)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"06e6ffb5f8e411f16b4508a259638a07c7b4c4d8","unresolved":false,"context_lines":[{"line_number":10,"context_line":"So we need a nova spec to illustrate the blueprint."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"APIImpact"},{"line_number":13,"context_line":"DocImpact"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Change-Id: I024dd6890af3dbceee4f704aa1049b5fa563f453"},{"line_number":16,"context_line":"Blueprint: rebuild-keypair-reset"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"5f4e5783_f45d6ae9","line":13,"range":{"start_line":13,"start_character":0,"end_line":13,"end_character":9},"updated":"2017-10-12 15:08:09.000000000","message":"We don\u0027t need this tag on a nova-spec change. It might generate a bug and we don\u0027t have anything to do for a bug for this.","commit_id":"f722ddc6cde6f53342032aa324dcced9d73c7bbc"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"e39b4732ffe0faa59abbca379091d79719a081be","unresolved":false,"context_lines":[{"line_number":10,"context_line":"So we need a nova spec to illustrate the blueprint."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"APIImpact"},{"line_number":13,"context_line":"DocImpact"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Change-Id: I024dd6890af3dbceee4f704aa1049b5fa563f453"},{"line_number":16,"context_line":"Blueprint: rebuild-keypair-reset"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"5f4e5783_37d66451","line":13,"range":{"start_line":13,"start_character":0,"end_line":13,"end_character":9},"in_reply_to":"5f4e5783_f45d6ae9","updated":"2017-10-12 16:00:10.000000000","message":"Done","commit_id":"f722ddc6cde6f53342032aa324dcced9d73c7bbc"}],"specs/ocata/approved/rebuild-keypair-reset.rst":[{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"41ffbebf6df6ef1e9d1e67b07ba8cb7f68991131","unresolved":false,"context_lines":[{"line_number":124,"context_line":"* Rubild a instance and see if the key_name and key_data in DB are really"},{"line_number":125,"context_line":"  changed."},{"line_number":126,"context_line":"* If the rebuilt instance is in ACTIVE state, make sure the cloud-init or"},{"line_number":127,"context_line":"  config drive did the right public key setting."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_40101aa9","line":127,"updated":"2016-09-28 04:43:46.000000000","message":"We required tempest for new microversion.","commit_id":"eaf7a0f4681c5f8101c20b5b953a94f178381d19"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"96933e794ca10b0842e4e84849d2edf412396422","unresolved":false,"context_lines":[{"line_number":124,"context_line":"* Rubild a instance and see if the key_name and key_data in DB are really"},{"line_number":125,"context_line":"  changed."},{"line_number":126,"context_line":"* If the rebuilt instance is in ACTIVE state, make sure the cloud-init or"},{"line_number":127,"context_line":"  config drive did the right public key setting."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_2aa03aa5","line":127,"in_reply_to":"5a8bc5a2_40101aa9","updated":"2016-09-28 10:56:05.000000000","message":"Hi, Alex.\n\nShould I add that tempest statement here? Cloud you please paste me some microversion tempest guide? I did not see nova tempest cases in nova code repo, so will also need to change the tempest code ?","commit_id":"eaf7a0f4681c5f8101c20b5b953a94f178381d19"}],"specs/pike/approved/rebuild-keypair-reset.rst":[{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"a991c514c52676e06e5f2b52441318f10d2917c9","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Launchpad blueprint:"},{"line_number":12,"context_line":"https://blueprints.launchpad.net/nova/+spec/rebuild-keypair-reset"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"This spec describe how to implement the new apporach for reset keypair"},{"line_number":15,"context_line":"while rebuilding."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":6,"id":"dfeb2761_c66ab0eb","line":14,"updated":"2017-04-04 14:55:38.000000000","message":"s/describe/describes s/apporach/approach\n\nAlso should probably say \"resetting the keypair\" instead of \"reset keypair\".","commit_id":"c1f109c9dd1cedf0e62f5138917f0de74ba9e334"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"449f5ee60cd67c606e3bb6f9533e54051cea007a","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Launchpad blueprint:"},{"line_number":12,"context_line":"https://blueprints.launchpad.net/nova/+spec/rebuild-keypair-reset"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"This spec describe how to implement the new apporach for reset keypair"},{"line_number":15,"context_line":"while rebuilding."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":6,"id":"dfeb2761_f25c3bee","line":14,"in_reply_to":"dfeb2761_c66ab0eb","updated":"2017-04-05 03:45:06.000000000","message":"Done","commit_id":"c1f109c9dd1cedf0e62f5138917f0de74ba9e334"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"61c7176713365fb395b00203afa602bf559f6ab0","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Nova now has no way to reset the instance keypair, even during the rebuild"},{"line_number":21,"context_line":"procedure. So, at least, `nova rebulid` will be a good approach to reset"},{"line_number":22,"context_line":"the instance key pair. And in the foreseeable future, maybe the dynamic"},{"line_number":23,"context_line":"changing will be possible."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Use Cases"},{"line_number":26,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"dfeb2761_f18fb920","line":23,"range":{"start_line":22,"start_character":23,"end_line":23,"end_character":26},"updated":"2017-04-04 11:32:52.000000000","message":"I think we we should drop this bit, its not about this spec.","commit_id":"c1f109c9dd1cedf0e62f5138917f0de74ba9e334"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"449f5ee60cd67c606e3bb6f9533e54051cea007a","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Nova now has no way to reset the instance keypair, even during the rebuild"},{"line_number":21,"context_line":"procedure. So, at least, `nova rebulid` will be a good approach to reset"},{"line_number":22,"context_line":"the instance key pair. And in the foreseeable future, maybe the dynamic"},{"line_number":23,"context_line":"changing will be possible."