)]}'
{"specs/backlog/approved/fetch-hostkey.rst":[{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"91b02bf96fdb21ba19a02d7f4b2117b25e282e4b","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"The code implementing the actual dispatch would need to be in nova-network"},{"line_number":60,"context_line":"and neutron, as those are the only things that can have an expectation of"},{"line_number":61,"context_line":"network access to the guest."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"The API call will take a \"port\" parameter in case the user knows that they"},{"line_number":64,"context_line":"have set up an image to run ssh on a non-standard port."}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a2ca52d_c718fc20","line":61,"updated":"2015-10-15 22:28:38.000000000","message":"Wait, so we have to have something in neutron to implement this? So we have a blocking nova-api call that calls over to neutron and blocks for a timeout interval? Presumably on the neutron side that means a blocking rpc call back to the compute agent or something? That\u0027s a lot of things waiting on things.\n\nSince I voted for async in the last revision, how about we ask neutron to do that thing, and then it can send us an async notification to tell us it\u0027s done (or failed). We have those. We can persist it for our own API once we do that.\n\nEven still that seems complex and fragile for this level of usefulness.\n\nCan I point out again that we can scrape it out of the console the same way for all network backends? :)","commit_id":"b3b21b38448737e927d91e2e96d97f83ffdfad17"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"dee735b101ab38e199c75c383b75f47bd3ff5904","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"The code implementing the actual dispatch would need to be in nova-network"},{"line_number":60,"context_line":"and neutron, as those are the only things that can have an expectation of"},{"line_number":61,"context_line":"network access to the guest."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"The API call will take a \"port\" parameter in case the user knows that they"},{"line_number":64,"context_line":"have set up an image to run ssh on a non-standard port."}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a2ca52d_aa531c6a","line":61,"in_reply_to":"5a2ca52d_367bff8d","updated":"2015-10-16 17:36:06.000000000","message":"YES!!!! Sorry for not grokking what you were saying. I COMPLETELY agree with you, and will now rewrite this with that in mind.","commit_id":"b3b21b38448737e927d91e2e96d97f83ffdfad17"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"28fa7b6f972c894b90afe4b9aa9b93378de2e24f","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"The code implementing the actual dispatch would need to be in nova-network"},{"line_number":60,"context_line":"and neutron, as those are the only things that can have an expectation of"},{"line_number":61,"context_line":"network access to the guest."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"The API call will take a \"port\" parameter in case the user knows that they"},{"line_number":64,"context_line":"have set up an image to run ssh on a non-standard port."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a29b11f_22e0b528","line":61,"in_reply_to":"5a2ca52d_aa531c6a","updated":"2015-10-21 13:00:36.000000000","message":"Agree with Dan, Nova should probe in an order. I also agree we should try to do this without a config variable and have it just work, and only result to config if we\u0027ve got deployers that break in odd ways.","commit_id":"b3b21b38448737e927d91e2e96d97f83ffdfad17"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"3641fc5399d289a0fc51cc09c4b12219231a16f8","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"The code implementing the actual dispatch would need to be in nova-network"},{"line_number":60,"context_line":"and neutron, as those are the only things that can have an expectation of"},{"line_number":61,"context_line":"network access to the guest."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"The API call will take a \"port\" parameter in case the user knows that they"},{"line_number":64,"context_line":"have set up an image to run ssh on a non-standard port."}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a2ca52d_f1791683","line":61,"in_reply_to":"5a2ca52d_c718fc20","updated":"2015-10-16 14:57:01.000000000","message":"I think async is a great idea - I\u0027m sorry I missed your vote for that in the last revision. I agree - blocking calls waiting on rpc systems on the backend is crazy. I\u0027ll cut a new rev.\n\nWhen you say \"we can scrape it out of the console\" ... are you suggesting that we have nova scrape the console or the user? Because if that\u0027s what you\u0027re saying, I could totally be down with that. I just don\u0027t think the answer should be \"as a user you need to fetch the console log and grep for magic strings if you want to securely connect to the vm we just launched for you\" :)\n\nMy concern with that though is the same as your concern with instances that have firewalled off port 22 or something - which is that not everyone runs cloud-init in their images (in fact, infra explicitly do not because it breaks things)\n\nSo we have this problem - which is that each of us have a \"simple\" way to get the data  (the cost of actually pinging port 22 is super low if it wasn\u0027t for the weird need to get neutron and rabbit involved) - and neither of our methods will work for everyone. BUT - the main difference all has to do with guest image composition - my method won\u0027t work for you because you have taken action in your image to prevent it. Your method won\u0027t work for me for the same reason. That sounds like a difference that\u0027s reasonable to expect the user to know ... perhaps both the scrape and the ping method should be available and should be a user selectable option?","commit_id":"b3b21b38448737e927d91e2e96d97f83ffdfad17"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"3adc03523893b9a5ade0ae3bc01aabb7b6078d75","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"The code implementing the actual dispatch would need to be in nova-network"},{"line_number":60,"context_line":"and neutron, as those are the only things that can have an expectation of"},{"line_number":61,"context_line":"network access to the guest."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"The API call will take a \"port\" parameter in case the user knows that they"},{"line_number":64,"context_line":"have set up an image to run ssh on a non-standard port."}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a2ca52d_367bff8d","line":61,"in_reply_to":"5a2ca52d_f1791683","updated":"2015-10-16 15:55:25.000000000","message":"I meant to be very clear about this several times, so apologies if I wasn\u0027t.\n\nI mean NOVA should scrape it out on behalf of the user. I think this API should be \"get me the effing host key\" and nova tries whatever mechanisms are available to it to get that for you. Hopefully the multiple approaches means this will actually work almost all of the time, and not just when the network is laid out conveniently.\n\nTo be super clear let me quote the next bit:\n\n \u003eThat sounds like a difference that\u0027s reasonable to expect the user to \n \u003eknow ... perhaps both the scrape and the ping method should be \n \u003eavailable and should be a user selectable option?\n\nI don\u0027t want the user to have to choose. I want to try the mechanisms we have in some order. Scraping the console for the cloud-init way should be something we can do in constant time. Kicking off something to probe the network with a timeout if that fails is a little more complex, but we have mechanisms to do that.\n\nI\u0027d also be fine with a config variable that says \"try the ssh things in this order\", although I don\u0027t really think it\u0027s necessary. I\u0027d say do the constant-time things first (check the console, ask virt driver if it knows via special agent enlightenment) and then if not, start a task to try to probe the network and report the key if it finds it.","commit_id":"b3b21b38448737e927d91e2e96d97f83ffdfad17"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"28fa7b6f972c894b90afe4b9aa9b93378de2e24f","unresolved":false,"context_lines":[{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Request::"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"  GET /v2.x/servers/{server_id}/os-hostkey?port\u003d{port}"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"The port parameter is optional and defaults to 22."