)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"40c7e199f7e8919cf1f9c8690c8ebf2e6561f736","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"7d354119_3c27aaa3","updated":"2024-08-05 14:04:31.000000000","message":"Hey, nice write-up, some comments inline.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":23851,"name":"Riccardo Pittau","email":"elfosardo@gmail.com","username":"elfosardo"},"change_message_id":"41d954743d5ec8e68863c8de3a5cd58a2532c8c7","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"aff27611_8f147880","updated":"2024-08-02 13:55:33.000000000","message":"from a first reading it looks ok to me, and a very interesting feature\nI left a comment for now, I plan to come back to it next week though","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"}],"specs/approved/root-device-root-partition-and-config-drive-encryption.rst":[{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"40c7e199f7e8919cf1f9c8690c8ebf2e6561f736","unresolved":true,"context_lines":[{"line_number":42,"context_line":"Some cases of data at rest in the context of ironic are configuration files,"},{"line_number":43,"context_line":"the process of Ironic cacheing IPA and user images, the presence of the Ironic"},{"line_number":44,"context_line":"database and ``the process of writing the user image to the root device of a"},{"line_number":45,"context_line":"node.``"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"In case of the wider Ironic project in general there is support for data"},{"line_number":48,"context_line":"encryption at transit via ``HTTP+TLS`` but on the other hand there is a lack of"}],"source_content_type":"text/x-rst","patch_set":9,"id":"aa77b5ff_cf8f1789","line":45,"updated":"2024-08-05 14:04:31.000000000","message":"nit: not sure why double ticks here and in some places below","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":23851,"name":"Riccardo Pittau","email":"elfosardo@gmail.com","username":"elfosardo"},"change_message_id":"41d954743d5ec8e68863c8de3a5cd58a2532c8c7","unresolved":true,"context_lines":[{"line_number":103,"context_line":"the word partition is mentioned take it as GPT partition unless stated"},{"line_number":104,"context_line":"otherwise."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"TPM"},{"line_number":107,"context_line":"----"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"\"Trusted platform module library (TPM) is a secure crypto-processor which is"}],"source_content_type":"text/x-rst","patch_set":9,"id":"904256bc_74daf6f7","line":106,"range":{"start_line":106,"start_character":0,"end_line":106,"end_character":3},"updated":"2024-08-02 13:55:33.000000000","message":"since we\u0027re talking about TPM I\u0027d like to point your attention to https://github.com/keylime/keylime, if you haven\u0027t seen it yet.\nThere was also a tentative to integrate that into ironic https://review.opendev.org/c/openstack/ironic-python-agent/+/803510, unfortunately never finished.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"40c7e199f7e8919cf1f9c8690c8ebf2e6561f736","unresolved":true,"context_lines":[{"line_number":103,"context_line":"the word partition is mentioned take it as GPT partition unless stated"},{"line_number":104,"context_line":"otherwise."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"TPM"},{"line_number":107,"context_line":"----"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"\"Trusted platform module library (TPM) is a secure crypto-processor which is"}],"source_content_type":"text/x-rst","patch_set":9,"id":"90776383_66497bd0","line":106,"range":{"start_line":106,"start_character":0,"end_line":106,"end_character":3},"in_reply_to":"904256bc_74daf6f7","updated":"2024-08-05 14:04:31.000000000","message":"Keylime is about attestation, not encryption","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":103,"context_line":"the word partition is mentioned take it as GPT partition unless stated"},{"line_number":104,"context_line":"otherwise."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"TPM"},{"line_number":107,"context_line":"----"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"\"Trusted platform module library (TPM) is a secure crypto-processor which is"}],"source_content_type":"text/x-rst","patch_set":9,"id":"a3b23050_9cb5b3f1","line":106,"range":{"start_line":106,"start_character":0,"end_line":106,"end_character":3},"in_reply_to":"90776383_66497bd0","updated":"2024-08-05 15:43:02.000000000","message":"Dmitry++","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"40c7e199f7e8919cf1f9c8690c8ebf2e6561f736","unresolved":true,"context_lines":[{"line_number":112,"context_line":"for encryption, decryption and authentication. Doing so provides a first line"},{"line_number":113,"context_line":"of defense against potentially critical malware and firmware attacks, as it"},{"line_number":114,"context_line":"ensures all data remains encrypted even if an attack takes place.\"(From the"},{"line_number":115,"context_line":"trusted computing group website)"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"The current TPM standard version is the 2.0 and it has been officially"},{"line_number":118,"context_line":"published as intentional standards ``ISO/IEC 11889-1:2015, 11889-2:2015,"}],"source_content_type":"text/x-rst","patch_set":9,"id":"d4838e78_e480818b","line":115,"updated":"2024-08-05 14:04:31.000000000","message":"nit: for a proper attribution, a link would be ideal","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":23851,"name":"Riccardo Pittau","email":"elfosardo@gmail.com","username":"elfosardo"},"change_message_id":"41d954743d5ec8e68863c8de3a5cd58a2532c8c7","unresolved":true,"context_lines":[{"line_number":128,"context_line":"On x86/amd64 based platforms TPM support is wide spread and that is highlighted"},{"line_number":129,"context_line":"by the fact that TPM support is a minimum system requirement for Windows 11."},{"line_number":130,"context_line":"This proposal doesn\u0027t build its reasoning on the fact that TPM is required"},{"line_number":131,"context_line":"for Widows, that is not a reason why it should be supported in IPA but it shows"},{"line_number":132,"context_line":"the scale of TPM adoption. TPM support is facilitated on Intel processors by"},{"line_number":133,"context_line":"the ``PTT`` module and on AMD systems by the ``fTPM`` module of the processor."