)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"a7e1874409ca38ead75a12ad9438ba01b6d738e6","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Integrate Castellan for Key Management"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Adds blueprint for integrating Castellan for key management."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Castellan is a key manager interface library that is intended to be"},{"line_number":12,"context_line":"usable with multiple back ends, including Barbican. The Castellan code"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"9a8ffd7b_65bbae73","line":9,"updated":"2015-11-24 21:42:39.000000000","message":"I should correct this: blueprint -\u003e spec\n\nand add a link to the blueprint on my next patch","commit_id":"ee36e5cbe22a2b106dd27ae1611663a8043b8d8e"}],"specs/mitaka/approved/use-castellan-key-manager.rst":[{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"df90097d74b63d153f47a645e95ee27b96b12f5c","unresolved":false,"context_lines":[{"line_number":140,"context_line":"Documentation Impact"},{"line_number":141,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"None"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"References"},{"line_number":146,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba8a016a_cddf77d4","line":143,"updated":"2015-11-19 15:16:11.000000000","message":"We need to document the upgrade process for existing deployments. We should likely document the use of disk encryption in conbination with castellan.","commit_id":"ee36e5cbe22a2b106dd27ae1611663a8043b8d8e"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"439ce21536a848a31edf4b04bab8b5748c21545c","unresolved":false,"context_lines":[{"line_number":140,"context_line":"Documentation Impact"},{"line_number":141,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"None"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"References"},{"line_number":146,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba8a016a_ee60b1a6","line":143,"in_reply_to":"ba8a016a_7c259e08","updated":"2015-11-23 13:51:51.000000000","message":"Thank you for the feedback.  I am working on getting the updates out.","commit_id":"ee36e5cbe22a2b106dd27ae1611663a8043b8d8e"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"24c4402a81e65a497c95b7c6c7afebc5946fafb0","unresolved":false,"context_lines":[{"line_number":140,"context_line":"Documentation Impact"},{"line_number":141,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"None"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"References"},{"line_number":146,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba8a016a_7c259e08","line":143,"in_reply_to":"ba8a016a_cddf77d4","updated":"2015-11-20 14:54:35.000000000","message":"I agree. There would at least need to be some documentation for configuring Castellan properly.","commit_id":"ee36e5cbe22a2b106dd27ae1611663a8043b8d8e"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"38bdce217ca3011bab4a5d668ccc49da92e36178","unresolved":false,"context_lines":[{"line_number":38,"context_line":"Proposed change"},{"line_number":39,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Castellan must be added to the required libraries list."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Castellan by default pulls configuration options from a Castellan-specific"},{"line_number":44,"context_line":"configuration file in /etc/castellan, but can also take in configuration"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a7e1126_51d4cebb","line":41,"updated":"2015-12-18 14:55:12.000000000","message":"This is no longer necessary. Castellan was added to Nova\u0027s requirements.txt file yesterday.","commit_id":"30957136e6b874e6cc4c284b40b1bdf3924bee40"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"5c29c5281d9bf3d3a2a36f29c16ccdc2ae9d1d6e","unresolved":false,"context_lines":[{"line_number":38,"context_line":"Proposed change"},{"line_number":39,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Castellan must be added to the required libraries list."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Castellan by default pulls configuration options from a Castellan-specific"},{"line_number":44,"context_line":"configuration file in /etc/castellan, but can also take in configuration"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa69d971_00273613","line":41,"in_reply_to":"3a7e1126_51d4cebb","updated":"2015-12-30 18:07:17.000000000","message":"Done","commit_id":"30957136e6b874e6cc4c284b40b1bdf3924bee40"},{"author":{"_account_id":12898,"name":"Tony Breeds","email":"tony@bakeyournoodle.com","username":"tonyb"},"change_message_id":"87fe44652e4a47010314a8ea947dff9cc21f0293","unresolved":false,"context_lines":[{"line_number":101,"context_line":"The options in the Nova configuration file for disk encryption will change. The"},{"line_number":102,"context_line":"option group \u0027keymgr\u0027 will be spelled out to \u0027key_manager\u0027. The key manager"},{"line_number":103,"context_line":"option group will still have an option \u0027api_class\u0027 to specify the desired back"},{"line_number":104,"context_line":"end, but an option to specify the fixed key will no longer be available. In"},{"line_number":105,"context_line":"the \u0027barbican\u0027 opt group, a few new options will be available to increase the"},{"line_number":106,"context_line":"robustness of the back end, such as the number of times to check if a key has"},{"line_number":107,"context_line":"been successfully created."