)]}'
{"doc/source/main/api/haproxy-amphora-api.rst":[{"author":{"_account_id":6287,"name":"David Lenwell","email":"dlenwell@gmail.com","username":"dlenwell"},"change_message_id":"13a42217fc24cea7fcec0582d60d880f8e765dfe","unresolved":false,"context_lines":[{"line_number":4,"context_line":"This document describes the API interface between the reference haproxy driver"},{"line_number":5,"context_line":"and its corresponding haproxy-based amphorae."},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Octavia reference haproxy amphorae use a RESTful API for configuration and"},{"line_number":8,"context_line":"control. This API should be secured through the use of TLS encryption as well"},{"line_number":9,"context_line":"as bi-directional verification of client- and server-side certificates. (The"},{"line_number":10,"context_line":"exact process for generating and distributing these certificates should be"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_9a98bac1","line":7,"updated":"2014-10-24 00:01:03.000000000","message":"Unless you plan on this being strictly a RESTful web service. the term RESTful comes with its own opinionated definition of how a web service should work. I would just call this a \"Web Service API\"  To avoid confusion.","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"f81a7bbb7b155f9b6b7cd0cf738a35d362015ba4","unresolved":false,"context_lines":[{"line_number":19,"context_line":"same time, configuration and control actions should be made on all these"},{"line_number":20,"context_line":"amphorae at approximately the same time. (Amphorae do not communicate directly"},{"line_number":21,"context_line":"with each other, except in an active-standby topology, and then this"},{"line_number":22,"context_line":"communication is limited to fail-over protocols.)"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":".. contents::"},{"line_number":25,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_33e9ee80","line":22,"updated":"2014-10-14 05:13:17.000000000","message":"I still feel like using a web server API for this is like using a sledgehammer to crack a nut.  However, I think the majority have agreed on this so I\u0027m just posting my one final complaint.","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"8a34bfb1935f2d310de5b83100059b83c2001189","unresolved":false,"context_lines":[{"line_number":19,"context_line":"same time, configuration and control actions should be made on all these"},{"line_number":20,"context_line":"amphorae at approximately the same time. (Amphorae do not communicate directly"},{"line_number":21,"context_line":"with each other, except in an active-standby topology, and then this"},{"line_number":22,"context_line":"communication is limited to fail-over protocols.)"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":".. contents::"},{"line_number":25,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_1bd7acee","line":22,"in_reply_to":"baa201ad_33e9ee80","updated":"2014-10-22 08:12:56.000000000","message":"What would you do if not a RESTful API?","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":6287,"name":"David Lenwell","email":"dlenwell@gmail.com","username":"dlenwell"},"change_message_id":"13a42217fc24cea7fcec0582d60d880f8e765dfe","unresolved":false,"context_lines":[{"line_number":49,"context_line":"* **URL params:** none"},{"line_number":50,"context_line":"* **Data params:** none"},{"line_number":51,"context_line":"* **Success Response:**"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"  * Code: 200"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"    * Content: JSON formatted listing of this amphora\u0027s configured topology."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_5af2d206","line":52,"updated":"2014-10-24 00:01:03.000000000","message":"General comment about all of these url definitions is that they lack any example json output.. to avoid confusion about how you want data structured when it is returned.","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"f81a7bbb7b155f9b6b7cd0cf738a35d362015ba4","unresolved":false,"context_lines":[{"line_number":66,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":67,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":68,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":69,"context_line":"  routing IP address for ACTIVE-STANDBY pair."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Set amphora topology"},{"line_number":72,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_13f22a6f","line":69,"updated":"2014-10-14 05:13:17.000000000","message":"some of these can be derived from the os and load balancing config.  Some cannot though (topology, role).  How will these be stored?","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"22deafb67886f3997ad5a0a40a3646715af87e1a","unresolved":false,"context_lines":[{"line_number":66,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":67,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":68,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":69,"context_line":"  routing IP address for ACTIVE-STANDBY pair."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Set amphora topology"},{"line_number":72,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_312b9f31","line":69,"in_reply_to":"9aa7fdbe_1b1c0cc1","updated":"2014-10-22 17:45:23.000000000","message":"well the reason I asked is because it sounded like it would need access to the database.   I don\u0027t like that idea because I feel like that will cause scalability issues, in that every amphora can make a connection to the database, which will cause issues.  So I feel like this needs to be stored on the Amphora itself, in one way or the other.  Or we need another solution.","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"8a34bfb1935f2d310de5b83100059b83c2001189","unresolved":false,"context_lines":[{"line_number":66,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":67,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":68,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":69,"context_line":"  routing IP address for ACTIVE-STANDBY pair."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Set amphora topology"},{"line_number":72,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_1b1c0cc1","line":69,"in_reply_to":"baa201ad_13f22a6f","updated":"2014-10-22 08:12:56.000000000","message":"Well, the topology needs to be stored persistently, so I could see this being stored in the Octavia database eventually-- though at first we might simply opt for one type of topology per OpenStack installation, in which case \u0027topology\u0027 becomes a configuration file parameter. The Amphora doesn\u0027t know this, though, and presumably the reference image we create should be capable of running in several topologies.\n\nThe \u0027role\u0027 attribute can probably be authoritatively stored on the amphorae themselves, especially since this can spontaneously change based on the failure of a node (prior to the controller or driver becoming aware of the failure, per se.)","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"f81a7bbb7b155f9b6b7cd0cf738a35d362015ba4","unresolved":false,"context_lines":[{"line_number":118,"context_line":"Get amphora status"},{"line_number":119,"context_line":"------------------"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"* **URL:** /status"},{"line_number":122,"context_line":"* **Method:** GET"},{"line_number":123,"context_line":"* **URL params:** none"},{"line_number":124,"context_line":"* **Data params:** none"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_d3f7c257","line":121,"updated":"2014-10-14 05:13:17.000000000","message":"maybe this should be /details or /info since the paragraph above mentions an amphora status of OK and TOPOLOGY-CHANGE but below I only see a boolean active.  Maybe I\u0027m missing something though.","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"22deafb67886f3997ad5a0a40a3646715af87e1a","unresolved":false,"context_lines":[{"line_number":118,"context_line":"Get amphora status"},{"line_number":119,"context_line":"------------------"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"* **URL:** /status"},{"line_number":122,"context_line":"* **Method:** GET"},{"line_number":123,"context_line":"* **URL params:** none"},{"line_number":124,"context_line":"* **Data params:** none"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_51e823e2","line":121,"in_reply_to":"9aa7fdbe_db7284e2","updated":"2014-10-22 17:45:23.000000000","message":"I mean in the response body there is the \"active\" field that feels like it is the only field that describes a status.","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"8a34bfb1935f2d310de5b83100059b83c2001189","unresolved":false,"context_lines":[{"line_number":118,"context_line":"Get amphora status"},{"line_number":119,"context_line":"------------------"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"* **URL:** /status"},{"line_number":122,"context_line":"* **Method:** GET"},{"line_number":123,"context_line":"* **URL params:** none"},{"line_number":124,"context_line":"* **Data params:** none"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_db7284e2","line":121,"in_reply_to":"baa201ad_d3f7c257","updated":"2014-10-22 08:12:56.000000000","message":"I\u0027m happy to change to one of those paths if it\u0027s more descriptive, eh. I\u0027m not sure I follow what you mean by \"I only see a boolean active,\" though.","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"f81a7bbb7b155f9b6b7cd0cf738a35d362015ba4","unresolved":false,"context_lines":[{"line_number":192,"context_line":"* *status* - One of: UP, DOWN"},{"line_number":193,"context_line":"* *uuid* - Listener UUID"},{"line_number":194,"context_line":"* *provisioning_status* - One of: ACTIVE, PENDING_CREATE, PENDING_UPDATE,"},{"line_number":195,"context_line":"  PENDING_DELETE, DELETED, ERROR"},{"line_number":196,"context_line":"* *type* - One of: TCP, HTTP, TERMINATED_HTTPS"},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"**Notes:** Note that this returns a status if *any* files exist for the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_53a3d24e","line":195,"updated":"2014-10-14 05:13:17.000000000","message":"same question as above but where will these value be stored? internal db for every amphora?","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"22deafb67886f3997ad5a0a40a3646715af87e1a","unresolved":false,"context_lines":[{"line_number":192,"context_line":"* *status* - One of: UP, DOWN"},{"line_number":193,"context_line":"* *uuid* - Listener UUID"},{"line_number":194,"context_line":"* *provisioning_status* - One of: ACTIVE, PENDING_CREATE, PENDING_UPDATE,"},{"line_number":195,"context_line":"  PENDING_DELETE, DELETED, ERROR"},{"line_number":196,"context_line":"* *type* - One of: TCP, HTTP, TERMINATED_HTTPS"},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"**Notes:** Note that this returns a status if *any* files exist for the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_7191a751","line":195,"in_reply_to":"9aa7fdbe_1b2b2c95","updated":"2014-10-22 17:45:23.000000000","message":"I still dont understand.  So how does the API determine that an haproxy instance is anything but ACTIVE or DELETED?","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"8a34bfb1935f2d310de5b83100059b83c2001189","unresolved":false,"context_lines":[{"line_number":192,"context_line":"* *status* - One of: UP, DOWN"},{"line_number":193,"context_line":"* *uuid* - Listener UUID"},{"line_number":194,"context_line":"* *provisioning_status* - One of: ACTIVE, PENDING_CREATE, PENDING_UPDATE,"},{"line_number":195,"context_line":"  PENDING_DELETE, DELETED, ERROR"},{"line_number":196,"context_line":"* *type* - One of: TCP, HTTP, TERMINATED_HTTPS"},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"**Notes:** Note that this returns a status if *any* files exist for the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_1b2b2c95","line":195,"in_reply_to":"baa201ad_53a3d24e","updated":"2014-10-22 08:12:56.000000000","message":"I\u0027m not sure I follow you on this: These statuses are probed in real time on the amphora. So, if the driver/controller wants to know the status of a listener at any given moment, presumably it hits this API, and the API handler on the amphora probes the appropriate haproxy status to find out.","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"f81a7bbb7b155f9b6b7cd0cf738a35d362015ba4","unresolved":false,"context_lines":[{"line_number":237,"context_line":"Start or Stop a listener"},{"line_number":238,"context_line":"------------------------"},{"line_number":239,"context_line":""},{"line_number":240,"context_line":"* **URL:** /listeners/*:listener*?action\u003d *:action*"},{"line_number":241,"context_line":"* **Method:** GET"},{"line_number":242,"context_line":"* **URL params:**"},{"line_number":243,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_d38ee2cf","line":240,"updated":"2014-10-14 05:13:17.000000000","message":"I feel like these are more RESTful\n\nPOST to /listeners/*:listener*/start\n\nPOST to /listeners/*:listener*/stop","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"22deafb67886f3997ad5a0a40a3646715af87e1a","unresolved":false,"context_lines":[{"line_number":237,"context_line":"Start or Stop a listener"},{"line_number":238,"context_line":"------------------------"},{"line_number":239,"context_line":""},{"line_number":240,"context_line":"* **URL:** /listeners/*:listener*?action\u003d *:action*"},{"line_number":241,"context_line":"* **Method:** GET"},{"line_number":242,"context_line":"* **URL params:**"},{"line_number":243,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_d1b7b3d6","line":240,"in_reply_to":"9aa7fdbe_960d333a","updated":"2014-10-22 17:45:23.000000000","message":"then use PUT instead of POST.  GETs to me are supposed to be about data retrieval, not firing off actions.","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"8a34bfb1935f2d310de5b83100059b83c2001189","unresolved":false,"context_lines":[{"line_number":237,"context_line":"Start or Stop a listener"},{"line_number":238,"context_line":"------------------------"},{"line_number":239,"context_line":""},{"line_number":240,"context_line":"* **URL:** /listeners/*:listener*?action\u003d *:action*"},{"line_number":241,"context_line":"* **Method:** GET"},{"line_number":242,"context_line":"* **URL params:**"},{"line_number":243,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_960d333a","line":240,"in_reply_to":"baa201ad_d38ee2cf","updated":"2014-10-22 08:12:56.000000000","message":"These are idempotent requests, so GET is probably more appropriate since a retried \u0027start\u0027 or \u0027stop\u0027 command should have the same ultimate result.","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"f81a7bbb7b155f9b6b7cd0cf738a35d362015ba4","unresolved":false,"context_lines":[{"line_number":425,"context_line":"  * Clean up listener configuration directory if it\u0027s now empty."},{"line_number":426,"context_line":""},{"line_number":427,"context_line":"Upload listener haproxy configuration"},{"line_number":428,"context_line":"-------------------------------------"},{"line_number":429,"context_line":""},{"line_number":430,"context_line":"* **URL:** /listeners/*:listener*/haproxy"},{"line_number":431,"context_line":"* **Method:** PUT"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_336e4e02","line":428,"updated":"2014-10-14 05:13:17.000000000","message":"This is for creating a new listener and updating an existing one correct?","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"8a34bfb1935f2d310de5b83100059b83c2001189","unresolved":false,"context_lines":[{"line_number":425,"context_line":"  * Clean up listener configuration directory if it\u0027s now empty."},{"line_number":426,"context_line":""},{"line_number":427,"context_line":"Upload listener haproxy configuration"},{"line_number":428,"context_line":"-------------------------------------"},{"line_number":429,"context_line":""},{"line_number":430,"context_line":"* **URL:** /listeners/*:listener*/haproxy"},{"line_number":431,"context_line":"* **Method:** PUT"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_f634bfdf","line":428,"in_reply_to":"baa201ad_336e4e02","updated":"2014-10-22 08:12:56.000000000","message":"Yep, though it might not be start-able at first (eg. if the listener is TLS terminated-- you need the certificate/key pem file before you can start the listener, and that\u0027s a separate API command.)","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"f81a7bbb7b155f9b6b7cd0cf738a35d362015ba4","unresolved":false,"context_lines":[{"line_number":501,"context_line":""},{"line_number":502,"context_line":"* **Implied actions:** none"},{"line_number":503,"context_line":""},{"line_number":504,"context_line":"Delete listener haproxy configuration"},{"line_number":505,"context_line":"-------------------------------------"},{"line_number":506,"context_line":""},{"line_number":507,"context_line":"* **URL:** /listeners/*:listener*/haproxy"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_9359ba5d","line":504,"updated":"2014-10-14 05:13:17.000000000","message":"What is the use case for only needing to delete the listener haproxy configuration but not the entire listener?","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"8a34bfb1935f2d310de5b83100059b83c2001189","unresolved":false,"context_lines":[{"line_number":501,"context_line":""},{"line_number":502,"context_line":"* **Implied actions:** none"},{"line_number":503,"context_line":""},{"line_number":504,"context_line":"Delete listener haproxy configuration"},{"line_number":505,"context_line":"-------------------------------------"},{"line_number":506,"context_line":""},{"line_number":507,"context_line":"* **URL:** /listeners/*:listener*/haproxy"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_165ea312","line":504,"in_reply_to":"baa201ad_9359ba5d","updated":"2014-10-22 08:12:56.000000000","message":"Aah-- you\u0027re right that there probably isn\u0027t one in this case. I was thinking of a potential amphora that could use either haproxy or nginx for the load balancing software, but I think we already established that that would entail a different driver and probably different amphora API interface anyway.","commit_id":"870ccf444dccbe8232da87ed013837a3d738db05"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"1b6a01dfc44423e2c2ea7247290966815a31ff2c","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"In addition to the web service configuration and control interface, the"},{"line_number":14,"context_line":"amphorae may use an HMAC-signed UDP protocol for communicating regular, less-"},{"line_number":15,"context_line":"vital information to the controller (eg. statistics updates and whatnot)."},{"line_number":16,"context_line":"Information on this will also be covered in another document."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"If a given loadbalancer is being serviced by mutiple haproxy amphorae at the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_42accd35","line":15,"updated":"2014-11-07 09:53:29.000000000","message":"please be precise: statistics, heart beat, health information, wake-up signal (to make the controller call back the amphora over REST). Which of those specific functionality is TBD","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"In addition to the web service configuration and control interface, the"},{"line_number":14,"context_line":"amphorae may use an HMAC-signed UDP protocol for communicating regular, less-"},{"line_number":15,"context_line":"vital information to the controller (eg. statistics updates and whatnot)."},{"line_number":16,"context_line":"Information on this will also be covered in another document."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"If a given loadbalancer is being serviced by mutiple haproxy amphorae at the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_5c3f44b4","line":15,"in_reply_to":"5a890539_c18c7b82","updated":"2014-11-21 23:20:10.000000000","message":"Seriously? In an introductory paragraph? The idea here is to communicate that this API specification covers the REST API that lives on the Amphora only. It is not meant to outline the UDP messages, nor the API that will live with the driver in the controller, nor any back-end REST API which may live on the controller.\n\nI\u0027ll remove the word \u0027whatnot\u0027, but it should be obvious from the context that this isn\u0027t meant to be a comprehensive list of things that will be covered in another spec.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"In addition to the web service configuration and control interface, the"},{"line_number":14,"context_line":"amphorae may use an HMAC-signed UDP protocol for communicating regular, less-"},{"line_number":15,"context_line":"vital information to the controller (eg. statistics updates and whatnot)."},{"line_number":16,"context_line":"Information on this will also be covered in another document."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"If a given loadbalancer is being serviced by mutiple haproxy amphorae at the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_c18c7b82","line":15,"in_reply_to":"7a8c0949_42accd35","updated":"2014-11-20 02:08:35.000000000","message":"I agree, I would like to see these listed out.\n\"whatnot\" falls under \"obscure non-english words\" from the conventions guide in my book.\nWe are not supposed to use e.g. either.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"1b6a01dfc44423e2c2ea7247290966815a31ff2c","unresolved":false,"context_lines":[{"line_number":15,"context_line":"vital information to the controller (eg. statistics updates and whatnot)."},{"line_number":16,"context_line":"Information on this will also be covered in another document."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"If a given loadbalancer is being serviced by mutiple haproxy amphorae at the"},{"line_number":19,"context_line":"same time, configuration and control actions should be made on all these"},{"line_number":20,"context_line":"amphorae at approximately the same time. (Amphorae do not communicate directly"},{"line_number":21,"context_line":"with each other, except in an active-standby topology, and then this"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_82a6b551","line":18,"updated":"2014-11-07 09:53:29.000000000","message":"Didn\u0027t we decide the plural of amphora is amphora?","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":15,"context_line":"vital information to the controller (eg. statistics updates and whatnot)."},{"line_number":16,"context_line":"Information on this will also be covered in another document."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"If a given loadbalancer is being serviced by mutiple haproxy amphorae at the"},{"line_number":19,"context_line":"same time, configuration and control actions should be made on all these"},{"line_number":20,"context_line":"amphorae at approximately the same time. (Amphorae do not communicate directly"},{"line_number":21,"context_line":"with each other, except in an active-standby topology, and then this"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_7c5fa00f","line":18,"in_reply_to":"5a890539_0d63511b","updated":"2014-11-21 23:20:10.000000000","message":"I\u0027m going with amphorae.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"ea3f9be56564270494d52cbb9230aa194530ba22","unresolved":false,"context_lines":[{"line_number":15,"context_line":"vital information to the controller (eg. statistics updates and whatnot)."},{"line_number":16,"context_line":"Information on this will also be covered in another document."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"If a given loadbalancer is being serviced by mutiple haproxy amphorae at the"},{"line_number":19,"context_line":"same time, configuration and control actions should be made on all these"},{"line_number":20,"context_line":"amphorae at approximately the same time. (Amphorae do not communicate directly"},{"line_number":21,"context_line":"with each other, except in an active-standby topology, and then this"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_0d63511b","line":18,"in_reply_to":"7a8c0949_82a6b551","updated":"2014-11-07 17:19:11.000000000","message":"We discovered that either are valid. That said, I still much prefer \"amphorae\". :)","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"If a given loadbalancer is being serviced by mutiple haproxy amphorae at the"},{"line_number":19,"context_line":"same time, configuration and control actions should be made on all these"},{"line_number":20,"context_line":"amphorae at approximately the same time. (Amphorae do not communicate directly"},{"line_number":21,"context_line":"with each other, except in an active-standby topology, and then this"},{"line_number":22,"context_line":"communication is limited to fail-over protocols.)"},{"line_number":23,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_4146cb24","line":20,"updated":"2014-11-20 02:08:35.000000000","message":"What is the failure handling here?  How does rollback work if something goes wrong?  Do we just skip unreachable Amphorae and hope they are dead?\nI guess these are really questions for the controller/driver specs.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"If a given loadbalancer is being serviced by mutiple haproxy amphorae at the"},{"line_number":19,"context_line":"same time, configuration and control actions should be made on all these"},{"line_number":20,"context_line":"amphorae at approximately the same time. (Amphorae do not communicate directly"},{"line_number":21,"context_line":"with each other, except in an active-standby topology, and then this"},{"line_number":22,"context_line":"communication is limited to fail-over protocols.)"},{"line_number":23,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_9cb36c4c","line":20,"in_reply_to":"5a890539_4146cb24","updated":"2014-11-21 23:20:10.000000000","message":"Yes, I would say the design around that will be handed in the controller or (more likely) amphora lifecycle spec.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"* 200 OK - Operation was completed as requested."},{"line_number":38,"context_line":"* 201 Created - Operation successfully resulted in the creation / processing"},{"line_number":39,"context_line":"  of a file."