)]}'
{"mistral/context.py":[{"author":{"_account_id":6732,"name":"Lingxian Kong","email":"anlin.kong@gmail.com","username":"kong"},"change_message_id":"7f3cc7366319cce69844ac22699c53569841b73a","unresolved":false,"context_lines":[{"line_number":151,"context_line":"        params \u003d {"},{"line_number":152,"context_line":"            # TODO(akovi): Target cert not handled yet"},{"line_number":153,"context_line":"            \u0027auth_cacert\u0027: None,"},{"line_number":154,"context_line":"            \u0027insecure\u0027: headers.get(\u0027X-Target-Insecure\u0027, False),"},{"line_number":155,"context_line":"            \u0027auth_token\u0027: headers.get(\u0027X-Target-Auth-Token\u0027),"},{"line_number":156,"context_line":"            \u0027auth_uri\u0027: headers.get(\u0027X-Target-Auth-Uri\u0027),"},{"line_number":157,"context_line":"            \u0027project_id\u0027: headers.get(\u0027X-Target-Project-Id\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba5201f7_49a6bbae","line":154,"updated":"2017-01-08 10:22:58.000000000","message":"Did you test if it functions well with \u0027insecure\u003dFalse\u0027? Do you need to pass related certs?\n\nBTW, In order to make this function available for end users, please also change mistralclient (depends on this patch) to pass this header accordingly.","commit_id":"8473dceca06ac14b05e1aef3c6f4fb1c966ffbba"},{"author":{"_account_id":23271,"name":"Istvan Imre","email":"istvan.imre@nokia.com","username":"istvan.imre"},"change_message_id":"19493bdecc63a9031dc913ef34ff9e2b4ec27206","unresolved":false,"context_lines":[{"line_number":151,"context_line":"        params \u003d {"},{"line_number":152,"context_line":"            # TODO(akovi): Target cert not handled yet"},{"line_number":153,"context_line":"            \u0027auth_cacert\u0027: None,"},{"line_number":154,"context_line":"            \u0027insecure\u0027: headers.get(\u0027X-Target-Insecure\u0027, False),"},{"line_number":155,"context_line":"            \u0027auth_token\u0027: headers.get(\u0027X-Target-Auth-Token\u0027),"},{"line_number":156,"context_line":"            \u0027auth_uri\u0027: headers.get(\u0027X-Target-Auth-Uri\u0027),"},{"line_number":157,"context_line":"            \u0027project_id\u0027: headers.get(\u0027X-Target-Project-Id\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba5201f7_72032277","line":154,"in_reply_to":"ba5201f7_0e780a8f","updated":"2017-01-10 09:16:38.000000000","message":"Yes we were using the mentioned solution in our local patch, but now we need this flag to set by the client. In case of target cloud is specified by mistralclient user, it could specify any cloud credentials and and the insecure flag could varies cloud by cloud.","commit_id":"8473dceca06ac14b05e1aef3c6f4fb1c966ffbba"},{"author":{"_account_id":6732,"name":"Lingxian Kong","email":"anlin.kong@gmail.com","username":"kong"},"change_message_id":"bcc75ccb1deb407c99a8dfc9cb055c98694bf24b","unresolved":false,"context_lines":[{"line_number":151,"context_line":"        params \u003d {"},{"line_number":152,"context_line":"            # TODO(akovi): Target cert not handled yet"},{"line_number":153,"context_line":"            \u0027auth_cacert\u0027: None,"},{"line_number":154,"context_line":"            \u0027insecure\u0027: headers.get(\u0027X-Target-Insecure\u0027, False),"},{"line_number":155,"context_line":"            \u0027auth_token\u0027: headers.get(\u0027X-Target-Auth-Token\u0027),"},{"line_number":156,"context_line":"            \u0027auth_uri\u0027: headers.get(\u0027X-Target-Auth-Uri\u0027),"},{"line_number":157,"context_line":"            \u0027project_id\u0027: headers.get(\u0027X-Target-Project-Id\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba5201f7_33fe3239","line":154,"in_reply_to":"ba5201f7_217fc315","updated":"2017-01-09 09:53:52.000000000","message":"Sorry, I mean, what if when using \u0027secure https connection\u0027, which means the ca cert and/or client cert need to be passed?","commit_id":"8473dceca06ac14b05e1aef3c6f4fb1c966ffbba"},{"author":{"_account_id":23271,"name":"Istvan Imre","email":"istvan.imre@nokia.com","username":"istvan.imre"},"change_message_id":"e402da8e3b3e72feb597a4ec580ae093cf8db497","unresolved":false,"context_lines":[{"line_number":151,"context_line":"        params \u003d {"},{"line_number":152,"context_line":"            # TODO(akovi): Target cert