)]}'
{"specs/liberty/dynamic-policies-overlay.rst":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"e7d7200f7b79fc2d3441ff819340787916c3d8c3","unresolved":false,"context_lines":[{"line_number":36,"context_line":"Based on a dict containing rules and on the existing options ``policy_file``"},{"line_number":37,"context_line":"and ``policy_dirs``, add to ``oslo.policy`` the capability to overlay rules in"},{"line_number":38,"context_line":"the existing local policy file."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Alternatives"},{"line_number":41,"context_line":"------------"},{"line_number":42,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba3cc151_a5652846","line":39,"updated":"2015-06-29 17:49:02.000000000","message":"Use stock and dyminc to distinguish between the two policy files.\n\nPlease specify how the merging of the rules from stock and dynamic will work\n\nPlease specify what happens upon change of stock file and change of dynamic file.","commit_id":"b2fae89de27e144721a65f47d5898e0d72d7151b"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"3a4aa419653751b6d98344afb87ea1e26d25654b","unresolved":false,"context_lines":[{"line_number":133,"context_line":"  (https://review.openstack.org/#/c/134655/), which defines how the custom"},{"line_number":134,"context_line":"  rules will be fetched and cached by Keystone Middleware and then passed to"},{"line_number":135,"context_line":"  the proposed ``oslo.policy`` call;"},{"line_number":136,"context_line":"- Relared to spec \u0027Policy by URL\u0027 (https://review.openstack.org/#/c/192422/),"},{"line_number":137,"context_line":"  which specifies how policy custom rules are associated to a service endpoint"},{"line_number":138,"context_line":"  in Keystone server."},{"line_number":139,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba3cc151_05a414a4","line":136,"updated":"2015-06-29 17:44:42.000000000","message":"s/Relared/Related","commit_id":"b2fae89de27e144721a65f47d5898e0d72d7151b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"89aac636ac4f5d5a4a30738ad6421bcaaf74ab4e","unresolved":false,"context_lines":[{"line_number":42,"context_line":"overrides the rule in ``Stock Policy``. It means that any customization made"},{"line_number":43,"context_line":"directly in the ``Stock Policy`` will be lost if there is an entry for it in"},{"line_number":44,"context_line":"the ``Dynamic Policy``."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Alternatives"},{"line_number":47,"context_line":"------------"},{"line_number":48,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba3cc151_d5858cad","line":45,"updated":"2015-07-05 14:40:23.000000000","message":"As an aside, but probably outside of the scope of this spec, we might want to add the capability to OS_ENDPOINT_POLICY for overlay between region/service/endpoint (with the \"lower\" one overriding the \"higher\" concept one). In other words, it isn\u0027t really Dynamic Policy vs Stock Policy, rather a hierarchy of policies of which today we support two (Dynamic, Stock), but may add other levels in the future.  To that end, maybe we don\u0027t pass a single dict , but a chain of dicts indicating the order of overlays?","commit_id":"610e6367cc671e295506a5cc82dde2a667c047f3"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"2815506b1b5db213e94cf3fce8d8c13627ba5fd3","unresolved":false,"context_lines":[{"line_number":42,"context_line":"overrides the rule in ``Stock Policy``. It means that any customization made"},{"line_number":43,"context_line":"directly in the ``Stock Policy`` will be lost if there is an entry for it in"},{"line_number":44,"context_line":"the ``Dynamic Policy``."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Alternatives"},{"line_number":47,"context_line":"------------"},{"line_number":48,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba3cc151_76547b53","line":45,"in_reply_to":"ba3cc151_d5858cad","updated":"2015-07-07 12:33:22.000000000","message":"Henry, I got your idea. I think it is a valid use case and I agree it is out of the scope of this spec.\n\nHowever, I think that passing a chain of dicts from the server to middleware would be inefficient in the case a whole policy is defined for region/service/endpoint. An alternative would be for Keystone server doing this initial overlay at server side and then passing only the Dynamic Policy to Middleware, that would overlay it directly.","commit_id":"610e6367cc671e295506a5cc82dde2a667c047f3"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"89aac636ac4f5d5a4a30738ad6421bcaaf74ab4e","unresolved":false,"context_lines":[{"line_number":103,"context_line":"----------"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"* Create a new function that receives as input the ``Dynamic Policy`` as a"},{"line_number":106,"context_line":"  Python dict and write them out to the ``Stock Policy``, using override"},{"line_number":107,"context_line":"  strategy when a clashing occurs."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Incubation"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba3cc151_d5acac37","line":106,"updated":"2015-07-05 14:40:23.000000000","message":"not sure what you mean by \"write them out\"...to the policy file?","commit_id":"610e6367cc671e295506a5cc82dde2a667c047f3"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"2815506b1b5db213e94cf3fce8d8c13627ba5fd3","unresolved":false,"context_lines":[{"line_number":103,"context_line":"----------"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"* Create a new function that receives as input the ``Dynamic Policy`` as a"},{"line_number":106,"context_line":"  Python dict and write them out to the ``Stock Policy``, using override"},{"line_number":107,"context_line":"  strategy when a clashing occurs."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Incubation"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba3cc151_16cacf1a","line":106,"in_reply_to":"ba3cc151_d5acac37","updated":"2015-07-07 12:33:22.000000000","message":"Yes, write them to the policy file, which is what we\u0027re calling Stock Policy.\n\nI will clarify this in the next patch set.","commit_id":"610e6367cc671e295506a5cc82dde2a667c047f3"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"144c35d67ec8da3a867320aab8df2b5655e86d69","unresolved":false,"context_lines":[{"line_number":1,"context_line":".."