)]}'
{"id":"openstack%2Foctavia~763825","triplet_id":"openstack%2Foctavia~master~I643829b3f412f272ee54a3abbe17ccc878ed7a18","project":"openstack/octavia","branch":"master","topic":"secure-rbac","hashtags":[],"change_id":"I643829b3f412f272ee54a3abbe17ccc878ed7a18","subject":"Implement secure RBAC for provider availability zones","status":"ABANDONED","created":"2020-11-23 17:51:11.000000000","updated":"2021-03-10 16:44:54.000000000","total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"d386d4b8bd3587c212af7b97be30dc9ab8a11e89","_number":763825,"virtual_id_number":763825,"owner":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"actions":{},"labels":{"Verified":{"disliked":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"tag":"autogenerated:zuul:check","value":-1,"date":"2020-11-24 07:41:06.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":-1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"rejected":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"all":[{"value":-1,"date":"2021-03-02 18:49:10.000000000","permitted_voting_range":{"min":-1,"max":0},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Backport-Candidate":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do Not Backport","-1":"Not A Backport Candidate"," 0":"Backport Review Needed","+1":"Proposed Backport","+2":"Should Backport"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2020-11-23 22:30:21.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2021-02-24 21:58:29.000000000","updated_by":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"reviewer":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"state":"CC"}],"messages":[{"id":"79bc243094ff9e0e1209af01b31f82753182a96e","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-23 17:51:11.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"d5c28aef6dd978359693e3a5be303b63c09814b3","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-23 17:56:06.000000000","message":"Topic set to secure-rbac","accounts_in_message":[],"_revision_number":1},{"id":"02667c0f3ed3660b56a0693936e189afc087c723","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-11-23 22:30:21.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/14617c08d4cc431c825cacfdd5d5a753 : SUCCESS in 9m 13s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/f360ad73c3b141e69d67193eb0c97765 : FAILURE in 4m 35s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/fe5044e4d82941b885dd64f3b5b1a96a : SUCCESS in 5m 12s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/2985692df7dd4956871b2a86c027571a : SUCCESS in 4m 53s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/065f4e048a3e4487a611806f19be0f70 : SUCCESS in 5m 38s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/83de136ceb6c446fbbcf22de99316107 : SUCCESS in 8m 43s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/a8a82d8fa02f458b9510e4855f9251db : SUCCESS in 12m 16s\n- octavia-tox-py37-tips https://zuul.opendev.org/t/openstack/build/93ad7fcae7564f8181021e9bc1df1d41 : SUCCESS in 5m 28s\n- octavia-tox-functional-py37-tips https://zuul.opendev.org/t/openstack/build/d49f802c8b15431dadb62aa2fa3cfd53 : SUCCESS in 8m 25s\n- openstack-tox-pip-check-reqs https://zuul.opendev.org/t/openstack/build/7b807f71a8824f0c810268a00824ff9b : SUCCESS in 6m 28s\n- openstack-tox-functional-py36 https://zuul.opendev.org/t/openstack/build/e66e41390a374b01be8be4edce56afca : SUCCESS in 7m 18s\n- octavia-v2-dsvm-noop-api https://zuul.opendev.org/t/openstack/build/174d8ab87eae42ea981602d1b39db327 : FAILURE in 1h 17m 44s\n- octavia-v2-dsvm-scenario https://zuul.opendev.org/t/openstack/build/ad96f45547d049089525d345bd758033 : SUCCESS in 2h 12m 54s\n- octavia-v2-dsvm-tls-barbican https://zuul.opendev.org/t/openstack/build/e2bf1c6d60ba428a8808849d062bc22d : SUCCESS in 49m 59s\n- octavia-v2-dsvm-spare-pool https://zuul.opendev.org/t/openstack/build/ab27ebee794b47f493f29e484246ff65 : SUCCESS in 42m 58s\n- octavia-v2-act-stdby-dsvm-scenario https://zuul.opendev.org/t/openstack/build/e34e706d23d84f99adab243f3925907e : SUCCESS in 44m 24s\n- octavia-grenade https://zuul.opendev.org/t/openstack/build/9bab03ac3dc44d7e8cde709bc32489df : SUCCESS in 53m 30s\n- octavia-v2-dsvm-cinder-amphora https://zuul.opendev.org/t/openstack/build/507377b3fd0749eeaa4ea37f3771b9df : SUCCESS