)]}'
{"specs/liberty/approved/convert-consoles-to-objects.rst":[{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"2cb928b2e541356c3699712be3a270e7e74b08c9","unresolved":false,"context_lines":[{"line_number":55,"context_line":"* Define a new Console object"},{"line_number":56,"context_line":"* Convert drivers to return Console object"},{"line_number":57,"context_line":"* Remove using of the connect_info\u0027s dict"},{"line_number":58,"context_line":"* Define schema and API to store Console object in database"},{"line_number":59,"context_line":"* Update code to store Console with valid token in database instead of"},{"line_number":60,"context_line":"  a cache"},{"line_number":61,"context_line":"* Define a periodic task to clean expired Console"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3acd31a7_b3e7c4e3","line":58,"updated":"2015-04-30 15:33:28.000000000","message":"Right here you say that you plan to store it in the database.","commit_id":"5e498cfa3c50e8d51683a8788db5dce4dbcda555"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"5774d8d3328f38fb8e7f68578349a9597ae0f969","unresolved":false,"context_lines":[{"line_number":55,"context_line":"* Define a new Console object"},{"line_number":56,"context_line":"* Convert drivers to return Console object"},{"line_number":57,"context_line":"* Remove using of the connect_info\u0027s dict"},{"line_number":58,"context_line":"* Define schema and API to store Console object in database"},{"line_number":59,"context_line":"* Update code to store Console with valid token in database instead of"},{"line_number":60,"context_line":"  a cache"},{"line_number":61,"context_line":"* Define a periodic task to clean expired Console"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3acd31a7_f11ad16d","line":58,"in_reply_to":"3acd31a7_b3e7c4e3","updated":"2015-04-30 17:18:18.000000000","message":"I see now, I tried to do it line 74 but I will see how we usually do on other specs. Thank you.","commit_id":"5e498cfa3c50e8d51683a8788db5dce4dbcda555"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"e76ed0220739cca8b1fd25ede4fcf47d173c9b32","unresolved":false,"context_lines":[{"line_number":79,"context_line":"  internal_access_path, mode..."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"No migration are expected, during the upgrade already connected"},{"line_number":82,"context_line":"consoles should continue to work until proxy will be restarted."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"REST API impact"},{"line_number":85,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3acd31a7_2e313bed","line":82,"updated":"2015-04-29 15:43:12.000000000","message":"Is this going to be persisted in the database? I thought you said above that it will. If so, that involves a schema migration, right? Please describe the schema change here.\n\nAlso, can you describe the lazy conversion that the object will need to do to handle existing stuff already in flight? And will we need a background migration process for existing data (like migrate_flavor_data)?","commit_id":"5e498cfa3c50e8d51683a8788db5dce4dbcda555"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"dccfb4a82850a2597fb4763de9abb8c79599286b","unresolved":false,"context_lines":[{"line_number":79,"context_line":"  internal_access_path, mode..."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"No migration are expected, during the upgrade already connected"},{"line_number":82,"context_line":"consoles should continue to work until proxy will be restarted."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"REST API impact"},{"line_number":85,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3acd31a7_61f3a80b","line":82,"in_reply_to":"3acd31a7_2e313bed","updated":"2015-04-30 09:24:52.000000000","message":"What do you mean by schema migration ? Currently nothing is stored in the database, we convert the dict connect_info which is responsible to handle the token, instance_uuid, host, port etc.. to JSON string, then we store it in memcached or a localcache.\n\nWe do not have to convert something here, Michael asks me a similar question. Actually we need the dict connect_info only for the authentication process then the client is connected. If we are doing migration during the phase where the client is already connected he will keep his session activated until the operator will restart the console service. At this point the user will be disconnected and not able to reconnect himself to the console (an error \"token expired\" will be raised) since the code of console will now ask consoleauth with the new way, he will have to request for a new token and so the new process will goes.","commit_id":"5e498cfa3c50e8d51683a8788db5dce4dbcda555"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"2cb928b2e541356c3699712be3a270e7e74b08c9","unresolved":false,"context_lines":[{"line_number":79,"context_line":"  internal_access_path, mode..."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"No migration are expected, during the upgrade already connected"},{"line_number":82,"context_line":"consoles should continue to work until proxy will be restarted."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"REST API impact"},{"line_number":85,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3acd31a7_d3092097","line":82,"in_reply_to":"3acd31a7_61f3a80b","updated":"2015-04-30 15:33:28.000000000","message":"See above.","commit_id":"5e498cfa3c50e8d51683a8788db5dce4dbcda555"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"e76ed0220739cca8b1fd25ede4fcf47d173c9b32","unresolved":false,"context_lines":[{"line_number":93,"context_line":"currently tokens are stored in local memory or memcached which both of"},{"line_number":94,"context_line":"them do not provide any security layer. In other terms the security"},{"line_number":95,"context_line":"policy will enhanced to be the same than other critical components"},{"line_number":96,"context_line":"stored in database."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Notifications impact"},{"line_number":99,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3acd31a7_6ec17380","line":96,"updated":"2015-04-29 15:43:12.000000000","message":"Does the token expiration currently depend on memcache\u0027s key expiration? If so, we need to make sure we properly check/handle that so as not to honor a token beyond its lifetime, right?","commit_id":"5e498cfa3c50e8d51683a8788db5dce4dbcda555"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"dccfb4a82850a2597fb4763de9abb8c79599286b","unresolved":false,"context_lines":[{"line_number":93,"context_line":"currently tokens are stored in local memory or memcached which both of"},{"line_number":94,"context_line":"them do not provide any security layer. In other terms the security"},{"line_number":95,"context_line":"policy will enhanced to be the same than other critical components"},{"line_number":96,"context_line":"stored in database."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Notifications impact"},{"line_number":99,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3acd31a7_817ec4e2","line":96,"in_reply_to":"3acd31a7_6ec17380","updated":"2015-04-30 09:24:52.000000000","message":"We actually also store an entry with as key the instance_uuid and for value the list of tokens stored so when we destroy an instance we clean tokens.