)]}'
{"patrole_tempest_plugin/tests/api/network/test_agents_rbac.py":[{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"e1dd399955f051d2ad71d5fca6c07d58ee3bf77f","unresolved":false,"context_lines":[{"line_number":81,"context_line":"            uri \u003d \u0027/agents/%s\u0027 % self.agent[\u0027id\u0027]"},{"line_number":82,"context_line":"            self.agents_client.delete_resource(uri)"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"        # WIP: Very expensive ~25 seconds, can we force it somehow?"},{"line_number":85,"context_line":"        while total_agents !\u003d len(self.agents_client.list_agents()[\"agents\"]):"},{"line_number":86,"context_line":"            pass"},{"line_number":87,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_370f9530","line":84,"updated":"2018-09-11 13:10:21.000000000","message":"Maybe you need to tweak the `periodic_interval` option in `[DEFAULT] /etc/neutron/neutron.conf` and `[DEFAULT] /etc/neutron/l3_agent.ini`","commit_id":"76d28642d044dc3ed465bba997a5af3433087e48"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"a0a58f3b6617f4bab45bb08b72fe187051a9f98b","unresolved":false,"context_lines":[{"line_number":31,"context_line":"            msg \u003d \"agent extension not enabled.\""},{"line_number":32,"context_line":"            raise cls.skipException(msg)"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"    def setUp(self):"},{"line_number":35,"context_line":"        super(AgentsRbacTest, self).setUp()"},{"line_number":36,"context_line":"        agents \u003d self.agents_client.list_agents()[\u0027agents\u0027]"},{"line_number":37,"context_line":"        self.agent \u003d agents[0]"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_521ed8bb","line":34,"updated":"2018-09-11 19:55:36.000000000","message":"You can revert it back, now you delete agent from `_get_l3_agent()` function, not this one","commit_id":"b21214d52ae65b71db47bfb5fcaf9b59bbb6a007"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"ffa5cbdefb53f803293b5af0d35c5c1b2107cf30","unresolved":false,"context_lines":[{"line_number":31,"context_line":"            msg \u003d \"agent extension not enabled.\""},{"line_number":32,"context_line":"            raise cls.skipException(msg)"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"    def setUp(self):"},{"line_number":35,"context_line":"        super(AgentsRbacTest, self).setUp()"},{"line_number":36,"context_line":"        agents \u003d self.agents_client.list_agents()[\u0027agents\u0027]"},{"line_number":37,"context_line":"        self.agent \u003d agents[0]"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_22518bda","line":34,"in_reply_to":"3f79a3b5_521ed8bb","updated":"2018-09-12 18:51:17.000000000","message":"There is no guarantee that agent selected in _get_l3_agent and here will not be the same. If L3 agent is first on the list, and we hit delete_agent before show_agent we will have an error.","commit_id":"b21214d52ae65b71db47bfb5fcaf9b59bbb6a007"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"a0a58f3b6617f4bab45bb08b72fe187051a9f98b","unresolved":false,"context_lines":[{"line_number":64,"context_line":"            self.agents_client.update_agent(agent_id\u003dself.agent[\u0027id\u0027],"},{"line_number":65,"context_line":"                                            agent\u003dagent_status)"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"    def _get_l3_agent(cls):"},{"line_number":68,"context_line":"        agents \u003d cls.agents_client.list_agents()[\u0027agents\u0027]"},{"line_number":69,"context_line":"        for a in agents:"},{"line_number":70,"context_line":"            if a[\u0027agent_type\u0027] \u003d\u003d \u0027L3 agent\u0027:"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_9269d027","line":67,"updated":"2018-09-11 19:55:36.000000000","message":"self?","commit_id":"b21214d52ae65b71db47bfb5fcaf9b59bbb6a007"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"ffa5cbdefb53f803293b5af0d35c5c1b2107cf30","unresolved":false,"context_lines":[{"line_number":64,"context_line":"            self.agents_client.update_agent(agent_id\u003dself.agent[\u0027id\u0027],"},{"line_number":65,"context_line":"                                            agent\u003dagent_status)"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"    def _get_l3_agent(cls):"},{"line_number":68,"context_line":"        