)]}'
{"specs/approved/implement-rescue-mode.rst":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"6ac8a27f138d32b7d663891cf2b52a080daee242","unresolved":false,"context_lines":[{"line_number":78,"context_line":"    rescue password."},{"line_number":79,"context_line":"11. After next heartbeat, conductor polls agent (/v1/commands) for SUCCESS or"},{"line_number":80,"context_line":"    FAILURE."},{"line_number":81,"context_line":"12. On command success, the conductor calls finalize_rescue (/v1/commands)"},{"line_number":82,"context_line":"    (RESCUEWAIT -\u003e RESCUING). If using multiple networks, the conductor flips"},{"line_number":83,"context_line":"    network ports putting the node back on the tenant network (RESCUING -\u003e"},{"line_number":84,"context_line":"    RESCUE)."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a71b18c_8027f0c8","line":81,"updated":"2016-12-05 23:51:52.000000000","message":"I\u0027m wondering, now that we\u0027re moving  to having rescue be an explicit IPA API call, if doing the two steps of prepare and finalize are needed -- could we just make it a single call to the agent and simplify it?","commit_id":"a850fb71a236c0ed07698a68abcbb72445eb2a61"},{"author":{"_account_id":13295,"name":"Mario Villaplana","email":"mario.villaplana@gmail.com","username":"mariojv"},"change_message_id":"3d864ebcb005572cd95863296af845fe391db83d","unresolved":false,"context_lines":[{"line_number":76,"context_line":"   with config drive and rescue password (RESCUEWAIT -\u003e RESCUING)."},{"line_number":77,"context_line":"10. Agent sets password, configures network from information in config drive,"},{"line_number":78,"context_line":"    and stops agent service."},{"line_number":79,"context_line":"11. If using multiple networks, the conductor flips network ports putting the"},{"line_number":80,"context_line":"    node back on the tenant network."},{"line_number":81,"context_line":"12. The state is set to RESCUE."},{"line_number":82,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_d861bbd4","line":79,"range":{"start_line":79,"start_character":4,"end_line":79,"end_character":30},"updated":"2016-12-06 16:04:03.000000000","message":"Just a note:\n\nThe calls to switch networks will always be made, even though they\u0027re essentially no-ops in the flat network case. This happens so that third-party network drivers can still use rescue mode. It also helps keep a cleaner abstraction between the rescue logic and the network driver.","commit_id":"40aeda741ef62be61d5c3f994b56f2d90702b590"},{"author":{"_account_id":13295,"name":"Mario Villaplana","email":"mario.villaplana@gmail.com","username":"mariojv"},"change_message_id":"3d864ebcb005572cd95863296af845fe391db83d","unresolved":false,"context_lines":[{"line_number":263,"context_line":"Dependencies"},{"line_number":264,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":265,"context_line":"Updating the Ironic virt driver in Nova to support this."},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"Testing"},{"line_number":268,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":269,"context_line":"Unit tests and Tempest tests must be added."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_58812bfa","line":266,"updated":"2016-12-06 16:04:03.000000000","message":"IDK if it needs to be explicitly mentioned, but this needs to merge before we can merge the agent driver implementation: https://review.openstack.org/#/c/327046/","commit_id":"40aeda741ef62be61d5c3f994b56f2d90702b590"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"473c109235b356592fffbea34a6ee28353a3f158","unresolved":false,"context_lines":[{"line_number":29,"context_line":"* Add InstanceRescueFailure, and InstanceUnRescueFailure exceptions to Nova"},{"line_number":30,"context_line":"* Add methods to Nova driver to poll Ironic to wait for nodes to rescue and"},{"line_number":31,"context_line":"  unrescue, as appropriate."},{"line_number":32,"context_line":"* Store hashed/salted (crypt(3)) password in Ironic node instance_info for"},{"line_number":33,"context_line":"  use in /etc/shadow on the rescued node"},{"line_number":34,"context_line":"* Add method to create salted hash appropriate for injecting into linux"},{"line_number":35,"context_line":"  /etc/shadow file."