)]}'
{"specs/pike/approved/locked-by-service.rst":[{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"bfad4423d5046a455a8f397ebddd8f087bbfc86c","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"This allows a service token to create a server that is locked to that service."},{"line_number":14,"context_line":"This means it appears in the users server list, but the user is unable to"},{"line_number":15,"context_line":"delete that, they only see the name of the service user that locked the"},{"line_number":16,"context_line":"instance. Admin is able to override the service lock and clean up, if needed."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_46594c8d","line":15,"range":{"start_line":15,"start_character":0,"end_line":15,"end_character":6},"updated":"2017-03-14 15:41:15.000000000","message":"more generally, manipulate (i.e not just delete)","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"bfad4423d5046a455a8f397ebddd8f087bbfc86c","unresolved":false,"context_lines":[{"line_number":13,"context_line":"This allows a service token to create a server that is locked to that service."},{"line_number":14,"context_line":"This means it appears in the users server list, but the user is unable to"},{"line_number":15,"context_line":"delete that, they only see the name of the service user that locked the"},{"line_number":16,"context_line":"instance. Admin is able to override the service lock and clean up, if needed."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Problem description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_a6520865","line":16,"range":{"start_line":16,"start_character":57,"end_line":16,"end_character":65},"updated":"2017-03-14 15:41:15.000000000","message":"similar, expand scope","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":668,"name":"Adrian Otto","email":"aotto@aotto.com","username":"aotto"},"change_message_id":"9ef2d508a92cb01a889f2bba11efcdd642c721a0","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Problem description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"OpenStack services want to be able to create instances in a user\u0027s account,"},{"line_number":22,"context_line":"consuming their quota and being billed in a similar way to any other instance,"},{"line_number":23,"context_line":"but they server should not be able to access to delete that instance."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Use Cases"},{"line_number":26,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a30ddce_af01e606","line":23,"range":{"start_line":21,"start_character":0,"end_line":23,"end_character":69},"updated":"2017-03-13 17:12:12.000000000","message":"Consider:\n\nOpenStack services want to be able to create locked instances on behalf of a user. This user is known as the owner. Locked instances  count toward their owner\u0027s quota, and billing events would emit as if the owner created them. Once a locked instance is created, the owner will have read-only access to the instance. This prevents locked instances from being accidentally deleted or updated which could break a related instance in the related service.","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":2967,"name":"ljjjustin","email":"iamljj@gmail.com","username":"ljjjustin"},"change_message_id":"39bd7183c185451d418eb6fc50794ef1f89d853b","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"OpenStack services want to be able to create instances in a user\u0027s account,"},{"line_number":22,"context_line":"consuming their quota and being billed in a similar way to any other instance,"},{"line_number":23,"context_line":"but they server should not be able to access to delete that instance."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Use Cases"},{"line_number":26,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_aedf31d4","line":23,"range":{"start_line":23,"start_character":4,"end_line":23,"end_character":8},"updated":"2017-02-27 02:15:06.000000000","message":"Nit: those","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"bfad4423d5046a455a8f397ebddd8f087bbfc86c","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"OpenStack services want to be able to create instances in a user\u0027s account,"},{"line_number":22,"context_line":"consuming their quota and being billed in a similar way to any other instance,"},{"line_number":23,"context_line":"but they server should not be able to access to delete that instance."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Use Cases"},{"line_number":26,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_46d06cc9","line":23,"range":{"start_line":23,"start_character":48,"end_line":23,"end_character":54},"updated":"2017-03-14 15:41:15.000000000","message":"ditto","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"bfad4423d5046a455a8f397ebddd8f087bbfc86c","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"OpenStack services want to be able to create instances in a user\u0027s account,"},{"line_number":22,"context_line":"consuming their quota and being billed in a similar way to any other instance,"},{"line_number":23,"context_line":"but they server should not be able to access to delete that instance."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Use Cases"},{"line_number":26,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da36d5c6_c64d3cc5","line":23,"range":{"start_line":23,"start_character":5,"end_line":23,"end_character":14},"updated":"2017-03-14 15:41:15.000000000","message":"the user?","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":668,"name":"Adrian Otto","email":"aotto@aotto.com","username":"aotto"},"change_message_id":"9ef2d508a92cb01a889f2bba11efcdd642c721a0","unresolved":false,"context_lines":[{"line_number":31,"context_line":"* resize above instance"},{"line_number":32,"context_line":"* snapshot above instance"},{"line_number":33,"context_line":"* delete instance"},{"line_number":34,"context_line":"* ensure the regular user and other service can\u0027t do any actions on a server"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Here is a related user flow:"},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a30ddce_af9d66bd","line":34,"range":{"start_line":34,"start_character":0,"end_line":34,"end_character":76},"updated":"2017-03-13 17:12:12.000000000","message":"This is really not part of the flow. It\u0027s an expectation of how nova will react when a locked instance is acted upon by it\u0027s owner rather than the creating service account.\n\nConsider moving this out of a bullet point and expressing it as subtext:\n\n\"During the lifecycle of a locked instance, the owner is able to get and list the image, but will be prevented from making any changes to it, or deleting it.