)]}'
{"specs/newton/policy-in-code.rst":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"53ae7f1184bc67b74c578413c38a6f53dabccbdf","unresolved":false,"context_lines":[{"line_number":1,"context_line":".."},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":" The title of your blueprint"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Include the URL of your launchpad blueprint:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a122d0e_41a87777","line":4,"updated":"2016-04-26 19:25:42.000000000","message":":-)","commit_id":"17dc70a10053bd4231030c0ed5d9b0a377402b02"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"4d0903e9850b5df57da6b21995dbea2bc5dab212","unresolved":false,"context_lines":[{"line_number":1,"context_line":".."},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":" The title of your blueprint"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Include the URL of your launchpad blueprint:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a122d0e_77b4add3","line":4,"in_reply_to":"1a122d0e_41a87777","updated":"2016-05-03 14:23:55.000000000","message":"Woops :)","commit_id":"17dc70a10053bd4231030c0ed5d9b0a377402b02"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"53ae7f1184bc67b74c578413c38a6f53dabccbdf","unresolved":false,"context_lines":[{"line_number":58,"context_line":"    from nova import policy"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"    server_policies \u003d ["},{"line_number":61,"context_line":"        (\"os_compute_api:servers:create\", \"rule:admin_or_owner\"),"},{"line_number":62,"context_line":"        (\"os_compute_api:servers:create:forced_host\", \"rule:admin_or_owner\"),"},{"line_number":63,"context_line":"        (\"os_compute_api:servers:create:attach_volume\", \"rule:admin_or_owner\"),"},{"line_number":64,"context_line":"        (\"os_compute_api:servers:create:attach_network\","}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a122d0e_81e3afd8","line":61,"updated":"2016-04-26 19:25:42.000000000","message":"It would actually be nice to make this more like oslo.config option registration so that docs can eventually be added to show where the option is used or at least some other documentation.","commit_id":"17dc70a10053bd4231030c0ed5d9b0a377402b02"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"02686f86f97fe9d8b306c737539a33fb683bb7d0","unresolved":false,"context_lines":[{"line_number":99,"context_line":"The \"enforce\" method will be updated so that attempting to check against a rule"},{"line_number":100,"context_line":"that doesn\u0027t exist will, optionally, be an error. In other words the default"},{"line_number":101,"context_line":"rule loses it\u0027s special status and is not a fallback for rules that are not"},{"line_number":102,"context_line":"defined. It will still remain as a reference for other rules to use."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Files to change:"},{"line_number":105,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a122d0e_07cbaf1f","line":102,"updated":"2016-04-21 20:36:48.000000000","message":"How is that option specified? In the call, or when the Enforcer is created?","commit_id":"17dc70a10053bd4231030c0ed5d9b0a377402b02"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"4362c39d783d85b166507abb073a8a8dee1e50a8","unresolved":false,"context_lines":[{"line_number":99,"context_line":"The \"enforce\" method will be updated so that attempting to check against a rule"},{"line_number":100,"context_line":"that doesn\u0027t exist will, optionally, be an error. In other words the default"},{"line_number":101,"context_line":"rule loses it\u0027s special status and is not a fallback for rules that are not"},{"line_number":102,"context_line":"defined. It will still remain as a reference for other rules to use."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Files to change:"},{"line_number":105,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a122d0e_193d87bb","line":102,"in_reply_to":"1a122d0e_07cbaf1f","updated":"2016-04-24 18:43:51.000000000","message":"I was thinking to do it on a per call basis. That allows for a gradual switch to using the rule existence checking as policies are switched to this new style.\n\nAnother option would be to add a new method for enforcement-with-error semantics, which I think you mentioned in a comment on another review.","commit_id":"17dc70a10053bd4231030c0ed5d9b0a377402b02"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"a3c384caa2f1004610f16ae588f68e64617a797c","unresolved":false,"context_lines":[{"line_number":99,"context_line":"The \"enforce\" method will be updated so that attempting to check against a rule"},{"line_number":100,"context_line":"that doesn\u0027t exist will, optionally, be an error. In other words the default"},{"line_number":101,"context_line":"rule loses it\u0027s special status and is not a fallback for rules that are not"},{"line_number":102,"context_line":"defined. It will still remain as a reference for other rules to use."