)]}'
{"doc/source/admin/remote-console-access.rst":[{"author":{"_account_id":17130,"name":"melissaml","email":"ma.lei@99cloud.net","username":"malei"},"change_message_id":"59f978eac0f63e9f470e150fafc87a29dc4dd9b8","unresolved":false,"context_lines":[{"line_number":123,"context_line":""},{"line_number":124,"context_line":"- :file:`/etc/pki/libvirt-vnc/server-cert.pem`"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"  A x509 certificate to be presented by the VNC server. The"},{"line_number":127,"context_line":"  ``CommonName`` should match the primary hostname of the Compute"},{"line_number":128,"context_line":"  node. Use of ``subjectAltName`` is also permitted if there is"},{"line_number":129,"context_line":"  a need to use multiple hostnames or IP addresses to access"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f2577a7_f91235b1","line":126,"range":{"start_line":126,"start_character":2,"end_line":126,"end_character":3},"updated":"2017-09-12 04:55:01.000000000","message":"nit：A／An","commit_id":"9deab374f2518d48ae035e1015ff5e332e1631e1"},{"author":{"_account_id":17130,"name":"melissaml","email":"ma.lei@99cloud.net","username":"malei"},"change_message_id":"59f978eac0f63e9f470e150fafc87a29dc4dd9b8","unresolved":false,"context_lines":[{"line_number":208,"context_line":""},{"line_number":209,"context_line":"- :file:`/etc/pki//nova-novncproxy/client-cert.pem`"},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"  A x509 certificate to be presented to the VNC server. The"},{"line_number":212,"context_line":"  ``CommonName`` should match the primary hostname of the Compute"},{"line_number":213,"context_line":"  node. Though currently libvirt/QEMU will not do any"},{"line_number":214,"context_line":"  validation of the ``CommonName``, future versions will allow"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f2577a7_597949fa","line":211,"range":{"start_line":211,"start_character":2,"end_line":211,"end_character":3},"updated":"2017-09-12 04:55:01.000000000","message":"nit：A/An","commit_id":"9deab374f2518d48ae035e1015ff5e332e1631e1"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"003b83f35abb75ffd4994806de06a99104a749db","unresolved":false,"context_lines":[{"line_number":208,"context_line":""},{"line_number":209,"context_line":"- :file:`/etc/pki//nova-novncproxy/client-cert.pem`"},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"  A x509 certificate to be presented to the VNC server. The"},{"line_number":212,"context_line":"  ``CommonName`` should match the primary hostname of the Compute"},{"line_number":213,"context_line":"  node. Though currently libvirt/QEMU will not do any"},{"line_number":214,"context_line":"  validation of the ``CommonName``, future versions will allow"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ff5d4b2f_38034b45","line":211,"range":{"start_line":211,"start_character":2,"end_line":211,"end_character":3},"in_reply_to":"5f2577a7_597949fa","updated":"2017-09-19 14:39:30.000000000","message":"Done","commit_id":"9deab374f2518d48ae035e1015ff5e332e1631e1"},{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"e12d37cedf9198fa90a190514346d02778cc9327","unresolved":false,"context_lines":[{"line_number":111,"context_line":"attacks from malicious parties on the network between the tenant user and proxy"},{"line_number":112,"context_line":"server. When using HTTPS, the TLS encryption only applies to data between the"},{"line_number":113,"context_line":"tenant user and proxy server. The data between the proxy server and Compute"},{"line_number":114,"context_line":"node instance will still be in plain text. To provide protection for the"},{"line_number":115,"context_line":"latter, it is necessary to enable the VeNCrypt authentication scheme for VNC in"},{"line_number":116,"context_line":"both the Compute nodes and noVNC proxy server hosts."},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5f4e5783_894cb942","line":114,"range":{"start_line":114,"start_character":28,"end_line":114,"end_character":41},"updated":"2017-10-13 15:04:14.000000000","message":"nit: maybe use \u0027unencrypted\u0027? Strictly speaking, VNC is a binary (not text) protocol","commit_id":"cd61ea783490157a5c1731b13d3f4f75f9ae58a1"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"558d11bb7fbd172dfa07269476da80e0259f22c8","unresolved":false,"context_lines":[{"line_number":111,"context_line":"attacks from malicious parties on the network between the tenant user and proxy"},{"line_number":112,"context_line":"server. When using HTTPS, the TLS encryption only applies to data between the"},{"line_number":113,"context_line":"tenant user and proxy server. The data between the proxy server and Compute"},{"line_number":114,"context_line":"node instance will still be in plain text. To provide protection for the"},{"line_number":115,"context_line":"latter, it is necessary to enable the VeNCrypt authentication scheme for VNC in"},{"line_number":116,"context_line":"both the Compute nodes and noVNC proxy server hosts."