)]}'
{"specs/ocata/approved/support-auth-selection-based-on-image-metadata.rst":[{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"a8fc0453bfbc9347ef47d9fe174bf34696787824","unresolved":false,"context_lines":[{"line_number":61,"context_line":"image metadata, or intelligently caching image metadata (which is unlikely to"},{"line_number":62,"context_line":"change with great frequency) before the HTTP response is sent."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Posting this to get preliminary feedback on the scope of this spec."},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"**CHANGES STOP HERE**"},{"line_number":67,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_65a341b2","line":64,"updated":"2016-06-16 21:54:09.000000000","message":"This is a feature that probably should be able to be disabled by an operator who doesn\u0027t need it, regardless of if the metadata exists in glance or not.","commit_id":"87df8fb68efe4e89f91507903167c2ba599113c6"},{"author":{"_account_id":11642,"name":"Jesse J. Cook","email":"jesse.cook@rackspace.com","username":"crashenx"},"change_message_id":"7741c3c94cbed7261b1ec99717937f7b0435bff2","unresolved":false,"context_lines":[{"line_number":61,"context_line":"image metadata, or intelligently caching image metadata (which is unlikely to"},{"line_number":62,"context_line":"change with great frequency) before the HTTP response is sent."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Posting this to get preliminary feedback on the scope of this spec."},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"**CHANGES STOP HERE**"},{"line_number":67,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a9d85d2_8d14c2f5","line":64,"in_reply_to":"7aa08908_65a341b2","updated":"2016-06-21 01:00:02.000000000","message":"+1; this should be a config enabled option.","commit_id":"87df8fb68efe4e89f91507903167c2ba599113c6"},{"author":{"_account_id":11642,"name":"Jesse J. Cook","email":"jesse.cook@rackspace.com","username":"crashenx"},"change_message_id":"12c30eb50150aef47a43d926ee91f466e2d64422","unresolved":false,"context_lines":[{"line_number":41,"context_line":"Use Cases"},{"line_number":42,"context_line":"---------"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"An end user should get feedback immediately if they try to boot an instance to"},{"line_number":45,"context_line":"which they will have no remote access. Otherwise, computing resources are"},{"line_number":46,"context_line":"consumed and it will take time for the end user to realize their mistake."},{"line_number":47,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_fee6ff48","line":44,"updated":"2016-07-01 18:34:52.000000000","message":"I suspect what we are talking about here is a 400, so feedback might not be a strong enough word. Maybe more aptly described as enforcement.","commit_id":"88319f8aa3fe18ac0eadd609b1ad836df7ea473b"},{"author":{"_account_id":14228,"name":"Clif Houck","email":"me@clifhouck.com","username":"clif_h"},"change_message_id":"7b5f7193a752bec83d6767ec0e4023e5208f2d91","unresolved":false,"context_lines":[{"line_number":41,"context_line":"Use Cases"},{"line_number":42,"context_line":"---------"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"An end user should get feedback immediately if they try to boot an instance to"},{"line_number":45,"context_line":"which they will have no remote access. Otherwise, computing resources are"},{"line_number":46,"context_line":"consumed and it will take time for the end user to realize their mistake."},{"line_number":47,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"fad55976_d82064fa","line":44,"in_reply_to":"3aaa91ec_fee6ff48","updated":"2016-07-15 22:17:15.000000000","message":"Reworded to be a bit clearer.","commit_id":"88319f8aa3fe18ac0eadd609b1ad836df7ea473b"},{"author":{"_account_id":11642,"name":"Jesse J. Cook","email":"jesse.cook@rackspace.com","username":"crashenx"},"change_message_id":"12c30eb50150aef47a43d926ee91f466e2d64422","unresolved":false,"context_lines":[{"line_number":96,"context_line":""},{"line_number":97,"context_line":"* ``check_injected_files`` a boolean options that enables or disables"},{"line_number":98,"context_line":"  inspecting ``injected_files`` data to see if one of the files appears to be"},{"line_number":99,"context_line":"  an SSH public-key or x509 certificate."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"Alternatives"},{"line_number":102,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_de3983a5","line":99,"updated":"2016-07-01 18:34:52.000000000","message":"Checking injected files seems like a nice to have feature that we could defer to a future patch if desired? Seems fine to add now though.","commit_id":"88319f8aa3fe18ac0eadd609b1ad836df7ea473b"},{"author":{"_account_id":14228,"name":"Clif Houck","email":"me@clifhouck.com","username":"clif_h"},"change_message_id":"7b5f7193a752bec83d6767ec0e4023e5208f2d91","unresolved":false,"context_lines":[{"line_number":96,"context_line":""},{"line_number":97,"context_line":"* ``check_injected_files`` a boolean options that enables or disables"},{"line_number":98,"context_line":"  inspecting ``injected_files`` data to see if one of the files appears to be"},{"line_number":99,"context_line":"  an SSH public-key or x509 certificate."