},{"line_number":134,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"351bc1dd_073a6f7d","line":131,"updated":"2024-08-02 13:55:33.000000000","message":"nit: Windows","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":128,"context_line":"On x86/amd64 based platforms TPM support is wide spread and that is highlighted"},{"line_number":129,"context_line":"by the fact that TPM support is a minimum system requirement for Windows 11."},{"line_number":130,"context_line":"This proposal doesn\u0027t build its reasoning on the fact that TPM is required"},{"line_number":131,"context_line":"for Widows, that is not a reason why it should be supported in IPA but it shows"},{"line_number":132,"context_line":"the scale of TPM adoption. TPM support is facilitated on Intel processors by"},{"line_number":133,"context_line":"the ``PTT`` module and on AMD systems by the ``fTPM`` module of the processor."},{"line_number":134,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"608b522e_8227c685","line":131,"in_reply_to":"351bc1dd_073a6f7d","updated":"2024-08-05 15:43:02.000000000","message":"A more important item is that Secure Boot, which requires a TPM, is becoming an explicit operating requirement for some verticals which are subject to regulatory oversight. So this is a logical continuation of a requirement we should meet.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":130,"context_line":"This proposal doesn\u0027t build its reasoning on the fact that TPM is required"},{"line_number":131,"context_line":"for Widows, that is not a reason why it should be supported in IPA but it shows"},{"line_number":132,"context_line":"the scale of TPM adoption. TPM support is facilitated on Intel processors by"},{"line_number":133,"context_line":"the ``PTT`` module and on AMD systems by the ``fTPM`` module of the processor."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"In the context of IPA a general purpose TPM utility module has to be"},{"line_number":136,"context_line":"implemented. The IPA TPM module could rely on the user space tooling provided"}],"source_content_type":"text/x-rst","patch_set":9,"id":"b4468c3c_b979219f","line":133,"updated":"2024-08-05 15:43:02.000000000","message":"Nit: Explicitly listing the models for the popular x86 platforms is really just additional technical detail. I\u0027d expect additional variation since others are starting to come much more popular in terms of operational priorities (even if they are not quite there yet)","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"40c7e199f7e8919cf1f9c8690c8ebf2e6561f736","unresolved":true,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"In the context of IPA a general purpose TPM utility module has to be"},{"line_number":136,"context_line":"implemented. The IPA TPM module could rely on the user space tooling provided"},{"line_number":137,"context_line":"by the ``tpm2 software community`` (official project name) in order to"},{"line_number":138,"context_line":"integrate TPM functionality with minimal amount of custom code in IPA."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"The responsibilities of the new IPA TPM utility module would be to:"}],"source_content_type":"text/x-rst","patch_set":9,"id":"e4cc459a_1766765f","line":137,"updated":"2024-08-05 14:04:31.000000000","message":"Instead of double-ticks, better provide a link to it","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"In the context of IPA a general purpose TPM utility module has to be"},{"line_number":136,"context_line":"implemented. The IPA TPM module could rely on the user space tooling provided"},{"line_number":137,"context_line":"by the ``tpm2 software community`` (official project name) in order to"},{"line_number":138,"context_line":"integrate TPM functionality with minimal amount of custom code in IPA."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"The responsibilities of the new IPA TPM utility module would be to:"}],"source_content_type":"text/x-rst","patch_set":9,"id":"f3beda11_cfafa521","line":137,"in_reply_to":"e4cc459a_1766765f","updated":"2024-08-05 15:43:02.000000000","message":"\\`text \u003chttps://host/path\u003e`_","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":143,"context_line":" - generate encryption keys"},{"line_number":144,"context_line":" - store encryption keys"},{"line_number":145,"context_line":" - retrieve encryption keys"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"This proposal only advocates for the minimal viable implementation"},{"line_number":148,"context_line":"of the TPM utility module to make it functional enough to support the LUKS"},{"line_number":149,"context_line":"encryption process. As of the minimal viable implementation the functionality"}],"source_content_type":"text/x-rst","patch_set":9,"id":"40ebf4e3_8770bbd1","line":146,"updated":"2024-08-05 15:43:02.000000000","message":"As an aside, just thinking outloud here, this sounds like an hardware manager in our model where certian tasks are performed. I maybe wouldn\u0027t frame this as a specific utility module since we could then take a further step to enable generalized tpm interactions, as they will become more important with the new regulatory requirements.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":147,"context_line":"This proposal only advocates for the minimal viable implementation"},{"line_number":148,"context_line":"of the TPM utility module to make it functional enough to support the LUKS"},{"line_number":149,"context_line":"encryption process. As of the minimal viable implementation the functionality"},{"line_number":150,"context_line":"of the utility wouldn\u0027t be customizable by the \"deployer\"."},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"LUKS"},{"line_number":153,"context_line":"----"}],"source_content_type":"text/x-rst","patch_set":9,"id":"778af544_80b2d62b","line":150,"updated":"2024-08-05 15:43:02.000000000","message":"I\u0027ll note, if framed as a hardware manager, they could supply thier own hardware manager, if needed, and that is generally in scope for ironic\u0027s operation which allows some level of consistency.