)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6676,"name":"zqfan","email":"aji.zqfan@gmail.com","username":"aji-zqfan"},"change_message_id":"ae0e5501422a9a1d010f7a5fa03a0edfd3fde6a5","unresolved":false,"context_lines":[{"line_number":14,"context_line":"them."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"A policy.json file will contain the specific rules to apply"},{"line_number":17,"context_line":"for the differnt roles leaving to the deployer the ability"},{"line_number":18,"context_line":"of enforcing specific restrictions without having to change"},{"line_number":19,"context_line":"the implementation."},{"line_number":20,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"7a8c0949_b4c0612b","line":17,"updated":"2014-11-06 12:10:53.000000000","message":"nit: different","commit_id":"f2f2550d7a7cbcace5c5ab419148d732ca0eca83"}],"specs/juno/ceilometer-rbac.rst":[{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"97dd524f121ee2b500adc48097bad303942fa2c5","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Ceilometer API RBAC - Granular Role-based Access Control"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Current access control for the API is all or nothing. A policy.json file is"},{"line_number":12,"context_line":"used but it simply determines if the user is admin, granting all privileges, or"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_db0c8a96","line":9,"updated":"2014-08-05 22:54:30.000000000","message":"Please change the file name to reflect the title or vice-versa.\nMake the \u003d\u003d as long as the title","commit_id":"0e4e348057f06e31b1526b0f1424b61268b82e6f"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"97dd524f121ee2b500adc48097bad303942fa2c5","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Ceilometer API RBAC - Granular Role-based Access Control"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Current access control for the API is all or nothing. A policy.json file is"},{"line_number":12,"context_line":"used but it simply determines if the user is admin, granting all privileges, or"},{"line_number":13,"context_line":"scoping for a single project."},{"line_number":14,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_9b7932fe","line":11,"updated":"2014-08-05 22:54:30.000000000","message":"Please change in: Current access control for the API presents a clear lack of granularity. In fact it is possible to have a \"global\" admin role or a simple \"user\" within the project and nothing in between,","commit_id":"0e4e348057f06e31b1526b0f1424b61268b82e6f"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"97dd524f121ee2b500adc48097bad303942fa2c5","unresolved":false,"context_lines":[{"line_number":13,"context_line":"scoping for a single project."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"With upcoming Keystone v3 enhancements we can expand the granularity of access"},{"line_number":16,"context_line":"control to allow cross-project access by non-admins. This functionality will be"},{"line_number":17,"context_line":"useful for admins of groups of users/tenants who should not be the admin of the"},{"line_number":18,"context_line":"entire system."},{"line_number":19,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_7b5b7e89","line":16,"updated":"2014-08-05 22:54:30.000000000","message":"non \"global\" admins, i.e. Domain Admins or Parent Project admins.","commit_id":"0e4e348057f06e31b1526b0f1424b61268b82e6f"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"97dd524f121ee2b500adc48097bad303942fa2c5","unresolved":false,"context_lines":[{"line_number":18,"context_line":"entire system."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"We will accomplish this by using a decorator on the API functions. The"},{"line_number":21,"context_line":"decorator will control access based on user/tenant roles and rules specified in"},{"line_number":22,"context_line":"the policy json file."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"acl.py could be deprecated since its only function is to determine if a user is"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_bbe3569f","line":21,"updated":"2014-08-05 22:54:30.000000000","message":"please change tenant to project","commit_id":"0e4e348057f06e31b1526b0f1424b61268b82e6f"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"97dd524f121ee2b500adc48097bad303942fa2c5","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Use cases where this limits functionality include:"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"* Resellers who manage more than one tenant"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"* Domain administrators with more than one tenant"},{"line_number":57,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_bb9a7611","line":54,"updated":"2014-08-05 22:54:30.000000000","message":"please change to project","commit_id":"0e4e348057f06e31b1526b0f1424b61268b82e6f"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"97dd524f121ee2b500adc48097bad303942fa2c5","unresolved":false,"context_lines":[{"line_number":53,"context_line":""},{"line_number":54,"context_line":"* Resellers who manage more than one tenant"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"* Domain