\nThis mechanism of cleaning tokens when instance is destroyed can still exists we the database, but i also plan to setup a periodic task to flush already expired token. line 61.","commit_id":"5e498cfa3c50e8d51683a8788db5dce4dbcda555"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"e76ed0220739cca8b1fd25ede4fcf47d173c9b32","unresolved":false,"context_lines":[{"line_number":145,"context_line":""},{"line_number":146,"context_line":"The current code is already tested by functional and unit tests since"},{"line_number":147,"context_line":"we do not provide any feature we can consider that the code will be"},{"line_number":148,"context_line":"well covered by tests."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"Documentation Impact"},{"line_number":151,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3acd31a7_2e693b8c","line":148,"updated":"2015-04-29 15:43:12.000000000","message":"Aside from unit tests on the new object and testing of the lazy data migration, right?","commit_id":"5e498cfa3c50e8d51683a8788db5dce4dbcda555"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"dccfb4a82850a2597fb4763de9abb8c79599286b","unresolved":false,"context_lines":[{"line_number":145,"context_line":""},{"line_number":146,"context_line":"The current code is already tested by functional and unit tests since"},{"line_number":147,"context_line":"we do not provide any feature we can consider that the code will be"},{"line_number":148,"context_line":"well covered by tests."},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"Documentation Impact"},{"line_number":151,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3acd31a7_216ed02f","line":148,"in_reply_to":"3acd31a7_2e693b8c","updated":"2015-04-30 09:24:52.000000000","message":"Right !","commit_id":"5e498cfa3c50e8d51683a8788db5dce4dbcda555"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"83ea8b105bb3c51e09c794a0c71055f158c11449","unresolved":false,"context_lines":[{"line_number":36,"context_line":"particular port from a number of perspectives: from the compute node, to"},{"line_number":37,"context_line":"return the next port defined and not connected; from the proxy to"},{"line_number":38,"context_line":"reject new connections on already connected port from the API to"},{"line_number":39,"context_line":"let\u0027s user informed no more port are available."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Use Cases"},{"line_number":42,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3acd31a7_ac9605ee","line":39,"range":{"start_line":39,"start_character":0,"end_line":39,"end_character":5},"updated":"2015-05-04 15:27:27.000000000","message":"This should be \"lets\"","commit_id":"a1888eab6c8c4c24914daaf5f64adf3db59a86f5"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"39cdb021b7ff2086f8e5f933731394072f260f24","unresolved":false,"context_lines":[{"line_number":36,"context_line":"particular port from a number of perspectives: from the compute node, to"},{"line_number":37,"context_line":"return the next port defined and not connected; from the proxy to"},{"line_number":38,"context_line":"reject new connections on already connected port from the API to"},{"line_number":39,"context_line":"let\u0027s user informed no more port are available."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Use Cases"},{"line_number":42,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3acd31a7_1941b6a9","line":39,"in_reply_to":"3acd31a7_ac9605ee","updated":"2015-05-04 16:05:00.000000000","message":"Done","commit_id":"a1888eab6c8c4c24914daaf5f64adf3db59a86f5"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"83ea8b105bb3c51e09c794a0c71055f158c11449","unresolved":false,"context_lines":[{"line_number":88,"context_line":"         port INT NOT NULL,"},{"line_number":89,"context_line":"         token CHAR(36),"},{"line_number":90,"context_line":"         access_url VARCHAR(255),"},{"line_number":91,"context_line":"         options VARCHAR(255),"},{"line_number":92,"context_line":"         expires DATETIME,"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"         PRIMARY KEY (instance_uuid, host, port),"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3acd31a7_cc7dc1b2","line":91,"updated":"2015-05-04 15:27:27.000000000","message":"Above you say that \"options\" is a dict, but this is not enough room to reliably store a dict. Perhaps this should be a TEXT field and we drop a json blob here, protected by the typed object field?","commit_id":"a1888eab6c8c4c24914daaf5f64adf3db59a86f5"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"39cdb021b7ff2086f8e5f933731394072f260f24","unresolved":false,"context_lines":[{"line_number":88,"context_line":"         port INT NOT NULL,"},{"line_number":89,"context_line":"         token CHAR(36),"},{"line_number":90,"context_line":"         access_url VARCHAR(255),"},{"line_number":91,"context_line":"         options VARCHAR(255),"},{"line_number":92,"context_line":"         expires DATETIME,"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"         PRIMARY KEY (instance_uuid, host, port),"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3acd31a7_27a56ea1","line":91,"in_reply_to":"3acd31a7_cc7dc1b2","updated":"2015-05-04 16:05:00.000000000","message":"Yes sure I saw it and forgot to update that part before to commit, Thank you!","commit_id":"a1888eab6c8c4c24914daaf5f64adf3db59a86f5"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"83ea8b105bb3c51e09c794a0c71055f158c11449","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"    No migration are expected from memcached to the database, during"},{"line_number":104,"context_line":"    the upgrade already connected consoles should continue to work"},{"line_number":105,"context_line":"    until proxy will be restarted."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"REST API impact"},{"line_number":108,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3acd31a7_0c5bb955","line":105,"updated":"2015-05-04 15:27:27.000000000","message":"Does a console proxy restart normally kill all current console connections/tokens?","commit_id":"a1888eab6c8c4c24914daaf5f64adf3db59a86f5"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"39cdb021b7ff2086f8e5f933731394072f260f24","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"    No migration are expected from memcached to the database, during"},{"line_number":104,"context_line":"    the upgrade already connected consoles should continue to work"},{"line_number":105,"context_line":"    until proxy will be restarted."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"REST API impact"},{"line_number":108,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3acd31a7_b9ee42b2","line":105,"in_reply_to":"3acd31a7_0c5bb955","updated":"2015-05-04 16:05:00.000000000","message":"No, tokens are stored in memcached so after a restart clients are disconnected but they can reconnect to the console by using the same token as previously used.