)]}'
{"id":"openstack%2Foctavia~763822","triplet_id":"openstack%2Foctavia~master~I3db80fdf34849057159384536ca812d9eba054c7","project":"openstack/octavia","branch":"master","topic":"secure-rbac","hashtags":[],"change_id":"I3db80fdf34849057159384536ca812d9eba054c7","subject":"Implement secure RBAC for pool members","status":"ABANDONED","created":"2020-11-23 17:51:11.000000000","updated":"2021-03-10 16:44:43.000000000","total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"244bf9a956ff671e7373067097f82edff9fe9630","_number":763822,"virtual_id_number":763822,"owner":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"actions":{},"labels":{"Verified":{"disliked":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"tag":"autogenerated:zuul:check","value":-1,"date":"2020-11-24 07:07:23.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":-1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"rejected":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"all":[{"value":-1,"date":"2021-03-02 18:48:38.000000000","permitted_voting_range":{"min":-1,"max":0},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Backport-Candidate":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do Not Backport","-1":"Not A Backport Candidate"," 0":"Backport Review Needed","+1":"Proposed Backport","+2":"Should Backport"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2020-11-23 21:34:52.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2021-02-24 21:59:48.000000000","updated_by":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"reviewer":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"state":"CC"}],"messages":[{"id":"fb1e656745f7b7076337784329d4b485c9df1499","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-23 17:51:11.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"45103d9b973b2f86b1d1fcfccd101447f9a96fe8","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-23 17:55:29.000000000","message":"Topic set to secure-rbac","accounts_in_message":[],"_revision_number":1},{"id":"adf8ae903fc4812c6ccd3e818e6f40f9fffe9aa5","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-11-23 21:34:52.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/049b984693ec4d95a00fea1b0ea4dead : SUCCESS in 10m 27s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/7ee5354520114f42a4651b380139ec40 : FAILURE in 5m 32s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/5432a17df2b446efbcfa58a456eb5247 : SUCCESS in 5m 07s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/a4cd38611682435b979f3c4a829a7302 : SUCCESS in 5m 52s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/77c0dd6306c1418b85cb02e6ef1975de : SUCCESS in 4m 48s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/87ff19f8261644fa8f9a4f379bf68498 : SUCCESS in 5m 14s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/b057ee89227840b4a64d292b9c65daf6 : SUCCESS in 13m 10s\n- octavia-tox-py37-tips https://zuul.opendev.org/t/openstack/build/488fbe82cba941d8bf4d849676242cd5 : SUCCESS in 5m 44s\n- octavia-tox-functional-py37-tips https://zuul.opendev.org/t/openstack/build/faddc17b5ff04107b669acd208ff8c9c : SUCCESS in 7m 57s\n- openstack-tox-pip-check-reqs https://zuul.opendev.org/t/openstack/build/75f850c201764bff97daa802b4f35b37 : SUCCESS in 4m 41s\n- openstack-tox-functional-py36 https://zuul.opendev.org/t/openstack/build/b601ad64dac346cba1257c23c71a892a : SUCCESS in 7m 45s\n- octavia-v2-dsvm-noop-api https://zuul.opendev.org/t/openstack/build/5122867874614a4f8009c7768544a9b3 : FAILURE in 1h 21m 28s\n- octavia-v2-dsvm-scenario https://zuul.opendev.org/t/openstack/build/0e491376bc9341ed975bc6e38276e5cf : SUCCESS in 2h 00m 58s\n- octavia-v2-dsvm-tls-barbican https://zuul.opendev.org/t/openstack/build/a10c6e13ed9d4092aa6846f5615eff6c : SUCCESS in 44m 12s\n- octavia-v2-dsvm-spare-pool https://zuul.opendev.org/t/openstack/build/6b9ce687b1cc487d982ba3b78fc6378b : SUCCESS in 41m 16s\n- octavia-v2-act-stdby-dsvm-scenario https://zuul.opendev.org/t/openstack/build/2a92a852cba94963ae7edf0cd6b057a7 : SUCCESS in 42m 10s\n- octavia-grenade https://zuul.opendev.org/t/openstack/build/e907b45229d944d4b8f84447956d93e0 : SUCCESS in 54m 55s\n- octavia-v2-dsvm-cinder-amphora https://zuul.opendev.org/t/openstack/build/6c06a40cb2084347a1c8026165604b2e : SUCCESS in 2h 05m 27s (non-voting)\n- octavia-v2-dsvm-scenario-two-node https://zuul.opendev.org/t/openstack/build/023e1d541fa04296b9a6f8503b81df44 : FAILURE in 2h 09m 01s (non-voting)\n- octavia-v2-dsvm-scenario-ipv6-only https://zuul.opendev.org/t/openstack/build/39052f2dd5af4a0f97d2daa3040cb54e : SUCCESS in 2h 10m 38s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2 https://zuul.opendev.org/t/openstack/build/64c89868635143adbb234e7707fd800c : SUCCESS in 2h 12m 15s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2-no-jobboard https://zuul.opendev.org/t/openstack/build/79c0aa2fe1a14075aab86cbb692259f2 : SUCCESS in 2h 19m 30s (non-voting)\n- octavia-v2-dsvm-scenario-centos-8 https://zuul.opendev.org/t/openstack/build/8685f0341f2b4634a29ab95f1ecdf972 : FAILURE in 40m 56s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"1511608c535a72bd91d0f86b42a2ea3eb553e2cf","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-24 04:44:03.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.","accounts_in_message":[],"_revision_number":2},{"id":"61e62c4520c4394210b9d23a4a3ef8fe4445c887","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-11-24 07:07:23.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/6360c3edff604969b8d17366042ca4b7 : SUCCESS in 9m 24s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/3154cd65ec244c5c8af825223c99e4a0 : SUCCESS in 8m 29s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/04768c48cb2c439dac9aef53270d98fd : SUCCESS in 5m 27s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/fefb95fd18af4ec5937350f6dd5a1e02 : SUCCESS in 4m 29s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/11f147402d5449eab99ae9a418957eb1 : SUCCESS in 4m 59s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/656b48cab0724184badda7125707170e : SUCCESS in 6m 02s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3ab20a711bae4686acffa2fd60fbc59f : SUCCESS in 10m 39s\n- octavia-tox-py37-tips https://zuul.opendev.org/t/openstack/build/7c8567a0758f457097f6af11a516a632 : SUCCESS in 6m 06s\n- octavia-tox-functional-py37-tips https://zuul.opendev.org/t/openstack/build/4fe480f26ab742ea86000357f890935e : SUCCESS in 8m 28s\n- openstack-tox-pip-check-reqs https://zuul.opendev.org/t/openstack/build/2877477288314cbaa2d9b20013dfcf5b : SUCCESS in 4m 57s\n- openstack-tox-functional-py36 https://zuul.opendev.org/t/openstack/build/264addbc5b3b48feb435d0c180beebf7 : SUCCESS in 7m 03s\n- octavia-v2-dsvm-noop-api https://zuul.opendev.org/t/openstack/build/e7074918ae0b475d97c0d8cdc92f2784 : FAILURE in 1h 22m 31s\n- octavia-v2-dsvm-scenario https://zuul.opendev.org/t/openstack/build/0182c80efd4047c2989928ef5632390e : SUCCESS in 2h 00m 56s\n- octavia-v2-dsvm-tls-barbican https://zuul.opendev.org/t/openstack/build/9182dccf31444178bd936f5ac1f2fe49 : SUCCESS in 45m 00s\n- octavia-v2-dsvm-spare-pool https://zuul.opendev.org/t/openstack/build/5b203660a17b4ae3997063396a61f3b2 : SUCCESS in 38m 33s\n- octavia-v2-act-stdby-dsvm-scenario https://zuul.opendev.org/t/openstack/build/28ff5e49e8534369a00358b1b102eeca : SUCCESS in 39m 21s\n- octavia-grenade https://zuul.opendev.org/t/openstack/build/e7fd91c640b14805aba946ac8c2544ea : SUCCESS in 55m 48s\n- octavia-v2-dsvm-cinder-amphora https://zuul.opendev.org/t/openstack/build/1eb6854688414c6ab5aee9fb6a420919 : SUCCESS in 2h 10m 04s (non-voting)\n- octavia-v2-dsvm-scenario-two-node https://zuul.opendev.org/t/openstack/build/bd81c39d98e542139d82e2a8cf2ebbc8 : FAILURE in 2h 04m 31s (non-voting)\n- octavia-v2-dsvm-scenario-ipv6-only https://zuul.opendev.org/t/openstack/build/017437de0ad64cf58f81557fce6de4e3 : SUCCESS in 2h 00m 16s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2 https://zuul.opendev.org/t/openstack/build/3743268e5be649739e188a59b6abf825 : SUCCESS in 2h 08m 46s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2-no-jobboard https://zuul.opendev.org/t/openstack/build/aac1a09ef7b44a618fcdb51786b43b9a : FAILURE in 2h 01m 45s (non-voting)\n- octavia-v2-dsvm-scenario-centos-8 https://zuul.opendev.org/t/openstack/build/c0db128202af438b9cb530080e52339f : FAILURE in 40m 59s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"47089027dd83cc39a2bef95cfb8434adca231e05","author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"date":"2021-02-24 