)]}'
{"kubernetes-keystone-webhook/values.yaml":[{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"40884007be9e4c76b19aead2cef73cf3bd112d76","unresolved":false,"context_lines":[{"line_number":204,"context_line":"        - type: role"},{"line_number":205,"context_line":"          values:"},{"line_number":206,"context_line":"            - admin_k8cluster_edit"},{"line_number":207,"context_line":"    - resource:"},{"line_number":208,"context_line":"        resources:"},{"line_number":209,"context_line":"          - serviceaccounts"},{"line_number":210,"context_line":"        verbs:"},{"line_number":211,"context_line":"          - impersonate"},{"line_number":212,"context_line":"        namespace: \"*\""},{"line_number":213,"context_line":"        version: \"\""},{"line_number":214,"context_line":"      match:"},{"line_number":215,"context_line":"        - type: role"},{"line_number":216,"context_line":"          values:"},{"line_number":217,"context_line":"            - admin_k8cluster_edit"},{"line_number":218,"context_line":"    - resource:"},{"line_number":219,"context_line":"        resources:"},{"line_number":220,"context_line":"          - daemonsets"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"5f7c97a3_303b55c8","line":217,"range":{"start_line":207,"start_character":0,"end_line":217,"end_character":34},"updated":"2018-06-26 18:38:43.000000000","message":"I understand we would like to have a role that can behave like a k8scluster admin, but does an admin_k8cluster_edit need to impersonate serviceaccounts?  Do we really want to allow impersonation exposed?","commit_id":"323754d414d80a3942e46991409fa0a7a0864330"},{"author":{"_account_id":24780,"name":"Sangeet Gupta","email":"sg774j@att.com","username":"sgupta"},"change_message_id":"73b6d72898f9dcba5ded8e747b2ccd3209de1806","unresolved":false,"context_lines":[{"line_number":204,"context_line":"        - type: role"},{"line_number":205,"context_line":"          values:"},{"line_number":206,"context_line":"            - admin_k8cluster_edit"},{"line_number":207,"context_line":"    - resource:"},{"line_number":208,"context_line":"        resources:"},{"line_number":209,"context_line":"          - serviceaccounts"},{"line_number":210,"context_line":"        verbs:"},{"line_number":211,"context_line":"          - impersonate"},{"line_number":212,"context_line":"        namespace: \"*\""},{"line_number":213,"context_line":"        version: \"\""},{"line_number":214,"context_line":"      match:"},{"line_number":215,"context_line":"        - type: role"},{"line_number":216,"context_line":"          values:"},{"line_number":217,"context_line":"            - admin_k8cluster_edit"},{"line_number":218,"context_line":"    - resource:"},{"line_number":219,"context_line":"        resources:"},{"line_number":220,"context_line":"          - daemonsets"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"5f7c97a3_309275a0","line":217,"range":{"start_line":207,"start_character":0,"end_line":217,"end_character":34},"in_reply_to":"5f7c97a3_303b55c8","updated":"2018-06-26 18:41:44.000000000","message":"I got all these values from AIO OSH deployment. I am ok either way.","commit_id":"323754d414d80a3942e46991409fa0a7a0864330"}],"tools/deployment/keystone-auth/check.sh":[{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"073d150c71c7ba813cbed5002dba13afe7426428","unresolved":false,"context_lines":[{"line_number":86,"context_line":"export OS_USERNAME\u003d\"admin_k8cluster_user\""},{"line_number":87,"context_line":"export OS_PROJECT_NAME\u003d\"demoProject\""},{"line_number":88,"context_line":"TOKEN\u003d$(keystone_token)"},{"line_number":89,"context_line":"kubectl --kubeconfig /tmp/kubeconfig.yaml --token $TOKEN get ingress --all-namespaces"},{"line_number":90,"context_line":"if ! kubectl --kubeconfig /tmp/kubeconfig.yaml --token $TOKEN