)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b5330a2ad20b7fe5b547c42d168d4360b449c7e0","unresolved":false,"context_lines":[{"line_number":7,"context_line":"WIP: General policy sample file for placement"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This starts some bare bones work to generate a policy"},{"line_number":10,"context_line":"sample for placement. The placement policy code needs"},{"line_number":11,"context_line":"to change to actually read from the file so deployers"},{"line_number":12,"context_line":"can configure custom policy rules."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: I17573f5210314341c332fdcb1ce462a989c21940"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"df87a7cf_1d668b2b","line":12,"range":{"start_line":10,"start_character":22,"end_line":12,"end_character":34},"updated":"2017-12-10 04:32:51.000000000","message":"We have some new tooling [0] available in oslo.policy that should hopefully make policy for placement simple from the get-go.\n\nI\u0027d be happy to help here if needed.\n\n[0] https://review.openstack.org/#/c/510222/","commit_id":"529205af09a2de22036e508ad979929f8dfc22a1"}],"doc/source/index.rst":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"463b91c895b96fc93fa120c35a3d2a81dd538657","unresolved":false,"context_lines":[{"line_number":181,"context_line":"* :doc:`Nova CLI Command References \u003c/cli/index\u003e`: the complete command reference"},{"line_number":182,"context_line":"  for all the daemons and admin tools that come with nova."},{"line_number":183,"context_line":""},{"line_number":184,"context_line":".. toctree::"},{"line_number":185,"context_line":"   :maxdepth: 2"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"   configuration/index"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"For Contributors"},{"line_number":190,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9f6a8fd7_45b4e9f2","line":187,"range":{"start_line":184,"start_character":0,"end_line":187,"end_character":22},"updated":"2018-04-26 21:57:42.000000000","message":"TODO: split this refactor out into a separate change","commit_id":"ff7b0cea791435ef0ae19b328be2bc51c13d87f8"}],"etc/nova/placement-policy-generator.conf":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e7510b0eac12149f4efea03775b4a539c094f7e2","unresolved":false,"context_lines":[{"line_number":1,"context_line":"[DEFAULT]"},{"line_number":2,"context_line":"output_file \u003d etc/nova/placement-policy.yaml.sample"},{"line_number":3,"context_line":"namespace \u003d placement"}],"source_content_type":"text/plain","patch_set":1,"id":"ff82abbf_ca656547","line":2,"range":{"start_line":2,"start_character":18,"end_line":2,"end_character":22},"updated":"2017-11-30 23:11:47.000000000","message":"Should this be \"placement\"?","commit_id":"529205af09a2de22036e508ad979929f8dfc22a1"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"4cd071a55cb4b94b50cee4c46abd0f5feb3cc0e9","unresolved":false,"context_lines":[{"line_number":1,"context_line":"[DEFAULT]"},{"line_number":2,"context_line":"output_file \u003d etc/nova/placement-policy.yaml.sample"},{"line_number":3,"context_line":"namespace \u003d placement"}],"source_content_type":"text/plain","patch_set":1,"id":"df7087c5_54032143","line":2,"range":{"start_line":2,"start_character":18,"end_line":2,"end_character":22},"in_reply_to":"df87a7cf_139829be","updated":"2018-03-08 12:30:41.000000000","message":"Yeah, agree with mgagne on this (for now). This can/should change with the final split-out of placement from nova.","commit_id":"529205af09a2de22036e508ad979929f8dfc22a1"},{"author":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"change_message_id":"d3b29f8b2ea5459f77855cf6e3ce695d9130c011","unresolved":false,"context_lines":[{"line_number":1,"context_line":"[DEFAULT]"},{"line_number":2,"context_line":"output_file \u003d etc/nova/placement-policy.yaml.sample"},{"line_number":3,"context_line":"namespace \u003d placement"}],"source_content_type":"text/plain","patch_set":1,"id":"df87a7cf_139829be","line":2,"range":{"start_line":2,"start_character":18,"end_line":2,"end_character":22},"in_reply_to":"ff82abbf_ca656547","updated":"2017-12-05 19:14:11.000000000","message":"Can placement be 100% split from Nova code? I don\u0027t think so (yet). When packaging, it\u0027s gonna end up in Nova packages anyway. Furthermore, WSGI script is still called nova-placement-api. So to keep it consistent, I think it should still go in /etc/nova.","commit_id":"529205af09a2de22036e508ad979929f8dfc22a1"}],"nova/api/openstack/placement/context.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"27805def2626160e71f1c1f82aa941a6a5684253","unresolved":false,"context_lines":[{"line_number":20,"context_line":"@enginefacade.transaction_context_provider"},{"line_number":21,"context_line":"class RequestContext(context.RequestContext):"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"    def can(self, action, target\u003dNone, fatal\u003dTrue):"},{"line_number":24,"context_line":"        \"\"\"Verifies that the given action is valid on the target in this"},{"line_number":25,"context_line":"        context."},{"line_number":26,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_4ab6368d","line":23,"updated":"2018-04-26 21:26:14.000000000","message":"This is identical to the implementation in nova/context.py . I think the only difference is the fact that you\u0027re evaluating with nova.api.openstack.placement.policy instead of nova.policy.\n\nWhat if we made nova\u0027s context object smart enough to handle different policy enforcers? That might cut down on duplicate code.","commit_id":"ff7b0cea791435ef0ae19b328be2bc51c13d87f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f5731094851bc08d74ab05757eafa950d6b7d4ec","unresolved":false,"context_lines":[{"line_number":20,"context_line":"@enginefacade.transaction_context_provider"},{"line_number":21,"context_line":"class RequestContext(context.RequestContext):"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"    def can(self, action, target\u003dNone, fatal\u003dTrue):"},{"line_number":24,"context_line":"        \"\"\"Verifies that the given action is valid on the target in this"},{"line_number":25,"context_line":"        context."},{"line_number":26,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_65256dab","line":23,"in_reply_to":"9f6a8fd7_4ab6368d","updated":"2018-04-26 21:33:45.000000000","message":"Oh Lance...you just stepped into the great Placement schism of 2018.\n\nWe\u0027re intentionally trying to decouple nova-specific dependencies from the placement subtree in order to ease the eventual split. So DRY isn\u0027t a concern.","commit_id":"ff7b0cea791435ef0ae19b328be2bc51c13d87f8"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e94af750749b95a9944f5cd39b17fc89a124152a","unresolved":false,"context_lines":[{"line_number":36,"context_line":"                {\u0027project_id\u0027: self.project_id, \u0027user_id\u0027: self.user_id}"},{"line_number":37,"context_line":"        :param fatal: if False, will return False when an"},{"line_number":38,"context_line":"            exception.PolicyNotAuthorized occurs."},{"line_number":39,"context_line":"        :raises nova.exception.PolicyNotAuthorized: if verification fails and"},{"line_number":40,"context_line":"            fatal is True."},{"line_number":41,"context_line":"        :return: returns a non-False value (not necessarily \"True\") if"},{"line_number":42,"context_line":"            authorized and False if not authorized and fatal is False."}],"source_content_type":"text/x-python","patch_set":16,"id":"5f7c97a3_e3ea83d6","line":39,"range":{"start_line":39,"start_character":16,"end_line":39,"end_character":50},"updated":"2018-05-22 16:06:21.000000000","message":"nit: this looks like a different exception from what is being handled by the try/except?","commit_id":"0a461979df62cd1df2c807b3f4fb3593b3040d13"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"28c2d485da9b14cc1260eea7a908e00fafd867c4","unresolved":false,"context_lines":[{"line_number":36,"context_line":"                {\u0027project_id\u0027: self.project_id, \u0027user_id\u0027: self.user_id}"},{"line_number":37,"context_line":"        :param fatal: if False, will return False when an"},{"line_number":38,"context_line":"            exception.PolicyNotAuthorized occurs."},{"line_number":39,"context_line":"        :raises nova.exception.PolicyNotAuthorized: if verification fails and"},{"line_number":40,"context_line":"            fatal is True."},{"line_number":41,"context_line":"        :return: returns a non-False value (not necessarily \"True\") if"},{"line_number":42,"context_line":"            authorized and False if not authorized and fatal is False."}],"source_content_type":"text/x-python","patch_set":16,"id":"5f7c97a3_15bec264","line":39,"range":{"start_line":39,"start_character":16,"end_line":39,"end_character":50},"in_reply_to":"5f7c97a3_e3ea83d6","updated":"2018-05-23 23:21:33.000000000","message":"Yup, good point.","commit_id":"0a461979df62cd1df2c807b3f4fb3593b3040d13"}],"nova/api/openstack/placement/handler.