)]}'
{"nova/volume/encryptors/__init__.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"4bb21ba37d7b7ff59972a570f99adf29e8f15462","unresolved":false,"context_lines":[{"line_number":50,"context_line":"                      {\u0027provider\u0027: provider, \u0027exception\u0027: e})"},{"line_number":51,"context_line":"            raise"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    LOG.debug(\"Using encryptor %(encryptor)s for conn %(connection_info)s\","},{"line_number":54,"context_line":"              {\u0027encryptor\u0027: encryptor, \u0027connection_info\u0027: connection_info})"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    return encryptor"}],"source_content_type":"text/x-python","patch_set":1,"id":"3afb71cf_61fc5fb8","line":53,"updated":"2015-06-09 16:15:55.000000000","message":"I think connection_info can potentially have credentials in it, so not sure we should log the entire dict.","commit_id":"7295453051b8e30b3ddb60b8f64126d211b5500a"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"bc1f0d0044e7c5fc7a87d3b04a9be302b9621a40","unresolved":false,"context_lines":[{"line_number":50,"context_line":"                      {\u0027provider\u0027: provider, \u0027exception\u0027: e})"},{"line_number":51,"context_line":"            raise"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    LOG.debug(\"Using encryptor %(encryptor)s for conn %(connection_info)s\","},{"line_number":54,"context_line":"              {\u0027encryptor\u0027: encryptor, \u0027connection_info\u0027: connection_info})"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    return encryptor"}],"source_content_type":"text/x-python","patch_set":1,"id":"3afb71cf_779c1d5d","line":53,"in_reply_to":"3afb71cf_17f049c8","updated":"2015-06-09 17:01:36.000000000","message":"Then we already have this problem in vmware \u0026 hyperv drivers :-)\n\nIt sure would be nice to turn connection_info into a Nova object and implement a __repr__ method which did the masking by default so we could forget about this problem in all users of the data.","commit_id":"7295453051b8e30b3ddb60b8f64126d211b5500a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"657c0212f582005d2e6502205041129f6cc124fd","unresolved":false,"context_lines":[{"line_number":50,"context_line":"                      {\u0027provider\u0027: provider, \u0027exception\u0027: e})"},{"line_number":51,"context_line":"            raise"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    LOG.debug(\"Using encryptor %(encryptor)s for conn %(connection_info)s\","},{"line_number":54,"context_line":"              {\u0027encryptor\u0027: encryptor, \u0027connection_info\u0027: connection_info})"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    return encryptor"}],"source_content_type":"text/x-python","patch_set":1,"id":"3afb71cf_81a2bb49","line":53,"in_reply_to":"3afb71cf_61fc5fb8","updated":"2015-06-09 16:25:09.000000000","message":"Oh I guess it\u0027s block_device_info I was thinking of:\n\nhttp://git.openstack.org/cgit/openstack/nova/tree/nova/virt/libvirt/driver.py#n4298","commit_id":"7295453051b8e30b3ddb60b8f64126d211b5500a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"618550a21dd2204d97b17b145a512ba7f6d45700","unresolved":false,"context_lines":[{"line_number":50,"context_line":"                      {\u0027provider\u0027: provider, \u0027exception\u0027: e})"},{"line_number":51,"context_line":"            raise"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    LOG.debug(\"Using encryptor %(encryptor)s for conn %(connection_info)s\","},{"line_number":54,"context_line":"              {\u0027encryptor\u0027: encryptor, \u0027connection_info\u0027: connection_info})"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    return encryptor"}],"source_content_type":"text/x-python","patch_set":1,"id":"3afb71cf_32411339","line":53,"in_reply_to":"3afb71cf_779c1d5d","updated":"2015-06-09 17:13:59.000000000","message":"I agree, there is a bug for it:\n\nhttps://bugs.launchpad.net/nova/+bug/1321785\n\nIt\u0027s just never been worked on.  