},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":" Dynamic Policies Overlay"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba3cc151_7e1de3bc","line":1,"updated":"2015-07-08 18:45:59.000000000","message":"Where\u0027s the license?","commit_id":"0216f324195c8c92e1fca01ba581c7167777087e"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"3d9abd7ae74c93218f9f8263d00d655269bcef1c","unresolved":false,"context_lines":[{"line_number":1,"context_line":".."},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":" Dynamic Policies Overlay"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba3cc151_c140d2a7","line":1,"in_reply_to":"ba3cc151_7e1de3bc","updated":"2015-07-10 18:34:32.000000000","message":"oslo spec template defines the license as a footnote","commit_id":"0216f324195c8c92e1fca01ba581c7167777087e"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"144c35d67ec8da3a867320aab8df2b5655e86d69","unresolved":false,"context_lines":[{"line_number":10,"context_line":"improve access control in OpenStack by improving the mechanisms in which"},{"line_number":11,"context_line":"policies are defined and delivered to service endpoints."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"One step of dynamic delivering of policies is to overlay the existing service"},{"line_number":14,"context_line":"endpoint\u0027s local policy file with the custom rules defined in"},{"line_number":15,"context_line":"``Keystone server``. This overlay task is delegated to ``oslo.policy``."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba3cc151_9d7f90de","line":13,"updated":"2015-07-08 18:45:59.000000000","message":"s/delivering/delivery/","commit_id":"0216f324195c8c92e1fca01ba581c7167777087e"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"3d9abd7ae74c93218f9f8263d00d655269bcef1c","unresolved":false,"context_lines":[{"line_number":10,"context_line":"improve access control in OpenStack by improving the mechanisms in which"},{"line_number":11,"context_line":"policies are defined and delivered to service endpoints."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"One step of dynamic delivering of policies is to overlay the existing service"},{"line_number":14,"context_line":"endpoint\u0027s local policy file with the custom rules defined in"},{"line_number":15,"context_line":"``Keystone server``. This overlay task is delegated to ``oslo.policy``."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba3cc151_e13dd62b","line":13,"in_reply_to":"ba3cc151_9d7f90de","updated":"2015-07-10 18:34:32.000000000","message":"Done","commit_id":"0216f324195c8c92e1fca01ba581c7167777087e"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"144c35d67ec8da3a867320aab8df2b5655e86d69","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"One step of dynamic delivering of policies is to overlay the existing service"},{"line_number":14,"context_line":"endpoint\u0027s local policy file with the custom rules defined in"},{"line_number":15,"context_line":"``Keystone server``. This overlay task is delegated to ``oslo.policy``."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem description"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba3cc151_7eef23b1","line":15,"updated":"2015-07-08 18:45:59.000000000","message":"Does this allow the policy overlay to loosen the policy rules or just tighten them?","commit_id":"0216f324195c8c92e1fca01ba581c7167777087e"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"3d9abd7ae74c93218f9f8263d00d655269bcef1c","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"One step of dynamic delivering of policies is to overlay the existing service"},{"line_number":14,"context_line":"endpoint\u0027s local policy file with the custom rules defined in"},{"line_number":15,"context_line":"``Keystone server``. This overlay task is delegated to ``oslo.policy``."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem description"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba3cc151_3c15aa48","line":15,"in_reply_to":"ba3cc151_7eef23b1","updated":"2015-07-10 18:34:32.000000000","message":"The overlay stratefy is more detailed in the \"proposed solution\" section, the overlay is, in fact, an override of the base local policy with the dynamic policy.","commit_id":"0216f324195c8c92e1fca01ba581c7167777087e"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"144c35d67ec8da3a867320aab8df2b5655e86d69","unresolved":false,"context_lines":[{"line_number":24,"context_line":"OpenStack features like ``Dynamic Policies`` to enable them in her cloud."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"With that feature, she expects to be able to define her custom policy rules in"},{"line_number":27,"context_line":"``Keystone server`` and have those applied to service endpoints transparently."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Behind the scenes, ``Keystone Middleware`` will fetch the ``Dynamic Policy``,"},{"line_number":30,"context_line":"which contains the custom policy rules, for the service it is serving and ask"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba3cc151_fe081382","line":27,"updated":"2015-07-08 18:45:59.000000000","message":"This can be translated generically to \u0027A user wants to use this feature to do stuff\u0027. Can you explain in more detail a use case for a policy overlay? What specifically Alice would like to change, etc.","commit_id":"0216f324195c8c92e1fca01ba581c7167777087e"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"3d9abd7ae74c93218f9f8263d00d655269bcef1c","unresolved":false,"context_lines":[{"line_number":24,"context_line":"OpenStack features like ``Dynamic Policies`` to enable them in her cloud."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"With that feature, she expects to be able to define her custom policy rules in"},{"line_number":27,"context_line":"``Keystone server`` and have those applied to service endpoints transparently."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Behind the scenes, ``Keystone Middleware`` will fetch the ``Dynamic Policy``,"},{"line_number":30,"context_line":"which contains the custom policy rules, for the service it is serving and ask"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba3cc151_f7667bed","line":27,"in_reply_to":"ba3cc151_fe081382","updated":"2015-07-10 18:34:32.000000000","message":"Here I am telling what she wants to do, why the policy overlay is important to allow what she wants is in the paragraph below.\n\nLet me now if you still find it unclear.","commit_id":"0216f324195c8c92e1fca01ba581c7167777087e"}]}