)]}'
{"specs/backlog/approved/protected-resources.rst":[{"author":{"_account_id":4257,"name":"Zane Bitter","email":"zbitter@redhat.com","username":"zaneb"},"change_message_id":"5dff8692de3b39011bc652b81e3296a8d5633b8c","unresolved":false,"context_lines":[{"line_number":24,"context_line":"user, it currently has no way to prevent this compute instance from being"},{"line_number":25,"context_line":"manipulated directly by users via nova\u0027s APIs. As a result, a user could"},{"line_number":26,"context_line":"delete, resize, shut down, et cetera a compute instance, making a Heat stack"},{"line_number":27,"context_line":"unhealthy."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Use Cases"},{"line_number":30,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1a26ad4f_d03b2237","line":27,"updated":"2015-10-29 07:53:48.000000000","message":"TBH speaking from a Heat perspective, this doesn\u0027t really bother us. It\u0027s the user\u0027s server at the end of the day, so it\u0027s their funeral. It\u0027d be nice if there was a way to make it harder to screw up accidentally, but that could be as simple as e.g. some metadata saying that a server was created by Heat, and requiring a --force option on those servers. IMHO there\u0027s no need for cryptographic guarantees that only Heat can change something. In fact, it\u0027s outright undesirable, because if Heat has a bug then you definitely want to be able to manually remove resources.","commit_id":"e055a4c610a4af48744499eaafd7f34868ec90d3"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"6144a0b4efa7e54ab3c0136ea697229559322e78","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"An API user wishes to launch instances inside a given tenant, but not allow"},{"line_number":33,"context_line":"other API users with the credentials for that tenant to manipulate those"},{"line_number":34,"context_line":"instances."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Project Priority"},{"line_number":37,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"da85f559_7849fe8a","line":34,"updated":"2015-11-09 16:04:41.000000000","message":"Need to expand this to include things like locking access to the serial console, rather than just stopping delete.","commit_id":"e055a4c610a4af48744499eaafd7f34868ec90d3"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"6144a0b4efa7e54ab3c0136ea697229559322e78","unresolved":false,"context_lines":[{"line_number":36,"context_line":"Project Priority"},{"line_number":37,"context_line":"-----------------"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The priorities for Mitaka have not yet been defined."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Proposed change"},{"line_number":42,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"da85f559_385cd64a","line":39,"updated":"2015-11-09 16:04:41.000000000","message":"We can drop this whole section now.","commit_id":"e055a4c610a4af48744499eaafd7f34868ec90d3"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"6144a0b4efa7e54ab3c0136ea697229559322e78","unresolved":false,"context_lines":[{"line_number":67,"context_line":"* future operations on this lock either need to be performed by an"},{"line_number":68,"context_line":"  administrator or the original service account"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"Option Two: Secret Keys to lock calls"},{"line_number":71,"context_line":"-------------------------------------"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"Another option is to add an optional argument to the existing lock API call. An"}],"source_content_type":"text/x-rst","patch_set":10,"id":"da85f559_b81d2675","line":70,"updated":"2015-11-09 16:04:41.000000000","message":"Can we move this to alternatives now?","commit_id":"e055a4c610a4af48744499eaafd7f34868ec90d3"}],"specs/liberty/approved/protected-resources.rst":[{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"9ae12fdd19f78b9e2f8ed68432f94099b8447021","unresolved":false,"context_lines":[{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"OpenStack projects interact with and create resources with other OpenStack"},{"line_number":21,"context_line":"projects, in order to deliver their services and fulfil their mission. For"},{"line_number":22,"context_line":"example:"},{"line_number":23,"context_line":"* Nova and Cinder store backups in Swift (using Glance) and would like to"},{"line_number":24,"context_line":"prevent users from deleting these backup objects directly;"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da20952f_2e45d641","line":21,"updated":"2015-09-06 10:59:20.000000000","message":"s/fulfil/fulfill/","commit_id":"1d7e9c9fab48a3fcbc9082796fd9381f5bb7eac7"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"096f762ca4d8a7e5551a042de6d6b2bb6ab6b8b7","unresolved":false,"context_lines":[{"line_number":37,"context_line":"etc.] a compute instance, making a heat stack unhealthy (if not completely"},{"line_number":38,"context_line":"broken)."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"From Heat\u0027s point of view, it is currently impossible to prevent this from"},{"line_number":41,"context_line":"happening. A user can easily delete an instance that belongs to Heat and be"},{"line_number":42,"context_line":"surprised later with his broken stack (without correlating these two events,"},{"line_number":43,"context_line":"therefore violating the principle of least surprise). Moreover, it is very"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a4dcd0f_d0017c39","line":40,"updated":"2015-08-06 12:13:15.000000000","message":"Its tempting to have a nod to using a separate tenant to launch resources that are hidden from users, although we know that causes other issues.","commit_id":"1d7e9c9fab48a3fcbc9082796fd9381f5bb7eac7"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"096f762ca4d8a7e5551a042de6d6b2bb6ab6b8b7","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":"When an OpenStack project creates a resource with another project (for example:"},{"line_number":52,"context_line":"Nova creates a backup object in Swift via Glance, Heat creates an instance with"},{"line_number":53,"context_line":"Nova), they should be able to tag these resources as belonging to them."