agents \u003d cls.agents_client.list_agents()[\u0027agents\u0027]"},{"line_number":69,"context_line":"        for a in agents:"},{"line_number":70,"context_line":"            if a[\u0027agent_type\u0027] \u003d\u003d \u0027L3 agent\u0027:"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_22ff4bac","line":67,"in_reply_to":"3f79a3b5_9269d027","updated":"2018-09-12 18:51:17.000000000","message":"Done","commit_id":"b21214d52ae65b71db47bfb5fcaf9b59bbb6a007"},{"author":{"_account_id":8911,"name":"Sergey Vilgelm","email":"sergey@vilgelm.info","username":"sergey.vilgelm"},"change_message_id":"a0a58f3b6617f4bab45bb08b72fe187051a9f98b","unresolved":false,"context_lines":[{"line_number":65,"context_line":"                                            agent\u003dagent_status)"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"    def _get_l3_agent(cls):"},{"line_number":68,"context_line":"        agents \u003d cls.agents_client.list_agents()[\u0027agents\u0027]"},{"line_number":69,"context_line":"        for a in agents:"},{"line_number":70,"context_line":"            if a[\u0027agent_type\u0027] \u003d\u003d \u0027L3 agent\u0027:"},{"line_number":71,"context_line":"                return a"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_b2388c3b","line":68,"updated":"2018-09-11 19:55:36.000000000","message":"`list_agents` has  agent_type filter:\n\n    agents \u003d cls.agents_client.list_agents(agent_type\u003d\u0027L3 agent\u0027)","commit_id":"b21214d52ae65b71db47bfb5fcaf9b59bbb6a007"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"ffa5cbdefb53f803293b5af0d35c5c1b2107cf30","unresolved":false,"context_lines":[{"line_number":65,"context_line":"                                            agent\u003dagent_status)"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"    def _get_l3_agent(cls):"},{"line_number":68,"context_line":"        agents \u003d cls.agents_client.list_agents()[\u0027agents\u0027]"},{"line_number":69,"context_line":"        for a in agents:"},{"line_number":70,"context_line":"            if a[\u0027agent_type\u0027] \u003d\u003d \u0027L3 agent\u0027:"},{"line_number":71,"context_line":"                return a"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_42fcc7b4","line":68,"in_reply_to":"3f79a3b5_b2388c3b","updated":"2018-09-12 18:51:17.000000000","message":"Done","commit_id":"b21214d52ae65b71db47bfb5fcaf9b59bbb6a007"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"f2b369e111c7e02dd7b46d75dbf71a592536c44e","unresolved":false,"context_lines":[{"line_number":82,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":83,"context_line":"                                 rules\u003d[\"get_agent\", \"delete_agent\"],"},{"line_number":84,"context_line":"                                 expected_error_codes\u003d[404, 403])"},{"line_number":85,"context_line":"    def test_delete_agent(self):"},{"line_number":86,"context_line":"        \"\"\"Delete agent test."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"        RBAC test for the neutron delete_agent policy"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_56e1d39a","line":85,"range":{"start_line":85,"start_character":8,"end_line":85,"end_character":25},"updated":"2018-09-12 17:38:11.000000000","message":"This seems like a highly destructive action. We wouldn\u0027t want to delete an agent in Zuul as this could have cascading effects on multiple other tests that may rely on the existence of an agent (resulting in the other tests failing or skipping). So I would suggest coercing a 400 here if possible. We do that for evacuate_server test: https://github.com/openstack/patrole/blob/a6371ed510b318183e1c2cbafcc97bd85f6625f8/patrole_tempest_plugin/tests/api/compute/test_server_actions_rbac.py#L377\n\nPersonally I\u0027m not a fan of it, and only works if the policy check comes before additional validation/sever actions.","commit_id":"8a9620942fd93ae4be994e068dd2388480778084"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"ffa5cbdefb53f803293b5af0d35c5c1b2107cf30","unresolved":false,"context_lines":[{"line_number":82,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":83,"context_line":"                                 rules\u003d[\"get_agent\", \"delete_agent\"],"},{"line_number":84,"context_line":"                                 expected_error_codes\u003d[404, 403])"},{"line_number":85,"context_line":"    def test_delete_agent(self):"},{"line_number":86,"context_line":"        \"\"\"Delete agent test."