)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":14525,"name":"Vasyl Saienko","email":"vsaienko@mirantis.com","username":"vsaienko"},"change_message_id":"2961d4c6c1f67b06b15d845aa025b0b210b83a48","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Update multitenancy docs"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Add note to remind user not to use provision network for instance"},{"line_number":10,"context_line":"spawning."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: Ifd7218fc24386097ed072195de8712d600399f09"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"3a71b18c_86745d36","line":10,"updated":"2016-12-06 07:49:50.000000000","message":"If you do another revision please add Related-Bug: 1634573","commit_id":"5b9ca46898bf8bb8de388ae8576c88b2f1adfa4e"}],"doc/source/deploy/multitenancy.rst":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"af8f49c8614ff23bf08fcc904ffe20d48c4fa6f3","unresolved":false,"context_lines":[{"line_number":87,"context_line":"   information about cleaning."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"   .. note::"},{"line_number":90,"context_line":"      Spawning instance into provisioning network isn\u0027t supported yet, the node"},{"line_number":91,"context_line":"      should be deployed into a separate network from the provisioning network."},{"line_number":92,"context_line":"      So when you want to boot a bare metal instance from nova, you should"},{"line_number":93,"context_line":"      choose a different network in neutron for your instance."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a71b18c_c96fa5c3","line":90,"updated":"2016-12-02 18:22:01.000000000","message":"I would not say \"isn\u0027t supported yet\". This is an explicit decision -- booting a node into the provisioning network is a security risk and explicitly disallowed.","commit_id":"6ab678340c26da77c2ceaad02afb50cf5af98ed6"},{"author":{"_account_id":10453,"name":"octopuszhang","email":"zhangyf@rc.inesa.com","username":"1"},"change_message_id":"9582f4d33d07fe7aea9930f4ea659f7de92e902f","unresolved":false,"context_lines":[{"line_number":87,"context_line":"   information about cleaning."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"   .. note::"},{"line_number":90,"context_line":"      Spawning instance into provisioning network isn\u0027t supported yet, the node"},{"line_number":91,"context_line":"      should be deployed into a separate network from the provisioning network."},{"line_number":92,"context_line":"      So when you want to boot a bare metal instance from nova, you should"},{"line_number":93,"context_line":"      choose a different network in neutron for your instance."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a71b18c_09d35d05","line":90,"in_reply_to":"3a71b18c_c96fa5c3","updated":"2016-12-02 18:34:32.000000000","message":"Done","commit_id":"6ab678340c26da77c2ceaad02afb50cf5af98ed6"},{"author":{"_account_id":13295,"name":"Mario Villaplana","email":"mario.villaplana@gmail.com","username":"mariojv"},"change_message_id":"4d4c0f463b6ea5ba104c0a399279e18dd0c4ded4","unresolved":false,"context_lines":[{"line_number":87,"context_line":"   information about cleaning."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"   .. note::"},{"line_number":90,"context_line":"      Spawning instance into provisioning network is not permitted for security"},{"line_number":91,"context_line":"      reasons, the node should be deployed into a separate network from the"},{"line_number":92,"context_line":"      provisioning network. So when you want to boot a bare metal instance from"},{"line_number":93,"context_line":"      nova, you should choose a different network in neutron for your instance."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a71b18c_f9c5fa3b","line":90,"updated":"2016-12-03 21:56:11.000000000","message":"This might be better grammatically:\n\nSpawning an instance onto the provisioning network is not permitted for security reasons. The node should be deployed onto a different network than the provisioning network. So, when you want to boot a bare metal instance from nova, you should choose a different network in neutron for your instance.","commit_id":"c90bd238095ace9913bfff4772f258d12f853daa"},{"author":{"_account_id":10453,"name":"octopuszhang","email":"zhangyf@rc.inesa.com","username":"1"},"change_message_id":"6f44958b15a4bb7944af1be806036ebbc7c15856","unresolved":false,"context_lines":[{"line_number":87,"context_line":"   information about cleaning."