.cc","username":"bcwaldon"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2012-01-13 14:39:35.000000000","updated_by":{"_account_id":34,"name":"Todd Willey","email":"todd@ansolabs.com","username":"xtoddx"},"reviewer":{"_account_id":34,"name":"Todd Willey","email":"todd@ansolabs.com","username":"xtoddx"},"state":"REVIEWER"},{"updated":"2012-01-17 00:24:59.000000000","updated_by":{"_account_id":67,"name":"Vish Ishaya","email":"vishvananda@gmail.com","username":"vishvananda"},"reviewer":{"_account_id":67,"name":"Vish Ishaya","email":"vishvananda@gmail.com","username":"vishvananda"},"state":"REVIEWER"},{"updated":"2012-01-17 16:43:42.000000000","updated_by":{"_account_id":679,"name":"Kevin L. Mitchell","email":"klmitch@mit.edu","username":"klmitch"},"reviewer":{"_account_id":679,"name":"Kevin L. Mitchell","email":"klmitch@mit.edu","username":"klmitch"},"state":"REVIEWER"},{"updated":"2012-01-17 17:13:50.000000000","updated_by":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"reviewer":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"state":"REVIEWER"}],"messages":[{"id":"ce78e9143b0c3e35859abeeb74533378c4cf7949","author":{"_account_id":1132,"name":"Brian Waldon","email":"brian@waldon.cc","username":"bcwaldon"},"date":"2012-01-13 00:18:12.000000000","message":"Patch Set 1:\n\nDefault rules are empty for now since we dont have any good roles to validate against and we don\u0027t have volume objects so we cant check ownership","accounts_in_message":[],"_revision_number":1},{"id":"ee9a77071085ffb5999e62c675c38432948f947d","author":{"_account_id":1132,"name":"Brian Waldon","email":"brian@waldon.cc","username":"bcwaldon"},"date":"2012-01-13 00:18:22.000000000","message":"Patch Set 1:\n\ns/volume/network/","accounts_in_message":[],"_revision_number":1},{"id":"41f2f0a868a5a0347263aa79528b0ce20678f238","author":{"_account_id":1132,"name":"Brian Waldon","email":"brian@waldon.cc","username":"bcwaldon"},"date":"2012-01-13 00:58:26.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"33247f643a35b31eb930e7576fc3bd3fbe205f0c","author":{"_account_id":34,"name":"Todd Willey","email":"todd@ansolabs.com","username":"xtoddx"},"date":"2012-01-13 14:39:35.000000000","message":"Patch Set 2: (3 inline comments)\n\nA few comments inline.\n\nI\u0027d like to at least get back to having a netadmin role that we check for actions that create or delete network resources, like we did back in the good old days.  I know I can do this by tuning the json, but I\u0027d like to have a default that does *something*.\n\nAre there places where calling enforce with a target of the return value of an rpc.call makes sense?  Is it possible to add enforce checks in the manager and bubble the exception (if it raises one) back through the queue?\n\nWe need some way to enforce ownership of IPs that are attempted to be associated, unassociated, etc.  Ideally we would check for ownership AND the netadmin role, like we did in Bexar.","accounts_in_message":[],"_revision_number":2},{"id":"e944d46444ed3c7ff0a91012e3b2a0784d1f3c34","author":{"_account_id":67,"name":"Vish Ishaya","email":"vishvananda@gmail.com","username":"vishvananda"},"date":"2012-01-13 15:28:22.000000000","message":"Patch Set 2:\n\nTodd: The default of noauth means that we can\u0027t depend on extra roles existing.  I think it makes sense for the default to stay at admin-or-owner.  \n\nThere might be some value in defining a couple more default rules that resolve to admin-or-owner:\nrule:compute-default -\u003e rule:admin-or-owner\nrule:network-default -\u003e rule:admin-or-owner\nrule:volume-default -rule:admin-or-owner\n\nI was also discussing with brian about where the checking should go, and I think it might be more valuable in the network case to put it in the manager classes.  We are planning on loading all of the objects at the api layer, checking, and then passing them through the queue, but I\u0027m not sure that makes sense for network as it will break quantum manager.","accounts_in_message":[],"_revision_number":2},{"id":"a66584be225dfcbe59036b55d49b9b0ecca86005","author":{"_account_id":1132,"name":"Brian Waldon","email":"brian@waldon.cc","username":"bcwaldon"},"date":"2012-01-16 21:34:15.000000000","message":"Uploaded patch set 3.","accounts_in_message":[],"_revision_number":3},{"id":"0a82e52145925f1e04a1f59e7e58acc2f50d6dd9","author":{"_account_id":1132,"name":"Brian Waldon","email":"brian@waldon.cc","username":"bcwaldon"},"date":"2012-01-16 21:34:38.000000000","message":"Patch Set 3:\n\nOk, I pushed all the checks down to the NetworkManager. Review away!","accounts_in_message":[],"_revision_number":3},{"id":"3f0d187803c098fa3434dce62307a0389c64e7b8","author":{"_account_id":679,"name":"Kevin