)]}'
{"octavia/api/v2/controllers/listener.py":[{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"a8ef324f2e348bca7d07bbd18f0cc4f7d0131723","unresolved":false,"context_lines":[{"line_number":372,"context_line":"                     driver.name)"},{"line_number":373,"context_line":"            driver_utils.call_provider(driver.name, driver.listener_delete, id)"},{"line_number":374,"context_line":""},{"line_number":375,"context_line":"        # Revoke access of octavia service user to certificates"},{"line_number":376,"context_line":"        tls_refs \u003d []"},{"line_number":377,"context_line":"        for sni in db_listener.sni_containers:"},{"line_number":378,"context_line":"            filters \u003d {\u0027tls_container_id\u0027: sni.tls_container_id}"}],"source_content_type":"text/x-python","patch_set":9,"id":"5f7c97a3_d4891a26","line":375,"updated":"2018-06-08 18:45:19.000000000","message":"We don\u0027t want this -- see one of my other comments.","commit_id":"f0dd64f4cbed33361bb04142fe12ff8bfcea4114"},{"author":{"_account_id":6469,"name":"Carlos Gonçalves","display_name":"Carlos Goncalves","email":"cgoncalves@redhat.com","username":"cgoncalves"},"change_message_id":"4796067daa24a729b3e54736f05438454e3d47ca","unresolved":false,"context_lines":[{"line_number":372,"context_line":"                     driver.name)"},{"line_number":373,"context_line":"            driver_utils.call_provider(driver.name, driver.listener_delete, id)"},{"line_number":374,"context_line":""},{"line_number":375,"context_line":"        # Revoke access of octavia service user to certificates"},{"line_number":376,"context_line":"        tls_refs \u003d []"},{"line_number":377,"context_line":"        for sni in db_listener.sni_containers:"},{"line_number":378,"context_line":"            filters \u003d {\u0027tls_container_id\u0027: sni.tls_container_id}"}],"source_content_type":"text/x-python","patch_set":9,"id":"5f7c97a3_518a05bc","line":375,"in_reply_to":"5f7c97a3_78833957","updated":"2018-07-13 11:32:43.000000000","message":"Actually INFO msg may not be the best fit, and there\u0027s already a DEBUG msg from the cert manager when revoking.","commit_id":"f0dd64f4cbed33361bb04142fe12ff8bfcea4114"},{"author":{"_account_id":6579,"name":"Nir Magnezi","email":"nmagnezi@redhat.com","username":"nmagnezi"},"change_message_id":"e047efbaf969caa651d6f4c6855295fbb859d5f8","unresolved":false,"context_lines":[{"line_number":372,"context_line":"                     driver.name)"},{"line_number":373,"context_line":"            driver_utils.call_provider(driver.name, driver.listener_delete, id)"},{"line_number":374,"context_line":""},{"line_number":375,"context_line":"        # Revoke access of octavia service user to certificates"},{"line_number":376,"context_line":"        tls_refs \u003d []"},{"line_number":377,"context_line":"        for sni in db_listener.sni_containers:"},{"line_number":378,"context_line":"            filters \u003d {\u0027tls_container_id\u0027: sni.tls_container_id}"}],"source_content_type":"text/x-python","patch_set":9,"id":"5f7c97a3_78833957","line":375,"in_reply_to":"5f7c97a3_d4891a26","updated":"2018-06-11 13:25:33.000000000","message":"\u003e We don\u0027t want this -- see one of my other comments.\n\nI have yet to test this but reading this code and also based on Carlos\u0027s paste[1] it looks okay to me.\n\nI think it makes sense to revoke access to a Barbican secret that is no longer being used by *any* Octavia listener. That will keep ACLs much cleaner during the lifecycle of the cloud.\n\nAfter a short discussion with Carlos, I suggest adding a DEBUG msg as when a certificate access is not revoked upon listener deletion, something in the spirit of: \"The access to \u003ctls_container_id\u003e will not be revoked upon deletion of \u003clistener.id\u003e since it is still being used by \u003clist_of_listener_ids\u003e.\n\nAlso, Carlos suggested adding an INFO msg about when an ACL is being revoked.\n\n[1] https://review.openstack.org/#/c/552549/9/octavia/certificates/common/barbican.py@82","commit_id":"f0dd64f4cbed33361bb04142fe12ff8bfcea4114"},{"author":{"_account_id":6469,"name":"Carlos Gonçalves","display_name":"Carlos Goncalves","email":"cgoncalves@redhat.com","username":"cgoncalves"},"change_message_id":"385d3fca24092cb50edc97b81378e19ffc3f7c95","unresolved":false,"context_lines":[{"line_number":377,"context_line":""},{"line_number":378,"context_line":"        for sni in db_listener.sni_containers:"},{"line_number":379,"context_line":"            filters \u003d {\u0027tls_container_id\u0027: sni.tls_container_id}"},{"line_number":380,"context_line":"            snis \u003d self.repositories.sni.get_all(context.session, **filters)[0]"},{"line_number":381,"context_line":""},{"line_number":382,"context_line":"            if len(snis) \u003d\u003d 1:"},{"line_number":383,"context_line":"                # referred only once, enqueue for access revoking"}],"source_content_type":"text/x-python","patch_set":12,"id":"5f7c97a3_6feba4dc","line":380,"updated":"2018-07-26 13:58:18.000000000","message":"Here and below we could have used:\n  snis, _ \u003d self.repositories [...]