},{"line_number":113,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a29b11f_825ae928","line":110,"updated":"2015-10-21 13:00:36.000000000","message":"nit: lets just call it hostkey not os-hostkey, it\u0027s not an os specific construct.","commit_id":"b3b21b38448737e927d91e2e96d97f83ffdfad17"}],"specs/backlog/approved/fetch-ssh-hostkey.rst":[{"author":{"_account_id":12898,"name":"Tony Breeds","email":"tony@bakeyournoodle.com","username":"tonyb"},"change_message_id":"0b8b7cb7c5ec0006bdafd9512413ec607782ebf8","unresolved":false,"context_lines":[{"line_number":113,"context_line":""},{"line_number":114,"context_line":"If a user has their image configured properly with cloud-init or a similar"},{"line_number":115,"context_line":"tool and their OS supports text console output, the console scraping approach"},{"line_number":116,"context_line":"should always work."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"Alternatives"},{"line_number":119,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_7c29229a","line":116,"updated":"2015-10-23 04:45:01.000000000","message":"One way the console scraping approach would fail is if the operator has enabled serial console support.  There are several way around this.  Obviously the simplest would be to remove scraping if that config option is set.","commit_id":"edc1fb04e5cf1e20b54f5397640bf9a6d229b132"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"76b6201ac6e8fd72cb1e0900ff49a0455842c0f9","unresolved":false,"context_lines":[{"line_number":113,"context_line":""},{"line_number":114,"context_line":"If a user has their image configured properly with cloud-init or a similar"},{"line_number":115,"context_line":"tool and their OS supports text console output, the console scraping approach"},{"line_number":116,"context_line":"should always work."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"Alternatives"},{"line_number":119,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_e9a32cb0","line":116,"in_reply_to":"3a29b11f_7c29229a","updated":"2015-10-23 10:22:27.000000000","message":"Wait- console scraping would fail if they\u0027ve enabled it? I don\u0027t follow? (I\u0027m often slow though ...)","commit_id":"edc1fb04e5cf1e20b54f5397640bf9a6d229b132"},{"author":{"_account_id":12898,"name":"Tony Breeds","email":"tony@bakeyournoodle.com","username":"tonyb"},"change_message_id":"0b8b7cb7c5ec0006bdafd9512413ec607782ebf8","unresolved":false,"context_lines":[{"line_number":189,"context_line":""},{"line_number":190,"context_line":"If the cloud cannot fetch a hostkey, if the hostkey has not been fetched,"},{"line_number":191,"context_line":"or if the hostkey is being fetched because the user just requested a fetch,"},{"line_number":192,"context_line":"the value will be an empty list."},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"Because of the two API additions, the change will need a microversion"},{"line_number":195,"context_line":"increase."}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_dc10765b","line":192,"updated":"2015-10-23 04:45:01.000000000","message":"IIUC this would be a silent failure path.  If the user requests a host key and it cannot be retrieved they have no way to detect that.  What about:\n\n    {\"server\":\n      {\n         ...\n         \"ssh-hostkey-status\": \u0027OK\u0027 | \u0027PENDING\u0027 | \u0027ERROR\u0027\n         \"ssh-hostkeys\": [{\n             \"ssh-hostkey-type\": string,\n             \"ssh-hostkey-fingerprint\": string,\n             \"ssh-hostkey\": string\n         }]\n         ...\n      }\n   }\n\nThat way a user can verify that a) the request was received, and that it failed.\n\nDue to the asynchronous nature of the network dispatch, it might be challenging to really detect that failure let alone capture any kind of debug.  I\u0027m not sure is we need to report the failure details to the end user?","commit_id":"edc1fb04e5cf1e20b54f5397640bf9a6d229b132"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"76b6201ac6e8fd72cb1e0900ff49a0455842c0f9","unresolved":false,"context_lines":[{"line_number":189,"context_line":""},{"line_number":190,"context_line":"If the cloud cannot fetch a hostkey, if the hostkey has not been fetched,"},{"line_number":191,"context_line":"or if the hostkey is being fetched because the user just requested a fetch,"},{"line_number":192,"context_line":"the value will be an empty list."},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"Because of the two API additions, the change will need a microversion"},{"line_number":195,"context_line":"increase."}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_89e5d809","line":192,"in_reply_to":"3a29b11f_dc10765b","updated":"2015-10-23 10:22:27.000000000","message":"Yes - I think that\u0027s a great idea","commit_id":"edc1fb04e5cf1e20b54f5397640bf9a6d229b132"},{"author":{"_account_id":12898,"name":"Tony Breeds","email":"tony@bakeyournoodle.com","username":"tonyb"},"change_message_id":"0b8b7cb7c5ec0006bdafd9512413ec607782ebf8","unresolved":false,"context_lines":[{"line_number":244,"context_line":"on it already is a fairly impressive feat these days what with people putting"},{"line_number":245,"context_line":"kitchen sinks all over the place, so if that addition is problematic for"},{"line_number":246,"context_line":"someone, I\u0027ll be happy to personally update their puppet, chef, salt, ansible"},{"line_number":247,"context_line":"or cfengine scripts."},{"line_number":248,"context_line":""},{"line_number":249,"context_line":"Developer impact"},{"line_number":250,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_9cfc3eb9","line":247,"updated":"2015-10-23 04:45:01.000000000","message":"Be careful what you promise :D","commit_id":"edc1fb04e5cf1e20b54f5397640bf9a6d229b132"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"76b6201ac6e8fd72cb1e0900ff49a0455842c0f9","unresolved":false,"context_lines":[{"line_number":244,"context_line":"on it already is a fairly impressive feat these days what with people putting"},{"line_number":245,"context_line":"kitchen sinks all over the place, so if that addition is problematic for"},{"line_number":246,"context_line":"someone, I\u0027ll be happy to personally update their puppet, chef, salt, ansible"},{"line_number":247,"context_line":"or cfengine scripts."},{"line_number":248,"context_line":""},{"line_number":249,"context_line":"Developer impact"},{"line_number":250,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_49eb40dc","line":247,"in_reply_to":"3a29b11f_9cfc3eb9","updated":"2015-10-23 10:22:27.000000000","message":"Listen man - who doesn\u0027t want to update cfengine scripts?","commit_id":"edc1fb04e5cf1e20b54f5397640bf9a6d229b132"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"4a1b55d249f8330bf5b604f7961988dc2f454e64","unresolved":false,"context_lines":[{"line_number":64,"context_line":"  -----BEGIN SSH HOST KEY KEYS-----"},{"line_number":65,"context_line":"  ecdsa-sha2-nistp256 AAAAE2V... root@mordred-irc"},{"line_number":66,"context_line":"  ssh-rsa AAAAB3NzaC1yc2EAAAA... root@mordred-irc"},{"line_number":67,"context_line":"  -----END SSH HOST KEY KEYS-----"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"The second is by connecting to the ssh port and reading the header information"},{"line_number":70,"context_line":"such as via `ssh-keyscan`."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a8ffd7b_35940636","line":67,"updated":"2015-11-24 16:13:34.000000000","message":"I think building a public Nova API that relies on scraping information out of the guest OS console is a pretty horrific thing to do. We currently have a formally specified schema to provide metadata to the guest via config-driver or metadata service, but we place zero requirement on what consumes this data. It may be cloud-init, or it may be a re-implementation of cloud-init, or something else entirely.  I don\u0027t think Nova should be introducing a dependency on the main cloud-init specifically.