)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"9582a6b429e1636cb7e2b898607231db0213d033","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Look at simplifying the number of services deployers need to worry about"},{"line_number":10,"context_line":"when deploying Nova."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"This spec is derived from [1] which addressed issues outside of it\u0027s"},{"line_number":13,"context_line":"scope."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"[1] https://review.openstack.org/#/c/438936/"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":8,"id":"dfeb2761_7f02740b","line":12,"updated":"2017-04-03 14:39:23.000000000","message":"s/it\u0027s/its/","commit_id":"f4a780bff6cf963b11909916cd521f1ab99434a3"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"256c64c468da64cc27d461c716be9796172f7424","unresolved":false,"context_lines":[{"line_number":13,"context_line":"scope."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"[1] https://review.openstack.org/#/c/438936/"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"blueprint remove-nova-cert"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Change-Id: I0bee8fa460e59d6483de7813f4d19106f1da9432"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"dfeb2761_0b866167","line":16,"updated":"2017-04-04 14:14:14.000000000","message":"Should have the APIImpact tag in here.","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":14511,"name":"Maciej Szankin","email":"maciej+review@szankin.pl","username":"mszankin"},"change_message_id":"0fb426834d3ff4b10dcee644730a3e5429d625b2","unresolved":false,"context_lines":[{"line_number":13,"context_line":"scope."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"[1] https://review.openstack.org/#/c/438936/"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"blueprint remove-nova-cert"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Change-Id: I0bee8fa460e59d6483de7813f4d19106f1da9432"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"dfeb2761_bfad6a9c","line":16,"in_reply_to":"dfeb2761_0b866167","updated":"2017-04-05 13:51:04.000000000","message":"Done","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"}],"specs/pike/approved/remove-nova-cert.rst":[{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"f632d50cd2b3e3c92146872755b0980de234f98d","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/remove-nova-cert"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Nova has a lot of separate workers that require additional effort during"},{"line_number":14,"context_line":"deployment or upgrade."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"This spec looks at simplifying the deployment for the majority of deployments."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Problem description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"dfeb2761_733bd5ea","line":16,"range":{"start_line":13,"start_character":0,"end_line":16,"end_character":78},"updated":"2017-04-03 13:41:01.000000000","message":"This is meant to be a summary of *this* spec. So maybe just, \"removing nova-cert to make deployers lives easier\".","commit_id":"07d572a53c90469eba997fe0b3d5244603bb8230"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"f632d50cd2b3e3c92146872755b0980de234f98d","unresolved":false,"context_lines":[{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"``nova-cert`` has been deprecated since July 2016, so the removal of this"},{"line_number":35,"context_line":"service should be straight forward."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Alternatives"},{"line_number":38,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"dfeb2761_e61cc16b","line":35,"range":{"start_line":35,"start_character":8,"end_line":35,"end_character":34},"updated":"2017-04-03 13:41:01.000000000","message":"You mean is allowed?\n\nCan you please link to the commit we actually deprecated it, like did it go in the release notes, do we warn users running nova-cert and tell them not to?\n\nWhat are you doing here? removing the command line entry point, removing the service code? What else?","commit_id":"07d572a53c90469eba997fe0b3d5244603bb8230"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"f632d50cd2b3e3c92146872755b0980de234f98d","unresolved":false,"context_lines":[{"line_number":43,"context_line":"with if condition checking for the value of this option. Until disabling"},{"line_number":44,"context_line":"``nova-cert`` has been confirmed in tests as stable, we default"},{"line_number":45,"context_line":"``disable_cert_service`` to False. Once the tests are satisfactory, we drop"},{"line_number":46,"context_line":"the service and all changes mentioned above."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Data model impact"},{"line_number":49,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"dfeb2761_86d5f545","line":46,"updated":"2017-04-03 13:41:01.000000000","message":"I was expecting an alternative to be send all cert-api requests to nova-conductor. Or have nova-conductor listen for the cert RPC bus?","commit_id":"07d572a53c90469eba997fe0b3d5244603bb8230"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"f632d50cd2b3e3c92146872755b0980de234f98d","unresolved":false,"context_lines":[{"line_number":53,"context_line":"REST API impact"},{"line_number":54,"context_line":"---------------"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"None"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Security impact"},{"line_number":59,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"dfeb2761_b31a7d7a","line":56,"range":{"start_line":56,"start_character":0,"end_line":56,"end_character":4},"updated":"2017-04-03 13:41:01.000000000","message":"So what happens to the Cert APIs the depend on the service existing?\n\nI guess they now return 400? maybe?