)]}'
{"specs/easier-policy-modification.rst":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"f34d4e7855124e94527146e15c79df7048c6f3a9","unresolved":false,"context_lines":[{"line_number":45,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Use oslo.conf to get policy"},{"line_number":48,"context_line":"---------------------------"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"We have already established patterns around configuration with oslo.config,"},{"line_number":51,"context_line":"so I propose we make it possible to use olso.config to provide the current"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_46baa524","line":48,"updated":"2016-03-29 15:27:10.000000000","message":"Can you explain a bit more about what oslo.conf to get policy means?","commit_id":"1365bbe8e1c9e9711f9a881cf96b6e3bd2d728b8"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"f34d4e7855124e94527146e15c79df7048c6f3a9","unresolved":false,"context_lines":[{"line_number":60,"context_line":"* the default values are stored in the code"},{"line_number":61,"context_line":"* we use a generator"},{"line_number":62,"context_line":"* there is a description of what that configuration changes"},{"line_number":63,"context_line":"* we have the ability rename options through deprecated names"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Agree set of conventions for typical default roles"},{"line_number":66,"context_line":"--------------------------------------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_86d03d55","line":63,"updated":"2016-03-29 15:27:10.000000000","message":"It isn\u0027t clear what you\u0027re proposing here, I think I have a vague idea but would prefer to not make assumptions.","commit_id":"1365bbe8e1c9e9711f9a881cf96b6e3bd2d728b8"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"8ea8a2dc3551bf9a0ed50b5a9e07843a8fae5e58","unresolved":false,"context_lines":[{"line_number":60,"context_line":"* the default values are stored in the code"},{"line_number":61,"context_line":"* we use a generator"},{"line_number":62,"context_line":"* there is a description of what that configuration changes"},{"line_number":63,"context_line":"* we have the ability rename options through deprecated names"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Agree set of conventions for typical default roles"},{"line_number":66,"context_line":"--------------------------------------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_c3acaa37","line":63,"in_reply_to":"ba0121b8_86d03d55","updated":"2016-03-30 13:27:45.000000000","message":"Yes, I should try refine that.","commit_id":"1365bbe8e1c9e9711f9a881cf96b6e3bd2d728b8"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"f34d4e7855124e94527146e15c79df7048c6f3a9","unresolved":false,"context_lines":[{"line_number":63,"context_line":"* we have the ability rename options through deprecated names"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Agree set of conventions for typical default roles"},{"line_number":66,"context_line":"--------------------------------------------------"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Lets set a new convention for the default list of roles that are mentioned"},{"line_number":69,"context_line":"in all projects policy file:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_035fff41","line":66,"updated":"2016-03-29 15:27:10.000000000","message":"This is a great idea, unfortunately you also run into an issue where it is likely to break existing deployments / change semantics of authorization.\n\nWe\u0027ve done a bad job of managing policy in the past and now are paying for the technical debt that deployers rely on. The main purpose of the other proposal was it would be (except in extreme edge cases) non-disruptive of those using the current crummy default policy.","commit_id":"1365bbe8e1c9e9711f9a881cf96b6e3bd2d728b8"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"8ea8a2dc3551bf9a0ed50b5a9e07843a8fae5e58","unresolved":false,"context_lines":[{"line_number":63,"context_line":"* we have the ability rename options through deprecated names"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Agree set of conventions for typical default roles"},{"line_number":66,"context_line":"--------------------------------------------------"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Lets set a new convention for the default list of roles that are mentioned"},{"line_number":69,"context_line":"in all projects policy file:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_43c09ae0","line":66,"in_reply_to":"ba0121b8_035fff41","updated":"2016-03-30 13:27:45.000000000","message":"I agree with that, I am thinking about doing some work to allow fallback to previous roles and defaults, etc, like we do for config. I should add more about that in here.","commit_id":"1365bbe8e1c9e9711f9a881cf96b6e3bd2d728b8"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"f34d4e7855124e94527146e15c79df7048c6f3a9","unresolved":false,"context_lines":[{"line_number":97,"context_line":"    will allow to send network events into Nova)"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"Policy Config to match URL endpoint"},{"line_number":100,"context_line":"-----------------------------------"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"We need to create a new opt types in oslo.config that allows you to validate"},{"line_number":103,"context_line":"the file is correct. We must have checks in oslo.polcy to ensure