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a7e1126_7918a21e","line":104,"updated":"2015-12-21 04:43:59.000000000","message":"This worries me.   What\u0027s the upgrade path from a liberty cloud to a mitaka cloud?\n\nIt seems like the liberty config will work albeit by using the deprecated options.  What about fixed key?  is it still available?","commit_id":"30957136e6b874e6cc4c284b40b1bdf3924bee40"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"15b9754ade7676d46d3944e7ac2c80c9dee832e8","unresolved":false,"context_lines":[{"line_number":101,"context_line":"The options in the Nova configuration file for disk encryption will change. The"},{"line_number":102,"context_line":"option group \u0027keymgr\u0027 will be spelled out to \u0027key_manager\u0027. The key manager"},{"line_number":103,"context_line":"option group will still have an option \u0027api_class\u0027 to specify the desired back"},{"line_number":104,"context_line":"end, but an option to specify the fixed key will no longer be available. In"},{"line_number":105,"context_line":"the \u0027barbican\u0027 opt group, a few new options will be available to increase the"},{"line_number":106,"context_line":"robustness of the back end, such as the number of times to check if a key has"},{"line_number":107,"context_line":"been successfully created."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a7e1126_c1f17b96","line":104,"in_reply_to":"3a7e1126_7918a21e","updated":"2015-12-21 18:33:38.000000000","message":"A fixed key option will not be available with Castellan.  I understand your concern for upgrades when that option is removed, but the fixed key option has been advertised as for testing use only and not suitable for deployments.  What is the typical strategy for dropping support for something?","commit_id":"30957136e6b874e6cc4c284b40b1bdf3924bee40"},{"author":{"_account_id":12898,"name":"Tony Breeds","email":"tony@bakeyournoodle.com","username":"tonyb"},"change_message_id":"17725b9cbc011a6094b9ddec82a7540a101ace64","unresolved":false,"context_lines":[{"line_number":101,"context_line":"The options in the Nova configuration file for disk encryption will change. The"},{"line_number":102,"context_line":"option group \u0027keymgr\u0027 will be spelled out to \u0027key_manager\u0027. The key manager"},{"line_number":103,"context_line":"option group will still have an option \u0027api_class\u0027 to specify the desired back"},{"line_number":104,"context_line":"end, but an option to specify the fixed key will no longer be available. In"},{"line_number":105,"context_line":"the \u0027barbican\u0027 opt group, a few new options will be available to increase the"},{"line_number":106,"context_line":"robustness of the back end, such as the number of times to check if a key has"},{"line_number":107,"context_line":"been successfully created."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a7e1126_5f6b1885","line":104,"in_reply_to":"3a7e1126_7f8a9465","updated":"2015-12-22 01:10:37.000000000","message":"Actually this wasn\u0027t published post freeze I take that back.  Sorry.","commit_id":"30957136e6b874e6cc4c284b40b1bdf3924bee40"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"5c29c5281d9bf3d3a2a36f29c16ccdc2ae9d1d6e","unresolved":false,"context_lines":[{"line_number":101,"context_line":"The options in the Nova configuration file for disk encryption will change. The"},{"line_number":102,"context_line":"option group \u0027keymgr\u0027 will be spelled out to \u0027key_manager\u0027. The key manager"},{"line_number":103,"context_line":"option group will still have an option \u0027api_class\u0027 to specify the desired back"},{"line_number":104,"context_line":"end, but an option to specify the fixed key will no longer be available. In"},{"line_number":105,"context_line":"the \u0027barbican\u0027 opt group, a few new options will be available to increase the"},{"line_number":106,"context_line":"robustness of the back end, such as the number of times to check if a key has"},{"line_number":107,"context_line":"been successfully created."