in 1h 55m 19s (non-voting)\n- octavia-v2-dsvm-scenario-two-node https://zuul.opendev.org/t/openstack/build/8e5a2b99a61f4e81bdb5f9acbf5c6729 : FAILURE in 2h 08m 51s (non-voting)\n- octavia-v2-dsvm-scenario-ipv6-only https://zuul.opendev.org/t/openstack/build/fa8e997aa10449bab47f50a8e2787fcd : SUCCESS in 2h 05m 53s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2 https://zuul.opendev.org/t/openstack/build/c2ee31675d124fecb64eeef5254c748a : SUCCESS in 1h 47m 08s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2-no-jobboard https://zuul.opendev.org/t/openstack/build/d5252ebd796e4178bdf90b65b34eb4df : SUCCESS in 2h 02m 32s (non-voting)\n- octavia-v2-dsvm-scenario-centos-8 https://zuul.opendev.org/t/openstack/build/bb85e73b21f8496d814dcb1b3622106d : FAILURE in 32m 03s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"b2b9e4744038d0e787921e2cf11c2c98db2eedcd","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-24 04:44:03.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.","accounts_in_message":[],"_revision_number":2},{"id":"0fec4eac8b86f12797441be50d21db0eaf1aea99","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-11-24 07:41:06.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/45357c5e54eb4e238d617d30e7185220 : SUCCESS in 9m 28s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/4062646ece674fbfa449e52c2662ebb3 : SUCCESS in 9m 38s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/1ac054d6702c4943bacf6dd9532ccee9 : SUCCESS in 5m 48s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/94c67a08533e4b7c878d2e8bffecbb49 : SUCCESS in 4m 28s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/42c5760e8f484aa79b25c058c972c8e3 : SUCCESS in 5m 09s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/31fc0abfee214b2cb21104678e835509 : SUCCESS in 5m 56s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/cd4499e84b8a4a408dbd83a010e58531 : SUCCESS in 10m 18s\n- octavia-tox-py37-tips https://zuul.opendev.org/t/openstack/build/fe5ea46654fb4bc890471da2a5d5ce25 : SUCCESS in 6m 12s\n- octavia-tox-functional-py37-tips https://zuul.opendev.org/t/openstack/build/1811d1be896c4745a06f50c0da5a881b : SUCCESS in 8m 54s\n- openstack-tox-pip-check-reqs https://zuul.opendev.org/t/openstack/build/90bfe98ce9564f8eb8c42fe9adafeb58 : SUCCESS in 5m 09s\n- openstack-tox-functional-py36 https://zuul.opendev.org/t/openstack/build/2f623a65babd43c9b74f98f3e73935f5 : SUCCESS in 7m 18s\n- octavia-v2-dsvm-noop-api https://zuul.opendev.org/t/openstack/build/7f01e12a1c5c4b8bb3319f17923d2ed7 : FAILURE in 1h 30m 47s\n- octavia-v2-dsvm-scenario https://zuul.opendev.org/t/openstack/build/271330fc0fc14f8f9fa25a136045e099 : TIMED_OUT in 2h 37m 23s\n- octavia-v2-dsvm-tls-barbican https://zuul.opendev.org/t/openstack/build/86a3dda8fdc843cab43c1c6317ef50c6 : SUCCESS in 1h 04m 10s\n- octavia-v2-dsvm-spare-pool https://zuul.opendev.org/t/openstack/build/b271fdb3157c4b9b96c2ea188cd36053 : SUCCESS in 1h 33m 56s\n- octavia-v2-act-stdby-dsvm-scenario https://zuul.opendev.org/t/openstack/build/f9f4c47e12254653adaac0d90b0605af : FAILURE in 1h 27m 55s\n- octavia-grenade https://zuul.opendev.org/t/openstack/build/aabadeffdbc342ebb124cfabf4f1f472 : SUCCESS in 59m 55s\n- octavia-v2-dsvm-cinder-amphora https://zuul.opendev.org/t/openstack/build/ebfd96a164414116a3b24f1156d880c4 : SUCCESS in 2h 21m 14s (non-voting)\n- octavia-v2-dsvm-scenario-two-node https://zuul.opendev.org/t/openstack/build/d9b244e1e03d4fea967af84329391ad4 : TIMED_OUT in 2h 31m 56s (non-voting)\n- octavia-v2-dsvm-scenario-ipv6-only https://zuul.opendev.org/t/openstack/build/3162973be4914157a98b53df462af86a : SUCCESS in 1h 47m 45s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2 https://zuul.opendev.org/t/openstack/build/d1f4bfc7686e4c469051610c3a9007d7 : SUCCESS in 2h 00m 21s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2-no-jobboard https://zuul.opendev.org/t/openstack/build/b91e62d652c4449c8a245bcc108f3992 : SUCCESS in 1h 38m 33s (non-voting)\n- octavia-v2-dsvm-scenario-centos-8 https://zuul.opendev.org/t/openstack/build/35848458490047f7b07bb4f8ed041999 : FAILURE in 29m 53s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"c5cff9b5715d15d693e19595bbd51ff2b61ee9da","author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"date":"2021-02-24 