)]}'
{"specs/mitaka/approved/vmware-encrypt-vcenter-passwords.rst":[{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"905a73bd1cc1d6d2d3eeb2647090b2b21a5c7460","unresolved":false,"context_lines":[{"line_number":21,"context_line":"the VMware driver to properly communicate with the vCenter Server. They are:"},{"line_number":22,"context_line":"host_username and host_password. The primary concern of some deployers is that"},{"line_number":23,"context_line":"the vCenter usernames and passwords are stored in plain text inside the"},{"line_number":24,"context_line":"nova.conf file."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"This problem statement only applies to the VMware credenitals stored in"},{"line_number":27,"context_line":"nova.conf. It does not attempt to address the more general issue of plain text"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a29b11f_186db3cb","line":24,"updated":"2015-10-22 14:40:15.000000000","message":"We\u0027re already pretty screwed if someone has achieved root breakout. OK, multilayer security is good, but I\u0027d be more concerned about the database than the VMWare creds.","commit_id":"7b3977ad31fb2080b67e6e13a1e5c0e94d741962"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"c38da10d14e567efbe15474e3070c1eaed5b32b5","unresolved":false,"context_lines":[{"line_number":21,"context_line":"the VMware driver to properly communicate with the vCenter Server. They are:"},{"line_number":22,"context_line":"host_username and host_password. The primary concern of some deployers is that"},{"line_number":23,"context_line":"the vCenter usernames and passwords are stored in plain text inside the"},{"line_number":24,"context_line":"nova.conf file."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"This problem statement only applies to the VMware credenitals stored in"},{"line_number":27,"context_line":"nova.conf. It does not attempt to address the more general issue of plain text"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a8ffd7b_c348a4b5","line":24,"in_reply_to":"3a29b11f_186db3cb","updated":"2015-11-28 02:14:46.000000000","message":"Its not just about root access to the system.  Customers also hate seeing clear text passwords when editing this file.  For example, doing a webex session for support reasons. and having their private creds on display to everyone.\n\nThe other issue is log collection where the config files are collected.\n\nIn any case, I\u0027m not trying to solve the whole \"plain text password\" issue for all of OpenStack.  I just want to address VMware\u0027s credentials.","commit_id":"7b3977ad31fb2080b67e6e13a1e5c0e94d741962"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"905a73bd1cc1d6d2d3eeb2647090b2b21a5c7460","unresolved":false,"context_lines":[{"line_number":23,"context_line":"the vCenter usernames and passwords are stored in plain text inside the"},{"line_number":24,"context_line":"nova.conf file."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"This problem statement only applies to the VMware credenitals stored in"},{"line_number":27,"context_line":"nova.conf. It does not attempt to address the more general issue of plain text"},{"line_number":28,"context_line":"passwords being stored in \\*.conf files."},{"line_number":29,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a29b11f_18a4d305","line":26,"range":{"start_line":26,"start_character":50,"end_line":26,"end_character":61},"updated":"2015-10-22 14:40:15.000000000","message":"nit: credentials","commit_id":"7b3977ad31fb2080b67e6e13a1e5c0e94d741962"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"c38da10d14e567efbe15474e3070c1eaed5b32b5","unresolved":false,"context_lines":[{"line_number":23,"context_line":"the vCenter usernames and passwords are stored in plain text inside the"},{"line_number":24,"context_line":"nova.conf file."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"This problem statement only applies to the VMware credenitals stored in"},{"line_number":27,"context_line":"nova.conf. It does not attempt to address the more general issue of plain text"},{"line_number":28,"context_line":"passwords being stored in \\*.conf files."},{"line_number":29,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a8ffd7b_03da2ce8","line":26,"in_reply_to":"3a29b11f_18a4d305","updated":"2015-11-28 02:14:46.000000000","message":"Done","commit_id":"7b3977ad31fb2080b67e6e13a1e5c0e94d741962"},{"author":{"_account_id":9172,"name":"Radoslav Gerganov","email":"rgerganov@vmware.com","username":"rgerganov"},"change_message_id":"5e82bfad0a8d5a308019a7e3f84e1600b9fd1f73","unresolved":false,"context_lines":[{"line_number":36,"context_line":"Proposed change"},{"line_number":37,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The proposed solution is to utilize the leverage the existing keystone"},{"line_number":40,"context_line":"credential store a repository for the vCenter user/password."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"The flow would be as follows:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a2ca52d_6c60df01","line":39,"updated":"2015-10-16 07:26:03.000000000","message":"s/to utilize the leverage/to leverage","commit_id":"7b3977ad31fb2080b67e6e13a1e5c0e94d741962"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"c38da10d14e567efbe15474e3070c1eaed5b32b5","unresolved":false,"context_lines":[{"line_number":36,"context_line":"Proposed change"},{"line_number":37,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The proposed solution is to utilize the leverage the existing keystone"},{"line_number":40,"context_line":"credential store a repository for the vCenter user/password."