)]}'
{"doc/source/guides/basic-cookbook.rst":[{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"3057ac87071aa5abb215463acb1d87810e152655","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Neutron LBaaS with an Octavia back-end. In order to keep these examples short,"},{"line_number":28,"context_line":"we also assume that tasks not directly associated with deploying load balancing"},{"line_number":29,"context_line":"services have already been accomplished. This might include such things as"},{"line_number":30,"context_line":"deploying and configuring Nova VMs, setting up Neutron networks, obtaining TLS"},{"line_number":31,"context_line":"certificates from a trusted provider, and so on. A description of the starting"},{"line_number":32,"context_line":"conditions is given in each example below."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_f346f84d","line":30,"range":{"start_line":30,"start_character":26,"end_line":30,"end_character":34},"updated":"2016-09-24 21:14:39.000000000","message":"This could confuse users, maybe change this to web servers?","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"c6c0bbc75a2b402b4a6fd740bd2f2a79ec3e9ed8","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Neutron LBaaS with an Octavia back-end. In order to keep these examples short,"},{"line_number":28,"context_line":"we also assume that tasks not directly associated with deploying load balancing"},{"line_number":29,"context_line":"services have already been accomplished. This might include such things as"},{"line_number":30,"context_line":"deploying and configuring Nova VMs, setting up Neutron networks, obtaining TLS"},{"line_number":31,"context_line":"certificates from a trusted provider, and so on. A description of the starting"},{"line_number":32,"context_line":"conditions is given in each example below."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_b6c37e88","line":30,"range":{"start_line":30,"start_character":26,"end_line":30,"end_character":34},"in_reply_to":"5a8bc5a2_f346f84d","updated":"2016-09-25 03:49:32.000000000","message":"Done","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"3057ac87071aa5abb215463acb1d87810e152655","unresolved":false,"context_lines":[{"line_number":43,"context_line":"Deploy a basic HTTP load balancer"},{"line_number":44,"context_line":"---------------------------------"},{"line_number":45,"context_line":"While this is technically the simplest complete load balancing solution that"},{"line_number":46,"context_line":"can be deployed, we actually recommend deploying HTTP load balancers with a"},{"line_number":47,"context_line":"health monitor to ensure back-end member availability. See"},{"line_number":48,"context_line":":ref:`basic-lb-with-hm` below."},{"line_number":49,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_337b008e","line":46,"range":{"start_line":46,"start_character":20,"end_line":46,"end_character":28},"updated":"2016-09-24 21:14:39.000000000","message":"nit: remove this","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"c6c0bbc75a2b402b4a6fd740bd2f2a79ec3e9ed8","unresolved":false,"context_lines":[{"line_number":43,"context_line":"Deploy a basic HTTP load balancer"},{"line_number":44,"context_line":"---------------------------------"},{"line_number":45,"context_line":"While this is technically the simplest complete load balancing solution that"},{"line_number":46,"context_line":"can be deployed, we actually recommend deploying HTTP load balancers with a"},{"line_number":47,"context_line":"health monitor to ensure back-end member availability. See"},{"line_number":48,"context_line":":ref:`basic-lb-with-hm` below."},{"line_number":49,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_d6bc8a08","line":46,"range":{"start_line":46,"start_character":20,"end_line":46,"end_character":28},"in_reply_to":"5a8bc5a2_337b008e","updated":"2016-09-25 03:49:32.000000000","message":"Done","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"3057ac87071aa5abb215463acb1d87810e152655","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"**Scenario description**:"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"* Back-end servers 10.0.100.10 and 10.0.100.11 on subnet *private-subnet* have"},{"line_number":53,"context_line":"  been configured with an HTTP application on TCP port 80."},{"line_number":54,"context_line":"* Subnet *public-subnet* is a shared external subnet created by the cloud"},{"line_number":55,"context_line":"  operator which is reachable from the internet."