)]}'
{"specs/version0.5/tls-data-security-1.diag":[{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"13c97f00019d834807c4e1712d0b2369b195903c","unresolved":false,"context_lines":[{"line_number":1,"context_line":"seqdiag {"},{"line_number":2,"context_line":"    User \u003d\u003e Octavia [label\u003d\"Create LB with TLS (passing tls_certificate_id)\", note\u003d\"HTTPS\", return\u003d\"202/400/401/422\"] {"},{"line_number":3,"context_line":"        Octavia \u003d\u003e Barbican [label\u003d\"Fetch Certificate Container\", note\u003d\"HTTPS\", return\u003d\"Certificate Data\"];"},{"line_number":4,"context_line":"    }"},{"line_number":5,"context_line":"    Octavia -\u003e Octavia [label\u003d\"Fetch Amphora from Spare Pool\"];"},{"line_number":6,"context_line":"    Octavia \u003d\u003e \"Amphora API\" [label\u003d\"Configure Amphora\", note\u003d\"HTTPS\", return\u003d\"Update LB Status\"];"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"9aa7fdbe_b9e703ab","line":3,"updated":"2014-10-28 04:34:59.000000000","message":"shouldn\u0027t we also be showing Octavia storing its own copy of this certificate data in Barbican?","commit_id":"9850425b1050bb1e8fc66b9f17dd9c525ef6d089"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"aff9e0d307a9c2d149054c6f089901d813e4b163","unresolved":false,"context_lines":[{"line_number":1,"context_line":"seqdiag {"},{"line_number":2,"context_line":"    User \u003d\u003e Octavia [label\u003d\"Create LB with TLS (passing tls_certificate_id)\", note\u003d\"HTTPS\", return\u003d\"202/400/401/422\"] {"},{"line_number":3,"context_line":"        Octavia \u003d\u003e Barbican [label\u003d\"Fetch Certificate Container\", note\u003d\"HTTPS\", return\u003d\"Certificate Data\"];"},{"line_number":4,"context_line":"    }"},{"line_number":5,"context_line":"    Octavia -\u003e Octavia [label\u003d\"Fetch Amphora from Spare Pool\"];"},{"line_number":6,"context_line":"    Octavia \u003d\u003e \"Amphora API\" [label\u003d\"Configure Amphora\", note\u003d\"HTTPS\", return\u003d\"Update LB Status\"];"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"9aa7fdbe_3992f8f6","line":3,"in_reply_to":"9aa7fdbe_b9e703ab","updated":"2014-10-29 20:07:00.000000000","message":"No, because Octavia will not be storing its own copy.","commit_id":"9850425b1050bb1e8fc66b9f17dd9c525ef6d089"}],"specs/version0.5/tls-data-security-2.diag":[{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"13c97f00019d834807c4e1712d0b2369b195903c","unresolved":false,"context_lines":[{"line_number":14,"context_line":"    \"Amphora Heartbeat\" -\u003e Octavia [label\u003d\"Announce\", note\u003d\"UDP? HTTPS?\"] {"},{"line_number":15,"context_line":"        Octavia -\u003e Octavia [label\u003d\"Verify Amphora by source IP (UDP) or certificate (HTTPS)\"];"},{"line_number":16,"context_line":"        \u003d\u003d\u003d If Verification fails \u003d\u003d\u003d"},{"line_number":17,"context_line":"        Octavia -\u003e Octavia [label\u003d\"Ignore\"];"},{"line_number":18,"context_line":"        \u003d\u003d\u003d If Verification succeeds \u003d\u003d\u003d"},{"line_number":19,"context_line":"        Octavia \u003d\u003e \"Amphora API\" [label\u003d\"Run Self-test\"];"},{"line_number":20,"context_line":"        \u003d\u003d\u003d If Self-test fails \u003d\u003d\u003d"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"9aa7fdbe_99c23fe7","line":17,"updated":"2014-10-28 04:34:59.000000000","message":"Log + Ignore.","commit_id":"9850425b1050bb1e8fc66b9f17dd9c525ef6d089"}],"specs/version0.5/tls-data-security.rst":[{"author":{"_account_id":11302,"name":"Phillip Toohill","email":"phillip.toohill@rackspace.com","username":"ptoohill1"},"change_message_id":"1eaf69ac225bac47b400dc77d2acbf09b6b3d00a","unresolved":false,"context_lines":[{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":"1. Octavia will support TLS Termination, which will require us to store and"},{"line_number":21,"context_line":"retrieve certificates and private keys from a secure repository."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"2. Octavia will communicate with its Amphorae using TLS, so each Amphora"},{"line_number":24,"context_line":"will need a certificate for the controller to validate."