any"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_2618511d","line":100,"updated":"2016-03-29 15:27:10.000000000","message":"I think we\u0027re just going to move the issue from a complex hard to manage policy file to a complex hard to manage config file (with less flexibility that the deployers already rely on).","commit_id":"1365bbe8e1c9e9711f9a881cf96b6e3bd2d728b8"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"8ea8a2dc3551bf9a0ed50b5a9e07843a8fae5e58","unresolved":false,"context_lines":[{"line_number":97,"context_line":"    will allow to send network events into Nova)"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"Policy Config to match URL endpoint"},{"line_number":100,"context_line":"-----------------------------------"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"We need to create a new opt types in oslo.config that allows you to validate"},{"line_number":103,"context_line":"the file is correct. We must have checks in oslo.polcy to ensure any"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba0121b8_952145a2","line":100,"in_reply_to":"ba0121b8_2618511d","updated":"2016-03-30 13:27:45.000000000","message":"But with the defaults in the code, so its clear what the overrides are, along with some deprecation cycle for old names and groups, etc, I think we are in a much happier place.\n\nI am not sure oslo.config is the best fit, its just they have already built most of the plumbing and deployers understand the patterns already, so it would be good to reuse those concepts, even if we don\u0027t end up re-using the implementation.","commit_id":"1365bbe8e1c9e9711f9a881cf96b6e3bd2d728b8"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3d65b69b39814b4cefe55a04333436eb98804ca2","unresolved":false,"context_lines":[{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"At recent operators meetups, when configuration has been discussed the"},{"line_number":6,"context_line":"current difficulty around modify policy configuration has been raised."},{"line_number":7,"context_line":"It seems most has to restore the default policy configuration files in"},{"line_number":8,"context_line":"order to get a working system"},{"line_number":9,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_c8060685","line":6,"updated":"2016-04-01 16:19:10.000000000","message":"And at the Tokyo summit! I forget which session, but it was a Keystone design session.","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3d65b69b39814b4cefe55a04333436eb98804ca2","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Many projects have a very limited default policy file. If we have a better"},{"line_number":14,"context_line":"range of roles available in the default policy file, we can avoid the need for"},{"line_number":15,"context_line":"many operators to edit the policy file at all. When moving between projects,"},{"line_number":16,"context_line":"ideally they would all follow common patterns for the default policy."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Across upgrades, it can be hard to understand the changes that have happened"},{"line_number":19,"context_line":"to the default policy file, and how that relates to modifications you have"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_281ea20b","line":16,"updated":"2016-04-01 16:19:10.000000000","message":"That is basically this proposal https://review.openstack.org/#/c/245629/","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7060040231bc626a4e50a05ecd7de1b21fdc6056","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Many projects have a very limited default policy file. If we have a better"},{"line_number":14,"context_line":"range of roles available in the default policy file, we can avoid the need for"},{"line_number":15,"context_line":"many operators to edit the policy file at all. When moving between projects,"},{"line_number":16,"context_line":"ideally they would all follow common patterns for the default policy."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Across upgrades, it can be hard to understand the changes that have happened"},{"line_number":19,"context_line":"to the default policy file, and how that relates to modifications you have"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a061dce_1d1141ad","line":16,"in_reply_to":"ba0121b8_281ea20b","updated":"2016-04-04 14:32:04.000000000","message":"yes, I should reference that.","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3d65b69b39814b4cefe55a04333436eb98804ca2","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Across upgrades, it can be hard to understand the changes that have happened"},{"line_number":19,"context_line":"to the default policy file, and how that relates to modifications you have"},{"line_number":20,"context_line":"made to the previous default policy file. It to identify new policy rules vs"},{"line_number":21,"context_line":"name changes vs new defaults."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"The trend towards microversions over API extensions, now means if you"},{"line_number":24,"context_line":"don\u0027t want users to have access to a particular API, you must modify the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_88ac0e8d","line":21,"updated":"2016-04-01 16:19:10.000000000","message":"+1","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3d65b69b39814b4cefe55a04333436eb98804ca2","unresolved":false,"context_lines":[{"line_number":28,"context_line":"currently very hard to find the specific policy rule without reading the"},{"line_number":29,"context_line":"source code. There is no description for the specific policy. In many cases"},{"line_number":30,"context_line":"the default policy is such that many different policy changes are required"},{"line_number":31,"context_line":"to enable one specific API call."