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Use Cases"},{"line_number":26,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"dfeb2761_926baf83","line":23,"range":{"start_line":22,"start_character":23,"end_line":23,"end_character":26},"in_reply_to":"dfeb2761_f18fb920","updated":"2017-04-05 03:45:06.000000000","message":"Done","commit_id":"c1f109c9dd1cedf0e62f5138917f0de74ba9e334"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"61c7176713365fb395b00203afa602bf559f6ab0","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"If the user lost the original private key, and without a password, the VM"},{"line_number":29,"context_line":"will not be able to login. Then this spec will use the rebuild API to make"},{"line_number":30,"context_line":"this possible."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Proposed change"},{"line_number":33,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"dfeb2761_9103cd73","line":30,"updated":"2017-04-04 11:32:52.000000000","message":"I am not sure how that helps the user though, it also deletes all their data, which is probably not what they want?\n\nIs the really use case about keeping the IP address and VM location, but refreshing the key in a stateless worker that is bootstrapped from the user_data?\n\nNot sure that case makes a whole heap of sense.","commit_id":"c1f109c9dd1cedf0e62f5138917f0de74ba9e334"},{"author":{"_account_id":1063,"name":"Ed Leafe","email":"ed@leafe.com","username":"ed-leafe"},"change_message_id":"9061501316d2b21fe0aca3ad195bc0e24de1212b","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"If the user lost the original private key, and without a password, the VM"},{"line_number":29,"context_line":"will not be able to login. Then this spec will use the rebuild API to make"},{"line_number":30,"context_line":"this possible."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Proposed change"},{"line_number":33,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"dfeb2761_da1a89ca","line":30,"in_reply_to":"dfeb2761_9103cd73","updated":"2017-04-04 13:24:16.000000000","message":"Agreed - I don\u0027t see any benefit over building a new VM with the user\u0027s key.","commit_id":"c1f109c9dd1cedf0e62f5138917f0de74ba9e334"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"a57e4c6ef552c9d3ea72560362069d5fbc97c400","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"If the user lost the original private key, and without a password, the VM"},{"line_number":29,"context_line":"will not be able to login. Then this spec will use the rebuild API to make"},{"line_number":30,"context_line":"this possible."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Proposed change"},{"line_number":33,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"dfeb2761_1282ff00","line":30,"in_reply_to":"dfeb2761_d2fa57bb","updated":"2017-04-05 03:50:23.000000000","message":"It\u0027s something similar to that rebuilding with admin_pass.","commit_id":"c1f109c9dd1cedf0e62f5138917f0de74ba9e334"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"449f5ee60cd67c606e3bb6f9533e54051cea007a","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"If the user lost the original private key, and without a password, the VM"},{"line_number":29,"context_line":"will not be able to login. Then this spec will use the rebuild API to make"},{"line_number":30,"context_line":"this possible."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Proposed change"},{"line_number":33,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"dfeb2761_d2fa57bb","line":30,"in_reply_to":"dfeb2761_da1a89ca","updated":"2017-04-05 03:45:06.000000000","message":"It\u0027s rebuilding the old VM with a new key, so user could login the new rebuilt VM with the new key. Currently nova has no ability to change the VM login key pair, even for such rebuild action. I will make these lines more specific.","commit_id":"c1f109c9dd1cedf0e62f5138917f0de74ba9e334"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"a1e17594afc107aa36daae7f9cfbb968d7d6c330","unresolved":false,"context_lines":[{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Nova now has no way to reset the instance keypair, even during the rebuild"},{"line_number":21,"context_line":"procedure. So, at least, `nova rebulid` will be a good approach to reset"},{"line_number":22,"context_line":"the instance key pair."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Use Cases"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7f287b81_ed0a7a88","line":21,"range":{"start_line":21,"start_character":31,"end_line":21,"end_character":38},"updated":"2017-08-23 14:24:31.000000000","message":"rebuild","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"6f1501e9d7b97153b12ed4848e475c602ff48fe5","unresolved":false,"context_lines":[{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Nova now has no way to reset the instance keypair, even during the rebuild"},{"line_number":21,"context_line":"procedure. So, at least, `nova rebulid` will be a good approach to reset"},{"line_number":22,"context_line":"the instance key pair."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Use Cases"}],"source_content_type":"text/x-rst","patch_set":7,"id":"5f2577a7_7805a345","line":21,"range":{"start_line":21,"start_character":31,"end_line":21,"end_character":38},"in_reply_to":"7f287b81_ed0a7a88","updated":"2017-09-17 04:52:34.000000000","message":"Done","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"256dccbac3816ae17be16670c8a32c73ef78f733","unresolved":false,"context_lines":[{"line_number":21,"context_line":"procedure. So, at least, `nova rebulid` will be a good approach to reset"},{"line_number":22,"context_line":"the instance key pair."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Use Cases"},{"line_number":25,"context_line":"---------"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"While rebuiding instance, the user could set a new keypair for the instance."