)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":13642,"name":"Vikram Hosakote","email":"vikram.ganesh@gmail.com","username":"vhosakot"},"change_message_id":"9ccfbb6b8141ad7c80f161b4154e09a8839068b5","unresolved":false,"context_lines":[{"line_number":10,"context_line":"provides better performance characteristics compared with"},{"line_number":11,"context_line":"the database UUID provider."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"To deploy a cloud with Fernet the steps requieds are:"},{"line_number":14,"context_line":"1) Configure fernet as the token provider"},{"line_number":15,"context_line":"2) Create fernet key repository"},{"line_number":16,"context_line":"3) Create initial set of of keys"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5aef4532_007ba87c","line":13,"range":{"start_line":13,"start_character":0,"end_line":13,"end_character":53},"updated":"2016-03-11 05:01:36.000000000","message":"Typo. requieds should be required.","commit_id":"68164e375b8b60a064e8280a17ab188b7bb58541"},{"author":{"_account_id":13642,"name":"Vikram Hosakote","email":"vikram.ganesh@gmail.com","username":"vhosakot"},"change_message_id":"9ccfbb6b8141ad7c80f161b4154e09a8839068b5","unresolved":false,"context_lines":[{"line_number":13,"context_line":"To deploy a cloud with Fernet the steps requieds are:"},{"line_number":14,"context_line":"1) Configure fernet as the token provider"},{"line_number":15,"context_line":"2) Create fernet key repository"},{"line_number":16,"context_line":"3) Create initial set of of keys"},{"line_number":17,"context_line":"4) Distribute the keys to all keystone containers"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"To operate a cloud securely, periodically perform these steps:"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5aef4532_404ad028","line":16,"range":{"start_line":16,"start_character":22,"end_line":16,"end_character":24},"updated":"2016-03-11 05:01:36.000000000","message":"of of","commit_id":"68164e375b8b60a064e8280a17ab188b7bb58541"}],"ansible/roles/keystone/tasks/init_fernet.yml":[{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"8c4988fb47b8b01fbf162ed9f48ce9c51e23ed0b","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"- name: Create Fernet Key Repository"},{"line_number":3,"context_line":"  file:"},{"line_number":4,"context_line":"    path: \"{{ keystone_fernet_keys_repository }}\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3afc51ec_cd51ee10","line":1,"updated":"2016-03-11 14:54:39.000000000","message":"the whole structure of this needs to change. Currently you are generating them if they do not exist... per node. so on multinode you may find keystone[0] doesnt have keys, but keystone[1] does. please look at how this is solved for ceph and maraidb","commit_id":"68164e375b8b60a064e8280a17ab188b7bb58541"},{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"8c4988fb47b8b01fbf162ed9f48ce9c51e23ed0b","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"- name: Create Fernet Keys"},{"line_number":15,"context_line":"  command: docker exec keystone keystone-manage fernet_setup \\"},{"line_number":16,"context_line":"                         --keystone-user keystone --keystone-group keystone"},{"line_number":17,"context_line":"  delegate_to: \"{{ groups[\u0027keystone\u0027][0] }}\""},{"line_number":18,"context_line":"  run_once: True"},{"line_number":19,"context_line":"  when: not _fernet_keys.stat.exists"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3afc51ec_2d57b203","line":16,"updated":"2016-03-11 14:54:39.000000000","message":"dont split lines on the command: line","commit_id":"68164e375b8b60a064e8280a17ab188b7bb58541"},{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"8c4988fb47b8b01fbf162ed9f48ce9c51e23ed0b","unresolved":false,"context_lines":[{"line_number":19,"context_line":"  when: not _fernet_keys.stat.exists"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"- name: Rotate Fernet Keys"},{"line_number":22,"context_line":"  command: docker exec keystone