)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"64c1b9cb78f7c048030297822f98298936f7d9d4","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This commit lays down the configuration options needed to implement encryption"},{"line_number":10,"context_line":"of credentials at rest."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I83cc6138f2101bf121c75c465b43e95f90ef1f67"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"3ac371cc_1636f6e5","line":11,"updated":"2016-08-16 18:07:42.000000000","message":"bp credential-encryption","commit_id":"28e6f1010f450bac400d8ec19e27ebbdac7cd7a6"}],"keystone/conf/credential.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"af149d7b07255eecfc2cc5745ea08b223ee5e845","unresolved":false,"context_lines":[{"line_number":29,"context_line":"    default\u003d\u0027fernet\u0027,"},{"line_number":30,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":31,"context_line":"Controls the credential encryption and decryption operations. Entry point in"},{"line_number":32,"context_line":"the ``keystone.credential.provider`` namespace. Default provider is [fernet]."},{"line_number":33,"context_line":"\"\"\"))"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"allow_plaintext \u003d cfg.BoolOpt("}],"source_content_type":"text/x-python","patch_set":1,"id":"9ad45d7e_06be18ff","line":32,"range":{"start_line":32,"start_character":48,"end_line":32,"end_character":77},"updated":"2016-08-12 17:22:36.000000000","message":"\"Keystone only provides a `fernet` provider, so there\u0027s no reason to\nchange this unless you are providing a custom entry point.\"","commit_id":"15065c68ffccfada8572853e72c86cb82540842b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"af149d7b07255eecfc2cc5745ea08b223ee5e845","unresolved":false,"context_lines":[{"line_number":36,"context_line":"    \u0027allow_plaintext\u0027,"},{"line_number":37,"context_line":"    default\u003dTrue,"},{"line_number":38,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":39,"context_line":"Allow fields to not be encrypted when retrieving them from backend.  This"},{"line_number":40,"context_line":"should be disabled once credentials have been encrypted using the"},{"line_number":41,"context_line":"``keystone-manage credentials_encrypt`` command.  This can also be used to"},{"line_number":42,"context_line":"allow storing non-encrypted credentials."}],"source_content_type":"text/x-python","patch_set":1,"id":"9ad45d7e_86404809","line":39,"range":{"start_line":39,"start_character":6,"end_line":39,"end_character":12},"updated":"2016-08-12 17:22:36.000000000","message":"credentials?","commit_id":"15065c68ffccfada8572853e72c86cb82540842b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"af149d7b07255eecfc2cc5745ea08b223ee5e845","unresolved":false,"context_lines":[{"line_number":36,"context_line":"    \u0027allow_plaintext\u0027,"},{"line_number":37,"context_line":"    default\u003dTrue,"},{"line_number":38,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":39,"context_line":"Allow fields to not be encrypted when retrieving them from backend.  This"},{"line_number":40,"context_line":"should be disabled once credentials have been encrypted using the"},{"line_number":41,"context_line":"``keystone-manage credentials_encrypt`` command.  This can also be used to"},{"line_number":42,"context_line":"allow storing non-encrypted credentials."}],"source_content_type":"text/x-python","patch_set":1,"id":"9ad45d7e_e65144da","line":39,"range":{"start_line":39,"start_character":67,"end_line":39,"end_character":69},"updated":"2016-08-12 17:22:36.000000000","message":"nit, only use 1 space since that\u0027s the pattern we\u0027ve established in all other conf options. this applies throughout the change","commit_id":"15065c68ffccfada8572853e72c86cb82540842b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"13d2f4b83f5d10fc9cb45f871a94cda6f0c73586","unresolved":false,"context_lines":[{"line_number":36,"context_line":"    \u0027allow_plaintext\u0027,"},{"line_number":37,"context_line":"    default\u003dTrue,"},{"line_number":38,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":39,"context_line":"Allow fields to not be encrypted when retrieving them from backend.  