)]}'
{".zuul.yaml":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"9e452e78a4f98e0ebb2efa1469d4a24c01765d1c","unresolved":false,"context_lines":[{"line_number":33,"context_line":"        test-config:"},{"line_number":34,"context_line":"          $TEMPEST_CONFIG:"},{"line_number":35,"context_line":"            patrole:"},{"line_number":36,"context_line":"              custom_policy_files: \"/etc/%s/policy.json,/etc/%s/policy.d/*.json\""},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"- job:"},{"line_number":39,"context_line":"    name: patrole-base-multinode"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3f79a3b5_8d10275b","line":36,"range":{"start_line":36,"start_character":56,"end_line":36,"end_character":80},"updated":"2018-09-07 05:02:42.000000000","message":"Is this only needed for fwaas plugin? If so, this should be specified under patrole-plugin-member only. Also do you know why fwaas (if I am understanding correctly) assumes this directory path, instead of /etc/neutron/policy.json which is more common?","commit_id":"c0fde03f1a26e24406833559d4103d012bcc4dc0"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"b90eb40c3472bab102227dbdef4b3b330a1235a5","unresolved":false,"context_lines":[{"line_number":33,"context_line":"        test-config:"},{"line_number":34,"context_line":"          $TEMPEST_CONFIG:"},{"line_number":35,"context_line":"            patrole:"},{"line_number":36,"context_line":"              custom_policy_files: \"/etc/%s/policy.json,/etc/%s/policy.d/*.json\""},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"- job:"},{"line_number":39,"context_line":"    name: patrole-base-multinode"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3f79a3b5_f61ddcbd","line":36,"range":{"start_line":36,"start_character":56,"end_line":36,"end_character":80},"in_reply_to":"3f79a3b5_8d10275b","updated":"2018-09-07 16:26:37.000000000","message":"Right now Yes, this is needed for fwaas only, but let\u0027s keep it in here, because the changes change the current behavior and can affect future changes.\n\n\u003e instead of /etc/neutron/policy.json which is more common?\nMost of the neutron-plugins uses /etc/neutron/policy.json and provides full list of rules. Some of the plugins like fwaas provide a policy.json file with their own rules (not full list) and store that file in policy.d/ folder.","commit_id":"c0fde03f1a26e24406833559d4103d012bcc4dc0"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"f916aef6d752aff76c732b8adab23fa08c6b77f7","unresolved":false,"context_lines":[{"line_number":33,"context_line":"        test-config:"},{"line_number":34,"context_line":"          $TEMPEST_CONFIG:"},{"line_number":35,"context_line":"            patrole:"},{"line_number":36,"context_line":"              custom_policy_files: \"/etc/%s/policy.json,/etc/%s/policy.d/*.json\""},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"- job:"},{"line_number":39,"context_line":"    name: patrole-base-multinode"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"3f79a3b5_4b1d020d","line":36,"range":{"start_line":36,"start_character":56,"end_line":36,"end_character":80},"updated":"2018-09-08 03:49:33.000000000","message":"This kind of path is useful to support in general (i.e. * which glob makes possible). But a simpler solution is to simply set service\u003d\"neutron-fwaas\" for these fwaas tests: https://github.com/openstack/neutron-fwaas/blob/master/etc/neutron/policy.d/neutron-fwaas.json\n\nAs you can see, the policy name is \"neutron-fwaas.json\" so \"/etc/*./policy.d/%s.json\" would be one way to select this policy file, while guaranteeing that policy names don\u0027t collide.","commit_id":"68311d0daf96e79e7ce6d3442f44822d8c6cec7e"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"3acbf9ba0b006946fdffe795c65ac5291787aca5","unresolved":false,"context_lines":[{"line_number":33,"context_line":"        test-config:"},{"line_number":34,"context_line":"          $TEMPEST_CONFIG:"},{"line_number":35,"context_line":"            patrole:"},{"line_number":36,"context_line":"              custom_policy_files: \"/etc/%s/policy.json,/etc/%s/policy.d/*.json\""},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"- job:"},{"line_number":39,"context_line":"    name: patrole-base-multinode"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"3f79a3b5_5bb374ea","line":36,"range":{"start_line":36,"start_character":56,"end_line":36,"end_character":80},"in_reply_to":"3f79a3b5_4b1d020d","updated":"2018-09-10 18:00:04.000000000","message":"No, that\u0027s not gonna work, validate_service will fail because there is no `neutron-fwaas` service in the openstack, the result of `services_client.list_services()` will not contain fwaas. This was the first or second attempt.","commit_id":"68311d0daf96e79e7ce6d3442f44822d8c6cec7e"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"f916aef6d752aff76c732b8adab23fa08c6b77f7","unresolved":false,"context_lines":[{"line_number":69,"context_line":"      tempest_concurrency: 1"},{"line_number":70,"context_line":"      tempest_test_regex: (?