)]}'
{"specs/newton/approved/use-castellan-key-manager.rst":[{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"62eee445ae051893e35dc73b517feee4b429d9f1","unresolved":false,"context_lines":[{"line_number":66,"context_line":"deprecating class-based loading should live in the Castellan/Barbican specs."},{"line_number":67,"context_line":"The followng are possible alternatives, which solve one or more of the goals:"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":" * Remove and Replace ConfKeyManager"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"   One strategy for a path forward is to deprecate and remove ConfKeyManager"},{"line_number":72,"context_line":"   and find an alternative back end suitable for testing. The ConfKeyManager"}],"source_content_type":"text/x-rst","patch_set":1,"id":"dada55a8_3b51650f","line":69,"range":{"start_line":69,"start_character":14,"end_line":69,"end_character":15},"updated":"2016-07-19 19:26:07.000000000","message":"nit: Replace -\u003e replace","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"6161a27049fa7b558a97416735ee34f19efdf5f2","unresolved":false,"context_lines":[{"line_number":66,"context_line":"deprecating class-based loading should live in the Castellan/Barbican specs."},{"line_number":67,"context_line":"The followng are possible alternatives, which solve one or more of the goals:"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":" * Remove and Replace ConfKeyManager"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"   One strategy for a path forward is to deprecate and remove ConfKeyManager"},{"line_number":72,"context_line":"   and find an alternative back end suitable for testing. The ConfKeyManager"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ac371cc_3d7515f9","line":69,"range":{"start_line":69,"start_character":14,"end_line":69,"end_character":15},"in_reply_to":"dada55a8_3b51650f","updated":"2016-08-15 16:54:11.000000000","message":"Will fix in next patch","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"62eee445ae051893e35dc73b517feee4b429d9f1","unresolved":false,"context_lines":[{"line_number":85,"context_line":"   * Option 1: KMIP Castellan back end"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"     The Key Manager Interoperability Protocol (KMIP) is a standardized"},{"line_number":88,"context_line":"     protocol for interacting with a key manager. The PyKMIP library includes"},{"line_number":89,"context_line":"     not only client code necessary for interacting with a KMIP hardware"},{"line_number":90,"context_line":"     device but also a KMIP software server with Keystone authentication that"},{"line_number":91,"context_line":"     is useful for functional testing where a hardware device is not an"}],"source_content_type":"text/x-rst","patch_set":1,"id":"dada55a8_bbab95d5","line":88,"range":{"start_line":88,"start_character":54,"end_line":88,"end_character":68},"updated":"2016-07-19 19:26:07.000000000","message":"reference?","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"6161a27049fa7b558a97416735ee34f19efdf5f2","unresolved":false,"context_lines":[{"line_number":85,"context_line":"   * Option 1: KMIP Castellan back end"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"     The Key Manager Interoperability Protocol (KMIP) is a standardized"},{"line_number":88,"context_line":"     protocol for interacting with a key manager. The PyKMIP library includes"},{"line_number":89,"context_line":"     not only client code necessary for interacting with a KMIP hardware"},{"line_number":90,"context_line":"     device but also a KMIP software server with Keystone authentication that"},{"line_number":91,"context_line":"     is useful for functional testing where a hardware device is not an"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ac371cc_7dccad35","line":88,"range":{"start_line":88,"start_character":54,"end_line":88,"end_character":68},"in_reply_to":"dada55a8_bbab95d5","updated":"2016-08-15 16:54:11.000000000","message":"Will add link to https://github.com/OpenKMIP/PyKMIP with next patch","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"62eee445ae051893e35dc73b517feee4b429d9f1","unresolved":false,"context_lines":[{"line_number":89,"context_line":"     not only client code necessary for interacting with a KMIP hardware"},{"line_number":90,"context_line":"     device but also a KMIP software server with Keystone authentication that"},{"line_number":91,"context_line":"     is useful for functional testing where a hardware device is not an"},{"line_number":92,"context_line":"     option. Work on a KMIP Castellan back end has already started, but would"},{"line_number":93,"context_line":"     need to be completed for this option. The PyKMIP software server is"},{"line_number":94,"context_line":"     