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a7b0d38_8046dabd","line":104,"in_reply_to":"3a7e1126_7f8a9465","updated":"2015-12-30 18:07:17.000000000","message":"Tony, thanks for linking to the deprecation policy, that is helpful info. And yes, that is the correct back end.","commit_id":"30957136e6b874e6cc4c284b40b1bdf3924bee40"},{"author":{"_account_id":12898,"name":"Tony Breeds","email":"tony@bakeyournoodle.com","username":"tonyb"},"change_message_id":"af69c80167881234f58502a9458c0b3fde33d6e2","unresolved":false,"context_lines":[{"line_number":101,"context_line":"The options in the Nova configuration file for disk encryption will change. The"},{"line_number":102,"context_line":"option group \u0027keymgr\u0027 will be spelled out to \u0027key_manager\u0027. The key manager"},{"line_number":103,"context_line":"option group will still have an option \u0027api_class\u0027 to specify the desired back"},{"line_number":104,"context_line":"end, but an option to specify the fixed key will no longer be available. In"},{"line_number":105,"context_line":"the \u0027barbican\u0027 opt group, a few new options will be available to increase the"},{"line_number":106,"context_line":"robustness of the back end, such as the number of times to check if a key has"},{"line_number":107,"context_line":"been successfully created."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a7e1126_7f8a9465","line":104,"in_reply_to":"3a7e1126_c1f17b96","updated":"2015-12-22 01:08:47.000000000","message":"So just to be sure we\u0027re on the same page, I\u0027m not a source of authority so I may get the details wrong but we\u0027re talking about the deprecation policy is at [1].  When we\u0027re talking about fixed_key I\u0027m referring to [2].\n\nSo I think we\u0027d need to mark this as deprecated for removal in Mitaka, add the new code and a shim to keep allow single_key_mgr to function for Mitaka. then early in \u0027N\u0027 remove the code at the soonest possibly \u0027O\u0027.\n\nHowever that assumes, acceptance of this spec (which was published post freeze).\n\n[1] https://governance.openstack.org/reference/tags/assert_follows-standard-deprecation.html\n[2] http://git.openstack.org/cgit/openstack/nova/tree/nova/keymgr/conf_key_mgr.py#n40","commit_id":"30957136e6b874e6cc4c284b40b1bdf3924bee40"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"38bdce217ca3011bab4a5d668ccc49da92e36178","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"Nova developers should not be impacted by this change. If developers find more"},{"line_number":116,"context_line":"uses for a key manager, Castellan should be just as easy to use as the current"},{"line_number":117,"context_line":"Nova key manager interface."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Implementation"},{"line_number":120,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a7e1126_06236b57","line":117,"updated":"2015-12-18 14:55:12.000000000","message":"I can attest to the fact that including Castellan makes implementing new security features much easier.","commit_id":"30957136e6b874e6cc4c284b40b1bdf3924bee40"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"38bdce217ca3011bab4a5d668ccc49da92e36178","unresolved":false,"context_lines":[{"line_number":131,"context_line":"Work Items"},{"line_number":132,"context_line":"----------"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":" * Add Castellan to Nova requirements."},{"line_number":135,"context_line":" * Exchange calls to Nova\u0027s key manager with calls to Castellan."},{"line_number":136,"context_line":" * Remove Nova key manager code."},{"line_number":137,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a7e1126_430ac57a","line":134,"updated":"2015-12-18 14:55:12.000000000","message":"Again, no longer necessary.","commit_id":"30957136e6b874e6cc4c284b40b1bdf3924bee40"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"5c29c5281d9bf3d3a2a36f29c16ccdc2ae9d1d6e","unresolved":false,"context_lines":[{"line_number":131,"context_line":"Work Items"},{"line_number":132,"context_line":"----------"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":" * Add Castellan to Nova requirements."},{"line_number":135,"context_line":" * Exchange calls to Nova\u0027s key manager with calls to Castellan."},{"line_number":136,"context_line":" * Remove Nova key manager code."},{"line_number":137,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa69d971_801246b3","line":134,"in_reply_to":"3a7e1126_430ac57a","updated":"2015-12-30 18:07:17.000000000","message":"Done","commit_id":"30957136e6b874e6cc4c284b40b1bdf3924bee40"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"38bdce217ca3011bab4a5d668ccc49da92e36178","unresolved":false,"context_lines":[{"line_number":144,"context_line":"Testing"},{"line_number":145,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"This change can be unit tested using a simple in-memory back end. As actual"},{"line_number":148,"context_line":"deployments should be using Barbican, this feature should be tested using a"},{"line_number":149,"context_line":"Barbican back end, too."