)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"fdf2ee8bd2da6482cda8fe4ce380f59c98c09ac8","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"df1df561_8255bd53","updated":"2022-07-14 18:21:15.000000000","message":"I\u0027ll remove -2 to unblock this but keep -1 because of my concern I earlier explained.","commit_id":"86f56244a04bd2ee11a98d929efd0740e3aaa1d8"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"c9457799faeaa4c73d6d32b4633c887f0bb8218f","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"93ee1ae5_7b1a19bb","updated":"2022-07-14 13:11:42.000000000","message":"Posting -2 to blocking merge now.\n\nIn my understanding we do not use these roles now.\n\nThe octavia package in RDO installs the policy rule file, which makes octavia to use the conventional keystone roles(admin or not) instead of the default rules implemented in code","commit_id":"86f56244a04bd2ee11a98d929efd0740e3aaa1d8"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"d00ec21c42fe5fbc17c4ceb73106b974847c7204","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"f6a97a52_92032025","updated":"2022-07-14 16:27:45.000000000","message":"Takashi,\nThis is part of the secure-RBAC work. As you mentioned, Octavia has had these roles since Pike, but TripleO had previously overrode these with the old admin-or-owner policy.\nWith the switch to \"secure-RBAC\" we are moving closer to what Octavia has had support for. In fact, the \"secure-RBAC\" and enable-secure-RBAC environment leverages and overrides these roles to provide the project-member, project-reader functionality.\nGreg is adding these roles to keystone in Tripleo to bring alignment with the default roles in Octavia and the new \"secure-RBAC\" policies.\nIt will also simplify the tempest testing as you noted, because these keystone roles can be used in both the Octavia \"advanced RBAC\" and the \"secure-RBAC\" configurations.\nThe advantage for customers is if they are/have been using these roles with Octavia previously, they will now be compatible in Tripleo deployments and compatible with the \"secure-RBAC\" policies. If the customer does not need them, they will cause no issue in the cloud, but will make tempest testing easier (you don\u0027t have to override the role configuration in tempest.conf).\n","commit_id":"86f56244a04bd2ee11a98d929efd0740e3aaa1d8"},{"author":{"_account_id":6681,"name":"Brent Eagles","email":"beagles@redhat.com","username":"beagles"},"change_message_id":"d480af607881adf36dc60864b905cc651aa04a8b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"4b2f8324_11712e7a","updated":"2021-11-03 20:19:10.000000000","message":"This looks legit. Is there a bug for this @gthiemonge?","commit_id":"86f56244a04bd2ee11a98d929efd0740e3aaa1d8"},{"author":{"_account_id":29244,"name":"Gregory Thiemonge","email":"gthiemon@redhat.com","username":"gthiemonge"},"change_message_id":"c3167e7115b35f19a93342e2c91320069bd3556d","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"ffdca283_8f09131f","updated":"2021-11-04 06:34:19.000000000","message":"W-1 I don\u0027t think we need it with the new RBAC stuff","commit_id":"86f56244a04bd2ee11a98d929efd0740e3aaa1d8"},{"author":{"_account_id":29244,"name":"Gregory Thiemonge","email":"gthiemon@redhat.com","username":"gthiemonge"},"change_message_id":"c62fe38f53e15c728088f03fe828e55caa20b3c9","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"db7124ff_3256638f","updated":"2022-07-12 16:38:01.000000000","message":"recheck getting new CI results","commit_id":"86f56244a04bd2ee11a98d929efd0740e3aaa1d8"},{"author":{"_account_id":29244,"name":"Gregory Thiemonge","email":"gthiemon@redhat.com","username":"gthiemonge"},"change_message_id":"3193eb4b4cfe6a7dd470013ae697eebb8921f634","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"71353b32_20df6d51","updated":"2022-07-17 17:52:23.000000000","message":"recheck tripleo-ci-centos-9-scenario010-standalone blocker fix was merged","commit_id":"86f56244a04bd2ee11a98d929efd0740e3aaa1d8"},{"author":{"_account_id":29244,"name":"Gregory Thiemonge","email":"gthiemon@redhat.com","username":"gthiemonge"},"change_message_id":"0b5fed6075fdf16703491e559a370b35f78e96c6","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"39a2efaf_fe033730","updated":"2022-07-13 18:04:17.000000000","message":"recheck tripleo-ci-centos-9-scenario010-standalone failed","commit_id":"86f56244a04bd2ee11a98d929efd0740e3aaa1d8"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"ce60a275708e418b61e1794c72428dfc1fbab13e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"45f2f099_0f0570ff","in_reply_to":"1f123b6e_43c91579","updated":"2022-07-14 16:58:30.000000000","message":"The history of the advanced RBAC and more granular roles goes back to work we did with Nova based on a customer request for more granular RBAC policies. Octavia merged their implementation, nova did not. However, the current secure-RBAC proposal gets us closer to the capabilities provided by Octavia.