}],"source_content_type":"text/x-rst","patch_set":7,"id":"7f287b81_ad7112e3","line":24,"updated":"2017-08-23 14:25:38.000000000","message":"FWIW, the openstack infra team would also be interested in this, you should talk to Paul Belanger. So their use case could also fit above.","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"6f1501e9d7b97153b12ed4848e475c602ff48fe5","unresolved":false,"context_lines":[{"line_number":21,"context_line":"procedure. So, at least, `nova rebulid` will be a good approach to reset"},{"line_number":22,"context_line":"the instance key pair."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Use Cases"},{"line_number":25,"context_line":"---------"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"While rebuiding instance, the user could set a new keypair for the instance."}],"source_content_type":"text/x-rst","patch_set":7,"id":"5f2577a7_23612cd4","line":24,"in_reply_to":"7f287b81_ad7112e3","updated":"2017-09-17 04:52:34.000000000","message":"Done. Add Paul Belanger to the spec reviewer list.","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"121450cb466960b159c110dda4639147aaff009f","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Proposed change"},{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Will add a new parameter to rebuild API input body, which named ``key_name``."},{"line_number":35,"context_line":"And after rebuild API call, the response body must contain the updated new"},{"line_number":36,"context_line":"instance ``key_name``."},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"7f287b81_69f0b768","line":34,"range":{"start_line":34,"start_character":46,"end_line":34,"end_character":63},"updated":"2017-08-23 17:20:07.000000000","message":"s/body, which named/body, which is named/","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"6f1501e9d7b97153b12ed4848e475c602ff48fe5","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Proposed change"},{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Will add a new parameter to rebuild API input body, which named ``key_name``."},{"line_number":35,"context_line":"And after rebuild API call, the response body must contain the updated new"},{"line_number":36,"context_line":"instance ``key_name``."},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"5f2577a7_5802e73e","line":34,"range":{"start_line":34,"start_character":46,"end_line":34,"end_character":63},"in_reply_to":"7f287b81_69f0b768","updated":"2017-09-17 04:52:34.000000000","message":"Done","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"a1e17594afc107aa36daae7f9cfbb968d7d6c330","unresolved":false,"context_lines":[{"line_number":38,"context_line":"Alternatives"},{"line_number":39,"context_line":"------------"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"None"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Data model impact"},{"line_number":44,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7f287b81_6df68a92","line":41,"updated":"2017-08-23 14:24:31.000000000","message":"Well, the alternative is you delete and create a new VM with a different key pair. It would be nice to mention that and explain why that\u0027s not a sufficient alternative for your use case. I assume the answer is \"pet VMs\" though.","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"6f1501e9d7b97153b12ed4848e475c602ff48fe5","unresolved":false,"context_lines":[{"line_number":38,"context_line":"Alternatives"},{"line_number":39,"context_line":"------------"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"None"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Data model impact"},{"line_number":44,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"5f2577a7_38fb9b47","line":41,"in_reply_to":"7f287b81_6df68a92","updated":"2017-09-17 04:52:34.000000000","message":"Done","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"a1e17594afc107aa36daae7f9cfbb968d7d6c330","unresolved":false,"context_lines":[{"line_number":55,"context_line":""},{"line_number":56,"context_line":"::"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"  base_rebuild_vXXX \u003d copy.deepcopy(base_rebuild)"},{"line_number":59,"context_line":"  base_rebuild_vXXX[\u0027properties\u0027][\u0027rebuild\u0027]["},{"line_number":60,"context_line":"      \u0027properties\u0027][\u0027key_name\u0027] \u003d parameter_types.name"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Security impact"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7f287b81_cd345e4d","line":60,"range":{"start_line":58,"start_character":2,"end_line":60,"end_character":54},"updated":"2017-08-23 14:24:31.000000000","message":"This isn\u0027t helpful as it hides the full schema - it would be better to just show the actual json schema here.","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"6f1501e9d7b97153b12ed4848e475c602ff48fe5","unresolved":false,"context_lines":[{"line_number":55,"context_line":""},{"line_number":56,"context_line":"::"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"  base_rebuild_vXXX \u003d copy.deepcopy(base_rebuild)"},{"line_number":59,"context_line":"  base_rebuild_vXXX[\u0027properties\u0027][\u0027rebuild\u0027]["},{"line_number":60,"context_line":"      \u0027properties\u0027][\u0027key_name\u0027] \u003d parameter_types.name"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Security impact"}],"source_content_type":"text/x-rst","patch_set":7,"id":"5f2577a7_18f8df46","line":60,"range":{"start_line":58,"start_character":2,"end_line":60,"end_character":54},"in_reply_to":"7f287b81_cd345e4d","updated":"2017-09-17 04:52:34.000000000","message":"Done","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"a1e17594afc107aa36daae7f9cfbb968d7d6c330","unresolved":false,"context_lines":[{"line_number":69,"context_line":"Notifications impact"},{"line_number":70,"context_line":"--------------------"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"None"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Other end user impact"},{"line_number":75,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7f287b81_edcb9a1b","line":72,"updated":"2017-08-23 14:24:31.000000000","message":"I