)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"1c01a48b46261e8ca5bd2c527c6186315ca8d1a3","unresolved":true,"context_lines":[{"line_number":27,"context_line":"Finally, you can generate the necessary heat template:"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"  $ ./convert_policy_yaml_to_heat_template.py -d $DEST"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"The tool outputs to stdout. It\u0027s up to the user to redirect to a file if"},{"line_number":32,"context_line":"they wish to save results."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":24,"id":"f321c9a7_f13dfd69","line":30,"updated":"2021-09-29 07:09:37.000000000","message":"this stuff would be nice as a release note on this change","commit_id":"c9635bf92e3174799724ebe0cbe46f666800b88e"}],"environments/enable-secure-rbac.yaml":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5c53d30c025e7d3d7226617623b8ce60c88cdc93","unresolved":true,"context_lines":[{"line_number":72,"context_line":"    cinder-volume_detach: { key: \u0027volume_extension:volume_actions:detach\u0027, value: \u0027rule:admin_or_project_member\u0027 },"},{"line_number":73,"context_line":"    # Message policies"},{"line_number":74,"context_line":"    cinder-message_get: { key: \u0027message:get\u0027, value: \u0027rule:admin_or_project_reader\u0027 },"},{"line_number":75,"context_line":"    cinder-message_get_all: { key: \u0027message:get\u0027, value: \u0027rule:admin_or_project_reader\u0027 },"},{"line_number":76,"context_line":"    cinder-message_delete: { key: \u0027message:delete\u0027, value: \u0027rule:admin_or_project_member\u0027 },"},{"line_number":77,"context_line":"    # Volume access policies"},{"line_number":78,"context_line":"    cinder-type_access: { key: \u0027volume_extension:volume_type_access\u0027, value: \u0027rule:admin_or_project_member\u0027 },"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"a4a09986_bf0434c7","line":75,"range":{"start_line":75,"start_character":36,"end_line":75,"end_character":47},"updated":"2021-03-19 19:11:38.000000000","message":"This should be get_all","commit_id":"1cc7da6c89390ef67ba4ff9b27b0b936e8ec6397"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"54aefce54f1fccd1f6fd2d7e47a4eff818ed9016","unresolved":true,"context_lines":[{"line_number":10,"context_line":"        value: True"},{"line_number":11,"context_line":"    keystone::config::keystone_config:"},{"line_number":12,"context_line":"      oslo_policy/enforce_new_defaults:"},{"line_number":13,"context_line":"        value: True"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"    # Nova configuration to enable system-admin, system-reader, project-member,"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"afa8d71d_e5e278c9","line":13,"updated":"2021-03-27 04:00:33.000000000","message":"This is the error I\u0027m getting if I set the hiera data directly\n\nhttp://paste.openstack.org/raw/803845/","commit_id":"a29edc246e598a7ac9f9f25767bc7ffc916e40c9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"be9105328ff0b2fa7d993b6f6d238f5215d8f337","unresolved":true,"context_lines":[{"line_number":10,"context_line":"        value: True"},{"line_number":11,"context_line":"    keystone::config::keystone_config:"},{"line_number":12,"context_line":"      oslo_policy/enforce_new_defaults:"},{"line_number":13,"context_line":"        value: True"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"    # Nova configuration to enable system-admin, system-reader, project-member,"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"6be37700_ff44908a","line":13,"in_reply_to":"afa8d71d_e5e278c9","updated":"2021-04-14 20:50:04.000000000","message":"Updated:\n\n Error: Evaluation Error: Error while evaluating a Resource Statement, Evaluation Error: Error while evaluating a Function Call, Duplicate declaration: Keystone_config[oslo_policy/enforce_new_defaults] is already declared at (file: /etc/puppet/modules/keystone/manifests/config.pp, line: 31); cannot redeclare (file: /etc/puppet/modules/oslo/manifests/policy.pp, line: 52) (file: /etc/puppet/modules/oslo/manifests/policy.pp, line: 52, column: 3) (file: /etc/puppet/modules/keystone/manifests/policy.pp, line: 61) on node controller-0.ooo.test","commit_id":"a29edc246e598a7ac9f9f25767bc7ffc916e40c9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"106cedb3709cb5ee7fe5c8fd29540343c6aae572","unresolved":true,"context_lines":[{"line_number":50,"context_line":"    # Explicitly disable the new defaults for cinder since we still need to"},{"line_number":51,"context_line":"    # implement secure RBAC there. For now, try and implement default roles"},{"line_number":52,"context_line":"    # through policy overrides below."},{"line_number":53,"context_line":"    cinder::config::cinder_config:"},{"line_number":54,"context_line":"      oslo_policy/enforce_scope:"},{"line_number":55,"context_line":"        value: False"},{"line_number":56,"context_line":"    cinder::config::cinder_config:"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"68771485_cb96f9df","line":53,"updated":"2021-03-23 22:07:25.000000000","message":"These fail when I run them in a deployment. Maybe I can\u0027t specify them twice if I\u0027m just setting them to the default values?\n\nTesting ways to fix this, but leaving a comment here for now.","commit_id":"a29edc246e598a7ac9f9f25767bc7ffc916e40c9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8d9174ce69a7380ba34b1a3b792c9d9af6808cd5","unresolved":true,"context_lines":[{"line_number":153,"context_line":"    cinder-attachment_complete: { key: \"volume:attachment_complete\", value: \"rule:admin_or_project_member\" },"},{"line_number":154,"context_line":"    cinder-attachment_multiattach: { key: \"volume:multiattach_bootable_volume\", value: \"rule:admin_or_project_member\" },"},{"line_number":155,"context_line":"  }"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"  # Restrict the glance metadef policies https://wiki.openstack.org/wiki/OSSN/OSSN-0088"},{"line_number":158,"context_line":"  GlanceApiPolicies: {"},{"line_number":159,"context_line":"    glance-metadef_default: { key: \"metadef_default\", value: \"\" },"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"589e7d15_fee175b0","line":156,"updated":"2021-04-12 15:44:50.000000000","message":"For octavia - we need to make sure we set:\n\n  [oslo_policy]\n  enforce_scope\u003dTrue\n  enforce_new_defaults\u003dTrue\n\nAnd set a handful of aliases, which are documented here:\n\nhttps://opendev.org/openstack/octavia/src/branch/master/etc/policy/keystone_default_roles-policy.yaml","commit_id":"a29edc246e598a7ac9f9f25767bc7ffc916e40c9"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"87a229c4017015ff6c93fecb8af5019525cbad65","unresolved":true,"context_lines":[{"line_number":153,"context_line":"    cinder-attachment_complete: { key: \"volume:attachment_complete\", value: \"rule:admin_or_project_member\" },"},{"line_number":154,"context_line":"    cinder-attachment_multiattach: { key: \"volume:multiattach_bootable_volume\", value: \"rule:admin_or_project_member\" },"},{"line_number":155,"context_line":"  }"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"  # Restrict the glance metadef policies https://wiki.openstack.org/wiki/OSSN/OSSN-0088"},{"line_number":158,"context_line":"  GlanceApiPolicies: {"},{"line_number":159,"context_line":"    glance-metadef_default: { key: \"metadef_default\", value: \"\" },"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"42534655_e0e2ce5c","line":156,"in_reply_to":"589e7d15_fee175b0","updated":"2021-04-12 15:53:08.000000000","message":"It would be best to pull in the override file from https://opendev.org/openstack/octavia/src/branch/master/etc/policy/keystone_default_roles-policy.yaml\n\nThat way if updates are needed, they will get pulled in.","commit_id":"a29edc246e598a7ac9f9f25767bc7ffc916e40c9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b9e2577d666163d3f84c293cdb831549d08c186b","unresolved":true,"context_lines":[{"line_number":185,"context_line":"    glance-delete_metadef_tag: { key: \"delete_metadef_tag\", value: \"rule:metadef_admin\" },"},{"line_number":186,"context_line":"    glance-delete_metadef_tags: { key: \"delete_metadef_tags\", value: \"rule:metadef_admin\" }"},{"line_number":187,"context_line":"  }"},{"line_number":188,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"a0af302e_56fd3869","line":188,"updated":"2021-04-09 19:43:16.000000000","message":"When we add octavia to this list - we will need to include a handful of overrides if we want octavia\u0027s API to behave exactly the same as all the others who implemented secure RBAC.\n\nThat should be a trivial thing to add here since johnsom documented it extensively for octavia:\n\nhttps://docs.openstack.org/octavia/latest/configuration/policy.html#openstack-default-roles-policy-override-file\n\nhttps://github.com/openstack/octavia/blob/master/etc/policy/keystone_default_roles-policy.yaml","commit_id":"a29edc246e598a7ac9f9f25767bc7ffc916e40c9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"eaac9caeddabe7888f162b3836fb5654eeb9e343","unresolved":true,"context_lines":[{"line_number":185,"context_line":"    glance-delete_metadef_tag: { key: \"delete_metadef_tag\", value: \"rule:metadef_admin\" },"},{"line_number":186,"context_line":"    glance-delete_metadef_tags: { key: \"delete_metadef_tags\", value: \"rule:metadef_admin\" }"},{"line_number":187,"context_line":"  }"},{"line_number":188,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"5e1858a1_4ffa56fb","line":188,"in_reply_to":"12d4b4d4_e96926ee","updated":"2021-04-12 18:26:43.000000000","message":"Ok, cool. So we don\u0027t need to supply the aliases here. Thanks for the follow-up Michael.","commit_id":"a29edc246e598a7ac9f9f25767bc7ffc916e40c9"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"87a229c4017015ff6c93fecb8af5019525cbad65","unresolved":true,"context_lines":[{"line_number":185,"context_line":"    glance-delete_metadef_tag: { key: \"delete_metadef_tag\", value: \"rule:metadef_admin\" },"},{"line_number":186,"context_line":"    glance-delete_metadef_tags: { key: \"delete_metadef_tags\", value: \"rule:metadef_admin\" }"},{"line_number":187,"context_line":"  }"},{"line_number":188,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"12d4b4d4_e96926ee","line":188,"in_reply_to":"a0af302e_56fd3869","updated":"2021-04-12 15:53:08.000000000","message":"At a high level:\nThe \"keystone_default_roles-policy.yaml\" override file should be used for the Octavia API and the following set in the octavia.conf:\n[oslo_policy]\nenforce_scope \u003d True\nenforce_new_defaults \u003d True","commit_id":"a29edc246e598a7ac9f9f25767bc7ffc916e40c9"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"56d78f6e93fc83f69420e42ee6014f07eaf61bcc","unresolved":true,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"parameter_defaults:"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"  ControllerExtraConfig:"},{"line_number":7,"context_line":"    # Keystone configuration to enable all 9 secure RBAC personas."},{"line_number":8,"context_line":"    keystone::policy::enforce_scope: True"},{"line_number":9,"context_line":"    keystone::policy::enforce_new_defaults: True"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"90d112ce_82eaba75","line":6,"range":{"start_line":6,"start_character":2,"end_line":6,"end_character":23},"updated":"2021-04-22 13:31:34.000000000","message":"I\u0027d prefer implementing native template parameters and use these parameters rather than using *ExtraConfig directly.\n\nI\u0027m not sure whether we see such situation actually but this also allows us to implement some more logics required only when secure RBAC is enabled.","commit_id":"ef660542dc94902b6be6ff72ff0509e8892c7779"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"8d7216d3cefcd974cecc8be00f00e52f4702ac60","unresolved":true,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"parameter_defaults:"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"  ControllerExtraConfig:"},{"line_number":7,"context_line":"    # Keystone configuration to enable all 9 secure RBAC personas."},{"line_number":8,"context_line":"    keystone::policy::enforce_scope: True"},{"line_number":9,"context_line":"    keystone::policy::enforce_new_defaults: True"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"7e7fa08c_09ccc1e3","line":6,"range":{"start_line":6,"start_character":2,"end_line":6,"end_character":23},"in_reply_to":"189f2352_7781202c","updated":"2021-06-01 23:30:34.000000000","message":"\u003e If we add service specific THT parameters now,\n\nI expect a global parameter instead of service specific parameters because I don\u0027t expect any use case where users want secure rbac for specific service.\n\n\u003e they will need to be deprecated and removed after the transition period\n\nIf we expect very short timeline for this transition then we\u0027d be able to skip but if we expect 2-3 cycles then it\u0027s worth adding a parameter for these releases.\n\nI agree with Alex that it\u0027d be file to use ExtraConfig for just testing but then there should be a mark to explain this is Experimental, IMHO.","commit_id":"ef660542dc94902b6be6ff72ff0509e8892c7779"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"cb838af1c4820cc10763bce8ef7f7a428cb61048","unresolved":true,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"parameter_defaults:"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"  ControllerExtraConfig:"},{"line_number":7,"context_line":"    # Keystone configuration to enable all 9 secure RBAC personas."},{"line_number":8,"context_line":"    keystone::policy::enforce_scope: True"},{"line_number":9,"context_line":"    keystone::policy::enforce_new_defaults: True"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"5935b3c1_a8c52a13","line":6,"range":{"start_line":6,"start_character":2,"end_line":6,"end_character":23},"in_reply_to":"7e7fa08c_09ccc1e3","updated":"2021-08-05 00:39:56.000000000","message":"Have we considered the operational maintenance cost for our development efforts and maintenance activities to continue use of specific service parameters through the THT templates to the puppet manifests?\n\nIt seems like were going to have to land number_of_puppet_modules * 2 as a minimum number of changes by taking any other path than a single central path. That number of patches has a huge cost in resources, both electronic and human.\n\nMaybe there is a value I\u0027m not seeing? In other words, I think this is the right path and maybe the simpler path is to begin to rework config injection/management through this path. If we feel projects don\u0027t ship sane defaults which we override in the puppet modules, then that feedback needs to make it to the project otherwise we\u0027re just carrying technical debt.","commit_id":"ef660542dc94902b6be6ff72ff0509e8892c7779"},{"author":{"_account_id":21129,"name":"Alan Bishop","email":"abishopsweng@gmail.com","username":"ASBishop","status":"ex Red Hat"},"change_message_id":"9d5fc2942e8acd48ebe89b4877c052c4d00fd0d7","unresolved":true,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"parameter_defaults:"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"  ControllerExtraConfig:"},{"line_number":7,"context_line":"    # Keystone configuration to enable all 9 secure RBAC personas."},{"line_number":8,"context_line":"    keystone::policy::enforce_scope: True"},{"line_number":9,"context_line":"    keystone::policy::enforce_new_defaults: True"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"f3b877a3_954bacde","line":6,"range":{"start_line":6,"start_character":2,"end_line":6,"end_character":23},"in_reply_to":"90d112ce_82eaba75","updated":"2021-04-22 14:24:24.000000000","message":"My understanding is this patch facilitates transitioning to secure RBAC, and the ultimate goal is the settings are enabled by default. If we add service specific THT parameters now, they will need to be deprecated and removed after the transition period. So I vote in favor of using ExtraConfig, and leave it up to the services to work out requirements specific to their situation. There may be situations where a service would benefit from a THT parameter, but lets defer creating them until an actual use case arises.","commit_id":"ef660542dc94902b6be6ff72ff0509e8892c7779"},{"author":{"_account_id":6796,"name":"Giulio Fidente","email":"gfidente@redhat.com","username":"gfidente"},"change_message_id":"37c719946e884390fe655c7321836ab42766044f","unresolved":true,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"parameter_defaults:"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"  ControllerExtraConfig:"},{"line_number":7,"context_line":"    # Keystone configuration to enable all 9 secure RBAC personas."},{"line_number":8,"context_line":"    keystone::policy::enforce_scope: True"},{"line_number":9,"context_line":"    keystone::policy::enforce_new_defaults: True"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"189f2352_7781202c","line":6,"range":{"start_line":6,"start_character":2,"end_line":6,"end_character":23},"in_reply_to":"a997e988_061de8c7","updated":"2021-05-31 16:47:55.000000000","message":"proposing EnableSecureRBAC in [1]\n\n1. https://review.opendev.org/c/openstack/tripleo-heat-templates/+/783623","commit_id":"ef660542dc94902b6be6ff72ff0509e8892c7779"},{"author":{"_account_id":14985,"name":"Alex Schultz","email":"aschultz@next-development.com","username":"mwhahaha"},"change_message_id":"3fa4298a94fddc735360ba869f7e87121cc4a2de","unresolved":true,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"parameter_defaults:"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"  ControllerExtraConfig:"},{"line_number":7,"context_line":"    # Keystone configuration to enable all 9 secure RBAC personas."},{"line_number":8,"context_line":"    keystone::policy::enforce_scope: True"},{"line_number":9,"context_line":"    keystone::policy::enforce_new_defaults: True"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"a997e988_061de8c7","line":6,"range":{"start_line":6,"start_character":2,"end_line":6,"end_character":23},"in_reply_to":"f3b877a3_954bacde","updated":"2021-05-10 15:21:58.000000000","message":"This is fine for testing but these need top level heat params with environment files to enable/disable to be merged.  *ExtraConfig should only be used as a last resort to config hiera data (e.g. by a customer) because they need to config something we don\u0027t already expose.  This being a feature should have a top level configuration.","commit_id":"ef660542dc94902b6be6ff72ff0509e8892c7779"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"56d78f6e93fc83f69420e42ee6014f07eaf61bcc","unresolved":true,"context_lines":[{"line_number":132,"context_line":"  }"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"  # Restrict the glance metadef policies https://wiki.openstack.org/wiki/OSSN/OSSN-0088"},{"line_number":135,"context_line":"  GlanceApiPolicies: {"},{"line_number":136,"context_line":"    glance-metadef_default: { key: \"metadef_default\", value: \"\" },"},{"line_number":137,"context_line":"    glance-metadef_admin: { key: \"metadef_admin\", value: \"role:admin\" },"},{"line_number":138,"context_line":"    glance-get_metadef_namespace: { key: \"get_metadef_namespace\", value: \"rule:metadef_default\" },"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"1d6934f1_7397f572","line":135,"range":{"start_line":135,"start_character":2,"end_line":135,"end_character":19},"updated":"2021-04-22 13:31:34.000000000","message":"If this is something Glance community is recommending, then can we ask them to own the default policy (create a sample yaml in their repo) and consume that file, rather than implementing these rules in tht layer ?","commit_id":"ef660542dc94902b6be6ff72ff0509e8892c7779"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8a76af56f653f98179462ec8752a694189d91d37","unresolved":true,"context_lines":[{"line_number":132,"context_line":"  }"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"  # Restrict the glance metadef policies https://wiki.openstack.org/wiki/OSSN/OSSN-0088"},{"line_number":135,"context_line":"  GlanceApiPolicies: {"},{"line_number":136,"context_line":"    glance-metadef_default: { key: \"metadef_default\", value: \"\" },"},{"line_number":137,"context_line":"    glance-metadef_admin: { key: \"metadef_admin\", value: \"role:admin\" },"},{"line_number":138,"context_line":"    glance-get_metadef_namespace: { key: \"get_metadef_namespace\", value: \"rule:metadef_default\" },"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"b0e93380_25a9c7fe","line":135,"range":{"start_line":135,"start_character":2,"end_line":135,"end_character":19},"in_reply_to":"1d6934f1_7397f572","updated":"2021-04-28 19:12:43.000000000","message":"Yeah - this can probably be removed now that glance has done this upstream in the service defaults for the metadef API.\n\nhttps://opendev.org/openstack/glance/commit/f8551de8c9d660be3d6820918c1aaab0d235c98d","commit_id":"ef660542dc94902b6be6ff72ff0509e8892c7779"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"8d7216d3cefcd974cecc8be00f00e52f4702ac60","unresolved":true,"context_lines":[{"line_number":132,"context_line":"  }"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"  # Restrict the glance metadef policies https://wiki.openstack.org/wiki/OSSN/OSSN-0088"},{"line_number":135,"context_line":"  GlanceApiPolicies: {"},{"line_number":136,"context_line":"    glance-metadef_default: { key: \"metadef_default\", value: \"\" },"},{"line_number":137,"context_line":"    glance-metadef_admin: { key: \"metadef_admin\", value: \"role:admin\" },"},{"line_number":138,"context_line":"    glance-get_metadef_namespace: { key: \"get_metadef_namespace\", value: \"rule:metadef_default\" },"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"39ae15e6_1dca124d","line":135,"range":{"start_line":135,"start_character":2,"end_line":135,"end_character":19},"in_reply_to":"b0e93380_25a9c7fe","updated":"2021-06-01 23:30:34.000000000","message":"That\u0027s nice !","commit_id":"ef660542dc94902b6be6ff72ff0509e8892c7779"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0bf39f8b39a59b0ed4c3ad290194c3f39a184807","unresolved":true,"context_lines":[{"line_number":6,"context_line":"  ControllerExtraConfig:"},{"line_number":7,"context_line":"    # Keystone configuration to enable all 9 secure RBAC personas."},{"line_number":8,"context_line":"    keystone::policy::enforce_scope: true"},{"line_number":9,"context_line":"    keystone::policy::enforce_new_defaults: true"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"    # Nova configuration to enable system-admin, system-reader, project-member,"},{"line_number":12,"context_line":"    # project-reader."}],"source_content_type":"text/x-yaml","patch_set":8,"id":"59a07010_7741fe8a","line":9,"updated":"2021-08-11 15:35:25.000000000","message":"This should be:\n\n  KeystoneEnforceSecureRbac: true","commit_id":"2189a31b7d4e592650f92f1d16048ce1daa1822f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8b68087f9dd0ba8b4401939c45f8d19af6a8a9a1","unresolved":false,"context_lines":[{"line_number":6,"context_line":"  ControllerExtraConfig:"},{"line_number":7,"context_line":"    # Keystone configuration to enable all 9 secure RBAC personas."},{"line_number":8,"context_line":"    keystone::policy::enforce_scope: true"},{"line_number":9,"context_line":"    keystone::policy::enforce_new_defaults: true"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"    # Nova configuration to enable system-admin, system-reader, project-member,"},{"line_number":12,"context_line":"    # project-reader."}],"source_content_type":"text/x-yaml","patch_set":8,"id":"7f14437d_036a622a","line":9,"in_reply_to":"59a07010_7741fe8a","updated":"2021-08-11 15:53:33.000000000","message":"Done","commit_id":"2189a31b7d4e592650f92f1d16048ce1daa1822f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0bf39f8b39a59b0ed4c3ad290194c3f39a184807","unresolved":true,"context_lines":[{"line_number":11,"context_line":"    # Nova configuration to enable system-admin, system-reader, project-member,"},{"line_number":12,"context_line":"    # project-reader."},{"line_number":13,"context_line":"    nova::policy::enforce_scope: true"},{"line_number":14,"context_line":"    nova::policy::enforce_new_defaults: true"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"    # Neutron configuration to enable system-admin, system-reader,"},{"line_number":17,"context_line":"    # project-member, project-reader."}],"source_content_type":"text/x-yaml","patch_set":8,"id":"89b40ee9_83723a00","line":14,"updated":"2021-08-11 15:35:25.000000000","message":"This should be:\n\n  NovaEnforceSecureRbac: true","commit_id":"2189a31b7d4e592650f92f1d16048ce1daa1822f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8b68087f9dd0ba8b4401939c45f8d19af6a8a9a1","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    # Nova configuration to enable system-admin, system-reader, project-member,"},{"line_number":12,"context_line":"    # project-reader."},{"line_number":13,"context_line":"    nova::policy::enforce_scope: true"},{"line_number":14,"context_line":"    nova::policy::enforce_new_defaults: true"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"    # Neutron configuration to enable system-admin, system-reader,"},{"line_number":17,"context_line":"    # project-member, project-reader."}],"source_content_type":"text/x-yaml","patch_set":8,"id":"dd8f59d3_5069da65","line":14,"in_reply_to":"89b40ee9_83723a00","updated":"2021-08-11 15:53:33.000000000","message":"Done","commit_id":"2189a31b7d4e592650f92f1d16048ce1daa1822f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0bf39f8b39a59b0ed4c3ad290194c3f39a184807","unresolved":true,"context_lines":[{"line_number":16,"context_line":"    # Neutron configuration to enable system-admin, system-reader,"},{"line_number":17,"context_line":"    # project-member, project-reader."},{"line_number":18,"context_line":"    neutron::policy::enforce_scope: true"},{"line_number":19,"context_line":"    neutron::policy::enforce_new_defaults: true"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"    # Glance configuration to enable project-member and project-reader. Glance"},{"line_number":22,"context_line":"    # has an additional configuration option since all the Wallaby work is"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"720a2a8b_a5bb13ed","line":19,"updated":"2021-08-11 15:35:25.000000000","message":"This should be:\n\n  NeutronEnforceSecureRbac: true","commit_id":"2189a31b7d4e592650f92f1d16048ce1daa1822f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8b68087f9dd0ba8b4401939c45f8d19af6a8a9a1","unresolved":false,"context_lines":[{"line_number":16,"context_line":"    # Neutron configuration to enable system-admin, system-reader,"},{"line_number":17,"context_line":"    # project-member, project-reader."},{"line_number":18,"context_line":"    neutron::policy::enforce_scope: true"},{"line_number":19,"context_line":"    neutron::policy::enforce_new_defaults: true"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"    # Glance configuration to enable project-member and project-reader. Glance"},{"line_number":22,"context_line":"    # has an additional configuration option since all the Wallaby work is"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"5d956aa8_340bec9a","line":19,"in_reply_to":"720a2a8b_a5bb13ed","updated":"2021-08-11 15:53:33.000000000","message":"Done","commit_id":"2189a31b7d4e592650f92f1d16048ce1daa1822f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0bf39f8b39a59b0ed4c3ad290194c3f39a184807","unresolved":true,"context_lines":[{"line_number":26,"context_line":"    glance::policy::enforce_new_defaults: true"},{"line_number":27,"context_line":"    # Don\u0027t enable this until glance actually supports system personas"},{"line_number":28,"context_line":"    # (hopefully in Xena?)"},{"line_number":29,"context_line":"    glance::policy::enforce_scope: false"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"    # Explicitly disable the new defaults for cinder since we still need to"},{"line_number":32,"context_line":"    # implement secure RBAC there. For now, try and implement default roles"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"6f43a22c_8a85813b","line":29,"updated":"2021-08-11 15:35:25.000000000","message":"This should be:\n\n  GlanceEnforceSecureRbac: true","commit_id":"2189a31b7d4e592650f92f1d16048ce1daa1822f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8b68087f9dd0ba8b4401939c45f8d19af6a8a9a1","unresolved":false,"context_lines":[{"line_number":26,"context_line":"    glance::policy::enforce_new_defaults: true"},{"line_number":27,"context_line":"    # Don\u0027t enable this until glance actually supports system personas"},{"line_number":28,"context_line":"    # (hopefully in Xena?)"},{"line_number":29,"context_line":"    glance::policy::enforce_scope: false"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"    # Explicitly disable the new defaults for cinder since we still need to"},{"line_number":32,"context_line":"    # implement secure RBAC there. For now, try and implement default roles"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"e983808b_65669588","line":29,"in_reply_to":"6f43a22c_8a85813b","updated":"2021-08-11 15:53:33.000000000","message":"Done","commit_id":"2189a31b7d4e592650f92f1d16048ce1daa1822f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0bf39f8b39a59b0ed4c3ad290194c3f39a184807","unresolved":true,"context_lines":[{"line_number":32,"context_line":"    # implement secure RBAC there. For now, try and implement default roles"},{"line_number":33,"context_line":"    # through policy overrides below."},{"line_number":34,"context_line":"    cinder::policy::enforce_scope: false"},{"line_number":35,"context_line":"    cinder::policy::enforce_new_defaults: false"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"  # TODO: These should be removed when"},{"line_number":38,"context_line":"  # https://review.opendev.org/q/topic:%2522secure-rbac%2522+status:open+project:openstack/cinder"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"a66ce57e_8d4c10f9","line":35,"updated":"2021-08-11 15:35:25.000000000","message":"This should be:\n\n  CinderEnforceSecureRbac: true","commit_id":"2189a31b7d4e592650f92f1d16048ce1daa1822f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8b68087f9dd0ba8b4401939c45f8d19af6a8a9a1","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    # implement secure RBAC there. For now, try and implement default roles"},{"line_number":33,"context_line":"    # through policy overrides below."},{"line_number":34,"context_line":"    cinder::policy::enforce_scope: false"},{"line_number":35,"context_line":"    cinder::policy::enforce_new_defaults: false"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"  # TODO: These should be removed when"},{"line_number":38,"context_line":"  # https://review.opendev.org/q/topic:%2522secure-rbac%2522+status:open+project:openstack/cinder"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"16161597_294c9837","line":35,"in_reply_to":"a66ce57e_8d4c10f9","updated":"2021-08-11 15:53:33.000000000","message":"Done","commit_id":"2189a31b7d4e592650f92f1d16048ce1daa1822f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0bf39f8b39a59b0ed4c3ad290194c3f39a184807","unresolved":true,"context_lines":[{"line_number":43,"context_line":"  # do not include support for system-scope. These overrides are only"},{"line_number":44,"context_line":"  # implementing project personas. System-scope support requires work in cinder"},{"line_number":45,"context_line":"  # before it can be implemented as overrides or as default policies."},{"line_number":46,"context_line":"  CinderApiPolicies:"},{"line_number":47,"context_line":"    # Volume policies"},{"line_number":48,"context_line":"    cinder-admin_or_project_member:"},{"line_number":49,"context_line":"      key: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":8,"id":"dd302707_25a51e69","line":46,"updated":"2021-08-11 15:35:25.000000000","message":"This should be:\n\n  CinderEnforceSecureRbac: true","commit_id":"2189a31b7d4e592650f92f1d16048ce1daa1822f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8b68087f9dd0ba8b4401939c45f8d19af6a8a9a1","unresolved":false,"context_lines":[{"line_number":43,"context_line":"  # do not include support for system-scope. These overrides are only"},{"line_number":44,"context_line":"  # implementing project personas. System-scope support requires work in cinder"},{"line_number":45,"context_line":"  # before it can be implemented as overrides or as default policies."},{"line_number":46,"context_line":"  CinderApiPolicies:"},{"line_number":47,"context_line":"    # Volume policies"},{"line_number":48,"context_line":"    cinder-admin_or_project_member:"},{"line_number":49,"context_line":"      key: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":8,"id":"dc33e6f5_e9146e8c","line":46,"in_reply_to":"dd302707_25a51e69","updated":"2021-08-11 15:53:33.000000000","message":"Done","commit_id":"2189a31b7d4e592650f92f1d16048ce1daa1822f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2c2e9182448522c149e361ae702bcef406184416","unresolved":true,"context_lines":[{"line_number":18,"context_line":"  NovaEnforceSecureRbac: true"},{"line_number":19,"context_line":"  OctaviaEnforceSecureRbac: true"},{"line_number":20,"context_line":"  PlacementEnforceSecureRbac: true"},{"line_number":21,"context_line":"  SwiftEnforceSecureRbac: true"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"  # TODO: These should be removed when"},{"line_number":24,"context_line":"  # https://review.opendev.org/q/topic:%2522secure-rbac%2522+status:open+project:openstack/cinder"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"06b39ec8_f81577c5","line":21,"updated":"2021-08-12 17:38:38.000000000","message":"I\u0027m reviewing this with the cinder folks and one question we\u0027re wondering is if we could just do this with a single variable:\n\n  EnforceSecureRbac: true\n\nThen each of the service api files for configuring the service would key off the same variable as opposed to individual variable (like how we enable TLS-e).","commit_id":"b05b8acf7baacabdb04bfbaa706469b94b5b75dc"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"e9fd736b495752391259b4fc054696691867e8fc","unresolved":true,"context_lines":[{"line_number":18,"context_line":"  NovaEnforceSecureRbac: true"},{"line_number":19,"context_line":"  OctaviaEnforceSecureRbac: true"},{"line_number":20,"context_line":"  PlacementEnforceSecureRbac: true"},{"line_number":21,"context_line":"  SwiftEnforceSecureRbac: true"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"  # TODO: These should be removed when"},{"line_number":24,"context_line":"  # https://review.opendev.org/q/topic:%2522secure-rbac%2522+status:open+project:openstack/cinder"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"9c067801_5ad251b0","line":21,"in_reply_to":"06b39ec8_f81577c5","updated":"2021-08-12 18:18:58.000000000","message":"(It was me who initially suggested implementing the global parameter)\nIMO it depends on whether we expect a use case where a user wants to/not to enforce SRBAC for specific services. If we expect SRBAC is enforced in all services at the same time then we can use the single parameter rather than adding multiple parameters. My initial expectation is that enforcement of SRBAC depends on the security policy of the deployment and would be something applied globally than than partially .","commit_id":"b05b8acf7baacabdb04bfbaa706469b94b5b75dc"},{"author":{"_account_id":6796,"name":"Giulio Fidente","email":"gfidente@redhat.com","username":"gfidente"},"change_message_id":"3b47f1e4c08ee263617733b20cafe436171ecd3b","unresolved":true,"context_lines":[{"line_number":18,"context_line":"  NovaEnforceSecureRbac: true"},{"line_number":19,"context_line":"  OctaviaEnforceSecureRbac: true"},{"line_number":20,"context_line":"  PlacementEnforceSecureRbac: true"},{"line_number":21,"context_line":"  SwiftEnforceSecureRbac: true"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"  # TODO: These should be removed when"},{"line_number":24,"context_line":"  # https://review.opendev.org/q/topic:%2522secure-rbac%2522+status:open+project:openstack/cinder"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"f9495868_0086618f","line":21,"in_reply_to":"16b1f058_74567101","updated":"2021-08-24 13:02:31.000000000","message":"I am not against using a different boolean per service but I thought it\u0027d be more user friendly to have a single parameter for all services and eventually let every service consume it to enable sRBAC\n\nCan the cloud actually work with only some services configured for sRBAC?","commit_id":"b05b8acf7baacabdb04bfbaa706469b94b5b75dc"},{"author":{"_account_id":10459,"name":"Luigi Toscano","email":"ltoscano@redhat.com","username":"ltoscano"},"change_message_id":"4ff91949432d551ba6946cbe7392d84cab3878b5","unresolved":true,"context_lines":[{"line_number":18,"context_line":"  NovaEnforceSecureRbac: true"},{"line_number":19,"context_line":"  OctaviaEnforceSecureRbac: true"},{"line_number":20,"context_line":"  PlacementEnforceSecureRbac: true"},{"line_number":21,"context_line":"  SwiftEnforceSecureRbac: true"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"  # TODO: These should be removed when"},{"line_number":24,"context_line":"  # https://review.opendev.org/q/topic:%2522secure-rbac%2522+status:open+project:openstack/cinder"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"582a8886_c686a4f9","line":21,"in_reply_to":"1a47e9da_c9dfba47","updated":"2021-08-25 14:00:12.000000000","message":"So given the interactions between components (I can easily think of a simple scenario which involves at least nova, neutron, cinder, glance and probably others), does it really make sense to support the full matrix of combination where some services have SRBAC enabled and others don\u0027t? I think it makes things more complicated for no gain.","commit_id":"b05b8acf7baacabdb04bfbaa706469b94b5b75dc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"af7390c3c57abca9f2f380918431fdb849a36c31","unresolved":true,"context_lines":[{"line_number":18,"context_line":"  NovaEnforceSecureRbac: true"},{"line_number":19,"context_line":"  OctaviaEnforceSecureRbac: true"},{"line_number":20,"context_line":"  PlacementEnforceSecureRbac: true"},{"line_number":21,"context_line":"  SwiftEnforceSecureRbac: true"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"  # TODO: These should be removed when"},{"line_number":24,"context_line":"  # https://review.opendev.org/q/topic:%2522secure-rbac%2522+status:open+project:openstack/cinder"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"d1589392_678aaa02","line":21,"in_reply_to":"582a8886_c686a4f9","updated":"2021-08-25 21:11:01.000000000","message":"Yeah - that\u0027s fair.\n\nI can rework this template and have it introduce a new global variable called EnforceSecureRbac, which will default to false.\n\nAdditionally, Kevin and I were working through the case where we set enforce_new_defaults: True and we don\u0027t think that\u0027s going to work without each service using the same common denominator (project personas for example). We knew this, but we\u0027re also waiting on development work in each of the services for them to use the right persona for service requests (e.g., neutron calling nova\u0027s API to update external events when creating an instance [0]).\n\nI\u0027ll update this review to use the operator-facing policy variables to implement those changes (KeystonePolicies, NovaApiPolicies, etc...) The goal would be to get a deployment working with just the project personas initially and then introduce more personas as more services actually implement them.\n\n[0] https://github.com/openstack/nova/blob/master/nova/policies/server_external_events.py#L27","commit_id":"b05b8acf7baacabdb04bfbaa706469b94b5b75dc"},{"author":{"_account_id":14985,"name":"Alex Schultz","email":"aschultz@next-development.com","username":"mwhahaha"},"change_message_id":"4e4b6b48348e0cb917225d9862859cfd0bbb0506","unresolved":true,"context_lines":[{"line_number":18,"context_line":"  NovaEnforceSecureRbac: true"},{"line_number":19,"context_line":"  OctaviaEnforceSecureRbac: true"},{"line_number":20,"context_line":"  PlacementEnforceSecureRbac: true"},{"line_number":21,"context_line":"  SwiftEnforceSecureRbac: true"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"  # TODO: These should be removed when"},{"line_number":24,"context_line":"  # https://review.opendev.org/q/topic:%2522secure-rbac%2522+status:open+project:openstack/cinder"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"915713b1_bbb46382","line":21,"in_reply_to":"6c99f6c5_890a9923","updated":"2021-08-20 16:49:21.000000000","message":"I think this should be something that is service specific provided that the cloud could work with only some services in rbac and others w/o rbac","commit_id":"b05b8acf7baacabdb04bfbaa706469b94b5b75dc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2b3ea5e90f17b5613fba6f5124a81deb63c40cce","unresolved":true,"context_lines":[{"line_number":18,"context_line":"  NovaEnforceSecureRbac: true"},{"line_number":19,"context_line":"  OctaviaEnforceSecureRbac: true"},{"line_number":20,"context_line":"  PlacementEnforceSecureRbac: true"},{"line_number":21,"context_line":"  SwiftEnforceSecureRbac: true"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"  # TODO: These should be removed when"},{"line_number":24,"context_line":"  # https://review.opendev.org/q/topic:%2522secure-rbac%2522+status:open+project:openstack/cinder"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"1a47e9da_c9dfba47","line":21,"in_reply_to":"7f600258_2f0e4ba9","updated":"2021-08-25 13:41:16.000000000","message":"The straight-forward case is if one service is calling a system-level API of another service that\u0027s configured to enforce secure RBAC with a project-scoped token, which will cause the request to fail.","commit_id":"b05b8acf7baacabdb04bfbaa706469b94b5b75dc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"256bab9ea15b014fd4dd91492b2ebb26bfa2b720","unresolved":true,"context_lines":[{"line_number":18,"context_line":"  NovaEnforceSecureRbac: true"},{"line_number":19,"context_line":"  OctaviaEnforceSecureRbac: true"},{"line_number":20,"context_line":"  PlacementEnforceSecureRbac: true"},{"line_number":21,"context_line":"  SwiftEnforceSecureRbac: true"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"  # TODO: These should be removed when"},{"line_number":24,"context_line":"  # https://review.opendev.org/q/topic:%2522secure-rbac%2522+status:open+project:openstack/cinder"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"16b1f058_74567101","line":21,"in_reply_to":"915713b1_bbb46382","updated":"2021-08-23 16:42:59.000000000","message":"Ok - one advantage of that is that it make it easier for operators to put a single service into enforcing secure RBAC mode (e.g., for a staging environment) to experiment with the new policies with minimal service changes.\n\nI\u0027m not sure how realistic is it for someone to use individual knobs in a production deployment, but for staging or test purposes it might be really useful and less invasive.\n\nWe\u0027ll move forward with that approach. Thanks, Alex.","commit_id":"b05b8acf7baacabdb04bfbaa706469b94b5b75dc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"30513c961da80c9196cdc1ca52d3c2e4dee599c1","unresolved":true,"context_lines":[{"line_number":18,"context_line":"  NovaEnforceSecureRbac: true"},{"line_number":19,"context_line":"  OctaviaEnforceSecureRbac: true"},{"line_number":20,"context_line":"  PlacementEnforceSecureRbac: true"},{"line_number":21,"context_line":"  SwiftEnforceSecureRbac: true"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"  # TODO: These should be removed when"},{"line_number":24,"context_line":"  # https://review.opendev.org/q/topic:%2522secure-rbac%2522+status:open+project:openstack/cinder"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"6c99f6c5_890a9923","line":21,"in_reply_to":"9c067801_5ad251b0","updated":"2021-08-19 17:03:38.000000000","message":"That makes sense.