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_33f060fe","line":52,"range":{"start_line":52,"start_character":19,"end_line":52,"end_character":46},"updated":"2016-09-24 21:14:39.000000000","message":"We should use one of the documentation subnets:\n192.0.2.0/24\n198.51.100.0/24\n203.0.113.0/24\nhttps://tools.ietf.org/html/rfc5737","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"c6c0bbc75a2b402b4a6fd740bd2f2a79ec3e9ed8","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"**Scenario description**:"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"* Back-end servers 10.0.100.10 and 10.0.100.11 on subnet *private-subnet* have"},{"line_number":53,"context_line":"  been configured with an HTTP application on TCP port 80."},{"line_number":54,"context_line":"* Subnet *public-subnet* is a shared external subnet created by the cloud"},{"line_number":55,"context_line":"  operator which is reachable from the internet."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_363e8e8c","line":52,"range":{"start_line":52,"start_character":19,"end_line":52,"end_character":46},"in_reply_to":"5a8bc5a2_33f060fe","updated":"2016-09-25 03:49:32.000000000","message":"Aah, good point! Done!","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"3057ac87071aa5abb215463acb1d87810e152655","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"* Back-end servers 10.0.100.10 and 10.0.100.11 on subnet *private-subnet* have"},{"line_number":94,"context_line":"  been configured with an HTTP application on TCP port 80."},{"line_number":95,"context_line":"* These back-end servers have been configured to do a light-weight health"},{"line_number":96,"context_line":"  check whenever the \"/healthcheck\" path is requested and will return a"},{"line_number":97,"context_line":"  HTTP 200 OK response if the server is healthy."},{"line_number":98,"context_line":"* Subnet *public-subnet* is a shared external subnet created by the cloud"},{"line_number":99,"context_line":"  operator which is reachable from the internet."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_d3b73c38","line":96,"range":{"start_line":95,"start_character":2,"end_line":96,"end_character":53},"updated":"2016-09-24 21:14:39.000000000","message":"That is a little heavy weight for a basic config.","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"c6c0bbc75a2b402b4a6fd740bd2f2a79ec3e9ed8","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"* Back-end servers 10.0.100.10 and 10.0.100.11 on subnet *private-subnet* have"},{"line_number":94,"context_line":"  been configured with an HTTP application on TCP port 80."},{"line_number":95,"context_line":"* These back-end servers have been configured to do a light-weight health"},{"line_number":96,"context_line":"  check whenever the \"/healthcheck\" path is requested and will return a"},{"line_number":97,"context_line":"  HTTP 200 OK response if the server is healthy."},{"line_number":98,"context_line":"* Subnet *public-subnet* is a shared external subnet created by the cloud"},{"line_number":99,"context_line":"  operator which is reachable from the internet."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_b64a9e24","line":96,"range":{"start_line":95,"start_character":2,"end_line":96,"end_character":53},"in_reply_to":"5a8bc5a2_d3b73c38","updated":"2016-09-25 03:49:32.000000000","message":"You know-- I thought about making this simpler in the basic config here, but I\u0027ve seen too many production scenarios where client has a heavy-weight \"/\" page, or a cached \"/\" page that doesn\u0027t exercise the underlying application at all, where the load balancer health monitor either overloads the application servers by requesting the heavy-weight page too often, or the site goes down because of a more subtle problem and the load balancer doesn\u0027t notice because the health monitor page is cached.\n\nOf course, the load balancer always gets blamed in these scenarios.\n\nI tried compressing some of these ideas in the description here... but the more I think about it, the more I think a description of a \u0027best practices health monitor\u0027 is called for. I\u0027ll add a new section to the end of this document which talks about health monitor best practices.","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"3057ac87071aa5abb215463acb1d87810e152655","unresolved":false,"context_lines":[{"line_number":101,"context_line":"  internet, which distributes web requests to the back-end servers, and which"},{"line_number":102,"context_line":"  checks the \"/healthcheck\" path to ensure back-end member health."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"*Note:* The health check URL will be tested every few seconds by the load"},{"line_number":105,"context_line":"balancer. It is essential that while this check be complete enough to be a"},{"line_number":106,"context_line":"\"good enough\" health check to determine server health, it must also be light"},{"line_number":107,"context_line":"weight enough that it does not create any significant server load when run. The"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_f3b43836","line":104,"range":{"start_line":104,"start_character":8,"end_line":104,"end_character":61},"updated":"2016-09-24 21:14:39.000000000","message":"Since you have to set those times when creating the health monitor, we should probably describe the, at a high level, here.","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"c6c0bbc75a2b402b4a6fd740bd2f2a79ec3e9ed8","unresolved":false,"context_lines":[{"line_number":101,"context_line":"  internet, which distributes web requests to the back-end servers, and which"},{"line_number":102,"context_line":"  checks the \"/healthcheck\" path to ensure back-end member health."