21:59:48.000000000","message":"Patch Set 2:\n\nAn alternate approach has been proposed in https://review.opendev.org/c/openstack/octavia/+/775957\n\nPlease consider if this is still necessary or a superior approach.","accounts_in_message":[],"_revision_number":2},{"id":"9806f4fa5dc34f2bd779763cf0b52403ad885273","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2021-03-02 18:48:38.000000000","message":"Patch Set 2: Workflow-1\n\nMarking as WIP based on Michael\u0027s comment and approach. We can pursue these patches in the future if we want to, but it looks like Michael\u0027s approach delivers the functionality we want.","accounts_in_message":[],"_revision_number":2},{"id":"244bf9a956ff671e7373067097f82edff9fe9630","tag":"autogenerated:gerrit:abandon","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2021-03-10 16:44:43.000000000","message":"Abandoned","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"db6bc50f675f61b67720dfcda4bb06de11a912b2","revisions":{"0aed38099045b81d89a9963b851be7222c444705":{"kind":"REWORK","_number":1,"created":"2020-11-23 17:51:11.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/22/763822/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/octavia","ref":"refs/changes/22/763822/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/octavia refs/changes/22/763822/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/octavia refs/changes/22/763822/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/octavia refs/changes/22/763822/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/octavia refs/changes/22/763822/1"}}},"commit":{"parents":[{"commit":"dc85851ccff08de672d33d66132fa8864592c05f","subject":"Implement secure RBAC for load balancers","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/dc85851ccff08de672d33d66132fa8864592c05f"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 17:14:47.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 17:14:47.000000000","tz":0},"subject":"Implement secure RBAC for pool members","message":"Implement secure RBAC for pool members\n\nThis commit updates the policies for pool member policies to understand scope\nchecking and account for a read-only role. This is part of a broader series of\nchanges across OpenStack to provide a consistent RBAC experience and improve\nsecurity.\n\nChange-Id: I3db80fdf34849057159384536ca812d9eba054c7\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/0aed38099045b81d89a9963b851be7222c444705"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/0aed38099045b81d89a9963b851be7222c444705"}]},"branch":"refs/heads/master"},"db6bc50f675f61b67720dfcda4bb06de11a912b2":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2020-11-24 04:44:03.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/22/763822/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/octavia","ref":"refs/changes/22/763822/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/octavia refs/changes/22/763822/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/octavia refs/changes/22/763822/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/octavia refs/changes/22/763822/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/octavia refs/changes/22/763822/2"}}},"commit":{"parents":[{"commit":"6bf0972c11f37bd5d7428d3d6becf119e0c9fecc","subject":"Implement secure RBAC for load balancers","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/6bf0972c11f37bd5d7428d3d6becf119e0c9fecc"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 17:14:47.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-24 04:40:43.000000000","tz":0},"subject":"Implement secure RBAC for pool members","message":"Implement secure RBAC for pool members\n\nThis commit updates the policies for pool member policies to understand scope\nchecking and account for a read-only role. This is part of a broader series of\nchanges across OpenStack to provide a consistent RBAC experience and improve\nsecurity.\n\nChange-Id: I3db80fdf34849057159384536ca812d9eba054c7\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/db6bc50f675f61b67720dfcda4bb06de11a912b2"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/db6bc50f675f61b67720dfcda4bb06de11a912b2"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[]}