)]}'
{"specs/pike/approved/stop_using_neutron_admin_token.rst":[{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"c5d2c2b79709c53187ddd28a3ab7f7db3ce59ed7","unresolved":false,"context_lines":[{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/stop-using-neutron-admin-token"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Make use of service token instead of admin token from keystoneauth"},{"line_number":14,"context_line":"when Nova API communicates with Neutron API."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_19c8fe21","line":14,"range":{"start_line":14,"start_character":31,"end_line":14,"end_character":43},"updated":"2017-03-02 16:55:38.000000000","message":"So currently this is only tackling the case of port binding. you should mention that here.","commit_id":"69a18fc52e6e59cc73f11f86d4bafe71895b4e48"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"a3a393bcd8ffec5442fc8dfcc93f1da553782892","unresolved":false,"context_lines":[{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/stop-using-neutron-admin-token"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Make use of service token instead of admin token from keystoneauth"},{"line_number":14,"context_line":"when Nova API communicates with Neutron API."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_a82ab02d","line":14,"range":{"start_line":14,"start_character":31,"end_line":14,"end_character":43},"in_reply_to":"ba2be162_19c8fe21","updated":"2017-03-06 20:01:02.000000000","message":"I think we are listing down Neutron admin actions in the description below. I feel title can be short and details can be added under problem decsription","commit_id":"69a18fc52e6e59cc73f11f86d4bafe71895b4e48"},{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"c5d2c2b79709c53187ddd28a3ab7f7db3ce59ed7","unresolved":false,"context_lines":[{"line_number":30,"context_line":"currently uses admin token. With this approach, we can restrict use of admin"},{"line_number":31,"context_line":"token when user token is present."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Operations like binding port to perticular host id can be performed with the"},{"line_number":34,"context_line":"help of service token instead of admin token where we have reference to user"},{"line_number":35,"context_line":"context. But, in some operations like periodic tasks we can\u0027t make use of"},{"line_number":36,"context_line":"service token as it does not have any user context. Such operations will"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_5eb25507","line":33,"range":{"start_line":33,"start_character":0,"end_line":33,"end_character":28},"updated":"2017-03-02 16:55:38.000000000","message":"I would like list of all operations that you will restrict to use admin token.","commit_id":"69a18fc52e6e59cc73f11f86d4bafe71895b4e48"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"a3a393bcd8ffec5442fc8dfcc93f1da553782892","unresolved":false,"context_lines":[{"line_number":30,"context_line":"currently uses admin token. With this approach, we can restrict use of admin"},{"line_number":31,"context_line":"token when user token is present."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Operations like binding port to perticular host id can be performed with the"},{"line_number":34,"context_line":"help of service token instead of admin token where we have reference to user"},{"line_number":35,"context_line":"context. But, in some operations like periodic tasks we can\u0027t make use of"},{"line_number":36,"context_line":"service token as it does not have any user context. Such operations will"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_e824a861","line":33,"range":{"start_line":33,"start_character":0,"end_line":33,"end_character":28},"in_reply_to":"ba2be162_5eb25507","updated":"2017-03-06 20:01:02.000000000","message":"Done","commit_id":"69a18fc52e6e59cc73f11f86d4bafe71895b4e48"},{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"c5d2c2b79709c53187ddd28a3ab7f7db3ce59ed7","unresolved":false,"context_lines":[{"line_number":63,"context_line":""},{"line_number":64,"context_line":"For example, if we want to perform \"binding port to host id\" operation with"},{"line_number":65,"context_line":"service token authentication, we will pass service token along with auth token"},{"line_number":66,"context_line":"to cmmunicate with Neutron. In this case, Neutron policy should also allow"},{"line_number":67,"context_line":"performing this operation with \"service_roles\"."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"With this change we restrict using admin token whereever user context is"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_f48c0f81","line":66,"range":{"start_line":66,"start_character":3,"end_line":66,"end_character":13},"updated":"2017-03-02 16:55:38.000000000","message":"communicate","commit_id":"69a18fc52e6e59cc73f11f86d4bafe71895b4e48"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"a3a393bcd8ffec5442fc8dfcc93f1da553782892","unresolved":false,"context_lines":[{"line_number":63,"context_line":""},{"line_number":64,"context_line":"For example, if we want to perform \"binding port to host id\" operation with"},{"line_number":65,"context_line":"service token authentication, we will pass service token along with auth token"},{"line_number":66,"context_line":"to cmmunicate with Neutron. In this case, Neutron policy should also allow"},{"line_number":67,"context_line":"performing this operation with \"service_roles\"."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"With this change we restrict using admin token whereever user context is"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_a89390ff","line":66,"range":{"start_line":66,"start_character":3,"end_line":66,"end_character":13},"in_reply_to":"ba2be162_f48c0f81","updated":"2017-03-06 20:01:02.000000000","message":"Done","commit_id":"69a18fc52e6e59cc73f11f86d4bafe71895b4e48"},{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"c5d2c2b79709c53187ddd28a3ab7f7db3ce59ed7","unresolved":false,"context_lines":[{"line_number":72,"context_line":"has a global scope and can cause potential security vulnerability."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"NOTE: Neutron policy.json needs to be modified for service token rule."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Alternatives"},{"line_number":78,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_7ef639fa","line":75,"updated":"2017-03-02 16:55:38.000000000","message":"How are you going to take care of upgrades here: Nova new and Neutron old?","commit_id":"69a18fc52e6e59cc73f11f86d4bafe71895b4e48"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"a3a393bcd8ffec5442fc8dfcc93f1da553782892","unresolved":false,"context_lines":[{"line_number":72,"context_line":"has a global scope and can cause potential security vulnerability."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"NOTE: Neutron policy.json needs to be modified for service token rule."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Alternatives"},{"line_number":78,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_c898c41e","line":75,"in_reply_to":"ba2be162_7ef639fa","updated":"2017-03-06 20:01:02.000000000","message":"Done","commit_id":"69a18fc52e6e59cc73f11f86d4bafe71895b4e48"},{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"c5d2c2b79709c53187ddd28a3ab7f7db3ce59ed7","unresolved":false,"context_lines":[{"line_number":77,"context_line":"Alternatives"},{"line_number":78,"context_line":"------------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"* With this approach, we can get rid of use of admin token on compute node."},{"line_number":81,"context_line":"  This can also be done if maintain admin token at Nova conductor level."},{"line_number":82,"context_line":"  Each conductor will have token to authenticate itself to Neutron as a"},{"line_number":83,"context_line":"  Nova service."}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_be1fd106","line":80,"range":{"start_line":80,"start_character":2,"end_line":80,"end_character":75},"updated":"2017-03-02 16:55:38.000000000","message":"I will reword as \"Another approach to get rid of admin token is ...\"","commit_id":"69a18fc52e6e59cc73f11f86d4bafe71895b4e48"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"a3a393bcd8ffec5442fc8dfcc93f1da553782892","unresolved":false,"context_lines":[{"line_number":77,"context_line":"Alternatives"},{"line_number":78,"context_line":"------------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"* With this approach, we can get rid of use of admin token on compute node."},{"line_number":81,"context_line":"  This can also be done if maintain admin token at Nova conductor level."},{"line_number":82,"context_line":"  Each conductor will have token to authenticate itself to Neutron as a"},{"line_number":83,"context_line":"  Nova service."}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_e89d880b","line":80,"range":{"start_line":80,"start_character":2,"end_line":80,"end_character":75},"in_reply_to":"ba2be162_be1fd106","updated":"2017-03-06 20:01:02.000000000","message":"Done","commit_id":"69a18fc52e6e59cc73f11f86d4bafe71895b4e48"},{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"c5d2c2b79709c53187ddd28a3ab7f7db3ce59ed7","unresolved":false,"context_lines":[{"line_number":144,"context_line":"* Use service token along with user context in Nova to authenticate"},{"line_number":145,"context_line":"  admin actions in Neutron."