},{"line_number":25,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"9aa7fdbe_f0cd50b8","line":22,"updated":"2014-10-24 20:27:53.000000000","message":"Do you want to mention SNI which would also need cert retrieval. This could also just be added as an addition to #1 instead of separate point.","commit_id":"cbaceacfa086d7cccc0ce5e9fe4650c398013950"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"a8610cff45a000ab88095cbd3a4b4f721e2027a6","unresolved":false,"context_lines":[{"line_number":44,"context_line":"when we initially receive it, and will assume that it remains unchanged for"},{"line_number":45,"context_line":"the lifespan of the LB (in Barbican the data is immutable so this is a safe"},{"line_number":46,"context_line":"assumption, I do not know how well this will work for other services). In the"},{"line_number":47,"context_line":"case of invalid TLS data, we will reject the request with a 422 (if it is an"},{"line_number":48,"context_line":"initial create) or else put the LB into ERROR status (if it is on a failover"},{"line_number":49,"context_line":"event or during some other non-interactive scenario)."},{"line_number":50,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9aa7fdbe_ef2fe186","line":47,"updated":"2014-10-30 05:54:32.000000000","message":"I think a code of 400 is more applicable since we won\u0027t use 422.","commit_id":"9850425b1050bb1e8fc66b9f17dd9c525ef6d089"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"7586dfbe83a8598d7694b669046469336511b15c","unresolved":false,"context_lines":[{"line_number":44,"context_line":"when we initially receive it, and will assume that it remains unchanged for"},{"line_number":45,"context_line":"the lifespan of the LB (in Barbican the data is immutable so this is a safe"},{"line_number":46,"context_line":"assumption, I do not know how well this will work for other services). In the"},{"line_number":47,"context_line":"case of invalid TLS data, we will reject the request with a 422 (if it is an"},{"line_number":48,"context_line":"initial create) or else put the LB into ERROR status (if it is on a failover"},{"line_number":49,"context_line":"event or during some other non-interactive scenario)."},{"line_number":50,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_779569e3","line":47,"in_reply_to":"9aa7fdbe_ef2fe186","updated":"2014-10-30 20:08:43.000000000","message":"I am sad that we can\u0027t use 422 (the most appropriate code for this), but 400 will have to do.","commit_id":"9850425b1050bb1e8fc66b9f17dd9c525ef6d089"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"13c97f00019d834807c4e1712d0b2369b195903c","unresolved":false,"context_lines":[{"line_number":48,"context_line":"initial create) or else put the LB into ERROR status (if it is on a failover"},{"line_number":49,"context_line":"event or during some other non-interactive scenario)."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":".. seqdiag:: tls-data-security-1.diag"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"2. Create a CertificateGenerator interface to generate certificates from CSRs."},{"line_number":54,"context_line":"When an Amphora spins up, it will generate its own private key and CSR, then"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9aa7fdbe_19000f33","line":51,"updated":"2014-10-28 04:34:59.000000000","message":"Nit: Put the diagram above the text explaining the diagram.","commit_id":"9850425b1050bb1e8fc66b9f17dd9c525ef6d089"},{"author":{"_account_id":6951,"name":"Brandon Logan","email":"brandon.logan@rackspace.com","username":"brandon-logan"},"change_message_id":"a8610cff45a000ab88095cbd3a4b4f721e2027a6","unresolved":false,"context_lines":[{"line_number":56,"context_line":"cause one to be generated [2] and return it to the Amphora, which will"},{"line_number":57,"context_line":"configure the Amphora API to listen using that certificate. All future"},{"line_number":58,"context_line":"communications with the Amphora will do client certificate validation based on"},{"line_number":59,"context_line":"our (private) certificate authority."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"If we are unable to generate a certificate for the Amphora, we will respond"},{"line_number":62,"context_line":"with a 503 and the Amphora will be expected to wait some configurable retry"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_48cc6336","line":59,"updated":"2014-10-30 05:54:32.000000000","message":"How will the controller send the signed cert back to the Amphora?  In the sequence diagram the amphora API doesn\u0027t get started until after this step.","commit_id":"9850425b1050bb1e8fc66b9f17dd9c525ef6d089"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"7586dfbe83a8598d7694b669046469336511b15c","unresolved":false,"context_lines":[{"line_number":56,"context_line":"cause one to be generated [2] and return it to the Amphora, which will"},{"line_number":57,"context_line":"configure the Amphora API to listen using that certificate. All future"},{"line_number":58,"context_line":"communications with the Amphora will do client certificate validation based on"},{"line_number":59,"context_line":"our (private) certificate authority."