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"*Note:* The health check URL will be tested every few seconds by the load"},{"line_number":105,"context_line":"balancer. It is essential that while this check be complete enough to be a"},{"line_number":106,"context_line":"\"good enough\" health check to determine server health, it must also be light"},{"line_number":107,"context_line":"weight enough that it does not create any significant server load when run. The"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_f650a6d6","line":104,"range":{"start_line":104,"start_character":8,"end_line":104,"end_character":61},"in_reply_to":"5a8bc5a2_f3b43836","updated":"2016-09-25 03:49:32.000000000","message":"Yep-- I\u0027ll add it to its own section at the bottom of this document and make a reference to it here.","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"3057ac87071aa5abb215463acb1d87810e152655","unresolved":false,"context_lines":[{"line_number":136,"context_line":"It can be beneficial to use a floating IP when setting up a load balancer\u0027s VIP"},{"line_number":137,"context_line":"in order to ensure you retain control of the IP that gets assigned as the"},{"line_number":138,"context_line":"floating IP in case the load balancer needs to be destroyed, moved, or"},{"line_number":139,"context_line":"recreated. Note that this is not possible to do with IPv6 load balancers as"},{"line_number":140,"context_line":"floating IPs do not work with IPv6."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"**Scenario description**:"},{"line_number":143,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_737f4866","line":140,"range":{"start_line":139,"start_character":11,"end_line":140,"end_character":35},"updated":"2016-09-24 21:14:39.000000000","message":"Do we also want to call out the DVR bug?\nhttps://bugs.launchpad.net/neutron/+bug/1583694","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"c6c0bbc75a2b402b4a6fd740bd2f2a79ec3e9ed8","unresolved":false,"context_lines":[{"line_number":136,"context_line":"It can be beneficial to use a floating IP when setting up a load balancer\u0027s VIP"},{"line_number":137,"context_line":"in order to ensure you retain control of the IP that gets assigned as the"},{"line_number":138,"context_line":"floating IP in case the load balancer needs to be destroyed, moved, or"},{"line_number":139,"context_line":"recreated. Note that this is not possible to do with IPv6 load balancers as"},{"line_number":140,"context_line":"floating IPs do not work with IPv6."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"**Scenario description**:"},{"line_number":143,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_3665aeb4","line":140,"range":{"start_line":139,"start_character":11,"end_line":140,"end_character":35},"in_reply_to":"5a8bc5a2_737f4866","updated":"2016-09-25 03:49:32.000000000","message":"Hah! I didn\u0027t know about that bug, but I\u0027ll go ahead and reference it here, too.","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"3057ac87071aa5abb215463acb1d87810e152655","unresolved":false,"context_lines":[{"line_number":195,"context_line":"* The application is written such that web clients should always be directed to"},{"line_number":196,"context_line":"  the same back-end server throughout their web session, based on an"},{"line_number":197,"context_line":"  application cookie inserted by the web application named \u0027PHPSESSIONID\u0027."},{"line_number":198,"context_line":"* The back-end servers have also been configured to do a light-weight health"},{"line_number":199,"context_line":"  check whenever the \"/healthcheck\" path is requested and will return a"},{"line_number":200,"context_line":"  HTTP 200 OK response if the server is healthy."},{"line_number":201,"context_line":"* Subnet *public-subnet* is a shared external subnet created by the cloud"},{"line_number":202,"context_line":"  operator which is reachable from the internet."