}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a71b18c_41dc9346","line":32,"updated":"2016-12-07 21:27:14.000000000","message":"This is wrong, and needs to be made to work as described in line 63 -- with nova passing in a password directly via api. That plaintext password (passed via API to lessen security risk) would be what\u0027s applied later in the ramdisk.","commit_id":"6073e315d6a188c1e0be95f07cb33fc11aa37b9a"},{"author":{"_account_id":13295,"name":"Mario Villaplana","email":"mario.villaplana@gmail.com","username":"mariojv"},"change_message_id":"a745c05aca2fe67d1f9674dfbfffb0c40d6c50df","unresolved":false,"context_lines":[{"line_number":73,"context_line":"8. Agent ramdisk boots, performs a lookup (/v1/lookup in ironic-api), gets node"},{"line_number":74,"context_line":"   info back, and begins heartbeating (/v1/heartbeat in ironic-api)."},{"line_number":75,"context_line":"9. Upon receiving heartbeat, the conductor calls finalize_rescue (/v1/commands)"},{"line_number":76,"context_line":"   with config drive and rescue password (RESCUEWAIT -\u003e RESCUING)."},{"line_number":77,"context_line":"10. Agent sets password, configures network from information in config drive,"},{"line_number":78,"context_line":"    and stops agent service."},{"line_number":79,"context_line":"11. The conductor flips network ports putting the node back on the tenant"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a71b18c_13a4f4b7","line":76,"range":{"start_line":76,"start_character":42,"end_line":76,"end_character":64},"updated":"2016-12-06 16:28:28.000000000","message":"shouldn\u0027t this still be RESCUEWAIT, since we\u0027re waiting on the finalize_rescue callback?","commit_id":"6073e315d6a188c1e0be95f07cb33fc11aa37b9a"},{"author":{"_account_id":11642,"name":"Jesse J. Cook","email":"jesse.cook@rackspace.com","username":"crashenx"},"change_message_id":"f438187bdc781fc5b48ad02cb8dec67103c39c7d","unresolved":false,"context_lines":[{"line_number":73,"context_line":"8. Agent ramdisk boots, performs a lookup (/v1/lookup in ironic-api), gets node"},{"line_number":74,"context_line":"   info back, and begins heartbeating (/v1/heartbeat in ironic-api)."},{"line_number":75,"context_line":"9. Upon receiving heartbeat, the conductor calls finalize_rescue (/v1/commands)"},{"line_number":76,"context_line":"   with config drive and rescue password (RESCUEWAIT -\u003e RESCUING)."},{"line_number":77,"context_line":"10. Agent sets password, configures network from information in config drive,"},{"line_number":78,"context_line":"    and stops agent service."},{"line_number":79,"context_line":"11. The conductor flips network ports putting the node back on the tenant"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a71b18c_5ac9e359","line":76,"range":{"start_line":76,"start_character":42,"end_line":76,"end_character":64},"in_reply_to":"3a71b18c_13a4f4b7","updated":"2016-12-07 18:05:02.000000000","message":"No, I don\u0027t think so. I believe once this call is made there is no more communication between agent, api, and conductor. Agent sets password, configures network, and stops agent service while conductor flips network in parallel.","commit_id":"6073e315d6a188c1e0be95f07cb33fc11aa37b9a"},{"author":{"_account_id":13295,"name":"Mario Villaplana","email":"mario.villaplana@gmail.com","username":"mariojv"},"change_message_id":"a745c05aca2fe67d1f9674dfbfffb0c40d6c50df","unresolved":false,"context_lines":[{"line_number":76,"context_line":"   with config drive and rescue password (RESCUEWAIT -\u003e RESCUING)."},{"line_number":77,"context_line":"10. Agent sets password, configures network from information in config drive,"},{"line_number":78,"context_line":"    and stops agent service."},{"line_number":79,"context_line":"11. The conductor flips network ports putting the node back on the tenant"},{"line_number":80,"context_line":"    network, and the state is set to RESCUE."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Standard Unrescue process:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a71b18c_9398047a","line":79,"updated":"2016-12-06 16:28:28.000000000","message":"RESCUEWAIT -\u003e RESCUING here while conductor flips network, then RESCUING -\u003e RESCUE","commit_id":"6073e315d6a188c1e0be95f07cb33fc11aa37b9a"},{"author":{"_account_id":22931,"name":"Taku Izumi","email":"izumi.taku@jp.fujitsu.com","username":"izumi777"},"change_message_id":"c8de3025df1d9ecc5fd2ce7c9ffde1e400aee7e5","unresolved":false,"context_lines":[{"line_number":166,"context_line":"Nova driver impact"},{"line_number":167,"context_line":"------------------"},{"line_number":168,"context_line":"Implement rescue() and unrescue() in the Nova driver.  Add supporting methods"},{"line_number":169,"context_line":"including _wait_for_rescue(), _wait_for_unrescue(), and _hash_password()."