)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"82c818a1_7c111daa","updated":"2021-10-28 20:16:14.000000000","message":"Reviewed with @Ade and @Dave.","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"287f17630ace2e8db99311c82c8518ee4ba1ce3a","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"b4f32ea5_bd858f9e","updated":"2021-11-01 19:20:28.000000000","message":"Reviewed with @Ade, @Dave and @Lance.","commit_id":"a98b73ad854106cb861a4c4985facb2ed3e2a97a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4c1157babbcaa8e70af2ef0d1f5edc75a1b5a575","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"98cdc9a8_66cb9009","updated":"2021-11-04 13:32:42.000000000","message":"A few comments inline.\n\nOtherwise, I think this is on the right track for applying administrative functionality to the project-admin level instead of the system user level for now.","commit_id":"839ddccdbd43b5eb41441c75a953647995f89959"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"90382296205ad6225a9b01a36307aa9908a53aae","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"a29589e1_7daa8a87","updated":"2021-11-11 17:48:07.000000000","message":"Looks good to me. Thanks, Doug!","commit_id":"839ddccdbd43b5eb41441c75a953647995f89959"}],"environments/enable-secure-rbac.yaml":[{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3052,"context_line":"    barbican-secret_acl_read:"},{"line_number":3053,"context_line":"      key: \"secret_acl_read\""},{"line_number":3054,"context_line":"      value: \"\u0027read\u0027:%(target.secret.read)s\""},{"line_number":3055,"context_line":"    barbican-secret_is_private_read:"},{"line_number":3056,"context_line":"      key: \"secret_is_private_read\""},{"line_number":3057,"context_line":"      value: \"\u0027False\u0027:%(target.secret.read_project_access)s\""},{"line_number":3058,"context_line":"    barbican-container_owner:"},{"line_number":3059,"context_line":"      key: \"container_owner\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"5c0e5dd8_f9eb97ae","line":3056,"range":{"start_line":3055,"start_character":13,"end_line":3056,"end_character":34},"updated":"2021-10-28 20:16:14.000000000","message":"s/secret_is_private/secret_is_not_private/","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3052,"context_line":"    barbican-secret_acl_read:"},{"line_number":3053,"context_line":"      key: \"secret_acl_read\""},{"line_number":3054,"context_line":"      value: \"\u0027read\u0027:%(target.secret.read)s\""},{"line_number":3055,"context_line":"    barbican-secret_is_private_read:"},{"line_number":3056,"context_line":"      key: \"secret_is_private_read\""},{"line_number":3057,"context_line":"      value: \"\u0027False\u0027:%(target.secret.read_project_access)s\""},{"line_number":3058,"context_line":"    barbican-container_owner:"},{"line_number":3059,"context_line":"      key: \"container_owner\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"6cfde54a_ccaf9e19","line":3056,"range":{"start_line":3055,"start_character":13,"end_line":3056,"end_character":34},"in_reply_to":"5c0e5dd8_f9eb97ae","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3054,"context_line":"      value: \"\u0027read\u0027:%(target.secret.read)s\""},{"line_number":3055,"context_line":"    barbican-secret_is_private_read:"},{"line_number":3056,"context_line":"      key: \"secret_is_private_read\""},{"line_number":3057,"context_line":"      value: \"\u0027False\u0027:%(target.secret.read_project_access)s\""},{"line_number":3058,"context_line":"    barbican-container_owner:"},{"line_number":3059,"context_line":"      key: \"container_owner\""},{"line_number":3060,"context_line":"      value: \"user_id:%(target.container.creator_id)s\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"a183e089_95c96970","line":3057,"range":{"start_line":3057,"start_character":15,"end_line":3057,"end_character":20},"updated":"2021-10-28 20:16:14.000000000","message":"s/False/True","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3054,"context_line":"      value: \"\u0027read\u0027:%(target.secret.read)s\""},{"line_number":3055,"context_line":"    barbican-secret_is_private_read:"},{"line_number":3056,"context_line":"      key: \"secret_is_private_read\""},{"line_number":3057,"context_line":"      value: \"\u0027False\u0027:%(target.secret.read_project_access)s\""},{"line_number":3058,"context_line":"    barbican-container_owner:"},{"line_number":3059,"context_line":"      key: \"container_owner\""},{"line_number":3060,"context_line":"      value: \"user_id:%(target.container.creator_id)s\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"06d3e8e5_2694fbf1","line":3057,"range":{"start_line":3057,"start_character":15,"end_line":3057,"end_character":20},"in_reply_to":"a183e089_95c96970","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3062,"context_line":"      key: \"container_acl_read\""},{"line_number":3063,"context_line":"      value: \"\u0027read\u0027:%(target.container.read)s\""},{"line_number":3064,"context_line":"    barbican-container_is_not_private_read:"},{"line_number":3065,"context_line":"      key: \"container_is_private_read\""},{"line_number":3066,"context_line":"      value: \"\u0027True\u0027:%(target.container.read_project_access)s\""},{"line_number":3067,"context_line":"    barbican-secret_project_admin:"},{"line_number":3068,"context_line":"      key: \"secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"f45bfc3a_bbfe650d","line":3065,"range":{"start_line":3065,"start_character":12,"end_line":3065,"end_character":37},"updated":"2021-10-28 20:16:14.000000000","message":"s/container_is_private_read/container_is_not_private/","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3062,"context_line":"      key: \"container_acl_read\""},{"line_number":3063,"context_line":"      value: \"\u0027read\u0027:%(target.container.read)s\""},{"line_number":3064,"context_line":"    barbican-container_is_not_private_read:"},{"line_number":3065,"context_line":"      key: \"container_is_private_read\""},{"line_number":3066,"context_line":"      value: \"\u0027True\u0027:%(target.container.read_project_access)s\""},{"line_number":3067,"context_line":"    barbican-secret_project_admin:"},{"line_number":3068,"context_line":"      key: \"secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"c3b0e21d_b3f4ac1b","line":3065,"range":{"start_line":3065,"start_character":12,"end_line":3065,"end_character":37},"in_reply_to":"f45bfc3a_bbfe650d","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3070,"context_line":"    barbican-secret_project_member:"},{"line_number":3071,"context_line":"      key: \"secret_project_member\""},{"line_number":3072,"context_line":"      value: \"rule:member and project_id:%(target.secret.project_id)s\""},{"line_number":3073,"context_line":"    barbican-secret_project_reader:"},{"line_number":3074,"context_line":"      key: \"secret_project_reader\""},{"line_number":3075,"context_line":"      value: \"rule:reader and project_id:%(target.secret.project_id)s\""},{"line_number":3076,"context_line":"    barbican-container_project_admin:"},{"line_number":3077,"context_line":"      key: \"container_project_admin\""},{"line_number":3078,"context_line":"      value: \"rule:admin and project_id:%(target.secret.project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"f785bc11_9a283969","line":3075,"range":{"start_line":3073,"start_character":4,"end_line":3075,"end_character":70},"updated":"2021-10-28 