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"End users also have issues discovering what they are allowed to do with a"},{"line_number":34,"context_line":"particular API. Exposing the current policy configuration would simply expose"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_28c86254","line":31,"updated":"2016-04-01 16:19:10.000000000","message":"Does this problem apply to project\u0027s other than Nova? Nova\u0027s use of policy is deeply ingrained, whereas it directly parallels documented HTTP API calls in keystone.","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7060040231bc626a4e50a05ecd7de1b21fdc6056","unresolved":false,"context_lines":[{"line_number":28,"context_line":"currently very hard to find the specific policy rule without reading the"},{"line_number":29,"context_line":"source code. There is no description for the specific policy. In many cases"},{"line_number":30,"context_line":"the default policy is such that many different policy changes are required"},{"line_number":31,"context_line":"to enable one specific API call."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"End users also have issues discovering what they are allowed to do with a"},{"line_number":34,"context_line":"particular API. Exposing the current policy configuration would simply expose"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a061dce_0388c421","line":31,"in_reply_to":"ba0121b8_28c86254","updated":"2016-04-04 14:32:04.000000000","message":"So I guess its fine if folks have already done this, but I still think its good to include to align across project.\n\nThe problem in Nova was the API extension system, the policy maps to that instead. Its too admin focused to make a discoverable system from it.","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3d65b69b39814b4cefe55a04333436eb98804ca2","unresolved":false,"context_lines":[{"line_number":33,"context_line":"End users also have issues discovering what they are allowed to do with a"},{"line_number":34,"context_line":"particular API. Exposing the current policy configuration would simply expose"},{"line_number":35,"context_line":"end users to all the problems deployers are currently facing when trying to"},{"line_number":36,"context_line":"understand the policy configuration. This is complicated by there being other"},{"line_number":37,"context_line":"reasons why certain actions are not allowed, outside of policy restrictions,"},{"line_number":38,"context_line":"for example being unable to resize a server while a snapshot is happening."},{"line_number":39,"context_line":"Defcore helps by setting a minimum number of actions all users should have"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_88c7ee62","line":36,"updated":"2016-04-01 16:19:10.000000000","message":"+1","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3d65b69b39814b4cefe55a04333436eb98804ca2","unresolved":false,"context_lines":[{"line_number":35,"context_line":"end users to all the problems deployers are currently facing when trying to"},{"line_number":36,"context_line":"understand the policy configuration. This is complicated by there being other"},{"line_number":37,"context_line":"reasons why certain actions are not allowed, outside of policy restrictions,"},{"line_number":38,"context_line":"for example being unable to resize a server while a snapshot is happening."},{"line_number":39,"context_line":"Defcore helps by setting a minimum number of actions all users should have"},{"line_number":40,"context_line":"access to, but this does not help with more optional features, often relating"},{"line_number":41,"context_line":"to two possible ways to achieve the same aim, that are technology specific,"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_48983678","line":38,"updated":"2016-04-01 16:19:10.000000000","message":"Hopefully Nova is not returning 403\u0027s in this scenario? This sounds much more like a 409.","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7060040231bc626a4e50a05ecd7de1b21fdc6056","unresolved":false,"context_lines":[{"line_number":35,"context_line":"end users to all the problems deployers are currently facing when trying to"},{"line_number":36,"context_line":"understand the policy configuration. This is complicated by there being other"},{"line_number":37,"context_line":"reasons why certain actions are not allowed, outside of policy restrictions,"},{"line_number":38,"context_line":"for example being unable to resize a server while a snapshot is happening."},{"line_number":39,"context_line":"Defcore helps by setting a minimum number of actions all users should have"},{"line_number":40,"context_line":"access to, but this does not help with more optional features, often relating"},{"line_number":41,"context_line":"to two possible ways to achieve the same aim, that are technology specific,"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a061dce_bd93f5f9","line":38,"in_reply_to":"ba0121b8_48983678","updated":"2016-04-04 14:32:04.000000000","message":"Yup, we use 409 for that kind of thing.