don\u0027t think this is correct. We have a versioned notification for rebuild.start and rebuild.end. They use the InstanceActionPayload which will put the instance.key_name in the notification, but will that be the old key_name or the new key_name when the notification is sent? You should clarify here.","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"6f1501e9d7b97153b12ed4848e475c602ff48fe5","unresolved":false,"context_lines":[{"line_number":69,"context_line":"Notifications impact"},{"line_number":70,"context_line":"--------------------"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"None"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Other end user impact"},{"line_number":75,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"5f2577a7_f89633f0","line":72,"in_reply_to":"7f287b81_edcb9a1b","updated":"2017-09-17 04:52:34.000000000","message":"Done","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"a1e17594afc107aa36daae7f9cfbb968d7d6c330","unresolved":false,"context_lines":[{"line_number":90,"context_line":"Developer impact"},{"line_number":91,"context_line":"----------------"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"New API microversion will be added, this may be a confict with other"},{"line_number":94,"context_line":"parallel nova API development."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7f287b81_2de1a29b","line":94,"range":{"start_line":93,"start_character":0,"end_line":94,"end_character":30},"updated":"2017-08-23 14:24:31.000000000","message":"I\u0027d just say \"None\" here. New microversions are implied conflicts.","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"6f1501e9d7b97153b12ed4848e475c602ff48fe5","unresolved":false,"context_lines":[{"line_number":90,"context_line":"Developer impact"},{"line_number":91,"context_line":"----------------"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"New API microversion will be added, this may be a confict with other"},{"line_number":94,"context_line":"parallel nova API development."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":7,"id":"5f2577a7_d89b7715","line":94,"range":{"start_line":93,"start_character":0,"end_line":94,"end_character":30},"in_reply_to":"7f287b81_2de1a29b","updated":"2017-09-17 04:52:34.000000000","message":"Done","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"a1e17594afc107aa36daae7f9cfbb968d7d6c330","unresolved":false,"context_lines":[{"line_number":121,"context_line":""},{"line_number":122,"context_line":"* Rubild a instance and see if the key_name and key_data in DB are really"},{"line_number":123,"context_line":"  changed."},{"line_number":124,"context_line":"* If the rebuilt instance is in ACTIVE state, make sure the cloud-init or"},{"line_number":125,"context_line":"  config drive did the right public key setting."},{"line_number":126,"context_line":"* Tempest cases for new microversion."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"7f287b81_4d92aef8","line":125,"range":{"start_line":124,"start_character":2,"end_line":125,"end_character":48},"updated":"2017-08-23 14:24:31.000000000","message":"This would be part of your tempest test, which is about the only way you\u0027re going to be able to test this since we don\u0027t have in-tree testing that will do live guest ssh like this.","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"6f1501e9d7b97153b12ed4848e475c602ff48fe5","unresolved":false,"context_lines":[{"line_number":121,"context_line":""},{"line_number":122,"context_line":"* Rubild a instance and see if the key_name and key_data in DB are really"},{"line_number":123,"context_line":"  changed."},{"line_number":124,"context_line":"* If the rebuilt instance is in ACTIVE state, make sure the cloud-init or"},{"line_number":125,"context_line":"  config drive did the right public key setting."},{"line_number":126,"context_line":"* Tempest cases for new microversion."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"5f2577a7_788a43bf","line":125,"range":{"start_line":124,"start_character":2,"end_line":125,"end_character":48},"in_reply_to":"7f287b81_4d92aef8","updated":"2017-09-17 04:52:34.000000000","message":"Done","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"121450cb466960b159c110dda4639147aaff009f","unresolved":false,"context_lines":[{"line_number":136,"context_line":"References"},{"line_number":137,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7f287b81_2983cfce","line":139,"range":{"start_line":139,"start_character":0,"end_line":139,"end_character":4},"updated":"2017-08-23 17:20:07.000000000","message":"I\u0027d recommend adding a link such as https://docs.openstack.org/nova/latest/reference/notifications.html to support the notification impact section update that Matt called out.","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"6f1501e9d7b97153b12ed4848e475c602ff48fe5","unresolved":false,"context_lines":[{"line_number":136,"context_line":"References"},{"line_number":137,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":7,"id":"5f2577a7_98a16f49","line":139,"range":{"start_line":139,"start_character":0,"end_line":139,"end_character":4},"in_reply_to":"7f287b81_2983cfce","updated":"2017-09-17 04:52:34.000000000","message":"Done","commit_id":"0cf7cada8c0fb86f9bfcbeb380aa0176d5a73214"}],"specs/queens/approved/rebuild-keypair-reset.rst":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"72774013e827f8c0ddb9f26ba4b18401a40949f1","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Proposed change"},{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Will add a new parameter to rebuild API input body, which is named"},{"line_number":35,"context_line":"``key_name``. And after rebuild API call, the response body must contain"},{"line_number":36,"context_line":"the updated new instance ``key_name``."