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Files to change:"},{"line_number":105,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a122d0e_3a2147fc","line":102,"in_reply_to":"1a122d0e_193d87bb","updated":"2016-04-25 13:11:35.000000000","message":"Yes, I think a new method is a better idea. It lets us retain the old, non-validating API, and in fact the new one could be implemented as a wrapper around the old one. Using a flag argument seems like it would make it more tempting to eventually change the default or otherwise deprecate that option in a way that a separate method doesn\u0027t.","commit_id":"17dc70a10053bd4231030c0ed5d9b0a377402b02"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"02686f86f97fe9d8b306c737539a33fb683bb7d0","unresolved":false,"context_lines":[{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The tuple passed to \"register\" could have a third field with a description of"},{"line_number":120,"context_line":"the policy. This would be useful for sample file generation, assuming that it"},{"line_number":121,"context_line":"gets converted to yaml."},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"Impact on Existing APIs"},{"line_number":124,"context_line":"-----------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a122d0e_47a3e74f","line":121,"updated":"2016-04-21 20:36:48.000000000","message":"Help text will be useful for generating reference documentation for the policies, regardless of the policy file format, so I think we should go ahead and include it.","commit_id":"17dc70a10053bd4231030c0ed5d9b0a377402b02"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"4362c39d783d85b166507abb073a8a8dee1e50a8","unresolved":false,"context_lines":[{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The tuple passed to \"register\" could have a third field with a description of"},{"line_number":120,"context_line":"the policy. This would be useful for sample file generation, assuming that it"},{"line_number":121,"context_line":"gets converted to yaml."},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"Impact on Existing APIs"},{"line_number":124,"context_line":"-----------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a122d0e_794c7b70","line":121,"in_reply_to":"1a122d0e_47a3e74f","updated":"2016-04-24 18:43:51.000000000","message":"Okay.","commit_id":"17dc70a10053bd4231030c0ed5d9b0a377402b02"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"02686f86f97fe9d8b306c737539a33fb683bb7d0","unresolved":false,"context_lines":[{"line_number":135,"context_line":"------------------"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"Registration of policies from code will have a slight peformance impact on"},{"line_number":138,"context_line":"startup, but this should be no different than loading configuration on startup."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Configuration Impact"},{"line_number":141,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a122d0e_e7579324","line":138,"updated":"2016-04-21 20:36:48.000000000","message":"Configuration options can be registered and reregistered at any point in time. We actually encourage users of oslo.config to register a configuration option immediately before accessing it, to ensure that the registration step is run in the code before the value is accessed (this is much safer than registering at import, for example). We need to take a similar approach for policy, allowing for the re-registration case, and that might change the suggested API.\n\nFor example, rather than registering the policies separately in one big step, we might have a new enforce_with_default() method that simply takes required arguments for the information that might need to be used to evaluate the policy if the settings are not found in the file. I don\u0027t know if we do want that, since it makes generating sample files and documentation harder, but it\u0027s an example of how the API might change when we consider all of the requirements.","commit_id":"17dc70a10053bd4231030c0ed5d9b0a377402b02"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"4362c39d783d85b166507abb073a8a8dee1e50a8","unresolved":false,"context_lines":[{"line_number":135,"context_line":"------------------"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"Registration of policies from code will have a slight peformance impact on"},{"line_number":138,"context_line":"startup, but this should be no different than loading configuration on startup."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Configuration Impact"},{"line_number":141,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a122d0e_196467e3","line":138,"in_reply_to":"1a122d0e_e7579324","updated":"2016-04-24 18:43:51.000000000","message":"That\u0027s a good point. I\u0027ll bring this up for discussion at the summit.","commit_id":"17dc70a10053bd4231030c0ed5d9b0a377402b02"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"7d92da1a4744cce316aee2cb9f2636d9a8d17d07","unresolved":false,"context_lines":[{"line_number":47,"context_line":"1. The rule name, e.g. \"compute:get\" or \"os_compute_api:servers:index\""},{"line_number":48,"context_line":"2. The rule, e.g. \"rule:admin_or_owner\" or \"role:admin\""},{"line_number":49,"context_line":"3. A description string. This can help guide admins with information on each"},{"line_number":50,"context_line":"   policy."