)]}'
{"id":"openstack%2Fpanko~764948","triplet_id":"openstack%2Fpanko~master~Ia0daee7d909f31e7f8f9e75fa52dca9254441559","project":"openstack/panko","branch":"master","topic":"secure-rbac","hashtags":[],"change_id":"Ia0daee7d909f31e7f8f9e75fa52dca9254441559","subject":"Implement secure RBAC for segregation and telemetry policies","status":"MERGED","created":"2020-12-01 14:43:10.000000000","updated":"2021-01-19 11:03:13.000000000","submitted":"2021-01-19 11:01:03.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"764948-secure-rbac","meta_rev_id":"5e11bbe7533476e2550764308e6e9cd5df31e833","_number":764948,"virtual_id_number":764948,"owner":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":4264,"name":"Matthias Runge","email":"mrunge@redhat.com","username":"mrunge"},{"value":0,"_account_id":14107,"name":"zhurong","email":"aaronzhu1121@gmail.com","username":"zhurong"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2021-01-19 11:01:03.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":4264,"name":"Matthias Runge","email":"mrunge@redhat.com","username":"mrunge"},"all":[{"value":2,"date":"2020-12-03 09:56:04.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":4264,"name":"Matthias Runge","email":"mrunge@redhat.com","username":"mrunge"},{"value":2,"date":"2020-12-11 08:35:53.000000000","_account_id":14107,"name":"zhurong","email":"aaronzhu1121@gmail.com","username":"zhurong"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":14107,"name":"zhurong","email":"aaronzhu1121@gmail.com","username":"zhurong"},"all":[{"value":0,"_account_id":4264,"name":"Matthias Runge","email":"mrunge@redhat.com","username":"mrunge"},{"value":1,"date":"2020-12-11 08:35:53.000000000","_account_id":14107,"name":"zhurong","email":"aaronzhu1121@gmail.com","username":"zhurong"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":4264,"name":"Matthias Runge","email":"mrunge@redhat.com","username":"mrunge"},{"_account_id":14107,"name":"zhurong","email":"aaronzhu1121@gmail.com","username":"zhurong"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2020-12-01 15:53:41.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2020-12-03 09:56:04.000000000","updated_by":{"_account_id":4264,"name":"Matthias Runge","email":"mrunge@redhat.com","username":"mrunge"},"reviewer":{"_account_id":4264,"name":"Matthias Runge","email":"mrunge@redhat.com","username":"mrunge"},"state":"REVIEWER"},{"updated":"2020-12-11 08:35:53.000000000","updated_by":{"_account_id":14107,"name":"zhurong","email":"aaronzhu1121@gmail.com","username":"zhurong"},"reviewer":{"_account_id":14107,"name":"zhurong","email":"aaronzhu1121@gmail.com","username":"zhurong"},"state":"REVIEWER"}],"messages":[{"id":"2f6cf58ed7564d5e270a9fc8ad697cb38d254eae","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-12-01 14:43:10.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"c2583d5bc5bda249d9f31ddf85d83889741cb776","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-12-01 14:45:29.000000000","message":"Topic set to secure-rbac","accounts_in_message":[],"_revision_number":1},{"id":"3a941b4add8459a5bd725fc3c7907393df878a4b","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-12-01 15:53:41.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/209ab82f3c1c4d64a703d4921f4d313d : SUCCESS in 4m 22s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/eabee4b13d384a9284adb6ef056e687b : SUCCESS in 6m 09s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/9b850aa65e7f457784b7702e9326451d : SUCCESS in 11m 26s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/557472d0d3f04594ad2b80408914a29d : SUCCESS in 6m 59s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/7187f67c8f3e45c6ad326b515eac9535 : SUCCESS in 7m 16s","accounts_in_message":[],"_revision_number":1},{"id":"802b035df88cb43c521bee54f5382b226c4d746f","author":{"_account_id":4264,"name":"Matthias Runge","email":"mrunge@redhat.com","username":"mrunge"},"date":"2020-12-03 09:56:04.000000000","message":"Patch Set 1: Code-Review+2\n\nThank you","accounts_in_message":[],"_revision_number":1},{"id":"03511fc6d5d67caff3814ce389b99493d0727ea2","author":{"_account_id":14107,"name":"zhurong","email":"aaronzhu1121@gmail.com","username":"zhurong"},"date":"2020-12-11 08:35:53.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"9d6b115d611b61152318a6c3b7e35e789753dbc5","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-12-11 08:36:06.