\n\nOne thing to think about is that some of the services implement secure RBAC a little differently (e.g., glance\u0027s extra knob to turn on secure RBAC [0].) So I guess the thought was that they would just add a service specific option while they\u0027re in the process of proposing the necessary changes to enable secure RBAC.\n\nI\u0027m indifferent and I\u0027ll go with whatever the TripleO folks want to do.\n\n[0] https://docs.openstack.org/glance/latest/configuration/glance_api.html#DEFAULT.enforce_secure_rbac","commit_id":"b05b8acf7baacabdb04bfbaa706469b94b5b75dc"},{"author":{"_account_id":10459,"name":"Luigi Toscano","email":"ltoscano@redhat.com","username":"ltoscano"},"change_message_id":"cb01714be923f32ce30fc0c14db0125a15c06329","unresolved":true,"context_lines":[{"line_number":18,"context_line":"  NovaEnforceSecureRbac: true"},{"line_number":19,"context_line":"  OctaviaEnforceSecureRbac: true"},{"line_number":20,"context_line":"  PlacementEnforceSecureRbac: true"},{"line_number":21,"context_line":"  SwiftEnforceSecureRbac: true"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"  # TODO: These should be removed when"},{"line_number":24,"context_line":"  # https://review.opendev.org/q/topic:%2522secure-rbac%2522+status:open+project:openstack/cinder"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"7f600258_2f0e4ba9","line":21,"in_reply_to":"da611143_271bbbba","updated":"2021-08-25 08:12:33.000000000","message":"Apart from (human) operators, could there be any issue when services in mixed mode (some with srbac, others without) interact with each other?","commit_id":"b05b8acf7baacabdb04bfbaa706469b94b5b75dc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4c8befddc93370e8d8a16e20704fe592f3a2cbb9","unresolved":true,"context_lines":[{"line_number":18,"context_line":"  NovaEnforceSecureRbac: true"},{"line_number":19,"context_line":"  OctaviaEnforceSecureRbac: true"},{"line_number":20,"context_line":"  PlacementEnforceSecureRbac: true"},{"line_number":21,"context_line":"  SwiftEnforceSecureRbac: true"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"  # TODO: These should be removed when"},{"line_number":24,"context_line":"  # https://review.opendev.org/q/topic:%2522secure-rbac%2522+status:open+project:openstack/cinder"}],"source_content_type":"text/x-yaml","patch_set":11,"id":"da611143_271bbbba","line":21,"in_reply_to":"f9495868_0086618f","updated":"2021-08-24 13:46:05.000000000","message":"If an operator understands what services are enforcing which personas, then they can switch accordingly (even if it is a pain, it\u0027s possible.) For example, if keystone is configured to enforce secure RBAC and cinder is not, then the operator needs to know they have to use the system-admin personas to create a new domain, but they need to use the project-admin persona to update storage pools in cinder.\n\nAnother key part of this answer is that even if the deployment is using mixed RBAC personas, the project-admin persona can\u0027t be given to regular end users until every service adopts secure RBAC.\n\nSo the short answer is yes it\u0027s possible, but it requires the operator to switch between administrative personas and they can\u0027t give project-admin to anyone while running in a mixed state.","commit_id":"b05b8acf7baacabdb04bfbaa706469b94b5b75dc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f33db9a74af302e6b52a6692f38bff8afecc2593","unresolved":true,"context_lines":[{"line_number":26,"context_line":"# support, these overrides will be obsolete and we can rely solely on the"},{"line_number":27,"context_line":"# EnforceSecureRbac parameter to configure a deployment with system-admin,"},{"line_number":28,"context_line":"# system-member, system-reader, project-admin, project-member, and"},{"line_number":29,"context_line":"# project-reader."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"parameter_defaults:"},{"line_number":32,"context_line":"  # TODO(lbragstad): Flip this to True once all services have support for"}],"source_content_type":"text/x-yaml","patch_set":14,"id":"656b3960_08f1ddb1","line":29,"updated":"2021-09-02 19:27:39.000000000","message":"These are the remaining services we need to add to this file:\n\n- Barbican\n- Designate\n- Octavia\n- Placement\n- Manila\n- Ironic\n- Swift?","commit_id":"95f979e7c971b903ac2e7c330e8318540d417f46"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7f6438584940e3b1e9ac5f76c9fa767a02e0f0a1","unresolved":true,"context_lines":[{"line_number":2194,"context_line":"      key: \"demo_reader\""},{"line_number":2195,"context_line":"      value: \"role:reader and project_name:demo and project_domain_id:default\""},{"line_number":2196,"context_line":""},{"line_number":2197,"context_line":"  DesignateApiPolicies:"},{"line_number":2198,"context_line":"    designate-abandon_zone:"},{"line_number":2199,"context_line":"      key: \"abandon_zone\""},{"line_number":2200,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":17,"id":"d42685e0_677d9f28","line":2197,"range":{"start_line":2197,"start_character":2,"end_line":2197,"end_character":22},"updated":"2021-09-07 18:37:50.000000000","message":"Note: this doesn\u0027t exist, yet... we need to create it","commit_id":"a9d32f0fee879b194068e2ee13184ca8e5781d02"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"9929ae3456ee115d265c9b9a8f0c5dd91d7f391d","unresolved":true,"context_lines":[{"line_number":2463,"context_line":"      value: \"role:admin or rule:project-reader\""},{"line_number":2464,"context_line":"    octavia-load-balancer_read-global:"},{"line_number":2465,"context_line":"      key: \"load-balancer:read-global\""},{"line_number":2466,"context_line":"      value: \"role:admin\""},{"line_number":2467,"context_line":"    octavia-load-balancer_read-quota:"},{"line_number":2468,"context_line":"      key: \"load-balancer:read-quota\""},{"line_number":2469,"context_line":"      value: \"role:admin or rule:project-reader\""}],"source_content_type":"text/x-yaml","patch_set":18,"id":"dca3babc_20d5096c","line":2466,"updated":"2021-09-07 19:02:23.000000000","message":"system_reader?","commit_id":"49bae7543cd87634be72d65709fcbf99a62f2b2c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"58bf5c221edecbfdac26dcd04e9be97fc7a761a8","unresolved":true,"context_lines":[{"line_number":2463,"context_line":"      value: \"role:admin or rule:project-reader\""},{"line_number":2464,"context_line":"    octavia-load-balancer_read-global:"},{"line_number":2465,"context_line":"      key: \"load-balancer:read-global\""},{"line_number":2466,"context_line":"      value: \"role:admin\""},{"line_number":2467,"context_line":"    octavia-load-balancer_read-quota:"},{"line_number":2468,"context_line":"      key: \"load-balancer:read-quota\""},{"line_number":2469,"context_line":"      value: \"role:admin or rule:project-reader\""}],"source_content_type":"text/x-yaml","patch_set":18,"id":"21cd7def_56edb5f1","line":2466,"in_reply_to":"dca3babc_20d5096c","updated":"2021-09-07 21:08:00.000000000","message":"Unfortunately we can\u0027t use any of the system personas yet because we have to adhere to the least common denominator as far as support across OpenStack services. Once we get everyone on the same page with respect to system-scope support we can start using these.","commit_id":"49bae7543cd87634be72d65709fcbf99a62f2b2c"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"9929ae3456ee115d265c9b9a8f0c5dd91d7f391d","unresolved":true,"context_lines":[{"line_number":2469,"context_line":"      value: \"role:admin or rule:project-reader\""},{"line_number":2470,"context_line":"    octavia-load-balancer_read-quota-global:"},{"line_number":2471,"context_line":"      key: \"load-balancer:read-quota-global\""},{"line_number":2472,"context_line":"      value: \"role:admin\""},{"line_number":2473,"context_line":"    octavia-load-balancer_write:"},{"line_number":2474,"context_line":"      key: \"load-balancer:write\""},{"line_number":2475,"context_line":"      value: \"role:admin or rule:project-member\""}],"source_content_type":"text/x-yaml","patch_set":18,"id":"12947d5f_c5decfd3","line":2472,"updated":"2021-09-07 19:02:23.000000000","message":"system_reader?","commit_id":"49bae7543cd87634be72d65709fcbf99a62f2b2c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"58bf5c221edecbfdac26dcd04e9be97fc7a761a8","unresolved":true,"context_lines":[{"line_number":2469,"context_line":"      value: \"role:admin or rule:project-reader\""},{"line_number":2470,"context_line":"    octavia-load-balancer_read-quota-global:"},{"line_number":2471,"context_line":"      key: \"load-balancer:read-quota-global\""},{"line_number":2472,"context_line":"      value: \"role:admin\""},{"line_number":2473,"context_line":"    octavia-load-balancer_write:"},{"line_number":2474,"context_line":"      key: \"load-balancer:write\""},{"line_number":2475,"context_line":"      value: \"role:admin or rule:project-member\""}],"source_content_type":"text/x-yaml","patch_set":18,"id":"40eea161_b121e976","line":2472,"in_reply_to":"12947d5f_c5decfd3","updated":"2021-09-07 21:08:00.000000000","message":"Ditto","commit_id":"49bae7543cd87634be72d65709fcbf99a62f2b2c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dfbfb6f43aa9b8db13c82e30bbbd77079dea165f","unresolved":true,"context_lines":[{"line_number":246,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":247,"context_line":"    cinder-volume_accept_transfer:"},{"line_number":248,"context_line":"      key: \"volume:accept_transfer\""},{"line_number":249,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":250,"context_line":"    cinder-volume_delete_transfer:"},{"line_number":251,"context_line":"      key: \"volume:delete_transfer\""},{"line_number":252,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"0b7954ba_aa3666ba","line":249,"updated":"2021-09-20 15:48:03.000000000","message":"For some reason this policy is making several tempest tests fail and it\u0027s not clear to me why:\n\n- https://github.com/openstack/tempest/blob/master/tempest/api/volume/test_volume_transfers.py#L66-L67\n- https://github.com/openstack/tempest/blob/master/tempest/api/volume/admin/test_volume_quotas.py#L138\n\nTraceback (most recent call last):\n  File \"/usr/lib/python3.6/site-packages/tempest/api/volume/admin/test_volume_quotas.py\", line 161, in test_quota_usage_after_volume_transfer\n    transfer_id, auth_key\u003dauth_key)\n  File \"/usr/lib/python3.6/site-packages/tempest/lib/services/volume/v3/transfers_client.py\", line 85, in accept_volume_transfer\n    resp, body \u003d self.post(url, post_body)\n  File \"/usr/lib/python3.6/site-packages/tempest/lib/common/rest_client.py\", line 299, in post\n    return self.request(\u0027POST\u0027, url, extra_headers, headers, body, chunked)\n  File \"/usr/lib/python3.6/site-packages/tempest/lib/common/rest_client.py\", line 703, in request\n    self._error_checker(resp, resp_body)\n  File \"/usr/lib/python3.6/site-packages/tempest/lib/common/rest_client.py\", line 804, in _error_checker\n    raise exceptions.Forbidden(resp_body, resp\u003dresp)\ntempest.lib.exceptions.Forbidden: Forbidden\nDetails: {\u0027code\u0027: 403, \u0027message\u0027: \"Policy doesn\u0027t allow volume:accept_transfer to be performed.\"}","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dfbfb6f43aa9b8db13c82e30bbbd77079dea165f","unresolved":true,"context_lines":[{"line_number":292,"context_line":"      value: \"rule:admin_required\""},{"line_number":293,"context_line":"    keystone-admin_or_owner:"},{"line_number":294,"context_line":"      key: \"admin_or_owner\""},{"line_number":295,"context_line":"      value: \"role:admin or user_id:%(target.user.id)s\""},{"line_number":296,"context_line":"    keystone-admin_or_project_member:"},{"line_number":297,"context_line":"      key: \"admin_or_project_member\""},{"line_number":298,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"f325da46_dfc670c5","line":295,"range":{"start_line":295,"start_character":38,"end_line":295,"end_character":52},"updated":"2021-09-20 15:48:03.000000000","message":"I think this might just need to be:\n\n  role:admin or user_id:%(user_id)s\n\nBased on how keystone is passing in the target values.\n\nhttps://github.com/openstack/keystone/blob/master/keystone/api/users.py#L152","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":292,"context_line":"      value: \"rule:admin_required\""},{"line_number":293,"context_line":"    keystone-admin_or_owner:"},{"line_number":294,"context_line":"      key: \"admin_or_owner\""},{"line_number":295,"context_line":"      value: \"role:admin or user_id:%(target.user.id)s\""},{"line_number":296,"context_line":"    keystone-admin_or_project_member:"},{"line_number":297,"context_line":"      key: \"admin_or_project_member\""},{"line_number":298,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"afc1bb46_5bc946dc","line":295,"range":{"start_line":295,"start_character":38,"end_line":295,"end_character":52},"in_reply_to":"f325da46_dfc670c5","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dfbfb6f43aa9b8db13c82e30bbbd77079dea165f","unresolved":true,"context_lines":[{"line_number":535,"context_line":"      value: \"rule:admin_required\""},{"line_number":536,"context_line":"    keystone-get_application_credential:"},{"line_number":537,"context_line":"      key: \"identity:get_application_credential\""},{"line_number":538,"context_line":"      value: \"rule:admin_or_owner\""},{"line_number":539,"context_line":"    keystone-get_consumer:"},{"line_number":540,"context_line":"      key: \"identity:get_consumer\""},{"line_number":541,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"ce97b7b4_d3b5cc47","line":538,"range":{"start_line":538,"start_character":14,"end_line":538,"end_character":33},"updated":"2021-09-20 15:48:03.000000000","message":"This should be:\n\n  role:admin or user_id:%(user_id)s\n\nSince keystone is passing that in directly instead of a nested dictionary.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":535,"context_line":"      value: \"rule:admin_required\""},{"line_number":536,"context_line":"    keystone-get_application_credential:"},{"line_number":537,"context_line":"      key: \"identity:get_application_credential\""},{"line_number":538,"context_line":"      value: \"rule:admin_or_owner\""},{"line_number":539,"context_line":"    keystone-get_consumer:"},{"line_number":540,"context_line":"      key: \"identity:get_consumer\""},{"line_number":541,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"43524097_e3b2c67c","line":538,"range":{"start_line":538,"start_character":14,"end_line":538,"end_character":33},"in_reply_to":"ce97b7b4_d3b5cc47","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":885,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":886,"context_line":""},{"line_number":887,"context_line":"  NovaApiPolicies:"},{"line_number":888,"context_line":"    nova-admin_api:"},{"line_number":889,"context_line":"      key: \"admin_api\""},{"line_number":890,"context_line":"      value: \"is_admin:True\""},{"line_number":891,"context_line":"    nova-admin_or_owner:"},{"line_number":892,"context_line":"      key: \"admin_or_owner\""},{"line_number":893,"context_line":"      value: \"is_admin:True or project_id:%(project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"14bdf931_43e5761f","line":890,"range":{"start_line":888,"start_character":0,"end_line":890,"end_character":28},"updated":"2021-09-15 20:20:41.000000000","message":"This can removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":885,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":886,"context_line":""},{"line_number":887,"context_line":"  NovaApiPolicies:"},{"line_number":888,"context_line":"    nova-admin_api:"},{"line_number":889,"context_line":"      key: \"admin_api\""},{"line_number":890,"context_line":"      value: \"is_admin:True\""},{"line_number":891,"context_line":"    nova-admin_or_owner:"},{"line_number":892,"context_line":"      key: \"admin_or_owner\""},{"line_number":893,"context_line":"      value: \"is_admin:True or project_id:%(project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"44be2d9e_54a0932b","line":890,"range":{"start_line":888,"start_character":0,"end_line":890,"end_character":28},"in_reply_to":"14bdf931_43e5761f","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":888,"context_line":"    nova-admin_api:"},{"line_number":889,"context_line":"      key: \"admin_api\""},{"line_number":890,"context_line":"      value: \"is_admin:True\""},{"line_number":891,"context_line":"    nova-admin_or_owner:"},{"line_number":892,"context_line":"      key: \"admin_or_owner\""},{"line_number":893,"context_line":"      value: \"is_admin:True or project_id:%(project_id)s\""},{"line_number":894,"context_line":"    nova-admin_or_project_member:"},{"line_number":895,"context_line":"      key: \"admin_or_project_member\""},{"line_number":896,"context_line":"      value: \"rule:admin_required or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"3db54e15_0968b73b","line":893,"range":{"start_line":891,"start_character":0,"end_line":893,"end_character":57},"updated":"2021-09-15 20:20:41.000000000","message":"This can removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":888,"context_line":"    nova-admin_api:"},{"line_number":889,"context_line":"      key: \"admin_api\""},{"line_number":890,"context_line":"      value: \"is_admin:True\""},{"line_number":891,"context_line":"    nova-admin_or_owner:"},{"line_number":892,"context_line":"      key: \"admin_or_owner\""},{"line_number":893,"context_line":"      value: \"is_admin:True or project_id:%(project_id)s\""},{"line_number":894,"context_line":"    nova-admin_or_project_member:"},{"line_number":895,"context_line":"      key: \"admin_or_project_member\""},{"line_number":896,"context_line":"      value: \"rule:admin_required or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"7cb89e2b_987db83d","line":893,"range":{"start_line":891,"start_character":0,"end_line":893,"end_character":57},"in_reply_to":"3db54e15_0968b73b","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":909,"context_line":"    nova-compute_server_topology_index:"},{"line_number":910,"context_line":"      key: \"compute:server:topology:index\""},{"line_number":911,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":912,"context_line":"    nova-compute_servers_create_requested_destination:"},{"line_number":913,"context_line":"      key: \"compute:servers:create:requested_destination\""},{"line_number":914,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":915,"context_line":"    nova-compute_servers_resize_cross_cell:"},{"line_number":916,"context_line":"      key: \"compute:servers:resize:cross_cell\""},{"line_number":917,"context_line":"      value: \"!\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"4abd3497_448df2d6","line":914,"range":{"start_line":912,"start_character":0,"end_line":914,"end_character":37},"updated":"2021-09-15 20:20:41.000000000","message":"I think this should be rule:admin_required?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":909,"context_line":"    nova-compute_server_topology_index:"},{"line_number":910,"context_line":"      key: \"compute:server:topology:index\""},{"line_number":911,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":912,"context_line":"    nova-compute_servers_create_requested_destination:"},{"line_number":913,"context_line":"      key: \"compute:servers:create:requested_destination\""},{"line_number":914,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":915,"context_line":"    nova-compute_servers_resize_cross_cell:"},{"line_number":916,"context_line":"      key: \"compute:servers:resize:cross_cell\""},{"line_number":917,"context_line":"      value: \"!\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"57ac0584_558bd610","line":914,"range":{"start_line":912,"start_character":0,"end_line":914,"end_character":37},"in_reply_to":"4abd3497_448df2d6","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":912,"context_line":"    nova-compute_servers_create_requested_destination:"},{"line_number":913,"context_line":"      key: \"compute:servers:create:requested_destination\""},{"line_number":914,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":915,"context_line":"    nova-compute_servers_resize_cross_cell:"},{"line_number":916,"context_line":"      key: \"compute:servers:resize:cross_cell\""},{"line_number":917,"context_line":"      value: \"!\""},{"line_number":918,"context_line":"    nova-context_is_admin:"},{"line_number":919,"context_line":"      key: \"context_is_admin\""},{"line_number":920,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"adeb53af_68dab2eb","line":917,"range":{"start_line":915,"start_character":0,"end_line":917,"end_character":16},"updated":"2021-09-15 20:20:41.000000000","message":"I think this can be removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":912,"context_line":"    nova-compute_servers_create_requested_destination:"},{"line_number":913,"context_line":"      key: \"compute:servers:create:requested_destination\""},{"line_number":914,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":915,"context_line":"    nova-compute_servers_resize_cross_cell:"},{"line_number":916,"context_line":"      key: \"compute:servers:resize:cross_cell\""},{"line_number":917,"context_line":"      value: \"!\""},{"line_number":918,"context_line":"    nova-context_is_admin:"},{"line_number":919,"context_line":"      key: \"context_is_admin\""},{"line_number":920,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"4fc26e5e_5147b6d5","line":917,"range":{"start_line":915,"start_character":0,"end_line":917,"end_character":16},"in_reply_to":"adeb53af_68dab2eb","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":915,"context_line":"    nova-compute_servers_resize_cross_cell:"},{"line_number":916,"context_line":"      key: \"compute:servers:resize:cross_cell\""},{"line_number":917,"context_line":"      value: \"!\""},{"line_number":918,"context_line":"    nova-context_is_admin:"},{"line_number":919,"context_line":"      key: \"context_is_admin\""},{"line_number":920,"context_line":"      value: \"role:admin\""},{"line_number":921,"context_line":"    nova-network_attach_external_network:"},{"line_number":922,"context_line":"      key: \"network:attach_external_network\""},{"line_number":923,"context_line":"      value: \"rule:project_admin_api\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"266225fe_50651a84","line":920,"range":{"start_line":918,"start_character":0,"end_line":920,"end_character":25},"updated":"2021-09-15 20:20:41.000000000","message":"This can removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":915,"context_line":"    nova-compute_servers_resize_cross_cell:"},{"line_number":916,"context_line":"      key: \"compute:servers:resize:cross_cell\""},{"line_number":917,"context_line":"      value: \"!\""},{"line_number":918,"context_line":"    nova-context_is_admin:"},{"line_number":919,"context_line":"      key: \"context_is_admin\""},{"line_number":920,"context_line":"      value: \"role:admin\""},{"line_number":921,"context_line":"    nova-network_attach_external_network:"},{"line_number":922,"context_line":"      key: \"network:attach_external_network\""},{"line_number":923,"context_line":"      value: \"rule:project_admin_api\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"a29cadde_d9a6b188","line":920,"range":{"start_line":918,"start_character":0,"end_line":920,"end_character":25},"in_reply_to":"266225fe_50651a84","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":918,"context_line":"    nova-context_is_admin:"},{"line_number":919,"context_line":"      key: \"context_is_admin\""},{"line_number":920,"context_line":"      value: \"role:admin\""},{"line_number":921,"context_line":"    nova-network_attach_external_network:"},{"line_number":922,"context_line":"      key: \"network:attach_external_network\""},{"line_number":923,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":924,"context_line":"    nova-os_compute_api_extensions:"},{"line_number":925,"context_line":"      key: \"os_compute_api:extensions\""},{"line_number":926,"context_line":"      value: \"@\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"affb32ab_f6cd265d","line":923,"range":{"start_line":921,"start_character":0,"end_line":923,"end_character":37},"updated":"2021-09-15 20:20:41.000000000","message":"I think this is supposed to be rule:admin_required?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":918,"context_line":"    nova-context_is_admin:"},{"line_number":919,"context_line":"      key: \"context_is_admin\""},{"line_number":920,"context_line":"      value: \"role:admin\""},{"line_number":921,"context_line":"    nova-network_attach_external_network:"},{"line_number":922,"context_line":"      key: \"network:attach_external_network\""},{"line_number":923,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":924,"context_line":"    nova-os_compute_api_extensions:"},{"line_number":925,"context_line":"      key: \"os_compute_api:extensions\""},{"line_number":926,"context_line":"      value: \"@\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"121a801b_20681ef4","line":923,"range":{"start_line":921,"start_character":0,"end_line":923,"end_character":37},"in_reply_to":"affb32ab_f6cd265d","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":921,"context_line":"    nova-network_attach_external_network:"},{"line_number":922,"context_line":"      key: \"network:attach_external_network\""},{"line_number":923,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":924,"context_line":"    nova-os_compute_api_extensions:"},{"line_number":925,"context_line":"      key: \"os_compute_api:extensions\""},{"line_number":926,"context_line":"      value: \"@\""},{"line_number":927,"context_line":"    nova-os_compute_api_ips_index:"},{"line_number":928,"context_line":"      key: \"os_compute_api:ips:index\""},{"line_number":929,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"eb1ac5bf_ff496905","line":926,"range":{"start_line":924,"start_character":0,"end_line":926,"end_character":16},"updated":"2021-09-15 20:20:41.000000000","message":"This can be removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":921,"context_line":"    nova-network_attach_external_network:"},{"line_number":922,"context_line":"      key: \"network:attach_external_network\""},{"line_number":923,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":924,"context_line":"    nova-os_compute_api_extensions:"},{"line_number":925,"context_line":"      key: \"os_compute_api:extensions\""},{"line_number":926,"context_line":"      value: \"@\""},{"line_number":927,"context_line":"    nova-os_compute_api_ips_index:"},{"line_number":928,"context_line":"      key: \"os_compute_api:ips:index\""},{"line_number":929,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"6d55e878_763ee2f4","line":926,"range":{"start_line":924,"start_character":0,"end_line":926,"end_character":16},"in_reply_to":"eb1ac5bf_ff496905","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":930,"context_line":"    nova-os_compute_api_ips_show:"},{"line_number":931,"context_line":"      key: \"os_compute_api:ips:show\""},{"line_number":932,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":933,"context_line":"    nova-os_compute_api_limits:"},{"line_number":934,"context_line":"      key: \"os_compute_api:limits\""},{"line_number":935,"context_line":"      value: \"@\""},{"line_number":936,"context_line":"    nova-os_compute_api_limits_other_project:"},{"line_number":937,"context_line":"      key: \"os_compute_api:limits:other_project\""},{"line_number":938,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"c82c6445_1db8a1a2","line":935,"range":{"start_line":933,"start_character":0,"end_line":935,"end_character":16},"updated":"2021-09-15 20:20:41.000000000","message":"This can be removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":930,"context_line":"    nova-os_compute_api_ips_show:"},{"line_number":931,"context_line":"      key: \"os_compute_api:ips:show\""},{"line_number":932,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":933,"context_line":"    nova-os_compute_api_limits:"},{"line_number":934,"context_line":"      key: \"os_compute_api:limits\""},{"line_number":935,"context_line":"      value: \"@\""},{"line_number":936,"context_line":"    nova-os_compute_api_limits_other_project:"},{"line_number":937,"context_line":"      key: \"os_compute_api:limits:other_project\""},{"line_number":938,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"3ffbb8a1_3e8d7b77","line":935,"range":{"start_line":933,"start_character":0,"end_line":935,"end_character":16},"in_reply_to":"c82c6445_1db8a1a2","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":993,"context_line":"    nova-os_compute_api_os-availability-zone_detail:"},{"line_number":994,"context_line":"      key: \"os_compute_api:os-availability-zone:detail\""},{"line_number":995,"context_line":"      value: \"rule:admin_required\""},{"line_number":996,"context_line":"    nova-os_compute_api_os-availability-zone_list:"},{"line_number":997,"context_line":"      key: \"os_compute_api:os-availability-zone:list\""},{"line_number":998,"context_line":"      value: \"@\""},{"line_number":999,"context_line":"    nova-os_compute_api_os-baremetal-nodes:"},{"line_number":1000,"context_line":"      key: \"os_compute_api:os-baremetal-nodes\""},{"line_number":1001,"context_line":"      value: \"rule:os_compute_api:os-baremetal-nodes:show\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"d1add363_4fad5d3c","line":998,"range":{"start_line":996,"start_character":0,"end_line":998,"end_character":16},"updated":"2021-09-15 20:20:41.000000000","message":"This can be removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":993,"context_line":"    nova-os_compute_api_os-availability-zone_detail:"},{"line_number":994,"context_line":"      key: \"os_compute_api:os-availability-zone:detail\""},{"line_number":995,"context_line":"      value: \"rule:admin_required\""},{"line_number":996,"context_line":"    nova-os_compute_api_os-availability-zone_list:"},{"line_number":997,"context_line":"      key: \"os_compute_api:os-availability-zone:list\""},{"line_number":998,"context_line":"      value: \"@\""},{"line_number":999,"context_line":"    nova-os_compute_api_os-baremetal-nodes:"},{"line_number":1000,"context_line":"      key: \"os_compute_api:os-baremetal-nodes\""},{"line_number":1001,"context_line":"      value: \"rule:os_compute_api:os-baremetal-nodes:show\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"0db29af0_25fdaeb0","line":998,"range":{"start_line":996,"start_character":0,"end_line":998,"end_character":16},"in_reply_to":"d1add363_4fad5d3c","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":1062,"context_line":"    nova-os_compute_api_os-flavor-manage_update:"},{"line_number":1063,"context_line":"      key: \"os_compute_api:os-flavor-manage:update\""},{"line_number":1064,"context_line":"      value: \"rule:admin_required\""},{"line_number":1065,"context_line":"    nova-os_compute_api_os-floating-ip-pools:"},{"line_number":1066,"context_line":"      key: \"os_compute_api:os-floating-ip-pools\""},{"line_number":1067,"context_line":"      value: \"@\""},{"line_number":1068,"context_line":"    nova-os_compute_api_os-floating-ips:"},{"line_number":1069,"context_line":"      key: \"os_compute_api:os-floating-ips\""},{"line_number":1070,"context_line":"      value: \"rule:os_compute_api:os-floating-ips:delete\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"1c85d636_64b2df63","line":1067,"range":{"start_line":1065,"start_character":0,"end_line":1067,"end_character":16},"updated":"2021-09-15 20:20:41.000000000","message":"This can be removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1062,"context_line":"    nova-os_compute_api_os-flavor-manage_update:"},{"line_number":1063,"context_line":"      key: \"os_compute_api:os-flavor-manage:update\""},{"line_number":1064,"context_line":"      value: \"rule:admin_required\""},{"line_number":1065,"context_line":"    nova-os_compute_api_os-floating-ip-pools:"},{"line_number":1066,"context_line":"      key: \"os_compute_api:os-floating-ip-pools\""},{"line_number":1067,"context_line":"      value: \"@\""},{"line_number":1068,"context_line":"    nova-os_compute_api_os-floating-ips:"},{"line_number":1069,"context_line":"      key: \"os_compute_api:os-floating-ips\""},{"line_number":1070,"context_line":"      value: \"rule:os_compute_api:os-floating-ips:delete\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"1ed158e9_3d362b8a","line":1067,"range":{"start_line":1065,"start_character":0,"end_line":1067,"end_character":16},"in_reply_to":"1c85d636_64b2df63","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":1215,"context_line":"    nova-os_compute_api_os-quota-class-sets_update:"},{"line_number":1216,"context_line":"      key: \"os_compute_api:os-quota-class-sets:update\""},{"line_number":1217,"context_line":"      value: \"rule:admin_required\""},{"line_number":1218,"context_line":"    nova-os_compute_api_os-quota-sets_defaults:"},{"line_number":1219,"context_line":"      key: \"os_compute_api:os-quota-sets:defaults\""},{"line_number":1220,"context_line":"      value: \"@\""},{"line_number":1221,"context_line":"    nova-os_compute_api_os-quota-sets_delete:"},{"line_number":1222,"context_line":"      key: \"os_compute_api:os-quota-sets:delete\""},{"line_number":1223,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"24167fd9_b2cc34f3","line":1220,"range":{"start_line":1218,"start_character":0,"end_line":1220,"end_character":16},"updated":"2021-09-15 20:20:41.000000000","message":"This can be removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1215,"context_line":"    nova-os_compute_api_os-quota-class-sets_update:"},{"line_number":1216,"context_line":"      key: \"os_compute_api:os-quota-class-sets:update\""},{"line_number":1217,"context_line":"      value: \"rule:admin_required\""},{"line_number":1218,"context_line":"    nova-os_compute_api_os-quota-sets_defaults:"},{"line_number":1219,"context_line":"      key: \"os_compute_api:os-quota-sets:defaults\""},{"line_number":1220,"context_line":"      value: \"@\""},{"line_number":1221,"context_line":"    nova-os_compute_api_os-quota-sets_delete:"},{"line_number":1222,"context_line":"      key: \"os_compute_api:os-quota-sets:delete\""},{"line_number":1223,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"ce9e488a_215879f0","line":1220,"range":{"start_line":1218,"start_character":0,"end_line":1220,"end_character":16},"in_reply_to":"24167fd9_b2cc34f3","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":1275,"context_line":"    nova-os_compute_api_os-server-external-events_create:"},{"line_number":1276,"context_line":"      key: \"os_compute_api:os-server-external-events:create\""},{"line_number":1277,"context_line":"      value: \"rule:admin_required\""},{"line_number":1278,"context_line":"    nova-os_compute_api_os-server-groups_create:"},{"line_number":1279,"context_line":"      key: \"os_compute_api:os-server-groups:create\""},{"line_number":1280,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1281,"context_line":"    nova-os_compute_api_os-server-groups_delete:"},{"line_number":1282,"context_line":"      key: \"os_compute_api:os-server-groups:delete\""},{"line_number":1283,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"c37b7094_90f7d788","line":1280,"range":{"start_line":1278,"start_character":0,"end_line":1280,"end_character":38},"updated":"2021-09-15 20:20:41.000000000","message":"This can be removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1275,"context_line":"    nova-os_compute_api_os-server-external-events_create:"},{"line_number":1276,"context_line":"      key: \"os_compute_api:os-server-external-events:create\""},{"line_number":1277,"context_line":"      value: \"rule:admin_required\""},{"line_number":1278,"context_line":"    nova-os_compute_api_os-server-groups_create:"},{"line_number":1279,"context_line":"      key: \"os_compute_api:os-server-groups:create\""},{"line_number":1280,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1281,"context_line":"    nova-os_compute_api_os-server-groups_delete:"},{"line_number":1282,"context_line":"      key: \"os_compute_api:os-server-groups:delete\""},{"line_number":1283,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"7620dbb9_07b3e36b","line":1280,"range":{"start_line":1278,"start_character":0,"end_line":1280,"end_character":38},"in_reply_to":"c37b7094_90f7d788","updated":"2021-09-20 17:23:42.000000000","message":"Actually - updated this to be rule:admin_required since project_admin isn\u0027t really feasible until all OpenStack services are updated to use system-scope.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":1440,"context_line":"    nova-os_compute_api_servers_confirm_resize:"},{"line_number":1441,"context_line":"      key: \"os_compute_api:servers:confirm_resize\""},{"line_number":1442,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1443,"context_line":"    nova-os_compute_api_servers_create:"},{"line_number":1444,"context_line":"      key: \"os_compute_api:servers:create\""},{"line_number":1445,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1446,"context_line":"    nova-os_compute_api_servers_create_attach_network:"},{"line_number":1447,"context_line":"      key: \"os_compute_api:servers:create:attach_network\""},{"line_number":1448,"context_line":"      value: \"rule:project_member_api\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"8f83f324_07fed3e2","line":1445,"range":{"start_line":1443,"start_character":0,"end_line":1445,"end_character":38},"updated":"2021-09-15 20:20:41.000000000","message":"This can be removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1440,"context_line":"    nova-os_compute_api_servers_confirm_resize:"},{"line_number":1441,"context_line":"      key: \"os_compute_api:servers:confirm_resize\""},{"line_number":1442,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1443,"context_line":"    nova-os_compute_api_servers_create:"},{"line_number":1444,"context_line":"      key: \"os_compute_api:servers:create\""},{"line_number":1445,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1446,"context_line":"    nova-os_compute_api_servers_create_attach_network:"},{"line_number":1447,"context_line":"      key: \"os_compute_api:servers:create:attach_network\""},{"line_number":1448,"context_line":"      value: \"rule:project_member_api\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"fe6ed40c_c1e1d9cc","line":1445,"range":{"start_line":1443,"start_character":0,"end_line":1445,"end_character":38},"in_reply_to":"8f83f324_07fed3e2","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":1443,"context_line":"    nova-os_compute_api_servers_create:"},{"line_number":1444,"context_line":"      key: \"os_compute_api:servers:create\""},{"line_number":1445,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1446,"context_line":"    nova-os_compute_api_servers_create_attach_network:"},{"line_number":1447,"context_line":"      key: \"os_compute_api:servers:create:attach_network\""},{"line_number":1448,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1449,"context_line":"    nova-os_compute_api_servers_create_attach_volume:"},{"line_number":1450,"context_line":"      key: \"os_compute_api:servers:create:attach_volume\""},{"line_number":1451,"context_line":"      value: \"rule:project_member_api\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"753b2ab7_3624bfcf","line":1448,"range":{"start_line":1446,"start_character":0,"end_line":1448,"end_character":38},"updated":"2021-09-15 20:20:41.000000000","message":"I think this can be removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1443,"context_line":"    nova-os_compute_api_servers_create:"},{"line_number":1444,"context_line":"      key: \"os_compute_api:servers:create\""},{"line_number":1445,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1446,"context_line":"    nova-os_compute_api_servers_create_attach_network:"},{"line_number":1447,"context_line":"      key: \"os_compute_api:servers:create:attach_network\""},{"line_number":1448,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1449,"context_line":"    nova-os_compute_api_servers_create_attach_volume:"},{"line_number":1450,"context_line":"      key: \"os_compute_api:servers:create:attach_volume\""},{"line_number":1451,"context_line":"      value: \"rule:project_member_api\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"5dfad16f_9d4f3af5","line":1448,"range":{"start_line":1446,"start_character":0,"end_line":1448,"end_character":38},"in_reply_to":"753b2ab7_3624bfcf","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":1446,"context_line":"    nova-os_compute_api_servers_create_attach_network:"},{"line_number":1447,"context_line":"      key: \"os_compute_api:servers:create:attach_network\""},{"line_number":1448,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1449,"context_line":"    nova-os_compute_api_servers_create_attach_volume:"},{"line_number":1450,"context_line":"      key: \"os_compute_api:servers:create:attach_volume\""},{"line_number":1451,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1452,"context_line":"    nova-os_compute_api_servers_create_forced_host:"},{"line_number":1453,"context_line":"      key: \"os_compute_api:servers:create:forced_host\""},{"line_number":1454,"context_line":"      value: \"rule:project_admin_api\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"28b1ccec_3e4d154a","line":1451,"range":{"start_line":1449,"start_character":0,"end_line":1451,"end_character":38},"updated":"2021-09-15 20:20:41.000000000","message":"I think this can be removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1446,"context_line":"    nova-os_compute_api_servers_create_attach_network:"},{"line_number":1447,"context_line":"      key: \"os_compute_api:servers:create:attach_network\""},{"line_number":1448,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1449,"context_line":"    nova-os_compute_api_servers_create_attach_volume:"},{"line_number":1450,"context_line":"      key: \"os_compute_api:servers:create:attach_volume\""},{"line_number":1451,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1452,"context_line":"    nova-os_compute_api_servers_create_forced_host:"},{"line_number":1453,"context_line":"      key: \"os_compute_api:servers:create:forced_host\""},{"line_number":1454,"context_line":"      value: \"rule:project_admin_api\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"b339821d_c37c426d","line":1451,"range":{"start_line":1449,"start_character":0,"end_line":1451,"end_character":38},"in_reply_to":"28b1ccec_3e4d154a","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":1449,"context_line":"    nova-os_compute_api_servers_create_attach_volume:"},{"line_number":1450,"context_line":"      key: \"os_compute_api:servers:create:attach_volume\""},{"line_number":1451,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1452,"context_line":"    nova-os_compute_api_servers_create_forced_host:"},{"line_number":1453,"context_line":"      key: \"os_compute_api:servers:create:forced_host\""},{"line_number":1454,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":1455,"context_line":"    nova-os_compute_api_servers_create_image:"},{"line_number":1456,"context_line":"      key: \"os_compute_api:servers:create_image\""},{"line_number":1457,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"957fd850_6d6d5255","line":1454,"range":{"start_line":1452,"start_character":0,"end_line":1454,"end_character":37},"updated":"2021-09-15 20:20:41.000000000","message":"I think this should be rule:admin_required?