20:16:14.000000000","message":"We don\u0027t need this either.","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3070,"context_line":"    barbican-secret_project_member:"},{"line_number":3071,"context_line":"      key: \"secret_project_member\""},{"line_number":3072,"context_line":"      value: \"rule:member and project_id:%(target.secret.project_id)s\""},{"line_number":3073,"context_line":"    barbican-secret_project_reader:"},{"line_number":3074,"context_line":"      key: \"secret_project_reader\""},{"line_number":3075,"context_line":"      value: \"rule:reader and project_id:%(target.secret.project_id)s\""},{"line_number":3076,"context_line":"    barbican-container_project_admin:"},{"line_number":3077,"context_line":"      key: \"container_project_admin\""},{"line_number":3078,"context_line":"      value: \"rule:admin and project_id:%(target.secret.project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"b83c6cd4_0acd15ae","line":3075,"range":{"start_line":3073,"start_character":4,"end_line":3075,"end_character":70},"in_reply_to":"f785bc11_9a283969","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3075,"context_line":"      value: \"rule:reader and project_id:%(target.secret.project_id)s\""},{"line_number":3076,"context_line":"    barbican-container_project_admin:"},{"line_number":3077,"context_line":"      key: \"container_project_admin\""},{"line_number":3078,"context_line":"      value: \"rule:admin and project_id:%(target.secret.project_id)s\""},{"line_number":3079,"context_line":"    barbican-container_project_member:"},{"line_number":3080,"context_line":"      key: \"container_project_member\""},{"line_number":3081,"context_line":"      value: \"rule:member and project_id:%(target.secret.project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"cec1da3a_9a28de99","line":3078,"range":{"start_line":3078,"start_character":49,"end_line":3078,"end_character":55},"updated":"2021-10-28 20:16:14.000000000","message":"s/secret/container/","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3075,"context_line":"      value: \"rule:reader and project_id:%(target.secret.project_id)s\""},{"line_number":3076,"context_line":"    barbican-container_project_admin:"},{"line_number":3077,"context_line":"      key: \"container_project_admin\""},{"line_number":3078,"context_line":"      value: \"rule:admin and project_id:%(target.secret.project_id)s\""},{"line_number":3079,"context_line":"    barbican-container_project_member:"},{"line_number":3080,"context_line":"      key: \"container_project_member\""},{"line_number":3081,"context_line":"      value: \"rule:member and project_id:%(target.secret.project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"9bd1a6cc_ea1d6d07","line":3078,"range":{"start_line":3078,"start_character":49,"end_line":3078,"end_character":55},"in_reply_to":"cec1da3a_9a28de99","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3078,"context_line":"      value: \"rule:admin and project_id:%(target.secret.project_id)s\""},{"line_number":3079,"context_line":"    barbican-container_project_member:"},{"line_number":3080,"context_line":"      key: \"container_project_member\""},{"line_number":3081,"context_line":"      value: \"rule:member and project_id:%(target.secret.project_id)s\""},{"line_number":3082,"context_line":"    barbican-container_project_reader:"},{"line_number":3083,"context_line":"      key: \"container_project_reader\""},{"line_number":3084,"context_line":"      value: \"rule:reader and project_id:%(target.secret.project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"789342b3_647e631e","line":3081,"range":{"start_line":3081,"start_character":50,"end_line":3081,"end_character":56},"updated":"2021-10-28 20:16:14.000000000","message":"s/secret/container/","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3078,"context_line":"      value: \"rule:admin and project_id:%(target.secret.project_id)s\""},{"line_number":3079,"context_line":"    barbican-container_project_member:"},{"line_number":3080,"context_line":"      key: \"container_project_member\""},{"line_number":3081,"context_line":"      value: \"rule:member and project_id:%(target.secret.project_id)s\""},{"line_number":3082,"context_line":"    barbican-container_project_reader:"},{"line_number":3083,"context_line":"      key: \"container_project_reader\""},{"line_number":3084,"context_line":"      value: \"rule:reader and project_id:%(target.secret.project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"7254e86a_7a3e22fd","line":3081,"range":{"start_line":3081,"start_character":50,"end_line":3081,"end_character":56},"in_reply_to":"789342b3_647e631e","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3079,"context_line":"    barbican-container_project_member:"},{"line_number":3080,"context_line":"      key: \"container_project_member\""},{"line_number":3081,"context_line":"      value: \"rule:member and project_id:%(target.secret.project_id)s\""},{"line_number":3082,"context_line":"    barbican-container_project_reader:"},{"line_number":3083,"context_line":"      key: \"container_project_reader\""},{"line_number":3084,"context_line":"      value: \"rule:reader and project_id:%(target.secret.project_id)s\""},{"line_number":3085,"context_line":"    barbican-secret_acls_get:"},{"line_number":3086,"context_line":"      key: \"secret_acls:get\""},{"line_number":3087,"context_line":"      value: \"rule:secret_project_member and (rule:secret_owner or rule:secret_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"18062dce_e55c355f","line":3084,"range":{"start_line":3082,"start_character":4,"end_line":3084,"end_character":70},"updated":"2021-10-28 20:16:14.000000000","message":"We don\u0027t need this.","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3079,"context_line":"    barbican-container_project_member:"},{"line_number":3080,"context_line":"      key: \"container_project_member\""},{"line_number":3081,"context_line":"      value: \"rule:member and project_id:%(target.secret.project_id)s\""},{"line_number":3082,"context_line":"    barbican-container_project_reader:"},{"line_number":3083,"context_line":"      key: \"container_project_reader\""},{"line_number":3084,"context_line":"      value: \"rule:reader and project_id:%(target.secret.project_id)s\""},{"line_number":3085,"context_line":"    barbican-secret_acls_get:"},{"line_number":3086,"context_line":"      key: \"secret_acls:get\""},{"line_number":3087,"context_line":"      value: \"rule:secret_project_member and (rule:secret_owner or rule:secret_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"bf3c554a_2f585f34","line":3084,"range":{"start_line":3082,"start_character":4,"end_line":3084,"end_character":70},"in_reply_to":"18062dce_e55c355f","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3093,"context_line":"      value: \"rule:secret_project_member and (rule:secret_owner or rule:secret_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3094,"context_line":"    barbican-container_acls_get:"},{"line_number":3095,"context_line":"      key: \"container_acls:get\""},{"line_number":3096,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3097,"context_line":"    barbican-container_acls_delete:"},{"line_number":3098,"context_line":"      key: \"container_acls:delete\""},{"line_number":3099,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"d7d6f94c_a0e6a3a6","line":3096,"range":{"start_line":3096,"start_character":117,"end_line":3096,"end_character":137},"updated":"2021-10-28 