administrators with more than one tenant"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"* Support personnel for above cases"},{"line_number":59,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_fb830ea8","line":56,"updated":"2014-08-05 22:54:30.000000000","message":"as above","commit_id":"0e4e348057f06e31b1526b0f1424b61268b82e6f"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"97dd524f121ee2b500adc48097bad303942fa2c5","unresolved":false,"context_lines":[{"line_number":55,"context_line":""},{"line_number":56,"context_line":"* Domain administrators with more than one tenant"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"* Support personnel for above cases"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"Proposed change"},{"line_number":61,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_5b8b1ac0","line":58,"updated":"2014-08-05 22:54:30.000000000","message":"Supports personnel for the above mentioned use cases","commit_id":"0e4e348057f06e31b1526b0f1424b61268b82e6f"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"97dd524f121ee2b500adc48097bad303942fa2c5","unresolved":false,"context_lines":[{"line_number":171,"context_line":""},{"line_number":172,"context_line":"Pipeline impact"},{"line_number":173,"context_line":"---------------"},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"As configured by default there would be no pipeline impacts."},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"Other end user impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_5b795ac4","line":174,"updated":"2014-08-05 22:54:30.000000000","message":"Just put None","commit_id":"0e4e348057f06e31b1526b0f1424b61268b82e6f"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"97dd524f121ee2b500adc48097bad303942fa2c5","unresolved":false,"context_lines":[{"line_number":180,"context_line":"This will have no effect on python-ceilometerclient as roles and their associated rules would be established in keystone and interpreted by Ceilometer API."},{"line_number":181,"context_line":""},{"line_number":182,"context_line":"If end users were to take advantage of the expanded RBAC capabilities, there"},{"line_number":183,"context_line":"would be end user impacts in securing appropriate user and tenant roles to"},{"line_number":184,"context_line":"match those defined in the policy file."},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"Performance/Scalability Impacts"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_7b453e71","line":183,"updated":"2014-08-05 22:54:30.000000000","message":"Project","commit_id":"0e4e348057f06e31b1526b0f1424b61268b82e6f"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"97dd524f121ee2b500adc48097bad303942fa2c5","unresolved":false,"context_lines":[{"line_number":186,"context_line":"Performance/Scalability Impacts"},{"line_number":187,"context_line":"-------------------------------"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"Describe any potential performance or scaling impact on the system, considering"},{"line_number":190,"context_line":"for example:"},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"* The volume of new metering data generated, and the knock-on impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_9b4a1281","line":189,"updated":"2014-08-05 22:54:30.000000000","message":"I guess this can be replaced by: None","commit_id":"0e4e348057f06e31b1526b0f1424b61268b82e6f"},{"author":{"_account_id":7336,"name":"Phil Neal","email":"phil.neal@hp.com","username":"nealph"},"change_message_id":"39b52da92587d145561f9f576641a666067dcfaa","unresolved":false,"context_lines":[{"line_number":201,"context_line":"* Whether any explicit performance testing would be advisable to validate"},{"line_number":202,"context_line":"  the new feature, either at the PoC stage, and/or in its final form."},{"line_number":203,"context_line":""},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"Other deployer impact"},{"line_number":206,"context_line":"---------------------"},{"line_number":207,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_21cd3b31","line":204,"updated":"2014-08-06 15:52:27.000000000","message":"Isn\u0027t there a positive scalability impact here? i.e. the ability to manage a greater number of resources without growing api responses in parallel (if not exponentially)?","commit_id":"0e4e348057f06e31b1526b0f1424b61268b82e6f"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"97dd524f121ee2b500adc48097bad303942fa2c5","unresolved":false,"context_lines":[{"line_number":205,"context_line":"Other deployer impact"},{"line_number":206,"context_line":"---------------------"},{"line_number":207,"context_line":""},{"line_number":208,"context_line":"Discuss things that will affect how you deploy and configure OpenStack that"},{"line_number":209,"context_line":"have not already been mentioned, such as:"},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"* What config options are being added?"