)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"acb8d89548c765945f5cb6a4f40b8c0e29c3e461","unresolved":false,"context_lines":[{"line_number":18,"context_line":"resetting already existing consoles would be problematic for an"},{"line_number":19,"context_line":"operator."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Co-Authored-By: melanie witt \u003cmelwittt@gmail.com\u003e"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"partially-implements: blueprint convert-consoles-to-objects"},{"line_number":24,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":16,"id":"df87a7cf_c0ce8682","line":21,"range":{"start_line":21,"start_character":30,"end_line":21,"end_character":38},"updated":"2017-12-14 14:51:58.000000000","message":"melwitt?","commit_id":"ac1f3839522ee054b183992f52d933434b2be5ff"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"c32473a00de391970df56f7f0d6396ed88ae60ad","unresolved":false,"context_lines":[{"line_number":18,"context_line":"resetting already existing consoles would be problematic for an"},{"line_number":19,"context_line":"operator."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Co-Authored-By: melanie witt \u003cmelwittt@gmail.com\u003e"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"partially-implements: blueprint convert-consoles-to-objects"},{"line_number":24,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":16,"id":"df87a7cf_a8ad64eb","line":21,"range":{"start_line":21,"start_character":30,"end_line":21,"end_character":38},"in_reply_to":"df87a7cf_c0ce8682","updated":"2017-12-14 17:19:34.000000000","message":"Unfortunately melwitt was already taken and I chose an alternate poorly because everyone thinks it\u0027s a typo. :P","commit_id":"ac1f3839522ee054b183992f52d933434b2be5ff"}],"nova/conf/workarounds.py":[{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"587cfa29b1fc48a82ed8bf74f28e6ac2b6b15feb","unresolved":false,"context_lines":[{"line_number":150,"context_line":""},{"line_number":151,"context_line":"    cfg.BoolOpt("},{"line_number":152,"context_line":"        \u0027enable_consoleauth\u0027,"},{"line_number":153,"context_line":"        default\u003dFalse,"},{"line_number":154,"context_line":"        help\u003d\"\"\""},{"line_number":155,"context_line":"Enable the consoleauth service to avoid resetting unexpired consoles."},{"line_number":156,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"ff82abbf_0d33f215","line":153,"range":{"start_line":153,"start_character":7,"end_line":153,"end_character":22},"updated":"2017-11-24 15:34:55.000000000","message":"This should be deprecated immediately so we can remove it in Rocky. This is what we did for the \u0027project_id_regex\u0027 option in \u0027nova/conf/osapi_v21.py\u0027","commit_id":"1b3e24d83ee5fdd5a94704870c64aac80d4820f4"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"b7a0eb32a1a54fc24a0c8335adba9c66fac25c4d","unresolved":false,"context_lines":[{"line_number":150,"context_line":""},{"line_number":151,"context_line":"    cfg.BoolOpt("},{"line_number":152,"context_line":"        \u0027enable_consoleauth\u0027,"},{"line_number":153,"context_line":"        default\u003dFalse,"},{"line_number":154,"context_line":"        help\u003d\"\"\""},{"line_number":155,"context_line":"Enable the consoleauth service to avoid resetting unexpired consoles."},{"line_number":156,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"df87a7cf_3a759ecb","line":153,"range":{"start_line":153,"start_character":7,"end_line":153,"end_character":22},"in_reply_to":"ff82abbf_0d33f215","updated":"2017-12-09 00:37:22.000000000","message":"Done","commit_id":"1b3e24d83ee5fdd5a94704870c64aac80d4820f4"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"738ea826c9303fbcf0fd5a16be30a22cc40f6688","unresolved":false,"context_lines":[{"line_number":152,"context_line":"        \u0027enable_consoleauth\u0027,"},{"line_number":153,"context_line":"        default\u003dFalse,"},{"line_number":154,"context_line":"        deprecated_for_removal\u003dTrue,"},{"line_number":155,"context_line":"        deprecated_since\u003d\"17.0.0\","},{"line_number":156,"context_line":"        deprecated_reason\u003d\"\"\""},{"line_number":157,"context_line":"Enable the consoleauth service to avoid resetting unexpired consoles."},{"line_number":158,"context_line":""}],"source_content_type":"text/x-python","patch_set":26,"id":"df7087c5_7964c8e5","line":155,"range":{"start_line":155,"start_character":26,"end_line":155,"end_character":28},"updated":"2018-03-22 11:28:57.000000000","message":"18","commit_id":"bc0983f9fe903196db0b31dbd8ede80e1fc54d8d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":152,"context_line":"        \u0027enable_consoleauth\u0027,"},{"line_number":153,"context_line":"        default\u003dFalse,"},{"line_number":154,"context_line":"        deprecated_for_removal\u003dTrue,"},{"line_number":155,"context_line":"        deprecated_since\u003d\"18.0.0\","},{"line_number":156,"context_line":"        deprecated_reason\u003d\"\"\""},{"line_number":157,"context_line":"Enable the consoleauth service to avoid resetting unexpired consoles."},{"line_number":158,"context_line":""}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_ce330313","line":155,"updated":"2018-04-30 20:44:18.000000000","message":"Should we also emit a deprecation warning when starting the nova-consoleauth service? Maybe that would be a separate change in the series?","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":164,"context_line":""},{"line_number":165,"context_line":"Operators that have much longer token TTL configured or otherwise need to avoid"},{"line_number":166,"context_line":"resetting existing consoles right away can enable this flag to continue using"},{"line_number":167,"context_line":"the consoleauth service in addition to the database backend. Once all of the"},{"line_number":168,"context_line":"old consoleauth supported consoles have expired, this flag should be disabled"},{"line_number":169,"context_line":"and it will be no longer necessary to run the consoleauth service."},{"line_number":170,"context_line":"\"\"\"),"}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_ce9783eb","line":167,"range":{"start_line":167,"start_character":61,"end_line":167,"end_character":76},"updated":"2018-04-30 20:44:18.000000000","message":"How would an operator know when this has happened? Do they have to query the DB?","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":165,"context_line":"Operators that have much longer token TTL configured or otherwise need to avoid"},{"line_number":166,"context_line":"resetting existing consoles right away can enable this flag to continue using"},{"line_number":167,"context_line":"the consoleauth service in addition to the database backend. Once all of the"},{"line_number":168,"context_line":"old consoleauth supported consoles have expired, this flag should be disabled"},{"line_number":169,"context_line":"and it will be no longer necessary to run the consoleauth service."},{"line_number":170,"context_line":"\"\"\"),"},{"line_number":171,"context_line":"]"}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_2e039f44","line":168,"range":{"start_line":168,"start_character":26,"end_line":168,"end_character":34},"updated":"2018-04-30 20:44:18.000000000","message":"s/consoles/console tokens/ ?","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":167,"context_line":"the consoleauth service in addition to the database backend. Once all of the"},{"line_number":168,"context_line":"old consoleauth supported consoles have expired, this flag should be disabled"},{"line_number":169,"context_line":"and it will be no longer necessary to run the consoleauth service."},{"line_number":170,"context_line":"\"\"\"),"},{"line_number":171,"context_line":"]"},{"line_number":172,"context_line":""},{"line_number":173,"context_line":""}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_6eb75788","line":170,"updated":"2018-04-30 20:44:18.000000000","message":"Should maybe add this?\n\nRelated options:\n\n* ``[consoleauth]/token_ttl``\n\n--\n\nSimilarly, refer to ``[workarounds]/enable_consoleauth`` from the token_ttl option help.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"f97b9245e40ea5f63f6576cc312a73b4a9c135f7","unresolved":false,"context_lines":[{"line_number":153,"context_line":"        default\u003dFalse,"},{"line_number":154,"context_line":"        deprecated_for_removal\u003dTrue,"},{"line_number":155,"context_line":"        deprecated_since\u003d\"18.0.0\","},{"line_number":156,"context_line":"        deprecated_reason\u003d\"\"\""},{"line_number":157,"context_line":"Enable the consoleauth service to avoid resetting unexpired consoles."