already used in the Barbican functional gate. New DevStack gate checks"},{"line_number":95,"context_line":"     could be configured to use the PyKMIP server for the encryption Tempest"}],"source_content_type":"text/x-rst","patch_set":1,"id":"dada55a8_3b78458f","line":92,"range":{"start_line":92,"start_character":21,"end_line":92,"end_character":66},"updated":"2016-07-19 19:26:07.000000000","message":"reference?","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"6161a27049fa7b558a97416735ee34f19efdf5f2","unresolved":false,"context_lines":[{"line_number":89,"context_line":"     not only client code necessary for interacting with a KMIP hardware"},{"line_number":90,"context_line":"     device but also a KMIP software server with Keystone authentication that"},{"line_number":91,"context_line":"     is useful for functional testing where a hardware device is not an"},{"line_number":92,"context_line":"     option. Work on a KMIP Castellan back end has already started, but would"},{"line_number":93,"context_line":"     need to be completed for this option. The PyKMIP software server is"},{"line_number":94,"context_line":"     already used in the Barbican functional gate. New DevStack gate checks"},{"line_number":95,"context_line":"     could be configured to use the PyKMIP server for the encryption Tempest"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ac371cc_7d682df6","line":92,"range":{"start_line":92,"start_character":21,"end_line":92,"end_character":66},"in_reply_to":"dada55a8_3b78458f","updated":"2016-08-15 16:54:11.000000000","message":"Will add link to https://review.openstack.org/#/c/298991/ in next patch","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":7789,"name":"John Wood","email":"john.wood@rackspace.com","username":"woodster"},"change_message_id":"308eaa4dc4bafb98aeb7675e6a3209c327b1de36","unresolved":false,"context_lines":[{"line_number":98,"context_line":""},{"line_number":99,"context_line":"   * Option 2: Barbican Castellan back end"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"     A Barbican back end already exists for Castellan. This option entails"},{"line_number":102,"context_line":"     editing DevStack gate jobs and/or DevStack itself to configure and launch"},{"line_number":103,"context_line":"     Barbican. This option is beneficial because it would test encryption"},{"line_number":104,"context_line":"     features as they should be used in production, as Barbican is the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ac371cc_86402d58","line":101,"updated":"2016-08-15 22:07:15.000000000","message":"What Barbican backend would you recommend? The default plugin is insecure, but easy to configure (no additional services need be setup) and suitable for testing. You could also setup KMIP/Dogtag, but that seems overboard for integration testing to me.","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"50e5ab35ae54d31c9c448da310038747676e5bf1","unresolved":false,"context_lines":[{"line_number":98,"context_line":""},{"line_number":99,"context_line":"   * Option 2: Barbican Castellan back end"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"     A Barbican back end already exists for Castellan. This option entails"},{"line_number":102,"context_line":"     editing DevStack gate jobs and/or DevStack itself to configure and launch"},{"line_number":103,"context_line":"     Barbican. This option is beneficial because it would test encryption"},{"line_number":104,"context_line":"     features as they should be used in production, as Barbican is the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ac06dbe_c880948e","line":101,"in_reply_to":"3ac371cc_86402d58","updated":"2016-08-24 19:22:48.000000000","message":"@John, for integration testing, I would recommend the default plugin.","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"62eee445ae051893e35dc73b517feee4b429d9f1","unresolved":false,"context_lines":[{"line_number":106,"context_line":"     Barbican [4] so it may not make sense to include it in all of the gates."},{"line_number":107,"context_line":"     This option would satisfy all three of the goals listed above."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"   * Option 3: New database back end"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"     This option is to create a new Castellan test fixture back end that can"},{"line_number":112,"context_line":"     store multiple objects in a database. While this option will not provide"}],"source_content_type":"text/x-rst","patch_set":1,"id":"dada55a8_7b459d15","line":109,"updated":"2016-07-19 19:26:07.000000000","message":"Isn\u0027t this option similar to using Barbican -- i.e., the database back end essentially reimplements Barbican\u0027s HSM key store?","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"29513904ebf3ddb0370a1bee40c7d2ea203b2c0e","unresolved":false,"context_lines":[{"line_number":106,"context_line":"     Barbican [4] so it may not make sense to include it in all of the gates."