)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"0d685c2531aa55bffe0c41456c713ca085886c78","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":7,"id":"e7596271_9909618c","updated":"2021-11-20 14:07:24.000000000","message":"One observation, one question:\n\nObservation: I think this would be better as \"initial implementation without Secret Consumers\" and then you don\u0027t have to work out how the stubs for the Secret Consumers API will be handled.  You can\njust promise to add the Secret Consumers stuff when it\u0027s available in Barbican.  (The glance team has to trust you on that, just like they have to trust that you will come back to make the placeholders actually work.)\n\nQuestion: how is the EXPERIMENTAL nature of this going to be handled/communicated?  Will there be a config option (shipped \"off\") that operators can enable?  IIRC, all the info about the encrypted upload is being conveyed by setting image properties, so there\u0027s no API change associated with your implementation that could be flagged as an EXPERIMENTAL version of the API.","commit_id":"373d5e3049fcc748b8c0a6dcdf8e0fafc72c4d99"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"05278ce392a93dab99d43487c84a479a77aef1ae","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"eb4dec8c_b0246f03","updated":"2021-12-06 13:24:37.000000000","message":"All I did was resolve the merge conflict, no content change.  Still have my questions from PS 7.","commit_id":"4606cdae16794981c40c13c890604f45d3798f19"}],"specs/xena/approved/glance/image-encryption-delayed-secret-consumers.rst":[{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"2e911d82007a6a563b2077abf20210277a97ad90","unresolved":true,"context_lines":[{"line_number":8,"context_line":"Spec Lite: Image Encryption with delayed Secret Consumers"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":".."},{"line_number":12,"context_line":"  Mandatory sections"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":":project: glance"},{"line_number":15,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f654ca5_eab9f713","line":12,"range":{"start_line":11,"start_character":0,"end_line":12,"end_character":20},"updated":"2021-05-20 13:56:53.000000000","message":"You can remove this.\nAlso need to fix following indentation issues.","commit_id":"d0b33215e65080857bd3633ea8fd5402c4162a6d"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"66a312e2e781ff2b77f99e4dde3822e649c4955c","unresolved":true,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":":problem: The Secret Consumer API from Barbican should be used in the Image Encryption"},{"line_number":14,"context_line":"          to set an Image as a consumer for a secret when creating it and delete it"},{"line_number":15,"context_line":"          from the consumer list when the image is deleted. So a user cannot delete a"},{"line_number":16,"context_line":"          secret which still has consumers. This feature of Barbican still needs some"},{"line_number":17,"context_line":"          time to be finished and my not be available in Xena."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":":solution: We want to implement the Image Encryption with only placeholders for the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"b2aa22a1_d95e73db","line":16,"range":{"start_line":15,"start_character":60,"end_line":16,"end_character":43},"updated":"2021-05-24 12:36:03.000000000","message":"I thought with the Secret Consumer API, the owner can still delete a secret with a --force option, so it\u0027s more of an extra check (which is definitely nice to have), but a user could still delete in-use secrets even with the Secret Consumer API.  I think it\u0027s worth stating this explicitly in order to make it clear that the bad scenario can occur even with the Secret Consumer API, so it\u0027s not like there\u0027s a gaping hole in the implementation if the Consumer API is not available.)","commit_id":"cb9462bfcb5e653d75b8ce0d7d483ac87fa69c16"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"66a312e2e781ff2b77f99e4dde3822e649c4955c","unresolved":true,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":":impacts: For the proposed initial implementation, encrypted images might get"},{"line_number":26,"context_line":"          inaccessible if users accidently delete the corresponding encryption secrets"},{"line_number":27,"context_line":"          in Barbican. When secret consumers have been implemented, future users of"},{"line_number":28,"context_line":"          the Image Encryption will have to be careful when deleting secrets for any"},{"line_number":29,"context_line":"          Images created before secret consumer support was available to the Image"},{"line_number":30,"context_line":"          Encryption, since those will not be protected by the consumer list."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":":link: https://review.opendev.org/c/openstack/glance/+/705445/"},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"f5667341_d88503a9","line":30,"range":{"start_line":27,"start_character":23,"end_line":30,"end_character":77},"updated":"2021-05-24 12:36:03.000000000","message":"I think you\u0027ll be able to use os_glance_encrypt_key_id\u003dUUID as a filter to the image-list request to find out if a particular secret ID is in use.