\n\nAs there is no raising of the minimum API version here, there is really no way to discover the API is gone. Is there anything we can do about that? Maybe not, but we should probably address that here.","commit_id":"07d572a53c90469eba997fe0b3d5244603bb8230"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"f632d50cd2b3e3c92146872755b0980de234f98d","unresolved":false,"context_lines":[{"line_number":93,"context_line":"-----------"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Primary assignee:"},{"line_number":96,"context_line":"  John Garbutt (johnthetubaguy)"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Other contributors:"},{"line_number":99,"context_line":"  OSIC"}],"source_content_type":"text/x-rst","patch_set":7,"id":"dfeb2761_e654c1cc","line":96,"updated":"2017-04-03 13:41:01.000000000","message":"Really? I think we should assign this to you :)","commit_id":"07d572a53c90469eba997fe0b3d5244603bb8230"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"f632d50cd2b3e3c92146872755b0980de234f98d","unresolved":false,"context_lines":[{"line_number":103,"context_line":""},{"line_number":104,"context_line":"* delete ``nova-cert`` service"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Alternative:"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"* add ``disable_cert_service`` with default of ``False``"},{"line_number":109,"context_line":"* get the gate testing the new configuration, i.e."},{"line_number":110,"context_line":"  ``disable_cert_service \u003d True``"},{"line_number":111,"context_line":"* once testing is stable, switch the default of ``disable_cert_service`` to"},{"line_number":112,"context_line":"  ``True``"},{"line_number":113,"context_line":"* deprecate and finally remove ``disable_cert_service`` when ``nova-cert``"},{"line_number":114,"context_line":"  is no more."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"Dependencies"},{"line_number":117,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"dfeb2761_26f989c7","line":114,"range":{"start_line":106,"start_character":0,"end_line":114,"end_character":13},"updated":"2017-04-03 13:41:01.000000000","message":"don\u0027t talk about alternatives is here, the spec should be clear on exactly what is happening.\n\nalternatives are really just there to say, \"hey we thought about this other way, but its way worse, so we are not doing that.\"","commit_id":"07d572a53c90469eba997fe0b3d5244603bb8230"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"480e1a168623ce41f680efee44e8681070f4511f","unresolved":false,"context_lines":[{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"``nova-cert`` has been deprecated since July 2016 with the commit"},{"line_number":35,"context_line":"https://github.com/openstack/nova/commit/789edad0e811d866551bec18dc7729541105f59d,"},{"line_number":36,"context_line":"that added release note and logged a warning stating ``nova-cert`` as"},{"line_number":37,"context_line":"deprecated. If the deprecation cycle allows, dropping ``nova-cert`` should"},{"line_number":38,"context_line":"be straight forward."}],"source_content_type":"text/x-rst","patch_set":8,"id":"dfeb2761_6628b133","line":35,"range":{"start_line":35,"start_character":80,"end_line":35,"end_character":82},"updated":"2017-04-03 13:43:52.000000000","message":"I think you need to remove \",\" from the end here.","commit_id":"f4a780bff6cf963b11909916cd521f1ab99434a3"},{"author":{"_account_id":14511,"name":"Maciej Szankin","email":"maciej+review@szankin.pl","username":"mszankin"},"change_message_id":"2a46db0e793adb9793a54a3b750e2287da854b61","unresolved":false,"context_lines":[{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"``nova-cert`` has been deprecated since July 2016 with the commit"},{"line_number":35,"context_line":"https://github.com/openstack/nova/commit/789edad0e811d866551bec18dc7729541105f59d,"},{"line_number":36,"context_line":"that added release note and logged a warning stating ``nova-cert`` as"},{"line_number":37,"context_line":"deprecated. If the deprecation cycle allows, dropping ``nova-cert`` should"},{"line_number":38,"context_line":"be straight forward."}],"source_content_type":"text/x-rst","patch_set":8,"id":"dfeb2761_2f85d108","line":35,"range":{"start_line":35,"start_character":80,"end_line":35,"end_character":82},"in_reply_to":"dfeb2761_6628b133","updated":"2017-04-04 13:51:25.000000000","message":"Done","commit_id":"f4a780bff6cf963b11909916cd521f1ab99434a3"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"9582a6b429e1636cb7e2b898607231db0213d033","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"``nova-cert`` has been deprecated since July 2016 with the commit"},{"line_number":35,"context_line":"https://github.com/openstack/nova/commit/789edad0e811d866551bec18dc7729541105f59d,"},{"line_number":36,"context_line":"that added release note and logged a warning stating ``nova-cert`` as"},{"line_number":37,"context_line":"deprecated. If the deprecation cycle allows, dropping ``nova-cert`` should"},{"line_number":38,"context_line":"be straight forward."},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"dfeb2761_5f09f029","line":36,"updated":"2017-04-03 14:39:23.000000000","message":"s/as/is/","commit_id":"f4a780bff6cf963b11909916cd521f1ab99434a3"},{"author":{"_account_id":14511,"name":"Maciej Szankin","email":"maciej+review@szankin.pl","username":"mszankin"},"change_message_id":"2a46db0e793adb9793a54a3b750e2287da854b61","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"``nova-cert`` has been deprecated since July 2016 with the commit"},{"line_number":35,"context_line":"https://github.com/openstack/nova/commit/789edad0e811d866551bec18dc7729541105f59d,"},{"line_number":36,"context_line":"that added release note and logged a warning stating ``nova-cert`` as"},{"line_number":37,"context_line":"deprecated. If the deprecation cycle allows, dropping ``nova-cert`` should"},{"line_number":38,"context_line":"be straight forward."},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"dfeb2761_ef7ec917","line":36,"in_reply_to":"dfeb2761_5f09f029","updated":"2017-04-04 13:51:25.000000000","message":"Done","commit_id":"f4a780bff6cf963b11909916cd521f1ab99434a3"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"86b06fc68d87ad2a20bb4f88e678aba5d97d8e0d","unresolved":false,"context_lines":[{"line_number":40,"context_line":"Alternatives"},{"line_number":41,"context_line":"------------"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"If the deprecation cycle does not allow for removing of ``nova-cert`` we"},{"line_number":44,"context_line":"introduce new configuration option ``disable_cert_service`` that will allow"},{"line_number":45,"context_line":"to switch ``nova-cert`` on and off and surround all calls to this service"},{"line_number":46,"context_line":"with if condition checking for the value of this option. Until disabling"},{"line_number":47,"context_line":"``nova-cert`` has been confirmed in tests as stable, we default"},{"line_number":48,"context_line":"``disable_cert_service`` to False. Once the tests are satisfactory, we drop"},{"line_number":49,"context_line":"the service and all changes mentioned above."