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"   .. note::"},{"line_number":90,"context_line":"      Spawning instance into provisioning network is not permitted for security"},{"line_number":91,"context_line":"      reasons, the node should be deployed into a separate network from the"},{"line_number":92,"context_line":"      provisioning network. So when you want to boot a bare metal instance from"},{"line_number":93,"context_line":"      nova, you should choose a different network in neutron for your instance."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a71b18c_c373e7e5","line":90,"in_reply_to":"3a71b18c_f9c5fa3b","updated":"2016-12-04 16:48:33.000000000","message":"Thanks, fixed","commit_id":"c90bd238095ace9913bfff4772f258d12f853daa"},{"author":{"_account_id":14525,"name":"Vasyl Saienko","email":"vsaienko@mirantis.com","username":"vsaienko"},"change_message_id":"f4aa854ecaf676fff6621b1f5d0fb18ba0b36fb2","unresolved":false,"context_lines":[{"line_number":87,"context_line":"   information about cleaning."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"   .. note::"},{"line_number":90,"context_line":"      Spawning an instance onto the provisioning network is not permitted for"},{"line_number":91,"context_line":"      security reasons. The node should be deployed onto a different network"},{"line_number":92,"context_line":"      than the provisioning network. So, when you want to boot a bare metal"},{"line_number":93,"context_line":"      instance from nova, you should choose a different network in neutron for"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a71b18c_576b981d","line":90,"updated":"2016-12-07 08:55:40.000000000","message":"Please add also that ironic provision network should be configured as NON shared network, it will hide this network from non-admin users. And they will not be able to spawn instances in it.","commit_id":"7439f2f292feb498f39224b698aae74aa93ca667"},{"author":{"_account_id":10453,"name":"octopuszhang","email":"zhangyf@rc.inesa.com","username":"1"},"change_message_id":"b00fafc3e19050fdae0bc992bae27519c99ceabb","unresolved":false,"context_lines":[{"line_number":87,"context_line":"   information about cleaning."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"   .. note::"},{"line_number":90,"context_line":"      Spawning an instance onto the provisioning network is not permitted for"},{"line_number":91,"context_line":"      security reasons. The node should be deployed onto a different network"},{"line_number":92,"context_line":"      than the provisioning network. So, when you want to boot a bare metal"},{"line_number":93,"context_line":"      instance from nova, you should choose a different network in neutron for"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a71b18c_893b3f38","line":90,"in_reply_to":"3a71b18c_576b981d","updated":"2016-12-07 17:15:01.000000000","message":"Done","commit_id":"7439f2f292feb498f39224b698aae74aa93ca667"},{"author":{"_account_id":12356,"name":"Vladyslav Drok","email":"vdrok@mirantis.com","username":"vdrok"},"change_message_id":"d18dbe3af47e695c03c4409bc3b3c14825a4d862","unresolved":false,"context_lines":[{"line_number":93,"context_line":"      instance from nova, you should choose a different network in neutron for"},{"line_number":94,"context_line":"      your instance."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"      Also, the provisioning network should be configured as NON shared"},{"line_number":97,"context_line":"      network, it will hide this network from non-admin users. And they will"},{"line_number":98,"context_line":"      not be able to spawn instances in it."},{"line_number":99,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a71b18c_3722d9a3","line":96,"range":{"start_line":96,"start_character":61,"end_line":96,"end_character":71},"updated":"2016-12-12 14:38:34.000000000","message":"non-shared","commit_id":"a468d42fe8dc01f136e003edc19cf2729cc46b9b"},{"author":{"_account_id":10453,"name":"octopuszhang","email":"zhangyf@rc.inesa.com","username":"1"},"change_message_id":"13e7cbb6f5fcb0b1e33b1739b4358b85f1770b45","unresolved":false,"context_lines":[{"line_number":93,"context_line":"      instance from nova, you should choose a different network in neutron for"},{"line_number":94,"context_line":"      your instance."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"      Also, the provisioning network should be configured as NON shared"},{"line_number":97,"context_line":"      network, it will hide this network from non-admin users. And they will"},{"line_number":98,"context_line":"      not be able to spawn instances in it."