keystone-manage fernet_rotate \\"},{"line_number":23,"context_line":"                         --keystone-user keystone --keystone-group keystone"},{"line_number":24,"context_line":"  delegate_to: \"{{ groups[\u0027keystone\u0027][0] }}\""},{"line_number":25,"context_line":"  run_once: True"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3afc51ec_0d5c7624","line":22,"updated":"2016-03-11 14:54:39.000000000","message":"rotating keys liks this wont do. that means they will rotate everytime the playbooks are run","commit_id":"68164e375b8b60a064e8280a17ab188b7bb58541"},{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"8c4988fb47b8b01fbf162ed9f48ce9c51e23ed0b","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"- name: Rotate Fernet Keys"},{"line_number":22,"context_line":"  command: docker exec keystone keystone-manage fernet_rotate \\"},{"line_number":23,"context_line":"                         --keystone-user keystone --keystone-group keystone"},{"line_number":24,"context_line":"  delegate_to: \"{{ groups[\u0027keystone\u0027][0] }}\""},{"line_number":25,"context_line":"  run_once: True"},{"line_number":26,"context_line":"  when: _fernet_keys.stat.exists"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3afc51ec_6d41ba39","line":23,"updated":"2016-03-11 14:54:39.000000000","message":"dont split lines","commit_id":"68164e375b8b60a064e8280a17ab188b7bb58541"},{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"8c4988fb47b8b01fbf162ed9f48ce9c51e23ed0b","unresolved":false,"context_lines":[{"line_number":26,"context_line":"  when: _fernet_keys.stat.exists"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"- name: Get list of keys"},{"line_number":29,"context_line":"  command: \"docker exec keystone ls /etc/keystone/fernet-keys\""},{"line_number":30,"context_line":"  register: key_list"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"- name: Pull in generated keys"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3afc51ec_4d3e7eb9","line":29,"updated":"2016-03-11 14:54:39.000000000","message":"for the next task as well youll need to build a script much like the fetch_keys script in ceph to do what you are trying to do.","commit_id":"68164e375b8b60a064e8280a17ab188b7bb58541"},{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"8c4988fb47b8b01fbf162ed9f48ce9c51e23ed0b","unresolved":false,"context_lines":[{"line_number":30,"context_line":"  register: key_list"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"- name: Pull in generated keys"},{"line_number":33,"context_line":"  command: \"docker exec keystone cat /etc/keystone/fernet-keys/{{ item }}\""},{"line_number":34,"context_line":"  register: \"key-{{ item }}\""},{"line_number":35,"context_line":"  when:"},{"line_number":36,"context_line":"    - inventory_hostname \u003d\u003d groups[\u0027keystone\u0027][0]"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3afc51ec_ad4bc258","line":33,"updated":"2016-03-11 14:54:39.000000000","message":"cat\u0027ing is not acceptable, it needs to be converted to base64 for portability (see comment in task above)","commit_id":"68164e375b8b60a064e8280a17ab188b7bb58541"}],"ansible/roles/keystone/tasks/rotate_fernet.yml":[{"author":{"_account_id":16233,"name":"Mauricio Lima","email":"mauriciolimab@gmail.com","username":"limamauricio"},"change_message_id":"03362ab2bc00509e87a2777d5dd1d3d5f2022c46","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"#"},{"line_number":3,"context_line":"# Key Rotation is not a cloud deployment step."},{"line_number":4,"context_line":"# It should be done periodicly, by cron job, while keystone is"},{"line_number":5,"context_line":"# operational."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3afc51ec_a5676424","line":2,"range":{"start_line":2,"start_character":0,"end_line":2,"end_character":1},"updated":"2016-03-11 11:54:39.000000000","message":"you can remove it :)","commit_id":"68164e375b8b60a064e8280a17ab188b7bb58541"},{"author":{"_account_id":16233,"name":"Mauricio Lima","email":"mauriciolimab@gmail.com","username":"limamauricio"},"change_message_id":"03362ab2bc00509e87a2777d5dd1d3d5f2022c46","unresolved":false,"context_lines":[{"line_number":3,"context_line":"# Key Rotation is not a cloud deployment step."