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"Console token authorizations have moved from the ``nova-consoleauth`` service"}],"source_content_type":"text/x-python","patch_set":36,"id":"9f6a8fd7_93df4bd5","line":156,"range":{"start_line":156,"start_character":0,"end_line":156,"end_character":29},"updated":"2018-05-02 15:01:57.000000000","message":"This seems odd and it\u0027s been this was since PS13 [1]. Normally you use this for help text and then give the reason it\u0027s deprecated (The \"Once all of the old...\" sentence below) in \u0027deprecated_reason\u0027. However, this will technically work so I won\u0027t block on it.\n\n[1] https://review.openstack.org/#/c/333990/13/nova/conf/workarounds.py","commit_id":"947d60b63a316113325e2977340862c692806d96"}],"nova/console/websocketproxy.py":[{"author":{"_account_id":7461,"name":"Paul Murray","email":"pmurray@hpe.com","username":"ptm"},"change_message_id":"7bee1226d5d7ca9023ad3545b6270d0030ca573b","unresolved":false,"context_lines":[{"line_number":79,"context_line":"        # NOTE(PaulMurray) if we are using cells or we have an"},{"line_number":80,"context_line":"        # old style URL with no instance_uuid we use the old"},{"line_number":81,"context_line":"        # consoleauth way of doing things"},{"line_number":82,"context_line":"        if CONF.cells.enabled or instance_uuid is None:"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"            # NOTE(PaulMurray) consoleauth does an rpc to compute"},{"line_number":85,"context_line":"            # manager to check the console port is correct"}],"source_content_type":"text/x-python","patch_set":1,"id":"3aaa91ec_a3adcc9c","line":82,"updated":"2016-06-24 16:56:03.000000000","message":"I would like to change this part so we only use consoleauth if the instance_uuid is missing (implying the compute manager has only put data in consoleauth because it has not been upgraded). At the moment the code also uses consoleauth if CONF.cells.enabled \u003d True. The plan is to use instance mappings to find the cell that holds the ConsoleConnection object data. As far as I understand it, we cannot be sure that mapping is present yet, so if cells are enabled we can\u0027t use ConsoleConnection.","commit_id":"73d409c954c48d5584f1322c909e0f09411fd02f"},{"author":{"_account_id":7461,"name":"Paul Murray","email":"pmurray@hpe.com","username":"ptm"},"change_message_id":"93b7f565b82dc7526da6748ffd312e24fe483ca4","unresolved":false,"context_lines":[{"line_number":79,"context_line":"        # NOTE(PaulMurray) if we are using cells or we have an"},{"line_number":80,"context_line":"        # old style URL with no instance_uuid we use the old"},{"line_number":81,"context_line":"        # consoleauth way of doing things"},{"line_number":82,"context_line":"        if CONF.cells.enabled or instance_uuid is None:"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"            # NOTE(PaulMurray) consoleauth does an rpc to compute"},{"line_number":85,"context_line":"            # manager to check the console port is correct"}],"source_content_type":"text/x-python","patch_set":1,"id":"3aaa91ec_29c37d58","line":82,"in_reply_to":"3aaa91ec_a3adcc9c","updated":"2016-06-24 17:40:40.000000000","message":"Seems we also don\u0027t know if the proxy is deployed in a child cell or at the api cell level. If it is in a child cell we can go straight to the right database. If at api level we need to go through the mappings. The problem is there is not way of knowing which is the case. Maybe we need another config parameter there? Or ideally a cells function that tells us.","commit_id":"73d409c954c48d5584f1322c909e0f09411fd02f"},{"author":{"_account_id":7461,"name":"Paul Murray","email":"pmurray@hpe.com","username":"ptm"},"change_message_id":"e88c9903ccbe9f58a8fc681351f8e7371d5e1ebb","unresolved":false,"context_lines":[{"line_number":79,"context_line":"        # NOTE(PaulMurray) if we are using cells or we have an"},{"line_number":80,"context_line":"        # old style URL with no instance_uuid we use the old"},{"line_number":81,"context_line":"        # consoleauth way of doing things"},{"line_number":82,"context_line":"        if CONF.cells.enable or instance_uuid is None:"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"            # NOTE(PaulMurray) consoleauth check_token() validates the token"},{"line_number":85,"context_line":"            # and does an rpc to compute manager to check the console port"}],"source_content_type":"text/x-python","patch_set":2,"id":"3aaa91ec_00b3bd0a","line":82,"updated":"2016-06-27 11:16:42.000000000","message":"Actually we can use the new way of doing things if the proxy is deployed inside a child cell. I don\u0027t think there is a way of knowing that at the moment though.","commit_id":"7a704ac896c3b158b506267f0179b1829069cf42"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"587cfa29b1fc48a82ed8bf74f28e6ac2b6b15feb","unresolved":false,"context_lines":[{"line_number":128,"context_line":""},{"line_number":129,"context_line":"    def _get_connect_info(self, ctxt, token):"},{"line_number":130,"context_line":"        \"\"\"Validate the token and get the connect info.\"\"\""},{"line_number":131,"context_line":"        # NOTE(PaulMurray) if we are using cells v1, we use the old"},{"line_number":132,"context_line":"        # consoleauth way of doing things"},{"line_number":133,"context_line":"        if CONF.cells.enable:"},{"line_number":134,"context_line":"            # NOTE(PaulMurray) consoleauth check_token() validates the token"}],"source_content_type":"text/x-python","patch_set":12,"id":"ff82abbf_8db38298","line":131,"updated":"2017-11-24 15:34:55.000000000","message":"nit: This would probably be easier if split into two functions","commit_id":"1b3e24d83ee5fdd5a94704870c64aac80d4820f4"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"b7a0eb32a1a54fc24a0c8335adba9c66fac25c4d","unresolved":false,"context_lines":[{"line_number":128,"context_line":""},{"line_number":129,"context_line":"    def _get_connect_info(self, ctxt, token):"},{"line_number":130,"context_line":"        \"\"\"Validate the token and get the connect info.\"\"\""},{"line_number":131,"context_line":"        # NOTE(PaulMurray) if we are using cells v1, we use the old"},{"line_number":132,"context_line":"        # consoleauth way of doing things"},{"line_number":133,"context_line":"        if CONF.cells.enable:"},{"line_number":134,"context_line":"            # NOTE(PaulMurray) consoleauth check_token() validates the token"}],"source_content_type":"text/x-python","patch_set":12,"id":"df87a7cf_ba376eff","line":131,"in_reply_to":"ff82abbf_8db38298","updated":"2017-12-09 00:37:22.000000000","message":"Done","commit_id":"1b3e24d83ee5fdd5a94704870c64aac80d4820f4"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"587cfa29b1fc48a82ed8bf74f28e6ac2b6b15feb","unresolved":false,"context_lines":[{"line_number":151,"context_line":"            # NOTE(PaulMurray) ConsoleConnection.validate validates the token."},{"line_number":152,"context_line":"            # We call the compute manager directly to check the console port"},{"line_number":153,"context_line":"            # is correct."},{"line_number":154,"context_line":"            if not connect_info:"},{"line_number":155,"context_line":"                connect_info \u003d objects.ConsoleConnection.validate("},{"line_number":156,"context_line":"                    ctxt, token).to_dict()"},{"line_number":157,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"ff82abbf_ad7526cd","line":154,"range":{"start_line":154,"start_character":12,"end_line":154,"end_character":32},"updated":"2017-11-24 15:34:55.000000000","message":"So if we\u0027re using cells v1 and fail to get a token from the consoleauth service, we fail. However, if not using and that and instead using the consoleauth service, we try to fetch from the database. Is this discrepancy in behavior what we want?","commit_id":"1b3e24d83ee5fdd5a94704870c64aac80d4820f4"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"6507d79f500b84d34d798df028cea33870faab02","unresolved":false,"context_lines":[{"line_number":151,"context_line":"            # NOTE(PaulMurray) ConsoleConnection.validate validates the token."