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Alternatives"},{"line_number":39,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"7f515b1d_3470e772","line":36,"range":{"start_line":34,"start_character":0,"end_line":36,"end_character":38},"updated":"2017-09-22 14:16:49.000000000","message":"At the PTG we discussed this and agreed to just provide an API to allow updating the keypair for a given instance, which is in Kevin Zheng\u0027s spec here:\n\nhttps://review.openstack.org/#/c/506552\n\nThe reason being you might not need to rebuild the instance if simply rebooting it will refresh the key in the guest. This depends on how cloud-init is configured on the host, which is deployment specific, so that\u0027s kind of weird and we\u0027ll need to be clear in Kevin\u0027s spec about documenting this.\n\nBut it seems simpler to allow a single API to update the keypair for the instance and then let the user reboot or rebuild as necessary to refresh the keypair in the guest, rather than update rebuild (and reboot) APIs to provide a new keypair.","commit_id":"1c1fb2982cd5962487fdd8ce4b14630a0c76c3af"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"49a9d7983442dd8fc81c342a54dfe3f0d255afa9","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Proposed change"},{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Will add a new parameter to rebuild API input body, which is named"},{"line_number":35,"context_line":"``key_name``. And after rebuild API call, the response body must contain"},{"line_number":36,"context_line":"the updated new instance ``key_name``."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Alternatives"},{"line_number":39,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"7f515b1d_4f550c50","line":36,"range":{"start_line":34,"start_character":0,"end_line":36,"end_character":38},"in_reply_to":"7f515b1d_3470e772","updated":"2017-09-22 15:10:01.000000000","message":"Some talks form IRC:\n1.  If cloud-init does not running in every boot, the inconsistent can not be removed. To avoid that, the entire cloud platform images need updating.\n\n2. And for the running instance. If user does not change the cloud-init config. They create image and then boot a new VM. Even the entire cloud platform images have been updated, new API can not avoid inconsistent for this new VM.\n\n3. If new API does not supporting running injection, the DB keypair and guest keypair are not consistent without a rebuiding, reboot, unshelving... This looks not good.\n\n4. again, its totally two different ways. One API make sense while rebuild. That also make consistent with instance name, image, admin pass\n\n5.  IMHO, both specs are OK for now. One step for rebuild API make more reasonable.","commit_id":"1c1fb2982cd5962487fdd8ce4b14630a0c76c3af"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"7f080c8ab312a9139430861f9ef32312e8571b51","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Proposed change"},{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Will add a new parameter to rebuild API input body, which is named"},{"line_number":35,"context_line":"``key_name``. And after rebuild API call, the response body must contain"},{"line_number":36,"context_line":"the updated new instance ``key_name``."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Alternatives"},{"line_number":39,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"7f515b1d_a7dc9946","line":36,"range":{"start_line":34,"start_character":0,"end_line":36,"end_character":38},"in_reply_to":"7f515b1d_3470e772","updated":"2017-09-23 03:17:52.000000000","message":"Upgrade the PTG page: https://etherpad.openstack.org/p/nova-ptg-queens#L498. We should reconsider the PTG agreement.","commit_id":"1c1fb2982cd5962487fdd8ce4b14630a0c76c3af"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"989ee7c4188e93bc84af116b399917e0dfd76aa4","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"While rebuiding instance, the user could set a new keypair for the instance."},{"line_number":28,"context_line":"And for those VMs without admin password, after rebuiling with new key, they"},{"line_number":29,"context_line":"can be logged in by using the new key."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Proposed change"},{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7f515b1d_ed1f366e","line":29,"updated":"2017-10-03 19:33:28.000000000","message":"This isn\u0027t really a use case, this is just the action involved.\n\nI think the thing that continues to concern me about this API addition is it not being clear to me when it is useful. Because the entire VM and all disks are destroyed on rebuild.\n\nSo at which point the only reason for this is that people like their IP address. As they are coming up from a base image, it is extremely likely that they need to run config management on the new instance. If config management is run, it is surprising to me that folks aren\u0027t also installing other keys into the server given that Nova only allows 1 keypair, which is user scoped, so can only belong to the user triggering the build.\n\nMaybe this is addressing the boot from volume case, but that\u0027s not clear to me either, because rebuild on bfv looks like it\u0027s very likely going into an error state based on our bugs.\n\nSo it would be really great to build out a couple of scenarios about what was done creating guests in the first place, and why rebuild + new key was the best way to move forward.","commit_id":"58cd28bea701f719ca51aca3ab8a21f7f256ff68"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"705cae8164fb33424ce1a34d4b18b3065371cbff","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"While rebuiding instance, the user could set a new keypair for the instance."},{"line_number":28,"context_line":"And for those VMs without admin password, after rebuiling with new key, they"},{"line_number":29,"context_line":"can be logged in by using the new key."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Proposed change"},{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7f515b1d_18218ba0","line":29,"in_reply_to":"7f515b1d_be9cad5d","updated":"2017-10-04 23:04:53.000000000","message":"Done","commit_id":"58cd28bea701f719ca51aca3ab8a21f7f256ff68"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"4989515acd31cfca8caa274417159bf9a249cd40","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"While rebuiding instance, the user could set a new keypair for the instance."