This"},{"line_number":40,"context_line":"should be disabled once credentials have been encrypted using the"},{"line_number":41,"context_line":"``keystone-manage credentials_encrypt`` command.  This can also be used to"},{"line_number":42,"context_line":"allow storing non-encrypted credentials."}],"source_content_type":"text/x-python","patch_set":1,"id":"9ad45d7e_82366be5","line":39,"in_reply_to":"9ad45d7e_e65144da","updated":"2016-08-12 20:07:00.000000000","message":"Yeah - I\u0027m going to remove this. I posted something closer to what I\u0027m thinking in a separate patch.","commit_id":"15065c68ffccfada8572853e72c86cb82540842b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"af149d7b07255eecfc2cc5745ea08b223ee5e845","unresolved":false,"context_lines":[{"line_number":46,"context_line":"    \u0027key_repository\u0027,"},{"line_number":47,"context_line":"    default\u003d\u0027/etc/keystone/credential-keys/\u0027,"},{"line_number":48,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":49,"context_line":"Directory containing Encrypted Credential keys.  Credential token keys have no"},{"line_number":50,"context_line":"relationship to Fernet token keys."},{"line_number":51,"context_line":"\"\"\"))"},{"line_number":52,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"9ad45d7e_462bf033","line":49,"range":{"start_line":49,"start_character":21,"end_line":49,"end_character":46},"updated":"2016-08-12 17:22:36.000000000","message":"\"... keys that will be used to encrypt credentials\"","commit_id":"15065c68ffccfada8572853e72c86cb82540842b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"af149d7b07255eecfc2cc5745ea08b223ee5e845","unresolved":false,"context_lines":[{"line_number":46,"context_line":"    \u0027key_repository\u0027,"},{"line_number":47,"context_line":"    default\u003d\u0027/etc/keystone/credential-keys/\u0027,"},{"line_number":48,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":49,"context_line":"Directory containing Encrypted Credential keys.  Credential token keys have no"},{"line_number":50,"context_line":"relationship to Fernet token keys."},{"line_number":51,"context_line":"\"\"\"))"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"max_active_keys \u003d cfg.IntOpt("}],"source_content_type":"text/x-python","patch_set":1,"id":"9ad45d7e_26d7dc24","line":50,"range":{"start_line":49,"start_character":49,"end_line":50,"end_character":33},"updated":"2016-08-12 17:22:36.000000000","message":"I\u0027d either remove this sentence completely or re-write it as:\n\n\"The ``[credential] key_repository`` is unrelated to the ``[fernet] key_repository`` option.\"","commit_id":"15065c68ffccfada8572853e72c86cb82540842b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"af149d7b07255eecfc2cc5745ea08b223ee5e845","unresolved":false,"context_lines":[{"line_number":54,"context_line":"    \u0027max_active_keys\u0027,"},{"line_number":55,"context_line":"    default\u003d2,"},{"line_number":56,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":57,"context_line":"This controls how many keys are held in rotation by keystone-manage"},{"line_number":58,"context_line":"credential_rotate before they are discarded. The default value of 3 means that"},{"line_number":59,"context_line":"keystone will maintain one staged key, one primary key, and one secondary key."},{"line_number":60,"context_line":"Increasing this value means that additional secondary keys will be kept in the"},{"line_number":61,"context_line":"rotation."