)]}'
{"environments/enable-secure-rbac.yaml":[{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"cc61fa5406fa15104e5146792658c5d909192f7d","unresolved":true,"context_lines":[{"line_number":9,"context_line":"      value: \"is_admin:True or project_id:%(project_id)s\""},{"line_number":10,"context_line":"    nova-admin_api:"},{"line_number":11,"context_line":"      key: \"admin_api\""},{"line_number":12,"context_line":"      value: \"role:admin\""},{"line_number":13,"context_line":"    nova-system_admin_api:"},{"line_number":14,"context_line":"      key: \"system_admin_api\""},{"line_number":15,"context_line":"      value: \"role:admin and system_scope:all\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"8ba74b0d_f8494e57","line":12,"range":{"start_line":12,"start_character":0,"end_line":12,"end_character":3},"updated":"2021-09-24 15:18:59.000000000","message":"is this intentional.\n\nwhat are the implicaiton of checking is_admin:True vs role:admin or are they the same","commit_id":"f5d97f1a3622deac057192245ec9df4d4f2a08ca"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d65ce0039544efead0a55bb6e63dbec5b717046c","unresolved":true,"context_lines":[{"line_number":9,"context_line":"      value: \"is_admin:True or project_id:%(project_id)s\""},{"line_number":10,"context_line":"    nova-admin_api:"},{"line_number":11,"context_line":"      key: \"admin_api\""},{"line_number":12,"context_line":"      value: \"role:admin\""},{"line_number":13,"context_line":"    nova-system_admin_api:"},{"line_number":14,"context_line":"      key: \"system_admin_api\""},{"line_number":15,"context_line":"      value: \"role:admin and system_scope:all\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"fdceec7d_86a80b6d","line":12,"range":{"start_line":12,"start_character":0,"end_line":12,"end_character":3},"in_reply_to":"8ba74b0d_f8494e57","updated":"2021-09-28 13:16:14.000000000","message":"The is_admin:True check is just a longer way of getting to role:\u0027admin\u0027. The is_admin:True check evaluates the is_admin property of the context object [0], which is ultimately set by context_is_admin [1] and defaults to only checking the admin role [2].\n\nSince we\u0027re moving towards more granularity with administrative roles (e.g., ideally we want system-admins, domain-admins, and project-admins), I lean towards not using is_admin since it\u0027s doesn\u0027t relay anything about the scope unless you override the context_is_admin check. IME, using role:admin is more direct and clear until we get the scope-types integrated back in (or just using nova\u0027s defaults).\n\n[0] https://github.com/openstack/nova/blob/master/nova/context.py#L138\n[1] https://github.com/openstack/nova/blob/master/nova/policy.py#L218\n[2] https://github.com/openstack/nova/blob/master/nova/policies/base.py#L88-L91","commit_id":"f5d97f1a3622deac057192245ec9df4d4f2a08ca"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"cc61fa5406fa15104e5146792658c5d909192f7d","unresolved":true,"context_lines":[{"line_number":267,"context_line":"      value: \"rule:admin_api or rule:project_reader_api\""},{"line_number":268,"context_line":"    nova-os_compute_api_os-keypairs_index:"},{"line_number":269,"context_line":"      key: \"os_compute_api:os-keypairs:index\""},{"line_number":270,"context_line":"      value: \"rule:admin_api or user_id:%(user_id)s\""},{"line_number":271,"context_line":"    nova-os_compute_api_os-keypairs_create:"},{"line_number":272,"context_line":"      key: \"os_compute_api:os-keypairs:create\""},{"line_number":273,"context_line":"      value: \"rule:admin_api or user_id:%(user_id)s\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"9d360163_b8d9aa74","line":270,"range":{"start_line":270,"start_character":4,"end_line":270,"end_character":52},"updated":"2021-09-24 15:18:59.000000000","message":"ok yes the keypairs are owned by the user not the project so you should not be able to see keypair that are not yours unless you an admin +1","commit_id":"f5d97f1a3622deac057192245ec9df4d4f2a08ca"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"cc61fa5406fa15104e5146792658c5d909192f7d","unresolved":true,"context_lines":[{"line_number":490,"context_line":"    nova-os_compute_api_servers_create:"},{"line_number":491,"context_line":"      key: \"os_compute_api:servers:create\""},{"line_number":492,"context_line":"      value: \"rule:project_member_api\""},{"line_number":493,"context_line":"    nova-os_compute_api_servers_create_forced_host:"},{"line_number":494,"context_line":"      key: \"os_compute_api:servers:create:forced_host\""},{"line_number":495,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":496,"context_line":"    