\n\nIf we want to get this data from the guest, then I think we need a more formally specified mechanism / protocol to get it. That could be a metadata service URL at which the guest can POST back the SSH key or something else TBD.","commit_id":"ecdd9d74e468f459408e72d67d3df93fab875e64"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"39b13e7ea6e998a7c9112db781f644d385b20b41","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"::"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"  ssh-keyscan mordred-irc.inaugust.com"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Which produces output:"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_5b341e49","line":74,"updated":"2015-10-27 02:44:44.000000000","message":"I wrote up how to do this with paramiko ages ago at http://www.stillhq.com/python/paramiko/000005.html\n\nI\u0027d much prefer to use paramiko than add another command line tool to the mix.","commit_id":"ecdd9d74e468f459408e72d67d3df93fab875e64"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"39b13e7ea6e998a7c9112db781f644d385b20b41","unresolved":false,"context_lines":[{"line_number":92,"context_line":"log, or both. The default behavior will be to scrape the console log because"},{"line_number":93,"context_line":"it should work in the majority of the cases. However, not all hypervisor"},{"line_number":94,"context_line":"drivers or guests support text consoles, so as a secondary method for those,"},{"line_number":95,"context_line":"fetching the key over network channels is also an option."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"If the deployer has network layer fulfillment enabled, the request would then"},{"line_number":98,"context_line":"send a message to the network layer and cause the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_bb1692a5","line":95,"updated":"2015-10-27 02:44:44.000000000","message":"Why is scraping the log better than just a socket connection to the SSH server on the instance?","commit_id":"ecdd9d74e468f459408e72d67d3df93fab875e64"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"39b13e7ea6e998a7c9112db781f644d385b20b41","unresolved":false,"context_lines":[{"line_number":121,"context_line":"We could use the paramiko API, however it does not seem that paramiko exposes"},{"line_number":122,"context_line":"a function that allows connecting to the port, grabbing the host key and"},{"line_number":123,"context_line":"returning. It is, quite sensibly, a higher level API than that. I could be"},{"line_number":124,"context_line":"wrong about the missing feature, and/or we could add a patch to paramiko."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"We could add a boot parameter like \"ping-ssh-hostkey\" that would have nova"},{"line_number":127,"context_line":"not move the host to active state until it had succesfully gotten an ssh"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3a29b11f_3b6a821b","line":124,"updated":"2015-10-27 02:44:44.000000000","message":"As mentioned above, the code to do this with paramiko would look something like this:\n\n #!/usr/bin/python\n \n # A host key calculation example for Paramiko.\n # Args:\n #   1: hostname\n \n import base64\n import os\n import paramiko\n import socket\n import sys\n \n # Socket connection to remote host\n sock \u003d socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n sock.connect((sys.argv[1], 22))\n \n # Build a SSH transport\n t \u003d paramiko.Transport(sock)\n t.start_client()\n key \u003d t.get_remote_server_key()\n \n print \u0027%s %s\u0027 %(key.get_name(),\n                 base64.encodestring(key.__str__()).replace(\u0027\\n\u0027, \u0027\u0027))\n\n t.close()\n sock.close()","commit_id":"ecdd9d74e468f459408e72d67d3df93fab875e64"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"4acb290bf0ca34ffa6e534692ebd3ea730e6dd37","unresolved":false,"context_lines":[{"line_number":121,"context_line":"We could use the paramiko API, however it does not seem that paramiko exposes"},{"line_number":122,"context_line":"a function that allows connecting to the port, grabbing the host key and"},{"line_number":123,"context_line":"returning. It is, quite sensibly, a higher level API than that. I could be"},{"line_number":124,"context_line":"wrong about the missing feature, and/or we could add a patch to paramiko."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"We could add a boot parameter like \"ping-ssh-hostkey\" that would have nova"},{"line_number":127,"context_line":"not move the host to active state until it had succesfully gotten an ssh"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a26ad4f_b31038aa","line":124,"in_reply_to":"1a26ad4f_13f24c9b","updated":"2015-10-27 06:53:56.000000000","message":"The issue is not that you can\u0027t have this code it\u0027s what process runs this code. Why are we sure it always had connnectivity in all environments? How do we ensure a trust path so it\u0027s not man in the middled.","commit_id":"ecdd9d74e468f459408e72d67d3df93fab875e64"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"6323e2c063fff62a1dbf56c8caa5c46ab437e4f5","unresolved":false,"context_lines":[{"line_number":121,"context_line":"We could use the paramiko API, however it does not seem that paramiko exposes"},{"line_number":122,"context_line":"a function that allows connecting to the port, grabbing the host key and"},{"line_number":123,"context_line":"returning. It is, quite sensibly, a higher level API than that. I could be"},{"line_number":124,"context_line":"wrong about the missing feature, and/or we could add a patch to paramiko."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"We could add a boot parameter like \"ping-ssh-hostkey\" that would have nova"},{"line_number":127,"context_line":"not move the host to active state until it had succesfully gotten an ssh"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a8ffd7b_2a882522","line":124,"in_reply_to":"1a26ad4f_b31038aa","updated":"2015-11-24 15:57:35.000000000","message":"Cloud-init sends the password back, encrypted using the ssh public key. We could do something similar for the host key, I think thats the approach they talk about here:\nhttps://review.openstack.org/#/c/227686\n\nI am not a massive fan of the log scraping, I am curious what we think about the above idea. It does limit our options where there is no Metadata service, which is less than \"ideal\". But I wonder about a pure injection of a generated host key, for that case (using cloud-init to do the injection).","commit_id":"ecdd9d74e468f459408e72d67d3df93fab875e64"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"a489d491ea0d41526c41aa0fd4af504634ffd4d5","unresolved":false,"context_lines":[{"line_number":121,"context_line":"We could use the paramiko API, however it does not seem that paramiko exposes"},{"line_number":122,"context_line":"a function that allows connecting to the port, grabbing the host key and"},{"line_number":123,"context_line":"returning. It is, quite sensibly, a higher level API than that. I could be"},{"line_number":124,"context_line":"wrong about the missing feature, and/or we could add a patch to paramiko."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"We could add a boot parameter like \"ping-ssh-hostkey\" that would have nova"},{"line_number":127,"context_line":"not move the host to active state until it had succesfully gotten an ssh"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a26ad4f_13f24c9b","line":124,"in_reply_to":"3a29b11f_3b6a821b","updated":"2015-10-27 06:32:09.000000000","message":"who would run this code?","commit_id":"ecdd9d74e468f459408e72d67d3df93fab875e64"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"4a1b55d249f8330bf5b604f7961988dc2f454e64","unresolved":false,"context_lines":[{"line_number":121,"context_line":"We could use the paramiko API, however it does not seem that paramiko exposes"},{"line_number":122,"context_line":"a function that allows connecting to the port, grabbing the host key and"},{"line_number":123,"context_line":"returning. It is, quite sensibly, a higher level API than that. I could be"},{"line_number":124,"context_line":"wrong about the missing feature, and/or we could add a patch to paramiko."