}],"source_content_type":"text/x-python","patch_set":1,"id":"9ad45d7e_e6edc4f0","line":58,"range":{"start_line":57,"start_character":52,"end_line":58,"end_character":17},"updated":"2016-08-12 17:22:36.000000000","message":"``keystone-manage credential-rotate``","commit_id":"15065c68ffccfada8572853e72c86cb82540842b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"949406e3bf58ce4309b76eee4f6077db710a43c3","unresolved":false,"context_lines":[{"line_number":52,"context_line":""},{"line_number":53,"context_line":"max_active_keys \u003d cfg.IntOpt("},{"line_number":54,"context_line":"    \u0027max_active_keys\u0027,"},{"line_number":55,"context_line":"    default\u003d2,"},{"line_number":56,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":57,"context_line":"This controls how many keys are held in rotation by keystone-manage"},{"line_number":58,"context_line":"credential_rotate before they are discarded. The default value of 3 means that"}],"source_content_type":"text/x-python","patch_set":3,"id":"3ac371cc_f669ac26","line":55,"updated":"2016-08-16 13:33:14.000000000","message":"This should probably be changed to 3. If I\u0027m thinking about this right, I don\u0027t think 2 keys will be enough to properly rotate. This is because the staged key is always introduced as the 0 key and there would only ever be one primary key (1, 2, 3, 4, etc...). The repository would only ever consist of 0 and 1, or 0 and 2, or 0 and 3. By making 3 the default, we could ensure that we properly rotate all credentials to the new key before pruning the third key.\n\nDoes this sound right?","commit_id":"0d7882e1900bf63c76b5894f6187f5ff19e625b6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"80be9a02a843e35023a17504a48f9e6609c28774","unresolved":false,"context_lines":[{"line_number":52,"context_line":""},{"line_number":53,"context_line":"max_active_keys \u003d cfg.IntOpt("},{"line_number":54,"context_line":"    \u0027max_active_keys\u0027,"},{"line_number":55,"context_line":"    default\u003d2,"},{"line_number":56,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":57,"context_line":"This controls how many keys are held in rotation by keystone-manage"},{"line_number":58,"context_line":"credential_rotate before they are discarded. The default value of 3 means that"}],"source_content_type":"text/x-python","patch_set":3,"id":"3ac371cc_36a7c450","line":55,"in_reply_to":"3ac371cc_f669ac26","updated":"2016-08-16 13:35:58.000000000","message":"That being said - if we only need 3 keys and if we can enforce proper rotation and migration through keystone-manage using the key_hash, does it even make sense to expose this through config?","commit_id":"0d7882e1900bf63c76b5894f6187f5ff19e625b6"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"64c1b9cb78f7c048030297822f98298936f7d9d4","unresolved":false,"context_lines":[{"line_number":57,"context_line":"effect unless `[credential] encrypt` is set to `True`."},{"line_number":58,"context_line":"\"\"\"))"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"# NOTE(lbragstad): Do we even need this anymore with the key hash stored with"},{"line_number":61,"context_line":"# each credential?"},{"line_number":62,"context_line":"max_active_keys \u003d cfg.IntOpt("},{"line_number":63,"context_line":"    \u0027max_active_keys\u0027,"},{"line_number":64,"context_line":"    default\u003d3,"}],"source_content_type":"text/x-python","patch_set":4,"id":"3ac371cc_56ea2e10","line":61,"range":{"start_line":60,"start_character":0,"end_line":61,"end_character":18},"updated":"2016-08-16 18:07:42.000000000","message":"We need to decide on this first","commit_id":"28e6f1010f450bac400d8ec19e27ebbdac7cd7a6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"41626a7747f275591095593b660475c41d9cda56","unresolved":false,"context_lines":[{"line_number":58,"context_line":"\"\"\"))"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"# NOTE(lbragstad): Do we even need this anymore with the key hash stored with"},{"line_number":61,"context_line":"# each credential?"},{"line_number":62,"context_line":"max_active_keys \u003d cfg.IntOpt("},{"line_number":63,"context_line":"    \u0027max_active_keys\u0027,"},{"line_number":64,"context_line":"    default\u003d3,"}],"source_content_type":"text/x-python","patch_set":4,"id":"3ac371cc_dc691fc0","line":61,"in_reply_to":"3ac371cc_56ea2e10","updated":"2016-08-16 18:56:36.000000000","message":"Right - do you have an opinion?