},{"line_number":150,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a7e1126_a3e4c9e0","line":147,"updated":"2015-12-18 14:55:12.000000000","message":"Can you elaborate on the \"in-memory backend\" for unit-testing?  Does this mean you will mock out the key manager backend for the unit tests, or will you use a module like the existing MockKeyMgr or FixedKeyMgr classes? \n\nI just want to be clear about this point so we don\u0027t end up with the same situation as we had in Cinder, where people are using a key manager which was only intended for testing purposes in an actual deployment.","commit_id":"30957136e6b874e6cc4c284b40b1bdf3924bee40"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"15b9754ade7676d46d3944e7ac2c80c9dee832e8","unresolved":false,"context_lines":[{"line_number":144,"context_line":"Testing"},{"line_number":145,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"This change can be unit tested using a simple in-memory back end. As actual"},{"line_number":148,"context_line":"deployments should be using Barbican, this feature should be tested using a"},{"line_number":149,"context_line":"Barbican back end, too."},{"line_number":150,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a7e1126_c1765b05","line":147,"in_reply_to":"3a7e1126_a3e4c9e0","updated":"2015-12-21 18:33:38.000000000","message":"If you actually have a deployment that you want to use to test encryption, then I would recommend using the Barbican back end. When I mentioned testing here in the spec, I meant simply unit testing the new changes within nova only, which could be done using Castellan\u0027s in-memory back end, or perhaps just a mocked instance of Castellan.","commit_id":"30957136e6b874e6cc4c284b40b1bdf3924bee40"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"12084aa16095ab84ce8fd4be3b58d784236046bd","unresolved":false,"context_lines":[{"line_number":33,"context_line":"----------"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Castellan supports existing features such as ephemeral storage encryption and"},{"line_number":36,"context_line":"volume encryption."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Proposed change"},{"line_number":39,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa69d971_117f07e1","line":36,"updated":"2016-01-11 14:21:03.000000000","message":"It may be worthwhile to mention image-signing. The signature_utils module is a pretty solid example of how interaction with the key manager is greatly simplified by using Castellan.","commit_id":"e2ddeb1cb81069cd114c20fdf790ceaa6c2622b1"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"12084aa16095ab84ce8fd4be3b58d784236046bd","unresolved":false,"context_lines":[{"line_number":136,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"This change depends on Castellan, version \u003e\u003d 0.2.0. Castellan is already in"},{"line_number":139,"context_line":"OpenStack\u0027s global requirements."},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"Testing"},{"line_number":142,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa69d971_b1b2bb94","line":139,"updated":"2016-01-11 14:21:03.000000000","message":"Could be useful to mention that Castellan is already in Nova\u0027s requirements and is already in use in Nova\u0027s code base.","commit_id":"e2ddeb1cb81069cd114c20fdf790ceaa6c2622b1"}],"specs/newton/approved/use-castellan-key-manager.rst":[{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"328fa52662eec70cddb6d7611cf14090dc092b3c","unresolved":false,"context_lines":[{"line_number":94,"context_line":"The deployer should be made aware of a change in the default key manager back"},{"line_number":95,"context_line":"end. The current default back end in Nova is a fixed key, but Castellan uses"},{"line_number":96,"context_line":"Barbican as the default. This means the deployer should ensure Barbican is"},{"line_number":97,"context_line":"running and the fixed key added to Barbican so it can continue to be used."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"The options in the Nova configuration file for disk encryption will change. The"},{"line_number":100,"context_line":"option group \u0027keymgr\u0027 will be spelled out to \u0027key_manager\u0027. The key manager"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9aed3d3a_32b9287a","line":97,"updated":"2016-02-29 21:00:42.000000000","message":"Is it possible to allow the fixed key manager implementation to remain in Nova for the time being until it can follow the normal deprecation and removal policy?","commit_id":"01996bdbb1d76e46545dac6712a34f72de03d573"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"cd40250b7ddb16f0a37f1fe88ae17bf749dd5683","unresolved":false,"context_lines":[{"line_number":94,"context_line":"The deployer should be made aware of a change in the default key manager back"},{"line_number":95,"context_line":"end. The current default back end in Nova is a fixed key, but Castellan uses"},{"line_number":96,"context_line":"Barbican as the default. This means the deployer should ensure Barbican is"},{"line_number":97,"context_line":"running and the fixed key added to Barbican so it can continue to be used."