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_1b56022c","line":208,"updated":"2014-08-05 22:54:30.000000000","message":"Mention the ability to define and use different policy files","commit_id":"0e4e348057f06e31b1526b0f1424b61268b82e6f"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"97dd524f121ee2b500adc48097bad303942fa2c5","unresolved":false,"context_lines":[{"line_number":252,"context_line":"-----------"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"Who is leading the writing of the code? Or is this a blueprint where you\u0027re"},{"line_number":255,"context_line":"throwing it out there to see who picks it up?"},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"If more than one person is working on the implementation, please designate the"},{"line_number":258,"context_line":"primary author and contact."}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_5b507a2c","line":255,"updated":"2014-08-05 22:54:30.000000000","message":"Get rid of these two explanatory paragraphs","commit_id":"0e4e348057f06e31b1526b0f1424b61268b82e6f"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"97dd524f121ee2b500adc48097bad303942fa2c5","unresolved":false,"context_lines":[{"line_number":258,"context_line":"primary author and contact."},{"line_number":259,"context_line":""},{"line_number":260,"context_line":"Primary assignee:"},{"line_number":261,"context_line":"  \u003claunchpad-id or None\u003e"},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"Other contributors:"},{"line_number":264,"context_line":"  \u003claunchpad-id or None\u003e"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_bb36f600","line":261,"updated":"2014-08-05 22:54:30.000000000","message":"please put your user name (launchpad)","commit_id":"0e4e348057f06e31b1526b0f1424b61268b82e6f"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"97dd524f121ee2b500adc48097bad303942fa2c5","unresolved":false,"context_lines":[{"line_number":316,"context_line":"Documentation Impact"},{"line_number":317,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":318,"context_line":""},{"line_number":319,"context_line":"What is the impact on the docs team of this change? Some changes might require"},{"line_number":320,"context_line":"donating resources to the docs team to have the documentation updated. Don\u0027t"},{"line_number":321,"context_line":"repeat details discussed above, but please reference them here."},{"line_number":322,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_1b044218","line":319,"updated":"2014-08-05 22:54:30.000000000","message":"Maybe we will need to consider some documentation around the policy now that it becomes useful/more complex","commit_id":"0e4e348057f06e31b1526b0f1424b61268b82e6f"},{"author":{"_account_id":7336,"name":"Phil Neal","email":"phil.neal@hp.com","username":"nealph"},"change_message_id":"39b52da92587d145561f9f576641a666067dcfaa","unresolved":false,"context_lines":[{"line_number":317,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":318,"context_line":""},{"line_number":319,"context_line":"What is the impact on the docs team of this change? Some changes might require"},{"line_number":320,"context_line":"donating resources to the docs team to have the documentation updated. Don\u0027t"},{"line_number":321,"context_line":"repeat details discussed above, but please reference them here."},{"line_number":322,"context_line":""},{"line_number":323,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_819b6763","line":320,"updated":"2014-08-06 15:52:27.000000000","message":"IMO all public API changes need be documented, including examples...I would plan on updates to existing docs at minimum.\n\nAlso, any conf option would need to be updated into the appropriate docs.","commit_id":"0e4e348057f06e31b1526b0f1424b61268b82e6f"},{"author":{"_account_id":7336,"name":"Phil Neal","email":"phil.neal@hp.com","username":"nealph"},"change_message_id":"39b52da92587d145561f9f576641a666067dcfaa","unresolved":false,"context_lines":[{"line_number":335,"context_line":"* Links to relevant research, appropriately distilled or summarized"},{"line_number":336,"context_line":""},{"line_number":337,"context_line":"* Related specifications as appropriate (e.g.  if it\u0027s calling out to a REST"},{"line_number":338,"context_line":"  API exposed by another OpenStack service, link to that API definition)"},{"line_number":339,"context_line":""},{"line_number":340,"context_line":"* Anything else you feel it is worthwhile to refer to"},{"line_number":341,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_034bdf86","line":338,"updated":"2014-08-06 15:52:27.000000000","message":"Your launchpad blueprint link should go here.","commit_id":"0e4e348057f06e31b1526b0f1424b61268b82e6f"},{"author":{"_account_id":6537,"name":"gordon chung","email":"gord@live.ca","username":"chungg"},"change_message_id":"684df6ab2b83023f756ed77748129f6f85fdc7a1","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"++++++++++++++\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Ceilometer API RBAC - Granular Role-based Access Control"},{"line_number":9,"context_line":"++++++++++++++\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1abeadc6_c5dfa6d4","line":7,"updated":"2014-08-22 02:44:19.000000000","message":"formatting issue here.. should probably be just equal signs.","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"b6387115b48a8a84db49d01e876adc59b3baea35","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"++++++++++++++\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Ceilometer API RBAC - Granular Role-based Access Control"},{"line_number":9,"context_line":"++++++++++++++\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa98f980_14dcbfe3","line":7,"in_reply_to":"1abeadc6_c5dfa6d4","updated":"2014-09-02 21:52:38.000000000","message":"Done","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"175c34f9f67c0d2d36726d8a8fcca93877d5432e","unresolved":false,"context_lines":[{"line_number":67,"context_line":""},{"line_number":68,"context_line":"This would allow fine-grained, role-dependent, method-specific access control."