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"We could add a boot parameter like \"ping-ssh-hostkey\" that would have nova"},{"line_number":127,"context_line":"not move the host to active state until it had succesfully gotten an ssh"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a8ffd7b_b55b1654","line":124,"in_reply_to":"9a8ffd7b_2a882522","updated":"2015-11-24 16:13:34.000000000","message":"Yep, that review is talking about Nova itself generating the SSH host key and pushing them into the guest via metadata  service / cloud-init.  This avoids the entire problem of having to pulll SSH keys back from the guest.  I think that\u0027s a more desirable architecture than pulling SSH keys back, and waaaaaaay preferrable to log scraping.\n\nI\u0027d suggest taking it further and letting the tenant user have the option to provide a pre-generated SSH key when booting their guest instance.","commit_id":"ecdd9d74e468f459408e72d67d3df93fab875e64"}],"specs/liberty/approved/fetch-ssh-hostkey.rst":[{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"abf19564969847c38da26a10a622585e7e647114","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Not to my knowledge, but the friendly folks over in Infra would really like"},{"line_number":39,"context_line":"to be able to close the loop on key trusting - so perhaps it\u0027s related to the"},{"line_number":40,"context_line":"meta priority \"give infra ponies\"?"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Proposed change"},{"line_number":43,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_2fcbe6a6","line":40,"updated":"2015-09-28 18:55:52.000000000","message":"This should be \"The priorities for Mitaka have not been defined yet\"","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"abf19564969847c38da26a10a622585e7e647114","unresolved":false,"context_lines":[{"line_number":46,"context_line":"grab the ssh hostkey for a given server. An example of doing this for a server"},{"line_number":47,"context_line":"can be seen outside of nova by running::"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"  ssh-keyscan review.openstack.org"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The request would then cause the nova-compute service to effectively run"},{"line_number":52,"context_line":"`ssh-keyscan` directly against the local VM port. Obviously it\u0027s not"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_0f48622c","line":49,"updated":"2015-09-28 18:55:52.000000000","message":"Are we guaranteed that we can always talk directly to the instance? In the case of neutron and certain drivers, aren\u0027t we somewhat fundamentally unable to talk to it because of network-namespace isolation? That\u0027s why we need the odd neutron-proxy-over-unix-domain-socket thing for metadata, right?\n\nI think that expecting that the *api* servers are able to talk to the instance directly is even more of a stretch, from what I hear from some of the operators.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"8b08b07afa3e8cebe22aee7dcb997b6fa0790c8e","unresolved":false,"context_lines":[{"line_number":52,"context_line":"`ssh-keyscan` directly against the local VM port. Obviously it\u0027s not"},{"line_number":53,"context_line":"necessary to use the `ssh-keyscan` program itself, although it\u0027s part of the"},{"line_number":54,"context_line":"`openssh-client` package, so the operator impact of just shelling out to ssh"},{"line_number":55,"context_line":"would be pretty low."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"It\u0027s probably important that the API call take a \"port\" parameter in case the"},{"line_number":58,"context_line":"user knows that they have set up an image to run ssh on a non-standard port."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a4dcd0f_a67a9eef","line":55,"updated":"2015-08-11 18:43:12.000000000","message":"I think in conversations around network enforcement by providers we should probably put the logic for dispatching this in nova-network \u0026 neutron. The network agents have to be able to talk to guests, the compute agents might not.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"abf19564969847c38da26a10a622585e7e647114","unresolved":false,"context_lines":[{"line_number":52,"context_line":"`ssh-keyscan` directly against the local VM port. Obviously it\u0027s not"},{"line_number":53,"context_line":"necessary to use the `ssh-keyscan` program itself, although it\u0027s part of the"},{"line_number":54,"context_line":"`openssh-client` package, so the operator impact of just shelling out to ssh"},{"line_number":55,"context_line":"would be pretty low."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"It\u0027s probably important that the API call take a \"port\" parameter in case the"},{"line_number":58,"context_line":"user knows that they have set up an image to run ssh on a non-standard port."}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_4f5c1aed","line":55,"in_reply_to":"1a4dcd0f_a67a9eef","updated":"2015-09-28 18:55:52.000000000","message":"Yeah.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"342f568bcc7d098c60023c9774d71685e287980f","unresolved":false,"context_lines":[{"line_number":52,"context_line":"`ssh-keyscan` directly against the local VM port. Obviously it\u0027s not"},{"line_number":53,"context_line":"necessary to use the `ssh-keyscan` program itself, although it\u0027s part of the"},{"line_number":54,"context_line":"`openssh-client` package, so the operator impact of just shelling out to ssh"},{"line_number":55,"context_line":"would be pretty low."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"It\u0027s probably important that the API call take a \"port\" parameter in case the"},{"line_number":58,"context_line":"user knows that they have set up an image to run ssh on a non-standard port."}],"source_content_type":"text/x-rst","patch_set":3,"id":"da20952f_bb900150","line":55,"in_reply_to":"1a4dcd0f_a67a9eef","updated":"2015-10-15 21:48:37.000000000","message":"Yes. I realize now from some conversation that saying \"compute agent\" has confused the issue. What I meant was \"whatever portion of the openstack infrastructure that has access to the guest over a connection that is super unlikley to get MITM\u0027d. It\u0027s also possible that means different patches implementing the guts of this for nova-net/neutron backends. I apologize for saying an implementation word incorrectly.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"2cb405ab42cd4b1b8ad10943542b9f482efedfed","unresolved":false,"context_lines":[{"line_number":57,"context_line":"It\u0027s probably important that the API call take a \"port\" parameter in case the"},{"line_number":58,"context_line":"user knows that they have set up an image to run ssh on a non-standard port."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"I\u0027ve got open questions on implementation. Namely:"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"* It\u0027s a simple question on the part of the user, so making it an async"},{"line_number":63,"context_line":"  request seems like a bad user interface. However, it\u0027s a request that will"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abe1de1_6cf5ff81","line":60,"updated":"2015-04-27 11:27:15.000000000","message":"Can we close these before we approve the spec please?","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"0297ba9f71f3c9809f5f2b22cbe60f2bc9467fe4","unresolved":false,"context_lines":[{"line_number":57,"context_line":"It\u0027s probably important that the API call take a \"port\" parameter in case the"},{"line_number":58,"context_line":"user knows that they have set up an image to run ssh on a non-standard port."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"I\u0027ve got open questions on implementation. Namely:"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"* It\u0027s a simple question on the part of the user, so making it an async"},{"line_number":63,"context_line":"  request seems like a bad user interface. However, it\u0027s a request that will"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abe1de1_16956de3","line":60,"in_reply_to":"9abe1de1_6cf5ff81","updated":"2015-04-27 12:34:58.000000000","message":"Yes please!","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d8f44762d6076ab0e2eafb39b30b38a0c11c2518","unresolved":false,"context_lines":[{"line_number":63,"context_line":"  request seems like a bad user interface. However, it\u0027s a request that will"},{"line_number":64,"context_line":"  depend on at least a rabbit message to the compute host, a rabbit message"},{"line_number":65,"context_line":"  in response and a one-second timeout in the network port call - so it\u0027s a"},{"line_number":66,"context_line":"  non-zero number of seconds that the API call would be held open."