\n\nI\u0027m inclined to just remove it and see what happens.","commit_id":"28e6f1010f450bac400d8ec19e27ebbdac7cd7a6"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"56660aa60cfe374c757fd32ae39adce4c3e1f148","unresolved":false,"context_lines":[{"line_number":25,"context_line":"\"\"\"))"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"encrypt \u003d cfg.BoolOpt("},{"line_number":28,"context_line":"    \u0027encrypt\u0027,"},{"line_number":29,"context_line":"    default\u003dFalse,"},{"line_number":30,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":31,"context_line":"Encrypt credentials before storing them in the backend. Once enabled, newly"}],"source_content_type":"text/x-python","patch_set":6,"id":"3ac371cc_11019d05","line":28,"updated":"2016-08-17 18:47:52.000000000","message":"The spirit of keystone.conf is supposed to be production-friendly defaults, and defaulting to a complete lack of security is not production friendly.\n\nSo, I\u0027d rather not see this option exist at all, in that I\u0027d rather keystone require credentials to be encrypted in order to use the API. In other words, I\u0027d rather see keystone raise a 500 if you haven\u0027t populated the credential-keys repository and you try to POST to the /v3/credentials API.\n\nThe only use case for supporting this option is if we also had an example of a backend that performed the encryption for us (liiike Barbican). So, I guess keep the option, but you could amend the description with something about this only being useful for `[credential] driver` options that do not automatically encrypt credentials, such as \u0027sql\u0027.\n\n\u003c/rant\u003e","commit_id":"69b40f68051bdb7d1aab5bc3a1f3a1c992b54d73"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"dd35dcce318f45bcfce139f5960a26de0523e316","unresolved":false,"context_lines":[{"line_number":25,"context_line":"\"\"\"))"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"encrypt \u003d cfg.BoolOpt("},{"line_number":28,"context_line":"    \u0027encrypt\u0027,"},{"line_number":29,"context_line":"    default\u003dFalse,"},{"line_number":30,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":31,"context_line":"Encrypt credentials before storing them in the backend. Once enabled, newly"}],"source_content_type":"text/x-python","patch_set":6,"id":"3ac371cc_87d0af20","line":28,"in_reply_to":"3ac371cc_11019d05","updated":"2016-08-17 19:41:05.000000000","message":"I like the idea, however the point of a backend performing the encryption for us is valid. Please amend the description as suggested by Dolph.","commit_id":"69b40f68051bdb7d1aab5bc3a1f3a1c992b54d73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"bff36faab4056305a883a2bb30df724f368aa8f9","unresolved":false,"context_lines":[{"line_number":25,"context_line":"\"\"\"))"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"encrypt \u003d cfg.BoolOpt("},{"line_number":28,"context_line":"    \u0027encrypt\u0027,"},{"line_number":29,"context_line":"    default\u003dFalse,"},{"line_number":30,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":31,"context_line":"Encrypt credentials before storing them in the backend. Once enabled, newly"}],"source_content_type":"text/x-python","patch_set":6,"id":"3ac371cc_e5d6bb4d","line":28,"in_reply_to":"3ac371cc_87d0af20","updated":"2016-08-17 21:21:50.000000000","message":"I completely agree, but I\u0027m having a hard time visualizing a rolling upgrade process without this option.\n\nLet\u0027s say we have a deployment of Mitaka nodes that have credentials persisted as plaintext strings (just like today). As a deployer I\u0027m going to attempt a rolling upgrade. I take one keystone node out of rotation and upgrade it to Newton and I perform a `keystone-manage credential_migrate`. My Newton node should be able to handle all the migrated credentials without issue. But what about the Mitaka nodes? I believe they would be returning ciphertext as the credential blobs. Having this options gets around that by ensuring all nodes are updated to Newton before `[credential] encrypt` is set to true.\n\nEven if we make this feature dependent on rolling upgrades and introduce triggers to copy data back and forth to the new column, we can still run into issues where a credential is created on a Newton node and an update on Mitaka will copy plaintext values to places that expect ciphertext. Making the encryption pieces work in the triggers would be pretty tough.