)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"0c54bf564870d0c0bdde6e7093dd99d9c4319a21","unresolved":false,"context_lines":[{"line_number":25,"context_line":"  - Keep enforcing the old rules with same default for deprecation period"},{"line_number":26,"context_line":"  - Give warning for user about switching to old rules to new rules"},{"line_number":27,"context_line":"  - Note we will enforce the old rules as it is till deprecation period and"},{"line_number":28,"context_line":"    new rule as soft enforcement only as it should not effect any user for"},{"line_number":29,"context_line":"    deprecation period"},{"line_number":30,"context_line":"  - After deprecation period. we will remove the old rules and keep enforcing"},{"line_number":31,"context_line":"      the new rules only"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"5f7c97a3_992b967a","line":28,"range":{"start_line":28,"start_character":55,"end_line":28,"end_character":61},"updated":"2018-07-07 18:47:59.000000000","message":"affect","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"6b912e83606fd4693077e2d3623a45db66fcb642","unresolved":false,"context_lines":[{"line_number":25,"context_line":"  - Keep enforcing the old rules with same default for deprecation period"},{"line_number":26,"context_line":"  - Give warning for user about switching to old rules to new rules"},{"line_number":27,"context_line":"  - Note we will enforce the old rules as it is till deprecation period and"},{"line_number":28,"context_line":"    new rule as soft enforcement only as it should not effect any user for"},{"line_number":29,"context_line":"    deprecation period"},{"line_number":30,"context_line":"  - After deprecation period. we will remove the old rules and keep enforcing"},{"line_number":31,"context_line":"      the new rules only"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"5f7c97a3_29f8da47","line":28,"range":{"start_line":28,"start_character":55,"end_line":28,"end_character":61},"in_reply_to":"5f7c97a3_992b967a","updated":"2018-07-10 20:58:09.000000000","message":"Done","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"0c54bf564870d0c0bdde6e7093dd99d9c4319a21","unresolved":false,"context_lines":[{"line_number":27,"context_line":"  - Note we will enforce the old rules as it is till deprecation period and"},{"line_number":28,"context_line":"    new rule as soft enforcement only as it should not effect any user for"},{"line_number":29,"context_line":"    deprecation period"},{"line_number":30,"context_line":"  - After deprecation period. we will remove the old rules and keep enforcing"},{"line_number":31,"context_line":"      the new rules only"},{"line_number":32,"context_line":"~"},{"line_number":33,"context_line":"Closes-Bug: #1778994"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"5f7c97a3_7930fae9","line":30,"range":{"start_line":30,"start_character":28,"end_line":30,"end_character":29},"updated":"2018-07-07 18:47:59.000000000","message":",","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"6b912e83606fd4693077e2d3623a45db66fcb642","unresolved":false,"context_lines":[{"line_number":27,"context_line":"  - Note we will enforce the old rules as it is till deprecation period and"},{"line_number":28,"context_line":"    new rule as soft enforcement only as it should not effect any user for"},{"line_number":29,"context_line":"    deprecation period"},{"line_number":30,"context_line":"  - After deprecation period. we will remove the old rules and keep enforcing"},{"line_number":31,"context_line":"      the new rules only"},{"line_number":32,"context_line":"~"},{"line_number":33,"context_line":"Closes-Bug: #1778994"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"5f7c97a3_49f3d66d","line":30,"range":{"start_line":30,"start_character":28,"end_line":30,"end_character":29},"in_reply_to":"5f7c97a3_7930fae9","updated":"2018-07-10 20:58:09.000000000","message":"Done","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"0c54bf564870d0c0bdde6e7093dd99d9c4319a21","unresolved":false,"context_lines":[{"line_number":29,"context_line":"    deprecation period"},{"line_number":30,"context_line":"  - After deprecation period. we will remove the old rules and keep enforcing"},{"line_number":31,"context_line":"      the