},{"line_number":152,"context_line":"            # We call the compute manager directly to check the console port"},{"line_number":153,"context_line":"            # is correct."},{"line_number":154,"context_line":"            if not connect_info:"},{"line_number":155,"context_line":"                connect_info \u003d objects.ConsoleConnection.validate("},{"line_number":156,"context_line":"                    ctxt, token).to_dict()"},{"line_number":157,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"df87a7cf_161ad7ca","line":154,"range":{"start_line":154,"start_character":12,"end_line":154,"end_character":32},"in_reply_to":"df87a7cf_5df09cfd","updated":"2017-12-11 15:32:27.000000000","message":"Makes sense and the additional comments really help. Cheers :)","commit_id":"1b3e24d83ee5fdd5a94704870c64aac80d4820f4"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"35f8810a6fc48c556c585ce552bb130d7c781a18","unresolved":false,"context_lines":[{"line_number":151,"context_line":"            # NOTE(PaulMurray) ConsoleConnection.validate validates the token."},{"line_number":152,"context_line":"            # We call the compute manager directly to check the console port"},{"line_number":153,"context_line":"            # is correct."},{"line_number":154,"context_line":"            if not connect_info:"},{"line_number":155,"context_line":"                connect_info \u003d objects.ConsoleConnection.validate("},{"line_number":156,"context_line":"                    ctxt, token).to_dict()"},{"line_number":157,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"df87a7cf_5df09cfd","line":154,"range":{"start_line":154,"start_character":12,"end_line":154,"end_character":32},"in_reply_to":"df87a7cf_7d800047","updated":"2017-12-09 00:40:10.000000000","message":"Also, if in the transition state of CONF.workarounds.enable_consoleauth \u003d True, we store *new* tokens in the database backend. So what this is doing is, if using transition-option, check for the token in the consoleauth service, if it\u0027s not in there, it\u0027s probably new, so it\u0027s probably in the database backend, so check there next.","commit_id":"1b3e24d83ee5fdd5a94704870c64aac80d4820f4"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"b7a0eb32a1a54fc24a0c8335adba9c66fac25c4d","unresolved":false,"context_lines":[{"line_number":151,"context_line":"            # NOTE(PaulMurray) ConsoleConnection.validate validates the token."},{"line_number":152,"context_line":"            # We call the compute manager directly to check the console port"},{"line_number":153,"context_line":"            # is correct."},{"line_number":154,"context_line":"            if not connect_info:"},{"line_number":155,"context_line":"                connect_info \u003d objects.ConsoleConnection.validate("},{"line_number":156,"context_line":"                    ctxt, token).to_dict()"},{"line_number":157,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"df87a7cf_7d800047","line":154,"range":{"start_line":154,"start_character":12,"end_line":154,"end_character":32},"in_reply_to":"ff82abbf_ad7526cd","updated":"2017-12-09 00:37:22.000000000","message":"Yeah, so with cells v1, we\u0027re not supporting the new database backend at all for console auth tokens. So all cells v1 stuff will behave as though the consoleauth service is all there is (because that\u0027s all we\u0027re supporting for cells v1).\n\nIf not cells v1, we\u0027re giving people the option to opt-in to a transition state where they prefer the consoleauth service until they are sure all of their already-existing-pre-database-backend auth tokens have naturally expired. Because if they switch over to the database backend directly *without* a transition period, all of their existing auth tokens will behave as expired even if they haven\u0027t reached their expiration date, because they won\u0027t yet exist in the database (and are instead inside the old consoleauth service storage place).\n\nSo, if operators are worried about all their auth tokens getting invalidated in one swoop as soon as the database backend appears, they have the option of using CONF.workarounds.enable_consoleauth to let them delay and decide when they want it to switch over by manually changing the config option when they\u0027re ready. Does that make sense?","commit_id":"1b3e24d83ee5fdd5a94704870c64aac80d4820f4"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"520c77b481dc67950ed86a1ca6c87fda150656fa","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        connect_info \u003d rpcapi.check_token(ctxt, token\u003dtoken)"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"        if hard_fail and not connect_info:"},{"line_number":137,"context_line":"            raise exception.InvalidToken(token\u003d\u0027***\u0027)"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"        return connect_info"},{"line_number":140,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"df87a7cf_9d9c805e","line":137,"range":{"start_line":137,"start_character":47,"end_line":137,"end_character":52},"updated":"2017-12-13 18:11:35.000000000","message":"What\u0027s the implication of leaking these through to the user - aren\u0027t they useless anyway?","commit_id":"7127184f271e1dfc5f49610d25ae9b01697da970"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"52e78591132d859ee66caf0a53a45ded91b55870","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        connect_info \u003d rpcapi.check_token(ctxt, token\u003dtoken)"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"        if hard_fail and not connect_info:"},{"line_number":137,"context_line":"            raise exception.InvalidToken(token\u003d\u0027***\u0027)"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"        return connect_info"},{"line_number":140,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"df87a7cf_1704c8c5","line":137,"range":{"start_line":137,"start_character":47,"end_line":137,"end_character":52},"in_reply_to":"df87a7cf_9d9c805e","updated":"2017-12-13 23:28:08.000000000","message":"Well, the token is part of the url the user uses to access the console, so if someone else knows the token, they can get to your console if they also know the ip/port. The url looks like this [1]:\n\n http://ip:port/?token\u003dxyz\n\n[1] https://docs.openstack.org/nova/pike/admin/remote-console-access.html#vnc-console-proxy","commit_id":"7127184f271e1dfc5f49610d25ae9b01697da970"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"738ea826c9303fbcf0fd5a16be30a22cc40f6688","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        rpcapi \u003d consoleauth_rpcapi.ConsoleAuthAPI()"},{"line_number":135,"context_line":"        connect_info \u003d rpcapi.check_token(ctxt, token\u003dtoken)"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"        if hard_fail and not connect_info:"},{"line_number":138,"context_line":"            raise exception.InvalidToken(token\u003d\u0027***\u0027)"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"        return connect_info"},{"line_number":141,"context_line":""}],"source_content_type":"text/x-python","patch_set":26,"id":"df7087c5_997d1c70","line":138,"range":{"start_line":137,"start_character":0,"end_line":138,"end_character":53},"updated":"2018-03-22 11:28:57.000000000","message":"nit: Given that hard_fail is set to True in only one place, I\u0027d probably move this down to where that caller is (_get_connect_info)","commit_id":"bc0983f9fe903196db0b31dbd8ede80e1fc54d8d"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"857f42ce7bdfb2152f2533872e1bc106035aa999","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        rpcapi \u003d consoleauth_rpcapi.ConsoleAuthAPI()"},{"line_number":135,"context_line":"        connect_info \u003d rpcapi.check_token(ctxt, token\u003dtoken)"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"        if hard_fail and not connect_info:"},{"line_number":138,"context_line":"            raise exception.InvalidToken(token\u003d\u0027***\u0027)"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"        return connect_info"},{"line_number":141,"context_line":""}],"source_content_type":"text/x-python","patch_set":26,"id":"bf659307_e66cf909","line":138,"range":{"start_line":137,"start_character":0,"end_line":138,"end_character":53},"in_reply_to":"df7087c5_997d1c70","updated":"2018-03-26 21:23:02.000000000","message":"Makes sense.","commit_id":"bc0983f9fe903196db0b31dbd8ede80e1fc54d8d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"CONF \u003d nova.conf.CONF"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"objects.register_all()"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"class TenantSock(object):"}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_8e6f4bfb","line":43,"updated":"2018-04-30 20:44:18.000000000","message":"This looks a bit out of place. Normally this is done in the nova/cmd/* entrypoint to the service, so in this case it would go in nova/cmd/baseproxy.py. But should probably ask Dan to be sure.