)]}'
{"specs/5.1/ssl-endpoints.rst":[{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"c0d30516f2d83a12d856897ae025ef709a8fc38d","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"1ae5cdf2_c20ac41f","updated":"2014-06-24 15:38:44.000000000","message":"This is the first draft and some sections are still missing so all comments are more than welcome.","commit_id":"756d01c90df497ff3683250f19473e198f00d0c4"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"3e2cb385a7db584378bd35aaa4a56aca3bc9b602","unresolved":false,"context_lines":[{"line_number":34,"context_line":"Alternatives"},{"line_number":35,"context_line":"------------"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"None"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Data model impact"},{"line_number":40,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_2dc27934","line":37,"updated":"2014-06-24 16:14:23.000000000","message":"1) Use HAProxy SSL termination\n2) Web Server Reverse Proxy with SSL termination\n3) Consider not implementing SSL termination on the \u0027management\u0027 network and only on the \u0027public\u0027 network.","commit_id":"756d01c90df497ff3683250f19473e198f00d0c4"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"71b0fb28441bb95e5b64b33a71cad0a6dc5db005","unresolved":false,"context_lines":[{"line_number":34,"context_line":"Alternatives"},{"line_number":35,"context_line":"------------"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"None"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Data model impact"},{"line_number":40,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_a09cb45c","line":37,"in_reply_to":"1ae5cdf2_2dc27934","updated":"2014-06-25 09:48:52.000000000","message":"I will add the first two alternatives. The third one is the one that we will follow I think.","commit_id":"756d01c90df497ff3683250f19473e198f00d0c4"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"3e2cb385a7db584378bd35aaa4a56aca3bc9b602","unresolved":false,"context_lines":[{"line_number":70,"context_line":"Performance Impact"},{"line_number":71,"context_line":"------------------"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"The SSL-overhead is generally small. The major cost of HTTPS is the SSL"},{"line_number":74,"context_line":"handshaking so depending the typical session length and the caching behavior"},{"line_number":75,"context_line":"of clients the overhead may be different. For very short sessions you can see"},{"line_number":76,"context_line":"performance issue."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_0df13d96","line":73,"updated":"2014-06-24 16:14:23.000000000","message":"If SSL is implemented for all services you\u0027ll see quite a large performance impact overall due to the volume of API calls involved in doing even the smallest tasks. This is why, IMO, it\u0027s better to not have SSL implemented on the \u0027management\u0027 network.","commit_id":"756d01c90df497ff3683250f19473e198f00d0c4"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"71b0fb28441bb95e5b64b33a71cad0a6dc5db005","unresolved":false,"context_lines":[{"line_number":70,"context_line":"Performance Impact"},{"line_number":71,"context_line":"------------------"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"The SSL-overhead is generally small. The major cost of HTTPS is the SSL"},{"line_number":74,"context_line":"handshaking so depending the typical session length and the caching behavior"},{"line_number":75,"context_line":"of clients the overhead may be different. For very short sessions you can see"},{"line_number":76,"context_line":"performance issue."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_00cf28b4","line":73,"in_reply_to":"1ae5cdf2_0df13d96","updated":"2014-06-25 09:48:52.000000000","message":"I agree with you on this point and I will update the blueprint according to this so this BP will focus on HTTP services that provide API endpoints on the public network.","commit_id":"756d01c90df497ff3683250f19473e198f00d0c4"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"3e2cb385a7db584378bd35aaa4a56aca3bc9b602","unresolved":false,"context_lines":[{"line_number":107,"context_line":"* keystone"},{"line_number":108,"context_line":"* heat"},{"line_number":109,"context_line":"* ceilometer"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Puppet\u0027s manifests of most of them are supporting the possiblity of enabling"},{"line_number":112,"context_line":"SSL endpoints but this option is generally only available upstream and not in"},{"line_number":113,"context_line":"the version that we are using with fuel. So we will need to backport the part"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_ad0a0977","line":110,"updated":"2014-06-24 16:14:23.000000000","message":"What about Swift-Proxy or Ceph RGW?","commit_id":"756d01c90df497ff3683250f19473e198f00d0c4"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"71b0fb28441bb95e5b64b33a71cad0a6dc5db005","unresolved":false,"context_lines":[{"line_number":107,"context_line":"* keystone"},{"line_number":108,"context_line":"* heat"},{"line_number":109,"context_line":"* ceilometer"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Puppet\u0027s manifests of most of them are supporting the possiblity of enabling"},{"line_number":112,"context_line":"SSL endpoints but this option is generally only available upstream and not in"},{"line_number":113,"context_line":"the version that we are using with fuel. So we will need to backport the part"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_40b3f009","line":110,"in_reply_to":"1ae5cdf2_ad0a0977","updated":"2014-06-25 09:48:52.000000000","message":"It is not clear to me how much work it will require to implement this so the list will be modified and probably extended in the future. So yes it is really open to discussion.","commit_id":"756d01c90df497ff3683250f19473e198f00d0c4"},{"author":{"_account_id":7075,"name":"Swann Croiset","email":"scroiset@mirantis.com","username":"swann"},"change_message_id":"8e7449f4e23443362ae0014b0c2302b3e4625b2f","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":"https://blueprints.launchpad.net/fuel/+spec/ssl-endpoints"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"SSL needs to be configured between OpenStack services when deployed."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Problem description"},{"line_number":10,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_3c30e4e7","line":7,"updated":"2014-07-02 14:10:21.000000000","message":"I think this sentence is not clear/correct, seems that SSL \"between services\" is not addressed here but you should specify: enable SSL on public API endpoints","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"fc3922ec597d6c26a43017bd555855a76c401649","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":"https://blueprints.launchpad.net/fuel/+spec/ssl-endpoints"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"SSL needs to be configured between OpenStack services when deployed."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Problem description"},{"line_number":10,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_f26db39a","line":7,"in_reply_to":"baada198_3c30e4e7","updated":"2014-07-03 06:45:05.000000000","message":"You\u0027re right. I modified the sentence.","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":7195,"name":"Matthew Mosesohn","email":"raytrac3r@gmail.com","username":"mmosesohn"},"change_message_id":"90468e8b33613f6a7380004a8c628e22aa0464e8","unresolved":false,"context_lines":[{"line_number":11,"context_line":""},{"line_number":12,"context_line":"OpenStack services receive requests from public networks. It is a good"},{"line_number":13,"context_line":"practice to secure data over public networks. One way to achieve this is to"},{"line_number":14,"context_line":"use mechanism like Secure Sockets Layer. Into the OpenStack security guide,"},{"line_number":15,"context_line":"they recommend securing all domains with SSL/TLS including the management"},{"line_number":16,"context_line":"services."},{"line_number":17,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_7cd41c47","line":14,"updated":"2014-07-02 13:50:11.000000000","message":"use a mechanism such as Secure Sockets Layer. In the OpenStack","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"fc3922ec597d6c26a43017bd555855a76c401649","unresolved":false,"context_lines":[{"line_number":11,"context_line":""},{"line_number":12,"context_line":"OpenStack services receive requests from public networks. It is a good"},{"line_number":13,"context_line":"practice to secure data over public networks. One way to achieve this is to"},{"line_number":14,"context_line":"use mechanism like Secure Sockets Layer. Into the OpenStack security guide,"},{"line_number":15,"context_line":"they recommend securing all domains with SSL/TLS including the management"},{"line_number":16,"context_line":"services."},{"line_number":17,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_2fba680a","line":14,"in_reply_to":"baada198_7cd41c47","updated":"2014-07-03 06:45:05.000000000","message":"Done","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":7195,"name":"Matthew Mosesohn","email":"raytrac3r@gmail.com","username":"mmosesohn"},"change_message_id":"90468e8b33613f6a7380004a8c628e22aa0464e8","unresolved":false,"context_lines":[{"line_number":12,"context_line":"OpenStack services receive requests from public networks. It is a good"},{"line_number":13,"context_line":"practice to secure data over public networks. One way to achieve this is to"},{"line_number":14,"context_line":"use mechanism like Secure Sockets Layer. Into the OpenStack security guide,"},{"line_number":15,"context_line":"they recommend securing all domains with SSL/TLS including the management"},{"line_number":16,"context_line":"services."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"If a tenant escape their VM isolation we must prevent him to easly inject or"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_bcceb4b2","line":15,"updated":"2014-07-02 13:50:11.000000000","message":"it is recommended to secure","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"fc3922ec597d6c26a43017bd555855a76c401649","unresolved":false,"context_lines":[{"line_number":12,"context_line":"OpenStack services receive requests from public networks. It is a good"},{"line_number":13,"context_line":"practice to secure data over public networks. One way to achieve this is to"},{"line_number":14,"context_line":"use mechanism like Secure Sockets Layer. Into the OpenStack security guide,"},{"line_number":15,"context_line":"they recommend securing all domains with SSL/TLS including the management"},{"line_number":16,"context_line":"services."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"If a tenant escape their VM isolation we must prevent him to easly inject or"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_4f387ca0","line":15,"in_reply_to":"baada198_bcceb4b2","updated":"2014-07-03 06:45:05.000000000","message":"Done","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":7195,"name":"Matthew Mosesohn","email":"raytrac3r@gmail.com","username":"mmosesohn"},"change_message_id":"90468e8b33613f6a7380004a8c628e22aa0464e8","unresolved":false,"context_lines":[{"line_number":15,"context_line":"they recommend securing all domains with SSL/TLS including the management"},{"line_number":16,"context_line":"services."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"If a tenant escape their VM isolation we must prevent him to easly inject or"},{"line_number":19,"context_line":"capture messages or affect the management capabilites of the cloud. SSL/TLS"},{"line_number":20,"context_line":"provides mechanisms to ensure this kind of troubles."},{"line_number":21,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_5c3838a0","line":18,"updated":"2014-07-02 13:50:11.000000000","message":"escapes its VM isolation, we must prevent it from easily injecting or capturing","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"fc3922ec597d6c26a43017bd555855a76c401649","unresolved":false,"context_lines":[{"line_number":15,"context_line":"they recommend securing all domains with SSL/TLS including the management"},{"line_number":16,"context_line":"services."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"If a tenant escape their VM isolation we must prevent him to easly inject or"},{"line_number":19,"context_line":"capture messages or affect the management capabilites of the cloud. SSL/TLS"},{"line_number":20,"context_line":"provides mechanisms to ensure this kind of troubles."},{"line_number":21,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_ef46b020","line":18,"in_reply_to":"baada198_5c3838a0","updated":"2014-07-03 06:45:05.000000000","message":"Done","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":7195,"name":"Matthew Mosesohn","email":"raytrac3r@gmail.com","username":"mmosesohn"},"change_message_id":"90468e8b33613f6a7380004a8c628e22aa0464e8","unresolved":false,"context_lines":[{"line_number":22,"context_line":"Proposed change"},{"line_number":23,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"As OpenStack services can be configured to use SSL/TLS libraries. We propose"},{"line_number":26,"context_line":"to modify the puppet manifests to be able to use SSL/TLS and HTTP services."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"This blueprint will focus on HTTP services that provides API endpoints on"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_1c6de098","line":25,"updated":"2014-07-02 13:50:11.000000000","message":"remove As","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"fc3922ec597d6c26a43017bd555855a76c401649","unresolved":false,"context_lines":[{"line_number":22,"context_line":"Proposed change"},{"line_number":23,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"As OpenStack services can be configured to use SSL/TLS libraries. We propose"},{"line_number":26,"context_line":"to modify the puppet manifests to be able to use SSL/TLS and HTTP services."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"This blueprint will focus on HTTP services that provides API endpoints on"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_af5cb8ee","line":25,"in_reply_to":"baada198_1c6de098","updated":"2014-07-03 06:45:05.000000000","message":"Done","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":7195,"name":"Matthew Mosesohn","email":"raytrac3r@gmail.com","username":"mmosesohn"},"change_message_id":"90468e8b33613f6a7380004a8c628e22aa0464e8","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"- We need to install at least the version 1.5.0 of the HAProxy because the"},{"line_number":39,"context_line":"  support of SSL is available since this version. As it is not available in"},{"line_number":40,"context_line":"  Ubuntu we will use the PPA repository."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"- We need to configure HAProxy to manage SSL connections and to forward the"},{"line_number":43,"context_line":"  request to the corresponding service."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_7cd7bc23","line":40,"updated":"2014-07-02 13:50:11.000000000","message":"We don\u0027t PPA here. We rebuild anything not available in the base repository. This is just an OSCI work item to add at the end.","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"fc3922ec597d6c26a43017bd555855a76c401649","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"- We need to install at least the version 1.5.0 of the HAProxy because the"},{"line_number":39,"context_line":"  support of SSL is available since this version. As it is not available in"},{"line_number":40,"context_line":"  Ubuntu we will use the PPA repository."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"- We need to configure HAProxy to manage SSL connections and to forward the"},{"line_number":43,"context_line":"  request to the corresponding service."}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_8fe8d4b5","line":40,"in_reply_to":"baada198_7cd7bc23","updated":"2014-07-03 06:45:05.000000000","message":"Done","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"c766433ff43ef158bc0ad6619dc35b6149138379","unresolved":false,"context_lines":[{"line_number":42,"context_line":"- We need to configure HAProxy to manage SSL connections and to forward the"},{"line_number":43,"context_line":"  request to the corresponding service."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"- We will use our own CA. We will use openssl to manage them so that means"},{"line_number":46,"context_line":"  that we will add a dependence to openssl."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"- We need to ensure that each components gets the appropriate configuration"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_bbd9b385","line":45,"updated":"2014-06-30 14:29:28.000000000","message":"And provide the ability to upload an alternative CA, Intermediate and Server certificates?","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"fc3922ec597d6c26a43017bd555855a76c401649","unresolved":false,"context_lines":[{"line_number":42,"context_line":"- We need to configure HAProxy to manage SSL connections and to forward the"},{"line_number":43,"context_line":"  request to the corresponding service."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"- We will use our own CA. We will use openssl to manage them so that means"},{"line_number":46,"context_line":"  that we will add a dependence to openssl."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"- We need to ensure that each components gets the appropriate configuration"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_52d49f1f","line":45,"in_reply_to":"baada198_0f5684d2","updated":"2014-07-03 06:45:05.000000000","message":"I added a comment in the section \"Other end user impact\".","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":7075,"name":"Swann Croiset","email":"scroiset@mirantis.com","username":"swann"},"change_message_id":"8e7449f4e23443362ae0014b0c2302b3e4625b2f","unresolved":false,"context_lines":[{"line_number":42,"context_line":"- We need to configure HAProxy to manage SSL connections and to forward the"},{"line_number":43,"context_line":"  request to the corresponding service."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"- We will use our own CA. We will use openssl to manage them so that means"},{"line_number":46,"context_line":"  that we will add a dependence to openssl."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"- We need to ensure that each components gets the appropriate configuration"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_0f5684d2","line":45,"in_reply_to":"baada198_bbd9b385","updated":"2014-07-02 14:10:21.000000000","message":"+2 to be able to upload cert by users.\n\nneed to introduce new API in fuel and update fuel-web, and\nthe update of cert should be taken into account (expiration)","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"16bc12642bc88748fd127f3d13b0c133f1db5f1c","unresolved":false,"context_lines":[{"line_number":42,"context_line":"- We need to configure HAProxy to manage SSL connections and to forward the"},{"line_number":43,"context_line":"  request to the corresponding service."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"- We will use our own CA. We will use openssl to manage them so that means"},{"line_number":46,"context_line":"  that we will add a dependence to openssl."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"- We need to ensure that each components gets the appropriate configuration"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_49ceed84","line":45,"in_reply_to":"baada198_bbd9b385","updated":"2014-07-01 11:53:57.000000000","message":"I agree with this capability. I don\u0027t know how to deal with it since it requires some modifications from the web UI I guess. So it is not clear to me if I added this now or if it comes from UI team. But it is definitely something that we need.","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":7195,"name":"Matthew Mosesohn","email":"raytrac3r@gmail.com","username":"mmosesohn"},"change_message_id":"90468e8b33613f6a7380004a8c628e22aa0464e8","unresolved":false,"context_lines":[{"line_number":45,"context_line":"- We will use our own CA. We will use openssl to manage them so that means"},{"line_number":46,"context_line":"  that we will add a dependence to openssl."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"- We need to ensure that each components gets the appropriate configuration"},{"line_number":49,"context_line":"  for SSL certificates, keys and CAs."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_1c77a03b","line":48,"updated":"2014-07-02 13:50:11.000000000","message":"component (not plural)","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"fc3922ec597d6c26a43017bd555855a76c401649","unresolved":false,"context_lines":[{"line_number":45,"context_line":"- We will use our own CA. We will use openssl to manage them so that means"},{"line_number":46,"context_line":"  that we will add a dependence to openssl."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"- We need to ensure that each components gets the appropriate configuration"},{"line_number":49,"context_line":"  for SSL certificates, keys and CAs."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_6f30e09e","line":48,"in_reply_to":"baada198_1c77a03b","updated":"2014-07-03 06:45:05.000000000","message":"Done","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":7195,"name":"Matthew Mosesohn","email":"raytrac3r@gmail.com","username":"mmosesohn"},"change_message_id":"90468e8b33613f6a7380004a8c628e22aa0464e8","unresolved":false,"context_lines":[{"line_number":54,"context_line":""},{"line_number":55,"context_line":"#. Enable SSL for all OpenStack services. The problem with this solution is"},{"line_number":56,"context_line":"   that API services need to respond quickly and SSL handshake can add a"},{"line_number":57,"context_line":"   significant oberhead. Python services are not good for SSL management."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Data model impact"},{"line_number":60,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_7c933c4f","line":57,"updated":"2014-07-02 13:50:11.000000000","message":"overhead. Python services do not work well with direct SSL integration.","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"fc3922ec597d6c26a43017bd555855a76c401649","unresolved":false,"context_lines":[{"line_number":54,"context_line":""},{"line_number":55,"context_line":"#. Enable SSL for all OpenStack services. The problem with this solution is"},{"line_number":56,"context_line":"   that API services need to respond quickly and SSL handshake can add a"},{"line_number":57,"context_line":"   significant oberhead. Python services are not good for SSL management."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Data model impact"},{"line_number":60,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_8fde143e","line":57,"in_reply_to":"baada198_7c933c4f","updated":"2014-07-03 06:45:05.000000000","message":"Done","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":7075,"name":"Swann Croiset","email":"scroiset@mirantis.com","username":"swann"},"change_message_id":"8e7449f4e23443362ae0014b0c2302b3e4625b2f","unresolved":false,"context_lines":[{"line_number":63,"context_line":""},{"line_number":64,"context_line":"REST API impact"},{"line_number":65,"context_line":"---------------"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"None"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Upgrade impact"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_2f68a886","line":66,"updated":"2014-07-02 14:10:21.000000000","message":"certificat crud operations ?","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"fc3922ec597d6c26a43017bd555855a76c401649","unresolved":false,"context_lines":[{"line_number":63,"context_line":""},{"line_number":64,"context_line":"REST API impact"},{"line_number":65,"context_line":"---------------"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"None"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Upgrade impact"}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_1633f014","line":66,"in_reply_to":"baada198_2f68a886","updated":"2014-07-03 06:45:05.000000000","message":"The update of certificate will be done through the UI directly.","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":7195,"name":"Matthew Mosesohn","email":"raytrac3r@gmail.com","username":"mmosesohn"},"change_message_id":"90468e8b33613f6a7380004a8c628e22aa0464e8","unresolved":false,"context_lines":[{"line_number":136,"context_line":"    - keystone"},{"line_number":137,"context_line":"    - heat"},{"line_number":138,"context_line":"    - ceilometer"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"  Puppet\u0027s manifests of most of them are supporting the possiblity of"},{"line_number":141,"context_line":"  specifying SSL certificate. If it is not the case we will need to add it."},{"line_number":142,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_3ca9c47b","line":139,"updated":"2014-07-02 13:50:11.000000000","message":"Horizon","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"fc3922ec597d6c26a43017bd555855a76c401649","unresolved":false,"context_lines":[{"line_number":136,"context_line":"    - keystone"},{"line_number":137,"context_line":"    - heat"},{"line_number":138,"context_line":"    - ceilometer"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"  Puppet\u0027s manifests of most of them are supporting the possiblity of"},{"line_number":141,"context_line":"  specifying SSL certificate. If it is not the case we will need to add it."},{"line_number":142,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_4fbddc67","line":139,"in_reply_to":"baada198_3ca9c47b","updated":"2014-07-03 06:45:05.000000000","message":"Maksim Mazur is working on Horizon. Horizon is a little bit different because it does not expose any API. Here I\u0027m focusing on public API exposed by OpenStack.\n\nI added a note.","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":7195,"name":"Matthew Mosesohn","email":"raytrac3r@gmail.com","username":"mmosesohn"},"change_message_id":"90468e8b33613f6a7380004a8c628e22aa0464e8","unresolved":false,"context_lines":[{"line_number":144,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"- openssl"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"Testing"},{"line_number":149,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":150,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_bcb4f4d1","line":147,"updated":"2014-07-02 13:50:11.000000000","message":"haproxy 1.5 for Ubuntu","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"fc3922ec597d6c26a43017bd555855a76c401649","unresolved":false,"context_lines":[{"line_number":144,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"- openssl"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"Testing"},{"line_number":149,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":150,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"baada198_d2dd0f72","line":147,"in_reply_to":"baada198_bcb4f4d1","updated":"2014-07-03 06:45:05.000000000","message":"Done","commit_id":"970393e21202998c42d399916525a9ea8b45d16a"},{"author":{"_account_id":6926,"name":"Bogdan Dobrelya","email":"bdobreli@redhat.com","username":"bogdando"},"change_message_id":"beb5d2fd628d1698a88b9b6ad453a16ded40908d","unresolved":false,"context_lines":[{"line_number":34,"context_line":"will be configured with the IP of the HAproxy. It will handle incoming SSL"},{"line_number":35,"context_line":"connections, decrypting the SSL and passing the unencrypted request to the"},{"line_number":36,"context_line":"corresponding service. That means that the communication between the proxy and"},{"line_number":37,"context_line":"the endpoints will not be encrypted."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"- We need to install at least the version 1.5.0 of the HAProxy because the"},{"line_number":40,"context_line":"  support of SSL is available since this version. As it is not available in"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_0202ae6e","line":37,"updated":"2014-07-03 13:18:57.000000000","message":"Please elaborate what would be the traffic paths?\n\n1) Public faced: Client \u003c-(encrypted)-\u003e Public API endpoint \u003c-(decrypted)-\u003e Service\n\n2) Internally faced: Service \u003c-(not encrypted)-\u003e Management API endpoint \u003c-(not encrypted)-\u003e Service\n\nright?\nIf so, we would have to additionally ensure none of the OSt services will try to communicate to public faced endpoints but only the private ones. I mean this http://docs.openstack.org/security-guide/content/ch021_paste-and-middleware.html\nThus, we\u0027d have to consider as well the fact that some \"services might not obey the listed public or internal API end point values. This can lead to internal management traffic being routed to external API endpoints.\":\n\n3) Internally faced: Service \u003c-(expects non encrypted, but routed to the encrypted endpoint)-\u003ePublic API endpoint-\u003eX(dead session)","commit_id":"d22ea5cfe5fa75a908ca55e784bf98024a191939"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"cd8f39197393810f98c76488f1972153922f25ba","unresolved":false,"context_lines":[{"line_number":34,"context_line":"will be configured with the IP of the HAproxy. It will handle incoming SSL"},{"line_number":35,"context_line":"connections, decrypting the SSL and passing the unencrypted request to the"},{"line_number":36,"context_line":"corresponding service. That means that the communication between the proxy and"},{"line_number":37,"context_line":"the endpoints will not be encrypted."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"- We need to install at least the version 1.5.0 of the HAProxy because the"},{"line_number":40,"context_line":"  support of SSL is available since this version. As it is not available in"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_68c26835","line":37,"in_reply_to":"baada198_0202ae6e","updated":"2014-07-03 15:04:35.000000000","message":"Good points.\n1) and 2) are right. I will add them in the specs. About the problem of OSt services that tries to communicate to public faced endpoints I see two things. If we can configure the service to communicate with the internalURL. So we explicitly configured the service to access the proper internal API endpoint. If it is not possible we must add the certificate to enable the service to pass through the public interface.