},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"Dependencies"},{"line_number":148,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba2be162_3e3e818c","line":147,"range":{"start_line":147,"start_character":0,"end_line":147,"end_character":12},"updated":"2017-03-02 16:55:38.000000000","message":"Neutron change will be a dependency here, right?","commit_id":"69a18fc52e6e59cc73f11f86d4bafe71895b4e48"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"eecc007e3d7af314ceb18e1294c5c585f691169f","unresolved":false,"context_lines":[{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/stop-using-neutron-admin-token"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Make use of service token instead of admin token from keystoneauth"},{"line_number":14,"context_line":"when Nova API communicates with Neutron API."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_be3589f8","line":14,"updated":"2017-03-14 16:19:36.000000000","message":"We should say: \"Where possible make use of a service token instead of an admin token...\"","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"ed83d03946dd8ffee47dbaeace9ff25822de552f","unresolved":false,"context_lines":[{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/stop-using-neutron-admin-token"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Make use of service token instead of admin token from keystoneauth"},{"line_number":14,"context_line":"when Nova API communicates with Neutron API."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_daf24a6f","line":14,"in_reply_to":"3a1ff146_be3589f8","updated":"2017-03-14 18:37:29.000000000","message":"Done","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"eecc007e3d7af314ceb18e1294c5c585f691169f","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Problem description"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Nova API service maintains one authenticated admin auth globally. This is to"},{"line_number":21,"context_line":"support some API services where an admin context is used without an auth"},{"line_number":22,"context_line":"token. Keystoneauth plugin loads admin auth using configuration provided in"},{"line_number":23,"context_line":"Nova when we instantiate global session object."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Nova API service uses admin related configurations. Because of global scope"},{"line_number":26,"context_line":"of admin context, system become insecure."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"With the introduction of service token, we can use service token instead of"},{"line_number":29,"context_line":"admin token to perform metadata API services related operations which"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_79c5eb59","line":26,"range":{"start_line":20,"start_character":0,"end_line":26,"end_character":41},"updated":"2017-03-14 16:19:36.000000000","message":"I don\u0027t really understand what you mean here. I think you are trying to say something like...\n\nWhen Nova talks to the Neutron REST API, there are certain times it current must use an admin token, in particular when setting the port binding on a port. In these cases, the admin token is used to ensure only Nova has access to the binding API, as you don\u0027t want end users binding ports to hypervisors.\n\nWe also use admin tokens to do things like doing a periodic refresh of the network_info cache. Ideally this would be done with a token that only has global read access to Neutron. In addition, we might need to use and admin token when a periodic task triggers actions inside neutron, such as automatic confirm resize.\n\nThis spec focuses on just the first use case, and trying to stop us using an admin token to tell Neutron it is Nova doing a port binding. In Ocata we started sending a service token along with the user token, so Neutron already knows it is Nova sending a request on behalf of the user. So that service user should have permission to do the port binding, and the users token gives us access to their specific project.","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"ed83d03946dd8ffee47dbaeace9ff25822de552f","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Problem description"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Nova API service maintains one authenticated admin auth globally. This is to"},{"line_number":21,"context_line":"support some API services where an admin context is used without an auth"},{"line_number":22,"context_line":"token. Keystoneauth plugin loads admin auth using configuration provided in"},{"line_number":23,"context_line":"Nova when we instantiate global session object."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Nova API service uses admin related configurations. Because of global scope"},{"line_number":26,"context_line":"of admin context, system become insecure."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"With the introduction of service token, we can use service token instead of"},{"line_number":29,"context_line":"admin token to perform metadata API services related operations which"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_da67aa23","line":26,"range":{"start_line":20,"start_character":0,"end_line":26,"end_character":41},"in_reply_to":"3a1ff146_79c5eb59","updated":"2017-03-14 18:37:29.000000000","message":"I am trying to mention same point that how it works currently. But yes, your explanation describes in detail.","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":20217,"name":"Anusha Unnam","email":"anusha.unnam25@gmail.com","username":"aunnam"},"change_message_id":"59f018a44dcb56873c91d53816bfd274e32a6d35","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"With the introduction of service token, we can use service token instead of"},{"line_number":29,"context_line":"admin token to perform metadata API services related operations which"},{"line_number":30,"context_line":"currently uses admin token. With this approach, we can restrict use of admin"},{"line_number":31,"context_line":"token when user token is present."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Operations like binding port to perticular host id, updating network info"},{"line_number":34,"context_line":"cache, creating pci requests can be performed with the help of service token"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a30ddce_f243f110","line":31,"range":{"start_line":30,"start_character":28,"end_line":31,"end_character":33},"updated":"2017-03-10 22:28:26.000000000","message":"I am trying to understand the spec here.\n\nI understand that for periodic tasks we use admin context since we don\u0027t have auth token. But If there is user token, for particular operations why are we using admin token?\nAnd also can you provide a reference link to the code of this scenario?","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"ed83d03946dd8ffee47dbaeace9ff25822de552f","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"With the introduction of service token, we can use service token instead of"},{"line_number":29,"context_line":"admin token to perform metadata API services related operations which"},{"line_number":30,"context_line":"currently uses admin token. With this approach, we can restrict use of admin"},{"line_number":31,"context_line":"token when user token is present."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Operations like binding port to perticular host id, updating network info"},{"line_number":34,"context_line":"cache, creating pci requests can be performed with the help of service token"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_3a0c3e42","line":31,"range":{"start_line":30,"start_character":28,"end_line":31,"end_character":33},"in_reply_to":"9a30ddce_f243f110","updated":"2017-03-14 18:37:29.000000000","message":"In periodic tasks, we use admin token because we don\u0027t have user context there. \n\nIn addition, in some operations like port binding we use admin token because you don\u0027t end users binding ports to hypervisors.","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"a6b8d68f2616494221ed7c89f4f9dfbc377f9ac5","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"* System is insecure because of lot of admin related configurations. This"},{"line_number":45,"context_line":"  change gets rid of admin token in metadata API services and will have"},{"line_number":46,"context_line":"  control over use of admin token. Less use of admin token is better."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Proposed change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a30ddce_e5077f15","line":46,"updated":"2017-03-13 17:05:11.000000000","message":"Let me find the bug where folks wanted to not allow users to create port, but want to allow only Nova to create ports.","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"eecc007e3d7af314ceb18e1294c5c585f691169f","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"* System is insecure because of lot of admin related configurations. This"},{"line_number":45,"context_line":"  change gets rid of admin token in metadata API services and will have"},{"line_number":46,"context_line":"  control over use of admin token. Less use of admin token is better."