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"Data model impact"},{"line_number":52,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"dfeb2761_29415a3a","line":49,"range":{"start_line":43,"start_character":0,"end_line":49,"end_character":44},"updated":"2017-04-03 13:56:51.000000000","message":"Its easy to just not run nova-cert, I think we can remove this.\n\nThe main alternative is living nova-cert in the code base, and leave it creating confusion for deployers.","commit_id":"f4a780bff6cf963b11909916cd521f1ab99434a3"},{"author":{"_account_id":14511,"name":"Maciej Szankin","email":"maciej+review@szankin.pl","username":"mszankin"},"change_message_id":"2a46db0e793adb9793a54a3b750e2287da854b61","unresolved":false,"context_lines":[{"line_number":40,"context_line":"Alternatives"},{"line_number":41,"context_line":"------------"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"If the deprecation cycle does not allow for removing of ``nova-cert`` we"},{"line_number":44,"context_line":"introduce new configuration option ``disable_cert_service`` that will allow"},{"line_number":45,"context_line":"to switch ``nova-cert`` on and off and surround all calls to this service"},{"line_number":46,"context_line":"with if condition checking for the value of this option. Until disabling"},{"line_number":47,"context_line":"``nova-cert`` has been confirmed in tests as stable, we default"},{"line_number":48,"context_line":"``disable_cert_service`` to False. Once the tests are satisfactory, we drop"},{"line_number":49,"context_line":"the service and all changes mentioned above."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"Data model impact"},{"line_number":52,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"dfeb2761_4f0a558a","line":49,"range":{"start_line":43,"start_character":0,"end_line":49,"end_character":44},"in_reply_to":"dfeb2761_29415a3a","updated":"2017-04-04 13:51:25.000000000","message":"Done","commit_id":"f4a780bff6cf963b11909916cd521f1ab99434a3"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"480e1a168623ce41f680efee44e8681070f4511f","unresolved":false,"context_lines":[{"line_number":56,"context_line":"REST API impact"},{"line_number":57,"context_line":"---------------"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"None"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Security impact"},{"line_number":62,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"dfeb2761_26d0691f","line":59,"updated":"2017-04-03 13:43:52.000000000","message":"Need lots more discussion here.","commit_id":"f4a780bff6cf963b11909916cd521f1ab99434a3"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"86b06fc68d87ad2a20bb4f88e678aba5d97d8e0d","unresolved":false,"context_lines":[{"line_number":56,"context_line":"REST API impact"},{"line_number":57,"context_line":"---------------"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"None"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Security impact"},{"line_number":62,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"dfeb2761_26b2a995","line":59,"in_reply_to":"dfeb2761_26d0691f","updated":"2017-04-03 13:56:51.000000000","message":"I think we now start returning 400 with feature not available, kinds of messages. Ideally something we can use in similar situations in the future.","commit_id":"f4a780bff6cf963b11909916cd521f1ab99434a3"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"86b06fc68d87ad2a20bb4f88e678aba5d97d8e0d","unresolved":false,"context_lines":[{"line_number":61,"context_line":"Security impact"},{"line_number":62,"context_line":"---------------"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"None"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"Notifications impact"},{"line_number":67,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"dfeb2761_0937b6e5","line":64,"updated":"2017-04-03 13:56:51.000000000","message":"We could mention the worries about entropy not being managed, and how removing this is probably safest.","commit_id":"f4a780bff6cf963b11909916cd521f1ab99434a3"},{"author":{"_account_id":18337,"name":"Sujitha","email":"sujitha.neti@intel.com","username":"Sujitha"},"change_message_id":"e4afd40de5ffb8427db09054ed53ef38ba25dfb1","unresolved":false,"context_lines":[{"line_number":104,"context_line":"Work Items"},{"line_number":105,"context_line":"----------"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"* delete ``nova-cert`` service"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Alternative:"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"dfeb2761_0f88cd1c","line":107,"updated":"2017-04-03 18:29:08.000000000","message":"removing the API code and starter script for the service?\n\nWould be nice if work items are elaborated.","commit_id":"f4a780bff6cf963b11909916cd521f1ab99434a3"},{"author":{"_account_id":14511,"name":"Maciej Szankin","email":"maciej+review@szankin.pl","username":"mszankin"},"change_message_id":"2a46db0e793adb9793a54a3b750e2287da854b61","unresolved":false,"context_lines":[{"line_number":104,"context_line":"Work Items"},{"line_number":105,"context_line":"----------"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"* delete ``nova-cert`` service"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Alternative:"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"dfeb2761_3a33b5f8","line":107,"in_reply_to":"dfeb2761_0f88cd1c","updated":"2017-04-04 13:51:25.000000000","message":"Done","commit_id":"f4a780bff6cf963b11909916cd521f1ab99434a3"},{"author":{"_account_id":18337,"name":"Sujitha","email":"sujitha.neti@intel.com","username":"Sujitha"},"change_message_id":"e4afd40de5ffb8427db09054ed53ef38ba25dfb1","unresolved":false,"context_lines":[{"line_number":124,"context_line":"Testing"},{"line_number":125,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"If we choose alternative approach we should move gate jobs to"},{"line_number":128,"context_line":"``disable_cert_service \u003d True``, and no longer run the ``nova-cert`` process."