Maybe that\u0027s something I can do.","commit_id":"7295453051b8e30b3ddb60b8f64126d211b5500a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3a10181314f55041ccf5dd9db67db6e063641785","unresolved":false,"context_lines":[{"line_number":50,"context_line":"                      {\u0027provider\u0027: provider, \u0027exception\u0027: e})"},{"line_number":51,"context_line":"            raise"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    LOG.debug(\"Using encryptor %(encryptor)s for conn %(connection_info)s\","},{"line_number":54,"context_line":"              {\u0027encryptor\u0027: encryptor, \u0027connection_info\u0027: connection_info})"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    return encryptor"}],"source_content_type":"text/x-python","patch_set":1,"id":"3afb71cf_17f049c8","line":53,"in_reply_to":"3afb71cf_81a2bb49","updated":"2015-06-09 16:58:53.000000000","message":"Here is an example:\n\nhttp://logs.openstack.org/81/181781/3/check/check-tempest-dsvm-full-ceph/25a7e4d/logs/screen-n-cpu.txt.gz#_2015-06-08_23_17_35_190\n\nblock_device_info contains a list of BlockDeviceMapping objects which contain the connection_info dict which itself can contain auth_username/auth_password values, so we shouldn\u0027t log connection_info w/o masking the password first.","commit_id":"7295453051b8e30b3ddb60b8f64126d211b5500a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"776f908f20f3390df723fc3be7a435912ccf0475","unresolved":false,"context_lines":[{"line_number":61,"context_line":"    if (\u0027data\u0027 in connection_info and"},{"line_number":62,"context_line":"            connection_info[\u0027data\u0027].get(\u0027encrypted\u0027, False)):"},{"line_number":63,"context_line":"        try:"},{"line_number":64,"context_line":"            metadata \u003d volume_api.get_volume_encryption_metadata(context,"},{"line_number":65,"context_line":"                                                                 volume_id)"},{"line_number":66,"context_line":"        except Exception as e:"},{"line_number":67,"context_line":"            LOG.error(_LE(\"Failed to retrieve encryption metadata for \""}],"source_content_type":"text/x-python","patch_set":1,"id":"3afb71cf_7c0f6488","line":64,"updated":"2015-06-09 16:43:43.000000000","message":"We don\u0027t even get to get_volume_encryptor if we don\u0027t get any metadata back here, and from checking the logs on http://logs.openstack.org/81/181781/3/check/check-tempest-dsvm-full-ceph/25a7e4d/logs/screen-n-cpu.txt.gz#_2015-06-08_23_20_39_246 I\u0027m not even seeing this request logged, even in cinder-api:\n\nhttp://logs.openstack.org/81/181781/3/check/check-tempest-dsvm-full-ceph/25a7e4d/logs/screen-c-api.txt.gz\n\nSo we should probably debug log something here like:\n\nLOG.debug(\u0027Getting volume encryption metadata for volume: %s\u0027, volume_id)","commit_id":"7295453051b8e30b3ddb60b8f64126d211b5500a"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"97c88f50f39ac5a8182b66671b3140a88edd439e","unresolved":false,"context_lines":[{"line_number":61,"context_line":"    if (\u0027data\u0027 in connection_info and"},{"line_number":62,"context_line":"            connection_info[\u0027data\u0027].get(\u0027encrypted\u0027, False)):"},{"line_number":63,"context_line":"        try:"},{"line_number":64,"context_line":"            metadata \u003d volume_api.get_volume_encryption_metadata(context,"},{"line_number":65,"context_line":"                                                                 volume_id)"},{"line_number":66,"context_line":"        except Exception as e:"},{"line_number":67,"context_line":"            LOG.error(_LE(\"Failed to retrieve encryption metadata for \""}],"source_content_type":"text/x-python","patch_set":1,"id":"3afb71cf_d83e618a","line":64,"in_reply_to":"3afb71cf_7c0f6488","updated":"2015-06-09 17:36:52.000000000","message":"Yeah, the jenkins log did not include the message I added, so I\u0027d added a debug line to this method too now.","commit_id":"7295453051b8e30b3ddb60b8f64126d211b5500a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"39ca2ab271ded73881b4d839d090c9b8397c3a9d","unresolved":false,"context_lines":[{"line_number":52,"context_line":"            raise"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"    msg \u003d (\"Using encryptor %(encryptor)s for conn %(connection_info)s\" %"},{"line_number":56,"context_line":"           {\u0027encryptor\u0027: encryptor, \u0027connection_info\u0027: connection_info})"},{"line_number":57,"context_line":"    LOG.debug(strutils.mask_password(msg))"},{"line_number":58,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"3afb71cf_b89ba565","line":55,"updated":"2015-06-09 17:45:28.000000000","message":"nit: I\u0027d say \"Using volume encryptor...