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"025c3050420a03b666cfb2991bbd95cf14359afb","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"CONF \u003d nova.conf.CONF"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"objects.register_all()"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"class TenantSock(object):"}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_993d53df","line":43,"in_reply_to":"9f6a8fd7_8e6f4bfb","updated":"2018-04-30 21:17:50.000000000","message":"I did ask him about this long ago when I was working on this and IIRC, he said to just put it in the file where it\u0027s needed. But I\u0027m not 100% sure, so I can ask him again.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"321db0769b9684438a9f310532419a0904eb8a1f","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"CONF \u003d nova.conf.CONF"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"objects.register_all()"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"class TenantSock(object):"}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_3469aebd","line":43,"in_reply_to":"9f6a8fd7_8e6f4bfb","updated":"2018-04-30 21:03:36.000000000","message":"Yep, definitely belongs in the cmd file.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":118,"context_line":"    def _check_console_port(self, ctxt, instance_uuid, port, console_type):"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"        try:"},{"line_number":121,"context_line":"            instance \u003d objects.Instance.get_by_uuid(ctxt, instance_uuid)"},{"line_number":122,"context_line":"        except exception.InstanceNotFound:"},{"line_number":123,"context_line":"            return"},{"line_number":124,"context_line":""}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_39976793","line":121,"range":{"start_line":121,"start_character":52,"end_line":121,"end_character":56},"updated":"2018-04-30 20:44:18.000000000","message":"I\u0027m not sure how this is passing any functional tests in a cells v2 deployment because ctxt at this point comes from context.get_admin_context() in new_websocket_client which won\u0027t be targeted to a specific cell.\n\nOh I guess since we\u0027re running this from *within* a cell, the service should expect [database] to be configured for nova_cell1.conf (or whatever). I must have been getting confused with console auth stuff running in the API/controller layer.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"025c3050420a03b666cfb2991bbd95cf14359afb","unresolved":false,"context_lines":[{"line_number":118,"context_line":"    def _check_console_port(self, ctxt, instance_uuid, port, console_type):"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"        try:"},{"line_number":121,"context_line":"            instance \u003d objects.Instance.get_by_uuid(ctxt, instance_uuid)"},{"line_number":122,"context_line":"        except exception.InstanceNotFound:"},{"line_number":123,"context_line":"            return"},{"line_number":124,"context_line":""}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_392447c6","line":121,"range":{"start_line":121,"start_character":52,"end_line":121,"end_character":56},"in_reply_to":"9f6a8fd7_39976793","updated":"2018-04-30 21:17:50.000000000","message":"Yes, exactly. With this change, console proxies must run local to cell databases.\n\nThe ultimate reason why we had to go this way is because novnc could *not* handle parsing out an instance_uuid if we added it to the console url generation. It parsed \"?instance_uuid\u003d\u003c...\u003e\" as part of the \"token\" query parameter, thus breaking compat with console proxies on the old side of an upgrade.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":122,"context_line":"        except exception.InstanceNotFound:"},{"line_number":123,"context_line":"            return"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"        capi \u003d compute_rpcapi.ComputeAPI()"},{"line_number":126,"context_line":"        # NOTE(melwitt): The port is expected to be a str for validation."},{"line_number":127,"context_line":"        return capi.validate_console_port(ctxt, instance, str(port),"},{"line_number":128,"context_line":"                                          console_type)"}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_d9ebcb0f","line":125,"range":{"start_line":125,"start_character":8,"end_line":125,"end_character":42},"updated":"2018-04-30 20:44:18.000000000","message":"Is there any reason we don\u0027t set this as a class member variable in __init__? Or at least only construct it once? I see the previous code was not doing that for consoleauth rpcapi but seems like something it should have been doing.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"025c3050420a03b666cfb2991bbd95cf14359afb","unresolved":false,"context_lines":[{"line_number":122,"context_line":"        except exception.InstanceNotFound:"},{"line_number":123,"context_line":"            return"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"        capi \u003d compute_rpcapi.ComputeAPI()"},{"line_number":126,"context_line":"        # NOTE(melwitt): The port is expected to be a str for validation."},{"line_number":127,"context_line":"        return capi.validate_console_port(ctxt, instance, str(port),"},{"line_number":128,"context_line":"                                          console_type)"}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_f43496e0","line":125,"range":{"start_line":125,"start_character":8,"end_line":125,"end_character":42},"in_reply_to":"9f6a8fd7_d9ebcb0f","updated":"2018-04-30 21:17:50.000000000","message":"No, that would be a good thing to do. Will update.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":158,"context_line":"        if CONF.cells.enable:"},{"line_number":159,"context_line":"            connect_info \u003d self._get_connect_info_consoleauth(ctxt, token)"},{"line_number":160,"context_line":"            if not connect_info:"},{"line_number":161,"context_line":"                raise exception.InvalidToken(token\u003d\u0027***\u0027)"},{"line_number":162,"context_line":"        else:"},{"line_number":163,"context_line":"            # NOTE(melwitt): If consoleauth is enabled to aid in transitioning"},{"line_number":164,"context_line":"            # to the database backend, check it first before falling back to"}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_4e1ff36f","line":161,"range":{"start_line":161,"start_character":51,"end_line":161,"end_character":56},"updated":"2018-04-30 20:44:18.000000000","message":"This is a slight change in behavior, but I\u0027m assuming it\u0027s intentional. I know there is also an old bug and patch for this.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"025c3050420a03b666cfb2991bbd95cf14359afb","unresolved":false,"context_lines":[{"line_number":158,"context_line":"        if CONF.cells.enable:"},{"line_number":159,"context_line":"            connect_info \u003d self._get_connect_info_consoleauth(ctxt, token)"},{"line_number":160,"context_line":"            if not connect_info:"},{"line_number":161,"context_line":"                raise exception.InvalidToken(token\u003d\u0027***\u0027)"},{"line_number":162,"context_line":"        else:"},{"line_number":163,"context_line":"            # NOTE(melwitt): If consoleauth is enabled to aid in transitioning"},{"line_number":164,"context_line":"            # to the database backend, check it first before falling back to"}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_543b02c7","line":161,"range":{"start_line":161,"start_character":51,"end_line":161,"end_character":56},"in_reply_to":"9f6a8fd7_4e1ff36f","updated":"2018-04-30 21:17:50.000000000","message":"Yes, I realized in earlier patches in this series we made efforts to obfuscate the auth token and I noticed during testing that after all of that, we were logging auth tokens in the console proxy. So I changed it to make it consistent with the previous patches in this series.