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"Documentation Impact"},{"line_number":131,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"dfeb2761_afad6189","line":128,"range":{"start_line":127,"start_character":0,"end_line":128,"end_character":77},"updated":"2017-04-03 18:29:08.000000000","message":"I think we should talk about proposed approach here not the alternative approach.","commit_id":"f4a780bff6cf963b11909916cd521f1ab99434a3"},{"author":{"_account_id":14511,"name":"Maciej Szankin","email":"maciej+review@szankin.pl","username":"mszankin"},"change_message_id":"2a46db0e793adb9793a54a3b750e2287da854b61","unresolved":false,"context_lines":[{"line_number":124,"context_line":"Testing"},{"line_number":125,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"If we choose alternative approach we should move gate jobs to"},{"line_number":128,"context_line":"``disable_cert_service \u003d True``, and no longer run the ``nova-cert`` process."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"Documentation Impact"},{"line_number":131,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"dfeb2761_b743606c","line":128,"range":{"start_line":127,"start_character":0,"end_line":128,"end_character":77},"in_reply_to":"dfeb2761_afad6189","updated":"2017-04-04 13:51:25.000000000","message":"With proposed approach there is not much to discuss - we just drop the tests.","commit_id":"f4a780bff6cf963b11909916cd521f1ab99434a3"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"62e6a94fd7ca97f7fbad00fb8e0d6ad5439e0512","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Nova has a lot of separate workers that require additional effort during"},{"line_number":14,"context_line":"deployment or upgrade."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"This spec looks at simplifying the deployment for the majority of deployments."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Problem description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_40fb2846","line":16,"updated":"2017-04-04 14:12:54.000000000","message":"\"Simplifying the deployment\" is sort of a side effect of this change. The primary justification for removing nova-cert is that it\u0027s deprecated and unused. I think the opening section should just simply state that,","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":14511,"name":"Maciej Szankin","email":"maciej+review@szankin.pl","username":"mszankin"},"change_message_id":"0fb426834d3ff4b10dcee644730a3e5429d625b2","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Nova has a lot of separate workers that require additional effort during"},{"line_number":14,"context_line":"deployment or upgrade."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"This spec looks at simplifying the deployment for the majority of deployments."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Problem description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_6dc04a2b","line":16,"in_reply_to":"dfeb2761_40fb2846","updated":"2017-04-05 13:51:04.000000000","message":"Done","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"e040416d7c2d6998c44f981a1745447f4bac2609","unresolved":false,"context_lines":[{"line_number":21,"context_line":"Currently to run nova multiple services are required to be deployed and kept"},{"line_number":22,"context_line":"operational, which may complicate deployments and use unnecessary resources."},{"line_number":23,"context_line":"This can be addressed by removing ``nova-cert`` service, reducing the number of"},{"line_number":24,"context_line":"processes that nova has to run to operate."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Use Cases"},{"line_number":27,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_ba590036","line":24,"updated":"2017-04-04 14:55:33.000000000","message":"Perhaps the following:\n\nBecause of the legacy requirements of building euca bundles which require certificates, Nova has a very old and unmaintained \"certificates\" API. This allows a user to use openssl on their Nova cluster to generate certificates randomly instead of doing so locally. Private keys are returned during the POST call, and the root certificate can be fetched later.\n\nBehind the scenes this work is done by having a nova-cert worker. While it is intended to be used as a fleet for entropy reasons, in looking through the code, use as a fleet probably causes corrupt data because every worker would generated it\u0027s own local root CA (making the API not work as intended).\n\nThis API is not used for anything in current Nova code. It makes Nova a certificate authority for random 3rd party use (which it really should not be). There is no managing of entropy, so aggressive use of this API can have negative impacts on the entropy of your cloud depending on where your workers are.\n\nNova-cert is an instance of Nova doing a non essential thing badly. Doing security related operations badly is worse than not doing them at all.","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":14511,"name":"Maciej Szankin","email":"maciej+review@szankin.pl","username":"mszankin"},"change_message_id":"0fb426834d3ff4b10dcee644730a3e5429d625b2","unresolved":false,"context_lines":[{"line_number":21,"context_line":"Currently to run nova multiple services are required to be deployed and kept"},{"line_number":22,"context_line":"operational, which may complicate deployments and use unnecessary resources."},{"line_number":23,"context_line":"This can be addressed by removing ``nova-cert`` service, reducing the number of"},{"line_number":24,"context_line":"processes that nova has to run to operate."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Use Cases"},{"line_number":27,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_0dfe5e6a","line":24,"in_reply_to":"dfeb2761_ba590036","updated":"2017-04-05 13:51:04.000000000","message":"This is awesome.","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"0e8a3b7c3e3a5cc136a61001000caa4db1c098a3","unresolved":false,"context_lines":[{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"``nova-cert`` has been deprecated since July 2016 with the commit"},{"line_number":35,"context_line":"https://github.com/openstack/nova/commit/789edad0e811d866551bec18dc7729541105f59d"},{"line_number":36,"context_line":"that added release note and logged a warning stating ``nova-cert`` is"},{"line_number":37,"context_line":"deprecated. If the deprecation cycle allows, dropping ``nova-cert`` should"},{"line_number":38,"context_line":"be straight forward."