20:16:14.000000000","message":"s/secret_project_admin/container_project_admin/","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3093,"context_line":"      value: \"rule:secret_project_member and (rule:secret_owner or rule:secret_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3094,"context_line":"    barbican-container_acls_get:"},{"line_number":3095,"context_line":"      key: \"container_acls:get\""},{"line_number":3096,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3097,"context_line":"    barbican-container_acls_delete:"},{"line_number":3098,"context_line":"      key: \"container_acls:delete\""},{"line_number":3099,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"29dc4c83_6dbffc94","line":3096,"range":{"start_line":3096,"start_character":117,"end_line":3096,"end_character":137},"in_reply_to":"d7d6f94c_a0e6a3a6","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3096,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3097,"context_line":"    barbican-container_acls_delete:"},{"line_number":3098,"context_line":"      key: \"container_acls:delete\""},{"line_number":3099,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3100,"context_line":"    barbican-container_acls_put_patch:"},{"line_number":3101,"context_line":"      key: \"container_acls:put_patch\""},{"line_number":3102,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"bd13c5f7_b3a05d41","line":3099,"range":{"start_line":3099,"start_character":117,"end_line":3099,"end_character":137},"updated":"2021-10-28 20:16:14.000000000","message":"s/secret_project_admin/container_project_admin/","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3096,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3097,"context_line":"    barbican-container_acls_delete:"},{"line_number":3098,"context_line":"      key: \"container_acls:delete\""},{"line_number":3099,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3100,"context_line":"    barbican-container_acls_put_patch:"},{"line_number":3101,"context_line":"      key: \"container_acls:put_patch\""},{"line_number":3102,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"853719a2_634c298d","line":3099,"range":{"start_line":3099,"start_character":117,"end_line":3099,"end_character":137},"in_reply_to":"bd13c5f7_b3a05d41","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3099,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3100,"context_line":"    barbican-container_acls_put_patch:"},{"line_number":3101,"context_line":"      key: \"container_acls:put_patch\""},{"line_number":3102,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3103,"context_line":"    barbican-consumer_get:"},{"line_number":3104,"context_line":"      key: \"consumer:get\""},{"line_number":3105,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"82d39b85_04f9114b","line":3102,"range":{"start_line":3102,"start_character":117,"end_line":3102,"end_character":137},"updated":"2021-10-28 20:16:14.000000000","message":"s/secret_project_admin/container_project_admin/","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3099,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3100,"context_line":"    barbican-container_acls_put_patch:"},{"line_number":3101,"context_line":"      key: \"container_acls:put_patch\""},{"line_number":3102,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3103,"context_line":"    barbican-consumer_get:"},{"line_number":3104,"context_line":"      key: \"consumer:get\""},{"line_number":3105,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"5069dff8_de636bf1","line":3102,"range":{"start_line":3102,"start_character":117,"end_line":3102,"end_character":137},"in_reply_to":"82d39b85_04f9114b","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3102,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3103,"context_line":"    barbican-consumer_get:"},{"line_number":3104,"context_line":"      key: \"consumer:get\""},{"line_number":3105,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3106,"context_line":"    barbican-consumers_get:"},{"line_number":3107,"context_line":"      key: \"consumers:get\""},{"line_number":3108,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"a4cb336b_b3727b14","line":3105,"range":{"start_line":3105,"start_character":117,"end_line":3105,"end_character":137},"updated":"2021-10-28 20:16:14.000000000","message":"s/secret_project_admin/container_project_admin or rule:system_admin/","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3102,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3103,"context_line":"    barbican-consumer_get:"},{"line_number":3104,"context_line":"      key: \"consumer:get\""},{"line_number":3105,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3106,"context_line":"    barbican-consumers_get:"},{"line_number":3107,"context_line":"      key: \"consumers:get\""},{"line_number":3108,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"393f3a76_a7866076","line":3105,"range":{"start_line":3105,"start_character":117,"end_line":3105,"end_character":137},"in_reply_to":"a4cb336b_b3727b14","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3105,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3106,"context_line":"    barbican-consumers_get:"},{"line_number":3107,"context_line":"      key: \"consumers:get\""},{"line_number":3108,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3109,"context_line":"    barbican-consumers_post:"},{"line_number":3110,"context_line":"      key: \"consumers:post\""},{"line_number":3111,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"33d3560e_12917384","line":3108,"range":{"start_line":3108,"start_character":117,"end_line":3108,"end_character":137},"updated":"2021-10-28 20:16:14.000000000","message":"s/secret_project_admin/container_project_admin or rule:system_admin/","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3105,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3106,"context_line":"    barbican-consumers_get:"},{"line_number":3107,"context_line":"      key: \"consumers:get\""},{"line_number":3108,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3109,"context_line":"    barbican-consumers_post:"},{"line_number":3110,"context_line":"      key: \"consumers:post\""},{"line_number":3111,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"a95dcc82_0292ec30","line":3108,"range":{"start_line":3108,"start_character":117,"end_line":3108,"end_character":137},"in_reply_to":"33d3560e_12917384","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3108,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3109,"context_line":"    barbican-consumers_post:"},{"line_number":3110,"context_line":"      key: \"consumers:post\""},{"line_number":3111,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3112,"context_line":"    barbican-consumers_delete:"},{"line_number":3113,"context_line":"      key: \"consumers:delete\""},{"line_number":3114,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"38cca011_b036c48b","line":3111,"range":{"start_line":3111,"start_character":117,"end_line":3111,"end_character":137},"updated":"2021-10-28 20:16:14.000000000","message":"s/secret_project_admin/container_project_admin or rule:system_admin/","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3108,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3109,"context_line":"    barbican-consumers_post:"},{"line_number":3110,"context_line":"      key: \"consumers:post\""},{"line_number":3111,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3112,"context_line":"    