)]}'
{"specs/stein/oslo-policy-pluggable-drivers.rst":[{"author":{"_account_id":6928,"name":"Ben Nemec","email":"openstack@nemebean.com","username":"bnemec"},"change_message_id":"5f322eef0be7531fe5d0ea474f245d34be9cc28e","unresolved":false,"context_lines":[{"line_number":18,"context_line":"regarding communication to that external engine. For instance, it is not"},{"line_number":19,"context_line":"trivial to configure authentication with any method but mutual TLS."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Proposed change"},{"line_number":22,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"We could enable pluggable drivers by making the current enforcer (which is the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_b8a5d5b6","line":21,"updated":"2018-10-05 19:36:53.000000000","message":"Can you provide an example of a driver that would be implemented as a plugin and how it would be superior to HttpCheck? The PoC one[1] seems to be making fairly simple HTTP requests so I\u0027m not sure I see the benefit of making it a plugin.\n\n1: https://review.openstack.org/#/c/604038","commit_id":"1c14a4c32896604810e8123cf22b3c18128129e6"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"a87f17f237e5055bfe14cdf7a2f896f00509cdec","unresolved":false,"context_lines":[{"line_number":18,"context_line":"regarding communication to that external engine. For instance, it is not"},{"line_number":19,"context_line":"trivial to configure authentication with any method but mutual TLS."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Proposed change"},{"line_number":22,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"We could enable pluggable drivers by making the current enforcer (which is the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_19e907e3","line":21,"in_reply_to":"3f79a3b5_b8a5d5b6","updated":"2018-10-11 06:16:28.000000000","message":"HTTPCheck has a fairly strict response that it expects which I cannot deliver with OPA without having to write an extra proxy, which defeats the purpose in terms of performance. You also have to overwrite every single action... which also defeats the purpose, as you would need to do that too in the remote endpoint.","commit_id":"1c14a4c32896604810e8123cf22b3c18128129e6"},{"author":{"_account_id":6928,"name":"Ben Nemec","email":"openstack@nemebean.com","username":"bnemec"},"change_message_id":"5f322eef0be7531fe5d0ea474f245d34be9cc28e","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"This enhances security in the sense that it potentially enables easier ways for"},{"line_number":58,"context_line":"deployers to manage their policies. However, this can also be problematic for"},{"line_number":59,"context_line":"security, since it could allow deployers to use faulty policy engines."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Performance Impact"},{"line_number":62,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_526edffe","line":59,"updated":"2018-10-05 19:36:53.000000000","message":"There is also the security implications of having policy requests sent to a remote system. As you note, that is handled by TLS for the HttpCheck case, but it sounds like there were going to be more mechanisms added for this.","commit_id":"1c14a4c32896604810e8123cf22b3c18128129e6"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"a87f17f237e5055bfe14cdf7a2f896f00509cdec","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"This enhances security in the sense that it potentially enables easier ways for"},{"line_number":58,"context_line":"deployers to manage their policies. However, this can also be problematic for"},{"line_number":59,"context_line":"security, since it could allow deployers to use faulty policy engines."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Performance Impact"},{"line_number":62,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_f9d44b21","line":59,"in_reply_to":"3f79a3b5_526edffe","updated":"2018-10-11 06:16:28.000000000","message":"One of the things that you can do with OPA, for instance, is use a unix domain socket (which I haven\u0027t implemented, as I\u0027ve only been running it in localhost). So there you get the extra checks of having to go through unix permissions and SELinux (if configured appropriately).","commit_id":"1c14a4c32896604810e8123cf22b3c18128129e6"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"6913cbb2d440b4d57b79af37fee96d964224fb94","unresolved":false,"context_lines":[{"line_number":79,"context_line":"----------------"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"This should be seamless for other developers, as the interfaces will stay the"},{"line_number":82,"context_line":"same."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Testing Impact"},{"line_number":85,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_fb2267a6","line":82,"updated":"2018-10-05 20:27:02.000000000","message":"I see an unfortunate number of references to the policy file in service code. I think we\u0027re going to have to clean that up in order for any alternative drivers to work.\n\nhttp://codesearch.openstack.org/?q\u003d%5C.policy_file\u0026i\u003dnope\u0026files\u003d\u0026repos\u003d","commit_id":"1c14a4c32896604810e8123cf22b3c18128129e6"},{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"a87f17f237e5055bfe14cdf7a2f896f00509cdec","unresolved":false,"context_lines":[{"line_number":79,"context_line":"----------------"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"This should be seamless for other developers, as the interfaces will stay the"},{"line_number":82,"context_line":"same."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Testing Impact"},{"line_number":85,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_d9b86fe9","line":82,"in_reply_to":"3f79a3b5_fb2267a6","updated":"2018-10-11 06:16:28.000000000","message":"That sounds about right... gonna check those out and try to clean them up.","commit_id":"1c14a4c32896604810e8123cf22b3c18128129e6"}]}