)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"ba231f50745ec194b52087751741cce8e72d235a","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"08e76027_168064da","updated":"2021-12-09 22:28:27.000000000","message":"I started looking at this out of curiosity and couldn\u0027t stop ... I have only superficial knowledge of the secure RBAC stuff compared to everyone else but AFAICT and FWIW, this looks correct to me.","commit_id":"374b8b832b12b5691c31ccf8d4804e99b2283956"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"633f49b102f94aa37edbb73d2112e4a4c51c92c5","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"980ae5ea_e49fbd6e","updated":"2021-11-19 20:44:26.000000000","message":"Marking this as WIP until we verify the policies introduces here are consistent with the policies in the service on stable/wallaby.\n\nOnce that\u0027s acknowledge, or +1\u0027d, from the service I\u0027ll remove the WIP.","commit_id":"374b8b832b12b5691c31ccf8d4804e99b2283956"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"ea2f1b987c9d7f3b1fb8917869db9e253e64e0cf","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"02d83a5f_d2c84e2a","updated":"2021-12-08 17:38:12.000000000","message":"hi i wont get to this today but ill try and get back to this before the end of the week.\nsorry for the delay in reviewing this but its on my radar to do tomorrow","commit_id":"374b8b832b12b5691c31ccf8d4804e99b2283956"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"4c1add51fd14f139cc1b0660c481c881311a5332","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"7b64b97f_4a47e203","updated":"2021-12-16 17:43:49.000000000","message":"ok that took longer then i planed to actully compare ll of the the polciies but they all look correct to me","commit_id":"374b8b832b12b5691c31ccf8d4804e99b2283956"}],"environments/enable-secure-rbac.yaml":[{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"4c1add51fd14f139cc1b0660c481c881311a5332","unresolved":true,"context_lines":[{"line_number":34,"context_line":"    nova-system_or_project_reader:"},{"line_number":35,"context_line":"      key: \"system_or_project_reader\""},{"line_number":36,"context_line":"      value: \"rule:system_reader_api or rule:project_reader_api\""},{"line_number":37,"context_line":"    nova-os_compute_api_os-admin-actions_reset_state:"},{"line_number":38,"context_line":"      key: \"os_compute_api:os-admin-actions:reset_state\""},{"line_number":39,"context_line":"      value: \"rule:admin_api\""},{"line_number":40,"context_line":"    nova-os_compute_api_os-admin-actions_inject_network_info:"},{"line_number":41,"context_line":"      key: \"os_compute_api:os-admin-actions:inject_network_info\""},{"line_number":42,"context_line":"      value: \"rule:admin_api\""},{"line_number":43,"context_line":"    nova-os_compute_api_os-admin-password:"},{"line_number":44,"context_line":"      key: \"os_compute_api:os-admin-password\""},{"line_number":45,"context_line":"      value: \"rule:admin_api or rule:project_member_api\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"fff8edeb_7b28616a","line":42,"range":{"start_line":37,"start_character":3,"end_line":42,"end_character":29},"updated":"2021-12-16 17:43:49.000000000","message":"ack https://github.com/openstack/nova/blob/stable/wallaby/nova/policies/admin_actions.py these are correct","commit_id":"374b8b832b12b5691c31ccf8d4804e99b2283956"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"4c1add51fd14f139cc1b0660c481c881311a5332","unresolved":true,"context_lines":[{"line_number":42,"context_line":"      value: \"rule:admin_api\""},{"line_number":43,"context_line":"    nova-os_compute_api_os-admin-password:"},{"line_number":44,"context_line":"      key: \"os_compute_api:os-admin-password\""},{"line_number":45,"context_line":"      value: \"rule:admin_api or rule:project_member_api\""},{"line_number":46,"context_line":"    nova-os_compute_api_os-aggregates_set_metadata:"},{"line_number":47,"context_line":"      key: \"os_compute_api:os-aggregates:set_metadata\""},{"line_number":48,"context_line":"      value: \"rule:admin_api\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"d899c9c1_87a801ae","line":45,"updated":"2021-12-16 17:43:49.000000000","message":"yep admin or project member\nhttps://github.com/openstack/nova/blob/stable/wallaby/nova/policies/admin_password.py#L27","commit_id":"374b8b832b12b5691c31ccf8d4804e99b2283956"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"4c1add51fd14f139cc1b0660c481c881311a5332","unresolved":true,"context_lines":[{"line_number":43,"context_line":"    