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"40c7e199f7e8919cf1f9c8690c8ebf2e6561f736","unresolved":true,"context_lines":[{"line_number":174,"context_line":""},{"line_number":175,"context_line":"When the proposed encryption feature would be enabled, IPA would check the"},{"line_number":176,"context_line":"presence of the kernel module, the cryptsetup tooling and IPA would fail the"},{"line_number":177,"context_line":"deployment step if any of these are missing. During both the encryption and"},{"line_number":178,"context_line":"re-encryption processes IPA would check if there is enough disk space left"},{"line_number":179,"context_line":"(min. 32MiB) to either create or extend the targeted partition to contain the"},{"line_number":180,"context_line":"LUKS metadata header. In case there is not enough space for the LUKS metadata"}],"source_content_type":"text/x-rst","patch_set":9,"id":"8d6dec1c_1e27aaf8","line":177,"updated":"2024-08-05 14:04:31.000000000","message":"I assume the failure only happens if encryption has actually been requested?\n\nCan we also check for TPM presence and usability before we write anything to the disk.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"40c7e199f7e8919cf1f9c8690c8ebf2e6561f736","unresolved":true,"context_lines":[{"line_number":209,"context_line":"a less flexible option compared to transferring the config drive via the IPA"},{"line_number":210,"context_line":"HTTP API because the using the API allows the user to combine 1 disk image"},{"line_number":211,"context_line":"with any number of config drive without the need to build more than 1 disk"},{"line_number":212,"context_line":"image."},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"Regardless of what is the content of the whole disk image, the whole disk"},{"line_number":215,"context_line":"image is written to the disk without any consideration of its content thus"}],"source_content_type":"text/x-rst","patch_set":9,"id":"333073cf_99debe2d","line":212,"updated":"2024-08-05 14:04:31.000000000","message":"Yeah, I haven\u0027t heard about anyone specifically embedding the configdrive for the reasons you provide.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":209,"context_line":"a less flexible option compared to transferring the config drive via the IPA"},{"line_number":210,"context_line":"HTTP API because the using the API allows the user to combine 1 disk image"},{"line_number":211,"context_line":"with any number of config drive without the need to build more than 1 disk"},{"line_number":212,"context_line":"image."},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"Regardless of what is the content of the whole disk image, the whole disk"},{"line_number":215,"context_line":"image is written to the disk without any consideration of its content thus"}],"source_content_type":"text/x-rst","patch_set":9,"id":"c638d01a_55bab567","line":212,"in_reply_to":"333073cf_99debe2d","updated":"2024-08-05 15:43:02.000000000","message":"I\u0027ve only *really* seen it where someone had somehow snapshotted the state of the machine or wanted to provide the \"place\" in the disk image for the user\u0027s layout. It really is not a good idea and I think we\u0027ve generally discouraged it when it has come up in the past.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"40c7e199f7e8919cf1f9c8690c8ebf2e6561f736","unresolved":true,"context_lines":[{"line_number":213,"context_line":""},{"line_number":214,"context_line":"Regardless of what is the content of the whole disk image, the whole disk"},{"line_number":215,"context_line":"image is written to the disk without any consideration of its content thus"},{"line_number":216,"context_line":"it has to be re-encrypted after it lands on the root device."},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"This proposal focuses only on the (re-)encryption of the root partition and"},{"line_number":219,"context_line":"the config drive. As the whole disk image could contain any number of"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a3b32c5_d380725f","line":216,"updated":"2024-08-05 14:04:31.000000000","message":"This specification has pretty decent reference-level explanation of all the technologies (kudos!) but I\u0027d really like to see a few step-by-step workflows. How is this all going to work, exactly? Does re-encryption work in-place? What happens if the process fails after the data is written but before it\u0027s re-encrypted? Are there combinations of partition types and such that will make the process impossible and can we detect these situation?","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":213,"context_line":""},{"line_number":214,"context_line":"Regardless of what is the content of the whole disk image, the whole disk"},{"line_number":215,"context_line":"image is written to the disk without any consideration of its content thus"},{"line_number":216,"context_line":"it has to be re-encrypted after it lands on the root device."},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"This proposal focuses only on the (re-)encryption of the root partition and"},{"line_number":219,"context_line":"the config drive. As the whole disk image could contain any number of"}],"source_content_type":"text/x-rst","patch_set":9,"id":"c552360a_d3dedeff","line":216,"in_reply_to":"1a3b32c5_d380725f","updated":"2024-08-05 15:43:02.000000000","message":"++ I feel the exact same way. I\u0027m hopeful (even though I\u0027m only half way at the moment) that some of this will be revealed though. But the flows and the fit are sort of the critical details we need to also focus on.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":219,"context_line":"the config drive. As the whole disk image could contain any number of"},{"line_number":220,"context_line":"partitions in any number of order, there is a need to detect which one is"},{"line_number":221,"context_line":"the root partition. The proposed way of detecting the root partition is by"},{"line_number":222,"context_line":"checking the related GPT partition record\u0027s type UUID."