},{"line_number":107,"context_line":"     This option would satisfy all three of the goals listed above."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"   * Option 3: New database back end"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"     This option is to create a new Castellan test fixture back end that can"},{"line_number":112,"context_line":"     store multiple objects in a database. While this option will not provide"}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa7ab95a_7545a715","line":109,"in_reply_to":"3ac371cc_603524d9","updated":"2016-08-26 21:16:56.000000000","message":"I was wondering if this option could instead be for Barbican to be configured with a minimal setup to support a subset of its features. If support for Barbican waned in the future, it\u0027s possible that the minimal configuration could more easily be maintained and supported.\n\nAs you have it now, for Option 3 as a new backend, I think the motivation to develop this instead of use Barbican should be called out, since the description only compares it to ConfKeyManager.","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"6161a27049fa7b558a97416735ee34f19efdf5f2","unresolved":false,"context_lines":[{"line_number":106,"context_line":"     Barbican [4] so it may not make sense to include it in all of the gates."},{"line_number":107,"context_line":"     This option would satisfy all three of the goals listed above."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"   * Option 3: New database back end"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"     This option is to create a new Castellan test fixture back end that can"},{"line_number":112,"context_line":"     store multiple objects in a database. While this option will not provide"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ac371cc_603524d9","line":109,"in_reply_to":"9ad45d7e_40388fef","updated":"2016-08-15 16:54:11.000000000","message":"Yes, option 3 would be similar to how Barbican\u0027s back end currently works, though it would probably be quite stripped down and not have as many features.","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"40d8dd5e6a70dde00e9e75e7e5466e3272ea8e96","unresolved":false,"context_lines":[{"line_number":106,"context_line":"     Barbican [4] so it may not make sense to include it in all of the gates."},{"line_number":107,"context_line":"     This option would satisfy all three of the goals listed above."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"   * Option 3: New database back end"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"     This option is to create a new Castellan test fixture back end that can"},{"line_number":112,"context_line":"     store multiple objects in a database. While this option will not provide"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9ad45d7e_40388fef","line":109,"in_reply_to":"dada55a8_7b459d15","updated":"2016-08-10 12:20:23.000000000","message":"Right, Option 3 seems like it\u0027s just rewrite barbican a second time, right?","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"a14b9434124b9d39884e948db6287666829038f4","unresolved":false,"context_lines":[{"line_number":106,"context_line":"     Barbican [4] so it may not make sense to include it in all of the gates."},{"line_number":107,"context_line":"     This option would satisfy all three of the goals listed above."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"   * Option 3: New database back end"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"     This option is to create a new Castellan test fixture back end that can"},{"line_number":112,"context_line":"     store multiple objects in a database. While this option will not provide"}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa7ab95a_bd2c1f03","line":109,"in_reply_to":"fa7ab95a_7545a715","updated":"2016-08-29 18:56:41.000000000","message":"@Bruce, a minimally configured Barbican (option 2) is essentially the same thing as a db back end (option 3). The Barbican simple secret store stores things in a db. To me, option 2 is preferable to option 3 since all of the work is already done. It does not seem true to say that unknown future support for Barbican is motivation for writing our own, since it seems preferable to support Barbican and integrate it where possible","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"58c2d733b00524a9b5410b43fad7b9b2feed14bd","unresolved":false,"context_lines":[{"line_number":106,"context_line":"     Barbican [4] so it may not make sense to include it in all of the gates."