},{"line_number":40,"context_line":"* 403 Invalid Request - API handler does not recognize the specified URL or"},{"line_number":41,"context_line":"  HTTP method."},{"line_number":42,"context_line":"* 404 Not Found - The requested file was not found."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_41032b73","line":39,"updated":"2014-11-20 02:08:35.000000000","message":"What about 202 for async?\n\nAlso, to be complete: 401 - Unauthorized when the two way TLS authentication fails","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"* 200 OK - Operation was completed as requested."},{"line_number":38,"context_line":"* 201 Created - Operation successfully resulted in the creation / processing"},{"line_number":39,"context_line":"  of a file."},{"line_number":40,"context_line":"* 403 Invalid Request - API handler does not recognize the specified URL or"},{"line_number":41,"context_line":"  HTTP method."},{"line_number":42,"context_line":"* 404 Not Found - The requested file was not found."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_dc3df490","line":39,"in_reply_to":"5a890539_41032b73","updated":"2014-11-21 23:20:10.000000000","message":"Good point. I\u0027ll add them.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":49,"context_line":"--------------------------"},{"line_number":50,"context_line":"In the below API, it will become apparent that at times the amphora will need"},{"line_number":51,"context_line":"to be aware of the state of thing (topology-wise, or simply in terms running"},{"line_number":52,"context_line":"processes on the amphora). When it comes to storing or gathering this data, we"},{"line_number":53,"context_line":"should generally prefer to try to resolve these concerns in the following"},{"line_number":54,"context_line":"order. Note also that not every kind of state data will use all of the steps in"},{"line_number":55,"context_line":"this list:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_210fffe2","line":52,"updated":"2014-11-20 02:08:35.000000000","message":"NIT: grammar on this sentence is off.\nCan we be specific about what \"things\" the amphora will need to be aware of?","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":49,"context_line":"--------------------------"},{"line_number":50,"context_line":"In the below API, it will become apparent that at times the amphora will need"},{"line_number":51,"context_line":"to be aware of the state of thing (topology-wise, or simply in terms running"},{"line_number":52,"context_line":"processes on the amphora). When it comes to storing or gathering this data, we"},{"line_number":53,"context_line":"should generally prefer to try to resolve these concerns in the following"},{"line_number":54,"context_line":"order. Note also that not every kind of state data will use all of the steps in"},{"line_number":55,"context_line":"this list:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_1c121c09","line":52,"in_reply_to":"5a890539_210fffe2","updated":"2014-11-21 23:20:10.000000000","message":"Grammar fixed. Specific \"things\" about which the amphora needs to keep state are in context below. (This is not the right place to try to create an exhaustive list of these.)","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":61,"context_line":"   collect-- eg. package version listings.)"},{"line_number":62,"context_line":"3. Get state by consulting stored configuration data as sent by the controller."},{"line_number":63,"context_line":"   (ex. amphora topology, haproxy configuration or TLS certificate data)"},{"line_number":64,"context_line":"4. Get state by querying a controller API (not described here)."},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"In no case should the amphora assume it ever has direct access to the Octavia"},{"line_number":67,"context_line":"database. Also, sensitive data (like TLS certificates) should be stored in"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_e1b977ed","line":64,"updated":"2014-11-20 02:08:35.000000000","message":"I don\u0027t like this as an option.  I would like to see Amphora be self-sufficient as much as possible.\nThis also violates the security principle of having connections flow from more trusted systems to less trusted.  By having an Amphora be able to make calls up to the controller we are going less trusted to more trusted.\nIn other words, I would prefer to not have open ports on the controller if we can avoid it.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"169be8457efc129bbf5081a762603bff89374329","unresolved":false,"context_lines":[{"line_number":61,"context_line":"   collect-- eg. package version listings.)"},{"line_number":62,"context_line":"3. Get state by consulting stored configuration data as sent by the controller."},{"line_number":63,"context_line":"   (ex. amphora topology, haproxy configuration or TLS certificate data)"},{"line_number":64,"context_line":"4. Get state by querying a controller API (not described here)."},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"In no case should the amphora assume it ever has direct access to the Octavia"},{"line_number":67,"context_line":"database. Also, sensitive data (like TLS certificates) should be stored in"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_1af13c01","line":64,"in_reply_to":"5a890539_bcbbc8e3","updated":"2014-11-22 00:04:17.000000000","message":"I believe this will end up being a REST API, and the Amphorae should be validated by its Client Certificate after the initial setup (which would be validated by IP/network being expected -- IE, the IP belongs to an Amphora that is currently in \"BUILD\" state, but this is detailed in the TLS Security Overview spec).","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":61,"context_line":"   collect-- eg. package version listings.)"},{"line_number":62,"context_line":"3. Get state by consulting stored configuration data as sent by the controller."},{"line_number":63,"context_line":"   (ex. amphora topology, haproxy configuration or TLS certificate data)"},{"line_number":64,"context_line":"4. Get state by querying a controller API (not described here)."},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"In no case should the amphora assume it ever has direct access to the Octavia"},{"line_number":67,"context_line":"database. Also, sensitive data (like TLS certificates) should be stored in"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_bcbbc8e3","line":64,"in_reply_to":"5a890539_e1b977ed","updated":"2014-11-21 23:20:10.000000000","message":"I don\u0027t think we\u0027re going to be able to avoid making connections from the amphorae to the controllers if we want to communicate edge-transition events (like members going up or down) both in a timely and efficient manner. Poll-based notifications simply don\u0027t scale.\n\nSo in any case, the controller is going to be listening for connections from amphorae (even if only over a UDP socket).\n\nI agree that anything we expose in this manner needs extra scrutiny, and we should try to minimize the need for such down to a few well-understood and simple kinds of events.\n\nThis is also part of the reason this is the least desirable way for an amphora to discover state information.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"In no case should the amphora assume it ever has direct access to the Octavia"},{"line_number":67,"context_line":"database. Also, sensitive data (like TLS certificates) should be stored in"},{"line_number":68,"context_line":"a secure way (ex. memory filesystem)."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"\u003d\u003d\u003d"},{"line_number":71,"context_line":"API"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_41b08bf4","line":68,"updated":"2014-11-20 02:08:35.000000000","message":"We need to have more detail on what a \"secure way\" means.\n\nThis is probably details for the TLS/certs Controller-\u003eAmphora spec.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"In no case should the amphora assume it ever has direct access to the Octavia"},{"line_number":67,"context_line":"database. Also, sensitive data (like TLS certificates) should be stored in"},{"line_number":68,"context_line":"a secure way (ex. memory filesystem)."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"\u003d\u003d\u003d"},{"line_number":71,"context_line":"API"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_7c9c006b","line":68,"in_reply_to":"5a890539_41b08bf4","updated":"2014-11-21 23:20:10.000000000","message":"I would say that\u0027s beyond the scope of this specification. But the implication with my comment above is that at a very least secure information, when stored locally on the amphora, should only be put on volatile storage.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"169be8457efc129bbf5081a762603bff89374329","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"In no case should the amphora assume it ever has direct access to the Octavia"},{"line_number":67,"context_line":"database. Also, sensitive data (like TLS certificates) should be stored in"},{"line_number":68,"context_line":"a secure way (ex. memory filesystem)."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"\u003d\u003d\u003d"},{"line_number":71,"context_line":"API"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_fad6304e","line":68,"in_reply_to":"5a890539_7c9c006b","updated":"2014-11-22 00:04:17.000000000","message":"In talking with security people here, it seems that the general consensus is \"GREAT!\" if that\u0027s possible, but \"not a huge deal\" even if it isn\u0027t. So long as instances are properly shredded after deletion, the chances of someone getting access to the private filesystem of a VM (ie, via exploiting the hypervisor) is about as likely as someone getting access to the private memory of a VM.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":95,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":96,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":97,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":98,"context_line":"  routing IP address for ACTIVE-STANDBY pair."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"**Examples**"},{"line_number":101,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_4187ab0f","line":98,"updated":"2014-11-20 02:08:35.000000000","message":"This could be valid for ACTIVE-ACTIVE too as the ha-ip will be live on multiple hosts (under some HA methods).","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"169be8457efc129bbf5081a762603bff89374329","unresolved":false,"context_lines":[{"line_number":95,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":96,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":97,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":98,"context_line":"  routing IP address for ACTIVE-STANDBY pair."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"**Examples**"},{"line_number":101,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_5a73c47f","line":98,"in_reply_to":"5a890539_1c85bc06","updated":"2014-11-22 00:04:17.000000000","message":"Well, this will probably be up to the specific deployer, as I can say now that our implementation at RS will not operate the way you described (for example, no amphorae intercommunication necessary, and the ha-ip would not be the IP of the Amphora). In our implementation it *would* be just as valid to put the ACTIVE-ACTIVE Floating-IP here.\n\n... And not that it is directly relevant, but I don\u0027t know that we will even support ACTIVE-STANDBY.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":95,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":96,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":97,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":98,"context_line":"  routing IP address for ACTIVE-STANDBY pair."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"**Examples**"},{"line_number":101,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_1c85bc06","line":98,"in_reply_to":"5a890539_4187ab0f","updated":"2014-11-21 23:20:10.000000000","message":"In ACTIVE-ACTIVE, the IP you\u0027re describing is actually the load balancer VIP. In ACTIVE-STANDBY, the ha_ip is a third IP address that lives on the same layer-2 network segment as the two amphorae in the pair. The amphorae use corosync / pacemaker or linux heartbeat (or equivalent) to keep this IP address active on one of the nodes at all times so that sub-second failovers can happen (hopefully) without having to invoke anything special on the controller or anything else in the Octavia load balancing system.\n\nIs there another topology in ACTIVE-ACTIVE configurations which call for an extra IP address on the same layer-2 network segment as the amphorae?","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":123,"context_line":"  * *topology*: One of: SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":124,"context_line":"  * *role*: One of: ACTIVE, STANDBY"},{"line_number":125,"context_line":"  * *ha_ip*: (only applicable to ACTIVE-STANDBY) Highly-available IP for the"},{"line_number":126,"context_line":"    HA pair"},{"line_number":127,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"},{"line_number":128,"context_line":"    for authentication with other HA pair member"},{"line_number":129,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_813b5337","line":126,"updated":"2014-11-20 02:08:35.000000000","message":"Same question as above, we may need to pass this in for ACTIVE-ACTIVE","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":123,"context_line":"  * *topology*: One of: SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":124,"context_line":"  * *role*: One of: ACTIVE, STANDBY"},{"line_number":125,"context_line":"  * *ha_ip*: (only applicable to ACTIVE-STANDBY) Highly-available IP for the"},{"line_number":126,"context_line":"    HA pair"},{"line_number":127,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"},{"line_number":128,"context_line":"    for authentication with other HA pair member"},{"line_number":129,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_7cefa0b1","line":126,"in_reply_to":"5a890539_813b5337","updated":"2014-11-21 23:20:10.000000000","message":"See response above.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"1b6a01dfc44423e2c2ea7247290966815a31ff2c","unresolved":false,"context_lines":[{"line_number":125,"context_line":"  * *ha_ip*: (only applicable to ACTIVE-STANDBY) Highly-available IP for the"},{"line_number":126,"context_line":"    HA pair"},{"line_number":127,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"},{"line_number":128,"context_line":"    for authentication with other HA pair member"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"* **Success Response:**"},{"line_number":131,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_42084d2d","line":128,"updated":"2014-11-07 09:53:29.000000000","message":"Not sure this design has been explained. Why would we need a shared secret?","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":125,"context_line":"  * *ha_ip*: (only applicable to ACTIVE-STANDBY) Highly-available IP for the"},{"line_number":126,"context_line":"    HA pair"},{"line_number":127,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"},{"line_number":128,"context_line":"    for authentication with other HA pair member"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"* **Success Response:**"},{"line_number":131,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_9c1a8cc4","line":128,"in_reply_to":"5a890539_4d6d5904","updated":"2014-11-21 23:20:10.000000000","message":"The thought here is that both linux heartbeat and corosync / pacemaker use a shared secret for authentication between the two nodes in the highly available pair. The shared secret is specific to this way of maintaining a highly available IP address, though I don\u0027t know of any other method to do this that doesn\u0027t involve a passphrase, certificate, or some other kind of shared secret.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"169be8457efc129bbf5081a762603bff89374329","unresolved":false,"context_lines":[{"line_number":125,"context_line":"  * *ha_ip*: (only applicable to ACTIVE-STANDBY) Highly-available IP for the"},{"line_number":126,"context_line":"    HA pair"},{"line_number":127,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"},{"line_number":128,"context_line":"    for authentication with other HA pair member"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"* **Success Response:**"},{"line_number":131,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_1a0dbce8","line":128,"in_reply_to":"5a890539_9c1a8cc4","updated":"2014-11-22 00:04:17.000000000","message":"Yeah, I can think of other uses for a shared secret that is specific to each HA Set. It shouldn\u0027t hurt to have it, but I am hoping we can set it via nova personalities so it is provisioned at boot time for the Amphora and not at config time.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"ea3f9be56564270494d52cbb9230aa194530ba22","unresolved":false,"context_lines":[{"line_number":125,"context_line":"  * *ha_ip*: (only applicable to ACTIVE-STANDBY) Highly-available IP for the"},{"line_number":126,"context_line":"    HA pair"},{"line_number":127,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"},{"line_number":128,"context_line":"    for authentication with other HA pair member"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"* **Success Response:**"},{"line_number":131,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_4d6d5904","line":128,"in_reply_to":"7a8c0949_42084d2d","updated":"2014-11-07 17:19:11.000000000","message":"I am not 100% clear on this either -- I think it is probably right, and probably has something to do with HA Amphorae intercommunication, but I am not sure exactly how it is utilized, or if there are alternatives. Clarification would be good.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":126,"context_line":"    HA pair"},{"line_number":127,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"},{"line_number":128,"context_line":"    for authentication with other HA pair member"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"* **Success Response:**"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"  * Code: 200"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_e1033774","line":129,"updated":"2014-11-20 02:08:35.000000000","message":"Don\u0027t we need a way to tell the Amphora where it\u0027s primary controller is?\nI thought you were going to have it send the UDP messages to the controller that owns it, for health monitoring, etc.\nThat information probably needs to be returned in the get topology call as well.  Who it thinks it\u0027s primary controller is.\n\nMaybe this is another setting.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"169be8457efc129bbf5081a762603bff89374329","unresolved":false,"context_lines":[{"line_number":126,"context_line":"    HA pair"},{"line_number":127,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"},{"line_number":128,"context_line":"    for authentication with other HA pair member"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"* **Success Response:**"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"  * Code: 200"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_fa32b0a5","line":129,"in_reply_to":"5a890539_dc66d450","updated":"2014-11-22 00:04:17.000000000","message":"I have quite a number of comments on this, but I think it\u0027s going to have to wait until the meetup so we can do an appropriate amount of whiteboarding and high-bandwidth discussion. I think the solution we are envisioning now WOULD require an API endpoint for this, which means it would be relevant to this BP, but it can always be brought up in another spec update BP and this can be patched.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":126,"context_line":"    HA pair"},{"line_number":127,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"},{"line_number":128,"context_line":"    for authentication with other HA pair member"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"* **Success Response:**"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"  * Code: 200"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_dc66d450","line":129,"in_reply_to":"5a890539_e1033774","updated":"2014-11-21 23:20:10.000000000","message":"Again, the UDP portion of communication between the amphora and controller is not covered in this specification.\n\nAlso, we only need to tell the amphora which controller to talk to once we move to Octavia v1 territory (ie. when there\u0027s more than one controller). For v0.5, we could simply use a well known address for this initially.  (And even when we move to v1 and beyond, bootstrapping amphorae will still probably send \"I\u0027m alive!\" messages to a well-known address until they\u0027re told otherwise.)","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"d41452377a21c13f24aef518bf351198d6998774","unresolved":false,"context_lines":[{"line_number":129,"context_line":""},{"line_number":130,"context_line":"* **Success Response:**"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"  * Code: 200"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"    * Content: OK"},{"line_number":135,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_42bc49bb","line":132,"updated":"2014-10-28 20:05:06.000000000","message":"Per discussion in IRC, this might become an async call, so 202 would be appropriate.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"1b6a01dfc44423e2c2ea7247290966815a31ff2c","unresolved":false,"context_lines":[{"line_number":129,"context_line":""},{"line_number":130,"context_line":"* **Success Response:**"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"  * Code: 200"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"    * Content: OK"},{"line_number":135,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_b503ed0b","line":132,"in_reply_to":"9aa7fdbe_42bc49bb","updated":"2014-11-07 09:53:29.000000000","message":"+1 (and please make sure to add 202 also at the HHTP list in the beginning of the doc)","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":158,"context_line":"topology change is initiated, and the amphora status changes from \"OK\" to"},{"line_number":159,"context_line":"\"TOPOLOGY-CHANGE\". The controller should not try to change any resources during"},{"line_number":160,"context_line":"this transition. (Any attempts will be met with an error.) Once the"},{"line_number":161,"context_line":"topology change is complete, amphora status should return to \"OK\"."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"**Examples**"},{"line_number":164,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_e15fb773","line":161,"updated":"2014-11-20 02:08:35.000000000","message":"Hmm, should a message come back via UDP updating the state?","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":158,"context_line":"topology change is initiated, and the amphora status changes from \"OK\" to"},{"line_number":159,"context_line":"\"TOPOLOGY-CHANGE\". The controller should not try to change any resources during"},{"line_number":160,"context_line":"this transition. (Any attempts will be met with an error.) Once the"},{"line_number":161,"context_line":"topology change is complete, amphora status should return to \"OK\"."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"**Examples**"},{"line_number":164,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_5c002434","line":161,"in_reply_to":"5a890539_e15fb773","updated":"2014-11-21 23:20:10.000000000","message":"I think so; That saves the controller from having to poll for it.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":273,"context_line":"  * user"},{"line_number":274,"context_line":"  * system"},{"line_number":275,"context_line":"  * soft_irq"},{"line_number":276,"context_line":""},{"line_number":277,"context_line":"* *load* - System load (list)"},{"line_number":278,"context_line":"* *topology* - One of SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":279,"context_line":"* *topology_status* - One of OK, TOPOLOGY-CHANGE"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_219fff04","line":276,"updated":"2014-11-20 02:08:35.000000000","message":"Can we get memory utilization here too? (used, free, swap[hope not], etc.)\n\nConnections and multiple haproxy processes \u003d memory use\n\nIf I remember right there is 17k per connection in buffers alone for haproxy\n\nWhat about disk space for things like logs, certs, config files, etc.?","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":273,"context_line":"  * user"},{"line_number":274,"context_line":"  * system"},{"line_number":275,"context_line":"  * soft_irq"},{"line_number":276,"context_line":""},{"line_number":277,"context_line":"* *load* - System load (list)"},{"line_number":278,"context_line":"* *topology* - One of SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":279,"context_line":"* *topology_status* - One of OK, TOPOLOGY-CHANGE"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_fcb39097","line":276,"in_reply_to":"5a890539_219fff04","updated":"2014-11-21 23:20:10.000000000","message":"Yep, these are good ideas too, eh!","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":279,"context_line":"* *topology_status* - One of OK, TOPOLOGY-CHANGE"},{"line_number":280,"context_line":"* *listeners* - list of listener UUIDs being serviced by this amphora"},{"line_number":281,"context_line":"* *packages* - list of load-balancing related packages installed with versions"},{"line_number":282,"context_line":"  (eg. OpenSSL, haproxy, nginx, etc.)"},{"line_number":283,"context_line":""},{"line_number":284,"context_line":"**Notes:** The data in this request is meant to provide intelligence for an"},{"line_number":285,"context_line":"auto-scaling orchestration controller (heat) in order to determine whether"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_a1a92f26","line":282,"updated":"2014-11-20 02:08:35.000000000","message":"Interesting.\nI think we need to list these in an appendix or something, otherwise it could become a complete list of every package.\nAlso we should specify the format here and not just in the example.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":279,"context_line":"* *topology_status* - One of OK, TOPOLOGY-CHANGE"},{"line_number":280,"context_line":"* *listeners* - list of listener UUIDs being serviced by this amphora"},{"line_number":281,"context_line":"* *packages* - list of load-balancing related packages installed with versions"},{"line_number":282,"context_line":"  (eg. OpenSSL, haproxy, nginx, etc.)"