new rules only"},{"line_number":32,"context_line":"~"},{"line_number":33,"context_line":"Closes-Bug: #1778994"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Change-Id: Ie8579300792d3ceab1e5c37eade47e599207666f"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"5f7c97a3_1920e699","line":32,"range":{"start_line":32,"start_character":0,"end_line":32,"end_character":1},"updated":"2018-07-07 18:47:59.000000000","message":"Remove","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"6b912e83606fd4693077e2d3623a45db66fcb642","unresolved":false,"context_lines":[{"line_number":29,"context_line":"    deprecation period"},{"line_number":30,"context_line":"  - After deprecation period. we will remove the old rules and keep enforcing"},{"line_number":31,"context_line":"      the new rules only"},{"line_number":32,"context_line":"~"},{"line_number":33,"context_line":"Closes-Bug: #1778994"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Change-Id: Ie8579300792d3ceab1e5c37eade47e599207666f"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"5f7c97a3_e993c2fe","line":32,"range":{"start_line":32,"start_character":0,"end_line":32,"end_character":1},"in_reply_to":"5f7c97a3_1920e699","updated":"2018-07-10 20:58:09.000000000","message":"Done","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"0c54bf564870d0c0bdde6e7093dd99d9c4319a21","unresolved":false,"context_lines":[{"line_number":31,"context_line":"      the new rules only"},{"line_number":32,"context_line":"~"},{"line_number":33,"context_line":"Closes-Bug: #1778994"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Change-Id: Ie8579300792d3ceab1e5c37eade47e599207666f"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"5f7c97a3_b93a12ca","line":34,"updated":"2018-07-07 18:47:59.000000000","message":"Partially Implements: bp granular-api-policy","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"6b912e83606fd4693077e2d3623a45db66fcb642","unresolved":false,"context_lines":[{"line_number":31,"context_line":"      the new rules only"},{"line_number":32,"context_line":"~"},{"line_number":33,"context_line":"Closes-Bug: #1778994"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Change-Id: Ie8579300792d3ceab1e5c37eade47e599207666f"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"5f7c97a3_09971eed","line":34,"in_reply_to":"5f7c97a3_b93a12ca","updated":"2018-07-10 20:58:09.000000000","message":"Done","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"9ac7f02eef16140acc68e5c268eb3342235740f5","unresolved":false,"context_lines":[{"line_number":31,"context_line":"    the new rules only"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Closes-Bug: #1778994"},{"line_number":34,"context_line":"Partially Implements: bp granular-api-policy"},{"line_number":35,"context_line":"Change-Id: Ie8579300792d3ceab1e5c37eade47e599207666f"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"5f7c97a3_81686688","line":34,"range":{"start_line":34,"start_character":0,"end_line":34,"end_character":44},"updated":"2018-07-26 02:05:24.000000000","message":"As a side note I don\u0027t know if it\u0027s possible to implement a non-approved spec, so depending on what others say this may or may not apply contrary to what I said later, depending on when this should be merged","commit_id":"13e73cb7490fd74583c91b99dad288cd891dce59"}],"nova/api/openstack/compute/services.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"0c54bf564870d0c0bdde6e7093dd99d9c4319a21","unresolved":false,"context_lines":[{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        return {\u0027services\u0027: _services}"},{"line_number":279,"context_line":""},{"line_number":280,"context_line":"    @wsgi.Controller.api_version(\u00272.1\u0027, \u00272.52\u0027)"},{"line_number":281,"context_line":"    @wsgi.expected_errors((400, 404))"},{"line_number":282,"context_line":"    @validation.schema(services.service_update, \u00272.0\u0027, \u00272.10\u0027)"},{"line_number":283,"context_line":"    @validation.schema(services.service_update_v211, \u00272.11\u0027, \u00272.52\u0027)"}],"source_content_type":"text/x-python","patch_set":4,"id":"5f7c97a3_b968d2b9","line":280,"range":{"start_line":280,"start_character":4,"end_line":280,"end_character":47},"updated":"2018-07-07 18:47:59.000000000","message":"From what I can tell this is called for microversions 2.1-2.52.