},{"line_number":107,"context_line":"     This option would satisfy all three of the goals listed above."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"   * Option 3: New database back end"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"     This option is to create a new Castellan test fixture back end that can"},{"line_number":112,"context_line":"     store multiple objects in a database. While this option will not provide"}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa7ab95a_83745836","line":109,"in_reply_to":"fa7ab95a_bd2c1f03","updated":"2016-08-29 19:28:52.000000000","message":"Thanks Kaitlin. So if my first paragraph above is really equivalent to option 2, then I totally agree that option 2 is preferable.  Relating to my second paragraph above, I was just trying to say that if you don\u0027t see any advantages of Option 3 over Option 2, I think it would be helpful to state that explicitly in this section.\n\nSuggested update:\ns/Option 1 or Option 2 would require less Castellan development work./This option provides no advantages over a minimally configured Barbican (Option 2), and Option 1 or Option 2 would require less Castellan development work./","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"40d8dd5e6a70dde00e9e75e7e5466e3272ea8e96","unresolved":false,"context_lines":[{"line_number":131,"context_line":"     The Tempest tests are the only place where ConfKeyManager should be used,"},{"line_number":132,"context_line":"     so the back end could be moved to Tempest. As long as Castellan provides"},{"line_number":133,"context_line":"     an option to register back ends if class-based loading is deprecated,"},{"line_number":134,"context_line":"     this option could satisfy all three of the goals above."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"   * Option 5: Move ConfKeyManager to Castellan"},{"line_number":137,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"9ad45d7e_007df7b0","line":134,"updated":"2016-08-10 12:20:23.000000000","message":"NAK: This would break a bunch of the separation between Tempest and the rest of the stack we try to keep for sanity purposes.","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"6161a27049fa7b558a97416735ee34f19efdf5f2","unresolved":false,"context_lines":[{"line_number":131,"context_line":"     The Tempest tests are the only place where ConfKeyManager should be used,"},{"line_number":132,"context_line":"     so the back end could be moved to Tempest. As long as Castellan provides"},{"line_number":133,"context_line":"     an option to register back ends if class-based loading is deprecated,"},{"line_number":134,"context_line":"     this option could satisfy all three of the goals above."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"   * Option 5: Move ConfKeyManager to Castellan"},{"line_number":137,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ac371cc_e082b4ff","line":134,"in_reply_to":"9ad45d7e_007df7b0","updated":"2016-08-15 16:54:11.000000000","message":"Thanks, noted.","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"40d8dd5e6a70dde00e9e75e7e5466e3272ea8e96","unresolved":false,"context_lines":[{"line_number":133,"context_line":"     an option to register back ends if class-based loading is deprecated,"},{"line_number":134,"context_line":"     this option could satisfy all three of the goals above."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"   * Option 5: Move ConfKeyManager to Castellan"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"     This is not a recommended option. The ConfKeyManager does not support"},{"line_number":139,"context_line":"     testing of features such as signed image verification, which uses"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9ad45d7e_2080fb8a","line":136,"updated":"2016-08-10 12:20:23.000000000","message":"I\u0027d like to understand more about why this doesn\u0027t work.","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"6161a27049fa7b558a97416735ee34f19efdf5f2","unresolved":false,"context_lines":[{"line_number":133,"context_line":"     an option to register back ends if class-based loading is deprecated,"},{"line_number":134,"context_line":"     this option could satisfy all three of the goals above."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"   * Option 5: Move ConfKeyManager to Castellan"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"     This is not a recommended option. The ConfKeyManager does not support"},{"line_number":139,"context_line":"     testing of features such as signed image verification, which uses"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ac371cc_4360f2ce","line":136,"in_reply_to":"9ad45d7e_2080fb8a","updated":"2016-08-15 16:54:11.000000000","message":"A few reasons. ConfKeyManager won\u0027t support all of the encryption features that are being developed.  