},{"line_number":203,"context_line":"* We want to configure a basic load balancer that is accessible from the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_93df7468","line":200,"range":{"start_line":198,"start_character":2,"end_line":200,"end_character":48},"updated":"2016-09-24 21:14:39.000000000","message":"nit: we could change it up and do health checks in a different way","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"c6c0bbc75a2b402b4a6fd740bd2f2a79ec3e9ed8","unresolved":false,"context_lines":[{"line_number":195,"context_line":"* The application is written such that web clients should always be directed to"},{"line_number":196,"context_line":"  the same back-end server throughout their web session, based on an"},{"line_number":197,"context_line":"  application cookie inserted by the web application named \u0027PHPSESSIONID\u0027."},{"line_number":198,"context_line":"* The back-end servers have also been configured to do a light-weight health"},{"line_number":199,"context_line":"  check whenever the \"/healthcheck\" path is requested and will return a"},{"line_number":200,"context_line":"  HTTP 200 OK response if the server is healthy."},{"line_number":201,"context_line":"* Subnet *public-subnet* is a shared external subnet created by the cloud"},{"line_number":202,"context_line":"  operator which is reachable from the internet."},{"line_number":203,"context_line":"* We want to configure a basic load balancer that is accessible from the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_f667c6b4","line":200,"range":{"start_line":198,"start_character":2,"end_line":200,"end_character":48},"in_reply_to":"5a8bc5a2_93df7468","updated":"2016-09-25 03:49:32.000000000","message":"Eh... I think I\u0027ll make reference to the new section I\u0027m adding below. Users can decide what they want to go with here, eh.","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"3057ac87071aa5abb215463acb1d87810e152655","unresolved":false,"context_lines":[{"line_number":240,"context_line":"  operator which is reachable from the internet."},{"line_number":241,"context_line":"* We want to configure a basic load balancer that is accessible from the"},{"line_number":242,"context_line":"  internet, which distributes requests to the back-end servers."},{"line_number":243,"context_line":""},{"line_number":244,"context_line":"**Solution**:"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"1. Create load balancer *lb1* on subnet *public-subnet*."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_13d2845c","line":243,"updated":"2016-09-24 21:14:39.000000000","message":"We could show a health monitor of type TCP here.","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"c6c0bbc75a2b402b4a6fd740bd2f2a79ec3e9ed8","unresolved":false,"context_lines":[{"line_number":240,"context_line":"  operator which is reachable from the internet."},{"line_number":241,"context_line":"* We want to configure a basic load balancer that is accessible from the"},{"line_number":242,"context_line":"  internet, which distributes requests to the back-end servers."},{"line_number":243,"context_line":""},{"line_number":244,"context_line":"**Solution**:"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"1. Create load balancer *lb1* on subnet *public-subnet*."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_1607d2ca","line":243,"in_reply_to":"5a8bc5a2_13d2845c","updated":"2016-09-25 03:49:32.000000000","message":"Good point! I\u0027ll add it.","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"3057ac87071aa5abb215463acb1d87810e152655","unresolved":false,"context_lines":[{"line_number":306,"context_line":""},{"line_number":307,"context_line":"Deploy a TLS-terminated HTTPS load balancer"},{"line_number":308,"context_line":"-------------------------------------------"},{"line_number":309,"context_line":"A TLS-terminated HTTPS load balancer communicates with web clients over TLS"},{"line_number":310,"context_line":"protocols, terminates the TLS session on the load balancer, and may or may not"},{"line_number":311,"context_line":"re-encrypt the requests that get forwarded to the back-end servers. By"},{"line_number":312,"context_line":"terminating the TLS session on the load balancer, we offload the CPU-intensive"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_9374d468","line":309,"range":{"start_line":309,"start_character":0,"end_line":309,"end_character":75},"updated":"2016-09-24 21:14:39.000000000","message":"Maybe swap this around?\n\nWith a TLS-terminated HTTPS load balancer, web clients communicate with the load balancer over TLS protocols,","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"c6c0bbc75a2b402b4a6fd740bd2f2a79ec3e9ed8","unresolved":false,"context_lines":[{"line_number":306,"context_line":""},{"line_number":307,"context_line":"Deploy a TLS-terminated HTTPS load balancer"},{"line_number":308,"context_line":"-------------------------------------------"},{"line_number":309,"context_line":"A TLS-terminated HTTPS load balancer communicates with web clients over TLS"},{"line_number":310,"context_line":"protocols, terminates the TLS session on the load balancer, and may or may not"},{"line_number":311,"context_line":"re-encrypt the requests that get forwarded to the back-end