barbican-consumers_delete:"},{"line_number":3113,"context_line":"      key: \"consumers:delete\""},{"line_number":3114,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"36ddd23a_d6491a32","line":3111,"range":{"start_line":3111,"start_character":117,"end_line":3111,"end_character":137},"in_reply_to":"38cca011_b036c48b","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3111,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3112,"context_line":"    barbican-consumers_delete:"},{"line_number":3113,"context_line":"      key: \"consumers:delete\""},{"line_number":3114,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3115,"context_line":"    barbican-containers_post:"},{"line_number":3116,"context_line":"      key: \"containers:post\""},{"line_number":3117,"context_line":"      value: \"rule:member\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"855df8d2_2d2e2272","line":3114,"range":{"start_line":3114,"start_character":117,"end_line":3114,"end_character":137},"updated":"2021-10-28 20:16:14.000000000","message":"s/secret_project_admin/container_project_admin or rule:system_admin/","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3111,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3112,"context_line":"    barbican-consumers_delete:"},{"line_number":3113,"context_line":"      key: \"consumers:delete\""},{"line_number":3114,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3115,"context_line":"    barbican-containers_post:"},{"line_number":3116,"context_line":"      key: \"containers:post\""},{"line_number":3117,"context_line":"      value: \"rule:member\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"9b6c6c82_c2dc212d","line":3114,"range":{"start_line":3114,"start_character":117,"end_line":3114,"end_character":137},"in_reply_to":"855df8d2_2d2e2272","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3120,"context_line":"      value: \"rule:member\""},{"line_number":3121,"context_line":"    barbican-container_get:"},{"line_number":3122,"context_line":"      key: \"container:get\""},{"line_number":3123,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3124,"context_line":"    barbican-container_delete:"},{"line_number":3125,"context_line":"      key: \"container:delete\""},{"line_number":3126,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"7e4e70a6_a7b76eef","line":3123,"range":{"start_line":3123,"start_character":117,"end_line":3123,"end_character":137},"updated":"2021-10-28 20:16:14.000000000","message":"s/secret_project_admin/container_project_admin/","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3120,"context_line":"      value: \"rule:member\""},{"line_number":3121,"context_line":"    barbican-container_get:"},{"line_number":3122,"context_line":"      key: \"container:get\""},{"line_number":3123,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3124,"context_line":"    barbican-container_delete:"},{"line_number":3125,"context_line":"      key: \"container:delete\""},{"line_number":3126,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"663a8cf0_07b46819","line":3123,"range":{"start_line":3123,"start_character":117,"end_line":3123,"end_character":137},"in_reply_to":"7e4e70a6_a7b76eef","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3123,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3124,"context_line":"    barbican-container_delete:"},{"line_number":3125,"context_line":"      key: \"container:delete\""},{"line_number":3126,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3127,"context_line":"    barbican-container_secret_post:"},{"line_number":3128,"context_line":"      key: \"container_secret:post\""},{"line_number":3129,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"0d900b67_e320fed0","line":3126,"range":{"start_line":3126,"start_character":117,"end_line":3126,"end_character":137},"updated":"2021-10-28 20:16:14.000000000","message":"s/secret_project_admin/container_project_admin/","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3123,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3124,"context_line":"    barbican-container_delete:"},{"line_number":3125,"context_line":"      key: \"container:delete\""},{"line_number":3126,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3127,"context_line":"    barbican-container_secret_post:"},{"line_number":3128,"context_line":"      key: \"container_secret:post\""},{"line_number":3129,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"ae30d3ca_fe7099db","line":3126,"range":{"start_line":3126,"start_character":117,"end_line":3126,"end_character":137},"in_reply_to":"0d900b67_e320fed0","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3126,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3127,"context_line":"    barbican-container_secret_post:"},{"line_number":3128,"context_line":"      key: \"container_secret:post\""},{"line_number":3129,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3130,"context_line":"    barbican-container_secret_delete:"},{"line_number":3131,"context_line":"      key: \"container_secret:delete\""},{"line_number":3132,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3e42e284_af1abd55","line":3129,"range":{"start_line":3129,"start_character":117,"end_line":3129,"end_character":137},"updated":"2021-10-28 20:16:14.000000000","message":"s/secret_project_admin/container_project_admin/","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3126,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3127,"context_line":"    barbican-container_secret_post:"},{"line_number":3128,"context_line":"      key: \"container_secret:post\""},{"line_number":3129,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3130,"context_line":"    barbican-container_secret_delete:"},{"line_number":3131,"context_line":"      key: \"container_secret:delete\""},{"line_number":3132,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"5afb2b75_fada915a","line":3129,"range":{"start_line":3129,"start_character":117,"end_line":3129,"end_character":137},"in_reply_to":"3e42e284_af1abd55","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3129,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3130,"context_line":"    barbican-container_secret_delete:"},{"line_number":3131,"context_line":"      key: \"container_secret:delete\""},{"line_number":3132,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3133,"context_line":"    barbican-orders_get:"},{"line_number":3134,"context_line":"      key: \"orders:get\""},{"line_number":3135,"context_line":"      value: \"rule:member\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"ac123174_ee1f9539","line":3132,"range":{"start_line":3132,"start_character":117,"end_line":3132,"end_character":137},"updated":"2021-10-28 20:16:14.000000000","message":"s/secret_project_admin/container_project_admin/","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"2f5e2d644282225d16d884ec404e5d8babd8f66c","unresolved":false,"context_lines":[{"line_number":3129,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3130,"context_line":"    barbican-container_secret_delete:"},{"line_number":3131,"context_line":"      key: \"container_secret:delete\""},{"line_number":3132,"context_line":"      value: \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:secret_project_admin\""},{"line_number":3133,"context_line":"    barbican-orders_get:"},{"line_number":3134,"context_line":"      key: \"orders:get\""},{"line_number":3135,"context_line":"      