\n\nIf we don\u0027t have a requirement for uptime, then we can remove this option. The upgrade would look like:\n\n - take down all keystone nodes\n - upgrade all nodes to Newton code\n - encrypt all existing plaintext credentials using \u0027keystone-manage credential_migrate\u0027\n - restart all keystone nodes","commit_id":"69b40f68051bdb7d1aab5bc3a1f3a1c992b54d73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4f7328ca60efbddff129e6dbfde2e15d5fd63526","unresolved":false,"context_lines":[{"line_number":25,"context_line":"\"\"\"))"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"encrypt \u003d cfg.BoolOpt("},{"line_number":28,"context_line":"    \u0027encrypt\u0027,"},{"line_number":29,"context_line":"    default\u003dFalse,"},{"line_number":30,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":31,"context_line":"Encrypt credentials before storing them in the backend. Once enabled, newly"}],"source_content_type":"text/x-python","patch_set":6,"id":"3ac371cc_818d02d5","line":28,"in_reply_to":"3ac371cc_e5d6bb4d","updated":"2016-08-18 14:54:31.000000000","message":"Done","commit_id":"69b40f68051bdb7d1aab5bc3a1f3a1c992b54d73"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"428cb385227cbd0028acbe9d06f25929abfdca72","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"encrypt \u003d cfg.BoolOpt("},{"line_number":28,"context_line":"    \u0027encrypt\u0027,"},{"line_number":29,"context_line":"    default\u003dFalse,"},{"line_number":30,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":31,"context_line":"Encrypt credentials before storing them in the backend. Once enabled, newly"},{"line_number":32,"context_line":"created or updated credentials will be encrypted before being persisted. To"}],"source_content_type":"text/x-python","patch_set":6,"id":"3ac371cc_a79a0b6c","line":29,"range":{"start_line":29,"start_character":4,"end_line":29,"end_character":17},"updated":"2016-08-17 19:42:22.000000000","message":"As per the above idea, could this at least have True as default?","commit_id":"69b40f68051bdb7d1aab5bc3a1f3a1c992b54d73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4f7328ca60efbddff129e6dbfde2e15d5fd63526","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"encrypt \u003d cfg.BoolOpt("},{"line_number":28,"context_line":"    \u0027encrypt\u0027,"},{"line_number":29,"context_line":"    default\u003dFalse,"},{"line_number":30,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":31,"context_line":"Encrypt credentials before storing them in the backend. Once enabled, newly"},{"line_number":32,"context_line":"created or updated credentials will be encrypted before being persisted. To"}],"source_content_type":"text/x-python","patch_set":6,"id":"3ac371cc_a192bef3","line":29,"in_reply_to":"3ac371cc_a79a0b6c","updated":"2016-08-18 14:54:31.000000000","message":"Done","commit_id":"69b40f68051bdb7d1aab5bc3a1f3a1c992b54d73"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"56660aa60cfe374c757fd32ae39adce4c3e1f148","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Encrypt credentials before storing them in the backend. Once enabled, newly"},{"line_number":32,"context_line":"created or updated credentials will be encrypted before being persisted. To"},{"line_number":33,"context_line":"manually migrate existing credentials, please use the `keystone-manage"},{"line_number":34,"context_line":"credential_migrate` command after setting this option to `True`."},{"line_number":35,"context_line":"\"\"\"))"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"provider \u003d cfg.StrOpt("}],"source_content_type":"text/x-python","patch_set":6,"id":"3ac371cc_71f8d1c3","line":34,"updated":"2016-08-17 18:47:52.000000000","message":"`True` is a Python representation of a boolean value. keystone.conf is in INI format, so the value would be just be `true` there (although oslo.config is case insensitive on the issue).","commit_id":"69b40f68051bdb7d1aab5bc3a1f3a1c992b54d73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4f7328ca60efbddff129e6dbfde2e15d5fd63526","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Encrypt credentials before storing them in the backend. Once enabled, newly"},{"line_number":32,"context_line":"created or updated credentials will be encrypted before being persisted. To"},{"line_number":33,"context_line":"manually migrate existing credentials, please use the `keystone-manage"},{"line_number":34,"context_line":"credential_migrate` command after setting this option to `True`."