)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"cbdd37b36fa5ef72ff031fbafee74dfccbf99931","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"7fe88100_f2317a42","updated":"2021-10-11 18:45:53.000000000","message":"Thanks for the review, Alan.\n\nI think this is ready for another set of eyes.","commit_id":"3d2fec12b9f8d95ce3291584d7dc43821774822d"}],"environments/enable-secure-rbac.yaml":[{"author":{"_account_id":21129,"name":"Alan Bishop","email":"abishopsweng@gmail.com","username":"ASBishop","status":"ex Red Hat"},"change_message_id":"25e480433736d358b9beed459e04859eed3ce817","unresolved":true,"context_lines":[{"line_number":1967,"context_line":"      value: \"role:admin\""},{"line_number":1968,"context_line":"    cinder-admin_api:"},{"line_number":1969,"context_line":"      key: \"admin_api\""},{"line_number":1970,"context_line":"      value: \"role:admin\""},{"line_number":1971,"context_line":"    cinder-admin_or_project_member:"},{"line_number":1972,"context_line":"      key: \"admin_or_project_member\""},{"line_number":1973,"context_line":"      value: \"rule:admin_api or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"182feb72_0629839f","line":1970,"updated":"2021-10-06 16:46:15.000000000","message":"We definitely need to revert this change, and retain the other value.\n- cinder uses \"is_admin:True\" internally in places where it creates an elevated version of the user\u0027s context.\n- The \"and is_admin_project:True\" portion is necessary in order to ensure it\u0027s a system admin, and *not* a project admin. In cinder, project admins have very little additional authority over project members, so when cinder refers to an admin_api it\u0027s only for use by system admins.","commit_id":"c698e8d115f55f68d8e07a2c538078da3affcf41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e0d524ef1907584ffdad9bdcb49e54ed8aa729c5","unresolved":true,"context_lines":[{"line_number":1967,"context_line":"      value: \"role:admin\""},{"line_number":1968,"context_line":"    cinder-admin_api:"},{"line_number":1969,"context_line":"      key: \"admin_api\""},{"line_number":1970,"context_line":"      value: \"role:admin\""},{"line_number":1971,"context_line":"    cinder-admin_or_project_member:"},{"line_number":1972,"context_line":"      key: \"admin_or_project_member\""},{"line_number":1973,"context_line":"      value: \"rule:admin_api or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"4a7d7d25_33791f16","line":1970,"in_reply_to":"182feb72_0629839f","updated":"2021-10-06 20:37:13.000000000","message":"Thanks for the clarification on the is_admin bit.\n\nIs the second part of the check necessary though? The default value for is_admin_project in oslo.context is True [0] and it\u0027s deprecated [1]. That said, is it really just a role:admin check?\n\n[0] https://github.com/openstack/oslo.context/blob/master/oslo_context/context.py#L213\n[1] https://github.com/openstack/oslo.context/blob/master/oslo_context/context.py#L326","commit_id":"c698e8d115f55f68d8e07a2c538078da3affcf41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"04d188cc5b5adca884bdb336dc194521c64503ef","unresolved":true,"context_lines":[{"line_number":1967,"context_line":"      value: \"role:admin\""},{"line_number":1968,"context_line":"    cinder-admin_api:"},{"line_number":1969,"context_line":"      key: \"admin_api\""},{"line_number":1970,"context_line":"      value: \"role:admin\""},{"line_number":1971,"context_line":"    cinder-admin_or_project_member:"},{"line_number":1972,"context_line":"      key: \"admin_or_project_member\""},{"line_number":1973,"context_line":"      value: \"rule:admin_api or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"82b2a361_eaa019d7","line":1970,"in_reply_to":"4a7d7d25_33791f16","updated":"2021-10-06 20:41:01.000000000","message":"Also, this change isn\u0027t changing the behavior of is_admin at all, since that\u0027s handled by cinder\u0027s context object [0]. Is the idea that we should keep rule:admin_api consistent with the is_admin:True check because cinder internals rely on context.is_admin?\n\n[0] https://github.com/openstack/cinder/blob/master/cinder/context.py#L134-L139","commit_id":"c698e8d115f55f68d8e07a2c538078da3affcf41"},{"author":{"_account_id":21129,"name":"Alan Bishop","email":"abishopsweng@gmail.com","username":"ASBishop","status":"ex Red Hat"},"change_message_id":"39cb17f203770af01521f343158df60731bd9164","unresolved":true,"context_lines":[{"line_number":1967,"context_line":"      value: \"role:admin\""},{"line_number":1968,"context_line":"    cinder-admin_api:"},{"line_number":1969,"context_line":"      key: \"admin_api\""},{"line_number":1970,"context_line":"      value: \"role:admin\""},{"line_number":1971,"context_line":"    cinder-admin_or_project_member:"},{"line_number":1972,"context_line":"      key: \"admin_or_project_member\""},{"line_number":1973,"context_line":"      value: \"rule:admin_api or (role:member and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"4fa92435_ae97b023","line":1970,"in_reply_to":"82b2a361_eaa019d7","updated":"2021-10-07 14:44:14.000000000","message":"I take your point about \u0027is_admin_project\u0027 being deprecated, and cinder seems to acknowledge the fact [1]. But [1] states, \"these legacy rules are still used in Xena\" and so I assume they should be retained here. All of cinder\u0027s Xena tests were based on [1], and changing the admin_api rule here seems risky.