\n\nIts a very poor example really, I was more meaning things like this ironic based flavor will not support snapshot.","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3d65b69b39814b4cefe55a04333436eb98804ca2","unresolved":false,"context_lines":[{"line_number":62,"context_line":"Some observations around adopting this approach:"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"* the default values are stored in the code"},{"line_number":65,"context_line":"* we use a generator"},{"line_number":66,"context_line":"* there is a description of what that configuration changes"},{"line_number":67,"context_line":"* we have the ability rename options through deprecated names"},{"line_number":68,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_c81446a1","line":65,"updated":"2016-04-01 16:19:10.000000000","message":"? This sounds like a minor implementation detail, not a trait of the overall approach.","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7060040231bc626a4e50a05ecd7de1b21fdc6056","unresolved":false,"context_lines":[{"line_number":62,"context_line":"Some observations around adopting this approach:"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"* the default values are stored in the code"},{"line_number":65,"context_line":"* we use a generator"},{"line_number":66,"context_line":"* there is a description of what that configuration changes"},{"line_number":67,"context_line":"* we have the ability rename options through deprecated names"},{"line_number":68,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a061dce_bd813592","line":65,"in_reply_to":"ba0121b8_c81446a1","updated":"2016-04-04 14:32:04.000000000","message":"this is poor wording, it meant \"automatically generate the sample config file from the code\"","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"61efd2f3163fc2285235524bbf6339418223f3c3","unresolved":false,"context_lines":[{"line_number":64,"context_line":"* the default values are stored in the code"},{"line_number":65,"context_line":"* we use a generator"},{"line_number":66,"context_line":"* there is a description of what that configuration changes"},{"line_number":67,"context_line":"* we have the ability rename options through deprecated names"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Agree set of conventions for typical default roles"},{"line_number":70,"context_line":"--------------------------------------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_f85eb810","line":67,"updated":"2016-03-30 13:53:44.000000000","message":"Please read through my spec at https://review.openstack.org/#/c/290155/ where I propose something similar to this. I don\u0027t think leveraging oslo.conf is the right thing here, but I think making oslo.policy work similarly makes a lot of sense. The grouping aspect of oslo.conf doesn\u0027t quite match what I think we\u0027ll ultimately want.","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7060040231bc626a4e50a05ecd7de1b21fdc6056","unresolved":false,"context_lines":[{"line_number":64,"context_line":"* the default values are stored in the code"},{"line_number":65,"context_line":"* we use a generator"},{"line_number":66,"context_line":"* there is a description of what that configuration changes"},{"line_number":67,"context_line":"* we have the ability rename options through deprecated names"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Agree set of conventions for typical default roles"},{"line_number":70,"context_line":"--------------------------------------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a061dce_7d25ddc0","line":67,"in_reply_to":"ba0121b8_f85eb810","updated":"2016-04-04 14:32:04.000000000","message":"yeah, I am not sure I like oslo.conf either, it just happens to implement most of what we want, long term.\n\nI should put use oslo.conf in the alternatives actually.","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"61efd2f3163fc2285235524bbf6339418223f3c3","unresolved":false,"context_lines":[{"line_number":73,"context_line":"understand what they relate and are consistent between different project."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"This is discussed in depth in the spec on common default policy:"},{"line_number":76,"context_line":"https://review.openstack.org/#/c/245629"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Policy Config to match URL endpoint"},{"line_number":79,"context_line":"-----------------------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_18056cbb","line":76,"updated":"2016-03-30 13:53:44.000000000","message":"This is a far broader topic then the 4 lines of description here make it appear. And I think this is something that has to follow some work to make policy work more like configs. There is no deprecation/rename mechanism currently and doing these sorts of changes are going to get messy without that.","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7060040231bc626a4e50a05ecd7de1b21fdc6056","unresolved":false,"context_lines":[{"line_number":73,"context_line":"understand what they relate and are consistent between different project."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"This is discussed in depth in the spec on common default policy:"},{"line_number":76,"context_line":"https://review.openstack.org/#/c/245629"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Policy Config to match URL endpoint"},{"line_number":79,"context_line":"-----------------------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_1684e65b","line":76,"in_reply_to":"ba0121b8_18056cbb","updated":"2016-04-04 14:32:04.000000000","message":"yeah, agreed, this was a quick fix for me making a bad job of it. that spec does cover the details.","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3d65b69b39814b4cefe55a04333436eb98804ca2","unresolved":false,"context_lines":[{"line_number":82,"context_line":""},{"line_number":83,"context_line":"We need to create a new opt types in oslo.config that allows you to validate"},{"line_number":84,"context_line":"the file is correct. We must have checks in oslo.polcy to ensure any"},{"line_number":85,"context_line":"referenced rules are actually defined."