)]}'
{"doc/source/credential-encryption.rst":[{"author":{"_account_id":19985,"name":"Ryosuke Mizuno","email":"r-mizuno@rs.jp.nec.com","username":"r-mizuno"},"change_message_id":"871e5c1392651ca467e7ca9c15ba49779f6d5487","unresolved":false,"context_lines":[{"line_number":69,"context_line":"the new ``blob`` and update the key hash."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"When listing or showing credentials, all ``blob`` attributes are decrypted in"},{"line_number":72,"context_line":"the response. Niether the ciphertext, nor the hash of the key used to encrypt"},{"line_number":73,"context_line":"the ``blob`` are exposed through the API. Furthermore, the key has is only used"},{"line_number":74,"context_line":"internally to keystone."},{"line_number":75,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ac06dbe_0f56f15b","line":72,"range":{"start_line":72,"start_character":14,"end_line":72,"end_character":21},"updated":"2016-08-22 10:40:09.000000000","message":"Neither","commit_id":"cfd43db8b9cc27d34f02effe71d13346e882fc70"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a851141ed2b20a735b909e819920a8807dbcc27d","unresolved":false,"context_lines":[{"line_number":69,"context_line":"the new ``blob`` and update the key hash."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"When listing or showing credentials, all ``blob`` attributes are decrypted in"},{"line_number":72,"context_line":"the response. Niether the ciphertext, nor the hash of the key used to encrypt"},{"line_number":73,"context_line":"the ``blob`` are exposed through the API. Furthermore, the key has is only used"},{"line_number":74,"context_line":"internally to keystone."},{"line_number":75,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ac06dbe_cc833a03","line":72,"in_reply_to":"1ac06dbe_0f56f15b","updated":"2016-08-22 13:19:41.000000000","message":"Ah - good catch. Will fix.","commit_id":"cfd43db8b9cc27d34f02effe71d13346e882fc70"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"1b44e30c9e11e3d876d9decb08d027cff03dde30","unresolved":false,"context_lines":[{"line_number":41,"context_line":"a custom credential encryption implementation. The ``[credential]"},{"line_number":42,"context_line":"key_repository`` location is a requirement of using ``fernet`` but will default"},{"line_number":43,"context_line":"to the ``/etc/keystone/credential-keys/`` directory. Is it recommended that"},{"line_number":44,"context_line":"this location be changed to fit the needs of your deployment.  The purpose of"},{"line_number":45,"context_line":"the ``[credential] key_repository`` is the same as ``[fernet_tokens]"},{"line_number":46,"context_line":"key_repository``. One holds keys to encrypt and decrypt tokens and the other"},{"line_number":47,"context_line":"holds keys to encrypt and decrypt credentials. These repositories should be"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ac06dbe_d45e0f11","line":44,"range":{"start_line":44,"start_character":62,"end_line":44,"end_character":63},"updated":"2016-08-22 17:22:47.000000000","message":"Nit: Extra space here","commit_id":"de35b22e3f02f1355c63836fd22b83541552f23a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d4245e559a450dad0ec9b951b2bebb370d5cb0d3","unresolved":false,"context_lines":[{"line_number":41,"context_line":"a custom credential encryption implementation. The ``[credential]"},{"line_number":42,"context_line":"key_repository`` location is a requirement of using ``fernet`` but will default"},{"line_number":43,"context_line":"to the ``/etc/keystone/credential-keys/`` directory. Is it recommended that"},{"line_number":44,"context_line":"this location be changed to fit the needs of your deployment.  The purpose of"},{"line_number":45,"context_line":"the ``[credential] key_repository`` is the same as ``[fernet_tokens]"},{"line_number":46,"context_line":"key_repository``. One holds keys to encrypt and decrypt tokens and the other"},{"line_number":47,"context_line":"holds keys to encrypt and decrypt credentials. These repositories should be"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa7ab95a_2092b8f6","line":44,"in_reply_to":"1ac06dbe_d45e0f11","updated":"2016-08-29 14:18:42.000000000","message":"Done","commit_id":"de35b22e3f02f1355c63836fd22b83541552f23a"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"1b44e30c9e11e3d876d9decb08d027cff03dde30","unresolved":false,"context_lines":[{"line_number":46,"context_line":"key_repository``. One holds keys to encrypt and decrypt tokens and the other"},{"line_number":47,"context_line":"holds keys to encrypt and decrypt credentials. These repositories should be"},{"line_number":48,"context_line":"managed separately and should not share keys. ``[credential] key_repository``"},{"line_number":49,"context_line":"will have a fixed number of keys available, three. This is not configurable and"},{"line_number":50,"context_line":"allows for credentials to be re-keyed periodically with a new encryption key"},{"line_number":51,"context_line":"for the sake of security."},{"line_number":52,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ac06dbe_f4aeab83","line":49,"range":{"start_line":49,"start_character":12,"end_line":49,"end_character":50},"updated":"2016-08-22 17:22:47.000000000","message":"This looks a bit odd to me, maybe change the comma to colon and the word to a number?  \"fixed number of keys available: 3\"","commit_id":"de35b22e3f02f1355c63836fd22b83541552f23a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d4245e559a450dad0ec9b951b2bebb370d5cb0d3","unresolved":false,"context_lines":[{"line_number":46,"context_line":"key_repository``. One holds keys to encrypt and decrypt tokens and the other"},{"line_number":47,"context_line":"holds keys to encrypt and decrypt credentials. These repositories should be"},{"line_number":48,"context_line":"managed separately and should not share keys. ``[credential] key_repository``"},{"line_number":49,"context_line":"will have a fixed number of keys available, three. This is not configurable and"},{"line_number":50,"context_line":"allows for credentials to be re-keyed periodically with a new encryption key"},{"line_number":51,"context_line":"for the sake of security."