value: \"rule:member\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"8d218fb5_96a532fe","line":3132,"range":{"start_line":3132,"start_character":117,"end_line":3132,"end_character":137},"in_reply_to":"ac123174_ee1f9539","updated":"2021-10-28 21:07:50.000000000","message":"Done","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3141,"context_line":"      value: \"rule:member\""},{"line_number":3142,"context_line":"    barbican-order_get:"},{"line_number":3143,"context_line":"      key: \"order:get\""},{"line_number":3144,"context_line":"      value: \"rule:member\""},{"line_number":3145,"context_line":"    barbican-order_delete:"},{"line_number":3146,"context_line":"      key: \"order:delete\""},{"line_number":3147,"context_line":"      value: \"rule:member\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"42d0e97d_a939a1dd","line":3144,"range":{"start_line":3144,"start_character":19,"end_line":3144,"end_character":25},"updated":"2021-10-28 20:16:14.000000000","message":"s/member/order_project_member/ also check existing S-RBAC policy, it also needs to be updated.","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3144,"context_line":"      value: \"rule:member\""},{"line_number":3145,"context_line":"    barbican-order_delete:"},{"line_number":3146,"context_line":"      key: \"order:delete\""},{"line_number":3147,"context_line":"      value: \"rule:member\""},{"line_number":3148,"context_line":"    barbican-quotas_get:"},{"line_number":3149,"context_line":"      key: \"quotas:get\""},{"line_number":3150,"context_line":"      value: \"rule:reader\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"562cde15_061306b6","line":3147,"range":{"start_line":3147,"start_character":19,"end_line":3147,"end_character":25},"updated":"2021-10-28 20:16:14.000000000","message":"s/member/order_project_member/ also check existing S-RBAC policy, it also needs to be updated.","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"548160029cfd6f3fe01863d8259e55d5a41810af","unresolved":true,"context_lines":[{"line_number":3150,"context_line":"      value: \"rule:reader\""},{"line_number":3151,"context_line":"    barbican-project_quotas_get:"},{"line_number":3152,"context_line":"      key: \"project_quotas:get\""},{"line_number":3153,"context_line":"      value: \"rule:system_admin\""},{"line_number":3154,"context_line":"    barbican-project_quotas_put:"},{"line_number":3155,"context_line":"      key: \"project_quotas:put\""},{"line_number":3156,"context_line":"      value: \"rule:system_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"5f6035fd_a030c9dd","line":3153,"range":{"start_line":3153,"start_character":19,"end_line":3153,"end_character":31},"updated":"2021-10-28 20:16:14.000000000","message":"@Lance, for this rule, we\u0027ve defined it as system-scope reader in the new s-rbac policy, but since there won\u0027t be a reader yet, we\u0027re using system_admin here.\n\nFor Barbican, this patch defines system_admin as having the role \"key-manager:service-admin\", which is what we have historically used in the default policy.\n\nDoes this make sense?","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"28a2fbde5cd5b51e6db3fc4f8903efa2d698772a","unresolved":false,"context_lines":[{"line_number":3150,"context_line":"      value: \"rule:reader\""},{"line_number":3151,"context_line":"    barbican-project_quotas_get:"},{"line_number":3152,"context_line":"      key: \"project_quotas:get\""},{"line_number":3153,"context_line":"      value: \"rule:system_admin\""},{"line_number":3154,"context_line":"    barbican-project_quotas_put:"},{"line_number":3155,"context_line":"      key: \"project_quotas:put\""},{"line_number":3156,"context_line":"      value: \"rule:system_admin\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"b590215a_b9d0958a","line":3153,"range":{"start_line":3153,"start_character":19,"end_line":3153,"end_character":31},"in_reply_to":"5f6035fd_a030c9dd","updated":"2021-11-01 22:51:27.000000000","message":"After talking to Lance we decided to use the \"admin\" role for this system-specific API.","commit_id":"1c729e5421ec38416bee59da9feefe0f10d22a66"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"287f17630ace2e8db99311c82c8518ee4ba1ce3a","unresolved":true,"context_lines":[{"line_number":3043,"context_line":"    barbican-reader:"},{"line_number":3044,"context_line":"      key: \"reader\""},{"line_number":3045,"context_line":"      value: \"role:reader\""},{"line_number":3046,"context_line":"    barbican-system_admin:"},{"line_number":3047,"context_line":"      key: \"system_admin\""},{"line_number":3048,"context_line":"      value: \"role:key-manager:service-admin\""},{"line_number":3049,"context_line":"    barbican-secret_owner:"},{"line_number":3050,"context_line":"      key: \"secret_owner\""},{"line_number":3051,"context_line":"      value: \"user_id:%(target.secret.creator_id)s\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"177edc6e_4605e85a","line":3048,"range":{"start_line":3046,"start_character":4,"end_line":3048,"end_character":45},"updated":"2021-11-01 19:20:28.000000000","message":"Get rid of this custom role.","commit_id":"a98b73ad854106cb861a4c4985facb2ed3e2a97a"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"f3388060747c8a58f14a73794d6abafda1010921","unresolved":false,"context_lines":[{"line_number":3043,"context_line":"    barbican-reader:"},{"line_number":3044,"context_line":"      key: \"reader\""},{"line_number":3045,"context_line":"      value: \"role:reader\""},{"line_number":3046,"context_line":"    barbican-system_admin:"},{"line_number":3047,"context_line":"      key: \"system_admin\""},{"line_number":3048,"context_line":"      value: \"role:key-manager:service-admin\""},{"line_number":3049,"context_line":"    barbican-secret_owner:"},{"line_number":3050,"context_line":"      key: \"secret_owner\""},{"line_number":3051,"context_line":"      value: \"user_id:%(target.secret.creator_id)s\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"db49aa9d_694c2c31","line":3048,"range":{"start_line":3046,"start_character":4,"end_line":3048,"end_character":45},"in_reply_to":"177edc6e_4605e85a","updated":"2021-11-01 22:42:21.000000000","message":"Done","commit_id":"a98b73ad854106cb861a4c4985facb2ed3e2a97a"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"287f17630ace2e8db99311c82c8518ee4ba1ce3a","unresolved":true,"context_lines":[{"line_number":3144,"context_line":"      value: \"rule:reader\""},{"line_number":3145,"context_line":"    barbican-project_quotas_get:"},{"line_number":3146,"context_line":"      key: \"project_quotas:get\""},{"line_number":3147,"context_line":"      value: \"rule:system_admin\""},{"line_number":3148,"context_line":"    barbican-project_quotas_put:"},{"line_number":3149,"context_line":"      key: \"project_quotas:put\""},{"line_number":3150,"context_line":"      value: \"rule:system_admin\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"8d9e8e89_e9dc1a65","line":3147,"range":{"start_line":3147,"start_character":19,"end_line":3147,"end_character":31},"updated":"2021-11-01 19:20:28.000000000","message":"s/system_admin/admin/","commit_id":"a98b73ad854106cb861a4c4985facb2ed3e2a97a"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"f3388060747c8a58f14a73794d6abafda1010921","unresolved":false,"context_lines":[{"line_number":3144,"context_line":"      value: \"rule:reader\""},{"line_number":3145,"context_line":"    