}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_e0a7dcbc","line":35,"range":{"start_line":35,"start_character":0,"end_line":35,"end_character":81},"updated":"2017-04-04 14:07:42.000000000","message":"This should probably be moved down to References and just referenced with a citation here.","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":14511,"name":"Maciej Szankin","email":"maciej+review@szankin.pl","username":"mszankin"},"change_message_id":"0fb426834d3ff4b10dcee644730a3e5429d625b2","unresolved":false,"context_lines":[{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"``nova-cert`` has been deprecated since July 2016 with the commit"},{"line_number":35,"context_line":"https://github.com/openstack/nova/commit/789edad0e811d866551bec18dc7729541105f59d"},{"line_number":36,"context_line":"that added release note and logged a warning stating ``nova-cert`` is"},{"line_number":37,"context_line":"deprecated. If the deprecation cycle allows, dropping ``nova-cert`` should"},{"line_number":38,"context_line":"be straight forward."}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_2d1b62d0","line":35,"range":{"start_line":35,"start_character":0,"end_line":35,"end_character":81},"in_reply_to":"dfeb2761_e0a7dcbc","updated":"2017-04-05 13:51:04.000000000","message":"Done","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"62e6a94fd7ca97f7fbad00fb8e0d6ad5439e0512","unresolved":false,"context_lines":[{"line_number":35,"context_line":"https://github.com/openstack/nova/commit/789edad0e811d866551bec18dc7729541105f59d"},{"line_number":36,"context_line":"that added release note and logged a warning stating ``nova-cert`` is"},{"line_number":37,"context_line":"deprecated. If the deprecation cycle allows, dropping ``nova-cert`` should"},{"line_number":38,"context_line":"be straight forward."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Alternatives"},{"line_number":41,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_806ed02c","line":38,"updated":"2017-04-04 14:12:54.000000000","message":"s/straight forward/straightforward","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":14511,"name":"Maciej Szankin","email":"maciej+review@szankin.pl","username":"mszankin"},"change_message_id":"0fb426834d3ff4b10dcee644730a3e5429d625b2","unresolved":false,"context_lines":[{"line_number":35,"context_line":"https://github.com/openstack/nova/commit/789edad0e811d866551bec18dc7729541105f59d"},{"line_number":36,"context_line":"that added release note and logged a warning stating ``nova-cert`` is"},{"line_number":37,"context_line":"deprecated. If the deprecation cycle allows, dropping ``nova-cert`` should"},{"line_number":38,"context_line":"be straight forward."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Alternatives"},{"line_number":41,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_ed10daaa","line":38,"in_reply_to":"dfeb2761_806ed02c","updated":"2017-04-05 13:51:04.000000000","message":"Done","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"62e6a94fd7ca97f7fbad00fb8e0d6ad5439e0512","unresolved":false,"context_lines":[{"line_number":41,"context_line":"------------"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Alternative approach is to let ``nova-cert`` be, leaving developers in"},{"line_number":44,"context_line":"confusion."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Data model impact"},{"line_number":47,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_60750ccb","line":44,"updated":"2017-04-04 14:12:54.000000000","message":"As a developer, I would not be \"in confusion\" if nova-cert is still around. Just say that the alternative is to leave it in.","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":14511,"name":"Maciej Szankin","email":"maciej+review@szankin.pl","username":"mszankin"},"change_message_id":"0fb426834d3ff4b10dcee644730a3e5429d625b2","unresolved":false,"context_lines":[{"line_number":41,"context_line":"------------"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Alternative approach is to let ``nova-cert`` be, leaving developers in"},{"line_number":44,"context_line":"confusion."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Data model impact"},{"line_number":47,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_ad265214","line":44,"in_reply_to":"dfeb2761_60750ccb","updated":"2017-04-05 13:51:04.000000000","message":"Done","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3a8c91e95ad9983301882e8d4f7dbc2785848252","unresolved":false,"context_lines":[{"line_number":51,"context_line":"REST API impact"},{"line_number":52,"context_line":"---------------"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Return `400 Bad Request` upon calling"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"* ``POST /os-certificates``"},{"line_number":57,"context_line":"* ``GET /os-certificates/root``"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_60ad0ce8","line":54,"updated":"2017-04-04 14:00:46.000000000","message":"It\u0027s good that we at least already documented the os-certificates API is deprecated:\n\nhttps://developer.openstack.org/api-ref/compute/#root-certificates-os-certificates-deprecated","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"3b1f2b41407c263671db064393be2843a11b3cfe","unresolved":false,"context_lines":[{"line_number":57,"context_line":"* ``GET /os-certificates/root``"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Additionally, exception stating that feature is not available anymore should"},{"line_number":60,"context_line":"be raised and logged."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Security impact"},{"line_number":63,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_a0ad549c","line":60,"updated":"2017-04-04 14:01:30.000000000","message":"Honestly, 404 is probably the right answer, that\u0027s what we do for any other unknown URL, right?","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":14511,"name":"Maciej Szankin","email":"maciej+review@szankin.pl","username":"mszankin"},"change_message_id":"0fb426834d3ff4b10dcee644730a3e5429d625b2","unresolved":false,"context_lines":[{"line_number":57,"context_line":"* ``GET /os-certificates/root``"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Additionally, exception stating that feature is not available anymore should"},{"line_number":60,"context_line":"be raised and logged."