)]}'
{"specs/patrole-keystone-gate.rst":[{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"8ef3e066cf66fad5f7a85282a3e1f9769e65eaf4","unresolved":false,"context_lines":[{"line_number":63,"context_line":"Policy verification is performed by:"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"1. Pooling together the default `in-code` policy rules."},{"line_number":66,"context_line":"2. Overriding the defaults with custom policy rules located in a policy.json,"},{"line_number":67,"context_line":"   if the policy file exists and the custom policy definition is explicitly"},{"line_number":68,"context_line":"   defined therein."},{"line_number":69,"context_line":"3. Confirming that the policy action -- for example, \"list_users\" -- exists."},{"line_number":70,"context_line":"4. Performing a call with all necessary data (including metadata) to"},{"line_number":71,"context_line":"   ``oslo.policy``."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_ec6cfd9d","line":68,"range":{"start_line":66,"start_character":3,"end_line":68,"end_character":19},"updated":"2018-05-03 18:43:12.000000000","message":"This surprised me. After reading the Patrole intro section above, I had the impression that we needed things to be moved into policy-in-code to be tested. Is it that policy-in-code work needs to be in place first BUT Patrole will also scoop up overrides that exist in the respective policy.json file?","commit_id":"d4b8572b41279c07a1c2be4549c47b19deb63092"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"6fc6911863af2c6e013b197cdf6d0b33d58efc43","unresolved":false,"context_lines":[{"line_number":63,"context_line":"Policy verification is performed by:"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"1. Pooling together the default `in-code` policy rules."},{"line_number":66,"context_line":"2. Overriding the defaults with custom policy rules located in a policy.json,"},{"line_number":67,"context_line":"   if the policy file exists and the custom policy definition is explicitly"},{"line_number":68,"context_line":"   defined therein."},{"line_number":69,"context_line":"3. Confirming that the policy action -- for example, \"list_users\" -- exists."},{"line_number":70,"context_line":"4. Performing a call with all necessary data (including metadata) to"},{"line_number":71,"context_line":"   ``oslo.policy``."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_8d121558","line":68,"range":{"start_line":66,"start_character":3,"end_line":68,"end_character":19},"in_reply_to":"5f7c97a3_37aec22e","updated":"2018-05-04 17:03:16.000000000","message":"So, what about spoke with Neutron folks to push this policy-in-code change or just don\u0027t do this for services that don\u0027t work as policy-in-code compliance? We were doing it for a while and it\u0027s a cross-project effort, I\u0027m just afraid that doing this on this way, that might encourage those projects to don\u0027t update those policies implementations, since the \"default\" way to test it, still with policy.json files.","commit_id":"d4b8572b41279c07a1c2be4549c47b19deb63092"},{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"a449946dc13dc741a5ee8ccd67e8bf5a994ac9e1","unresolved":false,"context_lines":[{"line_number":63,"context_line":"Policy verification is performed by:"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"1. Pooling together the default `in-code` policy rules."},{"line_number":66,"context_line":"2. Overriding the defaults with custom policy rules located in a policy.json,"},{"line_number":67,"context_line":"   if the policy file exists and the custom policy definition is explicitly"},{"line_number":68,"context_line":"   defined therein."},{"line_number":69,"context_line":"3. Confirming that the policy action -- for example, \"list_users\" -- exists."},{"line_number":70,"context_line":"4. Performing a call with all necessary data (including metadata) to"},{"line_number":71,"context_line":"   ``oslo.policy``."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_94799494","line":68,"range":{"start_line":66,"start_character":3,"end_line":68,"end_character":19},"in_reply_to":"5f7c97a3_8d121558","updated":"2018-05-08 13:42:14.000000000","message":"There are complications that make Neutron completing the policy-in-code community goal difficult (specifics can be looked up and cited if needed).\n\n@Felipe -- no need to specifically test /only/ policy-in-code at this point. I\u0027m envisioning this gate assisting us in testing out the proposed default roles[1] which will actually involve both policy.json files as well as policy-in-code.\n\n[1] - https://review.openstack.org/#/c/464678/","commit_id":"d4b8572b41279c07a1c2be4549c47b19deb63092"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"b93f9433759a4de7d707b6753d81250cdb72c8e0","unresolved":false,"context_lines":[{"line_number":63,"context_line":"Policy verification is performed by:"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"1. Pooling together the default `in-code` policy rules."