nova-os_compute_api_os-admin-password:"},{"line_number":44,"context_line":"      key: \"os_compute_api:os-admin-password\""},{"line_number":45,"context_line":"      value: \"rule:admin_api or rule:project_member_api\""},{"line_number":46,"context_line":"    nova-os_compute_api_os-aggregates_set_metadata:"},{"line_number":47,"context_line":"      key: \"os_compute_api:os-aggregates:set_metadata\""},{"line_number":48,"context_line":"      value: \"rule:admin_api\""},{"line_number":49,"context_line":"    nova-os_compute_api_os-aggregates_add_host:"},{"line_number":50,"context_line":"      key: \"os_compute_api:os-aggregates:add_host\""},{"line_number":51,"context_line":"      value: \"rule:admin_api\""},{"line_number":52,"context_line":"    nova-os_compute_api_os-aggregates_create:"},{"line_number":53,"context_line":"      key: \"os_compute_api:os-aggregates:create\""},{"line_number":54,"context_line":"      value: \"rule:admin_api\""},{"line_number":55,"context_line":"    nova-os_compute_api_os-aggregates_remove_host:"},{"line_number":56,"context_line":"      key: \"os_compute_api:os-aggregates:remove_host\""},{"line_number":57,"context_line":"      value: \"rule:admin_api\""},{"line_number":58,"context_line":"    nova-os_compute_api_os-aggregates_update:"},{"line_number":59,"context_line":"      key: \"os_compute_api:os-aggregates:update\""},{"line_number":60,"context_line":"      value: \"rule:admin_api\""},{"line_number":61,"context_line":"    nova-os_compute_api_os-aggregates_index:"},{"line_number":62,"context_line":"      key: \"os_compute_api:os-aggregates:index\""},{"line_number":63,"context_line":"      value: \"rule:admin_api\""},{"line_number":64,"context_line":"    nova-os_compute_api_os-aggregates_delete:"},{"line_number":65,"context_line":"      key: \"os_compute_api:os-aggregates:delete\""},{"line_number":66,"context_line":"      value: \"rule:admin_api\""},{"line_number":67,"context_line":"    nova-os_compute_api_os-aggregates_show:"},{"line_number":68,"context_line":"      key: \"os_compute_api:os-aggregates:show\""},{"line_number":69,"context_line":"      value: \"rule:admin_api\""},{"line_number":70,"context_line":"    nova-compute_aggregates_images:"},{"line_number":71,"context_line":"      key: \"compute:aggregates:images\""},{"line_number":72,"context_line":"      value: \"rule:admin_api\""},{"line_number":73,"context_line":"    nova-os_compute_api_os-assisted-volume-snapshots_create:"},{"line_number":74,"context_line":"      key: \"os_compute_api:os-assisted-volume-snapshots:create\""},{"line_number":75,"context_line":"      value: \"rule:admin_api\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"73b0a60e_20990187","line":72,"range":{"start_line":46,"start_character":1,"end_line":72,"end_character":29},"updated":"2021-12-16 17:43:49.000000000","message":"yep these shoudl all be admin api \nhttps://github.com/openstack/nova/blob/stable/wallaby/nova/policies/aggregates.py#L25-L125","commit_id":"374b8b832b12b5691c31ccf8d4804e99b2283956"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"4c1add51fd14f139cc1b0660c481c881311a5332","unresolved":true,"context_lines":[{"line_number":70,"context_line":"    nova-compute_aggregates_images:"},{"line_number":71,"context_line":"      key: \"compute:aggregates:images\""},{"line_number":72,"context_line":"      value: \"rule:admin_api\""},{"line_number":73,"context_line":"    nova-os_compute_api_os-assisted-volume-snapshots_create:"},{"line_number":74,"context_line":"      key: \"os_compute_api:os-assisted-volume-snapshots:create\""},{"line_number":75,"context_line":"      value: \"rule:admin_api\""},{"line_number":76,"context_line":"    nova-os_compute_api_os-assisted-volume-snapshots_delete:"},{"line_number":77,"context_line":"      key: \"os_compute_api:os-assisted-volume-snapshots:delete\""},{"line_number":78,"context_line":"      value: \"rule:admin_api\""},{"line_number":79,"context_line":"    nova-os_compute_api_os-attach-interfaces_list:"},{"line_number":80,"context_line":"      key: \"os_compute_api:os-attach-interfaces:list\""},{"line_number":81,"context_line":"      value: \"rule:admin_api or rule:project_reader_api\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"8b0014b0_269972d9","line":78,"range":{"start_line":73,"start_character":3,"end_line":78,"end_character":29},"updated":"2021-12-16 