\u003d.*\\[.*\\bslow\\b.*\\])(^patrole_tempest_plugin\\.tests\\.api)"},{"line_number":71,"context_line":"      tox_envlist: all-plugin"},{"line_number":72,"context_line":"      devstack_local_conf:"},{"line_number":73,"context_line":"        test-config:"},{"line_number":74,"context_line":"          $TEMPEST_CONFIG:"},{"line_number":75,"context_line":"            patrole:"},{"line_number":76,"context_line":"              custom_policy_files: \"/etc/%s/policy.json,/etc/%s/policy.d/*.json\""},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"- job:"},{"line_number":79,"context_line":"    name: patrole-admin"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"3f79a3b5_0b138a02","line":76,"range":{"start_line":72,"start_character":0,"end_line":76,"end_character":80},"updated":"2018-09-08 03:49:33.000000000","message":"This stanza is really only useful for Neutron and Neutron plugins so there\u0027s no need to include this here. In fact, for Zuul testing, it would probably better to NOT use any custom policy overrides, and to only test default policy configuration.  But unfortunately Neutron doesn\u0027t use policy in code, making the default custom policy path of \"etc/%s/policy.json\" required.","commit_id":"68311d0daf96e79e7ce6d3442f44822d8c6cec7e"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"3acbf9ba0b006946fdffe795c65ac5291787aca5","unresolved":false,"context_lines":[{"line_number":69,"context_line":"      tempest_concurrency: 1"},{"line_number":70,"context_line":"      tempest_test_regex: (?\u003d.*\\[.*\\bslow\\b.*\\])(^patrole_tempest_plugin\\.tests\\.api)"},{"line_number":71,"context_line":"      tox_envlist: all-plugin"},{"line_number":72,"context_line":"      devstack_local_conf:"},{"line_number":73,"context_line":"        test-config:"},{"line_number":74,"context_line":"          $TEMPEST_CONFIG:"},{"line_number":75,"context_line":"            patrole:"},{"line_number":76,"context_line":"              custom_policy_files: \"/etc/%s/policy.json,/etc/%s/policy.d/*.json\""},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"- job:"},{"line_number":79,"context_line":"    name: patrole-admin"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"3f79a3b5_fee26e02","line":76,"range":{"start_line":72,"start_character":0,"end_line":76,"end_character":80},"in_reply_to":"3f79a3b5_0b138a02","updated":"2018-09-10 18:00:04.000000000","message":"ok, I will move it to `patrole-plugin-base` job.","commit_id":"68311d0daf96e79e7ce6d3442f44822d8c6cec7e"}],"/COMMIT_MSG":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"9e452e78a4f98e0ebb2efa1469d4a24c01765d1c","unresolved":false,"context_lines":[{"line_number":10,"context_line":"the policy actions provided by the plugins."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: Ib24f3d6d7a5ffdeaecce579af9795fd897dce872"},{"line_number":13,"context_line":"Story: 2002641"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3f79a3b5_5813ab5c","line":13,"range":{"start_line":13,"start_character":7,"end_line":13,"end_character":14},"updated":"2018-09-07 05:02:42.000000000","message":"This isn\u0027t a valid user story. This just points to the Patrole page itself. We should create a story/bug in SB to track this properly, or else drop this as it\u0027s not strictly required.","commit_id":"c0fde03f1a26e24406833559d4103d012bcc4dc0"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"b90eb40c3472bab102227dbdef4b3b330a1235a5","unresolved":false,"context_lines":[{"line_number":10,"context_line":"the policy actions provided by the plugins."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: Ib24f3d6d7a5ffdeaecce579af9795fd897dce872"},{"line_number":13,"context_line":"Story: 2002641"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3f79a3b5_b031ac0d","line":13,"range":{"start_line":13,"start_character":7,"end_line":13,"end_character":14},"in_reply_to":"3f79a3b5_5813ab5c","updated":"2018-09-07 16:26:37.000000000","message":"Done","commit_id":"c0fde03f1a26e24406833559d4103d012bcc4dc0"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"8d1041672ed9f8f4d625f695ffb232a7231bfb28","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Modify the discover_policy_files function to discover all policy files"},{"line_number":18,"context_line":"for each of the services. Using glob.glob() function makes it possible"},{"line_number":19,"context_line":"to use patterns like \u0027*.json\u0027 to discover the policy files."},{"line_number":20,"context_line":"Modify the _get_policy_data function to load a data from all dicoverd"},{"line_number":21,"context_line":"policy files for a service."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Update the unit test according to the changes."