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"463b91c895b96fc93fa120c35a3d2a81dd538657","unresolved":false,"context_lines":[{"line_number":134,"context_line":"PER_ROUTE_POLICY \u003d ["},{"line_number":135,"context_line":"    \u0027/\u0027,    # The root is special in that it does not require auth."},{"line_number":136,"context_line":"    \u0027/resource_providers\u0027,"},{"line_number":137,"context_line":"    \u0027/resource_providers/{uuid}\u0027,"},{"line_number":138,"context_line":"]"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_0593515e","line":137,"range":{"start_line":137,"start_character":25,"end_line":137,"end_character":31},"updated":"2018-04-26 21:57:42.000000000","message":"This probably doesn\u0027t make sense for environ[\u0027PATH_INFO\u0027].","commit_id":"ff7b0cea791435ef0ae19b328be2bc51c13d87f8"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"29f65745294c99966c9111042834885dc3c6506e","unresolved":false,"context_lines":[{"line_number":120,"context_line":"        \u0027DELETE\u0027: trait.delete_trait,"},{"line_number":121,"context_line":"    },"},{"line_number":122,"context_line":"    \u0027/resource_providers/{uuid}/traits\u0027: {"},{"line_number":123,"context_line":"        \u0027GET\u0027: trait.list_traits_for_resource_provider,"},{"line_number":124,"context_line":"        \u0027PUT\u0027: trait.update_traits_for_resource_provider,"},{"line_number":125,"context_line":"        \u0027DELETE\u0027: trait.delete_traits_for_resource_provider"},{"line_number":126,"context_line":"    },"}],"source_content_type":"text/x-python","patch_set":4,"id":"9f6a8fd7_d5fdfd08","line":123,"updated":"2018-04-27 09:20:00.000000000","message":"Instead of the PER_ROUTE_POLICY list below, and potentially some of the repeated docs in the modules under policies, it might be possible to extend this data structure and modify dispatch and the mapper to handle policy. This line would become something like:\n\n   \u0027GET\u0027: (trait.list_traits_for_reosurce_provider, trait_policy.SHOW)\n\nthe policy would get added as a kwarg when making the map in make_map and then dispatch would check it before calling handler.\n\nThat seems complex, but preserves the rather nice declarative style.\n\nNot necessary suggesting that we do that now, but if it gives some ideas, or is something that would be cool for later, at least it\u0027s out there.\n\nSee also my additional comments down below.","commit_id":"25f848ea741f9c0937e8d524edb8b8d2f3b3349d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"37780078b57cbbf2df1db61b74830ece4b43bcc8","unresolved":false,"context_lines":[{"line_number":120,"context_line":"        \u0027DELETE\u0027: trait.delete_trait,"},{"line_number":121,"context_line":"    },"},{"line_number":122,"context_line":"    \u0027/resource_providers/{uuid}/traits\u0027: {"},{"line_number":123,"context_line":"        \u0027GET\u0027: trait.list_traits_for_resource_provider,"},{"line_number":124,"context_line":"        \u0027PUT\u0027: trait.update_traits_for_resource_provider,"},{"line_number":125,"context_line":"        \u0027DELETE\u0027: trait.delete_traits_for_resource_provider"},{"line_number":126,"context_line":"    },"}],"source_content_type":"text/x-python","patch_set":4,"id":"9f6a8fd7_bc97093b","line":123,"in_reply_to":"9f6a8fd7_d5fdfd08","updated":"2018-04-27 16:56:05.000000000","message":"The first thing I thought about doing was adding the policy rules directly into this router mapper, so we\u0027re on the same page. But then I started looking at make_map() and got a little sidetracked so just went with something simple, which is putting the policy checks directly in the handler code, like we do in the compute API. I think long-term that is probably what we\u0027d want anyway, because we\u0027ll likely have policy rules that are specific to microversions and we\u0027ll need to do this in the handler based on which microversion is being used - and the router mapper isn\u0027t versioned (I\u0027m sure we could build that in if needed).","commit_id":"25f848ea741f9c0937e8d524edb8b8d2f3b3349d"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"29f65745294c99966c9111042834885dc3c6506e","unresolved":false,"context_lines":[{"line_number":237,"context_line":"        except exception.NotFound as exc:"},{"line_number":238,"context_line":"            raise webob.exc.HTTPNotFound("},{"line_number":239,"context_line":"                exc, json_formatter\u003dutil.json_error_formatter)"},{"line_number":240,"context_line":"        except exception.PolicyNotAuthorized as exc:"},{"line_number":241,"context_line":"            raise webob.exc.HTTPForbidden("},{"line_number":242,"context_line":"                exc.format_message(),"},{"line_number":243,"context_line":"                json_formatter\u003dutil.json_error_formatter)"}],"source_content_type":"text/x-python","patch_set":4,"id":"9f6a8fd7_12fceb3c","line":240,"updated":"2018-04-27 09:20:00.000000000","message":"If you\u0027re not keen on catching this here (earlier comments suggested that might be the case) two other options would be to either create a decorator\n\n     @enforce(the policy)\n\nthat wraps each handler and catches the exception and reraises a Forbidden\n\nOr catch the exception in wsgi_wrapper.\n\nBut here is fine and fairly natural.\n\nThere\u0027s also the idea I\u0027ve mentioned above.","commit_id":"25f848ea741f9c0937e8d524edb8b8d2f3b3349d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"37780078b57cbbf2df1db61b74830ece4b43bcc8","unresolved":false,"context_lines":[{"line_number":237,"context_line":"        except exception.NotFound as exc:"},{"line_number":238,"context_line":"            raise webob.exc.HTTPNotFound("},{"line_number":239,"context_line":"                exc, json_formatter\u003dutil.json_error_formatter)"},{"line_number":240,"context_line":"        except exception.PolicyNotAuthorized as exc:"},{"line_number":241,"context_line":"            raise webob.exc.HTTPForbidden("},{"line_number":242,"context_line":"                exc.format_message(),"},{"line_number":243,"context_line":"                json_formatter\u003dutil.json_error_formatter)"}],"source_content_type":"text/x-python","patch_set":4,"id":"9f6a8fd7_dcb51dcf","line":240,"in_reply_to":"9f6a8fd7_12fceb3c","updated":"2018-04-27 16:56:05.000000000","message":"I asked in IRC yesterday, after you\u0027d left for the day I think, if I should handle this in the FaultWrapper and just decided on doing it here for now. I kind of like it here since it\u0027s generically handling a common error, which is similar to what we\u0027re doing with 404s.","commit_id":"25f848ea741f9c0937e8d524edb8b8d2f3b3349d"}],"nova/api/openstack/placement/policies/__init__.py":[{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"4cd071a55cb4b94b50cee4c46abd0f5feb3cc0e9","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"def list_rules():"},{"line_number":19,"context_line":"    return itertools.chain("},{"line_number":20,"context_line":"        base.list_rules(),"},{"line_number":21,"context_line":"    )"}],"source_content_type":"text/x-python","patch_set":1,"id":"df7087c5_f499151f","line":20,"updated":"2018-03-08 12:30:41.000000000","message":"as much as I actually like this style, I\u0027m surprised edleafe and dansmith haven\u0027t dinged you for this egregious use of newlines and commas and an rparen on its own line.","commit_id":"529205af09a2de22036e508ad979929f8dfc22a1"}],"nova/api/openstack/placement/policies/base.py":[{"author":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"change_message_id":"d3b29f8b2ea5459f77855cf6e3ce695d9130c011","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"from oslo_policy import policy"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"RULE_ADMIN_API \u003d \u0027rule:admin_api\u0027"},{"line_number":16,"context_line":"RULE_ANY \u003d \u0027@\u0027"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"rules \u003d ["}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_d3e64145","line":15,"updated":"2017-12-05 19:14:11.000000000","message":"This isn\u0027t used.","commit_id":"529205af09a2de22036e508ad979929f8dfc22a1"},{"author":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"change_message_id":"d3b29f8b2ea5459f77855cf6e3ce695d9130c011","unresolved":false,"context_lines":[{"line_number":21,"context_line":"        \"role:admin\","},{"line_number":22,"context_line":"        \"Decides what is required for the \u0027is_admin:True\u0027 check to succeed.\"),"},{"line_number":23,"context_line":"    policy.RuleDefault("},{"line_number":24,"context_line":"        \"admin_api\","},{"line_number":25,"context_line":"        \"is_admin:True\","},{"line_number":26,"context_line":"        \"Default rule for most Admin APIs.\")"},{"line_number":27,"context_line":"]"}],"source_content_type":"text/x-python","patch_set":1,"id":"df87a7cf_93e9991b","line":24,"updated":"2017-12-05 19:14:11.000000000","message":"What\u0027s the point of admin_api? How does it differ from context_is_admin in placement?","commit_id":"529205af09a2de22036e508ad979929f8dfc22a1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ee28a6213d079f68d047e5bfe89dea14b2ece01e","unresolved":false,"context_lines":[{"line_number":21,"context_line":"        \"role:admin\","},{"line_number":22,"context_line":"        \"Decides what is required for the \u0027is_admin:True\u0027 check to succeed.