},{"line_number":283,"context_line":""},{"line_number":284,"context_line":"**Notes:** The data in this request is meant to provide intelligence for an"},{"line_number":285,"context_line":"auto-scaling orchestration controller (heat) in order to determine whether"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_dc509434","line":282,"in_reply_to":"5a890539_a1a92f26","updated":"2014-11-21 23:20:10.000000000","message":"I think having an index or authoritative list of what packages we\u0027re going to list is not a bad idea... but I\u0027m reluctant to try to define that list at specification time, when it\u0027s likely the list is going to change as we write the back-end scripts and whatnot which run on the amphora.\n\nAnd... the format here is pretty simple; I don\u0027t think there\u0027s anything about it one couldn\u0027t learn from the examples below.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":406,"context_line":"* *provisioning_status* - One of: ACTIVE, PENDING_CREATE, PENDING_UPDATE,"},{"line_number":407,"context_line":"  PENDING_DELETE, DELETED, ERROR"},{"line_number":408,"context_line":"* *type* - One of: TCP, HTTP, TERMINATED_HTTPS"},{"line_number":409,"context_line":"* *pools* - Map of pool UUIDs and their overall UP / DOWN status"},{"line_number":410,"context_line":"* *members* - Map of member UUIDs and their overall UP / DOWN status"},{"line_number":411,"context_line":""},{"line_number":412,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_3c0e4635","line":409,"updated":"2014-11-20 02:08:35.000000000","message":"We may have talked about this already, but shouldn\u0027t their be a third state for the pool?  Something like DEGRADED?","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":406,"context_line":"* *provisioning_status* - One of: ACTIVE, PENDING_CREATE, PENDING_UPDATE,"},{"line_number":407,"context_line":"  PENDING_DELETE, DELETED, ERROR"},{"line_number":408,"context_line":"* *type* - One of: TCP, HTTP, TERMINATED_HTTPS"},{"line_number":409,"context_line":"* *pools* - Map of pool UUIDs and their overall UP / DOWN status"},{"line_number":410,"context_line":"* *members* - Map of member UUIDs and their overall UP / DOWN status"},{"line_number":411,"context_line":""},{"line_number":412,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_ffc70296","line":409,"in_reply_to":"5a890539_3c0e4635","updated":"2014-11-21 23:20:10.000000000","message":"I\u0027m not sure we have talked about this, but I\u0027ve definitely considered it, and I think \u0027DEGRADED\u0027 probably does make sense...  the question is, what does \u0027DEGRADED\u0027 actually mean?\n\n\u0027DEGRADED\u0027 could mean that at least one member is down... but then with very large pools, it\u0027s unlikely there won\u0027t be a time when at least one member is down.\n\n\u0027DEGRADED\u0027 could mean that all the regular members are down, and we\u0027re now only using \u0027backup\u0027 members of the pool.\n\n\u0027DEGRADED\u0027 could also mean that we\u0027re beyond a certain threshold of down servers. In which case, we either need to hard-code a threshold (percentage? Say, \u003e10% members down and you\u0027re \u0027DEGRADED\u0027?) or we need a way for the user to set this herself. Given how hard it is to make changes to the user API, and how little we really want to expose to the user about the implementation details of the load balancer, having this be a configurable parameter is going to be an uphill battle.\n\nI\u0027ll add \u0027DEGRADED\u0027 in as a possible pool state, but we need to define what it actually means.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"d41452377a21c13f24aef518bf351198d6998774","unresolved":false,"context_lines":[{"line_number":457,"context_line":"Start or Stop a listener"},{"line_number":458,"context_line":"------------------------"},{"line_number":459,"context_line":""},{"line_number":460,"context_line":"* **URL:** /*:version*/listeners/*:listener*?action\u003d *:action*"},{"line_number":461,"context_line":"* **Method:** PUT"},{"line_number":462,"context_line":"* **URL params:**"},{"line_number":463,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_e2f0dd92","line":460,"updated":"2014-10-28 20:05:06.000000000","message":"I still think this URL is better:\n\n/*:version*/listeners/*:listener*/*:action*\n\nbecause a PUT to a specific listener seems like it would be updating the listener details, and not an action to it.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":457,"context_line":"Start or Stop a listener"},{"line_number":458,"context_line":"------------------------"},{"line_number":459,"context_line":""},{"line_number":460,"context_line":"* **URL:** /*:version*/listeners/*:listener*?action\u003d *:action*"},{"line_number":461,"context_line":"* **Method:** PUT"},{"line_number":462,"context_line":"* **URL params:**"},{"line_number":463,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_9fb8be12","line":460,"in_reply_to":"5a890539_5c3952d7","updated":"2014-11-21 23:20:10.000000000","message":"I like Brandon\u0027s suggestion, eh.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":457,"context_line":"Start or Stop a listener"},{"line_number":458,"context_line":"------------------------"},{"line_number":459,"context_line":""},{"line_number":460,"context_line":"* **URL:** /*:version*/listeners/*:listener*?action\u003d *:action*"},{"line_number":461,"context_line":"* **Method:** PUT"},{"line_number":462,"context_line":"* **URL params:**"},{"line_number":463,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_5c3952d7","line":460,"in_reply_to":"5a890539_8d7661d7","updated":"2014-11-20 02:08:35.000000000","message":"I think this form is ok.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"ea3f9be56564270494d52cbb9230aa194530ba22","unresolved":false,"context_lines":[{"line_number":457,"context_line":"Start or Stop a listener"},{"line_number":458,"context_line":"------------------------"},{"line_number":459,"context_line":""},{"line_number":460,"context_line":"* **URL:** /*:version*/listeners/*:listener*?action\u003d *:action*"},{"line_number":461,"context_line":"* **Method:** PUT"},{"line_number":462,"context_line":"* **URL params:**"},{"line_number":463,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_8d7661d7","line":460,"in_reply_to":"9aa7fdbe_e2f0dd92","updated":"2014-11-07 17:19:11.000000000","message":"I agree.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":489,"context_line":""},{"line_number":490,"context_line":"  * Code: 503"},{"line_number":491,"context_line":""},{"line_number":492,"context_line":"    * Content: Topology transition in progress"},{"line_number":493,"context_line":""},{"line_number":494,"context_line":"* **Response:**"},{"line_number":495,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_3cf806e5","line":492,"updated":"2014-11-20 02:08:35.000000000","message":"These worry me.  We will need to be careful how the controller handles these.  I could see a rapid deployment or configuration change becoming a queuing issue on the controller.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":489,"context_line":""},{"line_number":490,"context_line":"  * Code: 503"},{"line_number":491,"context_line":""},{"line_number":492,"context_line":"    * Content: Topology transition in progress"},{"line_number":493,"context_line":""},{"line_number":494,"context_line":"* **Response:**"},{"line_number":495,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_9f66feb9","line":492,"in_reply_to":"5a890539_3cf806e5","updated":"2014-11-21 23:20:10.000000000","message":"I agree-- things could get really complicated in a rapid deployment or fast-scaling scenario. Do you have any suggestions on how we can avoid choking on a bottleneck around cluster topology transitions?","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":595,"context_line":"  * Stop listener"},{"line_number":596,"context_line":"  * Delete IPs, iptables accounting rules, etc. from this amphora if they\u0027re no"},{"line_number":597,"context_line":"    longer in use."},{"line_number":598,"context_line":"  * Clean up listener configuration directory."},{"line_number":599,"context_line":""},{"line_number":600,"context_line":"**Examples**"},{"line_number":601,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_bce31632","line":598,"updated":"2014-11-20 02:08:35.000000000","message":"Clean up logs\n\nRemove stats socket","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":595,"context_line":"  * Stop listener"},{"line_number":596,"context_line":"  * Delete IPs, iptables accounting rules, etc. from this amphora if they\u0027re no"},{"line_number":597,"context_line":"    longer in use."},{"line_number":598,"context_line":"  * Clean up listener configuration directory."},{"line_number":599,"context_line":""},{"line_number":600,"context_line":"**Examples**"},{"line_number":601,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_7f0072ab","line":598,"in_reply_to":"5a890539_bce31632","updated":"2014-11-21 23:20:10.000000000","message":"Good catch.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":643,"context_line":"  * *:filename* \u003d PEM filename (see notes below for naming convention)"},{"line_number":644,"context_line":""},{"line_number":645,"context_line":"* **Data params:** Certificate data. (PEM file should be a concatenation of"},{"line_number":646,"context_line":"  unencrypted RSA key, certificate and chain, in that order)"},{"line_number":647,"context_line":"* **Success Response:**"},{"line_number":648,"context_line":""},{"line_number":649,"context_line":"  * Code: 201"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_fcd75e21","line":646,"updated":"2014-11-20 02:08:35.000000000","message":"Should these be unencrypted?\n\nI worry about the data being at rest on \"cloud storage\" unencrypted.\nI.e. drives walk, volumes get mis-mounted, etc.\n\nIt seems like even a cheesy key stored in the Amphora config is better than having this data rest unencrypted.  Best would probably be having the decrypt key not live on the Amphora at all, but be requested.\n\nDoes the order of intermediate certs matter?","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"169be8457efc129bbf5081a762603bff89374329","unresolved":false,"context_lines":[{"line_number":643,"context_line":"  * *:filename* \u003d PEM filename (see notes below for naming convention)"},{"line_number":644,"context_line":""},{"line_number":645,"context_line":"* **Data params:** Certificate data. (PEM file should be a concatenation of"},{"line_number":646,"context_line":"  unencrypted RSA key, certificate and chain, in that order)"},{"line_number":647,"context_line":"* **Success Response:**"},{"line_number":648,"context_line":""},{"line_number":649,"context_line":"  * Code: 201"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_5ae824e2","line":646,"in_reply_to":"5a890539_bfa2daab","updated":"2014-11-22 00:04:17.000000000","message":"Per above and per my discussions with others, I don\u0027t know if it matters a whole lot, but I think we can get away with RAMdisk or pushing them straight into a running HAProxy instance.\n\nWith regard to starts/restarts of the HAProxy service, I am leaning more and more towards the idea that an Amphora is a one-time configuration, and any change to the HAProxy config should just spawn a new Amphora. We can discuss this, but the idea came from our Ops guy originally, and I think it would simplify a lot of things.\n\nOrder for intermediates does matter, and I believe that part of our validation of the TLS Data when the user passes it in (directly or via Barbican) will be to check the chain, if possible.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":643,"context_line":"  * *:filename* \u003d PEM filename (see notes below for naming convention)"},{"line_number":644,"context_line":""},{"line_number":645,"context_line":"* **Data params:** Certificate data. (PEM file should be a concatenation of"},{"line_number":646,"context_line":"  unencrypted RSA key, certificate and chain, in that order)"},{"line_number":647,"context_line":"* **Success Response:**"},{"line_number":648,"context_line":""},{"line_number":649,"context_line":"  * Code: 201"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_bfa2daab","line":646,"in_reply_to":"5a890539_fcd75e21","updated":"2014-11-21 23:20:10.000000000","message":"So, this was what was implied when I said these secrets need to be stored in some \u0027secure\u0027 way. Specifically, I\u0027m thinking these should go onto a RAM disk, and if we\u0027re really paranoid, make sure the amphora is using an encrypted swap partition.\n\nThe reason I don\u0027t want to encrypt the RSA key on disk is because this is annoying to deal with for automated starts / restarts of the service. Yes, we could potentially use the same passphrase for all certs, but this is likely to become a very well-known (and unchangeable) string in a given operator\u0027s organization-- meaning it provides the illusion of security without actually being secure... which is a worse position to be in, IMO. The right way to go about this is to ensure the unencrypted key is never written unencrypted to non-volatile storage, which we can ensure by using a memory filesystem and encrypted swap for storing key data.\n\nOrder of intermediate certs might matter to some browsers, but I think it\u0027s beyond the scope of Octavia to have to deal with this. If the user didn\u0027t upload the intermediate certs in the correct order, that\u0027s their own fault, eh.  The only thing important here is that the intermediate certs must come after the actual cert in use for the connection.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"29e3ad5a9bb9cfffb70a9026210cc911d712e873","unresolved":false,"context_lines":[{"line_number":771,"context_line":""},{"line_number":772,"context_line":"* **Response:**"},{"line_number":773,"context_line":""},{"line_number":774,"context_line":"| -----BEGIN RSA PRIVATE KEY-----"},{"line_number":775,"context_line":"| MIICXQI...(cut for brevity)"},{"line_number":776,"context_line":"| -----END RSA PRIVATE KEY-----"},{"line_number":777,"context_line":"| -----BEGIN CERTIFICATE-----"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_56450641","line":774,"updated":"2014-10-28 02:52:16.000000000","message":"We should not allow egress of confidential SSL data. Fetching the certificate is ok, fetching the PK should not be possible.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":771,"context_line":""},{"line_number":772,"context_line":"* **Response:**"},{"line_number":773,"context_line":""},{"line_number":774,"context_line":"| -----BEGIN RSA PRIVATE KEY-----"},{"line_number":775,"context_line":"| MIICXQI...(cut for brevity)"},{"line_number":776,"context_line":"| -----END RSA PRIVATE KEY-----"},{"line_number":777,"context_line":"| -----BEGIN CERTIFICATE-----"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_df95e633","line":774,"in_reply_to":"5a890539_1ce7cae5","updated":"2014-11-21 23:20:10.000000000","message":"TBH, I could see the controller wanting to know some meta-data about the certificate (eg. md5sum) to know whether it\u0027s got a \"current\" version of the certificate stored (and, therefore, can short-circuit replacing the cert too frequently). So, I\u0027mma change this method to do that instead.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"169be8457efc129bbf5081a762603bff89374329","unresolved":false,"context_lines":[{"line_number":771,"context_line":""},{"line_number":772,"context_line":"* **Response:**"},{"line_number":773,"context_line":""},{"line_number":774,"context_line":"| -----BEGIN RSA PRIVATE KEY-----"},{"line_number":775,"context_line":"| MIICXQI...(cut for brevity)"},{"line_number":776,"context_line":"| -----END RSA PRIVATE KEY-----"},{"line_number":777,"context_line":"| -----BEGIN CERTIFICATE-----"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_fac0f051","line":774,"in_reply_to":"5a890539_df95e633","updated":"2014-11-22 00:04:17.000000000","message":"I think per my comment above regarding \"Amphorae are one-time configurable\", that would not be needed, any updates would create a new Amphora anyway. I think even if we didn\u0027t choose to go that route, this would still be unnecessary, because we will really want to pass a whole config every time anyway, not do anything stateful with HAProxy.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":771,"context_line":""},{"line_number":772,"context_line":"* **Response:**"},{"line_number":773,"context_line":""},{"line_number":774,"context_line":"| -----BEGIN RSA PRIVATE KEY-----"},{"line_number":775,"context_line":"| MIICXQI...(cut for brevity)"},{"line_number":776,"context_line":"| -----END RSA PRIVATE KEY-----"},{"line_number":777,"context_line":"| -----BEGIN CERTIFICATE-----"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_1ce7cae5","line":774,"in_reply_to":"7a8c0949_d5e95981","updated":"2014-11-20 02:08:35.000000000","message":"+1 for remove this method","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"1b6a01dfc44423e2c2ea7247290966815a31ff2c","unresolved":false,"context_lines":[{"line_number":771,"context_line":""},{"line_number":772,"context_line":"* **Response:**"},{"line_number":773,"context_line":""},{"line_number":774,"context_line":"| -----BEGIN RSA PRIVATE KEY-----"},{"line_number":775,"context_line":"| MIICXQI...(cut for brevity)"},{"line_number":776,"context_line":"| -----END RSA PRIVATE KEY-----"},{"line_number":777,"context_line":"| -----BEGIN CERTIFICATE-----"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_d5e95981","line":774,"in_reply_to":"9aa7fdbe_1cae3d2e","updated":"2014-11-07 09:53:29.000000000","message":"+!","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"dff94f463ace24d0b92458b98ac4d2a440091602","unresolved":false,"context_lines":[{"line_number":771,"context_line":""},{"line_number":772,"context_line":"* **Response:**"},{"line_number":773,"context_line":""},{"line_number":774,"context_line":"| -----BEGIN RSA PRIVATE KEY-----"},{"line_number":775,"context_line":"| MIICXQI...(cut for brevity)"},{"line_number":776,"context_line":"| -----END RSA PRIVATE KEY-----"},{"line_number":777,"context_line":"| -----BEGIN CERTIFICATE-----"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_f6743a69","line":774,"in_reply_to":"9aa7fdbe_56450641","updated":"2014-10-28 03:06:46.000000000","message":"I don\u0027t want the amphora to have to parse out the certificate (or strip the key, or whatever). I\u0027d be more OK with extracting meta-data on the certificate and returning that for the retrieval method instead of the raw data. But this begs the question:\n\nWhy do we even need the retrieval method? Realistically, any controller that wants to make sure the amphora is running a specific version of a given certificate is going to just over-write whatever\u0027s there anyway, eh.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"563d839ec9850af222469fc9f2d90b8b51c570ea","unresolved":false,"context_lines":[{"line_number":771,"context_line":""},{"line_number":772,"context_line":"* **Response:**"},{"line_number":773,"context_line":""},{"line_number":774,"context_line":"| -----BEGIN RSA PRIVATE KEY-----"},{"line_number":775,"context_line":"| MIICXQI...(cut for brevity)"},{"line_number":776,"context_line":"| -----END RSA PRIVATE KEY-----"},{"line_number":777,"context_line":"| -----BEGIN CERTIFICATE-----"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_1cae3d2e","line":774,"in_reply_to":"9aa7fdbe_f6743a69","updated":"2014-10-28 06:01:26.000000000","message":"Yes, we could probably just remove this entire method. I can\u0027t think of a good reason to fetch anything related to the certificate. When in doubt, overwrite.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"29e3ad5a9bb9cfffb70a9026210cc911d712e873","unresolved":false,"context_lines":[{"line_number":788,"context_line":""},{"line_number":789,"context_line":"  Response is the raw certificate data (not JSON encoded):"},{"line_number":790,"context_line":""},{"line_number":791,"context_line":"  -----BEGIN RSA PRIVATE KEY-----"},{"line_number":792,"context_line":"  MIICXQI...(cut for brevity)"},{"line_number":793,"context_line":"  -----END RSA PRIVATE KEY-----"},{"line_number":794,"context_line":"  -----BEGIN CERTIFICATE-----"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_76776aa0","line":791,"updated":"2014-10-28 02:52:16.000000000","message":"Same.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"1b6a01dfc44423e2c2ea7247290966815a31ff2c","unresolved":false,"context_lines":[{"line_number":804,"context_line":"    \u0027message\u0027: \u0027Not Found\u0027,"},{"line_number":805,"context_line":"  }"},{"line_number":806,"context_line":""},{"line_number":807,"context_line":"Delete SSL certificate PEM file"},{"line_number":808,"context_line":"-------------------------------"},{"line_number":809,"context_line":""},{"line_number":810,"context_line":"* **URL:** /*:version*/listeners/*:listener*/certificates/*:filename.pem*"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_55aba91c","line":807,"updated":"2014-11-07 09:53:29.000000000","message":"Needed? Can\u0027t we leave it laying around if we don\u0027t use it. Kust trying to make things simpler...","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":804,"context_line":"    \u0027message\u0027: \u0027Not Found\u0027,"},{"line_number":805,"context_line":"  }"},{"line_number":806,"context_line":""},{"line_number":807,"context_line":"Delete SSL certificate PEM file"},{"line_number":808,"context_line":"-------------------------------"},{"line_number":809,"context_line":""},{"line_number":810,"context_line":"* **URL:** /*:version*/listeners/*:listener*/certificates/*:filename.pem*"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_3c3ac636","line":807,"in_reply_to":"5a890539_2d4f2d94","updated":"2014-11-20 02:08:35.000000000","message":"We should be able to delete the certs and keys.\n\nPlus it frees up disk space","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":804,"context_line":"    \u0027message\u0027: \u0027Not Found\u0027,"},{"line_number":805,"context_line":"  }"},{"line_number":806,"context_line":""},{"line_number":807,"context_line":"Delete SSL certificate PEM file"},{"line_number":808,"context_line":"-------------------------------"},{"line_number":809,"context_line":""},{"line_number":810,"context_line":"* **URL:** /*:version*/listeners/*:listener*/certificates/*:filename.pem*"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_df7fa6de","line":807,"in_reply_to":"5a890539_3c3ac636","updated":"2014-11-21 23:20:10.000000000","message":"Agreed, we should be able to delete things. Also, \u0027certificate PEM file\u0027 is actually concatenation of key, cert and chain (as explained earlier).","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"169be8457efc129bbf5081a762603bff89374329","unresolved":false,"context_lines":[{"line_number":804,"context_line":"    \u0027message\u0027: \u0027Not Found\u0027,"},{"line_number":805,"context_line":"  }"},{"line_number":806,"context_line":""},{"line_number":807,"context_line":"Delete SSL certificate PEM file"},{"line_number":808,"context_line":"-------------------------------"},{"line_number":809,"context_line":""},{"line_number":810,"context_line":"* **URL:** /*:version*/listeners/*:listener*/certificates/*:filename.pem*"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_1ab21c06","line":807,"in_reply_to":"5a890539_df7fa6de","updated":"2014-11-22 00:04:17.000000000","message":"Again per above, I think if there is a change to the LB, especially significant enough to that it no longer needs the TLS data, we\u0027re going to end up nuking the whole Amphora anyway. Even if we don\u0027t, updating the config should wipe everything about the old config and completely replace it with a new config, including any additional data, so again this wouldn\u0027t be necessary.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"ea3f9be56564270494d52cbb9230aa194530ba22","unresolved":false,"context_lines":[{"line_number":804,"context_line":"    \u0027message\u0027: \u0027Not Found\u0027,"},{"line_number":805,"context_line":"  }"},{"line_number":806,"context_line":""},{"line_number":807,"context_line":"Delete SSL certificate PEM file"},{"line_number":808,"context_line":"-------------------------------"},{"line_number":809,"context_line":""},{"line_number":810,"context_line":"* **URL:** /*:version*/listeners/*:listener*/certificates/*:filename.pem*"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_2d4f2d94","line":807,"in_reply_to":"7a8c0949_55aba91c","updated":"2014-11-07 17:19:11.000000000","message":"If it\u0027s just the certificate and not the private key, probably would be fine -- if it\u0027s both, then it could be good to have a way to nuke the old data to limit exposure. It is worded like it is certificate specific, but I am not sure why it wouldn\u0027t have been both.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":833,"context_line":""},{"line_number":834,"context_line":"* **Implied actions:**"},{"line_number":835,"context_line":""},{"line_number":836,"context_line":"  * Clean up listener configuration directory if it\u0027s now empty."},{"line_number":837,"context_line":""},{"line_number":838,"context_line":"**Examples:**"},{"line_number":839,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_9cf1fa97","line":836,"updated":"2014-11-20 02:08:35.000000000","message":"Any concurrency issue with other config changes?  Example the configuration is being rebuilt.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":833,"context_line":""},{"line_number":834,"context_line":"* **Implied actions:**"},{"line_number":835,"context_line":""},{"line_number":836,"context_line":"  * Clean up listener configuration directory if it\u0027s now empty."},{"line_number":837,"context_line":""},{"line_number":838,"context_line":"**Examples:**"},{"line_number":839,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_df66c650","line":836,"in_reply_to":"5a890539_9cf1fa97","updated":"2014-11-21 23:20:10.000000000","message":"If the haproxy.cfg is being rebuilt, the old version will continue to be in the configuration directory until it\u0027s replaced by the new version. (In this scenario, there is never a time when the config directory is empty.)","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4f23e0d75ef26de994f34f5143bb7b79731667e6","unresolved":false,"context_lines":[{"line_number":907,"context_line":"* **Implied actions:**"},{"line_number":908,"context_line":""},{"line_number":909,"context_line":"  * Do a syntax check on haproxy configuration file prior to an attempt to"},{"line_number":910,"context_line":"    run it."