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"Alternatives"},{"line_number":102,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fad55976_78f698d8","line":99,"in_reply_to":"3aaa91ec_de3983a5","updated":"2016-07-15 22:17:15.000000000","message":"It works AFAICT right now in the proposed patch, and is enabled/disabled with a configuration option in case it doesn\u0027t behave as desired.","commit_id":"88319f8aa3fe18ac0eadd609b1ad836df7ea473b"},{"author":{"_account_id":11642,"name":"Jesse J. Cook","email":"jesse.cook@rackspace.com","username":"crashenx"},"change_message_id":"12c30eb50150aef47a43d926ee91f466e2d64422","unresolved":false,"context_lines":[{"line_number":102,"context_line":"------------"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"No known alternative check within Nova exists which would achieve the"},{"line_number":105,"context_line":"same functionality."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Data model impact"},{"line_number":108,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_be0117b2","line":105,"updated":"2016-07-01 18:34:52.000000000","message":"One alternative approach would be enable all enforcement via configuration. However, I think the approach of using metadata on the images is more robust and does not require a config deployment to modify enforcement type per image.","commit_id":"88319f8aa3fe18ac0eadd609b1ad836df7ea473b"},{"author":{"_account_id":14228,"name":"Clif Houck","email":"me@clifhouck.com","username":"clif_h"},"change_message_id":"7b5f7193a752bec83d6767ec0e4023e5208f2d91","unresolved":false,"context_lines":[{"line_number":102,"context_line":"------------"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"No known alternative check within Nova exists which would achieve the"},{"line_number":105,"context_line":"same functionality."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Data model impact"},{"line_number":108,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fad55976_58b474f1","line":105,"in_reply_to":"3aaa91ec_be0117b2","updated":"2016-07-15 22:17:15.000000000","message":"Can you elaborate on what you mean by enforcement via configuration?","commit_id":"88319f8aa3fe18ac0eadd609b1ad836df7ea473b"},{"author":{"_account_id":11642,"name":"Jesse J. Cook","email":"jesse.cook@rackspace.com","username":"crashenx"},"change_message_id":"12c30eb50150aef47a43d926ee91f466e2d64422","unresolved":false,"context_lines":[{"line_number":148,"context_line":"Performance Impact"},{"line_number":149,"context_line":"------------------"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"Inspecting ``key_data`` and ``injected_files`` is potentiallly adds a"},{"line_number":152,"context_line":"non-trivial computation cost to check if that data contains an SSH public-key"},{"line_number":153,"context_line":"or x509 certificate. One way to mitigate that penalty is to turn off"},{"line_number":154,"context_line":"inspection of ``key_data`` or ``injected_files`` if you require keys to be"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3aaa91ec_3edb6751","line":151,"updated":"2016-07-01 18:34:52.000000000","message":"extraneous \"is\"","commit_id":"88319f8aa3fe18ac0eadd609b1ad836df7ea473b"},{"author":{"_account_id":14228,"name":"Clif Houck","email":"me@clifhouck.com","username":"clif_h"},"change_message_id":"7b5f7193a752bec83d6767ec0e4023e5208f2d91","unresolved":false,"context_lines":[{"line_number":148,"context_line":"Performance Impact"},{"line_number":149,"context_line":"------------------"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"Inspecting ``key_data`` and ``injected_files`` is potentiallly adds a"},{"line_number":152,"context_line":"non-trivial computation cost to check if that data contains an SSH public-key"},{"line_number":153,"context_line":"or x509 certificate. One way to mitigate that penalty is to turn off"},{"line_number":154,"context_line":"inspection of ``key_data`` or ``injected_files`` if you require keys to be"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fad55976_585ab484","line":151,"in_reply_to":"3aaa91ec_3edb6751","updated":"2016-07-15 22:17:15.000000000","message":"Done","commit_id":"88319f8aa3fe18ac0eadd609b1ad836df7ea473b"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"896947582a4a739a50ba50aaac2263e0ba27b961","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"This specification aims to solve that problem. The implementation of this"},{"line_number":36,"context_line":"specification should give Nova the ability to understand enough image metadata,"},{"line_number":37,"context_line":"based on administrator configuration, to reject server create requests which"},{"line_number":38,"context_line":"which do not include enough information to allow the requester to remotely"},{"line_number":39,"context_line":"login to the provisioned instance."