\"),"},{"line_number":23,"context_line":"    policy.RuleDefault("},{"line_number":24,"context_line":"        \"admin_api\","},{"line_number":25,"context_line":"        \"is_admin:True\","},{"line_number":26,"context_line":"        \"Default rule for most Admin APIs.\")"},{"line_number":27,"context_line":"]"}],"source_content_type":"text/x-python","patch_set":1,"id":"9f6a8fd7_d72e868a","line":24,"in_reply_to":"9f6a8fd7_b1c76264","updated":"2018-04-25 21:49:50.000000000","message":"I did some digging here - but the call path is a bit confusing. I attempted to describe it in another patch and include a possible path for omitting it (it won\u0027t pass tests though):\n\nhttps://review.openstack.org/#/c/564349/\n\nHopefully that helps clear things up.\n\nTL;DR context_is_admin appears to be an alias used to set the is_admin property on RequestContext objects.","commit_id":"529205af09a2de22036e508ad979929f8dfc22a1"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e7396af8bc7391d62805714c8cd599fef6da57d3","unresolved":false,"context_lines":[{"line_number":21,"context_line":"        \"role:admin\","},{"line_number":22,"context_line":"        \"Decides what is required for the \u0027is_admin:True\u0027 check to succeed.\"),"},{"line_number":23,"context_line":"    policy.RuleDefault("},{"line_number":24,"context_line":"        \"admin_api\","},{"line_number":25,"context_line":"        \"is_admin:True\","},{"line_number":26,"context_line":"        \"Default rule for most Admin APIs.\")"},{"line_number":27,"context_line":"]"}],"source_content_type":"text/x-python","patch_set":1,"id":"9f6a8fd7_acb6173e","line":24,"in_reply_to":"9f6a8fd7_d72e868a","updated":"2018-04-26 15:01:08.000000000","message":"Looking at https://github.com/openstack/nova/blob/58ea2a3bea738ae5ae1f1d310c205e738640ef53/nova/api/openstack/placement/auth.py#L65 I\u0027m not sure that placement is actually using nova.context.RequestContext, I think it\u0027s just basically using oslo_context.context.RequestContext, so the context_is_admin alias hack might not be necessary here.","commit_id":"529205af09a2de22036e508ad979929f8dfc22a1"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"d3cde19f4e2073fd5106e34f39ebf349c3be4b5c","unresolved":false,"context_lines":[{"line_number":21,"context_line":"        \"role:admin\","},{"line_number":22,"context_line":"        \"Decides what is required for the \u0027is_admin:True\u0027 check to succeed.\"),"},{"line_number":23,"context_line":"    policy.RuleDefault("},{"line_number":24,"context_line":"        \"admin_api\","},{"line_number":25,"context_line":"        \"is_admin:True\","},{"line_number":26,"context_line":"        \"Default rule for most Admin APIs.\")"},{"line_number":27,"context_line":"]"}],"source_content_type":"text/x-python","patch_set":1,"id":"9f6a8fd7_b1c76264","line":24,"in_reply_to":"df7087c5_94b77987","updated":"2018-04-25 20:30:28.000000000","message":"That\u0027s a Lance question. This is just copying the stuff that\u0027s already in nova policy:\n\nhttps://github.com/openstack/nova/blob/master/nova/policies/base.py","commit_id":"529205af09a2de22036e508ad979929f8dfc22a1"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"4cd071a55cb4b94b50cee4c46abd0f5feb3cc0e9","unresolved":false,"context_lines":[{"line_number":21,"context_line":"        \"role:admin\","},{"line_number":22,"context_line":"        \"Decides what is required for the \u0027is_admin:True\u0027 check to succeed.\"),"},{"line_number":23,"context_line":"    policy.RuleDefault("},{"line_number":24,"context_line":"        \"admin_api\","},{"line_number":25,"context_line":"        \"is_admin:True\","},{"line_number":26,"context_line":"        \"Default rule for most Admin APIs.\")"},{"line_number":27,"context_line":"]"}],"source_content_type":"text/x-python","patch_set":1,"id":"df7087c5_94b77987","line":24,"in_reply_to":"df87a7cf_93e9991b","updated":"2018-03-08 12:30:41.000000000","message":"good question. I\u0027m curious about the answer to this as well.","commit_id":"529205af09a2de22036e508ad979929f8dfc22a1"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"463b91c895b96fc93fa120c35a3d2a81dd538657","unresolved":false,"context_lines":[{"line_number":13,"context_line":"from oslo_policy import policy"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"RULE_ADMIN_API \u003d \u0027rule:admin_api\u0027"},{"line_number":16,"context_line":"RULE_ANY \u003d \u0027@\u0027"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"rules \u003d ["},{"line_number":19,"context_line":"    # This is the default rule (action) used for all routes that do not yet"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_e572dd49","line":16,"updated":"2018-04-26 21:57:42.000000000","message":"Might as well remove this until something actually needs to use it.","commit_id":"ff7b0cea791435ef0ae19b328be2bc51c13d87f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"16b80e88e514e075fd5ea68092fa15ac97a51b86","unresolved":false,"context_lines":[{"line_number":15,"context_line":"RULE_ADMIN_API \u003d \u0027rule:admin_api\u0027"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"rules \u003d ["},{"line_number":18,"context_line":"    # \"placement\" the default rule (action) used for all routes that do"},{"line_number":19,"context_line":"    # not yet have granular policy rules. It is used in"},{"line_number":20,"context_line":"    # PlacementHandler.__call__ and can be dropped once all routes have"},{"line_number":21,"context_line":"    # granular policy handling."}],"source_content_type":"text/x-python","patch_set":4,"id":"9f6a8fd7_cc3101a5","line":18,"range":{"start_line":18,"start_character":18,"end_line":18,"end_character":21},"updated":"2018-04-27 00:05:27.000000000","message":"is the","commit_id":"25f848ea741f9c0937e8d524edb8b8d2f3b3349d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"fd95c2cb4b5aaf0161fcd60dc7ea9251135d37f5","unresolved":false,"context_lines":[{"line_number":15,"context_line":"RULE_ADMIN_API \u003d \u0027rule:admin_api\u0027"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"rules \u003d ["},{"line_number":18,"context_line":"    # \"placement\" the default rule (action) used for all routes that do"},{"line_number":19,"context_line":"    # not yet have granular policy rules. It is used in"},{"line_number":20,"context_line":"    # PlacementHandler.__call__ and can be dropped once all routes have"},{"line_number":21,"context_line":"    # granular policy handling."}],"source_content_type":"text/x-python","patch_set":4,"id":"9f6a8fd7_338ead2e","line":18,"range":{"start_line":18,"start_character":18,"end_line":18,"end_character":21},"in_reply_to":"9f6a8fd7_cc3101a5","updated":"2018-04-30 14:26:11.000000000","message":"Done","commit_id":"25f848ea741f9c0937e8d524edb8b8d2f3b3349d"},{"author":{"_account_id":23851,"name":"Riccardo Pittau","email":"elfosardo@gmail.com","username":"elfosardo"},"change_message_id":"1bc640f5c3445bc53851a596a313a5554efcd72e","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    # not yet have granular policy rules. It is used in"},{"line_number":20,"context_line":"    # PlacementHandler.__call__ and can be dropped once all routes have"},{"line_number":21,"context_line":"    # granular policy handling."},{"line_number":22,"context_line":"    policy.RuleDefault("},{"line_number":23,"context_line":"        \"placement\","},{"line_number":24,"context_line":"        \"role:admin\","},{"line_number":25,"context_line":"        description\u003d\"This rule is used for all routes that do not yet \""}],"source_content_type":"text/x-python","patch_set":11,"id":"5f7c97a3_c21081ab","line":22,"updated":"2018-05-24 18:21:54.000000000","message":"since this rule will be renamed you should use the class DeprecatedRule","commit_id":"69d496bb219681ba287ad436cea1db22d2c3f7cc"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"c4617f160de36a1a7f583fef490e500724fb0fe5","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    # not yet have granular policy rules. It is used in"},{"line_number":20,"context_line":"    # PlacementHandler.__call__ and can be dropped once all routes have"},{"line_number":21,"context_line":"    # granular policy handling."},{"line_number":22,"context_line":"    policy.RuleDefault("},{"line_number":23,"context_line":"        \"placement\","},{"line_number":24,"context_line":"        \"role:admin\","},{"line_number":25,"context_line":"        description\u003d\"This rule is used for all routes that do not yet \""}],"source_content_type":"text/x-python","patch_set":11,"id":"5f7c97a3_e5510638","line":22,"in_reply_to":"5f7c97a3_c21081ab","updated":"2018-05-24 21:08:37.000000000","message":"Maybe, see the TODO below. There are currently some bugs in oslo.policy about how the aliasing works and shows up in the documentation.","commit_id":"69d496bb219681ba287ad436cea1db22d2c3f7cc"}],"nova/api/openstack/placement/policies/resource_provider.