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"a0387e107938e1d69e53c8d185e417b726e1f2fe","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-12-11 09:01:20.000000000","message":"Patch Set 1: Verified-2\n\nThis change depends on a change that failed to merge.","accounts_in_message":[],"_revision_number":1},{"id":"f61829d0ce0ae2469261f637d7f18eaadfb52942","author":{"_account_id":4264,"name":"Matthias Runge","email":"mrunge@redhat.com","username":"mrunge"},"date":"2021-01-12 08:49:09.000000000","message":"Patch Set 1:\n\nrecheck","accounts_in_message":[],"_revision_number":1},{"id":"582107e3651ea10854f01af8f5a4eb48c2380f0f","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-01-12 10:19:22.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/cbf9109aacff4e41b16f3a147576db6c : SUCCESS in 4m 05s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/8c755fe814d84fc081a82b456beed03b : FAILURE in 3m 41s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/362e3881789d407abd9451687cc8fd06 : FAILURE in 3m 46s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/d800579b19bf46edb364c78381c461ba : FAILURE in 3m 46s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/a557574a61934b22b6bf8ab7bbedae1a : SUCCESS in 7m 51s\n- telemetry-dsvm-integration https://zuul.opendev.org/t/openstack/build/f82005234f174b15ad2068471db547f8 : SUCCESS in 1h 23m 32s\n- telemetry-dsvm-integration-ipv6-only https://zuul.opendev.org/t/openstack/build/1bb1817b6dc348ce9b51277c07c9a540 : POST_FAILURE in 44m 37s","accounts_in_message":[],"_revision_number":1},{"id":"ed839546cb13014a3155b82170756465174395ba","author":{"_account_id":4264,"name":"Matthias Runge","email":"mrunge@redhat.com","username":"mrunge"},"date":"2021-01-18 17:45:48.000000000","message":"Patch Set 1:\n\nrecheck","accounts_in_message":[],"_revision_number":1},{"id":"5991d8fe4c1b3bd8bb214fa6eca03561ada8c11f","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-01-18 18:37:27.000000000","message":"Patch Set 1:\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/e6d7a86e7b454c18956fc9a4e4b9d4a2 : SUCCESS in 4m 11s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/da7391db57eb446ca575832ea126605b : SUCCESS in 5m 47s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/d9789a2427154630b7689e42a081a4da : SUCCESS in 5m 59s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/4ed875585b7947fea0bc588ea3170990 : SUCCESS in 6m 12s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/688b5eaba76040b9a64de451abad88cd : SUCCESS in 9m 07s\n- telemetry-dsvm-integration https://zuul.opendev.org/t/openstack/build/a72babfacf06435a831df85ec9b71192 : FAILURE in 38m 57s\n- telemetry-dsvm-integration-ipv6-only https://zuul.opendev.org/t/openstack/build/59a24c2b06184e69b9e9b1f499236799 : SUCCESS in 41m 30s","accounts_in_message":[],"_revision_number":1},{"id":"a177023129d877ff58558a35fac4a6bb4fc3ae55","author":{"_account_id":4264,"name":"Matthias Runge","email":"mrunge@redhat.com","username":"mrunge"},"date":"2021-01-18 19:47:36.000000000","message":"Patch Set 1:\n\nFails in devstack with:\n```\nFailed to build prettytable PyYAML pyperclip openstack-requirements\n```","accounts_in_message":[],"_revision_number":1},{"id":"b6073366936ab6d4e4e4f756488e200929cb9cf9","author":{"_account_id":4264,"name":"Matthias Runge","email":"mrunge@redhat.com","username":"mrunge"},"date":"2021-01-19 08:59:33.000000000","message":"Patch Set 1:\n\nrecheck","accounts_in_message":[],"_revision_number":1},{"id":"5c7b711ee322fa5fa30064d239648344d1bfd2c5","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-01-19 09:58:25.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/fe968065d4c94b649871ea599def8394 : SUCCESS in 4m 26s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/d5c49af3ea1b461fb7a08eaa45947741 : SUCCESS in 5m 22s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/0f801981254242f1aa033a9e39cd681f : SUCCESS in 8m 03s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/ed3bd56a379a46a4bbea666640e77f5f : SUCCESS in 6m 41s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/5e044a2c09ad4c6698b5f7255110a6ae : SUCCESS in 8m 22s\n- telemetry-dsvm-integration https://zuul.opendev.org/t/openstack/build/58d93d6f1ed8415cb7c43679b3d9d4ac : SUCCESS in 50m 11s\n- telemetry-dsvm-integration-ipv6-only https://zuul.opendev.org/t/openstack/build/37591725a92d4056a8a114817a7ac217 : SUCCESS in 52m 36s","accounts_in_message":[],"_revision_number":1},{"id":"dc50f3d887785986db9af1ad1b1535e305aa2517","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-01-19 09:58:38.