)]}'
{"nova/policies/extended_availability_zone.py":[{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"906c30a8757fce8164b14ab97e9353b1148a34db","unresolved":false,"context_lines":[{"line_number":41,"context_line":"            \u0027Nova API extension concept has been removed in Pike. Those \u0027"},{"line_number":42,"context_line":"            \u0027extensions have their own policies enforcement. As there is \u0027"},{"line_number":43,"context_line":"            \u0027no extensions now, \"os_compute_api:os-extended-availability-zone\"\u0027"},{"line_number":44,"context_line":"            \u0027 policy which was added for extensions is not needed any more\u0027"},{"line_number":45,"context_line":"        ),"},{"line_number":46,"context_line":"        deprecated_since\u003d\u002717.0.0\u0027),"},{"line_number":47,"context_line":"]"}],"source_content_type":"text/x-python","patch_set":3,"id":"bf8cb3f7_75d20a37","line":44,"range":{"start_line":44,"start_character":13,"end_line":44,"end_character":14},"updated":"2017-12-20 17:27:39.000000000","message":"Just this one time :)","commit_id":"f2d18c2e9989f007a6576be6c9a6fcc5bcd67322"}],"nova/policies/keypairs.py":[{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"a24a35045c460c77f85d3c2f5a22f8381bf3a305","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        deprecated_reason\u003d("},{"line_number":82,"context_line":"            \u0027Nova API extension concept has been removed in Pike. Those \u0027"},{"line_number":83,"context_line":"            \u0027extensions have their own policies enforcement. As there is \u0027"},{"line_number":84,"context_line":"            \u0027no extensions now, \"os_compute_api:os-keypairs\" policy \u0027"},{"line_number":85,"context_line":"            \u0027which was added for extensions is not needed any more\u0027"},{"line_number":86,"context_line":"        ),"},{"line_number":87,"context_line":"        deprecated_since\u003d\u002717.0.0\u0027),"}],"source_content_type":"text/x-python","patch_set":3,"id":"df87a7cf_ebbd5dd8","line":84,"range":{"start_line":84,"start_character":33,"end_line":84,"end_character":68},"updated":"2017-12-07 07:32:43.000000000","message":"I am not sure whether we need follow\nhttps://review.openstack.org/#/c/526258/3/nova/policies/flavor_access.py\n\nto add something like os-keypairs policy only deprecated in server extenstion related not the os-keypairs itself\nas we should need it to controler keypair management such as create / delete keypair.","commit_id":"f2d18c2e9989f007a6576be6c9a6fcc5bcd67322"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"2149246c4dc18b7172a40a366e76e1da85077b29","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        deprecated_reason\u003d("},{"line_number":82,"context_line":"            \u0027Nova API extension concept has been removed in Pike. Those \u0027"},{"line_number":83,"context_line":"            \u0027extensions have their own policies enforcement. As there is \u0027"},{"line_number":84,"context_line":"            \u0027no extensions now, \"os_compute_api:os-keypairs\" policy \u0027"},{"line_number":85,"context_line":"            \u0027which was added for extensions is not needed any more\u0027"},{"line_number":86,"context_line":"        ),"},{"line_number":87,"context_line":"        deprecated_since\u003d\u002717.0.0\u0027),"}],"source_content_type":"text/x-python","patch_set":3,"id":"df87a7cf_6642e440","line":84,"range":{"start_line":84,"start_character":33,"end_line":84,"end_character":68},"in_reply_to":"df87a7cf_0b38c1ec","updated":"2017-12-07 08:15:26.000000000","message":"ok, thanks for info , the :index and :create make sense","commit_id":"f2d18c2e9989f007a6576be6c9a6fcc5bcd67322"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"5cb12d23ad3ac6626ded2985eb3bd6e1f05f7200","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        deprecated_reason\u003d("},{"line_number":82,"context_line":"            \u0027Nova API extension concept has been removed in Pike. Those \u0027"},{"line_number":83,"context_line":"            \u0027extensions have their own policies enforcement. As there is \u0027"},{"line_number":84,"context_line":"            \u0027no extensions now, \"os_compute_api:os-keypairs\" policy \u0027"},{"line_number":85,"context_line":"            \u0027which was added for extensions is not needed any more\u0027"},{"line_number":86,"context_line":"        ),"},{"line_number":87,"context_line":"        deprecated_since\u003d\u002717.0.0\u0027),"}],"source_content_type":"text/x-python","patch_set":3,"id":"df87a7cf_0b38c1ec","line":84,"range":{"start_line":84,"start_character":33,"end_line":84,"end_character":68},"in_reply_to":"df87a7cf_ebbd5dd8","updated":"2017-12-07 08:07:27.000000000","message":"No, we have different policy for them which is \u0027os_compute_api:os-keypairs:index\u0027, \u0027os_compute_api:os-keypairs:create\u0027 which is different than this policy.