},{"line_number":99,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a71b18c_17a87d8b","line":96,"range":{"start_line":96,"start_character":61,"end_line":96,"end_character":71},"in_reply_to":"3a71b18c_3722d9a3","updated":"2016-12-12 14:44:14.000000000","message":"Done","commit_id":"a468d42fe8dc01f136e003edc19cf2729cc46b9b"},{"author":{"_account_id":12356,"name":"Vladyslav Drok","email":"vdrok@mirantis.com","username":"vdrok"},"change_message_id":"a8a2f69615ec07e9ddd510040441d3baf99c5247","unresolved":false,"context_lines":[{"line_number":87,"context_line":"   information about cleaning."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"   .. note::"},{"line_number":90,"context_line":"      Spawning an instance onto the provisioning network is not permitted for"},{"line_number":91,"context_line":"      security reasons. The node should be deployed onto a different network"},{"line_number":92,"context_line":"      than the provisioning network. So, when you want to boot a bare metal"},{"line_number":93,"context_line":"      instance from nova, you should choose a different network in neutron for"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1a6eadb0_dc7b417a","line":90,"updated":"2016-12-12 15:49:37.000000000","message":"Also, to make it less confusing, I\u0027d highlight somehow that it is not \"not permitted\" (as we can\u0027t control what the user specifies on the nova side) but impossible, the deployment will fail.","commit_id":"55430e8dcd56972d4f118ee122d8ff8519b5c56f"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"54c515bd02f5ed5090452f6ad60b3c7032bfcde9","unresolved":false,"context_lines":[{"line_number":87,"context_line":"   information about cleaning."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"   .. note::"},{"line_number":90,"context_line":"      Spawning an instance onto the provisioning network is not permitted for"},{"line_number":91,"context_line":"      security reasons. The node should be deployed onto a different network"},{"line_number":92,"context_line":"      than the provisioning network. So, when you want to boot a bare metal"},{"line_number":93,"context_line":"      instance from nova, you should choose a different network in neutron for"},{"line_number":94,"context_line":"      your instance."}],"source_content_type":"text/x-rst","patch_set":7,"id":"1a6eadb0_531ac418","line":91,"range":{"start_line":90,"start_character":57,"end_line":91,"end_character":22},"updated":"2016-12-12 15:09:18.000000000","message":"Since we\u0027ve not fixed the bug to block this, this should be changed to something along the lines of \"must not be performed for security reasons.\"  That being said, we\u0027re also highlighting a security defect in a sense, and should land a fix in code first.","commit_id":"55430e8dcd56972d4f118ee122d8ff8519b5c56f"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2479cc4c07352d0f88f542168744350e26f915ab","unresolved":false,"context_lines":[{"line_number":87,"context_line":"   information about cleaning."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"   .. note::"},{"line_number":90,"context_line":"      Spawning an instance onto the provisioning network is not permitted for"},{"line_number":91,"context_line":"      security reasons. The node should be deployed onto a different network"},{"line_number":92,"context_line":"      than the provisioning network. So, when you want to boot a bare metal"},{"line_number":93,"context_line":"      instance from nova, you should choose a different network in neutron for"},{"line_number":94,"context_line":"      your instance."}],"source_content_type":"text/x-rst","patch_set":7,"id":"1a6eadb0_59f103cd","line":91,"range":{"start_line":90,"start_character":57,"end_line":91,"end_character":22},"in_reply_to":"1a6eadb0_531ac418","updated":"2016-12-12 15:41:26.000000000","message":"I\u0027ve re-reviewed the code. It should not work, however I have a very strong preference about stating behavior as intentional, when we are not explicitly testing for such a possibility.  My big fear being what if neutron changes behavior.","commit_id":"55430e8dcd56972d4f118ee122d8ff8519b5c56f"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"54c515bd02f5ed5090452f6ad60b3c7032bfcde9","unresolved":false,"context_lines":[{"line_number":93,"context_line":"      instance from nova, you should choose a different network in neutron for"},{"line_number":94,"context_line":"      your instance."