<html><body><p>Whether or not a restart is required is actually handled by oslo.policy. Which is only included in Kilo and newer versions of Keystone. The work to avoid restarting the service went in in commit [0] and was further worked on in [1].<br><br>Juno and older versions are using the oslo-incubator code to handle policy (before it was turned into it's own library), and AFAICT don't have the check to see if policy.json has been modified.<br><br>[0] <a href="https://github.com/openstack/oslo.policy/commit/63d699aff89969fdfc584ce875a23ba0a90e5b51">https://github.com/openstack/oslo.policy/commit/63d699aff89969fdfc584ce875a23ba0a90e5b51</a><br>[1] <a href="https://github.com/openstack/oslo.policy/commit/b5f07dfe4cd4a5d12c7fecbc3954694d934de642">https://github.com/openstack/oslo.policy/commit/b5f07dfe4cd4a5d12c7fecbc3954694d934de642</a><br><br>Thanks,<br><br>Steve Martinelli<br>OpenStack Keystone Project Team Lead<br><br><img width="16" height="16" src="cid:1__=8FBBF585DFE9A70D8f9e8a93df938690918c8FB@" border="0" alt="Inactive hide details for Timothy Symanczyk ---2015/12/09 04:40:10 PM---We are running keystone kilo in production, and Iım act"><font color="#424282">Timothy Symanczyk ---2015/12/09 04:40:10 PM---We are running keystone kilo in production, and Iım actively implementing RBAC right now. Iım certai</font><br><br><font size="2" color="#5F5F5F">From: </font><font size="2">Timothy Symanczyk <Timothy_Symanczyk@symantec.com></font><br><font size="2" color="#5F5F5F">To: </font><font size="2">"OpenStack Development Mailing List (not for usage questions)" <openstack-dev@lists.openstack.org>, "Kris G. Lindgren" <klindgren@godaddy.com>, Oguz Yarimtepe <oguzyarimtepe@gmail.com>, "openstack-operators@lists.openstack.org" <openstack-operators@lists.openstack.org></font><br><font size="2" color="#5F5F5F">Date: </font><font size="2">2015/12/09 04:40 PM</font><br><font size="2" color="#5F5F5F">Subject: </font><font size="2">Re: [openstack-dev] [Openstack-operators] [keystone] RBAC usage at production</font><br><hr width="100%" size="2" align="left" noshade style="color:#8091A5; "><br><br><br><tt>We are running keystone kilo in production, and Iım actively implementing<br>RBAC right now. Iım certain that, at least with the version of keystone<br>weıre running, a restart is NOT required when the policy file is modified.<br><br>Tim<br><br><br><br><br>On 12/9/15, 9:18 AM, "Edgar Magana" <edgar.magana@workday.com> wrote:<br><br>>We use RBAC in production but basically modify networking operations and<br>>some compute ones. In our case we donıt need to restart the services if<br>>we modify the policy.json file. I am surprise that keystone is not<br>>following the same process.<br>><br>>Edgar<br>><br>><br>><br>><br>>On 12/9/15, 9:06 AM, "Kris G. Lindgren" <klindgren@godaddy.com> wrote:<br>><br>>>In other projects the policy.json file is read each time of api request.<br>>> So changes to the file take place immediately. I was 90% sure keystone<br>>>was the same way?<br>>><br>>>___________________________________________________________________<br>>>Kris Lindgren<br>>>Senior Linux Systems Engineer<br>>>GoDaddy<br>>><br>>><br>>><br>>><br>>><br>>><br>>><br>>>On 12/9/15, 1:39 AM, "Oguz Yarimtepe" <oguzyarimtepe@gmail.com> wrote:<br>>><br>>>>Hi,<br>>>><br>>>>I am wondering whether there are people using RBAC at production. The<br>>>>policy.json file has a structure that requires restart of the service<br>>>>each time you edit the file. Is there and on the fly solution or tips<br>>>>about it?<br>>>><br>>>><br>>>><br>>>>_______________________________________________<br>>>>OpenStack-operators mailing list<br>>>>OpenStack-operators@lists.openstack.org<br>>>></tt><tt><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a></tt><tt><br>>>_______________________________________________<br>>>OpenStack-operators mailing list<br>>>OpenStack-operators@lists.openstack.org<br>>></tt><tt><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a></tt><tt><br>>__________________________________________________________________________<br>>OpenStack Development Mailing List (not for usage questions)<br>>Unsubscribe: OpenStack-dev-request@lists.openstack.org?subject:unsubscribe<br>></tt><tt><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a></tt><tt><br><br><br>__________________________________________________________________________<br>OpenStack Development Mailing List (not for usage questions)<br>Unsubscribe: OpenStack-dev-request@lists.openstack.org?subject:unsubscribe<br></tt><tt><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a></tt><tt><br><br></tt><br><br><BR>
</body></html>