)]}'
{"id":"openstack%2Foctavia~763820","triplet_id":"openstack%2Foctavia~master~I4a31aa9c0b5caad415a662ec39370d4da4503749","project":"openstack/octavia","branch":"master","topic":"secure-rbac","hashtags":[],"change_id":"I4a31aa9c0b5caad415a662ec39370d4da4503749","subject":"Implement secure RBAC for listeners","status":"ABANDONED","created":"2020-11-23 17:51:11.000000000","updated":"2021-03-10 16:44:37.000000000","total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"2b8b600a7ad1fb4c881dba3a466f53a83720279c","_number":763820,"virtual_id_number":763820,"owner":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"actions":{},"labels":{"Verified":{"disliked":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"tag":"autogenerated:zuul:check","value":-1,"date":"2020-11-24 07:19:59.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":-1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"rejected":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"all":[{"value":-1,"date":"2021-03-02 18:48:13.000000000","permitted_voting_range":{"min":-1,"max":0},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Backport-Candidate":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do Not Backport","-1":"Not A Backport Candidate"," 0":"Backport Review Needed","+1":"Proposed Backport","+2":"Should Backport"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2020-11-23 21:35:34.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2021-02-24 21:59:38.000000000","updated_by":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"reviewer":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"state":"CC"}],"messages":[{"id":"c09dc446d4f7440c2de43c777e73aabd7aab6ae8","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-23 17:51:11.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"638bfeabfc16a4c5e206328a39bad426f683d7aa","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-23 17:55:06.000000000","message":"Topic set to secure-rbac","accounts_in_message":[],"_revision_number":1},{"id":"61b350ce43666c2d479f3899720f792748025f22","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-11-23 21:35:34.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/b87a5f264a114750a6f0c0bb60682d8c : SUCCESS in 10m 03s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/e128272770dd4313be41d932c07c6a7b : FAILURE in 4m 07s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/a6e2906b622d47a782d4e3f205ba919e : SUCCESS in 5m 28s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/8268a148f71a44b9a3297e16718a654e : SUCCESS in 4m 38s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/581c6e3694d446c586d30decdea7b675 : SUCCESS in 4m 52s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/a09d8d64d3c34c66b6c3fb9548058d98 : SUCCESS in 5m 51s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/6b82186877ea4fe39f9ac01954c83f31 : SUCCESS in 12m 05s\n- octavia-tox-py37-tips https://zuul.opendev.org/t/openstack/build/1821fece19df480ba69edab4fab7fdd7 : SUCCESS in 5m 25s\n- octavia-tox-functional-py37-tips https://zuul.opendev.org/t/openstack/build/82192faeac864add920209ed63c79078 : SUCCESS in 7m 57s\n- openstack-tox-pip-check-reqs https://zuul.opendev.org/t/openstack/build/84e60261d81e4fb9afefe8d6218b036e : SUCCESS in 4m 36s\n- openstack-tox-functional-py36 https://zuul.opendev.org/t/openstack/build/0408a883835e4f908f03e555a6d86ae1 : SUCCESS in 7m 28s\n- octavia-v2-dsvm-noop-api https://zuul.opendev.org/t/openstack/build/7c34534e70f145429045fdd0d1f46822 : FAILURE in 1h 37m 12s\n- octavia-v2-dsvm-scenario https://zuul.opendev.org/t/openstack/build/eb8e5f70201946f58d1cbac28e9f5d01 : SUCCESS in 2h 09m 46s\n- octavia-v2-dsvm-tls-barbican https://zuul.opendev.org/t/openstack/build/a384319d43f747d9ae84f8b4a73954c4 : SUCCESS in 57m 08s\n- octavia-v2-dsvm-spare-pool https://zuul.opendev.org/t/openstack/build/c0a9a9f4d7bb4a498a30e3e77bf16924 : SUCCESS in 37m 48s\n- octavia-v2-act-stdby-dsvm-scenario https://zuul.opendev.org/t/openstack/build/062ddab39a754aca9421af9b3fcc23e8 : SUCCESS in 44m 02s\n- octavia-grenade https://zuul.opendev.org/t/openstack/build/2135f2e2d5154d7c96147230759bef7d : SUCCESS in 1h 05m 20s\n- octavia-v2-dsvm-cinder-amphora https://zuul.opendev.org/t/openstack/build/529b9ab39ea74428aec8e89f0cf07e7d : SUCCESS in 1h 50m 42s (non-voting)\n- octavia-v2-dsvm-scenario-two-node