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"The default section holds rules that can be referenced in other sections."},{"line_number":88,"context_line":"The rules can reference any bit of context object, in the usual way."}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_e884aad3","line":85,"updated":"2016-04-01 16:19:10.000000000","message":"Rules don\u0027t need to be defined today - you can just set a \"default\" rule and be done. For example, default deny all policy checks without defining anything more:\n\n  {\n      \"default\": \"!\"\n  }","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7060040231bc626a4e50a05ecd7de1b21fdc6056","unresolved":false,"context_lines":[{"line_number":82,"context_line":""},{"line_number":83,"context_line":"We need to create a new opt types in oslo.config that allows you to validate"},{"line_number":84,"context_line":"the file is correct. We must have checks in oslo.polcy to ensure any"},{"line_number":85,"context_line":"referenced rules are actually defined."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"The default section holds rules that can be referenced in other sections."},{"line_number":88,"context_line":"The rules can reference any bit of context object, in the usual way."}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a061dce_e3d4b048","line":85,"in_reply_to":"ba0121b8_e884aad3","updated":"2016-04-04 14:32:04.000000000","message":"I think we should be more explicit, when we have the defaults in the code, that any undefined rule fails. I should probably say that instead!\n\nAs an aside, we are having issues with that, I need to dig into why.","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"61efd2f3163fc2285235524bbf6339418223f3c3","unresolved":false,"context_lines":[{"line_number":97,"context_line":"* flavors"},{"line_number":98,"context_line":"* os-aggregates"},{"line_number":99,"context_line":"* servers"},{"line_number":100,"context_line":"* servers.metadata"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"For example: TODO..."},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_58052478","line":100,"updated":"2016-03-30 13:53:44.000000000","message":"This warrants more discussion because I\u0027m not yet convinced that endpoints are the right mapping here. I proposed a concept of capabilities which map to actions a user might want to take. That would allow for expressing something like \"booting an instance requires policy to pass for flavors/images/servers and potentially volumes\" which I think is more in line with what users and clients care about.","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7060040231bc626a4e50a05ecd7de1b21fdc6056","unresolved":false,"context_lines":[{"line_number":97,"context_line":"* flavors"},{"line_number":98,"context_line":"* os-aggregates"},{"line_number":99,"context_line":"* servers"},{"line_number":100,"context_line":"* servers.metadata"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"For example: TODO..."},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_b6e25a2d","line":100,"in_reply_to":"ba0121b8_58052478","updated":"2016-04-04 14:32:04.000000000","message":"I like the idea of capabilities, I just worry about how we then map them to API calls, but thats probably a better way to go.","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3d65b69b39814b4cefe55a04333436eb98804ca2","unresolved":false,"context_lines":[{"line_number":106,"context_line":""},{"line_number":107,"context_line":"We could do nothing, but operators have issues that need fixing."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"There are proposals to store all policy in keystone, in a central location."},{"line_number":110,"context_line":"But it feels like getting a better understanding of policy in each project"},{"line_number":111,"context_line":"would be a pre-requisite to more centralization efforts."},{"line_number":112,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_08d0fec7","line":109,"updated":"2016-04-01 16:19:10.000000000","message":"Keystone has the capability to centralize policy storage today - but nothing consumes that API.","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"61efd2f3163fc2285235524bbf6339418223f3c3","unresolved":false,"context_lines":[{"line_number":109,"context_line":"There are proposals to store all policy in keystone, in a central location."},{"line_number":110,"context_line":"But it feels like getting a better understanding of policy in each project"},{"line_number":111,"context_line":"would be a pre-requisite to more centralization efforts."