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"00eef845d487f5f4daca681383bec0bee7f05eb3","unresolved":false,"context_lines":[{"line_number":116,"context_line":""},{"line_number":117,"context_line":"        return origin_proto in expected_protos"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"    def _console_auth_token_obj_to_dict(self, obj):"},{"line_number":120,"context_line":"        \"\"\"Convert to a dict representation.\"\"\""},{"line_number":121,"context_line":"        # NOTE(PaulMurray) For compatibility while there is code that"},{"line_number":122,"context_line":"        # expects the dict representation returned by consoleauth."}],"source_content_type":"text/x-python","patch_set":34,"id":"9f6a8fd7_11c6f24a","line":119,"updated":"2018-05-01 12:13:12.000000000","message":"nit: this can be a staticmethod","commit_id":"eb7ab3f412668937685385818b5b23735de06abb"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3fee1a5571e436459f7b5e9c4859de7059f38563","unresolved":false,"context_lines":[{"line_number":142,"context_line":"            return"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"        # NOTE(melwitt): The port is expected to be a str for validation."},{"line_number":145,"context_line":"        return self.compute_rpcapi.validate_console_port(ctxt, instance,"},{"line_number":146,"context_line":"                                                         str(port),"},{"line_number":147,"context_line":"                                                         console_type)"},{"line_number":148,"context_line":""}],"source_content_type":"text/x-python","patch_set":34,"id":"9f6a8fd7_31aa1685","line":145,"range":{"start_line":145,"start_character":15,"end_line":145,"end_character":34},"updated":"2018-05-01 12:07:33.000000000","message":"This isn\u0027t getting set because the subclass init isn\u0027t calling the super class to set this.\n\nhttp://logs.openstack.org/12/527812/3/check/tempest-full/4cf2778/controller/logs/screen-n-novnc-cell1.txt.gz#_May_01_06_05_56_271408","commit_id":"eb7ab3f412668937685385818b5b23735de06abb"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3fee1a5571e436459f7b5e9c4859de7059f38563","unresolved":false,"context_lines":[{"line_number":318,"context_line":""},{"line_number":319,"context_line":"class NovaProxyRequestHandler(NovaProxyRequestHandlerBase,"},{"line_number":320,"context_line":"                              websockify.ProxyRequestHandler):"},{"line_number":321,"context_line":"    def __init__(self, *args, **kwargs):"},{"line_number":322,"context_line":"        websockify.ProxyRequestHandler.__init__(self, *args, **kwargs)"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"    def socket(self, *args, **kwargs):"}],"source_content_type":"text/x-python","patch_set":34,"id":"9f6a8fd7_3183f606","line":321,"updated":"2018-05-01 12:07:33.000000000","message":"You either need to set the compute_rpcapi variable in this method, or init the parent class(es). Since init with multiple inheritance is weird, it might be best to just set the compute_rpcapi variable in here.","commit_id":"eb7ab3f412668937685385818b5b23735de06abb"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"03c9fae5b8d8da1fcaa7885f3c43ebfb33e18b13","unresolved":false,"context_lines":[{"line_number":318,"context_line":"                              websockify.ProxyRequestHandler):"},{"line_number":319,"context_line":"    def __init__(self, *args, **kwargs):"},{"line_number":320,"context_line":"        websockify.ProxyRequestHandler.__init__(self, *args, **kwargs)"},{"line_number":321,"context_line":"        self.compute_rpcapi \u003d compute_rpcapi.ComputeAPI()"},{"line_number":322,"context_line":""},{"line_number":323,"context_line":"    def socket(self, *args, **kwargs):"},{"line_number":324,"context_line":"        return websockify.WebSocketServer.socket(*args, **kwargs)"}],"source_content_type":"text/x-python","patch_set":35,"id":"9f6a8fd7_5a0b1f23","line":321,"updated":"2018-05-01 14:33:45.000000000","message":"Maybe this needs to come before we init ProxyRequestHandler?\n\nhttp://logs.openstack.org/12/527812/3/check/tempest-full/2102973/controller/logs/screen-n-novnc-cell1.txt.gz#_May_01_13_10_31_617452","commit_id":"2895241fb211386c0a4d261ed5a2a36c8ad545ac"}],"nova/objects/console_auth_token.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":49,"context_line":"        \u0027token\u0027: fields.StringField(nullable\u003dFalse),"},{"line_number":50,"context_line":"    }"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"    def to_dict(self):"},{"line_number":53,"context_line":"        \"\"\"Convert to a dict representation.\"\"\""},{"line_number":54,"context_line":"        # NOTE(PaulMurray) For compatibility while there is code that"},{"line_number":55,"context_line":"        # expects the dict representation returned by consoleauth."}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_39f8c7c2","line":52,"updated":"2018-04-30 20:44:18.000000000","message":"This seems like it should be a private method in NovaProxyRequestHandlerBase, because otherwise we could just obj_to_primitive() - the problem is that NovaProxyRequestHandlerBase expects \"access_url\" instead of \"access_url_base\". But that\u0027s a problem for NovaProxyRequestHandlerBase to care about, we shouldn\u0027t tightly couple that logic in to the ConsoleAuthToken object.\n\nIt\u0027s also then easier to follow up with a cleanup patch in NovaProxyRequestHandlerBase that converts the legacy dict usage to object attribute access usage, e.g. connect_info.instance_access_path.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"cd3007dce513b67b03e533dbeaeba66c6c26aa86","unresolved":false,"context_lines":[{"line_number":49,"context_line":"        \u0027token\u0027: fields.StringField(nullable\u003dFalse),"},{"line_number":50,"context_line":"    }"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"    def to_dict(self):"},{"line_number":53,"context_line":"        \"\"\"Convert to a dict representation.\"\"\""},{"line_number":54,"context_line":"        # NOTE(PaulMurray) For compatibility while there is code that"},{"line_number":55,"context_line":"        # expects the dict representation returned by consoleauth."}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_f196de94","line":52,"in_reply_to":"9f6a8fd7_34976e93","updated":"2018-05-01 11:47:22.000000000","message":"But still, the only thing that needs this is NovaProxyRequestHandlerBase and we can ditch it once that code is updated to expect an object rather than a dict, right?","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"025c3050420a03b666cfb2991bbd95cf14359afb","unresolved":false,"context_lines":[{"line_number":49,"context_line":"        \u0027token\u0027: fields.StringField(nullable\u003dFalse),"},{"line_number":50,"context_line":"    }"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"    def to_dict(self):"},{"line_number":53,"context_line":"        \"\"\"Convert to a dict representation.\"\"\""},{"line_number":54,"context_line":"        # NOTE(PaulMurray) For compatibility while there is code that"},{"line_number":55,"context_line":"        # expects the dict representation returned by consoleauth."}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_34976e93","line":52,"in_reply_to":"9f6a8fd7_39f8c7c2","updated":"2018-04-30 21:17:50.000000000","message":"I\u0027m not sure. The only reason we don\u0027t store the entire access_url is because it contains the unhashed token. At least, the original idea was that the object is responsible for handing out the full access url if asked, hence the \"token\" attribute (not a field) on this object and the access_url property on L71.