\n\n[1] https://review.opendev.org/c/openstack/cinder/+/803748/9/cinder/policies/base.py#156","commit_id":"c698e8d115f55f68d8e07a2c538078da3affcf41"},{"author":{"_account_id":21129,"name":"Alan Bishop","email":"abishopsweng@gmail.com","username":"ASBishop","status":"ex Red Hat"},"change_message_id":"25e480433736d358b9beed459e04859eed3ce817","unresolved":true,"context_lines":[{"line_number":1968,"context_line":"    cinder-admin_api:"},{"line_number":1969,"context_line":"      key: \"admin_api\""},{"line_number":1970,"context_line":"      value: \"role:admin\""},{"line_number":1971,"context_line":"    cinder-admin_or_project_member:"},{"line_number":1972,"context_line":"      key: \"admin_or_project_member\""},{"line_number":1973,"context_line":"      value: \"rule:admin_api or (role:member and project_id:%(project_id)s)\""},{"line_number":1974,"context_line":"    cinder-admin_or_project_reader:"},{"line_number":1975,"context_line":"      key: \"admin_or_project_reader\""},{"line_number":1976,"context_line":"      value: \"rule:admin_api or (role:reader and project_id:%(project_id)s)\""},{"line_number":1977,"context_line":"    cinder-xena_system_admin_or_project_reader:"},{"line_number":1978,"context_line":"      key: \"xena_system_admin_or_project_reader\""},{"line_number":1979,"context_line":"      value: \"(role:admin) or (role:reader and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"f4f8510f_619007e8","line":1976,"range":{"start_line":1971,"start_character":0,"end_line":1976,"end_character":76},"updated":"2021-10-06 16:46:15.000000000","message":"I definitely agree with removing the \"xena_\" prefix from the rule names, but suggest we retain the \"system_\" portion. As I noted in my comment at L1970, when cinder refers to an \"admin\" we generally mean a system admin. That\u0027s because project admins generally don\u0027t have much more capabilities than project members.\n\ntl;dr, recommend these be \"systen_admin_or_project_member\" and \"system_admin_or_project_reader\"","commit_id":"c698e8d115f55f68d8e07a2c538078da3affcf41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e6c43b87c57fb86880bcf2d5586c7dd9658183c7","unresolved":false,"context_lines":[{"line_number":1968,"context_line":"    cinder-admin_api:"},{"line_number":1969,"context_line":"      key: \"admin_api\""},{"line_number":1970,"context_line":"      value: \"role:admin\""},{"line_number":1971,"context_line":"    cinder-admin_or_project_member:"},{"line_number":1972,"context_line":"      key: \"admin_or_project_member\""},{"line_number":1973,"context_line":"      value: \"rule:admin_api or (role:member and project_id:%(project_id)s)\""},{"line_number":1974,"context_line":"    cinder-admin_or_project_reader:"},{"line_number":1975,"context_line":"      key: \"admin_or_project_reader\""},{"line_number":1976,"context_line":"      value: \"rule:admin_api or (role:reader and project_id:%(project_id)s)\""},{"line_number":1977,"context_line":"    cinder-xena_system_admin_or_project_reader:"},{"line_number":1978,"context_line":"      key: \"xena_system_admin_or_project_reader\""},{"line_number":1979,"context_line":"      value: \"(role:admin) or (role:reader and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"fe19ec0f_05f5c0b5","line":1976,"range":{"start_line":1971,"start_character":0,"end_line":1976,"end_character":76},"in_reply_to":"f4f8510f_619007e8","updated":"2021-10-07 15:10:42.000000000","message":"Done","commit_id":"c698e8d115f55f68d8e07a2c538078da3affcf41"},{"author":{"_account_id":21129,"name":"Alan Bishop","email":"abishopsweng@gmail.com","username":"ASBishop","status":"ex Red Hat"},"change_message_id":"25e480433736d358b9beed459e04859eed3ce817","unresolved":true,"context_lines":[{"line_number":1974,"context_line":"    cinder-admin_or_project_reader:"},{"line_number":1975,"context_line":"      key: \"admin_or_project_reader\""},{"line_number":1976,"context_line":"      value: \"rule:admin_api or (role:reader and project_id:%(project_id)s)\""},{"line_number":1977,"context_line":"    cinder-xena_system_admin_or_project_reader:"},{"line_number":1978,"context_line":"      key: \"xena_system_admin_or_project_reader\""},{"line_number":1979,"context_line":"      value: \"(role:admin) or (role:reader and project_id:%(project_id)s)\""},{"line_number":1980,"context_line":"    