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1449,"context_line":"    nova-os_compute_api_servers_create_attach_volume:"},{"line_number":1450,"context_line":"      key: \"os_compute_api:servers:create:attach_volume\""},{"line_number":1451,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1452,"context_line":"    nova-os_compute_api_servers_create_forced_host:"},{"line_number":1453,"context_line":"      key: \"os_compute_api:servers:create:forced_host\""},{"line_number":1454,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":1455,"context_line":"    nova-os_compute_api_servers_create_image:"},{"line_number":1456,"context_line":"      key: \"os_compute_api:servers:create_image\""},{"line_number":1457,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"7599e678_a6bc73fe","line":1454,"range":{"start_line":1452,"start_character":0,"end_line":1454,"end_character":37},"in_reply_to":"957fd850_6d6d5255","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":1458,"context_line":"    nova-os_compute_api_servers_create_image_allow_volume_backed:"},{"line_number":1459,"context_line":"      key: \"os_compute_api:servers:create_image:allow_volume_backed\""},{"line_number":1460,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1461,"context_line":"    nova-os_compute_api_servers_create_trusted_certs:"},{"line_number":1462,"context_line":"      key: \"os_compute_api:servers:create:trusted_certs\""},{"line_number":1463,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1464,"context_line":"    nova-os_compute_api_servers_create_zero_disk_flavor:"},{"line_number":1465,"context_line":"      key: \"os_compute_api:servers:create:zero_disk_flavor\""},{"line_number":1466,"context_line":"      value: \"rule:project_admin_api\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"7a4bc099_7e2082ef","line":1463,"range":{"start_line":1461,"start_character":0,"end_line":1463,"end_character":38},"updated":"2021-09-15 20:20:41.000000000","message":"I think this can be removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1458,"context_line":"    nova-os_compute_api_servers_create_image_allow_volume_backed:"},{"line_number":1459,"context_line":"      key: \"os_compute_api:servers:create_image:allow_volume_backed\""},{"line_number":1460,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1461,"context_line":"    nova-os_compute_api_servers_create_trusted_certs:"},{"line_number":1462,"context_line":"      key: \"os_compute_api:servers:create:trusted_certs\""},{"line_number":1463,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1464,"context_line":"    nova-os_compute_api_servers_create_zero_disk_flavor:"},{"line_number":1465,"context_line":"      key: \"os_compute_api:servers:create:zero_disk_flavor\""},{"line_number":1466,"context_line":"      value: \"rule:project_admin_api\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"ce4e74df_c5846b24","line":1463,"range":{"start_line":1461,"start_character":0,"end_line":1463,"end_character":38},"in_reply_to":"7a4bc099_7e2082ef","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":1461,"context_line":"    nova-os_compute_api_servers_create_trusted_certs:"},{"line_number":1462,"context_line":"      key: \"os_compute_api:servers:create:trusted_certs\""},{"line_number":1463,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1464,"context_line":"    nova-os_compute_api_servers_create_zero_disk_flavor:"},{"line_number":1465,"context_line":"      key: \"os_compute_api:servers:create:zero_disk_flavor\""},{"line_number":1466,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":1467,"context_line":"    nova-os_compute_api_servers_delete:"},{"line_number":1468,"context_line":"      key: \"os_compute_api:servers:delete\""},{"line_number":1469,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"33c4a721_82bf7d82","line":1466,"range":{"start_line":1464,"start_character":0,"end_line":1466,"end_character":37},"updated":"2021-09-15 20:20:41.000000000","message":"I think this is supposed to be rule:admin_required?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1461,"context_line":"    nova-os_compute_api_servers_create_trusted_certs:"},{"line_number":1462,"context_line":"      key: \"os_compute_api:servers:create:trusted_certs\""},{"line_number":1463,"context_line":"      value: \"rule:project_member_api\""},{"line_number":1464,"context_line":"    nova-os_compute_api_servers_create_zero_disk_flavor:"},{"line_number":1465,"context_line":"      key: \"os_compute_api:servers:create:zero_disk_flavor\""},{"line_number":1466,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":1467,"context_line":"    nova-os_compute_api_servers_delete:"},{"line_number":1468,"context_line":"      key: \"os_compute_api:servers:delete\""},{"line_number":1469,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"1eb6c458_f9398af2","line":1466,"range":{"start_line":1464,"start_character":0,"end_line":1466,"end_character":37},"in_reply_to":"33c4a721_82bf7d82","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":1527,"context_line":"    nova-os_compute_api_servers_update:"},{"line_number":1528,"context_line":"      key: \"os_compute_api:servers:update\""},{"line_number":1529,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1530,"context_line":"    nova-project_admin_api:"},{"line_number":1531,"context_line":"      key: \"project_admin_api\""},{"line_number":1532,"context_line":"      value: \"role:admin and project_id:%(project_id)s\""},{"line_number":1533,"context_line":"    nova-project_member_api:"},{"line_number":1534,"context_line":"      key: \"project_member_api\""},{"line_number":1535,"context_line":"      value: \"role:member and project_id:%(project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"ded55436_c22c306d","line":1532,"range":{"start_line":1530,"start_character":0,"end_line":1532,"end_character":55},"updated":"2021-09-15 20:20:41.000000000","message":"This can removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1527,"context_line":"    nova-os_compute_api_servers_update:"},{"line_number":1528,"context_line":"      key: \"os_compute_api:servers:update\""},{"line_number":1529,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1530,"context_line":"    nova-project_admin_api:"},{"line_number":1531,"context_line":"      key: \"project_admin_api\""},{"line_number":1532,"context_line":"      value: \"role:admin and project_id:%(project_id)s\""},{"line_number":1533,"context_line":"    nova-project_member_api:"},{"line_number":1534,"context_line":"      key: \"project_member_api\""},{"line_number":1535,"context_line":"      value: \"role:member and project_id:%(project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"c14dda21_a837deff","line":1532,"range":{"start_line":1530,"start_character":0,"end_line":1532,"end_character":55},"in_reply_to":"ded55436_c22c306d","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":1530,"context_line":"    nova-project_admin_api:"},{"line_number":1531,"context_line":"      key: \"project_admin_api\""},{"line_number":1532,"context_line":"      value: \"role:admin and project_id:%(project_id)s\""},{"line_number":1533,"context_line":"    nova-project_member_api:"},{"line_number":1534,"context_line":"      key: \"project_member_api\""},{"line_number":1535,"context_line":"      value: \"role:member and project_id:%(project_id)s\""},{"line_number":1536,"context_line":"    nova-project_reader_api:"},{"line_number":1537,"context_line":"      key: \"project_reader_api\""},{"line_number":1538,"context_line":"      value: \"role:reader and project_id:%(project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"f1fa2f77_33ff869c","line":1535,"range":{"start_line":1533,"start_character":0,"end_line":1535,"end_character":56},"updated":"2021-09-15 20:20:41.000000000","message":"This can removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1530,"context_line":"    nova-project_admin_api:"},{"line_number":1531,"context_line":"      key: \"project_admin_api\""},{"line_number":1532,"context_line":"      value: \"role:admin and project_id:%(project_id)s\""},{"line_number":1533,"context_line":"    nova-project_member_api:"},{"line_number":1534,"context_line":"      key: \"project_member_api\""},{"line_number":1535,"context_line":"      value: \"role:member and project_id:%(project_id)s\""},{"line_number":1536,"context_line":"    nova-project_reader_api:"},{"line_number":1537,"context_line":"      key: \"project_reader_api\""},{"line_number":1538,"context_line":"      value: \"role:reader and project_id:%(project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"714f920c_ed9f0f7b","line":1535,"range":{"start_line":1533,"start_character":0,"end_line":1535,"end_character":56},"in_reply_to":"f1fa2f77_33ff869c","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":1533,"context_line":"    nova-project_member_api:"},{"line_number":1534,"context_line":"      key: \"project_member_api\""},{"line_number":1535,"context_line":"      value: \"role:member and project_id:%(project_id)s\""},{"line_number":1536,"context_line":"    nova-project_reader_api:"},{"line_number":1537,"context_line":"      key: \"project_reader_api\""},{"line_number":1538,"context_line":"      value: \"role:reader and project_id:%(project_id)s\""},{"line_number":1539,"context_line":"    nova-rule_admin_api:"},{"line_number":1540,"context_line":"      key: \"rule:admin_api\""},{"line_number":1541,"context_line":"      value: \"rule:project_admin_api\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"3d747039_d2720696","line":1538,"range":{"start_line":1536,"start_character":0,"end_line":1538,"end_character":56},"updated":"2021-09-15 20:20:41.000000000","message":"This can removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1533,"context_line":"    nova-project_member_api:"},{"line_number":1534,"context_line":"      key: \"project_member_api\""},{"line_number":1535,"context_line":"      value: \"role:member and project_id:%(project_id)s\""},{"line_number":1536,"context_line":"    nova-project_reader_api:"},{"line_number":1537,"context_line":"      key: \"project_reader_api\""},{"line_number":1538,"context_line":"      value: \"role:reader and project_id:%(project_id)s\""},{"line_number":1539,"context_line":"    nova-rule_admin_api:"},{"line_number":1540,"context_line":"      key: \"rule:admin_api\""},{"line_number":1541,"context_line":"      value: \"rule:project_admin_api\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"65d48f22_c332fb4c","line":1538,"range":{"start_line":1536,"start_character":0,"end_line":1538,"end_character":56},"in_reply_to":"3d747039_d2720696","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":1542,"context_line":"    nova-rule_admin_or_owner:"},{"line_number":1543,"context_line":"      key: \"rule:admin_or_owner\""},{"line_number":1544,"context_line":"      value: \"rule:system_or_project_reader\""},{"line_number":1545,"context_line":"    nova-system_admin_api:"},{"line_number":1546,"context_line":"      key: \"system_admin_api\""},{"line_number":1547,"context_line":"      value: \"role:admin and system_scope:all\""},{"line_number":1548,"context_line":"    nova-system_admin_or_owner:"},{"line_number":1549,"context_line":"      key: \"system_admin_or_owner\""},{"line_number":1550,"context_line":"      value: \"rule:system_admin_api or rule:project_member_api\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"9a741e07_f8ec8386","line":1547,"range":{"start_line":1545,"start_character":0,"end_line":1547,"end_character":46},"updated":"2021-09-15 20:20:41.000000000","message":"This can removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1542,"context_line":"    nova-rule_admin_or_owner:"},{"line_number":1543,"context_line":"      key: \"rule:admin_or_owner\""},{"line_number":1544,"context_line":"      value: \"rule:system_or_project_reader\""},{"line_number":1545,"context_line":"    nova-system_admin_api:"},{"line_number":1546,"context_line":"      key: \"system_admin_api\""},{"line_number":1547,"context_line":"      value: \"role:admin and system_scope:all\""},{"line_number":1548,"context_line":"    nova-system_admin_or_owner:"},{"line_number":1549,"context_line":"      key: \"system_admin_or_owner\""},{"line_number":1550,"context_line":"      value: \"rule:system_admin_api or rule:project_member_api\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"bf022a78_572f5710","line":1547,"range":{"start_line":1545,"start_character":0,"end_line":1547,"end_character":46},"in_reply_to":"9a741e07_f8ec8386","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":1545,"context_line":"    nova-system_admin_api:"},{"line_number":1546,"context_line":"      key: \"system_admin_api\""},{"line_number":1547,"context_line":"      value: \"role:admin and system_scope:all\""},{"line_number":1548,"context_line":"    nova-system_admin_or_owner:"},{"line_number":1549,"context_line":"      key: \"system_admin_or_owner\""},{"line_number":1550,"context_line":"      value: \"rule:system_admin_api or rule:project_member_api\""},{"line_number":1551,"context_line":"    nova-system_or_project_reader:"},{"line_number":1552,"context_line":"      key: \"system_or_project_reader\""},{"line_number":1553,"context_line":"      value: \"rule:system_reader_api or rule:project_reader_api\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"5c609570_4c127293","line":1550,"range":{"start_line":1548,"start_character":0,"end_line":1550,"end_character":63},"updated":"2021-09-15 20:20:41.000000000","message":"This can removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1545,"context_line":"    nova-system_admin_api:"},{"line_number":1546,"context_line":"      key: \"system_admin_api\""},{"line_number":1547,"context_line":"      value: \"role:admin and system_scope:all\""},{"line_number":1548,"context_line":"    nova-system_admin_or_owner:"},{"line_number":1549,"context_line":"      key: \"system_admin_or_owner\""},{"line_number":1550,"context_line":"      value: \"rule:system_admin_api or rule:project_member_api\""},{"line_number":1551,"context_line":"    nova-system_or_project_reader:"},{"line_number":1552,"context_line":"      key: \"system_or_project_reader\""},{"line_number":1553,"context_line":"      value: \"rule:system_reader_api or rule:project_reader_api\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"ed1b960b_fef909f5","line":1550,"range":{"start_line":1548,"start_character":0,"end_line":1550,"end_character":63},"in_reply_to":"5c609570_4c127293","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":1548,"context_line":"    nova-system_admin_or_owner:"},{"line_number":1549,"context_line":"      key: \"system_admin_or_owner\""},{"line_number":1550,"context_line":"      value: \"rule:system_admin_api or rule:project_member_api\""},{"line_number":1551,"context_line":"    nova-system_or_project_reader:"},{"line_number":1552,"context_line":"      key: \"system_or_project_reader\""},{"line_number":1553,"context_line":"      value: \"rule:system_reader_api or rule:project_reader_api\""},{"line_number":1554,"context_line":"    nova-system_reader_api:"},{"line_number":1555,"context_line":"      key: \"system_reader_api\""},{"line_number":1556,"context_line":"      value: \"role:reader and system_scope:all\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"2581d095_b1980486","line":1553,"range":{"start_line":1551,"start_character":0,"end_line":1553,"end_character":64},"updated":"2021-09-15 20:20:41.000000000","message":"This can removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1548,"context_line":"    nova-system_admin_or_owner:"},{"line_number":1549,"context_line":"      key: \"system_admin_or_owner\""},{"line_number":1550,"context_line":"      value: \"rule:system_admin_api or rule:project_member_api\""},{"line_number":1551,"context_line":"    nova-system_or_project_reader:"},{"line_number":1552,"context_line":"      key: \"system_or_project_reader\""},{"line_number":1553,"context_line":"      value: \"rule:system_reader_api or rule:project_reader_api\""},{"line_number":1554,"context_line":"    nova-system_reader_api:"},{"line_number":1555,"context_line":"      key: \"system_reader_api\""},{"line_number":1556,"context_line":"      value: \"role:reader and system_scope:all\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"1885ad0e_d03f3c97","line":1553,"range":{"start_line":1551,"start_character":0,"end_line":1553,"end_character":64},"in_reply_to":"2581d095_b1980486","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"df5dc7a47fa767807cbf81cc6af8f63b77944ed1","unresolved":true,"context_lines":[{"line_number":1551,"context_line":"    nova-system_or_project_reader:"},{"line_number":1552,"context_line":"      key: \"system_or_project_reader\""},{"line_number":1553,"context_line":"      value: \"rule:system_reader_api or rule:project_reader_api\""},{"line_number":1554,"context_line":"    nova-system_reader_api:"},{"line_number":1555,"context_line":"      key: \"system_reader_api\""},{"line_number":1556,"context_line":"      value: \"role:reader and system_scope:all\""},{"line_number":1557,"context_line":""},{"line_number":1558,"context_line":"  NeutronApiPolicies:"},{"line_number":1559,"context_line":"    neutron-add_extraroutes:"}],"source_content_type":"text/x-yaml","patch_set":22,"id":"7d48d228_a338d24e","line":1556,"range":{"start_line":1554,"start_character":0,"end_line":1556,"end_character":47},"updated":"2021-09-15 20:20:41.000000000","message":"This can removed since it\u0027s redundant with the default.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1551,"context_line":"    nova-system_or_project_reader:"},{"line_number":1552,"context_line":"      key: \"system_or_project_reader\""},{"line_number":1553,"context_line":"      value: \"rule:system_reader_api or rule:project_reader_api\""},{"line_number":1554,"context_line":"    nova-system_reader_api:"},{"line_number":1555,"context_line":"      key: \"system_reader_api\""},{"line_number":1556,"context_line":"      value: \"role:reader and system_scope:all\""},{"line_number":1557,"context_line":""},{"line_number":1558,"context_line":"  NeutronApiPolicies:"},{"line_number":1559,"context_line":"    neutron-add_extraroutes:"}],"source_content_type":"text/x-yaml","patch_set":22,"id":"2f51ae6f_e7d48590","line":1556,"range":{"start_line":1554,"start_character":0,"end_line":1556,"end_character":47},"in_reply_to":"7d48d228_a338d24e","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"8e04200e0588fa928ba6a301845b4ae592b00c79","unresolved":true,"context_lines":[{"line_number":1567,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""},{"line_number":1568,"context_line":"    neutron-add_subports:"},{"line_number":1569,"context_line":"      key: \"add_subports\""},{"line_number":1570,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""},{"line_number":1571,"context_line":"    neutron-admin_only:"},{"line_number":1572,"context_line":"      key: \"admin_only\""},{"line_number":1573,"context_line":"      value: \"rule:context_is_admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"fd0efced_6524a40e","line":1570,"range":{"start_line":1570,"start_character":40,"end_line":1570,"end_character":81},"updated":"2021-09-17 12:59:06.000000000","message":"is my understanding correct that this basically defines \"project-member\" persona? Can\u0027t we use here admin_or_project_member?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1567,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""},{"line_number":1568,"context_line":"    neutron-add_subports:"},{"line_number":1569,"context_line":"      key: \"add_subports\""},{"line_number":1570,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""},{"line_number":1571,"context_line":"    neutron-admin_only:"},{"line_number":1572,"context_line":"      key: \"admin_only\""},{"line_number":1573,"context_line":"      value: \"rule:context_is_admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"1a53be54_c1a634cf","line":1570,"range":{"start_line":1570,"start_character":40,"end_line":1570,"end_character":81},"in_reply_to":"fd0efced_6524a40e","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"8e04200e0588fa928ba6a301845b4ae592b00c79","unresolved":true,"context_lines":[{"line_number":1570,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""},{"line_number":1571,"context_line":"    neutron-admin_only:"},{"line_number":1572,"context_line":"      key: \"admin_only\""},{"line_number":1573,"context_line":"      value: \"rule:context_is_admin\""},{"line_number":1574,"context_line":"    neutron-admin_or_ext_parent_owner:"},{"line_number":1575,"context_line":"      key: \"admin_or_ext_parent_owner\""},{"line_number":1576,"context_line":"      value: \"rule:context_is_admin or tenant_id:%(ext_parent:tenant_id)s\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"e50a4868_fc1543b9","line":1573,"updated":"2021-09-17 12:59:06.000000000","message":"isn\u0027t neutron-admin_only, neutron-admin_required and neutron-context_is_admin the same thing really?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1570,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""},{"line_number":1571,"context_line":"    neutron-admin_only:"},{"line_number":1572,"context_line":"      key: \"admin_only\""},{"line_number":1573,"context_line":"      value: \"rule:context_is_admin\""},{"line_number":1574,"context_line":"    neutron-admin_or_ext_parent_owner:"},{"line_number":1575,"context_line":"      key: \"admin_or_ext_parent_owner\""},{"line_number":1576,"context_line":"      value: \"rule:context_is_admin or tenant_id:%(ext_parent:tenant_id)s\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"46f855a3_0e45388d","line":1573,"in_reply_to":"e50a4868_fc1543b9","updated":"2021-09-20 17:23:42.000000000","message":"Yeah - this can be removed since it\u0027s redundant with the defaults","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1571,"context_line":"    neutron-admin_only:"},{"line_number":1572,"context_line":"      key: \"admin_only\""},{"line_number":1573,"context_line":"      value: \"rule:context_is_admin\""},{"line_number":1574,"context_line":"    neutron-admin_or_ext_parent_owner:"},{"line_number":1575,"context_line":"      key: \"admin_or_ext_parent_owner\""},{"line_number":1576,"context_line":"      value: \"rule:context_is_admin or tenant_id:%(ext_parent:tenant_id)s\""},{"line_number":1577,"context_line":"    neutron-admin_or_network_owner:"},{"line_number":1578,"context_line":"      key: \"admin_or_network_owner\""},{"line_number":1579,"context_line":"      value: \"rule:context_is_admin or tenant_id:%(network:tenant_id)s\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"577d17d8_23ca5fa1","line":1576,"range":{"start_line":1574,"start_character":0,"end_line":1576,"end_character":74},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1574,"context_line":"    neutron-admin_or_ext_parent_owner:"},{"line_number":1575,"context_line":"      key: \"admin_or_ext_parent_owner\""},{"line_number":1576,"context_line":"      value: \"rule:context_is_admin or tenant_id:%(ext_parent:tenant_id)s\""},{"line_number":1577,"context_line":"    neutron-admin_or_network_owner:"},{"line_number":1578,"context_line":"      key: \"admin_or_network_owner\""},{"line_number":1579,"context_line":"      value: \"rule:context_is_admin or tenant_id:%(network:tenant_id)s\""},{"line_number":1580,"context_line":"    neutron-admin_or_owner:"},{"line_number":1581,"context_line":"      key: \"admin_or_owner\""},{"line_number":1582,"context_line":"      value: \"rule:context_is_admin or rule:owner\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"418351b8_907f6866","line":1579,"range":{"start_line":1577,"start_character":0,"end_line":1579,"end_character":71},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1577,"context_line":"    neutron-admin_or_network_owner:"},{"line_number":1578,"context_line":"      key: \"admin_or_network_owner\""},{"line_number":1579,"context_line":"      value: \"rule:context_is_admin or tenant_id:%(network:tenant_id)s\""},{"line_number":1580,"context_line":"    neutron-admin_or_owner:"},{"line_number":1581,"context_line":"      key: \"admin_or_owner\""},{"line_number":1582,"context_line":"      value: \"rule:context_is_admin or rule:owner\""},{"line_number":1583,"context_line":"    neutron-admin_or_project_member:"},{"line_number":1584,"context_line":"      key: \"admin_or_project_member\""},{"line_number":1585,"context_line":"      value: \"rule:admin_required or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"b39c302a_94b43ad6","line":1582,"range":{"start_line":1580,"start_character":0,"end_line":1582,"end_character":50},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1586,"context_line":"    neutron-admin_or_project_reader:"},{"line_number":1587,"context_line":"      key: \"admin_or_project_reader\""},{"line_number":1588,"context_line":"      value: \"rule:admin_required or (role:reader and project_id:%(project_id)s)\""},{"line_number":1589,"context_line":"    neutron-admin_or_sg_owner:"},{"line_number":1590,"context_line":"      key: \"admin_or_sg_owner\""},{"line_number":1591,"context_line":"      value: \"rule:context_is_admin or tenant_id:%(security_group:tenant_id)s\""},{"line_number":1592,"context_line":"    neutron-admin_owner_or_network_owner:"},{"line_number":1593,"context_line":"      key: \"admin_owner_or_network_owner\""},{"line_number":1594,"context_line":"      value: \"rule:owner or rule:admin_or_network_owner\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"40561446_5ab776ca","line":1591,"range":{"start_line":1589,"start_character":0,"end_line":1591,"end_character":78},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1592,"context_line":"    neutron-admin_owner_or_network_owner:"},{"line_number":1593,"context_line":"      key: \"admin_owner_or_network_owner\""},{"line_number":1594,"context_line":"      value: \"rule:owner or rule:admin_or_network_owner\""},{"line_number":1595,"context_line":"    neutron-admin_owner_or_sg_owner:"},{"line_number":1596,"context_line":"      key: \"admin_owner_or_sg_owner\""},{"line_number":1597,"context_line":"      value: \"rule:owner or rule:admin_or_sg_owner\""},{"line_number":1598,"context_line":"    neutron-admin_required:"},{"line_number":1599,"context_line":"      key: \"admin_required\""},{"line_number":1600,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"b44c62d9_d53a4ca4","line":1597,"range":{"start_line":1595,"start_character":0,"end_line":1597,"end_character":51},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1598,"context_line":"    neutron-admin_required:"},{"line_number":1599,"context_line":"      key: \"admin_required\""},{"line_number":1600,"context_line":"      value: \"role:admin\""},{"line_number":1601,"context_line":"    neutron-context_is_admin:"},{"line_number":1602,"context_line":"      key: \"context_is_admin\""},{"line_number":1603,"context_line":"      value: \"role:admin\""},{"line_number":1604,"context_line":"    neutron-context_is_advsvc:"},{"line_number":1605,"context_line":"      key: \"context_is_advsvc\""},{"line_number":1606,"context_line":"      value: \"role:advsvc\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"5bc0dbf1_1ba3d3ba","line":1603,"range":{"start_line":1601,"start_character":0,"end_line":1603,"end_character":25},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1601,"context_line":"    neutron-context_is_admin:"},{"line_number":1602,"context_line":"      key: \"context_is_admin\""},{"line_number":1603,"context_line":"      value: \"role:admin\""},{"line_number":1604,"context_line":"    neutron-context_is_advsvc:"},{"line_number":1605,"context_line":"      key: \"context_is_advsvc\""},{"line_number":1606,"context_line":"      value: \"role:advsvc\""},{"line_number":1607,"context_line":"    neutron-create_address_scope:"},{"line_number":1608,"context_line":"      key: \"create_address_scope\""},{"line_number":1609,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"ef3693e8_92b90b2d","line":1606,"range":{"start_line":1604,"start_character":0,"end_line":1606,"end_character":26},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"8e04200e0588fa928ba6a301845b4ae592b00c79","unresolved":true,"context_lines":[{"line_number":1621,"context_line":"      value: \"rule:admin_required\""},{"line_number":1622,"context_line":"    neutron-create_floatingip:"},{"line_number":1623,"context_line":"      key: \"create_floatingip\""},{"line_number":1624,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""},{"line_number":1625,"context_line":"    neutron-create_floatingip_floating_ip_address:"},{"line_number":1626,"context_line":"      key: \"create_floatingip:floating_ip_address\""},{"line_number":1627,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"6d7061bb_466df525","line":1624,"updated":"2021-09-17 12:59:06.000000000","message":"admin_or_project_memeber no?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1621,"context_line":"      value: \"rule:admin_required\""},{"line_number":1622,"context_line":"    neutron-create_floatingip:"},{"line_number":1623,"context_line":"      key: \"create_floatingip\""},{"line_number":1624,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""},{"line_number":1625,"context_line":"    neutron-create_floatingip_floating_ip_address:"},{"line_number":1626,"context_line":"      key: \"create_floatingip:floating_ip_address\""},{"line_number":1627,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"8498131f_9681f78b","line":1624,"in_reply_to":"6d7061bb_466df525","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"8e04200e0588fa928ba6a301845b4ae592b00c79","unresolved":true,"context_lines":[{"line_number":1629,"context_line":"      key: \"create_floatingip_port_forwarding\""},{"line_number":1630,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)"},{"line_number":1631,"context_line":"        or rule:ext_parent_owner\""},{"line_number":1632,"context_line":"    neutron-create_l3-router:"},{"line_number":1633,"context_line":"      key: \"create_l3-router\""},{"line_number":1634,"context_line":"      value: \"rule:admin_required\""},{"line_number":1635,"context_line":"    neutron-create_log:"}],"source_content_type":"text/x-yaml","patch_set":22,"id":"97a8eded_a5c93bdf","line":1632,"updated":"2021-09-17 12:59:06.000000000","message":"what is this really? I\u0027m not sure if we have such API","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":true,"context_lines":[{"line_number":1629,"context_line":"      key: \"create_floatingip_port_forwarding\""},{"line_number":1630,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)"},{"line_number":1631,"context_line":"        or rule:ext_parent_owner\""},{"line_number":1632,"context_line":"    neutron-create_l3-router:"},{"line_number":1633,"context_line":"      key: \"create_l3-router\""},{"line_number":1634,"context_line":"      value: \"rule:admin_required\""},{"line_number":1635,"context_line":"    neutron-create_log:"}],"source_content_type":"text/x-yaml","patch_set":22,"id":"e6d50f92_8d23634a","line":1632,"in_reply_to":"97a8eded_a5c93bdf","updated":"2021-09-20 17:23:42.000000000","message":"Apparently it\u0027s this? \n\nhttps://github.com/openstack/neutron/blob/master/neutron/conf/policies/agent.py#L132-L148","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"8e04200e0588fa928ba6a301845b4ae592b00c79","unresolved":true,"context_lines":[{"line_number":1631,"context_line":"        or rule:ext_parent_owner\""},{"line_number":1632,"context_line":"    neutron-create_l3-router:"},{"line_number":1633,"context_line":"      key: \"create_l3-router\""},{"line_number":1634,"context_line":"      value: \"rule:admin_required\""},{"line_number":1635,"context_line":"    neutron-create_log:"},{"line_number":1636,"context_line":"      key: \"create_log\""},{"line_number":1637,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"b632ddc2_c13c8e43","line":1634,"updated":"2021-09-17 12:59:06.000000000","message":"admin_or_project_member","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":true,"context_lines":[{"line_number":1631,"context_line":"        or rule:ext_parent_owner\""},{"line_number":1632,"context_line":"    neutron-create_l3-router:"},{"line_number":1633,"context_line":"      key: \"create_l3-router\""},{"line_number":1634,"context_line":"      value: \"rule:admin_required\""},{"line_number":1635,"context_line":"    neutron-create_log:"},{"line_number":1636,"context_line":"      key: \"create_log\""},{"line_number":1637,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"14f043ec_88b18cf2","line":1634,"in_reply_to":"b632ddc2_c13c8e43","updated":"2021-09-20 17:23:42.000000000","message":"I kept this as rule:admin_required since it\u0027s now base.SYSTEM_ADMIN","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"8e04200e0588fa928ba6a301845b4ae592b00c79","unresolved":true,"context_lines":[{"line_number":1643,"context_line":"      value: \"rule:admin_required\""},{"line_number":1644,"context_line":"    neutron-create_network:"},{"line_number":1645,"context_line":"      key: \"create_network\""},{"line_number":1646,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""},{"line_number":1647,"context_line":"    neutron-create_network_is_default:"},{"line_number":1648,"context_line":"      key: \"create_network:is_default\""},{"line_number":1649,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"904835d8_9b99c2bb","line":1646,"updated":"2021-09-17 12:59:06.000000000","message":"admin_or_project_member - and I think it can be changed in many places probably","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1643,"context_line":"      value: \"rule:admin_required\""},{"line_number":1644,"context_line":"    neutron-create_network:"},{"line_number":1645,"context_line":"      key: \"create_network\""},{"line_number":1646,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""},{"line_number":1647,"context_line":"    neutron-create_network_is_default:"},{"line_number":1648,"context_line":"      key: \"create_network:is_default\""},{"line_number":1649,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"f90c143e_ce58b491","line":1646,"in_reply_to":"904835d8_9b99c2bb","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1786,"context_line":"    neutron-create_trunk:"},{"line_number":1787,"context_line":"      key: \"create_trunk\""},{"line_number":1788,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""},{"line_number":1789,"context_line":"    neutron-default:"},{"line_number":1790,"context_line":"      key: \"default\""},{"line_number":1791,"context_line":"      value: \"rule:admin_or_owner\""},{"line_number":1792,"context_line":"    neutron-delete_address_scope:"},{"line_number":1793,"context_line":"      key: \"delete_address_scope\""},{"line_number":1794,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"954c3ce6_5bc85b51","line":1791,"range":{"start_line":1789,"start_character":0,"end_line":1791,"end_character":34},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1795,"context_line":"    neutron-delete_agent:"},{"line_number":1796,"context_line":"      key: \"delete_agent\""},{"line_number":1797,"context_line":"      value: \"rule:admin_required\""},{"line_number":1798,"context_line":"    neutron-delete_alias_bandwidth_limit_rule:"},{"line_number":1799,"context_line":"      key: \"delete_alias_bandwidth_limit_rule\""},{"line_number":1800,"context_line":"      value: \"rule:delete_policy_bandwidth_limit_rule\""},{"line_number":1801,"context_line":"    neutron-delete_alias_dscp_marking_rule:"},{"line_number":1802,"context_line":"      key: \"delete_alias_dscp_marking_rule\""},{"line_number":1803,"context_line":"      value: \"rule:delete_policy_dscp_marking_rule\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"2a702dca_25e726c6","line":1800,"range":{"start_line":1798,"start_character":0,"end_line":1800,"end_character":54},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1798,"context_line":"    neutron-delete_alias_bandwidth_limit_rule:"},{"line_number":1799,"context_line":"      key: \"delete_alias_bandwidth_limit_rule\""},{"line_number":1800,"context_line":"      value: \"rule:delete_policy_bandwidth_limit_rule\""},{"line_number":1801,"context_line":"    neutron-delete_alias_dscp_marking_rule:"},{"line_number":1802,"context_line":"      key: \"delete_alias_dscp_marking_rule\""},{"line_number":1803,"context_line":"      value: \"rule:delete_policy_dscp_marking_rule\""},{"line_number":1804,"context_line":"    neutron-delete_alias_minimum_bandwidth_rule:"},{"line_number":1805,"context_line":"      key: \"delete_alias_minimum_bandwidth_rule\""},{"line_number":1806,"context_line":"      value: \"rule:delete_policy_minimum_bandwidth_rule\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"e88d36cd_aaf7e1a5","line":1803,"range":{"start_line":1801,"start_character":0,"end_line":1803,"end_character":51},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1801,"context_line":"    neutron-delete_alias_dscp_marking_rule:"},{"line_number":1802,"context_line":"      key: \"delete_alias_dscp_marking_rule\""},{"line_number":1803,"context_line":"      value: \"rule:delete_policy_dscp_marking_rule\""},{"line_number":1804,"context_line":"    neutron-delete_alias_minimum_bandwidth_rule:"},{"line_number":1805,"context_line":"      key: \"delete_alias_minimum_bandwidth_rule\""},{"line_number":1806,"context_line":"      value: \"rule:delete_policy_minimum_bandwidth_rule\""},{"line_number":1807,"context_line":"    neutron-delete_auto_allocated_topology:"},{"line_number":1808,"context_line":"      key: \"delete_auto_allocated_topology\""},{"line_number":1809,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"26df5598_6235a34a","line":1806,"range":{"start_line":1804,"start_character":0,"end_line":1806,"end_character":56},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11975,"name":"Slawek Kaplonski","email":"skaplons@redhat.com","username":"slaweq"},"change_message_id":"8e04200e0588fa928ba6a301845b4ae592b00c79","unresolved":true,"context_lines":[{"line_number":1822,"context_line":"    neutron-delete_floatingip_port_forwarding:"},{"line_number":1823,"context_line":"      key: \"delete_floatingip_port_forwarding\""},{"line_number":1824,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s) or rule:ext_parent_owner\""},{"line_number":1825,"context_line":"    neutron-delete_l3-router:"},{"line_number":1826,"context_line":"      key: \"delete_l3-router\""},{"line_number":1827,"context_line":"      value: \"rule:admin_required\""},{"line_number":1828,"context_line":"    neutron-delete_log:"}],"source_content_type":"text/x-yaml","patch_set":22,"id":"4c4771cc_2c978b91","line":1825,"updated":"2021-09-17 12:59:06.000000000","message":"same question about that - where it is defined in Neutron?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":true,"context_lines":[{"line_number":1822,"context_line":"    neutron-delete_floatingip_port_forwarding:"},{"line_number":1823,"context_line":"      key: \"delete_floatingip_port_forwarding\""},{"line_number":1824,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s) or rule:ext_parent_owner\""},{"line_number":1825,"context_line":"    neutron-delete_l3-router:"},{"line_number":1826,"context_line":"      key: \"delete_l3-router\""},{"line_number":1827,"context_line":"      value: \"rule:admin_required\""},{"line_number":1828,"context_line":"    neutron-delete_log:"}],"source_content_type":"text/x-yaml","patch_set":22,"id":"421a45ab_d3ae33c0","line":1825,"in_reply_to":"4c4771cc_2c978b91","updated":"2021-09-20 17:23:42.000000000","message":"The policies are defined here:\n\nhttps://github.com/openstack/neutron/blob/master/neutron/conf/policies/agent.py#L150\n\nBut, I\u0027m not sure what calls it or why it exists.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1888,"context_line":"    neutron-delete_trunk:"},{"line_number":1889,"context_line":"      key: \"delete_trunk\""},{"line_number":1890,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""},{"line_number":1891,"context_line":"    neutron-ext_parent_owner:"},{"line_number":1892,"context_line":"      key: \"ext_parent_owner\""},{"line_number":1893,"context_line":"      value: \"tenant_id:%(ext_parent:tenant_id)s\""},{"line_number":1894,"context_line":"    neutron-external:"},{"line_number":1895,"context_line":"      key: \"external\""},{"line_number":1896,"context_line":"      value: \"field:networks:router:external\u003dTrue\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"1d728bd8_73d140c2","line":1893,"range":{"start_line":1891,"start_character":0,"end_line":1893,"end_character":49},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1891,"context_line":"    neutron-ext_parent_owner:"},{"line_number":1892,"context_line":"      key: \"ext_parent_owner\""},{"line_number":1893,"context_line":"      value: \"tenant_id:%(ext_parent:tenant_id)s\""},{"line_number":1894,"context_line":"    neutron-external:"},{"line_number":1895,"context_line":"      key: \"external\""},{"line_number":1896,"context_line":"      value: \"field:networks:router:external\u003dTrue\""},{"line_number":1897,"context_line":"    neutron-get_address_group:"},{"line_number":1898,"context_line":"      key: \"get_address_group\""},{"line_number":1899,"context_line":"      value: \"(rule:admin_required) or (role:reader and project_id:%(project_id)s) or rule:shared_address_groups\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"8a285b91_ef95aa3f","line":1896,"range":{"start_line":1894,"start_character":0,"end_line":1896,"end_character":50},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1903,"context_line":"    neutron-get_agent:"},{"line_number":1904,"context_line":"      key: \"get_agent\""},{"line_number":1905,"context_line":"      value: \"rule:admin_required\""},{"line_number":1906,"context_line":"    neutron-get_alias_bandwidth_limit_rule:"},{"line_number":1907,"context_line":"      key: \"get_alias_bandwidth_limit_rule\""},{"line_number":1908,"context_line":"      value: \"rule:get_policy_bandwidth_limit_rule\""},{"line_number":1909,"context_line":"    neutron-get_alias_dscp_marking_rule:"},{"line_number":1910,"context_line":"      key: \"get_alias_dscp_marking_rule\""},{"line_number":1911,"context_line":"      value: \"rule:get_policy_dscp_marking_rule\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"1fab4ead_85e4865c","line":1908,"range":{"start_line":1906,"start_character":0,"end_line":1908,"end_character":51},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1906,"context_line":"    neutron-get_alias_bandwidth_limit_rule:"},{"line_number":1907,"context_line":"      key: \"get_alias_bandwidth_limit_rule\""},{"line_number":1908,"context_line":"      value: \"rule:get_policy_bandwidth_limit_rule\""},{"line_number":1909,"context_line":"    neutron-get_alias_dscp_marking_rule:"},{"line_number":1910,"context_line":"      key: \"get_alias_dscp_marking_rule\""},{"line_number":1911,"context_line":"      value: \"rule:get_policy_dscp_marking_rule\""},{"line_number":1912,"context_line":"    neutron-get_alias_minimum_bandwidth_rule:"},{"line_number":1913,"context_line":"      key: \"get_alias_minimum_bandwidth_rule\""},{"line_number":1914,"context_line":"      value: \"rule:get_policy_minimum_bandwidth_rule\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"af8ac938_d87791b6","line":1911,"range":{"start_line":1909,"start_character":0,"end_line":1911,"end_character":48},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":1909,"context_line":"    neutron-get_alias_dscp_marking_rule:"},{"line_number":1910,"context_line":"      key: \"get_alias_dscp_marking_rule\""},{"line_number":1911,"context_line":"      value: \"rule:get_policy_dscp_marking_rule\""},{"line_number":1912,"context_line":"    neutron-get_alias_minimum_bandwidth_rule:"},{"line_number":1913,"context_line":"      key: \"get_alias_minimum_bandwidth_rule\""},{"line_number":1914,"context_line":"      value: \"rule:get_policy_minimum_bandwidth_rule\""},{"line_number":1915,"context_line":"    neutron-get_auto_allocated_topology:"},{"line_number":1916,"context_line":"      key: \"get_auto_allocated_topology\""},{"line_number":1917,"context_line":"      value: \"(rule:admin_required) or (role:reader and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"94ebe5d3_01e495d9","line":1914,"range":{"start_line":1912,"start_character":0,"end_line":1914,"end_character":53},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":2044,"context_line":"    neutron-get_service_profile:"},{"line_number":2045,"context_line":"      key: \"get_service_profile\""},{"line_number":2046,"context_line":"      value: \"rule:admin_required\""},{"line_number":2047,"context_line":"    neutron-get_service_provider:"},{"line_number":2048,"context_line":"      key: \"get_service_provider\""},{"line_number":2049,"context_line":"      value: \"role:reader\""},{"line_number":2050,"context_line":"    neutron-get_subnet:"},{"line_number":2051,"context_line":"      key: \"get_subnet\""},{"line_number":2052,"context_line":"      value: \"(rule:admin_required) or (role:reader and project_id:%(project_id)s) or rule:shared\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"e1e8c425_0db19266","line":2049,"range":{"start_line":2047,"start_character":0,"end_line":2049,"end_character":26},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults or switched to use the admin_or_project_reader rule.