},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"Ramdisk impact"},{"line_number":172,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a6eadb0_3fa975e0","line":169,"range":{"start_line":169,"start_character":56,"end_line":169,"end_character":71},"updated":"2016-12-19 07:57:39.000000000","message":"I think this method is not necessary because nova just passes plain password to Ironic.","commit_id":"93d91772c4111532485f74549673c8a2e839026a"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"697e736e55038e68037b870f05d5ed409bb432c4","unresolved":false,"context_lines":[{"line_number":166,"context_line":"Nova driver impact"},{"line_number":167,"context_line":"------------------"},{"line_number":168,"context_line":"Implement rescue() and unrescue() in the Nova driver.  Add supporting methods"},{"line_number":169,"context_line":"including _wait_for_rescue(), _wait_for_unrescue(), and _hash_password()."},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"Ramdisk impact"},{"line_number":172,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"ba5201f7_8ecb1a72","line":169,"range":{"start_line":169,"start_character":56,"end_line":169,"end_character":71},"in_reply_to":"1a6eadb0_3fa975e0","updated":"2016-12-30 15:04:12.000000000","message":"Agreed, we should likely remove the reference to it since part of the update is to use a plaintext password.","commit_id":"93d91772c4111532485f74549673c8a2e839026a"},{"author":{"_account_id":11642,"name":"Jesse J. Cook","email":"jesse.cook@rackspace.com","username":"crashenx"},"change_message_id":"b31d5c560fb7bea0c5f4ab5114dbdb2f5ccf2856","unresolved":false,"context_lines":[{"line_number":65,"context_line":"   Nova state as appropriate."},{"line_number":66,"context_line":"5. Ironic API receives set_provision_state call, and performs do_node_rescue"},{"line_number":67,"context_line":"   RPC call (ACTIVE -\u003e RESCUING)."},{"line_number":68,"context_line":"6. Ironic conductor hands off call to appropriate driver."},{"line_number":69,"context_line":"7. Driver boots rescue ramdisk (RESCUING -\u003e RESCUEWAIT), using the configured"},{"line_number":70,"context_line":"   boot driver. As part of this process, Ironic will put the node onto the"},{"line_number":71,"context_line":"   rescue_network, as configured in ironic.conf."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ba5201f7_003fc4d6","line":68,"updated":"2017-01-03 19:21:02.000000000","message":"Is the password saved here by the conductor? That would be in the instance info correct?","commit_id":"3182e8c2092c664f82ce0f35ff181bf819c898bb"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"07d71201bf2443542b49620a1cf565e44bb62fa3","unresolved":false,"context_lines":[{"line_number":65,"context_line":"   Nova state as appropriate."},{"line_number":66,"context_line":"5. Ironic API receives set_provision_state call, and performs do_node_rescue"},{"line_number":67,"context_line":"   RPC call (ACTIVE -\u003e RESCUING)."},{"line_number":68,"context_line":"6. Ironic conductor hands off call to appropriate driver."},{"line_number":69,"context_line":"7. Driver boots rescue ramdisk (RESCUING -\u003e RESCUEWAIT), using the configured"},{"line_number":70,"context_line":"   boot driver. As part of this process, Ironic will put the node onto the"},{"line_number":71,"context_line":"   rescue_network, as configured in ironic.conf."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ba5201f7_e012c061","line":68,"in_reply_to":"ba5201f7_003fc4d6","updated":"2017-01-03 19:22:36.000000000","message":"Yes, it should be.","commit_id":"3182e8c2092c664f82ce0f35ff181bf819c898bb"},{"author":{"_account_id":11642,"name":"Jesse J. Cook","email":"jesse.cook@rackspace.com","username":"crashenx"},"change_message_id":"b31d5c560fb7bea0c5f4ab5114dbdb2f5ccf2856","unresolved":false,"context_lines":[{"line_number":83,"context_line":"1. User calls Nova unrescue() on a node."},{"line_number":84,"context_line":"2. Nova calls Ironic unrescue() virt driver."},{"line_number":85,"context_line":"3. Virt driver removes rescue_password from node instance info (set during"},{"line_number":86,"context_line":"   rescue process)."},{"line_number":87,"context_line":"4. Virt driver calls node.set_provision_state(ACTIVE)."},{"line_number":88,"context_line":"5. Virt driver loops while waiting for provision_state to change, and updates"},{"line_number":89,"context_line":"   Nova state as appropriate."