cinder-xena_system_admin_or_project_member:"},{"line_number":1981,"context_line":"      key: \"xena_system_admin_or_project_member\""},{"line_number":1982,"context_line":"      value: \"(role:admin) or (role:member and project_id:%(project_id)s)\""},{"line_number":1983,"context_line":"    cinder-volume_attachment_create:"},{"line_number":1984,"context_line":"      key: \"volume:attachment_create\""},{"line_number":1985,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"03b5a1ea_4fbd4950","line":1982,"range":{"start_line":1977,"start_character":0,"end_line":1982,"end_character":74},"updated":"2021-10-06 16:46:15.000000000","message":"I think these are replaced by L1971..L1976, and so L1977..L1982 should be deleted.","commit_id":"c698e8d115f55f68d8e07a2c538078da3affcf41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e6c43b87c57fb86880bcf2d5586c7dd9658183c7","unresolved":false,"context_lines":[{"line_number":1974,"context_line":"    cinder-admin_or_project_reader:"},{"line_number":1975,"context_line":"      key: \"admin_or_project_reader\""},{"line_number":1976,"context_line":"      value: \"rule:admin_api or (role:reader and project_id:%(project_id)s)\""},{"line_number":1977,"context_line":"    cinder-xena_system_admin_or_project_reader:"},{"line_number":1978,"context_line":"      key: \"xena_system_admin_or_project_reader\""},{"line_number":1979,"context_line":"      value: \"(role:admin) or (role:reader and project_id:%(project_id)s)\""},{"line_number":1980,"context_line":"    cinder-xena_system_admin_or_project_member:"},{"line_number":1981,"context_line":"      key: \"xena_system_admin_or_project_member\""},{"line_number":1982,"context_line":"      value: \"(role:admin) or (role:member and project_id:%(project_id)s)\""},{"line_number":1983,"context_line":"    cinder-volume_attachment_create:"},{"line_number":1984,"context_line":"      key: \"volume:attachment_create\""},{"line_number":1985,"context_line":"      value: \"rule:admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"42330b19_08d1b605","line":1982,"range":{"start_line":1977,"start_character":0,"end_line":1982,"end_character":74},"in_reply_to":"03b5a1ea_4fbd4950","updated":"2021-10-07 15:10:42.000000000","message":"Done","commit_id":"c698e8d115f55f68d8e07a2c538078da3affcf41"},{"author":{"_account_id":21129,"name":"Alan Bishop","email":"abishopsweng@gmail.com","username":"ASBishop","status":"ex Red Hat"},"change_message_id":"25e480433736d358b9beed459e04859eed3ce817","unresolved":true,"context_lines":[{"line_number":2112,"context_line":"    cinder-group_group_types_create:"},{"line_number":2113,"context_line":"      key: \"group:group_types:create\""},{"line_number":2114,"context_line":"      value: \"rule:admin_api\""},{"line_number":2115,"context_line":"    cinder-group_group_types_manage:"},{"line_number":2116,"context_line":"      key: \"group:group_types_manage\""},{"line_number":2117,"context_line":"      value: \"rule:group:group_types:create\""},{"line_number":2118,"context_line":"    cinder-group_group_types_update:"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"97a1a12f_d3729b71","line":2115,"updated":"2021-10-06 16:46:15.000000000","message":"This policy is deprecated in Xena, so I wonder if it should not be included in a policy override file. The new policies are listed at L2112, L2118 and L2121.\n\nOf course, should backport this to Wallaby then the 3 new policies would need to be removed, and the legacy policy at L2115 restored.","commit_id":"c698e8d115f55f68d8e07a2c538078da3affcf41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e6c43b87c57fb86880bcf2d5586c7dd9658183c7","unresolved":true,"context_lines":[{"line_number":2112,"context_line":"    cinder-group_group_types_create:"},{"line_number":2113,"context_line":"      key: \"group:group_types:create\""},{"line_number":2114,"context_line":"      value: \"rule:admin_api\""},{"line_number":2115,"context_line":"    cinder-group_group_types_manage:"},{"line_number":2116,"context_line":"      key: \"group:group_types_manage\""},{"line_number":2117,"context_line":"      value: \"rule:group:group_types:create\""},{"line_number":2118,"context_line":"    cinder-group_group_types_update:"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"21402102_36c64abd","line":2115,"in_reply_to":"97a1a12f_d3729b71","updated":"2021-10-07 15:10:42.000000000","message":"Good call, does cinder use the granular checks? Or does it reference the group:group_types_manage policy in Xena? Which ever policy is being called from cinder\u0027s code, is the one that I think we should include here.","commit_id":"c698e8d115f55f68d8e07a2c538078da3affcf41"},{"author":{"_account_id":21129,"name":"Alan Bishop","email":"abishopsweng@gmail.com","username":"ASBishop","status":"ex Red Hat"},"change_message_id":"25e480433736d358b9beed459e04859eed3ce817","unresolved":true,"context_lines":[{"line_number":2121,"context_line":"    