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"If we are unable to generate a certificate for the Amphora, we will respond"},{"line_number":62,"context_line":"with a 503 and the Amphora will be expected to wait some configurable retry"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_97f3b572","line":59,"in_reply_to":"7a8c0949_48cc6336","updated":"2014-10-30 20:08:43.000000000","message":"It\u0027s a synchronous request/response. I\u0027ve updated this to be slightly more clear.","commit_id":"9850425b1050bb1e8fc66b9f17dd9c525ef6d089"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"13c97f00019d834807c4e1712d0b2369b195903c","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"3. The key/cert for the main Octavia API/controller should be maintained"},{"line_number":72,"context_line":"manually by the server operators using whatever configuration management"},{"line_number":73,"context_line":"they choose. We should not need to use a specific external repo for this."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Alternatives"},{"line_number":76,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9aa7fdbe_59a4574a","line":73,"updated":"2014-10-28 04:34:59.000000000","message":"Controller will also need a copy of the CA cert (but not the key associated with it) in order to verify amphora certificates.\n\nCould you add a description of this interaction when the controller starts? (should be pretty simple compared to the rest of this.)","commit_id":"9850425b1050bb1e8fc66b9f17dd9c525ef6d089"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"aff9e0d307a9c2d149054c6f089901d813e4b163","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"3. The key/cert for the main Octavia API/controller should be maintained"},{"line_number":72,"context_line":"manually by the server operators using whatever configuration management"},{"line_number":73,"context_line":"they choose. We should not need to use a specific external repo for this."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Alternatives"},{"line_number":76,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9aa7fdbe_f975d0cc","line":73,"in_reply_to":"9aa7fdbe_59a4574a","updated":"2014-10-29 20:07:00.000000000","message":"Yeah, controller CA cert should probably be manually set up as well (like the rest of #3).","commit_id":"9850425b1050bb1e8fc66b9f17dd9c525ef6d089"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"13c97f00019d834807c4e1712d0b2369b195903c","unresolved":false,"context_lines":[{"line_number":79,"context_line":"integration."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"We could also store everything locally or in the DB, but that isn\u0027t a real"},{"line_number":82,"context_line":"option for production systems because it is incredibly insecure."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Data model impact"},{"line_number":85,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9aa7fdbe_794d9b99","line":82,"updated":"2014-10-28 04:34:59.000000000","message":"Do we want to entertain having a \u0027simple storage\u0027 model that just uses the disk for testing or devstack purposes, or do we want to always assume that barbican will be there for tests and whatnot?","commit_id":"9850425b1050bb1e8fc66b9f17dd9c525ef6d089"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"aff9e0d307a9c2d149054c6f089901d813e4b163","unresolved":false,"context_lines":[{"line_number":79,"context_line":"integration."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"We could also store everything locally or in the DB, but that isn\u0027t a real"},{"line_number":82,"context_line":"option for production systems because it is incredibly insecure."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Data model impact"},{"line_number":85,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9aa7fdbe_39a91825","line":82,"in_reply_to":"9aa7fdbe_794d9b99","updated":"2014-10-29 20:07:00.000000000","message":"Yeah, I will note that I plan on making a dummy driver for storing certs on the filesystem, for development use only.","commit_id":"9850425b1050bb1e8fc66b9f17dd9c525ef6d089"},{"author":{"_account_id":11255,"name":"Dustin Lundquist","username":"dustin.lundquist","inactive":true},"change_message_id":"6044545a0eea4266ebedc6f2092ddc23f83f9208","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Problem description"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":"1. Octavia will support TLS Termination (including SNI), which will require us"},{"line_number":21,"context_line":"to store and retrieve certificates and private keys from a secure repository."