)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"change_message_id":"af36cb6e74aa0f9b2bee144e340bf29c0532419a","unresolved":true,"context_lines":[{"line_number":7,"context_line":"Allow barbican to configure secure RBAC options"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This updates the barbican API container to set the appropriate"},{"line_number":10,"context_line":"configuration options when EnforceSecureRbac is True. This will be"},{"line_number":11,"context_line":"needed when more OpenStack services support system scope and we want to"},{"line_number":12,"context_line":"enable those personas."},{"line_number":13,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"1b5a87db_728a3c3f","line":10,"updated":"2021-08-30 09:48:19.000000000","message":"Same here - use EnableSecureRbac?","commit_id":"c016eea6018c604682b4620a114ca08f6c621196"}],"deployment/barbican/barbican-api-container-puppet.yaml":[{"author":{"_account_id":6926,"name":"Bogdan Dobrelya","email":"bdobreli@redhat.com","username":"bogdando"},"change_message_id":"f01c52119e9ecd0b9bb7ece7a7a2dd95a4bd2443","unresolved":true,"context_lines":[{"line_number":153,"context_line":"    description: |"},{"line_number":154,"context_line":"      Use the advanced (eventlet safe) memcached client pool."},{"line_number":155,"context_line":"    default: true"},{"line_number":156,"context_line":"  BarbicanEnforceSecureRbac:"},{"line_number":157,"context_line":"    description: \u003e"},{"line_number":158,"context_line":"      Require the Barbican API to enforce tenancy based on the admin, member,"},{"line_number":159,"context_line":"      and reader roles across the system and project authorization targets."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"cf945190_da8653ac","line":156,"updated":"2021-08-16 10:34:02.000000000","message":"do you think we could add a global setting, which can be as well controlled on a per service basis, just like we do for the Debug flag?","commit_id":"cfe7239d225b7e64172363312fc8a7ac9d610139"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c8d34879382604a618dcd882e1dbd5b333a9e3f0","unresolved":true,"context_lines":[{"line_number":153,"context_line":"    description: |"},{"line_number":154,"context_line":"      Use the advanced (eventlet safe) memcached client pool."},{"line_number":155,"context_line":"    default: true"},{"line_number":156,"context_line":"  BarbicanEnforceSecureRbac:"},{"line_number":157,"context_line":"    description: \u003e"},{"line_number":158,"context_line":"      Require the Barbican API to enforce tenancy based on the admin, member,"},{"line_number":159,"context_line":"      and reader roles across the system and project authorization targets."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"33e74403_fc8b0c5d","line":156,"in_reply_to":"cf945190_da8653ac","updated":"2021-08-27 20:51:27.000000000","message":"Added a global here https://review.opendev.org/c/openstack/tripleo-heat-templates/+/806449/1","commit_id":"cfe7239d225b7e64172363312fc8a7ac9d610139"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"43d13a4d05b3af8a57dd27584de62711af06258a","unresolved":true,"context_lines":[{"line_number":243,"context_line":"              - {get_param: BarbicanDebug}"},{"line_number":244,"context_line":"              - true"},{"line_number":245,"context_line":"              - {get_param: Debug}"},{"line_number":246,"context_line":"            - if:"},{"line_number":247,"context_line":"              - {get_param: EnforceSecureRbac}"},{"line_number":248,"context_line":"              - barbican::policy::enforce_scope: true"},{"line_number":249,"context_line":"              - barbican::policy::enforce_new_defaults: true"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"2e6f9e64_b4ef0c56","line":246,"updated":"2021-08-31 09:02:41.000000000","message":"There is pep8 failure here, this \u0027if\u0027 block needs to be moved to left.","commit_id":"c016eea6018c604682b4620a114ca08f6c621196"},{"author":{"_account_id":19138,"name":"Pranali Deore","email":"pdeore@redhat.com","username":"PranaliD"},"change_message_id":"43d13a4d05b3af8a57dd27584de62711af06258a","unresolved":false,"context_lines":[{"line_number":244,"context_line":"              - true"},{"line_number":245,"context_line":"              - {get_param: Debug}"},{"line_number":246,"context_line":"            - if:"},{"line_number":247,"context_line":"              - {get_param: EnforceSecureRbac}"},{"line_number":248,"context_line":"              - barbican::policy::enforce_scope: true"},{"line_number":249,"context_line":"              - barbican::policy::enforce_new_defaults: true"},{"line_number":250,"context_line":"            barbican::api::notification_driver: {get_param: NotificationDriver}"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"8a4c21fc_8279834f","line":247,"updated":"2021-08-31 09:02:41.000000000","message":"I think EnforceSecureRbac need to be defined in this template as well, since this template is not inheriting any settings from keystone service and even after enabling \u0027EnforceSecureRbac\u0027 from [1], babrbican api service will not consume parameter enabled via parameter_defaults.\n\n[1]: https://review.opendev.org/c/openstack/tripleo-heat-templates/+/781571/14/environments/enable-secure-rbac.yaml#42","commit_id":"c016eea6018c604682b4620a114ca08f6c621196"},{"author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"change_message_id":"af36cb6e74aa0f9b2bee144e340bf29c0532419a","unresolved":true,"context_lines":[{"line_number":244,"context_line":"              - true"},{"line_number":245,"context_line":"              - {get_param: Debug}"},{"line_number":246,"context_line":"            - if:"},{"line_number":247,"context_line":"              - {get_param: EnforceSecureRbac}"},{"line_number":248,"context_line":"              - barbican::policy::enforce_scope: true"},{"line_number":249,"context_line":"              - barbican::policy::enforce_new_defaults: true"},{"line_number":250,"context_line":"            barbican::api::notification_driver: {get_param: NotificationDriver}"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"dab5bb86_4ed135e2","line":247,"updated":"2021-08-30 09:48:19.000000000","message":"That should be EnableSecureRbac as defined in https://review.opendev.org/c/openstack/tripleo-heat-templates/+/806449/1/deployment/keystone/keystone-container-puppet.yaml#370 , or not?","commit_id":"c016eea6018c604682b4620a114ca08f6c621196"},{"author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"change_message_id":"74e0b6e5369d16dc17975fc4ef0e22fcd5fbba18","unresolved":false,"context_lines":[{"line_number":244,"context_line":"              - true"},{"line_number":245,"context_line":"              - {get_param: Debug}"},{"line_number":246,"context_line":"            - if:"},{"line_number":247,"context_line":"              - {get_param: EnforceSecureRbac}"},{"line_number":248,"context_line":"              - barbican::policy::enforce_scope: true"},{"line_number":249,"context_line":"              - barbican::policy::enforce_new_defaults: true"},{"line_number":250,"context_line":"            barbican::api::notification_driver: {get_param: NotificationDriver}"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"51c79b9b_a0ffa129","line":247,"in_reply_to":"dab5bb86_4ed135e2","updated":"2021-08-30 13:56:23.000000000","message":"Nevermind, this was named EnableSecureRbac in patchset #1.","commit_id":"c016eea6018c604682b4620a114ca08f6c621196"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"50dd8b628262b2b855d8acf02fbfc890a8f1530c","unresolved":true,"context_lines":[{"line_number":155,"context_line":"    default: true"},{"line_number":156,"context_line":"  EnforceSecureRbac:"},{"line_number":157,"context_line":"    description: \u003e"},{"line_number":158,"context_line":"      Enforcing authorization based on common RBAC personas for Heat APIs."},{"line_number":159,"context_line":"    type: boolean"},{"line_number":160,"context_line":"    default: false"},{"line_number":161,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":8,"id":"4abb44f2_d0811df1","line":158,"range":{"start_line":158,"start_character":64,"end_line":158,"end_character":68},"updated":"2021-09-07 21:35:36.000000000","message":"Should this be specific to Heat? Can we assume the keystone-container-puppet variable exist here or no?\n\nhttps://review.opendev.org/c/openstack/tripleo-heat-templates/+/806449/3/deployment/keystone/keystone-container-puppet.yaml","commit_id":"bc8998e95bd312d87caf411b40d2cd395c117eb8"}]}