},{"line_number":4,"context_line":"# It should be done periodicly, by cron job, while keystone is"},{"line_number":5,"context_line":"# operational."},{"line_number":6,"context_line":"#"},{"line_number":7,"context_line":"- name: Check if fernet keys exist"},{"line_number":8,"context_line":"  stat:"},{"line_number":9,"context_line":"    path: \"{{ keystone_fernet_keys_repository }}/0\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3afc51ec_457780d4","line":6,"range":{"start_line":6,"start_character":0,"end_line":6,"end_character":1},"updated":"2016-03-11 11:54:39.000000000","message":"ditto","commit_id":"68164e375b8b60a064e8280a17ab188b7bb58541"}],"ansible/roles/keystone/templates/keystone.conf.j2":[{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"8c4988fb47b8b01fbf162ed9f48ce9c51e23ed0b","unresolved":false,"context_lines":[{"line_number":9,"context_line":"[database]"},{"line_number":10,"context_line":"connection \u003d mysql+pymysql://{{ keystone_database_user }}:{{ keystone_database_password }}@{{ keystone_database_address }}/{{ keystone_database_name }}"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"{% if \u0027fernet\u0027 in keystone_token_provider %}"},{"line_number":13,"context_line":"[token]"},{"line_number":14,"context_line":"provider \u003d fernet"},{"line_number":15,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":1,"id":"3afc51ec_8d48865d","line":12,"updated":"2016-03-11 14:54:39.000000000","message":"lets go ahead and always set the [token] section to the value {{ \u0027keystone_token_provider\u0027 }}","commit_id":"68164e375b8b60a064e8280a17ab188b7bb58541"}],"etc/kolla/globals.yml":[{"author":{"_account_id":13642,"name":"Vikram Hosakote","email":"vikram.ganesh@gmail.com","username":"vhosakot"},"change_message_id":"9ccfbb6b8141ad7c80f161b4154e09a8839068b5","unresolved":false,"context_lines":[{"line_number":92,"context_line":"#nova_console: \"novnc\""},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"# Valid options are [ uuid, fernet ]"},{"line_number":95,"context_line":"#keystone_token_provider: \u0027fernet\u0027"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"# OpenStack services can be enabled or disabled with these options"},{"line_number":98,"context_line":"#enable_cinder: \"yes\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"5aef4532_e0e03cfd","line":95,"range":{"start_line":95,"start_character":0,"end_line":95,"end_character":34},"updated":"2016-03-11 05:01:36.000000000","message":"The value of a variable in ansible/group_vars/all.yml matches the value of the same variable commented out here in etc/kolla/globals.yml. Examples are neutron_plugin_agent, config_strategy and nova_console.\n\nHence, for consistency, I think this should match the value of keystone_token_provider in ansible/group_vars/all.yml and must be:\n\n    #keystone_token_provider: \u0027uuid\u0027","commit_id":"68164e375b8b60a064e8280a17ab188b7bb58541"},{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"8c4988fb47b8b01fbf162ed9f48ce9c51e23ed0b","unresolved":false,"context_lines":[{"line_number":92,"context_line":"#nova_console: \"novnc\""},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"# Valid options are [ uuid, fernet ]"},{"line_number":95,"context_line":"#keystone_token_provider: \u0027fernet\u0027"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"# OpenStack services can be enabled or disabled with these options"},{"line_number":98,"context_line":"#enable_cinder: \"yes\""}],"source_content_type":"text/x-yaml","patch_set":1,"id":"3afc51ec_ed4caa78","line":95,"updated":"2016-03-11 14:54:39.000000000","message":"vikram, thats not entirely true, see the lines after that. though I would agree we should follow that practice here.","commit_id":"68164e375b8b60a064e8280a17ab188b7bb58541"}]}