},{"line_number":52,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa7ab95a_40541c20","line":49,"in_reply_to":"1ac06dbe_f4aeab83","updated":"2016-08-29 14:18:42.000000000","message":"Done","commit_id":"de35b22e3f02f1355c63836fd22b83541552f23a"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"1b44e30c9e11e3d876d9decb08d027cff03dde30","unresolved":false,"context_lines":[{"line_number":95,"context_line":"Note that a limited service outage will take affect during this migration. A"},{"line_number":96,"context_line":"``[credential] key_repository`` location must be specified through"},{"line_number":97,"context_line":"configuration and bootstrapped with keys using ``keystone-manage"},{"line_number":98,"context_line":"credential_setup`` prior to migrating any existing credentials.  Credentials"},{"line_number":99,"context_line":"will still be readable but no writes will be possible during the migration."},{"line_number":100,"context_line":"Once the schema has been contracted, it will be possible to create and update"},{"line_number":101,"context_line":"credentials and all existing credentials should be encrypted."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ac06dbe_943bf737","line":98,"range":{"start_line":98,"start_character":64,"end_line":98,"end_character":65},"updated":"2016-08-22 17:22:47.000000000","message":"ditto :)","commit_id":"de35b22e3f02f1355c63836fd22b83541552f23a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d4245e559a450dad0ec9b951b2bebb370d5cb0d3","unresolved":false,"context_lines":[{"line_number":95,"context_line":"Note that a limited service outage will take affect during this migration. A"},{"line_number":96,"context_line":"``[credential] key_repository`` location must be specified through"},{"line_number":97,"context_line":"configuration and bootstrapped with keys using ``keystone-manage"},{"line_number":98,"context_line":"credential_setup`` prior to migrating any existing credentials.  Credentials"},{"line_number":99,"context_line":"will still be readable but no writes will be possible during the migration."},{"line_number":100,"context_line":"Once the schema has been contracted, it will be possible to create and update"},{"line_number":101,"context_line":"credentials and all existing credentials should be encrypted."}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa7ab95a_0025b4bf","line":98,"in_reply_to":"1ac06dbe_943bf737","updated":"2016-08-29 14:18:42.000000000","message":"Done","commit_id":"de35b22e3f02f1355c63836fd22b83541552f23a"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"1b44e30c9e11e3d876d9decb08d027cff03dde30","unresolved":false,"context_lines":[{"line_number":112,"context_line":""},{"line_number":113,"context_line":"``keystone-manage credential_setup`` will populate ``[credential]"},{"line_number":114,"context_line":"key_repository`` with new encryption keys. This must be done in order for"},{"line_number":115,"context_line":"credential encryption to work. This is step should only need to be done once."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"``keystone-manage credential_rotate`` will create and rotate a new encryption"},{"line_number":118,"context_line":"key in the ``[credential] key_repository``. This will only be done if all"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ac06dbe_3461633a","line":115,"range":{"start_line":115,"start_character":36,"end_line":115,"end_character":38},"updated":"2016-08-22 17:22:47.000000000","message":"Probably can remove \u0027is\u0027","commit_id":"de35b22e3f02f1355c63836fd22b83541552f23a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d4245e559a450dad0ec9b951b2bebb370d5cb0d3","unresolved":false,"context_lines":[{"line_number":112,"context_line":""},{"line_number":113,"context_line":"``keystone-manage credential_setup`` will populate ``[credential]"},{"line_number":114,"context_line":"key_repository`` with new encryption keys. This must be done in order for"},{"line_number":115,"context_line":"credential encryption to work. This is step should only need to be done once."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"``keystone-manage credential_rotate`` will create and rotate a new encryption"},{"line_number":118,"context_line":"key in the ``[credential] key_repository``. This will only be done if all"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa7ab95a_801f046b","line":115,"in_reply_to":"1ac06dbe_3461633a","updated":"2016-08-29 14:18:42.000000000","message":"Done","commit_id":"de35b22e3f02f1355c63836fd22b83541552f23a"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"1b44e30c9e11e3d876d9decb08d027cff03dde30","unresolved":false,"context_lines":[{"line_number":120,"context_line":"credential has been encrypted with an older key, or secondary key, the rotation"},{"line_number":121,"context_line":"will fail. Failing the rotation is necessary to prevent over-rotation, which"},{"line_number":122,"context_line":"would leave some credentials un-decipherable since the key used to encrypt it"},{"line_number":123,"context_line":"no longer exists. If this step fails it is possible to forcibly re-key all"},{"line_number":124,"context_line":"credentials using the same primary key with ``keystone-manage"},{"line_number":125,"context_line":"credential_migrate``."},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ac06dbe_b4039341","line":123,"range":{"start_line":123,"start_character":31,"end_line":123,"end_character":36},"updated":"2016-08-22 17:22:47.000000000","message":"comma after fails","commit_id":"de35b22e3f02f1355c63836fd22b83541552f23a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d4245e559a450dad0ec9b951b2bebb370d5cb0d3","unresolved":false,"context_lines":[{"line_number":120,"context_line":"credential has been encrypted with an older key, or secondary key, the rotation"},{"line_number":121,"context_line":"will fail. Failing the rotation is necessary to prevent over-rotation, which"},{"line_number":122,"context_line":"would leave some credentials un-decipherable since the key used to encrypt it"},{"line_number":123,"context_line":"no longer exists. If this step fails it is possible to forcibly re-key all"},{"line_number":124,"context_line":"credentials using the same primary key with ``keystone-manage"},{"line_number":125,"context_line":"credential_migrate``."