},{"line_number":66,"context_line":"2. Overriding the defaults with custom policy rules located in a policy.json,"},{"line_number":67,"context_line":"   if the policy file exists and the custom policy definition is explicitly"},{"line_number":68,"context_line":"   defined therein."},{"line_number":69,"context_line":"3. Confirming that the policy action -- for example, \"list_users\" -- exists."},{"line_number":70,"context_line":"4. Performing a call with all necessary data (including metadata) to"},{"line_number":71,"context_line":"   ``oslo.policy``."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_f2cf9cad","line":68,"range":{"start_line":66,"start_character":3,"end_line":68,"end_character":19},"in_reply_to":"5f7c97a3_94799494","updated":"2018-05-09 15:28:42.000000000","message":"@Harry, I believe you meant this spec: https://review.openstack.org/#/c/566377/\n\nI\u0027ve looked at Neutron\u0027s policy implementation and I agree that making the transition will be challenging for them.\n\nI think I will need to emphasize the link on L22 better because that documentation highlights which tests have a higher degree of accuracy in terms of validating the correct API to policy mapping.","commit_id":"d4b8572b41279c07a1c2be4549c47b19deb63092"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"38fd0b523069d32f5076d23b905d2ef8b6b16de9","unresolved":false,"context_lines":[{"line_number":63,"context_line":"Policy verification is performed by:"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"1. Pooling together the default `in-code` policy rules."},{"line_number":66,"context_line":"2. Overriding the defaults with custom policy rules located in a policy.json,"},{"line_number":67,"context_line":"   if the policy file exists and the custom policy definition is explicitly"},{"line_number":68,"context_line":"   defined therein."},{"line_number":69,"context_line":"3. Confirming that the policy action -- for example, \"list_users\" -- exists."},{"line_number":70,"context_line":"4. Performing a call with all necessary data (including metadata) to"},{"line_number":71,"context_line":"   ``oslo.policy``."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_37aec22e","line":68,"range":{"start_line":66,"start_character":3,"end_line":68,"end_character":19},"in_reply_to":"5f7c97a3_ec6cfd9d","updated":"2018-05-03 20:32:37.000000000","message":"Yes, so far this is the use case we\u0027ve used internally at AT\u0026T. However, if you like we can introduce a configuration option to _only_ select from policy in code defaults.\n\nThe background on this is that prior to policy in code we had to rely on the policy.json file. Neutron (last I checked) still hasn\u0027t implemented the policy in code spec. This is mostly intended to satisfy the fact that policy.json files are incomplete requiring a deference to the policy in code to fill in the gaps. This, I agree, is not ideal, but was kept in to work with older clouds.","commit_id":"d4b8572b41279c07a1c2be4549c47b19deb63092"},{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"8ef3e066cf66fad5f7a85282a3e1f9769e65eaf4","unresolved":false,"context_lines":[{"line_number":110,"context_line":"  testing stability, please reference"},{"line_number":111,"context_line":"  `OpenStack Health \u003chttp://status.openstack.org/openstack-health/#/?searchProject\u003dpatrole\u0026duration\u003dP14D\u003e`_."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"The solution is to add a Patrole non-voting gate in Keystone, responsible"},{"line_number":114,"context_line":"for testing Keystone-specific APIs or for testing all Big Tent APIs. Patrole"},{"line_number":115,"context_line":"runs gates for admin and Member roles for the aforementioned OpenStack services"},{"line_number":116,"context_line":"though any role can be used."},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_8c2c6948","line":114,"range":{"start_line":113,"start_character":0,"end_line":114,"end_character":68},"updated":"2018-05-03 18:43:12.000000000","message":"I believe we should pick one or the other in the spec -- even if we change our minds later.","commit_id":"d4b8572b41279c07a1c2be4549c47b19deb63092"},{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"a449946dc13dc741a5ee8ccd67e8bf5a994ac9e1","unresolved":false,"context_lines":[{"line_number":110,"context_line":"  testing stability, please reference"},{"line_number":111,"context_line":"  `OpenStack Health \u003chttp://status.openstack.org/openstack-health/#/?searchProject\u003dpatrole\u0026duration\u003dP14D\u003e`_."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"The solution is to add a Patrole non-voting gate in Keystone, responsible"},{"line_number":114,"context_line":"for testing Keystone-specific APIs or for testing all Big Tent APIs. Patrole"},{"line_number":115,"context_line":"runs gates for admin and Member roles for the aforementioned OpenStack services"},{"line_number":116,"context_line":"though any role can be used."