},{"line_number":117,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_894ba829","line":114,"range":{"start_line":114,"start_character":28,"end_line":114,"end_character":41},"in_reply_to":"5f4e5783_894cb942","updated":"2017-10-25 17:05:15.000000000","message":"Done","commit_id":"cd61ea783490157a5c1731b13d3f4f75f9ae58a1"},{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"e12d37cedf9198fa90a190514346d02778cc9327","unresolved":false,"context_lines":[{"line_number":147,"context_line":"a mechanism to restrict what certificates can be presented by the proxy server."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"For further details on certificate creation, consult the QEMU manual page"},{"line_number":150,"context_line":"documentation on VNC server certificate setup."},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"Configure libvirt to enable the VeNCrypt authentication scheme for the VNC"},{"line_number":153,"context_line":"server. In :file:`/etc/libvirt/qemu.conf`, uncomment the following settings:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5f4e5783_69c4dd91","line":150,"updated":"2017-10-13 15:04:14.000000000","message":"I\u0027d insert a link to the QEMU docs [1] here\n\n[1] https://qemu.weilnetz.de/doc/qemu-doc.html#vnc_005fsec_005fcertificate_005fverify","commit_id":"cd61ea783490157a5c1731b13d3f4f75f9ae58a1"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"558d11bb7fbd172dfa07269476da80e0259f22c8","unresolved":false,"context_lines":[{"line_number":147,"context_line":"a mechanism to restrict what certificates can be presented by the proxy server."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"For further details on certificate creation, consult the QEMU manual page"},{"line_number":150,"context_line":"documentation on VNC server certificate setup."},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"Configure libvirt to enable the VeNCrypt authentication scheme for the VNC"},{"line_number":153,"context_line":"server. In :file:`/etc/libvirt/qemu.conf`, uncomment the following settings:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_ecbfcacd","line":150,"in_reply_to":"5f4e5783_69c4dd91","updated":"2017-10-25 17:05:15.000000000","message":"Done","commit_id":"cd61ea783490157a5c1731b13d3f4f75f9ae58a1"},{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"e12d37cedf9198fa90a190514346d02778cc9327","unresolved":false,"context_lines":[{"line_number":188,"context_line":""},{"line_number":189,"context_line":"The ``auth_schemes`` values should be listed in order of preference.  If"},{"line_number":190,"context_line":"enabling VeNCrypt on an existing deployment which already has instances"},{"line_number":191,"context_line":"running, the noVNC proxy server must initially be allowed to use ``vencrypt``"},{"line_number":192,"context_line":"or ``none``. Once it is confirmed that all Compute nodes have VeNCrypt enabled"},{"line_number":193,"context_line":"for VNC, it is possible to remove the ``none`` option from the list of the"},{"line_number":194,"context_line":"``auth_schemes`` values."},{"line_number":195,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5f4e5783_0930c99e","line":192,"range":{"start_line":191,"start_character":65,"end_line":192,"end_character":11},"updated":"2017-10-13 15:04:14.000000000","message":"This means \"both ``vencrypt`` and ``none``\" for \"backwards compatibility\" so to speak, right? To my mind using both/and is clearer than \"or\".","commit_id":"cd61ea783490157a5c1731b13d3f4f75f9ae58a1"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"558d11bb7fbd172dfa07269476da80e0259f22c8","unresolved":false,"context_lines":[{"line_number":188,"context_line":""},{"line_number":189,"context_line":"The ``auth_schemes`` values should be listed in order of preference.  