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Security impact"},{"line_number":63,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_ed857ad0","line":60,"in_reply_to":"dfeb2761_0691b847","updated":"2017-04-05 13:51:04.000000000","message":"I am going for the 410. It looks solid for this case.","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"84d50dd1518d38df55e3aa9ccea88ae10bee79fa","unresolved":false,"context_lines":[{"line_number":57,"context_line":"* ``GET /os-certificates/root``"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Additionally, exception stating that feature is not available anymore should"},{"line_number":60,"context_line":"be raised and logged."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Security impact"},{"line_number":63,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_4be229a2","line":60,"in_reply_to":"dfeb2761_0b2d41fd","updated":"2017-04-04 14:26:33.000000000","message":"Based on the RFC, looks like 410 is the way to go. 410 indicates that the resource is \"intentionally unavailable\" and \"the server owners desire that remote links to that resource be removed\".\n\nhttps://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"4de42f6c3efebf03962d39fdd448dadf4ee22dcc","unresolved":false,"context_lines":[{"line_number":57,"context_line":"* ``GET /os-certificates/root``"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Additionally, exception stating that feature is not available anymore should"},{"line_number":60,"context_line":"be raised and logged."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Security impact"},{"line_number":63,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_0b2d41fd","line":60,"in_reply_to":"dfeb2761_2b17e547","updated":"2017-04-04 14:22:36.000000000","message":"404 makes sense for the proxy APIs, they are removed in a specific version.\n\nThis is about a change to all existing versions, where previously a URL returned some meaningful response. As such, 410 sdague mentioned on IRC makes more sense to me.","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"e040416d7c2d6998c44f981a1745447f4bac2609","unresolved":false,"context_lines":[{"line_number":57,"context_line":"* ``GET /os-certificates/root``"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Additionally, exception stating that feature is not available anymore should"},{"line_number":60,"context_line":"be raised and logged."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Security impact"},{"line_number":63,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_0691b847","line":60,"in_reply_to":"dfeb2761_4be229a2","updated":"2017-04-04 14:55:33.000000000","message":"Honestly, we should not over think this.\n\nWhat is the natural error code for a URL that doesn\u0027t exist in the routes table, and use that.","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"62e6a94fd7ca97f7fbad00fb8e0d6ad5439e0512","unresolved":false,"context_lines":[{"line_number":57,"context_line":"* ``GET /os-certificates/root``"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Additionally, exception stating that feature is not available anymore should"},{"line_number":60,"context_line":"be raised and logged."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Security impact"},{"line_number":63,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_e037dcfe","line":60,"in_reply_to":"dfeb2761_a0ad549c","updated":"2017-04-04 14:12:54.000000000","message":"+1 for returning 404. 400 will lead the end user to think they need to reformat their request somehow.","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"beddf40d5044fe35f7c36ebc2469da1c42b488a1","unresolved":false,"context_lines":[{"line_number":57,"context_line":"* ``GET /os-certificates/root``"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Additionally, exception stating that feature is not available anymore should"},{"line_number":60,"context_line":"be raised and logged."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Security impact"},{"line_number":63,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_c00bb87a","line":60,"in_reply_to":"dfeb2761_a0ad549c","updated":"2017-04-04 14:04:49.000000000","message":"I was seeing this as a valid URL with no one to serve up the request. But 404 is maybe more useful to the client, its just we have clearly delete the API I guess. I was assuming its just a case of the API never working any more. Which is probably stupid.","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"23b70ad51cf540504eacd8cb494cb97f6eff880e","unresolved":false,"context_lines":[{"line_number":57,"context_line":"* ``GET /os-certificates/root``"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Additionally, exception stating that feature is not available anymore should"},{"line_number":60,"context_line":"be raised and logged."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Security impact"},{"line_number":63,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_2b17e547","line":60,"in_reply_to":"dfeb2761_c00bb87a","updated":"2017-04-04 14:13:31.000000000","message":"FWIW we use 404 for the proxy APIs after microversion 2.36. What about 410?","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"62e6a94fd7ca97f7fbad00fb8e0d6ad5439e0512","unresolved":false,"context_lines":[{"line_number":67,"context_line":"level of random numbers available from pseudorandom number generator to the"},{"line_number":68,"context_line":"Linux kernel. There are additional packages that users would have to install"},{"line_number":69,"context_line":"inside virtual machines to increase entropy when generating certificates"},{"line_number":70,"context_line":"inside them."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Notifications impact"},{"line_number":73,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_8b14b145","line":70,"updated":"2017-04-04 14:12:54.000000000","message":"Is nova-cert being used to generate certs currently? If so then it probably shouldn\u0027t be removed. If not, then there\u0027s no need for this paragraph.","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"e040416d7c2d6998c44f981a1745447f4bac2609","unresolved":false,"context_lines":[{"line_number":67,"context_line":"level of random numbers available from pseudorandom number generator to the"},{"line_number":68,"context_line":"Linux kernel. There are additional packages that users would have to install"},{"line_number":69,"context_line":"inside virtual machines to increase entropy when generating certificates"},{"line_number":70,"context_line":"inside them."