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"It would also prepare Ceilometer API for the upcoming Keystone v3 added"},{"line_number":71,"context_line":"functionality since domains could be used in rule creation."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"This functionality could be applied in Ceilometer API before Keystone v3 is"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1abeadc6_9f9f1f50","line":70,"updated":"2014-08-19 18:50:39.000000000","message":"Please change in:\nIt would also align Ceilometer API wit the Keystone V3 Domain capabilities as well as the hierarchical project proposal since both domain or project could be used in rule creation.","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"b6387115b48a8a84db49d01e876adc59b3baea35","unresolved":false,"context_lines":[{"line_number":67,"context_line":""},{"line_number":68,"context_line":"This would allow fine-grained, role-dependent, method-specific access control."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"It would also prepare Ceilometer API for the upcoming Keystone v3 added"},{"line_number":71,"context_line":"functionality since domains could be used in rule creation."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"This functionality could be applied in Ceilometer API before Keystone v3 is"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa98f980_f4d57bb9","line":70,"in_reply_to":"1abeadc6_9f9f1f50","updated":"2014-09-02 21:52:38.000000000","message":"Done","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"175c34f9f67c0d2d36726d8a8fcca93877d5432e","unresolved":false,"context_lines":[{"line_number":70,"context_line":"It would also prepare Ceilometer API for the upcoming Keystone v3 added"},{"line_number":71,"context_line":"functionality since domains could be used in rule creation."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"This functionality could be applied in Ceilometer API before Keystone v3 is"},{"line_number":74,"context_line":"implemented and behavior would default to the current access control scheme"},{"line_number":75,"context_line":"unless the owner decided to use the expanded functionality."},{"line_number":76,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1abeadc6_7fcb2353","line":73,"updated":"2014-08-19 18:50:39.000000000","message":"Please remove this param. Keystone is already v3","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"b6387115b48a8a84db49d01e876adc59b3baea35","unresolved":false,"context_lines":[{"line_number":70,"context_line":"It would also prepare Ceilometer API for the upcoming Keystone v3 added"},{"line_number":71,"context_line":"functionality since domains could be used in rule creation."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"This functionality could be applied in Ceilometer API before Keystone v3 is"},{"line_number":74,"context_line":"implemented and behavior would default to the current access control scheme"},{"line_number":75,"context_line":"unless the owner decided to use the expanded functionality."},{"line_number":76,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa98f980_b4cbf31c","line":73,"in_reply_to":"1abeadc6_7fcb2353","updated":"2014-09-02 21:52:38.000000000","message":"Done","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":6537,"name":"gordon chung","email":"gord@live.ca","username":"chungg"},"change_message_id":"684df6ab2b83023f756ed77748129f6f85fdc7a1","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"This functionality could be applied in Ceilometer API before Keystone v3 is"},{"line_number":74,"context_line":"implemented and behavior would default to the current access control scheme"},{"line_number":75,"context_line":"unless the owner decided to use the expanded functionality."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Alternatives"},{"line_number":78,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1abeadc6_45d476bc","line":75,"updated":"2014-08-22 02:44:19.000000000","message":"i haven\u0027t looked at the corresponding code so might be stupid question but i assume this doesn\u0027t require any additional api calls to keystone? is it using the environ variables keystonemiddleware sets and applies some logic to it to figure out access?","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"b6387115b48a8a84db49d01e876adc59b3baea35","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"This functionality could be applied in Ceilometer API before Keystone v3 is"},{"line_number":74,"context_line":"implemented and behavior would default to the current access control scheme"},{"line_number":75,"context_line":"unless the owner decided to use the expanded functionality."