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"3f79a3b5_fbeca793","line":20,"range":{"start_line":20,"start_character":61,"end_line":20,"end_character":69},"updated":"2018-09-11 16:16:26.000000000","message":"discovered","commit_id":"695cc6a2d360713fdfdbe7547630ae9d27a9fe7e"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"a9c44bca037ae1c0e9672efcd18126b262b68e0d","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Modify the discover_policy_files function to discover all policy files"},{"line_number":18,"context_line":"for each of the services. Using glob.glob() function makes it possible"},{"line_number":19,"context_line":"to use patterns like \u0027*.json\u0027 to discover the policy files."},{"line_number":20,"context_line":"Modify the _get_policy_data function to load a data from all dicoverd"},{"line_number":21,"context_line":"policy files for a service."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Update the unit test according to the changes."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"3f79a3b5_5e44a947","line":20,"range":{"start_line":20,"start_character":61,"end_line":20,"end_character":69},"in_reply_to":"3f79a3b5_fbeca793","updated":"2018-09-11 16:34:57.000000000","message":"Done","commit_id":"695cc6a2d360713fdfdbe7547630ae9d27a9fe7e"}],"patrole_tempest_plugin/config.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"9e452e78a4f98e0ebb2efa1469d4a24c01765d1c","unresolved":false,"context_lines":[{"line_number":38,"context_line":"                default\u003d[\u0027/etc/%s/policy.json\u0027],"},{"line_number":39,"context_line":"                help\u003d\"\"\"List of the paths to search for policy files. Each"},{"line_number":40,"context_line":"policy path assumes that the service name is included in the path once. Also"},{"line_number":41,"context_line":"assumes Patrole is on the same host as the policy files. The all paths that are"},{"line_number":42,"context_line":"found to contain the service\u0027s policy file will be used and all policy files"},{"line_number":43,"context_line":"will be merged."},{"line_number":44,"context_line":"\"\"\"),"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_adb72385","line":41,"range":{"start_line":41,"start_character":56,"end_line":41,"end_character":64},"updated":"2018-09-07 05:02:42.000000000","message":"All the","commit_id":"c0fde03f1a26e24406833559d4103d012bcc4dc0"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"b90eb40c3472bab102227dbdef4b3b330a1235a5","unresolved":false,"context_lines":[{"line_number":38,"context_line":"                default\u003d[\u0027/etc/%s/policy.json\u0027],"},{"line_number":39,"context_line":"                help\u003d\"\"\"List of the paths to search for policy files. Each"},{"line_number":40,"context_line":"policy path assumes that the service name is included in the path once. Also"},{"line_number":41,"context_line":"assumes Patrole is on the same host as the policy files. The all paths that are"},{"line_number":42,"context_line":"found to contain the service\u0027s policy file will be used and all policy files"},{"line_number":43,"context_line":"will be merged."},{"line_number":44,"context_line":"\"\"\"),"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_135bca21","line":41,"range":{"start_line":41,"start_character":56,"end_line":41,"end_character":64},"in_reply_to":"3f79a3b5_adb72385","updated":"2018-09-07 16:26:37.000000000","message":"Done","commit_id":"c0fde03f1a26e24406833559d4103d012bcc4dc0"}],"patrole_tempest_plugin/policy_authority.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"f916aef6d752aff76c732b8adab23fa08c6b77f7","unresolved":false,"context_lines":[{"line_number":178,"context_line":"        for path in self.policy_files[self.service]:"},{"line_number":179,"context_line":"            try:"},{"line_number":180,"context_line":"                with open(path, \u0027r\u0027) as policy_file:"},{"line_number":181,"context_line":"                    file_policy_data.update(json.load(policy_file))"},{"line_number":182,"context_line":"            except (IOError, ValueError) as e:"},{"line_number":183,"context_line":"                msg \u003d \"Failed to read policy file for service. \""},{"line_number":184,"context_line":"                if isinstance(e, IOError):"}],"source_content_type":"text/x-python","patch_set":5,"id":"3f79a3b5_ab2e1640","line":181,"range":{"start_line":181,"start_character":20,"end_line":181,"end_character":43},"updated":"2018-09-08 03:49:33.000000000","message":"The one concern here is overlapping policy names which is unlikely in most cases but could be possible for some common policy names like context_is_admin or default or admin_or_owner, etc. It would be foolproof to isolate the policy files as the current implementation does rather than combining policy files, which introduces this risk, which would