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":2062,"context_line":"    neutron-get_trunk:"},{"line_number":2063,"context_line":"      key: \"get_trunk\""},{"line_number":2064,"context_line":"      value: \"(rule:admin_required) or (role:reader and project_id:%(project_id)s)\""},{"line_number":2065,"context_line":"    neutron-network_device:"},{"line_number":2066,"context_line":"      key: \"network_device\""},{"line_number":2067,"context_line":"      value: \"field:port:device_owner\u003d~^network:\""},{"line_number":2068,"context_line":"    neutron-network_owner:"},{"line_number":2069,"context_line":"      key: \"network_owner\""},{"line_number":2070,"context_line":"      value: \"tenant_id:%(network:tenant_id)s\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"a06d3b11_3485df35","line":2067,"range":{"start_line":2065,"start_character":0,"end_line":2067,"end_character":49},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":2065,"context_line":"    neutron-network_device:"},{"line_number":2066,"context_line":"      key: \"network_device\""},{"line_number":2067,"context_line":"      value: \"field:port:device_owner\u003d~^network:\""},{"line_number":2068,"context_line":"    neutron-network_owner:"},{"line_number":2069,"context_line":"      key: \"network_owner\""},{"line_number":2070,"context_line":"      value: \"tenant_id:%(network:tenant_id)s\""},{"line_number":2071,"context_line":"    neutron-onboard_network_subnets:"},{"line_number":2072,"context_line":"      key: \"onboard_network_subnets\""},{"line_number":2073,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"c07041c8_0f697dbc","line":2070,"range":{"start_line":2068,"start_character":0,"end_line":2070,"end_character":46},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":2071,"context_line":"    neutron-onboard_network_subnets:"},{"line_number":2072,"context_line":"      key: \"onboard_network_subnets\""},{"line_number":2073,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""},{"line_number":2074,"context_line":"    neutron-owner:"},{"line_number":2075,"context_line":"      key: \"owner\""},{"line_number":2076,"context_line":"      value: \"tenant_id:%(tenant_id)s\""},{"line_number":2077,"context_line":"    neutron-regular_user:"},{"line_number":2078,"context_line":"      key: \"regular_user\""},{"line_number":2079,"context_line":"      value: \"\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"c5c4ce40_70139c35","line":2076,"range":{"start_line":2074,"start_character":0,"end_line":2076,"end_character":38},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":2074,"context_line":"    neutron-owner:"},{"line_number":2075,"context_line":"      key: \"owner\""},{"line_number":2076,"context_line":"      value: \"tenant_id:%(tenant_id)s\""},{"line_number":2077,"context_line":"    neutron-regular_user:"},{"line_number":2078,"context_line":"      key: \"regular_user\""},{"line_number":2079,"context_line":"      value: \"\""},{"line_number":2080,"context_line":"    neutron-remove_extraroutes:"},{"line_number":2081,"context_line":"      key: \"remove_extraroutes\""},{"line_number":2082,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"5ec22812_fb08efba","line":2079,"range":{"start_line":2077,"start_character":0,"end_line":2079,"end_character":15},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":2089,"context_line":"    neutron-remove_subports:"},{"line_number":2090,"context_line":"      key: \"remove_subports\""},{"line_number":2091,"context_line":"      value: \"(rule:admin_required) or (role:member and project_id:%(project_id)s)\""},{"line_number":2092,"context_line":"    neutron-restrict_wildcard:"},{"line_number":2093,"context_line":"      key: \"restrict_wildcard\""},{"line_number":2094,"context_line":"      value: \"(not field:rbac_policy:target_tenant\u003d*) or rule:admin_only\""},{"line_number":2095,"context_line":"    neutron-sg_owner:"},{"line_number":2096,"context_line":"      key: \"sg_owner\""},{"line_number":2097,"context_line":"      value: \"tenant_id:%(security_group:tenant_id)s\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"197089c8_f8b66cf6","line":2094,"range":{"start_line":2092,"start_character":0,"end_line":2094,"end_character":73},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":2092,"context_line":"    neutron-restrict_wildcard:"},{"line_number":2093,"context_line":"      key: \"restrict_wildcard\""},{"line_number":2094,"context_line":"      value: \"(not field:rbac_policy:target_tenant\u003d*) or rule:admin_only\""},{"line_number":2095,"context_line":"    neutron-sg_owner:"},{"line_number":2096,"context_line":"      key: \"sg_owner\""},{"line_number":2097,"context_line":"      value: \"tenant_id:%(security_group:tenant_id)s\""},{"line_number":2098,"context_line":"    neutron-shared:"},{"line_number":2099,"context_line":"      key: \"shared\""},{"line_number":2100,"context_line":"      value: \"field:networks:shared\u003dTrue\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"e886d01b_cca5a3dc","line":2097,"range":{"start_line":2095,"start_character":0,"end_line":2097,"end_character":53},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":2095,"context_line":"    neutron-sg_owner:"},{"line_number":2096,"context_line":"      key: \"sg_owner\""},{"line_number":2097,"context_line":"      value: \"tenant_id:%(security_group:tenant_id)s\""},{"line_number":2098,"context_line":"    neutron-shared:"},{"line_number":2099,"context_line":"      key: \"shared\""},{"line_number":2100,"context_line":"      value: \"field:networks:shared\u003dTrue\""},{"line_number":2101,"context_line":"    neutron-shared_address_groups:"},{"line_number":2102,"context_line":"      key: \"shared_address_groups\""},{"line_number":2103,"context_line":"      value: \"field:address_groups:shared\u003dTrue\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"e08fdb1f_55a76c67","line":2100,"range":{"start_line":2098,"start_character":0,"end_line":2100,"end_character":41},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":2098,"context_line":"    neutron-shared:"},{"line_number":2099,"context_line":"      key: \"shared\""},{"line_number":2100,"context_line":"      value: \"field:networks:shared\u003dTrue\""},{"line_number":2101,"context_line":"    neutron-shared_address_groups:"},{"line_number":2102,"context_line":"      key: \"shared_address_groups\""},{"line_number":2103,"context_line":"      value: \"field:address_groups:shared\u003dTrue\""},{"line_number":2104,"context_line":"    neutron-shared_address_scopes:"},{"line_number":2105,"context_line":"      key: \"shared_address_scopes\""},{"line_number":2106,"context_line":"      value: \"field:address_scopes:shared\u003dTrue\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"94528cc2_fa1f94c7","line":2103,"range":{"start_line":2101,"start_character":0,"end_line":2103,"end_character":47},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":2101,"context_line":"    neutron-shared_address_groups:"},{"line_number":2102,"context_line":"      key: \"shared_address_groups\""},{"line_number":2103,"context_line":"      value: \"field:address_groups:shared\u003dTrue\""},{"line_number":2104,"context_line":"    neutron-shared_address_scopes:"},{"line_number":2105,"context_line":"      key: \"shared_address_scopes\""},{"line_number":2106,"context_line":"      value: \"field:address_scopes:shared\u003dTrue\""},{"line_number":2107,"context_line":"    neutron-shared_subnetpools:"},{"line_number":2108,"context_line":"      key: \"shared_subnetpools\""},{"line_number":2109,"context_line":"      value: \"field:subnetpools:shared\u003dTrue\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"b0906b3e_172605b5","line":2106,"range":{"start_line":2104,"start_character":0,"end_line":2106,"end_character":47},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":2116,"context_line":"    neutron-update_agent:"},{"line_number":2117,"context_line":"      key: \"update_agent\""},{"line_number":2118,"context_line":"      value: \"rule:admin_required\""},{"line_number":2119,"context_line":"    neutron-update_alias_bandwidth_limit_rule:"},{"line_number":2120,"context_line":"      key: \"update_alias_bandwidth_limit_rule\""},{"line_number":2121,"context_line":"      value: \"rule:update_policy_bandwidth_limit_rule\""},{"line_number":2122,"context_line":"    neutron-update_alias_dscp_marking_rule:"},{"line_number":2123,"context_line":"      key: \"update_alias_dscp_marking_rule\""},{"line_number":2124,"context_line":"      value: \"rule:update_policy_dscp_marking_rule\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"86d056cc_93fff361","line":2121,"range":{"start_line":2119,"start_character":0,"end_line":2121,"end_character":54},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":2119,"context_line":"    neutron-update_alias_bandwidth_limit_rule:"},{"line_number":2120,"context_line":"      key: \"update_alias_bandwidth_limit_rule\""},{"line_number":2121,"context_line":"      value: \"rule:update_policy_bandwidth_limit_rule\""},{"line_number":2122,"context_line":"    neutron-update_alias_dscp_marking_rule:"},{"line_number":2123,"context_line":"      key: \"update_alias_dscp_marking_rule\""},{"line_number":2124,"context_line":"      value: \"rule:update_policy_dscp_marking_rule\""},{"line_number":2125,"context_line":"    neutron-update_alias_minimum_bandwidth_rule:"},{"line_number":2126,"context_line":"      key: \"update_alias_minimum_bandwidth_rule\""},{"line_number":2127,"context_line":"      value: \"rule:update_policy_minimum_bandwidth_rule\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"82873e51_5798aa76","line":2124,"range":{"start_line":2122,"start_character":0,"end_line":2124,"end_character":51},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":2122,"context_line":"    neutron-update_alias_dscp_marking_rule:"},{"line_number":2123,"context_line":"      key: \"update_alias_dscp_marking_rule\""},{"line_number":2124,"context_line":"      value: \"rule:update_policy_dscp_marking_rule\""},{"line_number":2125,"context_line":"    neutron-update_alias_minimum_bandwidth_rule:"},{"line_number":2126,"context_line":"      key: \"update_alias_minimum_bandwidth_rule\""},{"line_number":2127,"context_line":"      value: \"rule:update_policy_minimum_bandwidth_rule\""},{"line_number":2128,"context_line":"    neutron-update_flavor:"},{"line_number":2129,"context_line":"      key: \"update_flavor\""},{"line_number":2130,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"1f705eac_2efac8d6","line":2127,"range":{"start_line":2125,"start_character":0,"end_line":2127,"end_character":56},"updated":"2021-09-20 17:23:42.000000000","message":"This can be removed since it\u0027s redundant with the defaults.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2389,"context_line":"  IronicApiPolicies:"},{"line_number":2390,"context_line":"    ironic-baremetal_admin:"},{"line_number":2391,"context_line":"      key: \"baremetal_admin\""},{"line_number":2392,"context_line":"      value: \"role:admin and project_name:baremetal and project_domain_id:default\""},{"line_number":2393,"context_line":"    ironic-baremetal_allocation_create:"},{"line_number":2394,"context_line":"      key: \"baremetal:allocation:create\""},{"line_number":2395,"context_line":"      value: \"role:admin or rule:baremetal_admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"f4959cf1_521c6aba","line":2392,"updated":"2021-09-16 21:35:23.000000000","message":"Do we want to replace stock policy base policies in case someone deletes some of these?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2389,"context_line":"  IronicApiPolicies:"},{"line_number":2390,"context_line":"    ironic-baremetal_admin:"},{"line_number":2391,"context_line":"      key: \"baremetal_admin\""},{"line_number":2392,"context_line":"      value: \"role:admin and project_name:baremetal and project_domain_id:default\""},{"line_number":2393,"context_line":"    ironic-baremetal_allocation_create:"},{"line_number":2394,"context_line":"      key: \"baremetal:allocation:create\""},{"line_number":2395,"context_line":"      value: \"role:admin or rule:baremetal_admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"d4e4a299_3cc80179","line":2392,"range":{"start_line":2392,"start_character":14,"end_line":2392,"end_character":82},"updated":"2021-09-16 21:35:23.000000000","message":"Should this also be permitted for service project as well? So cross service interactions will be permitted?\n\nrole:admin and project_name:baremetal and project_domain_id:default or role:admin and project_name:service and project_domain_id:default","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"f9ad3315cd6f8ece7a4829705b3dc233d4706ecf","unresolved":true,"context_lines":[{"line_number":2389,"context_line":"  IronicApiPolicies:"},{"line_number":2390,"context_line":"    ironic-baremetal_admin:"},{"line_number":2391,"context_line":"      key: \"baremetal_admin\""},{"line_number":2392,"context_line":"      value: \"role:admin and project_name:baremetal and project_domain_id:default\""},{"line_number":2393,"context_line":"    ironic-baremetal_allocation_create:"},{"line_number":2394,"context_line":"      key: \"baremetal:allocation:create\""},{"line_number":2395,"context_line":"      value: \"role:admin or rule:baremetal_admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"f213a759_9f31e1d6","line":2392,"in_reply_to":"7543d758_8a05ca32","updated":"2021-09-22 15:01:56.000000000","message":"I dunno, maybe?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"f9ad3315cd6f8ece7a4829705b3dc233d4706ecf","unresolved":true,"context_lines":[{"line_number":2389,"context_line":"  IronicApiPolicies:"},{"line_number":2390,"context_line":"    ironic-baremetal_admin:"},{"line_number":2391,"context_line":"      key: \"baremetal_admin\""},{"line_number":2392,"context_line":"      value: \"role:admin and project_name:baremetal and project_domain_id:default\""},{"line_number":2393,"context_line":"    ironic-baremetal_allocation_create:"},{"line_number":2394,"context_line":"      key: \"baremetal:allocation:create\""},{"line_number":2395,"context_line":"      value: \"role:admin or rule:baremetal_admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"be44afa3_7ef1fc2f","line":2392,"range":{"start_line":2392,"start_character":14,"end_line":2392,"end_character":82},"in_reply_to":"d177d778_38bfd7c4","updated":"2021-09-22 15:01:56.000000000","message":"Yes, if your an admin project or admin service, or in demo, or in a specific baremetal project, you were granted access. If you were an explicit baremetal_admin in the baremetal project, then you were also granted access.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":true,"context_lines":[{"line_number":2389,"context_line":"  IronicApiPolicies:"},{"line_number":2390,"context_line":"    ironic-baremetal_admin:"},{"line_number":2391,"context_line":"      key: \"baremetal_admin\""},{"line_number":2392,"context_line":"      value: \"role:admin and project_name:baremetal and project_domain_id:default\""},{"line_number":2393,"context_line":"    ironic-baremetal_allocation_create:"},{"line_number":2394,"context_line":"      key: \"baremetal:allocation:create\""},{"line_number":2395,"context_line":"      value: \"role:admin or rule:baremetal_admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"d177d778_38bfd7c4","line":2392,"range":{"start_line":2392,"start_character":14,"end_line":2392,"end_character":82},"in_reply_to":"d4e4a299_3cc80179","updated":"2021-09-20 17:23:42.000000000","message":"Is that how it used to work prior to the policy work ironic did in Wallaby?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":true,"context_lines":[{"line_number":2389,"context_line":"  IronicApiPolicies:"},{"line_number":2390,"context_line":"    ironic-baremetal_admin:"},{"line_number":2391,"context_line":"      key: \"baremetal_admin\""},{"line_number":2392,"context_line":"      value: \"role:admin and project_name:baremetal and project_domain_id:default\""},{"line_number":2393,"context_line":"    ironic-baremetal_allocation_create:"},{"line_number":2394,"context_line":"      key: \"baremetal:allocation:create\""},{"line_number":2395,"context_line":"      value: \"role:admin or rule:baremetal_admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"7543d758_8a05ca32","line":2392,"in_reply_to":"f4959cf1_521c6aba","updated":"2021-09-20 17:23:42.000000000","message":"In case someone deletes baremetal_admin?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2392,"context_line":"      value: \"role:admin and project_name:baremetal and project_domain_id:default\""},{"line_number":2393,"context_line":"    ironic-baremetal_allocation_create:"},{"line_number":2394,"context_line":"      key: \"baremetal:allocation:create\""},{"line_number":2395,"context_line":"      value: \"role:admin or rule:baremetal_admin\""},{"line_number":2396,"context_line":"    ironic-baremetal_allocation_create_restricted:"},{"line_number":2397,"context_line":"      key: \"baremetal:allocation:create_restricted\""},{"line_number":2398,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"9811a523_a23e9c67","line":2395,"range":{"start_line":2395,"start_character":14,"end_line":2395,"end_character":28},"updated":"2021-09-16 21:35:23.000000000","message":"I think if we do the above note, allows the service to still work, and allows us to drop all of the role definitions on each key for \"role:admin\".\n\nFor what it is worth, conceptually anyone is allowed to create an allocation. Ironic internally filters if they have rights to see the nodes and choses from them, but I think for this purpose, restricting it down to the rule baremetal_admin is fine.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":true,"context_lines":[{"line_number":2392,"context_line":"      value: \"role:admin and project_name:baremetal and project_domain_id:default\""},{"line_number":2393,"context_line":"    ironic-baremetal_allocation_create:"},{"line_number":2394,"context_line":"      key: \"baremetal:allocation:create\""},{"line_number":2395,"context_line":"      value: \"role:admin or rule:baremetal_admin\""},{"line_number":2396,"context_line":"    ironic-baremetal_allocation_create_restricted:"},{"line_number":2397,"context_line":"      key: \"baremetal:allocation:create_restricted\""},{"line_number":2398,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"a1f65efd_72fcd0c4","line":2395,"range":{"start_line":2395,"start_character":14,"end_line":2395,"end_character":28},"in_reply_to":"9811a523_a23e9c67","updated":"2021-09-20 17:23:42.000000000","message":"Just so I understand correctly, you think we should rewrite these so that an administrator in Ironic is only someone with the \u0027admin\u0027 role on the \u0027baremetal\u0027 project, right?\n\nThe way we\u0027re approaching this with other policies in this file is to say \"role:admin\" so that the admin with the \u0027admin\u0027 role on the admin project (bootstrapped by keystone) will be able to interact with administrative APIs in every service.\n\nIf we take the baremetal_admin approach, we will need to make sure something (devstack, OSA, tripleo) gives the admin user the \u0027admin\u0027 role on the baremetal project or document it somewhere. Unless that exists already and I\u0027m just not aware of it?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"f9ad3315cd6f8ece7a4829705b3dc233d4706ecf","unresolved":true,"context_lines":[{"line_number":2392,"context_line":"      value: \"role:admin and project_name:baremetal and project_domain_id:default\""},{"line_number":2393,"context_line":"    ironic-baremetal_allocation_create:"},{"line_number":2394,"context_line":"      key: \"baremetal:allocation:create\""},{"line_number":2395,"context_line":"      value: \"role:admin or rule:baremetal_admin\""},{"line_number":2396,"context_line":"    ironic-baremetal_allocation_create_restricted:"},{"line_number":2397,"context_line":"      key: \"baremetal:allocation:create_restricted\""},{"line_number":2398,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"615ac712_a8eef404","line":2395,"range":{"start_line":2395,"start_character":14,"end_line":2395,"end_character":28},"in_reply_to":"a1f65efd_72fcd0c4","updated":"2021-09-22 15:01:56.000000000","message":"I *think* it already exists, but for devstack it is just excessive use of the demo tenant. :\\","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2395,"context_line":"      value: \"role:admin or rule:baremetal_admin\""},{"line_number":2396,"context_line":"    ironic-baremetal_allocation_create_restricted:"},{"line_number":2397,"context_line":"      key: \"baremetal:allocation:create_restricted\""},{"line_number":2398,"context_line":"      value: \"role:admin\""},{"line_number":2399,"context_line":"    ironic-baremetal_allocation_delete:"},{"line_number":2400,"context_line":"      key: \"baremetal:allocation:delete\""},{"line_number":2401,"context_line":"      value: \"(role:admin) or (role:member and project_id:%(allocation.owner)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"88678fe3_564e9ae0","line":2398,"range":{"start_line":2398,"start_character":14,"end_line":2398,"end_character":24},"updated":"2021-09-16 21:35:23.000000000","message":"rule:baremetal_admin\n\nOr...\n\nLots of duplicaiton of the longer form set forth in baremetal_admin.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2398,"context_line":"      value: \"role:admin\""},{"line_number":2399,"context_line":"    ironic-baremetal_allocation_delete:"},{"line_number":2400,"context_line":"      key: \"baremetal:allocation:delete\""},{"line_number":2401,"context_line":"      value: \"(role:admin) or (role:member and project_id:%(allocation.owner)s)\""},{"line_number":2402,"context_line":"    ironic-baremetal_allocation_get:"},{"line_number":2403,"context_line":"      key: \"baremetal:allocation:get\""},{"line_number":2404,"context_line":"      value: \"(role:admin) or (role:reader and project_id:%(allocation.owner)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"65ce426c_da0d45fb","line":2401,"range":{"start_line":2401,"start_character":14,"end_line":2401,"end_character":27},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin) or (role:member and project_id:%(allocation.owner)s)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2401,"context_line":"      value: \"(role:admin) or (role:member and project_id:%(allocation.owner)s)\""},{"line_number":2402,"context_line":"    ironic-baremetal_allocation_get:"},{"line_number":2403,"context_line":"      key: \"baremetal:allocation:get\""},{"line_number":2404,"context_line":"      value: \"(role:admin) or (role:reader and project_id:%(allocation.owner)s)\""},{"line_number":2405,"context_line":"    ironic-baremetal_allocation_list:"},{"line_number":2406,"context_line":"      key: \"baremetal:allocation:list\""},{"line_number":2407,"context_line":"      value: \"role:reader\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"f5753fad_b8b1524d","line":2404,"range":{"start_line":2404,"start_character":14,"end_line":2404,"end_character":79},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin) or (role:member and project_id:%(allocation.owner)s)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2407,"context_line":"      value: \"role:reader\""},{"line_number":2408,"context_line":"    ironic-baremetal_allocation_list_all:"},{"line_number":2409,"context_line":"      key: \"baremetal:allocation:list_all\""},{"line_number":2410,"context_line":"      value: \"role:admin\""},{"line_number":2411,"context_line":"    ironic-baremetal_allocation_update:"},{"line_number":2412,"context_line":"      key: \"baremetal:allocation:update\""},{"line_number":2413,"context_line":"      value: \"(role:admin) or (role:member and project_id:%(allocation.owner)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"4ce64cf1_4410e074","line":2410,"range":{"start_line":2410,"start_character":3,"end_line":2410,"end_character":25},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin)\"\n\nlist_all policies are generally for controlling if additional list policy checks are required. So we generally need to restrict this down to be the most restrictive. In a system scope, its not a big deal, but mixed project it should still be restricted.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2410,"context_line":"      value: \"role:admin\""},{"line_number":2411,"context_line":"    ironic-baremetal_allocation_update:"},{"line_number":2412,"context_line":"      key: \"baremetal:allocation:update\""},{"line_number":2413,"context_line":"      value: \"(role:admin) or (role:member and project_id:%(allocation.owner)s)\""},{"line_number":2414,"context_line":"    ironic-baremetal_chassis_create:"},{"line_number":2415,"context_line":"      key: \"baremetal:chassis:create\""},{"line_number":2416,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"6a5fcb60_762eb295","line":2413,"range":{"start_line":2413,"start_character":13,"end_line":2413,"end_character":80},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin) or (role:member and project_id:%(allocation.owner)s)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2413,"context_line":"      value: \"(role:admin) or (role:member and project_id:%(allocation.owner)s)\""},{"line_number":2414,"context_line":"    ironic-baremetal_chassis_create:"},{"line_number":2415,"context_line":"      key: \"baremetal:chassis:create\""},{"line_number":2416,"context_line":"      value: \"role:admin\""},{"line_number":2417,"context_line":"    ironic-baremetal_chassis_delete:"},{"line_number":2418,"context_line":"      key: \"baremetal:chassis:delete\""},{"line_number":2419,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"6e8e9d67_1141dee1","line":2416,"range":{"start_line":2416,"start_character":12,"end_line":2416,"end_character":25},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2416,"context_line":"      value: \"role:admin\""},{"line_number":2417,"context_line":"    ironic-baremetal_chassis_delete:"},{"line_number":2418,"context_line":"      key: \"baremetal:chassis:delete\""},{"line_number":2419,"context_line":"      value: \"role:admin\""},{"line_number":2420,"context_line":"    ironic-baremetal_chassis_get:"},{"line_number":2421,"context_line":"      key: \"baremetal:chassis:get\""},{"line_number":2422,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"79c9af52_5463ab2b","line":2419,"range":{"start_line":2419,"start_character":13,"end_line":2419,"end_character":25},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2419,"context_line":"      value: \"role:admin\""},{"line_number":2420,"context_line":"    ironic-baremetal_chassis_get:"},{"line_number":2421,"context_line":"      key: \"baremetal:chassis:get\""},{"line_number":2422,"context_line":"      value: \"role:admin\""},{"line_number":2423,"context_line":"    ironic-baremetal_chassis_update:"},{"line_number":2424,"context_line":"      key: \"baremetal:chassis:update\""},{"line_number":2425,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"68de55af_04dc8ff9","line":2422,"range":{"start_line":2422,"start_character":12,"end_line":2422,"end_character":25},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2422,"context_line":"      value: \"role:admin\""},{"line_number":2423,"context_line":"    ironic-baremetal_chassis_update:"},{"line_number":2424,"context_line":"      key: \"baremetal:chassis:update\""},{"line_number":2425,"context_line":"      value: \"role:admin\""},{"line_number":2426,"context_line":"    ironic-baremetal_conductor_get:"},{"line_number":2427,"context_line":"      key: \"baremetal:conductor:get\""},{"line_number":2428,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"55b1b956_c860f391","line":2425,"range":{"start_line":2425,"start_character":13,"end_line":2425,"end_character":25},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2425,"context_line":"      value: \"role:admin\""},{"line_number":2426,"context_line":"    ironic-baremetal_conductor_get:"},{"line_number":2427,"context_line":"      key: \"baremetal:conductor:get\""},{"line_number":2428,"context_line":"      value: \"role:admin\""},{"line_number":2429,"context_line":"    ironic-baremetal_deploy_template_create:"},{"line_number":2430,"context_line":"      key: \"baremetal:deploy_template:create\""},{"line_number":2431,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"2efdfbf6_682196fb","line":2428,"range":{"start_line":2428,"start_character":13,"end_line":2428,"end_character":25},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2428,"context_line":"      value: \"role:admin\""},{"line_number":2429,"context_line":"    ironic-baremetal_deploy_template_create:"},{"line_number":2430,"context_line":"      key: \"baremetal:deploy_template:create\""},{"line_number":2431,"context_line":"      value: \"role:admin\""},{"line_number":2432,"context_line":"    ironic-baremetal_deploy_template_delete:"},{"line_number":2433,"context_line":"      key: \"baremetal:deploy_template:delete\""},{"line_number":2434,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"1b4579ac_88fd2ad1","line":2431,"range":{"start_line":2431,"start_character":13,"end_line":2431,"end_character":25},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2431,"context_line":"      value: \"role:admin\""},{"line_number":2432,"context_line":"    ironic-baremetal_deploy_template_delete:"},{"line_number":2433,"context_line":"      key: \"baremetal:deploy_template:delete\""},{"line_number":2434,"context_line":"      value: \"role:admin\""},{"line_number":2435,"context_line":"    ironic-baremetal_deploy_template_get:"},{"line_number":2436,"context_line":"      key: \"baremetal:deploy_template:get\""},{"line_number":2437,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"6b07ea5c_27cd8ff8","line":2434,"range":{"start_line":2434,"start_character":13,"end_line":2434,"end_character":25},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2434,"context_line":"      value: \"role:admin\""},{"line_number":2435,"context_line":"    ironic-baremetal_deploy_template_get:"},{"line_number":2436,"context_line":"      key: \"baremetal:deploy_template:get\""},{"line_number":2437,"context_line":"      value: \"role:admin\""},{"line_number":2438,"context_line":"    ironic-baremetal_deploy_template_update:"},{"line_number":2439,"context_line":"      key: \"baremetal:deploy_template:update\""},{"line_number":2440,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"d3e63c10_5afc848a","line":2437,"range":{"start_line":2437,"start_character":13,"end_line":2437,"end_character":25},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2437,"context_line":"      value: \"role:admin\""},{"line_number":2438,"context_line":"    ironic-baremetal_deploy_template_update:"},{"line_number":2439,"context_line":"      key: \"baremetal:deploy_template:update\""},{"line_number":2440,"context_line":"      value: \"role:admin\""},{"line_number":2441,"context_line":"    ironic-baremetal_driver_get:"},{"line_number":2442,"context_line":"      key: \"baremetal:driver:get\""},{"line_number":2443,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"f4ff3912_4c37daa8","line":2440,"range":{"start_line":2440,"start_character":13,"end_line":2440,"end_character":25},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2440,"context_line":"      value: \"role:admin\""},{"line_number":2441,"context_line":"    ironic-baremetal_driver_get:"},{"line_number":2442,"context_line":"      key: \"baremetal:driver:get\""},{"line_number":2443,"context_line":"      value: \"role:admin\""},{"line_number":2444,"context_line":"    ironic-baremetal_driver_get_properties:"},{"line_number":2445,"context_line":"      key: \"baremetal:driver:get_properties\""},{"line_number":2446,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"d9882456_9e5f48c7","line":2443,"range":{"start_line":2443,"start_character":13,"end_line":2443,"end_character":25},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2443,"context_line":"      value: \"role:admin\""},{"line_number":2444,"context_line":"    ironic-baremetal_driver_get_properties:"},{"line_number":2445,"context_line":"      key: \"baremetal:driver:get_properties\""},{"line_number":2446,"context_line":"      value: \"role:admin\""},{"line_number":2447,"context_line":"    ironic-baremetal_driver_get_raid_logical_disk_properties:"},{"line_number":2448,"context_line":"      key: \"baremetal:driver:get_raid_logical_disk_properties\""},{"line_number":2449,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"512ea382_148aed9f","line":2446,"range":{"start_line":2446,"start_character":13,"end_line":2446,"end_character":25},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2446,"context_line":"      value: \"role:admin\""},{"line_number":2447,"context_line":"    ironic-baremetal_driver_get_raid_logical_disk_properties:"},{"line_number":2448,"context_line":"      key: \"baremetal:driver:get_raid_logical_disk_properties\""},{"line_number":2449,"context_line":"      value: \"role:admin\""},{"line_number":2450,"context_line":"    ironic-baremetal_driver_ipa_lookup:"},{"line_number":2451,"context_line":"      key: \"baremetal:driver:ipa_lookup\""},{"line_number":2452,"context_line":"      value: \"\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"35613f02_7449df55","line":2449,"range":{"start_line":2449,"start_character":13,"end_line":2449,"end_character":25},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2452,"context_line":"      value: \"\""},{"line_number":2453,"context_line":"    ironic-baremetal_driver_vendor_passthru:"},{"line_number":2454,"context_line":"      key: \"baremetal:driver:vendor_passthru\""},{"line_number":2455,"context_line":"      value: \"role:admin\""},{"line_number":2456,"context_line":"    ironic-baremetal_events_post:"},{"line_number":2457,"context_line":"      key: \"baremetal:events:post\""},{"line_number":2458,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"04d60191_3f9469d7","line":2455,"range":{"start_line":2455,"start_character":13,"end_line":2455,"end_character":25},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2455,"context_line":"      value: \"role:admin\""},{"line_number":2456,"context_line":"    ironic-baremetal_events_post:"},{"line_number":2457,"context_line":"      key: \"baremetal:events:post\""},{"line_number":2458,"context_line":"      value: \"role:admin\""},{"line_number":2459,"context_line":"    ironic-baremetal_node_bios_get:"},{"line_number":2460,"context_line":"      key: \"baremetal:node:bios:get\""},{"line_number":2461,"context_line":"      value: \"(role:admin) or (role:reader and (project_id:%(node.owner)s or project_id:%(node.lessee)s))\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"6cf28517_20b1d222","line":2458,"range":{"start_line":2458,"start_character":13,"end_line":2458,"end_character":25},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2458,"context_line":"      value: \"role:admin\""},{"line_number":2459,"context_line":"    ironic-baremetal_node_bios_get:"},{"line_number":2460,"context_line":"      key: \"baremetal:node:bios:get\""},{"line_number":2461,"context_line":"      value: \"(role:admin) or (role:reader and (project_id:%(node.owner)s or project_id:%(node.lessee)s))\""},{"line_number":2462,"context_line":"    ironic-baremetal_node_clear_maintenance:"},{"line_number":2463,"context_line":"      key: \"baremetal:node:clear_maintenance\""},{"line_number":2464,"context_line":"      value: \"(role:admin) or (role:member and project_id:%(node.owner)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"f9b8d5e4_0940e5b8","line":2461,"range":{"start_line":2461,"start_character":13,"end_line":2461,"end_character":106},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin) or (role:reader and (project_id:%(node.owner)s or project_id:%(node.lessee)s))\"\n\nYou know, all of the node get related activites, or get under nodes could likely be fine with the policy. and potentially just flip the order around rule:baremetal:node:get","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2461,"context_line":"      value: \"(role:admin) or (role:reader and (project_id:%(node.owner)s or project_id:%(node.lessee)s))\""},{"line_number":2462,"context_line":"    ironic-baremetal_node_clear_maintenance:"},{"line_number":2463,"context_line":"      key: \"baremetal:node:clear_maintenance\""},{"line_number":2464,"context_line":"      value: \"(role:admin) or (role:member and project_id:%(node.owner)s)\""},{"line_number":2465,"context_line":"    ironic-baremetal_node_create:"},{"line_number":2466,"context_line":"      key: \"baremetal:node:create\""},{"line_number":2467,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"37275b4e_40234bdd","line":2464,"range":{"start_line":2464,"start_character":0,"end_line":2464,"end_character":74},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin) or (role:member and (project_id:%(node.owner)s or project_id:%(node.lessee)s))\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2464,"context_line":"      value: \"(role:admin) or (role:member and project_id:%(node.owner)s)\""},{"line_number":2465,"context_line":"    ironic-baremetal_node_create:"},{"line_number":2466,"context_line":"      key: \"baremetal:node:create\""},{"line_number":2467,"context_line":"      value: \"role:admin\""},{"line_number":2468,"context_line":"    ironic-baremetal_node_delete:"},{"line_number":2469,"context_line":"      key: \"baremetal:node:delete\""},{"line_number":2470,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"597ab0b9_316d35f0","line":2467,"range":{"start_line":2467,"start_character":13,"end_line":2467,"end_character":25},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2467,"context_line":"      value: \"role:admin\""},{"line_number":2468,"context_line":"    ironic-baremetal_node_delete:"},{"line_number":2469,"context_line":"      key: \"baremetal:node:delete\""},{"line_number":2470,"context_line":"      value: \"role:admin\""},{"line_number":2471,"context_line":"    ironic-baremetal_node_disable_cleaning:"},{"line_number":2472,"context_line":"      key: \"baremetal:node:disable_cleaning\""},{"line_number":2473,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"799be660_28573481","line":2470,"range":{"start_line":2470,"start_character":2,"end_line":2470,"end_character":25},"updated":"2021-09-16 21:35:23.000000000","message":"\"(rule:baremetal_admin)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2470,"context_line":"      value: \"role:admin\""},{"line_number":2471,"context_line":"    ironic-baremetal_node_disable_cleaning:"},{"line_number":2472,"context_line":"      key: \"baremetal:node:disable_cleaning\""},{"line_number":2473,"context_line":"      value: \"role:admin\""},{"line_number":2474,"context_line":"    ironic-baremetal_node_get:"},{"line_number":2475,"context_line":"      key: \"baremetal:node:get\""},{"line_number":2476,"context_line":"      value: \"rule:baremetal:node:get:driver_info\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"907dc0ce_1ab3ecd0","line":2473,"updated":"2021-09-16 21:35:23.000000000","message":"I think the idea might make sense by now... so I\u0027m going to forgo every line saying to use rule:baremetal_admin","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":true,"context_lines":[{"line_number":2470,"context_line":"      value: \"role:admin\""},{"line_number":2471,"context_line":"    ironic-baremetal_node_disable_cleaning:"},{"line_number":2472,"context_line":"      key: \"baremetal:node:disable_cleaning\""},{"line_number":2473,"context_line":"      value: \"role:admin\""},{"line_number":2474,"context_line":"    ironic-baremetal_node_get:"},{"line_number":2475,"context_line":"      key: \"baremetal:node:get\""},{"line_number":2476,"context_line":"      value: \"rule:baremetal:node:get:driver_info\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"0615ee3d_d2fc84cf","line":2473,"in_reply_to":"907dc0ce_1ab3ecd0","updated":"2021-09-20 17:23:42.000000000","message":"Yep - I have one outstanding question above on the general idea, but once we close the loop on that I\u0027ll come back and update these if necessary.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"caffaafbb291acdcb88fa4953c71694813da3328","unresolved":true,"context_lines":[{"line_number":2507,"context_line":"    ironic-baremetal_node_ipa_heartbeat:"},{"line_number":2508,"context_line":"      key: \"baremetal:node:ipa_heartbeat\""},{"line_number":2509,"context_line":"      value: \"\""},{"line_number":2510,"context_line":"    ironic-baremetal_node_list:"},{"line_number":2511,"context_line":"      key: \"baremetal:node:list\""},{"line_number":2512,"context_line":"      value: \"role:reader\""},{"line_number":2513,"context_line":"    ironic-baremetal_node_list_all:"},{"line_number":2514,"context_line":"      key: \"baremetal:node:list_all\""},{"line_number":2515,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"348af010_bdbadd76","line":2512,"range":{"start_line":2510,"start_character":0,"end_line":2512,"end_character":26},"updated":"2021-09-13 22:25:39.000000000","message":"So are we saying any tenant reader role in this configuration is allowed to read a list of all baremetal nodes?  Traditionally this has been why we have promoted a separate project so the rules could be constrained to restrict access.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"997181ee0e5062d357f85eadf024cdb31ec03cc3","unresolved":true,"context_lines":[{"line_number":2507,"context_line":"    ironic-baremetal_node_ipa_heartbeat:"},{"line_number":2508,"context_line":"      key: \"baremetal:node:ipa_heartbeat\""},{"line_number":2509,"context_line":"      value: \"\""},{"line_number":2510,"context_line":"    ironic-baremetal_node_list:"},{"line_number":2511,"context_line":"      key: \"baremetal:node:list\""},{"line_number":2512,"context_line":"      value: \"role:reader\""},{"line_number":2513,"context_line":"    ironic-baremetal_node_list_all:"},{"line_number":2514,"context_line":"      key: \"baremetal:node:list_all\""},{"line_number":2515,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"b8b1b372_dc56842a","line":2512,"range":{"start_line":2510,"start_character":0,"end_line":2512,"end_character":26},"in_reply_to":"348af010_bdbadd76","updated":"2021-09-14 13:26:33.000000000","message":"Yes - that\u0027s what this policy would do. Should it be changed to be more restrictive? I used the current default to write this and I noticed the scope type for this policy include system and project.\n\nShould this be something else?