},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_5481bc49","line":114,"range":{"start_line":113,"start_character":0,"end_line":114,"end_character":68},"in_reply_to":"5f7c97a3_377322ea","updated":"2018-05-08 13:42:14.000000000","message":"Felipe -- that is a difficult question to answer. I\u0027ll be discussing this spec with the Keystone team today. If we can agree that this might be the best way to test out our default roles work[1] than I would say the former.\n\nIf not, this spec will likely be part of the larger testing requirement of moving [1] from a PoC in Keystone (and hopefully Barbican) to the wider audience of OpenStack services.\n\n[1] - https://review.openstack.org/#/c/559137/1/specs/patrole-keystone-gate.rst","commit_id":"d4b8572b41279c07a1c2be4549c47b19deb63092"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"b93f9433759a4de7d707b6753d81250cdb72c8e0","unresolved":false,"context_lines":[{"line_number":110,"context_line":"  testing stability, please reference"},{"line_number":111,"context_line":"  `OpenStack Health \u003chttp://status.openstack.org/openstack-health/#/?searchProject\u003dpatrole\u0026duration\u003dP14D\u003e`_."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"The solution is to add a Patrole non-voting gate in Keystone, responsible"},{"line_number":114,"context_line":"for testing Keystone-specific APIs or for testing all Big Tent APIs. Patrole"},{"line_number":115,"context_line":"runs gates for admin and Member roles for the aforementioned OpenStack services"},{"line_number":116,"context_line":"though any role can be used."},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_f2447c1d","line":114,"range":{"start_line":113,"start_character":0,"end_line":114,"end_character":68},"in_reply_to":"5f7c97a3_5481bc49","updated":"2018-05-09 15:28:42.000000000","message":"I will use wording to say that we should most certainly start out with testing all of keystone v3 then we can toggle on additional services by changing the regex we use for test selection in .zuul.yaml job definition that manifests from this spec.","commit_id":"d4b8572b41279c07a1c2be4549c47b19deb63092"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"38fd0b523069d32f5076d23b905d2ef8b6b16de9","unresolved":false,"context_lines":[{"line_number":110,"context_line":"  testing stability, please reference"},{"line_number":111,"context_line":"  `OpenStack Health \u003chttp://status.openstack.org/openstack-health/#/?searchProject\u003dpatrole\u0026duration\u003dP14D\u003e`_."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"The solution is to add a Patrole non-voting gate in Keystone, responsible"},{"line_number":114,"context_line":"for testing Keystone-specific APIs or for testing all Big Tent APIs. Patrole"},{"line_number":115,"context_line":"runs gates for admin and Member roles for the aforementioned OpenStack services"},{"line_number":116,"context_line":"though any role can be used."},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_377322ea","line":114,"range":{"start_line":113,"start_character":0,"end_line":114,"end_character":68},"in_reply_to":"5f7c97a3_8c2c6948","updated":"2018-05-03 20:32:37.000000000","message":"Hmm, is there a preference? Please bear my first question in mind: Neutron doesn\u0027t have policy in code. This makes it extremely difficult to validate the mapping we assume. And this is why policy in code is such a nice innovation as it makes the mapping transparent, canonical and capable of being validated.","commit_id":"d4b8572b41279c07a1c2be4549c47b19deb63092"},{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"8ef3e066cf66fad5f7a85282a3e1f9769e65eaf4","unresolved":false,"context_lines":[{"line_number":111,"context_line":"  `OpenStack Health \u003chttp://status.openstack.org/openstack-health/#/?searchProject\u003dpatrole\u0026duration\u003dP14D\u003e`_."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"The solution is to add a Patrole non-voting gate in Keystone, responsible"},{"line_number":114,"context_line":"for testing Keystone-specific APIs or for testing all Big Tent APIs. Patrole"},{"line_number":115,"context_line":"runs gates for admin and Member roles for the aforementioned OpenStack services"},{"line_number":116,"context_line":"though any role can be used."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"Should the Keystone team decide to change the gate from non-voting to voting"},{"line_number":119,"context_line":"or make any other minor alterations, it is now fairly trivial to do so with"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_2ce67518","line":116,"range":{"start_line":114,"start_character":69,"end_line":116,"end_character":28},"updated":"2018-05-03 18:43:12.000000000","message":"Are we limited to running these roles? Could we add/remove roles now or is additional functionality needed within the code?","commit_id":"d4b8572b41279c07a1c2be4549c47b19deb63092"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"38fd0b523069d32f5076d23b905d2ef8b6b16de9","unresolved":false,"context_lines":[{"line_number":111,"context_line":"  `OpenStack Health \u003chttp://status.openstack.org/openstack-health/#/?searchProject\u003dpatrole\u0026duration\u003dP14D\u003e`_."