Also, if deployers don\u0027t realize that additional key manager configuration is needed before using encryption features securely, they may use the default ConfKeyManager by mistake. If Castellan only supports deployment-ready back ends, it will be more difficult to accidentally deploy an insecure back end.","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":6802,"name":"Joel Coffman","email":"jmc7tp@gmail.com","username":"joel-coffman"},"change_message_id":"62eee445ae051893e35dc73b517feee4b429d9f1","unresolved":false,"context_lines":[{"line_number":136,"context_line":"   * Option 5: Move ConfKeyManager to Castellan"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"     This is not a recommended option. The ConfKeyManager does not support"},{"line_number":139,"context_line":"     testing of features such as signed image verification, which uses"},{"line_number":140,"context_line":"     certificates, not keys. Moving ConfKeyManager to Castellan will push"},{"line_number":141,"context_line":"     the problem of not having an adequate testing back end down the road."},{"line_number":142,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"dada55a8_1b6e2195","line":139,"range":{"start_line":139,"start_character":33,"end_line":139,"end_character":58},"updated":"2016-07-19 19:26:07.000000000","message":"reference?","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"6161a27049fa7b558a97416735ee34f19efdf5f2","unresolved":false,"context_lines":[{"line_number":136,"context_line":"   * Option 5: Move ConfKeyManager to Castellan"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"     This is not a recommended option. The ConfKeyManager does not support"},{"line_number":139,"context_line":"     testing of features such as signed image verification, which uses"},{"line_number":140,"context_line":"     certificates, not keys. Moving ConfKeyManager to Castellan will push"},{"line_number":141,"context_line":"     the problem of not having an adequate testing back end down the road."},{"line_number":142,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ac371cc_80878060","line":139,"range":{"start_line":139,"start_character":33,"end_line":139,"end_character":58},"in_reply_to":"dada55a8_1b6e2195","updated":"2016-08-15 16:54:11.000000000","message":"Will add a link to https://specs.openstack.org/openstack/glance-specs/specs/liberty/image-signing-and-verification-support.html","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"40d8dd5e6a70dde00e9e75e7e5466e3272ea8e96","unresolved":false,"context_lines":[{"line_number":142,"context_line":""},{"line_number":143,"context_line":" * Revert the Castellan integration patch"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"    * Option 6: Revert to nova/keymgr"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"      This is not a recommended option. The key manager interface will be left"},{"line_number":148,"context_line":"      as it is in nova/keymgr, but this means that Nova\u0027s key manager will not"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9ad45d7e_80b9e77b","line":145,"updated":"2016-08-10 12:20:23.000000000","message":"NAK: I don\u0027t want us to go backwards here.","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"6161a27049fa7b558a97416735ee34f19efdf5f2","unresolved":false,"context_lines":[{"line_number":142,"context_line":""},{"line_number":143,"context_line":" * Revert the Castellan integration patch"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"    * Option 6: Revert to nova/keymgr"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"      This is not a recommended option. The key manager interface will be left"},{"line_number":148,"context_line":"      as it is in nova/keymgr, but this means that Nova\u0027s key manager will not"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ac371cc_e07c7474","line":145,"in_reply_to":"9ad45d7e_80b9e77b","updated":"2016-08-15 16:54:11.000000000","message":"Thanks, noted.","commit_id":"81cf7ce08dadab4655284749ac7ea188936d9a30"}],"specs/newton/implemented/use-castellan-key-manager.rst":[{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"fa658dacb8dcb72daa0265a122092da1e06c812c","unresolved":false,"context_lines":[{"line_number":64,"context_line":""},{"line_number":65,"context_line":"However, class-based loading is a Castellan feature, and so the spec for"},{"line_number":66,"context_line":"deprecating class-based loading should live in the Castellan/Barbican specs."