21:58:29.000000000","message":"Patch Set 2:\n\nAn alternate approach has been proposed in https://review.opendev.org/c/openstack/octavia/+/775957\n\nPlease consider if this is still necessary or a superior approach.","accounts_in_message":[],"_revision_number":2},{"id":"7ae700507e081b05a7390c92d20926dd22fc191c","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2021-03-02 18:49:10.000000000","message":"Patch Set 2: Workflow-1\n\nMarking as WIP based on Michael\u0027s comment and approach. We can pursue these patches in the future if we want to, but it looks like Michael\u0027s approach delivers the functionality we want.","accounts_in_message":[],"_revision_number":2},{"id":"d386d4b8bd3587c212af7b97be30dc9ab8a11e89","tag":"autogenerated:gerrit:abandon","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2021-03-10 16:44:54.000000000","message":"Abandoned","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"a2b683846f201548f8c380c6daff53361fda18c0","revisions":{"74f2df767e3decc937f392a8fe9c81619d30e373":{"kind":"REWORK","_number":1,"created":"2020-11-23 17:51:11.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/25/763825/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/octavia","ref":"refs/changes/25/763825/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/octavia refs/changes/25/763825/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/octavia refs/changes/25/763825/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/octavia refs/changes/25/763825/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/octavia refs/changes/25/763825/1"}}},"commit":{"parents":[{"commit":"77fa6c2b1b58c88049dd7097c9a9cd96f8f9ef8e","subject":"Implement secure RBAC for providers","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/77fa6c2b1b58c88049dd7097c9a9cd96f8f9ef8e"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 17:30:28.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 17:30:28.000000000","tz":0},"subject":"Implement secure RBAC for provider availability zones","message":"Implement secure RBAC for provider availability zones\n\nThis commit updates the policy for provider availability zones to understand\nscope checking and account for a read-only role. This is part of a broader\nseries of changes across OpenStack to provide a consistent RBAC experience and\nimprove security.\n\nChange-Id: I643829b3f412f272ee54a3abbe17ccc878ed7a18\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/74f2df767e3decc937f392a8fe9c81619d30e373"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/74f2df767e3decc937f392a8fe9c81619d30e373"}]},"branch":"refs/heads/master"},"a2b683846f201548f8c380c6daff53361fda18c0":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2020-11-24 04:44:03.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/25/763825/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/octavia","ref":"refs/changes/25/763825/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/octavia refs/changes/25/763825/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/octavia refs/changes/25/763825/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/octavia refs/changes/25/763825/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/octavia refs/changes/25/763825/2"}}},"commit":{"parents":[{"commit":"eceeb64b42f53b34cdfab6aa737b6266610f321d","subject":"Implement secure RBAC for providers","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/eceeb64b42f53b34cdfab6aa737b6266610f321d"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 17:30:28.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-24 04:40:43.000000000","tz":0},"subject":"Implement secure RBAC for provider availability zones","message":"Implement secure RBAC for provider availability zones\n\nThis commit updates the policy for provider availability zones to understand\nscope checking and account for a read-only role. This is part of a broader\nseries of changes across OpenStack to provide a consistent RBAC experience and\nimprove security.\n\nChange-Id: I643829b3f412f272ee54a3abbe17ccc878ed7a18\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/a2b683846f201548f8c380c6daff53361fda18c0"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/a2b683846f201548f8c380c6daff53361fda18c0"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[]}