\n\nI will add this in the specs.","commit_id":"d22ea5cfe5fa75a908ca55e784bf98024a191939"},{"author":{"_account_id":6926,"name":"Bogdan Dobrelya","email":"bdobreli@redhat.com","username":"bogdando"},"change_message_id":"beb5d2fd628d1698a88b9b6ad453a16ded40908d","unresolved":false,"context_lines":[{"line_number":43,"context_line":"- We need to configure HAProxy to manage SSL connections and to forward the"},{"line_number":44,"context_line":"  request to the corresponding service."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"- We will use our own CA. We will use openssl to manage them so that means"},{"line_number":47,"context_line":"  that we will add a dependence to openssl. We also need to provide the"},{"line_number":48,"context_line":"  ability to upload an alternative CA from the user. This will be done if"},{"line_number":49,"context_line":"  it is supported by the UI."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_37253209","line":46,"updated":"2014-07-03 13:18:57.000000000","message":"Please elaborate either it would provide self-signed or white certificates?","commit_id":"d22ea5cfe5fa75a908ca55e784bf98024a191939"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"cd8f39197393810f98c76488f1972153922f25ba","unresolved":false,"context_lines":[{"line_number":43,"context_line":"- We need to configure HAProxy to manage SSL connections and to forward the"},{"line_number":44,"context_line":"  request to the corresponding service."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"- We will use our own CA. We will use openssl to manage them so that means"},{"line_number":47,"context_line":"  that we will add a dependence to openssl. We also need to provide the"},{"line_number":48,"context_line":"  ability to upload an alternative CA from the user. This will be done if"},{"line_number":49,"context_line":"  it is supported by the UI."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_4825a407","line":46,"in_reply_to":"baada198_37253209","updated":"2014-07-03 15:04:35.000000000","message":"I thought about self-signed certificate as I don\u0027t know what is white certificates ;).","commit_id":"d22ea5cfe5fa75a908ca55e784bf98024a191939"},{"author":{"_account_id":6926,"name":"Bogdan Dobrelya","email":"bdobreli@redhat.com","username":"bogdando"},"change_message_id":"6b223b278fb87a1287e6e553977bc1129ef6976e","unresolved":false,"context_lines":[{"line_number":43,"context_line":"- We need to configure HAProxy to manage SSL connections and to forward the"},{"line_number":44,"context_line":"  request to the corresponding service."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"- We will use our own CA. We will use openssl to manage them so that means"},{"line_number":47,"context_line":"  that we will add a dependence to openssl. We also need to provide the"},{"line_number":48,"context_line":"  ability to upload an alternative CA from the user. This will be done if"},{"line_number":49,"context_line":"  it is supported by the UI."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_9e7fd965","line":46,"in_reply_to":"baada198_4825a407","updated":"2014-07-04 06:14:30.000000000","message":"I was meaning \u0027white\u0027 \u003d\u003d any certificates issued by the acknowledged CA in Internet (e.g. G o  D a d d y)","commit_id":"d22ea5cfe5fa75a908ca55e784bf98024a191939"},{"author":{"_account_id":6926,"name":"Bogdan Dobrelya","email":"bdobreli@redhat.com","username":"bogdando"},"change_message_id":"beb5d2fd628d1698a88b9b6ad453a16ded40908d","unresolved":false,"context_lines":[{"line_number":58,"context_line":"#. Enable SSL for all OpenStack services. The problem with this solution is"},{"line_number":59,"context_line":"   that API services need to respond quickly and SSL handshake can add a"},{"line_number":60,"context_line":"   significant oberhead. Python services do not work well with direct SSL"},{"line_number":61,"context_line":"   integration."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Data model impact"},{"line_number":64,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_bd2da397","line":61,"updated":"2014-07-03 13:18:57.000000000","message":"That is the Cons. And the Pros are the route #3 (see above) would have never became dead, if occurred.","commit_id":"d22ea5cfe5fa75a908ca55e784bf98024a191939"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"cd8f39197393810f98c76488f1972153922f25ba","unresolved":false,"context_lines":[{"line_number":58,"context_line":"#. Enable SSL for all OpenStack services. The problem with this solution is"},{"line_number":59,"context_line":"   that API services need to respond quickly and SSL handshake can add a"},{"line_number":60,"context_line":"   significant oberhead. Python services do not work well with direct SSL"},{"line_number":61,"context_line":"   integration."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Data model impact"},{"line_number":64,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_838ebd77","line":61,"in_reply_to":"baada198_bd2da397","updated":"2014-07-03 15:04:35.000000000","message":"Right. I think that if we explicitly configure the internal URL when possible and if we add the CA for services that can be configured correctly, we are OK. I don\u0027t find service where you can not set the internalURL and you can not specify a certificate. I really need to double check that.\n\nI will add the pros for this solution.","commit_id":"d22ea5cfe5fa75a908ca55e784bf98024a191939"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"bbed3c3af7e29de4eeea32921180a57ed47d8c6a","unresolved":false,"context_lines":[{"line_number":90,"context_line":"---------------------"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"We generate certificate that ends ten years later. Is it fair to think that"},{"line_number":93,"context_line":"we don\u0027t need to take care of the expiration of a certificate?"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Performance Impact"},{"line_number":96,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_644aa1c6","line":93,"updated":"2014-07-03 09:23:04.000000000","message":"There should be some sort of monitor/alert (in the health check perhaps) to identify when a certificate is near expiry - perhaps 60 days? While the internal CA approach may have very long term certificates, external CA certificates often do not.","commit_id":"d22ea5cfe5fa75a908ca55e784bf98024a191939"},{"author":{"_account_id":6926,"name":"Bogdan Dobrelya","email":"bdobreli@redhat.com","username":"bogdando"},"change_message_id":"beb5d2fd628d1698a88b9b6ad453a16ded40908d","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"The internal communications between services involved many API calls for"},{"line_number":104,"context_line":"small tasks and this is why we will not implement SSL endpoints for the"},{"line_number":105,"context_line":"management network."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Other deployer impact"},{"line_number":108,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_ddf17702","line":105,"updated":"2014-07-03 13:18:57.000000000","message":"but there are still \"route #3\" cases are potentially possible...","commit_id":"d22ea5cfe5fa75a908ca55e784bf98024a191939"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"cd8f39197393810f98c76488f1972153922f25ba","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"The internal communications between services involved many API calls for"},{"line_number":104,"context_line":"small tasks and this is why we will not implement SSL endpoints for the"},{"line_number":105,"context_line":"management network."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Other deployer impact"},{"line_number":108,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_e3d77949","line":105,"in_reply_to":"baada198_ddf17702","updated":"2014-07-03 15:04:35.000000000","message":"Done","commit_id":"d22ea5cfe5fa75a908ca55e784bf98024a191939"},{"author":{"_account_id":6926,"name":"Bogdan Dobrelya","email":"bdobreli@redhat.com","username":"bogdando"},"change_message_id":"beb5d2fd628d1698a88b9b6ad453a16ded40908d","unresolved":false,"context_lines":[{"line_number":126,"context_line":"Work Items"},{"line_number":127,"context_line":"----------"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"- We need to generate a CA that will be used for authentification."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"- We need to install HAProxy and configure it to handle SSL connections and"},{"line_number":132,"context_line":"  forward requets to the corresponding service."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_1dc68f9a","line":129,"updated":"2014-07-03 13:18:57.000000000","message":"I believe we should never use self-signed certificates. Only CI tasks could be allowed to do so.","commit_id":"d22ea5cfe5fa75a908ca55e784bf98024a191939"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"cc4054e6b095c0ee8a314657eb76d4c9e6b27670","unresolved":false,"context_lines":[{"line_number":126,"context_line":"Work Items"},{"line_number":127,"context_line":"----------"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"- We need to generate a CA that will be used for authentification."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"- We need to install HAProxy and configure it to handle SSL connections and"},{"line_number":132,"context_line":"  forward requets to the corresponding service."}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_e3513937","line":129,"in_reply_to":"baada198_1dc68f9a","updated":"2014-07-03 15:13:07.000000000","message":"I will check with max as I know that he has the same concern about SSL for Horizon. On my side I think that it is okay to use self-signed certificates but I\u0027m really open to hear other voices.","commit_id":"d22ea5cfe5fa75a908ca55e784bf98024a191939"},{"author":{"_account_id":6926,"name":"Bogdan Dobrelya","email":"bdobreli@redhat.com","username":"bogdando"},"change_message_id":"beb5d2fd628d1698a88b9b6ad453a16ded40908d","unresolved":false,"context_lines":[{"line_number":146,"context_line":"  specifying SSL certificate. If it is not the case we will need to add it."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"  Horizon is not part of this blueprint because it doesn\u0027t expose any APIs."},{"line_number":149,"context_line":"  The work to enable SSL is done in another blueprint."},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"Dependencies"},{"line_number":152,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_3d719376","line":149,"updated":"2014-07-03 13:18:57.000000000","message":"And one more action item to do: ensure internal inter-services communications will never be routed via \u0027dead route #3\u0027 (see above)","commit_id":"d22ea5cfe5fa75a908ca55e784bf98024a191939"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"cc4054e6b095c0ee8a314657eb76d4c9e6b27670","unresolved":false,"context_lines":[{"line_number":146,"context_line":"  specifying SSL certificate. If it is not the case we will need to add it."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"  Horizon is not part of this blueprint because it doesn\u0027t expose any APIs."},{"line_number":149,"context_line":"  The work to enable SSL is done in another blueprint."},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"Dependencies"},{"line_number":152,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baada198_630b692a","line":149,"in_reply_to":"baada198_3d719376","updated":"2014-07-03 15:13:07.000000000","message":"agree","commit_id":"d22ea5cfe5fa75a908ca55e784bf98024a191939"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"61e474d952a656b981db62f030a3181679d9e94b","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"If a tenant escapes its VM isolation we must prevent it from easily injecting"},{"line_number":20,"context_line":"or capturing messages or affect the management capabilities of the cloud."},{"line_number":21,"context_line":"SSL/TLS provides mechanisms to ensure this kind of troubles."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Proposed change"},{"line_number":24,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_1f257908","line":21,"updated":"2014-07-04 14:13:49.000000000","message":"Small nit but I don\u0027t think that an attack from the VM is the main reason for encrypting the traffic. The main issue is that the network path between the end-users and the OSt services is untrusted by definition hence encryption is required.","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"399483aa628ccfe717c5f8217a6a2b65e1e10c58","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"If a tenant escapes its VM isolation we must prevent it from easily injecting"},{"line_number":20,"context_line":"or capturing messages or affect the management capabilities of the cloud."},{"line_number":21,"context_line":"SSL/TLS provides mechanisms to ensure this kind of troubles."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Proposed change"},{"line_number":24,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_25d94e22","line":21,"in_reply_to":"baada198_1f257908","updated":"2014-07-04 15:35:14.000000000","message":"Agree. I modified the description according to what you say.","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"61e474d952a656b981db62f030a3181679d9e94b","unresolved":false,"context_lines":[{"line_number":46,"context_line":"                                           \\--{ HTTP }--\u003e OSt service"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Even if it is recommended that an OpenStack service communicate to another"},{"line_number":49,"context_line":"OpenStack service by using the internal API endpoint, it can occurs that"},{"line_number":50,"context_line":"it is not the case and it uses the public endpoint. For these reason we need"},{"line_number":51,"context_line":"to explicitly configured all OpenStack services to use the internal API"},{"line_number":52,"context_line":"endpoint when communicating with other services. If a project doesn\u0027t"}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_7f4f556b","line":49,"range":{"start_line":49,"start_character":61,"end_line":49,"end_character":67},"updated":"2014-07-04 14:13:49.000000000","message":"s/occurs/occur/","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"399483aa628ccfe717c5f8217a6a2b65e1e10c58","unresolved":false,"context_lines":[{"line_number":46,"context_line":"                                           \\--{ HTTP }--\u003e OSt service"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Even if it is recommended that an OpenStack service communicate to another"},{"line_number":49,"context_line":"OpenStack service by using the internal API endpoint, it can occurs that"},{"line_number":50,"context_line":"it is not the case and it uses the public endpoint. For these reason we need"},{"line_number":51,"context_line":"to explicitly configured all OpenStack services to use the internal API"},{"line_number":52,"context_line":"endpoint when communicating with other services. If a project doesn\u0027t"}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_25f06e90","line":49,"range":{"start_line":49,"start_character":61,"end_line":49,"end_character":67},"in_reply_to":"baada198_7f4f556b","updated":"2014-07-04 15:35:14.000000000","message":"Done","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"61e474d952a656b981db62f030a3181679d9e94b","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"- We need to install at least the version 1.5.0 of the HAProxy because the"},{"line_number":60,"context_line":"  support of SSL is available since this version. As it is not available in"},{"line_number":61,"context_line":"  Ubuntu we will need to rebuild it."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"- We need to configure HAProxy to manage SSL connections and to forward the"},{"line_number":64,"context_line":"  request to the corresponding service."}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_7f7bd5f4","line":61,"updated":"2014-07-04 14:13:49.000000000","message":"The same is true for CentOS probably.","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"399483aa628ccfe717c5f8217a6a2b65e1e10c58","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"- We need to install at least the version 1.5.0 of the HAProxy because the"},{"line_number":60,"context_line":"  support of SSL is available since this version. As it is not available in"},{"line_number":61,"context_line":"  Ubuntu we will need to rebuild it."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"- We need to configure HAProxy to manage SSL connections and to forward the"},{"line_number":64,"context_line":"  request to the corresponding service."}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_c50fb286","line":61,"in_reply_to":"baada198_7f7bd5f4","updated":"2014-07-04 15:35:14.000000000","message":"Done","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"61e474d952a656b981db62f030a3181679d9e94b","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"- We need to ensure that an internal OpenStack service is using the internal"},{"line_number":67,"context_line":"  API endpoint and if it is not possible to explicitly configured the access"},{"line_number":68,"context_line":"  we need to configure the certificate for authentication."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"- We will use a self-signed certificate. We will use openssl to manage them"},{"line_number":71,"context_line":"  so that means that we will add a dependence to openssl. We also need to"}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_1fae59e6","line":68,"updated":"2014-07-04 14:13:49.000000000","message":"... and if it is not possible, the service needs to be configured with the SSL certificate used by HAProxy.","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"399483aa628ccfe717c5f8217a6a2b65e1e10c58","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"- We need to ensure that an internal OpenStack service is using the internal"},{"line_number":67,"context_line":"  API endpoint and if it is not possible to explicitly configured the access"},{"line_number":68,"context_line":"  we need to configure the certificate for authentication."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"- We will use a self-signed certificate. We will use openssl to manage them"},{"line_number":71,"context_line":"  so that means that we will add a dependence to openssl. We also need to"}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_6562663f","line":68,"in_reply_to":"baada198_1fae59e6","updated":"2014-07-04 15:35:14.000000000","message":"Done","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"61e474d952a656b981db62f030a3181679d9e94b","unresolved":false,"context_lines":[{"line_number":68,"context_line":"  we need to configure the certificate for authentication."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"- We will use a self-signed certificate. We will use openssl to manage them"},{"line_number":71,"context_line":"  so that means that we will add a dependence to openssl. We also need to"},{"line_number":72,"context_line":"  provide the ability to upload an alternative CA from the user. This will be"},{"line_number":73,"context_line":"  done if it is supported by the UI."},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_9f898977","line":71,"updated":"2014-07-04 14:13:49.000000000","message":"s/dependence/dependency/\n\nopenssl is probably already a dependency though.","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"399483aa628ccfe717c5f8217a6a2b65e1e10c58","unresolved":false,"context_lines":[{"line_number":68,"context_line":"  we need to configure the certificate for authentication."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"- We will use a self-signed certificate. We will use openssl to manage them"},{"line_number":71,"context_line":"  so that means that we will add a dependence to openssl. We also need to"},{"line_number":72,"context_line":"  provide the ability to upload an alternative CA from the user. This will be"},{"line_number":73,"context_line":"  done if it is supported by the UI."},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_10cd6685","line":71,"in_reply_to":"baada198_9f898977","updated":"2014-07-04 15:35:14.000000000","message":"Done","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"61e474d952a656b981db62f030a3181679d9e94b","unresolved":false,"context_lines":[{"line_number":70,"context_line":"- We will use a self-signed certificate. We will use openssl to manage them"},{"line_number":71,"context_line":"  so that means that we will add a dependence to openssl. We also need to"},{"line_number":72,"context_line":"  provide the ability to upload an alternative CA from the user. This will be"},{"line_number":73,"context_line":"  done if it is supported by the UI."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"- We need to ensure that each client gets the appropriate configuration"},{"line_number":76,"context_line":"  for SSL certificates, keys and CAs."}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_5f67f1b6","line":73,"updated":"2014-07-04 14:13:49.000000000","message":"I guess that UI \u003d Fuel UI","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"399483aa628ccfe717c5f8217a6a2b65e1e10c58","unresolved":false,"context_lines":[{"line_number":70,"context_line":"- We will use a self-signed certificate. We will use openssl to manage them"},{"line_number":71,"context_line":"  so that means that we will add a dependence to openssl. We also need to"},{"line_number":72,"context_line":"  provide the ability to upload an alternative CA from the user. This will be"},{"line_number":73,"context_line":"  done if it is supported by the UI."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"- We need to ensure that each client gets the appropriate configuration"},{"line_number":76,"context_line":"  for SSL certificates, keys and CAs."}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_055d2a47","line":73,"in_reply_to":"baada198_5f67f1b6","updated":"2014-07-04 15:35:14.000000000","message":"Yes it is. Done","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"61e474d952a656b981db62f030a3181679d9e94b","unresolved":false,"context_lines":[{"line_number":72,"context_line":"  provide the ability to upload an alternative CA from the user. This will be"},{"line_number":73,"context_line":"  done if it is supported by the UI."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"- We need to ensure that each client gets the appropriate configuration"},{"line_number":76,"context_line":"  for SSL certificates, keys and CAs."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_df122108","line":75,"updated":"2014-07-04 14:13:49.000000000","message":"who are the clients? Other OSt services? End-users?","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"399483aa628ccfe717c5f8217a6a2b65e1e10c58","unresolved":false,"context_lines":[{"line_number":72,"context_line":"  provide the ability to upload an alternative CA from the user. This will be"},{"line_number":73,"context_line":"  done if it is supported by the UI."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"- We need to ensure that each client gets the appropriate configuration"},{"line_number":76,"context_line":"  for SSL certificates, keys and CAs."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_651a667e","line":75,"in_reply_to":"baada198_df122108","updated":"2014-07-04 15:35:14.000000000","message":"End-user in this sentence. Fixed.","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"61e474d952a656b981db62f030a3181679d9e94b","unresolved":false,"context_lines":[{"line_number":73,"context_line":"  done if it is supported by the UI."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"- We need to ensure that each client gets the appropriate configuration"},{"line_number":76,"context_line":"  for SSL certificates, keys and CAs."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_bf248d60","line":76,"updated":"2014-07-04 14:13:49.000000000","message":"Keys must not be exposed.","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"399483aa628ccfe717c5f8217a6a2b65e1e10c58","unresolved":false,"context_lines":[{"line_number":73,"context_line":"  done if it is supported by the UI."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"- We need to ensure that each client gets the appropriate configuration"},{"line_number":76,"context_line":"  for SSL certificates, keys and CAs."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_704f826b","line":76,"in_reply_to":"baada198_bf248d60","updated":"2014-07-04 15:35:14.000000000","message":"Yes. It was a mixed between two different sentences. Fixed.","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"61e474d952a656b981db62f030a3181679d9e94b","unresolved":false,"context_lines":[{"line_number":85,"context_line":"      - API services need to respond quickly and SSL handshake can add a"},{"line_number":86,"context_line":"        significant overhead. Python services do not work well with direct SSL"},{"line_number":87,"context_line":"        integration."},{"line_number":88,"context_line":"      - You need to manage as many certificates as there are services."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"   Pros:"},{"line_number":91,"context_line":"      - It enables SSL on both, public and internal APIs. That means that we"}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_ff7d251d","line":88,"updated":"2014-07-04 14:13:49.000000000","message":"This is especially true in case you spread API services on different nodes. Even when all services run on the same node, you still may have to keep different copies of the certificates because of permission/ownership issues.","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"399483aa628ccfe717c5f8217a6a2b65e1e10c58","unresolved":false,"context_lines":[{"line_number":85,"context_line":"      - API services need to respond quickly and SSL handshake can add a"},{"line_number":86,"context_line":"        significant overhead. Python services do not work well with direct SSL"},{"line_number":87,"context_line":"        integration."},{"line_number":88,"context_line":"      - You need to manage as many certificates as there are services."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"   Pros:"},{"line_number":91,"context_line":"      - It enables SSL on both, public and internal APIs. That means that we"}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_908fb629","line":88,"in_reply_to":"baada198_ff7d251d","updated":"2014-07-04 15:35:14.000000000","message":"I modified the text to emphasis the distributed aspect of services.","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"61e474d952a656b981db62f030a3181679d9e94b","unresolved":false,"context_lines":[{"line_number":124,"context_line":"we don\u0027t need to take care of the expiration of a certificate? If it is not"},{"line_number":125,"context_line":"fair we will need to add some sort of monitoring to identify when a"},{"line_number":126,"context_line":"certificate is near to expire."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Performance Impact"},{"line_number":129,"context_line":"------------------"},{"line_number":130,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_ffa445a7","line":127,"updated":"2014-07-04 14:13:49.000000000","message":"As Jesse stated in a previous change, it is always better to monitor the expiry date when end-users can upload their own certificates.","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"399483aa628ccfe717c5f8217a6a2b65e1e10c58","unresolved":false,"context_lines":[{"line_number":124,"context_line":"we don\u0027t need to take care of the expiration of a certificate? If it is not"},{"line_number":125,"context_line":"fair we will need to add some sort of monitoring to identify when a"},{"line_number":126,"context_line":"certificate is near to expire."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Performance Impact"},{"line_number":129,"context_line":"------------------"},{"line_number":130,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"baada198_30efcaea","line":127,"in_reply_to":"baada198_ffa445a7","updated":"2014-07-04 15:35:14.000000000","message":"Right because expiry can short in this case. I added a note.","commit_id":"b004fb8c8614e43b61618e87cb10c3a11bfedecb"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"7593ecec652dbd8d7f0560fe8a7be10ea70a8a61","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"  2. Between OpenStack services:"},{"line_number":45,"context_line":"      OSt service --{ HTTP }--\u003e internal API endpoint"},{"line_number":46,"context_line":"                                           \\--{ HTTP }--\u003e OSt service"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Even if it is recommended that an OpenStack service communicate to another"},{"line_number":49,"context_line":"OpenStack service by using the internal API endpoint, it can occurs that"}],"source_content_type":"text/x-rst","patch_set":8,"id":"baada198_df0ce13d","line":46,"updated":"2014-07-04 13:52:43.000000000","message":"I will do that with asciiflow for the next iteration.","commit_id":"64d79d23af75fa817dabd10d133a2f6b37e12098"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"a668715ca8cefd3954e470adc6cf6bb3d90f0d12","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"OpenStack services receive requests from public networks that are untrusted"},{"line_number":14,"context_line":"area. As network path between the end-users and the OpenStack services is"},{"line_number":15,"context_line":"untrusted, the encrytion is requited to ensure confidentiality or integrity."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Another reason to use encryption is if a tenant escapes its VM isolation. In"},{"line_number":18,"context_line":"this case we must prevent it from easily injecting or capturing messages or"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_bcdabe14","line":15,"updated":"2014-07-07 08:08:45.000000000","message":"It\u0027s just confidentiality, really.","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"09b6835c4c82195e8861c13bda07257955efbbca","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"OpenStack services receive requests from public networks that are untrusted"},{"line_number":14,"context_line":"area. As network path between the end-users and the OpenStack services is"},{"line_number":15,"context_line":"untrusted, the encrytion is requited to ensure confidentiality or integrity."