\n\nThus, what this means is that for older microversions none of the policy granularity is being implemented. This API appears to call _disable, _enable, _force_down, and _disable_log_reason and none of those do policy checks.\n\nHowever, _disable_log_reason is superseded in microversion 2.53 so I don\u0027t know whether granularity should be added for that: \"Starting with microversion 2.53 this API is superseded by PUT /os-services/{service_id}\". \n\nhttps://developer.openstack.org/api-ref/compute/#disable-scheduling-for-a-compute-service-and-log-disabled-reason","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"6b912e83606fd4693077e2d3623a45db66fcb642","unresolved":false,"context_lines":[{"line_number":277,"context_line":""},{"line_number":278,"context_line":"        return {\u0027services\u0027: _services}"},{"line_number":279,"context_line":""},{"line_number":280,"context_line":"    @wsgi.Controller.api_version(\u00272.1\u0027, \u00272.52\u0027)"},{"line_number":281,"context_line":"    @wsgi.expected_errors((400, 404))"},{"line_number":282,"context_line":"    @validation.schema(services.service_update, \u00272.0\u0027, \u00272.10\u0027)"},{"line_number":283,"context_line":"    @validation.schema(services.service_update_v211, \u00272.11\u0027, \u00272.52\u0027)"}],"source_content_type":"text/x-python","patch_set":4,"id":"5f7c97a3_b14bf45c","line":280,"range":{"start_line":280,"start_character":4,"end_line":280,"end_character":47},"in_reply_to":"5f7c97a3_b968d2b9","updated":"2018-07-10 20:58:09.000000000","message":"It does do a policy check in the \"_perform_action\" method, but you are right in the sense that there is no granularity there - it only checks a single policy action for all updates. If policy granularity is needed for older microversions, I can work on that.","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"0c54bf564870d0c0bdde6e7093dd99d9c4319a21","unresolved":false,"context_lines":[{"line_number":297,"context_line":""},{"line_number":298,"context_line":"        return self._perform_action(req, id, body, actions)"},{"line_number":299,"context_line":""},{"line_number":300,"context_line":"    @wsgi.Controller.api_version(UUID_FOR_ID_MIN_VERSION)  # noqa F811"},{"line_number":301,"context_line":"    @wsgi.expected_errors((400, 404))"},{"line_number":302,"context_line":"    @validation.schema(services.service_update_v2_53, UUID_FOR_ID_MIN_VERSION)"},{"line_number":303,"context_line":"    def update(self, req, id, body):"}],"source_content_type":"text/x-python","patch_set":4,"id":"5f7c97a3_196ea6c7","line":300,"range":{"start_line":300,"start_character":4,"end_line":300,"end_character":70},"updated":"2018-07-07 18:47:59.000000000","message":"From what I can tell this is called for microversions 2.53+","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"6b912e83606fd4693077e2d3623a45db66fcb642","unresolved":false,"context_lines":[{"line_number":297,"context_line":""},{"line_number":298,"context_line":"        return self._perform_action(req, id, body, actions)"},{"line_number":299,"context_line":""},{"line_number":300,"context_line":"    @wsgi.Controller.api_version(UUID_FOR_ID_MIN_VERSION)  # noqa F811"},{"line_number":301,"context_line":"    @wsgi.expected_errors((400, 404))"},{"line_number":302,"context_line":"    @validation.schema(services.service_update_v2_53, UUID_FOR_ID_MIN_VERSION)"},{"line_number":303,"context_line":"    def update(self, req, id, body):"}],"source_content_type":"text/x-python","patch_set":4,"id":"5f7c97a3_d138f09f","line":300,"range":{"start_line":300,"start_character":4,"end_line":300,"end_character":70},"in_reply_to":"5f7c97a3_196ea6c7","updated":"2018-07-10 20:58:09.000000000","message":"That is correct. When I specify the microversion 2.53+ in the CLI, I see in the logs that the new policy action is being soft enforced. If I specify anything between 2.1 - 2.52, then as mentioned before only a single policy action is being enforced.","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"31d4e6a15e436b37b31cc3807077f89842f039b7","unresolved":false,"context_lines":[{"line_number":46,"context_line":"                        \"disable-log-reason\": self._disable_log_reason}"},{"line_number":47,"context_line":"        self.placementclient \u003d report.SchedulerReportClient()"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    def perform_policy_check(self, context, action):"},{"line_number":50,"context_line":"        \"\"\"Perform policy check and enforce the action being deprecated\"\"\""},{"line_number":51,"context_line":"        # TODO(rb560u): old policy action is being removed in future release,"},{"line_number":52,"context_line":"        # so update policy check to use new action in the future. Policy"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_0da93cdd","line":49,"range":{"start_line":49,"start_character":8,"end_line":49,"end_character":28},"updated":"2018-07-11 09:31:07.000000000","message":"nit: can add a _ as prefix","commit_id":"dee182e188fd223aa9312bb33cbbd5d1f84be3be"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"f712db2614941abb502b19caf1eb4b2440bed986","unresolved":false,"context_lines":[{"line_number":46,"context_line":"                        \"disable-log-reason\": self._disable_log_reason}"},{"line_number":47,"context_line":"        self.placementclient \u003d report.SchedulerReportClient()"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    def perform_policy_check(self, context, action):"},{"line_number":50,"context_line":"        \"\"\"Perform policy check and enforce the action being deprecated\"\"\""},{"line_number":51,"context_line":"        # TODO(rb560u): old policy action is being removed in future release,"},{"line_number":52,"context_line":"        # so update policy check to use new action in the future. Policy"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_0ca0f0a3","line":49,"range":{"start_line":49,"start_character":8,"end_line":49,"end_character":28},"in_reply_to":"5f7c97a3_0da93cdd","updated":"2018-07-16 20:21:00.000000000","message":"Done","commit_id":"dee182e188fd223aa9312bb33cbbd5d1f84be3be"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"62fc6d1abb6465ebc7880e07c818b3f060431e51","unresolved":false,"context_lines":[{"line_number":313,"context_line":"            msg \u003d _(\u0027Invalid uuid %s\u0027) % service_id"},{"line_number":314,"context_line":"            raise webob.exc.HTTPBadRequest(explanation\u003dmsg)"},{"line_number":315,"context_line":""},{"line_number":316,"context_line":"        # request context to validate against the policy."},{"line_number":317,"context_line":"        context \u003d req.environ[\u0027nova.context\u0027]"},{"line_number":318,"context_line":""},{"line_number":319,"context_line":"        # Get the service by uuid."},{"line_number":320,"context_line":"        try:"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_75ef6886","line":317,"range":{"start_line":316,"start_character":0,"end_line":317,"end_character":45},"updated":"2018-07-10 21:06:30.000000000","message":"not sure if it is better to do a policy check before checking if a valid service is found?  That is how it was done originally.","commit_id":"dee182e188fd223aa9312bb33cbbd5d1f84be3be"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"31d4e6a15e436b37b31cc3807077f89842f039b7","unresolved":false,"context_lines":[{"line_number":313,"context_line":"            msg \u003d _(\u0027Invalid uuid %s\u0027) % service_id"},{"line_number":314,"context_line":"            raise webob.exc.HTTPBadRequest(explanation\u003dmsg)"},{"line_number":315,"context_line":""},{"line_number":316,"context_line":"        # request context to validate against the policy."},{"line_number":317,"context_line":"        context \u003d req.environ[\u0027nova.context\u0027]"},{"line_number":318,"context_line":""},{"line_number":319,"context_line":"        # Get the service by uuid."},{"line_number":320,"context_line":"        try:"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_d28c45da","line":317,"range":{"start_line":316,"start_character":0,"end_line":317,"end_character":45},"in_reply_to":"5f7c97a3_75ef6886","updated":"2018-07-11 09:31:07.000000000","message":"this may change behavior a little bit \noriginally not authorized user will get a 403 when finding a non-existing service and now got a 404\npersonally think should be ok","commit_id":"dee182e188fd223aa9312bb33cbbd5d1f84be3be"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"f712db2614941abb502b19caf1eb4b2440bed986","unresolved":false,"context_lines":[{"line_number":313,"context_line":"            msg \u003d _(\u0027Invalid uuid %s\u0027) % service_id"},{"line_number":314,"context_line":"            raise webob.exc.HTTPBadRequest(explanation\u003dmsg)"},{"line_number":315,"context_line":""},{"line_number":316,"context_line":"        # request context to validate against the policy."