not handled yet"},{"line_number":153,"context_line":"            \u0027auth_cacert\u0027: None,"},{"line_number":154,"context_line":"            \u0027insecure\u0027: headers.get(\u0027X-Target-Insecure\u0027, False),"},{"line_number":155,"context_line":"            \u0027auth_token\u0027: headers.get(\u0027X-Target-Auth-Token\u0027),"},{"line_number":156,"context_line":"            \u0027auth_uri\u0027: headers.get(\u0027X-Target-Auth-Uri\u0027),"},{"line_number":157,"context_line":"            \u0027project_id\u0027: headers.get(\u0027X-Target-Project-Id\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba5201f7_45220803","line":154,"in_reply_to":"ba5201f7_33fe3239","updated":"2017-01-09 12:18:34.000000000","message":"You have right that this insecure flag is mainly for testing purpose, so if user would like to use secure cloud connections then it needs to use secure mode anyway with cert checking. But generally every python client advertizes this insecure flag, just it is not possible to pass it to them through mistral.\n\nBut there are several other options which are not passed to the OpenStack clients, so may we need some more general implementation to pass any argument what user wan\u0027t to the OpenStack clients used by mistral.","commit_id":"8473dceca06ac14b05e1aef3c6f4fb1c966ffbba"},{"author":{"_account_id":6732,"name":"Lingxian Kong","email":"anlin.kong@gmail.com","username":"kong"},"change_message_id":"1a8ea88b677d7ce7fb6f1e1a74a9c372397ab656","unresolved":false,"context_lines":[{"line_number":151,"context_line":"        params \u003d {"},{"line_number":152,"context_line":"            # TODO(akovi): Target cert not handled yet"},{"line_number":153,"context_line":"            \u0027auth_cacert\u0027: None,"},{"line_number":154,"context_line":"            \u0027insecure\u0027: headers.get(\u0027X-Target-Insecure\u0027, False),"},{"line_number":155,"context_line":"            \u0027auth_token\u0027: headers.get(\u0027X-Target-Auth-Token\u0027),"},{"line_number":156,"context_line":"            \u0027auth_uri\u0027: headers.get(\u0027X-Target-Auth-Uri\u0027),"},{"line_number":157,"context_line":"            \u0027project_id\u0027: headers.get(\u0027X-Target-Project-Id\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba5201f7_0e780a8f","line":154,"in_reply_to":"ba5201f7_45220803","updated":"2017-01-09 20:37:41.000000000","message":"To make things easier, if you didn\u0027t want to support secure connection at the first step, then just pass \u0027insecure\u003dTrue\u0027. If we have some requirment in future, then we could make it configurable or get certs from client just as other projects do.","commit_id":"8473dceca06ac14b05e1aef3c6f4fb1c966ffbba"},{"author":{"_account_id":23271,"name":"Istvan Imre","email":"istvan.imre@nokia.com","username":"istvan.imre"},"change_message_id":"cc16f78e9c0cb80284a57ac7ecaa4102d6a8391a","unresolved":false,"context_lines":[{"line_number":151,"context_line":"        params \u003d {"},{"line_number":152,"context_line":"            # TODO(akovi): Target cert not handled yet"},{"line_number":153,"context_line":"            \u0027auth_cacert\u0027: None,"},{"line_number":154,"context_line":"            \u0027insecure\u0027: headers.get(\u0027X-Target-Insecure\u0027, False),"},{"line_number":155,"context_line":"            \u0027auth_token\u0027: headers.get(\u0027X-Target-Auth-Token\u0027),"},{"line_number":156,"context_line":"            \u0027auth_uri\u0027: headers.get(\u0027X-Target-Auth-Uri\u0027),"},{"line_number":157,"context_line":"            \u0027project_id\u0027: headers.get(\u0027X-Target-Project-Id\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba5201f7_217fc315","line":154,"in_reply_to":"ba5201f7_49a6bbae","updated":"2017-01-09 07:21:04.000000000","message":"In case of insecure https connection we just ignore server certificate, so you do not need include server cert. Yes I going to implement this in mistralclient also.","commit_id":"8473dceca06ac14b05e1aef3c6f4fb1c966ffbba"},{"author":{"_account_id":23271,"name":"Istvan Imre","email":"istvan.imre@nokia.com","username":"istvan.imre"},"change_message_id":"5e2e2f52902c3824e0c1451c21df12bfb74d4b6f","unresolved":false,"context_lines":[{"line_number":174,"context_line":"    else:"},{"line_number":175,"context_line":"        params \u003d {"},{"line_number":176,"context_line":"            \u0027auth_cacert\u0027: CONF.keystone_authtoken.cafile,"},{"line_number":177,"context_line":"            \u0027insecure\u0027: headers.get(\u0027X-Insecure\u0027, False),"},{"line_number":178,"context_line":"            \u0027auth_token\u0027: headers.get(\u0027X-Auth-Token\u0027),"},{"line_number":179,"context_line":"            \u0027auth_uri\u0027: CONF.keystone_authtoken.auth_uri,"},{"line_number":180,"context_line":"            \u0027project_id\u0027: headers.get(\u0027X-Project-Id\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba5201f7_0caf8f2a","line":177,"updated":"2017-01-06 08:46:22.000000000","message":"Insecure flag may relevant only in case of target cloud specified, in case of own cloud it is not relevant, or it shall come from mistral configuration. What do you think about this?","commit_id":"8473dceca06ac14b05e1aef3c6f4fb1c966ffbba"},{"author":{"_account_id":6732,"name":"Lingxian Kong","email":"anlin.kong@gmail.com","username":"kong"},"change_message_id":"7f3cc7366319cce69844ac22699c53569841b73a","unresolved":false,"context_lines":[{"line_number":174,"context_line":"    else:"},{"line_number":175,"context_line":"        params \u003d {"},{"line_number":176,"context_line":"            \u0027auth_cacert\u0027: CONF.keystone_authtoken.cafile,"},{"line_number":177,"context_line":"            \u0027insecure\u0027: headers.get(\u0027X-Insecure\u0027, False),"},{"line_number":178,"context_line":"            \u0027auth_token\u0027: headers.get(\u0027X-Auth-Token\u0027),"},{"line_number":179,"context_line":"            \u0027auth_uri\u0027: CONF.keystone_authtoken.auth_uri,"},{"line_number":180,"context_line":"            \u0027project_id\u0027: headers.get(\u0027X-Project-Id\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba5201f7_29841709","line":177,"in_reply_to":"ba5201f7_0caf8f2a","updated":"2017-01-08 10:22:58.000000000","message":"I wonder where \u0027X-Insecure\u0027 comes from?","commit_id":"8473dceca06ac14b05e1aef3c6f4fb1c966ffbba"},{"author":{"_account_id":23271,"name":"Istvan Imre","email":"istvan.imre@nokia.com","username":"istvan.imre"},"change_message_id":"cc16f78e9c0cb80284a57ac7ecaa4102d6a8391a","unresolved":false,"context_lines":[{"line_number":174,"context_line":"    else:"},{"line_number":175,"context_line":"        params \u003d {"},{"line_number":176,"context_line":"            \u0027auth_cacert\u0027: CONF.keystone_authtoken.cafile,"},{"line_number":177,"context_line":"            \u0027insecure\u0027: headers.get(\u0027X-Insecure\u0027, False),"},{"line_number":178,"context_line":"            \u0027auth_token\u0027: headers.get(\u0027X-Auth-Token\u0027),"},{"line_number":179,"context_line":"            \u0027auth_uri\u0027: CONF.keystone_authtoken.auth_uri,"},{"line_number":180,"context_line":"            \u0027project_id\u0027: headers.get(\u0027X-Project-Id\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba5201f7_21d423ea","line":177,"in_reply_to":"ba5201f7_29841709","updated":"2017-01-09 07:21:04.000000000","message":"It would come from mistralclient also, but I just thinking to remove this flag. So in case of mistral connects to own cloud (target cloud feature is not used), then it shall known the certificate of their cloud anyway. So no point in insecure https handling in that case.","commit_id":"8473dceca06ac14b05e1aef3c6f4fb1c966ffbba"},{"author":{"_account_id":6732,"name":"Lingxian Kong","email":"anlin.kong@gmail.com","username":"kong"},"change_message_id":"bc19bf8dcc7fb934d971bfff65e4e62d3c236eb2","unresolved":false,"context_lines":[{"line_number":150,"context_line":"    if headers.get(\"X-Target-Auth-Uri\"):"},{"line_number":151,"context_line":"        params \u003d {"},{"line_number":152,"context_line":"            # TODO(akovi): Target cert not handled yet"},{"line_number":153,"context_line":"            \u0027auth_cacert\u0027: None,"},{"line_number":154,"context_line":"            \u0027insecure\u0027: headers.get(\u0027X-Target-Insecure\u0027, False),"},{"line_number":155,"context_line":"            \u0027auth_token\u0027: headers.get(\u0027X-Target-Auth-Token\u0027),"},{"line_number":156,"context_line":"            \u0027auth_uri\u0027: headers.get(\u0027X-Target-Auth-Uri\u0027),"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba5201f7_154fe7bd","line":153,"range":{"start_line":153,"start_character":13,"end_line":153,"end_character":24},"updated":"2017-01-11 