},{"line_number":223,"context_line":""},{"line_number":224,"context_line":"GPT allows for both an instance UUID that uniquely identifies a specific"},{"line_number":225,"context_line":"partition on the device but also allows for a ``type UUID`` that can be used to"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fb9fed0d_cc57bf77","line":222,"updated":"2024-08-05 15:43:02.000000000","message":"As commentary: It would be good to see if there is any way to leave the door open to more. We\u0027re seeing more interest in the deployment of LVM based images. It doesn\u0027t have to work out of the gate, but if we can support LVM PVs, I think that would be *huge*. Just something to think about.\n\nThat being said, I do like an initial focus on a MVP, and being able to iterate. We just need to make sure we don\u0027t prevent our ability to iterate in the initial design.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":226,"context_line":"specify the intended use of a partition. In the context of Linux, the GPT"},{"line_number":227,"context_line":"partition UUIDs are commonly used to autodetect and mount partitions by e.g"},{"line_number":228,"context_line":"Systemd. In order to provide interoperability between Linux applications that"},{"line_number":229,"context_line":"handle partitions, there are a subset of commonly recognized type UUIDs defined"},{"line_number":230,"context_line":"by the Linux ``User API Group\u0027s Discoverable Partition Specifications"},{"line_number":231,"context_line":"(UAPI DPS)``. This proposal advocates for setting a requirement for the users"},{"line_number":232,"context_line":"that would specify that whatever whole disk image they are building the"},{"line_number":233,"context_line":"root partition needs to have the ``SD_GPT_ROOT_ALPHA`` type UUID set for the"},{"line_number":234,"context_line":"root partition if they would like to use encryption."}],"source_content_type":"text/x-rst","patch_set":9,"id":"90fd7c14_21ae3c6f","line":231,"range":{"start_line":229,"start_character":0,"end_line":231,"end_character":11},"updated":"2024-08-05 15:43:02.000000000","message":"nit: you might want to add a link here.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"40c7e199f7e8919cf1f9c8690c8ebf2e6561f736","unresolved":true,"context_lines":[{"line_number":234,"context_line":"root partition if they would like to use encryption."},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"In case of whole disk images the only supported encryption process would be"},{"line_number":237,"context_line":"the re-encryption, there would be a requirement for alt least 32MiB free"},{"line_number":238,"context_line":"continous disk space located right after the root partition. The free"},{"line_number":239,"context_line":"space could be a block of free disk space between the root and some other"},{"line_number":240,"context_line":"partition already defined in the disk image or the root partition could be"}],"source_content_type":"text/x-rst","patch_set":9,"id":"0d436d31_cd53fb21","line":237,"updated":"2024-08-05 14:04:31.000000000","message":"nit: at least","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":241,"context_line":"the last partition and there would be some free disk space remaining after it"},{"line_number":242,"context_line":"on the root device. This is required to add the LUKS header for the encryption"},{"line_number":243,"context_line":"and the expectation is that the partition won\u0027t have this header in place"},{"line_number":244,"context_line":"when it arrives to the disk."},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"This proposal doesn\u0027t ask for the handling of any other UAPI DPS type UUIDS"},{"line_number":247,"context_line":"thus there is no requirement to handle partitions for a \"segmented\""}],"source_content_type":"text/x-rst","patch_set":9,"id":"11c19218_f3776f8b","line":244,"updated":"2024-08-05 15:43:02.000000000","message":"So this would require support be encoded in partitioning as well. Just something we need to keep in mind and should likely note in changes if not already noted.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":246,"context_line":"This proposal doesn\u0027t ask for the handling of any other UAPI DPS type UUIDS"},{"line_number":247,"context_line":"thus there is no requirement to handle partitions for a \"segmented\""},{"line_number":248,"context_line":"Linux root file system setup where /,/home,/srv,/var etc... are mounted"},{"line_number":249,"context_line":"from separate partitions."},{"line_number":250,"context_line":""},{"line_number":251,"context_line":"Partition disk image encryption"},{"line_number":252,"context_line":"-------------------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"64426434_3b56260f","line":249,"updated":"2024-08-05 15:43:02.000000000","message":"How would this factor in with LVM as the partitions could just be logical volumes?","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":247,"context_line":"thus there is no requirement to handle partitions for a \"segmented\""},{"line_number":248,"context_line":"Linux root file system setup where /,/home,/srv,/var etc... are mounted"},{"line_number":249,"context_line":"from separate partitions."},{"line_number":250,"context_line":""},{"line_number":251,"context_line":"Partition disk image encryption"},{"line_number":252,"context_line":"-------------------------------"},{"line_number":253,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"c13bd07b_c47231cf","line":250,"updated":"2024-08-05 15:43:02.000000000","message":"As an aside: Have we looked at existing image encryption stuff just to see if there are similarities in fields/values which might/could/should be supported?","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"40c7e199f7e8919cf1f9c8690c8ebf2e6561f736","unresolved":true,"context_lines":[{"line_number":254,"context_line":"Partition images can be also streamed or cached then written to the root"},{"line_number":255,"context_line":"device. In case of partition images there is no need for re-encryption as the"},{"line_number":256,"context_line":"partition is created by IPA thus if the encryption feature is enabled IPA would"},{"line_number":257,"context_line":"create a partition with at leas 32MiB extra space and then encrypt it and"},{"line_number":258,"context_line":"unlock it then the content of the partition image can be written to the disk."