\"","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":668,"name":"Adrian Otto","email":"aotto@aotto.com","username":"aotto"},"change_message_id":"9ef2d508a92cb01a889f2bba11efcdd642c721a0","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Here is a related user flow:"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"* User sees instance, and sees service that created it"},{"line_number":39,"context_line":"* Goes to related service to delete instance"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Here is a related admin flow:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a30ddce_4aadb8e7","line":38,"range":{"start_line":38,"start_character":7,"end_line":38,"end_character":11},"updated":"2017-03-13 17:12:12.000000000","message":"sees the locked","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":668,"name":"Adrian Otto","email":"aotto@aotto.com","username":"aotto"},"change_message_id":"9ef2d508a92cb01a889f2bba11efcdd642c721a0","unresolved":false,"context_lines":[{"line_number":36,"context_line":"Here is a related user flow:"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"* User sees instance, and sees service that created it"},{"line_number":39,"context_line":"* Goes to related service to delete instance"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Here is a related admin flow:"},{"line_number":42,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a30ddce_0aa7400b","line":39,"range":{"start_line":39,"start_character":2,"end_line":39,"end_character":44},"updated":"2017-03-13 17:12:12.000000000","message":"Uses the related service to update/delete the locked instance.","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":668,"name":"Adrian Otto","email":"aotto@aotto.com","username":"aotto"},"change_message_id":"9ef2d508a92cb01a889f2bba11efcdd642c721a0","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Here is a related admin flow:"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"* Admin wants to live-migrate VM as normal during maintenance"},{"line_number":44,"context_line":"* Admin wants to delete an instance, if its found to be causing problems."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a30ddce_4a493830","line":43,"updated":"2017-03-13 17:12:12.000000000","message":"Wanting is not a flow. Did you mean to say that admins can take actions without first unlocking a locked instance? That\u0027s probably what makes the most sense here. Consider instead:\n\n\"Admin does a live-migrate action on a locked instance during normal maintenance without needing to unlock the instance first.\"","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":668,"name":"Adrian Otto","email":"aotto@aotto.com","username":"aotto"},"change_message_id":"9ef2d508a92cb01a889f2bba11efcdd642c721a0","unresolved":false,"context_lines":[{"line_number":41,"context_line":"Here is a related admin flow:"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"* Admin wants to live-migrate VM as normal during maintenance"},{"line_number":44,"context_line":"* Admin wants to delete an instance, if its found to be causing problems."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Proposed change"},{"line_number":47,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a30ddce_8a1410e9","line":44,"updated":"2017-03-13 17:12:12.000000000","message":"Wanting is not a flow. Did you mean to say that admins can delete locked instances? That\u0027s probably what makes the most sense here. Consider instead:\n\n\"Admin deletes a locked instance that\u0027s causing problems without needing to unlock the instance first.\"\n\nDoes this really make sense? It would leave the creating service in a broken state unless the admin knows what to delete there as well. It might be better for the admin to delete whatever the foreign parent resource is, and keep the delete action restricted except to the related service user. Thoughts?","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"4b59c3d9525c198e1df3185a22b5f6e9d739fbd0","unresolved":false,"context_lines":[{"line_number":41,"context_line":"Here is a related admin flow:"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"* Admin wants to live-migrate VM as normal during maintenance"},{"line_number":44,"context_line":"* Admin wants to delete an instance, if its found to be causing problems."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Proposed change"},{"line_number":47,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a22e58a_d82fb4f4","line":44,"in_reply_to":"9a30ddce_8a1410e9","updated":"2017-03-14 11:56:40.000000000","message":"We give admins full control.\n\nBut you are right, delete is one where you might want the admin to unlock it first, so its an explicit action, but thats a massive API change at this point, so probably for another spec.","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":668,"name":"Adrian Otto","email":"aotto@aotto.com","username":"aotto"},"change_message_id":"9ef2d508a92cb01a889f2bba11efcdd642c721a0","unresolved":false,"context_lines":[{"line_number":51,"context_line":"``\"locked\": True`` when creating a server. This stops there being a window"},{"line_number":52,"context_line":"where the user is not locked."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Currently instance.locked_by is only expected to be ``admin`` or ``owner``."},{"line_number":55,"context_line":"We need to expand that to include ``service``. This will only be allowed if"},{"line_number":56,"context_line":"the service token includes the appropriate role to pass a new"},{"line_number":57,"context_line":"``is_service_lock`` policy rule, and the service_user_id matches."},{"line_number":58,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a30ddce_ca30c858","line":55,"range":{"start_line":54,"start_character":0,"end_line":55,"end_character":46},"updated":"2017-03-13 17:12:12.000000000","message":"Why not allow this to be the name of the service (from the service catalog) that locked it? For example\" \"heat\" or \"trove\".","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"d201db562907830b35ec7526c69035f0aacbffd2","unresolved":false,"context_lines":[{"line_number":51,"context_line":"``\"locked\": True`` when creating a server. This stops there being a window"},{"line_number":52,"context_line":"where the user is not locked."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Currently instance.locked_by is only expected to be ``admin`` or ``owner``."},{"line_number":55,"context_line":"We need to expand that to include ``service``. This will only be allowed if"},{"line_number":56,"context_line":"the service token includes the appropriate role to pass a new"},{"line_number":57,"context_line":"``is_service_lock`` policy rule, and the service_user_id matches."},{"line_number":58,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a1ff146_cb4e0696","line":55,"range":{"start_line":54,"start_character":0,"end_line":55,"end_character":46},"in_reply_to":"5a22e58a_5823c405","updated":"2017-03-14 16:45:16.000000000","message":"Oh wait, I understand your comment now, I totally missed a bit of the spec out here.","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"4b59c3d9525c198e1df3185a22b5f6e9d739fbd0","unresolved":false,"context_lines":[{"line_number":51,"context_line":"``\"locked\": True`` when creating a server. This stops there being a window"},{"line_number":52,"context_line":"where the user is not locked."