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"      Also, the provisioning network should be configured as non-shared"},{"line_number":97,"context_line":"      network, it will hide this network from non-admin users. And they will"},{"line_number":98,"context_line":"      not be able to spawn instances in it."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"   .. note::"},{"line_number":101,"context_line":"      The \"provisioning\" and \"cleaning\" networks may be the same neutron"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1a6eadb0_d398946d","line":98,"range":{"start_line":96,"start_character":0,"end_line":98,"end_character":43},"updated":"2016-12-12 15:09:18.000000000","message":"nit: This should likely be slightly re-woreded as a separate note, or even warning.","commit_id":"55430e8dcd56972d4f118ee122d8ff8519b5c56f"},{"author":{"_account_id":10453,"name":"octopuszhang","email":"zhangyf@rc.inesa.com","username":"1"},"change_message_id":"12aa35f8c8d04c9c8a8ebb7c01b464caa65245dd","unresolved":false,"context_lines":[{"line_number":93,"context_line":"      instance from nova, you should choose a different network in neutron for"},{"line_number":94,"context_line":"      your instance."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"      Also, the provisioning network should be configured as non-shared"},{"line_number":97,"context_line":"      network, it will hide this network from non-admin users. And they will"},{"line_number":98,"context_line":"      not be able to spawn instances in it."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"   .. note::"},{"line_number":101,"context_line":"      The \"provisioning\" and \"cleaning\" networks may be the same neutron"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1a6eadb0_d698826d","line":98,"range":{"start_line":96,"start_character":0,"end_line":98,"end_character":43},"in_reply_to":"1a6eadb0_d398946d","updated":"2016-12-12 15:27:34.000000000","message":"Yes, looks reasonable, If someone builds an instance in the provisioning network，and run a dhcp service in it，the provision may be broken.","commit_id":"55430e8dcd56972d4f118ee122d8ff8519b5c56f"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"2479cc4c07352d0f88f542168744350e26f915ab","unresolved":false,"context_lines":[{"line_number":93,"context_line":"      instance from nova, you should choose a different network in neutron for"},{"line_number":94,"context_line":"      your instance."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"      Also, the provisioning network should be configured as non-shared"},{"line_number":97,"context_line":"      network, it will hide this network from non-admin users. And they will"},{"line_number":98,"context_line":"      not be able to spawn instances in it."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"   .. note::"},{"line_number":101,"context_line":"      The \"provisioning\" and \"cleaning\" networks may be the same neutron"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1a6eadb0_19ceab83","line":98,"range":{"start_line":96,"start_character":0,"end_line":98,"end_character":43},"in_reply_to":"1a6eadb0_d698826d","updated":"2016-12-12 15:41:26.000000000","message":"Even worse, if a user is somehow able to attach a router...","commit_id":"55430e8dcd56972d4f118ee122d8ff8519b5c56f"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"e268310a64db74b1818894e4e3852bc02ddad601","unresolved":false,"context_lines":[{"line_number":89,"context_line":"   .. warning::"},{"line_number":90,"context_line":"      Please make sure ironic is exclusive to the provisioning and cleaning"},{"line_number":91,"context_line":"      network in case that non-admin users could spawn instance onto it and"},{"line_number":92,"context_line":"      get the access to ironic control plane (It\u0027s dangerous). For this"},{"line_number":93,"context_line":"      reason, the provisioning and cleaning network should be configured as"},{"line_number":94,"context_line":"      non-shared network in admin tenant."},{"line_number":95,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6eadb0_614c0a43","line":92,"range":{"start_line":92,"start_character":45,"end_line":92,"end_character":61},"updated":"2016-12-13 18:01:51.000000000","message":"I strongly believe we need to explain why, see my suggestion below.