},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa7ab95a_2333a2f7","line":123,"in_reply_to":"1ac06dbe_b4039341","updated":"2016-08-29 14:18:42.000000000","message":"Done","commit_id":"de35b22e3f02f1355c63836fd22b83541552f23a"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"16dc6eb48c08352b4717c125f34ad353d4a70282","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Configuring credential encryption"},{"line_number":28,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"The configuration for credential encryption is straight-forward. There are only"},{"line_number":31,"context_line":"two configuration options needed:"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_a9f15303","line":30,"range":{"start_line":30,"start_character":55,"end_line":30,"end_character":56},"updated":"2016-08-29 14:52:48.000000000","message":"straightforward","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"835bd33cfc3604aded2ae645bf006bf3149d14da","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Configuring credential encryption"},{"line_number":28,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"The configuration for credential encryption is straight-forward. There are only"},{"line_number":31,"context_line":"two configuration options needed:"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_0ad4eae9","line":30,"in_reply_to":"fa7ab95a_a9f15303","updated":"2016-08-29 16:08:38.000000000","message":"Done","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"16dc6eb48c08352b4717c125f34ad353d4a70282","unresolved":false,"context_lines":[{"line_number":58,"context_line":"credential backend directly."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"When creating a credential, keystone will encrypt the ``blob`` attribute before"},{"line_number":61,"context_line":"persisting it to the backend. Keystone will also store a 7 character hash of"},{"line_number":62,"context_line":"the key that was used to encrypt the information in that credential. Since"},{"line_number":63,"context_line":"Fernet is used to encrypt credentials, a key repository consists of multiple"},{"line_number":64,"context_line":"keys. Keeping track of which key was used to encrypt each credential is an"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_89800fc2","line":61,"range":{"start_line":61,"start_character":57,"end_line":61,"end_character":58},"updated":"2016-08-29 14:52:48.000000000","message":"seven","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"835bd33cfc3604aded2ae645bf006bf3149d14da","unresolved":false,"context_lines":[{"line_number":58,"context_line":"credential backend directly."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"When creating a credential, keystone will encrypt the ``blob`` attribute before"},{"line_number":61,"context_line":"persisting it to the backend. Keystone will also store a 7 character hash of"},{"line_number":62,"context_line":"the key that was used to encrypt the information in that credential. Since"},{"line_number":63,"context_line":"Fernet is used to encrypt credentials, a key repository consists of multiple"},{"line_number":64,"context_line":"keys. Keeping track of which key was used to encrypt each credential is an"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_8a063a84","line":61,"in_reply_to":"fa7ab95a_89800fc2","updated":"2016-08-29 16:08:38.000000000","message":"Done","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"16dc6eb48c08352b4717c125f34ad353d4a70282","unresolved":false,"context_lines":[{"line_number":69,"context_line":"the new ``blob`` and update the key hash."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"When listing or showing credentials, all ``blob`` attributes are decrypted in"},{"line_number":72,"context_line":"the response. Neither the ciphertext, nor the hash of the key used to encrypt"},{"line_number":73,"context_line":"the ``blob`` are exposed through the API. Furthermore, the key has is only used"},{"line_number":74,"context_line":"internally to keystone."},{"line_number":75,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_a9a95392","line":72,"range":{"start_line":72,"start_character":26,"end_line":72,"end_character":36},"updated":"2016-08-29 14:52:48.000000000","message":"cipher text","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"835bd33cfc3604aded2ae645bf006bf3149d14da","unresolved":false,"context_lines":[{"line_number":69,"context_line":"the new ``blob`` and update the key hash."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"When listing or showing credentials, all ``blob`` attributes are decrypted in"},{"line_number":72,"context_line":"the response. Neither the ciphertext, nor the hash of the key used to encrypt"},{"line_number":73,"context_line":"the ``blob`` are exposed through the API. Furthermore, the key has is only used"},{"line_number":74,"context_line":"internally to keystone."},{"line_number":75,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_6aee56b5","line":72,"in_reply_to":"fa7ab95a_a9a95392","updated":"2016-08-29 16:08:38.000000000","message":"Done","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"16dc6eb48c08352b4717c125f34ad353d4a70282","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"When listing or showing credentials, all ``blob`` attributes are decrypted in"},{"line_number":72,"context_line":"the response. Neither the ciphertext, nor the hash of the key used to encrypt"},{"line_number":73,"context_line":"the ``blob`` are exposed through the API. Furthermore, the key has is only used"},{"line_number":74,"context_line":"internally to keystone."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Encrypting existing credentials"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_09a31f9e","line":73,"range":{"start_line":73,"start_character":63,"end_line":73,"end_character":66},"updated":"2016-08-29 14:52:48.000000000","message":"remove has","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"835bd33cfc3604aded2ae645bf006bf3149d14da","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"When listing or showing credentials, all ``blob`` attributes are decrypted in"},{"line_number":72,"context_line":"the response. Neither the ciphertext, nor the hash of the key used to encrypt"},{"line_number":73,"context_line":"the ``blob`` are exposed through the API. Furthermore, the key has is only used"},{"line_number":74,"context_line":"internally to keystone."