\n\nFlavor_access case was where same policy was enforced other API also.","commit_id":"f2d18c2e9989f007a6576be6c9a6fcc5bcd67322"}],"nova/policies/security_groups.py":[{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"2f668756b3b0216f818c752eee02d59dd69837be","unresolved":false,"context_lines":[{"line_number":57,"context_line":"            \u0027method\u0027: \u0027DELETE\u0027,"},{"line_number":58,"context_line":"            \u0027path\u0027: \u0027/os-security-groups/{security_group_id}\u0027"},{"line_number":59,"context_line":"        },"},{"line_number":60,"context_line":"        {"},{"line_number":61,"context_line":"            \u0027method\u0027: \u0027GET\u0027,"},{"line_number":62,"context_line":"            \u0027path\u0027: \u0027/servers/{server_id}/os-security-groups\u0027"},{"line_number":63,"context_line":"        },"},{"line_number":64,"context_line":"        {"},{"line_number":65,"context_line":"            \u0027method\u0027: \u0027POST\u0027,"},{"line_number":66,"context_line":"            \u0027path\u0027: \u0027/servers/{server_id}/action (addSecurityGroup)\u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"df87a7cf_cb0e463a","line":63,"range":{"start_line":60,"start_character":8,"end_line":63,"end_character":10},"updated":"2017-12-19 03:26:21.000000000","message":"If the admin denied a role to access this API, but after the policy check is removed from \u0027GET /servers\u0027, that role still can get the security group info from \u0027GET /servers\u0027 API, that sounds a break use-case?","commit_id":"f2d18c2e9989f007a6576be6c9a6fcc5bcd67322"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"4d0875cf40663ad1b299c26a020aadb7c8843585","unresolved":false,"context_lines":[{"line_number":57,"context_line":"            \u0027method\u0027: \u0027DELETE\u0027,"},{"line_number":58,"context_line":"            \u0027path\u0027: \u0027/os-security-groups/{security_group_id}\u0027"},{"line_number":59,"context_line":"        },"},{"line_number":60,"context_line":"        {"},{"line_number":61,"context_line":"            \u0027method\u0027: \u0027GET\u0027,"},{"line_number":62,"context_line":"            \u0027path\u0027: \u0027/servers/{server_id}/os-security-groups\u0027"},{"line_number":63,"context_line":"        },"},{"line_number":64,"context_line":"        {"},{"line_number":65,"context_line":"            \u0027method\u0027: \u0027POST\u0027,"},{"line_number":66,"context_line":"            \u0027path\u0027: \u0027/servers/{server_id}/action (addSecurityGroup)\u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f91af0f_cf56c907","line":63,"range":{"start_line":60,"start_character":8,"end_line":63,"end_character":10},"in_reply_to":"9f91af0f_843bc8cf","updated":"2018-01-02 07:15:58.000000000","message":"Gmann reminds me that we only expose the sec_group name in the server API also, there is no detail about sec group in the server API. So I think it is fine.","commit_id":"f2d18c2e9989f007a6576be6c9a6fcc5bcd67322"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"e0860176e0ba24e886171bb28c7f57869719c793","unresolved":false,"context_lines":[{"line_number":57,"context_line":"            \u0027method\u0027: \u0027DELETE\u0027,"},{"line_number":58,"context_line":"            \u0027path\u0027: \u0027/os-security-groups/{security_group_id}\u0027"},{"line_number":59,"context_line":"        },"},{"line_number":60,"context_line":"        {"},{"line_number":61,"context_line":"            \u0027method\u0027: \u0027GET\u0027,"},{"line_number":62,"context_line":"            \u0027path\u0027: \u0027/servers/{server_id}/os-security-groups\u0027"},{"line_number":63,"context_line":"        },"},{"line_number":64,"context_line":"        {"},{"line_number":65,"context_line":"            \u0027method\u0027: \u0027POST\u0027,"},{"line_number":66,"context_line":"            \u0027path\u0027: \u0027/servers/{server_id}/action (addSecurityGroup)\u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f91af0f_843bc8cf","line":63,"range":{"start_line":60,"start_character":8,"end_line":63,"end_character":10},"in_reply_to":"9f91af0f_88d77b24","updated":"2018-01-02 05:25:11.000000000","message":"I think it is fine for other APIs, for example, the keypairs, the extended field in the servers API is only the key name, there is no detail for other keypair detail info. For the flavor_access, the extended field in the flavor API is only the \u0027is_public\u0027 field, not the flavor_access info.  So I think it is fine for other APIs.","commit_id":"f2d18c2e9989f007a6576be6c9a6fcc5bcd67322"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"773fba8e2ce86707afc447987e3fbad3e5ec03bf","unresolved":false,"context_lines":[{"line_number":57,"context_line":"            \u0027method\u0027: \u0027DELETE\u0027,"},{"line_number":58,"context_line":"            \u0027path\u0027: \u0027/os-security-groups/{security_group_id}\u0027"},{"line_number":59,"context_line":"        },"},{"line_number":60,"context_line":"        {"},{"line_number":61,"context_line":"            \u0027method\u0027: \u0027GET\u0027,"},{"line_number":62,"context_line":"            \u0027path\u0027: \u0027/servers/{server_id}/os-security-groups\u0027"},{"line_number":63,"context_line":"        },"},{"line_number":64,"context_line":"        {"},{"line_number":65,"context_line":"            \u0027method\u0027: \u0027POST\u0027,"},{"line_number":66,"context_line":"            \u0027path\u0027: \u0027/servers/{server_id}/action (addSecurityGroup)\u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"9f91af0f_88d77b24","line":63,"range":{"start_line":60,"start_character":8,"end_line":63,"end_character":10},"in_reply_to":"df87a7cf_cb0e463a","updated":"2017-12-28 06:34:43.000000000","message":"yea that is true for other policy case also. I think deprecation period will be giving them the time to move that policy restriction. \n\nI feel, removing Policy control over sec group in GET /servers should not be issue.","commit_id":"f2d18c2e9989f007a6576be6c9a6fcc5bcd67322"}],"releasenotes/notes/deprecate-api-extensions-policies-5613bc4eea59709d.yaml":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"941a6f2de6bcf90b670b500fae13f4bc145ebef3","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"    - Show \u0026 List detail server"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"        - \u0027os_compute_api:os-config-drive\u0027"},{"line_number":12,"context_line":"        - \u0027os_compute_api:os-extended-availability-zone\u0027"},{"line_number":13,"context_line":"        - \u0027os_compute_api:os-extended-status\u0027"},{"line_number":14,"context_line":"        - \u0027os_compute_api:os-extended-volumes\u0027"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"9f91af0f_f99ed261","line":11,"range":{"start_line":11,"start_character":6,"end_line":11,"end_character":8},"updated":"2018-01-03 23:47:20.000000000","message":"These should be aligned with \"Show\" above otherwise you get this weird formatting:\n\nhttp://logs.openstack.org/58/526258/3/check/build-openstack-releasenotes/c5101bb/html/unreleased.html#deprecation-notes","commit_id":"f2d18c2e9989f007a6576be6c9a6fcc5bcd67322"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"862e78fef5d80f2113f5afcca46e2fe52e2f903a","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"    - Show \u0026 List detail server"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"        - \u0027os_compute_api:os-config-drive\u0027"},{"line_number":12,"context_line":"        - \u0027os_compute_api:os-extended-availability-zone\u0027"},{"line_number":13,"context_line":"        - \u0027os_compute_api:os-extended-status\u0027"},{"line_number":14,"context_line":"        - \u0027os_compute_api:os-extended-volumes\u0027"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"9f91af0f_af179c51","line":11,"range":{"start_line":11,"start_character":6,"end_line":11,"end_character":8},"in_reply_to":"9f91af0f_f99ed261","updated":"2018-01-04 02:39:49.000000000","message":"https://review.openstack.org/#/c/531061/","commit_id":"f2d18c2e9989f007a6576be6c9a6fcc5bcd67322"}]}