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Currently instance.locked_by is only expected to be ``admin`` or ``owner``."},{"line_number":55,"context_line":"We need to expand that to include ``service``. This will only be allowed if"},{"line_number":56,"context_line":"the service token includes the appropriate role to pass a new"},{"line_number":57,"context_line":"``is_service_lock`` policy rule, and the service_user_id matches."},{"line_number":58,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a22e58a_5823c405","line":55,"range":{"start_line":54,"start_character":0,"end_line":55,"end_character":46},"in_reply_to":"9a30ddce_ca30c858","updated":"2017-03-14 11:56:40.000000000","message":"We don\u0027t have that here, we only have the service token used, and the user_name on that token.","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":668,"name":"Adrian Otto","email":"aotto@aotto.com","username":"aotto"},"change_message_id":"9ef2d508a92cb01a889f2bba11efcdd642c721a0","unresolved":false,"context_lines":[{"line_number":55,"context_line":"We need to expand that to include ``service``. This will only be allowed if"},{"line_number":56,"context_line":"the service token includes the appropriate role to pass a new"},{"line_number":57,"context_line":"``is_service_lock`` policy rule, and the service_user_id matches."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"The locked instance is enforced by check_instance_lock in nova/compute/api.py"},{"line_number":60,"context_line":"Rather than only admins being able to perform actions on a locked server, we"},{"line_number":61,"context_line":"should also allow any matching service tokens to also perform actions on a"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a30ddce_4ad938f2","line":58,"updated":"2017-03-13 17:12:12.000000000","message":"It might also make sense for the API action that creates the locked instance to take an optional UUID value that is saved in the server\u0027s metadata such that it\u0027s possible to know which related service instance it is related to. For example, if I create trove instance AABBCCDD... and that in turn creates nova instance EEFFGGHH... than instance EEFFGGHH would have a metadata key/value pair of \"Parent-service-instance\u003dAABBCCDD...\". We should also set \"Parent-service\u003d\u003cname\u003e\" where \u003cname\u003e is the service catalog entry name of the service that created the locked instance.\n\nIf we already have an API for setting instance metadata on create, then there is no need to duplicate it, but provide documentation instructions for creating locked instances that also set these metadata values upon create to result in a better end-user and administrator experience.","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"4b59c3d9525c198e1df3185a22b5f6e9d739fbd0","unresolved":false,"context_lines":[{"line_number":55,"context_line":"We need to expand that to include ``service``. This will only be allowed if"},{"line_number":56,"context_line":"the service token includes the appropriate role to pass a new"},{"line_number":57,"context_line":"``is_service_lock`` policy rule, and the service_user_id matches."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"The locked instance is enforced by check_instance_lock in nova/compute/api.py"},{"line_number":60,"context_line":"Rather than only admins being able to perform actions on a locked server, we"},{"line_number":61,"context_line":"should also allow any matching service tokens to also perform actions on a"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a22e58a_d87df4e8","line":58,"in_reply_to":"9a30ddce_4ad938f2","updated":"2017-03-14 11:56:40.000000000","message":"You can use the existing APIs to do that today.","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":668,"name":"Adrian Otto","email":"aotto@aotto.com","username":"aotto"},"change_message_id":"9ef2d508a92cb01a889f2bba11efcdd642c721a0","unresolved":false,"context_lines":[{"line_number":61,"context_line":"should also allow any matching service tokens to also perform actions on a"},{"line_number":62,"context_line":"service locked instance."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"For consistency we must ensure a service is able to unlock a server it has"},{"line_number":65,"context_line":"locked, admins are also allowed to unlock, but users are not allowed to"},{"line_number":66,"context_line":"unlock."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"NOTE: volumes and ports are not \"locked\" as part of this process. But those"},{"line_number":69,"context_line":"resources will be unable to be used by other instances while attached to the"},{"line_number":70,"context_line":"specified server. This is left as a follow up problem."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"TODO - double check all non-read actions like server update."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Alternatives"},{"line_number":75,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a30ddce_8a7b30bd","line":72,"range":{"start_line":64,"start_character":0,"end_line":72,"end_character":60},"updated":"2017-03-13 17:12:12.000000000","message":"This sounds like a description of the various functional tests we expect to implement along with this feature. Maybe it would be better to have a sub-section for functional tests, and just have a high level description of each.","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"4b59c3d9525c198e1df3185a22b5f6e9d739fbd0","unresolved":false,"context_lines":[{"line_number":61,"context_line":"should also allow any matching service tokens to also perform actions on a"},{"line_number":62,"context_line":"service locked instance."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"For consistency we must ensure a service is able to unlock a server it has"},{"line_number":65,"context_line":"locked, admins are also allowed to unlock, but users are not allowed to"},{"line_number":66,"context_line":"unlock."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"NOTE: volumes and ports are not \"locked\" as part of this process. But those"},{"line_number":69,"context_line":"resources will be unable to be used by other instances while attached to the"},{"line_number":70,"context_line":"specified server. This is left as a follow up problem."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"TODO - double check all non-read actions like server update."