\n\nAlso, I think this commit:\nhttps://opendev.org/openstack/glance/commit/0c45de3ed8253096bb9d4031db8e046107e2774b\n\nwill have an impact on your original spec, because it makes the \u0027os_glance\u0027 prefix a reserved namespace, and end users won\u0027t be allowed to create the properties needed for the feature:\n\nhttps://opendev.org/openstack/glance-specs/blame/commit/c33e771b4e62267aed757849f9be063d3d5c35c0/specs/victoria/approved/glance/image-encryption.rst#L89-L94\n\nThis isn\u0027t directly related to the topic of this spec-lite, but we do need to figure out what to do about this (which I imagine will be using a different prefix for your image properties), and then amend the original spec.","commit_id":"cb9462bfcb5e653d75b8ce0d7d483ac87fa69c16"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"33e00690db9a2defaba50aff60f6ba72f6415391","unresolved":true,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":":impacts: For the proposed initial implementation, encrypted images might get"},{"line_number":26,"context_line":"          inaccessible if users accidently delete the corresponding encryption secrets"},{"line_number":27,"context_line":"          in Barbican. When secret consumers have been implemented, future users of"},{"line_number":28,"context_line":"          the Image Encryption will have to be careful when deleting secrets for any"},{"line_number":29,"context_line":"          Images created before secret consumer support was available to the Image"},{"line_number":30,"context_line":"          Encryption, since those will not be protected by the consumer list."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":":link: https://review.opendev.org/c/openstack/glance/+/705445/"},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"61076ab9_c42b5a6b","line":30,"range":{"start_line":27,"start_character":23,"end_line":30,"end_character":77},"in_reply_to":"a5d7378f_e2884953","updated":"2021-05-26 13:33:31.000000000","message":"I think those are fine.  The \u0027os_\u0027 part indicates that it has something to do with openstack, so that will help distinguish those properties.  Only \u0027os_glance_\u0027 properties are reserved.\n\nYou should probably put up a patch to update the original spec with the actual names you\u0027ll be using.","commit_id":"cb9462bfcb5e653d75b8ce0d7d483ac87fa69c16"},{"author":{"_account_id":28271,"name":"Josephine Seifert","email":"josephine.seifert@cloudandheat.com","username":"josei"},"change_message_id":"2cfc94f746e62b3a7f709bcead035dfef94fbdc4","unresolved":true,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":":impacts: For the proposed initial implementation, encrypted images might get"},{"line_number":26,"context_line":"          inaccessible if users accidently delete the corresponding encryption secrets"},{"line_number":27,"context_line":"          in Barbican. When secret consumers have been implemented, future users of"},{"line_number":28,"context_line":"          the Image Encryption will have to be careful when deleting secrets for any"},{"line_number":29,"context_line":"          Images created before secret consumer support was available to the Image"},{"line_number":30,"context_line":"          Encryption, since those will not be protected by the consumer list."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":":link: https://review.opendev.org/c/openstack/glance/+/705445/"},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"a5d7378f_e2884953","line":30,"range":{"start_line":27,"start_character":23,"end_line":30,"end_character":77},"in_reply_to":"f5667341_d88503a9","updated":"2021-05-26 09:14:37.000000000","message":"I looked into the WIP patch linked below. We don\u0027t use the \u0027os_glance\u0027 prefix but \u0027os_encrypt_*\u0027 and \u0027os_decrypt_*\u0027. Would that be a problem too?","commit_id":"cb9462bfcb5e653d75b8ce0d7d483ac87fa69c16"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"33e00690db9a2defaba50aff60f6ba72f6415391","unresolved":true,"context_lines":[{"line_number":14,"context_line":"          to set an Image as a consumer for a secret when creating it and delete it"},{"line_number":15,"context_line":"          from the consumer list when the image is deleted. So a user cannot delete a"},{"line_number":16,"context_line":"          secret which still has consumers unless the \u0027--force\u0027 option is used. This"},{"line_number":17,"context_line":"          feature of Barbican still needs some time to be finished and my not be"},{"line_number":18,"context_line":"          available in Xena."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":":solution: We want to implement the Image Encryption with only placeholders for the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"f9ee9339_8e2db23e","line":17,"range":{"start_line":17,"start_character":71,"end_line":17,"end_character":73},"updated":"2021-05-26 13:33:31.000000000","message":"may","commit_id":"d6e6cf92b2363f7fc420e1503abe112b64fde014"},{"author":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"change_message_id":"95783d951f2b67e0737cc51a6f2d5b4357c33f91","unresolved":true,"context_lines":[{"line_number":15,"context_line":"          from the consumer list when the image is deleted. So a user cannot delete a"},{"line_number":16,"context_line":"          secret which still has consumers unless the \u0027--force\u0027 option is used. This"},{"line_number":17,"context_line":"          feature of Barbican still needs some time to be finished and may not be"},{"line_number":18,"context_line":"          available in Xena."