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Proposed change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_d9aa5f85","line":46,"in_reply_to":"9a30ddce_c59a7b13","updated":"2017-03-14 16:19:36.000000000","message":"Yeah, lets add a link to the use case of users wanting to only allow Nova to create ports.","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"dc0b268005f0f2ee5d16f6247324ac7055e1d7cb","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"* System is insecure because of lot of admin related configurations. This"},{"line_number":45,"context_line":"  change gets rid of admin token in metadata API services and will have"},{"line_number":46,"context_line":"  control over use of admin token. Less use of admin token is better."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Proposed change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a30ddce_c59a7b13","line":46,"in_reply_to":"9a30ddce_e5077f15","updated":"2017-03-13 17:21:36.000000000","message":"https://bugs.launchpad.net/nova/+bug/1608601?","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"eecc007e3d7af314ceb18e1294c5c585f691169f","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":"There will be a new service role in context object."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"\"service_roles\": \"service:nova\""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"The above role can be used in policy to define level of access for an"},{"line_number":56,"context_line":"action when service token is used along with user context."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_1995d73f","line":53,"updated":"2017-03-14 16:19:36.000000000","message":"No, thats already been added by keystone auth.","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"ed83d03946dd8ffee47dbaeace9ff25822de552f","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":"There will be a new service role in context object."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"\"service_roles\": \"service:nova\""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"The above role can be used in policy to define level of access for an"},{"line_number":56,"context_line":"action when service token is used along with user context."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_754b275a","line":53,"in_reply_to":"3a1ff146_1995d73f","updated":"2017-03-14 18:37:29.000000000","message":"Done","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":20217,"name":"Anusha Unnam","email":"anusha.unnam25@gmail.com","username":"aunnam"},"change_message_id":"59f018a44dcb56873c91d53816bfd274e32a6d35","unresolved":false,"context_lines":[{"line_number":53,"context_line":"\"service_roles\": \"service:nova\""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"The above role can be used in policy to define level of access for an"},{"line_number":56,"context_line":"action when service token is used along with user context."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"A configuration option ``service_token_admin_actions`` which defaults to"},{"line_number":59,"context_line":"``False`` can be used to perform admin API actions using service token."}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a30ddce_927c75ed","line":56,"range":{"start_line":56,"start_character":7,"end_line":56,"end_character":11},"updated":"2017-03-10 22:28:26.000000000","message":"s/when/in which?","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"ed83d03946dd8ffee47dbaeace9ff25822de552f","unresolved":false,"context_lines":[{"line_number":53,"context_line":"\"service_roles\": \"service:nova\""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"The above role can be used in policy to define level of access for an"},{"line_number":56,"context_line":"action when service token is used along with user context."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"A configuration option ``service_token_admin_actions`` which defaults to"},{"line_number":59,"context_line":"``False`` can be used to perform admin API actions using service token."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_3541af3a","line":56,"range":{"start_line":56,"start_character":7,"end_line":56,"end_character":11},"in_reply_to":"9a30ddce_927c75ed","updated":"2017-03-14 18:37:29.000000000","message":"I think \"when\" is fine here. I trying say, we need to pass service token along with user token if we want to make use of \"service_roles\".","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":20217,"name":"Anusha Unnam","email":"anusha.unnam25@gmail.com","username":"aunnam"},"change_message_id":"59f018a44dcb56873c91d53816bfd274e32a6d35","unresolved":false,"context_lines":[{"line_number":55,"context_line":"The above role can be used in policy to define level of access for an"},{"line_number":56,"context_line":"action when service token is used along with user context."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"A configuration option ``service_token_admin_actions`` which defaults to"},{"line_number":59,"context_line":"``False`` can be used to perform admin API actions using service token."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"We could add a service token along with auth token which identifies itself"},{"line_number":62,"context_line":"to Neutron as Nova. This allows to perform any actions for which we have"},{"line_number":63,"context_line":"added service role in policy configurations."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"For example, if we want to perform \"binding port to host id\" operation with"},{"line_number":66,"context_line":"service token authentication, we will pass service token along with auth token"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a30ddce_f2469179","line":63,"range":{"start_line":58,"start_character":0,"end_line":63,"end_character":44},"updated":"2017-03-10 22:28:26.000000000","message":"So, to use service token for certain actions, one needs to set config option service_token_admin_actions and the new service role in policy?","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"eecc007e3d7af314ceb18e1294c5c585f691169f","unresolved":false,"context_lines":[{"line_number":55,"context_line":"The above role can be used in policy to define level of access for an"},{"line_number":56,"context_line":"action when service token is used along with user context."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"A configuration option ``service_token_admin_actions`` which defaults to"},{"line_number":59,"context_line":"``False`` can be used to perform admin API actions using service token."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"We could add a service token along with auth token which identifies itself"},{"line_number":62,"context_line":"to Neutron as Nova. This allows to perform any actions for which we have"},{"line_number":63,"context_line":"added service role in policy configurations."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"For example, if we want to perform \"binding port to host id\" operation with"},{"line_number":66,"context_line":"service token authentication, we will pass service token along with auth token"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_b98cc336","line":63,"range":{"start_line":58,"start_character":0,"end_line":63,"end_character":44},"in_reply_to":"9a30ddce_f2469179","updated":"2017-03-14 16:19:36.000000000","message":"Right, we can just use the same service token we already have here.","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"50fc9bd8f05a854490bc487d098b6f64ad0d84bd","unresolved":false,"context_lines":[{"line_number":72,"context_line":"to perform admin only actions. Hence, we don\u0027t need admin context here which"},{"line_number":73,"context_line":"has a global scope and can cause potential security vulnerability."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"This change needs to be done in such a way that request to Neutron does not"},{"line_number":76,"context_line":"fail if new Nova (N+1) release and old Neutron (N) release co-exists. Hence,"},{"line_number":77,"context_line":"in first release (N), we will make it defaults to ``False`` and in the"},{"line_number":78,"context_line":"subsequent release (N+1), it will be ``True`` by default."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"NOTE: Neutron policy.json needs to be modified for service token rule."},{"line_number":81,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba2be162_6880b88c","line":78,"range":{"start_line":75,"start_character":0,"end_line":78,"end_character":57},"updated":"2017-03-06 20:02:46.000000000","message":"I think this can be described in a better way. Any suggestions ?","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"ed83d03946dd8ffee47dbaeace9ff25822de552f","unresolved":false,"context_lines":[{"line_number":72,"context_line":"to perform admin only actions. Hence, we don\u0027t need admin context here which"},{"line_number":73,"context_line":"has a global scope and can cause potential security vulnerability."