},{"line_number":40,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3ac371cc_a50c5543","line":37,"range":{"start_line":37,"start_character":71,"end_line":37,"end_character":76},"updated":"2016-08-15 15:21:11.000000000","message":"2 which","commit_id":"459c2b82a8a0b240fbb1aa01f92f14065476bec3"},{"author":{"_account_id":20522,"name":"Aline Bousquet","email":"albousque@gmail.com","username":"alineb"},"change_message_id":"d18912938217c26d6c6804e090b5e243d9591611","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"This specification aims to solve that problem. The implementation of this"},{"line_number":36,"context_line":"specification should give Nova the ability to understand enough image metadata,"},{"line_number":37,"context_line":"based on administrator configuration, to reject server create requests which"},{"line_number":38,"context_line":"which do not include enough information to allow the requester to remotely"},{"line_number":39,"context_line":"login to the provisioned instance."},{"line_number":40,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3ac371cc_205108d9","line":37,"range":{"start_line":37,"start_character":71,"end_line":37,"end_character":76},"in_reply_to":"3ac371cc_a50c5543","updated":"2016-08-17 10:06:49.000000000","message":"Done","commit_id":"459c2b82a8a0b240fbb1aa01f92f14065476bec3"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"896947582a4a739a50ba50aaac2263e0ba27b961","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"An end user should get feedback immediately, in this case in the form of a"},{"line_number":45,"context_line":"400 HTTP response code, if they try to boot an instance to which they will"},{"line_number":46,"context_line":"have no remote access. Otherwise, computing resources are consumed and it will"},{"line_number":47,"context_line":"take time for the end user to realize their mistake."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3ac371cc_a8138c5b","line":46,"range":{"start_line":46,"start_character":5,"end_line":46,"end_character":21},"updated":"2016-08-15 15:21:11.000000000","message":"there\u0027s a lot of case can lead to \u0027no remote access\u0027","commit_id":"459c2b82a8a0b240fbb1aa01f92f14065476bec3"},{"author":{"_account_id":20522,"name":"Aline Bousquet","email":"albousque@gmail.com","username":"alineb"},"change_message_id":"d18912938217c26d6c6804e090b5e243d9591611","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"An end user should get feedback immediately, in this case in the form of a"},{"line_number":45,"context_line":"400 HTTP response code, if they try to boot an instance to which they will"},{"line_number":46,"context_line":"have no remote access. Otherwise, computing resources are consumed and it will"},{"line_number":47,"context_line":"take time for the end user to realize their mistake."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3ac371cc_a05b38f5","line":46,"range":{"start_line":46,"start_character":5,"end_line":46,"end_character":21},"in_reply_to":"3ac371cc_a8138c5b","updated":"2016-08-17 10:06:49.000000000","message":"I’ve updated that, let me know if it’s better.","commit_id":"459c2b82a8a0b240fbb1aa01f92f14065476bec3"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"896947582a4a739a50ba50aaac2263e0ba27b961","unresolved":false,"context_lines":[{"line_number":54,"context_line":"Since image meta-data is already requested at this point,"},{"line_number":55,"context_line":"no additional external calls will be needed."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Add validation for these remote authentication methods:"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"* ``password`` - Validate that ``admin_password`` is passed or set by Nova."},{"line_number":60,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3ac371cc_43e9191a","line":57,"range":{"start_line":57,"start_character":25,"end_line":57,"end_character":31},"updated":"2016-08-15 15:21:11.000000000","message":"why remote ?","commit_id":"459c2b82a8a0b240fbb1aa01f92f14065476bec3"},{"author":{"_account_id":20522,"name":"Aline Bousquet","email":"albousque@gmail.com","username":"alineb"},"change_message_id":"d18912938217c26d6c6804e090b5e243d9591611","unresolved":false,"context_lines":[{"line_number":54,"context_line":"Since image meta-data is already requested at this point,"},{"line_number":55,"context_line":"no additional external calls will be needed."