},{"line_number":259,"context_line":"In case of partition images IPA knows which partition is the root partition"},{"line_number":260,"context_line":"thus no partition detection is required."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ddd79179_3b2ae430","line":257,"updated":"2024-08-05 14:04:31.000000000","message":"nit: at least","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"40c7e199f7e8919cf1f9c8690c8ebf2e6561f736","unresolved":true,"context_lines":[{"line_number":331,"context_line":"configuartion. IPA would need to inject the proper configuration into"},{"line_number":332,"context_line":"the initrd because the root partition\u0027s GUID (not type GUID/ typcode)"},{"line_number":333,"context_line":"is randomly generated thus the initd has no information about the GUID prior"},{"line_number":334,"context_line":"the the creation of the partition."},{"line_number":335,"context_line":""},{"line_number":336,"context_line":"In case of the whole disk image workflow, the partition table is already"},{"line_number":337,"context_line":"a given. The creator of the user image has to make sure that the initrd"}],"source_content_type":"text/x-rst","patch_set":9,"id":"954a99c4_c171f831","line":334,"updated":"2024-08-05 14:04:31.000000000","message":"How is this going to be done? Repacking the initrs of an arbitrary Linux distribution sounds like a can of worms.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"f91f81201d16789d551e7b9823ddf7c466c3083e","unresolved":true,"context_lines":[{"line_number":331,"context_line":"configuartion. IPA would need to inject the proper configuration into"},{"line_number":332,"context_line":"the initrd because the root partition\u0027s GUID (not type GUID/ typcode)"},{"line_number":333,"context_line":"is randomly generated thus the initd has no information about the GUID prior"},{"line_number":334,"context_line":"the the creation of the partition."},{"line_number":335,"context_line":""},{"line_number":336,"context_line":"In case of the whole disk image workflow, the partition table is already"},{"line_number":337,"context_line":"a given. The creator of the user image has to make sure that the initrd"}],"source_content_type":"text/x-rst","patch_set":9,"id":"e5c70174_683241ee","line":334,"in_reply_to":"4eaaec7b_530246f0","updated":"2024-08-06 10:19:44.000000000","message":"Fair enough, we actually do it in OpenShift to inject settings into CoreOS.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":331,"context_line":"configuartion. IPA would need to inject the proper configuration into"},{"line_number":332,"context_line":"the initrd because the root partition\u0027s GUID (not type GUID/ typcode)"},{"line_number":333,"context_line":"is randomly generated thus the initd has no information about the GUID prior"},{"line_number":334,"context_line":"the the creation of the partition."},{"line_number":335,"context_line":""},{"line_number":336,"context_line":"In case of the whole disk image workflow, the partition table is already"},{"line_number":337,"context_line":"a given. The creator of the user image has to make sure that the initrd"}],"source_content_type":"text/x-rst","patch_set":9,"id":"4eaaec7b_530246f0","line":334,"in_reply_to":"954a99c4_c171f831","updated":"2024-08-05 15:43:02.000000000","message":"In **theory** you can just append another cpio file to the tail end on the uncompressed form and re-compress it.  Stressing \"theory\" there. That might actually be what folks like Centos Stream is doing today though, I\u0027ve just never looked with a hex editor.\n\nBut yes, *how* is also important. :)","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":336,"context_line":"In case of the whole disk image workflow, the partition table is already"},{"line_number":337,"context_line":"a given. The creator of the user image has to make sure that the initrd"},{"line_number":338,"context_line":"contains the proper ``/etc/crypttab`` configuration as the partition GUIDs"},{"line_number":339,"context_line":"are known during the creation fo the whole disk image."},{"line_number":340,"context_line":""},{"line_number":341,"context_line":"Variations, possible improvements"},{"line_number":342,"context_line":"---------------------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"51a61ad7_51d4213b","line":339,"updated":"2024-08-05 15:43:02.000000000","message":"This sounds like it is going to require something like a diskimage-builder element and some good documentation around it.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":353,"context_line":"  is done for the ``automated_cleaning`` variable."},{"line_number":354,"context_line":"  The minimal implementation proposes to enable the disk encryption via IPA"},{"line_number":355,"context_line":"  config options mainly via kernel command line argument thus in the improved"},{"line_number":356,"context_line":"  variant when the ``disk_encryption`` API field would be true Ironic would"},{"line_number":357,"context_line":"  append the kernel command line arguments of the node specific iPXE config"},{"line_number":358,"context_line":"  or in case of virtual media the node specific IPA image."},{"line_number":359,"context_line":""},{"line_number":360,"context_line":"- Support for \"segmented\" root file system, this feature would extend the"},{"line_number":361,"context_line":"  number of supported UAPI DPS type UUIDs such that e.g. IPA would detect the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"6998efd0_38dbc61a","line":358,"range":{"start_line":356,"start_character":0,"end_line":358,"end_character":58},"updated":"2024-08-05 15:43:02.000000000","message":"So, this doesn\u0027t need to be on the command line and we should sort of generally avoid it unless it *has* to be. This can be loaded/discovered as part of the configuration interaction which happens as part of the lookup process where the agent gains additional operational state configuration, like the target root device hint.\n\nAs the world moves towards unikernels, the command line will be impossible for us to modify without maintaining our own tooling ot do thinks like UKI rebuilding/modifying/signing and programming all hosts to trust the signing signature.