cinder-group_group_types_delete:"},{"line_number":2122,"context_line":"      key: \"group:group_types:delete\""},{"line_number":2123,"context_line":"      value: \"rule:admin_api\""},{"line_number":2124,"context_line":"    cinder-group_access_group_types_specs:"},{"line_number":2125,"context_line":"      key: \"group:access_group_types_specs\""},{"line_number":2126,"context_line":"      value: \"rule:admin_api\""},{"line_number":2127,"context_line":"    cinder-group_group_types_specs_get:"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"a04d8a57_2796a228","line":2124,"updated":"2021-10-06 16:46:15.000000000","message":"Same thing here. \"group:access_group_types_specs\" is the Wallaby policy that is replaced in Xena by separate \"get\" L2127, \"get_all\" L2133, \"create\" L2136, \"update\" L2139 and \"delete\" L2142 policies.\n\nSo I think this one at L2124 can be deleted, but we\u0027ll need to add it back if backported to Wallaby.","commit_id":"c698e8d115f55f68d8e07a2c538078da3affcf41"},{"author":{"_account_id":21129,"name":"Alan Bishop","email":"abishopsweng@gmail.com","username":"ASBishop","status":"ex Red Hat"},"change_message_id":"25e480433736d358b9beed459e04859eed3ce817","unresolved":true,"context_lines":[{"line_number":2199,"context_line":"    cinder-volume_extension_quota_classes_get:"},{"line_number":2200,"context_line":"      key: \"volume_extension:quota_classes:get\""},{"line_number":2201,"context_line":"      value: \"rule:admin_api\""},{"line_number":2202,"context_line":"    cinder-volume_extension_quota_classes:"},{"line_number":2203,"context_line":"      key: \"volume_extension:quota_classes\""},{"line_number":2204,"context_line":"      value: \"rule:volume_extension:quota_classes:get\""},{"line_number":2205,"context_line":"    cinder-volume_extension_quota_classes_update:"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"b2cfc940_d3fcc14f","line":2202,"updated":"2021-10-06 16:46:15.000000000","message":"Same as above. \"volume_extension:quota_classes\" is deprecated in Xena in favor of separate \"get\" and \"update\" policies (L2199 and L2205). We can remove the deprecated one from the Xena overrides, but will need to restore it (and delete new Xena policies) for Wallaby.","commit_id":"c698e8d115f55f68d8e07a2c538078da3affcf41"},{"author":{"_account_id":21129,"name":"Alan Bishop","email":"abishopsweng@gmail.com","username":"ASBishop","status":"ex Red Hat"},"change_message_id":"25e480433736d358b9beed459e04859eed3ce817","unresolved":true,"context_lines":[{"line_number":2253,"context_line":"    cinder-volume_extension_type_create:"},{"line_number":2254,"context_line":"      key: \"volume_extension:type_create\""},{"line_number":2255,"context_line":"      value: \"rule:admin_api\""},{"line_number":2256,"context_line":"    cinder-volume_extension_types_manage:"},{"line_number":2257,"context_line":"      key: \"volume_extension:types_manage\""},{"line_number":2258,"context_line":"      value: \"rule:volume_extension:type_create\""},{"line_number":2259,"context_line":"    cinder-volume_extension_type_update:"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"3a62ecba_4337f583","line":2256,"updated":"2021-10-06 16:46:15.000000000","message":"Same as above. \"volume_extension:types_manage\" is deprecated in Xena, and it\u0027s replaced by separate \"create\", \"update\" and \"delete\" policies (L2253, L2259 and L2252).","commit_id":"c698e8d115f55f68d8e07a2c538078da3affcf41"},{"author":{"_account_id":21129,"name":"Alan Bishop","email":"abishopsweng@gmail.com","username":"ASBishop","status":"ex Red Hat"},"change_message_id":"25e480433736d358b9beed459e04859eed3ce817","unresolved":true,"context_lines":[{"line_number":2391,"context_line":"    cinder-volume_extension_volume_image_metadata_show:"},{"line_number":2392,"context_line":"      key: \"volume_extension:volume_image_metadata:show\""},{"line_number":2393,"context_line":"      value: \"rule:admin_or_project_reader\""},{"line_number":2394,"context_line":"    cinder-volume_extension_volume_image_metadata:"},{"line_number":2395,"context_line":"      key: \"volume_extension:volume_image_metadata\""},{"line_number":2396,"context_line":"      value: \"rule:volume_extension:volume_image_metadata:show\""},{"line_number":2397,"context_line":"    cinder-volume_extension_volume_image_metadata_set:"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"9d7545d7_6562a984","line":2394,"updated":"2021-10-06 16:46:15.000000000","message":"Same as above. \"volume_extension:volume_image_metadata\" is deprecated in Xena, and is replaced by separate \"show\", \"set\" and \"remove\" policies (L2391, L2397 and L2400).","commit_id":"c698e8d115f55f68d8e07a2c538078da3affcf41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e6c43b87c57fb86880bcf2d5586c7dd9658183c7","unresolved":true,"context_lines":[{"line_number":2106,"context_line":"    