17:43:49.000000000","message":"https://github.com/openstack/nova/blob/stable/wallaby/nova/policies/assisted_volume_snapshots.py\n\nthese are also correect","commit_id":"374b8b832b12b5691c31ccf8d4804e99b2283956"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"4c1add51fd14f139cc1b0660c481c881311a5332","unresolved":true,"context_lines":[{"line_number":78,"context_line":"      value: \"rule:admin_api\""},{"line_number":79,"context_line":"    nova-os_compute_api_os-attach-interfaces_list:"},{"line_number":80,"context_line":"      key: \"os_compute_api:os-attach-interfaces:list\""},{"line_number":81,"context_line":"      value: \"rule:admin_api or rule:project_reader_api\""},{"line_number":82,"context_line":"    nova-os_compute_api_os-attach-interfaces:"},{"line_number":83,"context_line":"      key: \"os_compute_api:os-attach-interfaces\""},{"line_number":84,"context_line":"      value: \"rule:os_compute_api:os-attach-interfaces:list\""},{"line_number":85,"context_line":"    nova-os_compute_api_os-attach-interfaces_show:"},{"line_number":86,"context_line":"      key: \"os_compute_api:os-attach-interfaces:show\""},{"line_number":87,"context_line":"      value: \"rule:admin_api or rule:project_reader_api\""},{"line_number":88,"context_line":"    nova-os_compute_api_os-attach-interfaces_create:"},{"line_number":89,"context_line":"      key: \"os_compute_api:os-attach-interfaces:create\""},{"line_number":90,"context_line":"      value: \"rule:admin_api or rule:project_member_api\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"13311da2_c6a88d0d","line":87,"range":{"start_line":81,"start_character":0,"end_line":87,"end_character":56},"updated":"2021-12-16 17:43:49.000000000","message":"yep admin or reader \nhttps://github.com/openstack/nova/blob/stable/wallaby/nova/policies/attach_interfaces.py#L37-L51","commit_id":"374b8b832b12b5691c31ccf8d4804e99b2283956"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"4c1add51fd14f139cc1b0660c481c881311a5332","unresolved":true,"context_lines":[{"line_number":87,"context_line":"      value: \"rule:admin_api or rule:project_reader_api\""},{"line_number":88,"context_line":"    nova-os_compute_api_os-attach-interfaces_create:"},{"line_number":89,"context_line":"      key: \"os_compute_api:os-attach-interfaces:create\""},{"line_number":90,"context_line":"      value: \"rule:admin_api or rule:project_member_api\""},{"line_number":91,"context_line":"    nova-os_compute_api_os-attach-interfaces_delete:"},{"line_number":92,"context_line":"      key: \"os_compute_api:os-attach-interfaces:delete\""},{"line_number":93,"context_line":"      value: \"rule:admin_api or rule:project_member_api\""},{"line_number":94,"context_line":"    nova-os_compute_api_os-availability-zone_list:"},{"line_number":95,"context_line":"      key: \"os_compute_api:os-availability-zone:list\""},{"line_number":96,"context_line":"      value: \"@\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"a6cea715_d9823e08","line":93,"range":{"start_line":90,"start_character":0,"end_line":93,"end_character":56},"updated":"2021-12-16 17:43:49.000000000","message":"and these shoudl be admin or member \nhttps://github.com/openstack/nova/blob/stable/wallaby/nova/policies/attach_interfaces.py#L65-L79\n\n+1","commit_id":"374b8b832b12b5691c31ccf8d4804e99b2283956"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"4c1add51fd14f139cc1b0660c481c881311a5332","unresolved":true,"context_lines":[{"line_number":93,"context_line":"      value: \"rule:admin_api or rule:project_member_api\""},{"line_number":94,"context_line":"    nova-os_compute_api_os-availability-zone_list:"},{"line_number":95,"context_line":"      key: \"os_compute_api:os-availability-zone:list\""},{"line_number":96,"context_line":"      value: \"@\""},{"line_number":97,"context_line":"    nova-os_compute_api_os-availability-zone_detail:"},{"line_number":98,"context_line":"      key: \"os_compute_api:os-availability-zone:detail\""},{"line_number":99,"context_line":"      value: \"rule:admin_api\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"f9c7e0d5_f0721f79","line":96,"range":{"start_line":96,"start_character":3,"end_line":96,"end_character":16},"updated":"2021-12-16 17:43:49.000000000","message":"yep so list is avaiabel to everyone \nhttps://github.com/openstack/nova/blob/stable/wallaby/nova/policies/availability_zone.py#L27","commit_id":"374b8b832b12b5691c31ccf8d4804e99b2283956"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"4c1add51fd14f139cc1b0660c481c881311a5332","unresolved":true,"context_lines":[{"line_number":96,"context_line":"      value: \"@\""},{"line_number":97,"context_line":"    nova-os_compute_api_os-availability-zone_detail:"},{"line_number":98,"context_line":"      key: \"os_compute_api:os-availability-zone:detail\""},{"line_number":99,"context_line":"      value: \"rule:admin_api\""},{"line_number":100,"context_line":"    nova-os_compute_api_os-baremetal-nodes_list:"},{"line_number":101,"context_line":"      key: \"os_compute_api:os-baremetal-nodes:list\""},{"line_number":102,"context_line":"      value: \"rule:admin_api\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"4ddebc1a_e93ce5d0","line":99,"range":{"start_line":99,"start_character":3,"end_line":99,"end_character":29},"updated":"2021-12-16 17:43:49.000000000","message":"but the deatil api was system reader so it shoudl be admin api +1\nhttps://github.com/openstack/nova/blob/stable/wallaby/nova/policies/availability_zone.py#L39","commit_id":"374b8b832b12b5691c31ccf8d4804e99b2283956"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"4c1add51fd14f139cc1b0660c481c881311a5332","unresolved":true,"context_lines":[{"line_number":97,"context_line":"    nova-os_compute_api_os-availability-zone_detail:"},{"line_number":98,"context_line":"      key: \"os_compute_api:os-availability-zone:detail\""},{"line_number":99,"context_line":"      value: \"rule:admin_api\""},{"line_number":100,"context_line":"    nova-os_compute_api_os-baremetal-nodes_list:"},{"line_number":101,"context_line":"      key: \"os_compute_api:os-baremetal-nodes:list\""},{"line_number":102,"context_line":"      value: \"rule:admin_api\""},{"line_number":103,"context_line":"    nova-os_compute_api_os-baremetal-nodes:"},{"line_number":104,"context_line":"      key: \"os_compute_api:os-baremetal-nodes\""},{"line_number":105,"context_line":"      value: \"rule:os_compute_api:os-baremetal-nodes:list\""},{"line_number":106,"context_line":"    nova-os_compute_api_os-baremetal-nodes_show:"},{"line_number":107,"context_line":"      key: \"os_compute_api:os-baremetal-nodes:show\""},{"line_number":108,"context_line":"      value: \"rule:admin_api\""},{"line_number":109,"context_line":"    nova-os_compute_api_os-console-auth-tokens:"},{"line_number":110,"context_line":"      key: \"os_compute_api:os-console-auth-tokens\""},{"line_number":111,"context_line":"      value: \"rule:admin_api\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"e1e6477c_55ded571","line":108,"range":{"start_line":100,"start_character":1,"end_line":108,"end_character":29},"updated":"2021-12-16 17:43:49.000000000","message":"these are also correct\nhttps://github.com/openstack/nova/blob/stable/wallaby/nova/policies/baremetal_nodes.py#L39-L56\n\ninstead of linking each of the relevent policy files im going to continue to review them but ill only leave a comment if there is a mistake of i have somethihg else to say.","commit_id":"374b8b832b12b5691c31ccf8d4804e99b2283956"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"4c1add51fd14f139cc1b0660c481c881311a5332","unresolved":true,"context_lines":[{"line_number":130,"context_line":"    nova-os_compute_api_os-extended-server-attributes:"},{"line_number":131,"context_line":"      key: \"os_compute_api:os-extended-server-attributes\""},{"line_number":132,"context_line":"      value: \"rule:admin_api\""},{"line_number":133,"context_line":"    nova-os_compute_api_extensions:"},{"line_number":134,"context_line":"      key: \"os_compute_api:extensions\""},{"line_number":135,"context_line":"      value: \"@\""},{"line_number":136,"context_line":"    nova-os_compute_api_os-flavor-access_add_tenant_access:"},{"line_number":137,"context_line":"      key: \"os_compute_api:os-flavor-access:add_tenant_access\""},{"line_number":138,"context_line":"      value: \"rule:admin_api\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"6feef8a1_a1600129","line":135,"range":{"start_line":133,"start_character":3,"end_line":135,"end_character":16},"updated":"2021-12-16 17:43:49.000000000","message":"given we dont supprot api extenions any more \nwe proably can remove this upstream\n\nin anycase this is correct\n\nhttps://github.com/openstack/nova/blob/stable/wallaby/nova/policies/extensions.py","commit_id":"374b8b832b12b5691c31ccf8d4804e99b2283956"}]}