\n\nAbout to create a script to migrate already created tokens to the database: Means to scan all active instances then for each instance hit memcached to retrieve the list of tokens and for each tokens hit memcached to retrieve the connect_info dict, then create entry to the database for each connect_info. This is not something so terrible to achieve just thinking about the pain to create and maintain free bugs a script like that VS make clients to consider their tokens have expired. (the default value of a token is 600seconds)","commit_id":"a1888eab6c8c4c24914daaf5f64adf3db59a86f5"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"b50fa6e63f521d2fe5027dd62767159bcc65980f","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"    No migration are expected from memcached to the database, during"},{"line_number":104,"context_line":"    the upgrade already connected consoles should continue to work"},{"line_number":105,"context_line":"    until proxy will be restarted."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"REST API impact"},{"line_number":108,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3acd31a7_d959fe5b","line":105,"in_reply_to":"3acd31a7_b9ee42b2","updated":"2015-05-04 16:11:25.000000000","message":"So how will this script work? We run it after we upgrade the schema, before we restart the proxy service to the new code?\n\nIf we run it and it takes an hour, presumably some of them will be expired before it\u0027s done and people are still requesting new consoles and generating new tokens in memcache, right?\n\nMaybe we need to support reading from memcache, but writing to the db so we can upgrade the schema, upgrade the code, and then do the migration in the background like we did for flavors? Since consoles expire, we wouldn\u0027t need the script as consoles will naturally expire out of memcache and be re-requested and stored in the database.\n\nAlternately, maybe just killing all consoles isn\u0027t a huge deal anyway? If we had some operator feedback that said it\u0027s not a huge deal maybe we just do the cutover and not try to maintain compatibility at all?","commit_id":"a1888eab6c8c4c24914daaf5f64adf3db59a86f5"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"c54ddcf5c44903c4e323c8d15bd006b3065d5f34","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"    No migration are expected from memcached to the database, during"},{"line_number":104,"context_line":"    the upgrade already connected consoles should continue to work"},{"line_number":105,"context_line":"    until proxy will be restarted."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"REST API impact"},{"line_number":108,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3acd31a7_7dae3699","line":105,"in_reply_to":"3acd31a7_d959fe5b","updated":"2015-05-07 12:51:52.000000000","message":"Well i\u0027m in favor of your alternative; means just killing all consoles. Operator will informs in all cases that the console connection will be killed during the upgrade so I do not believe it will makes big pain for user to ask for new token after to have been disconnected.\n\nSo consoleauth is the process responsible to handle the auth and it will be restarted first. It will be able to handle old and new version. That means until proxy are not restarted all we run as before and since a proxy get restarted the switch will happen. I do not think we need to make any compatibility between old and new, consoleauth use API versionning.","commit_id":"a1888eab6c8c4c24914daaf5f64adf3db59a86f5"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"83ea8b105bb3c51e09c794a0c71055f158c11449","unresolved":false,"context_lines":[{"line_number":116,"context_line":"currently tokens are stored in local memory or memcached which both of"},{"line_number":117,"context_line":"them do not provide any security layer. In other terms the security"},{"line_number":118,"context_line":"policy will enhanced to be the same than other critical components"},{"line_number":119,"context_line":"stored in database."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Notifications impact"},{"line_number":122,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3acd31a7_ec307d03","line":119,"updated":"2015-05-04 15:27:27.000000000","message":"On the other hand, we\u0027re storing them in the database, which means they are written to disk, and potentially recoverable through other means. I don\u0027t think this is a problem, but I think it\u0027s probably worth noting.","commit_id":"a1888eab6c8c4c24914daaf5f64adf3db59a86f5"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"39cdb021b7ff2086f8e5f933731394072f260f24","unresolved":false,"context_lines":[{"line_number":116,"context_line":"currently tokens are stored in local memory or memcached which both of"},{"line_number":117,"context_line":"them do not provide any security layer. In other terms the security"},{"line_number":118,"context_line":"policy will enhanced to be the same than other critical components"},{"line_number":119,"context_line":"stored in database."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Notifications impact"},{"line_number":122,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3acd31a7_1922d652","line":119,"in_reply_to":"3acd31a7_ec307d03","updated":"2015-05-04 16:05:00.000000000","message":"Done","commit_id":"a1888eab6c8c4c24914daaf5f64adf3db59a86f5"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"cb02fd5193021583b2944db571f9794dbfdcd6a8","unresolved":false,"context_lines":[{"line_number":36,"context_line":"particular port from a number of perspectives: from the compute node, to"},{"line_number":37,"context_line":"return the next port defined and not connected; from the proxy to"},{"line_number":38,"context_line":"reject new connections on already connected port from the API to"},{"line_number":39,"context_line":"let user informed no more port are available."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Use Cases"},{"line_number":42,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9a0c5dc1_f5e1bbd1","line":39,"updated":"2015-05-12 10:48:09.000000000","message":"It seems you are actually saying drop the use of memcache and use the DB instead?\n\nI was expecting to see, persist the objects into either the DB or memcache?\n\nIs that really what we want to do here?","commit_id":"a33ee2e74dd39f1ec7e38a1ec2b00ff3ec5a8d70"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"cb02fd5193021583b2944db571f9794dbfdcd6a8","unresolved":false,"context_lines":[{"line_number":74,"context_line":"- instance: an instance which refer the console"},{"line_number":75,"context_line":"- host: a string field to handle hostname"},{"line_number":76,"context_line":"- port: an int field to handle service number"},{"line_number":77,"context_line":"- token: a string field to handle a token or null"},{"line_number":78,"context_line":"- access_url: a string field to handle access or null"},{"line_number":79,"context_line":"- options: a dict field to handle particular information like usetls,"},{"line_number":80,"context_line":"  internal_access_path, mode..."