)]}'
{"id":"openstack%2Foctavia~763818","triplet_id":"openstack%2Foctavia~master~Id5bf1e7cc003f437f337e76b3eb5d7a4b9e73e86","project":"openstack/octavia","branch":"master","topic":"secure-rbac","hashtags":[],"change_id":"Id5bf1e7cc003f437f337e76b3eb5d7a4b9e73e86","subject":"Implement secure RBAC for L7 policies","status":"ABANDONED","created":"2020-11-23 17:51:11.000000000","updated":"2021-03-10 16:44:29.000000000","total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"7227c11523208fc533da89665d5bdea8b766804e","_number":763818,"virtual_id_number":763818,"owner":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"actions":{},"labels":{"Verified":{"disliked":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"tag":"autogenerated:zuul:check","value":-1,"date":"2020-11-24 07:20:44.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":-1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"rejected":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"all":[{"value":-1,"date":"2021-03-02 18:46:40.000000000","permitted_voting_range":{"min":-1,"max":0},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Backport-Candidate":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do Not Backport","-1":"Not A Backport Candidate"," 0":"Backport Review Needed","+1":"Proposed Backport","+2":"Should Backport"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2020-11-23 21:04:59.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2021-02-24 21:59:29.000000000","updated_by":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"reviewer":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"state":"CC"}],"messages":[{"id":"13330159f992fc3d35597ac3de8aacd942c3393a","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-23 17:51:11.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"1a5dddca8765870321c730266ceef70cc2b7f262","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-23 17:54:47.000000000","message":"Topic set to secure-rbac","accounts_in_message":[],"_revision_number":1},{"id":"47821304a8c7208f4e4e296959bb30e2182c0dd8","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-11-23 21:04:59.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/f1c67bae889f4ca18804d22809d73406 : SUCCESS in 8m 47s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/eabc77c364654cc28bd87b08a1a38450 : FAILURE in 4m 28s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/1885940396b2444798aabf5284b3c670 : SUCCESS in 5m 29s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/250822e0dfb04f5ab72892466428c361 : SUCCESS in 4m 30s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/519a7fb222ae422d8b55d4305cc4193a : SUCCESS in 5m 56s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/f7e3f6dd799b4f6d982ea6c0066a96b7 : SUCCESS in 6m 51s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/f6343475e2764d579efc1d3a2636975c : SUCCESS in 10m 59s\n- octavia-tox-py37-tips https://zuul.opendev.org/t/openstack/build/4364eb51422d4125bb0844d8f45fdf14 : SUCCESS in 5m 37s\n- octavia-tox-functional-py37-tips https://zuul.opendev.org/t/openstack/build/4a5cb1de494146dc9a75f8b900a81c4f : SUCCESS in 8m 29s\n- openstack-tox-pip-check-reqs https://zuul.opendev.org/t/openstack/build/98589b04726a4b6887386335e3e66cd5 : SUCCESS in 4m 55s\n- openstack-tox-functional-py36 https://zuul.opendev.org/t/openstack/build/50bce71e86064d25a4fd4b2fdc4708f8 : SUCCESS in 6m 14s\n- octavia-v2-dsvm-noop-api https://zuul.opendev.org/t/openstack/build/6c0e29030ae2481dbea3dc98d4a0cecb : FAILURE in 1h 16m 29s\n- octavia-v2-dsvm-scenario https://zuul.opendev.org/t/openstack/build/67f85d807f0342aba444109edb9bc110 : SUCCESS in 1h 52m 25s\n- octavia-v2-dsvm-tls-barbican https://zuul.opendev.org/t/openstack/build/39101da40f4d4aecadb81fb9deae1dd4 : SUCCESS in 40m 37s\n- octavia-v2-dsvm-spare-pool https://zuul.opendev.org/t/openstack/build/634f4b42a3fe44ac8d0bb31a8986058d : SUCCESS in 37m 04s\n- octavia-v2-act-stdby-dsvm-scenario https://zuul.opendev.org/t/openstack/build/e9b32cbf50e749d195ad3d4fc43a5b02 : SUCCESS in 42m 12s\n- octavia-grenade https://zuul.opendev.org/t/openstack/build/779511ac9cf041dfa3b2fdfe07229603 : SUCCESS in 56m 31s\n- octavia-v2-dsvm-cinder-amphora https://zuul.opendev.org/t/openstack/build/643fca3fe16d4ff4a41ba6dd813418fc : SUCCESS in 1h 51m 17s (non-voting)\n- octavia-v2-dsvm-scenario-two-node https://zuul.opendev.org/t/openstack/build/fb2736ec7208441fa0cfc935e8f66fec : FAILURE in 2h 09m 20s (non-voting)\n- octavia-v2-dsvm-scenario-ipv6-only https://zuul.opendev.org/t/openstack/build/e1661dc2093a4582b92512e0b0550827 : SUCCESS in 2h 04m 36s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2 https://zuul.opendev.org/t/openstack/build/e542d9dce4e34a23ae6c44e48d1f637a : SUCCESS in 1h 56m 44s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2-no-jobboard https://zuul.opendev.org/t/openstack/build/46c88e195f0a4d5094eeacedc86e1656 : SUCCESS in 2h 06m 08s (non-voting)\n- octavia-v2-dsvm-scenario-centos-8 https://zuul.opendev.org/t/openstack/build/63c1e0eac0574b73881518d70e520b84 : FAILURE in 46m 59s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"7d13e7497eddc02f7bfc08db17337da9d0d23331","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-24 04:44:03.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.","accounts_in_message":[],"_revision_number":2},{"id":"8a559a6ab7175efdca2d471fbe4864da5bcfb002","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-11-24 07:20:44.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/74eeb9962a1b46be8c0349f220e7cfd7 : SUCCESS in 10m 00s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/b60fdcb3b2954fe4a8f8e91211dad0d7 : SUCCESS in 9m 32s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/9378d4cfeef84a20b44202c898162cf3 : SUCCESS in 4m 59s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/ab6193635ba74fefba8f029f05612f16 : SUCCESS in 5m 33s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/5803047a40bf4d358b328d83f0df9232 : SUCCESS in 5m 37s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/2f21424720c84cd99ea5cff183251383 : SUCCESS in 5m 24s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/5121c1c54ae0432b80a63c78ca3a97f6 : SUCCESS in 11m 56s\n- octavia-tox-py37-tips https://zuul.opendev.org/t/openstack/build/b9e4c5e07273434cb0d7418826a217f0 : SUCCESS in 5m 52s\n- octavia-tox-functional-py37-tips https://zuul.opendev.org/t/openstack/build/216f50afa66e48ed8439924ee8a7ed99 : SUCCESS in 7m 50s\n- openstack-tox-pip-check-reqs https://zuul.opendev.org/t/openstack/build/7772dd39d84f428eacc52f78a5dc184f : SUCCESS in 5m 09s\n- openstack-tox-functional-py36 https://zuul.opendev.org/t/openstack/build/11c5f7fb285d436cbd94638c726cbb66 : SUCCESS in 7m 46s\n- octavia-v2-dsvm-noop-api https://zuul.opendev.org/t/openstack/build/94ed62bbeb58447996b4824365b12fea : FAILURE in 1h 30m 55s\n- octavia-v2-dsvm-scenario https://zuul.opendev.org/t/openstack/build/a91b995a3b0d4cbaac8463a91a23d1c9 : SUCCESS in 1h 38m 28s\n- octavia-v2-dsvm-tls-barbican https://zuul.opendev.org/t/openstack/build/317a14d1a57a41cebee76793e606560c : SUCCESS in 42m 08s\n- octavia-v2-dsvm-spare-pool https://zuul.opendev.org/t/openstack/build/a854666e8add44b69635c6330362a24b : SUCCESS in 41m 42s\n- octavia-v2-act-stdby-dsvm-scenario https://zuul.opendev.org/t/openstack/build/e10c96c507524c3eb7448ea258c5ba65 : SUCCESS in 44m 14s\n- octavia-grenade https://zuul.opendev.org/t/openstack/build/3f1843de8ce3494480f805b2dc1f59a1 : SUCCESS in 57m 55s\n- octavia-v2-dsvm-cinder-amphora https://zuul.opendev.org/t/openstack/build/c705aa5cf64f421ab1b0f46f2ae3c7f7 : SUCCESS in 2h 06m 27s (non-voting)\n- octavia-v2-dsvm-scenario-two-node https://zuul.opendev.org/t/openstack/build/af9a15ec5e88417fbf7e8b18f5c41bf6 : FAILURE in 2h 24m 57s (non-voting)\n- octavia-v2-dsvm-scenario-ipv6-only https://zuul.opendev.org/t/openstack/build/dd0f98a3d3c34df7bed2de8e1720a699 : SUCCESS in 2h 12m 42s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2 https://zuul.opendev.org/t/openstack/build/3faff162cda047f7b4a43bdd68ddcff1 : SUCCESS in 2h 12m 48s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2-no-jobboard https://zuul.opendev.org/t/openstack/build/6720021c89c6475f9cce8ed04ff3b0be : SUCCESS in 1h 45m 14s (non-voting)\n- octavia-v2-dsvm-scenario-centos-8 https://zuul.opendev.org/t/openstack/build/60bef7c59bff498785dfb2938f37d496 : FAILURE in 36m 53s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"8bb11f5f20e639c5ec9d2fba1dffbdf6f3c9e518","author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"date":"2021-02-24 