servers. By"},{"line_number":312,"context_line":"terminating the TLS session on the load balancer, we offload the CPU-intensive"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_96fbe2c0","line":309,"range":{"start_line":309,"start_character":0,"end_line":309,"end_character":75},"in_reply_to":"5a8bc5a2_9374d468","updated":"2016-09-25 03:49:32.000000000","message":"Done","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"3057ac87071aa5abb215463acb1d87810e152655","unresolved":false,"context_lines":[{"line_number":307,"context_line":"Deploy a TLS-terminated HTTPS load balancer"},{"line_number":308,"context_line":"-------------------------------------------"},{"line_number":309,"context_line":"A TLS-terminated HTTPS load balancer communicates with web clients over TLS"},{"line_number":310,"context_line":"protocols, terminates the TLS session on the load balancer, and may or may not"},{"line_number":311,"context_line":"re-encrypt the requests that get forwarded to the back-end servers. By"},{"line_number":312,"context_line":"terminating the TLS session on the load balancer, we offload the CPU-intensive"},{"line_number":313,"context_line":"encryption work to the load balancer, and enable the possibility of using"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_b371d078","line":310,"range":{"start_line":310,"start_character":64,"end_line":310,"end_character":67},"updated":"2016-09-24 21:14:39.000000000","message":"We don\u0027t have this yet, so maybe remove it?","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"c6c0bbc75a2b402b4a6fd740bd2f2a79ec3e9ed8","unresolved":false,"context_lines":[{"line_number":307,"context_line":"Deploy a TLS-terminated HTTPS load balancer"},{"line_number":308,"context_line":"-------------------------------------------"},{"line_number":309,"context_line":"A TLS-terminated HTTPS load balancer communicates with web clients over TLS"},{"line_number":310,"context_line":"protocols, terminates the TLS session on the load balancer, and may or may not"},{"line_number":311,"context_line":"re-encrypt the requests that get forwarded to the back-end servers. By"},{"line_number":312,"context_line":"terminating the TLS session on the load balancer, we offload the CPU-intensive"},{"line_number":313,"context_line":"encryption work to the load balancer, and enable the possibility of using"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_b6f8dec4","line":310,"range":{"start_line":310,"start_character":64,"end_line":310,"end_character":67},"in_reply_to":"5a8bc5a2_b371d078","updated":"2016-09-25 03:49:32.000000000","message":"Good point. Done.","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"3057ac87071aa5abb215463acb1d87810e152655","unresolved":false,"context_lines":[{"line_number":326,"context_line":"  www.example.com have been obtained from an external certificate authority."},{"line_number":327,"context_line":"  These now exist in the files server.crt, server.key, and ca-chain.p7b in the"},{"line_number":328,"context_line":"  current directory. The key and certificate are PEM-encoded, and the"},{"line_number":329,"context_line":"  intermediate certificate chain is PKCS7 encoded. The key is not encrypted"},{"line_number":330,"context_line":"  with a passphrase."},{"line_number":331,"context_line":"* The *admin* user on this cloud installation has keystone ID *admin_id*"},{"line_number":332,"context_line":"* We want to configure a TLS-terminated HTTPS load balancer that is accessible"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_1307e4ca","line":329,"range":{"start_line":329,"start_character":36,"end_line":329,"end_character":41},"updated":"2016-09-24 21:14:39.000000000","message":"PKCS7 PEM","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"c6c0bbc75a2b402b4a6fd740bd2f2a79ec3e9ed8","unresolved":false,"context_lines":[{"line_number":326,"context_line":"  www.example.com have been obtained from an external certificate authority."},{"line_number":327,"context_line":"  These now exist in the files server.crt, server.key, and ca-chain.p7b in the"},{"line_number":328,"context_line":"  current directory. The key and certificate are PEM-encoded, and the"},{"line_number":329,"context_line":"  intermediate certificate chain is PKCS7 encoded. The key is not encrypted"},{"line_number":330,"context_line":"  with a passphrase."},{"line_number":331,"context_line":"* The *admin* user on this cloud installation has keystone ID *admin_id*"},{"line_number":332,"context_line":"* We want to configure a TLS-terminated HTTPS load balancer that is accessible"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_f6fee6ac","line":329,"range":{"start_line":329,"start_character":36,"end_line":329,"end_character":41},"in_reply_to":"5a8bc5a2_1307e4ca","updated":"2016-09-25 03:49:32.000000000","message":"Done","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"3057ac87071aa5abb215463acb1d87810e152655","unresolved":false,"context_lines":[{"line_number":341,"context_line":"   *intermediates1* respectively."