}],"source_content_type":"text/x-rst","patch_set":9,"id":"9a0c5dc1_15632f1c","line":77,"updated":"2015-05-12 10:48:09.000000000","message":"Should we actually only store a hash of the token in the DB?","commit_id":"a33ee2e74dd39f1ec7e38a1ec2b00ff3ec5a8d70"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"cb02fd5193021583b2944db571f9794dbfdcd6a8","unresolved":false,"context_lines":[{"line_number":89,"context_line":"         token CHAR(36),"},{"line_number":90,"context_line":"         access_url VARCHAR(255),"},{"line_number":91,"context_line":"         options TEXT,"},{"line_number":92,"context_line":"         expires DATETIME,"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"         PRIMARY KEY (instance_uuid, host, port),"},{"line_number":95,"context_line":"         INDEX (token),"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9a0c5dc1_b5ec6390","line":92,"updated":"2015-05-12 10:48:09.000000000","message":"Just to confirm, I am guessing there is no soft_delete here on purpose.\n\nI am fine with that, but its worth stating.","commit_id":"a33ee2e74dd39f1ec7e38a1ec2b00ff3ec5a8d70"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"497528ff0e059fff8f48ac57e8dcd060f5abf7f0","unresolved":false,"context_lines":[{"line_number":89,"context_line":"         token CHAR(36),"},{"line_number":90,"context_line":"         access_url VARCHAR(255),"},{"line_number":91,"context_line":"         options TEXT,"},{"line_number":92,"context_line":"         expires DATETIME,"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"         PRIMARY KEY (instance_uuid, host, port),"},{"line_number":95,"context_line":"         INDEX (token),"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9a0c5dc1_c2f6f5d6","line":92,"in_reply_to":"9a0c5dc1_b5ec6390","updated":"2015-05-12 13:59:32.000000000","message":"It\"s not necessary to store a soft_delete here, the aim of token is to be used one time then when expired never be used again.","commit_id":"a33ee2e74dd39f1ec7e38a1ec2b00ff3ec5a8d70"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"e56b40bc41179d47432c93679717b9e5f9a90905","unresolved":false,"context_lines":[{"line_number":89,"context_line":"         token CHAR(36),"},{"line_number":90,"context_line":"         access_url VARCHAR(255),"},{"line_number":91,"context_line":"         options TEXT,"},{"line_number":92,"context_line":"         expires DATETIME,"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"         PRIMARY KEY (instance_uuid, host, port),"},{"line_number":95,"context_line":"         INDEX (token),"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9a0c5dc1_28e8ece1","line":92,"in_reply_to":"9a0c5dc1_c2f6f5d6","updated":"2015-05-13 08:57:13.000000000","message":"agreed, just its worth stating that explicitly I think.","commit_id":"a33ee2e74dd39f1ec7e38a1ec2b00ff3ec5a8d70"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"cb02fd5193021583b2944db571f9794dbfdcd6a8","unresolved":false,"context_lines":[{"line_number":96,"context_line":"         FOREIGN KEY (instance_uuid)"},{"line_number":97,"context_line":"           REFERENCES instances(uuid)"},{"line_number":98,"context_line":"           ON DELETE CASCADE"},{"line_number":99,"context_line":"    );"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":".. note::"},{"line_number":102,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"9a0c5dc1_d56c770a","line":99,"updated":"2015-05-12 10:48:09.000000000","message":"I suspect we will need an index, but probably best to ignore that for now.","commit_id":"a33ee2e74dd39f1ec7e38a1ec2b00ff3ec5a8d70"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"497528ff0e059fff8f48ac57e8dcd060f5abf7f0","unresolved":false,"context_lines":[{"line_number":96,"context_line":"         FOREIGN KEY (instance_uuid)"},{"line_number":97,"context_line":"           REFERENCES instances(uuid)"},{"line_number":98,"context_line":"           ON DELETE CASCADE"},{"line_number":99,"context_line":"    );"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":".. note::"},{"line_number":102,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"9a0c5dc1_82d8fd1e","line":99,"in_reply_to":"9a0c5dc1_d56c770a","updated":"2015-05-12 13:59:32.000000000","message":"Hum, you probably mean about the foreign key and so create an index on instance_uuid. Well I guess you are right but i will be happy to get comment from Jay about it. I do not know if when we index a primary key with multiple fields that will create several one or not.","commit_id":"a33ee2e74dd39f1ec7e38a1ec2b00ff3ec5a8d70"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"cb02fd5193021583b2944db571f9794dbfdcd6a8","unresolved":false,"context_lines":[{"line_number":119,"context_line":"currently tokens are stored in memcached which does not provide any"},{"line_number":120,"context_line":"security layer. In other terms the security policy will enhanced to be"},{"line_number":121,"context_line":"the same than other critical components stored in database. A special"},{"line_number":122,"context_line":"regard has to be done since now token are written in the disk."},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Notifications impact"},{"line_number":125,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9a0c5dc1_d59eb706","line":122,"updated":"2015-05-12 10:48:09.000000000","message":"Sorry, not sure I understand the comments here?\n\nTalking about storing the token on disk. Can we get away with only storing a hash of the token instead?","commit_id":"a33ee2e74dd39f1ec7e38a1ec2b00ff3ec5a8d70"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"e56b40bc41179d47432c93679717b9e5f9a90905","unresolved":false,"context_lines":[{"line_number":119,"context_line":"currently tokens are stored in memcached which does not provide any"},{"line_number":120,"context_line":"security layer. In other terms the security policy will enhanced to be"},{"line_number":121,"context_line":"the same than other critical components stored in database. A special"},{"line_number":122,"context_line":"regard has to be done since now token are written in the disk."},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Notifications impact"},{"line_number":125,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9a0c5dc1_287d8c1c","line":122,"in_reply_to":"9a0c5dc1_a2aae117","updated":"2015-05-13 08:57:13.000000000","message":"I was thinking, if you have the token in the DB, and you get access to the DB, you could use the token if you get access to only the hash, its no use to an attacker.","commit_id":"a33ee2e74dd39f1ec7e38a1ec2b00ff3ec5a8d70"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"497528ff0e059fff8f48ac57e8dcd060f5abf7f0","unresolved":false,"context_lines":[{"line_number":119,"context_line":"currently tokens are stored in memcached which does not provide any"},{"line_number":120,"context_line":"security layer. In other terms the security policy will enhanced to be"},{"line_number":121,"context_line":"the same than other critical components stored in database. A special"},{"line_number":122,"context_line":"regard has to be done since now token are written in the disk."