get pods --all-namespaces ; then"},{"line_number":91,"context_line":"  exit 1"},{"line_number":92,"context_line":"fi"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"export OS_USERNAME\u003d\"admin_k8cluster_edit_user\""},{"line_number":95,"context_line":"export OS_PROJECT_NAME\u003d\"demoProject\""}],"source_content_type":"text/x-sh","patch_set":2,"id":"5f7c97a3_4b55054f","line":92,"range":{"start_line":89,"start_character":0,"end_line":92,"end_character":2},"updated":"2018-06-26 15:51:43.000000000","message":"we need to test for +ve cases here","commit_id":"323754d414d80a3942e46991409fa0a7a0864330"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"073d150c71c7ba813cbed5002dba13afe7426428","unresolved":false,"context_lines":[{"line_number":95,"context_line":"export OS_PROJECT_NAME\u003d\"demoProject\""},{"line_number":96,"context_line":"TOKEN\u003d$(keystone_token)"},{"line_number":97,"context_line":"kubectl --kubeconfig /tmp/kubeconfig.yaml --token $TOKEN get ingress --all-namespaces"},{"line_number":98,"context_line":"if ! kubectl --kubeconfig /tmp/kubeconfig.yaml --token $TOKEN create namespace test ; then"},{"line_number":99,"context_line":"  echo \"Denied, as expected by policy\""},{"line_number":100,"context_line":"else"},{"line_number":101,"context_line":"  exit 1"},{"line_number":102,"context_line":"fi"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"export OS_USERNAME\u003d\"admin_k8cluster_view_user\""},{"line_number":105,"context_line":"export OS_PROJECT_NAME\u003d\"demoProject\""}],"source_content_type":"text/x-sh","patch_set":2,"id":"5f7c97a3_ab8139c4","line":102,"range":{"start_line":98,"start_character":0,"end_line":102,"end_character":2},"updated":"2018-06-26 15:51:43.000000000","message":"we need to test for the +ve cases here","commit_id":"323754d414d80a3942e46991409fa0a7a0864330"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"073d150c71c7ba813cbed5002dba13afe7426428","unresolved":false,"context_lines":[{"line_number":105,"context_line":"export OS_PROJECT_NAME\u003d\"demoProject\""},{"line_number":106,"context_line":"TOKEN\u003d$(keystone_token)"},{"line_number":107,"context_line":"kubectl --kubeconfig /tmp/kubeconfig.yaml --token $TOKEN get ingress --all-namespaces"},{"line_number":108,"context_line":"if ! kubectl --kubeconfig /tmp/kubeconfig.yaml --token $TOKEN create namespace test ; then"},{"line_number":109,"context_line":"  echo \"Denied, as expected by policy\""},{"line_number":110,"context_line":"else"},{"line_number":111,"context_line":"  exit 1"},{"line_number":112,"context_line":"fi"}],"source_content_type":"text/x-sh","patch_set":2,"id":"5f7c97a3_6b67a152","line":112,"range":{"start_line":108,"start_character":0,"end_line":112,"end_character":2},"updated":"2018-06-26 15:51:43.000000000","message":"we need to test for the +ve cases here","commit_id":"323754d414d80a3942e46991409fa0a7a0864330"},{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"2cf7381abe3d3c2bf5640de6edab046593dc1ac8","unresolved":false,"context_lines":[{"line_number":28,"context_line":""},{"line_number":29,"context_line":"function test_positive_kubectl_call () {"},{"line_number":30,"context_line":"  export OS_USERNAME\u003d$1"},{"line_number":31,"context_line":"  export OS_PROJECT_NAME\u003d\"demoProject\""},{"line_number":32,"context_line":"  TOKEN\u003d$(keystone_token)"},{"line_number":33,"context_line":"  if ! kubectl --kubeconfig /tmp/kubeconfig.yaml --token $TOKEN $2 ; then"},{"line_number":34,"context_line":"    report_failed_policy $1 \"not allowed\" \"$2\""}],"source_content_type":"text/x-sh","patch_set":3,"id":"5f7c97a3_ce3e0c89","line":31,"range":{"start_line":31,"start_character":25,"end_line":31,"end_character":38},"updated":"2018-07-09 16:48:34.000000000","message":"should we make this $2 and make this customizable