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"aa382c8baaece6f9ae3cd3d5fad4a789ea8bcdce","unresolved":false,"context_lines":[{"line_number":51,"context_line":"        ["},{"line_number":52,"context_line":"            {"},{"line_number":53,"context_line":"                \u0027method\u0027: \u0027GET\u0027,"},{"line_number":54,"context_line":"                \u0027path\u0027: \u0027/resource_providers/{uuid}\u0027"},{"line_number":55,"context_line":"            }"},{"line_number":56,"context_line":"        ]),"},{"line_number":57,"context_line":"    policy.DocumentedRuleDefault("}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_86cf6aaf","line":54,"range":{"start_line":54,"start_character":46,"end_line":54,"end_character":50},"updated":"2018-05-17 12:19:00.000000000","message":"Some of the other policies in nova use things like {server_id} [0] or {hypervisor_id} [1]. Do we want to continue that pattern here or do we not do that because we\u0027re not sure what the resource is, so we just use the format?\n\n[0] https://github.com/openstack/nova/blob/master/nova/policies/servers.py#L71\n[1] https://github.com/openstack/nova/blob/master/nova/policies/hypervisors.py#L52","commit_id":"f605474b80d6882006628b7a5abea9f74f9b8908"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"5c415a2c9d1a8b5997c4c7138ba9bb37656b6d1a","unresolved":false,"context_lines":[{"line_number":51,"context_line":"        ["},{"line_number":52,"context_line":"            {"},{"line_number":53,"context_line":"                \u0027method\u0027: \u0027GET\u0027,"},{"line_number":54,"context_line":"                \u0027path\u0027: \u0027/resource_providers/{uuid}\u0027"},{"line_number":55,"context_line":"            }"},{"line_number":56,"context_line":"        ]),"},{"line_number":57,"context_line":"    policy.DocumentedRuleDefault("}],"source_content_type":"text/x-python","patch_set":15,"id":"5f7c97a3_f2eb78d9","line":54,"range":{"start_line":54,"start_character":46,"end_line":54,"end_character":50},"in_reply_to":"5f7c97a3_86cf6aaf","updated":"2018-05-17 14:55:28.000000000","message":"What I\u0027m using here matches what\u0027s in the placement API reference so I\u0027m just shooting for consistency:\n\nhttps://developer.openstack.org/api-ref/placement/#show-resource-provider\n\nAlso, {uuid} is the entry in the resource provider resource body response, so it was probably done that way. {server_id} isn\u0027t a thing in the server response body, {id} is. So if anything the compute API reference docs are probably the ones that are \"incorrect\" if we\u0027re going to be pedantic.","commit_id":"f605474b80d6882006628b7a5abea9f74f9b8908"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e94af750749b95a9944f5cd39b17fc89a124152a","unresolved":false,"context_lines":[{"line_number":26,"context_line":"rules \u003d ["},{"line_number":27,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":28,"context_line":"        LIST,"},{"line_number":29,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":30,"context_line":"        \"List resource providers.\","},{"line_number":31,"context_line":"        ["},{"line_number":32,"context_line":"            {"}],"source_content_type":"text/x-python","patch_set":16,"id":"5f7c97a3_03cbff52","line":29,"updated":"2018-05-22 16:06:21.000000000","message":"Since we\u0027re in here, do we want to add scope_types, too? Are resource_providers system-specific things?\n\n  scope_types\u003d[\u0027system\u0027]\n\n\nFWIW - this won\u0027t get applied in policy enforcement with oslo.policy until operators enable it in nova.conf [0].\n\n[0] https://docs.openstack.org/oslo.policy/latest/configuration/index.html#oslo_policy.enforce_scope","commit_id":"0a461979df62cd1df2c807b3f4fb3593b3040d13"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"28c2d485da9b14cc1260eea7a908e00fafd867c4","unresolved":false,"context_lines":[{"line_number":26,"context_line":"rules \u003d ["},{"line_number":27,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":28,"context_line":"        LIST,"},{"line_number":29,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":30,"context_line":"        \"List resource providers.\","},{"line_number":31,"context_line":"        ["},{"line_number":32,"context_line":"            {"}],"source_content_type":"text/x-python","patch_set":16,"id":"5f7c97a3_95b17292","line":29,"in_reply_to":"5f7c97a3_03cbff52","updated":"2018-05-23 23:21:33.000000000","message":"Yes I think resource providers are system scope things (think compute nodes, SR-IOV physical functions, NUMA nodes), physical hardware things. I just neatly avoided scope since I haven\u0027t wrapped my head around it right now, and some of the later things in the series need not necessarily be restricted by system scope, like GET /usages which is per-project (so I guess that would be project scope).\n\nSince resource providers don\u0027t have project/user fields on them, they are probably safely system scope, but things like consumer allocations, which are specific a project/user (they represent the allocation of some resource class (VCPU) that a given consumer (server instance) has on a resource provider (compute node)), those should probably be project scope, right?","commit_id":"0a461979df62cd1df2c807b3f4fb3593b3040d13"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"9617a14b5e8e0b6965925053b76b51dc2691b32b","unresolved":false,"context_lines":[{"line_number":26,"context_line":"rules \u003d ["},{"line_number":27,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":28,"context_line":"        LIST,"},{"line_number":29,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":30,"context_line":"        \"List resource providers.\","},{"line_number":31,"context_line":"        ["},{"line_number":32,"context_line":"            {"}],"source_content_type":"text/x-python","patch_set":16,"id":"5f7c97a3_48dd6f6e","line":29,"in_reply_to":"5f7c97a3_151a427c","updated":"2018-05-24 21:35:23.000000000","message":"Resource class creation, update and delete should be system scoped. List and show should be project scoped. Same for /traits.","commit_id":"0a461979df62cd1df2c807b3f4fb3593b3040d13"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"8242145b2d18888e334c8c1b3063e598697b29b7","unresolved":false,"context_lines":[{"line_number":26,"context_line":"rules \u003d ["},{"line_number":27,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":28,"context_line":"        LIST,"},{"line_number":29,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":30,"context_line":"        \"List resource providers.\","},{"line_number":31,"context_line":"        ["},{"line_number":32,"context_line":"            {"}],"source_content_type":"text/x-python","patch_set":16,"id":"5f7c97a3_5ba64ec3","line":29,"in_reply_to":"5f7c97a3_27a9397b","updated":"2018-05-31 05:14:58.000000000","message":"+1 on doing scope things separately after we have all these policy setup.","commit_id":"0a461979df62cd1df2c807b3f4fb3593b3040d13"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b0c18186f542bd30520b177a4193b8400b0d7862","unresolved":false,"context_lines":[{"line_number":26,"context_line":"rules \u003d ["},{"line_number":27,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":28,"context_line":"        LIST,"},{"line_number":29,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":30,"context_line":"        \"List resource providers.\","},{"line_number":31,"context_line":"        ["},{"line_number":32,"context_line":"            {"}],"source_content_type":"text/x-python","patch_set":16,"id":"5f7c97a3_9458828a","line":29,"in_reply_to":"5f7c97a3_48dd6f6e","updated":"2018-05-25 05:42:59.000000000","message":"OK, I talked a little with Lance about it this week too. I figure I\u0027ll take a separate pass through this for the scope types once we get the base policy rules in place.","commit_id":"0a461979df62cd1df2c807b3f4fb3593b3040d13"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"ed4ba25a22ad553a3e393af69247e7ae240d1cbc","unresolved":false,"context_lines":[{"line_number":26,"context_line":"rules \u003d ["},{"line_number":27,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":28,"context_line":"        LIST,"},{"line_number":29,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":30,"context_line":"        \"List resource providers.\","},{"line_number":31,"context_line":"        ["},{"line_number":32,"context_line":"            {"}],"source_content_type":"text/x-python","patch_set":16,"id":"5f7c97a3_27a9397b","line":29,"in_reply_to":"5f7c97a3_9458828a","updated":"2018-05-25 14:30:01.000000000","message":"Yup, totally.","commit_id":"0a461979df62cd1df2c807b3f4fb3593b3040d13"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"00eb713a9c3f705b53c61ffafb8f8bb6ae7b5652","unresolved":false,"context_lines":[{"line_number":26,"context_line":"rules \u003d ["},{"line_number":27,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":28,"context_line":"        LIST,"},{"line_number":29,"context_line":"        base.RULE_ADMIN_API,"},{"line_number":30,"context_line":"        \"List resource providers.