)]}'
{"devstack/plugin.sh":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"dc1ff33ebefc24e0675bcab36e640cfc7fef3ba3","unresolved":false,"context_lines":[{"line_number":20,"context_line":"    iniset $TEMPEST_CONFIG patrole enable_rbac True"},{"line_number":21,"context_line":"    iniset $TEMPEST_CONFIG patrole rbac_test_role $RBAC_TEST_ROLE"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"    if [[ ${DEVSTACK_SERIES} \u003d\u003d \u0027pike\u0027 ]]; then"},{"line_number":24,"context_line":"        # Policies used by Patrole testing that were changed in a backwards-incompatible way."},{"line_number":25,"context_line":"        # TODO(fmontei): Remove these once stable/pike becomes EOL."},{"line_number":26,"context_line":"        iniset $TEMPEST_CONFIG policy-feature-enabled create_port_fixed_ips_ip_address_policy False"}],"source_content_type":"text/x-sh","patch_set":14,"id":"5f7c97a3_f1b7c839","line":23,"range":{"start_line":23,"start_character":0,"end_line":23,"end_character":47},"updated":"2018-05-20 23:53:45.000000000","message":"i was thinking of lib/patrole in devstack and we maintain that per branch but that can be more complicated to maintain.\n\nSo doing the setting of features flags based on DEVSTACK_SERIES works for me.\n\nDo not we need for queens?","commit_id":"739041fb9c0018326baa55098e6d1a381e08c87c"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"64dc81b87d4ab871a578ec97170248aec65ee868","unresolved":false,"context_lines":[{"line_number":20,"context_line":"    iniset $TEMPEST_CONFIG patrole enable_rbac True"},{"line_number":21,"context_line":"    iniset $TEMPEST_CONFIG patrole rbac_test_role $RBAC_TEST_ROLE"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"    if [[ ${DEVSTACK_SERIES} \u003d\u003d \u0027pike\u0027 ]]; then"},{"line_number":24,"context_line":"        # Policies used by Patrole testing that were changed in a backwards-incompatible way."},{"line_number":25,"context_line":"        # TODO(fmontei): Remove these once stable/pike becomes EOL."},{"line_number":26,"context_line":"        iniset $TEMPEST_CONFIG policy-feature-enabled create_port_fixed_ips_ip_address_policy False"}],"source_content_type":"text/x-sh","patch_set":14,"id":"5f7c97a3_51923ca1","line":23,"range":{"start_line":23,"start_character":0,"end_line":23,"end_character":47},"in_reply_to":"5f7c97a3_f1b7c839","updated":"2018-05-20 23:55:50.000000000","message":"i see, we do not need for queens as these are new policy from queens.","commit_id":"739041fb9c0018326baa55098e6d1a381e08c87c"}],"patrole_tempest_plugin/config.py":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"e588a7c4d0bd254b735c876c4eafe5f5950777f5","unresolved":false,"context_lines":[{"line_number":88,"context_line":"             - add_image"},{"line_number":89,"context_line":"allowed_role \u003d the Keystone role that is allowed to perform the API"},{"line_number":90,"context_line":"\"\"\"),"},{"line_number":91,"context_line":"    cfg.ListOpt(\u0027backwards_incompatible_rules\u0027,"},{"line_number":92,"context_line":"                default\u003d[],"},{"line_number":93,"context_line":"                sample_default\u003d[\"os_compute_api:servers:create\"],"},{"line_number":94,"context_line":"                help\u003d\"\"\"The list of backwards-incompatible policy actions that"},{"line_number":95,"context_line":"are not supported in either the N-1 or N-2 OpenStack releases. For example,"}],"source_content_type":"text/x-python","patch_set":3,"id":"bf659307_1d6873f3","line":92,"range":{"start_line":91,"start_character":16,"end_line":92,"end_character":27},"updated":"2018-03-26 07:34:16.000000000","message":"humm, i think having a common option as list which can take multiple policies to skip their test is little loop hole in testing specially security testing. \n\nThis has few issues like:\n1. Any one can add/modify this list to include more policy so that they can avoid test failure on policy backward incompatible changes.\n\n2. This list can be hard to maintain like api_extensions case in tempest.\n\nI am thinking to have explicit flags for each policy which had been renamed or newly introduced. How many such policies we have as of now ?\n\nOverall Idea was:\n- If new policy is introduced, that can still be tested by skipping the their test on stable branches with specific flag. that flag can be removed once those stable branches are EOL.