},{"line_number":317,"context_line":"        context \u003d req.environ[\u0027nova.context\u0027]"},{"line_number":318,"context_line":""},{"line_number":319,"context_line":"        # Get the service by uuid."},{"line_number":320,"context_line":"        try:"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_4cbca8b4","line":317,"range":{"start_line":316,"start_character":0,"end_line":317,"end_character":45},"in_reply_to":"5f7c97a3_d28c45da","updated":"2018-07-16 20:21:00.000000000","message":"Ok thanks for the feedback. I will leave it as it is for now unless others believe it should change.","commit_id":"dee182e188fd223aa9312bb33cbbd5d1f84be3be"}],"nova/policies/services.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"1876379af1a446f46cff1a5b9dfefa80f7484e7d","unresolved":false,"context_lines":[{"line_number":75,"context_line":"            }"},{"line_number":76,"context_line":"        ]),"},{"line_number":77,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":78,"context_line":"        POLICY_ROOT % \u0027update\u0027,"},{"line_number":79,"context_line":"        BASE_POLICY_RULE,"},{"line_number":80,"context_line":"        \"Disable Scheduling For A Compute Service, \""},{"line_number":81,"context_line":"        \"Disable Scheduling For A Compute Service and Log Disabled Reason, \""}],"source_content_type":"text/x-python","patch_set":3,"id":"5f7c97a3_04856907","line":78,"updated":"2018-06-29 14:52:32.000000000","message":"I wonder if this is enough granularity after all. Some of these update actions are more \"destructive\" like forcing a service down than simply update a service description (assuming that\u0027s one of the things you can do with L105 API).","commit_id":"d96846d22dc15ef39e96de16a5a21284709b3fbd"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"1876379af1a446f46cff1a5b9dfefa80f7484e7d","unresolved":false,"context_lines":[{"line_number":77,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":78,"context_line":"        POLICY_ROOT % \u0027update\u0027,"},{"line_number":79,"context_line":"        BASE_POLICY_RULE,"},{"line_number":80,"context_line":"        \"Disable Scheduling For A Compute Service, \""},{"line_number":81,"context_line":"        \"Disable Scheduling For A Compute Service and Log Disabled Reason, \""},{"line_number":82,"context_line":"        \"Enable Scheduling For A Compute Service, \""},{"line_number":83,"context_line":"        \"Update Forced Down, \""}],"source_content_type":"text/x-python","patch_set":3,"id":"5f7c97a3_248bc517","line":80,"updated":"2018-06-29 14:52:32.000000000","message":"Why not phrase this the same way it\u0027s phrased on L31-35 for consistency? These descriptions below are also rather terse.","commit_id":"d96846d22dc15ef39e96de16a5a21284709b3fbd"}],"nova/policy.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"0c54bf564870d0c0bdde6e7093dd99d9c4319a21","unresolved":false,"context_lines":[{"line_number":252,"context_line":"                       \"removed in future release.\".format(new_policy,"},{"line_number":253,"context_line":"                                                           old_policy))"},{"line_number":254,"context_line":""},{"line_number":255,"context_line":"    def policy_check():"},{"line_number":256,"context_line":"        LOG.warning(deprecation_msg)"},{"line_number":257,"context_line":"        # soft enfoce new policy and continue to enforce old policy until"},{"line_number":258,"context_line":"        # the old policy is removed"}],"source_content_type":"text/x-python","patch_set":4,"id":"5f7c97a3_f9788a7e","line":255,"updated":"2018-07-07 18:47:59.000000000","message":"When the old_policy is finally removed after deprecation then it looks like context.can() will continue to perform soft authorization against new_policy. I would imagine the value of `fatal` below would be `not new_deprecation`, that is:\n\n    context.can(new_policy, fatal\u003d(not new_deprecation))\n\nbut then you still have the issue of double policy enforcement.","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"6b912e83606fd4693077e2d3623a45db66fcb642","unresolved":false,"context_lines":[{"line_number":252,"context_line":"                       \"removed in future release.