},{"line_number":67,"context_line":"The followng are possible alternatives, which solve one or more of the goals:"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":" * Remove and replace ConfKeyManager"},{"line_number":70,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a3c09a3_5ea55602","line":67,"range":{"start_line":67,"start_character":4,"end_line":67,"end_character":12},"updated":"2017-01-13 17:30:21.000000000","message":"s/followng/following","commit_id":"ebf04e087d30d1877b24ae197d704e2a34b67279"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"3117fc7d5eaa0560aa78ca26e07e57a13a913a66","unresolved":false,"context_lines":[{"line_number":66,"context_line":"deprecating class-based loading should live in the Castellan/Barbican specs."},{"line_number":67,"context_line":"The followng are possible alternatives, which solve one or more of the goals:"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":" * Remove and replace ConfKeyManager"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"   One strategy for a path forward is to deprecate and remove ConfKeyManager"},{"line_number":72,"context_line":"   and find an alternative back end suitable for testing. The ConfKeyManager"}],"source_content_type":"text/x-rst","patch_set":3,"id":"dfeb2761_33307be8","line":69,"updated":"2017-04-04 15:56:00.000000000","message":"You mean \"repeal and replace\"? ;P","commit_id":"ebf04e087d30d1877b24ae197d704e2a34b67279"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"fa658dacb8dcb72daa0265a122092da1e06c812c","unresolved":false,"context_lines":[{"line_number":87,"context_line":"     The Key Manager Interoperability Protocol (KMIP) is a standardized"},{"line_number":88,"context_line":"     protocol for interacting with a key manager. The PyKMIP library [6]"},{"line_number":89,"context_line":"     includes not only client code necessary for interacting with a KMIP"},{"line_number":90,"context_line":"     hardware device but also a KMIP software server with Keystone"},{"line_number":91,"context_line":"     authentication that is useful for functional testing where a hardware"},{"line_number":92,"context_line":"     device is not an option. Work on a KMIP Castellan back end has already"},{"line_number":93,"context_line":"     started [7], but would need to be completed for this option. The PyKMIP"},{"line_number":94,"context_line":"     software server is already used in the Barbican functional gate. New"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a3c09a3_7e469224","line":91,"range":{"start_line":90,"start_character":53,"end_line":91,"end_character":19},"updated":"2017-01-13 17:30:21.000000000","message":"So just to clarify here, I\u0027ve prototyped Keystone integration with PyKMIP and it works but it was never officially merged into PyKMIP. That would need to happen before this option could be viable.","commit_id":"ebf04e087d30d1877b24ae197d704e2a34b67279"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"3117fc7d5eaa0560aa78ca26e07e57a13a913a66","unresolved":false,"context_lines":[{"line_number":123,"context_line":" * Move ConfKeyManager elsewhere"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"   The community has expressed concern about ConfKeyManager living in the"},{"line_number":126,"context_line":"   Nova code base, but moving ConfKeyManager into Castellan is not preferred."},{"line_number":127,"context_line":"   The following are options for if ConfKeyManager cannot be deprecated:"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"   * Option 4: Move ConfKeyManager to Tempest"}],"source_content_type":"text/x-rst","patch_set":3,"id":"dfeb2761_134fb76b","line":126,"updated":"2017-04-04 15:56:00.000000000","message":"Might be good to add a link to a ML discussion about the expressed concern?","commit_id":"ebf04e087d30d1877b24ae197d704e2a34b67279"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"26f57c5b270adedfa6b8efc92078ccfcfa71989a","unresolved":false,"context_lines":[{"line_number":123,"context_line":" * Move ConfKeyManager elsewhere"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"   The community has expressed concern about ConfKeyManager living in the"},{"line_number":126,"context_line":"   Nova code base, but moving ConfKeyManager into Castellan is not preferred."},{"line_number":127,"context_line":"   The following are options for if ConfKeyManager cannot be deprecated:"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"   * Option 4: Move ConfKeyManager to Tempest"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f1d235d_05defcd8","line":126,"in_reply_to":"dfeb2761_134fb76b","updated":"2017-07-06 20:55:14.000000000","message":"There was no mailing list discussion about this, from what I remember. It was a conversation in IRC that prompted this spec update:\n\nhttp://eavesdrop.openstack.org/irclogs/%23openstack-nova/%23openstack-nova.2016-06-13.log.html#t2016-06-13T18:44:47","commit_id":"ebf04e087d30d1877b24ae197d704e2a34b67279"}]}