Re: [openstack-dev] [oslo][policy][neutron] oslo.policy API is not powerful enough to switch Neutron to it

2015-04-23 Thread Ihar Hrachyshka
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 I've sent a patch that makes And, Or, Not, and Rule checks public. As for RoleCheck, we don't need it anymore since we're going to kill the code that relied on it. The patch is: https://review.openstack.org/#/c/176683/ Note that we will need a new

Re: [openstack-dev] [oslo][policy][neutron] oslo.policy API is not powerful enough to switch Neutron to it

2015-04-22 Thread Doug Hellmann
Excerpts from Ihar Hrachyshka's message of 2015-04-22 12:33:52 +0200: On 04/22/2015 05:01 AM, Doug Hellmann wrote: Excerpts from Ihar Hrachyshka's message of 2015-04-17 14:45:58 +0200: Hi, tl;dr neutron has special semantics for policy targets that relies on private symbols from

Re: [openstack-dev] [oslo][policy][neutron] oslo.policy API is not powerful enough to switch Neutron to it

2015-04-22 Thread Kevin L. Mitchell
On Wed, 2015-04-22 at 08:49 -0400, Doug Hellmann wrote: That feature sounds like it could be useful outside of neutron, so let's see if we can come up with a new syntax to make it portable. Bonus points if the new syntax results in a proper DSL. I have been thinking that I should point people

Re: [openstack-dev] [oslo][policy][neutron] oslo.policy API is not powerful enough to switch Neutron to it

2015-04-22 Thread Salvatore Orlando
On 22 April 2015 at 14:49, Doug Hellmann d...@doughellmann.com wrote: Excerpts from Ihar Hrachyshka's message of 2015-04-22 12:33:52 +0200: On 04/22/2015 05:01 AM, Doug Hellmann wrote: Excerpts from Ihar Hrachyshka's message of 2015-04-17 14:45:58 +0200: Hi, tl;dr neutron has

Re: [openstack-dev] [oslo][policy][neutron] oslo.policy API is not powerful enough to switch Neutron to it

2015-04-22 Thread Doug Hellmann
Excerpts from Salvatore Orlando's message of 2015-04-22 23:10:01 +0200: On 22 April 2015 at 14:49, Doug Hellmann d...@doughellmann.com wrote: Excerpts from Ihar Hrachyshka's message of 2015-04-22 12:33:52 +0200: On 04/22/2015 05:01 AM, Doug Hellmann wrote: Excerpts from Ihar

Re: [openstack-dev] [oslo][policy][neutron] oslo.policy API is not powerful enough to switch Neutron to it

2015-04-22 Thread Ihar Hrachyshka
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 04/22/2015 05:01 AM, Doug Hellmann wrote: Excerpts from Ihar Hrachyshka's message of 2015-04-17 14:45:58 +0200: Hi, tl;dr neutron has special semantics for policy targets that relies on private symbols from oslo.policy, and it's impossible

Re: [openstack-dev] [oslo][policy][neutron] oslo.policy API is not powerful enough to switch Neutron to it

2015-04-21 Thread Doug Hellmann
Excerpts from Ihar Hrachyshka's message of 2015-04-17 14:45:58 +0200: Hi, tl;dr neutron has special semantics for policy targets that relies on private symbols from oslo.policy, and it's impossible to introduce this semantics into oslo.policy itself due to backwards compatibility concerns,

Re: [openstack-dev] [oslo][policy][neutron] oslo.policy API is not powerful enough to switch Neutron to it

2015-04-20 Thread Adam Young
On 04/17/2015 08:45 AM, Ihar Hrachyshka wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, tl;dr neutron has special semantics for policy targets that relies on private symbols from oslo.policy, and it's impossible to introduce this semantics into oslo.policy itself due to backwards

Re: [openstack-dev] [oslo][policy][neutron] oslo.policy API is not powerful enough to switch Neutron to it

2015-04-20 Thread Ihar Hrachyshka
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 04/17/2015 07:49 PM, Salvatore Orlando wrote: == 2. filling in admin context with admin roles == Admin context object is filled with .roles attribute that is a list of roles considered granting admin permissions [4]. The attribute would then

Re: [openstack-dev] [oslo][policy][neutron] oslo.policy API is not powerful enough to switch Neutron to it

2015-04-20 Thread Salvatore Orlando
On 20 April 2015 at 10:03, Ihar Hrachyshka ihrac...@redhat.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 04/17/2015 07:49 PM, Salvatore Orlando wrote: == 2. filling in admin context with admin roles == Admin context object is filled with .roles attribute that is a list

[openstack-dev] [oslo][policy][neutron] oslo.policy API is not powerful enough to switch Neutron to it

2015-04-17 Thread Ihar Hrachyshka
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, tl;dr neutron has special semantics for policy targets that relies on private symbols from oslo.policy, and it's impossible to introduce this semantics into oslo.policy itself due to backwards compatibility concerns, meaning we need to expose

Re: [openstack-dev] [oslo][policy][neutron] oslo.policy API is not powerful enough to switch Neutron to it

2015-04-17 Thread Salvatore Orlando
Thanks for this analysis Ihar. Some comments inline. On 17 April 2015 at 14:45, Ihar Hrachyshka ihrac...@redhat.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, tl;dr neutron has special semantics for policy targets that relies on private symbols from oslo.policy, and it's