too?","commit_id":"9434673772fc6678ca430302008dcc375bae9374"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"32c8713588df2287ac01e050e817e7010301a990","unresolved":false,"context_lines":[{"line_number":28,"context_line":""},{"line_number":29,"context_line":"function test_positive_kubectl_call () {"},{"line_number":30,"context_line":"  export OS_USERNAME\u003d$1"},{"line_number":31,"context_line":"  export OS_PROJECT_NAME\u003d\"demoProject\""},{"line_number":32,"context_line":"  TOKEN\u003d$(keystone_token)"},{"line_number":33,"context_line":"  if ! kubectl --kubeconfig /tmp/kubeconfig.yaml --token $TOKEN $2 ; then"},{"line_number":34,"context_line":"    report_failed_policy $1 \"not allowed\" \"$2\""}],"source_content_type":"text/x-sh","patch_set":3,"id":"5f7c97a3_6e20184a","line":31,"range":{"start_line":31,"start_character":25,"end_line":31,"end_character":38},"in_reply_to":"5f7c97a3_ce3e0c89","updated":"2018-07-09 16:53:27.000000000","message":"probably. I think everything here uses this project though, so it could either be done via customization, or just set once and not here.","commit_id":"9434673772fc6678ca430302008dcc375bae9374"},{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"2cf7381abe3d3c2bf5640de6edab046593dc1ac8","unresolved":false,"context_lines":[{"line_number":93,"context_line":"test_negative_kubectl_call \"demo_user\" \"get pods\""},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"#kube-system-admin"},{"line_number":96,"context_line":"test_negative_kubectl_call \"kube-system-admin\" \"get pods -n openstack\" "},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"#admin_k8cluser_user"},{"line_number":99,"context_line":"test_positive_kubectl_call \"admin_k8cluster_user\" \"get pods --all-namespaces\""}],"source_content_type":"text/x-sh","patch_set":3,"id":"5f7c97a3_8ebfb4fa","line":96,"range":{"start_line":96,"start_character":70,"end_line":96,"end_character":71},"updated":"2018-07-09 16:48:34.000000000","message":"ws","commit_id":"9434673772fc6678ca430302008dcc375bae9374"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"7b49d9a0357a7daa440cbe9460537c9cf595eda9","unresolved":false,"context_lines":[{"line_number":26,"context_line":"  exit 1"},{"line_number":27,"context_line":"}"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"function test_positive_kubectl () {"},{"line_number":30,"context_line":"  TOKEN\u003d$(keystone_token)"},{"line_number":31,"context_line":"  if ! kubectl --kubeconfig /tmp/kubeconfig.yaml --token $TOKEN $1 ; then"},{"line_number":32,"context_line":"    report_failed_policy \"$OS_USERNAME\" \"not allowed\" \"$1\""}],"source_content_type":"text/x-sh","patch_set":16,"id":"5f7c97a3_f994b39a","line":29,"range":{"start_line":29,"start_character":9,"end_line":29,"end_character":30},"updated":"2018-07-23 21:19:40.000000000","message":"Calling this something like: \"test_user_is_authorized\" would be more descriptive or something along those lines","commit_id":"04e788d85e325ad278f2a057490e9150136074db"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"7b49d9a0357a7daa440cbe9460537c9cf595eda9","unresolved":false,"context_lines":[{"line_number":33,"context_line":"  fi"},{"line_number":34,"context_line":"}"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"function test_negative_kubectl () {"},{"line_number":37,"context_line":"  TOKEN\u003d$(keystone_token)"},{"line_number":38,"context_line":"  if ! kubectl --kubeconfig /tmp/kubeconfig.yaml --token $TOKEN $1 ; then"},{"line_number":39,"context_line":"    echo \"Denied, as expected by policy\""}],"source_content_type":"text/x-sh","patch_set":16,"id":"5f7c97a3_199acfc3","line":36,"range":{"start_line":36,"start_character":9,"end_line":36,"end_character":30},"updated":"2018-07-23 