},{"line_number":911,"context_line":"  * Add IPs, iptables accounting rules, etc. to this amphora if they\u0027re"},{"line_number":912,"context_line":"    not already present."},{"line_number":913,"context_line":"  * Start or restart haproxy listener."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_dc78e2fa","line":910,"updated":"2014-11-20 02:08:35.000000000","message":"Validate that the required certificates are present.\n\nHAProxy won\u0027t start if they are missing.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"625ed05c89c0eda4139e12398c513e4dcaa1c855","unresolved":false,"context_lines":[{"line_number":907,"context_line":"* **Implied actions:**"},{"line_number":908,"context_line":""},{"line_number":909,"context_line":"  * Do a syntax check on haproxy configuration file prior to an attempt to"},{"line_number":910,"context_line":"    run it."},{"line_number":911,"context_line":"  * Add IPs, iptables accounting rules, etc. to this amphora if they\u0027re"},{"line_number":912,"context_line":"    not already present."},{"line_number":913,"context_line":"  * Start or restart haproxy listener."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_7f4b12b1","line":910,"in_reply_to":"5a890539_dc78e2fa","updated":"2014-11-21 23:20:10.000000000","message":"I think a syntax check of the haproxy.cfg does this. But I could be wrong. We\u0027ll need to discover this in testing, and if a syntax check doesn\u0027t check for the existence of the certificate PEM files, then yes, we\u0027ll have to add an explicit check for the same.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"29e3ad5a9bb9cfffb70a9026210cc911d712e873","unresolved":false,"context_lines":[{"line_number":912,"context_line":"    not already present."},{"line_number":913,"context_line":"  * Start or restart haproxy listener."},{"line_number":914,"context_line":""},{"line_number":915,"context_line":"**Notes:** The uploaded configuration file should be a complete and"},{"line_number":916,"context_line":"syntactically-correct haproxy config. The amphora does not have intelligence"},{"line_number":917,"context_line":"to generate these itself and has only rudimentary ability to parse certain"},{"line_number":918,"context_line":"features out of the configuration file (like bind addresses and ports for"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_96a12efa","line":915,"updated":"2014-10-28 02:52:16.000000000","message":"Did we officially wrap up discussion of whether the config is generated in the driver or on the amphora? This is the driver-generated config model, but there is something to be said for keeping the driver generic and communicating with a more abstracted language, and having the Amphora API build the config (since it\u0027ll be sitting around anyway). That would allow Amphorae of differing types to be flipped around seamlessly in the background if that were necessary/warranted. I think German was advocating that model previously as well?","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"563d839ec9850af222469fc9f2d90b8b51c570ea","unresolved":false,"context_lines":[{"line_number":912,"context_line":"    not already present."},{"line_number":913,"context_line":"  * Start or restart haproxy listener."},{"line_number":914,"context_line":""},{"line_number":915,"context_line":"**Notes:** The uploaded configuration file should be a complete and"},{"line_number":916,"context_line":"syntactically-correct haproxy config. The amphora does not have intelligence"},{"line_number":917,"context_line":"to generate these itself and has only rudimentary ability to parse certain"},{"line_number":918,"context_line":"features out of the configuration file (like bind addresses and ports for"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_7c66692b","line":915,"in_reply_to":"9aa7fdbe_76612aa8","updated":"2014-10-28 06:01:26.000000000","message":"Yeah, #3 is the real kicker.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"dff94f463ace24d0b92458b98ac4d2a440091602","unresolved":false,"context_lines":[{"line_number":912,"context_line":"    not already present."},{"line_number":913,"context_line":"  * Start or restart haproxy listener."},{"line_number":914,"context_line":""},{"line_number":915,"context_line":"**Notes:** The uploaded configuration file should be a complete and"},{"line_number":916,"context_line":"syntactically-correct haproxy config. The amphora does not have intelligence"},{"line_number":917,"context_line":"to generate these itself and has only rudimentary ability to parse certain"},{"line_number":918,"context_line":"features out of the configuration file (like bind addresses and ports for"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_76612aa8","line":915,"in_reply_to":"9aa7fdbe_96a12efa","updated":"2014-10-28 03:06:46.000000000","message":"Yes, we did draw that discussion to a close. We even voted on it.\n\nThe reason behind rendering the haproxy config in the controller is:\n\n1) Drivers should be specific to the type of amphora. If you want to write an haproxy-based amphora, that means you\u0027re going to be writing a new driver, too.\n\n2) Centralize intelligence, decentralize workload.\n\n3) If you need to make a minor change to the haproxy configuration template, it\u0027s easier to update a few dozen controllers rather than 10,000+ amphorae.\n\n4) If we\u0027re exposing nitty-gritty details, not only do we have to do a lot more sanity checking and error handling on the amphora, but even minor feature changes require an update to this API. This retards progress on feature enhancements.\n\n5) The generic interface is the front-end of the driver (ie. base class and methods which get filled in by a given driver), behind the driver (where this API lives), we should be implementation-specific.\n\nI\u0027m not interested in re-hashing this discussion, as we\u0027ve already spent over a week on it in the past.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"29e3ad5a9bb9cfffb70a9026210cc911d712e873","unresolved":false,"context_lines":[{"line_number":993,"context_line":"  GET URL:"},{"line_number":994,"context_line":"  https://octavia-haproxy-img-00328.local/v0.1/listeners/7e9f91eb-b3e6-4e3b-a1a7-d6f7fdc1de7c/haproxy"},{"line_number":995,"context_line":""},{"line_number":996,"context_line":"  Response is the raw haproxy.cfg:"},{"line_number":997,"context_line":""},{"line_number":998,"context_line":"  # Config file for 7e9f91eb-b3e6-4e3b-a1a7-d6f7fdc1de7c"},{"line_number":999,"context_line":"  (cut for brevity)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9aa7fdbe_d6a73609","line":996,"updated":"2014-10-28 02:52:16.000000000","message":"And the other side of the coin, continuing from the argument above.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"ea3f9be56564270494d52cbb9230aa194530ba22","unresolved":false,"context_lines":[{"line_number":993,"context_line":"  GET URL:"},{"line_number":994,"context_line":"  https://octavia-haproxy-img-00328.local/v0.1/listeners/7e9f91eb-b3e6-4e3b-a1a7-d6f7fdc1de7c/haproxy"},{"line_number":995,"context_line":""},{"line_number":996,"context_line":"  Response is the raw haproxy.cfg:"},{"line_number":997,"context_line":""},{"line_number":998,"context_line":"  # Config file for 7e9f91eb-b3e6-4e3b-a1a7-d6f7fdc1de7c"},{"line_number":999,"context_line":"  (cut for brevity)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_6d49358b","line":996,"in_reply_to":"9aa7fdbe_d6a73609","updated":"2014-11-07 17:19:11.000000000","message":"Ignore this comment now, since I agreed with the comments above about the config rendering.","commit_id":"a3f5befea652bcbb70fcab1d6a24f39b70612a69"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"71d28e1298fcac7373dd2514e37107503b274fa9","unresolved":false,"context_lines":[{"line_number":64,"context_line":"   collect-- eg. package version listings.)"},{"line_number":65,"context_line":"3. Get state by consulting stored configuration data as sent by the controller."},{"line_number":66,"context_line":"   (ex. amphora topology, haproxy configuration or TLS certificate data)"},{"line_number":67,"context_line":"4. Get state by querying a controller API (not described here)."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"In no case should the amphora assume it ever has direct access to the Octavia"},{"line_number":70,"context_line":"database. Also, sensitive data (like TLS certificates) should be stored in"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_5a55844e","line":67,"updated":"2014-11-22 01:00:27.000000000","message":"Continuing on Adam\u0027s points from PS 2:\n\nAgreed, it might end up being a REST API (actually, I expect the back-end / driver side of the controller to have both a REST and UDP-based API... but those aren\u0027t detailed in this document.)","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"8e207978b27e42fb3e51fcbabce87c096362804a","unresolved":false,"context_lines":[{"line_number":64,"context_line":"   collect-- eg. package version listings.)"},{"line_number":65,"context_line":"3. Get state by consulting stored configuration data as sent by the controller."},{"line_number":66,"context_line":"   (ex. amphora topology, haproxy configuration or TLS certificate data)"},{"line_number":67,"context_line":"4. Get state by querying a controller API (not described here)."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"In no case should the amphora assume it ever has direct access to the Octavia"},{"line_number":70,"context_line":"database. Also, sensitive data (like TLS certificates) should be stored in"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_d143ed10","line":67,"in_reply_to":"5a890539_35236ba8","updated":"2014-11-24 23:02:59.000000000","message":"Do you at least agree this is beyond the scope of this particular spec?","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"8ad706c1c05372d89f7ceee3a04f116e3c05c425","unresolved":false,"context_lines":[{"line_number":64,"context_line":"   collect-- eg. package version listings.)"},{"line_number":65,"context_line":"3. Get state by consulting stored configuration data as sent by the controller."},{"line_number":66,"context_line":"   (ex. amphora topology, haproxy configuration or TLS certificate data)"},{"line_number":67,"context_line":"4. Get state by querying a controller API (not described here)."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"In no case should the amphora assume it ever has direct access to the Octavia"},{"line_number":70,"context_line":"database. Also, sensitive data (like TLS certificates) should be stored in"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_35236ba8","line":67,"in_reply_to":"5a890539_5a55844e","updated":"2014-11-22 01:15:43.000000000","message":"I\u0027m not a huge fan of UDP for this, and I think this will scale fine without using UDP, but that is another thing that merits discussion offline.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"21fa606a0806330387b2adc5096cd9751added65","unresolved":false,"context_lines":[{"line_number":64,"context_line":"   collect-- eg. package version listings.)"},{"line_number":65,"context_line":"3. Get state by consulting stored configuration data as sent by the controller."},{"line_number":66,"context_line":"   (ex. amphora topology, haproxy configuration or TLS certificate data)"},{"line_number":67,"context_line":"4. Get state by querying a controller API (not described here)."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"In no case should the amphora assume it ever has direct access to the Octavia"},{"line_number":70,"context_line":"database. Also, sensitive data (like TLS certificates) should be stored in"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_04bfe8d0","line":67,"in_reply_to":"5a890539_d143ed10","updated":"2014-12-03 20:49:50.000000000","message":"Yeah, sure.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"71d28e1298fcac7373dd2514e37107503b274fa9","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"In no case should the amphora assume it ever has direct access to the Octavia"},{"line_number":70,"context_line":"database. Also, sensitive data (like TLS certificates) should be stored in"},{"line_number":71,"context_line":"a secure way (ex. memory filesystem)."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"\u003d\u003d\u003d"},{"line_number":74,"context_line":"API"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_ba4828b4","line":71,"updated":"2014-11-22 01:00:27.000000000","message":"Continuing from PS 2:\n\nI agree that for the most part it doesn\u0027t matter where we store \"secure\" stuff on the amphora... but it\u0027s pretty simple to set up a memory filesystem and encrypted swap on boot, so why not, eh?","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"21fa606a0806330387b2adc5096cd9751added65","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"In no case should the amphora assume it ever has direct access to the Octavia"},{"line_number":70,"context_line":"database. Also, sensitive data (like TLS certificates) should be stored in"},{"line_number":71,"context_line":"a secure way (ex. memory filesystem)."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"\u003d\u003d\u003d"},{"line_number":74,"context_line":"API"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_e4bbbce2","line":71,"in_reply_to":"5a890539_ba4828b4","updated":"2014-12-03 20:49:50.000000000","message":"Honestly this is up to the deployer as it is part of the image setup, so it doesn\u0027t really matter for the API.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"71d28e1298fcac7373dd2514e37107503b274fa9","unresolved":false,"context_lines":[{"line_number":98,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":99,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":100,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":101,"context_line":"  routing IP address for the ACTIVE-STANDBY pair."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"**Examples**"},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_7ad960f2","line":101,"updated":"2014-11-22 01:00:27.000000000","message":"Continuing from PS 2:\n\nAdam, could you describe how you envisioning ACTIVE-STANDBY handling a failover in your environment?  (If you\u0027re not going to support ACTIVE-STANDBY in your environment...  then is the point you made moot?)\n\nAgain, the ha_ip is something entirely separate from the loadbalancer VIP, and isn\u0027t part of this \u0027get topology\u0027 command at all. If you want to know the loadbalancer VIP, you grab the haproxy configuration and parse. (Though, again, I\u0027m not sure why you\u0027d do this-- the controller should already know it.)","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"b63205a112950a0b34ea9ee98db811fb5a4e7d32","unresolved":false,"context_lines":[{"line_number":98,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":99,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":100,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":101,"context_line":"  routing IP address for the ACTIVE-STANDBY pair."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"**Examples**"},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_b806461a","line":101,"in_reply_to":"5a890539_44557e1c","updated":"2014-11-24 22:10:38.000000000","message":"I am not sure how well corosync/pacemaker work in a neutron network (we had our fair share of struggles) so active/passive might not be getting beyond experimental. But that\u0027s also a different discussion...","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"4e0237ab5ccc09ec47ff2f1483703cfc23023d15","unresolved":false,"context_lines":[{"line_number":98,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":99,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":100,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":101,"context_line":"  routing IP address for the ACTIVE-STANDBY pair."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"**Examples**"},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_821d75c0","line":101,"in_reply_to":"5a890539_7106b9cf","updated":"2014-12-04 06:37:35.000000000","message":"So to be clear, if the topology does not require an ha_ip, then its safe to say the ha_ip can be blank, and the controller will handle a blank ha_ip fine?","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"8ad706c1c05372d89f7ceee3a04f116e3c05c425","unresolved":false,"context_lines":[{"line_number":98,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":99,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":100,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":101,"context_line":"  routing IP address for the ACTIVE-STANDBY pair."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"**Examples**"},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_f553a314","line":101,"in_reply_to":"5a890539_7ad960f2","updated":"2014-11-22 01:15:43.000000000","message":"Err, well, the \"Amphora VIP\" we\u0027d know from the `amphora` table in our DB, and the \"LB VIP\" I suppose we should know from the `vip` table in our DB. So, I guess I am actually not sure what this is for at all... Maybe you are correct?\n\nAnd yeah, I don\u0027t think we\u0027re supporting ACTIVE-STANDBY, just ACTIVE-ACTIVE.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"6c94dba6f4363d606ae325b37e398ceb94c44982","unresolved":false,"context_lines":[{"line_number":98,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":99,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":100,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":101,"context_line":"  routing IP address for the ACTIVE-STANDBY pair."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"**Examples**"},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_cdeea9b5","line":101,"in_reply_to":"5a890539_821d75c0","updated":"2014-12-05 03:54:24.000000000","message":"Correct.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"8e207978b27e42fb3e51fcbabce87c096362804a","unresolved":false,"context_lines":[{"line_number":98,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":99,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":100,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":101,"context_line":"  routing IP address for the ACTIVE-STANDBY pair."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"**Examples**"},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_7106b9cf","line":101,"in_reply_to":"5a890539_b806461a","updated":"2014-11-24 23:02:59.000000000","message":"Let me put it this way:  If the topology requires an ha_ip, it will be reported when getting topology information from the amphora. (Even if the controller already knows what it is--  it makes sense for the amphora to report it anyway... call it a sanity check. :P )","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"219719a15c2bfed4bdb3301dd754793840198369","unresolved":false,"context_lines":[{"line_number":98,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":99,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":100,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":101,"context_line":"  routing IP address for the ACTIVE-STANDBY pair."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"**Examples**"},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_44557e1c","line":101,"in_reply_to":"5a890539_f553a314","updated":"2014-11-24 20:55:48.000000000","message":"As we do run ACTIVE-STANDBY using layer-3 routing for VIP addresses, I can tell you that you need some way to switch which of the hosts is getting the load balancer traffic. If you\u0027re using corosync / pacemaker, this entails a highly available routing IP, and a static route on your core routing hardware pointing traffic destined for VIP addresses at said highly available routing IP.\n\nIt\u0027s possible to do this without an ha_ip, and simply have the standby host alter the static route on the core routing infrastructure when a flip-flop is necessary, but it seems a lot scarier to me (from a security perspective) to give your load balancers the power to alter core routing rules more-or-less directly.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"71d28e1298fcac7373dd2514e37107503b274fa9","unresolved":false,"context_lines":[{"line_number":128,"context_line":"  * *ha_ip*: (only applicable to ACTIVE-STANDBY) Highly-available IP for the"},{"line_number":129,"context_line":"    HA pair"},{"line_number":130,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"},{"line_number":131,"context_line":"    for authentication with other HA pair member"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"* **Success Response:**"},{"line_number":134,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_1ae69cb0","line":131,"updated":"2014-11-22 01:00:27.000000000","message":"Continuing from PS 2:\n\nActually configuring the ha_ip at boot time might not be possible when a spares pool is in use. That is, amphorae in the spares pool will not know which topology they\u0027re going to ultimately be deployed in, nor who their partner is, nor what the ha_ip is until the controller gives them a command telling them this (and moving them into the \u0027active\u0027 pool).\n\nI suppose it\u0027s possible to run ACTIVE-STANDBY topologies with no spares pool, which would mean that you could do the above configuration on boot... but I don\u0027t really see a reason to have this restriction. Thoughts?","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"6c94dba6f4363d606ae325b37e398ceb94c44982","unresolved":false,"context_lines":[{"line_number":128,"context_line":"  * *ha_ip*: (only applicable to ACTIVE-STANDBY) Highly-available IP for the"},{"line_number":129,"context_line":"    HA pair"},{"line_number":130,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"},{"line_number":131,"context_line":"    for authentication with other HA pair member"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"* **Success Response:**"},{"line_number":134,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_8dcd8161","line":131,"in_reply_to":"5a890539_04bb68c4","updated":"2014-12-05 03:54:24.000000000","message":"To be honest, the more I consider this, I think that ACTIVE-STANDBY might simply be the choice to use until Octavia v2.0 is available. Once you can do ACTIVE-ACTIVE, why would you ever do ACTIVE-STANDBY? The only thing I can think of here is sub-second failure detection and recovery, which I\u0027m not yet sure we get with ACTIVE-ACTIVE.\n\nBut Octavia v2.0 is quite a ways away, and I know our customers are going to want HA before it\u0027s ready to go...  making ACTIVE-PASSIVE work is a good interrim solution.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"8ad706c1c05372d89f7ceee3a04f116e3c05c425","unresolved":false,"context_lines":[{"line_number":128,"context_line":"  * *ha_ip*: (only applicable to ACTIVE-STANDBY) Highly-available IP for the"},{"line_number":129,"context_line":"    HA pair"},{"line_number":130,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"},{"line_number":131,"context_line":"    for authentication with other HA pair member"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"* **Success Response:**"},{"line_number":134,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_d575c798","line":131,"in_reply_to":"5a890539_1ae69cb0","updated":"2014-11-22 01:15:43.000000000","message":"Ah, yeah, I keep bouncing back and forth between wanting to use a spare pool and not... If you are, then yes, that would not work and it would need to be here.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"b63205a112950a0b34ea9ee98db811fb5a4e7d32","unresolved":false,"context_lines":[{"line_number":128,"context_line":"  * *ha_ip*: (only applicable to ACTIVE-STANDBY) Highly-available IP for the"},{"line_number":129,"context_line":"    HA pair"},{"line_number":130,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"},{"line_number":131,"context_line":"    for authentication with other HA pair member"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"* **Success Response:**"},{"line_number":134,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_b81d6664","line":131,"in_reply_to":"5a890539_55de376e","updated":"2014-11-24 22:10:38.000000000","message":"We should be able to have the same code path. The amphora comes up and starts the \"agent\". Then the controller configures it for active use... or leaves it in the spare pool.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"21fa606a0806330387b2adc5096cd9751added65","unresolved":false,"context_lines":[{"line_number":128,"context_line":"  * *ha_ip*: (only applicable to ACTIVE-STANDBY) Highly-available IP for the"},{"line_number":129,"context_line":"    HA pair"},{"line_number":130,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"},{"line_number":131,"context_line":"    for authentication with other HA pair member"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"* **Success Response:**"},{"line_number":134,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_04bb68c4","line":131,"in_reply_to":"5a890539_b81d6664","updated":"2014-12-03 20:49:50.000000000","message":"Yes, German+1.\n\nAlso, who actually thinks they might use ACTIVE-PASSIVE? I am honestly not sure it\u0027s something that would ever see use, and if it adds complications, maybe a discussion about whether we even want to support it?","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"c4b070e8ffad74a0f3427479eee04f7be20f99a4","unresolved":false,"context_lines":[{"line_number":128,"context_line":"  * *ha_ip*: (only applicable to ACTIVE-STANDBY) Highly-available IP for the"},{"line_number":129,"context_line":"    HA pair"},{"line_number":130,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"},{"line_number":131,"context_line":"    for authentication with other HA pair member"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"* **Success Response:**"},{"line_number":134,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_55de376e","line":131,"in_reply_to":"5a890539_d575c798","updated":"2014-11-22 01:35:56.000000000","message":"The point is that some operators almost certainly want to run using a spare pool.