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Other projects should respect these tags and prompt users to use the original"},{"line_number":56,"context_line":"service that tagged them to interact with these resources."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a4dcd0f_702d08a7","line":53,"updated":"2015-08-06 12:13:15.000000000","message":"Glance and Swift already have a system for this, to some extent:\nhttp://specs.openstack.org/openstack/keystone-specs/specs/keystonemiddleware/implemented/service-tokens.html\n\nThis is the swift side:\nhttp://docs.openstack.org/developer/swift/overview_auth.html#openstack-service-using-composite-tokens\n\nHowever I think for Nova and Heat its almost the reverse. We want the resources to live in the user\u0027s account, but you need the service token to access them (in Nova this means would mean the resource is \"locked\" by the service, or something like that).","commit_id":"1d7e9c9fab48a3fcbc9082796fd9381f5bb7eac7"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"096f762ca4d8a7e5551a042de6d6b2bb6ab6b8b7","unresolved":false,"context_lines":[{"line_number":74,"context_line":"This topic has been discussed extensively at the Vancouver summit and its need"},{"line_number":75,"context_line":"was backed by the PTLs of the following projects: Trove, Sahara, Cue, Heat. A"},{"line_number":76,"context_line":"brief discussion with the Nova team also highlighted their own desire to have"},{"line_number":77,"context_line":"this ability with other projects."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"Proposed change"},{"line_number":80,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a4dcd0f_9001b408","line":77,"updated":"2015-08-06 12:13:15.000000000","message":"This section is not used for this, its all about if you fit into one of these categories:\nhttp://specs.openstack.org/openstack/nova-specs/priorities/liberty-priorities.html","commit_id":"1d7e9c9fab48a3fcbc9082796fd9381f5bb7eac7"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"096f762ca4d8a7e5551a042de6d6b2bb6ab6b8b7","unresolved":false,"context_lines":[{"line_number":86,"context_line":"the Nova team to identify the options and define the best way to move forward."},{"line_number":87,"context_line":"We acknowledge there are multiple ways this could be achieved and trust the"},{"line_number":88,"context_line":"Nova team is ultimately in the best position to suggest the best and easiest"},{"line_number":89,"context_line":"way to move forward."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Alternatives"},{"line_number":92,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a4dcd0f_3bdf610e","line":89,"updated":"2015-08-06 12:13:15.000000000","message":"OK, this is actually a backlog spec then, but thats cool.\n\nMy preference is this...\n\nWe will make use of the composite token concept:\nhttp://docs.openstack.org/developer/swift/overview_auth.html#openstack-service-using-composite-tokens\n\nExtend the Nova \"lock\" concept in these key ways:\n* see: http://developer.openstack.org/api-ref-compute-v2-ext.html#lock\n* if the lock is applied with a composite token, apply a service lock\n* creating a service with a composite token, applies the above service lock\n* the service lock appears like an admin lock to the end user, i.e. a lock they can\u0027t remove\n* When the service lock is applied, locked operations need to be performed using a composite token, including: unlock, snapshot, delete, etc. (or an admin token, as an over-ride).\n* Note when locked, you can still see the server in the server list API, as expected\n\nWould that work?","commit_id":"1d7e9c9fab48a3fcbc9082796fd9381f5bb7eac7"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"096f762ca4d8a7e5551a042de6d6b2bb6ab6b8b7","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Besides tagging resources, Glance and Swift have a new system that require"},{"line_number":95,"context_line":"tokens for two tenants to access a resource. Nova could mimic this behaviour to"},{"line_number":96,"context_line":"achieve this."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"It would be good if the method utilised allowed projects to easily identify the"},{"line_number":99,"context_line":"original project that created the resource, so that reasonable error messages"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a4dcd0f_fbfb3979","line":96,"updated":"2015-08-06 12:13:15.000000000","message":"Ah, cool, I added reference above, might be good to include them here.","commit_id":"1d7e9c9fab48a3fcbc9082796fd9381f5bb7eac7"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"096f762ca4d8a7e5551a042de6d6b2bb6ab6b8b7","unresolved":false,"context_lines":[{"line_number":127,"context_line":"that resources belonging to the same tenant should be accessible to the owner"},{"line_number":128,"context_line":"of this tenant. If a single instance is compromised, there is more opportunity"},{"line_number":129,"context_line":"for lateral movement and compromise of resources that effectively belong to"},{"line_number":130,"context_line":"other tenants."