\n\nI think something like \"ironic control plane, as this could present a security risk in some configurations.\"","commit_id":"a01e8ee2a734d44483bf5e83d1f8e2ef63c611e4"},{"author":{"_account_id":10453,"name":"octopuszhang","email":"zhangyf@rc.inesa.com","username":"1"},"change_message_id":"fb3c96c18a721d65b09deffdb77071ba083f41f3","unresolved":false,"context_lines":[{"line_number":89,"context_line":"   .. warning::"},{"line_number":90,"context_line":"      Please make sure ironic is exclusive to the provisioning and cleaning"},{"line_number":91,"context_line":"      network in case that non-admin users could spawn instance onto it and"},{"line_number":92,"context_line":"      get the access to ironic control plane (It\u0027s dangerous). For this"},{"line_number":93,"context_line":"      reason, the provisioning and cleaning network should be configured as"},{"line_number":94,"context_line":"      non-shared network in admin tenant."},{"line_number":95,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6eadb0_8b366f50","line":92,"range":{"start_line":92,"start_character":45,"end_line":92,"end_character":61},"in_reply_to":"1a6eadb0_614c0a43","updated":"2016-12-14 16:05:18.000000000","message":"Done","commit_id":"a01e8ee2a734d44483bf5e83d1f8e2ef63c611e4"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"e268310a64db74b1818894e4e3852bc02ddad601","unresolved":false,"context_lines":[{"line_number":96,"context_line":"   .. note::"},{"line_number":97,"context_line":"      Spawning a bare metal instance onto the provisioning network is"},{"line_number":98,"context_line":"      impossible, the deployment will fail. The node should be deployed onto a"},{"line_number":99,"context_line":"      different network than the provisioning network. So, when you want to"},{"line_number":100,"context_line":"      boot a bare metal instance from nova, you should choose a different"},{"line_number":101,"context_line":"      network in neutron for your instance."},{"line_number":102,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6eadb0_81f5a6cc","line":99,"range":{"start_line":99,"start_character":55,"end_line":99,"end_character":58},"updated":"2016-12-13 18:01:51.000000000","message":"nit: s/So, w/W/   and s/want to//","commit_id":"a01e8ee2a734d44483bf5e83d1f8e2ef63c611e4"},{"author":{"_account_id":10453,"name":"octopuszhang","email":"zhangyf@rc.inesa.com","username":"1"},"change_message_id":"fb3c96c18a721d65b09deffdb77071ba083f41f3","unresolved":false,"context_lines":[{"line_number":96,"context_line":"   .. note::"},{"line_number":97,"context_line":"      Spawning a bare metal instance onto the provisioning network is"},{"line_number":98,"context_line":"      impossible, the deployment will fail. The node should be deployed onto a"},{"line_number":99,"context_line":"      different network than the provisioning network. So, when you want to"},{"line_number":100,"context_line":"      boot a bare metal instance from nova, you should choose a different"},{"line_number":101,"context_line":"      network in neutron for your instance."},{"line_number":102,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6eadb0_2b463bbf","line":99,"range":{"start_line":99,"start_character":55,"end_line":99,"end_character":58},"in_reply_to":"1a6eadb0_81f5a6cc","updated":"2016-12-14 16:05:18.000000000","message":"Done","commit_id":"a01e8ee2a734d44483bf5e83d1f8e2ef63c611e4"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"6de27638be2a695069d9a1164b6adc8fe53b8d1f","unresolved":false,"context_lines":[{"line_number":88,"context_line":""},{"line_number":89,"context_line":"   .. warning::"},{"line_number":90,"context_line":"      Please make sure ironic is exclusive to the provisioning and cleaning"},{"line_number":91,"context_line":"      network in case that non-admin users could spawn instance onto it and"},{"line_number":92,"context_line":"      get the access to ironic control plane, as this could present a security"},{"line_number":93,"context_line":"      risk in some configurations. For this reason, the provisioning and"},{"line_number":94,"context_line":"      cleaning network should be configured as non-shared network in admin"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1a6eadb0_f2534637","line":91,"range":{"start_line":91,"start_character":54,"end_line":91,"end_character":55},"updated":"2016-12-14 21:06:36.000000000","message":"nit: an instance, We can follow-up and fix