cinder-group_group_types_create:"},{"line_number":2107,"context_line":"      key: \"group:group_types:create\""},{"line_number":2108,"context_line":"      value: \"rule:admin_api\""},{"line_number":2109,"context_line":"    cinder-group_group_types_manage:"},{"line_number":2110,"context_line":"      key: \"group:group_types_manage\""},{"line_number":2111,"context_line":"      value: \"rule:group:group_types:create\""},{"line_number":2112,"context_line":"    cinder-group_group_types_update:"},{"line_number":2113,"context_line":"      key: \"group:group_types:update\""},{"line_number":2114,"context_line":"      value: \"rule:admin_api\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"ce9557ce_35833aa2","line":2111,"range":{"start_line":2109,"start_character":0,"end_line":2111,"end_character":44},"updated":"2021-10-07 15:10:42.000000000","message":"Note for reviewers, this isn\u0027t used in Xena because cinder is calling enforcement on the granular policies and not this generic one.\n\nKeeping this here shouldn\u0027t hurt anything since it\u0027s effectively ignored by cinder code.","commit_id":"63cca41a2989e87d166ce5389c94af5b03e3d7f4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e6c43b87c57fb86880bcf2d5586c7dd9658183c7","unresolved":true,"context_lines":[{"line_number":2121,"context_line":"    cinder-group_group_types_specs_get:"},{"line_number":2122,"context_line":"      key: \"group:group_types_specs:get\""},{"line_number":2123,"context_line":"      value: \"rule:admin_api\""},{"line_number":2124,"context_line":"    cinder-group_group_types_specs:"},{"line_number":2125,"context_line":"      key: \"group:group_types_specs\""},{"line_number":2126,"context_line":"      value: \"rule:group:group_types_specs:get\""},{"line_number":2127,"context_line":"    cinder-group_group_types_specs_get_all:"},{"line_number":2128,"context_line":"      key: \"group:group_types_specs:get_all\""},{"line_number":2129,"context_line":"      value: \"rule:admin_api\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"95325190_4a48b166","line":2126,"range":{"start_line":2124,"start_character":0,"end_line":2126,"end_character":47},"updated":"2021-10-07 15:10:42.000000000","message":"Note for reviewers, this isn\u0027t used in Xena because cinder is calling enforcement on the granular policies and not this generic one.\n\nKeeping this here shouldn\u0027t hurt anything since it\u0027s effectively ignored by cinder code.","commit_id":"63cca41a2989e87d166ce5389c94af5b03e3d7f4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e6c43b87c57fb86880bcf2d5586c7dd9658183c7","unresolved":true,"context_lines":[{"line_number":2193,"context_line":"    cinder-volume_extension_quota_classes_get:"},{"line_number":2194,"context_line":"      key: \"volume_extension:quota_classes:get\""},{"line_number":2195,"context_line":"      value: \"rule:admin_api\""},{"line_number":2196,"context_line":"    cinder-volume_extension_quota_classes:"},{"line_number":2197,"context_line":"      key: \"volume_extension:quota_classes\""},{"line_number":2198,"context_line":"      value: \"rule:volume_extension:quota_classes:get\""},{"line_number":2199,"context_line":"    cinder-volume_extension_quota_classes_update:"},{"line_number":2200,"context_line":"      key: \"volume_extension:quota_classes:update\""},{"line_number":2201,"context_line":"      value: \"rule:admin_api\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"d94d39b1_af686612","line":2198,"range":{"start_line":2196,"start_character":0,"end_line":2198,"end_character":54},"updated":"2021-10-07 15:10:42.000000000","message":"Note for reviewers, this isn\u0027t used in Xena because cinder is calling enforcement on the granular policies and not this generic one.\n\nKeeping this here shouldn\u0027t hurt anything since it\u0027s effectively ignored by cinder code.","commit_id":"63cca41a2989e87d166ce5389c94af5b03e3d7f4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e6c43b87c57fb86880bcf2d5586c7dd9658183c7","unresolved":true,"context_lines":[{"line_number":2247,"context_line":"    cinder-volume_extension_type_create:"},{"line_number":2248,"context_line":"      key: \"volume_extension:type_create\""},{"line_number":2249,"context_line":"      value: \"rule:admin_api\""},{"line_number":2250,"context_line":"    cinder-volume_extension_types_manage:"},{"line_number":2251,"context_line":"      key: \"volume_extension:types_manage\""},{"line_number":2252,"context_line":"      value: \"rule:volume_extension:type_create\""},{"line_number":2253,"context_line":"    cinder-volume_extension_type_update:"},{"line_number":2254,"context_line":"      key: \"volume_extension:type_update\""},{"line_number":2255,"context_line":"      value: \"rule:admin_api\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3837606b_5d7a9863","line":2252,"range":{"start_line":2250,"start_character":0,"end_line":2252,"end_character":48},"updated":"2021-10-07 15:10:42.000000000","message":"Note for reviewers, this isn\u0027t used in Xena because cinder is calling enforcement on the granular policies and not this generic one.