https://zuul.opendev.org/t/openstack/build/abcb5738e66045409311ca0d4dff6459 : FAILURE in 1h 58m 04s (non-voting)\n- octavia-v2-dsvm-scenario-ipv6-only https://zuul.opendev.org/t/openstack/build/67e899d71b874e2dba8946fa69890faa : SUCCESS in 1h 34m 47s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2 https://zuul.opendev.org/t/openstack/build/1210230064a5419fb6949227f488f103 : SUCCESS in 2h 34m 55s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2-no-jobboard https://zuul.opendev.org/t/openstack/build/9ca46a0936a342089b890f3d61a623a7 : SUCCESS in 1h 43m 44s (non-voting)\n- octavia-v2-dsvm-scenario-centos-8 https://zuul.opendev.org/t/openstack/build/c737ff6d78644997b4bb37804af9b9ea : FAILURE in 35m 56s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"545ce91255a0415d55aa950d9c64bc1f4d9eff3a","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-24 04:44:03.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.","accounts_in_message":[],"_revision_number":2},{"id":"b58b667f637586e6ee33302dd1ee07d40294a25f","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-11-24 07:19:59.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/4fc20bade26c4825b599e04bde623b77 : SUCCESS in 8m 55s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/6e185c2176ad4fa5b965f11f488e8671 : SUCCESS in 8m 09s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/39d7fcab58474372ae77d3bb74a360fc : SUCCESS in 6m 25s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/64b2e6ba232e4287a3c83cb4d1a5b7ac : SUCCESS in 4m 48s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/9ea2cf6ef8b34fe9afa2e8899aeb7401 : SUCCESS in 4m 57s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/06906ac262204539bdeeeafd29ed6e8a : SUCCESS in 5m 35s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/aef5ce062d43433893bd8bda96ac83d0 : SUCCESS in 10m 31s\n- octavia-tox-py37-tips https://zuul.opendev.org/t/openstack/build/55f0979ecf0b4735b50d0680365a72ef : SUCCESS in 5m 48s\n- octavia-tox-functional-py37-tips https://zuul.opendev.org/t/openstack/build/93fb8460f3fe4f58a818bd77386c28f0 : SUCCESS in 8m 20s\n- openstack-tox-pip-check-reqs https://zuul.opendev.org/t/openstack/build/c514c6c684894971a1718840efc27388 : SUCCESS in 4m 31s\n- openstack-tox-functional-py36 https://zuul.opendev.org/t/openstack/build/41ba4a73335e4a3cafa3b0da4a07a3c9 : SUCCESS in 7m 36s\n- octavia-v2-dsvm-noop-api https://zuul.opendev.org/t/openstack/build/29a9025f838f4402aa2c839f18f39dae : FAILURE in 1h 21m 11s\n- octavia-v2-dsvm-scenario https://zuul.opendev.org/t/openstack/build/27ab3c7600a74df1bcab9e8be2b127ad : SUCCESS in 2h 22m 18s\n- octavia-v2-dsvm-tls-barbican https://zuul.opendev.org/t/openstack/build/b029af0d83f1427b9752fd5c3813b474 : SUCCESS in 52m 59s\n- octavia-v2-dsvm-spare-pool https://zuul.opendev.org/t/openstack/build/554a847e6a434b8eb7496f06958bbc0f : SUCCESS in 1h 00m 53s\n- octavia-v2-act-stdby-dsvm-scenario https://zuul.opendev.org/t/openstack/build/5296e73c57dd4e7c8db95abbb3357396 : SUCCESS in 1h 02m 16s\n- octavia-grenade https://zuul.opendev.org/t/openstack/build/0d124dd701534cf689e5d67d2308baa7 : SUCCESS in 54m 22s\n- octavia-v2-dsvm-cinder-amphora https://zuul.opendev.org/t/openstack/build/31c24ed2e5d345a4adfbfadfe64f12cf : SUCCESS in 1h 48m 55s (non-voting)\n- octavia-v2-dsvm-scenario-two-node https://zuul.opendev.org/t/openstack/build/d23233459da1497fa049512a9817fdaf : FAILURE in 2h 23m 19s (non-voting)\n- octavia-v2-dsvm-scenario-ipv6-only https://zuul.opendev.org/t/openstack/build/e6244bbc28984b6b8e9d826dd6ea38d0 : SUCCESS in 1h 39m 07s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2 https://zuul.opendev.org/t/openstack/build/a5ad8ca136e1466d98b743637916f6b1 : SUCCESS in 1h 44m 03s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2-no-jobboard https://zuul.opendev.org/t/openstack/build/aa8048eae6cd42809596e980a1f0e914 : SUCCESS in 2h 00m 32s (non-voting)\n- octavia-v2-dsvm-scenario-centos-8 https://zuul.opendev.org/t/openstack/build/a90d9d28f87e4d608c04d56e1b377457 : FAILURE in 30m 41s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"b2d94ffb20e3c739d1763dc395347e940f704566","author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"date":"2021-02-24 21:59:38.000000000","message":"Patch Set 2:\n\nAn alternate approach has been proposed in