21:19:40.000000000","message":"\"test_user_is_unauthorized\"","commit_id":"04e788d85e325ad278f2a057490e9150136074db"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"7b49d9a0357a7daa440cbe9460537c9cf595eda9","unresolved":false,"context_lines":[{"line_number":92,"context_line":"test_negative_kubectl \"get pods\""},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"export OS_PROJECT_NAME\u003d\"demoProject\""},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"#kube-system-admin"},{"line_number":97,"context_line":"export OS_USERNAME\u003d\"kube-system-admin\""},{"line_number":98,"context_line":"test_negative_kubectl \"get pods -n openstack\""}],"source_content_type":"text/x-sh","patch_set":16,"id":"5f7c97a3_d97c5773","line":95,"updated":"2018-07-23 21:19:40.000000000","message":"This code below is getting complicated enough that a function per test or series of tests would be more readable.","commit_id":"04e788d85e325ad278f2a057490e9150136074db"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"f6fcc800ca588b9d72db5d73bd6ee09cccf0ed05","unresolved":false,"context_lines":[{"line_number":104,"context_line":"#admin_k8cluster_edit_user"},{"line_number":105,"context_line":"export OS_USERNAME\u003d\"admin_k8cluster_edit_user\""},{"line_number":106,"context_line":"RESOURCES\u003d(\"pods\" \"configmaps\" \"endpoints\" \"persistentvolumeclaims\" \\"},{"line_number":107,"context_line":"\t   \"replicationcontrollers\" \"secrets\" \"serviceaccounts\" \\"},{"line_number":108,"context_line":"\t   \"services\")"},{"line_number":109,"context_line":"for r in \"${RESOURCES[@]}\" ; do"},{"line_number":110,"context_line":"  test_positive_kubectl \"get $r\""},{"line_number":111,"context_line":"done"}],"source_content_type":"text/x-sh","patch_set":16,"id":"5f7c97a3_f127edc7","line":108,"range":{"start_line":107,"start_character":0,"end_line":108,"end_character":15},"updated":"2018-07-23 21:08:06.000000000","message":"Tabs","commit_id":"04e788d85e325ad278f2a057490e9150136074db"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"afb218f0ed2d7587b11bd5459d184ca66e0afa72","unresolved":false,"context_lines":[{"line_number":133,"context_line":""},{"line_number":134,"context_line":"test_user_is_authorized \"create secret generic test-secret --from-file\u003d/tmp/user.txt --from-file\u003d/tmp/pass.txt\""},{"line_number":135,"context_line":"test_user_is_authorized \"delete secret test-secret\""},{"line_number":136,"context_line":"test_user_is_authorized \"logs $TEST_POD -n openstack\""},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"test_user_is_unauthorized \"create namespace test\""},{"line_number":139,"context_line":""}],"source_content_type":"text/x-sh","patch_set":18,"id":"5f7c97a3_84d36bd3","line":136,"range":{"start_line":136,"start_character":0,"end_line":136,"end_character":53},"updated":"2018-07-27 15:10:47.000000000","message":"can we redirect the output of this out of the way, or limit how much we get.","commit_id":"784cea34c77124d54b8428f50ce07c415a13a040"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"984e9aa4cf516dd4cc5e39fd317b32ef03d4edc1","unresolved":false,"context_lines":[{"line_number":133,"context_line":""},{"line_number":134,"context_line":"test_user_is_authorized \"create secret generic test-secret --from-file\u003d/tmp/user.txt --from-file\u003d/tmp/pass.txt\""},{"line_number":135,"context_line":"test_user_is_authorized \"delete secret test-secret\""},{"line_number":136,"context_line":"test_user_is_authorized \"logs $TEST_POD -n openstack\""},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"test_user_is_unauthorized \"create namespace test\""},{"line_number":139,"context_line":""}],"source_content_type":"text/x-sh","patch_set":18,"id":"5f7c97a3_67aad1d3","line":136,"range":{"start_line":136,"start_character":0,"end_line":136,"end_character":53},"in_reply_to":"5f7c97a3_84d36bd3","updated":"2018-07-27 15:27:31.000000000","message":"Done","commit_id":"784cea34c77124d54b8428f50ce07c415a13a040"}]}