},{"line_number":35,"context_line":"\"\"\"))"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"provider \u003d cfg.StrOpt("}],"source_content_type":"text/x-python","patch_set":6,"id":"3ac371cc_41002a34","line":34,"in_reply_to":"3ac371cc_71f8d1c3","updated":"2016-08-18 14:54:31.000000000","message":"Done","commit_id":"69b40f68051bdb7d1aab5bc3a1f3a1c992b54d73"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"56660aa60cfe374c757fd32ae39adce4c3e1f148","unresolved":false,"context_lines":[{"line_number":42,"context_line":"`keystone.credential.provider` namespace. Keystone only provides a `fernet`"},{"line_number":43,"context_line":"driver, so there\u0027s no reason to change this unless you are providing a custom"},{"line_number":44,"context_line":"entry point to encrypt and decrypt credentials. This option doesn\u0027t take effect"},{"line_number":45,"context_line":"unless you have `[credential] encrypt` set to `True`."},{"line_number":46,"context_line":"\"\"\"))"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"key_repository \u003d cfg.StrOpt("}],"source_content_type":"text/x-python","patch_set":6,"id":"3ac371cc_7139f1d6","line":45,"updated":"2016-08-17 18:47:52.000000000","message":"Note: if you remove the \u0027encrypt\u0027 option, then this last sentence would be dropped.","commit_id":"69b40f68051bdb7d1aab5bc3a1f3a1c992b54d73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4f7328ca60efbddff129e6dbfde2e15d5fd63526","unresolved":false,"context_lines":[{"line_number":42,"context_line":"`keystone.credential.provider` namespace. Keystone only provides a `fernet`"},{"line_number":43,"context_line":"driver, so there\u0027s no reason to change this unless you are providing a custom"},{"line_number":44,"context_line":"entry point to encrypt and decrypt credentials. This option doesn\u0027t take effect"},{"line_number":45,"context_line":"unless you have `[credential] encrypt` set to `True`."},{"line_number":46,"context_line":"\"\"\"))"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"key_repository \u003d cfg.StrOpt("}],"source_content_type":"text/x-python","patch_set":6,"id":"3ac371cc_61056644","line":45,"in_reply_to":"3ac371cc_7139f1d6","updated":"2016-08-18 14:54:31.000000000","message":"Done","commit_id":"69b40f68051bdb7d1aab5bc3a1f3a1c992b54d73"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"56660aa60cfe374c757fd32ae39adce4c3e1f148","unresolved":false,"context_lines":[{"line_number":49,"context_line":"    \u0027key_repository\u0027,"},{"line_number":50,"context_line":"    default\u003d\u0027/etc/keystone/credential-keys/\u0027,"},{"line_number":51,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":52,"context_line":"Directory containing Fernet keys used to encrypt credentials stored on disk."},{"line_number":53,"context_line":"Fernet keys used to encrypt credentials have no relationship to Fernet keys"},{"line_number":54,"context_line":"used to encrypt Fernet tokens. Both sets of keys are managed separately and"},{"line_number":55,"context_line":"require different rotation policies. Do not share this repository with the"}],"source_content_type":"text/x-python","patch_set":6,"id":"3ac371cc_f17a0187","line":52,"updated":"2016-08-17 18:47:52.000000000","message":"to encrypt credentials stored in the credential backend","commit_id":"69b40f68051bdb7d1aab5bc3a1f3a1c992b54d73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4f7328ca60efbddff129e6dbfde2e15d5fd63526","unresolved":false,"context_lines":[{"line_number":49,"context_line":"    \u0027key_repository\u0027,"},{"line_number":50,"context_line":"    default\u003d\u0027/etc/keystone/credential-keys/\u0027,"},{"line_number":51,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":52,"context_line":"Directory containing Fernet keys used to encrypt credentials stored on disk."