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"* If we go the other way and have it be a request that nova get the information"},{"line_number":69,"context_line":"  and put it somewhere - potentially adding it to the nova metadata - how would"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a2ca52d_07e03428","line":66,"updated":"2015-10-15 22:23:33.000000000","message":"yeah, making this a blocking call seems like not the best thing, especially because a bunch of calls could be made, all of which end up causing the compute node to initiate a connection. API rate-limiting aside, this could be disruptive.\n\nI vote for the other alternative of probe+persist.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":9420,"name":"Matthew Gilliard","email":"matthew.gilliard@hp.com","username":"gilliard"},"change_message_id":"b8e585afc064a04de2993a7f307df0390382c2d8","unresolved":false,"context_lines":[{"line_number":70,"context_line":"  the user know it\u0027s done? Just poll /servers/detail and wait to see if an"},{"line_number":71,"context_line":"  ssh_hostkey value has shown up? If we do that, should there always be an"},{"line_number":72,"context_line":"  ssh_hostkey key in the metadata regardless of someone ever having called this"},{"line_number":73,"context_line":"  API?"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Alternatives"},{"line_number":76,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bab921fb_67fa0345","line":73,"updated":"2015-04-27 07:27:42.000000000","message":"Another alternative: Nova eagerly caches all its instances\u0027 host keys.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"2cb405ab42cd4b1b8ad10943542b9f482efedfed","unresolved":false,"context_lines":[{"line_number":71,"context_line":"  ssh_hostkey value has shown up? If we do that, should there always be an"},{"line_number":72,"context_line":"  ssh_hostkey key in the metadata regardless of someone ever having called this"},{"line_number":73,"context_line":"  API?"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Alternatives"},{"line_number":76,"context_line":"------------"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abe1de1_4c58fb56","line":74,"updated":"2015-04-27 11:27:15.000000000","message":"There is an assumption that the compute node (or something like that) is able to connect to the network the instance is listening on.\n\nIt feels like we should follow the same pattern we have to get-password, were cloud-init is able to set that via the metadata service?","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"342f568bcc7d098c60023c9774d71685e287980f","unresolved":false,"context_lines":[{"line_number":71,"context_line":"  ssh_hostkey value has shown up? If we do that, should there always be an"},{"line_number":72,"context_line":"  ssh_hostkey key in the metadata regardless of someone ever having called this"},{"line_number":73,"context_line":"  API?"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Alternatives"},{"line_number":76,"context_line":"------------"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a2ca52d_3995593e","line":74,"in_reply_to":"5a2ca52d_11675626","updated":"2015-10-15 21:48:37.000000000","message":"Except not all the clouds out there enable console log access.\n\nNot all the clouds out there work with cloud-init.\n\nNot all images want/need cloud-init\n\nAn end user can\u0027t depend on cloud-init behavior being in place. They can depend on a nova microversioned API. So I think putting the complexity on the end user to be able to get ssh access to their server securely is a strange position to take when we\u0027re comfortable putting security groups in.\n\nAlso, \"cloud, please get me a few bytes from the server\" is much less heavy weight than \"cloud, please get me the entire boot log so that I can grep for a string in it\"","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d8f44762d6076ab0e2eafb39b30b38a0c11c2518","unresolved":false,"context_lines":[{"line_number":71,"context_line":"  ssh_hostkey value has shown up? If we do that, should there always be an"},{"line_number":72,"context_line":"  ssh_hostkey key in the metadata regardless of someone ever having called this"},{"line_number":73,"context_line":"  API?"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Alternatives"},{"line_number":76,"context_line":"------------"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a2ca52d_dcc21334","line":74,"in_reply_to":"5a2ca52d_3995593e","updated":"2015-10-15 22:23:33.000000000","message":"Right, which is why I think only doing this via ssh port probing is not sufficient. If we\u0027re going to make this an API that people expect to work, then it should work for things without ssh (i.e. windows), restrictive network environments, and weird situations where the compute host can\u0027t reach the network of the guest.\n\nJust to be clear, I\u0027m not talking about the user grabbing this via the console, I\u0027m talking about nova doing it for them. Even if the cloud doesn\u0027t expose the console (really the console-log in this case), there\u0027s a good chance that nova itself can access it.\n\nI know not everyone runs cloud-init, of course, but it\u0027s a widely-deployed thing that a lot of environments depend on for proper operation of other things so I think it\u0027s a pretty reasonable fallback mechanism if we can\u0027t probe ssh directly (or even the primary mechanism before we fall back to a timed attempt via the network).\n\nFor environments that do have even more proper agents than cloud-init, we probably have an even easier path to get it.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":8099,"name":"Graham Hayes","email":"gr@ham.ie","username":"graham"},"change_message_id":"fada592d813f192eea48f68f98c27dddc32d92f9","unresolved":false,"context_lines":[{"line_number":71,"context_line":"  ssh_hostkey value has shown up? If we do that, should there always be an"},{"line_number":72,"context_line":"  ssh_hostkey key in the metadata regardless of someone ever having called this"},{"line_number":73,"context_line":"  API?"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Alternatives"},{"line_number":76,"context_line":"------------"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_719e3c64","line":74,"in_reply_to":"9a1a9d01_0f1dc20e","updated":"2015-09-30 18:20:46.000000000","message":"When I was thinking about this recently what I had thought of was:\n\n1. cloud-init gets the key\n2. cloud-init posts to a metadata api endpoint\n3. nova stores it, and when you do a \"nova show\" its one of the parameters\n\nExtra Credit:\n\nHook in with https://review.openstack.org/#/c/90150/ and https://review.openstack.org/#/c/212213/ to push a SSHFP record out to designate.\n\nI may be grasping at straws, but for me #2 is important - as using the nova metadata api would reduce the attack surface (I think?)\n\nAlso leaves it open for extensions, like the Key Fingerprint for a Windows RDP connection.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"edc8de6ec67e2c38a869f651243e0c76736dd847","unresolved":false,"context_lines":[{"line_number":71,"context_line":"  ssh_hostkey value has shown up? If we do that, should there always be an"},{"line_number":72,"context_line":"  ssh_hostkey key in the metadata regardless of someone ever having called this"},{"line_number":73,"context_line":"  API?"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Alternatives"},{"line_number":76,"context_line":"------------"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a2ca52d_11675626","line":74,"in_reply_to":"9a1a9d01_719e3c64","updated":"2015-10-14 18:43:18.000000000","message":"++ I\u0027d much rather this be a cloud-init based solution than port scanning.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"0297ba9f71f3c9809f5f2b22cbe60f2bc9467fe4","unresolved":false,"context_lines":[{"line_number":71,"context_line":"  ssh_hostkey value has shown up? If we do that, should there always be an"},{"line_number":72,"context_line":"  ssh_hostkey key in the metadata regardless of someone ever having called this"},{"line_number":73,"context_line":"  API?"