<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Apple Color Emoji";
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Awesome! Thanks for the clarification! I was ready to have a heart attack!
</span><span style="font-size:11.0pt;font-family:"Apple Color Emoji"">☺</span><span style="font-size:11.0pt;font-family:Calibri"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Edgar<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-family:Calibri;color:black">From: </span>
</b><span style="font-family:Calibri;color:black"><medberry@gmail.com> on behalf of David Medberry <openstack@medberry.net><br>
<b>Date: </b>Thursday, February 23, 2017 at 12:17 PM<br>
<b>To: </b>"Logan V." <logan@protiumit.com><br>
<b>Cc: </b>Edgar Magana <edgar.magana@workday.com>, "openstack-operators@lists.openstack.org" <openstack-operators@lists.openstack.org><br>
<b>Subject: </b>Re: [Openstack-operators] Policy Updates<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Yep what Logan said. I'm pretty sure Sean Dague talked about this at the last Operator's mid-cycle. The "blank" policy.json just means you get the default policies. You set a value to override the defaults.
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I don't see it in the Ocata relnotes but git indicates this is where it happened:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_openstack_nova_blob_stable_mitaka_etc_nova_policy.json&d=DwMFaQ&c=DS6PUFBBr_KiLo7Sjt3ljp5jaW5k2i9ijVXllEdOozc&r=G0XRJfDQsuBvqa_wpWyDAUlSpeMV4W1qfWqBfctlWwQ&m=R2WX6zRqpVyBw2fVL01fmsbTX6XicRJiKW1LNyOcR_k&s=QuBKr7RZpB9lzLV9mMm0Y1NKDL2eP6R04O-UVXklNHU&e=">https://github.com/openstack/nova/blob/stable/mitaka/etc/nova/policy.json</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_openstack_nova_blob_stable_newton_etc_nova_policy.json&d=DwMFaQ&c=DS6PUFBBr_KiLo7Sjt3ljp5jaW5k2i9ijVXllEdOozc&r=G0XRJfDQsuBvqa_wpWyDAUlSpeMV4W1qfWqBfctlWwQ&m=R2WX6zRqpVyBw2fVL01fmsbTX6XicRJiKW1LNyOcR_k&s=HeP7-DU9WTao6BEtltycCJCRlk9H9FxayAU7jBF72LY&e=">https://github.com/openstack/nova/blob/stable/newton/etc/nova/policy.json</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">again, no change in behavior...<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Thu, Feb 23, 2017 at 3:06 PM, Logan V. <<a href="mailto:logan@protiumit.com" target="_blank">logan@protiumit.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">I think this actually started in Newton. Yes it ships blank, however<br>
there is still a default policy implemented as before with similar<br>
defaults separating the admin and user roles. The default policy is<br>
implemented in the nova code base<br>
(<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_openstack_nova_tree_stable_newton_nova_policies&d=DwMFaQ&c=DS6PUFBBr_KiLo7Sjt3ljp5jaW5k2i9ijVXllEdOozc&r=G0XRJfDQsuBvqa_wpWyDAUlSpeMV4W1qfWqBfctlWwQ&m=R2WX6zRqpVyBw2fVL01fmsbTX6XicRJiKW1LNyOcR_k&s=ra1H4GXwVQfIRH_hhSXlN-ymdb3ZEksRoBb7UNTz9mE&e=" target="_blank">https://github.com/openstack/nova/tree/stable/newton/nova/policies</a>)<br>
and overrides can be provided using policy.json (which also accepts<br>
yaml despite what the file extension would lead you to believe). The<br>
difference now is that the default policy is not enumerated in a<br>
policy.json file by default. You can obtain the default policy by<br>
running<br>
oslopolicy-sample-generator --namespace nova<br>
<br>
There are also several other oslopolicy-* tools like<br>
oslopolicy-list-redundant - can be used to list policies defined in<br>
the policy.json which are redundant to the default policy<br>
oslopolicy-checker -test access against a specific policy item<br>
oslopolicy-policy-generator - dump a consolidated view of the policy<br>
(ie defaults combined with overrides) for use with ie. horizon's<br>
policy things. One thing I found with exporting this dump from nova<br>
and using it in horizon is that you must define a policy called<br>
"default" (usually set to "rule:admin_or_owner") because it is not<br>
included in the dump and it seemed to cause some odd behavior in<br>
horizon like the instances tab not showing up under the admin panel.<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><br>
<br>
On Thu, Feb 23, 2017 at 1:52 PM, Edgar Magana <<a href="mailto:edgar.magana@workday.com">edgar.magana@workday.com</a>> wrote:<br>
> Am I understanding correctly that in Ocata release, the policy.json file for<br>
> NOVA is blank?<br>
><br>
> What does that mean for us (operators)? Everything will be open for<br>
> everybody for the other way around?<br>
><br>
><br>
><br>
> In any case, that sounds like an awful approach because know if we upgrade<br>
> we will need to be sure that we have a proper json file while in the past we<br>
> at least were starting from the default one.<br>
><br>
><br>
><br>
> Edgar<br>
><br>
><br>
><br>
> From: David Medberry <<a href="mailto:openstack@medberry.net">openstack@medberry.net</a>><br>
> Date: Thursday, February 23, 2017 at 10:45 AM<br>
> To: "<a href="mailto:openstack-operators@lists.openstack.org">openstack-operators@lists.openstack.org</a>"<br>
> <<a href="mailto:openstack-operators@lists.openstack.org">openstack-operators@lists.openstack.org</a>><br>
> Subject: [Openstack-operators] Policy Updates<br>
><br>
><br>
><br>
> Nova no longer ships with a fleshed-out skeleton of all policy.json. It<br>
> ships blank.<br>
><br>
><br>
><br>
> Discussion in here on how to help operators select specific settings to<br>
> include in their policy.json via documentation.<br>
><br>
><br>
><br>
> You (as an op) may want to review and comment on this. This model is being<br>
> proposed for all openstack projects (or at least MORE openstack projects.)<br>
><br>
><br>
><br>
> <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__review.openstack.org_-23_c_433010&d=DwMFaQ&c=DS6PUFBBr_KiLo7Sjt3ljp5jaW5k2i9ijVXllEdOozc&r=G0XRJfDQsuBvqa_wpWyDAUlSpeMV4W1qfWqBfctlWwQ&m=R2WX6zRqpVyBw2fVL01fmsbTX6XicRJiKW1LNyOcR_k&s=60IL3jQQP22RMOWSro-hwyAWcZR7ujQtuX-lD84KDbM&e=" target="_blank">
https://review.openstack.org/#/c/433010</a><br>
><br>
><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal">> _______________________________________________<br>
> OpenStack-operators mailing list<br>
> <a href="mailto:OpenStack-operators@lists.openstack.org">OpenStack-operators@lists.openstack.org</a><br>
> <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openstack.org_cgi-2Dbin_mailman_listinfo_openstack-2Doperators&d=DwMFaQ&c=DS6PUFBBr_KiLo7Sjt3ljp5jaW5k2i9ijVXllEdOozc&r=G0XRJfDQsuBvqa_wpWyDAUlSpeMV4W1qfWqBfctlWwQ&m=R2WX6zRqpVyBw2fVL01fmsbTX6XicRJiKW1LNyOcR_k&s=72QegakKTCFXCLdj39ZDobHbOJErXImZfFukhtwhGN8&e=" target="_blank">
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a><br>
><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>