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"The flow would be as follows:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a8ffd7b_a3e480ab","line":39,"in_reply_to":"3a29b11f_6d9bcb18","updated":"2015-11-28 02:14:46.000000000","message":"Done","commit_id":"7b3977ad31fb2080b67e6e13a1e5c0e94d741962"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"905a73bd1cc1d6d2d3eeb2647090b2b21a5c7460","unresolved":false,"context_lines":[{"line_number":36,"context_line":"Proposed change"},{"line_number":37,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"The proposed solution is to utilize the leverage the existing keystone"},{"line_number":40,"context_line":"credential store a repository for the vCenter user/password."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"The flow would be as follows:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a29b11f_6d9bcb18","line":39,"in_reply_to":"5a2ca52d_6c60df01","updated":"2015-10-22 14:40:15.000000000","message":"\"The proposed solution is to store the vCenter credentials in Keystone\"\n\nbut really you already said this on line 13, delete para.\n\nRedundancy is just as bad in prose as code, bugbear of mine.","commit_id":"7b3977ad31fb2080b67e6e13a1e5c0e94d741962"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"905a73bd1cc1d6d2d3eeb2647090b2b21a5c7460","unresolved":false,"context_lines":[{"line_number":42,"context_line":"The flow would be as follows:"},{"line_number":43,"context_line":"- The openstack command line is used to create a new credential for the nova"},{"line_number":44,"context_line":"user in keystone\u0027s credential store (openstack credential create)."},{"line_number":45,"context_line":"- The values in nova.conf for host_username and host_password are left empty."},{"line_number":46,"context_line":"- When the VMware Nova driver starts it will fetch the user and password from"},{"line_number":47,"context_line":"Keystone if they are undefined in nova.conf."},{"line_number":48,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a29b11f_a53257a5","line":45,"range":{"start_line":45,"start_character":71,"end_line":45,"end_character":76},"updated":"2015-10-22 14:40:15.000000000","message":"These should be omitted rather than left empty.","commit_id":"7b3977ad31fb2080b67e6e13a1e5c0e94d741962"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"c38da10d14e567efbe15474e3070c1eaed5b32b5","unresolved":false,"context_lines":[{"line_number":42,"context_line":"The flow would be as follows:"},{"line_number":43,"context_line":"- The openstack command line is used to create a new credential for the nova"},{"line_number":44,"context_line":"user in keystone\u0027s credential store (openstack credential create)."},{"line_number":45,"context_line":"- The values in nova.conf for host_username and host_password are left empty."},{"line_number":46,"context_line":"- When the VMware Nova driver starts it will fetch the user and password from"},{"line_number":47,"context_line":"Keystone if they are undefined in nova.conf."},{"line_number":48,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a8ffd7b_83f4dc5a","line":45,"in_reply_to":"3a29b11f_a53257a5","updated":"2015-11-28 02:14:46.000000000","message":"Done","commit_id":"7b3977ad31fb2080b67e6e13a1e5c0e94d741962"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"905a73bd1cc1d6d2d3eeb2647090b2b21a5c7460","unresolved":false,"context_lines":[{"line_number":49,"context_line":"The Keystone credential store is a v3 API, so there is a dependency on Nova"},{"line_number":50,"context_line":"using this version."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Also, note that is it not required that the username and password to be stored"},{"line_number":53,"context_line":"in this credential store.  A deployer may still put these values in the"},{"line_number":54,"context_line":"nova.conf."},{"line_number":55,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a29b11f_65df5f3a","line":52,"range":{"start_line":52,"start_character":16,"end_line":52,"end_character":22},"updated":"2015-10-22 14:40:15.000000000","message":"nit: it is","commit_id":"7b3977ad31fb2080b67e6e13a1e5c0e94d741962"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"c38da10d14e567efbe15474e3070c1eaed5b32b5","unresolved":false,"context_lines":[{"line_number":49,"context_line":"The Keystone credential store is a v3 API, so there is a dependency on Nova"},{"line_number":50,"context_line":"using this version."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Also, note that is it not required that the username and password to be stored"},{"line_number":53,"context_line":"in this credential store.  A deployer may still put these values in the"},{"line_number":54,"context_line":"nova.conf."},{"line_number":55,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a8ffd7b_63f1b86a","line":52,"in_reply_to":"3a29b11f_65df5f3a","updated":"2015-11-28 02:14:46.000000000","message":"Done","commit_id":"7b3977ad31fb2080b67e6e13a1e5c0e94d741962"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"905a73bd1cc1d6d2d3eeb2647090b2b21a5c7460","unresolved":false,"context_lines":[{"line_number":125,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"Nova must be using the keystone middleware which supports the Keystone v3 API."},{"line_number":128,"context_line":"This dependency should already be satisfied."