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":61,"context_line":"        connect_info[\u0027console_type\u0027] \u003d self.console_type"},{"line_number":62,"context_line":"        connect_info[\u0027host\u0027] \u003d self.host"},{"line_number":63,"context_line":"        connect_info[\u0027port\u0027] \u003d self.port"},{"line_number":64,"context_line":"        if self.obj_attr_is_set(\u0027internal_access_path\u0027):"},{"line_number":65,"context_line":"            connect_info[\u0027internal_access_path\u0027] \u003d self.internal_access_path"},{"line_number":66,"context_line":"        if self.obj_attr_is_set(\u0027access_url_base\u0027):"},{"line_number":67,"context_line":"            connect_info[\u0027access_url\u0027] \u003d self.access_url"}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_39c5278f","line":64,"updated":"2018-04-30 20:44:18.000000000","message":"if \u0027internal_access_path\u0027 in self:","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":63,"context_line":"        connect_info[\u0027port\u0027] \u003d self.port"},{"line_number":64,"context_line":"        if self.obj_attr_is_set(\u0027internal_access_path\u0027):"},{"line_number":65,"context_line":"            connect_info[\u0027internal_access_path\u0027] \u003d self.internal_access_path"},{"line_number":66,"context_line":"        if self.obj_attr_is_set(\u0027access_url_base\u0027):"},{"line_number":67,"context_line":"            connect_info[\u0027access_url\u0027] \u003d self.access_url"},{"line_number":68,"context_line":"        return connect_info"},{"line_number":69,"context_line":""}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_59c01b7d","line":66,"updated":"2018-04-30 20:44:18.000000000","message":"same","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"025c3050420a03b666cfb2991bbd95cf14359afb","unresolved":false,"context_lines":[{"line_number":68,"context_line":"        return connect_info"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"    @property"},{"line_number":71,"context_line":"    def access_url(self):"},{"line_number":72,"context_line":"        \"\"\"The access url with token parameter."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"        :returns: the access url with credential parameters"}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_549222a1","line":71,"updated":"2018-04-30 21:17:50.000000000","message":"This.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"}],"nova/tests/unit/console/test_websocketproxy.py":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":37,"context_line":"    def setUp(self):"},{"line_number":38,"context_line":"        super(NovaProxyRequestHandlerDBTestCase, self).setUp()"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"        self.flags(console_allowed_origins \u003d [\u0027allowed-origin-example-1.net\u0027,"},{"line_number":41,"context_line":"                                              \u0027allowed-origin-example-2.net\u0027])"},{"line_number":42,"context_line":"        self.wh \u003d websocketproxy.NovaProxyRequestHandlerBase()"},{"line_number":43,"context_line":"        self.wh.server \u003d websocketproxy.NovaWebSocketProxy()"}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_b92db747","line":40,"range":{"start_line":40,"start_character":42,"end_line":40,"end_character":45},"updated":"2018-04-30 20:44:18.000000000","message":"Remove whitespaces around \u003d for kwargs.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"025c3050420a03b666cfb2991bbd95cf14359afb","unresolved":false,"context_lines":[{"line_number":37,"context_line":"    def setUp(self):"},{"line_number":38,"context_line":"        super(NovaProxyRequestHandlerDBTestCase, self).setUp()"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"        self.flags(console_allowed_origins \u003d [\u0027allowed-origin-example-1.net\u0027,"},{"line_number":41,"context_line":"                                              \u0027allowed-origin-example-2.net\u0027])"},{"line_number":42,"context_line":"        self.wh \u003d websocketproxy.NovaProxyRequestHandlerBase()"},{"line_number":43,"context_line":"        self.wh.server \u003d websocketproxy.NovaWebSocketProxy()"}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_b4e85e16","line":40,"range":{"start_line":40,"start_character":42,"end_line":40,"end_character":45},"in_reply_to":"9f6a8fd7_b92db747","updated":"2018-04-30 21:17:50.000000000","message":"Oops.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":61,"context_line":"        \u0027Host\u0027: \u0027example.net:6080\u0027,"},{"line_number":62,"context_line":"    }"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"    @mock.patch(\u0027nova.db.console_auth_token_get_valid\u0027)"},{"line_number":65,"context_line":"    @mock.patch(\u0027nova.objects.Instance.get_by_uuid\u0027)"},{"line_number":66,"context_line":"    @mock.patch(\u0027nova.compute.rpcapi.ComputeAPI.validate_console_port\u0027)"},{"line_number":67,"context_line":"    @mock.patch(\u0027nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token\u0027)"}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_992a332a","line":64,"updated":"2018-04-30 20:44:18.000000000","message":"This is mocking a bit too deep for my taste, why not just mock objects.ConsoleAuthToken.validate?","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"025c3050420a03b666cfb2991bbd95cf14359afb","unresolved":false,"context_lines":[{"line_number":61,"context_line":"        \u0027Host\u0027: \u0027example.net:6080\u0027,"},{"line_number":62,"context_line":"    }"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"    @mock.patch(\u0027nova.db.console_auth_token_get_valid\u0027)"},{"line_number":65,"context_line":"    @mock.patch(\u0027nova.objects.Instance.get_by_uuid\u0027)"},{"line_number":66,"context_line":"    @mock.patch(\u0027nova.compute.rpcapi.ComputeAPI.validate_console_port\u0027)"},{"line_number":67,"context_line":"    @mock.patch(\u0027nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token\u0027)"}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_34dc4e73","line":64,"in_reply_to":"9f6a8fd7_992a332a","updated":"2018-04-30 21:17:50.000000000","message":"Yep, I can\u0027t remember if there\u0027s a reason I did that or if I even wrote this test.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":226,"context_line":"        self.wh.do_proxy.assert_called_with(\u0027\u003csocket\u003e\u0027)"},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"    @mock.patch(\u0027nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token\u0027,"},{"line_number":229,"context_line":"                return_value\u003dFalse)"},{"line_number":230,"context_line":"    @mock.patch(\u0027nova.console.websocketproxy.NovaProxyRequestHandlerBase.\u0027"},{"line_number":231,"context_line":"                \u0027_check_console_port\u0027)"},{"line_number":232,"context_line":"    @mock.patch(\u0027nova.objects.ConsoleAuthToken.validate\u0027)"}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_19eb83dc","line":229,"range":{"start_line":229,"start_character":29,"end_line":229,"end_character":34},"updated":"2018-04-30 20:44:18.000000000","message":"nit: this should be None since check_token either returns a token if it\u0027s valid, or None.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"025c3050420a03b666cfb2991bbd95cf14359afb","unresolved":false,"context_lines":[{"line_number":226,"context_line":"        self.wh.do_proxy.assert_called_with(\u0027\u003csocket\u003e\u0027)"},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"    @mock.patch(\u0027nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token\u0027,"},{"line_number":229,"context_line":"                return_value\u003dFalse)"},{"line_number":230,"context_line":"    @mock.patch(\u0027nova.console.websocketproxy.NovaProxyRequestHandlerBase.\u0027"},{"line_number":231,"context_line":"                \u0027_check_console_port\u0027)"},{"line_number":232,"context_line":"    @mock.patch(\u0027nova.objects.ConsoleAuthToken.validate\u0027)"}],"source_content_type":"text/x-python","patch_set":32,"id":"9f6a8fd7_f4e57639","line":229,"range":{"start_line":229,"start_character":29,"end_line":229,"end_character":34},"in_reply_to":"9f6a8fd7_19eb83dc","updated":"2018-04-30 21:17:50.000000000","message":"Done","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"430ab3fbee3412710c2167485f50f47990b8240d","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"        self.flags(console_allowed_origins\u003d[\u0027allowed-origin-example-1.net\u0027,"},{"line_number":42,"context_line":"                                            \u0027allowed-origin-example-2.net\u0027])"},{"line_number":43,"context_line":"        self.wh \u003d websocketproxy.NovaProxyRequestHandlerBase()"},{"line_number":44,"context_line":"        self.wh.server \u003d websocketproxy.NovaWebSocketProxy()"},{"line_number":45,"context_line":"        self.wh.socket \u003d mock.MagicMock()"},{"line_number":46,"context_line":"        self.wh.msg \u003d