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":":solution: We want to implement the Image Encryption with only placeholders for the"},{"line_number":21,"context_line":"           Secret Consumers in Xena. The Secret Consumers can be added as soon as they"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3d1265e0_22415c88","line":18,"range":{"start_line":18,"start_character":0,"end_line":18,"end_character":28},"updated":"2021-07-01 00:57:36.000000000","message":"This already sounds more like a solution than a problem. What is the actual issue we are facing? Then in the \"solution\" section, describe how/why the secret consumer API from Barbican would help us solve this issue.","commit_id":"b74e83b3e39b3bcccdb07062b15c7bdffc1c9277"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"1d868218264fb4b000c2941e62612786ddd017b5","unresolved":true,"context_lines":[{"line_number":17,"context_line":"          feature of Barbican still needs some time to be finished and may not be"},{"line_number":18,"context_line":"          available in Xena."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":":solution: We want to implement the Image Encryption with only placeholders for the"},{"line_number":21,"context_line":"           Secret Consumers in Xena. The Secret Consumers can be added as soon as they"},{"line_number":22,"context_line":"           are finished by replacing the placeholders. Omitting the implementation of"},{"line_number":23,"context_line":"           secret consumers will not restrict the functionality of the image"},{"line_number":24,"context_line":"           encryption itself."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":":impacts: For the proposed initial implementation, encrypted images might get"},{"line_number":27,"context_line":"          inaccessible if users accidently delete the corresponding encryption secrets"}],"source_content_type":"text/x-rst","patch_set":5,"id":"a07fcd49_0b93f298","line":24,"range":{"start_line":20,"start_character":11,"end_line":24,"end_character":29},"updated":"2021-06-24 14:46:23.000000000","message":"I\u0027d propose we make it clear here that the feature is not considered completed and supported before the Secret Consumers part is done and it\u0027s EXPERIMENTAL (also for the reasons that we can correct the API behaviour if this work goes past Xena release). The intent for this lite-spec is speed up the development of the other components while waiting for the Secret Consumer API finishingg in Barbican.","commit_id":"b74e83b3e39b3bcccdb07062b15c7bdffc1c9277"},{"author":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"change_message_id":"95783d951f2b67e0737cc51a6f2d5b4357c33f91","unresolved":true,"context_lines":[{"line_number":17,"context_line":"          feature of Barbican still needs some time to be finished and may not be"},{"line_number":18,"context_line":"          available in Xena."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":":solution: We want to implement the Image Encryption with only placeholders for the"},{"line_number":21,"context_line":"           Secret Consumers in Xena. The Secret Consumers can be added as soon as they"},{"line_number":22,"context_line":"           are finished by replacing the placeholders. Omitting the implementation of"},{"line_number":23,"context_line":"           secret consumers will not restrict the functionality of the image"},{"line_number":24,"context_line":"           encryption itself."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":":impacts: For the proposed initial implementation, encrypted images might get"},{"line_number":27,"context_line":"          inaccessible if users accidently delete the corresponding encryption secrets"}],"source_content_type":"text/x-rst","patch_set":5,"id":"145083a7_9781aa58","line":24,"range":{"start_line":20,"start_character":11,"end_line":24,"end_character":29},"in_reply_to":"a07fcd49_0b93f298","updated":"2021-07-01 00:57:36.000000000","message":"+1. I\u0027d like users to know that if they use this before it\u0027s been fully implemented, they might run into issues.","commit_id":"b74e83b3e39b3bcccdb07062b15c7bdffc1c9277"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"cbe31190db01137875d60086a9e7bb157152fb17","unresolved":true,"context_lines":[{"line_number":30,"context_line":"          Images created before secret consumer support was available to the Image"},{"line_number":31,"context_line":"          Encryption, since those will not be protected by the consumer list. As a"},{"line_number":32,"context_line":"          workaround users can look into the \u0027os_encrypt_key_id\u0027 parameter of an"},{"line_number":33,"context_line":"          encrypted image to check which Barbican secrets are in use."