)]}'
{"doc/source/fernet_docs.rst":[{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d740ecddaf8ca94e0ed0865de62c6ba00514380b","unresolved":false,"context_lines":[{"line_number":1,"context_line":".."},{"line_number":2,"context_line":"      Copyright 2011-2012 OpenStack Foundation"},{"line_number":3,"context_line":"      All Rights Reserved."},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_eeda7b16","line":2,"updated":"2015-11-12 03:35:41.000000000","message":"These should be changed.","commit_id":"d949e9391714f9d61314bb1a749595a718d275ff"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a555e174e85d282084b40568bed16fafb7345da3","unresolved":false,"context_lines":[{"line_number":1,"context_line":".."},{"line_number":2,"context_line":"      Copyright 2011-2012 OpenStack Foundation"},{"line_number":3,"context_line":"      All Rights Reserved."},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_63619dd2","line":2,"in_reply_to":"da85f559_eeda7b16","updated":"2015-11-12 14:49:32.000000000","message":"removed, done.","commit_id":"d949e9391714f9d61314bb1a749595a718d275ff"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d740ecddaf8ca94e0ed0865de62c6ba00514380b","unresolved":false,"context_lines":[{"line_number":35,"context_line":"  named as ``1`` in the key repository."},{"line_number":36,"context_line":"* Secondary Key: The secondary key was at one point a primary key, but has"},{"line_number":37,"context_line":"  since been demoted in place of another primary. It is only allowed to"},{"line_number":38,"context_line":"  validate tokens. Since it was the primary at some point in time, it existence"},{"line_number":39,"context_line":"  in the key repository is justified because keystone needs the ability to"},{"line_number":40,"context_line":"  validate tokens that were created with old primary keys. This key is always"},{"line_number":41,"context_line":"  named higher than ``1`` in the key repository, since ``1`` is reserved for"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_424fdb36","line":38,"updated":"2015-11-12 03:35:41.000000000","message":"s/it existence/it\u0027s existence","commit_id":"d949e9391714f9d61314bb1a749595a718d275ff"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a555e174e85d282084b40568bed16fafb7345da3","unresolved":false,"context_lines":[{"line_number":35,"context_line":"  named as ``1`` in the key repository."},{"line_number":36,"context_line":"* Secondary Key: The secondary key was at one point a primary key, but has"},{"line_number":37,"context_line":"  since been demoted in place of another primary. It is only allowed to"},{"line_number":38,"context_line":"  validate tokens. Since it was the primary at some point in time, it existence"},{"line_number":39,"context_line":"  in the key repository is justified because keystone needs the ability to"},{"line_number":40,"context_line":"  validate tokens that were created with old primary keys. This key is always"},{"line_number":41,"context_line":"  named higher than ``1`` in the key repository, since ``1`` is reserved for"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_a3e0e529","line":38,"in_reply_to":"da85f559_424fdb36","updated":"2015-11-12 14:49:32.000000000","message":"Done","commit_id":"d949e9391714f9d61314bb1a749595a718d275ff"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d740ecddaf8ca94e0ed0865de62c6ba00514380b","unresolved":false,"context_lines":[{"line_number":102,"context_line":"The arguments for using Fernet over PKI and PKIZ remain the same as UUID, in"},{"line_number":103,"context_line":"addition to the fact that Fernet tokens are much smaller than PKI and PKIZ"},{"line_number":104,"context_line":"tokens. PKI and PKIZ tokens still require persistent storage. However, Fernet"},{"line_number":105,"context_line":"tokens can\u0027t be validated by the client. If you\u0027re leveraging distributed"},{"line_number":106,"context_line":"signing for PKI and PKIZ tokens, you won\u0027t be able to continue that flow with"},{"line_number":107,"context_line":"Fernet, simply because keystone doesn\u0027t share it\u0027s key repository with clients."},{"line_number":108,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_65c9c958","line":105,"updated":"2015-11-12 03:35:41.000000000","message":"Good point! but this doesn\u0027t looks like the reason to choose Fernet over PKI or PKIZ. :)","commit_id":"d949e9391714f9d61314bb1a749595a718d275ff"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a555e174e85d282084b40568bed16fafb7345da3","unresolved":false,"context_lines":[{"line_number":102,"context_line":"The arguments for using Fernet over PKI and PKIZ remain the same as UUID, in"},{"line_number":103,"context_line":"addition to the fact that Fernet tokens are much smaller than PKI and PKIZ"},{"line_number":104,"context_line":"tokens. PKI and PKIZ tokens still require persistent storage. However, Fernet"},{"line_number":105,"context_line":"tokens can\u0027t be validated by the client. If you\u0027re leveraging distributed"},{"line_number":106,"context_line":"signing for PKI and PKIZ tokens, you won\u0027t be able to continue that flow with"},{"line_number":107,"context_line":"Fernet, simply because keystone doesn\u0027t share it\u0027s key repository with clients."