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"The rule name is needed for later lookups. The rule is necessary in order to"},{"line_number":53,"context_line":"set the defaults and generate a sample file. The description can be added as a"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_6e9e8a08","line":50,"updated":"2016-05-03 20:50:04.000000000","message":"Does the policy name imply a URL? We had a request that the documentation for policies be easily tied to the API docs in some way. Maybe we want the rest API info to be optionally given as part of the policy definition?","commit_id":"78cb0d01094d15a4321548a78122363156e5feaf"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"a3612e88245e64a8f86ed3a9eefa44d9513ebfb5","unresolved":false,"context_lines":[{"line_number":47,"context_line":"1. The rule name, e.g. \"compute:get\" or \"os_compute_api:servers:index\""},{"line_number":48,"context_line":"2. The rule, e.g. \"rule:admin_or_owner\" or \"role:admin\""},{"line_number":49,"context_line":"3. A description string. This can help guide admins with information on each"},{"line_number":50,"context_line":"   policy."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"The rule name is needed for later lookups. The rule is necessary in order to"},{"line_number":53,"context_line":"set the defaults and generate a sample file. The description can be added as a"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_503ec829","line":50,"in_reply_to":"1a122d0e_6e9e8a08","updated":"2016-05-03 22:18:52.000000000","message":"The policy name does not imply a URL, which is something a number of people would like to see fixed at some point.\n\nI have a concern about embedding this information now because there is some complexity around this that doesn\u0027t currently have a good solution. For example a policy may not be directly related to a URL but may be dependent on a specific key in a POST body for a URL. So my preference would be to defer that capability while the discussion progresses on how best to represent that. And if registration is done with a PolicyOpt class it will be easy to extend it later to accept the API mapping.","commit_id":"78cb0d01094d15a4321548a78122363156e5feaf"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"7d92da1a4744cce316aee2cb9f2636d9a8d17d07","unresolved":false,"context_lines":[{"line_number":60,"context_line":"    from nova import policy"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"    server_policies \u003d ["},{"line_number":63,"context_line":"        (\"os_compute_api:servers:create\", \"rule:admin_or_owner\", \"Checked on"},{"line_number":64,"context_line":"            POST /servers\"),"},{"line_number":65,"context_line":"        (\"os_compute_api:servers:create:forced_host\", \"rule:admin_or_owner\","},{"line_number":66,"context_line":"            \"Controls whether the forced_host scheduler hint is allowed.\"),"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_0e65561c","line":63,"updated":"2016-05-03 20:50:04.000000000","message":"I read David\u0027s comment as suggesting that we go ahead and define a class to hold this data. It doesn\u0027t have to be fancy, but by creating it at the beginning we avoid having to transition to classes later when we want to add features.","commit_id":"78cb0d01094d15a4321548a78122363156e5feaf"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"a3612e88245e64a8f86ed3a9eefa44d9513ebfb5","unresolved":false,"context_lines":[{"line_number":60,"context_line":"    from nova import policy"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"    server_policies \u003d ["},{"line_number":63,"context_line":"        (\"os_compute_api:servers:create\", \"rule:admin_or_owner\", \"Checked on"},{"line_number":64,"context_line":"            POST /servers\"),"},{"line_number":65,"context_line":"        (\"os_compute_api:servers:create:forced_host\", \"rule:admin_or_owner\","},{"line_number":66,"context_line":"            \"Controls whether the forced_host scheduler hint is allowed.\"),"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a122d0e_b0de3c0e","line":63,"in_reply_to":"1a122d0e_0e65561c","updated":"2016-05-03 22:18:52.000000000","message":"I\u0027m all for that. When I proposed this in Nova for initial feedback I had a class in some early drafts. There was some pushback that it would be better to start simply and then transition to the more powerful class when necessary. I completely agree that it\u0027s likely easier to just do the class thing now.","commit_id":"78cb0d01094d15a4321548a78122363156e5feaf"}]}