that.","commit_id":"8c8bfc505539e7d9a4afbefc2e1dbd75ac46c15f"},{"author":{"_account_id":10453,"name":"octopuszhang","email":"zhangyf@rc.inesa.com","username":"1"},"change_message_id":"0dac5bdec3ddfe297e4f2331e446982ab7e8ddb2","unresolved":false,"context_lines":[{"line_number":88,"context_line":""},{"line_number":89,"context_line":"   .. warning::"},{"line_number":90,"context_line":"      Please make sure ironic is exclusive to the provisioning and cleaning"},{"line_number":91,"context_line":"      network in case that non-admin users could spawn instance onto it and"},{"line_number":92,"context_line":"      get the access to ironic control plane, as this could present a security"},{"line_number":93,"context_line":"      risk in some configurations. For this reason, the provisioning and"},{"line_number":94,"context_line":"      cleaning network should be configured as non-shared network in admin"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1a6eadb0_2ae37534","line":91,"range":{"start_line":91,"start_character":54,"end_line":91,"end_character":55},"in_reply_to":"1a6eadb0_f2534637","updated":"2016-12-15 07:18:09.000000000","message":"Done","commit_id":"8c8bfc505539e7d9a4afbefc2e1dbd75ac46c15f"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"6de27638be2a695069d9a1164b6adc8fe53b8d1f","unresolved":false,"context_lines":[{"line_number":91,"context_line":"      network in case that non-admin users could spawn instance onto it and"},{"line_number":92,"context_line":"      get the access to ironic control plane, as this could present a security"},{"line_number":93,"context_line":"      risk in some configurations. For this reason, the provisioning and"},{"line_number":94,"context_line":"      cleaning network should be configured as non-shared network in admin"},{"line_number":95,"context_line":"      tenant."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"   .. note::"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1a6eadb0_f22a668f","line":94,"range":{"start_line":94,"start_character":68,"end_line":94,"end_character":69},"updated":"2016-12-14 21:06:36.000000000","message":"nit: the admin","commit_id":"8c8bfc505539e7d9a4afbefc2e1dbd75ac46c15f"},{"author":{"_account_id":10453,"name":"octopuszhang","email":"zhangyf@rc.inesa.com","username":"1"},"change_message_id":"0dac5bdec3ddfe297e4f2331e446982ab7e8ddb2","unresolved":false,"context_lines":[{"line_number":91,"context_line":"      network in case that non-admin users could spawn instance onto it and"},{"line_number":92,"context_line":"      get the access to ironic control plane, as this could present a security"},{"line_number":93,"context_line":"      risk in some configurations. For this reason, the provisioning and"},{"line_number":94,"context_line":"      cleaning network should be configured as non-shared network in admin"},{"line_number":95,"context_line":"      tenant."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"   .. note::"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1a6eadb0_4ad2715d","line":94,"range":{"start_line":94,"start_character":68,"end_line":94,"end_character":69},"in_reply_to":"1a6eadb0_f22a668f","updated":"2016-12-15 07:18:09.000000000","message":"Done","commit_id":"8c8bfc505539e7d9a4afbefc2e1dbd75ac46c15f"},{"author":{"_account_id":12356,"name":"Vladyslav Drok","email":"vdrok@mirantis.com","username":"vdrok"},"change_message_id":"1fbe0c0ca76305fc8a8c3f077cc324fe74b7f6ae","unresolved":false,"context_lines":[{"line_number":88,"context_line":""},{"line_number":89,"context_line":"   .. warning::"},{"line_number":90,"context_line":"      Please make sure ironic is exclusive to the provisioning and cleaning"},{"line_number":91,"context_line":"      network in case that non-admin users could spawn an instance onto it and"},{"line_number":92,"context_line":"      get the access to ironic control plane, as this could present a security"},{"line_number":93,"context_line":"      risk in some configurations. For this reason, the provisioning and"},{"line_number":94,"context_line":"      cleaning network should be configured as non-shared network in the admin"},{"line_number":95,"context_line":"      tenant."},{"line_number":96,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"1a6eadb0_f4fb1fbf","line":93,"range":{"start_line":91,"start_character":6,"end_line":93,"end_character":50},"updated":"2016-12-15 08:49:33.000000000","message":"network. Non-admin users spawning instances in this network and getting access to ironic control plane is a security risk. For this reason...","commit_id":"35862e632dc8245a5870380a8d206de008a19013"}]}