\n\nKeeping this here shouldn\u0027t hurt anything since it\u0027s effectively ignored by cinder code.","commit_id":"63cca41a2989e87d166ce5389c94af5b03e3d7f4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5d61af628fb9067a7f1ffa2de3f48ace82a734be","unresolved":true,"context_lines":[{"line_number":2108,"context_line":"      value: \"rule:admin_api\""},{"line_number":2109,"context_line":"    cinder-group_group_types_manage:"},{"line_number":2110,"context_line":"      key: \"group:group_types_manage\""},{"line_number":2111,"context_line":"      value: \"rule:group:group_types:create\""},{"line_number":2112,"context_line":"    cinder-group_group_types_update:"},{"line_number":2113,"context_line":"      key: \"group:group_types:update\""},{"line_number":2114,"context_line":"      value: \"rule:admin_api\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"e383b0f9_196e1977","side":"PARENT","line":2111,"updated":"2021-10-07 16:41:36.000000000","message":"The cinder code doesn\u0027t call this policy, so keeping it here is noise and gives the impression it does something when it actually doesn\u0027t so long as we\u0027re using the new, more granular policies.","commit_id":"c9635bf92e3174799724ebe0cbe46f666800b88e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5d61af628fb9067a7f1ffa2de3f48ace82a734be","unresolved":true,"context_lines":[{"line_number":2123,"context_line":"      value: \"rule:admin_api\""},{"line_number":2124,"context_line":"    cinder-group_group_types_specs:"},{"line_number":2125,"context_line":"      key: \"group:group_types_specs\""},{"line_number":2126,"context_line":"      value: \"rule:group:group_types_specs:get\""},{"line_number":2127,"context_line":"    cinder-group_group_types_specs_get_all:"},{"line_number":2128,"context_line":"      key: \"group:group_types_specs:get_all\""},{"line_number":2129,"context_line":"      value: \"rule:admin_api\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"294a9a4b_4d4d256e","side":"PARENT","line":2126,"updated":"2021-10-07 16:41:36.000000000","message":"The cinder code doesn\u0027t call this policy, so keeping it here is noise and gives the impression it does something when it actually doesn\u0027t so long as we\u0027re using the new, more granular policies.","commit_id":"c9635bf92e3174799724ebe0cbe46f666800b88e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5d61af628fb9067a7f1ffa2de3f48ace82a734be","unresolved":true,"context_lines":[{"line_number":2195,"context_line":"      value: \"rule:admin_api\""},{"line_number":2196,"context_line":"    cinder-volume_extension_quota_classes:"},{"line_number":2197,"context_line":"      key: \"volume_extension:quota_classes\""},{"line_number":2198,"context_line":"      value: \"rule:volume_extension:quota_classes:get\""},{"line_number":2199,"context_line":"    cinder-volume_extension_quota_classes_update:"},{"line_number":2200,"context_line":"      key: \"volume_extension:quota_classes:update\""},{"line_number":2201,"context_line":"      value: \"rule:admin_api\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"fa4b81cf_9c8c2585","side":"PARENT","line":2198,"updated":"2021-10-07 16:41:36.000000000","message":"The cinder code doesn\u0027t call this policy, so keeping it here is noise and gives the impression it does something when it actually doesn\u0027t so long as we\u0027re using the new, more granular policies.","commit_id":"c9635bf92e3174799724ebe0cbe46f666800b88e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5d61af628fb9067a7f1ffa2de3f48ace82a734be","unresolved":true,"context_lines":[{"line_number":2249,"context_line":"      value: \"rule:admin_api\""},{"line_number":2250,"context_line":"    cinder-volume_extension_types_manage:"},{"line_number":2251,"context_line":"      key: \"volume_extension:types_manage\""},{"line_number":2252,"context_line":"      value: \"rule:volume_extension:type_create\""},{"line_number":2253,"context_line":"    cinder-volume_extension_type_update:"},{"line_number":2254,"context_line":"      key: \"volume_extension:type_update\""},{"line_number":2255,"context_line":"      value: \"rule:admin_api\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"93b73bed_1dea3e96","side":"PARENT","line":2252,"updated":"2021-10-07 16:41:36.000000000","message":"The cinder code doesn\u0027t call this policy, so keeping it here is noise and gives the impression it does something when it actually doesn\u0027t so long as we\u0027re using the new, more granular policies.","commit_id":"c9635bf92e3174799724ebe0cbe46f666800b88e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5d61af628fb9067a7f1ffa2de3f48ace82a734be","unresolved":true,"context_lines":[{"line_number":2387,"context_line":"      