\","},{"line_number":31,"context_line":"        ["},{"line_number":32,"context_line":"            {"}],"source_content_type":"text/x-python","patch_set":16,"id":"5f7c97a3_151a427c","line":29,"in_reply_to":"5f7c97a3_95b17292","updated":"2018-05-23 23:32:33.000000000","message":"I get confused about something like resource classes:\n\nhttps://review.openstack.org/#/c/565578/10/nova/api/openstack/placement/policies/resource_class.py\n\nWhich aren\u0027t scoped to a project, they are created by the system scope admin (or are standard), but they would show up in allocations results, e.g.:\n\nhttps://developer.openstack.org/api-ref/placement/#list-allocations\n\nAnd allocations would likely be project-scope since they have a project/user on them. But the project-scope user doesn\u0027t really need to care about resource classes otherwise (I don\u0027t think), just that they see they have allocations on something and they have VCPU/DISK_GB/etc allocations.","commit_id":"0a461979df62cd1df2c807b3f4fb3593b3040d13"}],"nova/api/openstack/placement/policy.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d3dbd28d5f9e477457d2af53831f315f030ebf01","unresolved":false,"context_lines":[{"line_number":56,"context_line":"    # be present. So we pass in an arg list with those stripped out."},{"line_number":57,"context_line":"    conf_args \u003d []"},{"line_number":58,"context_line":"    # Start at 1 because cfg.CONF expects the equivalent of sys.argv[1:]"},{"line_number":59,"context_line":"    i \u003d 1"},{"line_number":60,"context_line":"    while i \u003c len(sys.argv):"},{"line_number":61,"context_line":"        if sys.argv[i].strip(\u0027-\u0027) in [\u0027namespace\u0027, \u0027output-file\u0027]:"},{"line_number":62,"context_line":"            i +\u003d 2"},{"line_number":63,"context_line":"            continue"},{"line_number":64,"context_line":"        conf_args.append(sys.argv[i])"},{"line_number":65,"context_line":"        i +\u003d 1"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"    CONF(conf_args, project\u003d\u0027nova\u0027)"},{"line_number":68,"context_line":"    init()    # constructs the _ENFORCER_PLACEMENT global"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_2a5bc254","line":65,"range":{"start_line":59,"start_character":3,"end_line":65,"end_character":14},"updated":"2018-04-26 21:32:02.000000000","message":"I had a patch to make this simpler after we implemented this in keystone [0].\n\n[0] https://review.openstack.org/#/c/531008/","commit_id":"ff7b0cea791435ef0ae19b328be2bc51c13d87f8"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"eb26f50e4eebc278ab43bd72877f8fa350632499","unresolved":false,"context_lines":[{"line_number":56,"context_line":"    # be present. So we pass in an arg list with those stripped out."},{"line_number":57,"context_line":"    conf_args \u003d []"},{"line_number":58,"context_line":"    # Start at 1 because cfg.CONF expects the equivalent of sys.argv[1:]"},{"line_number":59,"context_line":"    i \u003d 1"},{"line_number":60,"context_line":"    while i \u003c len(sys.argv):"},{"line_number":61,"context_line":"        if sys.argv[i].strip(\u0027-\u0027) in [\u0027namespace\u0027, \u0027output-file\u0027]:"},{"line_number":62,"context_line":"            i +\u003d 2"},{"line_number":63,"context_line":"            continue"},{"line_number":64,"context_line":"        conf_args.append(sys.argv[i])"},{"line_number":65,"context_line":"        i +\u003d 1"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"    CONF(conf_args, project\u003d\u0027nova\u0027)"},{"line_number":68,"context_line":"    init()    # constructs the _ENFORCER_PLACEMENT global"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_e55e5d11","line":65,"range":{"start_line":59,"start_character":3,"end_line":65,"end_character":14},"in_reply_to":"9f6a8fd7_253775e6","updated":"2018-04-26 21:37:59.000000000","message":"Nope. What I meant is that i proposed a similar patch to nova [0], after we simplified things in keystone [1] (Doug\u0027s comments on patch set three).\n\n[0] https://review.openstack.org/#/c/531008/\n[1] https://review.openstack.org/#/c/530828/5","commit_id":"ff7b0cea791435ef0ae19b328be2bc51c13d87f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f5731094851bc08d74ab05757eafa950d6b7d4ec","unresolved":false,"context_lines":[{"line_number":56,"context_line":"    # be present. So we pass in an arg list with those stripped out."},{"line_number":57,"context_line":"    conf_args \u003d []"},{"line_number":58,"context_line":"    # Start at 1 because cfg.CONF expects the equivalent of sys.argv[1:]"},{"line_number":59,"context_line":"    i \u003d 1"},{"line_number":60,"context_line":"    while i \u003c len(sys.argv):"},{"line_number":61,"context_line":"        if sys.argv[i].strip(\u0027-\u0027) in [\u0027namespace\u0027, \u0027output-file\u0027]:"},{"line_number":62,"context_line":"            i +\u003d 2"},{"line_number":63,"context_line":"            continue"},{"line_number":64,"context_line":"        conf_args.append(sys.argv[i])"},{"line_number":65,"context_line":"        i +\u003d 1"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"    CONF(conf_args, project\u003d\u0027nova\u0027)"},{"line_number":68,"context_line":"    init()    # constructs the _ENFORCER_PLACEMENT global"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_253775e6","line":65,"range":{"start_line":59,"start_character":3,"end_line":65,"end_character":14},"in_reply_to":"9f6a8fd7_2a5bc254","updated":"2018-04-26 21:33:45.000000000","message":"Wrong patch?","commit_id":"ff7b0cea791435ef0ae19b328be2bc51c13d87f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"457d19aa57fae3130d2698264ece178eca4f9e2b","unresolved":false,"context_lines":[{"line_number":56,"context_line":"    # be present. So we pass in an arg list with those stripped out."},{"line_number":57,"context_line":"    conf_args \u003d []"},{"line_number":58,"context_line":"    # Start at 1 because cfg.CONF expects the equivalent of sys.argv[1:]"},{"line_number":59,"context_line":"    i \u003d 1"},{"line_number":60,"context_line":"    while i \u003c len(sys.argv):"},{"line_number":61,"context_line":"        if sys.argv[i].strip(\u0027-\u0027) in [\u0027namespace\u0027, \u0027output-file\u0027]:"},{"line_number":62,"context_line":"            i +\u003d 2"},{"line_number":63,"context_line":"            continue"},{"line_number":64,"context_line":"        conf_args.append(sys.argv[i])"},{"line_number":65,"context_line":"        i +\u003d 1"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"    CONF(conf_args, project\u003d\u0027nova\u0027)"},{"line_number":68,"context_line":"    init()    # constructs the _ENFORCER_PLACEMENT global"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_05c4b191","line":65,"range":{"start_line":59,"start_character":3,"end_line":65,"end_character":14},"in_reply_to":"9f6a8fd7_e55e5d11","updated":"2018-04-26 21:43:39.000000000","message":"Sorry, I should have looked closer, I thought that was your context_is_admin patch at first glance. Yeah I\u0027ll copy the keystone thing.","commit_id":"ff7b0cea791435ef0ae19b328be2bc51c13d87f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"16b80e88e514e075fd5ea68092fa15ac97a51b86","unresolved":false,"context_lines":[{"line_number":68,"context_line":"        nova.api.openstack.placement.context.RequestContext"},{"line_number":69,"context_line":"    :param action: string representing the action to be checked"},{"line_number":70,"context_line":"        this should be colon separated for clarity, i.e."},{"line_number":71,"context_line":"        ``placement:resource_providers:index``"},{"line_number":72,"context_line":"    :param target: dictionary representing the object of the action;"},{"line_number":73,"context_line":"        for object creation this should be a dictionary representing the"},{"line_number":74,"context_line":"        owner of the object e.g. ``{\u0027project_id\u0027: context.project_id}``."}],"source_content_type":"text/x-python","patch_set":4,"id":"9f6a8fd7_2ce51d0b","line":71,"range":{"start_line":71,"start_character":39,"end_line":71,"end_character":44},"updated":"2018-04-27 00:05:27.000000000","message":"list","commit_id":"25f848ea741f9c0937e8d524edb8b8d2f3b3349d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"fd95c2cb4b5aaf0161fcd60dc7ea9251135d37f5","unresolved":false,"context_lines":[{"line_number":68,"context_line":"        nova.api.openstack.placement.context.RequestContext"},{"line_number":69,"context_line":"    :param action: string representing the action to be checked"},{"line_number":70,"context_line":"        this should be colon separated for clarity, i.e."},{"line_number":71,"context_line":"        ``placement:resource_providers:index``"},{"line_number":72,"context_line":"    :param target: dictionary representing the object of the action;"},{"line_number":73,"context_line":"        for object creation this should be a dictionary representing the"},{"line_number":74,"context_line":"        owner of the object e.g. ``{\u0027project_id\u0027: context.project_id}``."}],"source_content_type":"text/x-python","patch_set":4,"id":"9f6a8fd7_f387d50e","line":71,"range":{"start_line":71,"start_character":39,"end_line":71,"end_character":44},"in_reply_to":"9f6a8fd7_2ce51d0b","updated":"2018-04-30 14:26:11.000000000","message":"Done","commit_id":"25f848ea741f9c0937e8d524edb8b8d2f3b3349d"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"9617a14b5e8e0b6965925053b76b51dc2691b32b","unresolved":false,"context_lines":[{"line_number":52,"context_line":"    # This method is used by oslopolicy CLI scripts in order to generate policy"},{"line_number":53,"context_line":"    # files from overrides on disk and defaults in code. We can just pass an"},{"line_number":54,"context_line":"    # empty list and let oslo do the config lifting for us."