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"2. Octavia will communicate with its Amphorae using TLS, so each Amphora"},{"line_number":24,"context_line":"will need a certificate for the controller to validate."}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_27314fed","line":21,"updated":"2014-11-25 00:56:44.000000000","message":"You might call out that this is specifically _customer_ certificate/private key pairs.","commit_id":"5a89a60c09915088e5f1817a4185c6e940383f00"},{"author":{"_account_id":11255,"name":"Dustin Lundquist","username":"dustin.lundquist","inactive":true},"change_message_id":"6044545a0eea4266ebedc6f2092ddc23f83f9208","unresolved":false,"context_lines":[{"line_number":21,"context_line":"to store and retrieve certificates and private keys from a secure repository."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"2. Octavia will communicate with its Amphorae using TLS, so each Amphora"},{"line_number":24,"context_line":"will need a certificate for the controller to validate."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"3. Octavia will need TLS data for exposing its own API via HTTPS."},{"line_number":27,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_a71d3f64","line":24,"updated":"2014-11-25 00:56:44.000000000","message":"I assume you mean a certificate/private key pair?","commit_id":"5a89a60c09915088e5f1817a4185c6e940383f00"},{"author":{"_account_id":11255,"name":"Dustin Lundquist","username":"dustin.lundquist","inactive":true},"change_message_id":"6044545a0eea4266ebedc6f2092ddc23f83f9208","unresolved":false,"context_lines":[{"line_number":23,"context_line":"2. Octavia will communicate with its Amphorae using TLS, so each Amphora"},{"line_number":24,"context_line":"will need a certificate for the controller to validate."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"3. Octavia will need TLS data for exposing its own API via HTTPS."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Proposed change"},{"line_number":29,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_8753e315","line":26,"updated":"2014-11-25 00:56:44.000000000","message":"The Octavia API will require its own certificate/private key pair to expose its API.","commit_id":"5a89a60c09915088e5f1817a4185c6e940383f00"},{"author":{"_account_id":11255,"name":"Dustin Lundquist","username":"dustin.lundquist","inactive":true},"change_message_id":"6044545a0eea4266ebedc6f2092ddc23f83f9208","unresolved":false,"context_lines":[{"line_number":39,"context_line":"which is a reference to their data in some secure service. Octavia will store"},{"line_number":40,"context_line":"that certificate_id for each Listener/SNI and will retrieve the data when"},{"line_number":41,"context_line":"necessary. (Barbican specific: users will need to add Octavia\u0027s user account as"},{"line_number":42,"context_line":"an authorized user on the Container and all Secrets [1] so we catch fetch the"},{"line_number":43,"context_line":"data on their behalf.)"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"We will need to validate the certificate data (including key and intermediates)"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_a76b7fb7","line":42,"updated":"2014-11-25 00:56:44.000000000","message":"s/catch fetch/can fetch/","commit_id":"5a89a60c09915088e5f1817a4185c6e940383f00"},{"author":{"_account_id":11255,"name":"Dustin Lundquist","username":"dustin.lundquist","inactive":true},"change_message_id":"6044545a0eea4266ebedc6f2092ddc23f83f9208","unresolved":false,"context_lines":[{"line_number":100,"context_line":""},{"line_number":101,"context_line":"Security impact"},{"line_number":102,"context_line":"---------------"},{"line_number":103,"context_line":"Using Barbican is considered secure."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Notifications impact"},{"line_number":106,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_0749b330","line":103,"updated":"2014-11-25 00:56:44.000000000","message":"We should call out how certificate/private key data is stored/handled once Octavia retrieves it to setup an instance, or at least call it out as a subject for a follow up spec.","commit_id":"5a89a60c09915088e5f1817a4185c6e940383f00"}]}