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Notifications impact"},{"line_number":73,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_46d8e01c","line":70,"in_reply_to":"dfeb2761_8b14b145","updated":"2017-04-04 14:55:33.000000000","message":"It\u0027s only being used if you use it directly. The nova-cert API was needed for some bit of the euca bundles back in the EC2 days IIRC, and mostly just means that from a Mac or Windows machine you didn\u0027t have to generate a cert locally.\n\nThat\u0027s not a thing any more. The cert API is a post/get path that is not called by any other Nova code. It\u0027s completely vestigial.","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":7764,"name":"Peter Hamilton","email":"peter.hamilton@jhuapl.edu","username":"Peter"},"change_message_id":"0e8a3b7c3e3a5cc136a61001000caa4db1c098a3","unresolved":false,"context_lines":[{"line_number":77,"context_line":"Other end user impact"},{"line_number":78,"context_line":"---------------------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"None"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Performance Impact"},{"line_number":83,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_802930e7","line":80,"range":{"start_line":80,"start_character":0,"end_line":80,"end_character":4},"updated":"2017-04-04 14:07:42.000000000","message":"What is the recommended alternative for this functionality now? barbican has deprecated their CA functionality. Is there another existing OpenStack solution or are users left with third-party options?","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"23b70ad51cf540504eacd8cb494cb97f6eff880e","unresolved":false,"context_lines":[{"line_number":77,"context_line":"Other end user impact"},{"line_number":78,"context_line":"---------------------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"None"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Performance Impact"},{"line_number":83,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_cb6d19cd","line":80,"range":{"start_line":80,"start_character":0,"end_line":80,"end_character":4},"in_reply_to":"dfeb2761_802930e7","updated":"2017-04-04 14:13:31.000000000","message":"I was wondering the same. The wording in the \u0027Security impact\u0027  section had me a bit worried about dropping something people were using without providing alternatives.","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3a8c91e95ad9983301882e8d4f7dbc2785848252","unresolved":false,"context_lines":[{"line_number":93,"context_line":"Developer impact"},{"line_number":94,"context_line":"----------------"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"None"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Implementation"},{"line_number":99,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_e0d91c57","line":96,"updated":"2017-04-04 14:00:46.000000000","message":"This is going to break the ec2api repo code which relies on the nova-cert rpc client:\n\nhttps://github.com/openstack/ec2-api/blob/480dc02de0d8413aa518a23b22a0140013df1350/ec2api/clients.py#L140\n\nSo I think we need to sort this out with them too.","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":14511,"name":"Maciej Szankin","email":"maciej+review@szankin.pl","username":"mszankin"},"change_message_id":"cdaa8c05e5a19a2c61f081b02f964da322c8ee3f","unresolved":false,"context_lines":[{"line_number":93,"context_line":"Developer impact"},{"line_number":94,"context_line":"----------------"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"None"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Implementation"},{"line_number":99,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"bff0334d_e6209ab3","line":96,"in_reply_to":"dfeb2761_e0d91c57","updated":"2017-04-05 13:58:12.000000000","message":"Leaving a note here.","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":15524,"name":"dane-fichter","email":"dane.fichter@jhuapl.edu","username":"dane-fichter"},"change_message_id":"08e92e963139d23dfd4077ac8f79c6b550cd9bfd","unresolved":false,"context_lines":[{"line_number":124,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"If we choose alternative approach we should move gate jobs to"},{"line_number":127,"context_line":"``disable_cert_service \u003d True``, and no longer run the ``nova-cert`` process."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Documentation Impact"},{"line_number":130,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"dfeb2761_2beec5b3","line":127,"updated":"2017-04-04 14:22:37.000000000","message":"Don\u0027t know if this belongs in the \u0027Testing\u0027 section but looks like there\u0027s a bunch of code in Tempest that needs to be removed as a part of this change.\n\nhttps://github.com/openstack/tempest/blob/8c8943aa45d0a6428fdd4e32aa4e3bd71f39d050/tempest/api/compute/certificates/test_certificates.py","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":14511,"name":"Maciej Szankin","email":"maciej+review@szankin.pl","username":"mszankin"},"change_message_id":"cdaa8c05e5a19a2c61f081b02f964da322c8ee3f","unresolved":false,"context_lines":[{"line_number":124,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"If we choose alternative approach we should move gate jobs to"},{"line_number":127,"context_line":"``disable_cert_service \u003d True``, and no longer run the ``nova-cert`` process."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Documentation Impact"},{"line_number":130,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"bff0334d_49087927","line":127,"in_reply_to":"dfeb2761_2beec5b3","updated":"2017-04-05 13:58:12.000000000","message":"This section is obsolete after I removed the alternative approach. But good point with tempest.","commit_id":"dcef23a7395e685e640b2d7e6b5b9383d73f010d"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"9c786cd723c90b2ad8dd31a06578efc14c61c4a5","unresolved":false,"context_lines":[{"line_number":23,"context_line":"call, and the root certificate can be fetched later."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Behind the scenes this work is done by having a nova-cert worker. While it"},{"line_number":26,"context_line":"is intended to be used as a fleet for entropy reasons, in looking through"},{"line_number":27,"context_line":"the code, use as a fleet probably causes corrupt data because every worker"},{"line_number":28,"context_line":"would generated it\u0027s own local root CA (making the API not work as intended)."