},{"line_number":55,"context_line":"    cfg.CONF([], project\u003d\u0027nova\u0027)"},{"line_number":56,"context_line":"    init()"},{"line_number":57,"context_line":"    return _ENFORCER_PLACEMENT"},{"line_number":58,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"5f7c97a3_88d94757","line":55,"range":{"start_line":55,"start_character":26,"end_line":55,"end_character":30},"updated":"2018-05-24 21:35:23.000000000","message":"should this be placement? or is this nova in order to output the /etc/nova/placement-policy.yaml file?","commit_id":"0a461979df62cd1df2c807b3f4fb3593b3040d13"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b0c18186f542bd30520b177a4193b8400b0d7862","unresolved":false,"context_lines":[{"line_number":52,"context_line":"    # This method is used by oslopolicy CLI scripts in order to generate policy"},{"line_number":53,"context_line":"    # files from overrides on disk and defaults in code. We can just pass an"},{"line_number":54,"context_line":"    # empty list and let oslo do the config lifting for us."},{"line_number":55,"context_line":"    cfg.CONF([], project\u003d\u0027nova\u0027)"},{"line_number":56,"context_line":"    init()"},{"line_number":57,"context_line":"    return _ENFORCER_PLACEMENT"},{"line_number":58,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"5f7c97a3_d4791afc","line":55,"range":{"start_line":55,"start_character":26,"end_line":55,"end_character":30},"in_reply_to":"5f7c97a3_2e44bb46","updated":"2018-05-25 05:42:59.000000000","message":"Yeah it\u0027s for the config since we currently read all placement config options from nova.conf. Similar to the stuff here:\n\nhttps://github.com/openstack/nova/blob/e4a2ebafe1086dbb287c33476b1e47714031b275/nova/api/openstack/placement/deploy.py#L28\n\nAnd\n\nhttps://github.com/openstack/nova/blob/e4a2ebafe1086dbb287c33476b1e47714031b275/nova/api/openstack/placement/wsgi.py","commit_id":"0a461979df62cd1df2c807b3f4fb3593b3040d13"},{"author":{"_account_id":7156,"name":"Mathieu Gagné","email":"mgagne@calavera.ca","username":"mgagne"},"change_message_id":"3627ee21ab56b2573d33e758532b102d44d36d6a","unresolved":false,"context_lines":[{"line_number":52,"context_line":"    # This method is used by oslopolicy CLI scripts in order to generate policy"},{"line_number":53,"context_line":"    # files from overrides on disk and defaults in code. We can just pass an"},{"line_number":54,"context_line":"    # empty list and let oslo do the config lifting for us."},{"line_number":55,"context_line":"    cfg.CONF([], project\u003d\u0027nova\u0027)"},{"line_number":56,"context_line":"    init()"},{"line_number":57,"context_line":"    return _ENFORCER_PLACEMENT"},{"line_number":58,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"5f7c97a3_2e44bb46","line":55,"range":{"start_line":55,"start_character":26,"end_line":55,"end_character":30},"in_reply_to":"5f7c97a3_88d94757","updated":"2018-05-25 00:00:55.000000000","message":"I think it\u0027s used to get [placement]/policy_file which would still be in /etc/nova/nova.conf\n\nSee L46 above and introduced config in nova/conf/placement.py","commit_id":"0a461979df62cd1df2c807b3f4fb3593b3040d13"}],"nova/tests/functional/api/openstack/placement/gabbits/resource-provider-policy.yaml":[{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"a5d3a8d9adba5bcf4eb63fc0d7473b3c889440d1","unresolved":false,"context_lines":[{"line_number":12,"context_line":"tests:"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"- name: list resource providers"},{"line_number":15,"context_line":"  GET: /resource_providers"},{"line_number":16,"context_line":"  request_headers:"},{"line_number":17,"context_line":"      # microversion 1.15 for cache headers"},{"line_number":18,"context_line":"      openstack-api-version: placement 1.15"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"5f7c97a3_7d426240","line":15,"updated":"2018-05-10 16:03:01.000000000","message":"If your goal here is to prove that you able to make things work with the token as \"user\" I\u0027d not include all this other respone_* checks.\n\nSet the header explicitly in some requests, verify that you get the non-403 response.\n\nThe other confirmations are noise.","commit_id":"31372a191faeb29e9d2863bfcc189720e144895c"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"5ad64afbbe3f74f20cc115d061b545b0b480c523","unresolved":false,"context_lines":[{"line_number":12,"context_line":"tests:"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"- name: list resource providers"},{"line_number":15,"context_line":"  GET: /resource_providers"},{"line_number":16,"context_line":"  request_headers:"},{"line_number":17,"context_line":"      # microversion 1.15 for cache headers"},{"line_number":18,"context_line":"      openstack-api-version: placement 1.15"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"5f7c97a3_470c3aa4","line":15,"in_reply_to":"5f7c97a3_536bd683","updated":"2018-05-14 15:50:09.000000000","message":"Done","commit_id":"31372a191faeb29e9d2863bfcc189720e144895c"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f5f7dc416a74930b3a699310eb30bd51b2d19e55","unresolved":false,"context_lines":[{"line_number":12,"context_line":"tests:"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"- name: list resource providers"},{"line_number":15,"context_line":"  GET: /resource_providers"},{"line_number":16,"context_line":"  request_headers:"},{"line_number":17,"context_line":"      # microversion 1.15 for cache headers"},{"line_number":18,"context_line":"      openstack-api-version: placement 1.15"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"5f7c97a3_536bd683","line":15,"in_reply_to":"5f7c97a3_7d426240","updated":"2018-05-10 18:04:14.000000000","message":"I\u0027ll just remove the optional headers and response validation. It was copy/paste anyway.","commit_id":"31372a191faeb29e9d2863bfcc189720e144895c"}],"nova/tests/functional/api/openstack/placement/gabbits/resource-provider.yaml":[{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"a5d3a8d9adba5bcf4eb63fc0d7473b3c889440d1","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  response_json_paths:"},{"line_number":32,"context_line":"      $.errors[0].title: Forbidden"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"- name: non admin forbidden non json"},{"line_number":35,"context_line":"  GET: /resource_providers"},{"line_number":36,"context_line":"  request_headers:"},{"line_number":37,"context_line":"      x-auth-token: user"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"5f7c97a3_fdd3d25e","side":"PARENT","line":34,"updated":"2018-05-10 16:03:01.000000000","message":"not certain that you want to change this in this way. The intent of this test was to make sure that when we have an accept header (which controls the representation of the error response) we get strings in the textual response that we wanted","commit_id":"ed44c2f48d6cd0e6b4cf2966a829dbc7bdb4ca4e"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"ae50f45804532591fbbf48328fe0a0f9d462c623","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  response_json_paths:"},{"line_number":32,"context_line":"      $.errors[0].title: Forbidden"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"- name: non admin forbidden non json"},{"line_number":35,"context_line":"  GET: /resource_providers"},{"line_number":36,"context_line":"  request_headers:"},{"line_number":37,"context_line":"      x-auth-token: user"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"5f7c97a3_d3b36609","side":"PARENT","line":34,"in_reply_to":"5f7c97a3_d357e6c9","updated":"2018-05-10 18:07:12.000000000","message":"So I guess the 403 was just an easy error to trigger the text/plan accept header, and you\u0027re saying now I should change this to some other kind of error that will generate the response in text rather than json?","commit_id":"ed44c2f48d6cd0e6b4cf2966a829dbc7bdb4ca4e"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"7b78d47bc6b3f372d3901e2dae81b67ae633f125","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  response_json_paths:"},{"line_number":32,"context_line":"      $.errors[0].title: Forbidden"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"- name: non admin forbidden non json"},{"line_number":35,"context_line":"  GET: /resource_providers"},{"line_number":36,"context_line":"  request_headers:"},{"line_number":37,"context_line":"      x-auth-token: user"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"5f7c97a3_d3e4c6e2","side":"PARENT","line":34,"in_reply_to":"5f7c97a3_d3b36609","updated":"2018-05-10 18:21:58.000000000","message":"Yeah, pretty much. It\u0027s not really all that necessary, as we know how it works, but if we want to preserve that intent then switching to GET: /moo, with accept text/plain, status 404 and whatever the response_strings would exercise the same thing\n\nI\u0027m not sure it is hugely necessary.","commit_id":"ed44c2f48d6cd0e6b4cf2966a829dbc7bdb4ca4e"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"5ad64afbbe3f74f20cc115d061b545b0b480c523","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  response_json_paths:"},{"line_number":32,"context_line":"      $.errors[0].title: Forbidden"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"- name: non admin forbidden non json"},{"line_number":35,"context_line":"  GET: /resource_providers"},{"line_number":36,"context_line":"  request_headers:"},{"line_number":37,"context_line":"      x-auth-token: user"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"5f7c97a3_a76f4e29","side":"PARENT","line":34,"in_reply_to":"5f7c97a3_d3e4c6e2","updated":"2018-05-14 15:50:09.000000000","message":"Done","commit_id":"ed44c2f48d6cd0e6b4cf2966a829dbc7bdb4ca4e"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f5f7dc416a74930b3a699310eb30bd51b2d19e55","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  response_json_paths:"},{"line_number":32,"context_line":"      $.errors[0].title: Forbidden"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"- name: non admin forbidden non json"},{"line_number":35,"context_line":"  GET: /resource_providers"},{"line_number":36,"context_line":"  request_headers:"},{"line_number":37,"context_line":"      x-auth-token: user"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"5f7c97a3_d357e6c9","side":"PARENT","line":34,"in_reply_to":"5f7c97a3_fdd3d25e","updated":"2018-05-10 18:04:14.000000000","message":"I had to change it because the order of the checks in the code was changed, so we now get 406 back instead of 403.","commit_id":"ed44c2f48d6cd0e6b4cf2966a829dbc7bdb4ca4e"}],"nova/tests/unit/api/openstack/placement/test_context.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b14ee9176b8efc93ab658e3035d6c78745b8a639","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"class TestPlacementRequestContext(testtools.TestCase):"},{"line_number":21,"context_line":"    \"\"\"Test cases for PlacementRequestContext.\"\"\""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"    def setUp(self):"},{"line_number":24,"context_line":"        super(TestPlacementRequestContext, self).setUp()"}],"source_content_type":"text/x-python","patch_set":7,"id":"9f6a8fd7_73ff4067","line":21,"range":{"start_line":21,"start_character":22,"end_line":21,"end_character":45},"updated":"2018-04-30 18:45:00.000000000","message":"This doesn\u0027t exist. Could probably just drop this docstring.","commit_id":"4c9d669a3b7787f8322cfcc917dfed66679b5da1"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b14ee9176b8efc93ab658e3035d6c78745b8a639","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"    @mock.patch(\u0027nova.api.openstack.placement.policy.authorize\u0027,"},{"line_number":58,"context_line":"                return_value\u003dTrue)"},{"line_number":59,"context_line":"    def test_can_target_none_fatal_true_accept_custom_target("},{"line_number":60,"context_line":"            self, mock_authorize):"},{"line_number":61,"context_line":"        class MyObj(object):"},{"line_number":62,"context_line":"            user_id \u003d project_id \u003d \u0027fake2\u0027"}],"source_content_type":"text/x-python","patch_set":7,"id":"9f6a8fd7_33f9c87f","line":59,"range":{"start_line":59,"start_character":17,"end_line":59,"end_character":28},"updated":"2018-04-30 18:45:00.000000000","message":"rename: test_can_target_custom_fatal_true_accept","commit_id":"4c9d669a3b7787f8322cfcc917dfed66679b5da1"}],"nova/tests/unit/policy_fixture.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"16b80e88e514e075fd5ea68092fa15ac97a51b86","unresolved":false,"context_lines":[{"line_number":141,"context_line":"    ``policy_file`` accordingly."},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"    \"\"\""},{"line_number":144,"context_line":"    def _prepare_policy(self):"},{"line_number":145,"context_line":"        \"\"\"Allow changing of the policy before we get started\"\"\""},{"line_number":146,"context_line":"        pass"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"    def setUp(self):"},{"line_number":149,"context_line":"        super(PlacementPolicyFixture, self).setUp()"}],"source_content_type":"text/x-python","patch_set":4,"id":"9f6a8fd7_0cecd9f1","line":146,"range":{"start_line":144,"start_character":0,"end_line":146,"end_character":12},"updated":"2018-04-27 00:05:27.000000000","message":"I can probably remove all of this. Add subclass support when it\u0027s actually needed.","commit_id":"25f848ea741f9c0937e8d524edb8b8d2f3b3349d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"fd95c2cb4b5aaf0161fcd60dc7ea9251135d37f5","unresolved":false,"context_lines":[{"line_number":141,"context_line":"    ``policy_file`` accordingly."},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"    \"\"\""},{"line_number":144,"context_line":"    def _prepare_policy(self):"},{"line_number":145,"context_line":"        \"\"\"Allow changing of the policy before we get started\"\"\""},{"line_number":146,"context_line":"        pass"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"    def setUp(self):"},{"line_number":149,"context_line":"        super(PlacementPolicyFixture, self).setUp()"}],"source_content_type":"text/x-python","patch_set":4,"id":"9f6a8fd7_1361293a","line":146,"range":{"start_line":144,"start_character":0,"end_line":146,"end_character":12},"in_reply_to":"9f6a8fd7_0cecd9f1","updated":"2018-04-30 14:26:11.000000000","message":"Done","commit_id":"25f848ea741f9c0937e8d524edb8b8d2f3b3349d"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"a5d3a8d9adba5bcf4eb63fc0d7473b3c889440d1","unresolved":false,"context_lines":[{"line_number":133,"context_line":"    \"\"\"Load the live policy for tests."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"    A base policy fixture that starts with the assumption that you\u0027d"},{"line_number":136,"context_line":"    like to load and enforce the shipped default policy in tests."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"    This fixture requires nova.tests.unit.conf_fixture.ConfFixture."},{"line_number":139,"context_line":"    \"\"\""}],"source_content_type":"text/x-python","patch_set":10,"id":"5f7c97a3_bdb31a0a","line":136,"updated":"2018-05-10 16:03:01.000000000","message":"Since the shipped policy is \"in code\" in these policy-in-code days, do we need to say it like that?","commit_id":"31372a191faeb29e9d2863bfcc189720e144895c"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"5ad64afbbe3f74f20cc115d061b545b0b480c523","unresolved":false,"context_lines":[{"line_number":133,"context_line":"    \"\"\"Load the live policy for tests."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"    A base policy fixture that starts with the assumption that you\u0027d"},{"line_number":136,"context_line":"    like to load and enforce the shipped default policy in tests."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"    This fixture requires nova.tests.unit.conf_fixture.ConfFixture."},{"line_number":139,"context_line":"    \"\"\""}],"source_content_type":"text/x-python","patch_set":10,"id":"5f7c97a3_8749f2b7","line":136,"in_reply_to":"5f7c97a3_5300b6ab","updated":"2018-05-14 15:50:09.000000000","message":"Done","commit_id":"31372a191faeb29e9d2863bfcc189720e144895c"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f5f7dc416a74930b3a699310eb30bd51b2d19e55","unresolved":false,"context_lines":[{"line_number":133,"context_line":"    \"\"\"Load the live policy for tests."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"    A base policy fixture that starts with the assumption that you\u0027d"},{"line_number":136,"context_line":"    like to load and enforce the shipped default policy in tests."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"    This fixture requires nova.tests.unit.conf_fixture.ConfFixture."},{"line_number":139,"context_line":"    \"\"\""}],"source_content_type":"text/x-python","patch_set":10,"id":"5f7c97a3_5300b6ab","line":136,"in_reply_to":"5f7c97a3_bdb31a0a","updated":"2018-05-10 18:04:14.000000000","message":"I could remove this. It was copied from RealPolicyFixture to start, and RealPolicyFixture came after we already had been running with fake policy in nova unit tests forever. Since we don\u0027t do that with placement, I can just remove this.","commit_id":"31372a191faeb29e9d2863bfcc189720e144895c"}],"nova/tests/unit/test_fixtures.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"463b91c895b96fc93fa120c35a3d2a81dd538657","unresolved":false,"context_lines":[{"line_number":481,"context_line":""},{"line_number":482,"context_line":"        # request a known bad url, and we should get a 404"},{"line_number":483,"context_line":"        resp \u003d placement_fixture._fake_get(None, \u0027/foo\u0027)"},{"line_number":484,"context_line":"        self.assertEqual(404, resp.status_code, resp.text)"},{"line_number":485,"context_line":""},{"line_number":486,"context_line":"        # unsets the token so we fake missing it"},{"line_number":487,"context_line":"        placement_fixture.token \u003d None"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f6a8fd7_85dbe11f","line":484,"updated":"2018-04-26 21:57:42.000000000","message":"Remove this, it\u0027s here for debugging why this test is failing.","commit_id":"ff7b0cea791435ef0ae19b328be2bc51c13d87f8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"16b80e88e514e075fd5ea68092fa15ac97a51b86","unresolved":false,"context_lines":[{"line_number":474,"context_line":"class TestPlacementFixture(testtools.TestCase):"},{"line_number":475,"context_line":"    def setUp(self):"},{"line_number":476,"context_line":"        super(TestPlacementFixture, self).setUp()"},{"line_number":477,"context_line":"        # We need ConfFixture since PlacementPolicyFixture reads from config."