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Another reason to use encryption is if a tenant escapes its VM isolation. In"},{"line_number":18,"context_line":"this case we must prevent it from easily injecting or capturing messages or"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_f0b1d28f","line":15,"updated":"2014-07-04 15:57:24.000000000","message":"s/requited/required/","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"962b9725d5281acde54cb753289e02572812501a","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"OpenStack services receive requests from public networks that are untrusted"},{"line_number":14,"context_line":"area. As network path between the end-users and the OpenStack services is"},{"line_number":15,"context_line":"untrusted, the encrytion is requited to ensure confidentiality or integrity."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Another reason to use encryption is if a tenant escapes its VM isolation. In"},{"line_number":18,"context_line":"this case we must prevent it from easily injecting or capturing messages or"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_9ddb4e4e","line":15,"in_reply_to":"baada198_f0b1d28f","updated":"2014-07-07 11:42:35.000000000","message":"Done","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"a668715ca8cefd3954e470adc6cf6bb3d90f0d12","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Another reason to use encryption is if a tenant escapes its VM isolation. In"},{"line_number":18,"context_line":"this case we must prevent it from easily injecting or capturing messages or"},{"line_number":19,"context_line":"affect the management capabilities of the cloud."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"One way to achieve this is to use mechanism such Secure Sockets Layer. Into"},{"line_number":22,"context_line":"the OpenStack security guide, it is recommended to secure all domains with"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_7cfbc678","line":19,"updated":"2014-07-07 08:08:45.000000000","message":"Using SSL endpoints doesn\u0027t actually protect against an instance escaping VM isolation. The security for that is in the hypervisor (nwfilter, etc). I\u0027m guessing that you mean that if a VM escapes its isolation, then using SSL endpoints protects the confidentiality of information being passed around in the back-end? In this case, the protectsion is no more than that described in the first paragraph, so I think this paragraph should be removed.","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"962b9725d5281acde54cb753289e02572812501a","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Another reason to use encryption is if a tenant escapes its VM isolation. In"},{"line_number":18,"context_line":"this case we must prevent it from easily injecting or capturing messages or"},{"line_number":19,"context_line":"affect the management capabilities of the cloud."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"One way to achieve this is to use mechanism such Secure Sockets Layer. Into"},{"line_number":22,"context_line":"the OpenStack security guide, it is recommended to secure all domains with"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_bc8e372c","line":19,"in_reply_to":"baada198_7cfbc678","updated":"2014-07-07 11:42:35.000000000","message":"Yes I mean that if a VM escapes then SSL endpoints protects the confidentiality. I will remove this paragraph.","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"a668715ca8cefd3954e470adc6cf6bb3d90f0d12","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"One way to achieve this is to use mechanism such Secure Sockets Layer. Into"},{"line_number":22,"context_line":"the OpenStack security guide, it is recommended to secure all domains with"},{"line_number":23,"context_line":"SSL/TLS."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_bce47eac","line":23,"updated":"2014-07-07 08:08:45.000000000","message":"perhaps reword to something like \u0027We achieve this by implementing SSL as recommended in the OpenStack Security Guide.\u0027","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"a668715ca8cefd3954e470adc6cf6bb3d90f0d12","unresolved":false,"context_lines":[{"line_number":85,"context_line":"  API endpoint and if it is not possible, the service needs to be configured"},{"line_number":86,"context_line":"  with the SSL certificate used by the HAProxy."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"- We will use a self-signed certificate. We will use openssl to manage them"},{"line_number":89,"context_line":"  so that means that we will add a dependency to openssl if it is not already"},{"line_number":90,"context_line":"  the case. We also need to provide the ability to upload an alternative CA"},{"line_number":91,"context_line":"  from the user. This will be done if it is supported by the Fuel UI."}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_bc92bef3","line":88,"updated":"2014-07-07 08:08:45.000000000","message":"\u0027We will use a self-signed certificate by default.\u0027","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"962b9725d5281acde54cb753289e02572812501a","unresolved":false,"context_lines":[{"line_number":85,"context_line":"  API endpoint and if it is not possible, the service needs to be configured"},{"line_number":86,"context_line":"  with the SSL certificate used by the HAProxy."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"- We will use a self-signed certificate. We will use openssl to manage them"},{"line_number":89,"context_line":"  so that means that we will add a dependency to openssl if it is not already"},{"line_number":90,"context_line":"  the case. We also need to provide the ability to upload an alternative CA"},{"line_number":91,"context_line":"  from the user. This will be done if it is supported by the Fuel UI."}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_dcfdab6f","line":88,"in_reply_to":"baada198_bc92bef3","updated":"2014-07-07 11:42:35.000000000","message":"Done","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"09b6835c4c82195e8861c13bda07257955efbbca","unresolved":false,"context_lines":[{"line_number":87,"context_line":""},{"line_number":88,"context_line":"- We will use a self-signed certificate. We will use openssl to manage them"},{"line_number":89,"context_line":"  so that means that we will add a dependency to openssl if it is not already"},{"line_number":90,"context_line":"  the case. We also need to provide the ability to upload an alternative CA"},{"line_number":91,"context_line":"  from the user. This will be done if it is supported by the Fuel UI."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"- We need to ensure that each end user can retrieve the certificate."}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_50019e04","line":90,"updated":"2014-07-04 15:57:24.000000000","message":"the user will upload the certificate + the private key","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"962b9725d5281acde54cb753289e02572812501a","unresolved":false,"context_lines":[{"line_number":87,"context_line":""},{"line_number":88,"context_line":"- We will use a self-signed certificate. We will use openssl to manage them"},{"line_number":89,"context_line":"  so that means that we will add a dependency to openssl if it is not already"},{"line_number":90,"context_line":"  the case. We also need to provide the ability to upload an alternative CA"},{"line_number":91,"context_line":"  from the user. This will be done if it is supported by the Fuel UI."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"- We need to ensure that each end user can retrieve the certificate."}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_1def3eea","line":90,"in_reply_to":"baada198_50019e04","updated":"2014-07-07 11:42:35.000000000","message":"Done","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"a668715ca8cefd3954e470adc6cf6bb3d90f0d12","unresolved":false,"context_lines":[{"line_number":90,"context_line":"  the case. We also need to provide the ability to upload an alternative CA"},{"line_number":91,"context_line":"  from the user. This will be done if it is supported by the Fuel UI."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"- We need to ensure that each end user can retrieve the certificate."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_82175444","line":93,"updated":"2014-07-07 08:08:45.000000000","message":"Not sure what you mean by this line. End-users retrieve the certificates by accessing the service through the browser? Do you mean that they should be able to download the key and certificate for re-implementation elsewhere? Perhaps you mean that the end-user can _upload_ their own private key, server/service cert, CA cert and intermediate cert?\n\nSomething else that does need to be included is that the SSL certificates (CA and server/service) and keys (server/service) need to be distributed to each node that requires them. The certificates also need to be able to be modified after the deployment, and when that happens the modifications must be pushed to all nodes that require the changes.\n\nI would expect that the replication of certs to the nodes should be handled by a puppet run.","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"962b9725d5281acde54cb753289e02572812501a","unresolved":false,"context_lines":[{"line_number":90,"context_line":"  the case. We also need to provide the ability to upload an alternative CA"},{"line_number":91,"context_line":"  from the user. This will be done if it is supported by the Fuel UI."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"- We need to ensure that each end user can retrieve the certificate."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_bc66374f","line":93,"in_reply_to":"baada198_82175444","updated":"2014-07-07 11:42:35.000000000","message":"If the end-users are using the browser they will retrieve the certificate through the browser. My concern is if a user wants to use nova CLI for example. It needs to be able to retrieve the certificate from the server but it is not clear to me how this is done.","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"30eb86117e1b05dbe1b92c7477b02c0ada0f1656","unresolved":false,"context_lines":[{"line_number":90,"context_line":"  the case. We also need to provide the ability to upload an alternative CA"},{"line_number":91,"context_line":"  from the user. This will be done if it is supported by the Fuel UI."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"- We need to ensure that each end user can retrieve the certificate."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_6f50590b","line":93,"in_reply_to":"baada198_bc66374f","updated":"2014-07-07 15:42:41.000000000","message":"Ah, I see your point. This will be important only for the self-signed certificate - the CA\u0027s public certificate will be needed and the ed-user of OpenStack will be able to access Horizon first to get it via the browser, then can install it onto his OS for CLI usage. I would suggest that this just becomes a documentation item as the customers using SSL endpoints will most likely use proper certificates.","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"a668715ca8cefd3954e470adc6cf6bb3d90f0d12","unresolved":false,"context_lines":[{"line_number":103,"context_line":"        significant overhead. Python services do not work well with direct SSL"},{"line_number":104,"context_line":"        integration."},{"line_number":105,"context_line":"      - You need to manage as many certificates as there are services. The"},{"line_number":106,"context_line":"        problem is even more dificult when services are spread on different"},{"line_number":107,"context_line":"        nodes as it is often the case."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"   Pros:"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_9caeda2c","line":106,"updated":"2014-07-07 08:08:45.000000000","message":"\u0027s/dificult/difficult/\u0027","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"962b9725d5281acde54cb753289e02572812501a","unresolved":false,"context_lines":[{"line_number":103,"context_line":"        significant overhead. Python services do not work well with direct SSL"},{"line_number":104,"context_line":"        integration."},{"line_number":105,"context_line":"      - You need to manage as many certificates as there are services. The"},{"line_number":106,"context_line":"        problem is even more dificult when services are spread on different"},{"line_number":107,"context_line":"        nodes as it is often the case."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"   Pros:"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_1c29e3e5","line":106,"in_reply_to":"baada198_9caeda2c","updated":"2014-07-07 11:42:35.000000000","message":"Done","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"a668715ca8cefd3954e470adc6cf6bb3d90f0d12","unresolved":false,"context_lines":[{"line_number":108,"context_line":""},{"line_number":109,"context_line":"   Pros:"},{"line_number":110,"context_line":"      - It enables SSL on both, public and internal APIs. That means that we"},{"line_number":111,"context_line":"        don\u0027t need to care about OpenStack service that uses public endpoint."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"Data model impact"},{"line_number":114,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_5c70c2db","line":111,"updated":"2014-07-07 08:08:45.000000000","message":"We don\u0027t need to be concerned with which endpoint is being used by each OpenStack service.","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"962b9725d5281acde54cb753289e02572812501a","unresolved":false,"context_lines":[{"line_number":108,"context_line":""},{"line_number":109,"context_line":"   Pros:"},{"line_number":110,"context_line":"      - It enables SSL on both, public and internal APIs. That means that we"},{"line_number":111,"context_line":"        don\u0027t need to care about OpenStack service that uses public endpoint."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"Data model impact"},{"line_number":114,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_1c70030a","line":111,"in_reply_to":"baada198_5c70c2db","updated":"2014-07-07 11:42:35.000000000","message":"Done","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"09b6835c4c82195e8861c13bda07257955efbbca","unresolved":false,"context_lines":[{"line_number":143,"context_line":"we don\u0027t need to take care of the expiration of a certificate? If it is not"},{"line_number":144,"context_line":"fair we will need to add some sort of monitoring to identify when a"},{"line_number":145,"context_line":"certificate is near to expire."},{"line_number":146,"context_line":"**Note**: If an end-user can download its own certificate"},{"line_number":147,"context_line":"the delay can be short so in this case it\u0027s really better to monitor the"},{"line_number":148,"context_line":"expiry date."},{"line_number":149,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_70330214","line":146,"updated":"2014-07-04 15:57:24.000000000","message":"s/download/upload/","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"962b9725d5281acde54cb753289e02572812501a","unresolved":false,"context_lines":[{"line_number":143,"context_line":"we don\u0027t need to take care of the expiration of a certificate? If it is not"},{"line_number":144,"context_line":"fair we will need to add some sort of monitoring to identify when a"},{"line_number":145,"context_line":"certificate is near to expire."},{"line_number":146,"context_line":"**Note**: If an end-user can download its own certificate"},{"line_number":147,"context_line":"the delay can be short so in this case it\u0027s really better to monitor the"},{"line_number":148,"context_line":"expiry date."},{"line_number":149,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"baada198_5dbc56dc","line":146,"in_reply_to":"baada198_70330214","updated":"2014-07-07 11:42:35.000000000","message":"Done","commit_id":"2de66c77502f6311dd9d13a5b51bbe66de259903"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"7e2bf9ade444d6d16dedbbcc8217c59940eeaf84","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Another reason to use encryption is if a tenant escapes its VM isolation. In"},{"line_number":18,"context_line":"this case we must prevent it from easily injecting or capturing messages or"},{"line_number":19,"context_line":"affect the management capabilities of the cloud."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"We achieve this by implementing Secure Sockets Layer as recommended in the"},{"line_number":22,"context_line":"OpenStack security guider."}],"source_content_type":"text/x-rst","patch_set":10,"id":"baada198_3c2307be","line":19,"updated":"2014-07-07 11:45:51.000000000","message":"This section will be removed.","commit_id":"d91a9c44cfaa4425592e48f8f3122b4433f2b7eb"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"b6d74a94a087aad5981c2b303c99e84c466b03c5","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"OpenStack services receive requests from public networks that are untrusted"},{"line_number":14,"context_line":"area. As network path between the end-users and the OpenStack services is"},{"line_number":15,"context_line":"untrusted, the encrytion is required to ensure confidentiality or integrity."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"We achieve this by implementing Secure Sockets Layer as recommended in the"},{"line_number":18,"context_line":"OpenStack security guider."}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_d70e64e4","line":15,"updated":"2014-07-07 12:09:03.000000000","message":"please remove integrity as Jesse noted.","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"4acc2e445239cf8fd5ab5f8ab70ee8bb668159fd","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"OpenStack services receive requests from public networks that are untrusted"},{"line_number":14,"context_line":"area. As network path between the end-users and the OpenStack services is"},{"line_number":15,"context_line":"untrusted, the encrytion is required to ensure confidentiality or integrity."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"We achieve this by implementing Secure Sockets Layer as recommended in the"},{"line_number":18,"context_line":"OpenStack security guider."}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_7729189a","line":15,"in_reply_to":"baada198_d70e64e4","updated":"2014-07-07 12:32:13.000000000","message":"Done","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"b6d74a94a087aad5981c2b303c99e84c466b03c5","unresolved":false,"context_lines":[{"line_number":23,"context_line":"OpenStack services can be configured to use SSL/TLS libraries. We propose to"},{"line_number":24,"context_line":"modify the puppet manifests to be able to use SSL/TLS and HTTP services."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"This blueprint will focus on HTTP services that provides API endpoints on"},{"line_number":27,"context_line":"public networks. Endpoints used for management and other services like"},{"line_number":28,"context_line":"messaging will not be done in this blueprint."},{"line_number":29,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_f7436810","line":26,"updated":"2014-07-07 12:09:03.000000000","message":"s/provides/provide/","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"4acc2e445239cf8fd5ab5f8ab70ee8bb668159fd","unresolved":false,"context_lines":[{"line_number":23,"context_line":"OpenStack services can be configured to use SSL/TLS libraries. We propose to"},{"line_number":24,"context_line":"modify the puppet manifests to be able to use SSL/TLS and HTTP services."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"This blueprint will focus on HTTP services that provides API endpoints on"},{"line_number":27,"context_line":"public networks. Endpoints used for management and other services like"},{"line_number":28,"context_line":"messaging will not be done in this blueprint."},{"line_number":29,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_69114051","line":26,"in_reply_to":"baada198_f7436810","updated":"2014-07-07 12:32:13.000000000","message":"Done","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"b6d74a94a087aad5981c2b303c99e84c466b03c5","unresolved":false,"context_lines":[{"line_number":28,"context_line":"messaging will not be done in this blueprint."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"We will use the HAProxy and its support of SSL. The endpoints of public URLs"},{"line_number":31,"context_line":"will be configured with the IP of the HAproxy. It will handle incoming SSL"},{"line_number":32,"context_line":"connections, decrypting the SSL and passing the unencrypted request to the"},{"line_number":33,"context_line":"corresponding service. That means that the communication between the proxy"},{"line_number":34,"context_line":"and the endpoints will not be encrypted."}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_17237c56","line":31,"updated":"2014-07-07 12:09:03.000000000","message":"the IP address *or name* of HAProxy","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"4acc2e445239cf8fd5ab5f8ab70ee8bb668159fd","unresolved":false,"context_lines":[{"line_number":28,"context_line":"messaging will not be done in this blueprint."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"We will use the HAProxy and its support of SSL. The endpoints of public URLs"},{"line_number":31,"context_line":"will be configured with the IP of the HAproxy. It will handle incoming SSL"},{"line_number":32,"context_line":"connections, decrypting the SSL and passing the unencrypted request to the"},{"line_number":33,"context_line":"corresponding service. That means that the communication between the proxy"},{"line_number":34,"context_line":"and the endpoints will not be encrypted."}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_891cd46b","line":31,"in_reply_to":"baada198_17237c56","updated":"2014-07-07 12:32:13.000000000","message":"Done","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"b6d74a94a087aad5981c2b303c99e84c466b03c5","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Even if it is recommended that an OpenStack service communicate to another"},{"line_number":61,"context_line":"OpenStack service by using the internal API endpoint, it can occur that"},{"line_number":62,"context_line":"it is not the case and it uses the public endpoint. For these reason we need"},{"line_number":63,"context_line":"to explicitly configured all OpenStack services to use the internal API"},{"line_number":64,"context_line":"endpoint when communicating with other services. If a project doesn\u0027t"},{"line_number":65,"context_line":"offer this possibility we will then configure the service with the correct CA"},{"line_number":66,"context_line":"for authentication."}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_77c2f853","line":63,"updated":"2014-07-07 12:09:03.000000000","message":"s/configured/configure/","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"4acc2e445239cf8fd5ab5f8ab70ee8bb668159fd","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Even if it is recommended that an OpenStack service communicate to another"},{"line_number":61,"context_line":"OpenStack service by using the internal API endpoint, it can occur that"},{"line_number":62,"context_line":"it is not the case and it uses the public endpoint. For these reason we need"},{"line_number":63,"context_line":"to explicitly configured all OpenStack services to use the internal API"},{"line_number":64,"context_line":"endpoint when communicating with other services. If a project doesn\u0027t"},{"line_number":65,"context_line":"offer this possibility we will then configure the service with the correct CA"},{"line_number":66,"context_line":"for authentication."}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_693860d3","line":63,"in_reply_to":"baada198_77c2f853","updated":"2014-07-07 12:32:13.000000000","message":"Done","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"b6d74a94a087aad5981c2b303c99e84c466b03c5","unresolved":false,"context_lines":[{"line_number":77,"context_line":""},{"line_number":78,"context_line":"- We need to ensure that an internal OpenStack service is using the internal"},{"line_number":79,"context_line":"  API endpoint and if it is not possible, the service needs to be configured"},{"line_number":80,"context_line":"  with the SSL certificate used by the HAProxy."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"- We will use a self-signed certificate by default. We will use openssl to"},{"line_number":83,"context_line":"  manage them so that means that we will add a dependency to openssl if it is"}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_377a4024","line":80,"updated":"2014-07-07 12:09:03.000000000","message":"with the SSL certificate (if self-signed) or the certification authority certificate.","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"4acc2e445239cf8fd5ab5f8ab70ee8bb668159fd","unresolved":false,"context_lines":[{"line_number":77,"context_line":""},{"line_number":78,"context_line":"- We need to ensure that an internal OpenStack service is using the internal"},{"line_number":79,"context_line":"  API endpoint and if it is not possible, the service needs to be configured"},{"line_number":80,"context_line":"  with the SSL certificate used by the HAProxy."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"- We will use a self-signed certificate by default. We will use openssl to"},{"line_number":83,"context_line":"  manage them so that means that we will add a dependency to openssl if it is"}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_e9a1d0f8","line":80,"in_reply_to":"baada198_377a4024","updated":"2014-07-07 12:32:13.000000000","message":"Done","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"b6d74a94a087aad5981c2b303c99e84c466b03c5","unresolved":false,"context_lines":[{"line_number":85,"context_line":"  alternative CA with its private key from the user. This will be done if it"},{"line_number":86,"context_line":"  is supported by the Fuel UI."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"- In case of \"real\" HA where serveral HAProxy are deployed, we need to manage"},{"line_number":89,"context_line":"  the replication of certificates."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"- We need to ensure that each end user can retrieve the certificate if they"}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_b7bc90bc","line":88,"updated":"2014-07-07 12:09:03.000000000","message":"s/serveral/several/","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"4acc2e445239cf8fd5ab5f8ab70ee8bb668159fd","unresolved":false,"context_lines":[{"line_number":85,"context_line":"  alternative CA with its private key from the user. This will be done if it"},{"line_number":86,"context_line":"  is supported by the Fuel UI."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"- In case of \"real\" HA where serveral HAProxy are deployed, we need to manage"},{"line_number":89,"context_line":"  the replication of certificates."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"- We need to ensure that each end user can retrieve the certificate if they"}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_a9b3584b","line":88,"in_reply_to":"baada198_b7bc90bc","updated":"2014-07-07 12:32:13.000000000","message":"Done","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"b6d74a94a087aad5981c2b303c99e84c466b03c5","unresolved":false,"context_lines":[{"line_number":109,"context_line":"   Pros:"},{"line_number":110,"context_line":"      - It enables SSL on both, public and internal APIs. That means that we"},{"line_number":111,"context_line":"        don\u0027t need to be concerned with enpoint is being used be each"},{"line_number":112,"context_line":"        OpenStack service."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"Data model impact"},{"line_number":115,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_b71810d4","line":112,"updated":"2014-07-07 12:09:03.000000000","message":"your last sentence is a bit weird...","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"4acc2e445239cf8fd5ab5f8ab70ee8bb668159fd","unresolved":false,"context_lines":[{"line_number":109,"context_line":"   Pros:"},{"line_number":110,"context_line":"      - It enables SSL on both, public and internal APIs. That means that we"},{"line_number":111,"context_line":"        don\u0027t need to be concerned with enpoint is being used be each"},{"line_number":112,"context_line":"        OpenStack service."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"Data model impact"},{"line_number":115,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_0958c4f8","line":112,"in_reply_to":"baada198_b71810d4","updated":"2014-07-07 12:32:13.000000000","message":"It\u0027s Monday and the beginning of the week is not so smooth... I just failed to copy/paste another sentence...\nI fixed it.","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"b6d74a94a087aad5981c2b303c99e84c466b03c5","unresolved":false,"context_lines":[{"line_number":130,"context_line":"---------------"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"By using SSL/TLS over HTTP services, we will be able to provide a secure"},{"line_number":133,"context_line":"system with authentication, confidentiality and integrity."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"Notifications impact"},{"line_number":136,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_f7e9a8b7","line":133,"updated":"2014-07-07 12:09:03.000000000","message":"pls remove integrity.","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"4acc2e445239cf8fd5ab5f8ab70ee8bb668159fd","unresolved":false,"context_lines":[{"line_number":130,"context_line":"---------------"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"By using SSL/TLS over HTTP services, we will be able to provide a secure"},{"line_number":133,"context_line":"system with authentication, confidentiality and integrity."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"Notifications impact"},{"line_number":136,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_c9e08ccf","line":133,"in_reply_to":"baada198_f7e9a8b7","updated":"2014-07-07 12:32:13.000000000","message":"Done","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"b6d74a94a087aad5981c2b303c99e84c466b03c5","unresolved":false,"context_lines":[{"line_number":145,"context_line":"fair we will need to add some sort of monitoring to identify when a"},{"line_number":146,"context_line":"certificate is near to expire."},{"line_number":147,"context_line":"**Note**: If an end-user can upload its own certificate the delay can be"},{"line_number":148,"context_line":"short so in this case it\u0027s really better to monitor the expiry date."