barbican-project_quotas_get:"},{"line_number":3146,"context_line":"      key: \"project_quotas:get\""},{"line_number":3147,"context_line":"      value: \"rule:system_admin\""},{"line_number":3148,"context_line":"    barbican-project_quotas_put:"},{"line_number":3149,"context_line":"      key: \"project_quotas:put\""},{"line_number":3150,"context_line":"      value: \"rule:system_admin\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"373ca6db_5fbbe9ba","line":3147,"range":{"start_line":3147,"start_character":19,"end_line":3147,"end_character":31},"in_reply_to":"8d9e8e89_e9dc1a65","updated":"2021-11-01 22:42:21.000000000","message":"Done","commit_id":"a98b73ad854106cb861a4c4985facb2ed3e2a97a"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"287f17630ace2e8db99311c82c8518ee4ba1ce3a","unresolved":true,"context_lines":[{"line_number":3147,"context_line":"      value: \"rule:system_admin\""},{"line_number":3148,"context_line":"    barbican-project_quotas_put:"},{"line_number":3149,"context_line":"      key: \"project_quotas:put\""},{"line_number":3150,"context_line":"      value: \"rule:system_admin\""},{"line_number":3151,"context_line":"    barbican-project_quotas_delete:"},{"line_number":3152,"context_line":"      key: \"project_quotas:delete\""},{"line_number":3153,"context_line":"      value: \"rule:system_admin\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"536b86ab_55566ab1","line":3150,"range":{"start_line":3150,"start_character":19,"end_line":3150,"end_character":31},"updated":"2021-11-01 19:20:28.000000000","message":"s/system_admin/admin/","commit_id":"a98b73ad854106cb861a4c4985facb2ed3e2a97a"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"f3388060747c8a58f14a73794d6abafda1010921","unresolved":false,"context_lines":[{"line_number":3147,"context_line":"      value: \"rule:system_admin\""},{"line_number":3148,"context_line":"    barbican-project_quotas_put:"},{"line_number":3149,"context_line":"      key: \"project_quotas:put\""},{"line_number":3150,"context_line":"      value: \"rule:system_admin\""},{"line_number":3151,"context_line":"    barbican-project_quotas_delete:"},{"line_number":3152,"context_line":"      key: \"project_quotas:delete\""},{"line_number":3153,"context_line":"      value: \"rule:system_admin\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"f0d243e0_faae28d0","line":3150,"range":{"start_line":3150,"start_character":19,"end_line":3150,"end_character":31},"in_reply_to":"536b86ab_55566ab1","updated":"2021-11-01 22:42:21.000000000","message":"Done","commit_id":"a98b73ad854106cb861a4c4985facb2ed3e2a97a"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"287f17630ace2e8db99311c82c8518ee4ba1ce3a","unresolved":true,"context_lines":[{"line_number":3150,"context_line":"      value: \"rule:system_admin\""},{"line_number":3151,"context_line":"    barbican-project_quotas_delete:"},{"line_number":3152,"context_line":"      key: \"project_quotas:delete\""},{"line_number":3153,"context_line":"      value: \"rule:system_admin\""},{"line_number":3154,"context_line":"    barbican-secret_meta_get:"},{"line_number":3155,"context_line":"      key: \"secret_meta:get\""},{"line_number":3156,"context_line":"      value: \"rule:secret_project_member and (rule:secret_owner or rule:secret_is_not_private_read) or rule:secret_acl_read or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"34a24448_fb936f10","line":3153,"range":{"start_line":3153,"start_character":19,"end_line":3153,"end_character":31},"updated":"2021-11-01 19:20:28.000000000","message":"s/system_admin/admin/","commit_id":"a98b73ad854106cb861a4c4985facb2ed3e2a97a"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"f3388060747c8a58f14a73794d6abafda1010921","unresolved":false,"context_lines":[{"line_number":3150,"context_line":"      value: \"rule:system_admin\""},{"line_number":3151,"context_line":"    barbican-project_quotas_delete:"},{"line_number":3152,"context_line":"      key: \"project_quotas:delete\""},{"line_number":3153,"context_line":"      value: \"rule:system_admin\""},{"line_number":3154,"context_line":"    barbican-secret_meta_get:"},{"line_number":3155,"context_line":"      key: \"secret_meta:get\""},{"line_number":3156,"context_line":"      value: \"rule:secret_project_member and (rule:secret_owner or rule:secret_is_not_private_read) or rule:secret_acl_read or rule:secret_project_admin\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"66e8ead4_075da2b3","line":3153,"range":{"start_line":3153,"start_character":19,"end_line":3153,"end_character":31},"in_reply_to":"34a24448_fb936f10","updated":"2021-11-01 22:42:21.000000000","message":"Done","commit_id":"a98b73ad854106cb861a4c4985facb2ed3e2a97a"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"287f17630ace2e8db99311c82c8518ee4ba1ce3a","unresolved":true,"context_lines":[{"line_number":3204,"context_line":"      value: \"rule:reader\""},{"line_number":3205,"context_line":"    barbican-transport_key_delete:"},{"line_number":3206,"context_line":"      key: \"transport_key:delete\""},{"line_number":3207,"context_line":"      value: \"rule:system_admin\""},{"line_number":3208,"context_line":"    barbican-transport_keys_get:"},{"line_number":3209,"context_line":"      key: \"transport_keys:get\""},{"line_number":3210,"context_line":"      value: \"rule:reader\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"e3416f2b_d05601e1","line":3207,"range":{"start_line":3207,"start_character":19,"end_line":3207,"end_character":31},"updated":"2021-11-01 19:20:28.000000000","message":"s/system_admin/admin/","commit_id":"a98b73ad854106cb861a4c4985facb2ed3e2a97a"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"f3388060747c8a58f14a73794d6abafda1010921","unresolved":false,"context_lines":[{"line_number":3204,"context_line":"      value: \"rule:reader\""},{"line_number":3205,"context_line":"    barbican-transport_key_delete:"},{"line_number":3206,"context_line":"      key: \"transport_key:delete\""},{"line_number":3207,"context_line":"      value: \"rule:system_admin\""},{"line_number":3208,"context_line":"    barbican-transport_keys_get:"},{"line_number":3209,"context_line":"      key: \"transport_keys:get\""},{"line_number":3210,"context_line":"      value: \"rule:reader\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"4a40b5a6_33f949e0","line":3207,"range":{"start_line":3207,"start_character":19,"end_line":3207,"end_character":31},"in_reply_to":"e3416f2b_d05601e1","updated":"2021-11-01 22:42:21.000000000","message":"Done","commit_id":"a98b73ad854106cb861a4c4985facb2ed3e2a97a"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"287f17630ace2e8db99311c82c8518ee4ba1ce3a","unresolved":true,"context_lines":[{"line_number":3210,"context_line":"      value: \"rule:reader\""},{"line_number":3211,"context_line":"    barbican-transport_keys_post:"},{"line_number":3212,"context_line":"      key: \"transport_keys:post\""},{"line_number":3213,"context_line":"      value: \"rule:system_admin\""},{"line_number":3214,"context_line":"  ManilaApiPolicies:"},{"line_number":3215,"context_line":"    manila-system-admin:"},{"line_number":3216,"context_line":"      key: \"system-admin\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"e247be63_3fc09f7c","line":3213,"range":{"start_line":3213,"start_character":19,"end_line":3213,"end_character":31},"updated":"2021-11-01 19:20:28.000000000","message":"s/system_admin/admin/","commit_id":"a98b73ad854106cb861a4c4985facb2ed3e2a97a"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"f3388060747c8a58f14a73794d6abafda1010921","unresolved":false,"context_lines":[{"line_number":3210,"context_line":"      