value: \"rule:xena_system_admin_or_project_reader\""},{"line_number":2388,"context_line":"    cinder-volume_extension_volume_image_metadata:"},{"line_number":2389,"context_line":"      key: \"volume_extension:volume_image_metadata\""},{"line_number":2390,"context_line":"      value: \"rule:volume_extension:volume_image_metadata:show\""},{"line_number":2391,"context_line":"    cinder-volume_extension_volume_image_metadata_set:"},{"line_number":2392,"context_line":"      key: \"volume_extension:volume_image_metadata:set\""},{"line_number":2393,"context_line":"      value: \"rule:xena_system_admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"67f86cba_5323dd7f","side":"PARENT","line":2390,"updated":"2021-10-07 16:41:36.000000000","message":"The cinder code doesn\u0027t call this policy, so keeping it here is noise and gives the impression it does something when it actually doesn\u0027t so long as we\u0027re using the new, more granular policies.","commit_id":"c9635bf92e3174799724ebe0cbe46f666800b88e"},{"author":{"_account_id":21129,"name":"Alan Bishop","email":"abishopsweng@gmail.com","username":"ASBishop","status":"ex Red Hat"},"change_message_id":"b4535bcc68a76ed6730353a5a53d7b9b7716c048","unresolved":true,"context_lines":[{"line_number":1970,"context_line":"      value: \"is_admin:True or (role:admin and is_admin_project:True)\""},{"line_number":1971,"context_line":"    cinder-system_admin_or_project_member:"},{"line_number":1972,"context_line":"      key: \"system_admin_or_project_member\""},{"line_number":1973,"context_line":"      value: \"rule:admin_api or (role:member and project_id:%(project_id)s)\""},{"line_number":1974,"context_line":"    cinder-system_admin_or_project_reader:"},{"line_number":1975,"context_line":"      key: \"system_admin_or_project_reader\""},{"line_number":1976,"context_line":"      value: \"rule:admin_api or (role:reader and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"3b254159_53e94198","line":1973,"updated":"2021-10-07 17:28:21.000000000","message":"Argh, I may have misled us in my previous comments here and at L1967. Looking closely at cinder\u0027s base policy, in xena it\u0027s using \"_LEGACY_SYSTEM_ADMIN\" [1], which resolves to \"role:admin\" (not \"rule:admin_api\").\n\n[1] https://review.opendev.org/c/openstack/cinder/+/803748/9/cinder/policies/base.py#166\n[2] https://review.opendev.org/c/openstack/cinder/+/803748/9/cinder/policies/base.py#69","commit_id":"184e17c2b0ae3c960c605e021a3050f364a52a87"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3c20302cfe6b50affd7732554ef3256a8cdcd9bf","unresolved":false,"context_lines":[{"line_number":1970,"context_line":"      value: \"is_admin:True or (role:admin and is_admin_project:True)\""},{"line_number":1971,"context_line":"    cinder-system_admin_or_project_member:"},{"line_number":1972,"context_line":"      key: \"system_admin_or_project_member\""},{"line_number":1973,"context_line":"      value: \"rule:admin_api or (role:member and project_id:%(project_id)s)\""},{"line_number":1974,"context_line":"    cinder-system_admin_or_project_reader:"},{"line_number":1975,"context_line":"      key: \"system_admin_or_project_reader\""},{"line_number":1976,"context_line":"      value: \"rule:admin_api or (role:reader and project_id:%(project_id)s)\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"883464f6_3eef71d9","line":1973,"in_reply_to":"3b254159_53e94198","updated":"2021-10-08 13:57:05.000000000","message":"Done","commit_id":"184e17c2b0ae3c960c605e021a3050f364a52a87"},{"author":{"_account_id":21129,"name":"Alan Bishop","email":"abishopsweng@gmail.com","username":"ASBishop","status":"ex Red Hat"},"change_message_id":"b4535bcc68a76ed6730353a5a53d7b9b7716c048","unresolved":true,"context_lines":[{"line_number":1973,"context_line":"      value: \"rule:admin_api or (role:member and project_id:%(project_id)s)\""},{"line_number":1974,"context_line":"    cinder-system_admin_or_project_reader:"},{"line_number":1975,"context_line":"      key: \"system_admin_or_project_reader\""},{"line_number":1976,"context_line":"      value: \"rule:admin_api or (role:reader and project_id:%(project_id)s)\""},{"line_number":1977,"context_line":"    cinder-volume_attachment_create:"},{"line_number":1978,"context_line":"      key: \"volume:attachment_create\""},{"line_number":1979,"context_line":"      value: \"rule:system_admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"9541660a_bf0ec53f","line":1976,"updated":"2021-10-07 17:28:21.000000000","message":"Same as above: in xena cinder specifies \"role:admin\" and not \"rule:admin_api\"\n\nSorry for causing churn!","commit_id":"184e17c2b0ae3c960c605e021a3050f364a52a87"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3c20302cfe6b50affd7732554ef3256a8cdcd9bf","unresolved":false,"context_lines":[{"line_number":1973,"context_line":"      