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Encrypting existing credentials"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_ca33e260","line":73,"in_reply_to":"fa7ab95a_09a31f9e","updated":"2016-08-29 16:08:38.000000000","message":"Done","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"16dc6eb48c08352b4717c125f34ad353d4a70282","unresolved":false,"context_lines":[{"line_number":76,"context_line":"Encrypting existing credentials"},{"line_number":77,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"The encryption of existing plaintext credentials is done using the rolling"},{"line_number":80,"context_line":"upgrade process. When upgrading a Mitaka deployment to Newton, three database"},{"line_number":81,"context_line":"migrations will ensure all credentials are encrypted. The process is as"},{"line_number":82,"context_line":"follows:"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_29c38339","line":79,"range":{"start_line":79,"start_character":27,"end_line":79,"end_character":36},"updated":"2016-08-29 14:52:48.000000000","message":"plain text","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"835bd33cfc3604aded2ae645bf006bf3149d14da","unresolved":false,"context_lines":[{"line_number":76,"context_line":"Encrypting existing credentials"},{"line_number":77,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"The encryption of existing plaintext credentials is done using the rolling"},{"line_number":80,"context_line":"upgrade process. When upgrading a Mitaka deployment to Newton, three database"},{"line_number":81,"context_line":"migrations will ensure all credentials are encrypted. The process is as"},{"line_number":82,"context_line":"follows:"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_ca0a0279","line":79,"in_reply_to":"fa7ab95a_29c38339","updated":"2016-08-29 16:08:38.000000000","message":"Done","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"16dc6eb48c08352b4717c125f34ad353d4a70282","unresolved":false,"context_lines":[{"line_number":81,"context_line":"migrations will ensure all credentials are encrypted. The process is as"},{"line_number":82,"context_line":"follows:"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"1. An additive schema change is made to create new ``encrypted_blob`` and"},{"line_number":85,"context_line":"   ``key_hash`` columns in the existing ``credential`` table using"},{"line_number":86,"context_line":"   ``keystone-manage db_sync --expand``."},{"line_number":87,"context_line":"2. A data migration will loop through all existing credentials, encrypt each"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_a958738b","line":84,"range":{"start_line":84,"start_character":47,"end_line":84,"end_character":50},"updated":"2016-08-29 14:52:48.000000000","message":"the new","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"835bd33cfc3604aded2ae645bf006bf3149d14da","unresolved":false,"context_lines":[{"line_number":81,"context_line":"migrations will ensure all credentials are encrypted. The process is as"},{"line_number":82,"context_line":"follows:"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"1. An additive schema change is made to create new ``encrypted_blob`` and"},{"line_number":85,"context_line":"   ``key_hash`` columns in the existing ``credential`` table using"},{"line_number":86,"context_line":"   ``keystone-manage db_sync --expand``."},{"line_number":87,"context_line":"2. A data migration will loop through all existing credentials, encrypt each"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_0a706a0a","line":84,"in_reply_to":"fa7ab95a_a958738b","updated":"2016-08-29 16:08:38.000000000","message":"Done","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"16dc6eb48c08352b4717c125f34ad353d4a70282","unresolved":false,"context_lines":[{"line_number":88,"context_line":"   ``blob`` and store the result in the new ``encrypted_blob`` column. The hash"},{"line_number":89,"context_line":"   of the key used is also written to the ``key_hash`` column for that specific"},{"line_number":90,"context_line":"   credential. This step is done using ``keystone-manage db_sync --migrate``."},{"line_number":91,"context_line":"3. A contractive schema will remove the ``blob`` column that held the plaintext"},{"line_number":92,"context_line":"   representations of the credential using ``keystone-manage db_sync"},{"line_number":93,"context_line":"   --contract``."},{"line_number":94,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_09db1fed","line":91,"range":{"start_line":91,"start_character":70,"end_line":91,"end_character":79},"updated":"2016-08-29 14:52:48.000000000","message":"plain text","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"835bd33cfc3604aded2ae645bf006bf3149d14da","unresolved":false,"context_lines":[{"line_number":88,"context_line":"   ``blob`` and store the result in the new ``encrypted_blob`` column. The hash"},{"line_number":89,"context_line":"   of the key used is also written to the ``key_hash`` column for that specific"},{"line_number":90,"context_line":"   credential. This step is done using ``keystone-manage db_sync --migrate``."},{"line_number":91,"context_line":"3. A contractive schema will remove the ``blob`` column that held the plaintext"},{"line_number":92,"context_line":"   representations of the credential using ``keystone-manage db_sync"},{"line_number":93,"context_line":"   --contract``."},{"line_number":94,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_0a578a58","line":91,"in_reply_to":"fa7ab95a_09db1fed","updated":"2016-08-29 16:08:38.000000000","message":"Done","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"16dc6eb48c08352b4717c125f34ad353d4a70282","unresolved":false,"context_lines":[{"line_number":112,"context_line":""},{"line_number":113,"context_line":"``keystone-manage credential_setup`` will populate ``[credential]"},{"line_number":114,"context_line":"key_repository`` with new encryption keys. This must be done in order for"},{"line_number":115,"context_line":"credential encryption to work. This step should only need to be done once."