value: \"rule:reader\""},{"line_number":3211,"context_line":"    barbican-transport_keys_post:"},{"line_number":3212,"context_line":"      key: \"transport_keys:post\""},{"line_number":3213,"context_line":"      value: \"rule:system_admin\""},{"line_number":3214,"context_line":"  ManilaApiPolicies:"},{"line_number":3215,"context_line":"    manila-system-admin:"},{"line_number":3216,"context_line":"      key: \"system-admin\""}],"source_content_type":"text/x-yaml","patch_set":4,"id":"0471a4f9_0c947c16","line":3213,"range":{"start_line":3213,"start_character":19,"end_line":3213,"end_character":31},"in_reply_to":"e247be63_3fc09f7c","updated":"2021-11-01 22:42:21.000000000","message":"Done","commit_id":"a98b73ad854106cb861a4c4985facb2ed3e2a97a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4c1157babbcaa8e70af2ef0d1f5edc75a1b5a575","unresolved":true,"context_lines":[{"line_number":3057,"context_line":"      value: \"rule:admin or rule:observer or rule:creator\""},{"line_number":3058,"context_line":"    barbican-all_users:"},{"line_number":3059,"context_line":"      key: \"all_users\""},{"line_number":3060,"context_line":"      value: \"rule:admin or rule:observer or rule:creator or rule:audit or rule:service_admin\""},{"line_number":3061,"context_line":"    barbican-secret_project_match:"},{"line_number":3062,"context_line":"      key: \"secret_project_match\""},{"line_number":3063,"context_line":"      value: \"project_id:%(target.secret.project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"bb959be8_9312265e","side":"PARENT","line":3060,"updated":"2021-11-04 13:32:42.000000000","message":"Just to clarify here, we\u0027re removing these because we\u0027re not overriding them, so we\u0027re just letting the defaults in code come though.","commit_id":"2e0bfcfc245c6f7d4a77889400883cf96dd18dde"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"d1d2a56cab1e589494bcb10d763c63df76d7c88b","unresolved":true,"context_lines":[{"line_number":3057,"context_line":"      value: \"rule:admin or rule:observer or rule:creator\""},{"line_number":3058,"context_line":"    barbican-all_users:"},{"line_number":3059,"context_line":"      key: \"all_users\""},{"line_number":3060,"context_line":"      value: \"rule:admin or rule:observer or rule:creator or rule:audit or rule:service_admin\""},{"line_number":3061,"context_line":"    barbican-secret_project_match:"},{"line_number":3062,"context_line":"      key: \"secret_project_match\""},{"line_number":3063,"context_line":"      value: \"project_id:%(target.secret.project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"cbbc78b2_b2557561","side":"PARENT","line":3060,"in_reply_to":"bb959be8_9312265e","updated":"2021-11-11 17:23:45.000000000","message":"Right.  In code, all of these base rules will still be defined.  However, they won\u0027t be used because they\u0027re not used in the policies that we are overriding.","commit_id":"2e0bfcfc245c6f7d4a77889400883cf96dd18dde"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"90382296205ad6225a9b01a36307aa9908a53aae","unresolved":false,"context_lines":[{"line_number":3057,"context_line":"      value: \"rule:admin or rule:observer or rule:creator\""},{"line_number":3058,"context_line":"    barbican-all_users:"},{"line_number":3059,"context_line":"      key: \"all_users\""},{"line_number":3060,"context_line":"      value: \"rule:admin or rule:observer or rule:creator or rule:audit or rule:service_admin\""},{"line_number":3061,"context_line":"    barbican-secret_project_match:"},{"line_number":3062,"context_line":"      key: \"secret_project_match\""},{"line_number":3063,"context_line":"      value: \"project_id:%(target.secret.project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"cb5fde09_a92144fb","side":"PARENT","line":3060,"in_reply_to":"cbbc78b2_b2557561","updated":"2021-11-11 17:48:07.000000000","message":"Ack","commit_id":"2e0bfcfc245c6f7d4a77889400883cf96dd18dde"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4c1157babbcaa8e70af2ef0d1f5edc75a1b5a575","unresolved":true,"context_lines":[{"line_number":3051,"context_line":"      value: \"\u0027read\u0027:%(target.secret.read)s\""},{"line_number":3052,"context_line":"    barbican-secret_is_not_private_read:"},{"line_number":3053,"context_line":"      key: \"secret_is_not_private_read\""},{"line_number":3054,"context_line":"      value: \"\u0027True\u0027:%(target.secret.read_project_access)s\""},{"line_number":3055,"context_line":"    barbican-container_owner:"},{"line_number":3056,"context_line":"      key: \"container_owner\""},{"line_number":3057,"context_line":"      value: \"user_id:%(target.container.creator_id)s\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"cdae1d9b_77be3499","line":3054,"updated":"2021-11-04 13:32:42.000000000","message":"Does this also need to check for tenancy? What would happen if someone in project foo created a secret with read_project_access True and I used a token scoped to project bar to access that secret?\n\nIt looks like this check just ensures the read_project_access attribute is True, but it doesn\u0027t ensure I\u0027m actually a member of the project.","commit_id":"839ddccdbd43b5eb41441c75a953647995f89959"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"90382296205ad6225a9b01a36307aa9908a53aae","unresolved":false,"context_lines":[{"line_number":3051,"context_line":"      value: \"\u0027read\u0027:%(target.secret.read)s\""},{"line_number":3052,"context_line":"    barbican-secret_is_not_private_read:"},{"line_number":3053,"context_line":"      key: \"secret_is_not_private_read\""},{"line_number":3054,"context_line":"      value: \"\u0027True\u0027:%(target.secret.read_project_access)s\""},{"line_number":3055,"context_line":"    barbican-container_owner:"},{"line_number":3056,"context_line":"      key: \"container_owner\""},{"line_number":3057,"context_line":"      value: \"user_id:%(target.container.creator_id)s\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"e5071f37_993481f1","line":3054,"in_reply_to":"bc8a9c88_d3ee5e76","updated":"2021-11-11 17:48:07.000000000","message":"Ack","commit_id":"839ddccdbd43b5eb41441c75a953647995f89959"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"d1d2a56cab1e589494bcb10d763c63df76d7c88b","unresolved":true,"context_lines":[{"line_number":3051,"context_line":"      value: \"\u0027read\u0027:%(target.secret.read)s\""},{"line_number":3052,"context_line":"    barbican-secret_is_not_private_read:"},{"line_number":3053,"context_line":"      key: \"secret_is_not_private_read\""},{"line_number":3054,"context_line":"      value: \"\u0027True\u0027:%(target.secret.read_project_access)s\""},{"line_number":3055,"context_line":"    barbican-container_owner:"},{"line_number":3056,"context_line":"      key: \"container_owner\""},{"line_number":3057,"context_line":"      value: \"user_id:%(target.container.creator_id)s\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"bc8a9c88_d3ee5e76","line":3054,"in_reply_to":"cdae1d9b_77be3499","updated":"2021-11-11 17:23:45.000000000","message":"This check is a base rule and it\u0027s meant to be used with other rules that check tenancy.  e.g.