value: \"rule:admin_api or (role:member and project_id:%(project_id)s)\""},{"line_number":1974,"context_line":"    cinder-system_admin_or_project_reader:"},{"line_number":1975,"context_line":"      key: \"system_admin_or_project_reader\""},{"line_number":1976,"context_line":"      value: \"rule:admin_api or (role:reader and project_id:%(project_id)s)\""},{"line_number":1977,"context_line":"    cinder-volume_attachment_create:"},{"line_number":1978,"context_line":"      key: \"volume:attachment_create\""},{"line_number":1979,"context_line":"      value: \"rule:system_admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"11be89f2_385fcec8","line":1976,"in_reply_to":"9541660a_bf0ec53f","updated":"2021-10-08 13:57:05.000000000","message":"Done","commit_id":"184e17c2b0ae3c960c605e021a3050f364a52a87"},{"author":{"_account_id":21129,"name":"Alan Bishop","email":"abishopsweng@gmail.com","username":"ASBishop","status":"ex Red Hat"},"change_message_id":"b4535bcc68a76ed6730353a5a53d7b9b7716c048","unresolved":true,"context_lines":[{"line_number":1994,"context_line":"      value: \"rule:system_admin_or_project_reader\""},{"line_number":1995,"context_line":"    cinder-message_get:"},{"line_number":1996,"context_line":"      key: \"message:get\""},{"line_number":1997,"context_line":"      value: \"rule:message:get_all\""},{"line_number":1998,"context_line":"    cinder-message_delete:"},{"line_number":1999,"context_line":"      key: \"message:delete\""},{"line_number":2000,"context_line":"      value: \"rule:system_admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"382d90f3_9188df60","line":1997,"updated":"2021-10-07 17:28:21.000000000","message":"Sorry, just spotted this now. Is there a reason why \"get\" sort of symlinks to the \"get_all\" policy? In all other instances, the \"get\" and \"get_all\" policy values are repeated. For example, see L2001-L2006.","commit_id":"184e17c2b0ae3c960c605e021a3050f364a52a87"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8beea56abce6593675583d9eed9818bf0707d655","unresolved":true,"context_lines":[{"line_number":1994,"context_line":"      value: \"rule:system_admin_or_project_reader\""},{"line_number":1995,"context_line":"    cinder-message_get:"},{"line_number":1996,"context_line":"      key: \"message:get\""},{"line_number":1997,"context_line":"      value: \"rule:message:get_all\""},{"line_number":1998,"context_line":"    cinder-message_delete:"},{"line_number":1999,"context_line":"      key: \"message:delete\""},{"line_number":2000,"context_line":"      value: \"rule:system_admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"84525e2c_6e21d63d","line":1997,"in_reply_to":"382d90f3_9188df60","updated":"2021-10-07 18:46:06.000000000","message":"I think we may have gotten our wires crossed [0], which is causing oslo.policy to think we\u0027re changing the policy name, hence the alias.\n\n[0] https://review.opendev.org/c/openstack/cinder/+/806631","commit_id":"184e17c2b0ae3c960c605e021a3050f364a52a87"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3c20302cfe6b50affd7732554ef3256a8cdcd9bf","unresolved":false,"context_lines":[{"line_number":1994,"context_line":"      value: \"rule:system_admin_or_project_reader\""},{"line_number":1995,"context_line":"    cinder-message_get:"},{"line_number":1996,"context_line":"      key: \"message:get\""},{"line_number":1997,"context_line":"      value: \"rule:message:get_all\""},{"line_number":1998,"context_line":"    cinder-message_delete:"},{"line_number":1999,"context_line":"      key: \"message:delete\""},{"line_number":2000,"context_line":"      value: \"rule:system_admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"34914c40_4e638a2a","line":1997,"in_reply_to":"60fdb409_7d64a823","updated":"2021-10-08 13:57:05.000000000","message":"Done","commit_id":"184e17c2b0ae3c960c605e021a3050f364a52a87"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e2695af7f3ef5b348080b6f79b7a3012188f8c75","unresolved":true,"context_lines":[{"line_number":1994,"context_line":"      value: \"rule:system_admin_or_project_reader\""},{"line_number":1995,"context_line":"    cinder-message_get:"},{"line_number":1996,"context_line":"      key: \"message:get\""},{"line_number":1997,"context_line":"      value: \"rule:message:get_all\""},{"line_number":1998,"context_line":"    cinder-message_delete:"},{"line_number":1999,"context_line":"      key: \"message:delete\""},{"line_number":2000,"context_line":"      value: \"rule:system_admin_or_project_member\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"60fdb409_7d64a823","line":1997,"in_reply_to":"84525e2c_6e21d63d","updated":"2021-10-07 18:50:41.000000000","message":"Proposed a fix.\n\nhttps://review.opendev.org/c/openstack/cinder/+/813067","commit_id":"184e17c2b0ae3c960c605e021a3050f364a52a87"}]}