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Alternatives"},{"line_number":75,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a22e58a_984b7cb0","line":72,"range":{"start_line":64,"start_character":0,"end_line":72,"end_character":60},"in_reply_to":"9a30ddce_8a7b30bd","updated":"2017-03-14 11:56:40.000000000","message":"Its probably better in the API section, but it should move.","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":668,"name":"Adrian Otto","email":"aotto@aotto.com","username":"aotto"},"change_message_id":"9ef2d508a92cb01a889f2bba11efcdd642c721a0","unresolved":false,"context_lines":[{"line_number":74,"context_line":"Alternatives"},{"line_number":75,"context_line":"------------"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Its possible to create instances in a separate dedicated project, but it makes"},{"line_number":78,"context_line":"billing and visibility very hard to do well."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a30ddce_4a5cd84a","line":77,"range":{"start_line":77,"start_character":0,"end_line":77,"end_character":3},"updated":"2017-03-13 17:12:12.000000000","message":"It\u0027s","commit_id":"ef7e2a3fc3fc27c8423212fb613e2cb6aa5f042d"},{"author":{"_account_id":4257,"name":"Zane Bitter","email":"zbitter@redhat.com","username":"zaneb"},"change_message_id":"19292d5ac9a136fd40597640d0b218626f45dc10","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Note, because the instances was locked from the moment it was created, no"},{"line_number":42,"context_line":"regular user (and no other service) can manipulate that server. All members"},{"line_number":43,"context_line":"of the project only get read-only access to the instance in the API. Only"},{"line_number":44,"context_line":"admins are able to override the lock the service has on the instance."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Here is a related user flow:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a1ff146_151ba51c","line":43,"updated":"2017-03-15 16:52:55.000000000","message":"Can you confirm that regular users would also be prevented from accessing the server\u0027s console (at least under the default policy.json)?","commit_id":"dd0454df7adc4e7938ab66d7e9ae6d8857fd9adb"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"f44ea3ad8e9a7278b53369830f33e379e119add0","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Note, because the instances was locked from the moment it was created, no"},{"line_number":42,"context_line":"regular user (and no other service) can manipulate that server. All members"},{"line_number":43,"context_line":"of the project only get read-only access to the instance in the API. Only"},{"line_number":44,"context_line":"admins are able to override the lock the service has on the instance."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Here is a related user flow:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a1ced50_7848855c","line":43,"in_reply_to":"1a1ced50_1d02233f","updated":"2017-03-16 18:45:27.000000000","message":"Dam it, we need a new API concept here, maybe service_protected\u003dTrue.\n\nStuff like snapshot and back_up are not stopped by locked.\n\nLets add a totally new thing, were the service token makes the instance only listable, and nothing else, unless you are admin where you can still do \"everything\". Simples. It can only be set on boot, no way on unsetting it. Lets call that an extra feature.\n\nNow that means an admin could lock an instance to stop a service deleting its service_protected_instance, but thats totally fine, and what we would probably want anyways.","commit_id":"dd0454df7adc4e7938ab66d7e9ae6d8857fd9adb"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"6e3e358339d15071b74281a4ac6864e71dcc5aa1","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Note, because the instances was locked from the moment it was created, no"},{"line_number":42,"context_line":"regular user (and no other service) can manipulate that server. All members"},{"line_number":43,"context_line":"of the project only get read-only access to the instance in the API. Only"},{"line_number":44,"context_line":"admins are able to override the lock the service has on the instance."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Here is a related user flow:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a1ced50_cc8c5e38","line":43,"in_reply_to":"1a1ced50_7848855c","updated":"2017-03-16 19:25:56.000000000","message":"+1. Secure by default. I think just blanket locking it all down like that is a good plan. Then if we need to lighten up the restrictions later, we can do so as people present valid reasons for needing exceptions.\n\nIt still kind of feels like it most of it should be possible to be handled with a new role of some kind? like, only admins/service roles can undo a service_protected or access the console/snapshot/whatever if service_protected\u003dtrue.","commit_id":"dd0454df7adc4e7938ab66d7e9ae6d8857fd9adb"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"f5704ab9200a8eaedef562c5fa8b33ac93b9e693","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Note, because the instances was locked from the moment it was created, no"},{"line_number":42,"context_line":"regular user (and no other service) can manipulate that server. All members"},{"line_number":43,"context_line":"of the project only get read-only access to the instance in the API. Only"},{"line_number":44,"context_line":"admins are able to override the lock the service has on the instance."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Here is a related user flow:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a1ced50_58902996","line":43,"in_reply_to":"1a1ced50_7848855c","updated":"2017-03-16 18:47:03.000000000","message":"well, service_protected \u003d \"\u003cdisplay_name_of_service\u003e\" is probably better, to stop assuming the user name is \"good\" in some sense.","commit_id":"dd0454df7adc4e7938ab66d7e9ae6d8857fd9adb"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"ccb220c38707f19f90b9c83e3b1df9dd01a43e61","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Note, because the instances was locked from the moment it was created, no"},{"line_number":42,"context_line":"regular user (and no other service) can manipulate that server. All members"},{"line_number":43,"context_line":"of the project only get read-only access to the instance in the API. Only"},{"line_number":44,"context_line":"admins are able to override the lock the service has on the instance."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Here is a related user flow:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a1ced50_1d02233f","line":43,"in_reply_to":"1a1ced50_a3673a24","updated":"2017-03-16 18:38:18.000000000","message":"So (facepalm) I totally forgot about all those stilly buttons and things.\n\nI need to have a think on how we add the lock for console. I need to complete my TODO around auditing all of the API actions. Will have a chat at the next API meeting about how we can do this, I am bit stuck on making that backwards compatible, in a doesn\u0027t suck kind of a way. We will have to invalidate all console tokens when you lock a server, etc, etc. Although that doesn\u0027t affect this use case too much.