\n\nhttps://github.com/openstack/ironic/blob/master/ironic/common/policy.py#L435-L436","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"f9ad3315cd6f8ece7a4829705b3dc233d4706ecf","unresolved":true,"context_lines":[{"line_number":2507,"context_line":"    ironic-baremetal_node_ipa_heartbeat:"},{"line_number":2508,"context_line":"      key: \"baremetal:node:ipa_heartbeat\""},{"line_number":2509,"context_line":"      value: \"\""},{"line_number":2510,"context_line":"    ironic-baremetal_node_list:"},{"line_number":2511,"context_line":"      key: \"baremetal:node:list\""},{"line_number":2512,"context_line":"      value: \"role:reader\""},{"line_number":2513,"context_line":"    ironic-baremetal_node_list_all:"},{"line_number":2514,"context_line":"      key: \"baremetal:node:list_all\""},{"line_number":2515,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"0ab388b5_8c2b2c31","line":2512,"range":{"start_line":2510,"start_character":0,"end_line":2512,"end_character":26},"in_reply_to":"4871c3a8_e7f8677b","updated":"2021-09-22 15:01:56.000000000","message":"the view is not filtered based on the requester project_id unless you don\u0027t match baremetal:node:list_all.\n\nWe need to keep in mind ironic was not a multitenant, and was a purely admin only API prior to wallaby, so the policies and modeling represent that delineation.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2507,"context_line":"    ironic-baremetal_node_ipa_heartbeat:"},{"line_number":2508,"context_line":"      key: \"baremetal:node:ipa_heartbeat\""},{"line_number":2509,"context_line":"      value: \"\""},{"line_number":2510,"context_line":"    ironic-baremetal_node_list:"},{"line_number":2511,"context_line":"      key: \"baremetal:node:list\""},{"line_number":2512,"context_line":"      value: \"role:reader\""},{"line_number":2513,"context_line":"    ironic-baremetal_node_list_all:"},{"line_number":2514,"context_line":"      key: \"baremetal:node:list_all\""},{"line_number":2515,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"f14a1ffb_f145aa9c","line":2512,"range":{"start_line":2510,"start_character":0,"end_line":2512,"end_character":26},"in_reply_to":"b8b1b372_dc56842a","updated":"2021-09-16 21:35:23.000000000","message":"Yeah, role:reader and project_name:baremetal or role:reader and project_name:service\n\nI think....","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":true,"context_lines":[{"line_number":2507,"context_line":"    ironic-baremetal_node_ipa_heartbeat:"},{"line_number":2508,"context_line":"      key: \"baremetal:node:ipa_heartbeat\""},{"line_number":2509,"context_line":"      value: \"\""},{"line_number":2510,"context_line":"    ironic-baremetal_node_list:"},{"line_number":2511,"context_line":"      key: \"baremetal:node:list\""},{"line_number":2512,"context_line":"      value: \"role:reader\""},{"line_number":2513,"context_line":"    ironic-baremetal_node_list_all:"},{"line_number":2514,"context_line":"      key: \"baremetal:node:list_all\""},{"line_number":2515,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"4871c3a8_e7f8677b","line":2512,"range":{"start_line":2510,"start_character":0,"end_line":2512,"end_character":26},"in_reply_to":"f14a1ffb_f145aa9c","updated":"2021-09-20 17:23:42.000000000","message":"Ok - similar question here, should we open this up to role:admin (in addition to the changes you propose) so that admin functionality is consistent with the rest of OpenStack?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"caffaafbb291acdcb88fa4953c71694813da3328","unresolved":true,"context_lines":[{"line_number":2528,"context_line":"    ironic-baremetal_node_set_maintenance:"},{"line_number":2529,"context_line":"      key: \"baremetal:node:set_maintenance\""},{"line_number":2530,"context_line":"      value: \"rule:baremetal:node:set_boot_device\""},{"line_number":2531,"context_line":"    ironic-baremetal_node_set_power_state:"},{"line_number":2532,"context_line":"      key: \"baremetal:node:set_power_state\""},{"line_number":2533,"context_line":"      value: \"rule:baremetal:node:set_secure_boot\""},{"line_number":2534,"context_line":"    ironic-baremetal_node_set_provision_state:"},{"line_number":2535,"context_line":"      key: \"baremetal:node:set_provision_state\""},{"line_number":2536,"context_line":"      value: \"(role:admin) or (role:member and project_id:%(node.owner)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"0c1bd534_54b4664a","line":2533,"range":{"start_line":2531,"start_character":0,"end_line":2533,"end_character":50},"updated":"2021-09-13 22:25:39.000000000","message":"Huh? So, fwiw, set_secure_boot is a xena feature.  But why does setting power state go to set_secure_boot?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"997181ee0e5062d357f85eadf024cdb31ec03cc3","unresolved":true,"context_lines":[{"line_number":2528,"context_line":"    ironic-baremetal_node_set_maintenance:"},{"line_number":2529,"context_line":"      key: \"baremetal:node:set_maintenance\""},{"line_number":2530,"context_line":"      value: \"rule:baremetal:node:set_boot_device\""},{"line_number":2531,"context_line":"    ironic-baremetal_node_set_power_state:"},{"line_number":2532,"context_line":"      key: \"baremetal:node:set_power_state\""},{"line_number":2533,"context_line":"      value: \"rule:baremetal:node:set_secure_boot\""},{"line_number":2534,"context_line":"    ironic-baremetal_node_set_provision_state:"},{"line_number":2535,"context_line":"      key: \"baremetal:node:set_provision_state\""},{"line_number":2536,"context_line":"      value: \"(role:admin) or (role:member and project_id:%(node.owner)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"f07792ca_a47ad784","line":2533,"range":{"start_line":2531,"start_character":0,"end_line":2533,"end_character":50},"in_reply_to":"0c1bd534_54b4664a","updated":"2021-09-14 13:26:33.000000000","message":"I used the samples generated from each service and worked backwards to get to something consistent (e.g., project personas).\n\nThis is aliasing the set_power_state to set_secure_boot because the default defined in code is using deprecated_node_set_power_state [0]. So are set_boot_mode and set_secure_boot [1]. Was that intentional or a copy/paste issue?\n\n[0] https://github.com/openstack/ironic/blob/master/ironic/common/policy.py#L763-L772\n[1] https://github.com/openstack/ironic/blob/master/ironic/common/policy.py#L773-L792","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":true,"context_lines":[{"line_number":2528,"context_line":"    ironic-baremetal_node_set_maintenance:"},{"line_number":2529,"context_line":"      key: \"baremetal:node:set_maintenance\""},{"line_number":2530,"context_line":"      value: \"rule:baremetal:node:set_boot_device\""},{"line_number":2531,"context_line":"    ironic-baremetal_node_set_power_state:"},{"line_number":2532,"context_line":"      key: \"baremetal:node:set_power_state\""},{"line_number":2533,"context_line":"      value: \"rule:baremetal:node:set_secure_boot\""},{"line_number":2534,"context_line":"    ironic-baremetal_node_set_provision_state:"},{"line_number":2535,"context_line":"      key: \"baremetal:node:set_provision_state\""},{"line_number":2536,"context_line":"      value: \"(role:admin) or (role:member and project_id:%(node.owner)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"9e59a592_d3cbb996","line":2533,"range":{"start_line":2531,"start_character":0,"end_line":2533,"end_character":50},"in_reply_to":"29e4bb21_1d79e008","updated":"2021-09-20 17:23:42.000000000","message":"Ok - that part makes sense. I\u0027ll wait to update this until we figure out if we want to incorporate the role:admin check per the discussions/comments above.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2528,"context_line":"    ironic-baremetal_node_set_maintenance:"},{"line_number":2529,"context_line":"      key: \"baremetal:node:set_maintenance\""},{"line_number":2530,"context_line":"      value: \"rule:baremetal:node:set_boot_device\""},{"line_number":2531,"context_line":"    ironic-baremetal_node_set_power_state:"},{"line_number":2532,"context_line":"      key: \"baremetal:node:set_power_state\""},{"line_number":2533,"context_line":"      value: \"rule:baremetal:node:set_secure_boot\""},{"line_number":2534,"context_line":"    ironic-baremetal_node_set_provision_state:"},{"line_number":2535,"context_line":"      key: \"baremetal:node:set_provision_state\""},{"line_number":2536,"context_line":"      value: \"(role:admin) or (role:member and project_id:%(node.owner)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"29e4bb21_1d79e008","line":2533,"range":{"start_line":2531,"start_character":0,"end_line":2533,"end_character":50},"in_reply_to":"f07792ca_a47ad784","updated":"2021-09-16 21:35:23.000000000","message":"Eh, its because we need to have something still backing the new rules because the behavior is actually a little different. It all goes back to set_secure_boot being brand new.\n\nSo realistically this should be something like:\n\nrule:baremetal_admin or (role:member and (project_id:%(node.owner)s or project_id:%(node.lessee)s))\n\nOr just baremetal_admin.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"caffaafbb291acdcb88fa4953c71694813da3328","unresolved":true,"context_lines":[{"line_number":2609,"context_line":"    ironic-baremetal_node_vif_list:"},{"line_number":2610,"context_line":"      key: \"baremetal:node:vif:list\""},{"line_number":2611,"context_line":"      value: \"(role:admin) or (role:reader and (project_id:%(node.owner)s or project_id:%(node.lessee)s))\""},{"line_number":2612,"context_line":"    ironic-baremetal_port_create:"},{"line_number":2613,"context_line":"      key: \"baremetal:port:create\""},{"line_number":2614,"context_line":"      value: \"role:admin\""},{"line_number":2615,"context_line":"    ironic-baremetal_port_delete:"},{"line_number":2616,"context_line":"      key: \"baremetal:port:delete\""},{"line_number":2617,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"6f33a39b_d8200af3","line":2614,"range":{"start_line":2612,"start_character":0,"end_line":2614,"end_character":25},"updated":"2021-09-13 22:25:39.000000000","message":"So any project admin can create a physical port record?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"f9ad3315cd6f8ece7a4829705b3dc233d4706ecf","unresolved":true,"context_lines":[{"line_number":2609,"context_line":"    ironic-baremetal_node_vif_list:"},{"line_number":2610,"context_line":"      key: \"baremetal:node:vif:list\""},{"line_number":2611,"context_line":"      value: \"(role:admin) or (role:reader and (project_id:%(node.owner)s or project_id:%(node.lessee)s))\""},{"line_number":2612,"context_line":"    ironic-baremetal_port_create:"},{"line_number":2613,"context_line":"      key: \"baremetal:port:create\""},{"line_number":2614,"context_line":"      value: \"role:admin\""},{"line_number":2615,"context_line":"    ironic-baremetal_port_delete:"},{"line_number":2616,"context_line":"      key: \"baremetal:port:delete\""},{"line_number":2617,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"fb58735b_a235e3cd","line":2614,"range":{"start_line":2612,"start_character":0,"end_line":2614,"end_character":25},"in_reply_to":"49635628_c2a452a4","updated":"2021-09-22 15:01:56.000000000","message":"so that essentially makes openstack deployments single tenant... :\\ I mean, if that is the take we\u0027re going to head down, most of my suggestions can just be dropped and if end users wishing to run multi-tenant then they *would* need to operate the deployment like such. Or you know, we potentially support custom policy usage.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"997181ee0e5062d357f85eadf024cdb31ec03cc3","unresolved":true,"context_lines":[{"line_number":2609,"context_line":"    ironic-baremetal_node_vif_list:"},{"line_number":2610,"context_line":"      key: \"baremetal:node:vif:list\""},{"line_number":2611,"context_line":"      value: \"(role:admin) or (role:reader and (project_id:%(node.owner)s or project_id:%(node.lessee)s))\""},{"line_number":2612,"context_line":"    ironic-baremetal_port_create:"},{"line_number":2613,"context_line":"      key: \"baremetal:port:create\""},{"line_number":2614,"context_line":"      value: \"role:admin\""},{"line_number":2615,"context_line":"    ironic-baremetal_port_delete:"},{"line_number":2616,"context_line":"      key: \"baremetal:port:delete\""},{"line_number":2617,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"49635628_c2a452a4","line":2614,"range":{"start_line":2612,"start_character":0,"end_line":2614,"end_character":25},"in_reply_to":"6f33a39b_d8200af3","updated":"2021-09-14 13:26:33.000000000","message":"Yes - with this policy file, project-admins are considered operators or deployers (system-admins).","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2645,"context_line":"    ironic-baremetal_portgroup_update:"},{"line_number":2646,"context_line":"      key: \"baremetal:portgroup:update\""},{"line_number":2647,"context_line":"      value: \"role:admin\""},{"line_number":2648,"context_line":"    ironic-baremetal_reader:"},{"line_number":2649,"context_line":"      key: \"baremetal_reader\""},{"line_number":2650,"context_line":"      value: \"role:reader and project_name:baremetal and project_domain_id:default\""},{"line_number":2651,"context_line":"    ironic-baremetal_volume_create:"}],"source_content_type":"text/x-yaml","patch_set":22,"id":"cc845dad_abc03c70","line":2648,"range":{"start_line":2648,"start_character":0,"end_line":2648,"end_character":28},"updated":"2021-09-16 21:35:23.000000000","message":"it could be that something like\n\n\"rule:baremetal_reader\" could make sense for things like port/volume target/connector listings, as well as the baremetal:node:get rule.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2526d8f51368f048554b3c41f9f3995e90cd564b","unresolved":true,"context_lines":[{"line_number":2647,"context_line":"      value: \"role:admin\""},{"line_number":2648,"context_line":"    ironic-baremetal_reader:"},{"line_number":2649,"context_line":"      key: \"baremetal_reader\""},{"line_number":2650,"context_line":"      value: \"role:reader and project_name:baremetal and project_domain_id:default\""},{"line_number":2651,"context_line":"    ironic-baremetal_volume_create:"},{"line_number":2652,"context_line":"      key: \"baremetal:volume:create\""},{"line_number":2653,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"8fbac4dc_41a3268e","line":2650,"updated":"2021-09-16 21:35:23.000000000","message":"We should likely include the service project so nova can read/interact with ironic.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"f9ad3315cd6f8ece7a4829705b3dc233d4706ecf","unresolved":true,"context_lines":[{"line_number":2647,"context_line":"      value: \"role:admin\""},{"line_number":2648,"context_line":"    ironic-baremetal_reader:"},{"line_number":2649,"context_line":"      key: \"baremetal_reader\""},{"line_number":2650,"context_line":"      value: \"role:reader and project_name:baremetal and project_domain_id:default\""},{"line_number":2651,"context_line":"    ironic-baremetal_volume_create:"},{"line_number":2652,"context_line":"      key: \"baremetal:volume:create\""},{"line_number":2653,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"c43fd6e6_903ef86f","line":2650,"in_reply_to":"18b09c85_816ddd8e","updated":"2021-09-22 15:01:56.000000000","message":"traditionally, it has admin on the service project.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":true,"context_lines":[{"line_number":2647,"context_line":"      value: \"role:admin\""},{"line_number":2648,"context_line":"    ironic-baremetal_reader:"},{"line_number":2649,"context_line":"      key: \"baremetal_reader\""},{"line_number":2650,"context_line":"      value: \"role:reader and project_name:baremetal and project_domain_id:default\""},{"line_number":2651,"context_line":"    ironic-baremetal_volume_create:"},{"line_number":2652,"context_line":"      key: \"baremetal:volume:create\""},{"line_number":2653,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"18b09c85_816ddd8e","line":2650,"in_reply_to":"8fbac4dc_41a3268e","updated":"2021-09-20 17:23:42.000000000","message":"I think the nova service user is given the admin role?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"74defc0ce8a66ed9470a07c76c79915e61e8e5a3","unresolved":true,"context_lines":[{"line_number":2703,"context_line":"      value: \"role:admin\""},{"line_number":2704,"context_line":"    designate-create_recordset:"},{"line_number":2705,"context_line":"      key: \"create_recordset\""},{"line_number":2706,"context_line":"      value: \"role:admin and (SECONDARY:%(zone_type)s)\""},{"line_number":2707,"context_line":"    designate-create_tld:"},{"line_number":2708,"context_line":"      key: \"create_tld\""},{"line_number":2709,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"3adea896_6ecb6974","line":2706,"updated":"2021-09-14 00:06:12.000000000","message":"\"(role:member and project_id:%(project_id)s) and (\u0027PRIMARY\u0027:%(zone_type)s) or role:admin and (\u0027PRIMARY\u0027:%(zone_type)s) or role:admin and (\u0027SECONDARY\u0027:%(zone_type)s)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"a5d0d37b7471eb0deb2e306c9e1d400ec6dd070c","unresolved":true,"context_lines":[{"line_number":2703,"context_line":"      value: \"role:admin\""},{"line_number":2704,"context_line":"    designate-create_recordset:"},{"line_number":2705,"context_line":"      key: \"create_recordset\""},{"line_number":2706,"context_line":"      value: \"role:admin and (SECONDARY:%(zone_type)s)\""},{"line_number":2707,"context_line":"    designate-create_tld:"},{"line_number":2708,"context_line":"      key: \"create_tld\""},{"line_number":2709,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"4a7f7ea6_f87cfe0e","line":2706,"in_reply_to":"1da284c6_6f6a8c6c","updated":"2021-09-21 19:12:53.000000000","message":"No","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":true,"context_lines":[{"line_number":2703,"context_line":"      value: \"role:admin\""},{"line_number":2704,"context_line":"    designate-create_recordset:"},{"line_number":2705,"context_line":"      key: \"create_recordset\""},{"line_number":2706,"context_line":"      value: \"role:admin and (SECONDARY:%(zone_type)s)\""},{"line_number":2707,"context_line":"    designate-create_tld:"},{"line_number":2708,"context_line":"      key: \"create_tld\""},{"line_number":2709,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"1da284c6_6f6a8c6c","line":2706,"in_reply_to":"3adea896_6ecb6974","updated":"2021-09-20 17:23:42.000000000","message":"Are the last two conditionals (secondary admin and primary admin) always true?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"74defc0ce8a66ed9470a07c76c79915e61e8e5a3","unresolved":true,"context_lines":[{"line_number":2721,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":2722,"context_line":"    designate-create_zone_transfer_accept:"},{"line_number":2723,"context_line":"      key: \"create_zone_transfer_accept\""},{"line_number":2724,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":2725,"context_line":"    designate-create_zone_transfer_request:"},{"line_number":2726,"context_line":"      key: \"create_zone_transfer_request\""},{"line_number":2727,"context_line":"      value: \"role:admin or (role:reader and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"6fb0dad2_2dca3e02","line":2724,"updated":"2021-09-14 00:06:12.000000000","message":"\"(role:admin or (role:member and project_id:%(project_id)s)) or project_id:%(target_project_id)s or None:%(target_project_id)s\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":true,"context_lines":[{"line_number":2721,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":2722,"context_line":"    designate-create_zone_transfer_accept:"},{"line_number":2723,"context_line":"      key: \"create_zone_transfer_accept\""},{"line_number":2724,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":2725,"context_line":"    designate-create_zone_transfer_request:"},{"line_number":2726,"context_line":"      key: \"create_zone_transfer_request\""},{"line_number":2727,"context_line":"      value: \"role:admin or (role:reader and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"cceb6227_f5686b18","line":2724,"in_reply_to":"6fb0dad2_2dca3e02","updated":"2021-09-20 17:23:42.000000000","message":"What are the last two checks for here?","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"74defc0ce8a66ed9470a07c76c79915e61e8e5a3","unresolved":true,"context_lines":[{"line_number":2733,"context_line":"      value: \"role:admin\""},{"line_number":2734,"context_line":"    designate-delete_recordset:"},{"line_number":2735,"context_line":"      key: \"delete_recordset\""},{"line_number":2736,"context_line":"      value: \"role:admin and (SECONDARY:%(zone_type)s)\""},{"line_number":2737,"context_line":"    designate-delete_tld:"},{"line_number":2738,"context_line":"      key: \"delete_tld\""},{"line_number":2739,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"3e13b87f_610a1acf","line":2736,"updated":"2021-09-14 00:06:12.000000000","message":"\"(role:member and project_id:%(project_id)s) and (\u0027PRIMARY\u0027:%(zone_type)s) or role:admin and (\u0027PRIMARY\u0027:%(zone_type)s) or role:admin and (\u0027SECONDARY\u0027:%(zone_type)s)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":2733,"context_line":"      value: \"role:admin\""},{"line_number":2734,"context_line":"    designate-delete_recordset:"},{"line_number":2735,"context_line":"      key: \"delete_recordset\""},{"line_number":2736,"context_line":"      value: \"role:admin and (SECONDARY:%(zone_type)s)\""},{"line_number":2737,"context_line":"    designate-delete_tld:"},{"line_number":2738,"context_line":"      key: \"delete_tld\""},{"line_number":2739,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"932d2852_8a51d2b3","line":2736,"in_reply_to":"3e13b87f_610a1acf","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"74defc0ce8a66ed9470a07c76c79915e61e8e5a3","unresolved":true,"context_lines":[{"line_number":2862,"context_line":"      value: \"(role:admin) or (role:reader and project_id:%(project_id)s)\""},{"line_number":2863,"context_line":"    designate-get_zone_transfer_request:"},{"line_number":2864,"context_line":"      key: \"get_zone_transfer_request\""},{"line_number":2865,"context_line":"      value: \"role:admin or (role:reader and project_id:%(project_id)s)\""},{"line_number":2866,"context_line":"    designate-get_zone_transfer_request_detailed:"},{"line_number":2867,"context_line":"      key: \"get_zone_transfer_request_detailed\""},{"line_number":2868,"context_line":"      value: \"role:admin or (role:reader and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"adb483e6_1c994224","line":2865,"updated":"2021-09-14 00:06:12.000000000","message":"\"(role:admin or (role:member and project_id:%(project_id)s)) or project_id:%(target_project_id)s or None:%(target_project_id)s\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":true,"context_lines":[{"line_number":2862,"context_line":"      value: \"(role:admin) or (role:reader and project_id:%(project_id)s)\""},{"line_number":2863,"context_line":"    designate-get_zone_transfer_request:"},{"line_number":2864,"context_line":"      key: \"get_zone_transfer_request\""},{"line_number":2865,"context_line":"      value: \"role:admin or (role:reader and project_id:%(project_id)s)\""},{"line_number":2866,"context_line":"    designate-get_zone_transfer_request_detailed:"},{"line_number":2867,"context_line":"      key: \"get_zone_transfer_request_detailed\""},{"line_number":2868,"context_line":"      value: \"role:admin or (role:reader and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"6c468c25_b5af399a","line":2865,"in_reply_to":"adb483e6_1c994224","updated":"2021-09-20 17:23:42.000000000","message":"Same question here as above.","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"74defc0ce8a66ed9470a07c76c79915e61e8e5a3","unresolved":true,"context_lines":[{"line_number":2871,"context_line":"      value: \"role:admin or (role:reader and project_id:%(project_id)s)\""},{"line_number":2872,"context_line":"    designate-purge_zones:"},{"line_number":2873,"context_line":"      key: \"purge_zones\""},{"line_number":2874,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":2875,"context_line":"    designate-reset_quotas:"},{"line_number":2876,"context_line":"      key: \"reset_quotas\""},{"line_number":2877,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"1315b63e_5856c8d1","line":2874,"updated":"2021-09-14 00:06:12.000000000","message":"\"role:admin\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":2871,"context_line":"      value: \"role:admin or (role:reader and project_id:%(project_id)s)\""},{"line_number":2872,"context_line":"    designate-purge_zones:"},{"line_number":2873,"context_line":"      key: \"purge_zones\""},{"line_number":2874,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":2875,"context_line":"    designate-reset_quotas:"},{"line_number":2876,"context_line":"      key: \"reset_quotas\""},{"line_number":2877,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"c0369d5f_f202517a","line":2874,"in_reply_to":"1315b63e_5856c8d1","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"74defc0ce8a66ed9470a07c76c79915e61e8e5a3","unresolved":true,"context_lines":[{"line_number":2889,"context_line":"      value: \"role:admin\""},{"line_number":2890,"context_line":"    designate-update_recordset:"},{"line_number":2891,"context_line":"      key: \"update_recordset\""},{"line_number":2892,"context_line":"      value: \"role:admin and (SECONDARY:%(zone_type)s)\""},{"line_number":2893,"context_line":"    designate-update_service_status:"},{"line_number":2894,"context_line":"      key: \"update_service_status\""},{"line_number":2895,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"635c54cd_2c24080d","line":2892,"updated":"2021-09-14 00:06:12.000000000","message":"\"(role:member and project_id:%(project_id)s) and (\u0027PRIMARY\u0027:%(zone_type)s) or role:admin and (\u0027PRIMARY\u0027:%(zone_type)s) or role:admin and (\u0027SECONDARY\u0027:%(zone_type)s)\"","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50dfa07a7b4003977aa395a0eb4d1ef6e9b0ade","unresolved":false,"context_lines":[{"line_number":2889,"context_line":"      value: \"role:admin\""},{"line_number":2890,"context_line":"    designate-update_recordset:"},{"line_number":2891,"context_line":"      key: \"update_recordset\""},{"line_number":2892,"context_line":"      value: \"role:admin and (SECONDARY:%(zone_type)s)\""},{"line_number":2893,"context_line":"    designate-update_service_status:"},{"line_number":2894,"context_line":"      key: \"update_service_status\""},{"line_number":2895,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":22,"id":"47035a07_a5253934","line":2892,"in_reply_to":"635c54cd_2c24080d","updated":"2021-09-20 17:23:42.000000000","message":"Done","commit_id":"d7ee0156d774f52d0824e70b73d0c4290c6c9119"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"fef5268a0d6ab5c9a97867fe07dbdf8e93ea4cdd","unresolved":true,"context_lines":[{"line_number":807,"context_line":"  GlanceApiPolicies:"},{"line_number":808,"context_line":"    glance-add_image:"},{"line_number":809,"context_line":"      key: \"add_image\""},{"line_number":810,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s and project_id:%(owner)s)\""},{"line_number":811,"context_line":"    glance-add_member:"},{"line_number":812,"context_line":"      key: \"add_member\""},{"line_number":813,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"95f2c510_a210340e","line":810,"range":{"start_line":810,"start_character":45,"end_line":810,"end_character":95},"updated":"2021-09-22 13:50:05.000000000","message":"Aren\u0027t these two the same thing?","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"9a63c5750647a84cfac8c456a88f072b95ae8ebc","unresolved":true,"context_lines":[{"line_number":807,"context_line":"  GlanceApiPolicies:"},{"line_number":808,"context_line":"    glance-add_image:"},{"line_number":809,"context_line":"      key: \"add_image\""},{"line_number":810,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s and project_id:%(owner)s)\""},{"line_number":811,"context_line":"    glance-add_member:"},{"line_number":812,"context_line":"      key: \"add_member\""},{"line_number":813,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"3a4f38b9_85a31272","line":810,"range":{"start_line":810,"start_character":45,"end_line":810,"end_character":95},"in_reply_to":"080d7588_e1c09b8c","updated":"2021-09-24 14:43:21.000000000","message":"To answer Erno\u0027s question, we can pass owner as a input while creating image and somewhere in our readonly checks (authorization layer/policy layer or db layer) we check whether owner is same as project id or not.\n\nAs we have policy enforcement in the API layer this policy avoid those readonly checks.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"eb7535bfc4a9137b0f41b360101c3817b3255ff8","unresolved":true,"context_lines":[{"line_number":807,"context_line":"  GlanceApiPolicies:"},{"line_number":808,"context_line":"    glance-add_image:"},{"line_number":809,"context_line":"      key: \"add_image\""},{"line_number":810,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s and project_id:%(owner)s)\""},{"line_number":811,"context_line":"    glance-add_member:"},{"line_number":812,"context_line":"      key: \"add_member\""},{"line_number":813,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"080d7588_e1c09b8c","line":810,"range":{"start_line":810,"start_character":45,"end_line":810,"end_character":95},"in_reply_to":"95f2c510_a210340e","updated":"2021-09-22 15:36:18.000000000","message":"It depends on how glance calls enforcement. If the target is passed in with project_id or owner.\n\nThis is the default check string: https://github.com/openstack/glance/blob/master/glance/policies/base.py#L78","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"fef5268a0d6ab5c9a97867fe07dbdf8e93ea4cdd","unresolved":true,"context_lines":[{"line_number":816,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":817,"context_line":"    glance-copy_image:"},{"line_number":818,"context_line":"      key: \"copy_image\""},{"line_number":819,"context_line":"      value: \"role:admin\""},{"line_number":820,"context_line":"    glance-deactivate:"},{"line_number":821,"context_line":"      key: \"deactivate\""},{"line_number":822,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"c63a4c6f_93ed4e6c","line":819,"updated":"2021-09-22 13:50:05.000000000","message":"I\u0027d say sensible default would be \"role:admin or (role:member and project_id:%(project_id)s)\" not relying the admin needing to copy the image between different stores.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"9a63c5750647a84cfac8c456a88f072b95ae8ebc","unresolved":true,"context_lines":[{"line_number":816,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":817,"context_line":"    glance-copy_image:"},{"line_number":818,"context_line":"      key: \"copy_image\""},{"line_number":819,"context_line":"      value: \"role:admin\""},{"line_number":820,"context_line":"    glance-deactivate:"},{"line_number":821,"context_line":"      key: \"deactivate\""},{"line_number":822,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"be66575d_12193091","line":819,"in_reply_to":"c63a4c6f_93ed4e6c","updated":"2021-09-24 14:43:21.000000000","message":"I think the existing default policy for copy image was admin only [1]\n[1] https://github.com/openstack/glance/blob/stable/wallaby/glance/policies/image.py#L321\n\nSo if we want to change it then I think we need to follow deprecation process here.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"fef5268a0d6ab5c9a97867fe07dbdf8e93ea4cdd","unresolved":true,"context_lines":[{"line_number":819,"context_line":"      value: \"role:admin\""},{"line_number":820,"context_line":"    glance-deactivate:"},{"line_number":821,"context_line":"      key: \"deactivate\""},{"line_number":822,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":823,"context_line":"    glance-delete_image:"},{"line_number":824,"context_line":"      key: \"delete_image\""},{"line_number":825,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"dcf29eb6_8ed0ea01","line":822,"updated":"2021-09-22 13:50:05.000000000","message":"This is correct, owner should be able to deactivate the image should they suspect something being wrong with it. REF my comment on reactivate L864","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"fef5268a0d6ab5c9a97867fe07dbdf8e93ea4cdd","unresolved":true,"context_lines":[{"line_number":825,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":826,"context_line":"    glance-delete_image_location:"},{"line_number":827,"context_line":"      key: \"delete_image_location\""},{"line_number":828,"context_line":"      value: \"role:admin\""},{"line_number":829,"context_line":"    glance-delete_member:"},{"line_number":830,"context_line":"      key: \"delete_member\""},{"line_number":831,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"3ec77335_1f37cdd8","line":828,"updated":"2021-09-22 13:50:05.000000000","message":"This should probably include role:member and project_id:%(project_id)s to allow the member to use the delete from store.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"9a63c5750647a84cfac8c456a88f072b95ae8ebc","unresolved":true,"context_lines":[{"line_number":825,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":826,"context_line":"    glance-delete_image_location:"},{"line_number":827,"context_line":"      key: \"delete_image_location\""},{"line_number":828,"context_line":"      value: \"role:admin\""},{"line_number":829,"context_line":"    glance-delete_member:"},{"line_number":830,"context_line":"      key: \"delete_member\""},{"line_number":831,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"183ace3b_9de055bc","line":828,"in_reply_to":"3ec77335_1f37cdd8","updated":"2021-09-24 14:43:21.000000000","message":"ditto","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"fef5268a0d6ab5c9a97867fe07dbdf8e93ea4cdd","unresolved":true,"context_lines":[{"line_number":828,"context_line":"      value: \"role:admin\""},{"line_number":829,"context_line":"    glance-delete_member:"},{"line_number":830,"context_line":"      key: \"delete_member\""},{"line_number":831,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":832,"context_line":"    glance-download_image:"},{"line_number":833,"context_line":"      key: \"download_image\""},{"line_number":834,"context_line":"      value: \u0027role:admin or (role:member and (project_id:%(project_id)s or project_id:%(member_id)s or \"community\":%(visibility)s or \"public\":%(visibility)s or \"shared\":%(visibility)s))\u0027"}],"source_content_type":"text/x-yaml","patch_set":23,"id":"00940129_b73a1412","line":831,"updated":"2021-09-22 13:50:05.000000000","message":"This should probably include role:member project_id:%(member_id)s to allow the member to remove itself from the image.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"9a63c5750647a84cfac8c456a88f072b95ae8ebc","unresolved":true,"context_lines":[{"line_number":828,"context_line":"      value: \"role:admin\""},{"line_number":829,"context_line":"    glance-delete_member:"},{"line_number":830,"context_line":"      key: \"delete_member\""},{"line_number":831,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":832,"context_line":"    glance-download_image:"},{"line_number":833,"context_line":"      key: \"download_image\""},{"line_number":834,"context_line":"      value: \u0027role:admin or (role:member and (project_id:%(project_id)s or project_id:%(member_id)s or \"community\":%(visibility)s or \"public\":%(visibility)s or \"shared\":%(visibility)s))\u0027"}],"source_content_type":"text/x-yaml","patch_set":23,"id":"6b7b3c33_7ea26a14","line":831,"in_reply_to":"00940129_b73a1412","updated":"2021-09-24 14:43:21.000000000","message":"ditto","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"fef5268a0d6ab5c9a97867fe07dbdf8e93ea4cdd","unresolved":true,"context_lines":[{"line_number":831,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":832,"context_line":"    glance-download_image:"},{"line_number":833,"context_line":"      key: \"download_image\""},{"line_number":834,"context_line":"      value: \u0027role:admin or (role:member and (project_id:%(project_id)s or project_id:%(member_id)s or \"community\":%(visibility)s or \"public\":%(visibility)s or \"shared\":%(visibility)s))\u0027"},{"line_number":835,"context_line":"    glance-get_image:"},{"line_number":836,"context_line":"      key: \"get_image\""},{"line_number":837,"context_line":"      value: \u0027role:admin or (role:reader and (project_id:%(project_id)s or project_id:%(member_id)s or \"community\":%(visibility)s or \"public\":%(visibility)s or \"shared\":%(visibility)s))\u0027"}],"source_content_type":"text/x-yaml","patch_set":23,"id":"44c70e88_d75fb1a5","line":834,"updated":"2021-09-22 13:50:05.000000000","message":"\"shared\" is the default visibility but the membership is defining with whom. Also IIRC we do not wipe the members list in a case image gets transitioned from \"shared\" to \"private\" so member is also not sufficient alone.\n\nI guess we really should have the enforcement as \u0027(role:member and (... or (\"shared\":%(visibility)s and project_id:%(member_id)s)...)\u0027","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"9a63c5750647a84cfac8c456a88f072b95ae8ebc","unresolved":true,"context_lines":[{"line_number":831,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":832,"context_line":"    glance-download_image:"},{"line_number":833,"context_line":"      key: \"download_image\""},{"line_number":834,"context_line":"      value: \u0027role:admin or (role:member and (project_id:%(project_id)s or project_id:%(member_id)s or \"community\":%(visibility)s or \"public\":%(visibility)s or \"shared\":%(visibility)s))\u0027"},{"line_number":835,"context_line":"    glance-get_image:"},{"line_number":836,"context_line":"      key: \"get_image\""},{"line_number":837,"context_line":"      value: \u0027role:admin or (role:reader and (project_id:%(project_id)s or project_id:%(member_id)s or \"community\":%(visibility)s or \"public\":%(visibility)s or \"shared\":%(visibility)s))\u0027"}],"source_content_type":"text/x-yaml","patch_set":23,"id":"da8b61bd_5082813b","line":834,"in_reply_to":"44c70e88_d75fb1a5","updated":"2021-09-24 14:43:21.000000000","message":"AFAIK and tested we have built these policy string considering all read only checks at various places, if you think of any particular scenario I would like to test it first.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"fef5268a0d6ab5c9a97867fe07dbdf8e93ea4cdd","unresolved":true,"context_lines":[{"line_number":834,"context_line":"      value: \u0027role:admin or (role:member and (project_id:%(project_id)s or project_id:%(member_id)s or \"community\":%(visibility)s or \"public\":%(visibility)s or \"shared\":%(visibility)s))\u0027"},{"line_number":835,"context_line":"    glance-get_image:"},{"line_number":836,"context_line":"      key: \"get_image\""},{"line_number":837,"context_line":"      value: \u0027role:admin or (role:reader and (project_id:%(project_id)s or project_id:%(member_id)s or \"community\":%(visibility)s or \"public\":%(visibility)s or \"shared\":%(visibility)s))\u0027"},{"line_number":838,"context_line":"    glance-get_image_location:"},{"line_number":839,"context_line":"      key: \"get_image_location\""},{"line_number":840,"context_line":"      value: \"role:admin or (role:reader and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"4ea221e2_2b0f5d90","line":837,"updated":"2021-09-22 13:50:05.000000000","message":"Ditto","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"9a63c5750647a84cfac8c456a88f072b95ae8ebc","unresolved":true,"context_lines":[{"line_number":834,"context_line":"      value: \u0027role:admin or (role:member and (project_id:%(project_id)s or project_id:%(member_id)s or \"community\":%(visibility)s or \"public\":%(visibility)s or \"shared\":%(visibility)s))\u0027"},{"line_number":835,"context_line":"    glance-get_image:"},{"line_number":836,"context_line":"      key: \"get_image\""},{"line_number":837,"context_line":"      value: \u0027role:admin or (role:reader and (project_id:%(project_id)s or project_id:%(member_id)s or \"community\":%(visibility)s or \"public\":%(visibility)s or \"shared\":%(visibility)s))\u0027"},{"line_number":838,"context_line":"    glance-get_image_location:"},{"line_number":839,"context_line":"      key: \"get_image_location\""},{"line_number":840,"context_line":"      value: \"role:admin or (role:reader and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"2a0cb263_b691a734","line":837,"in_reply_to":"4ea221e2_2b0f5d90","updated":"2021-09-24 14:43:21.000000000","message":"ditto","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"fef5268a0d6ab5c9a97867fe07dbdf8e93ea4cdd","unresolved":true,"context_lines":[{"line_number":846,"context_line":"      value: \"role:admin or role:reader and (project_id:%(project_id)s or project_id:%(member_id)s)\""},{"line_number":847,"context_line":"    glance-get_members:"},{"line_number":848,"context_line":"      key: \"get_members\""},{"line_number":849,"context_line":"      value: \"role:admin or role:reader and (project_id:%(project_id)s or project_id:%(member_id)s)\""},{"line_number":850,"context_line":"    glance-manage_image_cache:"},{"line_number":851,"context_line":"      key: \"manage_image_cache\""},{"line_number":852,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"1ad7c408_fda28e09","line":849,"range":{"start_line":849,"start_character":74,"end_line":849,"end_character":98},"updated":"2021-09-22 13:50:05.000000000","message":"Not sure why member should be able to list other members of the image.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"9a63c5750647a84cfac8c456a88f072b95ae8ebc","unresolved":true,"context_lines":[{"line_number":846,"context_line":"      value: \"role:admin or role:reader and (project_id:%(project_id)s or project_id:%(member_id)s)\""},{"line_number":847,"context_line":"    glance-get_members:"},{"line_number":848,"context_line":"      key: \"get_members\""},{"line_number":849,"context_line":"      value: \"role:admin or role:reader and (project_id:%(project_id)s or project_id:%(member_id)s)\""},{"line_number":850,"context_line":"    glance-manage_image_cache:"},{"line_number":851,"context_line":"      key: \"manage_image_cache\""},{"line_number":852,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"bd802876_3c597eae","line":849,"range":{"start_line":849,"start_character":74,"end_line":849,"end_character":98},"in_reply_to":"1ad7c408_fda28e09","updated":"2021-09-24 14:43:21.000000000","message":"I think this is what current behavior is.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"fef5268a0d6ab5c9a97867fe07dbdf8e93ea4cdd","unresolved":true,"context_lines":[{"line_number":861,"context_line":"      value: \"role:admin\""},{"line_number":862,"context_line":"    glance-reactivate:"},{"line_number":863,"context_line":"      key: \"reactivate\""},{"line_number":864,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":865,"context_line":"    glance-set_image_location:"},{"line_number":866,"context_line":"      key: \"set_image_location\""},{"line_number":867,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"ec766acd_d0056524","line":864,"range":{"start_line":864,"start_character":25,"end_line":864,"end_character":71},"updated":"2021-09-22 13:50:05.000000000","message":"This should be admin only, as the whole point of the feature is to lock the expected malicious image until admin inspection.