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Add validation for these remote authentication methods:"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"* ``password`` - Validate that ``admin_password`` is passed or set by Nova."},{"line_number":60,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3ac371cc_e071b077","line":57,"range":{"start_line":57,"start_character":25,"end_line":57,"end_character":31},"in_reply_to":"3ac371cc_43e9191a","updated":"2016-08-17 10:06:49.000000000","message":"This spec focuses on remote authentication methods since that’s the most common use case when accessing an instance.","commit_id":"459c2b82a8a0b240fbb1aa01f92f14065476bec3"},{"author":{"_account_id":6062,"name":"jichenjc","email":"jichenjc@cn.ibm.com","username":"jichenjc"},"change_message_id":"896947582a4a739a50ba50aaac2263e0ba27b961","unresolved":false,"context_lines":[{"line_number":64,"context_line":"* ``x509_cert`` - Check ``key_pair``, ``key_data``, and ``injected_files``"},{"line_number":65,"context_line":"  to see if an x509 certificate is being passed to the instance."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"* ``preset`` - Indicates that remote authentication credentials are preset in"},{"line_number":68,"context_line":"  the image and no credentials need to be present in the create request."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"This list of methods is not necessarily comprehensive, and may grow in the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3ac371cc_03e8c10f","line":67,"range":{"start_line":67,"start_character":4,"end_line":67,"end_character":10},"updated":"2016-08-15 15:21:11.000000000","message":"maybe \u0027none\u0027?","commit_id":"459c2b82a8a0b240fbb1aa01f92f14065476bec3"},{"author":{"_account_id":20522,"name":"Aline Bousquet","email":"albousque@gmail.com","username":"alineb"},"change_message_id":"d18912938217c26d6c6804e090b5e243d9591611","unresolved":false,"context_lines":[{"line_number":64,"context_line":"* ``x509_cert`` - Check ``key_pair``, ``key_data``, and ``injected_files``"},{"line_number":65,"context_line":"  to see if an x509 certificate is being passed to the instance."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"* ``preset`` - Indicates that remote authentication credentials are preset in"},{"line_number":68,"context_line":"  the image and no credentials need to be present in the create request."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"This list of methods is not necessarily comprehensive, and may grow in the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3ac371cc_603300ac","line":67,"range":{"start_line":67,"start_character":4,"end_line":67,"end_character":10},"in_reply_to":"3ac371cc_03e8c10f","updated":"2016-08-17 10:06:49.000000000","message":"This is used when listing the supported authentication method, so i think using ‘none’ may be confusing? While \u0027preset\u0027 indicates that there is no need to specify credentials since they are already in the image. WDYT?","commit_id":"459c2b82a8a0b240fbb1aa01f92f14065476bec3"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"ec1d2b3f93f7b7154769ccaf9106b141a20e6777","unresolved":false,"context_lines":[{"line_number":87,"context_line":"Proposed configuration options:"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"* ``validate_authentication_methods`` a boolean option which enables"},{"line_number":90,"context_line":"  or disables this feature completely. Should default to ``False``."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"* ``metadata_property_name`` a string representing the image meta-data"},{"line_number":93,"context_line":"  property name which will list the image\u0027s supported remote authentication"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3ac371cc_836a83ec","line":90,"updated":"2016-08-17 11:21:38.000000000","message":"If the image property is set, we should always honour it. I don\u0027t see a reason for turning this off - its just a pointless extra config option","commit_id":"5f3952b6305119a27c145eb9c6a42d1229244601"},{"author":{"_account_id":20522,"name":"Aline Bousquet","email":"albousque@gmail.com","username":"alineb"},"change_message_id":"f98c50114548d89a327f92153107edfdaae9b997","unresolved":false,"context_lines":[{"line_number":87,"context_line":"Proposed configuration options:"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"* ``validate_authentication_methods`` a boolean option which enables"},{"line_number":90,"context_line":"  or disables this feature completely. Should default to ``False``."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"* ``metadata_property_name`` a string representing the image meta-data"},{"line_number":93,"context_line":"  property name which will list the image\u0027s supported remote authentication"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa7ab95a_62e39dd9","line":90,"in_reply_to":"3ac371cc_836a83ec","updated":"2016-08-30 13:09:44.000000000","message":"I’m not sure about this: as other reviewers suggested, I think there are usecases where this functionality isn’t needed and where a user may want to boot an instance without SSH or password access. Because of that, an option to disable the functionality should probably be available?