\n\nI guess the question is more: Are there operators who want to use a spare pool who will also be using ACTIVE-STANDBY?  (ACTIVE-STANDBY seems to obviate the need for a spares pool.)  Then again, I suppose it\u0027s reasonable to want to have some load balancers use amphorae in ACTIVE-STANDBY as well as other topologies depending on flavor...  in which case using a spares pool might be necessary even with ACTIVE-STANDBY\n\nThere\u0027s also the question of code paths:  Do we want to have the same bootstrapping process for amphorae that end up in the spares pool as those that are going to be immediately deployed in an active role once they\u0027re up? I think we probably do (in order to reduce code and amphora management complexity).","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"71d28e1298fcac7373dd2514e37107503b274fa9","unresolved":false,"context_lines":[{"line_number":129,"context_line":"    HA pair"},{"line_number":130,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"},{"line_number":131,"context_line":"    for authentication with other HA pair member"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"* **Success Response:**"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"  * Code: 200"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_7a87a0b5","line":132,"updated":"2014-11-22 01:00:27.000000000","message":"Continuing from PS 2:\n\nAgain, this spec is meant to cover only the haproxy amphora API (which lives on the amphora), not a REST or UDP API which lives (probably) in the driver on the controller.\n\nAnd yes, we do need to flesh out the latter, which I can get going on after this spec is acceptable to people. (I wanted y\u0027all to see what I was thinking here before fleshing out those parts of the communication between controller and amphora.)","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"b63205a112950a0b34ea9ee98db811fb5a4e7d32","unresolved":false,"context_lines":[{"line_number":305,"context_line":"* *topology* - One of SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":306,"context_line":"* *topology_status* - One of OK, TOPOLOGY-CHANGE"},{"line_number":307,"context_line":"* *listeners* - list of listener UUIDs being serviced by this amphora"},{"line_number":308,"context_line":"* *packages* - list of load-balancing related packages installed with versions"},{"line_number":309,"context_line":"  (eg. OpenSSL, haproxy, nginx, etc.)"},{"line_number":310,"context_line":""},{"line_number":311,"context_line":"**Notes:** The data in this request is meant to provide intelligence for an"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_bbad6086","line":308,"updated":"2014-11-24 22:10:38.000000000","message":"This is key for security things like -- shoot all amphora with the bash exploit. So the more packages can be listed the better or maybe asked for specific packages.\n\nThis brings up another point if we do support in place updates (e.g. we run auto-update on most of our vms). If so, we might need an API function to do so?","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"21fa606a0806330387b2adc5096cd9751added65","unresolved":false,"context_lines":[{"line_number":305,"context_line":"* *topology* - One of SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":306,"context_line":"* *topology_status* - One of OK, TOPOLOGY-CHANGE"},{"line_number":307,"context_line":"* *listeners* - list of listener UUIDs being serviced by this amphora"},{"line_number":308,"context_line":"* *packages* - list of load-balancing related packages installed with versions"},{"line_number":309,"context_line":"  (eg. OpenSSL, haproxy, nginx, etc.)"},{"line_number":310,"context_line":""},{"line_number":311,"context_line":"**Notes:** The data in this request is meant to provide intelligence for an"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_e4649c23","line":308,"in_reply_to":"5a890539_31eef1ed","updated":"2014-12-03 20:49:50.000000000","message":"Yeah, that\u0027s a gigantic security hole in its own right. I\u0027d much rather go with something like Stephen said and just recycle and spin new Amphorae from a fixed image. It\u0027s a little more expensive possibly, but a lot cleaner and less prone to issues. If it\u0027s absolutely required though, I think it\u0027s up the deployer to set up their base image the way they want -- and that could include automating package updates.\n\nAs for actually filling this package list -- this would depend a lot on the image used (RHEL base / Debian base / etc) and can be time-consuming to generate and possibly quite difficult to filter in a useful way. I would assume if we know what\u0027s on the base image, and we don\u0027t do autoupdating, this would not even be necessary. Just returning the \"Amphora version\" would tell us what we\u0027d need to know. If we do autoupdating, possibly this would have to be async or something, where the first call triggers a process and indicates to the client to check back later, then caches the package list for the next call (within some time period obviously). This is getting into implementation details though (and possibly I am underestimating the performance of dpkg/yum), so for now I\u0027d say this should be fine as-is.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"8e207978b27e42fb3e51fcbabce87c096362804a","unresolved":false,"context_lines":[{"line_number":305,"context_line":"* *topology* - One of SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":306,"context_line":"* *topology_status* - One of OK, TOPOLOGY-CHANGE"},{"line_number":307,"context_line":"* *listeners* - list of listener UUIDs being serviced by this amphora"},{"line_number":308,"context_line":"* *packages* - list of load-balancing related packages installed with versions"},{"line_number":309,"context_line":"  (eg. OpenSSL, haproxy, nginx, etc.)"},{"line_number":310,"context_line":""},{"line_number":311,"context_line":"**Notes:** The data in this request is meant to provide intelligence for an"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_31eef1ed","line":308,"in_reply_to":"5a890539_bbad6086","updated":"2014-11-24 23:02:59.000000000","message":"So, my thought is \"no.\"\n\nIn general, if there\u0027s something wrong with the amphora image or if you need to update it, it\u0027s far cleaner and more predictable to generate a new master image and then recycle the currently running amphorae as soon as possible.\n\nHaving said this, in an emergency situation, I could see having the ability to send a command to all amphorae to run some arbitrary command being very useful. However, realize that the controller won\u0027t presently have any way to make use of this command unless we build that into the operator API and extend the controller-driver interface accordingly.  It\u0027s also worth pointing out that such an interface, while extremely powerful, is an obvious target for an attacker.\n\nThis is a pretty big discussion, and I\u0027m happy to have it, but I don\u0027t want it delaying implementation of the amphora-side API. Given that we should treat anything we merge as being up for changing later on, are you OK with approving of this spec without this feature (ie. to be added at a later date in another review, pending further discussion)?","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"6c94dba6f4363d606ae325b37e398ceb94c44982","unresolved":false,"context_lines":[{"line_number":305,"context_line":"* *topology* - One of SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":306,"context_line":"* *topology_status* - One of OK, TOPOLOGY-CHANGE"},{"line_number":307,"context_line":"* *listeners* - list of listener UUIDs being serviced by this amphora"},{"line_number":308,"context_line":"* *packages* - list of load-balancing related packages installed with versions"},{"line_number":309,"context_line":"  (eg. OpenSSL, haproxy, nginx, etc.)"},{"line_number":310,"context_line":""},{"line_number":311,"context_line":"**Notes:** The data in this request is meant to provide intelligence for an"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_4db3999a","line":308,"in_reply_to":"5a890539_e4649c23","updated":"2014-12-05 03:54:24.000000000","message":"No, you\u0027re not underestimating the performance of dpkg/yum-- it takes a second or two to return a full package list with versions, which is longer than I\u0027d like for a synchronous operation. It\u0027s possible to cache this data, of course, if it takes too long to generate (which would be the option I\u0027d take before making this an asynchronous API command).\n\nSomewhere someone is going to need to keep track of which amphora version has which packages installed, and so you\u0027re either left with keeping this information out of the API in some operator\u0027s database somewhere, or just having something to probe this information directly from the amphorae. I tend to prefer the latter, as it keeps Octavia self-contained, IMO.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"4e0237ab5ccc09ec47ff2f1483703cfc23023d15","unresolved":false,"context_lines":[{"line_number":546,"context_line":"::"},{"line_number":547,"context_line":""},{"line_number":548,"context_line":"  PUT URL:"},{"line_number":549,"context_line":"  https://octavia-haproxy-img-00328.local/v0.1/listeners/04bff5c3-5862-4a13-b9e3-9b440d0ed50a?action\u003dstart"},{"line_number":550,"context_line":""},{"line_number":551,"context_line":"  JSON Response:"},{"line_number":552,"context_line":"  {"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_6250895e","line":549,"updated":"2014-12-04 06:37:35.000000000","message":"nit: need to update to reflect different url.  should be /start\n\nsame for the ones below.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"6c94dba6f4363d606ae325b37e398ceb94c44982","unresolved":false,"context_lines":[{"line_number":546,"context_line":"::"},{"line_number":547,"context_line":""},{"line_number":548,"context_line":"  PUT URL:"},{"line_number":549,"context_line":"  https://octavia-haproxy-img-00328.local/v0.1/listeners/04bff5c3-5862-4a13-b9e3-9b440d0ed50a?action\u003dstart"},{"line_number":550,"context_line":""},{"line_number":551,"context_line":"  JSON Response:"},{"line_number":552,"context_line":"  {"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_8daca138","line":549,"in_reply_to":"5a890539_6250895e","updated":"2014-12-05 03:54:24.000000000","message":"AAh-- good catch. Thanks.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"71d28e1298fcac7373dd2514e37107503b274fa9","unresolved":false,"context_lines":[{"line_number":687,"context_line":"  * *:filename* \u003d PEM filename (see notes below for naming convention)"},{"line_number":688,"context_line":""},{"line_number":689,"context_line":"* **Data params:** Certificate data. (PEM file should be a concatenation of"},{"line_number":690,"context_line":"  unencrypted RSA key, certificate and chain, in that order)"},{"line_number":691,"context_line":"* **Success Response:**"},{"line_number":692,"context_line":""},{"line_number":693,"context_line":"  * Code: 201"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_5a5f4441","line":690,"updated":"2014-11-22 01:00:27.000000000","message":"Continuing discussion from PS 2:\n\nPer our discussion in IRC, making each configuration change recycle the amphora is not going to be tenable for some operators. And since restarting an haproxy instance is cheap (and is zero-downtime, and doesn\u0027t break currently-open connections to the amphora), there\u0027s no reason not to support this.\n\nAnd yes-- intermediate certificate ordering is something to be concerned with when the user first uploads the cert, and not anywhere else in the Octavia code. :)","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"6c94dba6f4363d606ae325b37e398ceb94c44982","unresolved":false,"context_lines":[{"line_number":687,"context_line":"  * *:filename* \u003d PEM filename (see notes below for naming convention)"},{"line_number":688,"context_line":""},{"line_number":689,"context_line":"* **Data params:** Certificate data. (PEM file should be a concatenation of"},{"line_number":690,"context_line":"  unencrypted RSA key, certificate and chain, in that order)"},{"line_number":691,"context_line":"* **Success Response:**"},{"line_number":692,"context_line":""},{"line_number":693,"context_line":"  * Code: 201"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_903d9abf","line":690,"in_reply_to":"5a890539_22e9217f","updated":"2014-12-05 03:54:24.000000000","message":"My general opinion on this sort of thing is that rebuilding everything from scratch is what you want to do when you\u0027re creating an amphora image or moving one from the spares pool to the active pool. But when the thing is in operation, you want to try to minimize the number of changes you make to only what is necessary each time.\n\nIn my experience, TLS certificates once uploaded to the load balancer only changed about once in a blue moon-- so it seems like an unnecessary hassle to replace all of them with even the most minor configuration update. (And will increase the opportunities for errors to occur.)","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"c4b070e8ffad74a0f3427479eee04f7be20f99a4","unresolved":false,"context_lines":[{"line_number":687,"context_line":"  * *:filename* \u003d PEM filename (see notes below for naming convention)"},{"line_number":688,"context_line":""},{"line_number":689,"context_line":"* **Data params:** Certificate data. (PEM file should be a concatenation of"},{"line_number":690,"context_line":"  unencrypted RSA key, certificate and chain, in that order)"},{"line_number":691,"context_line":"* **Success Response:**"},{"line_number":692,"context_line":""},{"line_number":693,"context_line":"  * Code: 201"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_f53d6390","line":690,"in_reply_to":"5a890539_5569d7bc","updated":"2014-11-22 01:35:56.000000000","message":"These are separate API commands.... and we can\u0027t necessarily anticipate the order in which they\u0027ll happen. The idea here is that \"once we have a complete configuration\" (including TLS data), we should start the service.\n\nIn the case of a very complicated configuration (with several dozen SNI certificates), it would be a good idea not have to upload all those certs every time a member gets added to a pool, eh.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"8ad706c1c05372d89f7ceee3a04f116e3c05c425","unresolved":false,"context_lines":[{"line_number":687,"context_line":"  * *:filename* \u003d PEM filename (see notes below for naming convention)"},{"line_number":688,"context_line":""},{"line_number":689,"context_line":"* **Data params:** Certificate data. (PEM file should be a concatenation of"},{"line_number":690,"context_line":"  unencrypted RSA key, certificate and chain, in that order)"},{"line_number":691,"context_line":"* **Success Response:**"},{"line_number":692,"context_line":""},{"line_number":693,"context_line":"  * Code: 201"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_5569d7bc","line":690,"in_reply_to":"5a890539_5a5f4441","updated":"2014-11-22 01:15:43.000000000","message":"I kind of assumed the SSL Data would be uploaded in the same call as the rest of the config update though, not as a separate call... Would you have to do a config update, then an SSL Data update, then call something to restart the service?\n\nI really assumed we\u0027d keep it to one operation: /*:version*/listeners/*:listener*/configuration \u003d\u003d here is your new config (including any TLS data), now put it in place and restart HAProxy.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"4e0237ab5ccc09ec47ff2f1483703cfc23023d15","unresolved":false,"context_lines":[{"line_number":687,"context_line":"  * *:filename* \u003d PEM filename (see notes below for naming convention)"},{"line_number":688,"context_line":""},{"line_number":689,"context_line":"* **Data params:** Certificate data. (PEM file should be a concatenation of"},{"line_number":690,"context_line":"  unencrypted RSA key, certificate and chain, in that order)"},{"line_number":691,"context_line":"* **Success Response:**"},{"line_number":692,"context_line":""},{"line_number":693,"context_line":"  * Code: 201"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_22e9217f","line":690,"in_reply_to":"5a890539_af48ad5c","updated":"2014-12-04 06:37:35.000000000","message":"Wouldn\u0027t this cause many requests to barbican? which would increase the time these operations take to complete?","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"21fa606a0806330387b2adc5096cd9751added65","unresolved":false,"context_lines":[{"line_number":687,"context_line":"  * *:filename* \u003d PEM filename (see notes below for naming convention)"},{"line_number":688,"context_line":""},{"line_number":689,"context_line":"* **Data params:** Certificate data. (PEM file should be a concatenation of"},{"line_number":690,"context_line":"  unencrypted RSA key, certificate and chain, in that order)"},{"line_number":691,"context_line":"* **Success Response:**"},{"line_number":692,"context_line":""},{"line_number":693,"context_line":"  * Code: 201"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_af48ad5c","line":690,"in_reply_to":"5a890539_f53d6390","updated":"2014-12-03 20:49:50.000000000","message":"Eh, I am not 100% convinced -- I think it is generally a lot cleaner to do it as a single full operation. It\u0027s not like the USER would have to specify every single thing every time -- we\u0027ll be pulling it from the database in code, so it\u0027s not really \"tedious\" to compile the entire config every time and send the whole thing over, including every cert for every member. :)","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"71d28e1298fcac7373dd2514e37107503b274fa9","unresolved":false,"context_lines":[{"line_number":815,"context_line":""},{"line_number":816,"context_line":"* **Response:**"},{"line_number":817,"context_line":""},{"line_number":818,"context_line":"| \u003ccertificate PEM file md5 sum\u003e"},{"line_number":819,"context_line":""},{"line_number":820,"context_line":"* **Implied actions:** none"},{"line_number":821,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_ba29089d","line":818,"updated":"2014-11-22 01:00:27.000000000","message":"Continuing from PS 2:\n\nSo, again, responded to the idea of recycling amphora vs. restarting haproxy with configuration updates above.\n\nAs far as state on the amphora: I agree that we generally want to avoid keeping state there. The only exceptions to this are going to be things we literally can\u0027t get any other way (for example, stats information, load, disk and memory usage, etc.) Some of these data points are going to have some state information in them.\n\nNote that pretty-much anything config related doesn\u0027t fall into this category. However, I think it\u0027s still a good idea to be able to retrieve things like an md5 sum of the certificate: This prevents us from unnecessarily sending the private key data over the wire (from the controller to the amphora) too often, and can even prevent having to restart the haproxy instance on the amphora (which is good, from a TLS performance perspective).","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"21fa606a0806330387b2adc5096cd9751added65","unresolved":false,"context_lines":[{"line_number":815,"context_line":""},{"line_number":816,"context_line":"* **Response:**"},{"line_number":817,"context_line":""},{"line_number":818,"context_line":"| \u003ccertificate PEM file md5 sum\u003e"},{"line_number":819,"context_line":""},{"line_number":820,"context_line":"* **Implied actions:** none"},{"line_number":821,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_8fc0517d","line":818,"in_reply_to":"5a890539_355b6bf7","updated":"2014-12-03 20:49:50.000000000","message":"Ok, but as I said above, I am still very uncomfortable with keeping the Amphorae stateful in ANY way, config included.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"c4b070e8ffad74a0f3427479eee04f7be20f99a4","unresolved":false,"context_lines":[{"line_number":815,"context_line":""},{"line_number":816,"context_line":"* **Response:**"},{"line_number":817,"context_line":""},{"line_number":818,"context_line":"| \u003ccertificate PEM file md5 sum\u003e"},{"line_number":819,"context_line":""},{"line_number":820,"context_line":"* **Implied actions:** none"},{"line_number":821,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_355b6bf7","line":818,"in_reply_to":"5a890539_b55cbb1a","updated":"2014-11-22 01:35:56.000000000","message":"It\u0027s pretty simple, actually--  if the controller knows that, for example, a member was just added, there\u0027s no reason to even touch any TLS certificate data because the only thing that\u0027s going to change is the haproxy.cfg.\n\nUnder normal operations, the controller never needs to check the md5sum of any uploaded certs. However, I\u0027ve also operated in environments where health-checking daemons also did some sanity checking (in this case, like making sure the amphorae really are running the latest configuration with the correct certificates). Having the ability to do these kinds of checks is really helpful after a massive datacenter event when shit hits the fan, and it\u0027s better than re-deploying 10,000+ amphorae \"just to be sure\" they\u0027re all running the code they\u0027re supposed to.\n\nAgain, the reason for being able to retrieve the md5sum of the TLS certs, and the haproxy configuration are for doing sanity checks. Under normal operations, these kinds of checks may be skipped.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"8ad706c1c05372d89f7ceee3a04f116e3c05c425","unresolved":false,"context_lines":[{"line_number":815,"context_line":""},{"line_number":816,"context_line":"* **Response:**"},{"line_number":817,"context_line":""},{"line_number":818,"context_line":"| \u003ccertificate PEM file md5 sum\u003e"},{"line_number":819,"context_line":""},{"line_number":820,"context_line":"* **Implied actions:** none"},{"line_number":821,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_b55cbb1a","line":818,"in_reply_to":"5a890539_ba29089d","updated":"2014-11-22 01:15:43.000000000","message":"But how would that even work? An update to config means we do a GET and compare the cert, and then do a PUT to update the config? I honestly think it\u0027s better just to send the full state, even if it means sending the PK over the (HTTPS encrypted!) wire. There should be ZERO state to the configs. And if nothing changed that would require an HAProxy restart, why was there even a communication made?","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"71d28e1298fcac7373dd2514e37107503b274fa9","unresolved":false,"context_lines":[{"line_number":845,"context_line":"    \u0027message\u0027: \u0027Not Found\u0027,"},{"line_number":846,"context_line":"  }"},{"line_number":847,"context_line":""},{"line_number":848,"context_line":"Delete SSL certificate PEM file"},{"line_number":849,"context_line":"-------------------------------"},{"line_number":850,"context_line":""},{"line_number":851,"context_line":"* **URL:** /*:version*/listeners/*:listener*/certificates/*:filename.pem*"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_55147743","line":848,"updated":"2014-11-22 01:00:27.000000000","message":"Continuing from PS 2:\n\nSo, I partially agree with this: Updating a configuration will replace any configuration that\u0027s already there. But it\u0027s also conceivable that a user might delete a whole listener on a load balancer while leaving another listener on the same load balancer intact, or simply want to delete one certificate out of an SNI configuration. (Note also that different certs are in separate files, and in a separate file from the haproxy.cfg.)","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"8ad706c1c05372d89f7ceee3a04f116e3c05c425","unresolved":false,"context_lines":[{"line_number":845,"context_line":"    \u0027message\u0027: \u0027Not Found\u0027,"},{"line_number":846,"context_line":"  }"},{"line_number":847,"context_line":""},{"line_number":848,"context_line":"Delete SSL certificate PEM file"},{"line_number":849,"context_line":"-------------------------------"},{"line_number":850,"context_line":""},{"line_number":851,"context_line":"* **URL:** /*:version*/listeners/*:listener*/certificates/*:filename.pem*"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_75adf3e8","line":848,"in_reply_to":"5a890539_55147743","updated":"2014-11-22 01:15:43.000000000","message":"Erk, alright, I think I need to whiteboard this at least once... Since what I\u0027m advocating is a removal of a function, if we do decide to remove it later it won\u0027t be a big deal, so for now it\u0027s fine.","commit_id":"d0e59b1527ca64cae378e01b00700cc9bda5a346"},{"author":{"_account_id":10806,"name":"Trevor Vardeman","email":"tvardema@redhat.com","username":"tvardeman"},"change_message_id":"959fd9fefe7cb1afac88ffe2a7c2f10cfe17eb49","unresolved":false,"context_lines":[{"line_number":142,"context_line":""},{"line_number":143,"context_line":"* **Error Response:**"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"  * Code: 409"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"    * Content: Invalid request."},{"line_number":148,"context_line":"    * *(Response will also include information on which parameters did not*"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_a8bf5dfb","line":145,"updated":"2014-12-30 15:51:21.000000000","message":"This status code is \"conflict,\" 403 is invalid request.","commit_id":"82aec728eb852b6955161e5bd9072728dbefded1"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"510d97ccc3a87372d53f318577a118b6367371dd","unresolved":false,"context_lines":[{"line_number":142,"context_line":""},{"line_number":143,"context_line":"* **Error Response:**"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"  * Code: 409"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"    * Content: Invalid request."},{"line_number":148,"context_line":"    * *(Response will also include information on which parameters did not*"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_aa689821","line":145,"in_reply_to":"3a961159_a8bf5dfb","updated":"2015-01-16 08:03:11.000000000","message":"Er....  From http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html :\n\n403 Forbidden\n\nThe server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. If the server does not wish to make this information available to the client, the status code 404 (Not Found) can be used instead.