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"``keystone-manage credential_rotate`` will create and rotate a new encryption"},{"line_number":118,"context_line":"key in the ``[credential] key_repository``. This will only be done if all"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_498fe7cb","line":115,"range":{"start_line":115,"start_character":31,"end_line":115,"end_character":72},"updated":"2016-08-29 14:52:48.000000000","message":"This step should only be done once.","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"835bd33cfc3604aded2ae645bf006bf3149d14da","unresolved":false,"context_lines":[{"line_number":112,"context_line":""},{"line_number":113,"context_line":"``keystone-manage credential_setup`` will populate ``[credential]"},{"line_number":114,"context_line":"key_repository`` with new encryption keys. This must be done in order for"},{"line_number":115,"context_line":"credential encryption to work. This step should only need to be done once."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"``keystone-manage credential_rotate`` will create and rotate a new encryption"},{"line_number":118,"context_line":"key in the ``[credential] key_repository``. This will only be done if all"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_aace9e2b","line":115,"in_reply_to":"fa7ab95a_498fe7cb","updated":"2016-08-29 16:08:38.000000000","message":"Done","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"16dc6eb48c08352b4717c125f34ad353d4a70282","unresolved":false,"context_lines":[{"line_number":118,"context_line":"key in the ``[credential] key_repository``. This will only be done if all"},{"line_number":119,"context_line":"credential key hashes match the hash of the current primary key. If any"},{"line_number":120,"context_line":"credential has been encrypted with an older key, or secondary key, the rotation"},{"line_number":121,"context_line":"will fail. Failing the rotation is necessary to prevent over-rotation, which"},{"line_number":122,"context_line":"would leave some credentials un-decipherable since the key used to encrypt it"},{"line_number":123,"context_line":"no longer exists. If this step fails, it is possible to forcibly re-key all"},{"line_number":124,"context_line":"credentials using the same primary key with ``keystone-manage"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_497d27b0","line":121,"range":{"start_line":121,"start_character":56,"end_line":121,"end_character":69},"updated":"2016-08-29 14:52:48.000000000","message":"overrotation","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"835bd33cfc3604aded2ae645bf006bf3149d14da","unresolved":false,"context_lines":[{"line_number":118,"context_line":"key in the ``[credential] key_repository``. This will only be done if all"},{"line_number":119,"context_line":"credential key hashes match the hash of the current primary key. If any"},{"line_number":120,"context_line":"credential has been encrypted with an older key, or secondary key, the rotation"},{"line_number":121,"context_line":"will fail. Failing the rotation is necessary to prevent over-rotation, which"},{"line_number":122,"context_line":"would leave some credentials un-decipherable since the key used to encrypt it"},{"line_number":123,"context_line":"no longer exists. If this step fails, it is possible to forcibly re-key all"},{"line_number":124,"context_line":"credentials using the same primary key with ``keystone-manage"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_0adeaadc","line":121,"in_reply_to":"fa7ab95a_497d27b0","updated":"2016-08-29 16:08:38.000000000","message":"Done","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"16dc6eb48c08352b4717c125f34ad353d4a70282","unresolved":false,"context_lines":[{"line_number":119,"context_line":"credential key hashes match the hash of the current primary key. If any"},{"line_number":120,"context_line":"credential has been encrypted with an older key, or secondary key, the rotation"},{"line_number":121,"context_line":"will fail. Failing the rotation is necessary to prevent over-rotation, which"},{"line_number":122,"context_line":"would leave some credentials un-decipherable since the key used to encrypt it"},{"line_number":123,"context_line":"no longer exists. If this step fails, it is possible to forcibly re-key all"},{"line_number":124,"context_line":"credentials using the same primary key with ``keystone-manage"},{"line_number":125,"context_line":"credential_migrate``."}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_a9423366","line":122,"range":{"start_line":122,"start_character":29,"end_line":122,"end_character":44},"updated":"2016-08-29 14:52:48.000000000","message":"indecipherable","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"835bd33cfc3604aded2ae645bf006bf3149d14da","unresolved":false,"context_lines":[{"line_number":119,"context_line":"credential key hashes match the hash of the current primary key. If any"},{"line_number":120,"context_line":"credential has been encrypted with an older key, or secondary key, the rotation"},{"line_number":121,"context_line":"will fail. Failing the rotation is necessary to prevent over-rotation, which"},{"line_number":122,"context_line":"would leave some credentials un-decipherable since the key used to encrypt it"},{"line_number":123,"context_line":"no longer exists. If this step fails, it is possible to forcibly re-key all"},{"line_number":124,"context_line":"credentials using the same primary key with ``keystone-manage"},{"line_number":125,"context_line":"credential_migrate``."}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_2adb6eed","line":122,"in_reply_to":"fa7ab95a_a9423366","updated":"2016-08-29 16:08:38.000000000","message":"Done","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"16dc6eb48c08352b4717c125f34ad353d4a70282","unresolved":false,"context_lines":[{"line_number":127,"context_line":"``keystone-manage credential_migrate`` will check the backend for credentials"},{"line_number":128,"context_line":"whose key hash doesn\u0027t match the hash of the current primary key. Any"},{"line_number":129,"context_line":"credentials with a key hash mismatching the current primary key will be"},{"line_number":130,"context_line":"re-encrypted with the current primary key. The new ciphertext and key hash will"},{"line_number":131,"context_line":"be updated in the backend."