If"},{"line_number":190,"context_line":"enabling VeNCrypt on an existing deployment which already has instances"},{"line_number":191,"context_line":"running, the noVNC proxy server must initially be allowed to use ``vencrypt``"},{"line_number":192,"context_line":"or ``none``. Once it is confirmed that all Compute nodes have VeNCrypt enabled"},{"line_number":193,"context_line":"for VNC, it is possible to remove the ``none`` option from the list of the"},{"line_number":194,"context_line":"``auth_schemes`` values."},{"line_number":195,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_acb9d2e9","line":192,"range":{"start_line":191,"start_character":65,"end_line":192,"end_character":11},"in_reply_to":"5f4e5783_0930c99e","updated":"2017-10-25 17:05:15.000000000","message":"correct - this should be \u0027and\u0027","commit_id":"cd61ea783490157a5c1731b13d3f4f75f9ae58a1"},{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"e12d37cedf9198fa90a190514346d02778cc9327","unresolved":false,"context_lines":[{"line_number":199,"context_line":"As well as enabling the authentication scheme, it is necessary to provide"},{"line_number":200,"context_line":"certificates to the noVNC proxy."},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"- :file:`/etc/pki//nova-novncproxy/client-cert.pem`"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"  An x509 certificate to be presented to the VNC server. The ``CommonName``"},{"line_number":205,"context_line":"  should match the primary hostname of the Compute node. Though currently"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5f4e5783_a92ad528","line":202,"range":{"start_line":202,"start_character":18,"end_line":202,"end_character":19},"updated":"2017-10-13 15:04:14.000000000","message":"nit: extra slash","commit_id":"cd61ea783490157a5c1731b13d3f4f75f9ae58a1"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"558d11bb7fbd172dfa07269476da80e0259f22c8","unresolved":false,"context_lines":[{"line_number":199,"context_line":"As well as enabling the authentication scheme, it is necessary to provide"},{"line_number":200,"context_line":"certificates to the noVNC proxy."},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"- :file:`/etc/pki//nova-novncproxy/client-cert.pem`"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"  An x509 certificate to be presented to the VNC server. The ``CommonName``"},{"line_number":205,"context_line":"  should match the primary hostname of the Compute node. Though currently"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_4cca5e6d","line":202,"range":{"start_line":202,"start_character":18,"end_line":202,"end_character":19},"in_reply_to":"5f4e5783_a92ad528","updated":"2017-10-25 17:05:15.000000000","message":"Done","commit_id":"cd61ea783490157a5c1731b13d3f4f75f9ae58a1"},{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"e12d37cedf9198fa90a190514346d02778cc9327","unresolved":false,"context_lines":[{"line_number":202,"context_line":"- :file:`/etc/pki//nova-novncproxy/client-cert.pem`"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"  An x509 certificate to be presented to the VNC server. The ``CommonName``"},{"line_number":205,"context_line":"  should match the primary hostname of the Compute node. Though currently"},{"line_number":206,"context_line":"  libvirt/QEMU will not do any validation of the ``CommonName``, future"},{"line_number":207,"context_line":"  versions will allow for setting up access controls based on the"},{"line_number":208,"context_line":"  ``CommonName``."}],"source_content_type":"text/x-rst","patch_set":3,"id":"5f4e5783_29eb85dc","line":205,"range":{"start_line":205,"start_character":43,"end_line":205,"end_character":55},"updated":"2017-10-13 15:04:14.000000000","message":"Wait, compute node? Not the controller node on which novncproxy is running?","commit_id":"cd61ea783490157a5c1731b13d3f4f75f9ae58a1"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"558d11bb7fbd172dfa07269476da80e0259f22c8","unresolved":false,"context_lines":[{"line_number":202,"context_line":"- :file:`/etc/pki//nova-novncproxy/client-cert.pem`"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"  An x509 certificate to be presented to the VNC server. The ``CommonName``"},{"line_number":205,"context_line":"  should match the primary hostname of the Compute node. Though currently"},{"line_number":206,"context_line":"  libvirt/QEMU will not do any validation of the ``CommonName``, future"},{"line_number":207,"context_line":"  versions will allow for setting up access controls based on the"},{"line_number":208,"context_line":"  ``CommonName``."