\".format(new_policy,"},{"line_number":253,"context_line":"                                                           old_policy))"},{"line_number":254,"context_line":""},{"line_number":255,"context_line":"    def policy_check():"},{"line_number":256,"context_line":"        LOG.warning(deprecation_msg)"},{"line_number":257,"context_line":"        # soft enfoce new policy and continue to enforce old policy until"},{"line_number":258,"context_line":"        # the old policy is removed"}],"source_content_type":"text/x-python","patch_set":4,"id":"5f7c97a3_51386039","line":255,"in_reply_to":"5f7c97a3_f9788a7e","updated":"2018-07-10 20:58:09.000000000","message":"When the deprecated policy is removed, then it should perform policy enforcement as it does across Nova. The \"verify_deprecated_policy\" method will not be called anymore.  Example from https://review.openstack.org/#/c/578553/4/nova/api/openstack/compute/services.py -  would need to change from:\n\nself.perform_policy_check(context, \"index\")\n\nto:\n\ncontext.can(services_policies.POLICY_ROOT % \u0027index\u0027)\n\n\nWhen the old policy is removed there will be no soft authorization and no double enforcement.","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"0c54bf564870d0c0bdde6e7093dd99d9c4319a21","unresolved":false,"context_lines":[{"line_number":256,"context_line":"        LOG.warning(deprecation_msg)"},{"line_number":257,"context_line":"        # soft enfoce new policy and continue to enforce old policy until"},{"line_number":258,"context_line":"        # the old policy is removed"},{"line_number":259,"context_line":"        context.can(new_policy, fatal\u003dFalse)"},{"line_number":260,"context_line":"        context.can(old_policy)"},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"    if _ENFORCER:"}],"source_content_type":"text/x-python","patch_set":4,"id":"5f7c97a3_79b31a4f","line":259,"range":{"start_line":259,"start_character":8,"end_line":259,"end_character":44},"updated":"2018-07-07 18:47:59.000000000","message":"I don\u0027t understand why do soft authorization as this is basically a noop: nothing is being done with the result.","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"6b912e83606fd4693077e2d3623a45db66fcb642","unresolved":false,"context_lines":[{"line_number":256,"context_line":"        LOG.warning(deprecation_msg)"},{"line_number":257,"context_line":"        # soft enfoce new policy and continue to enforce old policy until"},{"line_number":258,"context_line":"        # the old policy is removed"},{"line_number":259,"context_line":"        context.can(new_policy, fatal\u003dFalse)"},{"line_number":260,"context_line":"        context.can(old_policy)"},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"    if _ENFORCER:"}],"source_content_type":"text/x-python","patch_set":4,"id":"5f7c97a3_71ac7c87","line":259,"range":{"start_line":259,"start_character":8,"end_line":259,"end_character":44},"in_reply_to":"5f7c97a3_79b31a4f","updated":"2018-07-10 20:58:09.000000000","message":"the policy check is still logged, so there may be some value in that","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"31d4e6a15e436b37b31cc3807077f89842f039b7","unresolved":false,"context_lines":[{"line_number":256,"context_line":"        LOG.warning(deprecation_msg)"},{"line_number":257,"context_line":"        # soft enfoce new policy and continue to enforce old policy until"},{"line_number":258,"context_line":"        # the old policy is removed"},{"line_number":259,"context_line":"        context.can(new_policy, fatal\u003dFalse)"},{"line_number":260,"context_line":"        context.can(old_policy)"},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"    if _ENFORCER:"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_cd5d8417","line":259,"range":{"start_line":259,"start_character":8,"end_line":259,"end_character":44},"updated":"2018-07-11 