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"Performance Impact"},{"line_number":151,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_376b201f","line":148,"updated":"2014-07-07 12:09:03.000000000","message":"could you rewrite this section since it was agreed that monitoring the expiration dates is useful.","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"4acc2e445239cf8fd5ab5f8ab70ee8bb668159fd","unresolved":false,"context_lines":[{"line_number":145,"context_line":"fair we will need to add some sort of monitoring to identify when a"},{"line_number":146,"context_line":"certificate is near to expire."},{"line_number":147,"context_line":"**Note**: If an end-user can upload its own certificate the delay can be"},{"line_number":148,"context_line":"short so in this case it\u0027s really better to monitor the expiry date."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"Performance Impact"},{"line_number":151,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_09e7e4e4","line":148,"in_reply_to":"baada198_376b201f","updated":"2014-07-07 12:32:13.000000000","message":"Done","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"b6d74a94a087aad5981c2b303c99e84c466b03c5","unresolved":false,"context_lines":[{"line_number":202,"context_line":"    - ceilometer"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"  Puppet\u0027s manifests of most of them are supporting the possibility of"},{"line_number":205,"context_line":"  specifying SSL certificate. If it is not the case we will need to add it."},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"  Horizon is not part of this blueprint because it doesn\u0027t expose any APIs."},{"line_number":208,"context_line":"  The work to enable SSL is done in another blueprint."}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_37524067","line":205,"updated":"2014-07-07 12:09:03.000000000","message":"Is it relevant since OpenStack services won\u0027t be configured with SSL certificates?","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"4acc2e445239cf8fd5ab5f8ab70ee8bb668159fd","unresolved":false,"context_lines":[{"line_number":202,"context_line":"    - ceilometer"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"  Puppet\u0027s manifests of most of them are supporting the possibility of"},{"line_number":205,"context_line":"  specifying SSL certificate. If it is not the case we will need to add it."},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"  Horizon is not part of this blueprint because it doesn\u0027t expose any APIs."},{"line_number":208,"context_line":"  The work to enable SSL is done in another blueprint."}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_e99b9015","line":205,"in_reply_to":"baada198_37524067","updated":"2014-07-07 12:32:13.000000000","message":"If we cannot specify an internal URL for all OSt services to be sure that they won\u0027t use the public URL then the solution could be to configure them to use SSL for the public URL. I need to check if all OSt services can be forced to use a specific internal URL (if they don\u0027t already use it).","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"ff9cf03b501cd7b5f0fe740f5c331471dd2c81e5","unresolved":false,"context_lines":[{"line_number":202,"context_line":"    - ceilometer"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"  Puppet\u0027s manifests of most of them are supporting the possibility of"},{"line_number":205,"context_line":"  specifying SSL certificate. If it is not the case we will need to add it."},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"  Horizon is not part of this blueprint because it doesn\u0027t expose any APIs."},{"line_number":208,"context_line":"  The work to enable SSL is done in another blueprint."}],"source_content_type":"text/x-rst","patch_set":11,"id":"baada198_3fb3f698","line":205,"in_reply_to":"baada198_e99b9015","updated":"2014-07-07 13:16:50.000000000","message":"I modified the sentence.","commit_id":"56c0ed30d9f7a71f6cdb25294045bc8dbb74b6a9"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"0308b0c5194ee184b1143047c767adeed4ade7cc","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"OpenStack services receive requests from public networks that are untrusted"},{"line_number":14,"context_line":"area. As network path between the end-users and the OpenStack services is"},{"line_number":15,"context_line":"untrusted, the encrytion is required to ensure confidentiality."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"We achieve this by implementing Secure Sockets Layer as recommended in the"},{"line_number":18,"context_line":"OpenStack security guider."}],"source_content_type":"text/x-rst","patch_set":12,"id":"baada198_8f884d72","line":15,"updated":"2014-07-07 15:48:10.000000000","message":"\u0027As the network path...\u0027 \u0027s/the encrytion/encryption/\u0027","commit_id":"7f70617cbe4231a03cdf05c136dfccdb6b1b1eec"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"c07fb7a63928e601e69df4d972701a146975b17b","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"OpenStack services receive requests from public networks that are untrusted"},{"line_number":14,"context_line":"area. As network path between the end-users and the OpenStack services is"},{"line_number":15,"context_line":"untrusted, the encrytion is required to ensure confidentiality."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"We achieve this by implementing Secure Sockets Layer as recommended in the"},{"line_number":18,"context_line":"OpenStack security guider."}],"source_content_type":"text/x-rst","patch_set":12,"id":"baada198_958e9a2c","line":15,"in_reply_to":"baada198_8f884d72","updated":"2014-07-07 16:42:19.000000000","message":"Done","commit_id":"7f70617cbe4231a03cdf05c136dfccdb6b1b1eec"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"0308b0c5194ee184b1143047c767adeed4ade7cc","unresolved":false,"context_lines":[{"line_number":91,"context_line":""},{"line_number":92,"context_line":"- We need to ensure that each end user can retrieve the certificate if they"},{"line_number":93,"context_line":"  want to use a CLI (for example nova CLI) to interact with OpenStack"},{"line_number":94,"context_line":"  services."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":12,"id":"baada198_effb89be","line":94,"updated":"2014-07-07 15:48:10.000000000","message":"I would recommend that this be a documentation action, not a code action. If a self-signed certificate is used then the user can export it from the browser, or retrieve it through some other standard cli method (curl, openssl, etc).","commit_id":"7f70617cbe4231a03cdf05c136dfccdb6b1b1eec"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"c07fb7a63928e601e69df4d972701a146975b17b","unresolved":false,"context_lines":[{"line_number":91,"context_line":""},{"line_number":92,"context_line":"- We need to ensure that each end user can retrieve the certificate if they"},{"line_number":93,"context_line":"  want to use a CLI (for example nova CLI) to interact with OpenStack"},{"line_number":94,"context_line":"  services."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":12,"id":"baada198_d5b2d2e3","line":94,"in_reply_to":"baada198_effb89be","updated":"2014-07-07 16:42:19.000000000","message":"Right. I moved this section into Doc Impact.","commit_id":"7f70617cbe4231a03cdf05c136dfccdb6b1b1eec"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"dbc003e486cd7d81a3754bedd281db07a5633ae4","unresolved":false,"context_lines":[{"line_number":15,"context_line":"untrusted, encrytion is required to ensure confidentiality."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"We achieve this by implementing Secure Sockets Layer as recommended in the"},{"line_number":18,"context_line":"OpenStack security guider."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Proposed change"},{"line_number":21,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":13,"id":"baada198_68111a5c","line":18,"updated":"2014-07-08 08:08:05.000000000","message":"s/guider/guide/","commit_id":"25e05ccfc75d66fd852b35dd36f251792432d0ed"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"a51141206a96c69e630ad5f22748e3bbb8e47be3","unresolved":false,"context_lines":[{"line_number":15,"context_line":"untrusted, encrytion is required to ensure confidentiality."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"We achieve this by implementing Secure Sockets Layer as recommended in the"},{"line_number":18,"context_line":"OpenStack security guider."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Proposed change"},{"line_number":21,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":13,"id":"baada198_94c68398","line":18,"in_reply_to":"baada198_68111a5c","updated":"2014-07-08 10:25:11.000000000","message":"Done","commit_id":"25e05ccfc75d66fd852b35dd36f251792432d0ed"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"dbc003e486cd7d81a3754bedd281db07a5633ae4","unresolved":false,"context_lines":[{"line_number":59,"context_line":""},{"line_number":60,"context_line":"Even if it is recommended that an OpenStack service communicate to another"},{"line_number":61,"context_line":"OpenStack service by using the internal API endpoint, in practice many"},{"line_number":62,"context_line":"services use the public endpoint. For these reason we need to explicitly"},{"line_number":63,"context_line":"configure all OpenStack services to use the internal API endpoint when"},{"line_number":64,"context_line":"communicating with other services. If a project doesn\u0027t offer this"},{"line_number":65,"context_line":"possibility we will then configure the service with the correct CA"}],"source_content_type":"text/x-rst","patch_set":13,"id":"baada198_3b2cca98","line":62,"updated":"2014-07-08 08:08:05.000000000","message":"s/these/this/","commit_id":"25e05ccfc75d66fd852b35dd36f251792432d0ed"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"a51141206a96c69e630ad5f22748e3bbb8e47be3","unresolved":false,"context_lines":[{"line_number":59,"context_line":""},{"line_number":60,"context_line":"Even if it is recommended that an OpenStack service communicate to another"},{"line_number":61,"context_line":"OpenStack service by using the internal API endpoint, in practice many"},{"line_number":62,"context_line":"services use the public endpoint. For these reason we need to explicitly"},{"line_number":63,"context_line":"configure all OpenStack services to use the internal API endpoint when"},{"line_number":64,"context_line":"communicating with other services. If a project doesn\u0027t offer this"},{"line_number":65,"context_line":"possibility we will then configure the service with the correct CA"}],"source_content_type":"text/x-rst","patch_set":13,"id":"baada198_343db78f","line":62,"in_reply_to":"baada198_3b2cca98","updated":"2014-07-08 10:25:11.000000000","message":"Done","commit_id":"25e05ccfc75d66fd852b35dd36f251792432d0ed"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"dbc003e486cd7d81a3754bedd281db07a5633ae4","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Even if it is recommended that an OpenStack service communicate to another"},{"line_number":61,"context_line":"OpenStack service by using the internal API endpoint, in practice many"},{"line_number":62,"context_line":"services use the public endpoint. For these reason we need to explicitly"},{"line_number":63,"context_line":"configure all OpenStack services to use the internal API endpoint when"},{"line_number":64,"context_line":"communicating with other services. If a project doesn\u0027t offer this"},{"line_number":65,"context_line":"possibility we will then configure the service with the correct CA"},{"line_number":66,"context_line":"for authentication."}],"source_content_type":"text/x-rst","patch_set":13,"id":"baada198_fb5b321f","line":63,"updated":"2014-07-08 08:08:05.000000000","message":"maybe replace by: \"configure all Openstack services using the Keystone service catalog to use the internal API endpoint\" to emphasize that not all services are concerned.\nFor instance, a service like Nova uses the parameter \"neutron_url\" to connect to the Neutron server and Fuel already sets this value using the management IP address.","commit_id":"25e05ccfc75d66fd852b35dd36f251792432d0ed"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"a51141206a96c69e630ad5f22748e3bbb8e47be3","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Even if it is recommended that an OpenStack service communicate to another"},{"line_number":61,"context_line":"OpenStack service by using the internal API endpoint, in practice many"},{"line_number":62,"context_line":"services use the public endpoint. For these reason we need to explicitly"},{"line_number":63,"context_line":"configure all OpenStack services to use the internal API endpoint when"},{"line_number":64,"context_line":"communicating with other services. If a project doesn\u0027t offer this"},{"line_number":65,"context_line":"possibility we will then configure the service with the correct CA"},{"line_number":66,"context_line":"for authentication."}],"source_content_type":"text/x-rst","patch_set":13,"id":"baada198_caf05693","line":63,"in_reply_to":"baada198_fb5b321f","updated":"2014-07-08 10:25:11.000000000","message":"Done","commit_id":"25e05ccfc75d66fd852b35dd36f251792432d0ed"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"dbc003e486cd7d81a3754bedd281db07a5633ae4","unresolved":false,"context_lines":[{"line_number":218,"context_line":"API public endpoints, we need to document how to get this certificate if an"},{"line_number":219,"context_line":"end-user want to use a CLI (for example nova CLI) to interact with OpenStack"},{"line_number":220,"context_line":"services."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"References"},{"line_number":223,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":224,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"baada198_3eef581f","line":221,"updated":"2014-07-08 08:08:05.000000000","message":"When the end-user will be able to upload a certificate, the CN should comply with a few rules:\n- it should match with what is configured in Keystone (public URLs)\n- it should resolve to the expected IP address if it is a name","commit_id":"25e05ccfc75d66fd852b35dd36f251792432d0ed"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"a51141206a96c69e630ad5f22748e3bbb8e47be3","unresolved":false,"context_lines":[{"line_number":218,"context_line":"API public endpoints, we need to document how to get this certificate if an"},{"line_number":219,"context_line":"end-user want to use a CLI (for example nova CLI) to interact with OpenStack"},{"line_number":220,"context_line":"services."},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"References"},{"line_number":223,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":224,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"baada198_946f632a","line":221,"in_reply_to":"baada198_3eef581f","updated":"2014-07-08 10:25:11.000000000","message":"Done","commit_id":"25e05ccfc75d66fd852b35dd36f251792432d0ed"},{"author":{"_account_id":8954,"name":"Lukasz Oles","email":"loles@mirantis.com","username":"loles"},"change_message_id":"487ec46d37baa5c7f5901f63f85050add8871fd1","unresolved":false,"context_lines":[{"line_number":116,"context_line":"REST API impact"},{"line_number":117,"context_line":"---------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"None"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Upgrade impact"},{"line_number":122,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":16,"id":"1abeadc6_89650d20","line":119,"updated":"2014-08-20 14:08:11.000000000","message":"How do you want to add user certificate if not via API?","commit_id":"f8ddbe3681178606dbe384f3361ff227c2a25e2f"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"96ef3c4ac59cc76a08edfe898acaf0a878d3b632","unresolved":false,"context_lines":[{"line_number":116,"context_line":"REST API impact"},{"line_number":117,"context_line":"---------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"None"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Upgrade impact"},{"line_number":122,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":16,"id":"1abeadc6_41c9ea24","line":119,"in_reply_to":"1abeadc6_89650d20","updated":"2014-08-21 10:26:08.000000000","message":"Right. I added the fact that REST API should support the management of the CA.","commit_id":"f8ddbe3681178606dbe384f3361ff227c2a25e2f"},{"author":{"_account_id":8954,"name":"Lukasz Oles","email":"loles@mirantis.com","username":"loles"},"change_message_id":"487ec46d37baa5c7f5901f63f85050add8871fd1","unresolved":false,"context_lines":[{"line_number":119,"context_line":"None"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Upgrade impact"},{"line_number":122,"context_line":"--------------"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"None"},{"line_number":125,"context_line":""}],"source_content_type":"text/x-rst","patch_set":16,"id":"1abeadc6_8c019b07","line":122,"updated":"2014-08-20 14:08:11.000000000","message":"If you upgrade from deployed older version what will happen? Maybe we should upgrade env to use certificates?","commit_id":"f8ddbe3681178606dbe384f3361ff227c2a25e2f"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"96ef3c4ac59cc76a08edfe898acaf0a878d3b632","unresolved":false,"context_lines":[{"line_number":119,"context_line":"None"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Upgrade impact"},{"line_number":122,"context_line":"--------------"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"None"},{"line_number":125,"context_line":""}],"source_content_type":"text/x-rst","patch_set":16,"id":"1abeadc6_6138a6ef","line":122,"in_reply_to":"1abeadc6_8c019b07","updated":"2014-08-21 10:26:08.000000000","message":"I didn\u0027t think about it. I will add a note here to take into account the case of the update. Thanks for the highlight.","commit_id":"f8ddbe3681178606dbe384f3361ff227c2a25e2f"}],"specs/6.0/ssl-endpoints.rst":[{"author":{"_account_id":406,"name":"Mike Scherbakov","email":"mihgen@gmail.com","username":"mihgen"},"change_message_id":"1e130e6b0c7cecd80f1e0fec08d2ff72576429cc","unresolved":false,"context_lines":[{"line_number":27,"context_line":"public networks. Endpoints used for management and other services like"},{"line_number":28,"context_line":"messaging will not be done in this blueprint."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"We will use HAProxy and its support of SSL. The endpoints of public URLs"},{"line_number":31,"context_line":"will be configured with the IP or the name of the HAproxy. It will handle"},{"line_number":32,"context_line":"incoming SSL connections, decrypting the SSL and passing the unencrypted"},{"line_number":33,"context_line":"request to the corresponding service. That means that the communication"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_ff58988b","line":30,"updated":"2014-08-29 13:49:37.000000000","message":"We do not have HAProxy in simple deployment mode. If we are about implementing it using only in HA, then we should clearly state that this work absolutely depends on https://blueprints.launchpad.net/fuel/+spec/single-controller-ha to be done - otherwise simple mode would not work (or work without SSL).","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"0c8e599eccf046b47f9f16541f430552864347d0","unresolved":false,"context_lines":[{"line_number":27,"context_line":"public networks. Endpoints used for management and other services like"},{"line_number":28,"context_line":"messaging will not be done in this blueprint."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"We will use HAProxy and its support of SSL. The endpoints of public URLs"},{"line_number":31,"context_line":"will be configured with the IP or the name of the HAproxy. It will handle"},{"line_number":32,"context_line":"incoming SSL connections, decrypting the SSL and passing the unencrypted"},{"line_number":33,"context_line":"request to the corresponding service. That means that the communication"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_b0d2cf59","line":30,"in_reply_to":"1abeadc6_ff58988b","updated":"2014-08-29 16:04:49.000000000","message":"My first thought is that we are using it only in HA because when SSL will be released fuel should be in single controller HA mode. The reason is that simpler to just modify the puppet manifest instead of modify the logic if we want to run with a simple mode deployment. We need to change the logic because HAProxy needs to be deployed in simple mode and it is not the case right now. So we can manage the case of simple node but as this mode will disappear and as it added complexity I think that a better solution is to add a dependency on the BP you mentioned. Should I just add the dependency in the dependency tree or should I also add a note here?","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":406,"name":"Mike Scherbakov","email":"mihgen@gmail.com","username":"mihgen"},"change_message_id":"1e130e6b0c7cecd80f1e0fec08d2ff72576429cc","unresolved":false,"context_lines":[{"line_number":58,"context_line":"                                                           OSt service"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"Even if it is recommended that an OpenStack service communicate to another"},{"line_number":61,"context_line":"OpenStack service by using the internal API endpoint, in practice many"},{"line_number":62,"context_line":"services use the public endpoint. For this reason we need to explicitly"},{"line_number":63,"context_line":"configure all OpenStack services using Keystone service catalog to use"},{"line_number":64,"context_line":"the internal API endpoint when communicating with other services. If a"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_ffe6d8ae","line":61,"updated":"2014-08-29 13:49:37.000000000","message":"do we have such \"practice\" in Fuel? If so, can you please specify those services? Also, if there is a way to reconfigure them to use management network - I believe we should file bugs about it.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"0c8e599eccf046b47f9f16541f430552864347d0","unresolved":false,"context_lines":[{"line_number":58,"context_line":"                                                           OSt service"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"Even if it is recommended that an OpenStack service communicate to another"},{"line_number":61,"context_line":"OpenStack service by using the internal API endpoint, in practice many"},{"line_number":62,"context_line":"services use the public endpoint. For this reason we need to explicitly"},{"line_number":63,"context_line":"configure all OpenStack services using Keystone service catalog to use"},{"line_number":64,"context_line":"the internal API endpoint when communicating with other services. If a"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_d0bf4bce","line":61,"in_reply_to":"1abeadc6_ffe6d8ae","updated":"2014-08-29 16:04:49.000000000","message":"Horizon is using the public endpoint to request the keystone catalog. I think that other services are okay but I need to be double checked.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":406,"name":"Mike Scherbakov","email":"mihgen@gmail.com","username":"mihgen"},"change_message_id":"1e130e6b0c7cecd80f1e0fec08d2ff72576429cc","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"- Install at least the version 1.5.0 of HAProxy because the support of"},{"line_number":72,"context_line":"  SSL is available since this version. As it is not available in Ubuntu (and"},{"line_number":73,"context_line":"  probably it is the same for CentOS) we will need to rebuild it."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"- Configure HAProxy to manage SSL connections and to forward the request to"},{"line_number":76,"context_line":"  the corresponding service."}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_bf9700eb","line":73,"updated":"2014-08-29 13:49:37.000000000","message":"Please link LP task for it.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"0c8e599eccf046b47f9f16541f430552864347d0","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"- Install at least the version 1.5.0 of HAProxy because the support of"},{"line_number":72,"context_line":"  SSL is available since this version. As it is not available in Ubuntu (and"},{"line_number":73,"context_line":"  probably it is the same for CentOS) we will need to rebuild it."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"- Configure HAProxy to manage SSL connections and to forward the request to"},{"line_number":76,"context_line":"  the corresponding service."}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_b0a3afb0","line":73,"in_reply_to":"1abeadc6_bf9700eb","updated":"2014-08-29 16:04:49.000000000","message":"I will add https://bugs.launchpad.net/fuel/+bug/1346365/","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":406,"name":"Mike Scherbakov","email":"mihgen@gmail.com","username":"mihgen"},"change_message_id":"1e130e6b0c7cecd80f1e0fec08d2ff72576429cc","unresolved":false,"context_lines":[{"line_number":80,"context_line":"  configured with the SSL certificate (if self-signed) or the certification"},{"line_number":81,"context_line":"  authority\u0027s certificate used by HAProxy."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"- We will use a self-signed certificate by default. We will use openssl to"},{"line_number":84,"context_line":"  manage them so that means that we will add a dependency to openssl if it is"},{"line_number":85,"context_line":"  not already the case. We also need to provide the ability to upload an"},{"line_number":86,"context_line":"  alternative CA with its private key from the user. This will be done if it"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_3f0e903b","line":83,"updated":"2014-08-29 13:49:37.000000000","message":"Is it secure to use self-signed certificates? What is the best practice here? Can you provide any links to best practice in this area?","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":11827,"name":"Stanislaw Bogatkin","email":"regs+ubuntu.com@sbog.ru","username":"sbogatkin"},"change_message_id":"4c73086d6e29964ae365d213cfef1476d387fa55","unresolved":false,"context_lines":[{"line_number":80,"context_line":"  configured with the SSL certificate (if self-signed) or the certification"},{"line_number":81,"context_line":"  authority\u0027s certificate used by HAProxy."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"- We will use a self-signed certificate by default. We will use openssl to"},{"line_number":84,"context_line":"  manage them so that means that we will add a dependency to openssl if it is"},{"line_number":85,"context_line":"  not already the case. We also need to provide the ability to upload an"},{"line_number":86,"context_line":"  alternative CA with its private key from the user. This will be done if it"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_9d1d9676","line":83,"in_reply_to":"1abeadc6_2b2812e1","updated":"2014-09-01 08:37:28.000000000","message":"It is some difference between self-signed and CA signed certs, cause different software treat self-signed certs differently. As an example, if browser sees self-signed cert, then popup warning window will be displayed. Some mail clients will not work with imaps, if they don\u0027t have cert that have basicConstraints\u003dtrue field in it (or if subject\u003dissuer - it is main attribute of self-signed cert). We need to check, how it will work with openstack services.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"0c8e599eccf046b47f9f16541f430552864347d0","unresolved":false,"context_lines":[{"line_number":80,"context_line":"  configured with the SSL certificate (if self-signed) or the certification"},{"line_number":81,"context_line":"  authority\u0027s certificate used by HAProxy."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"- We will use a self-signed certificate by default. We will use openssl to"},{"line_number":84,"context_line":"  manage them so that means that we will add a dependency to openssl if it is"},{"line_number":85,"context_line":"  not already the case. We also need to provide the ability to upload an"},{"line_number":86,"context_line":"  alternative CA with its private key from the user. This will be done if it"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_2b2812e1","line":83,"in_reply_to":"1abeadc6_3f0e903b","updated":"2014-08-29 16:04:49.000000000","message":"In terms of encryption it is the same. Self-signed certificates aren\u0027t less \"secure\" but end-users have to assume that they are genuine.\nIf we don\u0027t want to use self-signed certificate generated by fuel, the customer will have to provide it before deploying the cluster. And to generate the certificate, the customer needs to know the public VIP address (or name). As long as the user can upload its own certificate to override the self-signed certificate we are good. It\u0027s like when you deploy fuel for the first time, it comes with the default root password and you are strongly encouraged to change it ).\n\nI will rephrase this paragraph.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"e7d4d9d95aeeeca7ff58f80b1c7281f6a5aadccb","unresolved":false,"context_lines":[{"line_number":80,"context_line":"  configured with the SSL certificate (if self-signed) or the certification"},{"line_number":81,"context_line":"  authority\u0027s certificate used by HAProxy."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"- We will use a self-signed certificate by default. We will use openssl to"},{"line_number":84,"context_line":"  manage them so that means that we will add a dependency to openssl if it is"},{"line_number":85,"context_line":"  not already the case. We also need to provide the ability to upload an"},{"line_number":86,"context_line":"  alternative CA with its private key from the user. This will be done if it"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_91301d58","line":83,"in_reply_to":"fa98f980_9d1d9676","updated":"2014-09-01 09:50:22.000000000","message":"I added a note in the end user impact about the popup of the warning window. I also added a not in this section to check that OpenStack services behaves the same with a self-signed cert and CA cert.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":406,"name":"Mike Scherbakov","email":"mihgen@gmail.com","username":"mihgen"},"change_message_id":"1e130e6b0c7cecd80f1e0fec08d2ff72576429cc","unresolved":false,"context_lines":[{"line_number":84,"context_line":"  manage them so that means that we will add a dependency to openssl if it is"},{"line_number":85,"context_line":"  not already the case. We also need to provide the ability to upload an"},{"line_number":86,"context_line":"  alternative CA with its private key from the user. This will be done if it"},{"line_number":87,"context_line":"  is supported by the Fuel UI."