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"f91f81201d16789d551e7b9823ddf7c466c3083e","unresolved":true,"context_lines":[{"line_number":353,"context_line":"  is done for the ``automated_cleaning`` variable."},{"line_number":354,"context_line":"  The minimal implementation proposes to enable the disk encryption via IPA"},{"line_number":355,"context_line":"  config options mainly via kernel command line argument thus in the improved"},{"line_number":356,"context_line":"  variant when the ``disk_encryption`` API field would be true Ironic would"},{"line_number":357,"context_line":"  append the kernel command line arguments of the node specific iPXE config"},{"line_number":358,"context_line":"  or in case of virtual media the node specific IPA image."},{"line_number":359,"context_line":""},{"line_number":360,"context_line":"- Support for \"segmented\" root file system, this feature would extend the"},{"line_number":361,"context_line":"  number of supported UAPI DPS type UUIDs such that e.g. IPA would detect the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"2042ccd0_7408a823","line":358,"range":{"start_line":356,"start_character":0,"end_line":358,"end_character":58},"in_reply_to":"6998efd0_38dbc61a","updated":"2024-08-06 10:19:44.000000000","message":"Yeah, we also have other venues to pass information to IPA. First, we pass general configuration on lookup. Second, we can pass instance information on deploy time.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"40c7e199f7e8919cf1f9c8690c8ebf2e6561f736","unresolved":true,"context_lines":[{"line_number":376,"context_line":"\"automated\" step (non zero step priority). This alternative could be"},{"line_number":377,"context_line":"implemented regardless as there was at least 1 comment on the original RFE bug"},{"line_number":378,"context_line":"report advocating for this regardless of the main proposal."},{"line_number":379,"context_line":""},{"line_number":380,"context_line":"Data model impact"},{"line_number":381,"context_line":"-----------------"},{"line_number":382,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"894cb0a7_384632ef","line":379,"updated":"2024-08-05 14:04:31.000000000","message":"Something that is not really covered here is why not do what many Ironic users already do with whole disk images (specifically): encrypt them in advance. Please list pros and cons.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"40c7e199f7e8919cf1f9c8690c8ebf2e6561f736","unresolved":true,"context_lines":[{"line_number":390,"context_line":"REST API impact"},{"line_number":391,"context_line":"---------------"},{"line_number":392,"context_line":""},{"line_number":393,"context_line":"None"},{"line_number":394,"context_line":""},{"line_number":395,"context_line":"Client (CLI) impact"},{"line_number":396,"context_line":"-------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"98ac5310_3bfa7d2b","line":393,"updated":"2024-08-05 14:04:31.000000000","message":"I can hardly believe this: something has to trigger encryption. You\u0027re talking about a Node-level flag above, I\u0027m rather thinking about something new in the instance_info.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":398,"context_line":"\"openstack baremetal\" CLI"},{"line_number":399,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"None, this is entirely a ram disk side capability/configuration."},{"line_number":402,"context_line":""},{"line_number":403,"context_line":"\"openstacksdk\""},{"line_number":404,"context_line":"~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ebbda5fe_1a0dac21","line":401,"updated":"2024-08-05 15:43:02.000000000","message":"This comment sort of back\u0027s Dmitry\u0027s question over flow. This seemed, to me at least, like a mix of embedded state on disk images *combined* with some sort of option to say \"do this\", since we can\u0027t do this by default. I guess if there is no change required to the CLI, I\u0027d personally just say \"None\" and leave it at that, but now I\u0027m worried I misunderstood the previous context because of a lack of flow.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"40c7e199f7e8919cf1f9c8690c8ebf2e6561f736","unresolved":true,"context_lines":[{"line_number":427,"context_line":"entirely in the ram disk as part of the generic hardware manager."},{"line_number":428,"context_line":""},{"line_number":429,"context_line":"This feature will be only usable if the necessary tooling for encryption,"},{"line_number":430,"context_line":"TPM management and partition handling is present on the ram disk."},{"line_number":431,"context_line":""},{"line_number":432,"context_line":"Security impact"},{"line_number":433,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"464a7174_f194908f","line":430,"updated":"2024-08-05 14:04:31.000000000","message":"Let\u0027s list this tooling. We\u0027ll need to add a new DIB element to provide it, most likely.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":427,"context_line":"entirely in the ram disk as part of the generic hardware manager."},{"line_number":428,"context_line":""},{"line_number":429,"context_line":"This feature will be only usable if the necessary tooling for encryption,"},{"line_number":430,"context_line":"TPM management and partition handling is present on the ram disk."