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ba5201f7_6059705a","line":86,"updated":"2017-01-03 19:21:02.000000000","message":"Is this where the rescue password is removed?","commit_id":"3182e8c2092c664f82ce0f35ff181bf819c898bb"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"07d71201bf2443542b49620a1cf565e44bb62fa3","unresolved":false,"context_lines":[{"line_number":83,"context_line":"1. User calls Nova unrescue() on a node."},{"line_number":84,"context_line":"2. Nova calls Ironic unrescue() virt driver."},{"line_number":85,"context_line":"3. Virt driver removes rescue_password from node instance info (set during"},{"line_number":86,"context_line":"   rescue process)."},{"line_number":87,"context_line":"4. Virt driver calls node.set_provision_state(ACTIVE)."},{"line_number":88,"context_line":"5. Virt driver loops while waiting for provision_state to change, and updates"},{"line_number":89,"context_line":"   Nova state as appropriate."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ba5201f7_4008ec2d","line":86,"in_reply_to":"ba5201f7_6059705a","updated":"2017-01-03 19:22:36.000000000","message":"Yes, however, ironic could reasonably remove rescue_password once it\u0027s been passed into the rescue Ramdisk. We won\u0027t use it after this point.","commit_id":"3182e8c2092c664f82ce0f35ff181bf819c898bb"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"e7d3af07edbd1ade5fdb0d24f46ba50af9489452","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"1. User calls Nova unrescue() on a node."},{"line_number":86,"context_line":"2. Nova calls Ironic unrescue() virt driver."},{"line_number":87,"context_line":"3. Virt driver calls node.set_provision_state(ACTIVE)."},{"line_number":88,"context_line":"4. Virt driver loops while waiting for provision_state to change, and updates"},{"line_number":89,"context_line":"   Nova state as appropriate."},{"line_number":90,"context_line":"5. Ironic API receives set_provision_state call, and performs"}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba5201f7_af2875e3","line":87,"updated":"2017-01-04 20:15:40.000000000","message":"Shouldn\u0027t the rescue password be removed from instance_info, still?","commit_id":"a9a9d01fce67734a925c94c876db5e4e0307b8b1"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"b05a801290652f40c5dfa117c7cebee132ec12fe","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"1. User calls Nova unrescue() on a node."},{"line_number":86,"context_line":"2. Nova calls Ironic unrescue() virt driver."},{"line_number":87,"context_line":"3. Virt driver calls node.set_provision_state(ACTIVE)."},{"line_number":88,"context_line":"4. Virt driver loops while waiting for provision_state to change, and updates"},{"line_number":89,"context_line":"   Nova state as appropriate."},{"line_number":90,"context_line":"5. Ironic API receives set_provision_state call, and performs"}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba5201f7_6fcf6d29","line":87,"in_reply_to":"ba5201f7_af2875e3","updated":"2017-01-04 20:17:21.000000000","message":"Ah, in step 9 of rescue, my fault.","commit_id":"a9a9d01fce67734a925c94c876db5e4e0307b8b1"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"9264944c399efe1cf135cc2c29d87efbce2d92c8","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"1. User calls Nova unrescue() on a node."},{"line_number":86,"context_line":"2. Nova calls Ironic unrescue() virt driver."},{"line_number":87,"context_line":"3. Virt driver calls node.set_provision_state(ACTIVE)."},{"line_number":88,"context_line":"4. Virt driver loops while waiting for provision_state to change, and updates"},{"line_number":89,"context_line":"   Nova state as appropriate."},{"line_number":90,"context_line":"5. Ironic API receives set_provision_state call, and performs"}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba5201f7_8fd491bd","line":87,"in_reply_to":"ba5201f7_af2875e3","updated":"2017-01-04 20:16:57.000000000","message":"No; Ironic removes it earlier. See step 9 above.","commit_id":"a9a9d01fce67734a925c94c876db5e4e0307b8b1"},{"author":{"_account_id":13295,"name":"Mario Villaplana","email":"mario.villaplana@gmail.com","username":"mariojv"},"change_message_id":"6816245165a84062ca22ca78beb38626f41ec238","unresolved":false,"context_lines":[{"line_number":259,"context_line":"Dependencies"},{"line_number":260,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":261,"context_line":"* Updating the Ironic virt driver in Nova to support this."},{"line_number":262,"context_line":"* Agent driver implementation depends on: https://review.openstack.org/#/c/327046/ ."