\" so there is context when reading through the logs.","commit_id":"3222d67ee7027888632aaf32ab8c10f53a4ee1ac"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"39ca2ab271ded73881b4d839d090c9b8397c3a9d","unresolved":false,"context_lines":[{"line_number":72,"context_line":"                      {\u0027volume_id\u0027: volume_id, \u0027exception\u0027: e})"},{"line_number":73,"context_line":"            raise"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"    msg \u003d (\"Using metadata %(metadata)s for conn %(connection_info)s\" %"},{"line_number":76,"context_line":"           {\u0027metadata\u0027: metadata, \u0027connection_info\u0027: connection_info})"},{"line_number":77,"context_line":"    LOG.debug(strutils.mask_password(msg))"},{"line_number":78,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"3afb71cf_b8e965b9","line":75,"updated":"2015-06-09 17:45:28.000000000","message":"nit: I\u0027d say \"Using volume encryption medata....\" so there is context when reading through the logs.","commit_id":"3222d67ee7027888632aaf32ab8c10f53a4ee1ac"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1aadfb3eef4a30b73e77a2941e2f60598f801e1e","unresolved":false,"context_lines":[{"line_number":72,"context_line":"                      {\u0027volume_id\u0027: volume_id, \u0027exception\u0027: e})"},{"line_number":73,"context_line":"            raise"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"    msg \u003d (\"Using metadata %(metadata)s for conn %(connection_info)s\" %"},{"line_number":76,"context_line":"           {\u0027metadata\u0027: metadata, \u0027connection_info\u0027: connection_info})"},{"line_number":77,"context_line":"    LOG.debug(strutils.mask_password(msg))"},{"line_number":78,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"3afb71cf_81951488","line":75,"in_reply_to":"3afb71cf_b8e965b9","updated":"2015-06-09 18:44:12.000000000","message":"Confirmed that for LVM backed Cinder we get something back:\n\nhttp://logs.openstack.org/99/189799/2/check/check-tempest-dsvm-full/c3ee602/logs/screen-n-cpu.txt.gz#_2015-06-09_18_18_18_078\n\nFor Ceph we don\u0027t:\n\nhttp://logs.openstack.org/99/189799/2/check/check-tempest-dsvm-full-ceph/353db23/logs/screen-n-cpu.txt.gz#_2015-06-09_18_21_16_723","commit_id":"3222d67ee7027888632aaf32ab8c10f53a4ee1ac"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3bcbfc33e409ab9761ecfac137340753cc2ce4d7","unresolved":false,"context_lines":[{"line_number":75,"context_line":"                      {\u0027volume_id\u0027: volume_id, \u0027exception\u0027: e})"},{"line_number":76,"context_line":"            raise"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"    if metadata:"},{"line_number":79,"context_line":"        msg \u003d (\"Using volume encryption metadata \u0027%(metadata)s\u0027 for \""},{"line_number":80,"context_line":"               \"connection: %(connection_info)s\" %"},{"line_number":81,"context_line":"               {\u0027metadata\u0027: metadata, \u0027connection_info\u0027: connection_info})"}],"source_content_type":"text/x-python","patch_set":3,"id":"3afb71cf_d3af5028","line":78,"updated":"2015-06-10 02:47:08.000000000","message":"With this change I noticed that nothing is being logged anymore, yet the warning above wasn\u0027t being logged either.\n\nApparently that\u0027s because the connection_info[\u0027data\u0027] dict doesn\u0027t contain the \u0027encrypted\u0027 key in the ceph case:\n\nhttp://logs.openstack.org/99/189799/2/check/check-tempest-dsvm-full-ceph/353db23/logs/screen-n-cpu.txt.gz#_2015-06-09_18_21_16_723\n\nHowever, the volume does have the encrypted value set to True:\n\nhttp://logs.openstack.org/99/189799/2/check/check-tempest-dsvm-full-ceph/353db23/logs/screen-n-cpu.txt.gz#_2015-06-09_18_21_16_217\n\nSo it seems we have some issues with the connection_info coming back from the cinder API after initializing the connection, cinder doesn\u0027t thing the volume is encrypted - maybe in the ceph case it\u0027s not, hence the bug.","commit_id":"c13588517a270bd8349c084c1f210598917180d4"}]}