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"- In case of \"real\" HA where several HAProxy are deployed. We need to be able"},{"line_number":90,"context_line":"  to distribute the certificate. If it is a self-signed certificate it will be"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_3f605000","line":87,"updated":"2014-08-29 13:49:37.000000000","message":"We can support it such uploading of a key via UI. Let\u0027s get a clear statement here, whether it becomes part of the blueprint or not.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"0c8e599eccf046b47f9f16541f430552864347d0","unresolved":false,"context_lines":[{"line_number":84,"context_line":"  manage them so that means that we will add a dependency to openssl if it is"},{"line_number":85,"context_line":"  not already the case. We also need to provide the ability to upload an"},{"line_number":86,"context_line":"  alternative CA with its private key from the user. This will be done if it"},{"line_number":87,"context_line":"  is supported by the Fuel UI."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"- In case of \"real\" HA where several HAProxy are deployed. We need to be able"},{"line_number":90,"context_line":"  to distribute the certificate. If it is a self-signed certificate it will be"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_cbccfe37","line":87,"in_reply_to":"1abeadc6_3f605000","updated":"2014-08-29 16:04:49.000000000","message":"Okay. I will remove the \"This will be done if it is supported by the fuel UI.\"","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":406,"name":"Mike Scherbakov","email":"mihgen@gmail.com","username":"mihgen"},"change_message_id":"1e130e6b0c7cecd80f1e0fec08d2ff72576429cc","unresolved":false,"context_lines":[{"line_number":88,"context_line":""},{"line_number":89,"context_line":"- In case of \"real\" HA where several HAProxy are deployed. We need to be able"},{"line_number":90,"context_line":"  to distribute the certificate. If it is a self-signed certificate it will be"},{"line_number":91,"context_line":"  generated by the fuel master and distributed to all nodes that run HAProxy."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Alternatives"},{"line_number":94,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_1a7002a3","line":91,"updated":"2014-08-29 13:49:37.000000000","message":"Let\u0027s consider and answer the following questions:\n* how are we going to generate certs, is it gonna be done by nailgun? Or by astute during deployment?\n* are you planning to use upload_file feature of astute to deliver certificate in a before deployment phase?\n* where certs will be stored? What happens if we remove one controller from env, and then we add new one? Will the new one get new cert, or old one will be propagated?","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"0c8e599eccf046b47f9f16541f430552864347d0","unresolved":false,"context_lines":[{"line_number":88,"context_line":""},{"line_number":89,"context_line":"- In case of \"real\" HA where several HAProxy are deployed. We need to be able"},{"line_number":90,"context_line":"  to distribute the certificate. If it is a self-signed certificate it will be"},{"line_number":91,"context_line":"  generated by the fuel master and distributed to all nodes that run HAProxy."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Alternatives"},{"line_number":94,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_af97cd38","line":91,"in_reply_to":"1abeadc6_1a7002a3","updated":"2014-08-29 16:04:49.000000000","message":"We have to know the VIP address of the cluster to generate the certificate because a certificate is related to it.\n\nThe certificate will be generated by astute and store somewhere on the fuel master file system with appropriate permissions (maybe in /var/lib/astute).\n\nTo distribute the certificate I think that we can use the upload_file feature of astute but I\u0027m not familiar enough with astute.\n\nThe certificate is related to a cluster (as it is \"linked\" its VIP) so if a controller is added to the cluster we just reuse the certificate \"stored\" somewhere on the fuel master.\n\nHere is the idea but I\u0027m not familiar enough with astute so it could be interesting if astute\u0027s devs have some opinions but I really think that it is close to the mechanism that \"generate_ssh_keys\".","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":11827,"name":"Stanislaw Bogatkin","email":"regs+ubuntu.com@sbog.ru","username":"sbogatkin"},"change_message_id":"4c73086d6e29964ae365d213cfef1476d387fa55","unresolved":false,"context_lines":[{"line_number":88,"context_line":""},{"line_number":89,"context_line":"- In case of \"real\" HA where several HAProxy are deployed. We need to be able"},{"line_number":90,"context_line":"  to distribute the certificate. If it is a self-signed certificate it will be"},{"line_number":91,"context_line":"  generated by the fuel master and distributed to all nodes that run HAProxy."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Alternatives"},{"line_number":94,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_8088c923","line":91,"in_reply_to":"1abeadc6_af97cd38","updated":"2014-09-01 08:37:28.000000000","message":"I don\u0027t think that it is good idea - relate cert to IP, cause if you will have different services on one ip station in future then you cannot distinguish them, cause certs will be assign to ip. Usually in this cases (usually in almost all cases, be honest) certs assign to dns name, cause it is convenient.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"e7d4d9d95aeeeca7ff58f80b1c7281f6a5aadccb","unresolved":false,"context_lines":[{"line_number":88,"context_line":""},{"line_number":89,"context_line":"- In case of \"real\" HA where several HAProxy are deployed. We need to be able"},{"line_number":90,"context_line":"  to distribute the certificate. If it is a self-signed certificate it will be"},{"line_number":91,"context_line":"  generated by the fuel master and distributed to all nodes that run HAProxy."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Alternatives"},{"line_number":94,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_b1b441f3","line":91,"in_reply_to":"fa98f980_8088c923","updated":"2014-09-01 09:50:22.000000000","message":"I agree with this remark and the fact that it is better to have a certificate related to a dns name. My concern here is that I don\u0027t really know if it\u0027s easy to setup a dns name corresponding to the VIP when deploying the cluster. Currently their is no dns name associated to the VIP right?\n\nI will add a note in the next version about this point to discuss about it.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":406,"name":"Mike Scherbakov","email":"mihgen@gmail.com","username":"mihgen"},"change_message_id":"1e130e6b0c7cecd80f1e0fec08d2ff72576429cc","unresolved":false,"context_lines":[{"line_number":117,"context_line":"---------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The REST API needs to be modified to allow a user to add and update its"},{"line_number":120,"context_line":"certificate. Certificate must be spread on all controllers."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"Upgrade impact"},{"line_number":123,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_5a6fda91","line":120,"updated":"2014-08-29 13:49:37.000000000","message":"Where do we want this in UI? Settings tab? What if we forgot to upload certificate, should we fail deployment? Do we want any check being done by Nailgun to verify that certificate is actually valid?","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":11827,"name":"Stanislaw Bogatkin","email":"regs+ubuntu.com@sbog.ru","username":"sbogatkin"},"change_message_id":"4c73086d6e29964ae365d213cfef1476d387fa55","unresolved":false,"context_lines":[{"line_number":117,"context_line":"---------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The REST API needs to be modified to allow a user to add and update its"},{"line_number":120,"context_line":"certificate. Certificate must be spread on all controllers."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"Upgrade impact"},{"line_number":123,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_c05ad182","line":120,"in_reply_to":"1abeadc6_323242f2","updated":"2014-09-01 08:37:28.000000000","message":"I think that we should have default value in UI that will say \"autogenerate SSL certs\" and will checked by default. If user need to upload cert from himself - then he will need to manually uncheck this field and upload new cert.\nAnd yes - we need to check basic validity of cert before deployment, cause if cert will be not valid (e.g. expired), then it will be strange to work with it (and if it will broken - then nothing will be work at all).","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"0c8e599eccf046b47f9f16541f430552864347d0","unresolved":false,"context_lines":[{"line_number":117,"context_line":"---------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The REST API needs to be modified to allow a user to add and update its"},{"line_number":120,"context_line":"certificate. Certificate must be spread on all controllers."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"Upgrade impact"},{"line_number":123,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_323242f2","line":120,"in_reply_to":"1abeadc6_5a6fda91","updated":"2014-08-29 16:04:49.000000000","message":"In fact we don\u0027t absolutely need to upload a certificate since by default there is a default self-signed CA that allows the deployment. Having said that user certainly want to be able to download a new CA for a given cluster but it is not in the scope of this BP and yes, Nailgun should verify that it is a valid one.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"c1bc88de55fa1ffdf1914f98cbcf0439980c68f2","unresolved":false,"context_lines":[{"line_number":117,"context_line":"---------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The REST API needs to be modified to allow a user to add and update its"},{"line_number":120,"context_line":"certificate. Certificate must be spread on all controllers."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"Upgrade impact"},{"line_number":123,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_62f682d9","line":120,"in_reply_to":"fa98f980_145df821","updated":"2014-09-01 12:31:11.000000000","message":"Agreed with point 1 concerning the private keys. It should probably go to the \"Security impact\" section.\n\nWhat is the use case for supporting multiple SSL certificates per cluster?","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":11827,"name":"Stanislaw Bogatkin","email":"regs+ubuntu.com@sbog.ru","username":"sbogatkin"},"change_message_id":"90fd5477c64cdbcef23b29812a37c99a8d2d03c3","unresolved":false,"context_lines":[{"line_number":117,"context_line":"---------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The REST API needs to be modified to allow a user to add and update its"},{"line_number":120,"context_line":"certificate. Certificate must be spread on all controllers."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"Upgrade impact"},{"line_number":123,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_5534d7dd","line":120,"in_reply_to":"fa98f980_62f682d9","updated":"2014-09-01 13:37:14.000000000","message":"There are no use cases as I see that stuff. It depends from level of paranoia. Some people feels themselve okay with multihost cert (*.domain.com). Some people like when one service have one cert.\nMy love with CA and multiple certs is simple. You need to have you private key with certificate on that machine with which you will be speak on https. If you have one self-signed cert per cluster then you private key will be store everywhere you give access to service. If one of that machine will be compromised then all will be compromised and we will need to recreate private key and cert and replace it in all places of cluster when needed. But if we will use scheme with CA then we will place compromised key to CRL and replace one compromised key - and it\u0027s all.\n\nActually, we can implement self-signed certs by this blueprint and do CA scheme later, as I see that.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":11827,"name":"Stanislaw Bogatkin","email":"regs+ubuntu.com@sbog.ru","username":"sbogatkin"},"change_message_id":"90fd5477c64cdbcef23b29812a37c99a8d2d03c3","unresolved":false,"context_lines":[{"line_number":117,"context_line":"---------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The REST API needs to be modified to allow a user to add and update its"},{"line_number":120,"context_line":"certificate. Certificate must be spread on all controllers."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"Upgrade impact"},{"line_number":123,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_7548fb5b","line":120,"in_reply_to":"fa98f980_9d174bed","updated":"2014-09-01 13:37:14.000000000","message":"See to my previous comment.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":8749,"name":"Evgeniy L","email":"eli@mirantis.com","username":"evgeniyl"},"change_message_id":"3a7d295de6e809f7b17e040f7a5726a0da8f2283","unresolved":false,"context_lines":[{"line_number":117,"context_line":"---------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The REST API needs to be modified to allow a user to add and update its"},{"line_number":120,"context_line":"certificate. Certificate must be spread on all controllers."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"Upgrade impact"},{"line_number":123,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_f11fa907","line":120,"in_reply_to":"fa98f980_c05ad182","updated":"2014-09-01 10:15:26.000000000","message":"Hi, I have several points to be clarified and discussed\n\n1. SSL certificates are sensitive data, we should make sure that it won\u0027t be stored in logs and in db in case of diagnostic snapshot.\n\n2. How we can check if certificate is valid? If it some command in shell, then it depends on implementing of background tasks in nailgun\n\nhttps://blueprints.launchpad.net/fuel/+spec/nailgun-backgorund-tasks-to-deploy-thousands-of-nodes\n\n3. REST API should have description of future api, example of description\n\n    POST /api/v1/clusters/1/ssl_certificates\n\n    Example of json\n\n    GET /api/v1/clusters/1/ssl_certificates\n    GET /api/v1/clusters/1/ssl_certificates/2\n\n    Example of json\n\n    DELETE /api/v1/clusters/1/ssl_certificates\n\n4. does it make sense for cluster to have several different certificates? If it makes sense, we should implement it in api as collection of objects.\n\n5. where are we going to keep this data, will it be separate column in cluster\u0027s model or it will be cluster\u0027s attribute which is stored as json.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"e7d4d9d95aeeeca7ff58f80b1c7281f6a5aadccb","unresolved":false,"context_lines":[{"line_number":117,"context_line":"---------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The REST API needs to be modified to allow a user to add and update its"},{"line_number":120,"context_line":"certificate. Certificate must be spread on all controllers."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"Upgrade impact"},{"line_number":123,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_515f950e","line":120,"in_reply_to":"fa98f980_c05ad182","updated":"2014-09-01 09:50:22.000000000","message":"I added a note about the default value in the UI and also about the verification of the certificate that must be done. I don\u0027t have a strong opinion how to upload the certificate. I mean should we uncheck the default value. Why not...","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"69035169178746150e21954aa93af1d59108ecd3","unresolved":false,"context_lines":[{"line_number":117,"context_line":"---------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The REST API needs to be modified to allow a user to add and update its"},{"line_number":120,"context_line":"certificate. Certificate must be spread on all controllers."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"Upgrade impact"},{"line_number":123,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_9d174bed","line":120,"in_reply_to":"fa98f980_f11fa907","updated":"2014-09-01 12:59:36.000000000","message":"1. I added a note about SSL certificates that are sensitive data and we should make sure that it won\u0027t be stored in logs and in db in case of diagnostic snapshot.\n\n2. With shell commands we need to check the DNS name or VIP that is used and we must check the expiration date.\n\n4. I\u0027m not sure the it makes sense. Any use case in mind?\n\n5. I\u0027m not sure to understand. The certificate should be downloaded into a file on the fuel master node. As you said in 1., I should not be store in any databases. If you are asking about the path of the SSL cert I don\u0027t know what is the best place. Need to be checked.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":11827,"name":"Stanislaw Bogatkin","email":"regs+ubuntu.com@sbog.ru","username":"sbogatkin"},"change_message_id":"a125951d3cabc569511092c6f917d3dbe1c95161","unresolved":false,"context_lines":[{"line_number":117,"context_line":"---------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The REST API needs to be modified to allow a user to add and update its"},{"line_number":120,"context_line":"certificate. Certificate must be spread on all controllers."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"Upgrade impact"},{"line_number":123,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_145df821","line":120,"in_reply_to":"fa98f980_f11fa907","updated":"2014-09-01 11:14:15.000000000","message":"2. It depends from what we will check, but in common case - yes, it is some shell command\n4. It depends. I think that yes, but we can do one sertificate now and many of them when we will implement full-fledged PKI.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":406,"name":"Mike Scherbakov","email":"mihgen@gmail.com","username":"mihgen"},"change_message_id":"1e130e6b0c7cecd80f1e0fec08d2ff72576429cc","unresolved":false,"context_lines":[{"line_number":123,"context_line":"--------------"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"When an upgrade occurs we need to be sure that certificates that are in use"},{"line_number":126,"context_line":"are still valid in the new environment."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Security impact"},{"line_number":129,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_fac8a6a9","line":126,"updated":"2014-08-29 13:49:37.000000000","message":"What is going to happen if we upgrade Fuel 5.1 -\u003e 6.0, and 6.0 has SSL for OpenStack. how would it affect deployments of additional nodes in old 5.1 env, which doesn\u0027t yet have SSL?\nAlso, would it affect Patching of OpenStack feature anyhow?","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":8749,"name":"Evgeniy L","email":"eli@mirantis.com","username":"evgeniyl"},"change_message_id":"3a7d295de6e809f7b17e040f7a5726a0da8f2283","unresolved":false,"context_lines":[{"line_number":123,"context_line":"--------------"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"When an upgrade occurs we need to be sure that certificates that are in use"},{"line_number":126,"context_line":"are still valid in the new environment."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Security impact"},{"line_number":129,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_8c9ac212","line":126,"in_reply_to":"1abeadc6_b258128b","updated":"2014-09-01 10:15:26.000000000","message":"Here are several statements and facts about upgrades\n\n1. astute should know nothing about certificates, all the information should come from nailgun, astute can execute some command on nodes or upload some files\n\n2. for cluster configuration we have json [1], which is stored in database and which has relation with cluster model, we don\u0027t change this json in cluster\u0027s model during the upgrade, unless data migration wasn\u0027t written [2]\n\n[1] https://github.com/stackforge/fuel-web/blob/bbe6c4acca6c3f7b41cfd6b161d603b26be7f03f/nailgun/nailgun/fixtures/openstack.yaml#L137-L513\n\n[2] https://github.com/stackforge/fuel-web/blob/bbe6c4acca6c3f7b41cfd6b161d603b26be7f03f/nailgun/nailgun/db/migration/alembic_migrations/versions/fuel_5_1.py#L184-L218\n\n3. to manage previous clusters, nailgun uses previous version of puppet manifests, so, it\u0027s not required for puppet to handle both cases, from upgrade point of view","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"0c8e599eccf046b47f9f16541f430552864347d0","unresolved":false,"context_lines":[{"line_number":123,"context_line":"--------------"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"When an upgrade occurs we need to be sure that certificates that are in use"},{"line_number":126,"context_line":"are still valid in the new environment."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Security impact"},{"line_number":129,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_b258128b","line":126,"in_reply_to":"1abeadc6_fac8a6a9","updated":"2014-08-29 16:04:49.000000000","message":"6.0 or 6.1 for the support of SSL )\nGood question.... \nOne solution could be to manage both deployment in the puppet manifest. It need to be check but here is a possible scenario. During an update the astute.yaml is generated. As it is an update and not a creation there is no certificate. So astute can detect this and pass a parameter into the yaml file to specify that SSL is not supported. That means that you need to manage this in the puppet file. \n\nDoes it make sense?","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"69035169178746150e21954aa93af1d59108ecd3","unresolved":false,"context_lines":[{"line_number":123,"context_line":"--------------"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"When an upgrade occurs we need to be sure that certificates that are in use"},{"line_number":126,"context_line":"are still valid in the new environment."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Security impact"},{"line_number":129,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_3da3bf9f","line":126,"in_reply_to":"fa98f980_8c9ac212","updated":"2014-09-01 12:59:36.000000000","message":"1. Yes right I mixed up astute and nailgun. So Nailgun can detect if it is a new env and it can add a parameter ssl_cert_path.\n\n2. I\u0027m not sure to understand your comment.\n\n3. So if I understand correctly when an upgrade occurs you have two different versions of puppet manifest. One version for old 5.1 and a new one for 6.0. So if you add a new node into an old environment it is old manifests that will be used. So upgrade should be OK.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":406,"name":"Mike Scherbakov","email":"mihgen@gmail.com","username":"mihgen"},"change_message_id":"1e130e6b0c7cecd80f1e0fec08d2ff72576429cc","unresolved":false,"context_lines":[{"line_number":134,"context_line":"Notifications impact"},{"line_number":135,"context_line":"--------------------"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"None"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Other end user impact"},{"line_number":140,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_da0a0ad1","line":137,"updated":"2014-08-29 13:49:37.000000000","message":"Notification of \"Deployment is done. Please open your Horizon at.. . httpS..\"","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"69035169178746150e21954aa93af1d59108ecd3","unresolved":false,"context_lines":[{"line_number":134,"context_line":"Notifications impact"},{"line_number":135,"context_line":"--------------------"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"None"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Other end user impact"},{"line_number":140,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_fdfe976a","line":137,"in_reply_to":"1abeadc6_329162f1","updated":"2014-09-01 12:59:36.000000000","message":"As after thinking it seems normal to enable SSL in Horizon. So I will add a note to use https instead of http.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"0c8e599eccf046b47f9f16541f430552864347d0","unresolved":false,"context_lines":[{"line_number":134,"context_line":"Notifications impact"},{"line_number":135,"context_line":"--------------------"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"None"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Other end user impact"},{"line_number":140,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_329162f1","line":137,"in_reply_to":"1abeadc6_da0a0ad1","updated":"2014-08-29 16:04:49.000000000","message":"The case of SSL in Horizon is in fact another work done by Max Mazur I think. It is a little different because in this specs we are focusing on services that provides API.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":406,"name":"Mike Scherbakov","email":"mihgen@gmail.com","username":"mihgen"},"change_message_id":"1e130e6b0c7cecd80f1e0fec08d2ff72576429cc","unresolved":false,"context_lines":[{"line_number":139,"context_line":"Other end user impact"},{"line_number":140,"context_line":"---------------------"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"We generate certificate that ends ten years later. As an end user can upload"},{"line_number":143,"context_line":"its own certificate the delay can be shorter. Thus we need to monitor the"},{"line_number":144,"context_line":"expiration date of the certificate and must warn before it expires."},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_1a280232","line":142,"updated":"2014-08-29 13:49:37.000000000","message":"Do we generate certificate for the user? Where? how do we provide an ability for a user to download it?","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"0c8e599eccf046b47f9f16541f430552864347d0","unresolved":false,"context_lines":[{"line_number":139,"context_line":"Other end user impact"},{"line_number":140,"context_line":"---------------------"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"We generate certificate that ends ten years later. As an end user can upload"},{"line_number":143,"context_line":"its own certificate the delay can be shorter. Thus we need to monitor the"},{"line_number":144,"context_line":"expiration date of the certificate and must warn before it expires."},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_f278cac5","line":142,"in_reply_to":"1abeadc6_1a280232","updated":"2014-08-29 16:04:49.000000000","message":"I think that it is cover in the previous responses.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":406,"name":"Mike Scherbakov","email":"mihgen@gmail.com","username":"mihgen"},"change_message_id":"1e130e6b0c7cecd80f1e0fec08d2ff72576429cc","unresolved":false,"context_lines":[{"line_number":141,"context_line":""},{"line_number":142,"context_line":"We generate certificate that ends ten years later. As an end user can upload"},{"line_number":143,"context_line":"its own certificate the delay can be shorter. Thus we need to monitor the"},{"line_number":144,"context_line":"expiration date of the certificate and must warn before it expires."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"Performance Impact"},{"line_number":147,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_dad84a55","line":144,"updated":"2014-08-29 13:49:37.000000000","message":"How do we plan to do so (warn that certificate expires soon)?","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"0c8e599eccf046b47f9f16541f430552864347d0","unresolved":false,"context_lines":[{"line_number":141,"context_line":""},{"line_number":142,"context_line":"We generate certificate that ends ten years later. As an end user can upload"},{"line_number":143,"context_line":"its own certificate the delay can be shorter. Thus we need to monitor the"},{"line_number":144,"context_line":"expiration date of the certificate and must warn before it expires."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"Performance Impact"},{"line_number":147,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_953ce094","line":144,"in_reply_to":"1abeadc6_dad84a55","updated":"2014-08-29 16:04:49.000000000","message":"I think about something like created a crontab when a CA is downloaded according to the date of expiration. The crontab will generate a message in fuel log. Does it make sense?","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":406,"name":"Mike Scherbakov","email":"mihgen@gmail.com","username":"mihgen"},"change_message_id":"1e130e6b0c7cecd80f1e0fec08d2ff72576429cc","unresolved":false,"context_lines":[{"line_number":163,"context_line":""},{"line_number":164,"context_line":"Maybe a default self-signed certificate must be deployed on the fuel master"},{"line_number":165,"context_line":"in order to be able to do the first setup. The certificate could then be"},{"line_number":166,"context_line":"overwritten by one chosen by the user with the REST API (see REST API impact)."},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"Developer impact"},{"line_number":169,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_7ac65669","line":166,"updated":"2014-08-29 13:49:37.000000000","message":"Why would we do so? In case if user doesn\u0027t have certificate yet? It is actually good question...","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":11827,"name":"Stanislaw Bogatkin","email":"regs+ubuntu.com@sbog.ru","username":"sbogatkin"},"change_message_id":"4c73086d6e29964ae365d213cfef1476d387fa55","unresolved":false,"context_lines":[{"line_number":163,"context_line":""},{"line_number":164,"context_line":"Maybe a default self-signed certificate must be deployed on the fuel master"},{"line_number":165,"context_line":"in order to be able to do the first setup. The certificate could then be"},{"line_number":166,"context_line":"overwritten by one chosen by the user with the REST API (see REST API impact)."},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"Developer impact"},{"line_number":169,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_602cc5ac","line":166,"in_reply_to":"1abeadc6_35c6ac68","updated":"2014-09-01 08:37:28.000000000","message":"I can\u0027t understand that discuss. Self-signed !\u003d CA, as I see SSL PKI. If you have CA, you need minimum 2 pkeys and 2 certs. If you have just self-signed cert then you need just 1 pair. How we will work? With CA and many keys signed by that CA? Or we will have one self-signed key for all?","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"0c8e599eccf046b47f9f16541f430552864347d0","unresolved":false,"context_lines":[{"line_number":163,"context_line":""},{"line_number":164,"context_line":"Maybe a default self-signed certificate must be deployed on the fuel master"},{"line_number":165,"context_line":"in order to be able to do the first setup. The certificate could then be"},{"line_number":166,"context_line":"overwritten by one chosen by the user with the REST API (see REST API impact)."