mock.MagicMock()"}],"source_content_type":"text/x-python","patch_set":34,"id":"9f6a8fd7_71b72eda","line":43,"range":{"start_line":43,"start_character":33,"end_line":43,"end_character":60},"updated":"2018-05-01 12:09:24.000000000","message":"This should be NovaProxyRequestHandler, not the base class, that\u0027s how the compute_rpcapi AttributeError was missed in unit tests.","commit_id":"eb7ab3f412668937685385818b5b23735de06abb"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e30c4651651ed0f1a36de59506d7521ed1275dee","unresolved":false,"context_lines":[{"line_number":65,"context_line":"    @mock.patch(\u0027nova.compute.rpcapi.ComputeAPI.validate_console_port\u0027)"},{"line_number":66,"context_line":"    @mock.patch(\u0027nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token\u0027)"},{"line_number":67,"context_line":"    def test_new_websocket_client_db("},{"line_number":68,"context_line":"            self, mock_ca_check, mock_validate_port, mock_inst_get,"},{"line_number":69,"context_line":"            mock_validate, internal_access_path\u003dNone,"},{"line_number":70,"context_line":"            instance_not_found\u003dFalse):"},{"line_number":71,"context_line":""}],"source_content_type":"text/x-python","patch_set":34,"id":"9f6a8fd7_b14e26bf","line":68,"range":{"start_line":68,"start_character":33,"end_line":68,"end_character":51},"updated":"2018-05-01 12:20:23.000000000","message":"Need to assert that this is called.","commit_id":"eb7ab3f412668937685385818b5b23735de06abb"}],"releasenotes/notes/workarounds-enable-consoleauth-71d68c3879dc2c8a.yaml":[{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"8f698d55d6c46d8c4bbc476e8f7b1f7867982571","unresolved":false,"context_lines":[{"line_number":12,"context_line":"    consoles right away can enable this flag to continue using the consoleauth"},{"line_number":13,"context_line":"    service in addition to the database backend. Once all of the old"},{"line_number":14,"context_line":"    consoleauth supported consoles have expired, this flag should be disabled"},{"line_number":15,"context_line":"    and it will be no longer necessary to run the consoleauth service."}],"source_content_type":"text/x-yaml","patch_set":17,"id":"bf8cb3f7_d5ef56ae","line":15,"updated":"2017-12-20 17:35:56.000000000","message":"Question: should this also mention that the console proxy services now need to run per-cell in a multiple cell deployment?","commit_id":"4d01e6ee083638f7b100a022b1d0cb3bb39e3704"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"21607627b3340f07890f173ae56d082068c8cba5","unresolved":false,"context_lines":[{"line_number":12,"context_line":"    consoles right away can enable this flag to continue using the consoleauth"},{"line_number":13,"context_line":"    service in addition to the database backend. Once all of the old"},{"line_number":14,"context_line":"    consoleauth supported consoles have expired, this flag should be disabled"},{"line_number":15,"context_line":"    and it will be no longer necessary to run the consoleauth service."}],"source_content_type":"text/x-yaml","patch_set":17,"id":"bf8cb3f7_56ac908b","line":15,"in_reply_to":"bf8cb3f7_9c98086b","updated":"2018-01-10 16:29:39.000000000","message":"It is in that, once the console proxy is expecting to find tokens in the database, the tokens will be in cell databases, so one proxy per cell is needed. Otherwise the proxy won\u0027t be able to reach the cell databases, if that makes sense.","commit_id":"4d01e6ee083638f7b100a022b1d0cb3bb39e3704"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"94b4e986dc11c5b40681da29d9b45019d50e8c17","unresolved":false,"context_lines":[{"line_number":12,"context_line":"    consoles right away can enable this flag to continue using the consoleauth"},{"line_number":13,"context_line":"    service in addition to the database backend. Once all of the old"},{"line_number":14,"context_line":"    consoleauth supported consoles have expired, this flag should be disabled"},{"line_number":15,"context_line":"    and it will be no longer necessary to run the consoleauth service."}],"source_content_type":"text/x-yaml","patch_set":17,"id":"bf8cb3f7_9c98086b","line":15,"in_reply_to":"bf8cb3f7_d5ef56ae","updated":"2017-12-21 10:17:18.000000000","message":"Is that directly related to this? I figured that would be the case with or without the change. If this is the case, perhaps a separate reno-only commit would be appropriate? If not, care to elaborate further?","commit_id":"4d01e6ee083638f7b100a022b1d0cb3bb39e3704"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"1555fdcd189306a15ccbf412a5399687d032650f","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    A new configuration option ``[workarounds]/enable_consoleauth`` has been"},{"line_number":5,"context_line":"    added to avoid resetting unexpired consoles and defaults to False. Console"}],"source_content_type":"text/x-yaml","patch_set":27,"id":"bf659307_5aa3f49e","line":2,"range":{"start_line":2,"start_character":0,"end_line":2,"end_character":8},"updated":"2018-03-28 17:49:41.000000000","message":"This should probably be \u0027upgrade\u0027","commit_id":"5fabdbe6e93338e67d92ffbd2c7aa42e10cb85cb"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"upgrade:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    The consoleauth service has been deprecated and new consoles will have"},{"line_number":5,"context_line":"    their token authorizations stored in cell databases instead of in the"},{"line_number":6,"context_line":"    consoleauth service. With this, console proxies are required to be run per"},{"line_number":7,"context_line":"    cell instead of globally for multiple cells. All existing consoles will be"}],"source_content_type":"text/x-yaml","patch_set":32,"id":"9f6a8fd7_19c4e35e","line":4,"range":{"start_line":4,"start_character":28,"end_line":4,"end_character":47},"updated":"2018-04-30 20:44:18.000000000","message":"Where do we officially say that nova-consoleauth is deprecated? See my other comment inline, but if it\u0027s deprecated, we should emit a warning when it starts up from nova/cmd/consoleauth.py, and we should add a \u0027deprecations\u0027 release note for that specifically, and update the man page docs:\n\nhttps://github.com/openstack/nova/blob/master/doc/source/cli/nova-consoleauth.rst\n\nYou might want to do that in a separate change on top of this one though, up to you.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"upgrade:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    The consoleauth service has been deprecated and new consoles will have"},{"line_number":5,"context_line":"    their token authorizations stored in cell databases instead of in the"},{"line_number":6,"context_line":"    consoleauth service. With this, console proxies are required to be run per"},{"line_number":7,"context_line":"    cell instead of globally for multiple cells. All existing consoles will be"}],"source_content_type":"text/x-yaml","patch_set":32,"id":"9f6a8fd7_d9be6bd3","line":4,"range":{"start_line":4,"start_character":8,"end_line":4,"end_character":19},"updated":"2018-04-30 20:44:18.000000000","message":"``nova-consoleauth``","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"025c3050420a03b666cfb2991bbd95cf14359afb","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"upgrade:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    The consoleauth service has been deprecated and new consoles will have"},{"line_number":5,"context_line":"    their token authorizations stored in cell databases instead of in the"},{"line_number":6,"context_line":"    consoleauth service. With this, console proxies are required to be run per"},{"line_number":7,"context_line":"    cell instead of globally for multiple cells. All existing consoles will be"}],"source_content_type":"text/x-yaml","patch_set":32,"id":"9f6a8fd7_34c52e8f","line":4,"range":{"start_line":4,"start_character":28,"end_line":4,"end_character":47},"in_reply_to":"9f6a8fd7_19c4e35e","updated":"2018-04-30 21:17:50.000000000","message":"Here, in the release note. I thought that was enough only because I haven\u0027t deprecated a service myself before.\n\nMakes sense to emit a warning, that would be a lot better. I\u0027ll add another change.