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"        RBAC test for the neutron delete_agent policy"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_5fe7a7ad","line":85,"range":{"start_line":85,"start_character":8,"end_line":85,"end_character":25},"in_reply_to":"3f79a3b5_16927bfd","updated":"2018-09-12 18:51:17.000000000","message":"Done","commit_id":"8a9620942fd93ae4be994e068dd2388480778084"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"96e0d52c0f72fe6179e93eeceac9b72c83588138","unresolved":false,"context_lines":[{"line_number":82,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":83,"context_line":"                                 rules\u003d[\"get_agent\", \"delete_agent\"],"},{"line_number":84,"context_line":"                                 expected_error_codes\u003d[404, 403])"},{"line_number":85,"context_line":"    def test_delete_agent(self):"},{"line_number":86,"context_line":"        \"\"\"Delete agent test."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"        RBAC test for the neutron delete_agent policy"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_4b8129a0","line":85,"range":{"start_line":85,"start_character":8,"end_line":85,"end_character":25},"in_reply_to":"3f79a3b5_16927bfd","updated":"2018-09-12 21:46:59.000000000","message":"Okay, I need more input on this idea.\n\nIf I run it as admin, it should hit 404 (real one), since I have access to it. We need to catch it.\n\nIf I run it as member, it should hit the same 404, since I have no access to it? But we should not catch it, so validation can catch it?","commit_id":"8a9620942fd93ae4be994e068dd2388480778084"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"0c2077fc3d4d58b366ae668d8ad2a7623058861d","unresolved":false,"context_lines":[{"line_number":82,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":83,"context_line":"                                 rules\u003d[\"get_agent\", \"delete_agent\"],"},{"line_number":84,"context_line":"                                 expected_error_codes\u003d[404, 403])"},{"line_number":85,"context_line":"    def test_delete_agent(self):"},{"line_number":86,"context_line":"        \"\"\"Delete agent test."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"        RBAC test for the neutron delete_agent policy"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_16927bfd","line":85,"range":{"start_line":85,"start_character":8,"end_line":85,"end_character":25},"in_reply_to":"3f79a3b5_56e1d39a","updated":"2018-09-12 17:39:07.000000000","message":"Not to mention it would be very bad to test this in production or really anywhere that isn\u0027t an ephemeral test environment. But Patrole and Tempest should be cloud-agnostic - i.e. capable of working in many different environments.","commit_id":"8a9620942fd93ae4be994e068dd2388480778084"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"f2b369e111c7e02dd7b46d75dbf71a592536c44e","unresolved":false,"context_lines":[{"line_number":91,"context_line":"        agent \u003d self._get_l3_agent()"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":94,"context_line":"            # WIP: Separate clinet witin Patrole or patch to tempest?"},{"line_number":95,"context_line":"            uri \u003d \u0027/agents/%s\u0027 % agent[\u0027id\u0027]"},{"line_number":96,"context_line":"            self.agents_client.delete_resource(uri)"},{"line_number":97,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_d6e3a3d7","line":94,"range":{"start_line":94,"start_character":12,"end_line":94,"end_character":69},"updated":"2018-09-12 17:38:11.000000000","message":"It\u0027ll probably be a patch to neutorn-tempest-plugin based on zhufl\u0027s comment in the Tempest patch for delete_agent.","commit_id":"8a9620942fd93ae4be994e068dd2388480778084"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"ffa5cbdefb53f803293b5af0d35c5c1b2107cf30","unresolved":false,"context_lines":[{"line_number":91,"context_line":"        agent \u003d self._get_l3_agent()"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":94,"context_line":"            # WIP: Separate clinet witin Patrole or patch to tempest?"