L. Mitchell","email":"klmitch@mit.edu","username":"klmitch"},"date":"2012-01-16 21:43:05.000000000","message":"Patch Set 3: (1 inline comment)\n\nYou have some trailing whitespace on nova/tests/policy.json; other than that, this looks good.","accounts_in_message":[],"_revision_number":3},{"id":"de29cd9388a9acf665c1dd1fca6baad9a5fe9af2","author":{"_account_id":1132,"name":"Brian Waldon","email":"brian@waldon.cc","username":"bcwaldon"},"date":"2012-01-17 00:21:21.000000000","message":"Uploaded patch set 4.","accounts_in_message":[],"_revision_number":4},{"id":"73b1d76cd47dde67a30314ccd88aa6386f86dd46","author":{"_account_id":1132,"name":"Brian Waldon","email":"brian@waldon.cc","username":"bcwaldon"},"date":"2012-01-17 00:21:46.000000000","message":"Patch Set 3: (1 inline comment)\n\n","accounts_in_message":[],"_revision_number":3},{"id":"12aa56840672e9aa9e03c597d23cc8a464c58d2c","author":{"_account_id":67,"name":"Vish Ishaya","email":"vishvananda@gmail.com","username":"vishvananda"},"date":"2012-01-17 00:24:59.000000000","message":"Patch Set 4: Looks good to me (core reviewer)\n\nSo this really needs to be loading the network objects and passing them in to the enforce call.  Unfortunately that is going to be a more extensive set of changes, so I\u0027m ok with it going in like this for now.","accounts_in_message":[],"_revision_number":4},{"id":"d412a581d3ef965eefd684a9cb1a50fccdb5f26b","author":{"_account_id":679,"name":"Kevin L. Mitchell","email":"klmitch@mit.edu","username":"klmitch"},"date":"2012-01-17 16:43:42.000000000","message":"Patch Set 4: Looks good to me (core reviewer); Approved\n\n","accounts_in_message":[],"_revision_number":4},{"id":"0d146dd6dd092b8a3a43ddfe3ccaf51c7804b66c","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2012-01-17 17:13:50.000000000","message":"Patch Set 4: Verified\n\nBuild Successful \n \nhttps://jenkins.openstack.org/job/gate-integration-tests-devstack-vm/544/ : SUCCESS \nhttps://jenkins.openstack.org/job/gate-nova-merge/936/ : SUCCESS \nhttps://jenkins.openstack.org/job/gate-nova-unittests/549/ : SUCCESS \nhttps://jenkins.openstack.org/job/gate-nova-pep8/2312/ : SUCCESS","accounts_in_message":[],"_revision_number":4},{"id":"531f73c865f1f4dae185955a2dc205f688ee7a99","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2012-01-17 17:13:51.000000000","message":"Change has been successfully merged into the git repository.","accounts_in_message":[],"_revision_number":4},{"id":"ab8c29dfa30adcd6bb148d6bcf18a9f7d2911185","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2012-01-17 17:17:04.000000000","message":"Patch Set 4:\n\nBuild Successful \n \nhttps://jenkins.openstack.org/job/nova-tarball/1674/ : SUCCESS","accounts_in_message":[],"_revision_number":4}],"current_revision_number":4,"current_revision":"480875d49c722a2310b52c3bd4b2241598df86c8","revisions":{"79d050a2a4e09eaa542747f48eaac8c137c71fce":{"kind":"REWORK","_number":1,"created":"2012-01-13 00:15:52.000000000","uploader":{"_account_id":1132,"name":"Brian Waldon","email":"brian@waldon.cc","username":"bcwaldon"},"ref":"refs/changes/21/3021/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/nova","ref":"refs/changes/21/3021/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/nova refs/changes/21/3021/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/nova refs/changes/21/3021/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/nova refs/changes/21/3021/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/nova refs/changes/21/3021/1"}}},"commit":{"parents":[{"commit":"6f2bf0994aabb110325491b8e6d6e929fb83c37f","subject":"Merge \"Adds test for local.py\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/nova/commit/6f2bf0994aabb110325491b8e6d6e929fb83c37f"}]}],"author":{"name":"Brian Waldon","email":"bcwaldon@gmail.com","date":"2012-01-12 23:52:11.000000000","tz":-480},"committer":{"name":"Brian Waldon","email":"bcwaldon@gmail.com","date":"2012-01-13 00:15:36.000000000","tz":-480},"subject":"Add policy checking to nova.network.api.API","message":"Add policy checking to nova.network.api.API\n\nPartially implements bp interim-nova-authz-service\n\nChange-Id: Ib93d854ee1a7f22f4e7f313a9d50300df8b8596b\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/nova/commit/79d050a2a4e09eaa542747f48eaac8c137c71fce"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/nova/commit/79d050a2a4e09eaa542747f48eaac8c137c71fce"}]},"branch":"refs/heads/master"},"ac487d88f34463bd02cf7351527877b04760aabb":{"kind":"REWORK","_number":2,"created":"2012-01-13 00:58:26.000000000","uploader":{"_account_id":1132,"name":"Brian