},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"Developer impact"},{"line_number":169,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_35c6ac68","line":166,"in_reply_to":"1abeadc6_7ac65669","updated":"2014-08-29 16:04:49.000000000","message":"According to the discussion above The work flow is to deploy the cluster with a self-signed certificate that was generated by astute at the creation of the cluster and store somewhere on the fuel master node. When the cluster is created, if it is possible (it is not in the scope of this blueprint) the user can download its own CA for the given VIP. If it cannot download it or don\u0027t want then everything will work fine with the self signed CA.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"e7d4d9d95aeeeca7ff58f80b1c7281f6a5aadccb","unresolved":false,"context_lines":[{"line_number":163,"context_line":""},{"line_number":164,"context_line":"Maybe a default self-signed certificate must be deployed on the fuel master"},{"line_number":165,"context_line":"in order to be able to do the first setup. The certificate could then be"},{"line_number":166,"context_line":"overwritten by one chosen by the user with the REST API (see REST API impact)."},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"Developer impact"},{"line_number":169,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_d6bb7b70","line":166,"in_reply_to":"fa98f980_602cc5ac","updated":"2014-09-01 09:50:22.000000000","message":"My mistake. I used CA as a short way of certificate that is not true and confusing. So s/CA/certificate","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":406,"name":"Mike Scherbakov","email":"mihgen@gmail.com","username":"mihgen"},"change_message_id":"1e130e6b0c7cecd80f1e0fec08d2ff72576429cc","unresolved":false,"context_lines":[{"line_number":168,"context_line":"Developer impact"},{"line_number":169,"context_line":"----------------"},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"None"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Implementation"},{"line_number":174,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_fa80a6f8","line":171,"updated":"2014-08-29 13:49:37.000000000","message":"Is OSTF going to be affected by changing OpenStack endpoints?","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"0c8e599eccf046b47f9f16541f430552864347d0","unresolved":false,"context_lines":[{"line_number":168,"context_line":"Developer impact"},{"line_number":169,"context_line":"----------------"},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"None"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Implementation"},{"line_number":174,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_75910446","line":171,"in_reply_to":"1abeadc6_fa80a6f8","updated":"2014-08-29 16:04:49.000000000","message":"I\u0027m not aware how OSTF is working by yes maybe...","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":406,"name":"Mike Scherbakov","email":"mihgen@gmail.com","username":"mihgen"},"change_message_id":"1e130e6b0c7cecd80f1e0fec08d2ff72576429cc","unresolved":false,"context_lines":[{"line_number":203,"context_line":"    - ceilometer"},{"line_number":204,"context_line":"    - *other? ...*"},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"  **Note**: Horizon is not part of this blueprint because it doesn\u0027t expose"},{"line_number":207,"context_line":"  any APIs. The work to enable SSL is done in another blueprint."},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_1ab2c2e4","line":206,"updated":"2014-08-29 13:49:37.000000000","message":"Does it mean that Horizon UI will still be accessible by plain HTTP?","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"0c8e599eccf046b47f9f16541f430552864347d0","unresolved":false,"context_lines":[{"line_number":203,"context_line":"    - ceilometer"},{"line_number":204,"context_line":"    - *other? ...*"},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"  **Note**: Horizon is not part of this blueprint because it doesn\u0027t expose"},{"line_number":207,"context_line":"  any APIs. The work to enable SSL is done in another blueprint."},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_d5b1f8e0","line":206,"in_reply_to":"1abeadc6_1ab2c2e4","updated":"2014-08-29 16:04:49.000000000","message":"There is a work in progress done by Max Mazur (IIRC) so it should be in https.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"69035169178746150e21954aa93af1d59108ecd3","unresolved":false,"context_lines":[{"line_number":203,"context_line":"    - ceilometer"},{"line_number":204,"context_line":"    - *other? ...*"},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"  **Note**: Horizon is not part of this blueprint because it doesn\u0027t expose"},{"line_number":207,"context_line":"  any APIs. The work to enable SSL is done in another blueprint."},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":20,"id":"fa98f980_fd0cd796","line":206,"in_reply_to":"1abeadc6_d5b1f8e0","updated":"2014-09-01 12:59:36.000000000","message":"I thought that Horizon was part of another BP but after verification it seems that it is not. Max done a work for MOX only. So enabling https for Horizon suits well here. So we need to modify the configuration file of HAProxy also for Horizon.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":406,"name":"Mike Scherbakov","email":"mihgen@gmail.com","username":"mihgen"},"change_message_id":"1e130e6b0c7cecd80f1e0fec08d2ff72576429cc","unresolved":false,"context_lines":[{"line_number":215,"context_line":"Testing"},{"line_number":216,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"Build a new fuel ISO and test if the deployment corresponds to what is"},{"line_number":219,"context_line":"expected. The existing deployment tests seems adequate."},{"line_number":220,"context_line":""},{"line_number":221,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_3ad3fe04","line":218,"updated":"2014-08-29 13:49:37.000000000","message":"I believe system tests might be affected by endpoint change. We should get approve from QA team here.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"0c8e599eccf046b47f9f16541f430552864347d0","unresolved":false,"context_lines":[{"line_number":215,"context_line":"Testing"},{"line_number":216,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"Build a new fuel ISO and test if the deployment corresponds to what is"},{"line_number":219,"context_line":"expected. The existing deployment tests seems adequate."},{"line_number":220,"context_line":""},{"line_number":221,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":20,"id":"1abeadc6_75df440d","line":218,"in_reply_to":"1abeadc6_3ad3fe04","updated":"2014-08-29 16:04:49.000000000","message":"Yes you are right. I will add a note of QA team.","commit_id":"96d3573810be0ad98f278ebee3437c933c5c8fc7"}],"specs/6.1/ssl-endpoints.rst":[{"author":{"_account_id":8749,"name":"Evgeniy L","email":"eli@mirantis.com","username":"evgeniyl"},"change_message_id":"eb33a9bea1cc844d1f18e7fbee720a9a319b738a","unresolved":false,"context_lines":[{"line_number":154,"context_line":""},{"line_number":155,"context_line":"In case the user uploads his own certificate we absolutely check its validity"},{"line_number":156,"context_line":"because a wrong certificate will prevent all services to communicate and the"},{"line_number":157,"context_line":"cluster will be unusable."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"Upgrade impact"},{"line_number":160,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":21,"id":"fa98f980_acb6a688","line":157,"updated":"2014-09-01 10:15:32.000000000","message":"Please, see my comments in \nhttps://review.openstack.org/#/c/102273/20/specs/6.0/ssl-endpoints.rst","commit_id":"00bd62203a3a5882f56530af2fcf3f223ba86209"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"0feb75ec9ae202bf514c7734d4eee88b6d38f91f","unresolved":false,"context_lines":[{"line_number":154,"context_line":""},{"line_number":155,"context_line":"In case the user uploads his own certificate we absolutely check its validity"},{"line_number":156,"context_line":"because a wrong certificate will prevent all services to communicate and the"},{"line_number":157,"context_line":"cluster will be unusable."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"Upgrade impact"},{"line_number":160,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":21,"id":"fa98f980_9d1d8bc0","line":157,"in_reply_to":"fa98f980_acb6a688","updated":"2014-09-01 12:59:49.000000000","message":"Answered on the other review.","commit_id":"00bd62203a3a5882f56530af2fcf3f223ba86209"},{"author":{"_account_id":8749,"name":"Evgeniy L","email":"eli@mirantis.com","username":"evgeniyl"},"change_message_id":"eb33a9bea1cc844d1f18e7fbee720a9a319b738a","unresolved":false,"context_lines":[{"line_number":165,"context_line":"an update the astute.yaml is generated. As it is an update and not a creation,"},{"line_number":166,"context_line":"there is no certificate. So astute can detect this and pass a parameter into"},{"line_number":167,"context_line":"the yaml file to specify that SSL is not supported. That means that you need"},{"line_number":168,"context_line":"to manage this in the puppet file."},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"Security impact"},{"line_number":171,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":21,"id":"fa98f980_4c90daec","line":168,"updated":"2014-09-01 10:15:32.000000000","message":"Please, see my comments in \nhttps://review.openstack.org/#/c/102273/20/specs/6.0/ssl-endpoints.rst","commit_id":"00bd62203a3a5882f56530af2fcf3f223ba86209"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"0feb75ec9ae202bf514c7734d4eee88b6d38f91f","unresolved":false,"context_lines":[{"line_number":165,"context_line":"an update the astute.yaml is generated. As it is an update and not a creation,"},{"line_number":166,"context_line":"there is no certificate. So astute can detect this and pass a parameter into"},{"line_number":167,"context_line":"the yaml file to specify that SSL is not supported. That means that you need"},{"line_number":168,"context_line":"to manage this in the puppet file."},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"Security impact"},{"line_number":171,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":21,"id":"fa98f980_5d6a431b","line":168,"in_reply_to":"fa98f980_4c90daec","updated":"2014-09-01 12:59:49.000000000","message":"Answered on the other review.","commit_id":"00bd62203a3a5882f56530af2fcf3f223ba86209"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"6d442ca6d0e91a475fd7a25a1247d0edb94beeaa","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"In this specification we are making the assumption that Fuel is running in"},{"line_number":37,"context_line":"single controller HA mode. This is because we are using HAProxy to enable SSL"},{"line_number":38,"context_line":"and using single HA controller is simplifying code and test case."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Here is a schema of the encryption of the traffic paths:"},{"line_number":41,"context_line":""}],"source_content_type":"text/x-rst","patch_set":22,"id":"fa98f980_8986f411","line":38,"updated":"2014-09-02 08:45:24.000000000","message":"I will add a note about the dependency on https://blueprints.launchpad.net/fuel/+spec/single-controller-ha","commit_id":"5475bd50c9b9a297c8369e2d50a5568e82349ebd"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"26d3517fb7b2b15ed896b776748beaf0d0199774","unresolved":false,"context_lines":[{"line_number":93,"context_line":"  dependency to openssl if it is not already the case."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"- As we are using a self-signed certificate by default we need to ensure that"},{"line_number":96,"context_line":"  OpenStack services behaves in the same way with a self-signed certificate"},{"line_number":97,"context_line":"  and a CA certificate. As an example, web browser opens a warning window if"},{"line_number":98,"context_line":"  you are using a self-signed certificate and not if you are using a"},{"line_number":99,"context_line":"  certificate issued by a trusted authority."}],"source_content_type":"text/x-rst","patch_set":22,"id":"fa98f980_c9bf1cfb","line":96,"range":{"start_line":96,"start_character":21,"end_line":96,"end_character":28},"updated":"2014-09-02 08:47:05.000000000","message":"s/behaves/behave/","commit_id":"5475bd50c9b9a297c8369e2d50a5568e82349ebd"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"952746deb87f6f50cd02e0ed8d43407d63f7c5c7","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"- In case of \"real\" HA where several HAProxy are deployed. We need to be able"},{"line_number":106,"context_line":"  to distribute the certificate. If it is a self-signed certificate it will be"},{"line_number":107,"context_line":"  generated by *nailgun* and store somewhere on the fuel master. Then the"},{"line_number":108,"context_line":"  certificate will be distributed to all nodes that run HAProxy through a"},{"line_number":109,"context_line":"  mechanism like *upload_file*. The certificate is related to a cluster"},{"line_number":110,"context_line":"  because it is valid for a given virtual IP. So if a controller is added to"}],"source_content_type":"text/x-rst","patch_set":22,"id":"fa98f980_c21d6068","line":107,"updated":"2014-09-01 16:19:18.000000000","message":"s/store/stored","commit_id":"5475bd50c9b9a297c8369e2d50a5568e82349ebd"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"952746deb87f6f50cd02e0ed8d43407d63f7c5c7","unresolved":false,"context_lines":[{"line_number":149,"context_line":"It could be interesting to have an indicator in the UI that says that the"},{"line_number":150,"context_line":"certificate is the default self-signed one."},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"In case the user uploads his own certificate we absolutely check its validity"},{"line_number":153,"context_line":"because a wrong certificate will prevent all services to communicate and the"},{"line_number":154,"context_line":"cluster will be unusable. That means that we need to check the common name and"},{"line_number":155,"context_line":"also the date of expiration."}],"source_content_type":"text/x-rst","patch_set":22,"id":"fa98f980_c2900098","line":152,"updated":"2014-09-01 16:19:18.000000000","message":"s/check/need to check","commit_id":"5475bd50c9b9a297c8369e2d50a5568e82349ebd"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"26d3517fb7b2b15ed896b776748beaf0d0199774","unresolved":false,"context_lines":[{"line_number":150,"context_line":"certificate is the default self-signed one."},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"In case the user uploads his own certificate we absolutely check its validity"},{"line_number":153,"context_line":"because a wrong certificate will prevent all services to communicate and the"},{"line_number":154,"context_line":"cluster will be unusable. That means that we need to check the common name and"},{"line_number":155,"context_line":"also the date of expiration."},{"line_number":156,"context_line":""}],"source_content_type":"text/x-rst","patch_set":22,"id":"fa98f980_69ac70a1","line":153,"updated":"2014-09-02 08:47:05.000000000","message":"An invalid certificate shouldn\u0027t break OSt services since they communicate using HTTP. But in any case, certificate validation is important.\n\nAlso this paragraph is redundant with the \"Other end user impact\" section.","commit_id":"5475bd50c9b9a297c8369e2d50a5568e82349ebd"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"c2df4daff7525592542075644417042373d2eebf","unresolved":false,"context_lines":[{"line_number":150,"context_line":"certificate is the default self-signed one."},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"In case the user uploads his own certificate we absolutely check its validity"},{"line_number":153,"context_line":"because a wrong certificate will prevent all services to communicate and the"},{"line_number":154,"context_line":"cluster will be unusable. That means that we need to check the common name and"},{"line_number":155,"context_line":"also the date of expiration."},{"line_number":156,"context_line":""}],"source_content_type":"text/x-rst","patch_set":22,"id":"fa98f980_893fd4d5","line":153,"in_reply_to":"fa98f980_69ac70a1","updated":"2014-09-02 09:02:56.000000000","message":"Yes right. The point is that in my mind we don\u0027t manage the upload of the certificate in this blueprint. So I will remove this section and let the choice into the right blueprint. Discussion is open if you prefer to see a basic implementation of the REST API in this blueprint.","commit_id":"5475bd50c9b9a297c8369e2d50a5568e82349ebd"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"26d3517fb7b2b15ed896b776748beaf0d0199774","unresolved":false,"context_lines":[{"line_number":173,"context_line":""},{"line_number":174,"context_line":"    DELETE /api/v1/clusters/1/ssl_certificate"},{"line_number":175,"context_line":""},{"line_number":176,"context_line":"As SSL certificates are sensitive data we should be certain that they are not"},{"line_number":177,"context_line":"stored in logs or in a database in case of diagnostic snapshot."},{"line_number":178,"context_line":""},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"Upgrade impact"}],"source_content_type":"text/x-rst","patch_set":22,"id":"fa98f980_09720449","line":177,"range":{"start_line":176,"start_character":0,"end_line":177,"end_character":63},"updated":"2014-09-02 08:47:05.000000000","message":"I would move this to \"Security impact\" section","commit_id":"5475bd50c9b9a297c8369e2d50a5568e82349ebd"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"c2df4daff7525592542075644417042373d2eebf","unresolved":false,"context_lines":[{"line_number":173,"context_line":""},{"line_number":174,"context_line":"    DELETE /api/v1/clusters/1/ssl_certificate"},{"line_number":175,"context_line":""},{"line_number":176,"context_line":"As SSL certificates are sensitive data we should be certain that they are not"},{"line_number":177,"context_line":"stored in logs or in a database in case of diagnostic snapshot."},{"line_number":178,"context_line":""},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"Upgrade impact"}],"source_content_type":"text/x-rst","patch_set":22,"id":"fa98f980_e40325b6","line":177,"range":{"start_line":176,"start_character":0,"end_line":177,"end_character":63},"in_reply_to":"fa98f980_09720449","updated":"2014-09-02 09:02:56.000000000","message":"Done","commit_id":"5475bd50c9b9a297c8369e2d50a5568e82349ebd"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"952746deb87f6f50cd02e0ed8d43407d63f7c5c7","unresolved":false,"context_lines":[{"line_number":185,"context_line":"the update, nailgun uses previous version of manifests. That means that there"},{"line_number":186,"context_line":"will be one version of puppet manifest without SSL support and the new version"},{"line_number":187,"context_line":"with SSL support. Both should work with last version of HAProxy since the"},{"line_number":188,"context_line":"version build for fuel support the declaration of several configuration files"},{"line_number":189,"context_line":"into a directory (that is not the case for the upstream version of HAProxy)."},{"line_number":190,"context_line":"See https://bugs.launchpad.net/fuel/+bug/1346365"},{"line_number":191,"context_line":""}],"source_content_type":"text/x-rst","patch_set":22,"id":"fa98f980_824b582a","line":188,"updated":"2014-09-01 16:19:18.000000000","message":"s/for fuel support/by fuel OSCI team supports/","commit_id":"5475bd50c9b9a297c8369e2d50a5568e82349ebd"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"952746deb87f6f50cd02e0ed8d43407d63f7c5c7","unresolved":false,"context_lines":[{"line_number":200,"context_line":"--------------------"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"We need to notify where the certificate that must be used by client can be"},{"line_number":203,"context_line":"downloaded."},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"Other end user impact"},{"line_number":206,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":22,"id":"fa98f980_c21ac016","line":203,"updated":"2014-09-01 16:19:18.000000000","message":"for example by showing the curl command with the correct RestAPI.","commit_id":"5475bd50c9b9a297c8369e2d50a5568e82349ebd"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"952746deb87f6f50cd02e0ed8d43407d63f7c5c7","unresolved":false,"context_lines":[{"line_number":235,"context_line":"The work flow is to deploy the cluster with a self-signed certificate that was"},{"line_number":236,"context_line":"generated by astute at the creation of the cluster. This certificate must"},{"line_number":237,"context_line":"be store somewhere on the fuel master node with the appropriate rights. When"},{"line_number":238,"context_line":"the cluster is created, if it is possible (it is not in the scope of this"},{"line_number":239,"context_line":"specification) the user can download its own certificate for the given VIP."},{"line_number":240,"context_line":"If it cannot download it or don\u0027t want to use another certificate then"},{"line_number":241,"context_line":"everything will work fine with the self signed certificate."}],"source_content_type":"text/x-rst","patch_set":22,"id":"fa98f980_62b114f8","line":238,"updated":"2014-09-01 16:19:18.000000000","message":"s/possible/available?","commit_id":"5475bd50c9b9a297c8369e2d50a5568e82349ebd"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"952746deb87f6f50cd02e0ed8d43407d63f7c5c7","unresolved":false,"context_lines":[{"line_number":243,"context_line":"Developer impact"},{"line_number":244,"context_line":"----------------"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"Maybe OSTF is going to be affected by changing OpenStack endpoints. Need to"},{"line_number":247,"context_line":"be checked."},{"line_number":248,"context_line":""},{"line_number":249,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":22,"id":"fa98f980_e273444b","line":246,"updated":"2014-09-01 16:19:18.000000000","message":"s/OSTF/OSTF team (health check team)/","commit_id":"5475bd50c9b9a297c8369e2d50a5568e82349ebd"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"69cfea741747ea2ea0b9b956ef12064a2a75616b","unresolved":false,"context_lines":[{"line_number":24,"context_line":"modify the puppet manifests to be able to use SSL/TLS and HTTP services."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"This blueprint will focus on HTTP services that provide API endpoints on"},{"line_number":27,"context_line":"public networks. Endpoints used for management and other services like"},{"line_number":28,"context_line":"messaging will not be done in this blueprint."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"We will use HAProxy and its support of SSL. The endpoints of public URLs"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_2600d266","line":27,"updated":"2014-09-02 09:25:20.000000000","message":"I will add a note to say that Horizon is included into this BP","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":9546,"name":"Tomasz \u0027Zen\u0027 Napierala","email":"tnapierala@mirantis.com","username":"tzn"},"change_message_id":"462f6f774ef4e604f8e6a5ed5cc10115da77f3d8","unresolved":false,"context_lines":[{"line_number":76,"context_line":"  https://bugs.launchpad.net/fuel/+bug/1346365/"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"- Configure HAProxy to manage SSL connections and to forward the request to"},{"line_number":79,"context_line":"  the corresponding service."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"- When an OpenStack service queries another OpenStack service it must use the"},{"line_number":82,"context_line":"  internal API endpoint. If it\u0027s not possible, the service needs to be"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_3a370550","line":79,"updated":"2014-09-02 11:17:05.000000000","message":"We implemented it in Occam (AT\u0026T cloud orchestrator). You can take a look here:\nhttps://github.com/att-innovate/occam-havana-cloud/blob/master/profile/manifests/openstack/proxy.pp","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"607b177d17d2ce82312bc7cc3fb0975b0b1f87fa","unresolved":false,"context_lines":[{"line_number":76,"context_line":"  https://bugs.launchpad.net/fuel/+bug/1346365/"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"- Configure HAProxy to manage SSL connections and to forward the request to"},{"line_number":79,"context_line":"  the corresponding service."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"- When an OpenStack service queries another OpenStack service it must use the"},{"line_number":82,"context_line":"  internal API endpoint. If it\u0027s not possible, the service needs to be"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_75cb5e53","line":79,"in_reply_to":"fa98f980_3a370550","updated":"2014-09-02 12:08:32.000000000","message":"Thanks for the link. We also started to implement it here:\nhttps://review.openstack.org/#/c/114909\nIt is not so different of course :)","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":9546,"name":"Tomasz \u0027Zen\u0027 Napierala","email":"tnapierala@mirantis.com","username":"tzn"},"change_message_id":"462f6f774ef4e604f8e6a5ed5cc10115da77f3d8","unresolved":false,"context_lines":[{"line_number":97,"context_line":"  and a CA certificate. As an example, web browser opens a warning window if"},{"line_number":98,"context_line":"  you are using a self-signed certificate and not if you are using a"},{"line_number":99,"context_line":"  certificate issued by a trusted authority."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"- The possibility for the user to upload a new certificate is not part of this"},{"line_number":102,"context_line":"  specification. That means that if a user cannot upload a new certificate,"},{"line_number":103,"context_line":"  the deployment can happen but we will use the self-signed certificate."}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_1af32174","line":100,"updated":"2014-09-02 11:17:05.000000000","message":"They are not. For example most clients need option \"--insecure\" otherwise they will fail. We need to investigate most of the manifests to check it out.","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":9546,"name":"Tomasz \u0027Zen\u0027 Napierala","email":"tnapierala@mirantis.com","username":"tzn"},"change_message_id":"462f6f774ef4e604f8e6a5ed5cc10115da77f3d8","unresolved":false,"context_lines":[{"line_number":101,"context_line":"- The possibility for the user to upload a new certificate is not part of this"},{"line_number":102,"context_line":"  specification. That means that if a user cannot upload a new certificate,"},{"line_number":103,"context_line":"  the deployment can happen but we will use the self-signed certificate."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"- In case of \"real\" HA where several HAProxy are deployed. We need to be able"},{"line_number":106,"context_line":"  to distribute the certificate. If it is a self-signed certificate it will be"},{"line_number":107,"context_line":"  generated by *nailgun* and stored somewhere on the fuel master. Then the"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_fa649d23","line":104,"updated":"2014-09-02 11:17:05.000000000","message":"It should not be silent ,we need to inform customer that we are creating self-signed cert. In some companies it\u0027s a policy not to use self signed certs","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"607b177d17d2ce82312bc7cc3fb0975b0b1f87fa","unresolved":false,"context_lines":[{"line_number":101,"context_line":"- The possibility for the user to upload a new certificate is not part of this"},{"line_number":102,"context_line":"  specification. That means that if a user cannot upload a new certificate,"},{"line_number":103,"context_line":"  the deployment can happen but we will use the self-signed certificate."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"- In case of \"real\" HA where several HAProxy are deployed. We need to be able"},{"line_number":106,"context_line":"  to distribute the certificate. If it is a self-signed certificate it will be"},{"line_number":107,"context_line":"  generated by *nailgun* and stored somewhere on the fuel master. Then the"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_5511faaa","line":104,"in_reply_to":"fa98f980_fa649d23","updated":"2014-09-02 12:08:32.000000000","message":"Yes you\u0027re right. I added a comment about the addition of a checkbox to allow the user to enable SSL with self-signed cert or not. I will add it clearly in the spec.","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"09c2da14698100984a54956ff008fe63e067606a","unresolved":false,"context_lines":[{"line_number":139,"context_line":"REST API impact"},{"line_number":140,"context_line":"---------------"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"The REST API needs to be modified to allow a user to add and update its"},{"line_number":143,"context_line":"certificate. Certificate must be spread on all controllers. This feature is"},{"line_number":144,"context_line":"not absolutely needed for the deployment of a new cluster since a default"},{"line_number":145,"context_line":"self-signed certificate is used. Having said that user certainly want to be"},{"line_number":146,"context_line":"able to download a new certificate for a given cluster but it is not in the"},{"line_number":147,"context_line":"scope of this specification."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"It could be interesting to have an indicator in the UI that says that the"},{"line_number":150,"context_line":"certificate is the default self-signed one."}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_e6c88a24","line":147,"range":{"start_line":142,"start_character":0,"end_line":147,"end_character":28},"updated":"2014-09-02 09:26:37.000000000","message":"Should be removed if we say that this blueprint supports only self-signed certificates.","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"1be9a29fec89fff83be740194dab46450b021827","unresolved":false,"context_lines":[{"line_number":139,"context_line":"REST API impact"},{"line_number":140,"context_line":"---------------"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"The REST API needs to be modified to allow a user to add and update its"},{"line_number":143,"context_line":"certificate. Certificate must be spread on all controllers. This feature is"},{"line_number":144,"context_line":"not absolutely needed for the deployment of a new cluster since a default"},{"line_number":145,"context_line":"self-signed certificate is used. Having said that user certainly want to be"},{"line_number":146,"context_line":"able to download a new certificate for a given cluster but it is not in the"},{"line_number":147,"context_line":"scope of this specification."