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"9a63c5750647a84cfac8c456a88f072b95ae8ebc","unresolved":true,"context_lines":[{"line_number":861,"context_line":"      value: \"role:admin\""},{"line_number":862,"context_line":"    glance-reactivate:"},{"line_number":863,"context_line":"      key: \"reactivate\""},{"line_number":864,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":865,"context_line":"    glance-set_image_location:"},{"line_number":866,"context_line":"      key: \"set_image_location\""},{"line_number":867,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"0bcdfd8a_a0264b04","line":864,"range":{"start_line":864,"start_character":25,"end_line":864,"end_character":71},"in_reply_to":"ec766acd_d0056524","updated":"2021-09-24 14:43:21.000000000","message":"This is how it was working since it is introduced and also the default policy for reactivate is wide open. Based on readonly check in auth layer we have build this new RBAC policy.\n\nhttps://github.com/openstack/glance/blob/8499efd3205d84eff35ed4ed157685313d9e3fb7/glance/api/authorization.py#L45","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":876,"context_line":"    nova-admin_or_project_reader:"},{"line_number":877,"context_line":"      key: \"admin_or_project_reader\""},{"line_number":878,"context_line":"      value: \"rule:admin_required or (role:reader and project_id:%(project_id)s)\""},{"line_number":879,"context_line":"    nova-admin_required:"},{"line_number":880,"context_line":"      key: \"admin_required\""},{"line_number":881,"context_line":"      value: \"role:admin\""},{"line_number":882,"context_line":"    nova-compute_aggregates_images:"},{"line_number":883,"context_line":"      key: \"compute:aggregates:images\""},{"line_number":884,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"b69ccc17_3bb556fd","line":881,"range":{"start_line":879,"start_character":4,"end_line":881,"end_character":25},"updated":"2021-09-22 12:57:08.000000000","message":"for admin required the closet we woudl have had before was\n\n    nova-admin_api:\n      key: \"admin_api\"\n      value: \"is_admin:True\"\n\nwhich i assume was using \n\n    nova-context_is_admin:\n      key: \"context_is_admin\"\n      value: \"role:admin\" \n\nto define is_admin\nso admin_required appears to be equvalent","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":870,"context_line":"      value: \"role:admin or (role:member and project_id:%(project_id)s)\""},{"line_number":871,"context_line":""},{"line_number":872,"context_line":"  NovaApiPolicies:"},{"line_number":873,"context_line":"    nova-admin_or_project_member:"},{"line_number":874,"context_line":"      key: \"admin_or_project_member\""},{"line_number":875,"context_line":"      value: \"rule:admin_required or (role:member and project_id:%(project_id)s)\""},{"line_number":876,"context_line":"    nova-admin_or_project_reader:"},{"line_number":877,"context_line":"      key: \"admin_or_project_reader\""},{"line_number":878,"context_line":"      value: \"rule:admin_required or (role:reader and project_id:%(project_id)s)\""},{"line_number":879,"context_line":"    nova-admin_required:"},{"line_number":880,"context_line":"      key: \"admin_required\""},{"line_number":881,"context_line":"      value: \"role:admin\""},{"line_number":882,"context_line":"    nova-compute_aggregates_images:"},{"line_number":883,"context_line":"      key: \"compute:aggregates:images\""},{"line_number":884,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"da80fb1c_8e34c8d2","line":881,"range":{"start_line":873,"start_character":0,"end_line":881,"end_character":25},"updated":"2021-09-22 12:57:08.000000000","message":"so these are the 3 personas we would be enabling\n\n\nadmin or project member\nadmin or project reader\nand admin only.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":881,"context_line":"      value: \"role:admin\""},{"line_number":882,"context_line":"    nova-compute_aggregates_images:"},{"line_number":883,"context_line":"      key: \"compute:aggregates:images\""},{"line_number":884,"context_line":"      value: \"rule:admin_required\""},{"line_number":885,"context_line":"    nova-compute_server_topology_host_index:"},{"line_number":886,"context_line":"      key: \"compute:server:topology:host:index\""},{"line_number":887,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"8d645bac_13bba03c","line":884,"range":{"start_line":884,"start_character":19,"end_line":884,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"this would have been system_admin_api so yes this is the correct non scoped policy","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":884,"context_line":"      value: \"rule:admin_required\""},{"line_number":885,"context_line":"    nova-compute_server_topology_host_index:"},{"line_number":886,"context_line":"      key: \"compute:server:topology:host:index\""},{"line_number":887,"context_line":"      value: \"rule:admin_required\""},{"line_number":888,"context_line":"    nova-compute_server_topology_index:"},{"line_number":889,"context_line":"      key: \"compute:server:topology:index\""},{"line_number":890,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"d3da462b_ccad136b","line":887,"range":{"start_line":887,"start_character":19,"end_line":887,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"this was system_reader_api so yes this is also correct since we only have project readers in this implementation\n\nnote here an beloew im only going to comment on the ones that have been updated.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":890,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":891,"context_line":"    nova-compute_servers_create_requested_destination:"},{"line_number":892,"context_line":"      key: \"compute:servers:create:requested_destination\""},{"line_number":893,"context_line":"      value: \"rule:admin_required\""},{"line_number":894,"context_line":"    nova-network_attach_external_network:"},{"line_number":895,"context_line":"      key: \"network:attach_external_network\""},{"line_number":896,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"2fca65f1_71bb6eb6","line":893,"range":{"start_line":893,"start_character":19,"end_line":893,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"this would have been project_admin_api but admin required is the correct no scoped verison","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":893,"context_line":"      value: \"rule:admin_required\""},{"line_number":894,"context_line":"    nova-network_attach_external_network:"},{"line_number":895,"context_line":"      key: \"network:attach_external_network\""},{"line_number":896,"context_line":"      value: \"rule:admin_required\""},{"line_number":897,"context_line":"    nova-os_compute_api_ips_index:"},{"line_number":898,"context_line":"      key: \"os_compute_api:ips:index\""},{"line_number":899,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"0163cbab_ccc688e6","line":896,"range":{"start_line":896,"start_character":19,"end_line":896,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"same as above his would have been project_admin_api but admin required is the correct non scoped verison","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":902,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":903,"context_line":"    nova-os_compute_api_limits_other_project:"},{"line_number":904,"context_line":"      key: \"os_compute_api:limits:other_project\""},{"line_number":905,"context_line":"      value: \"rule:admin_required\""},{"line_number":906,"context_line":"    nova-os_compute_api_os-admin-actions_inject_network_info:"},{"line_number":907,"context_line":"      key: \"os_compute_api:os-admin-actions:inject_network_info\""},{"line_number":908,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"ec0bba9b_92678eea","line":905,"range":{"start_line":905,"start_character":19,"end_line":905,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_reader_api is not avaiable","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":905,"context_line":"      value: \"rule:admin_required\""},{"line_number":906,"context_line":"    nova-os_compute_api_os-admin-actions_inject_network_info:"},{"line_number":907,"context_line":"      key: \"os_compute_api:os-admin-actions:inject_network_info\""},{"line_number":908,"context_line":"      value: \"rule:admin_required\""},{"line_number":909,"context_line":"    nova-os_compute_api_os-admin-actions_reset_state:"},{"line_number":910,"context_line":"      key: \"os_compute_api:os-admin-actions:reset_state\""},{"line_number":911,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"37173af8_3c20e685","line":908,"range":{"start_line":908,"start_character":19,"end_line":908,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_api is not available","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":908,"context_line":"      value: \"rule:admin_required\""},{"line_number":909,"context_line":"    nova-os_compute_api_os-admin-actions_reset_state:"},{"line_number":910,"context_line":"      key: \"os_compute_api:os-admin-actions:reset_state\""},{"line_number":911,"context_line":"      value: \"rule:admin_required\""},{"line_number":912,"context_line":"    nova-os_compute_api_os-admin-password:"},{"line_number":913,"context_line":"      key: \"os_compute_api:os-admin-password\""},{"line_number":914,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"d78c39d5_d1d24c38","line":911,"range":{"start_line":911,"start_character":19,"end_line":911,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_api is not available","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":911,"context_line":"      value: \"rule:admin_required\""},{"line_number":912,"context_line":"    nova-os_compute_api_os-admin-password:"},{"line_number":913,"context_line":"      key: \"os_compute_api:os-admin-password\""},{"line_number":914,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":915,"context_line":"    nova-os_compute_api_os-aggregates_add_host:"},{"line_number":916,"context_line":"      key: \"os_compute_api:os-aggregates:add_host\""},{"line_number":917,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"7cc199bd_7d5cbaef","line":914,"range":{"start_line":914,"start_character":19,"end_line":914,"end_character":42},"updated":"2021-09-22 12:57:08.000000000","message":"thies would have been system_admin_or_owner\n\nwhich was defined as \n\n    nova-system_admin_or_owner:\n      key: \"system_admin_or_owner\"\n      value: \"rule:system_admin_api or rule:project_member_api\"\n\n    nova-project_member_api:\n      key: \"project_member_api\"\n      value: \"role:member and project_id:%(project_id)s\"\n\n    nova-system_admin_api:\n      key: \"system_admin_api\"\n      value: \"role:admin and system_scope:all\"\n\nso this is the same as \n    nova-admin_or_project_member:\n      key: \"admin_or_project_member\"\n      value: \"rule:admin_required or (role:member and project_id:%(project_id)s)\"\n\n    nova-admin_required:\n      key: \"admin_required\"\n      value: \"role:admin\"\n\ni will treat these as the same form now on","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":912,"context_line":"    nova-os_compute_api_os-admin-password:"},{"line_number":913,"context_line":"      key: \"os_compute_api:os-admin-password\""},{"line_number":914,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":915,"context_line":"    nova-os_compute_api_os-aggregates_add_host:"},{"line_number":916,"context_line":"      key: \"os_compute_api:os-aggregates:add_host\""},{"line_number":917,"context_line":"      value: \"rule:admin_required\""},{"line_number":918,"context_line":"    nova-os_compute_api_os-aggregates_create:"},{"line_number":919,"context_line":"      key: \"os_compute_api:os-aggregates:create\""},{"line_number":920,"context_line":"      value: \"rule:admin_required\""},{"line_number":921,"context_line":"    nova-os_compute_api_os-aggregates_delete:"},{"line_number":922,"context_line":"      key: \"os_compute_api:os-aggregates:delete\""},{"line_number":923,"context_line":"      value: \"rule:admin_required\""},{"line_number":924,"context_line":"    nova-os_compute_api_os-aggregates_index:"},{"line_number":925,"context_line":"      key: \"os_compute_api:os-aggregates:index\""},{"line_number":926,"context_line":"      value: \"rule:admin_required\""},{"line_number":927,"context_line":"    nova-os_compute_api_os-aggregates_remove_host:"},{"line_number":928,"context_line":"      key: \"os_compute_api:os-aggregates:remove_host\""},{"line_number":929,"context_line":"      value: \"rule:admin_required\""},{"line_number":930,"context_line":"    nova-os_compute_api_os-aggregates_set_metadata:"},{"line_number":931,"context_line":"      key: \"os_compute_api:os-aggregates:set_metadata\""},{"line_number":932,"context_line":"      value: \"rule:admin_required\""},{"line_number":933,"context_line":"    nova-os_compute_api_os-aggregates_show:"},{"line_number":934,"context_line":"      key: \"os_compute_api:os-aggregates:show\""},{"line_number":935,"context_line":"      value: \"rule:admin_required\""},{"line_number":936,"context_line":"    nova-os_compute_api_os-aggregates_update:"},{"line_number":937,"context_line":"      key: \"os_compute_api:os-aggregates:update\""},{"line_number":938,"context_line":"      value: \"rule:admin_required\""},{"line_number":939,"context_line":"    nova-os_compute_api_os-assisted-volume-snapshots_create:"},{"line_number":940,"context_line":"      key: \"os_compute_api:os-assisted-volume-snapshots:create\""},{"line_number":941,"context_line":"      value: \"rule:admin_required\""},{"line_number":942,"context_line":"    nova-os_compute_api_os-assisted-volume-snapshots_delete:"},{"line_number":943,"context_line":"      key: \"os_compute_api:os-assisted-volume-snapshots:delete\""},{"line_number":944,"context_line":"      value: \"rule:admin_required\""},{"line_number":945,"context_line":"    nova-os_compute_api_os-attach-interfaces:"},{"line_number":946,"context_line":"      key: \"os_compute_api:os-attach-interfaces\""},{"line_number":947,"context_line":"      value: \"rule:os_compute_api:os-attach-interfaces:delete\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"4718c329_7ac691c3","line":944,"range":{"start_line":915,"start_character":2,"end_line":944,"end_character":34},"updated":"2021-09-22 12:57:08.000000000","message":"ack they would all have been system_admin_api or system_reader_api so this is correct","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":944,"context_line":"      value: \"rule:admin_required\""},{"line_number":945,"context_line":"    nova-os_compute_api_os-attach-interfaces:"},{"line_number":946,"context_line":"      key: \"os_compute_api:os-attach-interfaces\""},{"line_number":947,"context_line":"      value: \"rule:os_compute_api:os-attach-interfaces:delete\""},{"line_number":948,"context_line":"    nova-os_compute_api_os-attach-interfaces_create:"},{"line_number":949,"context_line":"      key: \"os_compute_api:os-attach-interfaces:create\""},{"line_number":950,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"54f82339_2201da48","line":947,"range":{"start_line":947,"start_character":13,"end_line":947,"end_character":62},"updated":"2021-09-22 12:57:08.000000000","message":"this is not the same as upstream where we use\nrule:os_compute_api:os-attach-interfaces:list\"\nhttps://review.opendev.org/c/openstack/tripleo-heat-templates/+/810321/2/environments/enable-secure-rbac.yaml#87\n\n    nova-os_compute_api_os-attach-interfaces_list:\n      key: \"os_compute_api:os-attach-interfaces:list\"\n      value: \"rule:admin_or_project_reader\"\n\nhere to use delete, why is there a delta?\n\n\nthe base rule does appear to be admin or owner upstream\nhttps://github.com/openstack/nova/blob/dfda0c0482acf579452742860cec2bdd64ac616a/nova/policies/attach_interfaces.py#L32\nwhich is \"is_admin:True or project_id:%(project_id)s\"\n\n\nso using delete which is \n    nova-os_compute_api_os-attach-interfaces_delete:\n      key: \"os_compute_api:os-attach-interfaces:delete\"\n      value: \"rule:admin_or_project_member\"\n\nis much more restritive\n\ngranted the other per http method rules are really what will take effect but we should really have an\n\neither\n      nova-admin_or_owner:\n      key: \"admin_or_owner\"\n      value: \"is_admin:True or project_id:%(project_id)s\"\n\nor use admin_or_project_reader to keep this as aligned as possible with upstream","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":959,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":960,"context_line":"    nova-os_compute_api_os-availability-zone_detail:"},{"line_number":961,"context_line":"      key: \"os_compute_api:os-availability-zone:detail\""},{"line_number":962,"context_line":"      value: \"rule:admin_required\""},{"line_number":963,"context_line":"    nova-os_compute_api_os-baremetal-nodes:"},{"line_number":964,"context_line":"      key: \"os_compute_api:os-baremetal-nodes\""},{"line_number":965,"context_line":"      value: \"rule:os_compute_api:os-baremetal-nodes:show\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"671b13f9_f37e824e","line":962,"range":{"start_line":962,"start_character":19,"end_line":962,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack was system_reader_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":962,"context_line":"      value: \"rule:admin_required\""},{"line_number":963,"context_line":"    nova-os_compute_api_os-baremetal-nodes:"},{"line_number":964,"context_line":"      key: \"os_compute_api:os-baremetal-nodes\""},{"line_number":965,"context_line":"      value: \"rule:os_compute_api:os-baremetal-nodes:show\""},{"line_number":966,"context_line":"    nova-os_compute_api_os-baremetal-nodes_list:"},{"line_number":967,"context_line":"      key: \"os_compute_api:os-baremetal-nodes:list\""},{"line_number":968,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"4887609e_0e42c061","line":965,"range":{"start_line":965,"start_character":0,"end_line":965,"end_character":4},"updated":"2021-09-22 12:57:08.000000000","message":"this used list in https://review.opendev.org/c/openstack/tripleo-heat-templates/+/810321/2/environments/enable-secure-rbac.yaml#108\n\n value: \"rule:os_compute_api:os-baremetal-nodes:list","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":965,"context_line":"      value: \"rule:os_compute_api:os-baremetal-nodes:show\""},{"line_number":966,"context_line":"    nova-os_compute_api_os-baremetal-nodes_list:"},{"line_number":967,"context_line":"      key: \"os_compute_api:os-baremetal-nodes:list\""},{"line_number":968,"context_line":"      value: \"rule:admin_required\""},{"line_number":969,"context_line":"    nova-os_compute_api_os-baremetal-nodes_show:"},{"line_number":970,"context_line":"      key: \"os_compute_api:os-baremetal-nodes:show\""},{"line_number":971,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"745e695f_fe38dd45","line":968,"range":{"start_line":968,"start_character":19,"end_line":968,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_reader_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":968,"context_line":"      value: \"rule:admin_required\""},{"line_number":969,"context_line":"    nova-os_compute_api_os-baremetal-nodes_show:"},{"line_number":970,"context_line":"      key: \"os_compute_api:os-baremetal-nodes:show\""},{"line_number":971,"context_line":"      value: \"rule:admin_required\""},{"line_number":972,"context_line":"    nova-os_compute_api_os-console-auth-tokens:"},{"line_number":973,"context_line":"      key: \"os_compute_api:os-console-auth-tokens\""},{"line_number":974,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"ddf09ded_da7d6953","line":971,"range":{"start_line":971,"start_character":19,"end_line":971,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_reader_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":971,"context_line":"      value: \"rule:admin_required\""},{"line_number":972,"context_line":"    nova-os_compute_api_os-console-auth-tokens:"},{"line_number":973,"context_line":"      key: \"os_compute_api:os-console-auth-tokens\""},{"line_number":974,"context_line":"      value: \"rule:admin_required\""},{"line_number":975,"context_line":"    nova-os_compute_api_os-console-output:"},{"line_number":976,"context_line":"      key: \"os_compute_api:os-console-output\""},{"line_number":977,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"3ca3c6b0_b3a8814e","line":974,"range":{"start_line":974,"start_character":19,"end_line":974,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_reader_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":974,"context_line":"      value: \"rule:admin_required\""},{"line_number":975,"context_line":"    nova-os_compute_api_os-console-output:"},{"line_number":976,"context_line":"      key: \"os_compute_api:os-console-output\""},{"line_number":977,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":978,"context_line":"    nova-os_compute_api_os-create-backup:"},{"line_number":979,"context_line":"      key: \"os_compute_api:os-create-backup\""},{"line_number":980,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"b810b7cb_7468445e","line":977,"range":{"start_line":977,"start_character":19,"end_line":977,"end_character":42},"updated":"2021-09-22 12:57:08.000000000","message":"-1 this was previously system_admin_or_owner\nmeaning no role was required\n\nthis should be admin_or_project_reader","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":977,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":978,"context_line":"    nova-os_compute_api_os-create-backup:"},{"line_number":979,"context_line":"      key: \"os_compute_api:os-create-backup\""},{"line_number":980,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":981,"context_line":"    nova-os_compute_api_os-deferred-delete:"},{"line_number":982,"context_line":"      key: \"os_compute_api:os-deferred-delete\""},{"line_number":983,"context_line":"      value: \"rule:os_compute_api:os-deferred-delete:force\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"46701d14_430b7825","line":980,"range":{"start_line":980,"start_character":19,"end_line":980,"end_character":42},"updated":"2021-09-22 12:57:08.000000000","message":"ack it was system_admin_or_owner but its a action that modifys state in this case creating a backup so member is correct","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":978,"context_line":"    nova-os_compute_api_os-create-backup:"},{"line_number":979,"context_line":"      key: \"os_compute_api:os-create-backup\""},{"line_number":980,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":981,"context_line":"    nova-os_compute_api_os-deferred-delete:"},{"line_number":982,"context_line":"      key: \"os_compute_api:os-deferred-delete\""},{"line_number":983,"context_line":"      value: \"rule:os_compute_api:os-deferred-delete:force\""},{"line_number":984,"context_line":"    nova-os_compute_api_os-deferred-delete_force:"},{"line_number":985,"context_line":"      key: \"os_compute_api:os-deferred-delete:force\""},{"line_number":986,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":987,"context_line":"    nova-os_compute_api_os-deferred-delete_restore:"},{"line_number":988,"context_line":"      key: \"os_compute_api:os-deferred-delete:restore\""},{"line_number":989,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":990,"context_line":"    nova-os_compute_api_os-evacuate:"},{"line_number":991,"context_line":"      key: \"os_compute_api:os-evacuate\""},{"line_number":992,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"bb1e10f3_a4f99e41","line":989,"range":{"start_line":981,"start_character":1,"end_line":989,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"nova-os_compute_api_os-deferred-delete: uses   value: \"rule:os_compute_api:os-deferred-delete:restore\"\nhere https://review.opendev.org/c/openstack/tripleo-heat-templates/+/810321/2/environments/enable-secure-rbac.yaml#126\n\nwhich would have used system_admin_or_owner \n\nboth restore and force use admin_or_project_member which is the correct equivalent here but agian we have a delta form the other file that i think we should explain.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":989,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":990,"context_line":"    nova-os_compute_api_os-evacuate:"},{"line_number":991,"context_line":"      key: \"os_compute_api:os-evacuate\""},{"line_number":992,"context_line":"      value: \"rule:admin_required\""},{"line_number":993,"context_line":"    nova-os_compute_api_os-extended-server-attributes:"},{"line_number":994,"context_line":"      key: \"os_compute_api:os-extended-server-attributes\""},{"line_number":995,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"ab2a116f_2fff2df9","line":992,"range":{"start_line":992,"start_character":19,"end_line":992,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":992,"context_line":"      value: \"rule:admin_required\""},{"line_number":993,"context_line":"    nova-os_compute_api_os-extended-server-attributes:"},{"line_number":994,"context_line":"      key: \"os_compute_api:os-extended-server-attributes\""},{"line_number":995,"context_line":"      value: \"rule:admin_required\""},{"line_number":996,"context_line":"    nova-os_compute_api_os-flavor-access:"},{"line_number":997,"context_line":"      key: \"os_compute_api:os-flavor-access\""},{"line_number":998,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"969a1d97_113c2252","line":995,"range":{"start_line":995,"start_character":19,"end_line":995,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":995,"context_line":"      value: \"rule:admin_required\""},{"line_number":996,"context_line":"    nova-os_compute_api_os-flavor-access:"},{"line_number":997,"context_line":"      key: \"os_compute_api:os-flavor-access\""},{"line_number":998,"context_line":"      value: \"rule:admin_required\""},{"line_number":999,"context_line":"    nova-os_compute_api_os-flavor-access_add_tenant_access:"},{"line_number":1000,"context_line":"      key: \"os_compute_api:os-flavor-access:add_tenant_access\""},{"line_number":1001,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"369dd167_69176b9f","line":998,"range":{"start_line":998,"start_character":19,"end_line":998,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_reader_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":996,"context_line":"    nova-os_compute_api_os-flavor-access:"},{"line_number":997,"context_line":"      key: \"os_compute_api:os-flavor-access\""},{"line_number":998,"context_line":"      value: \"rule:admin_required\""},{"line_number":999,"context_line":"    nova-os_compute_api_os-flavor-access_add_tenant_access:"},{"line_number":1000,"context_line":"      key: \"os_compute_api:os-flavor-access:add_tenant_access\""},{"line_number":1001,"context_line":"      value: \"rule:admin_required\""},{"line_number":1002,"context_line":"    nova-os_compute_api_os-flavor-access_remove_tenant_access:"},{"line_number":1003,"context_line":"      key: \"os_compute_api:os-flavor-access:remove_tenant_access\""},{"line_number":1004,"context_line":"      value: \"rule:admin_required\""},{"line_number":1005,"context_line":"    nova-os_compute_api_os-flavor-extra-specs_create:"},{"line_number":1006,"context_line":"      key: \"os_compute_api:os-flavor-extra-specs:create\""},{"line_number":1007,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"31822c26_80d08ddb","line":1004,"range":{"start_line":999,"start_character":2,"end_line":1004,"end_character":34},"updated":"2021-09-22 12:57:08.000000000","message":"ack both were system_admin_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1002,"context_line":"    nova-os_compute_api_os-flavor-access_remove_tenant_access:"},{"line_number":1003,"context_line":"      key: \"os_compute_api:os-flavor-access:remove_tenant_access\""},{"line_number":1004,"context_line":"      value: \"rule:admin_required\""},{"line_number":1005,"context_line":"    nova-os_compute_api_os-flavor-extra-specs_create:"},{"line_number":1006,"context_line":"      key: \"os_compute_api:os-flavor-extra-specs:create\""},{"line_number":1007,"context_line":"      value: \"rule:admin_required\""},{"line_number":1008,"context_line":"    nova-os_compute_api_os-flavor-extra-specs_delete:"},{"line_number":1009,"context_line":"      key: \"os_compute_api:os-flavor-extra-specs:delete\""},{"line_number":1010,"context_line":"      value: \"rule:admin_required\""},{"line_number":1011,"context_line":"    nova-os_compute_api_os-flavor-extra-specs_index:"},{"line_number":1012,"context_line":"      key: \"os_compute_api:os-flavor-extra-specs:index\""},{"line_number":1013,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1014,"context_line":"    nova-os_compute_api_os-flavor-extra-specs_show:"},{"line_number":1015,"context_line":"      key: \"os_compute_api:os-flavor-extra-specs:show\""},{"line_number":1016,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1017,"context_line":"    nova-os_compute_api_os-flavor-extra-specs_update:"},{"line_number":1018,"context_line":"      key: \"os_compute_api:os-flavor-extra-specs:update\""},{"line_number":1019,"context_line":"      value: \"rule:admin_required\""},{"line_number":1020,"context_line":"    nova-os_compute_api_os-flavor-manage_create:"},{"line_number":1021,"context_line":"      key: \"os_compute_api:os-flavor-manage:create\""},{"line_number":1022,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"c226c865_2d41397e","line":1019,"range":{"start_line":1005,"start_character":2,"end_line":1019,"end_character":34},"updated":"2021-09-22 12:57:08.000000000","message":"ack flavor extra spec create delete and update are system_admin_api normally so admin_required is correct\nshow and index are system_or_project_reader so admin_or_project_reader is correct","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1017,"context_line":"    nova-os_compute_api_os-flavor-extra-specs_update:"},{"line_number":1018,"context_line":"      key: \"os_compute_api:os-flavor-extra-specs:update\""},{"line_number":1019,"context_line":"      value: \"rule:admin_required\""},{"line_number":1020,"context_line":"    nova-os_compute_api_os-flavor-manage_create:"},{"line_number":1021,"context_line":"      key: \"os_compute_api:os-flavor-manage:create\""},{"line_number":1022,"context_line":"      value: \"rule:admin_required\""},{"line_number":1023,"context_line":"    nova-os_compute_api_os-flavor-manage_delete:"},{"line_number":1024,"context_line":"      key: \"os_compute_api:os-flavor-manage:delete\""},{"line_number":1025,"context_line":"      value: \"rule:admin_required\""},{"line_number":1026,"context_line":"    nova-os_compute_api_os-flavor-manage_update:"},{"line_number":1027,"context_line":"      key: \"os_compute_api:os-flavor-manage:update\""},{"line_number":1028,"context_line":"      value: \"rule:admin_required\""},{"line_number":1029,"context_line":"    nova-os_compute_api_os-floating-ips:"},{"line_number":1030,"context_line":"      key: \"os_compute_api:os-floating-ips\""},{"line_number":1031,"context_line":"      value: \"rule:os_compute_api:os-floating-ips:delete\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"499d901b_32af1e4a","line":1028,"range":{"start_line":1020,"start_character":4,"end_line":1028,"end_character":34},"updated":"2021-09-22 12:57:08.000000000","message":"ack theses are all system_admin_api so this correct","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1026,"context_line":"    nova-os_compute_api_os-flavor-manage_update:"},{"line_number":1027,"context_line":"      key: \"os_compute_api:os-flavor-manage:update\""},{"line_number":1028,"context_line":"      value: \"rule:admin_required\""},{"line_number":1029,"context_line":"    nova-os_compute_api_os-floating-ips:"},{"line_number":1030,"context_line":"      key: \"os_compute_api:os-floating-ips\""},{"line_number":1031,"context_line":"      value: \"rule:os_compute_api:os-floating-ips:delete\""},{"line_number":1032,"context_line":"    nova-os_compute_api_os-floating-ips_add:"},{"line_number":1033,"context_line":"      key: \"os_compute_api:os-floating-ips:add\""},{"line_number":1034,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1035,"context_line":"    nova-os_compute_api_os-floating-ips_create:"},{"line_number":1036,"context_line":"      key: \"os_compute_api:os-floating-ips:create\""},{"line_number":1037,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1038,"context_line":"    nova-os_compute_api_os-floating-ips_delete:"},{"line_number":1039,"context_line":"      key: \"os_compute_api:os-floating-ips:delete\""},{"line_number":1040,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1041,"context_line":"    nova-os_compute_api_os-floating-ips_list:"},{"line_number":1042,"context_line":"      key: \"os_compute_api:os-floating-ips:list\""},{"line_number":1043,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1044,"context_line":"    nova-os_compute_api_os-floating-ips_remove:"},{"line_number":1045,"context_line":"      key: \"os_compute_api:os-floating-ips:remove\""},{"line_number":1046,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1047,"context_line":"    nova-os_compute_api_os-floating-ips_show:"},{"line_number":1048,"context_line":"      key: \"os_compute_api:os-floating-ips:show\""},{"line_number":1049,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1050,"context_line":"    nova-os_compute_api_os-hosts:"},{"line_number":1051,"context_line":"      key: \"os_compute_api:os-hosts\""},{"line_number":1052,"context_line":"      value: \"rule:os_compute_api:os-hosts:start\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"c41c8857_a0c2f7f0","line":1049,"range":{"start_line":1029,"start_character":1,"end_line":1049,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"nova-os_compute_api_os-floating-ips_show: is system_or_project_reader so admin_or_project_reader\nis correct\n\nthe rest are system_admin_or_owner\n\nwhich is \n    nova-system_admin_or_owner:\n      key: \"system_admin_or_owner\"\n      value: \"rule:system_admin_api or rule:project_member_api\"\n\nso admin_or_project_member is the correct equvalent\n\nnote to self admin_or_owner does not requrie any role just a token for the project \n system_admin_or_owner requires project member","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1049,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1050,"context_line":"    nova-os_compute_api_os-hosts:"},{"line_number":1051,"context_line":"      key: \"os_compute_api:os-hosts\""},{"line_number":1052,"context_line":"      value: \"rule:os_compute_api:os-hosts:start\""},{"line_number":1053,"context_line":"    nova-os_compute_api_os-hosts_list:"},{"line_number":1054,"context_line":"      key: \"os_compute_api:os-hosts:list\""},{"line_number":1055,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"8907d286_d78e6527","line":1052,"range":{"start_line":1052,"start_character":14,"end_line":1052,"end_character":49},"updated":"2021-09-22 12:57:08.000000000","message":"this is still different then https://review.opendev.org/c/openstack/tripleo-heat-templates/+/810321/2/environments/enable-secure-rbac.yaml#40\n\nin this case start vs list\n\nthe polcy is the same thogh since this is all admin onley.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1050,"context_line":"    nova-os_compute_api_os-hosts:"},{"line_number":1051,"context_line":"      key: \"os_compute_api:os-hosts\""},{"line_number":1052,"context_line":"      value: \"rule:os_compute_api:os-hosts:start\""},{"line_number":1053,"context_line":"    nova-os_compute_api_os-hosts_list:"},{"line_number":1054,"context_line":"      key: \"os_compute_api:os-hosts:list\""},{"line_number":1055,"context_line":"      value: \"rule:admin_required\""},{"line_number":1056,"context_line":"    nova-os_compute_api_os-hosts_reboot:"},{"line_number":1057,"context_line":"      key: \"os_compute_api:os-hosts:reboot\""},{"line_number":1058,"context_line":"      value: \"rule:admin_required\""},{"line_number":1059,"context_line":"    nova-os_compute_api_os-hosts_show:"},{"line_number":1060,"context_line":"      key: \"os_compute_api:os-hosts:show\""},{"line_number":1061,"context_line":"      value: \"rule:admin_required\""},{"line_number":1062,"context_line":"    nova-os_compute_api_os-hosts_shutdown:"},{"line_number":1063,"context_line":"      key: \"os_compute_api:os-hosts:shutdown\""},{"line_number":1064,"context_line":"      value: \"rule:admin_required\""},{"line_number":1065,"context_line":"    nova-os_compute_api_os-hosts_start:"},{"line_number":1066,"context_line":"      key: \"os_compute_api:os-hosts:start\""},{"line_number":1067,"context_line":"      value: \"rule:admin_required\""},{"line_number":1068,"context_line":"    nova-os_compute_api_os-hosts_update:"},{"line_number":1069,"context_line":"      key: \"os_compute_api:os-hosts:update\""},{"line_number":1070,"context_line":"      value: \"rule:admin_required\""},{"line_number":1071,"context_line":"    nova-os_compute_api_os-hypervisors:"},{"line_number":1072,"context_line":"      key: \"os_compute_api:os-hypervisors\""},{"line_number":1073,"context_line":"      value: \"rule:os_compute_api:os-hypervisors:servers\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"35e238ad_22eb235c","line":1070,"range":{"start_line":1053,"start_character":2,"end_line":1070,"end_character":34},"updated":"2021-09-22 12:57:08.000000000","message":"there were either system_reader_api or system_admin_api so this is correct.\nas an asside no one shuld use the os-host endpoing in nova anymore we should really remove it.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1068,"context_line":"    nova-os_compute_api_os-hosts_update:"},{"line_number":1069,"context_line":"      key: \"os_compute_api:os-hosts:update\""},{"line_number":1070,"context_line":"      value: \"rule:admin_required\""},{"line_number":1071,"context_line":"    nova-os_compute_api_os-hypervisors:"},{"line_number":1072,"context_line":"      key: \"os_compute_api:os-hypervisors\""},{"line_number":1073,"context_line":"      value: \"rule:os_compute_api:os-hypervisors:servers\""},{"line_number":1074,"context_line":"    nova-os_compute_api_os-hypervisors_list:"}],"source_content_type":"text/x-yaml","patch_set":23,"id":"99ec5de1_15964827","line":1071,"range":{"start_line":1071,"start_character":0,"end_line":1071,"end_character":2},"updated":"2021-09-22 12:57:08.000000000","message":"this should referencce       value: \"rule:os_compute_api:os-hypervisors:list\"\n\ni kind of feel like how you gengerate the base rule for an endpoint is broken since it alway or almost always wrong, in this case there is no diference in policy but where one policy gets its default form an other i think we shoudl ensure that the way we generate it is stable.