Waldon","email":"brian@waldon.cc","username":"bcwaldon"},"ref":"refs/changes/21/3021/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/nova","ref":"refs/changes/21/3021/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/nova refs/changes/21/3021/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/nova refs/changes/21/3021/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/nova refs/changes/21/3021/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/nova refs/changes/21/3021/2"}}},"commit":{"parents":[{"commit":"6f2bf0994aabb110325491b8e6d6e929fb83c37f","subject":"Merge \"Adds test for local.py\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/nova/commit/6f2bf0994aabb110325491b8e6d6e929fb83c37f"}]}],"author":{"name":"Brian Waldon","email":"bcwaldon@gmail.com","date":"2012-01-12 23:52:11.000000000","tz":-480},"committer":{"name":"Brian Waldon","email":"bcwaldon@gmail.com","date":"2012-01-13 00:58:05.000000000","tz":-480},"subject":"Add policy checking to nova.network.api.API","message":"Add policy checking to nova.network.api.API\n\nPartially implements bp interim-nova-authz-service\n\nChange-Id: Ib93d854ee1a7f22f4e7f313a9d50300df8b8596b\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/nova/commit/ac487d88f34463bd02cf7351527877b04760aabb"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/nova/commit/ac487d88f34463bd02cf7351527877b04760aabb"}]},"branch":"refs/heads/master"},"5096d5511ff7b8f8b7b0ad8a7f8c56137a8219b2":{"kind":"REWORK","_number":3,"created":"2012-01-16 21:34:15.000000000","uploader":{"_account_id":1132,"name":"Brian Waldon","email":"brian@waldon.cc","username":"bcwaldon"},"ref":"refs/changes/21/3021/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/nova","ref":"refs/changes/21/3021/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/nova refs/changes/21/3021/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/nova refs/changes/21/3021/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/nova refs/changes/21/3021/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/nova refs/changes/21/3021/3"}}},"commit":{"parents":[{"commit":"fa3fa39187f2663dca36cb8d27b3815691a18a27","subject":"Merge \"Take the availability zone from the instance if available\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/nova/commit/fa3fa39187f2663dca36cb8d27b3815691a18a27"}]}],"author":{"name":"Brian Waldon","email":"bcwaldon@gmail.com","date":"2012-01-12 23:52:11.000000000","tz":-480},"committer":{"name":"Brian Waldon","email":"bcwaldon@gmail.com","date":"2012-01-16 21:34:10.000000000","tz":-480},"subject":"Add policy checking to nova.network.api.API","message":"Add policy checking to nova.network.api.API\n\nPartially implements bp interim-nova-authz-service\n\nChange-Id: Ib93d854ee1a7f22f4e7f313a9d50300df8b8596b\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/nova/commit/5096d5511ff7b8f8b7b0ad8a7f8c56137a8219b2"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/nova/commit/5096d5511ff7b8f8b7b0ad8a7f8c56137a8219b2"}]},"branch":"refs/heads/master"},"480875d49c722a2310b52c3bd4b2241598df86c8":{"kind":"REWORK","_number":4,"created":"2012-01-17 00:21:21.000000000","uploader":{"_account_id":1132,"name":"Brian Waldon","email":"brian@waldon.cc","username":"bcwaldon"},"ref":"refs/changes/21/3021/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/nova","ref":"refs/changes/21/3021/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/nova refs/changes/21/3021/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/nova refs/changes/21/3021/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/nova refs/changes/21/3021/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/nova refs/changes/21/3021/4"}}},"commit":{"parents":[{"commit":"1fd26203b29d6432325ae1365e3dcbecc9d97864","subject":"Merge \"Update some extensions (1)\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/nova/commit/1fd26203b29d6432325ae1365e3dcbecc9d97864"}]}],"author":{"name":"Brian Waldon","email":"bcwaldon@gmail.com","date":"2012-01-12 23:52:11.000000000","tz":-480},"committer":{"name":"Brian Waldon","email":"bcwaldon@gmail.com","date":"2012-01-17 00:21:15.000000000","tz":-480},"subject":"Add policy checking to nova.network.api.API","message":"Add policy checking to nova.network.api.API\n\nPartially implements bp interim-nova-authz-service\n\nChange-Id: Ib93d854ee1a7f22f4e7f313a9d50300df8b8596b\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/nova/commit/480875d49c722a2310b52c3bd4b2241598df86c8"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/nova/commit/480875d49c722a2310b52c3bd4b2241598df86c8"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[]}