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Alternatives"},{"line_number":78,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa98f980_94c8af23","line":75,"in_reply_to":"1abeadc6_45d476bc","updated":"2014-09-02 21:52:38.000000000","message":"Yeah, I removed the paragraph altogether since Keystone is already V3 and it would not require any changes from their side.","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":6537,"name":"gordon chung","email":"gord@live.ca","username":"chungg"},"change_message_id":"684df6ab2b83023f756ed77748129f6f85fdc7a1","unresolved":false,"context_lines":[{"line_number":81,"context_line":"This filter would implement RBAC through calls to Keystone to verify roles,"},{"line_number":82,"context_line":"projects and domains."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"While we believe this is a reasonable solution, it diverges from the way"},{"line_number":85,"context_line":"Ceilometer API is currently implemented.  It would require insertion of an"},{"line_number":86,"context_line":"access control filter between the middleware and Pecan.  It would also require"},{"line_number":87,"context_line":"significant code changes to the current RBAC scheme which handles access"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1abeadc6_a5daaa14","line":84,"updated":"2014-08-22 02:44:19.000000000","message":"while i prefer the proposed solution. is there a recommended solution on keystone end?","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"b6387115b48a8a84db49d01e876adc59b3baea35","unresolved":false,"context_lines":[{"line_number":81,"context_line":"This filter would implement RBAC through calls to Keystone to verify roles,"},{"line_number":82,"context_line":"projects and domains."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"While we believe this is a reasonable solution, it diverges from the way"},{"line_number":85,"context_line":"Ceilometer API is currently implemented.  It would require insertion of an"},{"line_number":86,"context_line":"access control filter between the middleware and Pecan.  It would also require"},{"line_number":87,"context_line":"significant code changes to the current RBAC scheme which handles access"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa98f980_f4a3bb4c","line":84,"in_reply_to":"1abeadc6_a5daaa14","updated":"2014-09-02 21:52:38.000000000","message":"Keystone will do the authN and authZ part. So if you are requesting a scoped token to a project and you are a project member it means that you are authorized to execute the API call, but the policy may require that you have a special role to execute that command and this is enforced locally.","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":6537,"name":"gordon chung","email":"gord@live.ca","username":"chungg"},"change_message_id":"684df6ab2b83023f756ed77748129f6f85fdc7a1","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The proposed model will minimize code changes.  It would simply add decorator"},{"line_number":91,"context_line":"statements to the external API methods, create an additional module, and add"},{"line_number":92,"context_line":"configuration changes to policy.json"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Data model impact"},{"line_number":95,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1abeadc6_05199ed6","line":92,"updated":"2014-08-22 02:44:19.000000000","message":"not a concern but a general question to all reviewers: while we are already pretty dependent on keystone throughout ceilometer\u0027s services, is such tight coupling acceptable? i\u0027m making an assumption that ceilometer api cannot function without keystone... if that\u0027s not true. please disregard.","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"b6387115b48a8a84db49d01e876adc59b3baea35","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The proposed model will minimize code changes.  It would simply add decorator"},{"line_number":91,"context_line":"statements to the external API methods, create an additional module, and add"},{"line_number":92,"context_line":"configuration changes to policy.json"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Data model impact"},{"line_number":95,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa98f980_94bd0f6b","line":92,"in_reply_to":"1abeadc6_05199ed6","updated":"2014-09-02 21:52:38.000000000","message":"Openstack is totally dependent on KS for authN and authZ without you cannot do anything.","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"175c34f9f67c0d2d36726d8a8fcca93877d5432e","unresolved":false,"context_lines":[{"line_number":141,"context_line":"Other end user impact"},{"line_number":142,"context_line":"---------------------"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"This will have no effect on python-ceilometerclient as roles and their"},{"line_number":145,"context_line":"associated rules would be established in keystone and interpreted by Ceilometer"},{"line_number":146,"context_line":"API."