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Alternatives"},{"line_number":76,"context_line":"------------"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abe1de1_96029d3d","line":74,"in_reply_to":"9abe1de1_4c58fb56","updated":"2015-04-27 12:34:58.000000000","message":"This is why I wanted it to be an API call that the user opts in to rather than a thing nova-compute does all the time - there are more than one situation out there - non-routable address, Windows VM both come to mind - where assuming this will always work gets us in to trouble. However, if it\u0027s a reach-in call, it gives the opportunity to return an error such as \"no reachable SSH service\" or something.\n\nThing with ssh hostkeys is that I could _set_ it right now. But then to securely boot a new instance what I need to do is pre-generate an ssh host key, then add it to nova metadata. That\u0027s a pretty complicated burden to put on a user. It also assumes that the images involved run cloud-init.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"abf19564969847c38da26a10a622585e7e647114","unresolved":false,"context_lines":[{"line_number":71,"context_line":"  ssh_hostkey value has shown up? If we do that, should there always be an"},{"line_number":72,"context_line":"  ssh_hostkey key in the metadata regardless of someone ever having called this"},{"line_number":73,"context_line":"  API?"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Alternatives"},{"line_number":76,"context_line":"------------"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_0f1dc20e","line":74,"in_reply_to":"9abe1de1_96029d3d","updated":"2015-09-28 18:55:52.000000000","message":"Doesn\u0027t cloud-init dump the fingerprints to the console for exactly this reason? Not that scraping the console output is awesome, but it\u0027s much more stable and secure (technically MITM-ing the compute agent is possible as well).\n\nAny reason not to just have nova-compute scrape the console once per boot, on a timer, on request, etc and write the key somewhere?","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"2cb405ab42cd4b1b8ad10943542b9f482efedfed","unresolved":false,"context_lines":[{"line_number":92,"context_line":"It has been suggested that an end user could generate an ssh hostkey for an"},{"line_number":93,"context_line":"instance before boot, and pass it in via user-data. I\u0027m listing that for"},{"line_number":94,"context_line":"completeness as it\u0027s a pretty yucky process for an end user and the cost of"},{"line_number":95,"context_line":"doing an ssh port ping when requested is pretty low."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Data model impact"},{"line_number":98,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abe1de1_4caa3b1b","line":95,"updated":"2015-04-27 11:27:15.000000000","message":"but its hard if that network is an isolate network created by neutron that the compute node is unable to reach.\n\nWe could generate that host key in nova, inject it automatically, and allow you to retrieve it via the API from the database?\n\nWould that not be easier for the general case.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"0297ba9f71f3c9809f5f2b22cbe60f2bc9467fe4","unresolved":false,"context_lines":[{"line_number":92,"context_line":"It has been suggested that an end user could generate an ssh hostkey for an"},{"line_number":93,"context_line":"instance before boot, and pass it in via user-data. I\u0027m listing that for"},{"line_number":94,"context_line":"completeness as it\u0027s a pretty yucky process for an end user and the cost of"},{"line_number":95,"context_line":"doing an ssh port ping when requested is pretty low."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Data model impact"},{"line_number":98,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abe1de1_965e1d44","line":95,"in_reply_to":"9abe1de1_4caa3b1b","updated":"2015-04-27 12:34:58.000000000","message":"Ah - I see what you\u0027re saying here. I mean, it requires special knowledge in the image, whereas the other thing (just pinging the ssh port) does not require anything to be set up in a particular way, other than there being an ssh daemon running on the host.\n\nYou could easily wind up with a situation where the image does not know about consuming host keys from nova metadata, yet there is a host key in the nova metadata, which means that you\u0027d have a confusing mis-match.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"2994728e99bb7b610e2ad7a37293123bb087d074","unresolved":false,"context_lines":[{"line_number":93,"context_line":"instance before boot, and pass it in via user-data. I\u0027m listing that for"},{"line_number":94,"context_line":"completeness as it\u0027s a pretty yucky process for an end user and the cost of"},{"line_number":95,"context_line":"doing an ssh port ping when requested is pretty low."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Data model impact"},{"line_number":98,"context_line":"-----------------"},{"line_number":99,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_e7dc7d48","line":96,"updated":"2015-04-27 18:36:03.000000000","message":"To me, this type of information is typically the role of a a guest OS agent too collect and report up to the hypervisor.  For VMware it would be VMware Tools (For libvirt, would it be QEMU Guest Agent?) \n\nI\u0027d much prefer a guest OS agent gathering this information as opposed to port scanning.  This wouldn\u0027t require networking.  And if a guest agent isn\u0027t installed, you wouldn\u0027t get the info.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d8f44762d6076ab0e2eafb39b30b38a0c11c2518","unresolved":false,"context_lines":[{"line_number":93,"context_line":"instance before boot, and pass it in via user-data. I\u0027m listing that for"},{"line_number":94,"context_line":"completeness as it\u0027s a pretty yucky process for an end user and the cost of"},{"line_number":95,"context_line":"doing an ssh port ping when requested is pretty low."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Data model impact"},{"line_number":98,"context_line":"-----------------"},{"line_number":99,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a2ca52d_0744b447","line":96,"in_reply_to":"1aca2d91_fcff2bff","updated":"2015-10-15 22:23:33.000000000","message":"It\u0027s not completely unnecessary if you\u0027re on a cloud that intentionally doesn\u0027t expose L3 communication between the guest and the host it\u0027s on. The console-log is a super safe one-way conduit for the guest to expose information to the host that we already have.\n\nI\u0027m not opposed to probing the port as a last result for weirdo monty (:P) instances that don\u0027t run cloud-init, but the more I think about it, that potentially requires a timeout and such and probably should be the last thing we try.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"19c205ac0231b0b18b0f2d9af768663ac3585e0f","unresolved":false,"context_lines":[{"line_number":93,"context_line":"instance before boot, and pass it in via user-data. I\u0027m listing that for"},{"line_number":94,"context_line":"completeness as it\u0027s a pretty yucky process for an end user and the cost of"},{"line_number":95,"context_line":"doing an ssh port ping when requested is pretty low."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Data model impact"},{"line_number":98,"context_line":"-----------------"},{"line_number":99,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1aca2d91_fcff2bff","line":96,"in_reply_to":"7ad32947_e7dc7d48","updated":"2015-05-07 17:33:44.000000000","message":"But I explicitly don\u0027t want an agent running in guests. It\u0027s also completely unnecessary to run a process in the guest to read the information that is publically available on the port. If it\u0027s not possible to connect to an ssh service on that port, then fetching the hostkey is a kind of useless task anyway.\n\nThe main thing is that nova is the only thing that sits in a place where you can be more assured that the connection has not been MITM\u0027d.