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":":link: https://review.opendev.org/c/openstack/glance/+/705445/"},{"line_number":36,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fbc0b5de_a82a08d6","line":33,"updated":"2021-06-14 16:11:59.000000000","message":"As I just noted on the WIP patch, there are a fair number of details to get right to make sure we don\u0027t do things out of order or ignore some error situations and leave data exposed to be lost if the key goes away. Might be worth doing a real spec to flesh out all those things, IMHO.","commit_id":"b74e83b3e39b3bcccdb07062b15c7bdffc1c9277"},{"author":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"change_message_id":"95783d951f2b67e0737cc51a6f2d5b4357c33f91","unresolved":true,"context_lines":[{"line_number":30,"context_line":"          Images created before secret consumer support was available to the Image"},{"line_number":31,"context_line":"          Encryption, since those will not be protected by the consumer list. As a"},{"line_number":32,"context_line":"          workaround users can look into the \u0027os_encrypt_key_id\u0027 parameter of an"},{"line_number":33,"context_line":"          encrypted image to check which Barbican secrets are in use."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":":link: https://review.opendev.org/c/openstack/glance/+/705445/"},{"line_number":36,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"b78b03dd_498bd606","line":33,"in_reply_to":"fbc0b5de_a82a08d6","updated":"2021-07-01 00:57:36.000000000","message":"Agreed. I\u0027m very worried with the fact that \"[users] will have to be careful when deleting secrets\". I\u0027d like to see all the details discussed before we implement this.","commit_id":"b74e83b3e39b3bcccdb07062b15c7bdffc1c9277"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"84f59488a95b9c73e0053b4c900225a277335f2a","unresolved":true,"context_lines":[{"line_number":15,"context_line":"          specify the key for that image. This results in a responsibility for the"},{"line_number":16,"context_line":"          key management including creation and deletion of keys. While creating and"},{"line_number":17,"context_line":"          using keys will not induce any risk of data loss, the deletion of a key"},{"line_number":18,"context_line":"          which is still used to decrypt an image will render that image unaccessable."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":":solution: The Secret Consumer API from Barbican should be used in the Image Encryption"},{"line_number":21,"context_line":"           to set an Image as a consumer for a secret when creating it and delete it"}],"source_content_type":"text/x-rst","patch_set":6,"id":"0e61f5cf_ad4dfd20","line":18,"range":{"start_line":18,"start_character":25,"end_line":18,"end_character":29},"updated":"2021-10-07 12:34:23.000000000","message":"nit: required","commit_id":"185d48821b70c0cd1853b672a080a8875af18cec"},{"author":{"_account_id":5314,"name":"Brian Rosmaita","email":"rosmaita.fossdev@gmail.com","username":"brian-rosmaita"},"change_message_id":"84f59488a95b9c73e0053b4c900225a277335f2a","unresolved":true,"context_lines":[{"line_number":36,"context_line":"          the Image Encryption will have to be careful when deleting secrets for any"},{"line_number":37,"context_line":"          Images created before secret consumer support was available to the Image"},{"line_number":38,"context_line":"          Encryption, since those will not be protected by the consumer list. As a"},{"line_number":39,"context_line":"          workaround users can look into the \u0027os_encrypt_key_id\u0027 parameter of an"},{"line_number":40,"context_line":"          encrypted image to check which Barbican secrets are in use."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":":link: https://review.opendev.org/c/openstack/glance/+/705445/"}],"source_content_type":"text/x-rst","patch_set":6,"id":"dcbfcdaa_6ccc6f3c","line":39,"range":{"start_line":39,"start_character":27,"end_line":39,"end_character":40},"updated":"2021-10-07 12:34:23.000000000","message":"nit: we can be a bit more specific; glance allows filtering on arbitrary metadata for the image-list call, so if you know the uuid of the encryption key, you can easily get a list of all images using it.","commit_id":"185d48821b70c0cd1853b672a080a8875af18cec"}],"specs/xena/approved/index.rst":[{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"da0af68e0f52fa8c6c8216db5a329177a3cd7bf0","unresolved":true,"context_lines":[{"line_number":7,"context_line":"   :maxdepth: 1"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Xena approved specs for glance:"},{"line_number":10,"context_line":"Spec-Lite to implement Image Encryption with delayed Secret Consumers"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":".. toctree::"},{"line_number":13,"context_line":"    :glob:"}],"source_content_type":"text/x-rst","patch_set":4,"id":"21f2d362_89fe8427","line":10,"range":{"start_line":10,"start_character":0,"end_line":10,"end_character":69},"updated":"2021-05-31 13:50:45.000000000","message":"I don\u0027t think this is required any more now, here the link for your spec will automatically get rendered.","commit_id":"2dd0af4caf9216197f49fc22060da1a24515f71a"}]}