\n\nGiven the description of the \u0027Invalid Request\u0027 below, the server actually didn\u0027t understand the request because parameters were missing or invalid. 403 seems appropriate if you want to say \"I got the message and understood it, and you are authorized to give it, but I\u0027m not going to do it because of X reason.\"\n\nGranted, 409 might not be any better in this case \"\u0027Conflict\u0027? WTF is that supposed to mean?\" But I tend to default to using that in cases where there\u0027s technically nothing wrong with the HTTP request but the logic on the back-end doesn\u0027t allow it for some reason. I\u0027m not totally married to 409 for this, so if others feel strongly about this, I\u0027ll change it.","commit_id":"82aec728eb852b6955161e5bd9072728dbefded1"},{"author":{"_account_id":10806,"name":"Trevor Vardeman","email":"tvardema@redhat.com","username":"tvardeman"},"change_message_id":"959fd9fefe7cb1afac88ffe2a7c2f10cfe17eb49","unresolved":false,"context_lines":[{"line_number":187,"context_line":"  Response:"},{"line_number":188,"context_line":"  OK"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"* Error code 409:"},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"::"},{"line_number":193,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_a8467d1f","line":190,"updated":"2014-12-30 15:51:21.000000000","message":"403 again.","commit_id":"82aec728eb852b6955161e5bd9072728dbefded1"},{"author":{"_account_id":10284,"name":"phillip toohill","email":"dead2hill@gmail.com","username":"ptoohill"},"change_message_id":"a0ab19ec9b8ef7430680d8ff643bc7ebda10dec3","unresolved":false,"context_lines":[{"line_number":723,"context_line":"**Notes:** filename.pem should match the primary CN for which the"},{"line_number":724,"context_line":"certificate is valid. All-caps WILDCARD should be used to replace an asterisk"},{"line_number":725,"context_line":"in a wildcard certificate (eg. a CN of \u0027\\*.example.com\u0027 should have a filename"},{"line_number":726,"context_line":"of \u0027WILDCARD.example.com.pem\u0027). Filenames must also have the .pem extension."},{"line_number":727,"context_line":""},{"line_number":728,"context_line":"**Examples:**"},{"line_number":729,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_b414d9e9","line":726,"updated":"2015-01-05 04:54:06.000000000","message":"In order for the config to be generated properly in the driver side we would need to know the exact location of the certificates that we upload to the api. This somewhat relates to my other comments about files. Would we extend the filename to include \u0027path\u0027 and let the driver maintain the locations of these files? Will we store in a generic directory separated by name(unique?) There are cases where we could potentialy have many certs for the listener and this could be an issue when generating the config if not thought out. \n\nWith all that said, does the API remove the cert after haproxy is started, thus loading it in memory only? This leads to other questions.. but we can discuss outside of the review system.\n\nIn either case I would like to come up with a solution and get it documented here","commit_id":"82aec728eb852b6955161e5bd9072728dbefded1"},{"author":{"_account_id":11302,"name":"Phillip Toohill","email":"phillip.toohill@rackspace.com","username":"ptoohill1"},"change_message_id":"eb8864be0d2d28fbd3d2a589a9f095cb90f1fbef","unresolved":false,"context_lines":[{"line_number":723,"context_line":"**Notes:** filename.pem should match the primary CN for which the"},{"line_number":724,"context_line":"certificate is valid. All-caps WILDCARD should be used to replace an asterisk"},{"line_number":725,"context_line":"in a wildcard certificate (eg. a CN of \u0027\\*.example.com\u0027 should have a filename"},{"line_number":726,"context_line":"of \u0027WILDCARD.example.com.pem\u0027). Filenames must also have the .pem extension."},{"line_number":727,"context_line":""},{"line_number":728,"context_line":"**Examples:**"},{"line_number":729,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_df958888","line":726,"in_reply_to":"3a961159_0abd2c68","updated":"2015-01-16 21:56:21.000000000","message":"With the additional discussion in IRC im on board here. \nAs for the removal of the certs thats exactly what i was figuring, and if we are indeed using a memFS then this works out just fine. Thanks for the replies!","commit_id":"82aec728eb852b6955161e5bd9072728dbefded1"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"510d97ccc3a87372d53f318577a118b6367371dd","unresolved":false,"context_lines":[{"line_number":723,"context_line":"**Notes:** filename.pem should match the primary CN for which the"},{"line_number":724,"context_line":"certificate is valid. All-caps WILDCARD should be used to replace an asterisk"},{"line_number":725,"context_line":"in a wildcard certificate (eg. a CN of \u0027\\*.example.com\u0027 should have a filename"},{"line_number":726,"context_line":"of \u0027WILDCARD.example.com.pem\u0027). Filenames must also have the .pem extension."},{"line_number":727,"context_line":""},{"line_number":728,"context_line":"**Examples:**"},{"line_number":729,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_0abd2c68","line":726,"in_reply_to":"3a961159_b414d9e9","updated":"2015-01-16 08:03:11.000000000","message":"Given the fact that a certificate is a child-object of a listener, I think we should allow the amphora to store it wherever it wants-- the driver doesn\u0027t need to care about the full path.\n\nBut since you ask, my plan is to have each listener store all of its data in a directory named after the listener UUID. This will be on a memory filesystem, and probably have a path something to the effect of:\n\n/var/lib/octavia/listeners/:uuid/\n\nAgain, the driver doesn\u0027t need to know or care about this.\n\nPart of the implication in using the cert\u0027s CN as the filename means that you can\u0027t have two certificates for the same CN under the same listener. This actually works out really well for how the OpenSSL library handles SNI. While it *is* possible to have two certs with the same CN used (and have one or the other selected based on x509v3 extended attributes), the actual real-world cases of this happening are rare enough that we can effectively ignore them.\n\nThe config itself should assume that everything the current listener cares about is in the current directory. (If this doesn\u0027t work, we can revisit this and lock it down to a path name as described above-- probably the exact path described above. XD )\n\nThe API should not remove the cert after haproxy is started-- after all, there is a chance that haproxy can fail spontaneously, and we want the amphora to be able to attempt to restart it if that happens without the amphora itself having to be recycled. Storing the certificate (and all parts of the haproxy config) on a memory filesystem should suffice for keeping secrets \"secure enough\" (it\u0027s no worse than having the certificate loaded in memory, really).\n\nAnyway, as far as documenting this-- I can update the verbage here, though, again, I think the driver shouldn\u0027t have to be concerned with specifics here, per se.","commit_id":"82aec728eb852b6955161e5bd9072728dbefded1"},{"author":{"_account_id":10284,"name":"phillip toohill","email":"dead2hill@gmail.com","username":"ptoohill"},"change_message_id":"5334f49418f3ad26890a40a7a46ea2b85c35717d","unresolved":false,"context_lines":[{"line_number":918,"context_line":"* **Method:** PUT"},{"line_number":919,"context_line":"* **URL params:**"},{"line_number":920,"context_line":""},{"line_number":921,"context_line":"  * *:listener* \u003d Listener UUID"},{"line_number":922,"context_line":""},{"line_number":923,"context_line":"* **Data params:** haproxy configuration file for the listener"},{"line_number":924,"context_line":"* **Success Response:**"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_bed59ae6","line":921,"updated":"2015-01-05 01:03:20.000000000","message":"I assume the API will handle any needed creation of pid file and other files that may need creation; since the driver configures this, will the API read the config for the file locations and create them as needed or would this be a param/part of body somehow?","commit_id":"82aec728eb852b6955161e5bd9072728dbefded1"},{"author":{"_account_id":11302,"name":"Phillip Toohill","email":"phillip.toohill@rackspace.com","username":"ptoohill1"},"change_message_id":"eb8864be0d2d28fbd3d2a589a9f095cb90f1fbef","unresolved":false,"context_lines":[{"line_number":918,"context_line":"* **Method:** PUT"},{"line_number":919,"context_line":"* **URL params:**"},{"line_number":920,"context_line":""},{"line_number":921,"context_line":"  * *:listener* \u003d Listener UUID"},{"line_number":922,"context_line":""},{"line_number":923,"context_line":"* **Data params:** haproxy configuration file for the listener"},{"line_number":924,"context_line":"* **Success Response:**"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_bff27c02","line":921,"in_reply_to":"3a961159_2a674826","updated":"2015-01-16 21:56:21.000000000","message":"This is an acceptable solution and works for me.","commit_id":"82aec728eb852b6955161e5bd9072728dbefded1"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"510d97ccc3a87372d53f318577a118b6367371dd","unresolved":false,"context_lines":[{"line_number":918,"context_line":"* **Method:** PUT"},{"line_number":919,"context_line":"* **URL params:**"},{"line_number":920,"context_line":""},{"line_number":921,"context_line":"  * *:listener* \u003d Listener UUID"},{"line_number":922,"context_line":""},{"line_number":923,"context_line":"* **Data params:** haproxy configuration file for the listener"},{"line_number":924,"context_line":"* **Success Response:**"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_2a674826","line":921,"in_reply_to":"3a961159_bed59ae6","updated":"2015-01-16 08:03:11.000000000","message":"Aah-- good point. Let\u0027s just go with an assumed path for now. Something under /var/run? I don\u0027t see anyone really needing to customize this since the amphora image should be tailor-made to fit with whatever the driver is going to send. Let\u0027s say, something under /var/run/octavia or /var/lib/octavia?  (Pick a subdirectory, and name the pid file after the UUID of the listener.)","commit_id":"82aec728eb852b6955161e5bd9072728dbefded1"},{"author":{"_account_id":10284,"name":"phillip toohill","email":"dead2hill@gmail.com","username":"ptoohill"},"change_message_id":"a663007e34075ef1b86415492b57ace77f497955","unresolved":false,"context_lines":[{"line_number":952,"context_line":"  * Add IPs, iptables accounting rules, etc. to this amphora if they\u0027re"},{"line_number":953,"context_line":"    not already present."},{"line_number":954,"context_line":"  * Start or restart haproxy listener."},{"line_number":955,"context_line":""},{"line_number":956,"context_line":"**Notes:** The uploaded configuration file should be a complete and"},{"line_number":957,"context_line":"syntactically-correct haproxy config. The amphora does not have intelligence"},{"line_number":958,"context_line":"to generate these itself and has only rudimentary ability to parse certain"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_86b5e5d1","line":955,"updated":"2015-01-05 17:35:24.000000000","message":"Why would it start/stop the service here? If I have yet to upload a new certificate this will fail because it has not been loaded to the system(since they should be cleaned up after start). \n\nSo, we need to set a documented order for the way we call things, or make this method just a \u0027upload config\u0027 method strictly. \n\n(This questions stems from other questions regarding files)","commit_id":"82aec728eb852b6955161e5bd9072728dbefded1"},{"author":{"_account_id":11302,"name":"Phillip Toohill","email":"phillip.toohill@rackspace.com","username":"ptoohill1"},"change_message_id":"eb8864be0d2d28fbd3d2a589a9f095cb90f1fbef","unresolved":false,"context_lines":[{"line_number":952,"context_line":"  * Add IPs, iptables accounting rules, etc. to this amphora if they\u0027re"},{"line_number":953,"context_line":"    not already present."},{"line_number":954,"context_line":"  * Start or restart haproxy listener."},{"line_number":955,"context_line":""},{"line_number":956,"context_line":"**Notes:** The uploaded configuration file should be a complete and"},{"line_number":957,"context_line":"syntactically-correct haproxy config. The amphora does not have intelligence"},{"line_number":958,"context_line":"to generate these itself and has only rudimentary ability to parse certain"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_df710878","line":955,"in_reply_to":"3a961159_0a4b6c87","updated":"2015-01-16 21:56:21.000000000","message":"If were keeping the restart here then it would be nice to have it clearly documented that we MUST call the methods in \u0027this\u0027 order. Or, if we have some other kind of documentation or policy in place to enforce the order then, me as the current haproxy driver implementor, is content with this solution.","commit_id":"82aec728eb852b6955161e5bd9072728dbefded1"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"510d97ccc3a87372d53f318577a118b6367371dd","unresolved":false,"context_lines":[{"line_number":952,"context_line":"  * Add IPs, iptables accounting rules, etc. to this amphora if they\u0027re"},{"line_number":953,"context_line":"    not already present."},{"line_number":954,"context_line":"  * Start or restart haproxy listener."},{"line_number":955,"context_line":""},{"line_number":956,"context_line":"**Notes:** The uploaded configuration file should be a complete and"},{"line_number":957,"context_line":"syntactically-correct haproxy config. The amphora does not have intelligence"},{"line_number":958,"context_line":"to generate these itself and has only rudimentary ability to parse certain"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_0a4b6c87","line":955,"in_reply_to":"3a961159_86b5e5d1","updated":"2015-01-16 08:03:11.000000000","message":"I see your point-- in this case, I would say that we upload the certificate and any other supporting files first, and then upload the haproxy config.\n\n(In our previous implementation, changing *any* of the files associated with the haproxy config would cause that haproxy instance to get restarted-- but it was a \u0027soft\u0027 restart that tolerated failures, because if a file was missing 99% of the time it was about to be uploaded anyway-- which would lead to another attempted restart, the second of which would actually work.)\n\nDoes that seem reasonable? I can make that more explicit in the wording above.","commit_id":"82aec728eb852b6955161e5bd9072728dbefded1"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"425ba98decbada2a02fff74d7b9049694765d516","unresolved":false,"context_lines":[{"line_number":997,"context_line":"  }"},{"line_number":998,"context_line":""},{"line_number":999,"context_line":"Get listener haproxy configuration"},{"line_number":1000,"context_line":"----------------------------------"},{"line_number":1001,"context_line":""},{"line_number":1002,"context_line":"* **URL:** /*:version*/listeners/*:listener*/haproxy"},{"line_number":1003,"context_line":"* **Method:** GET"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_875b43f5","line":1000,"updated":"2014-12-18 01:18:43.000000000","message":"I don\u0027t think we will need this method at all.  We should always just push a full new config.","commit_id":"82aec728eb852b6955161e5bd9072728dbefded1"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"510d97ccc3a87372d53f318577a118b6367371dd","unresolved":false,"context_lines":[{"line_number":997,"context_line":"  }"},{"line_number":998,"context_line":""},{"line_number":999,"context_line":"Get listener haproxy configuration"},{"line_number":1000,"context_line":"----------------------------------"},{"line_number":1001,"context_line":""},{"line_number":1002,"context_line":"* **URL:** /*:version*/listeners/*:listener*/haproxy"},{"line_number":1003,"context_line":"* **Method:** GET"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_4a3814ee","line":1000,"in_reply_to":"3a961159_34a21fae","updated":"2015-01-16 08:03:11.000000000","message":"One other reason for having this method: It\u0027s likely we will want to expose a feature in the Operator API that allows the operator to view the currently-running config (regardless of what\u0027s in the database) for troubleshooting purposes.\n\nAlso, as a sanity check after a network event, it\u0027s a good idea for the controller / driver to be able to check with all the amphorae servicing a loadbalancer to make sure the running config matches what it should be, from the database.\n\n(Though, of course, I realize both of these features are further down the road than the need for this based on what Phillip said.)","commit_id":"82aec728eb852b6955161e5bd9072728dbefded1"},{"author":{"_account_id":11302,"name":"Phillip Toohill","email":"phillip.toohill@rackspace.com","username":"ptoohill1"},"change_message_id":"59b527349827e44916aff4d4195a38f6176327cd","unresolved":false,"context_lines":[{"line_number":997,"context_line":"  }"},{"line_number":998,"context_line":""},{"line_number":999,"context_line":"Get listener haproxy configuration"},{"line_number":1000,"context_line":"----------------------------------"},{"line_number":1001,"context_line":""},{"line_number":1002,"context_line":"* **URL:** /*:version*/listeners/*:listener*/haproxy"},{"line_number":1003,"context_line":"* **Method:** GET"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_d4bf1bfa","line":1000,"in_reply_to":"3a961159_5102f26f","updated":"2015-01-09 05:49:23.000000000","message":"I disagree. If we are to revert a bad config for whatever reason that would require it, it would be nice to simply rerun the process with the \u0027old\u0027 config.  \n\nTo further this; unless the controller sends both the updated config/listener and a backup this is almost required. This would also mean we would need a mechanism higher up in the chain to maintain that. \n\nMaybe there\u0027s another/better way to handle this case, and if so, could you please elaborate.","commit_id":"82aec728eb852b6955161e5bd9072728dbefded1"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"98f4179506cee584f37113c3e276aff13ae8f59e","unresolved":false,"context_lines":[{"line_number":997,"context_line":"  }"},{"line_number":998,"context_line":""},{"line_number":999,"context_line":"Get listener haproxy configuration"},{"line_number":1000,"context_line":"----------------------------------"},{"line_number":1001,"context_line":""},{"line_number":1002,"context_line":"* **URL:** /*:version*/listeners/*:listener*/haproxy"},{"line_number":1003,"context_line":"* **Method:** GET"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_5102f26f","line":1000,"in_reply_to":"3a961159_875b43f5","updated":"2014-12-18 05:17:56.000000000","message":"+1","commit_id":"82aec728eb852b6955161e5bd9072728dbefded1"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"ebc2b576f8a822f4e53f369fa45e094af02c43e3","unresolved":false,"context_lines":[{"line_number":997,"context_line":"  }"},{"line_number":998,"context_line":""},{"line_number":999,"context_line":"Get listener haproxy configuration"},{"line_number":1000,"context_line":"----------------------------------"},{"line_number":1001,"context_line":""},{"line_number":1002,"context_line":"* **URL:** /*:version*/listeners/*:listener*/haproxy"},{"line_number":1003,"context_line":"* **Method:** GET"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_34a21fae","line":1000,"in_reply_to":"3a961159_d4bf1bfa","updated":"2015-01-09 06:06:43.000000000","message":"hmm good point.  to do a proper rollback we will need to get the last working configuration, which we can assume this will give us.  We\u0027ll have to put the LB in ERROR state as a temporary solution for now.  Later we can implement a task based API request workflow (not related to taskflow) so its a better UX.","commit_id":"82aec728eb852b6955161e5bd9072728dbefded1"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"d4a8417254c2e4706c9cb00b4db3031aa5ef783e","unresolved":false,"context_lines":[{"line_number":93,"context_line":"* *hostname* - hostname of amphora"},{"line_number":94,"context_line":"* *uuid* - uuid of amphora"},{"line_number":95,"context_line":"* *topology* - One of: SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":96,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":97,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":98,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":99,"context_line":"  routing IP address for the ACTIVE-STANDBY pair."}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_e348cece","line":96,"updated":"2015-01-30 23:12:50.000000000","message":"(only applicable to ACTIVE-STANDBY)","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"9e0ba96b07ae00c6f92cf5c083a9fbc2d44efd0a","unresolved":false,"context_lines":[{"line_number":93,"context_line":"* *hostname* - hostname of amphora"},{"line_number":94,"context_line":"* *uuid* - uuid of amphora"},{"line_number":95,"context_line":"* *topology* - One of: SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":96,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":97,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":98,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":99,"context_line":"  routing IP address for the ACTIVE-STANDBY pair."}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_ab80514a","line":96,"in_reply_to":"da86d52c_e348cece","updated":"2015-02-13 23:34:34.000000000","message":"Done","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"d4a8417254c2e4706c9cb00b4db3031aa5ef783e","unresolved":false,"context_lines":[{"line_number":94,"context_line":"* *uuid* - uuid of amphora"},{"line_number":95,"context_line":"* *topology* - One of: SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":96,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":97,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":98,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":99,"context_line":"  routing IP address for the ACTIVE-STANDBY pair."},{"line_number":100,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_a33ed627","line":97,"updated":"2015-01-30 23:12:50.000000000","message":"I\u0027m not sure how the Amphora will actually know what this is -- it doesn\u0027t appear to be set in set_topology, which implies that it should somehow be able to look through the interfaces that are up and figure out which one is the management network? I would really have assumed that we\u0027d store this data on the Controller side when the Amphora was first spun up, and wouldn\u0027t need to retrieve it here.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"6370c1f1c7e371e7af0aa918d2fe0f7f57e29b69","unresolved":false,"context_lines":[{"line_number":94,"context_line":"* *uuid* - uuid of amphora"},{"line_number":95,"context_line":"* *topology* - One of: SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":96,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":97,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":98,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":99,"context_line":"  routing IP address for the ACTIVE-STANDBY pair."},{"line_number":100,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_ebf41789","line":97,"in_reply_to":"da86d52c_92a4bd58","updated":"2015-02-01 05:32:01.000000000","message":"I wonder if this might have something to do with the amphora knowing where to send heartbeats to.  Though it storing its own IP address wouldn\u0027t make sense in that case, but just a thought.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"dcf857c6c15071bdfffbff9d0ff0f3e831fc10b2","unresolved":false,"context_lines":[{"line_number":94,"context_line":"* *uuid* - uuid of amphora"},{"line_number":95,"context_line":"* *topology* - One of: SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":96,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":97,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":98,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":99,"context_line":"  routing IP address for the ACTIVE-STANDBY pair."},{"line_number":100,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_92a4bd58","line":97,"in_reply_to":"da86d52c_a33ed627","updated":"2015-01-31 01:20:08.000000000","message":"Good point","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"9e0ba96b07ae00c6f92cf5c083a9fbc2d44efd0a","unresolved":false,"context_lines":[{"line_number":94,"context_line":"* *uuid* - uuid of amphora"},{"line_number":95,"context_line":"* *topology* - One of: SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":96,"context_line":"* *role* - One of: ACTIVE, STANDBY"},{"line_number":97,"context_line":"* *ip* - (management) IP address of amphora"},{"line_number":98,"context_line":"* *ha_ip* - only applicable to ACTIVE-STANDBY topology: Highly-available"},{"line_number":99,"context_line":"  routing IP address for the ACTIVE-STANDBY pair."},{"line_number":100,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_cbeca52c","line":97,"in_reply_to":"da86d52c_ebf41789","updated":"2015-02-13 23:34:34.000000000","message":"removed - since we are working towards the controllers being a cluster there is no relationship controller - amphora anymore","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":12403,"name":"Al Miller","email":"al.miller@ajmiller.net","username":"ajmiller"},"change_message_id":"73da2b310b64db65b9603dcca7fdd3d301ede643","unresolved":false,"context_lines":[{"line_number":110,"context_line":"    \u0027uuid\u0027: \u00276e2bc8a0-2548-4fb7-a5f0-fb1ef4a696ce\u0027,"},{"line_number":111,"context_line":"    \u0027topology\u0027: \u0027SINGLE\u0027,"},{"line_number":112,"context_line":"    \u0027role\u0027: \u0027ACTIVE\u0027,"},{"line_number":113,"context_line":"    \u0027ip\u0027: \u002710.10.2.24\u0027,"},{"line_number":114,"context_line":"    \u0027ha_ip\u0027: \u0027\u0027,"},{"line_number":115,"context_line":"  }"},{"line_number":116,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a930d6b_736c2b36","line":113,"updated":"2015-01-24 06:15:39.000000000","message":"Nit.   RFC 5737 provides blocks 192.0.2.0/24 (TEST-NET-1), 198.51.100.0/24 (TEST-NET-2), and 203.0.113.0/24 (TEST-NET-3) that are intended for use in documentation.   