},{"line_number":53,"context_line":"Fernet keys used to encrypt credentials have no relationship to Fernet keys"},{"line_number":54,"context_line":"used to encrypt Fernet tokens. Both sets of keys are managed separately and"},{"line_number":55,"context_line":"require different rotation policies. Do not share this repository with the"}],"source_content_type":"text/x-python","patch_set":6,"id":"3ac371cc_a1fbde45","line":52,"in_reply_to":"3ac371cc_f17a0187","updated":"2016-08-18 14:54:31.000000000","message":"Done","commit_id":"69b40f68051bdb7d1aab5bc3a1f3a1c992b54d73"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"56660aa60cfe374c757fd32ae39adce4c3e1f148","unresolved":false,"context_lines":[{"line_number":54,"context_line":"used to encrypt Fernet tokens. Both sets of keys are managed separately and"},{"line_number":55,"context_line":"require different rotation policies. Do not share this repository with the"},{"line_number":56,"context_line":"repository used to manage keys for Fernet tokens. This option doesn\u0027t take"},{"line_number":57,"context_line":"effect unless `[credential] encrypt` is set to `True`."},{"line_number":58,"context_line":"\"\"\"))"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"3ac371cc_f1532115","line":57,"updated":"2016-08-17 18:47:52.000000000","message":"Note: if you remove the \u0027encrypt\u0027 option, then this last sentence would be dropped.","commit_id":"69b40f68051bdb7d1aab5bc3a1f3a1c992b54d73"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4f7328ca60efbddff129e6dbfde2e15d5fd63526","unresolved":false,"context_lines":[{"line_number":54,"context_line":"used to encrypt Fernet tokens. Both sets of keys are managed separately and"},{"line_number":55,"context_line":"require different rotation policies. Do not share this repository with the"},{"line_number":56,"context_line":"repository used to manage keys for Fernet tokens. This option doesn\u0027t take"},{"line_number":57,"context_line":"effect unless `[credential] encrypt` is set to `True`."},{"line_number":58,"context_line":"\"\"\"))"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"3ac371cc_81f6a25a","line":57,"in_reply_to":"3ac371cc_f1532115","updated":"2016-08-18 14:54:31.000000000","message":"Done","commit_id":"69b40f68051bdb7d1aab5bc3a1f3a1c992b54d73"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ea819741a1b150a6450a07c9783e832c9a467d44","unresolved":false,"context_lines":[{"line_number":43,"context_line":"relationship to Fernet keys used to encrypt Fernet tokens. Both sets of keys"},{"line_number":44,"context_line":"should be managed separately and require different rotation policies. Do not"},{"line_number":45,"context_line":"share this repository with the repository used to manage keys for Fernet"},{"line_number":46,"context_line":"tokens."},{"line_number":47,"context_line":"\"\"\"))"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"3ac371cc_9fac248e","line":46,"updated":"2016-08-18 20:42:30.000000000","message":"This would be a great doctor check -- make sure the two config values are not equal!","commit_id":"bd80bb77e930e0fb2679767ef0d8b59bd209f4d1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d9d5db3b245baa2be5807d9d94009671f3a8ff7f","unresolved":false,"context_lines":[{"line_number":43,"context_line":"relationship to Fernet keys used to encrypt Fernet tokens. Both sets of keys"},{"line_number":44,"context_line":"should be managed separately and require different rotation policies. Do not"},{"line_number":45,"context_line":"share this repository with the repository used to manage keys for Fernet"},{"line_number":46,"context_line":"tokens."},{"line_number":47,"context_line":"\"\"\"))"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"1ac06dbe_10f3ee9f","line":46,"in_reply_to":"3ac371cc_9fac248e","updated":"2016-08-19 19:28:29.000000000","message":"Good call - done. \n\nhttps://review.openstack.org/#/c/358083/","commit_id":"bd80bb77e930e0fb2679767ef0d8b59bd209f4d1"}]}