},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Notifications impact"},{"line_number":125,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9a0c5dc1_a2aae117","line":122,"in_reply_to":"9a0c5dc1_d59eb706","updated":"2015-05-12 13:59:32.000000000","message":"Well i added this line referring a comment from Dan BUT I can have made a mistake to understand what he tried to tell me :)\n\nHum about storing only a hash I do not believe we will earn something about security since we can consider a token as a hash, can you give me more information about what you mean here? Also I would like to double indicate that mysql provides a security layer than memcached does not so we will surly enhance security here.","commit_id":"a33ee2e74dd39f1ec7e38a1ec2b00ff3ec5a8d70"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"cb02fd5193021583b2944db571f9794dbfdcd6a8","unresolved":false,"context_lines":[{"line_number":141,"context_line":""},{"line_number":142,"context_line":"The consoleauth service must be restarted before proxy services. When"},{"line_number":143,"context_line":"proxy will be restarted clients will be disconnected from consoles and"},{"line_number":144,"context_line":"tokens previously activated will be revoked."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"Developer impact"},{"line_number":147,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9a0c5dc1_5576473f","line":144,"updated":"2015-05-12 10:48:09.000000000","message":"Can\u0027t we do better than that?\n\nWe could have memcache as an optional persistence layer instead of the DB.\n\nDuring the migration period, the DB back end could check if a token is in memcache, if its not found in the DB, as a kind of fallback during the migration.","commit_id":"a33ee2e74dd39f1ec7e38a1ec2b00ff3ec5a8d70"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"e56b40bc41179d47432c93679717b9e5f9a90905","unresolved":false,"context_lines":[{"line_number":141,"context_line":""},{"line_number":142,"context_line":"The consoleauth service must be restarted before proxy services. When"},{"line_number":143,"context_line":"proxy will be restarted clients will be disconnected from consoles and"},{"line_number":144,"context_line":"tokens previously activated will be revoked."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"Developer impact"},{"line_number":147,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9a0c5dc1_0893e85c","line":144,"in_reply_to":"9a0c5dc1_25415b0c","updated":"2015-05-13 08:57:13.000000000","message":"we have set quite high expectations on upgrade at this point.\n\nif its easy to get around that, they I think its probably useful.","commit_id":"a33ee2e74dd39f1ec7e38a1ec2b00ff3ec5a8d70"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"497528ff0e059fff8f48ac57e8dcd060f5abf7f0","unresolved":false,"context_lines":[{"line_number":141,"context_line":""},{"line_number":142,"context_line":"The consoleauth service must be restarted before proxy services. When"},{"line_number":143,"context_line":"proxy will be restarted clients will be disconnected from consoles and"},{"line_number":144,"context_line":"tokens previously activated will be revoked."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"Developer impact"},{"line_number":147,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9a0c5dc1_25415b0c","line":144,"in_reply_to":"9a0c5dc1_5576473f","updated":"2015-05-12 13:59:32.000000000","message":"Well as I said before, tokens as an expiration time so users are aware of that their tokens can expires. We will add a layer of code (potentially with bugs) to handle a case not so \"important\"(do not have other word in english) since users will be disconnected in all cases.\n\nBUT since Dan and you gave to me complaints about that case perhaps I should handle it? :)","commit_id":"a33ee2e74dd39f1ec7e38a1ec2b00ff3ec5a8d70"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"8c38e48131b4152bd8b14a71d3935fae4368aacf","unresolved":false,"context_lines":[{"line_number":63,"context_line":"* Define schema and API to store Console object in database"},{"line_number":64,"context_line":"* Update code to store Console with valid token in database instead of"},{"line_number":65,"context_line":"  a cache"},{"line_number":66,"context_line":"* Define a periodic task to clean expired Console"},{"line_number":67,"context_line":"* Fix bug 1425640"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3afb71cf_af548bfe","line":66,"updated":"2015-06-09 13:48:53.000000000","message":"Who does the cleaning up of the console tokens?","commit_id":"ff1fa2971652169ffcae3e954b323edc011cb0b6"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"2d24021d0758c770587e2c20702ed87cda83ac40","unresolved":false,"context_lines":[{"line_number":63,"context_line":"* Define schema and API to store Console object in database"},{"line_number":64,"context_line":"* Update code to store Console with valid token in database instead of"},{"line_number":65,"context_line":"  a cache"},{"line_number":66,"context_line":"* Define a periodic task to clean expired Console"},{"line_number":67,"context_line":"* Fix bug 1425640"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3afb71cf_47a7daa6","line":66,"in_reply_to":"3afb71cf_af548bfe","updated":"2015-06-11 10:33:48.000000000","message":"I will update this point to indicate that: compute nodes will be responsible to clean the connection_info objects for guests they host.","commit_id":"ff1fa2971652169ffcae3e954b323edc011cb0b6"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"8c38e48131b4152bd8b14a71d3935fae4368aacf","unresolved":false,"context_lines":[{"line_number":69,"context_line":"Alternatives"},{"line_number":70,"context_line":"------------"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"None"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Data model impact"},{"line_number":75,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3afb71cf_af3ecb89","line":72,"updated":"2015-06-09 13:48:53.000000000","message":"We could just persist in memcache still, as a json blob, I think?\n\nIt would be good to discuss that, given another proposal looks ad matching the DB backend optional.","commit_id":"ff1fa2971652169ffcae3e954b323edc011cb0b6"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"2d24021d0758c770587e2c20702ed87cda83ac40","unresolved":false,"context_lines":[{"line_number":69,"context_line":"Alternatives"},{"line_number":70,"context_line":"------------"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"None"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Data model impact"},{"line_number":75,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3afb71cf_67dad618","line":72,"in_reply_to":"3afb71cf_5a7033dc","updated":"2015-06-11 10:33:48.000000000","message":"Also I do not think we can talk about persistence with memcached it\u0027s an LRU cache not a datastore. I will add note.","commit_id":"ff1fa2971652169ffcae3e954b323edc011cb0b6"},{"author":{"_account_id":11303,"name":"Markus Zoeller (markus_z)","email":"mzoeller@linux.vnet.ibm.com","username":"mzoeller"},"change_message_id":"3d1f4cb25f8058051c925571d4781ae5d5f64d95","unresolved":false,"context_lines":[{"line_number":69,"context_line":"Alternatives"},{"line_number":70,"context_line":"------------"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"None"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Data model impact"},{"line_number":75,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3afb71cf_5a7033dc","line":72,"in_reply_to":"3afb71cf_af3ecb89","updated":"2015-06-09 14:12:04.000000000","message":"@John Garbutt:\nDuring the live-migration of an instance which uses a serial console, the port number might have to be changed because it is already used by another instance on the target host. Maybe this is easier with a database approach, I\u0027m not sure. Right now the live-migration can be blocked by the serial console [1].