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"This change needs to be done in such a way that request to Neutron does not"},{"line_number":76,"context_line":"fail if new Nova (N+1) release and old Neutron (N) release co-exists. Hence,"},{"line_number":77,"context_line":"in first release (N), we will make it defaults to ``False`` and in the"},{"line_number":78,"context_line":"subsequent release (N+1), it will be ``True`` by default."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"NOTE: Neutron policy.json needs to be modified for service token rule."},{"line_number":81,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_9548a35d","line":78,"range":{"start_line":75,"start_character":0,"end_line":78,"end_character":57},"in_reply_to":"3a1ff146_99dc671a","updated":"2017-03-14 18:37:29.000000000","message":"Done","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"eecc007e3d7af314ceb18e1294c5c585f691169f","unresolved":false,"context_lines":[{"line_number":72,"context_line":"to perform admin only actions. Hence, we don\u0027t need admin context here which"},{"line_number":73,"context_line":"has a global scope and can cause potential security vulnerability."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"This change needs to be done in such a way that request to Neutron does not"},{"line_number":76,"context_line":"fail if new Nova (N+1) release and old Neutron (N) release co-exists. Hence,"},{"line_number":77,"context_line":"in first release (N), we will make it defaults to ``False`` and in the"},{"line_number":78,"context_line":"subsequent release (N+1), it will be ``True`` by default."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"NOTE: Neutron policy.json needs to be modified for service token rule."},{"line_number":81,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_99dc671a","line":78,"range":{"start_line":75,"start_character":0,"end_line":78,"end_character":57},"in_reply_to":"ba2be162_6880b88c","updated":"2017-03-14 16:19:36.000000000","message":"I think you need to decide when you can stop using an auth token to talk to Neutron.\n\nThat suggests to me we default a configuration like use_service_token_for_binding \u003d False, and we get it tested, the flip it over to True and deprecate it. We note in the docs that you can ensure a smooth upgrade by upgrading Neutron before Nova, else you need to look at that configuration to buy you more time.\n\nIn the code, we could just detect a 403 and fallback to using the admin token, but thats messy, lets put that in the alternatives section.","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"eecc007e3d7af314ceb18e1294c5c585f691169f","unresolved":false,"context_lines":[{"line_number":77,"context_line":"in first release (N), we will make it defaults to ``False`` and in the"},{"line_number":78,"context_line":"subsequent release (N+1), it will be ``True`` by default."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"NOTE: Neutron policy.json needs to be modified for service token rule."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":""},{"line_number":83,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_d9fdff6f","line":80,"updated":"2017-03-14 16:19:36.000000000","message":"This is the crux of this spec, can you please link to the tracking document in neutron about this.","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"ed83d03946dd8ffee47dbaeace9ff25822de552f","unresolved":false,"context_lines":[{"line_number":77,"context_line":"in first release (N), we will make it defaults to ``False`` and in the"},{"line_number":78,"context_line":"subsequent release (N+1), it will be ``True`` by default."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"NOTE: Neutron policy.json needs to be modified for service token rule."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":""},{"line_number":83,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_d59f7bb2","line":80,"in_reply_to":"3a1ff146_d9fdff6f","updated":"2017-03-14 18:37:29.000000000","message":"Yes. I have not added change request on Neutron yet.","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"eecc007e3d7af314ceb18e1294c5c585f691169f","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Another approach to get rid of use of admin token on compute node is to"},{"line_number":88,"context_line":"  maintain admin token at Nova conductor level. Each conductor will have"},{"line_number":89,"context_line":"  token to authenticate itself to Neutron as a Nova service."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Data model impact"},{"line_number":92,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_d9341f4c","line":89,"updated":"2017-03-14 16:19:36.000000000","message":"Lets just say this is to be considered in the future, and still you should prefer the \"least privileged\" token we can have for each operation.","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"ed83d03946dd8ffee47dbaeace9ff25822de552f","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"* Another approach to get rid of use of admin token on compute node is to"},{"line_number":88,"context_line":"  maintain admin token at Nova conductor level. Each conductor will have"},{"line_number":89,"context_line":"  token to authenticate itself to Neutron as a Nova service."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Data model impact"},{"line_number":92,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_f5a47709","line":89,"in_reply_to":"3a1ff146_d9341f4c","updated":"2017-03-14 18:37:29.000000000","message":"Done","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"eecc007e3d7af314ceb18e1294c5c585f691169f","unresolved":false,"context_lines":[{"line_number":153,"context_line":"Dependencies"},{"line_number":154,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"None"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Testing"},{"line_number":159,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_b91683a5","line":156,"updated":"2017-03-14 16:19:36.000000000","message":"Need changes in the policy file in Neutron, lets link to the neutorn RFV or code change to do that.","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"ed83d03946dd8ffee47dbaeace9ff25822de552f","unresolved":false,"context_lines":[{"line_number":153,"context_line":"Dependencies"},{"line_number":154,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"None"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Testing"},{"line_number":159,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a1ff146_75908796","line":156,"in_reply_to":"3a1ff146_b91683a5","updated":"2017-03-14 18:37:29.000000000","message":"Yes. we need to add change request in Neutron and add dependency here.","commit_id":"f1877fa67b823df2e129fdb313f248c0fecd6dca"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"fb7db9f7e86e43bbd9075385346d87fe33d7f2f6","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/stop-using-neutron-admin-token"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"where possible make use of service token instead of admin token from"},{"line_number":14,"context_line":"keystoneauth when Nova API communicates with Neutron API."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_f1ea180d","line":13,"updated":"2017-04-04 11:50:13.000000000","message":"Where","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"3d6e55f55b3c3358a54bb6de1f8312610bf8bf35","unresolved":false,"context_lines":[{"line_number":23,"context_line":"used to ensure only Nova has access to the binding API, as you don\u0027t want"},{"line_number":24,"context_line":"end users binding ports to hypervisors."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"We also use admin tokens to do things like doing a periodic refresh of the"},{"line_number":27,"context_line":"network_info cache. Ideally this would be done with a token that only has"},{"line_number":28,"context_line":"global read access to Neutron. In addition, we might need to use and admin"},{"line_number":29,"context_line":"token when a periodic task triggers actions inside neutron, such as automatic"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_b2682521","line":26,"range":{"start_line":26,"start_character":38,"end_line":26,"end_character":50},"updated":"2017-04-03 21:47:07.000000000","message":"like","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"fb7db9f7e86e43bbd9075385346d87fe33d7f2f6","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"We also use admin tokens to do things like doing a periodic refresh of the"},{"line_number":27,"context_line":"network_info cache. Ideally this would be done with a token that only has"},{"line_number":28,"context_line":"global read access to Neutron. In addition, we might need to use and admin"},{"line_number":29,"context_line":"token when a periodic task triggers actions inside neutron, such as automatic"},{"line_number":30,"context_line":"confirm resize."},{"line_number":31,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_d1d8347c","line":28,"updated":"2017-04-04 11:50:13.000000000","message":"an admin","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"3d6e55f55b3c3358a54bb6de1f8312610bf8bf35","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"We also use admin tokens to do things like doing a periodic refresh of the"},{"line_number":27,"context_line":"network_info cache. Ideally this would be done with a token that only has"},{"line_number":28,"context_line":"global read access to Neutron. In addition, we might need to use and admin"},{"line_number":29,"context_line":"token when a periodic task triggers actions inside neutron, such as automatic"},{"line_number":30,"context_line":"confirm resize."