\n\nim think this is an artifact mainlay of how you generate these files and it might be betere to flatten these instead of refering to another rule","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1071,"context_line":"    nova-os_compute_api_os-hypervisors:"},{"line_number":1072,"context_line":"      key: \"os_compute_api:os-hypervisors\""},{"line_number":1073,"context_line":"      value: \"rule:os_compute_api:os-hypervisors:servers\""},{"line_number":1074,"context_line":"    nova-os_compute_api_os-hypervisors_list:"},{"line_number":1075,"context_line":"      key: \"os_compute_api:os-hypervisors:list\""},{"line_number":1076,"context_line":"      value: \"rule:admin_required\""},{"line_number":1077,"context_line":"    nova-os_compute_api_os-hypervisors_list-detail:"},{"line_number":1078,"context_line":"      key: \"os_compute_api:os-hypervisors:list-detail\""},{"line_number":1079,"context_line":"      value: \"rule:admin_required\""},{"line_number":1080,"context_line":"    nova-os_compute_api_os-hypervisors_search:"},{"line_number":1081,"context_line":"      key: \"os_compute_api:os-hypervisors:search\""},{"line_number":1082,"context_line":"      value: \"rule:admin_required\""},{"line_number":1083,"context_line":"    nova-os_compute_api_os-hypervisors_servers:"},{"line_number":1084,"context_line":"      key: \"os_compute_api:os-hypervisors:servers\""},{"line_number":1085,"context_line":"      value: \"rule:admin_required\""},{"line_number":1086,"context_line":"    nova-os_compute_api_os-hypervisors_show:"},{"line_number":1087,"context_line":"      key: \"os_compute_api:os-hypervisors:show\""},{"line_number":1088,"context_line":"      value: \"rule:admin_required\""},{"line_number":1089,"context_line":"    nova-os_compute_api_os-hypervisors_statistics:"},{"line_number":1090,"context_line":"      key: \"os_compute_api:os-hypervisors:statistics\""},{"line_number":1091,"context_line":"      value: \"rule:admin_required\""},{"line_number":1092,"context_line":"    nova-os_compute_api_os-hypervisors_uptime:"},{"line_number":1093,"context_line":"      key: \"os_compute_api:os-hypervisors:uptime\""},{"line_number":1094,"context_line":"      value: \"rule:admin_required\""},{"line_number":1095,"context_line":"    nova-os_compute_api_os-instance-actions:"},{"line_number":1096,"context_line":"      key: \"os_compute_api:os-instance-actions\""},{"line_number":1097,"context_line":"      value: \"rule:os_compute_api:os-instance-actions:show\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"dd53b4bf_8282066d","line":1094,"range":{"start_line":1074,"start_character":2,"end_line":1094,"end_character":34},"updated":"2021-09-22 12:57:08.000000000","message":"these all would have been system_reader_api so admin_required is correct","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1094,"context_line":"      value: \"rule:admin_required\""},{"line_number":1095,"context_line":"    nova-os_compute_api_os-instance-actions:"},{"line_number":1096,"context_line":"      key: \"os_compute_api:os-instance-actions\""},{"line_number":1097,"context_line":"      value: \"rule:os_compute_api:os-instance-actions:show\""},{"line_number":1098,"context_line":"    nova-os_compute_api_os-instance-actions_events:"},{"line_number":1099,"context_line":"      key: \"os_compute_api:os-instance-actions:events\""},{"line_number":1100,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"379349a7_d0932db1","line":1097,"range":{"start_line":1097,"start_character":54,"end_line":1097,"end_character":58},"updated":"2021-09-22 12:57:08.000000000","message":"value: \"rule:os_compute_api:os-instance-actions:list\"\n\nshow and list both have the same policy","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1097,"context_line":"      value: \"rule:os_compute_api:os-instance-actions:show\""},{"line_number":1098,"context_line":"    nova-os_compute_api_os-instance-actions_events:"},{"line_number":1099,"context_line":"      key: \"os_compute_api:os-instance-actions:events\""},{"line_number":1100,"context_line":"      value: \"rule:admin_required\""},{"line_number":1101,"context_line":"    nova-os_compute_api_os-instance-actions_events_details:"},{"line_number":1102,"context_line":"      key: \"os_compute_api:os-instance-actions:events:details\""},{"line_number":1103,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"9a37a8be_ad2215fd","line":1100,"range":{"start_line":1100,"start_character":19,"end_line":1100,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_reader_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1100,"context_line":"      value: \"rule:admin_required\""},{"line_number":1101,"context_line":"    nova-os_compute_api_os-instance-actions_events_details:"},{"line_number":1102,"context_line":"      key: \"os_compute_api:os-instance-actions:events:details\""},{"line_number":1103,"context_line":"      value: \"rule:admin_required\""},{"line_number":1104,"context_line":"    nova-os_compute_api_os-instance-actions_list:"},{"line_number":1105,"context_line":"      key: \"os_compute_api:os-instance-actions:list\""},{"line_number":1106,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"6726097e_8b4a0d87","line":1103,"range":{"start_line":1103,"start_character":19,"end_line":1103,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_reader_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1101,"context_line":"    nova-os_compute_api_os-instance-actions_events_details:"},{"line_number":1102,"context_line":"      key: \"os_compute_api:os-instance-actions:events:details\""},{"line_number":1103,"context_line":"      value: \"rule:admin_required\""},{"line_number":1104,"context_line":"    nova-os_compute_api_os-instance-actions_list:"},{"line_number":1105,"context_line":"      key: \"os_compute_api:os-instance-actions:list\""},{"line_number":1106,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1107,"context_line":"    nova-os_compute_api_os-instance-actions_show:"},{"line_number":1108,"context_line":"      key: \"os_compute_api:os-instance-actions:show\""},{"line_number":1109,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1110,"context_line":"    nova-os_compute_api_os-instance-usage-audit-log:"},{"line_number":1111,"context_line":"      key: \"os_compute_api:os-instance-usage-audit-log\""},{"line_number":1112,"context_line":"      value: \"rule:os_compute_api:os-instance-usage-audit-log:show\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"17bc1475_5ac11acf","line":1109,"range":{"start_line":1104,"start_character":0,"end_line":1109,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_or_project_reader","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1109,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1110,"context_line":"    nova-os_compute_api_os-instance-usage-audit-log:"},{"line_number":1111,"context_line":"      key: \"os_compute_api:os-instance-usage-audit-log\""},{"line_number":1112,"context_line":"      value: \"rule:os_compute_api:os-instance-usage-audit-log:show\""},{"line_number":1113,"context_line":"    nova-os_compute_api_os-instance-usage-audit-log_list:"},{"line_number":1114,"context_line":"      key: \"os_compute_api:os-instance-usage-audit-log:list\""},{"line_number":1115,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"35a55231_742ab56b","line":1112,"range":{"start_line":1112,"start_character":0,"end_line":1112,"end_character":4},"updated":"2021-09-22 12:57:08.000000000","message":"value: \"rule:os_compute_api:os-instance-usage-audit-log:list\"","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1110,"context_line":"    nova-os_compute_api_os-instance-usage-audit-log:"},{"line_number":1111,"context_line":"      key: \"os_compute_api:os-instance-usage-audit-log\""},{"line_number":1112,"context_line":"      value: \"rule:os_compute_api:os-instance-usage-audit-log:show\""},{"line_number":1113,"context_line":"    nova-os_compute_api_os-instance-usage-audit-log_list:"},{"line_number":1114,"context_line":"      key: \"os_compute_api:os-instance-usage-audit-log:list\""},{"line_number":1115,"context_line":"      value: \"rule:admin_required\""},{"line_number":1116,"context_line":"    nova-os_compute_api_os-instance-usage-audit-log_show:"},{"line_number":1117,"context_line":"      key: \"os_compute_api:os-instance-usage-audit-log:show\""},{"line_number":1118,"context_line":"      value: \"rule:admin_required\""},{"line_number":1119,"context_line":"    nova-os_compute_api_os-keypairs_create:"},{"line_number":1120,"context_line":"      key: \"os_compute_api:os-keypairs:create\""},{"line_number":1121,"context_line":"      value: \"(rule:admin_required) or user_id:%(user_id)s\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"080e430b_6d8f8627","line":1118,"range":{"start_line":1113,"start_character":3,"end_line":1118,"end_character":34},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_reader_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1116,"context_line":"    nova-os_compute_api_os-instance-usage-audit-log_show:"},{"line_number":1117,"context_line":"      key: \"os_compute_api:os-instance-usage-audit-log:show\""},{"line_number":1118,"context_line":"      value: \"rule:admin_required\""},{"line_number":1119,"context_line":"    nova-os_compute_api_os-keypairs_create:"},{"line_number":1120,"context_line":"      key: \"os_compute_api:os-keypairs:create\""},{"line_number":1121,"context_line":"      value: \"(rule:admin_required) or user_id:%(user_id)s\""},{"line_number":1122,"context_line":"    nova-os_compute_api_os-keypairs_delete:"},{"line_number":1123,"context_line":"      key: \"os_compute_api:os-keypairs:delete\""},{"line_number":1124,"context_line":"      value: \"(rule:admin_required) or user_id:%(user_id)s\""},{"line_number":1125,"context_line":"    nova-os_compute_api_os-keypairs_index:"},{"line_number":1126,"context_line":"      key: \"os_compute_api:os-keypairs:index\""},{"line_number":1127,"context_line":"      value: \"(rule:admin_required) or user_id:%(user_id)s\""},{"line_number":1128,"context_line":"    nova-os_compute_api_os-keypairs_show:"},{"line_number":1129,"context_line":"      key: \"os_compute_api:os-keypairs:show\""},{"line_number":1130,"context_line":"      value: \"(rule:admin_required) or user_id:%(user_id)s\""},{"line_number":1131,"context_line":"    nova-os_compute_api_os-lock-server_lock:"},{"line_number":1132,"context_line":"      key: \"os_compute_api:os-lock-server:lock\""},{"line_number":1133,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"59c146a3_73ea3095","line":1130,"range":{"start_line":1119,"start_character":3,"end_line":1130,"end_character":59},"updated":"2021-09-22 12:57:08.000000000","message":"ack \"(rule:system_reader_api) or user_id:%(user_id)s\"","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1128,"context_line":"    nova-os_compute_api_os-keypairs_show:"},{"line_number":1129,"context_line":"      key: \"os_compute_api:os-keypairs:show\""},{"line_number":1130,"context_line":"      value: \"(rule:admin_required) or user_id:%(user_id)s\""},{"line_number":1131,"context_line":"    nova-os_compute_api_os-lock-server_lock:"},{"line_number":1132,"context_line":"      key: \"os_compute_api:os-lock-server:lock\""},{"line_number":1133,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1134,"context_line":"    nova-os_compute_api_os-lock-server_unlock:"},{"line_number":1135,"context_line":"      key: \"os_compute_api:os-lock-server:unlock\""},{"line_number":1136,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1137,"context_line":"    nova-os_compute_api_os-lock-server_unlock_unlock_override:"},{"line_number":1138,"context_line":"      key: \"os_compute_api:os-lock-server:unlock:unlock_override\""},{"line_number":1139,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"e3725c3a_0fcac9ed","line":1136,"range":{"start_line":1131,"start_character":3,"end_line":1136,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1134,"context_line":"    nova-os_compute_api_os-lock-server_unlock:"},{"line_number":1135,"context_line":"      key: \"os_compute_api:os-lock-server:unlock\""},{"line_number":1136,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1137,"context_line":"    nova-os_compute_api_os-lock-server_unlock_unlock_override:"},{"line_number":1138,"context_line":"      key: \"os_compute_api:os-lock-server:unlock:unlock_override\""},{"line_number":1139,"context_line":"      value: \"rule:admin_required\""},{"line_number":1140,"context_line":"    nova-os_compute_api_os-migrate-server_migrate:"},{"line_number":1141,"context_line":"      key: \"os_compute_api:os-migrate-server:migrate\""},{"line_number":1142,"context_line":"      value: \"rule:admin_required\""},{"line_number":1143,"context_line":"    nova-os_compute_api_os-migrate-server_migrate_live:"},{"line_number":1144,"context_line":"      key: \"os_compute_api:os-migrate-server:migrate_live\""},{"line_number":1145,"context_line":"      value: \"rule:admin_required\""},{"line_number":1146,"context_line":"    nova-os_compute_api_os-migrations_index:"},{"line_number":1147,"context_line":"      key: \"os_compute_api:os-migrations:index\""},{"line_number":1148,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"07c6f891_faac6b11","line":1145,"range":{"start_line":1137,"start_character":4,"end_line":1145,"end_character":34},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1143,"context_line":"    nova-os_compute_api_os-migrate-server_migrate_live:"},{"line_number":1144,"context_line":"      key: \"os_compute_api:os-migrate-server:migrate_live\""},{"line_number":1145,"context_line":"      value: \"rule:admin_required\""},{"line_number":1146,"context_line":"    nova-os_compute_api_os-migrations_index:"},{"line_number":1147,"context_line":"      key: \"os_compute_api:os-migrations:index\""},{"line_number":1148,"context_line":"      value: \"rule:admin_required\""},{"line_number":1149,"context_line":"    nova-os_compute_api_os-multinic:"},{"line_number":1150,"context_line":"      key: \"os_compute_api:os-multinic\""},{"line_number":1151,"context_line":"      value: \"rule:os_compute_api:os-multinic:remove\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"768ec247_e0349b0b","line":1148,"range":{"start_line":1146,"start_character":1,"end_line":1148,"end_character":34},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_reader_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1148,"context_line":"      value: \"rule:admin_required\""},{"line_number":1149,"context_line":"    nova-os_compute_api_os-multinic:"},{"line_number":1150,"context_line":"      key: \"os_compute_api:os-multinic\""},{"line_number":1151,"context_line":"      value: \"rule:os_compute_api:os-multinic:remove\""},{"line_number":1152,"context_line":"    nova-os_compute_api_os-multinic_add:"},{"line_number":1153,"context_line":"      key: \"os_compute_api:os-multinic:add\""},{"line_number":1154,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"c4fc7631_901e1505","line":1151,"range":{"start_line":1151,"start_character":46,"end_line":1151,"end_character":52},"updated":"2021-09-22 12:57:08.000000000","message":"add https://review.opendev.org/c/openstack/tripleo-heat-templates/+/810321/2/environments/enable-secure-rbac.yaml#315","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1149,"context_line":"    nova-os_compute_api_os-multinic:"},{"line_number":1150,"context_line":"      key: \"os_compute_api:os-multinic\""},{"line_number":1151,"context_line":"      value: \"rule:os_compute_api:os-multinic:remove\""},{"line_number":1152,"context_line":"    nova-os_compute_api_os-multinic_add:"},{"line_number":1153,"context_line":"      key: \"os_compute_api:os-multinic:add\""},{"line_number":1154,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1155,"context_line":"    nova-os_compute_api_os-multinic_remove:"},{"line_number":1156,"context_line":"      key: \"os_compute_api:os-multinic:remove\""},{"line_number":1157,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1158,"context_line":"    nova-os_compute_api_os-networks_list:"},{"line_number":1159,"context_line":"      key: \"os_compute_api:os-networks:list\""},{"line_number":1160,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"44ffb554_fc573823","line":1157,"range":{"start_line":1152,"start_character":4,"end_line":1157,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1155,"context_line":"    nova-os_compute_api_os-multinic_remove:"},{"line_number":1156,"context_line":"      key: \"os_compute_api:os-multinic:remove\""},{"line_number":1157,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1158,"context_line":"    nova-os_compute_api_os-networks_list:"},{"line_number":1159,"context_line":"      key: \"os_compute_api:os-networks:list\""},{"line_number":1160,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1161,"context_line":"    nova-os_compute_api_os-networks_show:"},{"line_number":1162,"context_line":"      key: \"os_compute_api:os-networks:show\""},{"line_number":1163,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1164,"context_line":"    nova-os_compute_api_os-networks_view:"},{"line_number":1165,"context_line":"      key: \"os_compute_api:os-networks:view\""},{"line_number":1166,"context_line":"      value: \"rule:os_compute_api:os-networks:show\""},{"line_number":1167,"context_line":"    nova-os_compute_api_os-pause-server_pause:"},{"line_number":1168,"context_line":"      key: \"os_compute_api:os-pause-server:pause\""},{"line_number":1169,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"d3838c4a_03fb657f","line":1166,"range":{"start_line":1158,"start_character":3,"end_line":1166,"end_character":51},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_or_project_reader\n\nand rule:os_compute_api:os-networks:show vs rule:os_compute_api:os-networks:list \n\ni dont know which of these two is correct but its make it a lot harder to reason about since this does not seam to be reliable\nhttps://review.opendev.org/c/openstack/tripleo-heat-templates/+/810321/2/environments/enable-secure-rbac.yaml#324","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1164,"context_line":"    nova-os_compute_api_os-networks_view:"},{"line_number":1165,"context_line":"      key: \"os_compute_api:os-networks:view\""},{"line_number":1166,"context_line":"      value: \"rule:os_compute_api:os-networks:show\""},{"line_number":1167,"context_line":"    nova-os_compute_api_os-pause-server_pause:"},{"line_number":1168,"context_line":"      key: \"os_compute_api:os-pause-server:pause\""},{"line_number":1169,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1170,"context_line":"    nova-os_compute_api_os-pause-server_unpause:"},{"line_number":1171,"context_line":"      key: \"os_compute_api:os-pause-server:unpause\""},{"line_number":1172,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1173,"context_line":"    nova-os_compute_api_os-quota-class-sets_show:"},{"line_number":1174,"context_line":"      key: \"os_compute_api:os-quota-class-sets:show\""},{"line_number":1175,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"2dd8baee_a95741a2","line":1172,"range":{"start_line":1167,"start_character":1,"end_line":1172,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1172,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1173,"context_line":"    nova-os_compute_api_os-quota-class-sets_show:"},{"line_number":1174,"context_line":"      key: \"os_compute_api:os-quota-class-sets:show\""},{"line_number":1175,"context_line":"      value: \"rule:admin_required\""},{"line_number":1176,"context_line":"    nova-os_compute_api_os-quota-class-sets_update:"},{"line_number":1177,"context_line":"      key: \"os_compute_api:os-quota-class-sets:update\""},{"line_number":1178,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"d22f1d5a_c7d0ba88","line":1175,"range":{"start_line":1175,"start_character":19,"end_line":1175,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_reader_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1173,"context_line":"    nova-os_compute_api_os-quota-class-sets_show:"},{"line_number":1174,"context_line":"      key: \"os_compute_api:os-quota-class-sets:show\""},{"line_number":1175,"context_line":"      value: \"rule:admin_required\""},{"line_number":1176,"context_line":"    nova-os_compute_api_os-quota-class-sets_update:"},{"line_number":1177,"context_line":"      key: \"os_compute_api:os-quota-class-sets:update\""},{"line_number":1178,"context_line":"      value: \"rule:admin_required\""},{"line_number":1179,"context_line":"    nova-os_compute_api_os-quota-sets_delete:"},{"line_number":1180,"context_line":"      key: \"os_compute_api:os-quota-sets:delete\""},{"line_number":1181,"context_line":"      value: \"rule:admin_required\""},{"line_number":1182,"context_line":"    nova-os_compute_api_os-quota-sets_detail:"},{"line_number":1183,"context_line":"      key: \"os_compute_api:os-quota-sets:detail\""},{"line_number":1184,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"c341a4d9_3da8bbc6","line":1181,"range":{"start_line":1176,"start_character":3,"end_line":1181,"end_character":34},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1179,"context_line":"    nova-os_compute_api_os-quota-sets_delete:"},{"line_number":1180,"context_line":"      key: \"os_compute_api:os-quota-sets:delete\""},{"line_number":1181,"context_line":"      value: \"rule:admin_required\""},{"line_number":1182,"context_line":"    nova-os_compute_api_os-quota-sets_detail:"},{"line_number":1183,"context_line":"      key: \"os_compute_api:os-quota-sets:detail\""},{"line_number":1184,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1185,"context_line":"    nova-os_compute_api_os-quota-sets_show:"},{"line_number":1186,"context_line":"      key: \"os_compute_api:os-quota-sets:show\""},{"line_number":1187,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1188,"context_line":"    nova-os_compute_api_os-quota-sets_update:"},{"line_number":1189,"context_line":"      key: \"os_compute_api:os-quota-sets:update\""},{"line_number":1190,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"4afe6b17_f312405b","line":1187,"range":{"start_line":1182,"start_character":1,"end_line":1187,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_or_project_reader","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1187,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1188,"context_line":"    nova-os_compute_api_os-quota-sets_update:"},{"line_number":1189,"context_line":"      key: \"os_compute_api:os-quota-sets:update\""},{"line_number":1190,"context_line":"      value: \"rule:admin_required\""},{"line_number":1191,"context_line":"    nova-os_compute_api_os-remote-consoles:"},{"line_number":1192,"context_line":"      key: \"os_compute_api:os-remote-consoles\""},{"line_number":1193,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"960d6806_6446f9d0","line":1190,"range":{"start_line":1190,"start_character":19,"end_line":1190,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1190,"context_line":"      value: \"rule:admin_required\""},{"line_number":1191,"context_line":"    nova-os_compute_api_os-remote-consoles:"},{"line_number":1192,"context_line":"      key: \"os_compute_api:os-remote-consoles\""},{"line_number":1193,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1194,"context_line":"    nova-os_compute_api_os-rescue:"},{"line_number":1195,"context_line":"      key: \"os_compute_api:os-rescue\""},{"line_number":1196,"context_line":"      value: \"rule:os_compute_api:os-unrescue\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"310a7efc_378a14b9","line":1193,"range":{"start_line":1193,"start_character":19,"end_line":1193,"end_character":42},"updated":"2021-09-22 12:57:08.000000000","message":"system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1193,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1194,"context_line":"    nova-os_compute_api_os-rescue:"},{"line_number":1195,"context_line":"      key: \"os_compute_api:os-rescue\""},{"line_number":1196,"context_line":"      value: \"rule:os_compute_api:os-unrescue\""},{"line_number":1197,"context_line":"    nova-os_compute_api_os-security-groups:"},{"line_number":1198,"context_line":"      key: \"os_compute_api:os-security-groups\""},{"line_number":1199,"context_line":"      value: \"rule:os_compute_api:os-security-groups:remove\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"a6760172_4f778e46","line":1196,"range":{"start_line":1196,"start_character":14,"end_line":1196,"end_character":45},"updated":"2021-09-22 12:57:08.000000000","message":"this end up being the same but we do not make resuce depend on unrescue in \n\nhttps://review.opendev.org/c/openstack/tripleo-heat-templates/+/810321/2/environments/enable-secure-rbac.yaml#358\n\nit uses system_admin_or_owner directly\n\nso this shoudl be admin_or_project_member","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1196,"context_line":"      value: \"rule:os_compute_api:os-unrescue\""},{"line_number":1197,"context_line":"    nova-os_compute_api_os-security-groups:"},{"line_number":1198,"context_line":"      key: \"os_compute_api:os-security-groups\""},{"line_number":1199,"context_line":"      value: \"rule:os_compute_api:os-security-groups:remove\""},{"line_number":1200,"context_line":"    nova-os_compute_api_os-security-groups_add:"},{"line_number":1201,"context_line":"      key: \"os_compute_api:os-security-groups:add\""},{"line_number":1202,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"4e42b2c3_a2513fb8","line":1199,"range":{"start_line":1199,"start_character":53,"end_line":1199,"end_character":59},"updated":"2021-09-22 12:57:08.000000000","message":"get\n\nthe base would be admin_or_project_reader with get but its admin_or_project_member with this default.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1197,"context_line":"    nova-os_compute_api_os-security-groups:"},{"line_number":1198,"context_line":"      key: \"os_compute_api:os-security-groups\""},{"line_number":1199,"context_line":"      value: \"rule:os_compute_api:os-security-groups:remove\""},{"line_number":1200,"context_line":"    nova-os_compute_api_os-security-groups_add:"},{"line_number":1201,"context_line":"      key: \"os_compute_api:os-security-groups:add\""},{"line_number":1202,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1203,"context_line":"    nova-os_compute_api_os-security-groups_create:"},{"line_number":1204,"context_line":"      key: \"os_compute_api:os-security-groups:create\""},{"line_number":1205,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1206,"context_line":"    nova-os_compute_api_os-security-groups_delete:"},{"line_number":1207,"context_line":"      key: \"os_compute_api:os-security-groups:delete\""},{"line_number":1208,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1209,"context_line":"    nova-os_compute_api_os-security-groups_get:"},{"line_number":1210,"context_line":"      key: \"os_compute_api:os-security-groups:get\""},{"line_number":1211,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"0a988e57_4ff73a61","line":1208,"range":{"start_line":1200,"start_character":3,"end_line":1208,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1206,"context_line":"    nova-os_compute_api_os-security-groups_delete:"},{"line_number":1207,"context_line":"      key: \"os_compute_api:os-security-groups:delete\""},{"line_number":1208,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1209,"context_line":"    nova-os_compute_api_os-security-groups_get:"},{"line_number":1210,"context_line":"      key: \"os_compute_api:os-security-groups:get\""},{"line_number":1211,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1212,"context_line":"    nova-os_compute_api_os-security-groups_list:"},{"line_number":1213,"context_line":"      key: \"os_compute_api:os-security-groups:list\""},{"line_number":1214,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1215,"context_line":"    nova-os_compute_api_os-security-groups_remove:"},{"line_number":1216,"context_line":"      key: \"os_compute_api:os-security-groups:remove\""},{"line_number":1217,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"cec53df7_280badbb","line":1214,"range":{"start_line":1209,"start_character":1,"end_line":1214,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_or_project_reader","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1212,"context_line":"    nova-os_compute_api_os-security-groups_list:"},{"line_number":1213,"context_line":"      key: \"os_compute_api:os-security-groups:list\""},{"line_number":1214,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1215,"context_line":"    nova-os_compute_api_os-security-groups_remove:"},{"line_number":1216,"context_line":"      key: \"os_compute_api:os-security-groups:remove\""},{"line_number":1217,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1218,"context_line":"    nova-os_compute_api_os-security-groups_rule_create:"},{"line_number":1219,"context_line":"      key: \"os_compute_api:os-security-groups:rule:create\""},{"line_number":1220,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1221,"context_line":"    nova-os_compute_api_os-security-groups_rule_delete:"},{"line_number":1222,"context_line":"      key: \"os_compute_api:os-security-groups:rule:delete\""},{"line_number":1223,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1224,"context_line":"    nova-os_compute_api_os-security-groups_show:"},{"line_number":1225,"context_line":"      key: \"os_compute_api:os-security-groups:show\""},{"line_number":1226,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"77e2de85_bece74b7","line":1223,"range":{"start_line":1215,"start_character":0,"end_line":1223,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1223,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1224,"context_line":"    nova-os_compute_api_os-security-groups_show:"},{"line_number":1225,"context_line":"      key: \"os_compute_api:os-security-groups:show\""},{"line_number":1226,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1227,"context_line":"    nova-os_compute_api_os-security-groups_update:"},{"line_number":1228,"context_line":"      key: \"os_compute_api:os-security-groups:update\""},{"line_number":1229,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"0df8a208_37bd2aff","line":1226,"range":{"start_line":1226,"start_character":19,"end_line":1226,"end_character":42},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_or_project_reader","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1226,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1227,"context_line":"    nova-os_compute_api_os-security-groups_update:"},{"line_number":1228,"context_line":"      key: \"os_compute_api:os-security-groups:update\""},{"line_number":1229,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1230,"context_line":"    nova-os_compute_api_os-server-diagnostics:"},{"line_number":1231,"context_line":"      key: \"os_compute_api:os-server-diagnostics\""},{"line_number":1232,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"7e402b21_9cd26c11","line":1229,"range":{"start_line":1229,"start_character":19,"end_line":1229,"end_character":42},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1227,"context_line":"    nova-os_compute_api_os-security-groups_update:"},{"line_number":1228,"context_line":"      key: \"os_compute_api:os-security-groups:update\""},{"line_number":1229,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1230,"context_line":"    nova-os_compute_api_os-server-diagnostics:"},{"line_number":1231,"context_line":"      key: \"os_compute_api:os-server-diagnostics\""},{"line_number":1232,"context_line":"      value: \"rule:admin_required\""},{"line_number":1233,"context_line":"    nova-os_compute_api_os-server-external-events_create:"},{"line_number":1234,"context_line":"      key: \"os_compute_api:os-server-external-events:create\""},{"line_number":1235,"context_line":"      value: \"rule:admin_required\""},{"line_number":1236,"context_line":"    nova-os_compute_api_os-server-groups_create:"},{"line_number":1237,"context_line":"      key: \"os_compute_api:os-server-groups:create\""},{"line_number":1238,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"2c25cfb3_4c4ef00e","line":1235,"range":{"start_line":1230,"start_character":0,"end_line":1235,"end_character":34},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1235,"context_line":"      value: \"rule:admin_required\""},{"line_number":1236,"context_line":"    nova-os_compute_api_os-server-groups_create:"},{"line_number":1237,"context_line":"      key: \"os_compute_api:os-server-groups:create\""},{"line_number":1238,"context_line":"      value: \"rule:admin_required\""},{"line_number":1239,"context_line":"    nova-os_compute_api_os-server-groups_delete:"},{"line_number":1240,"context_line":"      key: \"os_compute_api:os-server-groups:delete\""},{"line_number":1241,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"51ffc5a6_2d658013","line":1238,"range":{"start_line":1238,"start_character":19,"end_line":1238,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"-1 this should be equvalent to project_member_api\nhttps://review.opendev.org/c/openstack/tripleo-heat-templates/+/810321/2/environments/enable-secure-rbac.yaml#405\n\nserver groups are tenant facing apis that do not need eleveated permisison beyond project member\n\nadmin_or_project_member is likely ok","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1238,"context_line":"      value: \"rule:admin_required\""},{"line_number":1239,"context_line":"    nova-os_compute_api_os-server-groups_delete:"},{"line_number":1240,"context_line":"      key: \"os_compute_api:os-server-groups:delete\""},{"line_number":1241,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1242,"context_line":"    nova-os_compute_api_os-server-groups_index:"},{"line_number":1243,"context_line":"      key: \"os_compute_api:os-server-groups:index\""},{"line_number":1244,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"ccfce349_280d3785","line":1241,"range":{"start_line":1241,"start_character":19,"end_line":1241,"end_character":42},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1241,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1242,"context_line":"    nova-os_compute_api_os-server-groups_index:"},{"line_number":1243,"context_line":"      key: \"os_compute_api:os-server-groups:index\""},{"line_number":1244,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1245,"context_line":"    nova-os_compute_api_os-server-groups_index_all_projects:"},{"line_number":1246,"context_line":"      key: \"os_compute_api:os-server-groups:index:all_projects\""},{"line_number":1247,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"4bbb4b71_e16d63db","line":1244,"range":{"start_line":1244,"start_character":19,"end_line":1244,"end_character":42},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_or_project_reader","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1244,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1245,"context_line":"    nova-os_compute_api_os-server-groups_index_all_projects:"},{"line_number":1246,"context_line":"      key: \"os_compute_api:os-server-groups:index:all_projects\""},{"line_number":1247,"context_line":"      value: \"rule:admin_required\""},{"line_number":1248,"context_line":"    nova-os_compute_api_os-server-groups_show:"},{"line_number":1249,"context_line":"      key: \"os_compute_api:os-server-groups:show\""},{"line_number":1250,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"f0d3eb15_12b9baa8","line":1247,"range":{"start_line":1247,"start_character":19,"end_line":1247,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_reader_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1247,"context_line":"      value: \"rule:admin_required\""},{"line_number":1248,"context_line":"    nova-os_compute_api_os-server-groups_show:"},{"line_number":1249,"context_line":"      key: \"os_compute_api:os-server-groups:show\""},{"line_number":1250,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1251,"context_line":"    nova-os_compute_api_os-server-password:"},{"line_number":1252,"context_line":"      key: \"os_compute_api:os-server-password\""},{"line_number":1253,"context_line":"      value: \"rule:os_compute_api:os-server-password:clear\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"43999d22_1d84835c","line":1250,"range":{"start_line":1250,"start_character":0,"end_line":1250,"end_character":4},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_or_project_reader","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1250,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1251,"context_line":"    nova-os_compute_api_os-server-password:"},{"line_number":1252,"context_line":"      key: \"os_compute_api:os-server-password\""},{"line_number":1253,"context_line":"      value: \"rule:os_compute_api:os-server-password:clear\""},{"line_number":1254,"context_line":"    nova-os_compute_api_os-server-password_clear:"},{"line_number":1255,"context_line":"      key: \"os_compute_api:os-server-password:clear\""},{"line_number":1256,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"fd810b60_3759d47a","line":1253,"range":{"start_line":1253,"start_character":53,"end_line":1253,"end_character":58},"updated":"2021-09-22 12:57:08.000000000","message":"show","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1253,"context_line":"      value: \"rule:os_compute_api:os-server-password:clear\""},{"line_number":1254,"context_line":"    nova-os_compute_api_os-server-password_clear:"},{"line_number":1255,"context_line":"      key: \"os_compute_api:os-server-password:clear\""},{"line_number":1256,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1257,"context_line":"    nova-os_compute_api_os-server-password_show:"},{"line_number":1258,"context_line":"      key: \"os_compute_api:os-server-password:show\""},{"line_number":1259,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"5133c0ba_a203e713","line":1256,"range":{"start_line":1256,"start_character":19,"end_line":1256,"end_character":42},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1256,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1257,"context_line":"    nova-os_compute_api_os-server-password_show:"},{"line_number":1258,"context_line":"      key: \"os_compute_api:os-server-password:show\""},{"line_number":1259,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1260,"context_line":"    nova-os_compute_api_os-server-tags_delete:"},{"line_number":1261,"context_line":"      key: \"os_compute_api:os-server-tags:delete\""},{"line_number":1262,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"022975de_50075a7e","line":1259,"range":{"start_line":1259,"start_character":19,"end_line":1259,"end_character":42},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_or_project_reader","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1257,"context_line":"    nova-os_compute_api_os-server-password_show:"},{"line_number":1258,"context_line":"      key: \"os_compute_api:os-server-password:show\""},{"line_number":1259,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1260,"context_line":"    nova-os_compute_api_os-server-tags_delete:"},{"line_number":1261,"context_line":"      key: \"os_compute_api:os-server-tags:delete\""},{"line_number":1262,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1263,"context_line":"    nova-os_compute_api_os-server-tags_delete_all:"},{"line_number":1264,"context_line":"      key: \"os_compute_api:os-server-tags:delete_all\""},{"line_number":1265,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1266,"context_line":"    nova-os_compute_api_os-server-tags_index:"},{"line_number":1267,"context_line":"      key: \"os_compute_api:os-server-tags:index\""},{"line_number":1268,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"831e4749_ab5070a6","line":1265,"range":{"start_line":1260,"start_character":2,"end_line":1265,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1263,"context_line":"    nova-os_compute_api_os-server-tags_delete_all:"},{"line_number":1264,"context_line":"      key: \"os_compute_api:os-server-tags:delete_all\""},{"line_number":1265,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1266,"context_line":"    nova-os_compute_api_os-server-tags_index:"},{"line_number":1267,"context_line":"      key: \"os_compute_api:os-server-tags:index\""},{"line_number":1268,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1269,"context_line":"    nova-os_compute_api_os-server-tags_show:"},{"line_number":1270,"context_line":"      key: \"os_compute_api:os-server-tags:show\""},{"line_number":1271,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1272,"context_line":"    nova-os_compute_api_os-server-tags_update:"},{"line_number":1273,"context_line":"      key: \"os_compute_api:os-server-tags:update\""},{"line_number":1274,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"25af6a89_7c25a17f","line":1271,"range":{"start_line":1266,"start_character":1,"end_line":1271,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_or_project_reader","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1269,"context_line":"    nova-os_compute_api_os-server-tags_show:"},{"line_number":1270,"context_line":"      key: \"os_compute_api:os-server-tags:show\""},{"line_number":1271,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1272,"context_line":"    nova-os_compute_api_os-server-tags_update:"},{"line_number":1273,"context_line":"      key: \"os_compute_api:os-server-tags:update\""},{"line_number":1274,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1275,"context_line":"    nova-os_compute_api_os-server-tags_update_all:"},{"line_number":1276,"context_line":"      key: \"os_compute_api:os-server-tags:update_all\""},{"line_number":1277,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1278,"context_line":"    nova-os_compute_api_os-services:"},{"line_number":1279,"context_line":"      key: \"os_compute_api:os-services\""},{"line_number":1280,"context_line":"      value: \"rule:os_compute_api:os-services:delete\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"89cbfeff_2a1c1bac","line":1277,"range":{"start_line":1272,"start_character":1,"end_line":1277,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1277,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1278,"context_line":"    nova-os_compute_api_os-services:"},{"line_number":1279,"context_line":"      key: \"os_compute_api:os-services\""},{"line_number":1280,"context_line":"      value: \"rule:os_compute_api:os-services:delete\""},{"line_number":1281,"context_line":"    nova-os_compute_api_os-services_delete:"},{"line_number":1282,"context_line":"      key: \"os_compute_api:os-services:delete\""},{"line_number":1283,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"c0c93c7e_a4a5c3c7","line":1280,"range":{"start_line":1280,"start_character":46,"end_line":1280,"end_character":52},"updated":"2021-09-22 12:57:08.000000000","message":"list vs delete but both will use the same policy","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1278,"context_line":"    nova-os_compute_api_os-services:"},{"line_number":1279,"context_line":"      key: \"os_compute_api:os-services\""},{"line_number":1280,"context_line":"      value: \"rule:os_compute_api:os-services:delete\""},{"line_number":1281,"context_line":"    nova-os_compute_api_os-services_delete:"},{"line_number":1282,"context_line":"      key: \"os_compute_api:os-services:delete\""},{"line_number":1283,"context_line":"      value: \"rule:admin_required\""},{"line_number":1284,"context_line":"    nova-os_compute_api_os-services_list:"},{"line_number":1285,"context_line":"      key: \"os_compute_api:os-services:list\""},{"line_number":1286,"context_line":"      value: \"rule:admin_required\""},{"line_number":1287,"context_line":"    nova-os_compute_api_os-services_update:"},{"line_number":1288,"context_line":"      key: \"os_compute_api:os-services:update\""},{"line_number":1289,"context_line":"      value: \"rule:admin_required\""},{"line_number":1290,"context_line":"    nova-os_compute_api_os-shelve_shelve:"},{"line_number":1291,"context_line":"      key: \"os_compute_api:os-shelve:shelve\""},{"line_number":1292,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"64880ed2_1cb180dc","line":1289,"range":{"start_line":1281,"start_character":0,"end_line":1289,"end_character":34},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1287,"context_line":"    nova-os_compute_api_os-services_update:"},{"line_number":1288,"context_line":"      key: \"os_compute_api:os-services:update\""},{"line_number":1289,"context_line":"      value: \"rule:admin_required\""},{"line_number":1290,"context_line":"    nova-os_compute_api_os-shelve_shelve:"},{"line_number":1291,"context_line":"      key: \"os_compute_api:os-shelve:shelve\""},{"line_number":1292,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1293,"context_line":"    nova-os_compute_api_os-shelve_shelve_offload:"},{"line_number":1294,"context_line":"      key: \"os_compute_api:os-shelve:shelve_offload\""},{"line_number":1295,"context_line":"      value: \"rule:admin_required\""},{"line_number":1296,"context_line":"    nova-os_compute_api_os-shelve_unshelve:"},{"line_number":1297,"context_line":"      key: \"os_compute_api:os-shelve:unshelve\""},{"line_number":1298,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1299,"context_line":"    nova-os_compute_api_os-simple-tenant-usage_list:"},{"line_number":1300,"context_line":"      key: \"os_compute_api:os-simple-tenant-usage:list\""},{"line_number":1301,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"f79b7d22_7f3acfcb","line":1298,"range":{"start_line":1290,"start_character":1,"end_line":1298,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack shelve and unshelve are  system_admin_or_owner and      nova-os_compute_api_os-shelve_shelve_offload: system_admin_api\n\nso these are correct","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1298,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1299,"context_line":"    nova-os_compute_api_os-simple-tenant-usage_list:"},{"line_number":1300,"context_line":"      key: \"os_compute_api:os-simple-tenant-usage:list\""},{"line_number":1301,"context_line":"      value: \"rule:admin_required\""},{"line_number":1302,"context_line":"    nova-os_compute_api_os-simple-tenant-usage_show:"},{"line_number":1303,"context_line":"      key: \"os_compute_api:os-simple-tenant-usage:show\""},{"line_number":1304,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"3e4ad775_fedbd129","line":1301,"range":{"start_line":1301,"start_character":19,"end_line":1301,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"system_reader_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1301,"context_line":"      value: \"rule:admin_required\""},{"line_number":1302,"context_line":"    nova-os_compute_api_os-simple-tenant-usage_show:"},{"line_number":1303,"context_line":"      key: \"os_compute_api:os-simple-tenant-usage:show\""},{"line_number":1304,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1305,"context_line":"    nova-os_compute_api_os-suspend-server_resume:"},{"line_number":1306,"context_line":"      key: \"os_compute_api:os-suspend-server:resume\""},{"line_number":1307,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"941b4273_16c93e32","line":1304,"range":{"start_line":1304,"start_character":19,"end_line":1304,"end_character":42},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_or_project_reader","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1302,"context_line":"    nova-os_compute_api_os-simple-tenant-usage_show:"},{"line_number":1303,"context_line":"      key: \"os_compute_api:os-simple-tenant-usage:show\""},{"line_number":1304,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1305,"context_line":"    nova-os_compute_api_os-suspend-server_resume:"},{"line_number":1306,"context_line":"      key: \"os_compute_api:os-suspend-server:resume\""},{"line_number":1307,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1308,"context_line":"    nova-os_compute_api_os-suspend-server_suspend:"},{"line_number":1309,"context_line":"      key: \"os_compute_api:os-suspend-server:suspend\""},{"line_number":1310,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1311,"context_line":"    nova-os_compute_api_os-tenant-networks:"},{"line_number":1312,"context_line":"      key: \"os_compute_api:os-tenant-networks\""},{"line_number":1313,"context_line":"      value: \"rule:os_compute_api:os-tenant-networks:show\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"0e8e8eea_f7ac19ce","line":1310,"range":{"start_line":1305,"start_character":1,"end_line":1310,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1310,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1311,"context_line":"    nova-os_compute_api_os-tenant-networks:"},{"line_number":1312,"context_line":"      key: \"os_compute_api:os-tenant-networks\""},{"line_number":1313,"context_line":"      value: \"rule:os_compute_api:os-tenant-networks:show\""},{"line_number":1314,"context_line":"    nova-os_compute_api_os-tenant-networks_list:"},{"line_number":1315,"context_line":"      key: \"os_compute_api:os-tenant-networks:list\""},{"line_number":1316,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"41625ba2_35873c45","line":1313,"range":{"start_line":1313,"start_character":53,"end_line":1313,"end_character":57},"updated":"2021-09-22 12:57:08.000000000","message":"show vs list but have same policy","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1311,"context_line":"    nova-os_compute_api_os-tenant-networks:"},{"line_number":1312,"context_line":"      key: \"os_compute_api:os-tenant-networks\""},{"line_number":1313,"context_line":"      value: \"rule:os_compute_api:os-tenant-networks:show\""},{"line_number":1314,"context_line":"    nova-os_compute_api_os-tenant-networks_list:"},{"line_number":1315,"context_line":"      key: \"os_compute_api:os-tenant-networks:list\""},{"line_number":1316,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1317,"context_line":"    nova-os_compute_api_os-tenant-networks_show:"},{"line_number":1318,"context_line":"      key: \"os_compute_api:os-tenant-networks:show\""},{"line_number":1319,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1320,"context_line":"    nova-os_compute_api_os-unrescue:"},{"line_number":1321,"context_line":"      key: \"os_compute_api:os-unrescue\""},{"line_number":1322,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"b08f8fc3_15f523ea","line":1319,"range":{"start_line":1314,"start_character":2,"end_line":1319,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_or_project_reader","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1319,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1320,"context_line":"    nova-os_compute_api_os-unrescue:"},{"line_number":1321,"context_line":"      key: \"os_compute_api:os-unrescue\""},{"line_number":1322,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1323,"context_line":"    nova-os_compute_api_os-used-limits:"},{"line_number":1324,"context_line":"      key: \"os_compute_api:os-used-limits\""},{"line_number":1325,"context_line":"      value: \"rule:os_compute_api:limits:other_project\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"1e00327b_562c91b2","line":1322,"range":{"start_line":1322,"start_character":19,"end_line":1322,"end_character":42},"updated":"2021-09-22 12:57:08.000000000","message":"covered previously this is correct but its annoying this is not grouped with rescue\n\ni think you sorted this list at some point enaing that common itmes are not always groups now.