\n\n    rule:secret_project_member and rule:secret_is_not_private_read\n\nThis rule is not used by itself.","commit_id":"839ddccdbd43b5eb41441c75a953647995f89959"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4c1157babbcaa8e70af2ef0d1f5edc75a1b5a575","unresolved":true,"context_lines":[{"line_number":3060,"context_line":"      value: \"\u0027read\u0027:%(target.container.read)s\""},{"line_number":3061,"context_line":"    barbican-container_is_not_private_read:"},{"line_number":3062,"context_line":"      key: \"container_is_not_private_read\""},{"line_number":3063,"context_line":"      value: \"\u0027True\u0027:%(target.container.read_project_access)s\""},{"line_number":3064,"context_line":"    barbican-secret_project_admin:"},{"line_number":3065,"context_line":"      key: \"secret_project_admin\""},{"line_number":3066,"context_line":"      value: \"rule:admin and project_id:%(target.secret.project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"9ed5bdac_a61cb173","line":3063,"updated":"2021-11-04 13:32:42.000000000","message":"Similar comment as below.\n\nnit:\n\nDoes is_not_private only mean that the container is supposed to be viewable to other people in the project? Not other people in the deployment, right? Because by default containers/secrets are filtered based on users who created them I think?\n\nIf so, I wonder if something like:\n\n  barbican-container-project-visible:\n    key: \"container_project_visible\"\n    value: \"...\"\n\nwould make that more clear?","commit_id":"839ddccdbd43b5eb41441c75a953647995f89959"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"d1d2a56cab1e589494bcb10d763c63df76d7c88b","unresolved":true,"context_lines":[{"line_number":3060,"context_line":"      value: \"\u0027read\u0027:%(target.container.read)s\""},{"line_number":3061,"context_line":"    barbican-container_is_not_private_read:"},{"line_number":3062,"context_line":"      key: \"container_is_not_private_read\""},{"line_number":3063,"context_line":"      value: \"\u0027True\u0027:%(target.container.read_project_access)s\""},{"line_number":3064,"context_line":"    barbican-secret_project_admin:"},{"line_number":3065,"context_line":"      key: \"secret_project_admin\""},{"line_number":3066,"context_line":"      value: \"rule:admin and project_id:%(target.secret.project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"ffb589d9_830672e7","line":3063,"in_reply_to":"9ed5bdac_a61cb173","updated":"2021-11-11 17:23:45.000000000","message":"I chose to use the negative definition for this specific rule (not_private vs visible) becuase it makes the compounded rules a little easier to read.  e.g.  I think this:\n\n    \"rule:container_project_member and (rule:container_owner or rule:container_is_not_private_read) or rule:container_acl_read or rule:container_project_admin\"\n\nis easier to read than:\n\n    \"rule:container_project_member and (rule:container_owner or not rule:container_project_visible) or rule:container_acl_read or rule:container_project_admin\"\n\nI\u0027m not opposed to changing it if you think the second way is better in a complex rule like that.  (I was also unsure if you can use \"not\" in a policy rule)","commit_id":"839ddccdbd43b5eb41441c75a953647995f89959"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"90382296205ad6225a9b01a36307aa9908a53aae","unresolved":false,"context_lines":[{"line_number":3060,"context_line":"      value: \"\u0027read\u0027:%(target.container.read)s\""},{"line_number":3061,"context_line":"    barbican-container_is_not_private_read:"},{"line_number":3062,"context_line":"      key: \"container_is_not_private_read\""},{"line_number":3063,"context_line":"      value: \"\u0027True\u0027:%(target.container.read_project_access)s\""},{"line_number":3064,"context_line":"    barbican-secret_project_admin:"},{"line_number":3065,"context_line":"      key: \"secret_project_admin\""},{"line_number":3066,"context_line":"      value: \"rule:admin and project_id:%(target.secret.project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"cd432d22_17d1927e","line":3063,"in_reply_to":"ffb589d9_830672e7","updated":"2021-11-11 17:48:07.000000000","message":"Ack","commit_id":"839ddccdbd43b5eb41441c75a953647995f89959"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4c1157babbcaa8e70af2ef0d1f5edc75a1b5a575","unresolved":true,"context_lines":[{"line_number":3063,"context_line":"      value: \"\u0027True\u0027:%(target.container.read_project_access)s\""},{"line_number":3064,"context_line":"    barbican-secret_project_admin:"},{"line_number":3065,"context_line":"      key: \"secret_project_admin\""},{"line_number":3066,"context_line":"      value: \"rule:admin and project_id:%(target.secret.project_id)s\""},{"line_number":3067,"context_line":"    barbican-secret_project_member:"},{"line_number":3068,"context_line":"      key: \"secret_project_member\""},{"line_number":3069,"context_line":"      value: \"rule:member and project_id:%(target.secret.project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"3d7db38e_9e2d9155","line":3066,"updated":"2021-11-04 13:32:42.000000000","message":"This means someone with the admin role on a project will pass this check, which is probably fine given the rest of this environment file assumes project-admin\u0027s are operators of the deployment.\n\nBut, it will mean that operators need to have a token scoped to the secret\u0027s project they want to manage, as opposed to just having an token with the admin role scoped to any project, correct?","commit_id":"839ddccdbd43b5eb41441c75a953647995f89959"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"90382296205ad6225a9b01a36307aa9908a53aae","unresolved":false,"context_lines":[{"line_number":3063,"context_line":"      value: \"\u0027True\u0027:%(target.container.read_project_access)s\""},{"line_number":3064,"context_line":"    barbican-secret_project_admin:"},{"line_number":3065,"context_line":"      key: \"secret_project_admin\""},{"line_number":3066,"context_line":"      value: \"rule:admin and project_id:%(target.secret.project_id)s\""},{"line_number":3067,"context_line":"    barbican-secret_project_member:"},{"line_number":3068,"context_line":"      key: \"secret_project_member\""},{"line_number":3069,"context_line":"      value: \"rule:member and project_id:%(target.secret.project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"cc3f16e1_3f0482f3","line":3066,"in_reply_to":"04b122cb_cb3313b9","updated":"2021-11-11 17:48:07.000000000","message":"Ack","commit_id":"839ddccdbd43b5eb41441c75a953647995f89959"},{"author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"change_message_id":"d1d2a56cab1e589494bcb10d763c63df76d7c88b","unresolved":true,"context_lines":[{"line_number":3063,"context_line":"      value: \"\u0027True\u0027:%(target.container.read_project_access)s\""},{"line_number":3064,"context_line":"    barbican-secret_project_admin:"},{"line_number":3065,"context_line":"      key: \"secret_project_admin\""},{"line_number":3066,"context_line":"      value: \"rule:admin and project_id:%(target.secret.project_id)s\""},{"line_number":3067,"context_line":"    barbican-secret_project_member:"},{"line_number":3068,"context_line":"      key: \"secret_project_member\""},{"line_number":3069,"context_line":"      value: \"rule:member and project_id:%(target.secret.project_id)s\""}],"source_content_type":"text/x-yaml","patch_set":5,"id":"04b122cb_cb3313b9","line":3066,"in_reply_to":"3d7db38e_9e2d9155","updated":"2021-11-11 17:23:45.000000000","message":"Yes, that\u0027s correct.  The operator\u0027s token will have to be scoped to the project that owns the secret, not just any project.","commit_id":"839ddccdbd43b5eb41441c75a953647995f89959"}]}