Comment 2 for bug 1945336

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to oslo.policy (master)

Reviewed: https://review.opendev.org/c/openstack/oslo.policy/+/830514
Committed: https://opendev.org/openstack/oslo.policy/commit/b67e3c71a042719a6814621dd1c00c2e1818d2b1
Submitter: "Zuul (22348)"
Branch: master

commit b67e3c71a042719a6814621dd1c00c2e1818d2b1
Author: Julia Kreger <email address hidden>
Date: Tue Feb 22 11:08:56 2022 -0800

    make deprecated rule examples explicit

    Deprecated rules can be confusing and downright unfriendly when
    evaluating a generated sample output and seeing legacy rules being
    aliased to new rules. Technically this is also invalid and results
    in a broken sample file with overriding behavior.

    Under normal circumstances, this wouldn't be a big deal, but with
    the Secure RBAC effort, projects also performed some further
    delineation of RBAC policies instead of performing a 1:1 mapping.

    As a result of the policy enforcement model, a prior deprecated
    rule was required, which meant the prior deprecated rule would
    be reported multiple times in the output.

    Since we don't have an extra flag in the policy-in-code definitions
    of policies, all we can *really* do is both clarify the purpose
    and meaning of the entry, not enable the alias by default in
    sample output (as it is a sample! not an override of code!),
    and provide projects as well as operators with a knob to
    exclude deprecated policy inclusion into examples and sample
    output.

    Closes-Bug: #1945336
    Change-Id: I6d02eb4d8f94323a806fab991ba2f1c3bbf71d04