\n\nI am tempted to address this in a separate effort though, but its certainly a non trivial hole in the story. This might need to depend on that \"fix\".","commit_id":"dd0454df7adc4e7938ab66d7e9ae6d8857fd9adb"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"536a448673da9438bb9a90b9667e386970d9e4f9","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Note, because the instances was locked from the moment it was created, no"},{"line_number":42,"context_line":"regular user (and no other service) can manipulate that server. All members"},{"line_number":43,"context_line":"of the project only get read-only access to the instance in the API. Only"},{"line_number":44,"context_line":"admins are able to override the lock the service has on the instance."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Here is a related user flow:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a1ff146_a6cf09af","line":43,"in_reply_to":"3a1ff146_0b21c8fb","updated":"2017-03-15 17:47:27.000000000","message":"Console access in the Trove case at least, allows the user to reboot the box, set init\u003d/bin/bash in grub, and capture the rabbitmq access info. Then they can inject questionable messages. Console access really needs to be prevented.","commit_id":"dd0454df7adc4e7938ab66d7e9ae6d8857fd9adb"},{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"e7b8d65c98246ab445dd6516fdd7fddb4478e894","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Note, because the instances was locked from the moment it was created, no"},{"line_number":42,"context_line":"regular user (and no other service) can manipulate that server. All members"},{"line_number":43,"context_line":"of the project only get read-only access to the instance in the API. Only"},{"line_number":44,"context_line":"admins are able to override the lock the service has on the instance."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Here is a related user flow:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a1ff146_cc88a725","line":43,"in_reply_to":"3a1ff146_0c271f65","updated":"2017-03-15 18:12:08.000000000","message":"Absolutely restricting access to console is a good idea; not disputing it one bit. just wanted to bring this one to your attention. thx Kevin.","commit_id":"dd0454df7adc4e7938ab66d7e9ae6d8857fd9adb"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1e8c25562cad22f4cae2bf4a8f32a26ce61fa511","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Note, because the instances was locked from the moment it was created, no"},{"line_number":42,"context_line":"regular user (and no other service) can manipulate that server. All members"},{"line_number":43,"context_line":"of the project only get read-only access to the instance in the API. Only"},{"line_number":44,"context_line":"admins are able to override the lock the service has on the instance."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Here is a related user flow:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a1ff146_0b21c8fb","line":43,"in_reply_to":"3a1ff146_151ba51c","updated":"2017-03-15 17:35:15.000000000","message":"Hmm, good question. I think they can access the console, I should double check.\n\nI actually quite like them having access, so you could get info from the service on the console. But I am guess you would rather they couldn\u0027t access the console?","commit_id":"dd0454df7adc4e7938ab66d7e9ae6d8857fd9adb"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"3c8152d87b4a3acf479d7d7751a6d58e9c526e36","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Note, because the instances was locked from the moment it was created, no"},{"line_number":42,"context_line":"regular user (and no other service) can manipulate that server. All members"},{"line_number":43,"context_line":"of the project only get read-only access to the instance in the API. Only"},{"line_number":44,"context_line":"admins are able to override the lock the service has on the instance."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Here is a related user flow:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a1ff146_0c271f65","line":43,"in_reply_to":"3a1ff146_4631f50a","updated":"2017-03-15 18:10:46.000000000","message":"Oh cool. I guess thats: https://docs.openstack.org/developer/trove/dev/secure_oslo_messaging.html ?\n\nI\u0027ll have to re-evaluate Trove for our system now. Thanks. :)\n\nGenerally though, I do still think its useful to restrict console access as you can do almost anything from it if you gain access.","commit_id":"dd0454df7adc4e7938ab66d7e9ae6d8857fd9adb"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"d3b6d1bf810ebbc15c05dcccd9054c8927e6b248","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Note, because the instances was locked from the moment it was created, no"},{"line_number":42,"context_line":"regular user (and no other service) can manipulate that server. All members"},{"line_number":43,"context_line":"of the project only get read-only access to the instance in the API. Only"},{"line_number":44,"context_line":"admins are able to override the lock the service has on the instance."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Here is a related user flow:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a1ced50_a3673a24","line":43,"in_reply_to":"3a1ff146_6a2ccfab","updated":"2017-03-16 16:15:26.000000000","message":"Can you inject a ctrl-alt-delete sequence through the console? If you have a vnc console, I think you can do that. Not sure about a novnc one.\n\nWithout the reboot button, it would be harder to exploit, \nyeah. Waiting till an admin rebooted it would be one option. Could maybe automate the watcher. Finding a way to crash the kernel might be another. Or a local exploit in the software installed, might be easier to exploit if all you needed to do is reboot the machine then do all the work through the console. Depends a lot on what\u0027s in the vm.","commit_id":"dd0454df7adc4e7938ab66d7e9ae6d8857fd9adb"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"e663f376749840e4b2c41289742c2003b9be2ae6","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Note, because the instances was locked from the moment it was created, no"},{"line_number":42,"context_line":"regular user (and no other service) can manipulate that server. All members"},{"line_number":43,"context_line":"of the project only get read-only access to the instance in the API. Only"},{"line_number":44,"context_line":"admins are able to override the lock the service has on the instance."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Here is a related user flow:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a1ff146_e623c103","line":43,"in_reply_to":"3a1ff146_a6cf09af","updated":"2017-03-15 17:55:23.000000000","message":"If you have console access, you still need the password to do anything, AFAIK. I guess that totally depends how the VM is configured.