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"It could be interesting to have an indicator in the UI that says that the"},{"line_number":150,"context_line":"certificate is the default self-signed one."}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_69cf0d80","line":147,"range":{"start_line":142,"start_character":0,"end_line":147,"end_character":28},"in_reply_to":"fa98f980_e6c88a24","updated":"2014-09-02 09:38:53.000000000","message":"Yes. So I will remove it but as said previously the discussion is open if we have developer that can develop the REST API.\n\nThe other point that is still open is that it seems reasonable to let the user the possibility to disable SSL especially if he cannot download its own certificate. I guess that it can be a checkbox in fuel \"disable SSL for public endpoints\" and need to be checked to disable SSL. Or vice versa (ie enable SSL that need to be checked by the user).","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":9546,"name":"Tomasz \u0027Zen\u0027 Napierala","email":"tnapierala@mirantis.com","username":"tzn"},"change_message_id":"462f6f774ef4e604f8e6a5ed5cc10115da77f3d8","unresolved":false,"context_lines":[{"line_number":167,"context_line":""},{"line_number":168,"context_line":"By using SSL/TLS over HTTP services, we will be able to provide a secure"},{"line_number":169,"context_line":"system with authentication and confidentiality."},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"As SSL certificates are sensitive data we should be certain that they are not"},{"line_number":172,"context_line":"stored in logs or in a database in case of diagnostic snapshot."},{"line_number":173,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_3a14654d","line":170,"updated":"2014-09-02 11:17:05.000000000","message":"I don\u0027t see this blueprint implements anything about authentication. Am I wrong?","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"607b177d17d2ce82312bc7cc3fb0975b0b1f87fa","unresolved":false,"context_lines":[{"line_number":167,"context_line":""},{"line_number":168,"context_line":"By using SSL/TLS over HTTP services, we will be able to provide a secure"},{"line_number":169,"context_line":"system with authentication and confidentiality."},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"As SSL certificates are sensitive data we should be certain that they are not"},{"line_number":172,"context_line":"stored in logs or in a database in case of diagnostic snapshot."},{"line_number":173,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_e0b5ca31","line":170,"in_reply_to":"fa98f980_3a14654d","updated":"2014-09-02 12:08:32.000000000","message":"I wanted to say that a SSL certificate allows you (the user of the service) to authenticate that the service is really the one that it pretends to be.","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"12c7f12b3c58194330f09cdddf16b122f8f7b311","unresolved":false,"context_lines":[{"line_number":167,"context_line":""},{"line_number":168,"context_line":"By using SSL/TLS over HTTP services, we will be able to provide a secure"},{"line_number":169,"context_line":"system with authentication and confidentiality."},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"As SSL certificates are sensitive data we should be certain that they are not"},{"line_number":172,"context_line":"stored in logs or in a database in case of diagnostic snapshot."},{"line_number":173,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_73a325b2","line":170,"in_reply_to":"fa98f980_43cbfd52","updated":"2014-09-04 07:58:53.000000000","message":"I added a note saying the authentication is in case of CA.","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":9546,"name":"Tomasz \u0027Zen\u0027 Napierala","email":"tnapierala@mirantis.com","username":"tzn"},"change_message_id":"3ed95537d3ec974398824982fd732a2d0f627f70","unresolved":false,"context_lines":[{"line_number":167,"context_line":""},{"line_number":168,"context_line":"By using SSL/TLS over HTTP services, we will be able to provide a secure"},{"line_number":169,"context_line":"system with authentication and confidentiality."},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"As SSL certificates are sensitive data we should be certain that they are not"},{"line_number":172,"context_line":"stored in logs or in a database in case of diagnostic snapshot."},{"line_number":173,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_43cbfd52","line":170,"in_reply_to":"fa98f980_e0b5ca31","updated":"2014-09-02 13:45:08.000000000","message":"Not really in case of self signed certs. There is no trusted 3rd party to assure that the cert was issued by trusted entity. The only feature we have here is encryption","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"69cfea741747ea2ea0b9b956ef12064a2a75616b","unresolved":false,"context_lines":[{"line_number":176,"context_line":"--------------------"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"We need to notify where the certificate that must be used by client can be"},{"line_number":179,"context_line":"downloaded. It can be done by showing the curl command that can be used."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"Other end user impact"},{"line_number":182,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_666e5a31","line":179,"updated":"2014-09-02 09:25:20.000000000","message":"I will add the notification of \"Deployment is done. Please open your Horizon at.. . httpS..\" as suggested by Mike. I forgot to add it.","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"09c2da14698100984a54956ff008fe63e067606a","unresolved":false,"context_lines":[{"line_number":176,"context_line":"--------------------"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"We need to notify where the certificate that must be used by client can be"},{"line_number":179,"context_line":"downloaded. It can be done by showing the curl command that can be used."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"Other end user impact"},{"line_number":182,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_46b5d6cb","line":179,"range":{"start_line":179,"start_character":12,"end_line":179,"end_character":72},"updated":"2014-09-02 09:26:37.000000000","message":"Not everybody uses Linux ;)\nIdeally there should be a link in the UI that would download the certificate associated to the environment.","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"555353191219d0034b26effda68eabd752d8779c","unresolved":false,"context_lines":[{"line_number":176,"context_line":"--------------------"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"We need to notify where the certificate that must be used by client can be"},{"line_number":179,"context_line":"downloaded. It can be done by showing the curl command that can be used."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"Other end user impact"},{"line_number":182,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_09e201d5","line":179,"range":{"start_line":179,"start_character":12,"end_line":179,"end_character":72},"in_reply_to":"fa98f980_46b5d6cb","updated":"2014-09-02 09:41:24.000000000","message":"Done","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":9546,"name":"Tomasz \u0027Zen\u0027 Napierala","email":"tnapierala@mirantis.com","username":"tzn"},"change_message_id":"462f6f774ef4e604f8e6a5ed5cc10115da77f3d8","unresolved":false,"context_lines":[{"line_number":176,"context_line":"--------------------"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"We need to notify where the certificate that must be used by client can be"},{"line_number":179,"context_line":"downloaded. It can be done by showing the curl command that can be used."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"Other end user impact"},{"line_number":182,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_ba07751b","line":179,"in_reply_to":"fa98f980_46b5d6cb","updated":"2014-09-02 11:17:05.000000000","message":"What certificate are we talking about here?","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":9546,"name":"Tomasz \u0027Zen\u0027 Napierala","email":"tnapierala@mirantis.com","username":"tzn"},"change_message_id":"3ed95537d3ec974398824982fd732a2d0f627f70","unresolved":false,"context_lines":[{"line_number":176,"context_line":"--------------------"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"We need to notify where the certificate that must be used by client can be"},{"line_number":179,"context_line":"downloaded. It can be done by showing the curl command that can be used."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"Other end user impact"},{"line_number":182,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_c3a28dad","line":179,"in_reply_to":"fa98f980_5572dae5","updated":"2014-09-02 13:45:08.000000000","message":"I\u0027m not sure if I understand it correctly. Are you going to implement https client side authentication? Are you going to issue certs fo every client? If so, it would duplicate already implemented (but obviously limited) authentication via keystone, so no need for that. Apart from being very hard to deploy. If not, I understand that we are discussing here CA cert used to sign server cert. Again, this will be on-off operation, this cert will not be used by customer to sign any other certs. Of course there will be problem with expiration, but it would still be easier to repeat entire process including CA cert generation. Or am I wrong?","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"607b177d17d2ce82312bc7cc3fb0975b0b1f87fa","unresolved":false,"context_lines":[{"line_number":176,"context_line":"--------------------"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"We need to notify where the certificate that must be used by client can be"},{"line_number":179,"context_line":"downloaded. It can be done by showing the curl command that can be used."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"Other end user impact"},{"line_number":182,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_5572dae5","line":179,"in_reply_to":"fa98f980_ba07751b","updated":"2014-09-02 12:08:32.000000000","message":"We are talking about the certificate used by the client, the one with the public key.","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"807fb97648ea34b618c0299871f6b04d8c73cad5","unresolved":false,"context_lines":[{"line_number":176,"context_line":"--------------------"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"We need to notify where the certificate that must be used by client can be"},{"line_number":179,"context_line":"downloaded. It can be done by showing the curl command that can be used."},{"line_number":180,"context_line":""},{"line_number":181,"context_line":"Other end user impact"},{"line_number":182,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_3c9e1a57","line":179,"in_reply_to":"fa98f980_c3a28dad","updated":"2014-09-02 14:51:55.000000000","message":"Even if the certificate is self-signed, it would be useful for the end-user to be able to download it locally so he/she can pass it to the OpenStack clients (--os-cacert option) or curl (--cacert option).","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"09c2da14698100984a54956ff008fe63e067606a","unresolved":false,"context_lines":[{"line_number":181,"context_line":"Other end user impact"},{"line_number":182,"context_line":"---------------------"},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"We generate certificate that ends ten years later. As an end user can upload"},{"line_number":185,"context_line":"its own certificate the delay can be shorter. Thus we need to monitor the"},{"line_number":186,"context_line":"expiration date of the certificate and must warn before it expires. A solution"},{"line_number":187,"context_line":"could be to add a line in the crontab according to date of expiration."},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"As we are using a self-signed certificate by default, if a user is using a"},{"line_number":190,"context_line":"web browser to query OpenStack services there will be a popup to warn than"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_06174ea4","line":187,"range":{"start_line":184,"start_character":51,"end_line":187,"end_character":70},"updated":"2014-09-02 09:26:37.000000000","message":"Should be removed if we say that this blueprint supports only self-signed certificates.","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"1be9a29fec89fff83be740194dab46450b021827","unresolved":false,"context_lines":[{"line_number":181,"context_line":"Other end user impact"},{"line_number":182,"context_line":"---------------------"},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"We generate certificate that ends ten years later. As an end user can upload"},{"line_number":185,"context_line":"its own certificate the delay can be shorter. Thus we need to monitor the"},{"line_number":186,"context_line":"expiration date of the certificate and must warn before it expires. A solution"},{"line_number":187,"context_line":"could be to add a line in the crontab according to date of expiration."},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"As we are using a self-signed certificate by default, if a user is using a"},{"line_number":190,"context_line":"web browser to query OpenStack services there will be a popup to warn than"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_49aa49d5","line":187,"range":{"start_line":184,"start_character":51,"end_line":187,"end_character":70},"in_reply_to":"fa98f980_06174ea4","updated":"2014-09-02 09:38:53.000000000","message":"Yes good point.","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":9546,"name":"Tomasz \u0027Zen\u0027 Napierala","email":"tnapierala@mirantis.com","username":"tzn"},"change_message_id":"462f6f774ef4e604f8e6a5ed5cc10115da77f3d8","unresolved":false,"context_lines":[{"line_number":184,"context_line":"We generate certificate that ends ten years later. As an end user can upload"},{"line_number":185,"context_line":"its own certificate the delay can be shorter. Thus we need to monitor the"},{"line_number":186,"context_line":"expiration date of the certificate and must warn before it expires. A solution"},{"line_number":187,"context_line":"could be to add a line in the crontab according to date of expiration."},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"As we are using a self-signed certificate by default, if a user is using a"},{"line_number":190,"context_line":"web browser to query OpenStack services there will be a popup to warn than"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_953602e6","line":187,"in_reply_to":"fa98f980_49aa49d5","updated":"2014-09-02 11:17:05.000000000","message":"And this is usually on end user to monitor certificates","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":9546,"name":"Tomasz \u0027Zen\u0027 Napierala","email":"tnapierala@mirantis.com","username":"tzn"},"change_message_id":"3ed95537d3ec974398824982fd732a2d0f627f70","unresolved":false,"context_lines":[{"line_number":207,"context_line":""},{"line_number":208,"context_line":"OpenStack services will only use internal/admin URLs. Thus we must be sure"},{"line_number":209,"context_line":"that all services can communicate through the management network."},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"The work flow is to deploy the cluster with a self-signed certificate that was"},{"line_number":212,"context_line":"generated by astute at the creation of the cluster. This certificate must"},{"line_number":213,"context_line":"be store somewhere on the fuel master node with the appropriate rights. When"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_a34589b4","line":210,"updated":"2014-09-02 13:45:08.000000000","message":"Simple FW rule would be handy to check that. For development adding logging will validate if anything is using non private network","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":9546,"name":"Tomasz \u0027Zen\u0027 Napierala","email":"tnapierala@mirantis.com","username":"tzn"},"change_message_id":"462f6f774ef4e604f8e6a5ed5cc10115da77f3d8","unresolved":false,"context_lines":[{"line_number":251,"context_line":"    - heat"},{"line_number":252,"context_line":"    - ceilometer"},{"line_number":253,"context_line":"    - *other? ...*"},{"line_number":254,"context_line":""},{"line_number":255,"context_line":"Dependencies"},{"line_number":256,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":257,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_d5e32a31","line":254,"updated":"2014-09-02 11:17:05.000000000","message":"- sahara,\n- zabbix\n- ceph,\n- swift,\n- murano?\n\n\nAnd also crucial internal stuff\n- osnailyfacter\n-","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"607b177d17d2ce82312bc7cc3fb0975b0b1f87fa","unresolved":false,"context_lines":[{"line_number":251,"context_line":"    - heat"},{"line_number":252,"context_line":"    - ceilometer"},{"line_number":253,"context_line":"    - *other? ...*"},{"line_number":254,"context_line":""},{"line_number":255,"context_line":"Dependencies"},{"line_number":256,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":257,"context_line":""}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_80979e8f","line":254,"in_reply_to":"fa98f980_d5e32a31","updated":"2014-09-02 12:08:32.000000000","message":"Done","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":9546,"name":"Tomasz \u0027Zen\u0027 Napierala","email":"tnapierala@mirantis.com","username":"tzn"},"change_message_id":"462f6f774ef4e604f8e6a5ed5cc10115da77f3d8","unresolved":false,"context_lines":[{"line_number":272,"context_line":"API public endpoints, we need to document how to get this certificate if an"},{"line_number":273,"context_line":"end-user want to use a CLI (for example nova CLI) to interact with OpenStack"},{"line_number":274,"context_line":"services. When the end-user will be able to upload a certificate, the CN"},{"line_number":275,"context_line":"should comply with few rules:"},{"line_number":276,"context_line":""},{"line_number":277,"context_line":"    - It should match with what is configured in Keystone (public URLs)."},{"line_number":278,"context_line":"    - It should resolve to the expected IP address if it is a name."}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_55465a24","line":275,"updated":"2014-09-02 11:17:05.000000000","message":"Again, can you clarify what certificate are we talking about?","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"607b177d17d2ce82312bc7cc3fb0975b0b1f87fa","unresolved":false,"context_lines":[{"line_number":272,"context_line":"API public endpoints, we need to document how to get this certificate if an"},{"line_number":273,"context_line":"end-user want to use a CLI (for example nova CLI) to interact with OpenStack"},{"line_number":274,"context_line":"services. When the end-user will be able to upload a certificate, the CN"},{"line_number":275,"context_line":"should comply with few rules:"},{"line_number":276,"context_line":""},{"line_number":277,"context_line":"    - It should match with what is configured in Keystone (public URLs)."},{"line_number":278,"context_line":"    - It should resolve to the expected IP address if it is a name."}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_0001ee04","line":275,"in_reply_to":"fa98f980_55465a24","updated":"2014-09-02 12:08:32.000000000","message":"Yes right. I just see that using \"this certificate\" is very confusing (to not say wrong :). I will fix that.","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":9546,"name":"Tomasz \u0027Zen\u0027 Napierala","email":"tnapierala@mirantis.com","username":"tzn"},"change_message_id":"462f6f774ef4e604f8e6a5ed5cc10115da77f3d8","unresolved":false,"context_lines":[{"line_number":275,"context_line":"should comply with few rules:"},{"line_number":276,"context_line":""},{"line_number":277,"context_line":"    - It should match with what is configured in Keystone (public URLs)."},{"line_number":278,"context_line":"    - It should resolve to the expected IP address if it is a name."},{"line_number":279,"context_line":""},{"line_number":280,"context_line":"References"},{"line_number":281,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_3511d605","line":278,"updated":"2014-09-02 11:17:05.000000000","message":"It\u0027s a simple check, so it\u0027s better to read it from cert and validate, not leaving it on user. Less user responsibility - less problems","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"607b177d17d2ce82312bc7cc3fb0975b0b1f87fa","unresolved":false,"context_lines":[{"line_number":275,"context_line":"should comply with few rules:"},{"line_number":276,"context_line":""},{"line_number":277,"context_line":"    - It should match with what is configured in Keystone (public URLs)."},{"line_number":278,"context_line":"    - It should resolve to the expected IP address if it is a name."},{"line_number":279,"context_line":""},{"line_number":280,"context_line":"References"},{"line_number":281,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":23,"id":"fa98f980_605c7a26","line":278,"in_reply_to":"fa98f980_3511d605","updated":"2014-09-02 12:08:32.000000000","message":"Yes. And as the upload of the certificate is not part of this blueprint I will remove the section. So even less problems ;)","commit_id":"f296f6ac3e3b5289e047016a2269e7e6d1c45d47"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"92e99c064eb7ce708f607bb335a8be3e874ad74b","unresolved":false,"context_lines":[{"line_number":188,"context_line":"web browser to query OpenStack services there will be a popup to warn than"},{"line_number":189,"context_line":"the certificate can not be trusted."},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"Performance impact"},{"line_number":192,"context_line":"------------------"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"The SSL-overhead is generally small. The major cost of HTTPS is the SSL"}],"source_content_type":"text/x-rst","patch_set":24,"id":"fa98f980_4cc3de56","line":191,"updated":"2014-09-04 09:29:28.000000000","message":"s/impact/Impact\nInitially I replaced \"I\" by \"i\" to be consistent with others titles but by doing this it now fails to pass jenkins","commit_id":"36aa5af080289c7a23b072d07f4b9745071d8e27"},{"author":{"_account_id":9546,"name":"Tomasz \u0027Zen\u0027 Napierala","email":"tnapierala@mirantis.com","username":"tzn"},"change_message_id":"c6607a9e77621a5666a9275bffa8f0cdc5d4de61","unresolved":false,"context_lines":[{"line_number":97,"context_line":"  OpenStack services behave in the same way with a self-signed certificate"},{"line_number":98,"context_line":"  and a CA certificate. As an example, web browser opens a warning window if"},{"line_number":99,"context_line":"  you are using a self-signed certificate and not if you are using a"},{"line_number":100,"context_line":"  certificate issued by a trusted authority."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"- The possibility for the user to upload a new certificate is not part of this"},{"line_number":103,"context_line":"  specification. That means that if a user cannot upload a new certificate,"}],"source_content_type":"text/x-rst","patch_set":25,"id":"fa98f980_5814789f","line":100,"updated":"2014-09-04 12:27:05.000000000","message":"Apart from downloading certificate, we can provide a link to install CA in user browser as trusted root cert.","commit_id":"6c97e77ed37da9b6ffddc96aaa02e6221c2f60d4"},{"author":{"_account_id":11827,"name":"Stanislaw Bogatkin","email":"regs+ubuntu.com@sbog.ru","username":"sbogatkin"},"change_message_id":"04621d4dc4768d13e26698349e457d662c1cc7af","unresolved":false,"context_lines":[{"line_number":97,"context_line":"  OpenStack services behave in the same way with a self-signed certificate"},{"line_number":98,"context_line":"  and a CA certificate. As an example, web browser opens a warning window if"},{"line_number":99,"context_line":"  you are using a self-signed certificate and not if you are using a"},{"line_number":100,"context_line":"  certificate issued by a trusted authority."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"- The possibility for the user to upload a new certificate is not part of this"},{"line_number":103,"context_line":"  specification. That means that if a user cannot upload a new certificate,"}],"source_content_type":"text/x-rst","patch_set":25,"id":"fa98f980_faf4415c","line":100,"updated":"2014-09-04 12:18:48.000000000","message":"It\u0027s tricky term - \u0027trusted authirity\u0027. If I create authority for myself and sign my csr\u0027s with private key from that authority - is it \u0027trusted\u0027? If a fetch cert from service, that cert signed with top-level CA (e.g. Thawte) but top-level cert isn\u0027t imported to my browser - is it \u0027trusted\u0027?\nSo, if browser doesn\u0027t know about cert issuer - he will show warning. It not depend from type of cert - self-signed or CA signed.","commit_id":"6c97e77ed37da9b6ffddc96aaa02e6221c2f60d4"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"ef103f87648dcacdcd4308f91ea4ed3b6e776632","unresolved":false,"context_lines":[{"line_number":97,"context_line":"  OpenStack services behave in the same way with a self-signed certificate"},{"line_number":98,"context_line":"  and a CA certificate. As an example, web browser opens a warning window if"},{"line_number":99,"context_line":"  you are using a self-signed certificate and not if you are using a"},{"line_number":100,"context_line":"  certificate issued by a trusted authority."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"- The possibility for the user to upload a new certificate is not part of this"},{"line_number":103,"context_line":"  specification. That means that if a user cannot upload a new certificate,"}],"source_content_type":"text/x-rst","patch_set":25,"id":"fa98f980_f9b26f92","line":100,"in_reply_to":"fa98f980_e061eea9","updated":"2014-09-05 09:13:49.000000000","message":"I added a note to explain what we mean by trusted authority.","commit_id":"6c97e77ed37da9b6ffddc96aaa02e6221c2f60d4"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"35baa5f44adbb7571a48c75a479dbc27c45accc0","unresolved":false,"context_lines":[{"line_number":97,"context_line":"  OpenStack services behave in the same way with a self-signed certificate"},{"line_number":98,"context_line":"  and a CA certificate. As an example, web browser opens a warning window if"},{"line_number":99,"context_line":"  you are using a self-signed certificate and not if you are using a"},{"line_number":100,"context_line":"  certificate issued by a trusted authority."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"- The possibility for the user to upload a new certificate is not part of this"},{"line_number":103,"context_line":"  specification. That means that if a user cannot upload a new certificate,"}],"source_content_type":"text/x-rst","patch_set":25,"id":"fa98f980_e061eea9","line":100,"in_reply_to":"fa98f980_faf4415c","updated":"2014-09-04 13:07:30.000000000","message":"Trusted authority \u003d a CA that is installed in your browser\u0027s certificate manager. We don\u0027t care if it is a well-known CA (eg Verisign) which is included by all major browsers or a CA managed by your corporate IT.","commit_id":"6c97e77ed37da9b6ffddc96aaa02e6221c2f60d4"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"35baa5f44adbb7571a48c75a479dbc27c45accc0","unresolved":false,"context_lines":[{"line_number":101,"context_line":""},{"line_number":102,"context_line":"- The possibility for the user to upload a new certificate is not part of this"},{"line_number":103,"context_line":"  specification. That means that if a user cannot upload a new certificate,"},{"line_number":104,"context_line":"  the deployment can happen but we will use the self-signed certificate."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"- We can not force a user to use a self-signed certificate. That means that we"},{"line_number":107,"context_line":"  must give the possibility to disable SSL. It can be a checkbox in Fuel to"}],"source_content_type":"text/x-rst","patch_set":25,"id":"fa98f980_80e5820a","line":104,"updated":"2014-09-04 13:07:30.000000000","message":"Maybe remove this paragraph if we don\u0027t allow certificate upload.","commit_id":"6c97e77ed37da9b6ffddc96aaa02e6221c2f60d4"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"ef103f87648dcacdcd4308f91ea4ed3b6e776632","unresolved":false,"context_lines":[{"line_number":101,"context_line":""},{"line_number":102,"context_line":"- The possibility for the user to upload a new certificate is not part of this"},{"line_number":103,"context_line":"  specification. That means that if a user cannot upload a new certificate,"},{"line_number":104,"context_line":"  the deployment can happen but we will use the self-signed certificate."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"- We can not force a user to use a self-signed certificate. That means that we"},{"line_number":107,"context_line":"  must give the possibility to disable SSL. It can be a checkbox in Fuel to"}],"source_content_type":"text/x-rst","patch_set":25,"id":"fa98f980_99c243e7","line":104,"in_reply_to":"fa98f980_80e5820a","updated":"2014-09-05 09:13:49.000000000","message":"Done","commit_id":"6c97e77ed37da9b6ffddc96aaa02e6221c2f60d4"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"35baa5f44adbb7571a48c75a479dbc27c45accc0","unresolved":false,"context_lines":[{"line_number":107,"context_line":"  must give the possibility to disable SSL. It can be a checkbox in Fuel to"},{"line_number":108,"context_line":"  \"disable SSL for public endpoints\" that needs to be checked to disable SSL."},{"line_number":109,"context_line":"  Or vice versa (ie disable by default and a checkbox that need to be checked"},{"line_number":110,"context_line":"  to enable SSL)."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"- In case of \"real\" HA where several HAProxy are deployed. We need to be able"},{"line_number":113,"context_line":"  to distribute the certificate. If it is a self-signed certificate it will be"}],"source_content_type":"text/x-rst","patch_set":25,"id":"fa98f980_40b71af5","line":110,"updated":"2014-09-04 13:07:30.000000000","message":"Might be good to clarify what\u0027s the default behavior.","commit_id":"6c97e77ed37da9b6ffddc96aaa02e6221c2f60d4"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"ef103f87648dcacdcd4308f91ea4ed3b6e776632","unresolved":false,"context_lines":[{"line_number":107,"context_line":"  must give the possibility to disable SSL. It can be a checkbox in Fuel to"},{"line_number":108,"context_line":"  \"disable SSL for public endpoints\" that needs to be checked to disable SSL."