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"Testing"},{"line_number":131,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a29b11f_257ba729","line":128,"range":{"start_line":128,"start_character":16,"end_line":128,"end_character":22},"updated":"2015-10-22 14:40:15.000000000","message":"nit: please check then say it /is/ already satisfied.","commit_id":"7b3977ad31fb2080b67e6e13a1e5c0e94d741962"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"c38da10d14e567efbe15474e3070c1eaed5b32b5","unresolved":false,"context_lines":[{"line_number":125,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"Nova must be using the keystone middleware which supports the Keystone v3 API."},{"line_number":128,"context_line":"This dependency should already be satisfied."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"Testing"},{"line_number":131,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a8ffd7b_23b5f07c","line":128,"in_reply_to":"3a29b11f_257ba729","updated":"2015-11-28 02:14:46.000000000","message":"Done","commit_id":"7b3977ad31fb2080b67e6e13a1e5c0e94d741962"},{"author":{"_account_id":8688,"name":"Alexis Lee","email":"openstack@lxsli.co.uk","username":"lxsli"},"change_message_id":"905a73bd1cc1d6d2d3eeb2647090b2b21a5c7460","unresolved":false,"context_lines":[{"line_number":132,"context_line":""},{"line_number":133,"context_line":"The testing should be rather straightforward. A deployment should be tested"},{"line_number":134,"context_line":"with and without the user/password of vCenter in the Keystone credential store"},{"line_number":135,"context_line":"and verify communication of the driver to vCenter still works properly."},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"Documentation Impact"},{"line_number":138,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a29b11f_c5ac338e","line":135,"updated":"2015-10-22 14:40:15.000000000","message":"So you will supply a Tempest test to do this? Not interested in manual testing","commit_id":"7b3977ad31fb2080b67e6e13a1e5c0e94d741962"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"c38da10d14e567efbe15474e3070c1eaed5b32b5","unresolved":false,"context_lines":[{"line_number":132,"context_line":""},{"line_number":133,"context_line":"The testing should be rather straightforward. A deployment should be tested"},{"line_number":134,"context_line":"with and without the user/password of vCenter in the Keystone credential store"},{"line_number":135,"context_line":"and verify communication of the driver to vCenter still works properly."},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"Documentation Impact"},{"line_number":138,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a8ffd7b_239e5007","line":135,"in_reply_to":"3a29b11f_c5ac338e","updated":"2015-11-28 02:14:46.000000000","message":"There would definitely be unit tests.  As for tempest, its more of a tempest config option.  We can configure Minesweeper (vmware CI) to default to using this method instead of today\u0027s default (user/pwd in nova.conf).","commit_id":"7b3977ad31fb2080b67e6e13a1e5c0e94d741962"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"1a141cdbc4a27bc2856f160988e20d63a3c7f6bf","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"This problem statement only applies to the VMware credentials stored in"},{"line_number":27,"context_line":"nova.conf. It does not attempt to address the more general issue of plain text"},{"line_number":28,"context_line":"passwords being stored in \\*.conf files."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Use Cases"},{"line_number":31,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_0b854ccd","line":28,"updated":"2015-11-30 05:50:26.000000000","message":"But doing this is quite common. Wouldn\u0027t we be better off addressing the general case and then having the vmware credentials be a user of that general solution?","commit_id":"bd660c45880cd92ba44db29b586035be1ba73366"}],"specs/ocata/approved/vmware-encrypt-vcenter-passwords.rst":[{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"c1b200cfc3651f6af671d643d150fb40e6a66481","unresolved":false,"context_lines":[{"line_number":129,"context_line":""},{"line_number":130,"context_line":"The testing should be rather straightforward. A deployment should be tested"},{"line_number":131,"context_line":"with and without the user/password of vCenter in the Keystone credential store"},{"line_number":132,"context_line":"and verify communication of the driver to vCenter still works properly."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"Documentation Impact"},{"line_number":135,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_2f56af06","line":132,"updated":"2016-11-14 09:36:28.000000000","message":"This isn\u0027t what is intended by this section. We\u0027re more talking about unit and functional tests here.","commit_id":"8c6b3b59faa9d749481aeaecffc553e384b83930"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"c1b200cfc3651f6af671d643d150fb40e6a66481","unresolved":false,"context_lines":[{"line_number":135,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"The deployment flow described above should be documented as an alternative way"},{"line_number":138,"context_line":"of deploying the VMware compute driver in a more secure manner."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"References"},{"line_number":141,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a629dbe_0f780b8f","line":138,"updated":"2016-11-14 09:36:28.000000000","message":"And you\u0027re committing to do that thing? Yes?","commit_id":"8c6b3b59faa9d749481aeaecffc553e384b83930"}]}