}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_6933cb14","line":130,"range":{"start_line":130,"start_character":51,"end_line":130,"end_character":61},"updated":"2016-08-29 14:52:48.000000000","message":"cipher text","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"835bd33cfc3604aded2ae645bf006bf3149d14da","unresolved":false,"context_lines":[{"line_number":127,"context_line":"``keystone-manage credential_migrate`` will check the backend for credentials"},{"line_number":128,"context_line":"whose key hash doesn\u0027t match the hash of the current primary key. Any"},{"line_number":129,"context_line":"credentials with a key hash mismatching the current primary key will be"},{"line_number":130,"context_line":"re-encrypted with the current primary key. The new ciphertext and key hash will"},{"line_number":131,"context_line":"be updated in the backend."}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa7ab95a_8af0fa68","line":130,"in_reply_to":"fa7ab95a_6933cb14","updated":"2016-08-29 16:08:38.000000000","message":"Done","commit_id":"3255b6e215a62768589ecac6766bbf3f80bb4f5c"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d72de0013634965602b037de6900a5d747bcb4ad","unresolved":false,"context_lines":[{"line_number":24,"context_line":"This document details how credential encryption works, how to migrate existing"},{"line_number":25,"context_line":"credentials in a deployment, and how to manage encryption keys for credentials."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Configuring credential encryption"},{"line_number":28,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"The configuration for credential encryption is straightforward. There are only"}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa7ab95a_9491549d","line":27,"updated":"2016-08-31 20:49:35.000000000","message":"Sounds like it belongs in configuring.rst - but that can be a later refactor :)","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0596aa46616d25d0942f4c63cfc0abf586bd5e3e","unresolved":false,"context_lines":[{"line_number":24,"context_line":"This document details how credential encryption works, how to migrate existing"},{"line_number":25,"context_line":"credentials in a deployment, and how to manage encryption keys for credentials."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Configuring credential encryption"},{"line_number":28,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"The configuration for credential encryption is straightforward. There are only"}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa7ab95a_af4b6158","line":27,"in_reply_to":"fa7ab95a_9491549d","updated":"2016-08-31 21:17:09.000000000","message":"Done","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d72de0013634965602b037de6900a5d747bcb4ad","unresolved":false,"context_lines":[{"line_number":41,"context_line":"a custom credential encryption implementation. The ``[credential]"},{"line_number":42,"context_line":"key_repository`` location is a requirement of using ``fernet`` but will default"},{"line_number":43,"context_line":"to the ``/etc/keystone/credential-keys/`` directory. Is it recommended that"},{"line_number":44,"context_line":"this location be changed to fit the needs of your deployment. The purpose of"},{"line_number":45,"context_line":"the ``[credential] key_repository`` is the same as ``[fernet_tokens]"},{"line_number":46,"context_line":"key_repository``. One holds keys to encrypt and decrypt tokens and the other"},{"line_number":47,"context_line":"holds keys to encrypt and decrypt credentials. These repositories should be"}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa7ab95a_d4e2fc2e","line":44,"updated":"2016-08-31 20:49:35.000000000","message":"I\u0027d take out this sentence unless you can suggest why someone would have needs that would require it to be changed.","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0596aa46616d25d0942f4c63cfc0abf586bd5e3e","unresolved":false,"context_lines":[{"line_number":41,"context_line":"a custom credential encryption implementation. The ``[credential]"},{"line_number":42,"context_line":"key_repository`` location is a requirement of using ``fernet`` but will default"},{"line_number":43,"context_line":"to the ``/etc/keystone/credential-keys/`` directory. Is it recommended that"},{"line_number":44,"context_line":"this location be changed to fit the needs of your deployment. The purpose of"},{"line_number":45,"context_line":"the ``[credential] key_repository`` is the same as ``[fernet_tokens]"},{"line_number":46,"context_line":"key_repository``. One holds keys to encrypt and decrypt tokens and the other"},{"line_number":47,"context_line":"holds keys to encrypt and decrypt credentials. These repositories should be"}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa7ab95a_0fd60d27","line":44,"in_reply_to":"fa7ab95a_d4e2fc2e","updated":"2016-08-31 21:17:09.000000000","message":"Done","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d72de0013634965602b037de6900a5d747bcb4ad","unresolved":false,"context_lines":[{"line_number":44,"context_line":"this location be changed to fit the needs of your deployment. The purpose of"},{"line_number":45,"context_line":"the ``[credential] key_repository`` is the same as ``[fernet_tokens]"},{"line_number":46,"context_line":"key_repository``. One holds keys to encrypt and decrypt tokens and the other"},{"line_number":47,"context_line":"holds keys to encrypt and decrypt credentials. These repositories should be"},{"line_number":48,"context_line":"managed separately and should not share keys. ``[credential] key_repository``"},{"line_number":49,"context_line":"will have a fixed number of keys available: 3. This is not configurable and"},{"line_number":50,"context_line":"allows for credentials to be re-keyed periodically with a new encryption key"}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa7ab95a_34ca48a2","line":47,"updated":"2016-08-31 20:49:35.000000000","message":"You just said they\u0027re the same purpose and then defined them as being pretty different :)","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0596aa46616d25d0942f4c63cfc0abf586bd5e3e","unresolved":false,"context_lines":[{"line_number":44,"context_line":"this