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"Implementation"},{"line_number":114,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":115,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba0121b8_d8f93482","line":112,"updated":"2016-03-30 13:53:44.000000000","message":"https://review.openstack.org/#/c/290155/ :)","commit_id":"6e15cf16017c6378b7e6598f78c83e5699d7bb28"}],"specs/policy-problems.rst":[{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"96e0c2369f3adae04ef80f33046b93aff4cb9591","unresolved":false,"context_lines":[{"line_number":19,"context_line":"This is being discussed within keystone, and here:"},{"line_number":20,"context_line":"https://review.openstack.org/#/c/245629/"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"When trying to create a new role, or modifying a particular API call, it is"},{"line_number":23,"context_line":"currently very hard to find the specific policy rule without reading the"},{"line_number":24,"context_line":"source code. There is no description for the specific policy. In many cases"},{"line_number":25,"context_line":"the default policy is such that many different policy changes are required"},{"line_number":26,"context_line":"to enable one specific API call. This is not a universal problem, Keystone"},{"line_number":27,"context_line":"for example tried to ensure only only policy rule is needed for each API call"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a122d0e_72ba0825","line":24,"range":{"start_line":22,"start_character":70,"end_line":24,"end_character":12},"updated":"2016-04-17 14:54:32.000000000","message":"There is no way to inject some comments in the current json format policy. There should be some comments to explain for some sceptical or explain for some upgrade problem which described at line 32","commit_id":"aaf9939048987fae479a2e78e6f1893d1f1b7728"},{"author":{"_account_id":748,"name":"Armando Migliaccio","email":"armamig@gmail.com","username":"armando-migliaccio"},"change_message_id":"6feb557a44f2cadca9d7b1a00569461302c13cce","unresolved":false,"context_lines":[{"line_number":34,"context_line":"made to the previous default policy file. It to identify new policy rules vs"},{"line_number":35,"context_line":"name changes vs new defaults."},{"line_number":36,"context_line":"Nova are looking at how to make this happen in Newton:"},{"line_number":37,"context_line":"https://review.openstack.org/#/c/290155"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"End users also have issues discovering what they are allowed to do with a"},{"line_number":40,"context_line":"particular API. Exposing the current policy configuration would simply expose"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a18252c_9461593c","line":37,"updated":"2016-04-13 17:12:04.000000000","message":"I wonder if a text file to store policies has outlived its ability to suit the needs of such a complex system like openstack and its individual projects. Editing a policy file is very error prone without precautions, especially in deployments where multiple active service replicas, that rely on the policy file to be both syntactically and semantically correct, exist.","commit_id":"aaf9939048987fae479a2e78e6f1893d1f1b7728"},{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"96e0c2369f3adae04ef80f33046b93aff4cb9591","unresolved":false,"context_lines":[{"line_number":54,"context_line":"The trend towards microversions over API extensions, now means if you"},{"line_number":55,"context_line":"don\u0027t want users to have access to a particular API, you must modify the"},{"line_number":56,"context_line":"policy. Previously you could changing the list of enabled extensions."},{"line_number":57,"context_line":"This makes this it more urgent to solve these problems."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Proposed change"},{"line_number":60,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a122d0e_528eec78","line":57,"updated":"2016-04-17 14:54:32.000000000","message":"This sounds like something we don\u0027t expect operator to do. There is note which point out by Sean http://docs.openstack.org/developer/nova/policy_enforcement.html#existed-nova-api-being-restricted","commit_id":"aaf9939048987fae479a2e78e6f1893d1f1b7728"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"bd1d0e450dcd315089afd5dce51c43501d91d8f7","unresolved":false,"context_lines":[{"line_number":77,"context_line":"Work Items"},{"line_number":78,"context_line":"----------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"TODO"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a061dce_ba004903","line":80,"updated":"2016-04-07 17:34:07.000000000","message":"ides for this list:\n - work with empty file (defaults in code)\n - aliasing (so that names can be changed) \n - hierachical processing (so that foo:bar is the fall back if\n - optimized (for ux) way to specify overrides\n - warning of dangerous changes","commit_id":"aaf9939048987fae479a2e78e6f1893d1f1b7728"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"8f2332afaa482b2a7f5b6772dba0e1e46fe1c6f9","unresolved":false,"context_lines":[{"line_number":77,"context_line":"Work Items"},{"line_number":78,"context_line":"----------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"TODO"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a061dce_ffac2e8e","line":80,"in_reply_to":"9a061dce_ba004903","updated":"2016-04-08 19:13:09.000000000","message":"On hierarchical processing there\u0027s nothing in oslo.policy that enforces a hierarchy. The Nova convention is to use \u0027:\u0027 separated policy hierarchies but we could just as easily do things like \u0027compute_api_servers_create\u0027 or \u0027POST /servers\u0027 instead which leaves no natural hierarchy. So we would first need general agreement that enforcing a hierarchy structure in policy makes sense.","commit_id":"aaf9939048987fae479a2e78e6f1893d1f1b7728"}]}