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"2cb405ab42cd4b1b8ad10943542b9f482efedfed","unresolved":false,"context_lines":[{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Request::"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"  GET /v2.x/servers/{server_id}/os-ssh-hostkey"},{"line_number":110,"context_line":"  {"},{"line_number":111,"context_line":"    \"port\": integer"},{"line_number":112,"context_line":"  }"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abe1de1_4c935bfb","line":109,"updated":"2015-04-27 11:27:15.000000000","message":"can we make this agnostic, something like:\n\nos-hostkey\n\nso that windows can plug into this for the x509 certs that we have just added support for.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"abf19564969847c38da26a10a622585e7e647114","unresolved":false,"context_lines":[{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Request::"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"  GET /v2.x/servers/{server_id}/os-ssh-hostkey"},{"line_number":110,"context_line":"  {"},{"line_number":111,"context_line":"    \"port\": integer"},{"line_number":112,"context_line":"  }"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_4fb89ae5","line":109,"in_reply_to":"1a4dcd0f_c6e32ad8","updated":"2015-09-28 18:55:52.000000000","message":"Also note if we scrape the console, we don\u0027t need to know what port we should look at, nor do we need to worry about the effect that firewall rules would have on this.\n\nSpeaking of firewall: what if I have my guest image configured to only allow ssh from my company\u0027s subnet? I\u0027d still like to be able to get the host fingerprint, but I don\u0027t want the cloud provider able to hit my ssh port at all.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d8f44762d6076ab0e2eafb39b30b38a0c11c2518","unresolved":false,"context_lines":[{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Request::"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"  GET /v2.x/servers/{server_id}/os-ssh-hostkey"},{"line_number":110,"context_line":"  {"},{"line_number":111,"context_line":"    \"port\": integer"},{"line_number":112,"context_line":"  }"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a2ca52d_bc9cf70f","line":109,"in_reply_to":"5a2ca52d_d9ab0574","updated":"2015-10-15 22:23:33.000000000","message":"Why wouldn\u0027t I expect it to do something for me? Only if I know that nova finds the fingerprint via inspection over the network. If I\u0027m on a provider that doesn\u0027t provide me console access and that I don\u0027t want to let ssh into my guest, I would think that barfing the fingerprint to the console (as is already done) is probably how I\u0027d hope it works.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"342f568bcc7d098c60023c9774d71685e287980f","unresolved":false,"context_lines":[{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Request::"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"  GET /v2.x/servers/{server_id}/os-ssh-hostkey"},{"line_number":110,"context_line":"  {"},{"line_number":111,"context_line":"    \"port\": integer"},{"line_number":112,"context_line":"  }"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a2ca52d_d9ab0574","line":109,"in_reply_to":"9a1a9d01_4fb89ae5","updated":"2015-10-15 21:48:37.000000000","message":"I think the second concern is just a thing where the user of the cloud would not expect this API to do anything useful for them, and that user can easily fall back to the console usecase you mentioned.\n\nHowever, for the basic use case, having the cloud be able to get you an ssh fingerprint is a huge improvement over what\u0027s there today.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":1063,"name":"Ed Leafe","email":"ed@leafe.com","username":"ed-leafe"},"change_message_id":"06fd636333f31feb1f68016366c9a28bc67c3c59","unresolved":false,"context_lines":[{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Request::"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"  GET /v2.x/servers/{server_id}/os-ssh-hostkey"},{"line_number":110,"context_line":"  {"},{"line_number":111,"context_line":"    \"port\": integer"},{"line_number":112,"context_line":"  }"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abe1de1_afaf84e2","line":109,"in_reply_to":"9abe1de1_4c935bfb","updated":"2015-04-27 13:28:57.000000000","message":"+1 on making this agnostic. Great suggestion!","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"0297ba9f71f3c9809f5f2b22cbe60f2bc9467fe4","unresolved":false,"context_lines":[{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Request::"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"  GET /v2.x/servers/{server_id}/os-ssh-hostkey"},{"line_number":110,"context_line":"  {"},{"line_number":111,"context_line":"    \"port\": integer"},{"line_number":112,"context_line":"  }"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9abe1de1_56588556","line":109,"in_reply_to":"9abe1de1_4c935bfb","updated":"2015-04-27 12:34:58.000000000","message":"Yup!","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"8b08b07afa3e8cebe22aee7dcb997b6fa0790c8e","unresolved":false,"context_lines":[{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Request::"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"  GET /v2.x/servers/{server_id}/os-ssh-hostkey"},{"line_number":110,"context_line":"  {"},{"line_number":111,"context_line":"    \"port\": integer"},{"line_number":112,"context_line":"  }"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a4dcd0f_c6e32ad8","line":109,"in_reply_to":"9abe1de1_afaf84e2","updated":"2015-08-11 18:43:12.000000000","message":"GET doesn\u0027t typically take a body. So this really should be a port\u003dN parameter string.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"2994728e99bb7b610e2ad7a37293123bb087d074","unresolved":false,"context_lines":[{"line_number":120,"context_line":"    ["},{"line_number":121,"context_line":"      \"ssh-hostkey-type\": string,"},{"line_number":122,"context_line":"      \"ssh-hostkey-fingerprint\": string"},{"line_number":123,"context_line":"      \"ssh-hostkey\": string,"},{"line_number":124,"context_line":"    ],"},{"line_number":125,"context_line":"  }"},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7ad32947_a7a3259e","line":123,"updated":"2015-04-27 18:36:03.000000000","message":"Is there any need for the entire hostkey?  Typically, just fingerprints are compared.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"edc8de6ec67e2c38a869f651243e0c76736dd847","unresolved":false,"context_lines":[{"line_number":120,"context_line":"    ["},{"line_number":121,"context_line":"      \"ssh-hostkey-type\": string,"},{"line_number":122,"context_line":"      \"ssh-hostkey-fingerprint\": string"},{"line_number":123,"context_line":"      \"ssh-hostkey\": string,"},{"line_number":124,"context_line":"    ],"},{"line_number":125,"context_line":"  }"},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a2ca52d_1199961f","line":123,"in_reply_to":"1a4dcd0f_46d07af6","updated":"2015-10-14 18:43:18.000000000","message":"This is correct as an array.  Typically an SSH server has at least two host keys (RSA and DSA) and possibly more like ECDSA.  During the SSH handshake a host key algorithm is decided by both the client and server.  So depending on the client, it may not always be RSA for example.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"8b08b07afa3e8cebe22aee7dcb997b6fa0790c8e","unresolved":false,"context_lines":[{"line_number":120,"context_line":"    ["},{"line_number":121,"context_line":"      \"ssh-hostkey-type\": string,"},{"line_number":122,"context_line":"      \"ssh-hostkey-fingerprint\": string"},{"line_number":123,"context_line":"      \"ssh-hostkey\": string,"},{"line_number":124,"context_line":"    ],"},{"line_number":125,"context_line":"  }"},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a4dcd0f_46d07af6","line":123,"in_reply_to":"1aca2d91_812694cc","updated":"2015-08-11 18:43:12.000000000","message":"Why is this an array? Shouldn\u0027t there only be 1 host key?","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"19c205ac0231b0b18b0f2d9af768663ac3585e0f","unresolved":false,"context_lines":[{"line_number":120,"context_line":"    ["},{"line_number":121,"context_line":"      \"ssh-hostkey-type\": string,"},{"line_number":122,"context_line":"      \"ssh-hostkey-fingerprint\": string"},{"line_number":123,"context_line":"      \"ssh-hostkey\": string,"},{"line_number":124,"context_line":"    ],"},{"line_number":125,"context_line":"  }"},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1aca2d91_812694cc","line":123,"in_reply_to":"7ad32947_a7a3259e","updated":"2015-05-07 17:33:44.000000000","message":"Well, the hostkey is what\u0027s returned when you poke the port, so it seems like it would be more work to not return it, no?","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"30e1fd88972526f9952f0511478e39c7ddc11d51","unresolved":false,"context_lines":[{"line_number":126,"context_line":""},{"line_number":127,"context_line":"Error possibilities include:"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"* Passing a string, such as \"bunny rabbits\" to port: \"400 Bad Request\""},{"line_number":130,"context_line":"* ssh-hostkey timed out waiting for a key: \"408 Request Timeout\""},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"Security impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_45139b0d","line":129,"updated":"2015-09-28 19:50:28.000000000","message":"jsonschema validation in v2.1 handles all of the type checking for us.