},{"line_number":31,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_32665553","line":28,"range":{"start_line":28,"start_character":65,"end_line":28,"end_character":68},"updated":"2017-04-03 21:47:07.000000000","message":"the","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"3d6e55f55b3c3358a54bb6de1f8312610bf8bf35","unresolved":false,"context_lines":[{"line_number":26,"context_line":"We also use admin tokens to do things like doing a periodic refresh of the"},{"line_number":27,"context_line":"network_info cache. Ideally this would be done with a token that only has"},{"line_number":28,"context_line":"global read access to Neutron. In addition, we might need to use and admin"},{"line_number":29,"context_line":"token when a periodic task triggers actions inside neutron, such as automatic"},{"line_number":30,"context_line":"confirm resize."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"This spec focuses on just the first use case, and trying to stop us using an"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_b2514565","line":29,"range":{"start_line":29,"start_character":36,"end_line":29,"end_character":43},"updated":"2017-04-03 21:47:07.000000000","message":"any action","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"3d6e55f55b3c3358a54bb6de1f8312610bf8bf35","unresolved":false,"context_lines":[{"line_number":29,"context_line":"token when a periodic task triggers actions inside neutron, such as automatic"},{"line_number":30,"context_line":"confirm resize."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"This spec focuses on just the first use case, and trying to stop us using an"},{"line_number":33,"context_line":"admin token to tell Neutron it is Nova doing a port binding. In Ocata we"},{"line_number":34,"context_line":"started sending a service token along with the user token, so Neutron already"},{"line_number":35,"context_line":"knows it is Nova sending a request on behalf of the user. So that service user"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_92fe4135","line":32,"range":{"start_line":32,"start_character":50,"end_line":32,"end_character":56},"updated":"2017-04-03 21:47:07.000000000","message":"try","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"3d6e55f55b3c3358a54bb6de1f8312610bf8bf35","unresolved":false,"context_lines":[{"line_number":29,"context_line":"token when a periodic task triggers actions inside neutron, such as automatic"},{"line_number":30,"context_line":"confirm resize."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"This spec focuses on just the first use case, and trying to stop us using an"},{"line_number":33,"context_line":"admin token to tell Neutron it is Nova doing a port binding. In Ocata we"},{"line_number":34,"context_line":"started sending a service token along with the user token, so Neutron already"},{"line_number":35,"context_line":"knows it is Nova sending a request on behalf of the user. So that service user"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_529679f2","line":32,"range":{"start_line":32,"start_character":65,"end_line":32,"end_character":76},"updated":"2017-04-03 21:47:07.000000000","message":"usage of","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"fb7db9f7e86e43bbd9075385346d87fe33d7f2f6","unresolved":false,"context_lines":[{"line_number":29,"context_line":"token when a periodic task triggers actions inside neutron, such as automatic"},{"line_number":30,"context_line":"confirm resize."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"This spec focuses on just the first use case, and trying to stop us using an"},{"line_number":33,"context_line":"admin token to tell Neutron it is Nova doing a port binding. In Ocata we"},{"line_number":34,"context_line":"started sending a service token along with the user token, so Neutron already"},{"line_number":35,"context_line":"knows it is Nova sending a request on behalf of the user. So that service user"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_9143cc13","line":32,"updated":"2017-04-04 11:50:13.000000000","message":"use case: no longer using an admin token...","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"fb7db9f7e86e43bbd9075385346d87fe33d7f2f6","unresolved":false,"context_lines":[{"line_number":33,"context_line":"admin token to tell Neutron it is Nova doing a port binding. In Ocata we"},{"line_number":34,"context_line":"started sending a service token along with the user token, so Neutron already"},{"line_number":35,"context_line":"knows it is Nova sending a request on behalf of the user. So that service user"},{"line_number":36,"context_line":"should have permission to do the port binding, and the users token gives us"},{"line_number":37,"context_line":"access to their specific project."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"With the introduction of service token, we can use service token instead of"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_114fbc34","line":36,"updated":"2017-04-04 11:50:13.000000000","message":"user\u0027s","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":18337,"name":"Sujitha","email":"sujitha.neti@intel.com","username":"Sujitha"},"change_message_id":"02a99261a7487c58b90a71d7a364ebe853d4b8c1","unresolved":false,"context_lines":[{"line_number":41,"context_line":"currently uses admin token. With this approach, we can restrict use of admin"},{"line_number":42,"context_line":"token when user token is present."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Operations like binding port to perticular host id, updating network info"},{"line_number":45,"context_line":"cache, creating pci requests can be performed with the help of service token"},{"line_number":46,"context_line":"instead of admin token where we have reference to user context. But, in some"},{"line_number":47,"context_line":"operations like periodic tasks we can\u0027t make use of service token as it does"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_f7ab3f86","line":44,"range":{"start_line":44,"start_character":32,"end_line":44,"end_character":42},"updated":"2017-04-03 23:06:46.000000000","message":"particular","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"3d6e55f55b3c3358a54bb6de1f8312610bf8bf35","unresolved":false,"context_lines":[{"line_number":54,"context_line":""},{"line_number":55,"context_line":"* System is insecure because of lot of admin related configurations. This"},{"line_number":56,"context_line":"  change gets rid of admin token in metadata API services and will have"},{"line_number":57,"context_line":"  control over use of admin token. Less use of admin token is better."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Proposed change"},{"line_number":60,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_925ac14c","line":57,"range":{"start_line":57,"start_character":35,"end_line":57,"end_character":68},"updated":"2017-04-03 21:47:07.000000000","message":"Only use admin token when absolutely required.\nWhy not link the bug here.","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"3d6e55f55b3c3358a54bb6de1f8312610bf8bf35","unresolved":false,"context_lines":[{"line_number":54,"context_line":""},{"line_number":55,"context_line":"* System is insecure because of lot of admin related configurations. This"},{"line_number":56,"context_line":"  change gets rid of admin token in metadata API services and will have"},{"line_number":57,"context_line":"  control over use of admin token. Less use of admin token is better."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Proposed change"},{"line_number":60,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_32509532","line":57,"range":{"start_line":57,"start_character":15,"end_line":57,"end_character":18},"updated":"2017-04-03 21:47:07.000000000","message":"the use","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"c1f78c174daf09a08d1925c312b69d0d823b65a2","unresolved":false,"context_lines":[{"line_number":54,"context_line":""},{"line_number":55,"context_line":"* System is insecure because of lot of admin related configurations. This"},{"line_number":56,"context_line":"  change gets rid of admin token in metadata API services and will have"},{"line_number":57,"context_line":"  control over use of admin token. Less use of admin token is better."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Proposed change"},{"line_number":60,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_e652543b","line":57,"range":{"start_line":57,"start_character":35,"end_line":57,"end_character":68},"in_reply_to":"dfeb2761_925ac14c","updated":"2017-04-04 14:50:44.000000000","message":"Bug link added under references section.","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"3d6e55f55b3c3358a54bb6de1f8312610bf8bf35","unresolved":false,"context_lines":[{"line_number":59,"context_line":"Proposed change"},{"line_number":60,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"We can make use new role provided by keystoneauth."