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_4c9ffe5e","line":205,"range":{"start_line":205,"start_character":43,"end_line":205,"end_character":55},"in_reply_to":"5f4e5783_29eb85dc","updated":"2017-10-25 17:05:15.000000000","message":"Yup, it should be controller node. Fixed.","commit_id":"cd61ea783490157a5c1731b13d3f4f75f9ae58a1"},{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"645e41d48bbb0fc1f98692cd6b6d0b9635f2d2e3","unresolved":false,"context_lines":[{"line_number":207,"context_line":"  versions will allow for setting up access controls based on the"},{"line_number":208,"context_line":"  ``CommonName``."},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"- :file:`/etc/pki//nova-novncproxy/client-key.pem`"},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"  The private key used to generate the ``client-cert.pem`` file."},{"line_number":213,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5f4e5783_4f1a416f","line":210,"range":{"start_line":210,"start_character":18,"end_line":210,"end_character":19},"updated":"2017-10-13 15:46:32.000000000","message":"nit: forgot this extra slash as well","commit_id":"cd61ea783490157a5c1731b13d3f4f75f9ae58a1"},{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"e12d37cedf9198fa90a190514346d02778cc9327","unresolved":false,"context_lines":[{"line_number":211,"context_line":""},{"line_number":212,"context_line":"  The private key used to generate the ``client-cert.pem`` file."},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"- :file:`/etc/pki/nova-novncproxy/ca-cert.pem`"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"  The certificate authority cert used to sign ``client-cert.pem`` and sign the"},{"line_number":217,"context_line":"  Compute node VNC server certs."}],"source_content_type":"text/x-rst","patch_set":3,"id":"5f4e5783_e9be8db2","line":214,"updated":"2017-10-13 15:04:14.000000000","message":"This is the same ca cert as on L136, right? L144 recommends using a dedicated CA for VNC stuff, implying that it\u0027s the same CA for both compute hosts and proxies, but I would make it more explicit.","commit_id":"cd61ea783490157a5c1731b13d3f4f75f9ae58a1"},{"author":{"_account_id":8864,"name":"Artom Lifshitz","email":"notartom@gmail.com","username":"artom"},"change_message_id":"e12d37cedf9198fa90a190514346d02778cc9327","unresolved":false,"context_lines":[{"line_number":213,"context_line":""},{"line_number":214,"context_line":"- :file:`/etc/pki/nova-novncproxy/ca-cert.pem`"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"  The certificate authority cert used to sign ``client-cert.pem`` and sign the"},{"line_number":217,"context_line":"  Compute node VNC server certs."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"The certificates must have v3 basic constraints present to indicate the"},{"line_number":220,"context_line":"permitted key use and purpose data."}],"source_content_type":"text/x-rst","patch_set":3,"id":"5f4e5783_c9fd116f","line":217,"range":{"start_line":216,"start_character":70,"end_line":217,"end_character":31},"updated":"2017-10-13 15:04:14.000000000","message":"This sort addresses my comment on L214 above, but could easily be overlooked if readers don\u0027t notice that we\u0027re in the proxy section but talking about the compute node cert.","commit_id":"cd61ea783490157a5c1731b13d3f4f75f9ae58a1"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1456002c0adcef0a6ca66446c219f0a52e71fb84","unresolved":false,"context_lines":[{"line_number":104,"context_line":"   :alt: noVNC process"},{"line_number":105,"context_line":"   :width: 95%"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"VNC proxy security"},{"line_number":108,"context_line":"------------------"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Deploy the public-facing interface of the VNC proxy with HTTPS to prevent"}],"source_content_type":"text/x-rst","patch_set":16,"id":"7f96bb07_d0cacc18","line":107,"updated":"2018-01-12 19:09:13.000000000","message":"It might also be worth adding a link from https://docs.openstack.org/nova/latest/admin/security.html back to this doc, or vice-versa.","commit_id":"93c6aa89b19c2fc06b765855ad3ac3de050503a0"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"1456002c0adcef0a6ca66446c219f0a52e71fb84","unresolved":false,"context_lines":[{"line_number":196,"context_line":"At that point, the noVNC proxy will refuse to connect to any Compute node that"},{"line_number":197,"context_line":"does not offer VeNCrypt."},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"As well as enabling the authentication scheme, it is necessary to provide"},{"line_number":200,"context_line":"certificates to the noVNC proxy."