},{"line_number":28,"context_line":"And for those VMs without admin password, after rebuiling with new key, they"},{"line_number":29,"context_line":"can be logged in by using the new key."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Proposed change"},{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7f515b1d_d78c0081","line":29,"in_reply_to":"7f515b1d_d01ad16d","updated":"2017-10-04 02:22:57.000000000","message":"For volume based instance, rebuild action reset nothing. That\u0027s a very old bug or bugs, or we could consider that nova does not support rebuild for volume based instance.","commit_id":"58cd28bea701f719ca51aca3ab8a21f7f256ff68"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"28d6d70e3d3fc6e69140387e4527e924ba72d77b","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"While rebuiding instance, the user could set a new keypair for the instance."},{"line_number":28,"context_line":"And for those VMs without admin password, after rebuiling with new key, they"},{"line_number":29,"context_line":"can be logged in by using the new key."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Proposed change"},{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7f515b1d_be9cad5d","line":29,"in_reply_to":"7f515b1d_d78c0081","updated":"2017-10-04 16:08:41.000000000","message":"There are use cases in this thread:\n\nhttp://lists.openstack.org/pipermail/openstack-dev/2017-October/123071.html","commit_id":"58cd28bea701f719ca51aca3ab8a21f7f256ff68"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1bc232b3eb97e615f51218216c38fa4f8288e2a3","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"While rebuiding instance, the user could set a new keypair for the instance."},{"line_number":28,"context_line":"And for those VMs without admin password, after rebuiling with new key, they"},{"line_number":29,"context_line":"can be logged in by using the new key."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Proposed change"},{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7f515b1d_d01ad16d","line":29,"in_reply_to":"7f515b1d_ed1f366e","updated":"2017-10-03 19:37:43.000000000","message":"\u003e Maybe this is addressing the boot from volume case, but that\u0027s not clear to me either, because rebuild on bfv looks like it\u0027s very likely going into an error state based on our bugs.\n\nOn the bugs thing, I\u0027ve gone through some of those today and I think the main one (after duplicating several bugs to the same thing) is bug 1482040 where people expect the root disk to be replaced during rebuild but for boot from volume it\u0027s not.","commit_id":"58cd28bea701f719ca51aca3ab8a21f7f256ff68"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9a5470714745c07a2b1750ac9095b59c4b3382b5","unresolved":false,"context_lines":[{"line_number":85,"context_line":"Security impact"},{"line_number":86,"context_line":"---------------"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"None"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Notifications impact"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7f515b1d_633115a3","line":88,"updated":"2017-10-03 20:40:31.000000000","message":"I think you\u0027d need to consider security implications here. By default policy, another user in the same project can rebuild a server that is not their own. Keys are scoped to a user, but the instance is scoped to a project. So what happens if:\n\n1. user A creates instance with a key called \"mykey\"\n2. user B (in the same project as user A) rebuilds instance with a key called \"mykey\"\n\nWill we use mykey for user A (per the instance.user_id) or mykey for user B (per the context.user_id)?\n\nYou have to perform the keypair lookup using the key name and a user_id, so need to know if you use the instance user_id or the current request context user_id, because instance.user_id might not be the same as context.user_id.","commit_id":"58cd28bea701f719ca51aca3ab8a21f7f256ff68"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"705cae8164fb33424ce1a34d4b18b3065371cbff","unresolved":false,"context_lines":[{"line_number":85,"context_line":"Security impact"},{"line_number":86,"context_line":"---------------"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"None"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Notifications impact"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7f515b1d_3851e70f","line":88,"in_reply_to":"7f515b1d_0a4494b6","updated":"2017-10-04 23:04:53.000000000","message":"Done","commit_id":"58cd28bea701f719ca51aca3ab8a21f7f256ff68"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"4989515acd31cfca8caa274417159bf9a249cd40","unresolved":false,"context_lines":[{"line_number":85,"context_line":"Security impact"},{"line_number":86,"context_line":"---------------"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"None"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Notifications impact"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7f515b1d_74330a64","line":88,"in_reply_to":"7f515b1d_633115a3","updated":"2017-10-04 02:22:57.000000000","message":"Done, thank you.","commit_id":"58cd28bea701f719ca51aca3ab8a21f7f256ff68"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"986c9fb18aab21f621b11b19063e180a9b554937","unresolved":false,"context_lines":[{"line_number":85,"context_line":"Security impact"},{"line_number":86,"context_line":"---------------"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"None"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Notifications impact"}],"source_content_type":"text/x-rst","patch_set":10,"id":"7f515b1d_0a4494b6","line":88,"in_reply_to":"7f515b1d_74330a64","updated":"2017-10-04 20:11:32.000000000","message":"I think it\u0027s minor, but it should be mapped out as what the expected behavior is. Users don\u0027t own servers, but they do own keys, which makes this confusing. If users want to own servers, they need to be in a project with no other users.","commit_id":"58cd28bea701f719ca51aca3ab8a21f7f256ff68"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"06e6ffb5f8e411f16b4508a259638a07c7b4c4d8","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Use Cases"},{"line_number":25,"context_line":"---------"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"While rebuiding instance, the instance will be done a renew procedure. Since"},{"line_number":28,"context_line":"the instance disk was recreated, the new keypair for the instance can be"},{"line_number":29,"context_line":"applyed into it. Then for those VMs without admin password, after rebuiling"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f4e5783_94cab66a","line":26,"updated":"2017-10-12 15:08:09.000000000","message":"What you have here is still not really a use case, it\u0027s describing more or less the proposed change.