\n\n[1] https://bugs.launchpad.net/nova/+bug/1455252","commit_id":"ff1fa2971652169ffcae3e954b323edc011cb0b6"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"8c38e48131b4152bd8b14a71d3935fae4368aacf","unresolved":false,"context_lines":[{"line_number":85,"context_line":"  internal_access_path, mode..."},{"line_number":86,"context_line":"- expires: a date time to indicate when the token expires or null"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"The database schema ::"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"    CREATE TABLE console_connection ("},{"line_number":91,"context_line":"         instance_uuid CHAR(36) NOT NULL,"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3afb71cf_ef8ba366","line":88,"updated":"2015-06-09 13:48:53.000000000","message":"I was wondering if this should be in the API database, I think thats actually a bad idea, and the cell database is the correct place to go.\n\nBut I wanted to added this note to see if the other reviewers agree with me.","commit_id":"ff1fa2971652169ffcae3e954b323edc011cb0b6"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"8c38e48131b4152bd8b14a71d3935fae4368aacf","unresolved":false,"context_lines":[{"line_number":111,"context_line":"    proxy will be restarted. At this step we expect to have the"},{"line_number":112,"context_line":"    consoleauth service to also have been restarted. Users precedently"},{"line_number":113,"context_line":"    disconnected can reuse the same token to reconnect the consoles if"},{"line_number":114,"context_line":"    not already expired."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"REST API impact"},{"line_number":117,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3afb71cf_cf28e788","line":114,"updated":"2015-06-09 13:48:53.000000000","message":"I would have put this in alternatives actually, but it reads nicely here, so thats fine with me.","commit_id":"ff1fa2971652169ffcae3e954b323edc011cb0b6"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"8c38e48131b4152bd8b14a71d3935fae4368aacf","unresolved":false,"context_lines":[{"line_number":142,"context_line":"Performance Impact"},{"line_number":143,"context_line":"------------------"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"None"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"Other deployer impact"},{"line_number":148,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3afb71cf_efe2832e","line":145,"updated":"2015-06-09 13:48:53.000000000","message":"This will increase DB load. I am guessing not massively, but its an increase.","commit_id":"ff1fa2971652169ffcae3e954b323edc011cb0b6"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"2d24021d0758c770587e2c20702ed87cda83ac40","unresolved":false,"context_lines":[{"line_number":142,"context_line":"Performance Impact"},{"line_number":143,"context_line":"------------------"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"None"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"Other deployer impact"},{"line_number":148,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3afb71cf_59bd7e00","line":145,"in_reply_to":"3afb71cf_efe2832e","updated":"2015-06-11 10:33:48.000000000","message":"Done","commit_id":"ff1fa2971652169ffcae3e954b323edc011cb0b6"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"8c38e48131b4152bd8b14a71d3935fae4368aacf","unresolved":false,"context_lines":[{"line_number":149,"context_line":""},{"line_number":150,"context_line":"The consoleauth service must be restarted before proxy services. When"},{"line_number":151,"context_line":"proxy will be restarted clients will be disconnected from consoles."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Developer impact"},{"line_number":154,"context_line":"----------------"},{"line_number":155,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3afb71cf_0f54bfc7","line":152,"updated":"2015-06-09 13:48:53.000000000","message":"If they were using shared memcache, this is no longer used.\n\nWe might want to mention that here I think.","commit_id":"ff1fa2971652169ffcae3e954b323edc011cb0b6"},{"author":{"_account_id":5511,"name":"Nikola Dipanov","email":"ndipanov@redhat.com","username":"ndipanov"},"change_message_id":"96e709338528c1ca76c58d5abdcd8d28e86de4a9","unresolved":false,"context_lines":[{"line_number":30,"context_line":"expire before that limit (eviction). By using the framework objects"},{"line_number":31,"context_line":"we can get the opportunity to store the whole state of Console object"},{"line_number":32,"context_line":"with a valid token in the database and share the state between"},{"line_number":33,"context_line":"process."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"For instance bug 1425640 needs to know when an user is connected to a"},{"line_number":36,"context_line":"particular port from a number of perspectives: from the compute node, to"}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa32b979_3a9ef9b8","line":33,"updated":"2015-06-22 09:49:56.000000000","message":"I am not sure I like this idea - TBH this just seems too \"virt manager\"-y.\n\nWhat happens with these after migration for example. They will be invalid, but still in the DB.\n\nOne more issue - how do we handle expired but still connected sessions (we don\u0027t disconnect those afaik)\n\nI think best effort here is more than enough.","commit_id":"91d877e1ebe8eff494570843b041b8e7c59b43e1"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"9afae918b36e9e14ab9bf4f395f45494945c904e","unresolved":false,"context_lines":[{"line_number":30,"context_line":"expire before that limit (eviction). By using the framework objects"},{"line_number":31,"context_line":"we can get the opportunity to store the whole state of Console object"},{"line_number":32,"context_line":"with a valid token in the database and share the state between"},{"line_number":33,"context_line":"process."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"For instance bug 1425640 needs to know when an user is connected to a"},{"line_number":36,"context_line":"particular port from a number of perspectives: from the compute node, to"}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa32b979_30b92d7a","line":33,"in_reply_to":"fa32b979_3a9ef9b8","updated":"2015-06-22 14:33:58.000000000","message":"Hum what d you mean by \"virt manager -y\" ?\n\nAbout your two points:\n1/ A periodic task is used as garbage collector\n2/ Hum this seems to be not related to that spec. is there a bug related to this case?","commit_id":"91d877e1ebe8eff494570843b041b8e7c59b43e1"},{"author":{"_account_id":5511,"name":"Nikola Dipanov","email":"ndipanov@redhat.com","username":"ndipanov"},"change_message_id":"96e709338528c1ca76c58d5abdcd8d28e86de4a9","unresolved":false,"context_lines":[{"line_number":38,"context_line":"reject new connections on already connected port from the API to"},{"line_number":39,"context_line":"let user informed no more port are available."