},{"line_number":147,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1abeadc6_7f4083a5","line":144,"updated":"2014-08-19 18:50:39.000000000","message":"effect on/direct impact on","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"175c34f9f67c0d2d36726d8a8fcca93877d5432e","unresolved":false,"context_lines":[{"line_number":143,"context_line":""},{"line_number":144,"context_line":"This will have no effect on python-ceilometerclient as roles and their"},{"line_number":145,"context_line":"associated rules would be established in keystone and interpreted by Ceilometer"},{"line_number":146,"context_line":"API."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"If end users were to take advantage of the expanded RBAC capabilities, there"},{"line_number":149,"context_line":"would be end user impacts in securing appropriate user and project roles to"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1abeadc6_bfe69bb2","line":146,"updated":"2014-08-19 18:50:39.000000000","message":"API. Nevertheless the python-ceilometerclient will benefit from the increase security provided by the new policy support. For instance, collector agent (or any other ceilometer service) can have a special role associated with it disallowing other services (with admin status) to post data in the database.","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"b6387115b48a8a84db49d01e876adc59b3baea35","unresolved":false,"context_lines":[{"line_number":143,"context_line":""},{"line_number":144,"context_line":"This will have no effect on python-ceilometerclient as roles and their"},{"line_number":145,"context_line":"associated rules would be established in keystone and interpreted by Ceilometer"},{"line_number":146,"context_line":"API."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"If end users were to take advantage of the expanded RBAC capabilities, there"},{"line_number":149,"context_line":"would be end user impacts in securing appropriate user and project roles to"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa98f980_eaebd2ad","line":146,"in_reply_to":"1abeadc6_bfe69bb2","updated":"2014-09-02 21:52:38.000000000","message":"Done","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":6537,"name":"gordon chung","email":"gord@live.ca","username":"chungg"},"change_message_id":"684df6ab2b83023f756ed77748129f6f85fdc7a1","unresolved":false,"context_lines":[{"line_number":158,"context_line":"---------------------"},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"By default there will be no impact during deployment.  The change will ship"},{"line_number":161,"context_line":"with a configuration that preserves the current access control behavior.  The"},{"line_number":162,"context_line":"operator can simply leave everything as is and expect the system to behave as"},{"line_number":163,"context_line":"it did before this change."},{"line_number":164,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1abeadc6_856bee1c","line":161,"updated":"2014-08-22 02:44:19.000000000","message":"option or file? if it\u0027s a file you\u0027ll probably need to add a work item to test grenade upgrade","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"b6387115b48a8a84db49d01e876adc59b3baea35","unresolved":false,"context_lines":[{"line_number":158,"context_line":"---------------------"},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"By default there will be no impact during deployment.  The change will ship"},{"line_number":161,"context_line":"with a configuration that preserves the current access control behavior.  The"},{"line_number":162,"context_line":"operator can simply leave everything as is and expect the system to behave as"},{"line_number":163,"context_line":"it did before this change."},{"line_number":164,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa98f980_4a213efa","line":161,"in_reply_to":"1abeadc6_856bee1c","updated":"2014-09-02 21:52:38.000000000","message":"A sample policy file, testing some of the policy, can be validated during unit testing if there is the possibility of changing the file in the tests","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"5408af2aec75db7de51c654277b54910b2d0593c","unresolved":false,"context_lines":[{"line_number":169,"context_line":""},{"line_number":170,"context_line":"(EP: leaving below in as a guide for self as I complete this section)"},{"line_number":171,"context_line":"Discuss things that will affect how you deploy and configure OpenStack that"},{"line_number":172,"context_line":"have not already been mentioned, such as:"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"Deployment options:"},{"line_number":175,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1abeadc6_de67a2b5","line":172,"updated":"2014-08-20 23:45:21.000000000","message":"Remove the comment here please","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"b6387115b48a8a84db49d01e876adc59b3baea35","unresolved":false,"context_lines":[{"line_number":169,"context_line":""},{"line_number":170,"context_line":"(EP: leaving below in as a guide for self as I complete this section)"},{"line_number":171,"context_line":"Discuss things that will affect