},{"line_number":95,"context_line":"            uri \u003d \u0027/agents/%s\u0027 % agent[\u0027id\u0027]"},{"line_number":96,"context_line":"            self.agents_client.delete_resource(uri)"},{"line_number":97,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_1f012f3a","line":94,"range":{"start_line":94,"start_character":12,"end_line":94,"end_character":69},"in_reply_to":"3f79a3b5_d6e3a3d7","updated":"2018-09-12 18:51:17.000000000","message":"https://review.openstack.org/#/c/602044/","commit_id":"8a9620942fd93ae4be994e068dd2388480778084"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"f2b369e111c7e02dd7b46d75dbf71a592536c44e","unresolved":false,"context_lines":[{"line_number":95,"context_line":"            uri \u003d \u0027/agents/%s\u0027 % agent[\u0027id\u0027]"},{"line_number":96,"context_line":"            self.agents_client.delete_resource(uri)"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"        while total_agents_before !\u003d self._get_l3_agents_count():"},{"line_number":99,"context_line":"            pass"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"class L3AgentSchedulerRbacTest(base.BaseNetworkRbacTest):"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_b6f3879f","line":99,"range":{"start_line":98,"start_character":0,"end_line":99,"end_character":16},"updated":"2018-09-12 17:38:11.000000000","message":"This is not correct. For waiting for deletion more nuanced logic is required. This could lead to an infinite loop. To see how to do a waiter (wait_for_agent_deletion, e.g.): see:\n\nhttps://github.com/openstack/tempest/blob/138807b7e38d8ffcc3d80648cc2764025c97197e/tempest/common/waiters.py#L216","commit_id":"8a9620942fd93ae4be994e068dd2388480778084"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"280274d5aa9d830018fef26a9fd2919b3ab3d729","unresolved":false,"context_lines":[{"line_number":95,"context_line":"            uri \u003d \u0027/agents/%s\u0027 % agent[\u0027id\u0027]"},{"line_number":96,"context_line":"            self.agents_client.delete_resource(uri)"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"        while total_agents_before !\u003d self._get_l3_agents_count():"},{"line_number":99,"context_line":"            pass"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"class L3AgentSchedulerRbacTest(base.BaseNetworkRbacTest):"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_d66963f8","line":99,"range":{"start_line":98,"start_character":0,"end_line":99,"end_character":16},"in_reply_to":"3f79a3b5_b6f3879f","updated":"2018-09-12 17:41:54.000000000","message":"I\u0027m mistaken it would require this pattern: self.client.wait_for_resource_deletion(agent_id).\n\nBut that requires implementing something like: https://github.com/openstack/tempest/blob/138807b7e38d8ffcc3d80648cc2764025c97197e/tempest/lib/services/volume/v3/volumes_client.py#L180","commit_id":"8a9620942fd93ae4be994e068dd2388480778084"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"ff4cc90772f96800b83169c153478c9f2c21d4cc","unresolved":false,"context_lines":[{"line_number":73,"context_line":"            if a[\u0027agent_type\u0027] \u003d\u003d \u0027L3 agent\u0027:"},{"line_number":74,"context_line":"                return a"},{"line_number":75,"context_line":"        raise cls.skipException(\"No L3 agents found.\")"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"    @decorators.idempotent_id(\u00278ca68fdb-eaf6-4880-af82-ba0982123abc\u0027)"},{"line_number":78,"context_line":"    @rbac_utils.allowed_roles(roles\u003d[\"admin\"])"},{"line_number":79,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":80,"context_line":"                                 rules\u003d[\"get_agent\", \"delete_agent\"])"}],"source_content_type":"text/x-python","patch_set":8,"id":"3f79a3b5_75ccedba","line":77,"range":{"start_line":76,"start_character":0,"end_line":77,"end_character":4},"updated":"2018-09-13 17:16:03.000000000","message":"As an alternative, we can have a single test with IF that separate those 2 different testcases.","commit_id":"a1ea38a874ca7d4ea042cdaf87e010e721df95fb"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"28c5c2e7b04e1900c6396a51acb95100893deaa3","unresolved":false,"context_lines":[{"line_number":88,"context_line":"    @rbac_utils.allowed_roles(roles\u003d[\"admin\"])"},{"line_number":89,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":90,"context_line":"                                 rules\u003d[\"get_agent\", \"delete_agent\"])"},{"line_number":91,"context_line":"    def test_delete_agent_as_admin(self):"},{"line_number":92,"context_line":"        \"\"\"Delete agent test as admin."