09:31:07.000000000","message":"if we won\u0027t raise exception, and don\u0027t check the value of soft check, what\u0027s the purpose to do it here?","commit_id":"dee182e188fd223aa9312bb33cbbd5d1f84be3be"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"edeaf6ced28a5548541ebf3ae37edab218008e5f","unresolved":false,"context_lines":[{"line_number":256,"context_line":"        LOG.warning(deprecation_msg)"},{"line_number":257,"context_line":"        # soft enfoce new policy and continue to enforce old policy until"},{"line_number":258,"context_line":"        # the old policy is removed"},{"line_number":259,"context_line":"        context.can(new_policy, fatal\u003dFalse)"},{"line_number":260,"context_line":"        context.can(old_policy)"},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"    if _ENFORCER:"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_1f66cbbd","line":259,"range":{"start_line":259,"start_character":8,"end_line":259,"end_character":44},"in_reply_to":"5f7c97a3_0cef9086","updated":"2018-07-17 04:29:37.000000000","message":"ok, you are saying this is for aduit purpose?","commit_id":"dee182e188fd223aa9312bb33cbbd5d1f84be3be"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"5e81cde0e65a52455c9d3c2fac88acb10e6aa2ab","unresolved":false,"context_lines":[{"line_number":256,"context_line":"        LOG.warning(deprecation_msg)"},{"line_number":257,"context_line":"        # soft enfoce new policy and continue to enforce old policy until"},{"line_number":258,"context_line":"        # the old policy is removed"},{"line_number":259,"context_line":"        context.can(new_policy, fatal\u003dFalse)"},{"line_number":260,"context_line":"        context.can(old_policy)"},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"    if _ENFORCER:"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_68dcd570","line":259,"range":{"start_line":259,"start_character":8,"end_line":259,"end_character":44},"in_reply_to":"5f7c97a3_1f66cbbd","updated":"2018-07-17 16:16:44.000000000","message":"yes for audit purpose","commit_id":"dee182e188fd223aa9312bb33cbbd5d1f84be3be"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"f712db2614941abb502b19caf1eb4b2440bed986","unresolved":false,"context_lines":[{"line_number":256,"context_line":"        LOG.warning(deprecation_msg)"},{"line_number":257,"context_line":"        # soft enfoce new policy and continue to enforce old policy until"},{"line_number":258,"context_line":"        # the old policy is removed"},{"line_number":259,"context_line":"        context.can(new_policy, fatal\u003dFalse)"},{"line_number":260,"context_line":"        context.can(old_policy)"},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"    if _ENFORCER:"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_0cef9086","line":259,"range":{"start_line":259,"start_character":8,"end_line":259,"end_character":44},"in_reply_to":"5f7c97a3_cd5d8417","updated":"2018-07-16 20:21:00.000000000","message":"Is there any value of having this policy enforcement logged but not enforced - I see some value in that? As that is what the soft enforcement is doing.","commit_id":"dee182e188fd223aa9312bb33cbbd5d1f84be3be"}],"releasenotes/notes/bug-1778994-0c4cce7e75f81ab3.yaml":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"0c54bf564870d0c0bdde6e7093dd99d9c4319a21","unresolved":false,"context_lines":[{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Add granularity to the ``os_compute_api:os-services`` RBAC policy"},{"line_number":5,"context_line":"    with the addition of distinct actions for list, update operations, "},{"line_number":6,"context_line":"    and delete:"},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"    - ``os_compute_api:os-services:index``"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"5f7c97a3_f903aa0a","line":5,"range":{"start_line":5,"start_character":70,"end_line":5,"end_character":71},"updated":"2018-07-07 18:47:59.000000000","message":"WS","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"6b912e83606fd4693077e2d3623a45db66fcb642","unresolved":false,"context_lines":[{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Add granularity to the ``os_compute_api:os-services`` RBAC policy"},{"line_number":5,"context_line":"    with