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"The options in the Nova configuration file for disk encryption will change. The"},{"line_number":100,"context_line":"option group \u0027keymgr\u0027 will be spelled out to \u0027key_manager\u0027. The key manager"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7af24918_18c84854","line":97,"in_reply_to":"7af24918_6648b02e","updated":"2016-03-04 15:57:47.000000000","message":"Yes, these are good suggestions, I will update the spec to reflect this information. The ConfKeyManager should stay in Nova while everything else should be switched to Castellan.","commit_id":"01996bdbb1d76e46545dac6712a34f72de03d573"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"ec707f565285d09c20eac3e74c21b1f87a2ad4b8","unresolved":false,"context_lines":[{"line_number":94,"context_line":"The deployer should be made aware of a change in the default key manager back"},{"line_number":95,"context_line":"end. The current default back end in Nova is a fixed key, but Castellan uses"},{"line_number":96,"context_line":"Barbican as the default. This means the deployer should ensure Barbican is"},{"line_number":97,"context_line":"running and the fixed key added to Barbican so it can continue to be used."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"The options in the Nova configuration file for disk encryption will change. The"},{"line_number":100,"context_line":"option group \u0027keymgr\u0027 will be spelled out to \u0027key_manager\u0027. The key manager"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7af24918_6648b02e","line":97,"in_reply_to":"9aed3d3a_32b9287a","updated":"2016-03-01 15:46:22.000000000","message":"Could we remove the bulk of the key manager interface, but leave in an option to use either the fixed key or Castellan? The default of this option would, of course, be the fixed key.\n\nOf course, if the Nova community is OK with completely removing the fixed key default in the Newton cycle, then that\u0027s the preferable option.","commit_id":"01996bdbb1d76e46545dac6712a34f72de03d573"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"44fc2d0f2444d83d8e6a2587a8fda1afc232eb03","unresolved":false,"context_lines":[{"line_number":110,"context_line":"has been successfully created."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"To maintain backwards compatibility, the old options will still be listed as"},{"line_number":113,"context_line":"deprecated options. Standard deprecation policy will be followed, and these"},{"line_number":114,"context_line":"old options should be removed in the next release cycle."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_755fbf0e","line":113,"updated":"2016-03-28 18:29:56.000000000","message":"Does this actually retain backwards compatibility? If the \u0027keymgr\u0027 code no longer exists and the Castellan code uses the \u0027key_manager\u0027 options, what can the deprecated \u0027keymgr\u0027 flags actually do?","commit_id":"9c63e049a63be98b41fa59e9f6530bd64d19261e"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"35c8e328be4ddc67f5d0593021956a97b5e74ed1","unresolved":false,"context_lines":[{"line_number":110,"context_line":"has been successfully created."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"To maintain backwards compatibility, the old options will still be listed as"},{"line_number":113,"context_line":"deprecated options. Standard deprecation policy will be followed, and these"},{"line_number":114,"context_line":"old options should be removed in the next release cycle."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_c377c038","line":113,"in_reply_to":"ba0121b8_17f0d58f","updated":"2016-03-29 17:06:25.000000000","message":"I see.","commit_id":"9c63e049a63be98b41fa59e9f6530bd64d19261e"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"ff2ce31042ffdf878b78ac66198eec41643102a6","unresolved":false,"context_lines":[{"line_number":110,"context_line":"has been successfully created."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"To maintain backwards compatibility, the old options will still be listed as"},{"line_number":113,"context_line":"deprecated options. Standard deprecation policy will be followed, and these"},{"line_number":114,"context_line":"old options should be removed in the next release cycle."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba0121b8_17f0d58f","line":113,"in_reply_to":"ba0121b8_755fbf0e","updated":"2016-03-29 16:17:56.000000000","message":"Castellan will use the key_manager options by default but fall back to the keymgr options and log a deprecation warning. See https://review.openstack.org/#/c/280492/6/cinder/keymgr/__init__.py","commit_id":"9c63e049a63be98b41fa59e9f6530bd64d19261e"}]}