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"30e1fd88972526f9952f0511478e39c7ddc11d51","unresolved":false,"context_lines":[{"line_number":208,"context_line":"Testing"},{"line_number":209,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"Unfortunately, testing this requires ssh to be working on the guest, which"},{"line_number":212,"context_line":"is apparently flaky at best in the gate. We\u0027ll come up with something for sure"},{"line_number":213,"context_line":"though. Perhaps actually a fake something or other that spins up a daemon"},{"line_number":214,"context_line":"listening on a port and injects something into the nova db implying that there"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_65901f44","line":211,"updated":"2015-09-28 19:50:28.000000000","message":"There are still several tempest tests run in the gate that rely on ssh, like test_volume_boot_pattern.  So while flaky, I don\u0027t see this being any worse.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"30e1fd88972526f9952f0511478e39c7ddc11d51","unresolved":false,"context_lines":[{"line_number":217,"context_line":"Documentation Impact"},{"line_number":218,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"We\u0027ll need to add documentation on the new API call. I will be happy to also"},{"line_number":221,"context_line":"write that patch if the docs team will point me to the right place."},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_459ddb57","line":220,"updated":"2015-09-28 19:50:28.000000000","message":"Nova\u0027s API docs are now in tree so can be part of the API change itself.","commit_id":"d87eaa710db08c437841c810100d8048150e4a43"}],"specs/liberty/fetch-ssh-hostkey.rst":[{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"4ab70ec0081de84b35b8ed31e0753b0ae1fa7f27","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Fetch SSH Hostkey "},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/fetch-ssh-hostkey"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa041b7_e64f8cbb","line":8,"updated":"2015-04-05 08:39:48.000000000","message":"trailing space","commit_id":"66dd212dad3651f1e086c521a4412e70cbaef3fc"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"4ab70ec0081de84b35b8ed31e0753b0ae1fa7f27","unresolved":false,"context_lines":[{"line_number":51,"context_line":"The request would then cause the nova-compute service to effectively run"},{"line_number":52,"context_line":"`ssh-keyscan` directly against the local VM port. Obviously it\u0027s not"},{"line_number":53,"context_line":"necessary to use the `ssh-keyscan` program itself, although it\u0027s part of the"},{"line_number":54,"context_line":"`openssh-client` package, so the operator impact of just shelling out to ssh"},{"line_number":55,"context_line":"would be pretty low."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"It\u0027s probably important that the API call take a \"port\" parameter in case the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa041b7_465e3877","line":54,"updated":"2015-04-05 08:39:48.000000000","message":"You could just use the paramiko API which is already in the Nova requirements.","commit_id":"66dd212dad3651f1e086c521a4412e70cbaef3fc"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"fb8ff5ac97c448340adbbbbbafec62c0eaeba1c0","unresolved":false,"context_lines":[{"line_number":51,"context_line":"The request would then cause the nova-compute service to effectively run"},{"line_number":52,"context_line":"`ssh-keyscan` directly against the local VM port. Obviously it\u0027s not"},{"line_number":53,"context_line":"necessary to use the `ssh-keyscan` program itself, although it\u0027s part of the"},{"line_number":54,"context_line":"`openssh-client` package, so the operator impact of just shelling out to ssh"},{"line_number":55,"context_line":"would be pretty low."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"It\u0027s probably important that the API call take a \"port\" parameter in case the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"bab921fb_9a680c89","line":54,"in_reply_to":"baa041b7_465e3877","updated":"2015-04-24 20:57:06.000000000","message":"Sounds great- although on initial inspection paramiko doesn\u0027t provide an API to just do the intial ping without attempting to spawn a shell. I\u0027ll dig further though.","commit_id":"66dd212dad3651f1e086c521a4412e70cbaef3fc"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"4ab70ec0081de84b35b8ed31e0753b0ae1fa7f27","unresolved":false,"context_lines":[{"line_number":112,"context_line":""},{"line_number":113,"context_line":"  200 OK"},{"line_number":114,"context_line":"  {"},{"line_number":115,"context_line":"    \"ssh-hostkey\": string"},{"line_number":116,"context_line":"  }"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"Error possibilities include:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa041b7_2656945c","line":115,"updated":"2015-04-05 08:39:48.000000000","message":"You don\u0027t really need the entire host key, just the fingerprint.  Also typically OpenSSL servers have RSA,DSA, and ECC host keys.  Which will you return and why not all?","commit_id":"66dd212dad3651f1e086c521a4412e70cbaef3fc"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"fb8ff5ac97c448340adbbbbbafec62c0eaeba1c0","unresolved":false,"context_lines":[{"line_number":112,"context_line":""},{"line_number":113,"context_line":"  200 OK"},{"line_number":114,"context_line":"  {"},{"line_number":115,"context_line":"    \"ssh-hostkey\": string"},{"line_number":116,"context_line":"  }"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"Error possibilities include:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"bab921fb_9a16ccef","line":115,"in_reply_to":"baa041b7_2656945c","updated":"2015-04-24 20:57:06.000000000","message":"All would be great. Or we could default to all, but also accept an optional type param if only one was desired?","commit_id":"66dd212dad3651f1e086c521a4412e70cbaef3fc"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"4ab70ec0081de84b35b8ed31e0753b0ae1fa7f27","unresolved":false,"context_lines":[{"line_number":186,"context_line":"----------"},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"I cannot conceive of this being anything other than one patch once we get"},{"line_number":189,"context_line":"the details ironed out."},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"Dependencies"},{"line_number":192,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa041b7_06515062","line":189,"updated":"2015-04-05 08:39:48.000000000","message":"Would there also be a horizon change to display the host key?","commit_id":"66dd212dad3651f1e086c521a4412e70cbaef3fc"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"fb8ff5ac97c448340adbbbbbafec62c0eaeba1c0","unresolved":false,"context_lines":[{"line_number":186,"context_line":"----------"},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"I cannot conceive of this being anything other than one patch once we get"},{"line_number":189,"context_line":"the details ironed out."},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"Dependencies"},{"line_number":192,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"bab921fb_5ad71423","line":189,"in_reply_to":"baa041b7_06515062","updated":"2015-04-24 20:57:06.000000000","message":"That sounds like a great idea!","commit_id":"66dd212dad3651f1e086c521a4412e70cbaef3fc"}]}