nova-compute_servers_create_requested_destination:"},{"line_number":497,"context_line":"      key: \"compute:servers:create:requested_destination\""},{"line_number":498,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":499,"context_line":"    nova-os_compute_api_servers_create_attach_volume:"},{"line_number":500,"context_line":"      key: \"os_compute_api:servers:create:attach_volume\""},{"line_number":501,"context_line":"      value: \"rule:project_member_api\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"7f9ae610_bd88f185","line":498,"range":{"start_line":493,"start_character":1,"end_line":498,"end_character":36},"updated":"2021-09-24 15:18:59.000000000","message":"ok so project admin is \n\n    nova-project_admin_api:\n      key: \"project_admin_api\"\n      value: \"role:admin and project_id:%(project_id)s\"\n\nwe likely just want to have this be \n\n    nova-project_admin_api:\n      key: \"project_admin_api\"\n      value: \"rule:admin_api\"\n\nwe can check the project matche if we want but with this set of override there is just a gloabl admin and it feels strnge to lock down the api we wanted to open up to project admin more then the purly admin only apis\n\nso i would redefien project_admin_api as an alisa for admin_api\n\n-1 is for this","commit_id":"f5d97f1a3622deac057192245ec9df4d4f2a08ca"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d65ce0039544efead0a55bb6e63dbec5b717046c","unresolved":false,"context_lines":[{"line_number":490,"context_line":"    nova-os_compute_api_servers_create:"},{"line_number":491,"context_line":"      key: \"os_compute_api:servers:create\""},{"line_number":492,"context_line":"      value: \"rule:project_member_api\""},{"line_number":493,"context_line":"    nova-os_compute_api_servers_create_forced_host:"},{"line_number":494,"context_line":"      key: \"os_compute_api:servers:create:forced_host\""},{"line_number":495,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":496,"context_line":"    nova-compute_servers_create_requested_destination:"},{"line_number":497,"context_line":"      key: \"compute:servers:create:requested_destination\""},{"line_number":498,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":499,"context_line":"    nova-os_compute_api_servers_create_attach_volume:"},{"line_number":500,"context_line":"      key: \"os_compute_api:servers:create:attach_volume\""},{"line_number":501,"context_line":"      value: \"rule:project_member_api\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"9e17fdfd_271c96c8","line":498,"range":{"start_line":493,"start_character":1,"end_line":498,"end_character":36},"in_reply_to":"7f9ae610_bd88f185","updated":"2021-09-28 13:16:14.000000000","message":"Yep - good catch. Done.","commit_id":"f5d97f1a3622deac057192245ec9df4d4f2a08ca"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d65ce0039544efead0a55bb6e63dbec5b717046c","unresolved":false,"context_lines":[{"line_number":507,"context_line":"      value: \"rule:project_member_api\""},{"line_number":508,"context_line":"    nova-os_compute_api_servers_create_zero_disk_flavor:"},{"line_number":509,"context_line":"      key: \"os_compute_api:servers:create:zero_disk_flavor\""},{"line_number":510,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":511,"context_line":"    nova-network_attach_external_network:"},{"line_number":512,"context_line":"      key: \"network:attach_external_network\""},{"line_number":513,"context_line":"      value: \"rule:project_admin_api\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3ae9de60_c20beca4","line":510,"updated":"2021-09-28 13:16:14.000000000","message":"Moved this to rule:admin_api per Sean\u0027s comment above.","commit_id":"f5d97f1a3622deac057192245ec9df4d4f2a08ca"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d65ce0039544efead0a55bb6e63dbec5b717046c","unresolved":false,"context_lines":[{"line_number":510,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":511,"context_line":"    nova-network_attach_external_network:"},{"line_number":512,"context_line":"      key: \"network:attach_external_network\""},{"line_number":513,"context_line":"      value: \"rule:project_admin_api\""},{"line_number":514,"context_line":"    nova-os_compute_api_servers_delete:"},{"line_number":515,"context_line":"      key: \"os_compute_api:servers:delete\""},{"line_number":516,"context_line":"      value: \"rule:admin_api or rule:project_member_api\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"ad8941f5_7952262a","line":513,"updated":"2021-09-28 13:16:14.000000000","message":"Moved this to rule:admin_api per Sean\u0027s comment above.","commit_id":"f5d97f1a3622deac057192245ec9df4d4f2a08ca"}]}