},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"- :file:`/etc/pki/nova-novncproxy/client-cert.pem`"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"  An x509 certificate to be presented to the VNC server. The ``CommonName``"},{"line_number":205,"context_line":"  should match the primary hostname of the controller node. Though currently"},{"line_number":206,"context_line":"  libvirt/QEMU will not do any validation of the ``CommonName``, future"},{"line_number":207,"context_line":"  versions will allow for setting up access controls based on the"},{"line_number":208,"context_line":"  ``CommonName``."},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"- :file:`/etc/pki/nova-novncproxy/client-key.pem`"},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"  The private key used to generate the ``client-cert.pem`` file."},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"- :file:`/etc/pki/nova-novncproxy/ca-cert.pem`"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"  The certificate authority cert used to sign ``client-cert.pem`` and sign the"},{"line_number":217,"context_line":"  Compute node VNC server certs."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"The certificates must have v3 basic constraints present to indicate the"},{"line_number":220,"context_line":"permitted key use and purpose data."}],"source_content_type":"text/x-rst","patch_set":16,"id":"7f96bb07_50ff9c33","line":217,"range":{"start_line":199,"start_character":0,"end_line":217,"end_character":32},"updated":"2018-01-12 19:09:13.000000000","message":"This seems a bit redundant with the same stuff above...","commit_id":"93c6aa89b19c2fc06b765855ad3ac3de050503a0"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"197f7a6a464cd232649cb53e5dbcbaba02eca80c","unresolved":false,"context_lines":[{"line_number":196,"context_line":"At that point, the noVNC proxy will refuse to connect to any Compute node that"},{"line_number":197,"context_line":"does not offer VeNCrypt."},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"As well as enabling the authentication scheme, it is necessary to provide"},{"line_number":200,"context_line":"certificates to the noVNC proxy."},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"- :file:`/etc/pki/nova-novncproxy/client-cert.pem`"},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"  An x509 certificate to be presented to the VNC server. The ``CommonName``"},{"line_number":205,"context_line":"  should match the primary hostname of the controller node. Though currently"},{"line_number":206,"context_line":"  libvirt/QEMU will not do any validation of the ``CommonName``, future"},{"line_number":207,"context_line":"  versions will allow for setting up access controls based on the"},{"line_number":208,"context_line":"  ``CommonName``."},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"- :file:`/etc/pki/nova-novncproxy/client-key.pem`"},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"  The private key used to generate the ``client-cert.pem`` file."},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"- :file:`/etc/pki/nova-novncproxy/ca-cert.pem`"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"  The certificate authority cert used to sign ``client-cert.pem`` and sign the"},{"line_number":217,"context_line":"  Compute node VNC server certs."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"The certificates must have v3 basic constraints present to indicate the"},{"line_number":220,"context_line":"permitted key use and purpose data."}],"source_content_type":"text/x-rst","patch_set":16,"id":"7f96bb07_d9adc6e9","line":217,"range":{"start_line":199,"start_character":0,"end_line":217,"end_character":32},"in_reply_to":"7f96bb07_50ff9c33","updated":"2018-01-16 16:22:21.000000000","message":"Note that they\u0027re different things (client- vs. server-). The only thing shared here is \u0027ca-cert.pem\u0027. It makes sense to keep this, IMO, but I have bolded the differences","commit_id":"93c6aa89b19c2fc06b765855ad3ac3de050503a0"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"d118c657ed989c90a74cf8dd185791061ad8d23f","unresolved":false,"context_lines":[{"line_number":200,"context_line":""},{"line_number":201,"context_line":"- :file:`/etc/pki/nova-novncproxy/client-cert.pem`"},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"  An x509 certificate to be presented **to the VNC server**. The ``CommonName``"},{"line_number":204,"context_line":"  should match the **primary hostname of the controller node**. Though"},{"line_number":205,"context_line":"  libvirt/QEMU will not currently do any validation of the ``CommonName``,"},{"line_number":206,"context_line":"  future versions will allow for setting up access controls based on the"},{"line_number":207,"context_line":"  ``CommonName``."