},{"line_number":431,"context_line":""},{"line_number":432,"context_line":"Security impact"},{"line_number":433,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"b0036391_536e2790","line":430,"in_reply_to":"464a7174_f194908f","updated":"2024-08-05 15:43:02.000000000","message":"++","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"40c7e199f7e8919cf1f9c8690c8ebf2e6561f736","unresolved":true,"context_lines":[{"line_number":485,"context_line":"Work Items"},{"line_number":486,"context_line":"----------"},{"line_number":487,"context_line":""},{"line_number":488,"context_line":"    - Implement IPA config option to enable the partition encryption"},{"line_number":489,"context_line":""},{"line_number":490,"context_line":"      - Would support kernel command line argument based config"},{"line_number":491,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"91cbbf54_fc389614","line":488,"updated":"2024-08-05 14:04:31.000000000","message":"Please don\u0027t intent the first level of lists, it produces a confusing layout (indentation is a blockquote syntax in rst).","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":505,"context_line":"    - Implement integration between the IPA TPM utility module and the Generic"},{"line_number":506,"context_line":"      LUKS module"},{"line_number":507,"context_line":"    - Implement simple re-usable checks in the LUKS utility module that"},{"line_number":508,"context_line":"      make sure that the requirements for the encryption process are satisfied"},{"line_number":509,"context_line":""},{"line_number":510,"context_line":"      -  boot partition is present"},{"line_number":511,"context_line":"      -  GPT scheme is used"}],"source_content_type":"text/x-rst","patch_set":9,"id":"33a3e2f1_17c55202","line":508,"updated":"2024-08-05 15:43:02.000000000","message":"Lets move logic out of the Work items list and to specific sections covering flow. I\u0027m deeply concerned by auto-magic encryption being a thing since it can introduce a break between contextual understanding and operating reality.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":520,"context_line":"        re-encryption)"},{"line_number":521,"context_line":"      - Check what is the last block of the last partition and create a new"},{"line_number":522,"context_line":"        blocking partition 32MB offset (if growpart is used)"},{"line_number":523,"context_line":"      - Throw exception if we can\u0027t create the blocker partition"},{"line_number":524,"context_line":"      - Extend the partition with cloud-utils\u0027s \"growpart\" tool"},{"line_number":525,"context_line":"        (we can do it with other tool but with growpart it is a short one"},{"line_number":526,"context_line":"        liner)"}],"source_content_type":"text/x-rst","patch_set":9,"id":"25b2f0cd_15946b39","line":523,"updated":"2024-08-05 15:43:02.000000000","message":"We should likely note this is explicitly not compatible with BIOS MBR partitioning, since we\u0027ll quickly exceed the table and support.\n\n(and yes, people still try to use it and expect it to work. Some EFI firmwares also sort of enable this behavior, unfortunately.)","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":521,"context_line":"      - Check what is the last block of the last partition and create a new"},{"line_number":522,"context_line":"        blocking partition 32MB offset (if growpart is used)"},{"line_number":523,"context_line":"      - Throw exception if we can\u0027t create the blocker partition"},{"line_number":524,"context_line":"      - Extend the partition with cloud-utils\u0027s \"growpart\" tool"},{"line_number":525,"context_line":"        (we can do it with other tool but with growpart it is a short one"},{"line_number":526,"context_line":"        liner)"},{"line_number":527,"context_line":"      - TPM key generation and storing"},{"line_number":528,"context_line":"      - Do the re-encryption with the TPM key"},{"line_number":529,"context_line":"      - Delete the blocking partition (if growpart is used)"}],"source_content_type":"text/x-rst","patch_set":9,"id":"463b68d4_fddf6de0","line":526,"range":{"start_line":524,"start_character":11,"end_line":526,"end_character":14},"updated":"2024-08-05 15:43:02.000000000","message":"This changes an overall behavior pattern we\u0027ve sought to avoid, expanding the partition in real time during deployment and *not* letting the OS do so after deployment. This will be complicated and likely requires more visibility since it changes the workflow substantially. We have users who expect to be able to do this or control this after the fact as well which complicates things.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"40c7e199f7e8919cf1f9c8690c8ebf2e6561f736","unresolved":true,"context_lines":[{"line_number":527,"context_line":"      - TPM key generation and storing"},{"line_number":528,"context_line":"      - Do the re-encryption with the TPM key"},{"line_number":529,"context_line":"      - Delete the blocking partition (if growpart is used)"},{"line_number":530,"context_line":"      - Make sure the root partition is properly locked"},{"line_number":531,"context_line":""},{"line_number":532,"context_line":"    - Implement LUKS encryption for partition images"},{"line_number":533,"context_line":"      (this will utilize the generic tooling)"}],"source_content_type":"text/x-rst","patch_set":9,"id":"c015705a_7713150f","line":530,"updated":"2024-08-05 14:04:31.000000000","message":"These are not work items for you, this part should probably moved and expanded to a workflow description.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":527,"context_line":"      - TPM key generation and storing"},{"line_number":528,"context_line":"      - Do the re-encryption with the TPM key"},{"line_number":529,"context_line":"      - Delete the blocking partition (if growpart is used)"},{"line_number":530,"context_line":"      - Make sure the root partition is properly locked"},{"line_number":531,"context_line":""},{"line_number":532,"context_line":"    - Implement LUKS encryption for partition images"},{"line_number":533,"context_line":"      (this will utilize the generic tooling)"}],"source_content_type":"text/x-rst","patch_set":9,"id":"088e80fc_11a07c01","line":530,"in_reply_to":"c015705a_7713150f","updated":"2024-08-05 15:43:02.000000000","message":"Exact same impression. This is the first real insight into the exact workflow and has me concerned because the overall flow is not as clear as I think I need.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":540,"context_line":"      - Partition will be unlocked"},{"line_number":541,"context_line":"      - Partition image will be either streamed or cached then written to the"},{"line_number":542,"context_line":"        root partition"},{"line_number":543,"context_line":"      - Partition will be locked and the lock will be verified"},{"line_number":544,"context_line":""},{"line_number":545,"context_line":"    - Implement LUKS based config drive encryption"},{"line_number":546,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"56997075_269c5c7d","line":543,"updated":"2024-08-05 15:43:02.000000000","message":"So it *sounds* like this would end up being a deploy step which would run before write_image, do the needful and set the stage, and write_image could hten come along and discover state and do the needful for partition images?