Lots of openstack docs use 203.0.113.0/24.  For internal specs this is a non-issue, but if there is any chance this can end up being used externally it is generally a good idea to use one of the RFC 5737 ranges.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"9e0ba96b07ae00c6f92cf5c083a9fbc2d44efd0a","unresolved":false,"context_lines":[{"line_number":110,"context_line":"    \u0027uuid\u0027: \u00276e2bc8a0-2548-4fb7-a5f0-fb1ef4a696ce\u0027,"},{"line_number":111,"context_line":"    \u0027topology\u0027: \u0027SINGLE\u0027,"},{"line_number":112,"context_line":"    \u0027role\u0027: \u0027ACTIVE\u0027,"},{"line_number":113,"context_line":"    \u0027ip\u0027: \u002710.10.2.24\u0027,"},{"line_number":114,"context_line":"    \u0027ha_ip\u0027: \u0027\u0027,"},{"line_number":115,"context_line":"  }"},{"line_number":116,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_ab03f1bc","line":113,"in_reply_to":"1a930d6b_736c2b36","updated":"2015-02-13 23:34:34.000000000","message":"since I removed ip - not a problem any longer :-)","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"d4a8417254c2e4706c9cb00b4db3031aa5ef783e","unresolved":false,"context_lines":[{"line_number":122,"context_line":"* **Data params:**"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"  * *topology*: One of: SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":125,"context_line":"  * *role*: One of: ACTIVE, STANDBY"},{"line_number":126,"context_line":"  * *ha_ip*: (only applicable to ACTIVE-STANDBY) Highly-available IP for the"},{"line_number":127,"context_line":"    HA pair"},{"line_number":128,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_03d8821c","line":125,"updated":"2015-01-30 23:12:50.000000000","message":"(only applicable to ACTIVE-STANDBY)","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"9e0ba96b07ae00c6f92cf5c083a9fbc2d44efd0a","unresolved":false,"context_lines":[{"line_number":122,"context_line":"* **Data params:**"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"  * *topology*: One of: SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":125,"context_line":"  * *role*: One of: ACTIVE, STANDBY"},{"line_number":126,"context_line":"  * *ha_ip*: (only applicable to ACTIVE-STANDBY) Highly-available IP for the"},{"line_number":127,"context_line":"    HA pair"},{"line_number":128,"context_line":"  * *secret*: (only applicable to ACTIVE-STANDBY topology) Shared secret used"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_4bf435cf","line":125,"in_reply_to":"da86d52c_03d8821c","updated":"2015-02-13 23:34:34.000000000","message":"Done","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"1685fd183454fcb87cb02cbb50775be742f7153c","unresolved":false,"context_lines":[{"line_number":224,"context_line":""},{"line_number":225,"context_line":"* *hostname* - amphora hostname"},{"line_number":226,"context_line":"* *uuid* - amphora UUID"},{"line_number":227,"context_line":"* *version* - Version of haproxy amphora in use"},{"line_number":228,"context_line":"* *api_version* - Version of haproxy amphora API in use"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"**Notes:** The data in this request is used by the controller for determining"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_66cce736","line":227,"updated":"2015-01-31 06:13:15.000000000","message":"What does the version of the amphora mean? I would prefer two versions:\n- haproxy version\n- version of the amphora agent","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"9e0ba96b07ae00c6f92cf5c083a9fbc2d44efd0a","unresolved":false,"context_lines":[{"line_number":224,"context_line":""},{"line_number":225,"context_line":"* *hostname* - amphora hostname"},{"line_number":226,"context_line":"* *uuid* - amphora UUID"},{"line_number":227,"context_line":"* *version* - Version of haproxy amphora in use"},{"line_number":228,"context_line":"* *api_version* - Version of haproxy amphora API in use"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"**Notes:** The data in this request is used by the controller for determining"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_ab9f7164","line":227,"in_reply_to":"da86d52c_0bf24b9a","updated":"2015-02-13 23:34:34.000000000","message":"we could have a newer version of the agent (with bugs fixed) but still implementing the same api version","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"6370c1f1c7e371e7af0aa918d2fe0f7f57e29b69","unresolved":false,"context_lines":[{"line_number":224,"context_line":""},{"line_number":225,"context_line":"* *hostname* - amphora hostname"},{"line_number":226,"context_line":"* *uuid* - amphora UUID"},{"line_number":227,"context_line":"* *version* - Version of haproxy amphora in use"},{"line_number":228,"context_line":"* *api_version* - Version of haproxy amphora API in use"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"**Notes:** The data in this request is used by the controller for determining"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_0bf24b9a","line":227,"in_reply_to":"da86d52c_66cce736","updated":"2015-02-01 05:32:01.000000000","message":"isn\u0027t that exactly what version and api_version are defining? (Obviously version could be renamed to haproxy_version)","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"1685fd183454fcb87cb02cbb50775be742f7153c","unresolved":false,"context_lines":[{"line_number":267,"context_line":""},{"line_number":268,"context_line":"* *hostname* - amphora hostname"},{"line_number":269,"context_line":"* *uuid* - amphora UUID"},{"line_number":270,"context_line":"* *version* - Version of haproxy amphora in use"},{"line_number":271,"context_line":"* *api_version* - Version of haproxy amphora API in use"},{"line_number":272,"context_line":"* *network_tx* - Current total outbound bandwidth in bytes/sec (30-second"},{"line_number":273,"context_line":"  snapshot)"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_86d1dbcf","line":270,"updated":"2015-01-31 06:13:15.000000000","message":"sane as above. What do we mean with version?","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"6370c1f1c7e371e7af0aa918d2fe0f7f57e29b69","unresolved":false,"context_lines":[{"line_number":267,"context_line":""},{"line_number":268,"context_line":"* *hostname* - amphora hostname"},{"line_number":269,"context_line":"* *uuid* - amphora UUID"},{"line_number":270,"context_line":"* *version* - Version of haproxy amphora in use"},{"line_number":271,"context_line":"* *api_version* - Version of haproxy amphora API in use"},{"line_number":272,"context_line":"* *network_tx* - Current total outbound bandwidth in bytes/sec (30-second"},{"line_number":273,"context_line":"  snapshot)"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_8b355b48","line":270,"in_reply_to":"da86d52c_86d1dbcf","updated":"2015-02-01 05:32:01.000000000","message":"Looks like its the version of haproxy.  I suppose the definition can be interpreted differently.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"9e0ba96b07ae00c6f92cf5c083a9fbc2d44efd0a","unresolved":false,"context_lines":[{"line_number":267,"context_line":""},{"line_number":268,"context_line":"* *hostname* - amphora hostname"},{"line_number":269,"context_line":"* *uuid* - amphora UUID"},{"line_number":270,"context_line":"* *version* - Version of haproxy amphora in use"},{"line_number":271,"context_line":"* *api_version* - Version of haproxy amphora API in use"},{"line_number":272,"context_line":"* *network_tx* - Current total outbound bandwidth in bytes/sec (30-second"},{"line_number":273,"context_line":"  snapshot)"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_2ba1c195","line":270,"in_reply_to":"da86d52c_8b355b48","updated":"2015-02-13 23:34:34.000000000","message":"I will make it tow versions. So comment on the next draft --","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"d4a8417254c2e4706c9cb00b4db3031aa5ef783e","unresolved":false,"context_lines":[{"line_number":303,"context_line":"* *topology* - One of SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":304,"context_line":"* *topology_status* - One of OK, TOPOLOGY-CHANGE"},{"line_number":305,"context_line":"* *listeners* - list of listener UUIDs being serviced by this amphora"},{"line_number":306,"context_line":"* *packages* - list of load-balancing related packages installed with versions"},{"line_number":307,"context_line":"  (eg. OpenSSL, haproxy, nginx, etc.)"},{"line_number":308,"context_line":""},{"line_number":309,"context_line":"**Notes:** The data in this request is meant to provide intelligence for an"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_e3e44eae","line":306,"updated":"2015-01-30 23:12:50.000000000","message":"Did we decide that it was or was not possible to update packages on a running Amphora? I had assumed it would not be possible to update an existing Amphora, and that this information should be static based on the \"version\" given above.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"dcf857c6c15071bdfffbff9d0ff0f3e831fc10b2","unresolved":false,"context_lines":[{"line_number":303,"context_line":"* *topology* - One of SINGLE, ACTIVE-STANDBY, ACTIVE-ACTIVE"},{"line_number":304,"context_line":"* *topology_status* - One of OK, TOPOLOGY-CHANGE"},{"line_number":305,"context_line":"* *listeners* - list of listener UUIDs being serviced by this amphora"},{"line_number":306,"context_line":"* *packages* - list of load-balancing related packages installed with versions"},{"line_number":307,"context_line":"  (eg. OpenSSL, haproxy, nginx, etc.)"},{"line_number":308,"context_line":""},{"line_number":309,"context_line":"**Notes:** The data in this request is meant to provide intelligence for an"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_d25ab54f","line":306,"in_reply_to":"da86d52c_e3e44eae","updated":"2015-01-31 01:20:08.000000000","message":"Some companies require the \"security-updates\" setting in Ubuntu for images.  I think this should be a live list.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":12403,"name":"Al Miller","email":"al.miller@ajmiller.net","username":"ajmiller"},"change_message_id":"73da2b310b64db65b9603dcca7fdd3d301ede643","unresolved":false,"context_lines":[{"line_number":395,"context_line":"  PENDING_DELETE, DELETED, ERROR"},{"line_number":396,"context_line":"* *type* - One of: TCP, HTTP, TERMINATED_HTTPS"},{"line_number":397,"context_line":""},{"line_number":398,"context_line":"**Notes:** Note that this returns a status if *any* files exist for the"},{"line_number":399,"context_line":"listener (not just if there is a valid haproxy configuration)."},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"**Examples**"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a930d6b_93f0b792","line":398,"updated":"2015-01-24 06:15:39.000000000","message":"wrt \"*any* files exist\", just what files are these?  It is not clear from this context what other files than the haproxy configuration this could refer to.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"d4a8417254c2e4706c9cb00b4db3031aa5ef783e","unresolved":false,"context_lines":[{"line_number":395,"context_line":"  PENDING_DELETE, DELETED, ERROR"},{"line_number":396,"context_line":"* *type* - One of: TCP, HTTP, TERMINATED_HTTPS"},{"line_number":397,"context_line":""},{"line_number":398,"context_line":"**Notes:** Note that this returns a status if *any* files exist for the"},{"line_number":399,"context_line":"listener (not just if there is a valid haproxy configuration)."},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"**Examples**"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_83ed528e","line":398,"in_reply_to":"1a930d6b_93f0b792","updated":"2015-01-30 23:12:50.000000000","message":"I am actually curious about this too.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"9e0ba96b07ae00c6f92cf5c083a9fbc2d44efd0a","unresolved":false,"context_lines":[{"line_number":395,"context_line":"  PENDING_DELETE, DELETED, ERROR"},{"line_number":396,"context_line":"* *type* - One of: TCP, HTTP, TERMINATED_HTTPS"},{"line_number":397,"context_line":""},{"line_number":398,"context_line":"**Notes:** Note that this returns a status if *any* files exist for the"},{"line_number":399,"context_line":"listener (not just if there is a valid haproxy configuration)."},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"**Examples**"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_ebfc0975","line":398,"in_reply_to":"da86d52c_521de572","updated":"2015-02-13 23:34:34.000000000","message":"Done","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":11302,"name":"Phillip Toohill","email":"phillip.toohill@rackspace.com","username":"ptoohill1"},"change_message_id":"8641b85fd5bd69410485c1fc597e907c0d54888f","unresolved":false,"context_lines":[{"line_number":395,"context_line":"  PENDING_DELETE, DELETED, ERROR"},{"line_number":396,"context_line":"* *type* - One of: TCP, HTTP, TERMINATED_HTTPS"},{"line_number":397,"context_line":""},{"line_number":398,"context_line":"**Notes:** Note that this returns a status if *any* files exist for the"},{"line_number":399,"context_line":"listener (not just if there is a valid haproxy configuration)."},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"**Examples**"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_9e01293c","line":398,"in_reply_to":"da86d52c_83ed528e","updated":"2015-01-31 00:02:39.000000000","message":"Im assuming he is referring to PIDs. As we will be querying the stats socket for this info. Could be a tad more clear if this assumption is correct. Otherwise knowledge of where were getting the stats from is required.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"dcf857c6c15071bdfffbff9d0ff0f3e831fc10b2","unresolved":false,"context_lines":[{"line_number":395,"context_line":"  PENDING_DELETE, DELETED, ERROR"},{"line_number":396,"context_line":"* *type* - One of: TCP, HTTP, TERMINATED_HTTPS"},{"line_number":397,"context_line":""},{"line_number":398,"context_line":"**Notes:** Note that this returns a status if *any* files exist for the"},{"line_number":399,"context_line":"listener (not just if there is a valid haproxy configuration)."},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"**Examples**"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_521de572","line":398,"in_reply_to":"da86d52c_9e01293c","updated":"2015-01-31 01:20:08.000000000","message":"There are process startup files likely, but I\u0027m not sure why those would matter for status.  This needs clarification.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"d4a8417254c2e4706c9cb00b4db3031aa5ef783e","unresolved":false,"context_lines":[{"line_number":450,"context_line":"* *members* - Map of member UUIDs and their overall UP / DOWN status"},{"line_number":451,"context_line":""},{"line_number":452,"context_line":""},{"line_number":453,"context_line":"**Notes:** Note that this returns a status if *any* files exist for the"},{"line_number":454,"context_line":"listener (not just if there is a valid haproxy configuration)."},{"line_number":455,"context_line":""},{"line_number":456,"context_line":"**Examples**"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_639f7e04","line":453,"updated":"2015-01-30 23:12:50.000000000","message":"Same question as above. What original concern caused this to be explicitly stated? Does anyone remember?","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":11302,"name":"Phillip Toohill","email":"phillip.toohill@rackspace.com","username":"ptoohill1"},"change_message_id":"8641b85fd5bd69410485c1fc597e907c0d54888f","unresolved":false,"context_lines":[{"line_number":450,"context_line":"* *members* - Map of member UUIDs and their overall UP / DOWN status"},{"line_number":451,"context_line":""},{"line_number":452,"context_line":""},{"line_number":453,"context_line":"**Notes:** Note that this returns a status if *any* files exist for the"},{"line_number":454,"context_line":"listener (not just if there is a valid haproxy configuration)."},{"line_number":455,"context_line":""},{"line_number":456,"context_line":"**Examples**"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_defba145","line":453,"in_reply_to":"da86d52c_639f7e04","updated":"2015-01-31 00:02:39.000000000","message":"Same as my reply above","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"6370c1f1c7e371e7af0aa918d2fe0f7f57e29b69","unresolved":false,"context_lines":[{"line_number":450,"context_line":"* *members* - Map of member UUIDs and their overall UP / DOWN status"},{"line_number":451,"context_line":""},{"line_number":452,"context_line":""},{"line_number":453,"context_line":"**Notes:** Note that this returns a status if *any* files exist for the"},{"line_number":454,"context_line":"listener (not just if there is a valid haproxy configuration)."},{"line_number":455,"context_line":""},{"line_number":456,"context_line":"**Examples**"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_eb225700","line":453,"in_reply_to":"da86d52c_defba145","updated":"2015-02-01 05:32:01.000000000","message":"I think phil is right on this.  To get the status of an haproxy process that is not running it would need to check if files exist for it.  If a weird set of files exist for the haproxy process (listener) then maybe it\u0027ll return a MISCONFIGURED status or something.  Just my interpretation.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"9e0ba96b07ae00c6f92cf5c083a9fbc2d44efd0a","unresolved":false,"context_lines":[{"line_number":450,"context_line":"* *members* - Map of member UUIDs and their overall UP / DOWN status"},{"line_number":451,"context_line":""},{"line_number":452,"context_line":""},{"line_number":453,"context_line":"**Notes:** Note that this returns a status if *any* files exist for the"},{"line_number":454,"context_line":"listener (not just if there is a valid haproxy configuration)."},{"line_number":455,"context_line":""},{"line_number":456,"context_line":"**Examples**"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_cb15859c","line":453,"in_reply_to":"da86d52c_eb225700","updated":"2015-02-13 23:34:34.000000000","message":"Done","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"6370c1f1c7e371e7af0aa918d2fe0f7f57e29b69","unresolved":false,"context_lines":[{"line_number":463,"context_line":"  {"},{"line_number":464,"context_line":"    \u0027status\u0027: \u0027UP\u0027,"},{"line_number":465,"context_line":"    \u0027uuid\u0027: \u0027e2dfddc0-5b9e-11e4-8ed6-0800200c9a66\u0027,"},{"line_number":466,"context_line":"    \u0027provisioning_status\u0027: \u0027ACTIVE\u0027,"},{"line_number":467,"context_line":"    \u0027type\u0027: \u0027HTTP\u0027,"},{"line_number":468,"context_line":"    \u0027pools\u0027:["},{"line_number":469,"context_line":"      {"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_cb6cb339","line":466,"updated":"2015-02-01 05:32:01.000000000","message":"i wonder if this is overkill, roll this into status.  at least until it is decided we need a field like this to be different from status.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"9e0ba96b07ae00c6f92cf5c083a9fbc2d44efd0a","unresolved":false,"context_lines":[{"line_number":463,"context_line":"  {"},{"line_number":464,"context_line":"    \u0027status\u0027: \u0027UP\u0027,"},{"line_number":465,"context_line":"    \u0027uuid\u0027: \u0027e2dfddc0-5b9e-11e4-8ed6-0800200c9a66\u0027,"},{"line_number":466,"context_line":"    \u0027provisioning_status\u0027: \u0027ACTIVE\u0027,"},{"line_number":467,"context_line":"    \u0027type\u0027: \u0027HTTP\u0027,"},{"line_number":468,"context_line":"    \u0027pools\u0027:["},{"line_number":469,"context_line":"      {"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_eb58898c","line":466,"in_reply_to":"da86d52c_cb6cb339","updated":"2015-02-13 23:34:34.000000000","message":"agreed","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":11302,"name":"Phillip Toohill","email":"phillip.toohill@rackspace.com","username":"ptoohill1"},"change_message_id":"8641b85fd5bd69410485c1fc597e907c0d54888f","unresolved":false,"context_lines":[{"line_number":496,"context_line":""},{"line_number":497,"context_line":"Start or Stop a listener"},{"line_number":498,"context_line":"------------------------"},{"line_number":499,"context_line":""},{"line_number":500,"context_line":"* **URL:** /*:version*/listeners/*:listener*/*:action*"},{"line_number":501,"context_line":"* **Method:** PUT"},{"line_number":502,"context_line":"* **URL params:**"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_be5a6d4e","line":499,"updated":"2015-01-31 00:02:39.000000000","message":"Should we allow for param/tag to soft restart or should this be another call. ex. enable/disable. This allows for a \u0027graceful\u0027 reload where as this method is hard start/stop.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"6370c1f1c7e371e7af0aa918d2fe0f7f57e29b69","unresolved":false,"context_lines":[{"line_number":496,"context_line":""},{"line_number":497,"context_line":"Start or Stop a listener"},{"line_number":498,"context_line":"------------------------"},{"line_number":499,"context_line":""},{"line_number":500,"context_line":"* **URL:** /*:version*/listeners/*:listener*/*:action*"},{"line_number":501,"context_line":"* **Method:** PUT"},{"line_number":502,"context_line":"* **URL params:**"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_cbdaf3e8","line":499,"in_reply_to":"da86d52c_218d797c","updated":"2015-02-01 05:32:01.000000000","message":"I think this is one of those debates that won\u0027t get solved until we actually have code implemented.  My suggestion is we implement the simplest option between these two and re-evaluate after some trial time. \n\nMy first thought of what the simplest option is the where the agent running doesn\u0027t start the haproxy at all unless the agent receives an explicit command to start/stop/restart.  Of course, that just pushes the intelligence of when to start/stop/restart up to the controller.  I think that is easier to do on the controller than on the amphora itself, especially with how the certs are going to be done.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":11302,"name":"Phillip Toohill","email":"phillip.toohill@rackspace.com","username":"ptoohill1"},"change_message_id":"83c9efd83fbbd28aaa442e213e4b91b6230c5274","unresolved":false,"context_lines":[{"line_number":496,"context_line":""},{"line_number":497,"context_line":"Start or Stop a listener"},{"line_number":498,"context_line":"------------------------"},{"line_number":499,"context_line":""},{"line_number":500,"context_line":"* **URL:** /*:version*/listeners/*:listener*/*:action*"},{"line_number":501,"context_line":"* **Method:** PUT"},{"line_number":502,"context_line":"* **URL params:**"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_218d797c","line":499,"in_reply_to":"da86d52c_26a74f51","updated":"2015-01-31 07:01:16.000000000","message":"Theres a difference between enabling and starting likewise disabling/reloading and restarting. Were defining parameters and definition of API here, sure the api may do certain things in the backend, but this is ultimately an API for the driver where the deciding logic resides. The api/agent does the work and with many different permutations of options here why wouldnt we let the driver decide. It doesnt have to be additional methods but i would like to be able to tell the API to do what i want it to and not make too many decisions for me.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"1685fd183454fcb87cb02cbb50775be742f7153c","unresolved":false,"context_lines":[{"line_number":496,"context_line":""},{"line_number":497,"context_line":"Start or Stop a listener"},{"line_number":498,"context_line":"------------------------"},{"line_number":499,"context_line":""},{"line_number":500,"context_line":"* **URL:** /*:version*/listeners/*:listener*/*:action*"},{"line_number":501,"context_line":"* **Method:** PUT"},{"line_number":502,"context_line":"* **URL params:**"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_26a74f51","line":499,"in_reply_to":"da86d52c_3505bbc2","updated":"2015-01-31 06:13:15.000000000","message":"Yeah, I am not sure why we need explicit methods here -- starting means likely enabling which could also mean that we change an ipsec rule instead of actually starting haproxy -- so we are leaking an implementation detail we don\u0027t necessarily have to do. (not a deal breaker but food for thought)","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"dcf857c6c15071bdfffbff9d0ff0f3e831fc10b2","unresolved":false,"context_lines":[{"line_number":496,"context_line":""},{"line_number":497,"context_line":"Start or Stop a listener"},{"line_number":498,"context_line":"------------------------"},{"line_number":499,"context_line":""},{"line_number":500,"context_line":"* **URL:** /*:version*/listeners/*:listener*/*:action*"},{"line_number":501,"context_line":"* **Method:** PUT"},{"line_number":502,"context_line":"* **URL params:**"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_3505bbc2","line":499,"in_reply_to":"da86d52c_be5a6d4e","updated":"2015-01-31 01:20:08.000000000","message":"Hmm, could be valuable.  For normal configuration updates the \"Upload listener haproxy configuration\" will do a graceful reload.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"9e0ba96b07ae00c6f92cf5c083a9fbc2d44efd0a","unresolved":false,"context_lines":[{"line_number":496,"context_line":""},{"line_number":497,"context_line":"Start or Stop a listener"},{"line_number":498,"context_line":"------------------------"},{"line_number":499,"context_line":""},{"line_number":500,"context_line":"* **URL:** /*:version*/listeners/*:listener*/*:action*"},{"line_number":501,"context_line":"* **Method:** PUT"},{"line_number":502,"context_line":"* **URL params:**"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_8ba54d49","line":499,"in_reply_to":"da86d52c_cbdaf3e8","updated":"2015-02-13 23:34:34.000000000","message":"added new type of reload","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"d4a8417254c2e4706c9cb00b4db3031aa5ef783e","unresolved":false,"context_lines":[{"line_number":716,"context_line":""},{"line_number":717,"context_line":"* **Implied actions:**"},{"line_number":718,"context_line":""},{"line_number":719,"context_line":"  * Restart haproxy for the given listener."