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"\"service_roles\": \"service:nova\""},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_f23eadd8","line":62,"range":{"start_line":62,"start_character":16,"end_line":62,"end_character":19},"updated":"2017-04-03 21:47:07.000000000","message":"of new","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"3d6e55f55b3c3358a54bb6de1f8312610bf8bf35","unresolved":false,"context_lines":[{"line_number":79,"context_line":"object using oslo_context.context.Context.from_environ(). This will"},{"line_number":80,"context_line":"allow us to have service_roles field in the context object."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"A configuration option ``service_token_admin_actions`` which defaults to"},{"line_number":83,"context_line":"``False`` can be used to perform admin API actions using service token."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"We could add a service token along with auth token which identifies itself"},{"line_number":86,"context_line":"to Neutron as Nova. This allows to perform any actions for which we have"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_0d58d02f","line":83,"range":{"start_line":82,"start_character":0,"end_line":83,"end_character":71},"updated":"2017-04-03 21:47:07.000000000","message":"Better to call out why you are adding the cfg option. Basically to maintain current behavior.","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":18337,"name":"Sujitha","email":"sujitha.neti@intel.com","username":"Sujitha"},"change_message_id":"02a99261a7487c58b90a71d7a364ebe853d4b8c1","unresolved":false,"context_lines":[{"line_number":92,"context_line":"performing this operation with \"service_roles\"."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"With this change we restrict using admin token whereever user context is"},{"line_number":95,"context_line":"available. User context along with service role will have added priviledges"},{"line_number":96,"context_line":"to perform admin only actions. Hence, we don\u0027t need admin context here which"},{"line_number":97,"context_line":"has a global scope and can cause potential security vulnerability."},{"line_number":98,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_b2cb8570","line":95,"range":{"start_line":95,"start_character":64,"end_line":95,"end_character":75},"updated":"2017-04-03 23:06:46.000000000","message":"privileges","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":19590,"name":"Sarafraj Singh","email":"Sarafraj.Singh@intel.com","username":"sarafrajsingh"},"change_message_id":"3d6e55f55b3c3358a54bb6de1f8312610bf8bf35","unresolved":false,"context_lines":[{"line_number":98,"context_line":""},{"line_number":99,"context_line":"This change needs to be done in such a way that request to Neutron does not"},{"line_number":100,"context_line":"fail if new Nova (N+1) release and old Neutron (N) release co-exists. We can"},{"line_number":101,"context_line":"make use of some configuration like ``use_service_token_for_binding``. We will"},{"line_number":102,"context_line":"make it defaults to ``False`` in release (N) and in the subsequent release"},{"line_number":103,"context_line":"(N+1), it will be ``True`` by default. We note in the docs that you can ensure"},{"line_number":104,"context_line":"a smooth upgrade by upgrading Neutron before Nova, else you need to look at"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_0da69011","line":101,"range":{"start_line":101,"start_character":38,"end_line":101,"end_character":67},"updated":"2017-04-03 21:47:07.000000000","message":"How is this cfg option different than the one you described above? Can\u0027t we use the same cfg?","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":18337,"name":"Sujitha","email":"sujitha.neti@intel.com","username":"Sujitha"},"change_message_id":"02a99261a7487c58b90a71d7a364ebe853d4b8c1","unresolved":false,"context_lines":[{"line_number":98,"context_line":""},{"line_number":99,"context_line":"This change needs to be done in such a way that request to Neutron does not"},{"line_number":100,"context_line":"fail if new Nova (N+1) release and old Neutron (N) release co-exists. We can"},{"line_number":101,"context_line":"make use of some configuration like ``use_service_token_for_binding``. We will"},{"line_number":102,"context_line":"make it defaults to ``False`` in release (N) and in the subsequent release"},{"line_number":103,"context_line":"(N+1), it will be ``True`` by default. We note in the docs that you can ensure"},{"line_number":104,"context_line":"a smooth upgrade by upgrading Neutron before Nova, else you need to look at"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_684bcaaf","line":101,"range":{"start_line":101,"start_character":38,"end_line":101,"end_character":67},"in_reply_to":"dfeb2761_0da69011","updated":"2017-04-03 23:06:46.000000000","message":"+1","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":18335,"name":"Pushkar Umaranikar","email":"pushkar.umaranikar@intel.com","username":"pushkarumaranikar"},"change_message_id":"c1f78c174daf09a08d1925c312b69d0d823b65a2","unresolved":false,"context_lines":[{"line_number":98,"context_line":""},{"line_number":99,"context_line":"This change needs to be done in such a way that request to Neutron does not"},{"line_number":100,"context_line":"fail if new Nova (N+1) release and old Neutron (N) release co-exists. We can"},{"line_number":101,"context_line":"make use of some configuration like ``use_service_token_for_binding``. We will"},{"line_number":102,"context_line":"make it defaults to ``False`` in release (N) and in the subsequent release"},{"line_number":103,"context_line":"(N+1), it will be ``True`` by default. We note in the docs that you can ensure"},{"line_number":104,"context_line":"a smooth upgrade by upgrading Neutron before Nova, else you need to look at"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_86cdc867","line":101,"range":{"start_line":101,"start_character":38,"end_line":101,"end_character":67},"in_reply_to":"dfeb2761_684bcaaf","updated":"2017-04-04 14:50:44.000000000","message":"This config is used to decide when can we stop using auth token to communicate with Neutron.\nWe default it to False and we get it tested, then change it to True and deprecate it.","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"95afa4006c17f573eb701acfa8fd4f0ed72f292d","unresolved":false,"context_lines":[{"line_number":98,"context_line":""},{"line_number":99,"context_line":"This change needs to be done in such a way that request to Neutron does not"},{"line_number":100,"context_line":"fail if new Nova (N+1) release and old Neutron (N) release co-exists. We can"},{"line_number":101,"context_line":"make use of some configuration like ``use_service_token_for_binding``. We will"},{"line_number":102,"context_line":"make it defaults to ``False`` in release (N) and in the subsequent release"},{"line_number":103,"context_line":"(N+1), it will be ``True`` by default. We note in the docs that you can ensure"},{"line_number":104,"context_line":"a smooth upgrade by upgrading Neutron before Nova, else you need to look at"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_fa954834","line":101,"range":{"start_line":101,"start_character":38,"end_line":101,"end_character":67},"in_reply_to":"dfeb2761_86cdc867","updated":"2017-04-04 15:04:32.000000000","message":"I don\u0027t understand how you can test it when it is False to know if it\u0027s going to work.\n\nThis isn\u0027t and easy or quick fix, as this is something that has to be rolled out to *every* nova-compute worker. So on a 1000 node cluster, 1000 config file updates and worker restarts.","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":18337,"name":"Sujitha","email":"sujitha.neti@intel.com","username":"Sujitha"},"change_message_id":"02a99261a7487c58b90a71d7a364ebe853d4b8c1","unresolved":false,"context_lines":[{"line_number":115,"context_line":"------------"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"* In future, we can think of maintaining admin token at conductor instead of"},{"line_number":118,"context_line":"  computr node. Each conductor will have token to authenticate itself to"},{"line_number":119,"context_line":"  Neutron as a Nova service."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_92ad218a","line":118,"range":{"start_line":118,"start_character":2,"end_line":118,"end_character":9},"updated":"2017-04-03 23:06:46.000000000","message":"compute","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":18337,"name":"Sujitha","email":"sujitha.neti@intel.com","username":"Sujitha"},"change_message_id":"02a99261a7487c58b90a71d7a364ebe853d4b8c1","unresolved":false,"context_lines":[{"line_number":131,"context_line":"Security impact"},{"line_number":132,"context_line":"---------------"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"Service token will be used to perform admin actions with Neutron API."