},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"Testing"},{"line_number":265,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba5201f7_6fb20d08","line":262,"updated":"2017-01-04 20:08:38.000000000","message":"This is landed, so no need to explicitly mention it anymore","commit_id":"a9a9d01fce67734a925c94c876db5e4e0307b8b1"},{"author":{"_account_id":10343,"name":"Jim Rollenhagen","email":"jim@jimrollenhagen.com","username":"jimrollenhagen"},"change_message_id":"e7d3af07edbd1ade5fdb0d24f46ba50af9489452","unresolved":false,"context_lines":[{"line_number":259,"context_line":"Dependencies"},{"line_number":260,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":261,"context_line":"* Updating the Ironic virt driver in Nova to support this."},{"line_number":262,"context_line":"* Agent driver implementation depends on: https://review.openstack.org/#/c/327046/ ."},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"Testing"},{"line_number":265,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba5201f7_2f62c53e","line":262,"in_reply_to":"ba5201f7_6fb20d08","updated":"2017-01-04 20:15:40.000000000","message":"++ but not a blocker","commit_id":"a9a9d01fce67734a925c94c876db5e4e0307b8b1"},{"author":{"_account_id":6773,"name":"Lucas Alvares Gomes","email":"lucasagomes@gmail.com","username":"lucasagomes"},"change_message_id":"226f26c94c9ba78f650f3b788e14093d2b09048d","unresolved":false,"context_lines":[{"line_number":29,"context_line":"* Add InstanceRescueFailure, and InstanceUnRescueFailure exceptions to Nova"},{"line_number":30,"context_line":"* Add methods to Nova driver to poll Ironic to wait for nodes to rescue and"},{"line_number":31,"context_line":"  unrescue, as appropriate."},{"line_number":32,"context_line":"* Store plaintext password in Ironic node instance_info for use on the rescued"},{"line_number":33,"context_line":"  node."},{"line_number":34,"context_line":"* Add method for injecting password into OS."},{"line_number":35,"context_line":"* Modify Ironic state machine as described in the state machine impact section"},{"line_number":36,"context_line":"* Add AgentRescue driver (implements base.RescueInterface). This driver will"},{"line_number":37,"context_line":"  be mixed into the agent_ipmitool and agent_pyghmi drivers."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba5201f7_635e8f13","line":34,"range":{"start_line":32,"start_character":0,"end_line":34,"end_character":44},"updated":"2017-01-05 11:35:36.000000000","message":"Why does we need a plaintext password ? Wouldn\u0027t a hashed password be more secure here ?\n\nWe could totally inject a hashed password into the OS. E.g:\n\n $ password\u003d$(openssl passwd -1)\n ... type your password ...\n $ echo \"root:$password\" | chpasswd -e","commit_id":"27f197d66ebd3631902905dbc58d550a4649b725"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"816f537b2597500798c11da586b7ed63ae06694f","unresolved":false,"context_lines":[{"line_number":29,"context_line":"* Add InstanceRescueFailure, and InstanceUnRescueFailure exceptions to Nova"},{"line_number":30,"context_line":"* Add methods to Nova driver to poll Ironic to wait for nodes to rescue and"},{"line_number":31,"context_line":"  unrescue, as appropriate."},{"line_number":32,"context_line":"* Store plaintext password in Ironic node instance_info for use on the rescued"},{"line_number":33,"context_line":"  node."},{"line_number":34,"context_line":"* Add method for injecting password into OS."},{"line_number":35,"context_line":"* Modify Ironic state machine as described in the state machine impact section"},{"line_number":36,"context_line":"* Add AgentRescue driver (implements base.RescueInterface). This driver will"},{"line_number":37,"context_line":"  be mixed into the agent_ipmitool and agent_pyghmi drivers."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba5201f7_b17c36b6","line":34,"range":{"start_line":32,"start_character":0,"end_line":34,"end_character":44},"in_reply_to":"ba5201f7_635e8f13","updated":"2017-01-05 15:39:03.000000000","message":"Two reasons why not:\n\n1) Nova already deals in plaintext passwords, so if we were going to hash it, it\u0027d have to be in our driver and be a Ironic-specific thing.\n2) That makes the assumption of a linux-based rescue image: I could see many cases where someone would want to implement a rescue image based on Windows (WinPE), and having linuxy assumptions in our implementation would prevent that.","commit_id":"27f197d66ebd3631902905dbc58d550a4649b725"},{"author":{"_account_id":6773,"name":"Lucas Alvares Gomes","email":"lucasagomes@gmail.com","username":"lucasagomes"},"change_message_id":"9671f2fab3208d3f1a3ab0683bc61e90d8d971fa","unresolved":false,"context_lines":[{"line_number":29,"context_line":"* Add InstanceRescueFailure, and InstanceUnRescueFailure exceptions to Nova"},{"line_number":30,"context_line":"* Add methods to Nova driver to poll Ironic to wait for nodes to rescue and"},{"line_number":31,"context_line":"  unrescue, as appropriate."