},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"- :file:`/etc/pki/nova-novncproxy/client-key.pem`"},{"line_number":210,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"7f96bb07_57065d1f","line":207,"range":{"start_line":203,"start_character":2,"end_line":207,"end_character":17},"updated":"2018-01-16 17:18:23.000000000","message":"what are the ramifications of this hostname constraint for OpenStack environments running HA controller deployments? Would each controller need to run a separate VNC proxy with a separate client-cert that is specific to that controller node?","commit_id":"1309f134acbba0c2d69adfe5aae40ccee5db4907"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"caa56800217937814f779be1bb984ab87d501362","unresolved":false,"context_lines":[{"line_number":200,"context_line":""},{"line_number":201,"context_line":"- :file:`/etc/pki/nova-novncproxy/client-cert.pem`"},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"  An x509 certificate to be presented **to the VNC server**. The ``CommonName``"},{"line_number":204,"context_line":"  should match the **primary hostname of the controller node**. Though"},{"line_number":205,"context_line":"  libvirt/QEMU will not currently do any validation of the ``CommonName``,"},{"line_number":206,"context_line":"  future versions will allow for setting up access controls based on the"},{"line_number":207,"context_line":"  ``CommonName``."},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"- :file:`/etc/pki/nova-novncproxy/client-key.pem`"},{"line_number":210,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"7f96bb07_068de230","line":207,"range":{"start_line":203,"start_character":2,"end_line":207,"end_character":17},"in_reply_to":"7f96bb07_57065d1f","updated":"2018-01-17 15:50:01.000000000","message":"Long story short, you need to either whitelist the CN for every console proxy instance on each compute node, or you need to use a common \u0027Organization\u0027 across all console proxy instances. The latter is probably easier as it lets you add a remove console proxies trivially. I\u0027ve updated the text appropriately.","commit_id":"1309f134acbba0c2d69adfe5aae40ccee5db4907"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"d118c657ed989c90a74cf8dd185791061ad8d23f","unresolved":false,"context_lines":[{"line_number":215,"context_line":"  The certificate authority cert used to sign ``client-cert.pem`` and sign the"},{"line_number":216,"context_line":"  compute node VNC server certificates."},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"The certificates must have v3 basic constraints present to indicate the"},{"line_number":219,"context_line":"permitted key use and purpose data."},{"line_number":220,"context_line":""},{"line_number":221,"context_line":"Once the certificates have been created, the noVNC console proxy service must"}],"source_content_type":"text/x-rst","patch_set":17,"id":"7f96bb07_7748395b","line":218,"range":{"start_line":218,"start_character":0,"end_line":218,"end_character":47},"updated":"2018-01-16 17:18:23.000000000","message":"this is the second time in this patch I see this phrase. And I must admit I don\u0027t know what it means. Perhaps linkify this to a document that describes what \"v3 basic constraints\" are?","commit_id":"1309f134acbba0c2d69adfe5aae40ccee5db4907"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"caa56800217937814f779be1bb984ab87d501362","unresolved":false,"context_lines":[{"line_number":215,"context_line":"  The certificate authority cert used to sign ``client-cert.pem`` and sign the"},{"line_number":216,"context_line":"  compute node VNC server certificates."},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"The certificates must have v3 basic constraints present to indicate the"},{"line_number":219,"context_line":"permitted key use and purpose data."