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"We will also enhance security by only storing SHA-1 of tokens in the"},{"line_number":42,"context_line":"database after to have returned the clean one to the users. Then when"},{"line_number":43,"context_line":"users will request to connect a console the token passed will be"},{"line_number":44,"context_line":"hashed and compared to the one stored in the database for validation."}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa32b979_07c5df59","line":41,"updated":"2015-06-22 09:49:56.000000000","message":"Is there a particular reason to use SHA-1.\n\nFar from a crypto expert here, but common knowledge nowadays seems to be bcrypt or scrypt for this kind of stuff.\n\nIn reality - I am not sure any of this is too relevant as these are temporary tokens so not sure what leaking them from the storage means.","commit_id":"91d877e1ebe8eff494570843b041b8e7c59b43e1"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"9afae918b36e9e14ab9bf4f395f45494945c904e","unresolved":false,"context_lines":[{"line_number":38,"context_line":"reject new connections on already connected port from the API to"},{"line_number":39,"context_line":"let user informed no more port are available."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"We will also enhance security by only storing SHA-1 of tokens in the"},{"line_number":42,"context_line":"database after to have returned the clean one to the users. Then when"},{"line_number":43,"context_line":"users will request to connect a console the token passed will be"},{"line_number":44,"context_line":"hashed and compared to the one stored in the database for validation."}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa32b979_cb6852bd","line":41,"in_reply_to":"fa32b979_07c5df59","updated":"2015-06-22 14:33:58.000000000","message":"SHA-1 will be used with a salt here. This security point of view can probably be discussed during the code review\n\nThis was discussed in the history on the review and your point was one of mine too. We want to take opportunity to enhance security which I guess is good.","commit_id":"91d877e1ebe8eff494570843b041b8e7c59b43e1"},{"author":{"_account_id":5511,"name":"Nikola Dipanov","email":"ndipanov@redhat.com","username":"ndipanov"},"change_message_id":"96e709338528c1ca76c58d5abdcd8d28e86de4a9","unresolved":false,"context_lines":[{"line_number":66,"context_line":"* Define a periodic task to clean expired object stored in database;"},{"line_number":67,"context_line":"  To balance the load and avoid blocking the database during too much"},{"line_number":68,"context_line":"  time each compute nodes will be responsible to clean connection_info"},{"line_number":69,"context_line":"  for guests they host."},{"line_number":70,"context_line":"* Fix bug 1425640"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa32b979_a703d375","line":69,"updated":"2015-06-22 09:49:56.000000000","message":"Since this will not use the standard Nova soft-delete mechanism, it would be good to discuss how these deletes would work.","commit_id":"91d877e1ebe8eff494570843b041b8e7c59b43e1"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"9afae918b36e9e14ab9bf4f395f45494945c904e","unresolved":false,"context_lines":[{"line_number":66,"context_line":"* Define a periodic task to clean expired object stored in database;"},{"line_number":67,"context_line":"  To balance the load and avoid blocking the database during too much"},{"line_number":68,"context_line":"  time each compute nodes will be responsible to clean connection_info"},{"line_number":69,"context_line":"  for guests they host."},{"line_number":70,"context_line":"* Fix bug 1425640"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa32b979_30e04dfa","line":69,"in_reply_to":"fa32b979_a703d375","updated":"2015-06-22 14:33:58.000000000","message":"I guess we can discuss about that during the code reviews, actually this periodic task  is to ensure we do a maintenance since when we delete an instance we also delete potential connection_info related.","commit_id":"91d877e1ebe8eff494570843b041b8e7c59b43e1"},{"author":{"_account_id":5511,"name":"Nikola Dipanov","email":"ndipanov@redhat.com","username":"ndipanov"},"change_message_id":"96e709338528c1ca76c58d5abdcd8d28e86de4a9","unresolved":false,"context_lines":[{"line_number":67,"context_line":"  To balance the load and avoid blocking the database during too much"},{"line_number":68,"context_line":"  time each compute nodes will be responsible to clean connection_info"},{"line_number":69,"context_line":"  for guests they host."},{"line_number":70,"context_line":"* Fix bug 1425640"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa32b979_3d091632","line":70,"updated":"2015-06-22 09:49:56.000000000","message":"So I left a comment on this bug - I don\u0027t think we need to go so far as this BP to fix this for the normal use case actually.","commit_id":"91d877e1ebe8eff494570843b041b8e7c59b43e1"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"9afae918b36e9e14ab9bf4f395f45494945c904e","unresolved":false,"context_lines":[{"line_number":67,"context_line":"  To balance the load and avoid blocking the database during too much"},{"line_number":68,"context_line":"  time each compute nodes will be responsible to clean connection_info"},{"line_number":69,"context_line":"  for guests they host."},{"line_number":70,"context_line":"* Fix bug 1425640"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa32b979_d0dd6171","line":70,"in_reply_to":"fa32b979_3d091632","updated":"2015-06-22 14:33:58.000000000","message":"I replied to your comment on the bug report. Actually it\u0027s not so easy.","commit_id":"91d877e1ebe8eff494570843b041b8e7c59b43e1"},{"author":{"_account_id":5511,"name":"Nikola Dipanov","email":"ndipanov@redhat.com","username":"ndipanov"},"change_message_id":"96e709338528c1ca76c58d5abdcd8d28e86de4a9","unresolved":false,"context_lines":[{"line_number":108,"context_line":"         FOREIGN KEY (instance_uuid)"},{"line_number":109,"context_line":"           REFERENCES instances(uuid)"},{"line_number":110,"context_line":"           ON DELETE CASCADE"},{"line_number":111,"context_line":"    );"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":".. note::"},{"line_number":114,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa32b979_3d74b6cd","line":111,"updated":"2015-06-22 09:49:56.000000000","message":"So it would be interesting to see how this will be queried.","commit_id":"91d877e1ebe8eff494570843b041b8e7c59b43e1"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"9afae918b36e9e14ab9bf4f395f45494945c904e","unresolved":false,"context_lines":[{"line_number":108,"context_line":"         FOREIGN KEY (instance_uuid)"},{"line_number":109,"context_line":"           REFERENCES instances(uuid)"},{"line_number":110,"context_line":"           ON DELETE CASCADE"},{"line_number":111,"context_line":"    );"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":".. note::"},{"line_number":114,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"fa32b979_7007b581","line":111,"in_reply_to":"fa32b979_3d74b6cd","updated":"2015-06-22 14:33:58.000000000","message":"What do you mean? Without to implement code it\u0027s kind of difficult to be 100% no other indexes will be required yes","commit_id":"91d877e1ebe8eff494570843b041b8e7c59b43e1"},{"author":{"_account_id":5511,"name":"Nikola Dipanov","email":"ndipanov@redhat.com","username":"ndipanov"},"change_message_id":"61cea03be534684c9b8788dc8f52468d64483759","unresolved":false,"context_lines":[{"line_number":38,"context_line":"reject new connections on already connected port from the API to"},{"line_number":39,"context_line":"let user informed no more port are available."