\n\nThat said, I understand that we should limit options provided to users, but this patch is not adding a new tripleo parameter, it is just creating the roles up front.\nIf we don\u0027t do this, we will have to make changes to the tempest RPMs to configure role overrides specific to the Tripleo deployments. It seemed like this was the better approach as it provides Tripleo compatibility with the Octavia default roles and does not require any special handling/configuration on the behalf of users. It all \"just works\".","commit_id":"86f56244a04bd2ee11a98d929efd0740e3aaa1d8"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"d9cb2264309c864d38a746e338d553337ebfd798","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"9c753525_8e91ea08","in_reply_to":"45f2f099_0f0570ff","updated":"2022-07-14 17:29:29.000000000","message":"\u003e That said, I understand that we should limit options provided to users, but this patch is not adding a new tripleo parameter, it is just creating the roles up front.\n\nMy concern is exactly about showing up multiple roles. If a operator see these roles, it\u0027s quite reasonable that he/she is puzzled by difference between reader and loadbalancer-observer. I\u0027m pretty sure it looks quite strage to them that no instance-observer or volume-observer are created.\n\n\n\u003e If we don\u0027t do this, we will have to make changes to the tempest RPMs to configure role overrides specific to the Tripleo deployments. It seemed like this was the better approach as it provides Tripleo compatibility with the Octavia default roles and does not require any special handling/configuration on the behalf of users. It all \"just works\".\n\nTo run tempest without configuring roles, you can set the tht option to enable these roles. I\u0027m not quite getting how badly it affects us to keep these optional. It might not be the very best as we are not testing the actual default in tripleo but as long as octavia-tempest-plugin covers the default keystone roles(I believe yes) then it would not cause any missing test coverage but just allows coverage beyond defaults.\n\nI\u0027d not block your work with tight deadline here so I\u0027d remove -2 if this should be merged as it is. But I\u0027d appreciate if you can give it another thought to whether this is required by default.","commit_id":"86f56244a04bd2ee11a98d929efd0740e3aaa1d8"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"4dde3c5ff889dce7bbe130e19e8b6804bc8b5216","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"5f8938c9_d39a1323","in_reply_to":"93ee1ae5_7b1a19bb","updated":"2022-07-14 15:49:16.000000000","message":"Hmm... I assume this is required to let octavia tempest tests pass ?\n\nI understand Octavia has been delivering its own rules, but I\u0027m afraid adding these rules are quite confusing for the users. Because of the policy rules installed by the package Octavia now allows keystone default roles (admin, member, reader) by default and I don\u0027t expect users would be eager to use these specific roles rather than general default ones.\n\nIMO we better keep these roles optional at least, and consider adding an additional knob to octavia-tempest-plugin to disable its own roles as a long term solution.","commit_id":"86f56244a04bd2ee11a98d929efd0740e3aaa1d8"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"df897064c399bd513606bdf2a624c703ff6bb2ef","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"1f123b6e_43c91579","in_reply_to":"f6a97a52_92032025","updated":"2022-07-14 16:44:31.000000000","message":"Hi Michael,\n\nThank you for your explanation and I understand your point, as I spent some time recently to set up octavia job in puppet integration jobs. However I\u0027d argue this is not the simplification for users, while it\u0027s simplification for development/testing.\n\nMy main concern is that providing \"too many\" options is quite confusing for users sometimes. It\u0027s hard to understand why the same is not provided for the other services like nova, unless you understand the historical decision made in Octavia and the other projects.\n\nIf the user has been using these octavia specific roles then this might be useful but in that case they are aware that these have not been created by default. Keeping these optional would not harm them.\n\nSo unless there is any blocker, I\u0027d still prefer keeping this optional (like adding a parameter like OctaviaCreateRoles). If we learn enough use cases where this project specific role is required then we can turn it on at some point.","commit_id":"86f56244a04bd2ee11a98d929efd0740e3aaa1d8"}]}