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"b) Piping the network connectivity from the customer tenant to the cloud owner"},{"line_number":133,"context_line":"tenant is not straightforward or as flexible as having the resource on the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a4dcd0f_5b67cd4c","line":130,"updated":"2015-08-06 12:13:15.000000000","message":"ssh keys are probably a key place were those concepts are distinct, I guess.","commit_id":"1d7e9c9fab48a3fcbc9082796fd9381f5bb7eac7"}],"specs/mitaka/approved/protected-resources.rst":[{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"cafc7dea44c833f02f272419d3c2d06265730928","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Protected resources in OpenStack"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/protected-resources"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba15a1d1_aea7e1bb","line":8,"updated":"2015-09-23 11:41:02.000000000","message":"Maybe \"Locking resources by service token\" would sound better?","commit_id":"d531daf72ef18e0abb608666f2cad43fb590708f"},{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"77c58e9b8e5b06a7547294050fb8dc2a1be0a18a","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"We need to provide a method for these projects to achieve their goals with a"},{"line_number":53,"context_line":"common, well understood and supported design pattern that can be implemented by"},{"line_number":54,"context_line":"all projects."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"This topic has been discussed extensively at the Vancouver summit and its need"},{"line_number":57,"context_line":"was backed by the PTLs of the following projects: Trove, Sahara, Cue, Heat. A"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba15a1d1_8bff9d66","line":54,"updated":"2015-09-15 19:06:18.000000000","message":"I believe that this one statement is extremely important and worthy of a lot of focus and emphasis. One-of solutions in each project are not the answer, this is an OpenStack wide problem and we need a single comprehensive solution across projects.","commit_id":"d531daf72ef18e0abb608666f2cad43fb590708f"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"cafc7dea44c833f02f272419d3c2d06265730928","unresolved":false,"context_lines":[{"line_number":90,"context_line":"Nova team is ultimately in the best position to suggest the best and easiest"},{"line_number":91,"context_line":"way to move forward."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"After initial consultation with the Nova team and Nova PTL (John Garbutt), the"},{"line_number":94,"context_line":"method described below has been suggested as the preferred way to move forward."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"We will make use of the composite token concept:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba15a1d1_ae8e012c","line":93,"updated":"2015-09-23 11:41:02.000000000","message":"Nit: I would remove that it was me, that detail is not really important.","commit_id":"d531daf72ef18e0abb608666f2cad43fb590708f"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"cafc7dea44c833f02f272419d3c2d06265730928","unresolved":false,"context_lines":[{"line_number":91,"context_line":"way to move forward."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"After initial consultation with the Nova team and Nova PTL (John Garbutt), the"},{"line_number":94,"context_line":"method described below has been suggested as the preferred way to move forward."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"We will make use of the composite token concept:"},{"line_number":97,"context_line":"http://docs.openstack.org/developer/swift/overview_auth.html#openstack-service-using-composite-tokens"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba15a1d1_6e9b0967","line":94,"updated":"2015-09-23 11:41:02.000000000","message":"its my preferred at the time, rarther than \"the\", but thats spitting hairs","commit_id":"d531daf72ef18e0abb608666f2cad43fb590708f"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"a653c58360ce882f1aa6c58cd094592b24bd6fef","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/protected-resources"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"OpenStack projects like Nova, Cinder, Trove, Sahara, Cue and Murano, Heat need"},{"line_number":14,"context_line":"a way to protect resources they have created with other OpenStack projects, so"},{"line_number":15,"context_line":"they can deliver more reliable and friendly services to cloud users."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a1a9d01_f28d8ed3","line":13,"updated":"2015-09-30 08:16:32.000000000","message":"The grammar of this sentence needs love.","commit_id":"80bd8dbe6cd327364e8662f85628801857558047"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"a653c58360ce882f1aa6c58cd094592b24bd6fef","unresolved":false,"context_lines":[{"line_number":21,"context_line":"projects, in order to deliver their services and fulfill their mission. For"},{"line_number":22,"context_line":"example:"},{"line_number":23,"context_line":"* Nova and Cinder store backups in Swift (using Glance) and would like to"},{"line_number":24,"context_line":"prevent users from deleting these backup objects directly;"},{"line_number":25,"context_line":"* Trove, Sahara, Cue, Murano and Heat launch instances, volumes and other"},{"line_number":26,"context_line":"resources using Nova, Cinder, Neutron, etc, and would like to prevent users"},{"line_number":27,"context_line":"from interacting directly with them."}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a1a9d01_92669228","line":24,"updated":"2015-09-30 08:16:32.000000000","message":"Sorry to nit pick, but snapshots are explicitly not backups. We should not call them backups.","commit_id":"80bd8dbe6cd327364e8662f85628801857558047"}]}