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"We will also enhance security by only storing SHA-1 of tokens in the"},{"line_number":42,"context_line":"database after to have returned the clean one to the users. Then when"},{"line_number":43,"context_line":"users will request to connect a console the token passed will be"},{"line_number":44,"context_line":"hashed and compared to the one stored in the database for validation."}],"source_content_type":"text/x-rst","patch_set":14,"id":"ba3cc151_ab50fd32","line":41,"updated":"2015-07-02 13:19:39.000000000","message":"as commented on previous PSs - this is probably not the best hash to use but let\u0027s defer to the implementation on this.","commit_id":"ff183eff15d2294ce0ecf64418b00270acc890a9"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"1c7db5a08011130e675e49cf7b3bbcfa36f86816","unresolved":false,"context_lines":[{"line_number":38,"context_line":"reject new connections on already connected port from the API to"},{"line_number":39,"context_line":"let user informed no more port are available."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"We will also enhance security by only storing SHA-1 of tokens in the"},{"line_number":42,"context_line":"database after to have returned the clean one to the users. Then when"},{"line_number":43,"context_line":"users will request to connect a console the token passed will be"},{"line_number":44,"context_line":"hashed and compared to the one stored in the database for validation."}],"source_content_type":"text/x-rst","patch_set":14,"id":"ba3cc151_d93893d5","line":41,"in_reply_to":"ba3cc151_ab50fd32","updated":"2015-07-03 06:25:20.000000000","message":"Yes thank you i will be aware of your requests during the review about the hash.","commit_id":"ff183eff15d2294ce0ecf64418b00270acc890a9"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"9009ec84918d7e88df16bb341fc346f35ca260da","unresolved":false,"context_lines":[{"line_number":38,"context_line":"reject new connections on already connected port from the API to"},{"line_number":39,"context_line":"let user informed no more port are available."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"We will also enhance security by only storing SHA-1 of tokens in the"},{"line_number":42,"context_line":"database after to have returned the clean one to the users. Then when"},{"line_number":43,"context_line":"users will request to connect a console the token passed will be"},{"line_number":44,"context_line":"hashed and compared to the one stored in the database for validation."}],"source_content_type":"text/x-rst","patch_set":14,"id":"ba3cc151_3f539c18","line":41,"in_reply_to":"ba3cc151_d93893d5","updated":"2015-07-03 12:30:27.000000000","message":"+1 \"a hash\" would be a better level of detail, but thats a nit.","commit_id":"ff183eff15d2294ce0ecf64418b00270acc890a9"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"9009ec84918d7e88df16bb341fc346f35ca260da","unresolved":false,"context_lines":[{"line_number":47,"context_line":"allow operator to switch between different backends. The scope of this"},{"line_number":48,"context_line":"spec will allow 2 backends (memcached, database) The memcached backend"},{"line_number":49,"context_line":"will be implemented for legacy compatibility but in a deprecated"},{"line_number":50,"context_line":"status, supported for one release."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Use Cases"},{"line_number":53,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"ba3cc151_7f45a440","line":50,"updated":"2015-07-03 12:30:27.000000000","message":"Thanks for this addition, I think thats important.\n\nWe can get feedback on whats useful.","commit_id":"ff183eff15d2294ce0ecf64418b00270acc890a9"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"9009ec84918d7e88df16bb341fc346f35ca260da","unresolved":false,"context_lines":[{"line_number":199,"context_line":""},{"line_number":200,"context_line":"The current code is already tested by functional and unit tests since"},{"line_number":201,"context_line":"we do not provide any feature we can consider that the code will be"},{"line_number":202,"context_line":"well covered by tests."},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"Documentation Impact"},{"line_number":205,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":14,"id":"ba3cc151_3fa15cf8","line":202,"updated":"2015-07-03 12:30:27.000000000","message":"Nit: I would love to see here a note saying the gate will start testing the new non-deprecated version.\n\nAnd ideally one of check jobs would still check the old memcache impl?","commit_id":"ff183eff15d2294ce0ecf64418b00270acc890a9"}],"specs/liberty/convert-consoles-to-objects.rst":[{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"4640601653213b9051887ac37a0454f7ad810844","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"The current code does not provide any mechanism to handle versionning"},{"line_number":24,"context_line":"also since rpc cannot handle class derrived from the Python object"},{"line_number":25,"context_line":"type, we need to handle a dict \"connect_info\" between process and no"},{"line_number":26,"context_line":"way are provided to share data between process."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"An other problem comes with token, memcached is not a database and"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a80dd14_8256905c","line":25,"updated":"2015-03-19 14:27:11.000000000","message":"between rpc","commit_id":"b38a7c29db8ab2f9825be4fbe799439a80a70fb7"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"4640601653213b9051887ac37a0454f7ad810844","unresolved":false,"context_lines":[{"line_number":23,"context_line":"The current code does not provide any mechanism to handle versionning"},{"line_number":24,"context_line":"also since rpc cannot handle class derrived from the Python object"},{"line_number":25,"context_line":"type, we need to handle a dict \"connect_info\" between process and no"},{"line_number":26,"context_line":"way are provided to share data between process."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"An other problem comes with token, memcached is not a database and"},{"line_number":29,"context_line":"cannot quarantee that the expire time will be respected, a token can"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a80dd14_02e1c09a","line":26,"updated":"2015-03-19 14:27:11.000000000","message":"to share the state of a console across processes","commit_id":"b38a7c29db8ab2f9825be4fbe799439a80a70fb7"}]}