},{"line_number":478,"context_line":"        self.useFixture(conf_fixture.ConfFixture())"},{"line_number":479,"context_line":"        # We need PlacementPolicyFixture because placement-api checks policy."},{"line_number":480,"context_line":"        self.useFixture(policy_fixture.PlacementPolicyFixture())"}],"source_content_type":"text/x-python","patch_set":4,"id":"9f6a8fd7_ccbfc1ce","line":477,"range":{"start_line":477,"start_character":10,"end_line":477,"end_character":77},"updated":"2018-04-27 00:05:27.000000000","message":"Add this to the docstring for PlacementPolicyFixture.","commit_id":"25f848ea741f9c0937e8d524edb8b8d2f3b3349d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"fd95c2cb4b5aaf0161fcd60dc7ea9251135d37f5","unresolved":false,"context_lines":[{"line_number":474,"context_line":"class TestPlacementFixture(testtools.TestCase):"},{"line_number":475,"context_line":"    def setUp(self):"},{"line_number":476,"context_line":"        super(TestPlacementFixture, self).setUp()"},{"line_number":477,"context_line":"        # We need ConfFixture since PlacementPolicyFixture reads from config."},{"line_number":478,"context_line":"        self.useFixture(conf_fixture.ConfFixture())"},{"line_number":479,"context_line":"        # We need PlacementPolicyFixture because placement-api checks policy."},{"line_number":480,"context_line":"        self.useFixture(policy_fixture.PlacementPolicyFixture())"}],"source_content_type":"text/x-python","patch_set":4,"id":"9f6a8fd7_734bc5af","line":477,"range":{"start_line":477,"start_character":10,"end_line":477,"end_character":77},"in_reply_to":"9f6a8fd7_ccbfc1ce","updated":"2018-04-30 14:26:11.000000000","message":"Done","commit_id":"25f848ea741f9c0937e8d524edb8b8d2f3b3349d"}],"releasenotes/notes/bp-granular-placement-policy-65722fc6d7cb1359.yaml":[{"author":{"_account_id":14070,"name":"Eric Fried","email":"openstack@fried.cc","username":"efried"},"change_message_id":"fd8bba4d7d348519ed6503614ae344357e06c333","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    It is now possible to configure granular policy rules for placement"}],"source_content_type":"text/x-yaml","patch_set":15,"id":"5f7c97a3_299d150a","line":1,"updated":"2018-05-16 22:30:22.000000000","message":"should this mention the subset of endpoints for which this is currently implemented (and then be updated in subsequent patches as you add those to the mix)?","commit_id":"f605474b80d6882006628b7a5abea9f74f9b8908"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"5c415a2c9d1a8b5997c4c7138ba9bb37656b6d1a","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    It is now possible to configure granular policy rules for placement"}],"source_content_type":"text/x-yaml","patch_set":15,"id":"5f7c97a3_f21618f2","line":1,"in_reply_to":"5f7c97a3_299d150a","updated":"2018-05-17 14:55:28.000000000","message":"I don\u0027t really want to do that here in the release note because the release note links to the docs and the docs are going to be updated as the granular rules get added, so I can avoid the duplicate work of documenting all of this.","commit_id":"f605474b80d6882006628b7a5abea9f74f9b8908"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"8242145b2d18888e334c8c1b3063e598697b29b7","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"    For more information about placement policy including a sample file, see"},{"line_number":29,"context_line":"    the configuration reference documentation:"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"    https://docs.openstack.org/nova/latest/configuration/index.html#placement-policy"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"5f7c97a3_9ba2a5fb","line":30,"range":{"start_line":30,"start_character":0,"end_line":30,"end_character":0},"updated":"2018-05-31 05:14:58.000000000","message":"along with this, should we add the new policy rules addition explicitly also which are going to be introduced in current patch like rules in /policies/resource_provider.py in this patch.","commit_id":"0a461979df62cd1df2c807b3f4fb3593b3040d13"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"33ede994d69ca96bd90179633ae6b9ca372f0fc3","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"    For more information about placement policy including a sample file, see"},{"line_number":29,"context_line":"    the configuration reference documentation:"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"    https://docs.openstack.org/nova/latest/configuration/index.html#placement-policy"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"5f7c97a3_b80bda7a","line":30,"range":{"start_line":30,"start_character":0,"end_line":30,"end_character":0},"in_reply_to":"5f7c97a3_9ba2a5fb","updated":"2018-05-31 18:03:11.000000000","message":"No, I don\u0027t want to do that since it\u0027s in the docs, which I\u0027ve already linked to in the release note.","commit_id":"0a461979df62cd1df2c807b3f4fb3593b3040d13"}],"setup.cfg":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"463b91c895b96fc93fa120c35a3d2a81dd538657","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"oslo.policy.enforcer \u003d"},{"line_number":42,"context_line":"    nova \u003d nova.policy:get_enforcer"},{"line_number":43,"context_line":"    placement \u003d nova.policy:get_enforcer"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"oslo.policy.policies \u003d"},{"line_number":46,"context_line":"    # The sample policies will be ordered by entry point and then by list"}],"source_content_type":"text/x-ttcn-cfg","patch_set":3,"id":"9f6a8fd7_a5e065ce","line":43,"updated":"2018-04-26 21:57:42.000000000","message":"This needs to change.","commit_id":"ff7b0cea791435ef0ae19b328be2bc51c13d87f8"}],"tox.ini":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e7510b0eac12149f4efea03775b4a539c094f7e2","unresolved":false,"context_lines":[{"line_number":102,"context_line":"[testenv:genpolicy]"},{"line_number":103,"context_line":"commands \u003d oslopolicy-sample-generator --config-file\u003detc/nova/nova-policy-generator.conf"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"[testenv:genplacementpolicy]"},{"line_number":106,"context_line":"commands \u003d oslopolicy-sample-generator --config-file\u003detc/nova/placement-policy-generator.conf"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"[testenv:cover]"}],"source_content_type":"text/x-properties","patch_set":1,"id":"ff82abbf_ea4dc9c4","line":105,"updated":"2017-11-30 23:11:47.000000000","message":"This generates something like this:\n\n\nuser@ubuntu:~/git/nova$ cat etc/nova/placement-policy.yaml.sample\n# Decides what is required for the \u0027is_admin:True\u0027 check to succeed.\n#\"context_is_admin\": \"role:admin\"\n\n# Default rule for most Admin APIs.\n#\"admin_api\": \"is_admin:True\"\n\nuser@ubuntu:~/git/nova$","commit_id":"529205af09a2de22036e508ad979929f8dfc22a1"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e7510b0eac12149f4efea03775b4a539c094f7e2","unresolved":false,"context_lines":[{"line_number":103,"context_line":"commands \u003d oslopolicy-sample-generator --config-file\u003detc/nova/nova-policy-generator.conf"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"[testenv:genplacementpolicy]"},{"line_number":106,"context_line":"commands \u003d oslopolicy-sample-generator --config-file\u003detc/nova/placement-policy-generator.conf"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"[testenv:cover]"},{"line_number":109,"context_line":"# Also do not run test_coverage_ext tests while gathering coverage as those"}],"source_content_type":"text/x-properties","patch_set":1,"id":"ff82abbf_2a541154","line":106,"range":{"start_line":106,"start_character":11,"end_line":106,"end_character":38},"updated":"2017-11-30 23:11:47.000000000","message":"Why doesn\u0027t \"oslopolicy-policy-generator\" work?","commit_id":"529205af09a2de22036e508ad979929f8dfc22a1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"45e4e2cbd51d6f45c65e747cc8e357a0845b871b","unresolved":false,"context_lines":[{"line_number":103,"context_line":"commands \u003d oslopolicy-sample-generator --config-file\u003detc/nova/nova-policy-generator.conf"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"[testenv:genplacementpolicy]"},{"line_number":106,"context_line":"commands \u003d oslopolicy-sample-generator --config-file\u003detc/nova/placement-policy-generator.conf"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"[testenv:cover]"},{"line_number":109,"context_line":"# Also do not run test_coverage_ext tests while gathering coverage as those"}],"source_content_type":"text/x-properties","patch_set":1,"id":"9f6a8fd7_86bea6d2","line":106,"range":{"start_line":106,"start_character":11,"end_line":106,"end_character":38},"in_reply_to":"ff82abbf_2a541154","updated":"2018-04-25 19:45:39.000000000","message":"I was able to get this to work after pip installing nova (to get the namespace stuff figured out).\n\nhttp://paste.openstack.org/show/719954/","commit_id":"529205af09a2de22036e508ad979929f8dfc22a1"}]}