)]}'
{"id":"openstack%2Foctavia~763826","triplet_id":"openstack%2Foctavia~master~I0ccb9a59705d41c07bc14bb23bbd7431f5380282","project":"openstack/octavia","branch":"master","topic":"secure-rbac","hashtags":[],"change_id":"I0ccb9a59705d41c07bc14bb23bbd7431f5380282","subject":"Implement secure RBAC for provider flavors","status":"ABANDONED","created":"2020-11-23 17:51:11.000000000","updated":"2021-03-10 16:44:58.000000000","total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"0e5afc21df7bec78486ecc541292112393261a8f","_number":763826,"virtual_id_number":763826,"owner":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"actions":{},"labels":{"Verified":{"disliked":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"tag":"autogenerated:zuul:check","value":-1,"date":"2020-11-24 07:39:46.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":-1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"rejected":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"all":[{"value":-1,"date":"2021-03-02 18:49:20.000000000","permitted_voting_range":{"min":-1,"max":0},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true},"Backport-Candidate":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do Not Backport","-1":"Not A Backport Candidate"," 0":"Backport Review Needed","+1":"Proposed Backport","+2":"Should Backport"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2020-11-23 23:02:45.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2021-02-24 21:58:36.000000000","updated_by":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"reviewer":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"state":"CC"}],"messages":[{"id":"bcb9d1d276787955991667a6bd0875e83ae29c42","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-23 17:51:11.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"c96ed55a5f8aa1beb3d31449077884b46e910bc6","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-23 17:56:16.000000000","message":"Topic set to secure-rbac","accounts_in_message":[],"_revision_number":1},{"id":"820bb611f424aa6cea39cf14b38cd2a3bba64a2c","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-11-23 23:02:45.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/f68ad7bbe636440c90eb0cca5120fed8 : SUCCESS in 11m 15s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/eff89b6de21842ddaca7445faada79db : FAILURE in 4m 51s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/0761160190d74a2ab5f5a48cda20bbab : SUCCESS in 5m 29s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/75dcff955c4947f78f788f44dd885632 : SUCCESS in 4m 59s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/af99eb88d9534c6387eb2acd6a216f8e : SUCCESS in 4m 51s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/fcca21df704649eca82dbc3f1a26bd11 : SUCCESS in 5m 12s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/b24870756c0646178e63e1fa70b05eb7 : SUCCESS in 11m 23s\n- octavia-tox-py37-tips https://zuul.opendev.org/t/openstack/build/ceb4a18de63f4cd6a4eceebc904f2d85 : SUCCESS in 5m 02s\n- octavia-tox-functional-py37-tips https://zuul.opendev.org/t/openstack/build/cb8fb2acd91646acab5e030fc5d8ac88 : SUCCESS in 8m 36s\n- openstack-tox-pip-check-reqs https://zuul.opendev.org/t/openstack/build/d01498acfd7941b5a11bdb96f7027611 : SUCCESS in 4m 51s\n- openstack-tox-functional-py36 https://zuul.opendev.org/t/openstack/build/8cd52915000d44bf876aa8afb445f71d : SUCCESS in 6m 41s\n- octavia-v2-dsvm-noop-api https://zuul.opendev.org/t/openstack/build/cc5dd8e3219a449ba5d0ba3255599968 : FAILURE in 1h 05m 52s\n- octavia-v2-dsvm-scenario https://zuul.opendev.org/t/openstack/build/8949178446504fee81c55f97facdc89a : SUCCESS in 1h 43m 05s\n- octavia-v2-dsvm-tls-barbican https://zuul.opendev.org/t/openstack/build/71adc5f7a19145b2ad3a177d94f7b431 : SUCCESS in 52m 32s\n- octavia-v2-dsvm-spare-pool https://zuul.opendev.org/t/openstack/build/487540ada28b48188985c934577d596a : SUCCESS in 44m 48s\n- octavia-v2-act-stdby-dsvm-scenario https://zuul.opendev.org/t/openstack/build/dc3da2aed0c34f8eadf502ee44777351 : SUCCESS in 39m 25s\n- octavia-grenade https://zuul.opendev.org/t/openstack/build/9dd6b0892d034c4fbf421b4e8ae97e05 : SUCCESS in 50m 24s\n- octavia-v2-dsvm-cinder-amphora https://zuul.opendev.org/t/openstack/build/7eafc8acb67242c18ebc36b97c81f93e : SUCCESS in 2h 30m 23s (non-voting)\n- octavia-v2-dsvm-scenario-two-node https://zuul.opendev.org/t/openstack/build/cd897f2326f44aa188458b857ee2c11a : FAILURE in 2h 02m 43s (non-voting)\n- octavia-v2-dsvm-scenario-ipv6-only https://zuul.opendev.org/t/openstack/build/7e7e5fa451f54bc8a63fcb6f77a1932f : SUCCESS in 1h 58m 56s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2 https://zuul.opendev.org/t/openstack/build/0e0d1c3cf29c425f9a0811e3ffa271f4 : SUCCESS in 1h 47m 15s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2-no-jobboard https://zuul.opendev.org/t/openstack/build/41010cb8ae894e069d6d90270f6b05b4 : SUCCESS in 2h 03m 55s (non-voting)\n- octavia-v2-dsvm-scenario-centos-8 https://zuul.opendev.org/t/openstack/build/9e7386a4b70a41deb0c23e7531a79d4e : FAILURE in 31m 48s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"98ec470caf7d119892f45ea3e1f69d3f9a2bbe8f","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-11-24 04:44:03.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.","accounts_in_message":[],"_revision_number":2},{"id":"c5c8cc79961ce12030dc9ee5de1f7632b84c8d38","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-11-24 07:39:46.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/54a6d82464e14337b0e9ce82270627a3 : SUCCESS in 9m 26s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/2f969d0e00094a61a9abe997eb7916b6 : SUCCESS in 7m 53s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/0d68d1097a3d4c2e80d5ef240012d61b : SUCCESS in 5m 45s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/7333fd120a024f3ba465099e336380b0 : SUCCESS in 4m 43s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/98814f547f8a4836b9bb75776c75fbd9 : SUCCESS in 4m 46s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/fed83ae192384c01a2c84ec002805645 : SUCCESS in 5m 42s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/8a87121eb6dd49a990f07e91746024af : SUCCESS in 10m 52s\n- octavia-tox-py37-tips https://zuul.opendev.org/t/openstack/build/7dc5db44a394424f91d41e21d3f5ddea : SUCCESS in 5m 24s\n- octavia-tox-functional-py37-tips https://zuul.opendev.org/t/openstack/build/a1c4c633d093455e97343fd1a702395f : SUCCESS in 8m 22s\n- openstack-tox-pip-check-reqs https://zuul.opendev.org/t/openstack/build/188e8d4863e64eed8be599c7047615d9 : SUCCESS in 4m 55s\n- openstack-tox-functional-py36 https://zuul.opendev.org/t/openstack/build/6e08df849653472f9860623480929900 : SUCCESS in 7m 53s\n- octavia-v2-dsvm-noop-api https://zuul.opendev.org/t/openstack/build/a8ad3e60d79c4cd9a42972bf584f9940 : FAILURE in 1h 18m 37s\n- octavia-v2-dsvm-scenario https://zuul.opendev.org/t/openstack/build/c2ef506a152847018cdb85d6f57716ef : SUCCESS in 2h 16m 01s\n- octavia-v2-dsvm-tls-barbican https://zuul.opendev.org/t/openstack/build/77b0e84c51fc4ee5ba1569f07e42364f : SUCCESS in 41m 00s\n- octavia-v2-dsvm-spare-pool https://zuul.opendev.org/t/openstack/build/ecb1b448d2dc4bb29a9bb7de7c192892 : SUCCESS in 47m 11s\n- octavia-v2-act-stdby-dsvm-scenario https://zuul.opendev.org/t/openstack/build/13c2bbf686ae4b828b219248d406d4c7 : SUCCESS in 38m 03s\n- octavia-grenade https://zuul.opendev.org/t/openstack/build/bffc15d5c0fe4cc1b21f25e95d5a0338 : SUCCESS in 1h 27m 05s\n- octavia-v2-dsvm-cinder-amphora https://zuul.opendev.org/t/openstack/build/4652238b9750432ba594d6a0c141bb59 : SUCCESS in 1h 56m 39s (non-voting)\n- octavia-v2-dsvm-scenario-two-node https://zuul.opendev.org/t/openstack/build/2e4dde439c834a83b97dd4e78272003e : TIMED_OUT in 2h 32m 38s (non-voting)\n- octavia-v2-dsvm-scenario-ipv6-only https://zuul.opendev.org/t/openstack/build/d625f0f26aad462ea14c8e9fb3918abd : SUCCESS in 1h 56m 53s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2 https://zuul.opendev.org/t/openstack/build/70be0a5e65164b77a4d1c722829bc2ce : SUCCESS in 1h 55m 45s (non-voting)\n- octavia-v2-dsvm-scenario-amphora-v2-no-jobboard https://zuul.opendev.org/t/openstack/build/f9d99ef9f9244c9b8941498e1718a31f : SUCCESS in 2h 15m 26s (non-voting)\n- octavia-v2-dsvm-scenario-centos-8 https://zuul.opendev.org/t/openstack/build/451a1696a1d542f699c588b6dd41bd08 : FAILURE in 34m 51s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"8e2227de03869d273b60e795a2fb2a2a8ed6b00a","author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"date":"2021-02-24 