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1322,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1323,"context_line":"    nova-os_compute_api_os-used-limits:"},{"line_number":1324,"context_line":"      key: \"os_compute_api:os-used-limits\""},{"line_number":1325,"context_line":"      value: \"rule:os_compute_api:limits:other_project\""},{"line_number":1326,"context_line":"    nova-os_compute_api_os-volumes:"},{"line_number":1327,"context_line":"      key: \"os_compute_api:os-volumes\""},{"line_number":1328,"context_line":"      value: \"rule:os_compute_api:os-volumes:snapshots:delete\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"9ada020d_340370a5","line":1325,"range":{"start_line":1325,"start_character":0,"end_line":1325,"end_character":55},"updated":"2021-09-22 12:57:08.000000000","message":"-1 this does not exist so i assume it is a default so ti will be system_reader_api\n\nbut that would need to be admin_or_project_reader","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1325,"context_line":"      value: \"rule:os_compute_api:limits:other_project\""},{"line_number":1326,"context_line":"    nova-os_compute_api_os-volumes:"},{"line_number":1327,"context_line":"      key: \"os_compute_api:os-volumes\""},{"line_number":1328,"context_line":"      value: \"rule:os_compute_api:os-volumes:snapshots:delete\""},{"line_number":1329,"context_line":"    nova-os_compute_api_os-volumes-attachments_create:"},{"line_number":1330,"context_line":"      key: \"os_compute_api:os-volumes-attachments:create\""},{"line_number":1331,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"f225f9d2_fa11f2ae","line":1328,"range":{"start_line":1328,"start_character":55,"end_line":1328,"end_character":61},"updated":"2021-09-22 12:57:08.000000000","message":"list vs delete","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1326,"context_line":"    nova-os_compute_api_os-volumes:"},{"line_number":1327,"context_line":"      key: \"os_compute_api:os-volumes\""},{"line_number":1328,"context_line":"      value: \"rule:os_compute_api:os-volumes:snapshots:delete\""},{"line_number":1329,"context_line":"    nova-os_compute_api_os-volumes-attachments_create:"},{"line_number":1330,"context_line":"      key: \"os_compute_api:os-volumes-attachments:create\""},{"line_number":1331,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1332,"context_line":"    nova-os_compute_api_os-volumes-attachments_delete:"},{"line_number":1333,"context_line":"      key: \"os_compute_api:os-volumes-attachments:delete\""},{"line_number":1334,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1335,"context_line":"    nova-os_compute_api_os-volumes-attachments_index:"},{"line_number":1336,"context_line":"      key: \"os_compute_api:os-volumes-attachments:index\""},{"line_number":1337,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"e48cbf44_7652b673","line":1334,"range":{"start_line":1329,"start_character":3,"end_line":1334,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1332,"context_line":"    nova-os_compute_api_os-volumes-attachments_delete:"},{"line_number":1333,"context_line":"      key: \"os_compute_api:os-volumes-attachments:delete\""},{"line_number":1334,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1335,"context_line":"    nova-os_compute_api_os-volumes-attachments_index:"},{"line_number":1336,"context_line":"      key: \"os_compute_api:os-volumes-attachments:index\""},{"line_number":1337,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1338,"context_line":"    nova-os_compute_api_os-volumes-attachments_show:"},{"line_number":1339,"context_line":"      key: \"os_compute_api:os-volumes-attachments:show\""},{"line_number":1340,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1341,"context_line":"    nova-os_compute_api_os-volumes-attachments_swap:"},{"line_number":1342,"context_line":"      key: \"os_compute_api:os-volumes-attachments:swap\""},{"line_number":1343,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"2347fed1_7fd3b269","line":1340,"range":{"start_line":1335,"start_character":0,"end_line":1340,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_or_project_reader","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1340,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1341,"context_line":"    nova-os_compute_api_os-volumes-attachments_swap:"},{"line_number":1342,"context_line":"      key: \"os_compute_api:os-volumes-attachments:swap\""},{"line_number":1343,"context_line":"      value: \"rule:admin_required\""},{"line_number":1344,"context_line":"    nova-os_compute_api_os-volumes-attachments_update:"},{"line_number":1345,"context_line":"      key: \"os_compute_api:os-volumes-attachments:update\""},{"line_number":1346,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"774036c4_cf5e6028","line":1343,"range":{"start_line":1343,"start_character":19,"end_line":1343,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1343,"context_line":"      value: \"rule:admin_required\""},{"line_number":1344,"context_line":"    nova-os_compute_api_os-volumes-attachments_update:"},{"line_number":1345,"context_line":"      key: \"os_compute_api:os-volumes-attachments:update\""},{"line_number":1346,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1347,"context_line":"    nova-os_compute_api_os-volumes_create:"},{"line_number":1348,"context_line":"      key: \"os_compute_api:os-volumes:create\""},{"line_number":1349,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"23bffbb0_31ab8bbb","line":1346,"range":{"start_line":1346,"start_character":19,"end_line":1346,"end_character":42},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1344,"context_line":"    nova-os_compute_api_os-volumes-attachments_update:"},{"line_number":1345,"context_line":"      key: \"os_compute_api:os-volumes-attachments:update\""},{"line_number":1346,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1347,"context_line":"    nova-os_compute_api_os-volumes_create:"},{"line_number":1348,"context_line":"      key: \"os_compute_api:os-volumes:create\""},{"line_number":1349,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1350,"context_line":"    nova-os_compute_api_os-volumes_delete:"},{"line_number":1351,"context_line":"      key: \"os_compute_api:os-volumes:delete\""},{"line_number":1352,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1353,"context_line":"    nova-os_compute_api_os-volumes_detail:"},{"line_number":1354,"context_line":"      key: \"os_compute_api:os-volumes:detail\""},{"line_number":1355,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"573e7fda_22256357","line":1352,"range":{"start_line":1347,"start_character":3,"end_line":1352,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1350,"context_line":"    nova-os_compute_api_os-volumes_delete:"},{"line_number":1351,"context_line":"      key: \"os_compute_api:os-volumes:delete\""},{"line_number":1352,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1353,"context_line":"    nova-os_compute_api_os-volumes_detail:"},{"line_number":1354,"context_line":"      key: \"os_compute_api:os-volumes:detail\""},{"line_number":1355,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1356,"context_line":"    nova-os_compute_api_os-volumes_list:"},{"line_number":1357,"context_line":"      key: \"os_compute_api:os-volumes:list\""},{"line_number":1358,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1359,"context_line":"    nova-os_compute_api_os-volumes_show:"},{"line_number":1360,"context_line":"      key: \"os_compute_api:os-volumes:show\""},{"line_number":1361,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1362,"context_line":"    nova-os_compute_api_os-volumes_snapshots_create:"},{"line_number":1363,"context_line":"      key: \"os_compute_api:os-volumes:snapshots:create\""},{"line_number":1364,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"44177613_2e864ec8","line":1361,"range":{"start_line":1353,"start_character":0,"end_line":1361,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_or_project_reader","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1359,"context_line":"    nova-os_compute_api_os-volumes_show:"},{"line_number":1360,"context_line":"      key: \"os_compute_api:os-volumes:show\""},{"line_number":1361,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1362,"context_line":"    nova-os_compute_api_os-volumes_snapshots_create:"},{"line_number":1363,"context_line":"      key: \"os_compute_api:os-volumes:snapshots:create\""},{"line_number":1364,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1365,"context_line":"    nova-os_compute_api_os-volumes_snapshots_delete:"},{"line_number":1366,"context_line":"      key: \"os_compute_api:os-volumes:snapshots:delete\""},{"line_number":1367,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1368,"context_line":"    nova-os_compute_api_os-volumes_snapshots_detail:"},{"line_number":1369,"context_line":"      key: \"os_compute_api:os-volumes:snapshots:detail\""},{"line_number":1370,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"ac3b19aa_a7ef00a5","line":1367,"range":{"start_line":1362,"start_character":1,"end_line":1367,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1365,"context_line":"    nova-os_compute_api_os-volumes_snapshots_delete:"},{"line_number":1366,"context_line":"      key: \"os_compute_api:os-volumes:snapshots:delete\""},{"line_number":1367,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1368,"context_line":"    nova-os_compute_api_os-volumes_snapshots_detail:"},{"line_number":1369,"context_line":"      key: \"os_compute_api:os-volumes:snapshots:detail\""},{"line_number":1370,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1371,"context_line":"    nova-os_compute_api_os-volumes_snapshots_list:"},{"line_number":1372,"context_line":"      key: \"os_compute_api:os-volumes:snapshots:list\""},{"line_number":1373,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1374,"context_line":"    nova-os_compute_api_os-volumes_snapshots_show:"},{"line_number":1375,"context_line":"      key: \"os_compute_api:os-volumes:snapshots:show\""},{"line_number":1376,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1377,"context_line":"    nova-os_compute_api_server-metadata_create:"},{"line_number":1378,"context_line":"      key: \"os_compute_api:server-metadata:create\""},{"line_number":1379,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"3846dae6_281bbd98","line":1376,"range":{"start_line":1368,"start_character":2,"end_line":1376,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_or_project_reader","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1374,"context_line":"    nova-os_compute_api_os-volumes_snapshots_show:"},{"line_number":1375,"context_line":"      key: \"os_compute_api:os-volumes:snapshots:show\""},{"line_number":1376,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1377,"context_line":"    nova-os_compute_api_server-metadata_create:"},{"line_number":1378,"context_line":"      key: \"os_compute_api:server-metadata:create\""},{"line_number":1379,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1380,"context_line":"    nova-os_compute_api_server-metadata_delete:"},{"line_number":1381,"context_line":"      key: \"os_compute_api:server-metadata:delete\""},{"line_number":1382,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1383,"context_line":"    nova-os_compute_api_server-metadata_index:"},{"line_number":1384,"context_line":"      key: \"os_compute_api:server-metadata:index\""},{"line_number":1385,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"cc20ec9a_376f5aeb","line":1382,"range":{"start_line":1377,"start_character":0,"end_line":1382,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1380,"context_line":"    nova-os_compute_api_server-metadata_delete:"},{"line_number":1381,"context_line":"      key: \"os_compute_api:server-metadata:delete\""},{"line_number":1382,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1383,"context_line":"    nova-os_compute_api_server-metadata_index:"},{"line_number":1384,"context_line":"      key: \"os_compute_api:server-metadata:index\""},{"line_number":1385,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1386,"context_line":"    nova-os_compute_api_server-metadata_show:"},{"line_number":1387,"context_line":"      key: \"os_compute_api:server-metadata:show\""},{"line_number":1388,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1389,"context_line":"    nova-os_compute_api_server-metadata_update:"},{"line_number":1390,"context_line":"      key: \"os_compute_api:server-metadata:update\""},{"line_number":1391,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"8e05019b_ba757cb7","line":1388,"range":{"start_line":1383,"start_character":1,"end_line":1388,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack   system_or_project_reader","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1388,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1389,"context_line":"    nova-os_compute_api_server-metadata_update:"},{"line_number":1390,"context_line":"      key: \"os_compute_api:server-metadata:update\""},{"line_number":1391,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1392,"context_line":"    nova-os_compute_api_server-metadata_update_all:"},{"line_number":1393,"context_line":"      key: \"os_compute_api:server-metadata:update_all\""},{"line_number":1394,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"ee47bb1a_691a4c44","line":1391,"range":{"start_line":1391,"start_character":19,"end_line":1391,"end_character":42},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1391,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1392,"context_line":"    nova-os_compute_api_server-metadata_update_all:"},{"line_number":1393,"context_line":"      key: \"os_compute_api:server-metadata:update_all\""},{"line_number":1394,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1395,"context_line":"    nova-os_compute_api_servers_allow_all_filters:"},{"line_number":1396,"context_line":"      key: \"os_compute_api:servers:allow_all_filters\""},{"line_number":1397,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"afc64890_e2247669","line":1394,"range":{"start_line":1394,"start_character":19,"end_line":1394,"end_character":42},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1394,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1395,"context_line":"    nova-os_compute_api_servers_allow_all_filters:"},{"line_number":1396,"context_line":"      key: \"os_compute_api:servers:allow_all_filters\""},{"line_number":1397,"context_line":"      value: \"rule:admin_required\""},{"line_number":1398,"context_line":"    nova-os_compute_api_servers_confirm_resize:"},{"line_number":1399,"context_line":"      key: \"os_compute_api:servers:confirm_resize\""},{"line_number":1400,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"d66cb190_f4173b11","line":1397,"range":{"start_line":1397,"start_character":19,"end_line":1397,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_reader_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1397,"context_line":"      value: \"rule:admin_required\""},{"line_number":1398,"context_line":"    nova-os_compute_api_servers_confirm_resize:"},{"line_number":1399,"context_line":"      key: \"os_compute_api:servers:confirm_resize\""},{"line_number":1400,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1401,"context_line":"    nova-os_compute_api_servers_create_forced_host:"},{"line_number":1402,"context_line":"      key: \"os_compute_api:servers:create:forced_host\""},{"line_number":1403,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"eb521002_83640789","line":1400,"range":{"start_line":1400,"start_character":19,"end_line":1400,"end_character":42},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1400,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1401,"context_line":"    nova-os_compute_api_servers_create_forced_host:"},{"line_number":1402,"context_line":"      key: \"os_compute_api:servers:create:forced_host\""},{"line_number":1403,"context_line":"      value: \"rule:admin_required\""},{"line_number":1404,"context_line":"    nova-os_compute_api_servers_create_image:"},{"line_number":1405,"context_line":"      key: \"os_compute_api:servers:create_image\""},{"line_number":1406,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"8866d427_be24fe91","line":1403,"range":{"start_line":1403,"start_character":19,"end_line":1403,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack project_admin_api,in nova this is technially allow to be doen by a project admin but without scope supprot admin_required is correct, project member is not sufficent","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1401,"context_line":"    nova-os_compute_api_servers_create_forced_host:"},{"line_number":1402,"context_line":"      key: \"os_compute_api:servers:create:forced_host\""},{"line_number":1403,"context_line":"      value: \"rule:admin_required\""},{"line_number":1404,"context_line":"    nova-os_compute_api_servers_create_image:"},{"line_number":1405,"context_line":"      key: \"os_compute_api:servers:create_image\""},{"line_number":1406,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1407,"context_line":"    nova-os_compute_api_servers_create_image_allow_volume_backed:"},{"line_number":1408,"context_line":"      key: \"os_compute_api:servers:create_image:allow_volume_backed\""},{"line_number":1409,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1410,"context_line":"    nova-os_compute_api_servers_create_zero_disk_flavor:"},{"line_number":1411,"context_line":"      key: \"os_compute_api:servers:create:zero_disk_flavor\""},{"line_number":1412,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"03311e7c_0f1c4caa","line":1409,"range":{"start_line":1404,"start_character":2,"end_line":1409,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1409,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1410,"context_line":"    nova-os_compute_api_servers_create_zero_disk_flavor:"},{"line_number":1411,"context_line":"      key: \"os_compute_api:servers:create:zero_disk_flavor\""},{"line_number":1412,"context_line":"      value: \"rule:admin_required\""},{"line_number":1413,"context_line":"    nova-os_compute_api_servers_delete:"},{"line_number":1414,"context_line":"      key: \"os_compute_api:servers:delete\""},{"line_number":1415,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"62146e1a_657a9793","line":1412,"range":{"start_line":1412,"start_character":19,"end_line":1412,"end_character":33},"updated":"2021-09-22 12:57:08.000000000","message":"ack was project_admin_api this is correct without scopes","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1410,"context_line":"    nova-os_compute_api_servers_create_zero_disk_flavor:"},{"line_number":1411,"context_line":"      key: \"os_compute_api:servers:create:zero_disk_flavor\""},{"line_number":1412,"context_line":"      value: \"rule:admin_required\""},{"line_number":1413,"context_line":"    nova-os_compute_api_servers_delete:"},{"line_number":1414,"context_line":"      key: \"os_compute_api:servers:delete\""},{"line_number":1415,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1416,"context_line":"    nova-os_compute_api_servers_detail:"},{"line_number":1417,"context_line":"      key: \"os_compute_api:servers:detail\""},{"line_number":1418,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1419,"context_line":"    nova-os_compute_api_servers_detail_get_all_tenants:"},{"line_number":1420,"context_line":"      key: \"os_compute_api:servers:detail:get_all_tenants\""},{"line_number":1421,"context_line":"      value: \"rule:admin_required\""},{"line_number":1422,"context_line":"    nova-os_compute_api_servers_index:"},{"line_number":1423,"context_line":"      key: \"os_compute_api:servers:index\""},{"line_number":1424,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1425,"context_line":"    nova-os_compute_api_servers_index_get_all_tenants:"},{"line_number":1426,"context_line":"      key: \"os_compute_api:servers:index:get_all_tenants\""},{"line_number":1427,"context_line":"      value: \"rule:admin_required\""},{"line_number":1428,"context_line":"    nova-os_compute_api_servers_migrations_delete:"},{"line_number":1429,"context_line":"      key: \"os_compute_api:servers:migrations:delete\""},{"line_number":1430,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"e896db51_3dbe071f","line":1427,"range":{"start_line":1413,"start_character":1,"end_line":1427,"end_character":34},"updated":"2021-09-22 12:57:08.000000000","message":"ack delete should be member  detail and index should be reader\n\nall tenatns version should be admin required so these are correct","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1425,"context_line":"    nova-os_compute_api_servers_index_get_all_tenants:"},{"line_number":1426,"context_line":"      key: \"os_compute_api:servers:index:get_all_tenants\""},{"line_number":1427,"context_line":"      value: \"rule:admin_required\""},{"line_number":1428,"context_line":"    nova-os_compute_api_servers_migrations_delete:"},{"line_number":1429,"context_line":"      key: \"os_compute_api:servers:migrations:delete\""},{"line_number":1430,"context_line":"      value: \"rule:admin_required\""},{"line_number":1431,"context_line":"    nova-os_compute_api_servers_migrations_force_complete:"},{"line_number":1432,"context_line":"      key: \"os_compute_api:servers:migrations:force_complete\""},{"line_number":1433,"context_line":"      value: \"rule:admin_required\""},{"line_number":1434,"context_line":"    nova-os_compute_api_servers_migrations_index:"},{"line_number":1435,"context_line":"      key: \"os_compute_api:servers:migrations:index\""},{"line_number":1436,"context_line":"      value: \"rule:admin_required\""},{"line_number":1437,"context_line":"    nova-os_compute_api_servers_migrations_show:"},{"line_number":1438,"context_line":"      key: \"os_compute_api:servers:migrations:show\""},{"line_number":1439,"context_line":"      value: \"rule:admin_required\""},{"line_number":1440,"context_line":"    nova-os_compute_api_servers_reboot:"},{"line_number":1441,"context_line":"      key: \"os_compute_api:servers:reboot\""},{"line_number":1442,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"2898b174_028b3325","line":1439,"range":{"start_line":1428,"start_character":1,"end_line":1439,"end_character":34},"updated":"2021-09-22 12:57:08.000000000","message":"index and show would have been system_reader_api the others are system_admin_api so these are correct","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1437,"context_line":"    nova-os_compute_api_servers_migrations_show:"},{"line_number":1438,"context_line":"      key: \"os_compute_api:servers:migrations:show\""},{"line_number":1439,"context_line":"      value: \"rule:admin_required\""},{"line_number":1440,"context_line":"    nova-os_compute_api_servers_reboot:"},{"line_number":1441,"context_line":"      key: \"os_compute_api:servers:reboot\""},{"line_number":1442,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1443,"context_line":"    nova-os_compute_api_servers_rebuild:"},{"line_number":1444,"context_line":"      key: \"os_compute_api:servers:rebuild\""},{"line_number":1445,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1446,"context_line":"    nova-os_compute_api_servers_rebuild_trusted_certs:"},{"line_number":1447,"context_line":"      key: \"os_compute_api:servers:rebuild:trusted_certs\""},{"line_number":1448,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1449,"context_line":"    nova-os_compute_api_servers_resize:"},{"line_number":1450,"context_line":"      key: \"os_compute_api:servers:resize\""},{"line_number":1451,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1452,"context_line":"    nova-os_compute_api_servers_revert_resize:"},{"line_number":1453,"context_line":"      key: \"os_compute_api:servers:revert_resize\""},{"line_number":1454,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1455,"context_line":"    nova-os_compute_api_servers_show:"},{"line_number":1456,"context_line":"      key: \"os_compute_api:servers:show\""},{"line_number":1457,"context_line":"      value: \"rule:admin_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"1c2d6cf6_a9a73b91","line":1454,"range":{"start_line":1440,"start_character":1,"end_line":1454,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack these were all system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1454,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1455,"context_line":"    nova-os_compute_api_servers_show:"},{"line_number":1456,"context_line":"      key: \"os_compute_api:servers:show\""},{"line_number":1457,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1458,"context_line":"    nova-os_compute_api_servers_show_host_status:"},{"line_number":1459,"context_line":"      key: \"os_compute_api:servers:show:host_status\""},{"line_number":1460,"context_line":"      value: \"rule:admin_required\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"2bb24d11_1af2599a","line":1457,"range":{"start_line":1457,"start_character":19,"end_line":1457,"end_character":42},"updated":"2021-09-22 12:57:08.000000000","message":"ack system_or_project_reader","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1455,"context_line":"    nova-os_compute_api_servers_show:"},{"line_number":1456,"context_line":"      key: \"os_compute_api:servers:show\""},{"line_number":1457,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":1458,"context_line":"    nova-os_compute_api_servers_show_host_status:"},{"line_number":1459,"context_line":"      key: \"os_compute_api:servers:show:host_status\""},{"line_number":1460,"context_line":"      value: \"rule:admin_required\""},{"line_number":1461,"context_line":"    nova-os_compute_api_servers_show_host_status_unknown-only:"},{"line_number":1462,"context_line":"      key: \"os_compute_api:servers:show:host_status:unknown-only\""},{"line_number":1463,"context_line":"      value: \"rule:admin_required\""},{"line_number":1464,"context_line":"    nova-os_compute_api_servers_start:"},{"line_number":1465,"context_line":"      key: \"os_compute_api:servers:start\""},{"line_number":1466,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"941cd4d2_23984d0e","line":1463,"range":{"start_line":1458,"start_character":1,"end_line":1463,"end_character":34},"updated":"2021-09-22 12:57:08.000000000","message":"ack both are system_admin_api","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1461,"context_line":"    nova-os_compute_api_servers_show_host_status_unknown-only:"},{"line_number":1462,"context_line":"      key: \"os_compute_api:servers:show:host_status:unknown-only\""},{"line_number":1463,"context_line":"      value: \"rule:admin_required\""},{"line_number":1464,"context_line":"    nova-os_compute_api_servers_start:"},{"line_number":1465,"context_line":"      key: \"os_compute_api:servers:start\""},{"line_number":1466,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1467,"context_line":"    nova-os_compute_api_servers_stop:"},{"line_number":1468,"context_line":"      key: \"os_compute_api:servers:stop\""},{"line_number":1469,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1470,"context_line":"    nova-os_compute_api_servers_trigger_crash_dump:"},{"line_number":1471,"context_line":"      key: \"os_compute_api:servers:trigger_crash_dump\""},{"line_number":1472,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1473,"context_line":"    nova-os_compute_api_servers_update:"},{"line_number":1474,"context_line":"      key: \"os_compute_api:servers:update\""},{"line_number":1475,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1476,"context_line":"    nova-rule_admin_api:"},{"line_number":1477,"context_line":"      key: \"rule:admin_api\""},{"line_number":1478,"context_line":"      value: \"rule:project_admin_api\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"76b09f69_9e0e2fb6","line":1475,"range":{"start_line":1464,"start_character":0,"end_line":1475,"end_character":43},"updated":"2021-09-22 12:57:08.000000000","message":"ack these are all system_admin_or_owner","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1475,"context_line":"      value: \"rule:admin_or_project_member\""},{"line_number":1476,"context_line":"    nova-rule_admin_api:"},{"line_number":1477,"context_line":"      key: \"rule:admin_api\""},{"line_number":1478,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":1479,"context_line":"    nova-rule_admin_or_owner:"},{"line_number":1480,"context_line":"      key: \"rule:admin_or_owner\""},{"line_number":1481,"context_line":"      value: \"rule:system_or_project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"6aebdfeb_5cd039b6","line":1478,"range":{"start_line":1478,"start_character":19,"end_line":1478,"end_character":36},"updated":"2021-09-22 12:57:08.000000000","message":"this lookg wrong to me \n\nit should be     \n\nnova-rule_admin_api:\n      key: \"rule:admin_api\"\n      value: \"rule:system_admin_api\"\n\nwhich woudl translate to admin_required \n\n    nova-rule_admin_api:\n      key: \"rule:admin_api\"\n      value: \"rule:admin_required\"","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"8a2ae3775e10ebbf720fc6f28d018556fe031880","unresolved":true,"context_lines":[{"line_number":1477,"context_line":"      key: \"rule:admin_api\""},{"line_number":1478,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":1479,"context_line":"    nova-rule_admin_or_owner:"},{"line_number":1480,"context_line":"      key: \"rule:admin_or_owner\""},{"line_number":1481,"context_line":"      value: \"rule:system_or_project_reader\""},{"line_number":1482,"context_line":""},{"line_number":1483,"context_line":"  NeutronApiPolicies:"}],"source_content_type":"text/x-yaml","patch_set":23,"id":"7fc549c8_6b058431","line":1480,"range":{"start_line":1480,"start_character":17,"end_line":1480,"end_character":31},"updated":"2021-09-22 12:57:08.000000000","message":"this is \n\nhttps://review.opendev.org/c/openstack/tripleo-heat-templates/+/810321/2/environments/enable-secure-rbac.yaml#28\n\n    nova-rule_admin_or_owner:\n      key: \"rule:admin_or_owner\"\n      value: \"rule:project_member_api\"\n\nso it should be \n\n\n    nova-rule_admin_or_owner:\n      key: \"rule:admin_or_owner\"\n      value: \"rule:admin_or_project_member\"","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"a5d0d37b7471eb0deb2e306c9e1d400ec6dd070c","unresolved":true,"context_lines":[{"line_number":2558,"context_line":"      value: \"role:admin or rule:project_member\""},{"line_number":2559,"context_line":"    designate-create_zone_transfer_accept:"},{"line_number":2560,"context_line":"      key: \"create_zone_transfer_accept\""},{"line_number":2561,"context_line":"      value: \"role:admin or rule:project_member\""},{"line_number":2562,"context_line":"    designate-create_zone_transfer_request:"},{"line_number":2563,"context_line":"      key: \"create_zone_transfer_request\""},{"line_number":2564,"context_line":"      value: \"role:admin or rule:project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"c447cec1_589bc518","line":2561,"range":{"start_line":2561,"start_character":6,"end_line":2561,"end_character":48},"updated":"2021-09-21 19:12:53.000000000","message":"This is still incorrect. Using these new aliases it would be:\n\"(role:admin or rule:project_member) or project_id:%(target_project_id)s or None:%(target_project_id)s\"\n\nYou will notice the alternate conditions are matching the token project ID to the \"target\" project_id for a transfer of zone ownership between projects. They also allowed transferring to anyone with no target_project_id, which is unfortunate. See the original rule: https://github.com/openstack/designate/blob/stable/victoria/designate/common/policies/base.py#L24","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"34bef30f20fb4596e2029343328c0a21f3bdb623","unresolved":true,"context_lines":[{"line_number":2558,"context_line":"      value: \"role:admin or rule:project_member\""},{"line_number":2559,"context_line":"    designate-create_zone_transfer_accept:"},{"line_number":2560,"context_line":"      key: \"create_zone_transfer_accept\""},{"line_number":2561,"context_line":"      value: \"role:admin or rule:project_member\""},{"line_number":2562,"context_line":"    designate-create_zone_transfer_request:"},{"line_number":2563,"context_line":"      key: \"create_zone_transfer_request\""},{"line_number":2564,"context_line":"      value: \"role:admin or rule:project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"0498d49a_e5e82ba1","line":2561,"range":{"start_line":2561,"start_character":6,"end_line":2561,"end_character":48},"in_reply_to":"c447cec1_589bc518","updated":"2021-09-22 20:42:22.000000000","message":"Ok - attempting to simplify this in a separate review so it\u0027s clear how the defaults are changing.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"a5d0d37b7471eb0deb2e306c9e1d400ec6dd070c","unresolved":true,"context_lines":[{"line_number":2699,"context_line":"      value: \"(role:admin) or rule:project_reader\""},{"line_number":2700,"context_line":"    designate-get_zone_transfer_request:"},{"line_number":2701,"context_line":"      key: \"get_zone_transfer_request\""},{"line_number":2702,"context_line":"      value: \"role:admin or rule:project_reader\""},{"line_number":2703,"context_line":"    designate-get_zone_transfer_request_detailed:"},{"line_number":2704,"context_line":"      key: \"get_zone_transfer_request_detailed\""},{"line_number":2705,"context_line":"      value: \"role:admin or rule:project_reader\""}],"source_content_type":"text/x-yaml","patch_set":23,"id":"8b3ce56f_d6750ec9","line":2702,"updated":"2021-09-21 19:12:53.000000000","message":"This is still incorrect. Using these new aliases it would be:\n\"(role:admin or rule:project_member) or project_id:%(target_project_id)s or None:%(target_project_id)s\"\n\nSame answer as above.","commit_id":"6138783b31bd881b9663ea4d0a2574315e4a239e"},{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"1c01a48b46261e8ca5bd2c527c6186315ca8d1a3","unresolved":true,"context_lines":[{"line_number":1,"context_line":"parameter_defaults:"},{"line_number":2,"context_line":"  EnforceSecureRbac: false"},{"line_number":3,"context_line":"  NovaApiPolicies:"},{"line_number":4,"context_line":"    nova-context_is_admin:"},{"line_number":5,"context_line":"      key: \"context_is_admin\""},{"line_number":6,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":24,"id":"3eda9953_66edda57","line":3,"range":{"start_line":3,"start_character":2,"end_line":3,"end_character":17},"updated":"2021-09-29 07:09:37.000000000","message":"wondering if we can split these out into their own \u0027per service\u0027 environment file and especially if that is better or worse from a UI point of view.\n\nI don\u0027t expect Heat will have a problem with a 4500 line file but that aside, it is going to be a pain to work with for operators trying to find/adjust a particular policy for a given service.\n\nit would mean your tool also takes a parameter which is $service_name. BUT i am not sure if this is in the end better or worse for the operator, i.e. they\u0027d have to then specify multiple environment files for their secure-rbac policies","commit_id":"c9635bf92e3174799724ebe0cbe46f666800b88e"},{"author":{"_account_id":28223,"name":"Cedric Jeanneret","display_name":"cjeanner (Tengu)","email":"cjeanner@redhat.com","username":"cjeanner"},"change_message_id":"4280a385d3d7f2091ac85435b22c7fc6ee2f47a7","unresolved":true,"context_lines":[{"line_number":1,"context_line":"parameter_defaults:"},{"line_number":2,"context_line":"  EnforceSecureRbac: false"},{"line_number":3,"context_line":"  NovaApiPolicies:"},{"line_number":4,"context_line":"    nova-context_is_admin:"},{"line_number":5,"context_line":"      key: \"context_is_admin\""},{"line_number":6,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":24,"id":"456e4e7a_df1e5eb0","line":3,"range":{"start_line":3,"start_character":2,"end_line":3,"end_character":17},"in_reply_to":"3eda9953_66edda57","updated":"2021-09-30 07:40:42.000000000","message":"+1 for a per-service split. That would make the maintenance easier. Operator are already used to pass multiple env files within TripleO ecosystem (deploy, upgrade prepare, and so on).","commit_id":"c9635bf92e3174799724ebe0cbe46f666800b88e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4e05d2a907366252be82645628950db1439b811e","unresolved":true,"context_lines":[{"line_number":1,"context_line":"parameter_defaults:"},{"line_number":2,"context_line":"  EnforceSecureRbac: false"},{"line_number":3,"context_line":"  NovaApiPolicies:"},{"line_number":4,"context_line":"    nova-context_is_admin:"},{"line_number":5,"context_line":"      key: \"context_is_admin\""},{"line_number":6,"context_line":"      value: \"role:admin\""}],"source_content_type":"text/x-yaml","patch_set":24,"id":"cb6d2bc1_04c41561","line":3,"range":{"start_line":3,"start_character":2,"end_line":3,"end_character":17},"in_reply_to":"456e4e7a_df1e5eb0","updated":"2021-10-05 13:47:15.000000000","message":"I battled that same question for a while and I decided to propose it as a single file because of the following reasons (which I probably should have documented somewhere, like the commit message).\n\nThe way we intend this to work is that it will be a complete set of policy overrides that implement a baseline set of personas that will work across OpenStack services. Most deployments today have to implement some form of project-reader, and this allows that out of the box in addition to other consistencies. My goal is to describe those personas and encourage operators to use them if they meet or improve the security posture of their deployment. We don\u0027t intend users to create derivatives of this authorization model.\n\nAnother reason why I wanted to keep everything within a single file is that I don\u0027t expect this to be a long-term solution. Most, if not all, of the services upstream have some subset of these policies as their default. The hope is that we can continue working through changes necessary to implement system scope in Yoga [0]. That work will make this file obsolete if we can remove the overrides in favor of the service defaults upstream. The file, as is, provides a holistic view of *everything* that needs to change to offer at least some authorization consistency. I\u0027m worried splitting these out to separate files will cause drift between the implementations, or some of them won\u0027t be updated if needed. Also, I think it raises the bar for operators consuming this change because they need to include more files in their deploy commands. For example, with multiple files, they could mistakenly omit cinder\u0027s overrides and think they\u0027ve applied them but they haven\u0027t, allowing project-readers to create volumes when that\u0027s the opposite behavior in all the other services where the policies were overridden correctly.\n\nFWIW - I have applied this environment to development deployments (using standalone and full deploys) and I didn\u0027t see any issues with heat applying an environment this large.\n\n[0] https://governance.openstack.org/tc/goals/selected/yoga/consistent-and-secure-rbac.html","commit_id":"c9635bf92e3174799724ebe0cbe46f666800b88e"}],"tools/convert_policy_yaml_to_heat_template.py":[{"author":{"_account_id":8449,"name":"Marios Andreou","email":"marios.andreou@gmail.com","username":"marios"},"change_message_id":"1c01a48b46261e8ca5bd2c527c6186315ca8d1a3","unresolved":true,"context_lines":[{"line_number":46,"context_line":")"},{"line_number":47,"context_line":"args \u003d parser.parse_args()"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"heat_template \u003d {\u0027parameter_defaults\u0027: {\u0027EnforceSecureRbac\u0027: False}}"},{"line_number":50,"context_line":"for filename in os.listdir(args.policy_dir):"},{"line_number":51,"context_line":"    service \u003d filename.split(\u0027.\u0027)[0]"},{"line_number":52,"context_line":"    tht_var_name \u003d _SERVICE_MAP.get(service)"}],"source_content_type":"text/x-python","patch_set":24,"id":"c9b7caeb_9f12649b","line":49,"range":{"start_line":49,"start_character":16,"end_line":49,"end_character":18},"updated":"2021-09-29 07:09:37.000000000","message":"perhaps worth a \u0027banner\u0027 saying the file is generated by...\n\n# Environment file generated by tripleo-heat-templates/tools/convert_policy_yaml_to_heat_template.py \nparameter_defaults: ...","commit_id":"c9635bf92e3174799724ebe0cbe46f666800b88e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4e05d2a907366252be82645628950db1439b811e","unresolved":true,"context_lines":[{"line_number":46,"context_line":")"},{"line_number":47,"context_line":"args \u003d parser.parse_args()"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"heat_template \u003d {\u0027parameter_defaults\u0027: {\u0027EnforceSecureRbac\u0027: False}}"},{"line_number":50,"context_line":"for filename in os.listdir(args.policy_dir):"},{"line_number":51,"context_line":"    service \u003d filename.split(\u0027.\u0027)[0]"},{"line_number":52,"context_line":"    tht_var_name \u003d _SERVICE_MAP.get(service)"}],"source_content_type":"text/x-python","patch_set":24,"id":"4413a320_9ec0fa28","line":49,"range":{"start_line":49,"start_character":16,"end_line":49,"end_character":18},"in_reply_to":"c9b7caeb_9f12649b","updated":"2021-10-05 13:47:15.000000000","message":"I did use the tooling to generate the base file with the intention that I was going to update policies to implement the project personas (done in follow on patches).\n\nShould we still include a banner for that type of workflow, where the file is generated and hand-modified? Would it be misleading to readers in the final iteration?\n\nI only ask because I wouldn\u0027t want someone to read the banner, then assume the tool will implement project personas for them.","commit_id":"c9635bf92e3174799724ebe0cbe46f666800b88e"}]}