how you deploy and configure OpenStack that"},{"line_number":172,"context_line":"have not already been mentioned, such as:"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"Deployment options:"},{"line_number":175,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa98f980_ca360e52","line":172,"in_reply_to":"1abeadc6_de67a2b5","updated":"2014-09-02 21:52:38.000000000","message":"Done","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"},{"author":{"_account_id":7052,"name":"Fabio Giannetti","email":"fgiannet@cisco.com","username":"fabgia"},"change_message_id":"175c34f9f67c0d2d36726d8a8fcca93877d5432e","unresolved":false,"context_lines":[{"line_number":252,"context_line":"References"},{"line_number":253,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":254,"context_line":""},{"line_number":255,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1abeadc6_df02770a","line":255,"updated":"2014-08-19 18:50:39.000000000","message":"Please add the reference to the Keystone V3 Policy:\nhttps://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json","commit_id":"4fa4781e0363922e27a82421d7c609a3f9958e05"}],"specs/kilo/ceilometer-rbac.rst":[{"author":{"_account_id":6676,"name":"zqfan","email":"aji.zqfan@gmail.com","username":"aji-zqfan"},"change_message_id":"ae0e5501422a9a1d010f7a5fa03a0edfd3fde6a5","unresolved":false,"context_lines":[{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Ceilometer API RBAC - Granular Role-based Access Control"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Current access control for the API presents a clear lack of granularity. In"},{"line_number":12,"context_line":"fact it is possible to have a \"global\" admin role or a simple \"user\" within the"},{"line_number":13,"context_line":"project and nothing in between."}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a8c0949_54d2dd00","line":10,"updated":"2014-11-06 12:10:53.000000000","message":"add you bp address here:\n\nhttps://blueprints.launchpad.net/ceilometer/+spec/ready-ceilometer-rbac-keystone-v3","commit_id":"f2f2550d7a7cbcace5c5ab419148d732ca0eca83"},{"author":{"_account_id":6676,"name":"zqfan","email":"aji.zqfan@gmail.com","username":"aji-zqfan"},"change_message_id":"ae0e5501422a9a1d010f7a5fa03a0edfd3fde6a5","unresolved":false,"context_lines":[{"line_number":68,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"We propose to solve the problem by moving access control from calls to the ACL"},{"line_number":71,"context_line":"to applying a decorator to the API methods.  Each publicly accessible API"},{"line_number":72,"context_line":"method would have a decorator pointing to a new RBAC module.  The RBAC module"},{"line_number":73,"context_line":"decorator would use rules defined in policy.json to determine accesibility of"},{"line_number":74,"context_line":"methods by a caller."}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a8c0949_944a85c3","line":71,"updated":"2014-11-06 12:10:53.000000000","message":"why there are two spaces? some kind of IDE setting between sentences?","commit_id":"f2f2550d7a7cbcace5c5ab419148d732ca0eca83"},{"author":{"_account_id":6676,"name":"zqfan","email":"aji.zqfan@gmail.com","username":"aji-zqfan"},"change_message_id":"ae0e5501422a9a1d010f7a5fa03a0edfd3fde6a5","unresolved":false,"context_lines":[{"line_number":146,"context_line":"Other end user impact"},{"line_number":147,"context_line":"---------------------"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"This will have no direct impact on on python-ceilometerclient as roles and"},{"line_number":150,"context_line":"their associated rules would be established in keystone and interpreted by"},{"line_number":151,"context_line":"Ceilometer API. Nevertheless the python-ceilometerclient will benefit from the"},{"line_number":152,"context_line":"increase security provided by the new policy support. For instance, collector"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a8c0949_d4616d3a","line":149,"updated":"2014-11-06 12:10:53.000000000","message":"on on ?","commit_id":"f2f2550d7a7cbcace5c5ab419148d732ca0eca83"},{"author":{"_account_id":6676,"name":"zqfan","email":"aji.zqfan@gmail.com","username":"aji-zqfan"},"change_message_id":"ae0e5501422a9a1d010f7a5fa03a0edfd3fde6a5","unresolved":false,"context_lines":[{"line_number":151,"context_line":"Ceilometer API. Nevertheless the python-ceilometerclient will benefit from the"},{"line_number":152,"context_line":"increase security provided by the new policy support. For instance, collector"},{"line_number":153,"context_line":"agent (or any other ceilometer service) can have a special role associated"},{"line_number":154,"context_line":"with it disallowing other services (with admin status) to post data in the"},{"line_number":155,"context_line":"database."},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"If end users were to take advantage of the expanded RBAC capabilities, there"}],"source_content_type":"text/x-rst","patch_set":11,"id":"7a8c0949_54dc9de4","line":154,"updated":"2014-11-06 12:10:53.000000000","message":"IIUC, collector will not access API, it verifies message\u0027s signature","commit_id":"f2f2550d7a7cbcace5c5ab419148d732ca0eca83"}]}