the addition of distinct actions for list, update operations, "},{"line_number":6,"context_line":"    and delete:"},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"    - ``os_compute_api:os-services:index``"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"5f7c97a3_f1de4cd9","line":5,"range":{"start_line":5,"start_character":70,"end_line":5,"end_character":71},"in_reply_to":"5f7c97a3_f903aa0a","updated":"2018-07-10 20:58:09.000000000","message":"Done","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"0c54bf564870d0c0bdde6e7093dd99d9c4319a21","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    - Keep enforcing the old rules with same default for deprecation period"},{"line_number":22,"context_line":"    - Give warning for user about switching to old rules to new rules"},{"line_number":23,"context_line":"    - Note we will enforce the old rules as it is till deprecation period and"},{"line_number":24,"context_line":"      new rule as soft enforcement only as it should not effect any user for"},{"line_number":25,"context_line":"      deprecation period"},{"line_number":26,"context_line":"    - After deprecation period. we will remove the old rules and keep enforcing"},{"line_number":27,"context_line":"      the new rules only"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"5f7c97a3_9912b654","line":24,"range":{"start_line":24,"start_character":57,"end_line":24,"end_character":63},"updated":"2018-07-07 18:47:59.000000000","message":"affect","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"6b912e83606fd4693077e2d3623a45db66fcb642","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    - Keep enforcing the old rules with same default for deprecation period"},{"line_number":22,"context_line":"    - Give warning for user about switching to old rules to new rules"},{"line_number":23,"context_line":"    - Note we will enforce the old rules as it is till deprecation period and"},{"line_number":24,"context_line":"      new rule as soft enforcement only as it should not effect any user for"},{"line_number":25,"context_line":"      deprecation period"},{"line_number":26,"context_line":"    - After deprecation period. we will remove the old rules and keep enforcing"},{"line_number":27,"context_line":"      the new rules only"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"5f7c97a3_71e47ca8","line":24,"range":{"start_line":24,"start_character":57,"end_line":24,"end_character":63},"in_reply_to":"5f7c97a3_9912b654","updated":"2018-07-10 20:58:09.000000000","message":"Done","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"0c54bf564870d0c0bdde6e7093dd99d9c4319a21","unresolved":false,"context_lines":[{"line_number":23,"context_line":"    - Note we will enforce the old rules as it is till deprecation period and"},{"line_number":24,"context_line":"      new rule as soft enforcement only as it should not effect any user for"},{"line_number":25,"context_line":"      deprecation period"},{"line_number":26,"context_line":"    - After deprecation period. we will remove the old rules and keep enforcing"},{"line_number":27,"context_line":"      the new rules only"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"5f7c97a3_3927e2b8","line":26,"range":{"start_line":26,"start_character":30,"end_line":26,"end_character":31},"updated":"2018-07-07 18:47:59.000000000","message":", (comma)","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"6b912e83606fd4693077e2d3623a45db66fcb642","unresolved":false,"context_lines":[{"line_number":23,"context_line":"    - Note we will enforce the old rules as it is till deprecation period and"},{"line_number":24,"context_line":"      new rule as soft enforcement only as it should not effect any user for"},{"line_number":25,"context_line":"      deprecation period"},{"line_number":26,"context_line":"    - After deprecation period. we will remove the old rules and keep enforcing"},{"line_number":27,"context_line":"      the new rules only"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"5f7c97a3_91e7d8ab","line":26,"range":{"start_line":26,"start_character":30,"end_line":26,"end_character":31},"in_reply_to":"5f7c97a3_3927e2b8","updated":"2018-07-10 20:58:09.000000000","message":"Done","commit_id":"c702b7cdfba583af63738a6636175261b07054cf"}]}