\nWhat do you think?","commit_id":"5f3952b6305119a27c145eb9c6a42d1229244601"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"ec1d2b3f93f7b7154769ccaf9106b141a20e6777","unresolved":false,"context_lines":[{"line_number":91,"context_line":""},{"line_number":92,"context_line":"* ``metadata_property_name`` a string representing the image meta-data"},{"line_number":93,"context_line":"  property name which will list the image\u0027s supported remote authentication"},{"line_number":94,"context_line":"  methods."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"* ``check_key_data`` a boolean option that enables or disables inspecting"},{"line_number":97,"context_line":"  ``key_data`` to determine if it appears to be an SSH public-key or x509"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3ac371cc_63e4a7ab","line":94,"updated":"2016-08-17 11:21:38.000000000","message":"If you make the image property name configurable then we will have no consistent setup for this across cloud deployments, so we absolutely do not want todo this.\n\nThe ImageMetaProps object should define a standard property for this purpose which cannot be changed per-deployment.","commit_id":"5f3952b6305119a27c145eb9c6a42d1229244601"},{"author":{"_account_id":20522,"name":"Aline Bousquet","email":"albousque@gmail.com","username":"alineb"},"change_message_id":"f98c50114548d89a327f92153107edfdaae9b997","unresolved":false,"context_lines":[{"line_number":91,"context_line":""},{"line_number":92,"context_line":"* ``metadata_property_name`` a string representing the image meta-data"},{"line_number":93,"context_line":"  property name which will list the image\u0027s supported remote authentication"},{"line_number":94,"context_line":"  methods."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"* ``check_key_data`` a boolean option that enables or disables inspecting"},{"line_number":97,"context_line":"  ``key_data`` to determine if it appears to be an SSH public-key or x509"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa7ab95a_02dbb11b","line":94,"in_reply_to":"3ac371cc_63e4a7ab","updated":"2016-08-30 13:09:44.000000000","message":"Thanks, I will change that in the next patch.","commit_id":"5f3952b6305119a27c145eb9c6a42d1229244601"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"ec1d2b3f93f7b7154769ccaf9106b141a20e6777","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"* ``check_injected_files`` a boolean options that enables or disables"},{"line_number":101,"context_line":"  inspecting ``injected_files`` data to see if one of the files appears to be"},{"line_number":102,"context_line":"  an SSH public-key or x509 certificate."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Add code to Nova to prevent remote authentication using a specific method."},{"line_number":105,"context_line":"The prohibited methods will be defined in the image metadata, using the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3ac371cc_a6286d87","line":102,"updated":"2016-08-17 11:21:38.000000000","message":"Again, IMHO we should just always do this if the image meta prop requires this. Turning this off in the node will just lead to a silent change in behaviour of image property.","commit_id":"5f3952b6305119a27c145eb9c6a42d1229244601"},{"author":{"_account_id":20522,"name":"Aline Bousquet","email":"albousque@gmail.com","username":"alineb"},"change_message_id":"f98c50114548d89a327f92153107edfdaae9b997","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"* ``check_injected_files`` a boolean options that enables or disables"},{"line_number":101,"context_line":"  inspecting ``injected_files`` data to see if one of the files appears to be"},{"line_number":102,"context_line":"  an SSH public-key or x509 certificate."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Add code to Nova to prevent remote authentication using a specific method."},{"line_number":105,"context_line":"The prohibited methods will be defined in the image metadata, using the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa7ab95a_42077981","line":102,"in_reply_to":"3ac371cc_a6286d87","updated":"2016-08-30 13:09:44.000000000","message":"This isn’t required by the functionality since a key can be specified using other ways, for instance using a keypair.\n\nAlso, inspecting the injected files to check if one of them seems to be a key/cert can be a resource-intensive task (see the section on performance impact), so I think it should be possible to disable it. \n\nLet me know what you think.","commit_id":"5f3952b6305119a27c145eb9c6a42d1229244601"}]}