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"Notifications impact"},{"line_number":137,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dfeb2761_7244ddb7","line":134,"updated":"2017-04-03 23:06:46.000000000","message":"I think we should add it here: using service token removes the security vulnerability caused by using admin context.","commit_id":"b1e0c8eeb7b9ff495af7996cbe44b56617f941df"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Stop using neutron admin token"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/stop-using-neutron-admin-token"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_7291b952","line":8,"range":{"start_line":8,"start_character":0,"end_line":8,"end_character":30},"updated":"2017-04-06 11:19:51.000000000","message":"I think we should reverse this title, its misleading really. Would this be better:\n\nUse service token to authorize neutron port binding.","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Problem description"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Nova API service maintains one authenticated admin auth globally. When Nova"},{"line_number":21,"context_line":"talks to the Neutron REST API, it uses an admin token, in some scenarios"},{"line_number":22,"context_line":"like setting the port binding on a port. In these cases, the admin token is"},{"line_number":23,"context_line":"used to ensure only Nova has access to the binding API, as you don\u0027t want"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_b22ce147","line":20,"range":{"start_line":20,"start_character":0,"end_line":20,"end_character":65},"updated":"2017-04-06 11:19:51.000000000","message":"This sentence seems confusing. I would just drop this sentence.","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":23,"context_line":"used to ensure only Nova has access to the binding API, as you don\u0027t want"},{"line_number":24,"context_line":"end users binding ports to hypervisors."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"We also use admin tokens to do things like periodic refresh of the"},{"line_number":27,"context_line":"network_info cache. Ideally this would be done with a token that only has"},{"line_number":28,"context_line":"global read access to Neutron. In addition, we might need to use an admin"},{"line_number":29,"context_line":"token when a periodic task triggers any action inside neutron, such as"},{"line_number":30,"context_line":"automatic confirm resize."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"This spec focuses on just the first use case: no longer using an"},{"line_number":33,"context_line":"admin token to tell Neutron it is Nova doing a port binding. In Ocata we"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_b245011a","line":30,"range":{"start_line":26,"start_character":0,"end_line":30,"end_character":25},"updated":"2017-04-06 11:19:51.000000000","message":"This is all true, but not fixed here I fear. We should make it clear this is future work by moving it to the very end of the problem description, and starting it with something like:\n\n\"This is out of scope for this spec, but there are other places that use the admin token that we are not yet changing...\"","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"This spec focuses on just the first use case: no longer using an"},{"line_number":33,"context_line":"admin token to tell Neutron it is Nova doing a port binding. In Ocata we"},{"line_number":34,"context_line":"started sending a service token along with the user token, so Neutron already"},{"line_number":35,"context_line":"knows it is Nova sending a request on behalf of the user. So that service"},{"line_number":36,"context_line":"user\u0027s should have permission to do the port binding, and the users token"},{"line_number":37,"context_line":"gives us access to their specific project."},{"line_number":38,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_12b82dc6","line":35,"range":{"start_line":34,"start_character":59,"end_line":35,"end_character":56},"updated":"2017-04-06 11:19:51.000000000","message":"I find this bit confusing.\n\nI think I would just drop this bit of the sentence.","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":32,"context_line":"This spec focuses on just the first use case: no longer using an"},{"line_number":33,"context_line":"admin token to tell Neutron it is Nova doing a port binding. In Ocata we"},{"line_number":34,"context_line":"started sending a service token along with the user token, so Neutron already"},{"line_number":35,"context_line":"knows it is Nova sending a request on behalf of the user. So that service"},{"line_number":36,"context_line":"user\u0027s should have permission to do the port binding, and the users token"},{"line_number":37,"context_line":"gives us access to their specific project."},{"line_number":38,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_12ddcd13","line":35,"range":{"start_line":35,"start_character":58,"end_line":35,"end_character":60},"updated":"2017-04-06 11:19:51.000000000","message":"I think its clearer if we change:\n\nSo that service user\u0027s should have...\n\nTo something more like:\n\nIdeally, instead of needing an admin token for port binding, the service token along with the user\u0027s token would be enough.","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":36,"context_line":"user\u0027s should have permission to do the port binding, and the users token"},{"line_number":37,"context_line":"gives us access to their specific project."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"With the introduction of service token, we can use service token instead of"},{"line_number":40,"context_line":"admin token to perform metadata API services related operations which"},{"line_number":41,"context_line":"currently uses admin token. With this approach, we can restrict use of admin"},{"line_number":42,"context_line":"token when user token is present."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Operations like binding port to particular host id, updating network info"},{"line_number":45,"context_line":"cache, creating pci requests can be performed with the help of service token"},{"line_number":46,"context_line":"instead of admin token where we have reference to user context. But, in some"},{"line_number":47,"context_line":"operations like periodic tasks we can\u0027t make use of service token as it does"},{"line_number":48,"context_line":"not have any user context. Such operations will continue using admin auth"},{"line_number":49,"context_line":"token."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Use Cases"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_b2398142","line":49,"range":{"start_line":39,"start_character":0,"end_line":49,"end_character":6},"updated":"2017-04-06 11:19:51.000000000","message":"If we get the above re-ordered, I think this is just repeating the same things. But I could be wrong.","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":53,"context_line":"---------"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"* System is insecure because of lot of admin related configurations. This"},{"line_number":56,"context_line":"  change gets rid of admin token in metadata API services and will have"},{"line_number":57,"context_line":"  control over the use of admin token. Only use admin token when absolutely"},{"line_number":58,"context_line":"  required."},{"line_number":59,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_5248f5ca","line":56,"range":{"start_line":56,"start_character":36,"end_line":56,"end_character":58},"updated":"2017-04-06 11:19:51.000000000","message":"This change doesn\u0027t help with that I am afraid.","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":54,"context_line":""},{"line_number":55,"context_line":"* System is insecure because of lot of admin related configurations. This"},{"line_number":56,"context_line":"  change gets rid of admin token in metadata API services and will have"},{"line_number":57,"context_line":"  control over the use of admin token. Only use admin token when absolutely"},{"line_number":58,"context_line":"  required."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"Proposed change"},{"line_number":61,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_d20d2591","line":58,"range":{"start_line":57,"start_character":39,"end_line":58,"end_character":11},"updated":"2017-04-06 11:19:51.000000000","message":"This just reduces the use of the admin token, so we are closer to not needing it at all.","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":59,"context_line":""},{"line_number":60,"context_line":"Proposed change"},{"line_number":61,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"We can make use of new role provided by keystoneauth."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"\"service_roles\": \"service:nova\""}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_b2606134","line":62,"updated":"2017-04-06 11:19:51.000000000","message":"I would start with talking about the change in need in Neutron. Its not clear what is Nova and what is Neutron here.","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Proposed change"},{"line_number":61,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"We can make use of new role provided by keystoneauth."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"\"service_roles\": \"service:nova\""},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_f266e951","line":63,"updated":"2017-04-06 11:19:51.000000000","message":"Its more, keystoneauth now populates the context object with information from the service token, in particular:","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":64,"context_line":""},{"line_number":65,"context_line":"\"service_roles\": \"service:nova\""},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"The above role can be used in policy to define level of access for an"},{"line_number":68,"context_line":"action when service token is used along with user context."