\n\nA few from the linked thread in PS10:\n\n- As a user, I have lost my key and need to get into my instance but do not want to lose my IP address so I need to rebuild with a new key. http://lists.openstack.org/pipermail/openstack-dev/2017-October/123071.html\n\n- As a user, I use rebuild to deploy new OS images to my ironic-managed machines. I would like to use rebuild in a similar way for keypair rotation. http://lists.openstack.org/pipermail/openstack-dev/2017-October/123085.html\n\n- As a user, I have created an entire Heat stack and then found out I used the wrong key. Rather than recreate the entire stack, I would like to just rebuild the instances with the correct key. http://lists.openstack.org/pipermail/openstack-dev/2017-October/123090.html","commit_id":"f722ddc6cde6f53342032aa324dcced9d73c7bbc"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"e39b4732ffe0faa59abbca379091d79719a081be","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Use Cases"},{"line_number":25,"context_line":"---------"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"While rebuiding instance, the instance will be done a renew procedure. Since"},{"line_number":28,"context_line":"the instance disk was recreated, the new keypair for the instance can be"},{"line_number":29,"context_line":"applyed into it. Then for those VMs without admin password, after rebuiling"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f4e5783_f75d6ce9","line":26,"in_reply_to":"5f4e5783_94cab66a","updated":"2017-10-12 16:00:10.000000000","message":"Done, will add these cases.","commit_id":"f722ddc6cde6f53342032aa324dcced9d73c7bbc"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"06e6ffb5f8e411f16b4508a259638a07c7b4c4d8","unresolved":false,"context_lines":[{"line_number":24,"context_line":"Use Cases"},{"line_number":25,"context_line":"---------"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"While rebuiding instance, the instance will be done a renew procedure. Since"},{"line_number":28,"context_line":"the instance disk was recreated, the new keypair for the instance can be"},{"line_number":29,"context_line":"applyed into it. Then for those VMs without admin password, after rebuiling"},{"line_number":30,"context_line":"with new key, they can be logged in by using the new key."}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f4e5783_b4e25200","line":27,"range":{"start_line":27,"start_character":44,"end_line":27,"end_character":51},"updated":"2017-10-12 15:08:09.000000000","message":"undergo?","commit_id":"f722ddc6cde6f53342032aa324dcced9d73c7bbc"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"e39b4732ffe0faa59abbca379091d79719a081be","unresolved":false,"context_lines":[{"line_number":24,"context_line":"Use Cases"},{"line_number":25,"context_line":"---------"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"While rebuiding instance, the instance will be done a renew procedure. Since"},{"line_number":28,"context_line":"the instance disk was recreated, the new keypair for the instance can be"},{"line_number":29,"context_line":"applyed into it. Then for those VMs without admin password, after rebuiling"},{"line_number":30,"context_line":"with new key, they can be logged in by using the new key."}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f4e5783_d7f950c8","line":27,"range":{"start_line":27,"start_character":44,"end_line":27,"end_character":51},"in_reply_to":"5f4e5783_b4e25200","updated":"2017-10-12 16:00:10.000000000","message":"Done","commit_id":"f722ddc6cde6f53342032aa324dcced9d73c7bbc"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"06e6ffb5f8e411f16b4508a259638a07c7b4c4d8","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"While rebuiding instance, the instance will be done a renew procedure. Since"},{"line_number":28,"context_line":"the instance disk was recreated, the new keypair for the instance can be"},{"line_number":29,"context_line":"applyed into it. Then for those VMs without admin password, after rebuiling"},{"line_number":30,"context_line":"with new key, they can be logged in by using the new key."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f4e5783_54bd5ed6","line":29,"range":{"start_line":29,"start_character":0,"end_line":29,"end_character":7},"updated":"2017-10-12 15:08:09.000000000","message":"applied","commit_id":"f722ddc6cde6f53342032aa324dcced9d73c7bbc"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"e39b4732ffe0faa59abbca379091d79719a081be","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"While rebuiding instance, the instance will be done a renew procedure. Since"},{"line_number":28,"context_line":"the instance disk was recreated, the new keypair for the instance can be"},{"line_number":29,"context_line":"applyed into it. Then for those VMs without admin password, after rebuiling"},{"line_number":30,"context_line":"with new key, they can be logged in by using the new key."