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"        RBAC test for the neutron delete_agent policy"}],"source_content_type":"text/x-python","patch_set":11,"id":"3f79a3b5_64cb5649","line":91,"range":{"start_line":91,"start_character":8,"end_line":91,"end_character":34},"updated":"2018-09-20 19:06:15.000000000","message":"I vote to not test this in Patrole, because 1) it\u0027s a destructive action and Patrole/Tempest aren\u0027t ideal for that; 2) we can\u0027t spoof the 404 since RBAC for Neutron also raises a 404, making this quite difficult.","commit_id":"9bb10c214269942f6548cf2fc7fb9431e4619164"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"8e0833ab9ece7e0b39c1b91ad5ed2148619f4d7c","unresolved":false,"context_lines":[{"line_number":88,"context_line":"    @rbac_utils.allowed_roles(roles\u003d[\"admin\"])"},{"line_number":89,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":90,"context_line":"                                 rules\u003d[\"get_agent\", \"delete_agent\"])"},{"line_number":91,"context_line":"    def test_delete_agent_as_admin(self):"},{"line_number":92,"context_line":"        \"\"\"Delete agent test as admin."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"        RBAC test for the neutron delete_agent policy"}],"source_content_type":"text/x-python","patch_set":11,"id":"3f79a3b5_e9d96cf3","line":91,"range":{"start_line":91,"start_character":8,"end_line":91,"end_character":34},"in_reply_to":"3f79a3b5_64cb5649","updated":"2018-09-21 21:47:56.000000000","message":"Done","commit_id":"9bb10c214269942f6548cf2fc7fb9431e4619164"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"28c5c2e7b04e1900c6396a51acb95100893deaa3","unresolved":false,"context_lines":[{"line_number":101,"context_line":"                \"Agent %s could not be found.\" % fake_uuid,"},{"line_number":102,"context_line":"                self.ntp_client.delete_agent, fake_uuid)"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"    @decorators.idempotent_id(\u00278ca68fdb-eaf6-4880-af82-ba0982123cde\u0027)"},{"line_number":105,"context_line":"    @rbac_utils.allowed_roles(roles\u003d[\"member\"])"},{"line_number":106,"context_line":"    @rbac_rule_validation.action(service\u003d\"neutron\","},{"line_number":107,"context_line":"                                 rules\u003d[\"get_agent\", \"delete_agent\"],"},{"line_number":108,"context_line":"                                 expected_error_codes\u003d[404, 403])"},{"line_number":109,"context_line":"    def test_delete_agent_as_member(self):"},{"line_number":110,"context_line":"        \"\"\"Delete agent test as member."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"        RBAC test for the neutron delete_agent policy"},{"line_number":113,"context_line":"        \"\"\""},{"line_number":114,"context_line":"        agent \u003d self._get_l3_agent()"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":117,"context_line":"            self.ntp_client.delete_agent(agent[\u0027id\u0027])"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"class L3AgentSchedulerRbacTest(base.BaseNetworkRbacTest):"}],"source_content_type":"text/x-python","patch_set":11,"id":"3f79a3b5_84ad5285","line":117,"range":{"start_line":104,"start_character":0,"end_line":117,"end_character":53},"updated":"2018-09-20 19:06:15.000000000","message":"We can\u0027t do this because if an operator changes the default rule for \"delete_agent\" to \"@\" then \"member\" role will necessarily be allowed to do this. We can\u0027t operate under the assumption that this will necessarily fail.","commit_id":"9bb10c214269942f6548cf2fc7fb9431e4619164"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"0f4ddc27a8351f881927a3efd8678ef3b50cbfc6","unresolved":false,"context_lines":[{"line_number":262,"context_line":"        RBAC test for the neutron get_l3-agents policy"},{"line_number":263,"context_line":"        \"\"\""},{"line_number":264,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":265,"context_line":"            self.ntp_client.list_l3_agents_hosting_router(self.router[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":15,"id":"3f79a3b5_5d86bd18","line":265,"range":{"start_line":265,"start_character":28,"end_line":265,"end_character":57},"updated":"2018-09-26 