\n\n- If any policy is renamed or changed without deprecation and in incompatible way INTENSIONALLY then, projects (running patrole gate) can skip the test first and then merge projects change and then modify the test.\n\n- Otherwise patrole will block all kind of policy change which are not in compatible way.\n\n- I will suggest to test the RBAC with n-1 release only as policy deprecation phase in OpenStack usually is 6 months same as config options (though it is not documented anywhere).","commit_id":"71bece5c58153c208f9c2beab1dd518bc4b71454"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"8e684f4ec3cae6c6861a9f215f8c2aee609d7847","unresolved":false,"context_lines":[{"line_number":88,"context_line":"             - add_image"},{"line_number":89,"context_line":"allowed_role \u003d the Keystone role that is allowed to perform the API"},{"line_number":90,"context_line":"\"\"\"),"},{"line_number":91,"context_line":"    cfg.ListOpt(\u0027backwards_incompatible_rules\u0027,"},{"line_number":92,"context_line":"                default\u003d[],"},{"line_number":93,"context_line":"                sample_default\u003d[\"os_compute_api:servers:create\"],"},{"line_number":94,"context_line":"                help\u003d\"\"\"The list of backwards-incompatible policy actions that"},{"line_number":95,"context_line":"are not supported in either the N-1 or N-2 OpenStack releases. For example,"}],"source_content_type":"text/x-python","patch_set":3,"id":"bf659307_e8afff91","line":92,"range":{"start_line":91,"start_character":16,"end_line":92,"end_character":27},"in_reply_to":"bf659307_1d6873f3","updated":"2018-03-26 07:41:14.000000000","message":"correction:\n\nignore the last point (below one) as of now, I think i am over thinking on deprecation phase.\n\n-------------\n- I will suggest to test the RBAC with n-1 release only as policy deprecation phase in OpenStack usually is 6 months same as config options (though it is not documented anywhere).","commit_id":"71bece5c58153c208f9c2beab1dd518bc4b71454"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"91b63f54a9a1569349daefa0565234b8b1b85b29","unresolved":false,"context_lines":[{"line_number":93,"context_line":"                sample_default\u003d[\"os_compute_api:servers:create\"],"},{"line_number":94,"context_line":"                help\u003d\"\"\"The list of backwards-incompatible policy actions that"},{"line_number":95,"context_line":"are not supported in either the N-1 or N-2 OpenStack releases. For example,"},{"line_number":96,"context_line":"if a service in N (master) release renames a policy in a backwards-incompatible"},{"line_number":97,"context_line":"way, then the name of that policy should be included here for N-1 and earlier."},{"line_number":98,"context_line":"\"\"\")]"},{"line_number":99,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"bf659307_b46c0409","line":96,"range":{"start_line":96,"start_character":35,"end_line":96,"end_character":42},"updated":"2018-03-26 03:46:00.000000000","message":"renames/removes","commit_id":"71bece5c58153c208f9c2beab1dd518bc4b71454"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"9483059470b72e161f1f8250726367f89184def8","unresolved":false,"context_lines":[{"line_number":115,"context_line":""},{"line_number":116,"context_line":"policy_feature_enabled \u003d cfg.OptGroup("},{"line_number":117,"context_line":"    name\u003d\u0027policy-feature-enabled\u0027,"},{"line_number":118,"context_line":"    title\u003d\u0027Feature Flags for Backwards-Incompatible Policies\u0027)"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"PolicyFeatureEnabledGroup \u003d ["}],"source_content_type":"text/x-python","patch_set":9,"id":"9f6a8fd7_9e72fd10","line":118,"range":{"start_line":118,"start_character":29,"end_line":118,"end_character":60},"updated":"2018-04-19 02:38:27.000000000","message":"This can be used for newly introduced feature policy so let\u0027s not mention just backwards-Incompatible.