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"167c31df9a964e24d87c51d9302fc7fdd8d4fcab","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-01-19 11:01:03.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/fc8712eb5b474cce9fe28e364d90eed6 : SUCCESS in 4m 29s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/845825e51b864b648d45636f5dfd2291 : SUCCESS in 5m 57s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/87d0d7e5de5a48999b0cea29c008d333 : SUCCESS in 7m 07s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/42bba7d34b424075945e91638aff9131 : SUCCESS in 8m 31s\n- telemetry-dsvm-integration https://zuul.opendev.org/t/openstack/build/12880e35bd1b4df5a046e60c882ff67a : SUCCESS in 56m 16s\n- telemetry-dsvm-integration-ipv6-only https://zuul.opendev.org/t/openstack/build/da7fff1f910e4fa5ab32ddf36b0e7295 : SUCCESS in 55m 22s","accounts_in_message":[],"_revision_number":1},{"id":"6c2033f3d60ab550762d52d602c4b1a91b3280fd","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-01-19 11:01:03.000000000","message":"Change has been successfully merged by Zuul","accounts_in_message":[],"_revision_number":1},{"id":"5e11bbe7533476e2550764308e6e9cd5df31e833","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-01-19 11:03:13.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/be147648d7cc458588418967d87a0e48 : SUCCESS in 1m 36s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"6195c9a06db0d3d3bd46da74af1dfad092404c2b","revisions":{"6195c9a06db0d3d3bd46da74af1dfad092404c2b":{"kind":"REWORK","_number":1,"created":"2020-12-01 14:43:10.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/48/764948/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/panko","ref":"refs/changes/48/764948/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/panko refs/changes/48/764948/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/panko refs/changes/48/764948/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/panko refs/changes/48/764948/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/panko refs/changes/48/764948/1"}}},"commit":{"parents":[{"commit":"12c41a0a73114974b8d5d15a1cc14368d68099cc","subject":"Add a system-reader check string to base.py","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/panko/commit/12c41a0a73114974b8d5d15a1cc14368d68099cc"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-12-01 14:37:26.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-12-01 14:37:26.000000000","tz":0},"subject":"Implement secure RBAC for segregation and telemetry policies","message":"Implement secure RBAC for segregation and telemetry policies\n\nThis commit updates the policies for all policies in panko to support\nenhanced token scope checking and default roles, but implementing\nsupport for a reader role for read-only APIs.\n\nThis is part of a broader change to provide a more consistent and secure\nauthorization experience for operators and users across OpenStack.\n\nChange-Id: Ia0daee7d909f31e7f8f9e75fa52dca9254441559\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/panko/commit/6195c9a06db0d3d3bd46da74af1dfad092404c2b"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/panko/commit/6195c9a06db0d3d3bd46da74af1dfad092404c2b"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"status":"CLOSED","labels":[{"label":"Verified","status":"OK","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"OK","applied_by":{"_account_id":14107,"name":"zhurong","email":"aaronzhu1121@gmail.com","username":"zhurong"}},{"label":"Workflow","status":"OK","applied_by":{"_account_id":14107,"name":"zhurong","email":"aaronzhu1121@gmail.com","username":"zhurong"}}]}],"submit_requirements":[{"name":"Verified","status":"SATISFIED","is_legacy":true,"submittability_expression_result":{"expression":"label:Verified\u003dCustom-Rule","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dCustom-Rule"],"failing_atoms":[],"atom_explanations":{}}},{"name":"Workflow","status":"SATISFIED","is_legacy":true,"submittability_expression_result":{"expression":"label:Workflow\u003dCustom-Rule","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dCustom-Rule"],"failing_atoms":[],"atom_explanations":{}}},{"name":"Code-Review","status":"SATISFIED","is_legacy":true,"submittability_expression_result":{"expression":"label:Code-Review\u003dCustom-Rule","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dCustom-Rule"],"failing_atoms":[],"atom_explanations":{}}}]}