},{"line_number":220,"context_line":""},{"line_number":221,"context_line":"Once the certificates have been created, the noVNC console proxy service must"}],"source_content_type":"text/x-rst","patch_set":17,"id":"7f96bb07_26901e4a","line":218,"range":{"start_line":218,"start_character":0,"end_line":218,"end_character":47},"in_reply_to":"7f96bb07_7748395b","updated":"2018-01-17 15:50:01.000000000","message":"Done","commit_id":"1309f134acbba0c2d69adfe5aae40ccee5db4907"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"840f8e9106eb9ec9d2826eab952ed9432dc73bae","unresolved":false,"context_lines":[{"line_number":137,"context_line":"  The authority certificate used to sign ``server-cert.pem`` and sign the VNC"},{"line_number":138,"context_line":"  proxy server certificates."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"The certificates must have v3 basic constraints [3]_ present to indicate the"},{"line_number":141,"context_line":"permitted key use and purpose data."},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"We recommend using a dedicated certificate authority solely for the VNC"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f96bb07_89434542","line":140,"range":{"start_line":140,"start_character":48,"end_line":140,"end_character":53},"updated":"2018-01-17 16:04:43.000000000","message":"ty sir.","commit_id":"72e2f8e4e728ebe98da5ffc34c92062d13971e2f"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b8f4029e09179981e4468a974b78f38890f21084","unresolved":false,"context_lines":[{"line_number":207,"context_line":"  of the controller node**. If using a HA deployment, the ``Organization``"},{"line_number":208,"context_line":"  field can also be configured to a value that is common across all console"},{"line_number":209,"context_line":"  proxy instances in the deployment. This avoids the need to modify each"},{"line_number":210,"context_line":"  compute node\u0027s whitelist every time a new console proxy instance."},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"- :file:`/etc/pki/nova-novncproxy/client-key.pem`"},{"line_number":213,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f96bb07_8de2f82e","line":210,"range":{"start_line":210,"start_character":27,"end_line":210,"end_character":66},"updated":"2018-01-22 14:41:37.000000000","message":"\"every time a new console proxy instance\" is what? added? removed?","commit_id":"72e2f8e4e728ebe98da5ffc34c92062d13971e2f"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"840f8e9106eb9ec9d2826eab952ed9432dc73bae","unresolved":false,"context_lines":[{"line_number":204,"context_line":"  will not currently do any validation of the ``CommonName`` field, future"},{"line_number":205,"context_line":"  versions will allow for setting up access controls based on the"},{"line_number":206,"context_line":"  ``CommonName``. The ``CommonName`` field should match the **primary hostname"},{"line_number":207,"context_line":"  of the controller node**. If using a HA deployment, the ``Organization``"},{"line_number":208,"context_line":"  field can also be configured to a value that is common across all console"},{"line_number":209,"context_line":"  proxy instances in the deployment. This avoids the need to modify each"},{"line_number":210,"context_line":"  compute node\u0027s whitelist every time a new console proxy instance."},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"- :file:`/etc/pki/nova-novncproxy/client-key.pem`"},{"line_number":213,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f96bb07_29a1d1f8","line":210,"range":{"start_line":207,"start_character":28,"end_line":210,"end_character":67},"updated":"2018-01-17 16:04:43.000000000","message":"also ty, lgtm.","commit_id":"72e2f8e4e728ebe98da5ffc34c92062d13971e2f"},{"author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"change_message_id":"974c1d30151996c35905cbae78ec5610d6cade87","unresolved":false,"context_lines":[{"line_number":207,"context_line":"  of the controller node**. If using a HA deployment, the ``Organization``"},{"line_number":208,"context_line":"  field can also be configured to a value that is common across all console"},{"line_number":209,"context_line":"  proxy instances in the deployment. This avoids the need to modify each"},{"line_number":210,"context_line":"  compute node\u0027s whitelist every time a new console proxy instance."},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"- :file:`/etc/pki/nova-novncproxy/client-key.pem`"},{"line_number":213,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f96bb07_4dc07051","line":210,"range":{"start_line":210,"start_character":27,"end_line":210,"end_character":66},"in_reply_to":"7f96bb07_8de2f82e","updated":"2018-01-22 14:47:30.000000000","message":"Oops\n\n  every time a console proxy instance is added or removed.","commit_id":"72e2f8e4e728ebe98da5ffc34c92062d13971e2f"}]}