21:58:36.000000000","message":"Patch Set 2:\n\nAn alternate approach has been proposed in https://review.opendev.org/c/openstack/octavia/+/775957\n\nPlease consider if this is still necessary or a superior approach.","accounts_in_message":[],"_revision_number":2},{"id":"cd3ff17a260421431baf39dc4c936bfc5f16750c","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2021-03-02 18:49:20.000000000","message":"Patch Set 2: Workflow-1\n\nMarking as WIP based on Michael\u0027s comment and approach. We can pursue these patches in the future if we want to, but it looks like Michael\u0027s approach delivers the functionality we want.","accounts_in_message":[],"_revision_number":2},{"id":"0e5afc21df7bec78486ecc541292112393261a8f","tag":"autogenerated:gerrit:abandon","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2021-03-10 16:44:58.000000000","message":"Abandoned","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"b425d7714b4a2a38577c21bb001732fd376770e4","revisions":{"fe1ea9bcea9a9aff1ec45e1bb3396d14af7d9853":{"kind":"REWORK","_number":1,"created":"2020-11-23 17:51:11.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/26/763826/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/octavia","ref":"refs/changes/26/763826/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/octavia refs/changes/26/763826/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/octavia refs/changes/26/763826/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/octavia refs/changes/26/763826/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/octavia refs/changes/26/763826/1"}}},"commit":{"parents":[{"commit":"74f2df767e3decc937f392a8fe9c81619d30e373","subject":"Implement secure RBAC for provider availability zones","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/74f2df767e3decc937f392a8fe9c81619d30e373"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 17:33:16.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 17:33:16.000000000","tz":0},"subject":"Implement secure RBAC for provider flavors","message":"Implement secure RBAC for provider flavors\n\nThis commit updates the policy for provider flavors to understand scope\nchecking and account for a read-only role. This is part of a broader series of\nchanges across OpenStack to provide a consistent RBAC experience and improve\nsecurity.\n\nChange-Id: I0ccb9a59705d41c07bc14bb23bbd7431f5380282\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/fe1ea9bcea9a9aff1ec45e1bb3396d14af7d9853"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/fe1ea9bcea9a9aff1ec45e1bb3396d14af7d9853"}]},"branch":"refs/heads/master"},"b425d7714b4a2a38577c21bb001732fd376770e4":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2020-11-24 04:44:03.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/26/763826/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/octavia","ref":"refs/changes/26/763826/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/octavia refs/changes/26/763826/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/octavia refs/changes/26/763826/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/octavia refs/changes/26/763826/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/octavia refs/changes/26/763826/2"}}},"commit":{"parents":[{"commit":"a2b683846f201548f8c380c6daff53361fda18c0","subject":"Implement secure RBAC for provider availability zones","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/a2b683846f201548f8c380c6daff53361fda18c0"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-23 17:33:16.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-24 04:40:43.000000000","tz":0},"subject":"Implement secure RBAC for provider flavors","message":"Implement secure RBAC for provider flavors\n\nThis commit updates the policy for provider flavors to understand scope\nchecking and account for a read-only role. This is part of a broader series of\nchanges across OpenStack to provide a consistent RBAC experience and improve\nsecurity.\n\nChange-Id: I0ccb9a59705d41c07bc14bb23bbd7431f5380282\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/b425d7714b4a2a38577c21bb001732fd376770e4"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/octavia/commit/b425d7714b4a2a38577c21bb001732fd376770e4"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[]}