},{"line_number":109,"context_line":"  Or vice versa (ie disable by default and a checkbox that need to be checked"},{"line_number":110,"context_line":"  to enable SSL)."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"- In case of \"real\" HA where several HAProxy are deployed. We need to be able"},{"line_number":113,"context_line":"  to distribute the certificate. If it is a self-signed certificate it will be"}],"source_content_type":"text/x-rst","patch_set":25,"id":"fa98f980_1923b3bd","line":110,"in_reply_to":"fa98f980_0e0c553a","updated":"2014-09-05 09:13:49.000000000","message":"Agree with Tomasz. I think that self-signed is a better option than nothing for most people. So I think that it should be the default behavior.","commit_id":"6c97e77ed37da9b6ffddc96aaa02e6221c2f60d4"},{"author":{"_account_id":9546,"name":"Tomasz \u0027Zen\u0027 Napierala","email":"tnapierala@mirantis.com","username":"tzn"},"change_message_id":"cecec657f01c16aa4f8e4cfe219e1d22e258c198","unresolved":false,"context_lines":[{"line_number":107,"context_line":"  must give the possibility to disable SSL. It can be a checkbox in Fuel to"},{"line_number":108,"context_line":"  \"disable SSL for public endpoints\" that needs to be checked to disable SSL."},{"line_number":109,"context_line":"  Or vice versa (ie disable by default and a checkbox that need to be checked"},{"line_number":110,"context_line":"  to enable SSL)."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"- In case of \"real\" HA where several HAProxy are deployed. We need to be able"},{"line_number":113,"context_line":"  to distribute the certificate. If it is a self-signed certificate it will be"}],"source_content_type":"text/x-rst","patch_set":25,"id":"fa98f980_40b9da77","line":110,"in_reply_to":"fa98f980_40b71af5","updated":"2014-09-04 13:10:16.000000000","message":"I think better should be default, so it should be enabled","commit_id":"6c97e77ed37da9b6ffddc96aaa02e6221c2f60d4"},{"author":{"_account_id":6926,"name":"Bogdan Dobrelya","email":"bdobreli@redhat.com","username":"bogdando"},"change_message_id":"fdbc077609ade8ecb5856a7c69e925aaddef5547","unresolved":false,"context_lines":[{"line_number":107,"context_line":"  must give the possibility to disable SSL. It can be a checkbox in Fuel to"},{"line_number":108,"context_line":"  \"disable SSL for public endpoints\" that needs to be checked to disable SSL."},{"line_number":109,"context_line":"  Or vice versa (ie disable by default and a checkbox that need to be checked"},{"line_number":110,"context_line":"  to enable SSL)."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"- In case of \"real\" HA where several HAProxy are deployed. We need to be able"},{"line_number":113,"context_line":"  to distribute the certificate. If it is a self-signed certificate it will be"}],"source_content_type":"text/x-rst","patch_set":25,"id":"fa98f980_f07b75bb","line":110,"in_reply_to":"fa98f980_40b9da77","updated":"2014-09-04 18:41:46.000000000","message":"Perhaps, any self-signed certificates should never be used by default, thus the feature as well - then user enables it w/o providing a certificate it is supposed he or she understand the security impacts of self-signed certificates.","commit_id":"6c97e77ed37da9b6ffddc96aaa02e6221c2f60d4"},{"author":{"_account_id":9546,"name":"Tomasz \u0027Zen\u0027 Napierala","email":"tnapierala@mirantis.com","username":"tzn"},"change_message_id":"82174c3280a078b007aa8d955afd7754a6b18e3b","unresolved":false,"context_lines":[{"line_number":107,"context_line":"  must give the possibility to disable SSL. It can be a checkbox in Fuel to"},{"line_number":108,"context_line":"  \"disable SSL for public endpoints\" that needs to be checked to disable SSL."},{"line_number":109,"context_line":"  Or vice versa (ie disable by default and a checkbox that need to be checked"},{"line_number":110,"context_line":"  to enable SSL)."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"- In case of \"real\" HA where several HAProxy are deployed. We need to be able"},{"line_number":113,"context_line":"  to distribute the certificate. If it is a self-signed certificate it will be"}],"source_content_type":"text/x-rst","patch_set":25,"id":"fa98f980_0e0c553a","line":110,"in_reply_to":"fa98f980_6b579326","updated":"2014-09-04 21:09:20.000000000","message":"I se that we will not be using CA in this scenario, so this comment does only apply partially ;)","commit_id":"6c97e77ed37da9b6ffddc96aaa02e6221c2f60d4"},{"author":{"_account_id":9546,"name":"Tomasz \u0027Zen\u0027 Napierala","email":"tnapierala@mirantis.com","username":"tzn"},"change_message_id":"3b6a5078cb5591c3ee222ed3fc5db958e198955b","unresolved":false,"context_lines":[{"line_number":107,"context_line":"  must give the possibility to disable SSL. It can be a checkbox in Fuel to"},{"line_number":108,"context_line":"  \"disable SSL for public endpoints\" that needs to be checked to disable SSL."},{"line_number":109,"context_line":"  Or vice versa (ie disable by default and a checkbox that need to be checked"},{"line_number":110,"context_line":"  to enable SSL)."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"- In case of \"real\" HA where several HAProxy are deployed. We need to be able"},{"line_number":113,"context_line":"  to distribute the certificate. If it is a self-signed certificate it will be"}],"source_content_type":"text/x-rst","patch_set":25,"id":"fa98f980_6b579326","line":110,"in_reply_to":"fa98f980_f07b75bb","updated":"2014-09-04 21:07:15.000000000","message":"In setup with CA, it is almost as secure as third party cert. Morover some attack vectors are smaller. And encrypted traffic is always better than not encrypted.","commit_id":"6c97e77ed37da9b6ffddc96aaa02e6221c2f60d4"},{"author":{"_account_id":11827,"name":"Stanislaw Bogatkin","email":"regs+ubuntu.com@sbog.ru","username":"sbogatkin"},"change_message_id":"04621d4dc4768d13e26698349e457d662c1cc7af","unresolved":false,"context_lines":[{"line_number":212,"context_line":"the cluster is created, if it is available (it is not in the scope of this"},{"line_number":213,"context_line":"specification) the user can download its own certificate for the given VIP."},{"line_number":214,"context_line":"If it cannot download it or don\u0027t want to use another certificate then"},{"line_number":215,"context_line":"everything will work fine with the self signed certificate."},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"Developer impact"},{"line_number":218,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":25,"id":"fa98f980_bde1d32b","line":215,"updated":"2014-09-04 12:18:48.000000000","message":"s/self signed/self-signed/","commit_id":"6c97e77ed37da9b6ffddc96aaa02e6221c2f60d4"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"4b93ebffc1bce93b7170bcd032c051cf6d65f97c","unresolved":false,"context_lines":[{"line_number":212,"context_line":"the cluster is created, if it is available (it is not in the scope of this"},{"line_number":213,"context_line":"specification) the user can download its own certificate for the given VIP."},{"line_number":214,"context_line":"If it cannot download it or don\u0027t want to use another certificate then"},{"line_number":215,"context_line":"everything will work fine with the self signed certificate."},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"Developer impact"},{"line_number":218,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":25,"id":"fa98f980_2041360b","line":215,"in_reply_to":"fa98f980_bde1d32b","updated":"2014-09-04 12:55:18.000000000","message":"Done","commit_id":"6c97e77ed37da9b6ffddc96aaa02e6221c2f60d4"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"29a0ccb9b3694cf15889fc618cd43d603ea31449","unresolved":false,"context_lines":[{"line_number":228,"context_line":""},{"line_number":229,"context_line":"Primary assignee:"},{"line_number":230,"context_line":"  guillaume-thouvenin"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"Work Items"},{"line_number":233,"context_line":"----------"},{"line_number":234,"context_line":""}],"source_content_type":"text/x-rst","patch_set":25,"id":"fa98f980_7cbf4d61","line":231,"updated":"2014-09-05 09:20:34.000000000","message":"I added Stanislaw as a developer. And I also added the feature lead, mandatory design reviewer, etc...","commit_id":"6c97e77ed37da9b6ffddc96aaa02e6221c2f60d4"},{"author":{"_account_id":6926,"name":"Bogdan Dobrelya","email":"bdobreli@redhat.com","username":"bogdando"},"change_message_id":"79c08ec8de172ba041e86ffd035e7691ae0fb8ce","unresolved":false,"context_lines":[{"line_number":249,"context_line":""},{"line_number":250,"context_line":"- Generate a self-signed certificate that will be used for authentication. As"},{"line_number":251,"context_line":"  a future work we will use feature provided by the following blueprint"},{"line_number":252,"context_line":"  https://blueprints.launchpad.net/fuel/+spec/ca-deployment"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"- Install HAProxy and configure it to handle SSL connections and forward"},{"line_number":255,"context_line":"  requests to the corresponding service."}],"source_content_type":"text/x-rst","patch_set":28,"id":"fa98f980_7fe4f83b","line":252,"updated":"2014-09-11 09:27:16.000000000","message":"I agree CA management should be out of the scope of this design doc (basically, I strongly believe it should be out of scope of Fuel as well).\n\nBut should this one provide importing the side generated certificate, if user have any? I think it should","commit_id":"9bd38defb1e152ee9a1b0e46057e5e96b55cb1f8"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"80b00c77aacfe688ffb16eeb50ecea7d4d9e3495","unresolved":false,"context_lines":[{"line_number":249,"context_line":""},{"line_number":250,"context_line":"- Generate a self-signed certificate that will be used for authentication. As"},{"line_number":251,"context_line":"  a future work we will use feature provided by the following blueprint"},{"line_number":252,"context_line":"  https://blueprints.launchpad.net/fuel/+spec/ca-deployment"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"- Install HAProxy and configure it to handle SSL connections and forward"},{"line_number":255,"context_line":"  requests to the corresponding service."}],"source_content_type":"text/x-rst","patch_set":28,"id":"fa98f980_a4a7284f","line":252,"in_reply_to":"fa98f980_73218c4c","updated":"2014-09-11 15:26:08.000000000","message":"So basically I will add the following sentence:\n\n\nstage1:\n\n- User don\u0027t want SSL\n\n- User want SSL \u003d\u003e cert generated by Fuel (Nailgun). It can be self-signed or we can generate a CA authority (not so much work and less complicated for users and OSTF).\n\n- Document how user can upload its own cert for SSL endpoints\n\nstage2:\n\n- User wants to upload its/her own certificate.","commit_id":"9bd38defb1e152ee9a1b0e46057e5e96b55cb1f8"},{"author":{"_account_id":11827,"name":"Stanislaw Bogatkin","email":"regs+ubuntu.com@sbog.ru","username":"sbogatkin"},"change_message_id":"d792cc4e0c6f7c2b0b263b8e975de5ca21d2becf","unresolved":false,"context_lines":[{"line_number":249,"context_line":""},{"line_number":250,"context_line":"- Generate a self-signed certificate that will be used for authentication. As"},{"line_number":251,"context_line":"  a future work we will use feature provided by the following blueprint"},{"line_number":252,"context_line":"  https://blueprints.launchpad.net/fuel/+spec/ca-deployment"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"- Install HAProxy and configure it to handle SSL connections and forward"},{"line_number":255,"context_line":"  requests to the corresponding service."}],"source_content_type":"text/x-rst","patch_set":28,"id":"fa98f980_8eefa8b0","line":252,"in_reply_to":"fa98f980_7fe4f83b","updated":"2014-09-11 13:03:21.000000000","message":"I think that we can split work over this blueprint for parts. In first stage we will use self-signed cert. In second stage we will use CA (I agree with Bigdan that CA is out of scope to this blueprint, yes, but I think that we need CA in Fuel, actually) and can do some work to import user own cert.","commit_id":"9bd38defb1e152ee9a1b0e46057e5e96b55cb1f8"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"4abbd89f6c09cacef0a767b550f5ac4eb7e619a2","unresolved":false,"context_lines":[{"line_number":249,"context_line":""},{"line_number":250,"context_line":"- Generate a self-signed certificate that will be used for authentication. As"},{"line_number":251,"context_line":"  a future work we will use feature provided by the following blueprint"},{"line_number":252,"context_line":"  https://blueprints.launchpad.net/fuel/+spec/ca-deployment"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"- Install HAProxy and configure it to handle SSL connections and forward"},{"line_number":255,"context_line":"  requests to the corresponding service."}],"source_content_type":"text/x-rst","patch_set":28,"id":"fa98f980_73218c4c","line":252,"in_reply_to":"fa98f980_8eefa8b0","updated":"2014-09-11 13:53:06.000000000","message":"Another solution is the one proposed on the mailing list. It is to explain to the user into the documentation how he can use its own certificate. So in this spec we can focus on two cases:\n\n1) User don\u0027t want to use SSL (so there is an option to disable it)\n\n2) If he want SSL then it will be with a self-signed certificate.\n\nAll other cases are future work and/or documented (like the upload of its own CA).","commit_id":"9bd38defb1e152ee9a1b0e46057e5e96b55cb1f8"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"5ec6add054bd14429b1d67d7fca5dd24fc54d554","unresolved":false,"context_lines":[{"line_number":37,"context_line":"In this specification we are making the assumption that non HA deployment"},{"line_number":38,"context_line":"is deprecated and Fuel support deploying a single HA mode as descibed here:"},{"line_number":39,"context_line":"https://blueprints.launchpad.net/fuel/+spec/single-controller-ha"},{"line_number":40,"context_line":"That means that we consider that HAProxy is deployed for all configurations."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Here is a schema of the encryption of the traffic paths:"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":31,"id":"fa98f980_c32dbbff","line":40,"updated":"2014-09-15 08:01:39.000000000","message":"I would be less strict on this assumption. Non-HA mode may remain a supported option but in that case, it won\u0027t be compatible with SSL.","commit_id":"32668d0850c948de9e3a0cec469c03aa445342a0"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"c1df5b789c9cc7d8dfe8b1da9dd8f21bef7bb2e2","unresolved":false,"context_lines":[{"line_number":37,"context_line":"In this specification we are making the assumption that non HA deployment"},{"line_number":38,"context_line":"is deprecated and Fuel support deploying a single HA mode as descibed here:"},{"line_number":39,"context_line":"https://blueprints.launchpad.net/fuel/+spec/single-controller-ha"},{"line_number":40,"context_line":"That means that we consider that HAProxy is deployed for all configurations."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Here is a schema of the encryption of the traffic paths:"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":31,"id":"fa98f980_1948132c","line":40,"in_reply_to":"fa98f980_c32dbbff","updated":"2014-09-15 11:14:57.000000000","message":"Done","commit_id":"32668d0850c948de9e3a0cec469c03aa445342a0"},{"author":{"_account_id":10392,"name":"Dmitry Nikishov","email":"dnikishov@mirantis.com","username":"dnikishov"},"change_message_id":"209db9c3e775aa54e47cd24e38bb71e485767c3f","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"- Configure HAProxy to manage SSL connections and to forward the request to"},{"line_number":81,"context_line":"  the corresponding service."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"- When an OpenStack service queries another OpenStack service it must use the"},{"line_number":84,"context_line":"  internal API endpoint. If it\u0027s not possible, the service needs to be"},{"line_number":85,"context_line":"  configured with the SSL certificate (if self-signed) or the certification"}],"source_content_type":"text/x-rst","patch_set":31,"id":"fa98f980_d67d6d1d","line":82,"updated":"2014-09-15 16:50:53.000000000","message":"Shouldn\u0027t there be a separate step for configuring services\u0027 public endpoints in Keystone?","commit_id":"32668d0850c948de9e3a0cec469c03aa445342a0"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"aae6d37bea88e3c83a58b8e32cdfc5b05194a27d","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"- Configure HAProxy to manage SSL connections and to forward the request to"},{"line_number":81,"context_line":"  the corresponding service."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"- When an OpenStack service queries another OpenStack service it must use the"},{"line_number":84,"context_line":"  internal API endpoint. If it\u0027s not possible, the service needs to be"},{"line_number":85,"context_line":"  configured with the SSL certificate (if self-signed) or the certification"}],"source_content_type":"text/x-rst","patch_set":31,"id":"fa98f980_7a7d746c","line":82,"in_reply_to":"fa98f980_d67d6d1d","updated":"2014-09-16 07:31:39.000000000","message":"Yes I can add it. And there is already a review to configure them in keystone: https://review.openstack.org/#/c/114909/","commit_id":"32668d0850c948de9e3a0cec469c03aa445342a0"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"5ec6add054bd14429b1d67d7fca5dd24fc54d554","unresolved":false,"context_lines":[{"line_number":82,"context_line":""},{"line_number":83,"context_line":"- When an OpenStack service queries another OpenStack service it must use the"},{"line_number":84,"context_line":"  internal API endpoint. If it\u0027s not possible, the service needs to be"},{"line_number":85,"context_line":"  configured with the SSL certificate (if self-signed) or the certification"},{"line_number":86,"context_line":"  authority\u0027s certificate used by HAProxy."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"- We will use a self-signed certificate by default. In terms of encryption it"}],"source_content_type":"text/x-rst","patch_set":31,"id":"fa98f980_230e878c","line":85,"range":{"start_line":85,"start_character":42,"end_line":85,"end_character":53},"updated":"2014-09-15 08:01:39.000000000","message":"Fuel-signed rather?","commit_id":"32668d0850c948de9e3a0cec469c03aa445342a0"},{"author":{"_account_id":11827,"name":"Stanislaw Bogatkin","email":"regs+ubuntu.com@sbog.ru","username":"sbogatkin"},"change_message_id":"661485724c4229b91b534ee1c6e8a596a8b832eb","unresolved":false,"context_lines":[{"line_number":82,"context_line":""},{"line_number":83,"context_line":"- When an OpenStack service queries another OpenStack service it must use the"},{"line_number":84,"context_line":"  internal API endpoint. If it\u0027s not possible, the service needs to be"},{"line_number":85,"context_line":"  configured with the SSL certificate (if self-signed) or the certification"},{"line_number":86,"context_line":"  authority\u0027s certificate used by HAProxy."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"- We will use a self-signed certificate by default. In terms of encryption it"}],"source_content_type":"text/x-rst","patch_set":31,"id":"fa98f980_7ee58836","line":85,"range":{"start_line":85,"start_character":42,"end_line":85,"end_character":53},"in_reply_to":"fa98f980_230e878c","updated":"2014-09-15 08:15:56.000000000","message":"Nope. Term for that is \u0027self-signed\u0027.","commit_id":"32668d0850c948de9e3a0cec469c03aa445342a0"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"c1df5b789c9cc7d8dfe8b1da9dd8f21bef7bb2e2","unresolved":false,"context_lines":[{"line_number":82,"context_line":""},{"line_number":83,"context_line":"- When an OpenStack service queries another OpenStack service it must use the"},{"line_number":84,"context_line":"  internal API endpoint. If it\u0027s not possible, the service needs to be"},{"line_number":85,"context_line":"  configured with the SSL certificate (if self-signed) or the certification"},{"line_number":86,"context_line":"  authority\u0027s certificate used by HAProxy."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"- We will use a self-signed certificate by default. In terms of encryption it"}],"source_content_type":"text/x-rst","patch_set":31,"id":"fa98f980_19cbb372","line":85,"range":{"start_line":85,"start_character":42,"end_line":85,"end_character":53},"in_reply_to":"fa98f980_7ee58836","updated":"2014-09-15 11:14:57.000000000","message":"I will replace by \"needs to be configured with the appropriate SSL certificate.\" because the second part of the sentence (after the or) referred to certificate that has been downloaded by the user and it is not the case for this blueprint.","commit_id":"32668d0850c948de9e3a0cec469c03aa445342a0"},{"author":{"_account_id":10392,"name":"Dmitry Nikishov","email":"dnikishov@mirantis.com","username":"dnikishov"},"change_message_id":"209db9c3e775aa54e47cd24e38bb71e485767c3f","unresolved":false,"context_lines":[{"line_number":103,"context_line":""},{"line_number":104,"context_line":"- Even if encrypted communications with a self-signed certificate are a better"},{"line_number":105,"context_line":"  solution than plain text ones we can not force a user to use a self-signed"},{"line_number":106,"context_line":"  certificate. By default we will enable SSL but must give the possibility to"},{"line_number":107,"context_line":"  the user to disable it. It can be a checkbox in Fuel UI to \"disable SSL for"},{"line_number":108,"context_line":"  public endpoints\" that needs to be checked to disable SSL."},{"line_number":109,"context_line":""}],"source_content_type":"text/x-rst","patch_set":31,"id":"fa98f980_76092194","line":106,"updated":"2014-09-15 16:50:53.000000000","message":"Do we really need to enable SSL by default?","commit_id":"32668d0850c948de9e3a0cec469c03aa445342a0"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"aae6d37bea88e3c83a58b8e32cdfc5b05194a27d","unresolved":false,"context_lines":[{"line_number":103,"context_line":""},{"line_number":104,"context_line":"- Even if encrypted communications with a self-signed certificate are a better"},{"line_number":105,"context_line":"  solution than plain text ones we can not force a user to use a self-signed"},{"line_number":106,"context_line":"  certificate. By default we will enable SSL but must give the possibility to"},{"line_number":107,"context_line":"  the user to disable it. It can be a checkbox in Fuel UI to \"disable SSL for"},{"line_number":108,"context_line":"  public endpoints\" that needs to be checked to disable SSL."},{"line_number":109,"context_line":""}],"source_content_type":"text/x-rst","patch_set":31,"id":"fa98f980_3a0a0cd2","line":106,"in_reply_to":"fa98f980_76092194","updated":"2014-09-16 07:31:39.000000000","message":"I have not a strong opinion on this point. I guess that it is the choice of the product manager.","commit_id":"32668d0850c948de9e3a0cec469c03aa445342a0"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"5ec6add054bd14429b1d67d7fca5dd24fc54d554","unresolved":false,"context_lines":[{"line_number":211,"context_line":""},{"line_number":212,"context_line":"The work flow is to deploy the cluster with a self-signed certificate that was"},{"line_number":213,"context_line":"generated by astute at the creation of the cluster. This certificate must"},{"line_number":214,"context_line":"be store somewhere on the fuel master node with the appropriate rights. When"},{"line_number":215,"context_line":"the cluster is created, if it is available (it is not in the scope of this"},{"line_number":216,"context_line":"specification) the user can download its own certificate for the given VIP."},{"line_number":217,"context_line":"If it cannot download it or don\u0027t want to use another certificate then"}],"source_content_type":"text/x-rst","patch_set":31,"id":"fa98f980_03d0a3c7","line":214,"range":{"start_line":214,"start_character":3,"end_line":214,"end_character":8},"updated":"2014-09-15 08:01:39.000000000","message":"s/stored/store/","commit_id":"32668d0850c948de9e3a0cec469c03aa445342a0"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"c1df5b789c9cc7d8dfe8b1da9dd8f21bef7bb2e2","unresolved":false,"context_lines":[{"line_number":211,"context_line":""},{"line_number":212,"context_line":"The work flow is to deploy the cluster with a self-signed certificate that was"},{"line_number":213,"context_line":"generated by astute at the creation of the cluster. This certificate must"},{"line_number":214,"context_line":"be store somewhere on the fuel master node with the appropriate rights. When"},{"line_number":215,"context_line":"the cluster is created, if it is available (it is not in the scope of this"},{"line_number":216,"context_line":"specification) the user can download its own certificate for the given VIP."},{"line_number":217,"context_line":"If it cannot download it or don\u0027t want to use another certificate then"}],"source_content_type":"text/x-rst","patch_set":31,"id":"fa98f980_b90d47ea","line":214,"range":{"start_line":214,"start_character":3,"end_line":214,"end_character":8},"in_reply_to":"fa98f980_03d0a3c7","updated":"2014-09-15 11:14:57.000000000","message":"Done","commit_id":"32668d0850c948de9e3a0cec469c03aa445342a0"},{"author":{"_account_id":6794,"name":"Simon Pasquier","email":"pasquier.simon@gmail.com","username":"simon-pasquier"},"change_message_id":"5ec6add054bd14429b1d67d7fca5dd24fc54d554","unresolved":false,"context_lines":[{"line_number":315,"context_line":"CLI (for example nova CLI) to interact with OpenStack services."},{"line_number":316,"context_line":""},{"line_number":317,"context_line":"If the user wants to use its own certificate we need to describe where and how"},{"line_number":318,"context_line":"it can manually uploads its certificate."},{"line_number":319,"context_line":""},{"line_number":320,"context_line":"References"},{"line_number":321,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":31,"id":"fa98f980_a3f51752","line":318,"range":{"start_line":318,"start_character":16,"end_line":318,"end_character":23},"updated":"2014-09-15 08:01:39.000000000","message":"s/uploads/upload/","commit_id":"32668d0850c948de9e3a0cec469c03aa445342a0"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"c1df5b789c9cc7d8dfe8b1da9dd8f21bef7bb2e2","unresolved":false,"context_lines":[{"line_number":315,"context_line":"CLI (for example nova CLI) to interact with OpenStack services."},{"line_number":316,"context_line":""},{"line_number":317,"context_line":"If the user wants to use its own certificate we need to describe where and how"},{"line_number":318,"context_line":"it can manually uploads its certificate."},{"line_number":319,"context_line":""},{"line_number":320,"context_line":"References"},{"line_number":321,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":31,"id":"fa98f980_792e7f44","line":318,"range":{"start_line":318,"start_character":16,"end_line":318,"end_character":23},"in_reply_to":"fa98f980_a3f51752","updated":"2014-09-15 11:14:57.000000000","message":"Damn^H^H^Hone","commit_id":"32668d0850c948de9e3a0cec469c03aa445342a0"},{"author":{"_account_id":11827,"name":"Stanislaw Bogatkin","email":"regs+ubuntu.com@sbog.ru","username":"sbogatkin"},"change_message_id":"c6253b1e9f67e5aca49ad215913fcec26fbdbc91","unresolved":false,"context_lines":[{"line_number":168,"context_line":"If the updated environment does not use SSL before the update, it will not"},{"line_number":169,"context_line":"use SSL after the update. In other words, we currently not support the update"},{"line_number":170,"context_line":"from an environment that does not support SSL to a upgraded environment with"},{"line_number":171,"context_line":"SSL support."},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Security impact"},{"line_number":174,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":34,"id":"baa201ad_d73aab33","line":171,"updated":"2014-10-09 15:09:44.000000000","message":"So will be right to revert also - we will not support downgrade from SSL to non-SSL. I do not know would we support revert at all, but if we do - this fact should be mentioned here.","commit_id":"0be3729b70400768d439f61571acbe93cde91ae0"},{"author":{"_account_id":6904,"name":"Guillaume Thouvenin","email":"gthouvenin@mirantis.com","username":"guillaume-thouvenin"},"change_message_id":"fa101c962edfea61d9949a729818f398a29d2c84","unresolved":false,"context_lines":[{"line_number":168,"context_line":"If the updated environment does not use SSL before the update, it will not"},{"line_number":169,"context_line":"use SSL after the update. In other words, we currently not support the update"},{"line_number":170,"context_line":"from an environment that does not support SSL to a upgraded environment with"},{"line_number":171,"context_line":"SSL support."},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Security impact"},{"line_number":174,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":34,"id":"baa201ad_5f5ec213","line":171,"in_reply_to":"baa201ad_d73aab33","updated":"2014-10-10 07:37:18.000000000","message":"Done","commit_id":"0be3729b70400768d439f61571acbe93cde91ae0"},{"author":{"_account_id":11427,"name":"Igor Zinovik","email":"izinovik@mirantis.com","username":"izinovik"},"change_message_id":"ed7a71b071c4bb75b50ec67a7a191d01a04eaa07","unresolved":false,"context_lines":[{"line_number":231,"context_line":"----------------"},{"line_number":232,"context_line":""},{"line_number":233,"context_line":"Maybe OSTF team (health check team) is going to be affected by changing"},{"line_number":234,"context_line":"OpenStack endpoints. Need to be checked."},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"Implementation"},{"line_number":237,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":39,"id":"3a961159_447c44b6","line":234,"updated":"2014-12-26 10:09:12.000000000","message":"OSTF by default uses HTTP protocol to access OpenStack endpoints.\n\nIt also has option called \u0027disable_ssl_certificate_validation\u0027 (https://github.com/stackforge/fuel-ostf/blob/master/fuel_health/config.py#L40) which is set to\nFalse by default.  Seems that depending on usage of SSL this variable must\nbe triggered.","commit_id":"53768ae2e9e6f5ab315910ee16d9712cb5f9cdb8"}]}