https://review.opendev.org/c/openstack/octavia/+/775957\n\nPlease consider if this is still necessary or a superior approach.","accounts_in_message":[],"_revision_number":2},{"id":"907a50924d0d61a1dadf012e1f5742840e15ca53","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2021-03-02 18:48:04.000000000","message":"Patch Set 2:\n\nMarking as WIP based on Michael\u0027s comment and approach. We can pursue these patches in the future if we want to, but it looks like Michael\u0027s approach delivers the functionality we want.","accounts_in_message":[],"_revision_number":2},{"id":"166ea3ad766bea23fdbc19115aaa237986c97d26","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2021-03-02 18:48:13.000000000","message":"Patch Set 2: Workflow-1","accounts_in_message":[],"_revision_number":2},{"id":"2b8b600a7ad1fb4c881dba3a466f53a83720279c","tag":"autogenerated:gerrit:abandon","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2021-03-10 16:44:37.000000000","message":"Abandoned","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"3652c94b802b3b325916c4cf563d567b702f810c","revisions":{"89689ddba4dd0917694c9019b45bcfa8dc8c4b47":{"kind":"REWORK","_number":1,"created":"2020-11-23 17:51:11.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/20/763820/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/octavia","ref":"refs/changes/20/763820/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/octavia refs/changes/20/763820/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/octavia refs/changes/20/763820/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/octavia refs/changes/20/763820/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/octavia refs/changes/20/763820/1"}}},"commit":{"parents":[{"commit":"d0a95604cda8ed4819c1c0077e514e0a08aa4ebd","subject":"Implement secure RBAC for L7 rules","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/d0a95604cda8ed4819c1c0077e514e0a08aa4ebd"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 16:47:31.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 16:47:31.000000000","tz":0},"subject":"Implement secure RBAC for listeners","message":"Implement secure RBAC for listeners\n\nThis commit updates the policies for listeners policies to understand scope\nchecking and account for a read-only role. This is part of a broader series of\nchanges across OpenStack to provide a consistent RBAC experience and improve\nsecurity.\n\nChange-Id: I4a31aa9c0b5caad415a662ec39370d4da4503749\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/89689ddba4dd0917694c9019b45bcfa8dc8c4b47"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/89689ddba4dd0917694c9019b45bcfa8dc8c4b47"}]},"branch":"refs/heads/master"},"3652c94b802b3b325916c4cf563d567b702f810c":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2020-11-24 04:44:03.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/20/763820/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/octavia","ref":"refs/changes/20/763820/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/octavia refs/changes/20/763820/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/octavia refs/changes/20/763820/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/octavia refs/changes/20/763820/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/octavia refs/changes/20/763820/2"}}},"commit":{"parents":[{"commit":"cc92215a367853ad39cea6bc8d7d12ac378a18cd","subject":"Implement secure RBAC for L7 rules","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/cc92215a367853ad39cea6bc8d7d12ac378a18cd"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 16:47:31.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-24 04:40:43.000000000","tz":0},"subject":"Implement secure RBAC for listeners","message":"Implement secure RBAC for listeners\n\nThis commit updates the policies for listeners policies to understand scope\nchecking and account for a read-only role. This is part of a broader series of\nchanges across OpenStack to provide a consistent RBAC experience and improve\nsecurity.\n\nChange-Id: I4a31aa9c0b5caad415a662ec39370d4da4503749\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/3652c94b802b3b325916c4cf563d567b702f810c"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/3652c94b802b3b325916c4cf563d567b702f810c"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[]}