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f4e5783_b7f494d0","line":29,"range":{"start_line":29,"start_character":0,"end_line":29,"end_character":7},"in_reply_to":"5f4e5783_54bd5ed6","updated":"2017-10-12 16:00:10.000000000","message":"Done","commit_id":"f722ddc6cde6f53342032aa324dcced9d73c7bbc"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"e39b4732ffe0faa59abbca379091d79719a081be","unresolved":false,"context_lines":[{"line_number":87,"context_line":"---------------"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The instances are project scoped, key pairs are scoped to a user. This may"},{"line_number":90,"context_line":"coufuse the project users, if one user rebuild the instance with a new key"},{"line_number":91,"context_line":"pair, and others also have a same name key, they will not be able to login"},{"line_number":92,"context_line":"that instance. So, this spec will add restriction, if users do not own a"},{"line_number":93,"context_line":"server, they will not be able to reset the key name during rebuild, a 40X"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f4e5783_97cab86a","line":90,"range":{"start_line":90,"start_character":0,"end_line":90,"end_character":7},"updated":"2017-10-12 16:00:10.000000000","message":"s/coufuse/confuse","commit_id":"f722ddc6cde6f53342032aa324dcced9d73c7bbc"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"b5e573eccec86053686c41fa177ac16d98e1dff0","unresolved":false,"context_lines":[{"line_number":91,"context_line":"pair, and others also have a same name key, they will not be able to login"},{"line_number":92,"context_line":"that instance. So, this spec will add restriction, if users do not own a"},{"line_number":93,"context_line":"server, they will not be able to reset the key name during rebuild, a 40X"},{"line_number":94,"context_line":"HTTP code will be raised."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Notifications impact"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f4e5783_5700c001","line":94,"updated":"2017-10-12 15:21:12.000000000","message":"This comes down to the really weird fact that keys are owned by users (which is the only resource that\u0027s true of). Servers are owned by projects.\n\nI think it\u0027s fine to just document the limitations here, that because of this a rebuild with a keyname is looking up *by the user calling rebuild*. This is probably what people wanted, and if things are unexpected, the other user can just rebuild it again (it\u0027s not like anything is saved in this rebuild process).\n\nI think that longer term the model of keys owned by users, and not projects, really needs to be rethought. Everything nova is doing should be aligned on a project boundary, and if additional users / keys need to be injected into a system, that probably should be at the config management layer on top.","commit_id":"f722ddc6cde6f53342032aa324dcced9d73c7bbc"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"e39b4732ffe0faa59abbca379091d79719a081be","unresolved":false,"context_lines":[{"line_number":89,"context_line":"The instances are project scoped, key pairs are scoped to a user. This may"},{"line_number":90,"context_line":"coufuse the project users, if one user rebuild the instance with a new key"},{"line_number":91,"context_line":"pair, and others also have a same name key, they will not be able to login"},{"line_number":92,"context_line":"that instance. So, this spec will add restriction, if users do not own a"},{"line_number":93,"context_line":"server, they will not be able to reset the key name during rebuild, a 40X"},{"line_number":94,"context_line":"HTTP code will be raised."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Notifications impact"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f4e5783_578b201e","line":94,"range":{"start_line":92,"start_character":15,"end_line":94,"end_character":25},"updated":"2017-10-12 16:00:10.000000000","message":"will remove this line.","commit_id":"f722ddc6cde6f53342032aa324dcced9d73c7bbc"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"e39b4732ffe0faa59abbca379091d79719a081be","unresolved":false,"context_lines":[{"line_number":91,"context_line":"pair, and others also have a same name key, they will not be able to login"},{"line_number":92,"context_line":"that instance. So, this spec will add restriction, if users do not own a"},{"line_number":93,"context_line":"server, they will not be able to reset the key name during rebuild, a 40X"},{"line_number":94,"context_line":"HTTP code will be raised."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Notifications impact"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f4e5783_37c0a450","line":94,"in_reply_to":"5f4e5783_5700c001","updated":"2017-10-12 16:00:10.000000000","message":"So, patch set [1] will no logger need these key owner check change. : )\n\n\n[1] https://review.openstack.org/#/c/379128/","commit_id":"f722ddc6cde6f53342032aa324dcced9d73c7bbc"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"06e6ffb5f8e411f16b4508a259638a07c7b4c4d8","unresolved":false,"context_lines":[{"line_number":145,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"* Rubild a instance and see if the key_name and key_data in DB are really"},{"line_number":149,"context_line":"  changed."},{"line_number":150,"context_line":"* Tempest cases for new microversion. If the rebuilt instance is in ACTIVE"},{"line_number":151,"context_line":"  state, make sure the cloud-init or config drive did the right public key"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f4e5783_54631e43","line":148,"range":{"start_line":148,"start_character":2,"end_line":148,"end_character":8},"updated":"2017-10-12 15:08:09.000000000","message":"Rebuild","commit_id":"f722ddc6cde6f53342032aa324dcced9d73c7bbc"},{"author":{"_account_id":9531,"name":"liuyulong","display_name":"LIU Yulong","email":"i@liuyulong.me","username":"LIU-Yulong"},"change_message_id":"e39b4732ffe0faa59abbca379091d79719a081be","unresolved":false,"context_lines":[{"line_number":145,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"* Rubild a instance and see if the key_name and key_data in DB are really"},{"line_number":149,"context_line":"  changed."},{"line_number":150,"context_line":"* Tempest cases for new microversion. If the rebuilt instance is in ACTIVE"},{"line_number":151,"context_line":"  state, make sure the cloud-init or config drive did the right public key"}],"source_content_type":"text/x-rst","patch_set":11,"id":"5f4e5783_3a88896f","line":148,"range":{"start_line":148,"start_character":2,"end_line":148,"end_character":8},"in_reply_to":"5f4e5783_54631e43","updated":"2017-10-12 16:00:10.000000000","message":"Done","commit_id":"f722ddc6cde6f53342032aa324dcced9d73c7bbc"}]}