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"cd3007dce513b67b03e533dbeaeba66c6c26aa86","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"upgrade:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    The consoleauth service has been deprecated and new consoles will have"},{"line_number":5,"context_line":"    their token authorizations stored in cell databases instead of in the"},{"line_number":6,"context_line":"    consoleauth service. With this, console proxies are required to be run per"},{"line_number":7,"context_line":"    cell instead of globally for multiple cells. All existing consoles will be"}],"source_content_type":"text/x-yaml","patch_set":32,"id":"9f6a8fd7_b1906697","line":4,"range":{"start_line":4,"start_character":28,"end_line":4,"end_character":47},"in_reply_to":"9f6a8fd7_34c52e8f","updated":"2018-05-01 11:47:22.000000000","message":"With FFU people can gloss over the release notes, i.e. someone going from Pike to Stein might miss this and only notice the deprecation once it starts getting spewed into their logs on startup.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    The consoleauth service has been deprecated and new consoles will have"},{"line_number":5,"context_line":"    their token authorizations stored in cell databases instead of in the"},{"line_number":6,"context_line":"    consoleauth service. With this, console proxies are required to be run per"},{"line_number":7,"context_line":"    cell instead of globally for multiple cells. All existing consoles will be"},{"line_number":8,"context_line":"    reset. For most operators, this should be a minimal disruption as the"},{"line_number":9,"context_line":"    default TTL of a console token is 10 minutes."},{"line_number":10,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":32,"id":"9f6a8fd7_f99d6f66","line":7,"range":{"start_line":6,"start_character":25,"end_line":7,"end_character":48},"updated":"2018-04-30 20:44:18.000000000","message":"nit: even if I\u0027m running a single cell, I can\u0027t run this \u0027globally\u0027, i.e. in the API or controller services, right? So maybe this is better without \"instead of globally for multiple cells\"?","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"025c3050420a03b666cfb2991bbd95cf14359afb","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    The consoleauth service has been deprecated and new consoles will have"},{"line_number":5,"context_line":"    their token authorizations stored in cell databases instead of in the"},{"line_number":6,"context_line":"    consoleauth service. With this, console proxies are required to be run per"},{"line_number":7,"context_line":"    cell instead of globally for multiple cells. All existing consoles will be"},{"line_number":8,"context_line":"    reset. For most operators, this should be a minimal disruption as the"},{"line_number":9,"context_line":"    default TTL of a console token is 10 minutes."},{"line_number":10,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":32,"id":"9f6a8fd7_74408608","line":7,"range":{"start_line":6,"start_character":25,"end_line":7,"end_character":48},"in_reply_to":"9f6a8fd7_f99d6f66","updated":"2018-04-30 21:17:50.000000000","message":"Yeah, true.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"df910d8f637f8efc06c5992f697a07d1ff4c6208","unresolved":false,"context_lines":[{"line_number":12,"context_line":"    avoid resetting all existing consoles can use the new configuration option"},{"line_number":13,"context_line":"    ``[workarounds]/enable_consoleauth`` to fall back on the consoleauth"},{"line_number":14,"context_line":"    service for locating existing console authorizations. The option defaults"},{"line_number":15,"context_line":"    to False. Once all of the existing consoles have naturally expired,"},{"line_number":16,"context_line":"    operators may unset the configuration option and discontinue running the"},{"line_number":17,"context_line":"    consoleauth service."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"    Operators who do not need to use the ``[workarounds]/enable_consoleauth``"},{"line_number":20,"context_line":"    configuration option may discontinue running the consoleauth service."}],"source_content_type":"text/x-yaml","patch_set":32,"id":"9f6a8fd7_397d271c","line":17,"range":{"start_line":15,"start_character":14,"end_line":17,"end_character":24},"updated":"2018-04-30 20:44:18.000000000","message":"Again wondering how an operator can/will know when this has happened so they can flip the switch.\n\nAre you thinking like, if my consoleauth.token_ttl is 1 hour, that I can disable the workaround and stop running nova-consoleauth at least 1 hour after I\u0027ve deployed this code across all of my cells? Or is there something an operator can check in the DB?","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":4690,"name":"melanie witt","display_name":"melwitt","email":"melwittt@gmail.com","username":"melwitt"},"change_message_id":"025c3050420a03b666cfb2991bbd95cf14359afb","unresolved":false,"context_lines":[{"line_number":12,"context_line":"    avoid resetting all existing consoles can use the new configuration option"},{"line_number":13,"context_line":"    ``[workarounds]/enable_consoleauth`` to fall back on the consoleauth"},{"line_number":14,"context_line":"    service for locating existing console authorizations. The option defaults"},{"line_number":15,"context_line":"    to False. Once all of the existing consoles have naturally expired,"},{"line_number":16,"context_line":"    operators may unset the configuration option and discontinue running the"},{"line_number":17,"context_line":"    consoleauth service."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"    Operators who do not need to use the ``[workarounds]/enable_consoleauth``"},{"line_number":20,"context_line":"    configuration option may discontinue running the consoleauth service."}],"source_content_type":"text/x-yaml","patch_set":32,"id":"9f6a8fd7_f41a5615","line":17,"range":{"start_line":15,"start_character":14,"end_line":17,"end_character":24},"in_reply_to":"9f6a8fd7_397d271c","updated":"2018-04-30 21:17:50.000000000","message":"Yeah, it\u0027s like you said, depends on their TTL when all of their old token auths will be stale and no longer consulted for console access.\n\nWell, they can\u0027t check in the DB because the old console auths were stored in the nova-consoleauth service storage, which is a oslo.cache and depends on which CONF.cache.backend has been configured. So, to check, they\u0027d want to query the oslo.cache with something like, \"are all of the stored console auths expired?\" If so, the workaround can be disabled and nova-consoleauth decommissioned. Maybe such a query to oslo.cache could be created with nova-manage?","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"cd3007dce513b67b03e533dbeaeba66c6c26aa86","unresolved":false,"context_lines":[{"line_number":12,"context_line":"    avoid resetting all existing consoles can use the new configuration option"},{"line_number":13,"context_line":"    ``[workarounds]/enable_consoleauth`` to fall back on the consoleauth"},{"line_number":14,"context_line":"    service for locating existing console authorizations. The option defaults"},{"line_number":15,"context_line":"    to False. Once all of the existing consoles have naturally expired,"},{"line_number":16,"context_line":"    operators may unset the configuration option and discontinue running the"},{"line_number":17,"context_line":"    consoleauth service."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"    Operators who do not need to use the ``[workarounds]/enable_consoleauth``"},{"line_number":20,"context_line":"    configuration option may discontinue running the consoleauth service."}],"source_content_type":"text/x-yaml","patch_set":32,"id":"9f6a8fd7_31f21608","line":17,"range":{"start_line":15,"start_character":14,"end_line":17,"end_character":24},"in_reply_to":"9f6a8fd7_f41a5615","updated":"2018-05-01 11:47:22.000000000","message":"\u003e Maybe such a query to oslo.cache could be created with nova-manage?\n\nYeah maybe, but nova-manage would have to RPC call to nova-consoleauth right to figure that out, right? Anyway, definitely something for a later separate patch if we want / need it - it doesn\u0027t need to go in this change.","commit_id":"f595f29221afc7faa5f6019dc97468a35e8c58e8"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"f97b9245e40ea5f63f6576cc312a73b4a9c135f7","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":36,"id":"9f6a8fd7_b30daf3f","line":25,"updated":"2018-05-02 15:01:57.000000000","message":"We should have a deprecation section here, I guess.","commit_id":"947d60b63a316113325e2977340862c692806d96"}]}