},{"line_number":29,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"bff0334d_680f8c2e","line":26,"range":{"start_line":26,"start_character":26,"end_line":26,"end_character":53},"updated":"2017-04-06 11:24:07.000000000","message":"I thought it was more about running it on a physical host rather than a VM, so there was plenty of entropy on there. Either way, entropy is the key bit, and this covers that well.","commit_id":"aa3e70ea92ae23064710a3221f6a7c1e4b74f8ef"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f88307a2254e8d1378e25824ba4970cf45a7954e","unresolved":false,"context_lines":[{"line_number":25,"context_line":"Behind the scenes this work is done by having a nova-cert worker. While it"},{"line_number":26,"context_line":"is intended to be used as a fleet for entropy reasons, in looking through"},{"line_number":27,"context_line":"the code, use as a fleet probably causes corrupt data because every worker"},{"line_number":28,"context_line":"would generated it\u0027s own local root CA (making the API not work as intended)."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"This API is not used for anything in current Nova code. It makes Nova a"},{"line_number":31,"context_line":"certificate authority for random 3rd party use (which it really should not be)."}],"source_content_type":"text/x-rst","patch_set":10,"id":"bff0334d_5e122d0b","line":28,"range":{"start_line":28,"start_character":6,"end_line":28,"end_character":15},"updated":"2017-04-06 19:10:34.000000000","message":"generate","commit_id":"aa3e70ea92ae23064710a3221f6a7c1e4b74f8ef"},{"author":{"_account_id":10224,"name":"Feodor Tersin","email":"ftersin@hotmail.com","username":"ftersin"},"change_message_id":"aa3d5149ab2b64bb3c9e9ccf2e4e6532fb5656a2","unresolved":false,"context_lines":[{"line_number":48,"context_line":"added release note and logged a warning stating ``nova-cert`` is deprecated."},{"line_number":49,"context_line":"If the deprecation cycle allows, dropping ``nova-cert`` should be"},{"line_number":50,"context_line":"straightforward."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Alternatives"},{"line_number":53,"context_line":"------------"},{"line_number":54,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"bff0334d_832643b7","line":51,"updated":"2017-04-06 02:26:17.000000000","message":"Will you also clean up crypto.py and other sources of nova-cert related functions?","commit_id":"aa3e70ea92ae23064710a3221f6a7c1e4b74f8ef"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"9c786cd723c90b2ad8dd31a06578efc14c61c4a5","unresolved":false,"context_lines":[{"line_number":48,"context_line":"added release note and logged a warning stating ``nova-cert`` is deprecated."},{"line_number":49,"context_line":"If the deprecation cycle allows, dropping ``nova-cert`` should be"},{"line_number":50,"context_line":"straightforward."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Alternatives"},{"line_number":53,"context_line":"------------"},{"line_number":54,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"bff0334d_8d0d4240","line":51,"in_reply_to":"bff0334d_832643b7","updated":"2017-04-06 11:24:07.000000000","message":"I think we can leave that out of this spec, and do it as a follow up tidy up.\n\nI am more worried about the operator impact myself.","commit_id":"aa3e70ea92ae23064710a3221f6a7c1e4b74f8ef"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"08f643084056b52a9fb1148c69bd4e04d78b1122","unresolved":false,"context_lines":[{"line_number":88,"context_line":"Other end user impact"},{"line_number":89,"context_line":"---------------------"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"None"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Performance Impact"},{"line_number":94,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"bff0334d_019fa85f","line":91,"updated":"2017-04-06 19:36:14.000000000","message":"We need to also deprecate these novaclient commands:\n\nnova x509-create-cert\nnova x509-get-root-cert","commit_id":"aa3e70ea92ae23064710a3221f6a7c1e4b74f8ef"},{"author":{"_account_id":10224,"name":"Feodor Tersin","email":"ftersin@hotmail.com","username":"ftersin"},"change_message_id":"aa3d5149ab2b64bb3c9e9ccf2e4e6532fb5656a2","unresolved":false,"context_lines":[{"line_number":104,"context_line":"Developer impact"},{"line_number":105,"context_line":"----------------"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"ec2-api will become broken [2] after we remove ``nova-cert`` service"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Implementation"},{"line_number":110,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"bff0334d_23765708","line":107,"updated":"2017-04-06 02:26:17.000000000","message":"Thank you for letting us know about the intention. We\u0027ll find another way to get user certificates on the server. Btw, not entire ec2api will become broken with the change, but only one its function - uploading an image through s3.","commit_id":"aa3e70ea92ae23064710a3221f6a7c1e4b74f8ef"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"9c786cd723c90b2ad8dd31a06578efc14c61c4a5","unresolved":false,"context_lines":[{"line_number":104,"context_line":"Developer impact"},{"line_number":105,"context_line":"----------------"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"ec2-api will become broken [2] after we remove ``nova-cert`` service"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Implementation"},{"line_number":110,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"bff0334d_084da071","line":107,"in_reply_to":"bff0334d_23765708","updated":"2017-04-06 11:24:07.000000000","message":"I think its best for ec2api to maintain its own certificate system, ideally one that works better than this broken Nova system.","commit_id":"aa3e70ea92ae23064710a3221f6a7c1e4b74f8ef"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"f88307a2254e8d1378e25824ba4970cf45a7954e","unresolved":false,"context_lines":[{"line_number":134,"context_line":"Testing"},{"line_number":135,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"Tempest [3] will require updating to adjust to this change."},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Documentation Impact"},{"line_number":140,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"bff0334d_9e8d5533","line":137,"updated":"2017-04-06 19:10:34.000000000","message":"FWIW, Tempest changed it\u0027s default to no longer test that since Newton:\n\nhttps://github.com/openstack/tempest/commit/6943acbbfbd334fa267298fcdc8d1d4bff303c98","commit_id":"aa3e70ea92ae23064710a3221f6a7c1e4b74f8ef"}]}