\n\nIf we need it, thats fine, but its just that chances the current concept of a \"locked\" instance, so makes this a much bigger change.","commit_id":"dd0454df7adc4e7938ab66d7e9ae6d8857fd9adb"},{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"042db1c8d6cb0452f7986d005fb03d0192605398","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Note, because the instances was locked from the moment it was created, no"},{"line_number":42,"context_line":"regular user (and no other service) can manipulate that server. All members"},{"line_number":43,"context_line":"of the project only get read-only access to the instance in the API. Only"},{"line_number":44,"context_line":"admins are able to override the lock the service has on the instance."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Here is a related user flow:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a1ff146_4631f50a","line":43,"in_reply_to":"3a1ff146_a6cf09af","updated":"2017-03-15 18:00:21.000000000","message":"no longer as big an issue after we\u0027ve added message security.","commit_id":"dd0454df7adc4e7938ab66d7e9ae6d8857fd9adb"},{"author":{"_account_id":4257,"name":"Zane Bitter","email":"zbitter@redhat.com","username":"zaneb"},"change_message_id":"7088468bb6d0c8617fa7f35b54aabbc9a4b7aeac","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Note, because the instances was locked from the moment it was created, no"},{"line_number":42,"context_line":"regular user (and no other service) can manipulate that server. All members"},{"line_number":43,"context_line":"of the project only get read-only access to the instance in the API. Only"},{"line_number":44,"context_line":"admins are able to override the lock the service has on the instance."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Here is a related user flow:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a1ff146_6a2ccfab","line":43,"in_reply_to":"3a1ff146_c68965cc","updated":"2017-03-16 14:52:43.000000000","message":"Kevin, I guess the question is if there\u0027s any way to reboot the VM when the server is locked in Nova and you don\u0027t have the console password?\n\nI guess you can wait for the admin to reboot the VM and hijack the console then. That\u0027s fairly likely to be noticed though, I\u0027d imagine.","commit_id":"dd0454df7adc4e7938ab66d7e9ae6d8857fd9adb"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"d948610a2efa508a7edf580b77a45250a9a34264","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Note, because the instances was locked from the moment it was created, no"},{"line_number":42,"context_line":"regular user (and no other service) can manipulate that server. All members"},{"line_number":43,"context_line":"of the project only get read-only access to the instance in the API. Only"},{"line_number":44,"context_line":"admins are able to override the lock the service has on the instance."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Here is a related user flow:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a1ff146_6cc6d34a","line":43,"in_reply_to":"3a1ff146_cc88a725","updated":"2017-03-15 18:14:50.000000000","message":"Yeah. Thanks for letting me know. I really appreciate it. :)","commit_id":"dd0454df7adc4e7938ab66d7e9ae6d8857fd9adb"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"f0c1c949c04eb4c13aa5b13a5b5250fed94b38d6","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Note, because the instances was locked from the moment it was created, no"},{"line_number":42,"context_line":"regular user (and no other service) can manipulate that server. All members"},{"line_number":43,"context_line":"of the project only get read-only access to the instance in the API. Only"},{"line_number":44,"context_line":"admins are able to override the lock the service has on the instance."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Here is a related user flow:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a1ff146_c68965cc","line":43,"in_reply_to":"3a1ff146_e623c103","updated":"2017-03-15 17:58:05.000000000","message":"init\u003d/bin/bash bypasses all authentication in linux except for full, local disk encryption. I don\u0027t think anyone\u0027s doing that today.","commit_id":"dd0454df7adc4e7938ab66d7e9ae6d8857fd9adb"},{"author":{"_account_id":4257,"name":"Zane Bitter","email":"zbitter@redhat.com","username":"zaneb"},"change_message_id":"19292d5ac9a136fd40597640d0b218626f45dc10","unresolved":false,"context_lines":[{"line_number":71,"context_line":"There will be a new field, ``locked_by_username`` that will contain the"},{"line_number":72,"context_line":"username from the context that locked the instance. This is useful for when"},{"line_number":73,"context_line":"``locked_by\u003d\"service\"`` because this will tell you the name of the service"},{"line_number":74,"context_line":"that locked the instance, by that Trove or Heat, etc. Ideally the name will"},{"line_number":75,"context_line":"match the name given in the keystone service catalog. Note, once added, this"},{"line_number":76,"context_line":"should be populated for all future locks be they owner, service or admin"},{"line_number":77,"context_line":"locks."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a1ff146_b52571ac","line":74,"updated":"2017-03-15 16:52:55.000000000","message":"s/by/be/ ?","commit_id":"dd0454df7adc4e7938ab66d7e9ae6d8857fd9adb"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1e8c25562cad22f4cae2bf4a8f32a26ce61fa511","unresolved":false,"context_lines":[{"line_number":71,"context_line":"There will be a new field, ``locked_by_username`` that will contain the"},{"line_number":72,"context_line":"username from the context that locked the instance. This is useful for when"},{"line_number":73,"context_line":"``locked_by\u003d\"service\"`` because this will tell you the name of the service"},{"line_number":74,"context_line":"that locked the instance, by that Trove or Heat, etc. Ideally the name will"},{"line_number":75,"context_line":"match the name given in the keystone service catalog. Note, once added, this"},{"line_number":76,"context_line":"should be populated for all future locks be they owner, service or admin"},{"line_number":77,"context_line":"locks."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a1ff146_4b7900fc","line":74,"in_reply_to":"3a1ff146_b52571ac","updated":"2017-03-15 17:35:15.000000000","message":"yeah, oops.","commit_id":"dd0454df7adc4e7938ab66d7e9ae6d8857fd9adb"}],"specs/pike/approved/service-protected-server.rst":[{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"756d49a82df89c05b384eb7478f7e1a64b8e0d07","unresolved":false,"context_lines":[{"line_number":14,"context_line":"The server appears in the users server list, and consumes that project\u0027s"},{"line_number":15,"context_line":"quota, but no user in that project is able to manipulate the server in any"},{"line_number":16,"context_line":"way, including no access to the console. If a matching service token is"},{"line_number":17,"context_line":"provided, or and admin token is provided the server operations will execute"},{"line_number":18,"context_line":"as normal."