},{"line_number":342,"context_line":"2. Create a *secret container* resource combining all of the above. We will"},{"line_number":343,"context_line":"   call this *tls_container1*."},{"line_number":344,"context_line":"3. Grant the *admin* user access to all the *secret* and *secret container*"},{"line_number":345,"context_line":"   barbican resources above."},{"line_number":346,"context_line":"4. Create load balancer *lb1* on subnet *public-subnet*."},{"line_number":347,"context_line":"5. Create listener *listener1* as a TERMINATED_HTTPS listener referencing"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_7312e80a","line":344,"updated":"2016-09-24 21:14:39.000000000","message":"Hmm, this sucks.  I thought we had a work around for this.\nrm_work would know.\nDo these instructions not work any longer?\nhttps://wiki.openstack.org/wiki/Network/LBaaS/docs/how-to-create-tls-loadbalancer","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"c6c0bbc75a2b402b4a6fd740bd2f2a79ec3e9ed8","unresolved":false,"context_lines":[{"line_number":341,"context_line":"   *intermediates1* respectively."},{"line_number":342,"context_line":"2. Create a *secret container* resource combining all of the above. We will"},{"line_number":343,"context_line":"   call this *tls_container1*."},{"line_number":344,"context_line":"3. Grant the *admin* user access to all the *secret* and *secret container*"},{"line_number":345,"context_line":"   barbican resources above."},{"line_number":346,"context_line":"4. Create load balancer *lb1* on subnet *public-subnet*."},{"line_number":347,"context_line":"5. Create listener *listener1* as a TERMINATED_HTTPS listener referencing"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_7629f636","line":344,"in_reply_to":"5a8bc5a2_7312e80a","updated":"2016-09-25 03:49:32.000000000","message":"I really wish we had a better story here. I\u0027ve opened a bug with barbican to this effect here: https://bugs.launchpad.net/barbican/+bug/1627391\n\nThe instructions on that wiki page work, but only if you\u0027re the admin user. (It skips the whole \u0027granting permissions\u0027 part because a user implicitly has access to the secrets they create, and neutron-lbaas and octavia use the \u0027admin\u0027 user when talking to barbican.)\n\nThese instructions are intended to be consumed by regular cloud users, so at the present time that means they have to grant permissions to the admin user to access the secrets they upload. It is a pretty terrible user story, and I suspect a lot of this is taken care of behind the scenes in the GUI (which, I think, has a much better user story).\n\nSpeaking of which... eventually we should probably put together a walk-through that does everything in this document, but shows screenshots for how it\u0027s done, eh...","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"3057ac87071aa5abb215463acb1d87810e152655","unresolved":false,"context_lines":[{"line_number":452,"context_line":"same back-end pool (and therefore, probably respond with the exact same"},{"line_number":453,"context_line":"content regardless of whether the web client uses the HTTP or HTTPS protocol"},{"line_number":454,"context_line":"to connect)."},{"line_number":455,"context_line":""},{"line_number":456,"context_line":"**Scenario description**:"},{"line_number":457,"context_line":""},{"line_number":458,"context_line":"* Back-end servers 10.0.100.10 and 10.0.100.11 on subnet *private-subnet* have"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_73e028fb","line":455,"updated":"2016-09-24 21:14:39.000000000","message":"It might be nice to have a note here that if they want to setup HTTP to HTTPS redirection, they should reference the L7 guide.","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"},{"author":{"_account_id":11685,"name":"Stephen Balukoff","email":"stephen@balukoff.com","username":"sbalukoff"},"change_message_id":"c6c0bbc75a2b402b4a6fd740bd2f2a79ec3e9ed8","unresolved":false,"context_lines":[{"line_number":452,"context_line":"same back-end pool (and therefore, probably respond with the exact same"},{"line_number":453,"context_line":"content regardless of whether the web client uses the HTTP or HTTPS protocol"},{"line_number":454,"context_line":"to connect)."},{"line_number":455,"context_line":""},{"line_number":456,"context_line":"**Scenario description**:"},{"line_number":457,"context_line":""},{"line_number":458,"context_line":"* Back-end servers 10.0.100.10 and 10.0.100.11 on subnet *private-subnet* have"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a8bc5a2_d6180a21","line":455,"in_reply_to":"5a8bc5a2_73e028fb","updated":"2016-09-25 03:49:32.000000000","message":"Great suggestion! I\u0027ll add it.","commit_id":"ed50895d22134469a2a94d796b79d7f953b5f09b"}]}