location be changed to fit the needs of your deployment. The purpose of"},{"line_number":45,"context_line":"the ``[credential] key_repository`` is the same as ``[fernet_tokens]"},{"line_number":46,"context_line":"key_repository``. One holds keys to encrypt and decrypt tokens and the other"},{"line_number":47,"context_line":"holds keys to encrypt and decrypt credentials. These repositories should be"},{"line_number":48,"context_line":"managed separately and should not share keys. ``[credential] key_repository``"},{"line_number":49,"context_line":"will have a fixed number of keys available: 3. This is not configurable and"},{"line_number":50,"context_line":"allows for credentials to be re-keyed periodically with a new encryption key"}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa7ab95a_cfec25f6","line":47,"in_reply_to":"fa7ab95a_34ca48a2","updated":"2016-08-31 21:17:09.000000000","message":"Cleaning up and made this all more explicit.","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d72de0013634965602b037de6900a5d747bcb4ad","unresolved":false,"context_lines":[{"line_number":45,"context_line":"the ``[credential] key_repository`` is the same as ``[fernet_tokens]"},{"line_number":46,"context_line":"key_repository``. One holds keys to encrypt and decrypt tokens and the other"},{"line_number":47,"context_line":"holds keys to encrypt and decrypt credentials. These repositories should be"},{"line_number":48,"context_line":"managed separately and should not share keys. ``[credential] key_repository``"},{"line_number":49,"context_line":"will have a fixed number of keys available: 3. This is not configurable and"},{"line_number":50,"context_line":"allows for credentials to be re-keyed periodically with a new encryption key"},{"line_number":51,"context_line":"for the sake of security."}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa7ab95a_d4b91c17","line":48,"updated":"2016-08-31 20:49:35.000000000","message":"this is implicit based on what you wrote, but they should also not be the same directory path","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0596aa46616d25d0942f4c63cfc0abf586bd5e3e","unresolved":false,"context_lines":[{"line_number":45,"context_line":"the ``[credential] key_repository`` is the same as ``[fernet_tokens]"},{"line_number":46,"context_line":"key_repository``. One holds keys to encrypt and decrypt tokens and the other"},{"line_number":47,"context_line":"holds keys to encrypt and decrypt credentials. These repositories should be"},{"line_number":48,"context_line":"managed separately and should not share keys. ``[credential] key_repository``"},{"line_number":49,"context_line":"will have a fixed number of keys available: 3. This is not configurable and"},{"line_number":50,"context_line":"allows for credentials to be re-keyed periodically with a new encryption key"},{"line_number":51,"context_line":"for the sake of security."}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa7ab95a_8f905d50","line":48,"in_reply_to":"fa7ab95a_d4b91c17","updated":"2016-08-31 21:17:09.000000000","message":"Done","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d72de0013634965602b037de6900a5d747bcb4ad","unresolved":false,"context_lines":[{"line_number":46,"context_line":"key_repository``. One holds keys to encrypt and decrypt tokens and the other"},{"line_number":47,"context_line":"holds keys to encrypt and decrypt credentials. These repositories should be"},{"line_number":48,"context_line":"managed separately and should not share keys. ``[credential] key_repository``"},{"line_number":49,"context_line":"will have a fixed number of keys available: 3. This is not configurable and"},{"line_number":50,"context_line":"allows for credentials to be re-keyed periodically with a new encryption key"},{"line_number":51,"context_line":"for the sake of security."},{"line_number":52,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa7ab95a_1408e4d8","line":49,"updated":"2016-08-31 20:49:35.000000000","message":"the colon is unnecessary and sort of confusing to read in paragraph form - write out \"three\" and put it into the sentence.","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0596aa46616d25d0942f4c63cfc0abf586bd5e3e","unresolved":false,"context_lines":[{"line_number":46,"context_line":"key_repository``. One holds keys to encrypt and decrypt tokens and the other"},{"line_number":47,"context_line":"holds keys to encrypt and decrypt credentials. These repositories should be"},{"line_number":48,"context_line":"managed separately and should not share keys. ``[credential] key_repository``"},{"line_number":49,"context_line":"will have a fixed number of keys available: 3. This is not configurable and"},{"line_number":50,"context_line":"allows for credentials to be re-keyed periodically with a new encryption key"},{"line_number":51,"context_line":"for the sake of security."},{"line_number":52,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa7ab95a_6fa3199f","line":49,"in_reply_to":"fa7ab95a_1408e4d8","updated":"2016-08-31 21:17:09.000000000","message":"Done","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d72de0013634965602b037de6900a5d747bcb4ad","unresolved":false,"context_lines":[{"line_number":47,"context_line":"holds keys to encrypt and decrypt credentials. These repositories should be"},{"line_number":48,"context_line":"managed separately and should not share keys. ``[credential] key_repository``"},{"line_number":49,"context_line":"will have a fixed number of keys available: 3. This is not configurable and"},{"line_number":50,"context_line":"allows for credentials to be re-keyed periodically with a new encryption key"},{"line_number":51,"context_line":"for the sake of security."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"How credential encryption works"}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa7ab95a_941b141c","line":50,"updated":"2016-08-31 20:49:35.000000000","message":"re-encrypted","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0596aa46616d25d0942f4c63cfc0abf586bd5e3e","unresolved":false,"context_lines":[{"line_number":47,"context_line":"holds keys to encrypt and decrypt credentials. These repositories should be"},{"line_number":48,"context_line":"managed separately and should not share keys. ``[credential] key_repository``"},{"line_number":49,"context_line":"will have a fixed number of keys available: 3. This is not configurable and"},{"line_number":50,"context_line":"allows for credentials to be re-keyed periodically with a new encryption key"},{"line_number":51,"context_line":"for the sake of security."