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_73b635fd","line":17,"range":{"start_line":17,"start_character":17,"end_line":17,"end_character":28},"updated":"2017-04-03 13:23:14.000000000","message":"we don\u0027t have admin tokens any more.\n\nWhat kind of admin are we talking about here? Cloud admin or project admin?","commit_id":"9f1d63d8dab73e2d192db916516aa17e3d5b3dd2"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"756d49a82df89c05b384eb7478f7e1a64b8e0d07","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Problem description"},{"line_number":21,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"OpenStack services want to be able to create instances on behalf of a user."},{"line_number":24,"context_line":"This user\u0027s project is known as the owner. Locked instances count toward"},{"line_number":25,"context_line":"their owner\u0027s quota, and billing system will see the instance just like any"},{"line_number":26,"context_line":"instance that owner has created. Once a protected instance is created, the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_f377e539","line":23,"range":{"start_line":23,"start_character":0,"end_line":23,"end_character":75},"updated":"2017-04-03 13:23:14.000000000","message":"What for?","commit_id":"9f1d63d8dab73e2d192db916516aa17e3d5b3dd2"},{"author":{"_account_id":4257,"name":"Zane Bitter","email":"zbitter@redhat.com","username":"zaneb"},"change_message_id":"5d0d31c1d07e305782184f4a11167791b4d87490","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Problem description"},{"line_number":21,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"OpenStack services want to be able to create instances on behalf of a user."},{"line_number":24,"context_line":"This user\u0027s project is known as the owner. Locked instances count toward"},{"line_number":25,"context_line":"their owner\u0027s quota, and billing system will see the instance just like any"},{"line_number":26,"context_line":"instance that owner has created. Once a protected instance is created, the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7f515b1d_c2c51c3e","line":23,"range":{"start_line":23,"start_character":0,"end_line":23,"end_character":75},"in_reply_to":"dfeb2761_f377e539","updated":"2017-09-25 21:17:34.000000000","message":"https://wiki.openstack.org/wiki/Sahara\nhttps://wiki.openstack.org/wiki/Trove\nhttps://wiki.openstack.org/wiki/Cue","commit_id":"9f1d63d8dab73e2d192db916516aa17e3d5b3dd2"},{"author":{"_account_id":11536,"name":"hongbin","email":"hongbin034@gmail.com","username":"hongbin"},"change_message_id":"3ba5a5efd4b0dace991a3747a38112fe190cfea2","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Here is a typical service flow:"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"* creates service protected instance, attaches to user\u0027s network and volumes."},{"line_number":37,"context_line":"* resize above instance"},{"line_number":38,"context_line":"* snapshot above instance"},{"line_number":39,"context_line":"* delete instance"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_cfd45049","line":36,"range":{"start_line":36,"start_character":57,"end_line":36,"end_character":76},"updated":"2017-03-16 20:19:01.000000000","message":"How about floating IPs. I think associating user\u0027s floating IPs to such instance is also a valid use case. In addition, it might need a clarification of what image/keypair/security groups this instance is going to consume (i.e. user\u0027s image or service\u0027s image).","commit_id":"9f1d63d8dab73e2d192db916516aa17e3d5b3dd2"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"ef2faffd022b2822f1ca9c2478bdacdf60a01f6f","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Here is a typical service flow:"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"* creates service protected instance, attaches to user\u0027s network and volumes."},{"line_number":37,"context_line":"* resize above instance"},{"line_number":38,"context_line":"* snapshot above instance"},{"line_number":39,"context_line":"* delete instance"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_93ca634e","line":36,"range":{"start_line":36,"start_character":57,"end_line":36,"end_character":76},"in_reply_to":"1a1ced50_cfd45049","updated":"2017-03-17 17:02:20.000000000","message":"These are just representative use cases, rather than all the use cases.\n\nWe also need to implement this in steps, so we are going with the simplest use cases first here.\n\nFloating IPs should be done through neutron now. That should still work as normal.\n\nI was mostly ignoring keypairs, because you can pass custom ones in user data, if needed in the first version. Its not a required thing to boot a server.\n\nOn boot, the image will be consumed as the user booting the instance. So in this version, so the user will need access to the image to boot from it. We can look at access glance via the service token at a later date, if needed.","commit_id":"9f1d63d8dab73e2d192db916516aa17e3d5b3dd2"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"6a1a52b64e744dd8b62e3ff146a9265a8522c658","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"* creates service protected instance, attaches to user\u0027s network and volumes."},{"line_number":37,"context_line":"* resize above instance"},{"line_number":38,"context_line":"* snapshot above instance"},{"line_number":39,"context_line":"* delete instance"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Note, because the instances are protected from the moment they are created, no"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_86b70839","line":38,"range":{"start_line":38,"start_character":2,"end_line":38,"end_character":25},"updated":"2017-03-21 21:26:53.000000000","message":"How about visibility of snapshot.  Is it going to be public ?","commit_id":"9f1d63d8dab73e2d192db916516aa17e3d5b3dd2"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"6a1a52b64e744dd8b62e3ff146a9265a8522c658","unresolved":false,"context_lines":[{"line_number":64,"context_line":"Proposed change"},{"line_number":65,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Based on the service token\u0027s project_id, we decide if the protected instance"},{"line_number":68,"context_line":"is able to have any action performed other than GET."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"TODO..."