},{"line_number":32,"context_line":"* Store plaintext password in Ironic node instance_info for use on the rescued"},{"line_number":33,"context_line":"  node."},{"line_number":34,"context_line":"* Add method for injecting password into OS."},{"line_number":35,"context_line":"* Modify Ironic state machine as described in the state machine impact section"},{"line_number":36,"context_line":"* Add AgentRescue driver (implements base.RescueInterface). This driver will"},{"line_number":37,"context_line":"  be mixed into the agent_ipmitool and agent_pyghmi drivers."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba5201f7_f90b0422","line":34,"range":{"start_line":32,"start_character":0,"end_line":34,"end_character":44},"in_reply_to":"ba5201f7_b17c36b6","updated":"2017-01-05 16:19:45.000000000","message":"Right, yeah I haven\u0027t considered a non-linux rescue image. Makes sense.","commit_id":"27f197d66ebd3631902905dbc58d550a4649b725"},{"author":{"_account_id":7080,"name":"Mathieu Mitchell","email":"mat128@gmail.com","username":"mat128"},"change_message_id":"0464dac7c0e81f90c6bd74082520c3bf061e42bc","unresolved":false,"context_lines":[{"line_number":76,"context_line":"   with config drive and rescue password (RESCUEWAIT -\u003e RESCUING), and removes"},{"line_number":77,"context_line":"   the rescue password from the instance_info, as it\u0027s no longer needed."},{"line_number":78,"context_line":"10. Agent sets password, configures network from information in config drive,"},{"line_number":79,"context_line":"    and stops agent service."},{"line_number":80,"context_line":"11. The conductor flips network ports putting the node back on the tenant"},{"line_number":81,"context_line":"    network, and the state is set to RESCUE."},{"line_number":82,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba5201f7_1ac45d5d","line":79,"updated":"2017-01-04 20:40:15.000000000","message":"Maybe add a security warning in the docs that this will essentially provide the source to the operators\u0027 agent code, unless extra measures are taken (build a different ramdisk with upstream agent, for example).","commit_id":"27f197d66ebd3631902905dbc58d550a4649b725"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"0c7dbd8f9bc65fdf5d04236df5bf11de9ddafb65","unresolved":false,"context_lines":[{"line_number":76,"context_line":"   with config drive and rescue password (RESCUEWAIT -\u003e RESCUING), and removes"},{"line_number":77,"context_line":"   the rescue password from the instance_info, as it\u0027s no longer needed."},{"line_number":78,"context_line":"10. Agent sets password, configures network from information in config drive,"},{"line_number":79,"context_line":"    and stops agent service."},{"line_number":80,"context_line":"11. The conductor flips network ports putting the node back on the tenant"},{"line_number":81,"context_line":"    network, and the state is set to RESCUE."},{"line_number":82,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba5201f7_b5b28292","line":79,"in_reply_to":"ba5201f7_1ac45d5d","updated":"2017-01-04 21:27:42.000000000","message":"This is addressed pretty throughly under \"security impact\".","commit_id":"27f197d66ebd3631902905dbc58d550a4649b725"},{"author":{"_account_id":7080,"name":"Mathieu Mitchell","email":"mat128@gmail.com","username":"mat128"},"change_message_id":"c51928d52993ec4afd0da35d27ce0c3cba2ff92b","unresolved":false,"context_lines":[{"line_number":76,"context_line":"   with config drive and rescue password (RESCUEWAIT -\u003e RESCUING), and removes"},{"line_number":77,"context_line":"   the rescue password from the instance_info, as it\u0027s no longer needed."},{"line_number":78,"context_line":"10. Agent sets password, configures network from information in config drive,"},{"line_number":79,"context_line":"    and stops agent service."},{"line_number":80,"context_line":"11. The conductor flips network ports putting the node back on the tenant"},{"line_number":81,"context_line":"    network, and the state is set to RESCUE."},{"line_number":82,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba5201f7_c73cbdca","line":79,"in_reply_to":"ba5201f7_b5b28292","updated":"2017-01-04 21:31:54.000000000","message":"Yes, my bad :(","commit_id":"27f197d66ebd3631902905dbc58d550a4649b725"}]}