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"How credential encryption works"}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa7ab95a_afad218a","line":50,"in_reply_to":"fa7ab95a_941b141c","updated":"2016-08-31 21:17:09.000000000","message":"Done","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d72de0013634965602b037de6900a5d747bcb4ad","unresolved":false,"context_lines":[{"line_number":76,"context_line":"Encrypting existing credentials"},{"line_number":77,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"The encryption of existing plain text credentials is done using the rolling"},{"line_number":80,"context_line":"upgrade process. When upgrading a Mitaka deployment to Newton, three database"},{"line_number":81,"context_line":"migrations will ensure all credentials are encrypted. The process is as"},{"line_number":82,"context_line":"follows:"}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa7ab95a_74e77012","line":79,"updated":"2016-08-31 20:49:35.000000000","message":"Do implementation details need to be in docs? Who is the intended audience here - developers? If so, the audience seems to differ from the rest of the file.","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0596aa46616d25d0942f4c63cfc0abf586bd5e3e","unresolved":false,"context_lines":[{"line_number":76,"context_line":"Encrypting existing credentials"},{"line_number":77,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"The encryption of existing plain text credentials is done using the rolling"},{"line_number":80,"context_line":"upgrade process. When upgrading a Mitaka deployment to Newton, three database"},{"line_number":81,"context_line":"migrations will ensure all credentials are encrypted. The process is as"},{"line_number":82,"context_line":"follows:"}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa7ab95a_4fb3b5e9","line":79,"in_reply_to":"fa7ab95a_74e77012","updated":"2016-08-31 21:17:09.000000000","message":"++ I can omit this.","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d72de0013634965602b037de6900a5d747bcb4ad","unresolved":false,"context_lines":[{"line_number":92,"context_line":"   text representations of the credential using ``keystone-manage db_sync"},{"line_number":93,"context_line":"   --contract``."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Note that a limited service outage will take affect during this migration. A"},{"line_number":96,"context_line":"``[credential] key_repository`` location must be specified through"},{"line_number":97,"context_line":"configuration and bootstrapped with keys using ``keystone-manage"},{"line_number":98,"context_line":"credential_setup`` prior to migrating any existing credentials. Credentials"}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa7ab95a_34b408f1","line":95,"updated":"2016-08-31 20:49:35.000000000","message":"This should be an upgrade note in the Newton-specific release notes, not buried in docs to become stale and outdated.","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0596aa46616d25d0942f4c63cfc0abf586bd5e3e","unresolved":false,"context_lines":[{"line_number":92,"context_line":"   text representations of the credential using ``keystone-manage db_sync"},{"line_number":93,"context_line":"   --contract``."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Note that a limited service outage will take affect during this migration. A"},{"line_number":96,"context_line":"``[credential] key_repository`` location must be specified through"},{"line_number":97,"context_line":"configuration and bootstrapped with keys using ``keystone-manage"},{"line_number":98,"context_line":"credential_setup`` prior to migrating any existing credentials. Credentials"}],"source_content_type":"text/x-rst","patch_set":15,"id":"fa7ab95a_4f01f569","line":95,"in_reply_to":"fa7ab95a_34b408f1","updated":"2016-08-31 21:17:09.000000000","message":"Done","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"}],"releasenotes/notes/support_encrypted_credentials_at_rest-93dcb67b3508e91a.yaml":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d72de0013634965602b037de6900a5d747bcb4ad","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - Keystone now supports encrypted credentials at rest."},{"line_number":4,"context_line":"    In order to upgrade successfully to Newton, deployers"},{"line_number":5,"context_line":"    must encrypt all credentials currently stored before"},{"line_number":6,"context_line":"    contracting the database. In order to upgrade to Newton,"},{"line_number":7,"context_line":"    deployers must run `keystone-manage credential_setup` in"},{"line_number":8,"context_line":"    order to use the credential API within Newton."}],"source_content_type":"text/x-yaml","patch_set":15,"id":"fa7ab95a_74af70e3","line":6,"updated":"2016-08-31 20:49:35.000000000","message":"the distinction of having a schema contraction phase only really applies to those opting into rolling upgrades","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"0596aa46616d25d0942f4c63cfc0abf586bd5e3e","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - Keystone now supports encrypted credentials at rest."},{"line_number":4,"context_line":"    In order to upgrade successfully to Newton, deployers"},{"line_number":5,"context_line":"    must encrypt all credentials currently stored before"},{"line_number":6,"context_line":"    contracting the database. In order to upgrade to Newton,"},{"line_number":7,"context_line":"    deployers must run `keystone-manage credential_setup` in"},{"line_number":8,"context_line":"    order to use the credential API within Newton."}],"source_content_type":"text/x-yaml","patch_set":15,"id":"fa7ab95a_8f685d23","line":6,"in_reply_to":"fa7ab95a_74af70e3","updated":"2016-08-31 21:17:09.000000000","message":"Done","commit_id":"ce13b4f5df295ad4770d72ad453eb91c0c078a5d"}]}