20:18:05.000000000","message":"Is this going to return an exception? Otherwise we need to some additional checks below to see whether this is empty or just a partial response.","commit_id":"2b1fa98213e5624207c3fd30410f554a05093919"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"d899168e7be0659e6afef4ed39caffc5250d139c","unresolved":false,"context_lines":[{"line_number":262,"context_line":"        RBAC test for the neutron get_l3-agents policy"},{"line_number":263,"context_line":"        \"\"\""},{"line_number":264,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":265,"context_line":"            self.ntp_client.list_l3_agents_hosting_router(self.router[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":15,"id":"3f79a3b5_3b8acd19","line":265,"range":{"start_line":265,"start_character":28,"end_line":265,"end_character":57},"in_reply_to":"3f79a3b5_115a57f1","updated":"2018-09-27 21:56:12.000000000","message":"Thanks, I see why. May we add a NOTE here explaining that this is a unique case. I\u0027m also OK to merge it as it is documented as bullet point #2 here: https://docs.openstack.org/neutron/pike/contributor/internals/policy.html#request-authorization\n\n\"A 403 response for failures while authorizing API actions such as add_router_interface;\"\n\nHere is why: https://github.com/openstack/neutron/blob/a388701ddfe628e9a5bd16a78422164799b11ef8/neutron/extensions/l3agentscheduler.py#L100\n\nAlso, if you check policy.enforce in codesearch.openstack.org for Neutron you will see the other resources like here: http://git.openstack.org/cgit/openstack/neutron/tree/neutron/extensions/dhcpagentscheduler.py#n36\n\nThat has this same behavior.","commit_id":"2b1fa98213e5624207c3fd30410f554a05093919"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"1ac5d7669a1ec262c7d8eb8dc10cd9727b26503f","unresolved":false,"context_lines":[{"line_number":262,"context_line":"        RBAC test for the neutron get_l3-agents policy"},{"line_number":263,"context_line":"        \"\"\""},{"line_number":264,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":265,"context_line":"            self.ntp_client.list_l3_agents_hosting_router(self.router[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":15,"id":"3f79a3b5_31f95e81","line":265,"range":{"start_line":265,"start_character":28,"end_line":265,"end_character":57},"in_reply_to":"3f79a3b5_3b8acd19","updated":"2018-09-30 19:51:12.000000000","message":"Done","commit_id":"2b1fa98213e5624207c3fd30410f554a05093919"},{"author":{"_account_id":16274,"name":"Mykola Yakovliev","email":"VegasQ@gmail.com","username":"vegasq"},"change_message_id":"d0b6fcc7307bdf3aad39de14ba014a01656c750f","unresolved":false,"context_lines":[{"line_number":262,"context_line":"        RBAC test for the neutron get_l3-agents policy"},{"line_number":263,"context_line":"        \"\"\""},{"line_number":264,"context_line":"        with self.rbac_utils.override_role(self):"},{"line_number":265,"context_line":"            self.ntp_client.list_l3_agents_hosting_router(self.router[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":15,"id":"3f79a3b5_115a57f1","line":265,"range":{"start_line":265,"start_character":28,"end_line":265,"end_character":57},"in_reply_to":"3f79a3b5_5d86bd18","updated":"2018-09-27 17:35:51.000000000","message":"This one actually pulls 403:\n\n(Pdb) resp\n{\u0027status\u0027: \u0027403\u0027, u\u0027content-length\u0027: \u0027120\u0027, \u0027content-location\u0027: \u0027http://10.0.2.15:9696/v2.0/routers/47ad7d8b-b3a4-4a74-8d3e-fd1fbe116a5c/l3-agents\u0027, u\u0027connection\u0027: \u0027close\u0027, u\u0027date\u0027: \u0027Thu, 27 Sep 2018 17:29:01 GMT\u0027, u\u0027content-type\u0027: \u0027application/json\u0027, u\u0027x-openstack-request-id\u0027: \u0027req-4da796a8-33f7-4a74-b78f-09160be86eb6\u0027}\n(Pdb) resp_body\n\u0027{\"NeutronError\": {\"message\": \"rule:get_l3-agents is disallowed by policy\", \"type\": \"PolicyNotAuthorized\", \"detail\": \"\"}}\u0027\n\nI think (need to double check) its again just nested field within router [0]. Since we have all right to read router, no 404 is thrown. So we get 403 on rule validation step.\n\n\n[0] https://github.com/openstack/neutron/blob/master/neutron/db/models/l3.py#L62","commit_id":"2b1fa98213e5624207c3fd30410f554a05093919"}]}