},{"line_number":720,"context_line":""},{"line_number":721,"context_line":"**Notes:** filename.pem should match the primary CN for which the"},{"line_number":722,"context_line":"certificate is valid. All-caps WILDCARD should be used to replace an asterisk"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_83bb9271","line":719,"updated":"2015-01-30 23:12:50.000000000","message":"Does this require a *restart* or just a config *reload*?","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"1685fd183454fcb87cb02cbb50775be742f7153c","unresolved":false,"context_lines":[{"line_number":716,"context_line":""},{"line_number":717,"context_line":"* **Implied actions:**"},{"line_number":718,"context_line":""},{"line_number":719,"context_line":"  * Restart haproxy for the given listener."},{"line_number":720,"context_line":""},{"line_number":721,"context_line":"**Notes:** filename.pem should match the primary CN for which the"},{"line_number":722,"context_line":"certificate is valid. All-caps WILDCARD should be used to replace an asterisk"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_e65a974f","line":719,"in_reply_to":"da86d52c_15d8b71c","updated":"2015-01-31 06:13:15.000000000","message":"I think there are two cases:\n- we do a hot swap of the cert and want to minimize downtime. In that vase I would assume that this operation gracefully restarts haproxy\n- we \"disable/stop\" happroxy before the operation as part of a \"bigger\" configuration change -- in that case I would assume we are not performing the restart\n\nI think it\u0027s easy for the amphora agent/api to determine when to restart and when not. So let\u0027s just document those two cases...","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":11302,"name":"Phillip Toohill","email":"phillip.toohill@rackspace.com","username":"ptoohill1"},"change_message_id":"8641b85fd5bd69410485c1fc597e907c0d54888f","unresolved":false,"context_lines":[{"line_number":716,"context_line":""},{"line_number":717,"context_line":"* **Implied actions:**"},{"line_number":718,"context_line":""},{"line_number":719,"context_line":"  * Restart haproxy for the given listener."},{"line_number":720,"context_line":""},{"line_number":721,"context_line":"**Notes:** filename.pem should match the primary CN for which the"},{"line_number":722,"context_line":"certificate is valid. All-caps WILDCARD should be used to replace an asterisk"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_9eaf692b","line":719,"in_reply_to":"da86d52c_83bb9271","updated":"2015-01-31 00:02:39.000000000","message":"Im against having restarts/stops/starts of any kind within individual operations. I feel they should be called by the driver. So the flow would be call-\u003eupload_cert, call-\u003erestart/stop/start haproxy.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"dcf857c6c15071bdfffbff9d0ff0f3e831fc10b2","unresolved":false,"context_lines":[{"line_number":716,"context_line":""},{"line_number":717,"context_line":"* **Implied actions:**"},{"line_number":718,"context_line":""},{"line_number":719,"context_line":"  * Restart haproxy for the given listener."},{"line_number":720,"context_line":""},{"line_number":721,"context_line":"**Notes:** filename.pem should match the primary CN for which the"},{"line_number":722,"context_line":"certificate is valid. All-caps WILDCARD should be used to replace an asterisk"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_d5e37f03","line":719,"in_reply_to":"da86d52c_9eaf692b","updated":"2015-01-31 01:20:08.000000000","message":"I think it should be a reload.\nAs for separate restart calls, I see the benefit of reducing round trips with the controller.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"6370c1f1c7e371e7af0aa918d2fe0f7f57e29b69","unresolved":false,"context_lines":[{"line_number":716,"context_line":""},{"line_number":717,"context_line":"* **Implied actions:**"},{"line_number":718,"context_line":""},{"line_number":719,"context_line":"  * Restart haproxy for the given listener."},{"line_number":720,"context_line":""},{"line_number":721,"context_line":"**Notes:** filename.pem should match the primary CN for which the"},{"line_number":722,"context_line":"certificate is valid. All-caps WILDCARD should be used to replace an asterisk"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_ebfed737","line":719,"in_reply_to":"da86d52c_c171fd78","updated":"2015-02-01 05:32:01.000000000","message":"with the complexity phil is describing, it seems like the simplest solution is having the controller decide.  This doesn\u0027t mean we can\u0027t go back and change it later.\n\nAnother thought: wouldn\u0027t it be possible to have an upload_config call take in a new config AND the necessary certs needed in the same call?","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":11302,"name":"Phillip Toohill","email":"phillip.toohill@rackspace.com","username":"ptoohill1"},"change_message_id":"49405a53d216d4e05b69ad7ae461840e3c96b8f7","unresolved":false,"context_lines":[{"line_number":716,"context_line":""},{"line_number":717,"context_line":"* **Implied actions:**"},{"line_number":718,"context_line":""},{"line_number":719,"context_line":"  * Restart haproxy for the given listener."},{"line_number":720,"context_line":""},{"line_number":721,"context_line":"**Notes:** filename.pem should match the primary CN for which the"},{"line_number":722,"context_line":"certificate is valid. All-caps WILDCARD should be used to replace an asterisk"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_15d8b71c","line":719,"in_reply_to":"da86d52c_d5e37f03","updated":"2015-01-31 01:28:39.000000000","message":"I still think we shouldnt allow the methods like this or upload_config to do a restart regardless if its graceful. The driver would be the one making these calls, not the controller. Reason is if there was a cert configured in the haproxy configuration but the cert was not uploaded there would be failures even if its graceful. I think we should let the driver decide when/how to restart/reload. \n\nGranted we could just make sure to document that there is a specific order and assume that is followed then this is not an issue. I just dont see one additional api call as too much overhead and would ensure no accidental failures.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":11302,"name":"Phillip Toohill","email":"phillip.toohill@rackspace.com","username":"ptoohill1"},"change_message_id":"83c9efd83fbbd28aaa442e213e4b91b6230c5274","unresolved":false,"context_lines":[{"line_number":716,"context_line":""},{"line_number":717,"context_line":"* **Implied actions:**"},{"line_number":718,"context_line":""},{"line_number":719,"context_line":"  * Restart haproxy for the given listener."},{"line_number":720,"context_line":""},{"line_number":721,"context_line":"**Notes:** filename.pem should match the primary CN for which the"},{"line_number":722,"context_line":"certificate is valid. All-caps WILDCARD should be used to replace an asterisk"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_c171fd78","line":719,"in_reply_to":"da86d52c_e65a974f","updated":"2015-01-31 07:01:16.000000000","message":"The problem with this is now for every cert that I need to upload we restart/reload or what ever. \n\nSame as my opinion above, I would like the driver to be able to tell the API what to do in the backend and not have to determine what the driver actually wants on its own. \n\nSimply documenting the cases doesnt help with what the API is going to do from a driver perspective. If I decide in the driver that I NEED a full restart because im uploading a new AND a new config for whatever reason the driver has no way to tell this API to so and I will have to assume that when I upload this cert itll hard stop/soft stop the server, which means its running with only the new certificate that we just uploaded but not the actual configuration change that actually uses the new cert making this completely pointless. Same goes for the upload_config method... If i upload a new config that requires the certificate but I restart/reload before i call the upload_cert I just restarted/reloaded for no reason and new connections would fail in either case. The only case i see this being acceptable is if we have to reupload the certificate because it was the wrong one or bad or something along those lines. In this case, all we need is to upload certificate and restart. I cant think of another case where this makes sense.  \n\nTL;DR: It doesnt make much sense to have a upload_config/upload_cert do the restart/reload unless specifically told to do so.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"9e0ba96b07ae00c6f92cf5c083a9fbc2d44efd0a","unresolved":false,"context_lines":[{"line_number":716,"context_line":""},{"line_number":717,"context_line":"* **Implied actions:**"},{"line_number":718,"context_line":""},{"line_number":719,"context_line":"  * Restart haproxy for the given listener."},{"line_number":720,"context_line":""},{"line_number":721,"context_line":"**Notes:** filename.pem should match the primary CN for which the"},{"line_number":722,"context_line":"certificate is valid. All-caps WILDCARD should be used to replace an asterisk"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_6b7f39ac","line":719,"in_reply_to":"da86d52c_ebfed737","updated":"2015-02-13 23:34:34.000000000","message":"will remove that side effect","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":11302,"name":"Phillip Toohill","email":"phillip.toohill@rackspace.com","username":"ptoohill1"},"change_message_id":"8641b85fd5bd69410485c1fc597e907c0d54888f","unresolved":false,"context_lines":[{"line_number":948,"context_line":"  * Do a syntax check on haproxy configuration file prior to an attempt to"},{"line_number":949,"context_line":"    run it."},{"line_number":950,"context_line":"  * Add IPs, iptables accounting rules, etc. to this amphora if they\u0027re"},{"line_number":951,"context_line":"    not already present."},{"line_number":952,"context_line":""},{"line_number":953,"context_line":"**Notes:** The uploaded configuration file should be a complete and"},{"line_number":954,"context_line":"syntactically-correct haproxy config. The amphora does not have intelligence"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_7e171552","line":951,"updated":"2015-01-31 00:02:39.000000000","message":"I was under the impression the networking/compute layer would ensure the amphorae are properly wired up, is this not the case?","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"6370c1f1c7e371e7af0aa918d2fe0f7f57e29b69","unresolved":false,"context_lines":[{"line_number":948,"context_line":"  * Do a syntax check on haproxy configuration file prior to an attempt to"},{"line_number":949,"context_line":"    run it."},{"line_number":950,"context_line":"  * Add IPs, iptables accounting rules, etc. to this amphora if they\u0027re"},{"line_number":951,"context_line":"    not already present."},{"line_number":952,"context_line":""},{"line_number":953,"context_line":"**Notes:** The uploaded configuration file should be a complete and"},{"line_number":954,"context_line":"syntactically-correct haproxy config. The amphora does not have intelligence"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_aba4df57","line":951,"in_reply_to":"da86d52c_610a11d4","updated":"2015-02-01 05:32:01.000000000","message":"I believe in this case BBG was planning on getting some stats from iptables. Not sure if the rest of us were going to do that or not, but stil it doesnt hurt to have this here.  It could all basically just say \"add resources needed for stats, logs, and connectivity\"","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"dcf857c6c15071bdfffbff9d0ff0f3e831fc10b2","unresolved":false,"context_lines":[{"line_number":948,"context_line":"  * Do a syntax check on haproxy configuration file prior to an attempt to"},{"line_number":949,"context_line":"    run it."},{"line_number":950,"context_line":"  * Add IPs, iptables accounting rules, etc. to this amphora if they\u0027re"},{"line_number":951,"context_line":"    not already present."},{"line_number":952,"context_line":""},{"line_number":953,"context_line":"**Notes:** The uploaded configuration file should be a complete and"},{"line_number":954,"context_line":"syntactically-correct haproxy config. The amphora does not have intelligence"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_d5ca9f6d","line":951,"in_reply_to":"da86d52c_7e171552","updated":"2015-01-31 01:20:08.000000000","message":"Yes.  I think he is trying to capture the guest OS network setup.  One company mentioned using iptables rules for accounting.  It may need to set the IP on the interface that was wired up via the networking driver in the guest OS.","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"9e0ba96b07ae00c6f92cf5c083a9fbc2d44efd0a","unresolved":false,"context_lines":[{"line_number":948,"context_line":"  * Do a syntax check on haproxy configuration file prior to an attempt to"},{"line_number":949,"context_line":"    run it."},{"line_number":950,"context_line":"  * Add IPs, iptables accounting rules, etc. to this amphora if they\u0027re"},{"line_number":951,"context_line":"    not already present."},{"line_number":952,"context_line":""},{"line_number":953,"context_line":"**Notes:** The uploaded configuration file should be a complete and"},{"line_number":954,"context_line":"syntactically-correct haproxy config. The amphora does not have intelligence"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_0b16bd55","line":951,"in_reply_to":"da86d52c_aba4df57","updated":"2015-02-13 23:34:34.000000000","message":"Done","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":11302,"name":"Phillip Toohill","email":"phillip.toohill@rackspace.com","username":"ptoohill1"},"change_message_id":"83c9efd83fbbd28aaa442e213e4b91b6230c5274","unresolved":false,"context_lines":[{"line_number":948,"context_line":"  * Do a syntax check on haproxy configuration file prior to an attempt to"},{"line_number":949,"context_line":"    run it."},{"line_number":950,"context_line":"  * Add IPs, iptables accounting rules, etc. to this amphora if they\u0027re"},{"line_number":951,"context_line":"    not already present."},{"line_number":952,"context_line":""},{"line_number":953,"context_line":"**Notes:** The uploaded configuration file should be a complete and"},{"line_number":954,"context_line":"syntactically-correct haproxy config. The amphora does not have intelligence"}],"source_content_type":"text/x-rst","patch_set":5,"id":"da86d52c_610a11d4","line":951,"in_reply_to":"da86d52c_d5ca9f6d","updated":"2015-01-31 07:01:16.000000000","message":"Is this something the reference driver needs to worry about? Wouldn\u0027t that be a driver that\u0027s specific to that company?","commit_id":"26180760096b6a39f614790536ff5956ddba87d2"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"a82fe6063e2f080d97e75143b79800c37a74afc3","unresolved":false,"context_lines":[{"line_number":222,"context_line":""},{"line_number":223,"context_line":"* *hostname* - amphora hostname"},{"line_number":224,"context_line":"* *uuid* - amphora UUID"},{"line_number":225,"context_line":"* *version* - Version of amphora agent in use"},{"line_number":226,"context_line":"* *haproxy_version* - Version of the haproxy installed"},{"line_number":227,"context_line":"* *api_version* - Version of haproxy amphora API in use"},{"line_number":228,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"da86d52c_ae9f7f64","line":225,"updated":"2015-02-13 23:48:27.000000000","message":"To me, this meant the version of the base-image that was used (which would probably be read out of some file stamped onto the base image). API Version would take care of the agent version, I would assume (and could use minor-versions for \"new agent but no API change\").","commit_id":"a629b54791d667452ba6cd12b49b6466c180e0ab"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"610cda4c677e042585ab9971bec351b95fadbb77","unresolved":false,"context_lines":[{"line_number":222,"context_line":""},{"line_number":223,"context_line":"* *hostname* - amphora hostname"},{"line_number":224,"context_line":"* *uuid* - amphora UUID"},{"line_number":225,"context_line":"* *version* - Version of amphora agent in use"},{"line_number":226,"context_line":"* *haproxy_version* - Version of the haproxy installed"},{"line_number":227,"context_line":"* *api_version* - Version of haproxy amphora API in use"},{"line_number":228,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"da86d52c_b6fb1a46","line":225,"in_reply_to":"da86d52c_2ed9cff4","updated":"2015-02-17 04:16:45.000000000","message":"yeah i dont see much use yet of having an agent version and an API version.  sounds like they can be rolled into one.  But like German, no strong opinion.","commit_id":"a629b54791d667452ba6cd12b49b6466c180e0ab"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"ca5795a7839a0caf255bab399bcf1b1f8ad40175","unresolved":false,"context_lines":[{"line_number":222,"context_line":""},{"line_number":223,"context_line":"* *hostname* - amphora hostname"},{"line_number":224,"context_line":"* *uuid* - amphora UUID"},{"line_number":225,"context_line":"* *version* - Version of amphora agent in use"},{"line_number":226,"context_line":"* *haproxy_version* - Version of the haproxy installed"},{"line_number":227,"context_line":"* *api_version* - Version of haproxy amphora API in use"},{"line_number":228,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"da86d52c_2ed9cff4","line":225,"in_reply_to":"da86d52c_ae9f7f64","updated":"2015-02-13 23:56:55.000000000","message":"ok, let\u0027s have others weigh in if minor versions in the api_version to indicate a new agent version without an api change are ok. I have no strong opinion on that...","commit_id":"a629b54791d667452ba6cd12b49b6466c180e0ab"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"c79708f8b113d8c45b5695b234f6eb96a0d251f0","unresolved":false,"context_lines":[{"line_number":222,"context_line":""},{"line_number":223,"context_line":"* *hostname* - amphora hostname"},{"line_number":224,"context_line":"* *uuid* - amphora UUID"},{"line_number":225,"context_line":"* *version* - Version of amphora agent in use"},{"line_number":226,"context_line":"* *haproxy_version* - Version of the haproxy installed"},{"line_number":227,"context_line":"* *api_version* - Version of haproxy amphora API in use"},{"line_number":228,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"da86d52c_58fbd246","line":225,"in_reply_to":"da86d52c_b6fb1a46","updated":"2015-02-17 17:31:45.000000000","message":"I usually track the base image version via the GUID in nova, so I\u0027m not sure how useful stamping another version into the image would be and making it accessible here.  Just query nova for the GUID of the image used.\nTo me it seems like the image, agent, and API (implemented by the agent) are all tied together.\nSo, for me, German\u0027s proposal works, but I also don\u0027t have a strong opinion.","commit_id":"a629b54791d667452ba6cd12b49b6466c180e0ab"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"a82fe6063e2f080d97e75143b79800c37a74afc3","unresolved":false,"context_lines":[{"line_number":266,"context_line":""},{"line_number":267,"context_line":"* *hostname* - amphora hostname"},{"line_number":268,"context_line":"* *uuid* - amphora UUID"},{"line_number":269,"context_line":"* *version* - Version of amphora agent in use"},{"line_number":270,"context_line":"* *haproxy_version* - Version of the haproxy installed"},{"line_number":271,"context_line":"* *api_version* - Version of haproxy amphora API in use"},{"line_number":272,"context_line":"* *network_tx* - Current total outbound bandwidth in bytes/sec (30-second"}],"source_content_type":"text/x-rst","patch_set":6,"id":"da86d52c_0eafab95","line":269,"updated":"2015-02-13 23:48:27.000000000","message":"Same as above, since this is essentially duplicating all of the info from the above call and just tacking on some extras.","commit_id":"a629b54791d667452ba6cd12b49b6466c180e0ab"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"a82fe6063e2f080d97e75143b79800c37a74afc3","unresolved":false,"context_lines":[{"line_number":394,"context_line":"* *uuid* - Listener UUID"},{"line_number":395,"context_line":"* *type* - One of: TCP, HTTP, TERMINATED_HTTPS"},{"line_number":396,"context_line":""},{"line_number":397,"context_line":"**Notes:** Note that this returns a status even if only a pid files exist or"},{"line_number":398,"context_line":"a stats socket for the listener (not just if there is a valid haproxy"},{"line_number":399,"context_line":"configuration)."},{"line_number":400,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"da86d52c_ceb913cd","line":397,"updated":"2015-02-13 23:48:27.000000000","message":"Wait, is this supposed to be \"only if a pid file exists\"? Or... .... The grammar in this whole sentence is a bit wonky.","commit_id":"a629b54791d667452ba6cd12b49b6466c180e0ab"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"6fd322c23bb7db6466f440baf7cd1d43b24e3fb4","unresolved":false,"context_lines":[{"line_number":394,"context_line":"* *uuid* - Listener UUID"},{"line_number":395,"context_line":"* *type* - One of: TCP, HTTP, TERMINATED_HTTPS"},{"line_number":396,"context_line":""},{"line_number":397,"context_line":"**Notes:** Note that this returns a status even if only a pid files exist or"},{"line_number":398,"context_line":"a stats socket for the listener (not just if there is a valid haproxy"},{"line_number":399,"context_line":"configuration)."},{"line_number":400,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"da86d52c_f9978338","line":397,"in_reply_to":"da86d52c_ce98331e","updated":"2015-02-14 00:24:09.000000000","message":"Ok, my issue is just that the wording is really confusing as it exists currently.","commit_id":"a629b54791d667452ba6cd12b49b6466c180e0ab"},{"author":{"_account_id":10850,"name":"German Eichberger","email":"german.eichberger@gmail.com","username":"german"},"change_message_id":"ca5795a7839a0caf255bab399bcf1b1f8ad40175","unresolved":false,"context_lines":[{"line_number":394,"context_line":"* *uuid* - Listener UUID"},{"line_number":395,"context_line":"* *type* - One of: TCP, HTTP, TERMINATED_HTTPS"},{"line_number":396,"context_line":""},{"line_number":397,"context_line":"**Notes:** Note that this returns a status even if only a pid files exist or"},{"line_number":398,"context_line":"a stats socket for the listener (not just if there is a valid haproxy"},{"line_number":399,"context_line":"configuration)."},{"line_number":400,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"da86d52c_ce98331e","line":397,"in_reply_to":"da86d52c_ceb913cd","updated":"2015-02-13 23:56:55.000000000","message":"I think we should return something if any of the following exists:\n* pid file\n* stats socket\n* haproxy configuration","commit_id":"a629b54791d667452ba6cd12b49b6466c180e0ab"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"c79708f8b113d8c45b5695b234f6eb96a0d251f0","unresolved":false,"context_lines":[{"line_number":394,"context_line":"* *uuid* - Listener UUID"},{"line_number":395,"context_line":"* *type* - One of: TCP, HTTP, TERMINATED_HTTPS"},{"line_number":396,"context_line":""},{"line_number":397,"context_line":"**Notes:** Note that this returns a status even if only a pid files exist or"},{"line_number":398,"context_line":"a stats socket for the listener (not just if there is a valid haproxy"},{"line_number":399,"context_line":"configuration)."},{"line_number":400,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"da86d52c_d843426a","line":397,"in_reply_to":"da86d52c_f9978338","updated":"2015-02-17 17:31:45.000000000","message":"NIT, could be re-worded:\n**Notes:** Note that this returns a status if: the pid file exists, the stats socket exists, or an haproxy configuration is present (not just if there is a valid haproxy configuration).","commit_id":"a629b54791d667452ba6cd12b49b6466c180e0ab"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"a82fe6063e2f080d97e75143b79800c37a74afc3","unresolved":false,"context_lines":[{"line_number":447,"context_line":"* *members* - Map of member UUIDs and their overall UP / DOWN status"},{"line_number":448,"context_line":""},{"line_number":449,"context_line":""},{"line_number":450,"context_line":"**Notes:** Note that this returns a status even if only a pid files exist or"},{"line_number":451,"context_line":"a stats socket for the listener (not just if there is a valid haproxy"},{"line_number":452,"context_line":"configuration)."},{"line_number":453,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"da86d52c_0eb40bd0","line":450,"updated":"2015-02-13 23:48:27.000000000","message":"Same comment as above.","commit_id":"a629b54791d667452ba6cd12b49b6466c180e0ab"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"c7cb318b61723d8afdc4b14fe5e97871a5370918","unresolved":false,"context_lines":[{"line_number":221,"context_line":"JSON Response attributes:"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"* *hostname* - amphora hostname"},{"line_number":224,"context_line":"* *uuid* - amphora UUID"},{"line_number":225,"context_line":"* *haproxy_version* - Version of the haproxy installed"},{"line_number":226,"context_line":"* *api_version* - Version of haproxy amphora API in use"},{"line_number":227,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"da86d52c_01bfe2d0","line":224,"updated":"2015-02-19 00:09:26.000000000","message":"I didn\u0027t really mean that \"version\" should be REMOVED, just that it should mean something else -- the version of the \"base_image\"  that was used for the Amphora. However, I feel like we could probably derive all the information we really needed to know from the combination of haproxy_version and api_version.","commit_id":"e9a1fe240c0c264923c7e041c689ded489603162"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"c7cb318b61723d8afdc4b14fe5e97871a5370918","unresolved":false,"context_lines":[{"line_number":223,"context_line":"* *hostname* - amphora hostname"},{"line_number":224,"context_line":"* *uuid* - amphora UUID"},{"line_number":225,"context_line":"* *haproxy_version* - Version of the haproxy installed"},{"line_number":226,"context_line":"* *api_version* - Version of haproxy amphora API in use"},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"**Notes:** The data in this request is used by the controller for determining"},{"line_number":229,"context_line":"the amphora and API version numbers."}],"source_content_type":"text/x-rst","patch_set":7,"id":"da86d52c_2124e65e","line":226,"updated":"2015-02-19 00:09:26.000000000","message":"This could match the addition of \"agent\" below","commit_id":"e9a1fe240c0c264923c7e041c689ded489603162"}]}