\n\nsomething like -\u0027Feature Flags for new or changed Policies\u0027","commit_id":"18c226221b23b10ace17b6b6b5bf27939338ad95"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"c0823a9119b93bffe7efb5e0ae0015e9a0612722","unresolved":false,"context_lines":[{"line_number":115,"context_line":""},{"line_number":116,"context_line":"policy_feature_enabled \u003d cfg.OptGroup("},{"line_number":117,"context_line":"    name\u003d\u0027policy-feature-enabled\u0027,"},{"line_number":118,"context_line":"    title\u003d\u0027Feature Flags for Backwards-Incompatible Policies\u0027)"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"PolicyFeatureEnabledGroup \u003d ["}],"source_content_type":"text/x-python","patch_set":9,"id":"9f6a8fd7_401d49bb","line":118,"range":{"start_line":118,"start_character":29,"end_line":118,"end_character":60},"in_reply_to":"9f6a8fd7_9e72fd10","updated":"2018-04-19 23:54:36.000000000","message":"Done","commit_id":"18c226221b23b10ace17b6b6b5bf27939338ad95"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"c67f10d3a76e78bf5d000798fc984c0f317777ee","unresolved":false,"context_lines":[{"line_number":122,"context_line":"    # TODO(felipemonteiro): The 6 feature flags below should be removed after"},{"line_number":123,"context_line":"    # Pike is EOL."},{"line_number":124,"context_line":"    cfg.BoolOpt(\u0027create_port_fixed_ips_ip_address_policy\u0027,"},{"line_number":125,"context_line":"                default\u003dTrue,"},{"line_number":126,"context_line":"                help\u003d\"\"\"Is the Neutron policy"},{"line_number":127,"context_line":"\"create_port:fixed_ips:ip_address\" available in the cloud? This policy was"},{"line_number":128,"context_line":"changed in a backwards-incompatible way.\"\"\"),"}],"source_content_type":"text/x-python","patch_set":13,"id":"5f7c97a3_7773dab2","line":125,"range":{"start_line":125,"start_character":24,"end_line":125,"end_character":28},"updated":"2018-05-17 14:16:43.000000000","message":"Should the defaults be \"False\"?\n\nIf I were to deploy and use Patrole with this PS, is the assumption that I would be using Pike as the test that checks these actions are executed?  I know it can be set to False in tempest.conf, but to me it seems like it should be False to begin with.","commit_id":"39a13dd2843d37516846ed7f71e436c6a82a3eb6"},{"author":{"_account_id":17896,"name":"Rick Bartra","email":"rickbartra@microsoft.com","username":"rb560u"},"change_message_id":"72a9f7106e8e2d1bdf415f2f185de703a4410887","unresolved":false,"context_lines":[{"line_number":122,"context_line":"    # TODO(felipemonteiro): The 6 feature flags below should be removed after"},{"line_number":123,"context_line":"    # Pike is EOL."},{"line_number":124,"context_line":"    cfg.BoolOpt(\u0027create_port_fixed_ips_ip_address_policy\u0027,"},{"line_number":125,"context_line":"                default\u003dTrue,"},{"line_number":126,"context_line":"                help\u003d\"\"\"Is the Neutron policy"},{"line_number":127,"context_line":"\"create_port:fixed_ips:ip_address\" available in the cloud? This policy was"},{"line_number":128,"context_line":"changed in a backwards-incompatible way.\"\"\"),"}],"source_content_type":"text/x-python","patch_set":13,"id":"5f7c97a3_e59e4bb7","line":125,"range":{"start_line":125,"start_character":24,"end_line":125,"end_character":28},"in_reply_to":"5f7c97a3_453fffb4","updated":"2018-05-17 19:03:15.000000000","message":"ok makes sense","commit_id":"39a13dd2843d37516846ed7f71e436c6a82a3eb6"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"7baf68a223adaeb9660c7d523b228476d7fe3c45","unresolved":false,"context_lines":[{"line_number":122,"context_line":"    # TODO(felipemonteiro): The 6 feature flags below should be removed after"},{"line_number":123,"context_line":"    # Pike is EOL."},{"line_number":124,"context_line":"    cfg.BoolOpt(\u0027create_port_fixed_ips_ip_address_policy\u0027,"},{"line_number":125,"context_line":"                default\u003dTrue,"},{"line_number":126,"context_line":"                help\u003d\"\"\"Is the Neutron policy"},{"line_number":127,"context_line":"\"create_port:fixed_ips:ip_address\" available in the cloud? This policy was"},{"line_number":128,"context_line":"changed in a backwards-incompatible way.