\n\nBut then that has be wondering about wholedisk images and the exact flow there since wholedisk are the general default and really the project preference for what is used.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":562,"context_line":"These work items are planned to be completed incrementally, first the"},{"line_number":563,"context_line":"generic utility modules then the config drive encryption, whole disk image"},{"line_number":564,"context_line":"based re-encryption, partition image based encryption and  finally the embedded"},{"line_number":565,"context_line":"config drive encryption."},{"line_number":566,"context_line":""},{"line_number":567,"context_line":"The order was established like this because without the utilities one can\u0027t"},{"line_number":568,"context_line":"really do anything and then the order is set up based on the estimation that"}],"source_content_type":"text/x-rst","patch_set":9,"id":"db452fc4_e65f4394","line":565,"updated":"2024-08-05 15:43:02.000000000","message":"nit: I would explicitly break these into phases to separate the list. As we all know, the further you go down the rabbit hole down the phases, the more unknowns get uncovered and uncertainty is higher with later work.\n\nAlso, there likely wouldn\u0027t be many crying if this wasn\u0027t a thing with partition images.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":567,"context_line":"The order was established like this because without the utilities one can\u0027t"},{"line_number":568,"context_line":"really do anything and then the order is set up based on the estimation that"},{"line_number":569,"context_line":"for most users the config drive probably contains sensitive information and the"},{"line_number":570,"context_line":"config drive handling is mostly the same for all use cases except one"},{"line_number":571,"context_line":"(unofficial)."},{"line_number":572,"context_line":""},{"line_number":573,"context_line":"After the config drive encryption is implemented the next is the whole image"},{"line_number":574,"context_line":"encryption  because partition image based workflow doesn\u0027t support software"}],"source_content_type":"text/x-rst","patch_set":9,"id":"0549bf15_8aa6de71","line":571,"range":{"start_line":570,"start_character":58,"end_line":571,"end_character":12},"updated":"2024-08-05 15:43:02.000000000","message":"If this is going to be noted, it needs detail. Otherwise it might need to be removed because it then gets read as \"the project has an unofficial thing\" which I\u0027m not sure is the impression your attempting to convey.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":570,"context_line":"config drive handling is mostly the same for all use cases except one"},{"line_number":571,"context_line":"(unofficial)."},{"line_number":572,"context_line":""},{"line_number":573,"context_line":"After the config drive encryption is implemented the next is the whole image"},{"line_number":574,"context_line":"encryption  because partition image based workflow doesn\u0027t support software"},{"line_number":575,"context_line":"RAID features. Partition image encryption ended up being the next as it is the"},{"line_number":576,"context_line":"last officially supported use-case and then the last task is the detection and"}],"source_content_type":"text/x-rst","patch_set":9,"id":"32ab4c3c_7affc808","line":573,"range":{"start_line":573,"start_character":47,"end_line":573,"end_character":50},"updated":"2024-08-05 15:43:02.000000000","message":"nit: I\u0027d add a comma here or make an explicit ordered phase list.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"c847b6b09b837c32636768aa3d9a7c4a40cd669a","unresolved":true,"context_lines":[{"line_number":571,"context_line":"(unofficial)."},{"line_number":572,"context_line":""},{"line_number":573,"context_line":"After the config drive encryption is implemented the next is the whole image"},{"line_number":574,"context_line":"encryption  because partition image based workflow doesn\u0027t support software"},{"line_number":575,"context_line":"RAID features. Partition image encryption ended up being the next as it is the"},{"line_number":576,"context_line":"last officially supported use-case and then the last task is the detection and"},{"line_number":577,"context_line":"encryption of embedded config drives in case of whole disk images but the"},{"line_number":578,"context_line":"community might end up with the decision that such a scenario would remain"},{"line_number":579,"context_line":"unsupported."},{"line_number":580,"context_line":""},{"line_number":581,"context_line":"Dependencies"},{"line_number":582,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"5eac1fed_dff8af6e","line":579,"range":{"start_line":574,"start_character":0,"end_line":579,"end_character":12},"updated":"2024-08-05 15:43:02.000000000","message":"Please make this phases of implementation, as opposed to descriptive text to map it all together.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"},{"author":{"_account_id":10239,"name":"Dmitry Tantsur","email":"dtantsur@protonmail.com","username":"dtantsur"},"change_message_id":"40c7e199f7e8919cf1f9c8690c8ebf2e6561f736","unresolved":true,"context_lines":[{"line_number":608,"context_line":"Upgrades and Backwards Compatibility"},{"line_number":609,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":610,"context_line":""},{"line_number":611,"context_line":"No issues are anticipated here."},{"line_number":612,"context_line":""},{"line_number":613,"context_line":"Documentation Impact"},{"line_number":614,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9d442e46_e7d51da2","line":611,"updated":"2024-08-05 14:04:31.000000000","message":"One subtle issue: if Ironic is updated without IPA, the feature may seem to be working, while in reality IPA will not do anything.","commit_id":"a9f293d2bce69c79fe4eb25c6a5fa087a8a706ac"}]}