},{"line_number":108,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_c3a16995","line":105,"in_reply_to":"da85f559_65c9c958","updated":"2015-11-12 14:49:32.000000000","message":"Done","commit_id":"d949e9391714f9d61314bb1a749595a718d275ff"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d740ecddaf8ca94e0ed0865de62c6ba00514380b","unresolved":false,"context_lines":[{"line_number":156,"context_line":"      i) If no, investigate issues with the particular keystone host you"},{"line_number":157,"context_line":"         rotated keys on. Fernet keys are small and the operation for rotation"},{"line_number":158,"context_line":"         is fairly trivial. There shouldn\u0027t be much room for error in key"},{"line_number":159,"context_line":"         rotation."},{"line_number":160,"context_line":"      ii) If yes, you should see a new staged key, the old staged key should be"},{"line_number":161,"context_line":"          the new primary, and depending on the ``max_active_keys`` limit you"},{"line_number":162,"context_line":"          have set you might have keys that were pruned. At this point, the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_cc08dadc","line":159,"updated":"2015-11-12 03:35:41.000000000","message":"any idea on possibly failure here? the only place to find some clue is keystone.log?","commit_id":"d949e9391714f9d61314bb1a749595a718d275ff"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a555e174e85d282084b40568bed16fafb7345da3","unresolved":false,"context_lines":[{"line_number":156,"context_line":"      i) If no, investigate issues with the particular keystone host you"},{"line_number":157,"context_line":"         rotated keys on. Fernet keys are small and the operation for rotation"},{"line_number":158,"context_line":"         is fairly trivial. There shouldn\u0027t be much room for error in key"},{"line_number":159,"context_line":"         rotation."},{"line_number":160,"context_line":"      ii) If yes, you should see a new staged key, the old staged key should be"},{"line_number":161,"context_line":"          the new primary, and depending on the ``max_active_keys`` limit you"},{"line_number":162,"context_line":"          have set you might have keys that were pruned. At this point, the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_4366d951","line":159,"in_reply_to":"da85f559_cc08dadc","updated":"2015-11-12 14:49:32.000000000","message":"Done","commit_id":"d949e9391714f9d61314bb1a749595a718d275ff"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d740ecddaf8ca94e0ed0865de62c6ba00514380b","unresolved":false,"context_lines":[{"line_number":163,"context_line":"          node that you rotated on will be creating Fernet tokens with a"},{"line_number":164,"context_line":"          primary key that all other nodes should have. This is why we checked"},{"line_number":165,"context_line":"          the state of all key repositories in Step 1. All other nodes in the"},{"line_number":166,"context_line":"          cluster should be able decrypt tokens created with the new primary."},{"line_number":167,"context_line":"          At this point, we\u0027re ready to distribute the new key set."},{"line_number":168,"context_line":"4. Distribute the new key repository."},{"line_number":169,"context_line":"   a) Was it successful?"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_8c6df2cd","line":166,"updated":"2015-11-12 03:35:41.000000000","message":"s/be able/be able to?","commit_id":"d949e9391714f9d61314bb1a749595a718d275ff"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a555e174e85d282084b40568bed16fafb7345da3","unresolved":false,"context_lines":[{"line_number":163,"context_line":"          node that you rotated on will be creating Fernet tokens with a"},{"line_number":164,"context_line":"          primary key that all other nodes should have. This is why we checked"},{"line_number":165,"context_line":"          the state of all key repositories in Step 1. All other nodes in the"},{"line_number":166,"context_line":"          cluster should be able decrypt tokens created with the new primary."},{"line_number":167,"context_line":"          At this point, we\u0027re ready to distribute the new key set."},{"line_number":168,"context_line":"4. Distribute the new key repository."},{"line_number":169,"context_line":"   a) Was it successful?"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_a38c65da","line":166,"in_reply_to":"da85f559_8c6df2cd","updated":"2015-11-12 14:49:32.000000000","message":"Done","commit_id":"d949e9391714f9d61314bb1a749595a718d275ff"}]}