},{"line_number":71,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_6c6cab35","line":68,"range":{"start_line":67,"start_character":0,"end_line":68,"end_character":52},"updated":"2017-03-21 21:26:53.000000000","message":"I am trying to understand this. Little confused about how the flow would be. Here, is the service token part of request from end user ?","commit_id":"9f1d63d8dab73e2d192db916516aa17e3d5b3dd2"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"6a1a52b64e744dd8b62e3ff146a9265a8522c658","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Data model impact"},{"line_number":83,"context_line":"-----------------"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"TODO - need to store these in the instance table and add them to the object:"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* protected_by_service_display_name"},{"line_number":88,"context_line":"* protected_by_service_project_id"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_60daf4e9","line":85,"range":{"start_line":85,"start_character":33,"end_line":85,"end_character":48},"updated":"2017-03-21 21:26:53.000000000","message":"may be in instance_actions as well and in corresponding shadow_tables.","commit_id":"9f1d63d8dab73e2d192db916516aa17e3d5b3dd2"},{"author":{"_account_id":11536,"name":"hongbin","email":"hongbin034@gmail.com","username":"hongbin"},"change_message_id":"d6b151094d8437d959750f59efb597330b76b1ef","unresolved":false,"context_lines":[{"line_number":132,"context_line":"Other deployer impact"},{"line_number":133,"context_line":"---------------------"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"There may be additional roles and service tokens that need to be configured"},{"line_number":136,"context_line":"in services that want to start using the new service lock concept."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_62e533a7","line":135,"range":{"start_line":135,"start_character":34,"end_line":135,"end_character":48},"updated":"2017-03-16 20:45:35.000000000","message":"I am not sure about this. It sounds like a prerequisite of leveraging this feature is to enable the service token in keystone. I am not sure if everyone is able to do that since they might deployed a legacy version of keystone or various other reasons. I think decoupling this feature from service tokens would be more flexible if the implementation is feasible.","commit_id":"9f1d63d8dab73e2d192db916516aa17e3d5b3dd2"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"2c78f22d34beb2e77cd65c8beab4c23c0256c4c7","unresolved":false,"context_lines":[{"line_number":132,"context_line":"Other deployer impact"},{"line_number":133,"context_line":"---------------------"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"There may be additional roles and service tokens that need to be configured"},{"line_number":136,"context_line":"in services that want to start using the new service lock concept."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_775e8613","line":135,"range":{"start_line":135,"start_character":34,"end_line":135,"end_character":48},"in_reply_to":"1a1ced50_31eb50b2","updated":"2017-03-20 10:36:56.000000000","message":"Suggestions on how to do that would be very welcome.\n\nThis needs additional security, both the service and the user token. I am unsure how thats going to be possible with no additional setup.","commit_id":"9f1d63d8dab73e2d192db916516aa17e3d5b3dd2"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"ef2faffd022b2822f1ca9c2478bdacdf60a01f6f","unresolved":false,"context_lines":[{"line_number":132,"context_line":"Other deployer impact"},{"line_number":133,"context_line":"---------------------"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"There may be additional roles and service tokens that need to be configured"},{"line_number":136,"context_line":"in services that want to start using the new service lock concept."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_a4db97ec","line":135,"range":{"start_line":135,"start_character":34,"end_line":135,"end_character":48},"in_reply_to":"1a1ced50_62e533a7","updated":"2017-03-17 17:02:20.000000000","message":"The service token is just a user token added into a different header. The special thing is on the keystone middlewere interpreting the extra header.\n\nAnyways, Keystone is now an assumed base service, please see:\nhttps://governance.openstack.org/tc/reference/base-services.html","commit_id":"9f1d63d8dab73e2d192db916516aa17e3d5b3dd2"},{"author":{"_account_id":11536,"name":"hongbin","email":"hongbin034@gmail.com","username":"hongbin"},"change_message_id":"cd7597ecab5c3e2093659c474bafa70449c9aa50","unresolved":false,"context_lines":[{"line_number":132,"context_line":"Other deployer impact"},{"line_number":133,"context_line":"---------------------"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"There may be additional roles and service tokens that need to be configured"},{"line_number":136,"context_line":"in services that want to start using the new service lock concept."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_c00ac389","line":135,"range":{"start_line":135,"start_character":34,"end_line":135,"end_character":48},"in_reply_to":"1a1ced50_775e8613","updated":"2017-03-21 21:44:02.000000000","message":"I wonder if it is possible to default to admin role \u0026 normal token if the additional roles \u0026 service tokens were not setup. I imagined it might require an additional field like \"protected_by_admin\". I am not in the domain so I am not sure if it satisfies the security requirements you mentioned. Just a brainstormed idea.","commit_id":"9f1d63d8dab73e2d192db916516aa17e3d5b3dd2"},{"author":{"_account_id":11536,"name":"hongbin","email":"hongbin034@gmail.com","username":"hongbin"},"change_message_id":"1caf1b0b0cab93d83f443013218826acb73e412d","unresolved":false,"context_lines":[{"line_number":132,"context_line":"Other deployer impact"},{"line_number":133,"context_line":"---------------------"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"There may be additional roles and service tokens that need to be configured"},{"line_number":136,"context_line":"in services that want to start using the new service lock concept."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_31eb50b2","line":135,"range":{"start_line":135,"start_character":34,"end_line":135,"end_character":48},"in_reply_to":"1a1ced50_a4db97ec","updated":"2017-03-19 02:00:37.000000000","message":"Yes, my point is it would be better if this feature can work out of the box (no extra configuration steps for additional roles and service tokens).","commit_id":"9f1d63d8dab73e2d192db916516aa17e3d5b3dd2"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"6a1a52b64e744dd8b62e3ff146a9265a8522c658","unresolved":false,"context_lines":[{"line_number":156,"context_line":"Work Items"},{"line_number":157,"context_line":"----------"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"* Add locked param in create server API and build request object"},{"line_number":160,"context_line":"* Add locked_by_username into instance object and allow \"service\" lock"},{"line_number":161,"context_line":"* Expose locked_by_username and locked_by \u003d \"service\" in the API"},{"line_number":162,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a1ced50_0cb25706","line":159,"range":{"start_line":159,"start_character":6,"end_line":159,"end_character":12},"updated":"2017-03-21 21:26:53.000000000","message":"protected ?","commit_id":"9f1d63d8dab73e2d192db916516aa17e3d5b3dd2"}]}