result in buggy test behavior.","commit_id":"68311d0daf96e79e7ce6d3442f44822d8c6cec7e"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"3acbf9ba0b006946fdffe795c65ac5291787aca5","unresolved":false,"context_lines":[{"line_number":178,"context_line":"        for path in self.policy_files[self.service]:"},{"line_number":179,"context_line":"            try:"},{"line_number":180,"context_line":"                with open(path, \u0027r\u0027) as policy_file:"},{"line_number":181,"context_line":"                    file_policy_data.update(json.load(policy_file))"},{"line_number":182,"context_line":"            except (IOError, ValueError) as e:"},{"line_number":183,"context_line":"                msg \u003d \"Failed to read policy file for service. \""},{"line_number":184,"context_line":"                if isinstance(e, IOError):"}],"source_content_type":"text/x-python","patch_set":5,"id":"3f79a3b5_be463650","line":181,"range":{"start_line":181,"start_character":20,"end_line":181,"end_character":43},"in_reply_to":"3f79a3b5_ab2e1640","updated":"2018-09-10 18:00:04.000000000","message":"Yes, you are right. I fixed this.","commit_id":"68311d0daf96e79e7ce6d3442f44822d8c6cec7e"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"8d1041672ed9f8f4d625f695ffb232a7231bfb28","unresolved":false,"context_lines":[{"line_number":180,"context_line":"            try:"},{"line_number":181,"context_line":"                with open(path, \u0027r\u0027) as policy_file:"},{"line_number":182,"context_line":"                    for k, v in json.load(policy_file).items():"},{"line_number":183,"context_line":"                        if k not in file_policy_data:"},{"line_number":184,"context_line":"                            file_policy_data[k] \u003d v"},{"line_number":185,"context_line":"            except (IOError, ValueError) as e:"},{"line_number":186,"context_line":"                msg \u003d \"Failed to read policy file for service. \""},{"line_number":187,"context_line":"                if isinstance(e, IOError):"}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_3be1bf9c","line":184,"range":{"start_line":183,"start_character":24,"end_line":184,"end_character":51},"updated":"2018-09-11 16:16:26.000000000","message":"One nit: Can we add an else condition with:\n\n    if k not in file_policy_data:\n        [...]\n    else:\n        # If the policy name and rule are the same, no ambiguity, so no reason to warn.\n        if v !\u003d file_policy_data[k]:\n            LOG.warning(\"The same policy name: %s was found in multiple policies files \"\n                        \"for service %s. This can lead to policy rule ambiguity. Using\n                        \"rule: %s\", k, service, file_policy_data[k])","commit_id":"695cc6a2d360713fdfdbe7547630ae9d27a9fe7e"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"a9c44bca037ae1c0e9672efcd18126b262b68e0d","unresolved":false,"context_lines":[{"line_number":180,"context_line":"            try:"},{"line_number":181,"context_line":"                with open(path, \u0027r\u0027) as policy_file:"},{"line_number":182,"context_line":"                    for k, v in json.load(policy_file).items():"},{"line_number":183,"context_line":"                        if k not in file_policy_data:"},{"line_number":184,"context_line":"                            file_policy_data[k] \u003d v"},{"line_number":185,"context_line":"            except (IOError, ValueError) as e:"},{"line_number":186,"context_line":"                msg \u003d \"Failed to read policy file for service. \""},{"line_number":187,"context_line":"                if isinstance(e, IOError):"}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_de7199aa","line":184,"range":{"start_line":183,"start_character":24,"end_line":184,"end_character":51},"in_reply_to":"3f79a3b5_3be1bf9c","updated":"2018-09-11 16:34:57.000000000","message":"Good point, thanks.","commit_id":"695cc6a2d360713fdfdbe7547630ae9d27a9fe7e"}],"releasenotes/notes/multiple-policy-files-9aa7f7583283739e.yaml":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"f916aef6d752aff76c732b8adab23fa08c6b77f7","unresolved":false,"context_lines":[{"line_number":16,"context_line":"      Patrole loads a data from each of the discovered policy files for a"},{"line_number":17,"context_line":"      service and merge the data from all files."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"    **Patrole loads a data from ALL files, not just from the first.**"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"3f79a3b5_eb172eed","line":19,"range":{"start_line":19,"start_character":4,"end_line":19,"end_character":69},"updated":"2018-09-08 03:49:33.000000000","message":"I think this can be removed. ALL files is a bit misleading, and I think the content above does a good job of explaining the change already.","commit_id":"68311d0daf96e79e7ce6d3442f44822d8c6cec7e"}]}