)]}'
{"stack.sh":[{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"01323c13fb20e3d737e0791747c7f1560830218f","unresolved":false,"context_lines":[{"line_number":1243,"context_line":""},{"line_number":1244,"context_line":"# NOTE(lyarwood): Use a single hardcoded fixed_key across devstack deployments."},{"line_number":1245,"context_line":"# This ensures the keys match across nova and cinder across all hosts."},{"line_number":1246,"context_line":"FIXED_KEY\u003d\"bae3516cc1c0eb18b05440eba8012a4a880a2ee04d584a9c1579445e675b12defdc716ec\""},{"line_number":1247,"context_line":"if is_service_enabled nova; then"},{"line_number":1248,"context_line":"    iniset $NOVA_CONF key_manager fixed_key \"$FIXED_KEY\""},{"line_number":1249,"context_line":"    iniset $NOVA_CPU_CONF key_manager fixed_key \"$FIXED_KEY\""}],"source_content_type":"text/x-sh","patch_set":2,"id":"7f96bb07_aa723d10","line":1246,"updated":"2018-01-22 12:42:45.000000000","message":"Shared across all hosts in a deployment is fine, but using the same key for every deployment seems a bit too static to me. Maybe at least allow this to be set via local.conf?","commit_id":"b9570292aa742f07400732a08e767e4adffa74f1"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"f5ed50184ce2781b3173f473f1c429633d64be86","unresolved":false,"context_lines":[{"line_number":1243,"context_line":""},{"line_number":1244,"context_line":"# NOTE(lyarwood): Use a single hardcoded fixed_key across devstack deployments."},{"line_number":1245,"context_line":"# This ensures the keys match across nova and cinder across all hosts."},{"line_number":1246,"context_line":"FIXED_KEY\u003d\"bae3516cc1c0eb18b05440eba8012a4a880a2ee04d584a9c1579445e675b12defdc716ec\""},{"line_number":1247,"context_line":"if is_service_enabled nova; then"},{"line_number":1248,"context_line":"    iniset $NOVA_CONF key_manager fixed_key \"$FIXED_KEY\""},{"line_number":1249,"context_line":"    iniset $NOVA_CPU_CONF key_manager fixed_key \"$FIXED_KEY\""}],"source_content_type":"text/x-sh","patch_set":2,"id":"5f93b717_60d24c37","line":1246,"in_reply_to":"7f96bb07_171279b2","updated":"2018-01-24 16:08:38.000000000","message":"I\u0027d be o.k. with having a fixed default value, but maybe just make it\n\nFIXED_KEY\u003d${FIXED_KEY:-bae...}\n\nto allow overrides. But then with your second argument I think we can also go with the current approach for now.","commit_id":"b9570292aa742f07400732a08e767e4adffa74f1"},{"author":{"_account_id":10135,"name":"Lee Yarwood","display_name":"Lee Yarwood","email":"lyarwood@redhat.com","username":"lyarwood"},"change_message_id":"4d60941f8abbff0fd6e0012722f90eac192f1832","unresolved":false,"context_lines":[{"line_number":1243,"context_line":""},{"line_number":1244,"context_line":"# NOTE(lyarwood): Use a single hardcoded fixed_key across devstack deployments."},{"line_number":1245,"context_line":"# This ensures the keys match across nova and cinder across all hosts."},{"line_number":1246,"context_line":"FIXED_KEY\u003d\"bae3516cc1c0eb18b05440eba8012a4a880a2ee04d584a9c1579445e675b12defdc716ec\""},{"line_number":1247,"context_line":"if is_service_enabled nova; then"},{"line_number":1248,"context_line":"    iniset $NOVA_CONF key_manager fixed_key \"$FIXED_KEY\""},{"line_number":1249,"context_line":"    iniset $NOVA_CPU_CONF key_manager fixed_key \"$FIXED_KEY\""}],"source_content_type":"text/x-sh","patch_set":2,"id":"7f96bb07_171279b2","line":1246,"in_reply_to":"7f96bb07_aa723d10","updated":"2018-01-22 13:54:00.000000000","message":"Yeah, I appreciate that this looks ugly. My issue with the local.conf approach is that you then need to synchronise that fixed_key between hosts during a multi-host deployment. That\u0027s additional work that I think we can avoid.\n\nIf we want real world testing of our encryption flows then the answer is to use Barbican. No amount of variation in the value of fixed_key would ever provide that so in the short term I don\u0027t mind this approach.","commit_id":"b9570292aa742f07400732a08e767e4adffa74f1"}]}