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"The solution is to add a Patrole non-voting gate in Keystone, responsible"},{"line_number":114,"context_line":"for testing Keystone-specific APIs or for testing all Big Tent APIs. Patrole"},{"line_number":115,"context_line":"runs gates for admin and Member roles for the aforementioned OpenStack services"},{"line_number":116,"context_line":"though any role can be used."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"Should the Keystone team decide to change the gate from non-voting to voting"},{"line_number":119,"context_line":"or make any other minor alterations, it is now fairly trivial to do so with"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_576c9e07","line":116,"range":{"start_line":114,"start_character":69,"end_line":116,"end_character":28},"in_reply_to":"5f7c97a3_2ce67518","updated":"2018-05-03 20:32:37.000000000","message":"No, you\u0027re not limited to any role, so long as it exists in the system. We use the framework to test against 10 or so roles internally.","commit_id":"d4b8572b41279c07a1c2be4549c47b19deb63092"},{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"a449946dc13dc741a5ee8ccd67e8bf5a994ac9e1","unresolved":false,"context_lines":[{"line_number":111,"context_line":"  `OpenStack Health \u003chttp://status.openstack.org/openstack-health/#/?searchProject\u003dpatrole\u0026duration\u003dP14D\u003e`_."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"The solution is to add a Patrole non-voting gate in Keystone, responsible"},{"line_number":114,"context_line":"for testing Keystone-specific APIs or for testing all Big Tent APIs. Patrole"},{"line_number":115,"context_line":"runs gates for admin and Member roles for the aforementioned OpenStack services"},{"line_number":116,"context_line":"though any role can be used."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"Should the Keystone team decide to change the gate from non-voting to voting"},{"line_number":119,"context_line":"or make any other minor alterations, it is now fairly trivial to do so with"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_149344a5","line":116,"range":{"start_line":114,"start_character":69,"end_line":116,"end_character":28},"in_reply_to":"5f7c97a3_576c9e07","updated":"2018-05-08 13:42:14.000000000","message":"+1","commit_id":"d4b8572b41279c07a1c2be4549c47b19deb63092"},{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"8ef3e066cf66fad5f7a85282a3e1f9769e65eaf4","unresolved":false,"context_lines":[{"line_number":121,"context_line":""},{"line_number":122,"context_line":"The tests should be split into separate gates for each role to provide proper"},{"line_number":123,"context_line":"test isolation between roles, which will facilitate debugging of the gates."},{"line_number":124,"context_line":"Note that it is nonetheless possible to execute tests for both roles within a"},{"line_number":125,"context_line":"single gate, if required, although this approach will result in much longer"},{"line_number":126,"context_line":"net gate execution time (probably 1.5 hours or more)."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"The implementation details are relatively straightforward: Patrole\u0027s"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_8cba29dc","line":125,"range":{"start_line":124,"start_character":0,"end_line":125,"end_character":12},"updated":"2018-05-03 18:43:12.000000000","message":"This might be a good candidate for a infrequent, periodic job once things stablize","commit_id":"d4b8572b41279c07a1c2be4549c47b19deb63092"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"b93f9433759a4de7d707b6753d81250cdb72c8e0","unresolved":false,"context_lines":[{"line_number":121,"context_line":""},{"line_number":122,"context_line":"The tests should be split into separate gates for each role to provide proper"},{"line_number":123,"context_line":"test isolation between roles, which will facilitate debugging of the gates."},{"line_number":124,"context_line":"Note that it is nonetheless possible to execute tests for both roles within a"},{"line_number":125,"context_line":"single gate, if required, although this approach will result in much longer"},{"line_number":126,"context_line":"net gate execution time (probably 1.5 hours or more)."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"The implementation details are relatively straightforward: Patrole\u0027s"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_b2460421","line":125,"range":{"start_line":124,"start_character":0,"end_line":125,"end_character":12},"in_reply_to":"5f7c97a3_8cba29dc","updated":"2018-05-09 15:28:42.000000000","message":"I will add that in.","commit_id":"d4b8572b41279c07a1c2be4549c47b19deb63092"}]}