21:59:29.000000000","message":"Patch Set 2:\n\nAn alternate approach has been proposed in https://review.opendev.org/c/openstack/octavia/+/775957\n\nPlease consider if this is still necessary or a superior approach.","accounts_in_message":[],"_revision_number":2},{"id":"b96ff100ab4eb94810119fb45f9e1baf361f66ce","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2021-03-02 18:46:40.000000000","message":"Patch Set 2: Workflow-1\n\nMarking as WIP based on Michael\u0027s comment and approach. We can pursue these patches in the future if we want to, but it looks like Michael\u0027s approach delivers the functionality we want.","accounts_in_message":[],"_revision_number":2},{"id":"7227c11523208fc533da89665d5bdea8b766804e","tag":"autogenerated:gerrit:abandon","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2021-03-10 16:44:29.000000000","message":"Abandoned","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"a07196e2c11ad0c7b773a6039fdc6103ccad0060","revisions":{"c4855677c97479f74f403974d7e2c24fee548201":{"kind":"REWORK","_number":1,"created":"2020-11-23 17:51:11.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/18/763818/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/octavia","ref":"refs/changes/18/763818/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/octavia refs/changes/18/763818/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/octavia refs/changes/18/763818/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/octavia refs/changes/18/763818/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/octavia refs/changes/18/763818/1"}}},"commit":{"parents":[{"commit":"16170f0820d4abd82b862859a46618e1977024f2","subject":"Implement secure RBAC for health monitors","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/16170f0820d4abd82b862859a46618e1977024f2"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 16:17:35.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 16:17:35.000000000","tz":0},"subject":"Implement secure RBAC for L7 policies","message":"Implement secure RBAC for L7 policies\n\nThis commit updates the policies for L7 policies to understand scope checking\nand account for a read-only role. This is part of a broader series of changes\nacross OpenStack to provide a consistent RBAC experience and improve security.\n\nChange-Id: Id5bf1e7cc003f437f337e76b3eb5d7a4b9e73e86\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/c4855677c97479f74f403974d7e2c24fee548201"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/c4855677c97479f74f403974d7e2c24fee548201"}]},"branch":"refs/heads/master"},"a07196e2c11ad0c7b773a6039fdc6103ccad0060":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2020-11-24 04:44:03.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/18/763818/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/octavia","ref":"refs/changes/18/763818/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/octavia refs/changes/18/763818/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/octavia refs/changes/18/763818/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/octavia refs/changes/18/763818/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/octavia refs/changes/18/763818/2"}}},"commit":{"parents":[{"commit":"793198296d9c91b27168fb1a0511ca3bee078c8a","subject":"Implement secure RBAC for health monitors","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/793198296d9c91b27168fb1a0511ca3bee078c8a"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 16:17:35.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-24 04:40:43.000000000","tz":0},"subject":"Implement secure RBAC for L7 policies","message":"Implement secure RBAC for L7 policies\n\nThis commit updates the policies for L7 policies to understand scope checking\nand account for a read-only role. This is part of a broader series of changes\nacross OpenStack to provide a consistent RBAC experience and improve security.\n\nChange-Id: Id5bf1e7cc003f437f337e76b3eb5d7a4b9e73e86\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/a07196e2c11ad0c7b773a6039fdc6103ccad0060"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/a07196e2c11ad0c7b773a6039fdc6103ccad0060"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[]}