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"At now, oslo.context provides service_roles field."},{"line_number":71,"context_line":"http://git.openstack.org/cgit/openstack/oslo.context/tree/oslo_context/context.py#n281"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_edc04e53","line":68,"range":{"start_line":67,"start_character":0,"end_line":68,"end_character":58},"updated":"2017-04-06 11:19:51.000000000","message":"Thats not really a \"role\" as such. the role would be \"service:nova\"","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":70,"context_line":"At now, oslo.context provides service_roles field."},{"line_number":71,"context_line":"http://git.openstack.org/cgit/openstack/oslo.context/tree/oslo_context/context.py#n281"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"We can add policy rule like:"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"\"service_role\": \"service_roles:\u003crole_name\u003e\""},{"line_number":76,"context_line":"\"update_port:binding:host_id\": \"rule:admin_only or rule:service_role\""}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_0da132aa","line":73,"range":{"start_line":73,"start_character":11,"end_line":73,"end_character":17},"updated":"2017-04-06 11:19:51.000000000","message":"thats going to need olso.policy changes.","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":80,"context_line":"object using oslo_context.context.Context.from_environ(). This will"},{"line_number":81,"context_line":"allow us to have service_roles field in the context object."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"A configuration option ``service_token_admin_actions`` which defaults to"},{"line_number":84,"context_line":"``False`` can be used to perform admin API actions using service token."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"We could add a service token along with auth token which identifies itself"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_2da9967a","line":83,"range":{"start_line":83,"start_character":25,"end_line":83,"end_character":52},"updated":"2017-04-06 11:19:51.000000000","message":"hmm, I guess this is a neutron specific one.\n\nMaybe neutron.use_service_token_for_binding \u003d True/False would be easier to understand.\n\ni.e. we fall back to using the admin token.","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":"For example, if we want to perform \"binding port to host id\" operation with"},{"line_number":91,"context_line":"service token authentication, we will pass service token along with auth token"},{"line_number":92,"context_line":"to communicate with Neutron. In this case, Neutron policy should also allow"},{"line_number":93,"context_line":"performing this operation with \"service_roles\"."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"With this change we restrict using admin token whereever user context is"},{"line_number":96,"context_line":"available. User context along with service role will have added privileges"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_0dddb213","line":93,"range":{"start_line":92,"start_character":29,"end_line":93,"end_character":47},"updated":"2017-04-06 11:19:51.000000000","message":"We need to be much clearer on neutron vs Nova changes here.","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":95,"context_line":"With this change we restrict using admin token whereever user context is"},{"line_number":96,"context_line":"available. User context along with service role will have added privileges"},{"line_number":97,"context_line":"to perform admin only actions. Hence, we don\u0027t need admin context here which"},{"line_number":98,"context_line":"has a global scope and can cause potential security vulnerability."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"This change needs to be done in such a way that request to Neutron does not"},{"line_number":101,"context_line":"fail if new Nova (N+1) release and old Neutron (N) release co-exists. We can"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_6dcd5e5c","line":98,"updated":"2017-04-06 11:19:51.000000000","message":"I am not 100% sure we can do the change like that.\n\nI would rather we focus on the binding for now.","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"This change needs to be done in such a way that request to Neutron does not"},{"line_number":101,"context_line":"fail if new Nova (N+1) release and old Neutron (N) release co-exists. We can"},{"line_number":102,"context_line":"make use of some configuration like ``use_service_token_for_binding``. We will"},{"line_number":103,"context_line":"make it defaults to ``False`` in release (N) and in the subsequent release"},{"line_number":104,"context_line":"(N+1), it will be ``True`` by default. We note in the docs that you can ensure"},{"line_number":105,"context_line":"a smooth upgrade by upgrading Neutron before Nova, else you need to look at"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_8dcb0252","line":102,"range":{"start_line":102,"start_character":38,"end_line":102,"end_character":67},"updated":"2017-04-06 11:19:51.000000000","message":"hmm, so what does the above config do then? I am confused.\n\nWe should be clear on how this interacts with the send_service_token config we have already. I assume this only works if the other one is True?","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":106,"context_line":"that configuration to buy you more time."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"In the code, we could just detect a 403 and fallback to using the admin"},{"line_number":109,"context_line":"token."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"NOTE: Neutron policy.json needs to be modified for service token rule."},{"line_number":112,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_4d485acb","line":109,"updated":"2017-04-06 11:19:51.000000000","message":"I think we should fail hard, otherwise its going to be hard to debug.\n\nThis could be done to slow rolling with no configuration, but I think we want a hard stop while we have an explicit configuration here.","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":108,"context_line":"In the code, we could just detect a 403 and fallback to using the admin"},{"line_number":109,"context_line":"token."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"NOTE: Neutron policy.json needs to be modified for service token rule."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":""},{"line_number":114,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_ad87e6d7","line":111,"updated":"2017-04-06 11:19:51.000000000","message":"we should link to the RFE bug here, rather than just adding in the references. But as mentioned above, I think we should start with that.","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":117,"context_line":""},{"line_number":118,"context_line":"* In future, we can think of maintaining admin token at conductor instead of"},{"line_number":119,"context_line":"  compute node. Each conductor will have token to authenticate itself to"},{"line_number":120,"context_line":"  Neutron as a Nova service."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"Data model impact"},{"line_number":123,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_cde90a81","line":120,"updated":"2017-04-06 11:19:51.000000000","message":"Right, we could move all credentials to a central service like the conductor, rather than having to have credentials on every compute node.\n\nIts really about the credentials.","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":133,"context_line":"---------------"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"Service token will be used to perform admin actions with Neutron API."},{"line_number":136,"context_line":"It removes the security vulnerability caused by using admin context."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Notifications impact"},{"line_number":139,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_0dbed264","line":136,"updated":"2017-04-06 11:19:51.000000000","message":"I don\u0027t think this really does that.\n\nI would like to not call it a vulnerability. Its more about reducing the potential attack surface.","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"1ab0ba857270b6164c01f5bc216f05154e167b22","unresolved":false,"context_lines":[{"line_number":191,"context_line":"Testing"},{"line_number":192,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"* Add unit tests which will cover this flow."},{"line_number":195,"context_line":""},{"line_number":196,"context_line":"Documentation Impact"},{"line_number":197,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_52bfd5fa","line":194,"range":{"start_line":194,"start_character":0,"end_line":194,"end_character":44},"updated":"2017-04-06 11:19:51.000000000","message":"So when we discussed this I thought we agreed this flow:\n\n* off by default\n* get it working in the gate\n* consider turning it on by default\n* (wait a cycle)\n* consider deprecating the ability to turn the feature off","commit_id":"c8bf61660c868724bf181888844daf3e652dbf11"}]}