\"\"\"),"}],"source_content_type":"text/x-python","patch_set":13,"id":"5f7c97a3_453fffb4","line":125,"range":{"start_line":125,"start_character":24,"end_line":125,"end_character":28},"in_reply_to":"5f7c97a3_7773dab2","updated":"2018-05-17 19:01:33.000000000","message":"It\u0027s True since they\u0027re available in master. They have to be overridden to False using automation for earlier releases, i.e. stable/pike: https://review.openstack.org/#/c/562874/","commit_id":"39a13dd2843d37516846ed7f71e436c6a82a3eb6"}],"patrole_tempest_plugin/rbac_rule_validation.py":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"e588a7c4d0bd254b735c876c4eafe5f5950777f5","unresolved":false,"context_lines":[{"line_number":123,"context_line":"                raise rbac_exceptions.RbacResourceSetupFailed("},{"line_number":124,"context_line":"                    \u0027`rbac_rule_validation` decorator can only be applied to \u0027"},{"line_number":125,"context_line":"                    \u0027an instance of `tempest.test.BaseTestCase`.\u0027)"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"            if rule in CONF.patrole.backwards_incompatible_rules:"},{"line_number":128,"context_line":"                raise testtools.TestCase.skipException("},{"line_number":129,"context_line":"                    \u0027The policy rule: %s is not supported in this OpenStack \u0027"},{"line_number":130,"context_line":"                    \u0027release because it was deprecated in a \u0027"},{"line_number":131,"context_line":"                    \u0027backwards-incompatible way.\u0027 % rule)"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"            allowed \u003d _is_authorized(test_obj, service, rule,"},{"line_number":134,"context_line":"                                     extra_target_data)"}],"source_content_type":"text/x-python","patch_set":3,"id":"bf659307_9d524367","line":131,"range":{"start_line":126,"start_character":0,"end_line":131,"end_character":57},"updated":"2018-03-26 07:34:16.000000000","message":"i feel this leads to same situation as previous in case of strict_policy_check. we should skip test itself with decorator based on feature flag.\n\nThat way we know very explicitly that what all policies are renamed/newly introduced and when we can cleanup those etc.\n\nCurrent way of skipping test for renamed/new policy is too hidden way which can be known only after run and checking skip reason in logs.","commit_id":"71bece5c58153c208f9c2beab1dd518bc4b71454"}],"releasenotes/notes/backwards-incompatible-rule-feature-flag-ebe8b44c0aa663a8.yaml":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"9483059470b72e161f1f8250726367f89184def8","unresolved":false,"context_lines":[{"line_number":4,"context_line":"    A new configuration group ``[policy_feature_enabled]`` has been added to"},{"line_number":5,"context_line":"    Patrole which will be responsible for collecting the feature flags to be"},{"line_number":6,"context_line":"    used for policies that were renamed or removed in a backwards-incompatible"},{"line_number":7,"context_line":"    way. These feature flags are:"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"    * create_port_fixed_ips_ip_address_policy (Neutron)"},{"line_number":10,"context_line":"    * update_port_fixed_ips_ip_address_policy (Neutron)"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"9f6a8fd7_3ec89120","line":7,"range":{"start_line":7,"start_character":4,"end_line":7,"end_character":7},"updated":"2018-04-19 02:38:27.000000000","message":"s/way/way or newly introduced.","commit_id":"18c226221b23b10ace17b6b6b5bf27939338ad95"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"c0823a9119b93bffe7efb5e0ae0015e9a0612722","unresolved":false,"context_lines":[{"line_number":4,"context_line":"    A new configuration group ``[policy_feature_enabled]`` has been added to"},{"line_number":5,"context_line":"    Patrole which will be responsible for collecting the feature flags to be"},{"line_number":6,"context_line":"    used for policies that were renamed or removed in a backwards-incompatible"},{"line_number":7,"context_line":"    way. These feature flags are:"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"    * create_port_fixed_ips_ip_address_policy (Neutron)"},{"line_number":10,"context_line":"    * update_port_fixed_ips_ip_address_policy (Neutron)"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"9f6a8fd7_a08305cc","line":7,"range":{"start_line":7,"start_character":4,"end_line":7,"end_character":7},"in_reply_to":"9f6a8fd7_3ec89120","updated":"2018-04-19 23:54:36.000000000","message":"Done","commit_id":"18c226221b23b10ace17b6b6b5bf27939338ad95"}]}