09:35:11.000000000","message":"Sorry, I\u0027m still confused here, if \u0027insecure\u003dFalse\u0027, which means user wants to enable target cloud server certificate verification, \u0027auth_cacert\u0027 should be set here, shouldn\u0027t it?","commit_id":"81301400c2aa6e53a3461c7f8d81d354de0b2479"},{"author":{"_account_id":23271,"name":"Istvan Imre","email":"istvan.imre@nokia.com","username":"istvan.imre"},"change_message_id":"3e6eaa135da74ece5284aded9cbf3a60c4a4981b","unresolved":false,"context_lines":[{"line_number":150,"context_line":"    if headers.get(\"X-Target-Auth-Uri\"):"},{"line_number":151,"context_line":"        params \u003d {"},{"line_number":152,"context_line":"            # TODO(akovi): Target cert not handled yet"},{"line_number":153,"context_line":"            \u0027auth_cacert\u0027: None,"},{"line_number":154,"context_line":"            \u0027insecure\u0027: headers.get(\u0027X-Target-Insecure\u0027, False),"},{"line_number":155,"context_line":"            \u0027auth_token\u0027: headers.get(\u0027X-Target-Auth-Token\u0027),"},{"line_number":156,"context_line":"            \u0027auth_uri\u0027: headers.get(\u0027X-Target-Auth-Uri\u0027),"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba5201f7_16728e49","line":153,"range":{"start_line":153,"start_character":13,"end_line":153,"end_character":24},"in_reply_to":"ba5201f7_154fe7bd","updated":"2017-01-11 11:34:12.000000000","message":"You have right, but it is a bit strange that auth_cacert is used only in keystone actions, how this feature was implemented?\n\nI think so it could be a new feature to handle auth_cacert in case of target cloud also. Anyway we are planing to use system\u0027s trust store in production when we need secure connection. \n\nTo support this target ca_cert could be a bit complicated, due to we need save content of certificate to a file and pass it to the clients. So it would be not just an easy in-memory solution.","commit_id":"81301400c2aa6e53a3461c7f8d81d354de0b2479"},{"author":{"_account_id":6732,"name":"Lingxian Kong","email":"anlin.kong@gmail.com","username":"kong"},"change_message_id":"bc19bf8dcc7fb934d971bfff65e4e62d3c236eb2","unresolved":false,"context_lines":[{"line_number":174,"context_line":"    else:"},{"line_number":175,"context_line":"        params \u003d {"},{"line_number":176,"context_line":"            \u0027auth_cacert\u0027: CONF.keystone_authtoken.cafile,"},{"line_number":177,"context_line":"            \u0027insecure\u0027: False,"},{"line_number":178,"context_line":"            \u0027auth_token\u0027: headers.get(\u0027X-Auth-Token\u0027),"},{"line_number":179,"context_line":"            \u0027auth_uri\u0027: CONF.keystone_authtoken.auth_uri,"},{"line_number":180,"context_line":"            \u0027project_id\u0027: headers.get(\u0027X-Project-Id\u0027),"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba5201f7_15ab671e","line":177,"updated":"2017-01-11 09:35:11.000000000","message":"If my comments above is valid, then what if CONF.keystone_authtoken.cafile is not specified?","commit_id":"81301400c2aa6e53a3461c7f8d81d354de0b2479"},{"author":{"_account_id":23271,"name":"Istvan Imre","email":"istvan.imre@nokia.com","username":"istvan.imre"},"change_message_id":"3e6eaa135da74ece5284aded9cbf3a60c4a4981b","unresolved":false,"context_lines":[{"line_number":174,"context_line":"    else:"},{"line_number":175,"context_line":"        params \u003d {"},{"line_number":176,"context_line":"            \u0027auth_cacert\u0027: CONF.keystone_authtoken.cafile,"},{"line_number":177,"context_line":"            \u0027insecure\u0027: False,"},{"line_number":178,"context_line":"            \u0027auth_token\u0027: headers.get(\u0027X-Auth-Token\u0027),"},{"line_number":179,"context_line":"            \u0027auth_uri\u0027: CONF.keystone_authtoken.auth_uri,"},{"line_number":180,"context_line":"            \u0027project_id\u0027: headers.get(\u0027X-Project-Id\u0027),"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba5201f7_d6f3a69d","line":177,"in_reply_to":"ba5201f7_15ab671e","updated":"2017-01-11 11:34:12.000000000","message":"I just fixed it to False in order to preserve current behavior in case of self cloud is used by mistral. \n\nMay later we could define a new configuration parameter for this, if someone requested it.","commit_id":"81301400c2aa6e53a3461c7f8d81d354de0b2479"}]}