\n  listeners, _ \u003d self.repositories [...]\n\nSomehow I did that on my test env but failed to copy that to this patch.","commit_id":"05de05654e726efbe5c687c04187d3da4c03a100"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"b574eb021a58839966fc789c3044ef2617adb0d6","unresolved":false,"context_lines":[{"line_number":377,"context_line":""},{"line_number":378,"context_line":"        for sni in db_listener.sni_containers:"},{"line_number":379,"context_line":"            filters \u003d {\u0027tls_container_id\u0027: sni.tls_container_id}"},{"line_number":380,"context_line":"            snis \u003d self.repositories.sni.get_all(context.session, **filters)[0]"},{"line_number":381,"context_line":""},{"line_number":382,"context_line":"            if len(snis) \u003d\u003d 1:"},{"line_number":383,"context_line":"                # referred only once, enqueue for access revoking"}],"source_content_type":"text/x-python","patch_set":12,"id":"5f7c97a3_af677c52","line":380,"in_reply_to":"5f7c97a3_6feba4dc","updated":"2018-07-26 14:06:08.000000000","message":"Using \"_\" is a bad practice as that is used for localization. The better practice is to us the array index.","commit_id":"05de05654e726efbe5c687c04187d3da4c03a100"},{"author":{"_account_id":6469,"name":"Carlos Gonçalves","display_name":"Carlos Goncalves","email":"cgoncalves@redhat.com","username":"cgoncalves"},"change_message_id":"385d3fca24092cb50edc97b81378e19ffc3f7c95","unresolved":false,"context_lines":[{"line_number":391,"context_line":""},{"line_number":392,"context_line":"        if db_listener.tls_certificate_id:"},{"line_number":393,"context_line":"            filters \u003d {\u0027tls_certificate_id\u0027: db_listener.tls_certificate_id}"},{"line_number":394,"context_line":"            # Note get_all returns the list and links. We only want links."},{"line_number":395,"context_line":"            listeners \u003d self.repositories.listener.get_all("},{"line_number":396,"context_line":"                context.session, show_deleted\u003dFalse, **filters)[0]"},{"line_number":397,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"5f7c97a3_94a1793d","line":394,"range":{"start_line":394,"start_character":68,"end_line":394,"end_character":73},"updated":"2018-07-26 13:58:18.000000000","message":"you mean we only want list?","commit_id":"05de05654e726efbe5c687c04187d3da4c03a100"}],"octavia/certificates/common/auth/barbican_acl.py":[{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"550213f92d705e1ab42404ff26bb797d86907aaf","unresolved":false,"context_lines":[{"line_number":22,"context_line":"from oslo_config import cfg"},{"line_number":23,"context_line":"from oslo_log import log as logging"},{"line_number":24,"context_line":"from oslo_utils import excutils"},{"line_number":25,"context_line":"from pecan import request"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"from octavia.certificates.common import barbican as barbican_common"},{"line_number":28,"context_line":"from octavia.common import keystone"}],"source_content_type":"text/x-python","patch_set":1,"id":"df7087c5_c3d14725","line":25,"range":{"start_line":25,"start_character":0,"end_line":25,"end_character":25},"updated":"2018-03-13 16:06:38.000000000","message":"Do we need to do this here or can we centralize this to the API code and just pass in the token?\nIn the API controller code it is: context.auth_token","commit_id":"66156e9731050ad09a4eae1247388ea1cb793b7b"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"e40eacb2db5e63e624a1c065dd28a1a4d815d225","unresolved":false,"context_lines":[{"line_number":22,"context_line":"from oslo_config import cfg"},{"line_number":23,"context_line":"from oslo_log import log as logging"},{"line_number":24,"context_line":"from oslo_utils import excutils"},{"line_number":25,"context_line":"from pecan import request"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"from octavia.certificates.common import barbican as barbican_common"},{"line_number":28,"context_line":"from octavia.common import keystone"}],"source_content_type":"text/x-python","patch_set":1,"id":"df7087c5_56c3b75d","line":25,"range":{"start_line":25,"start_character":0,"end_line":25,"end_character":25},"in_reply_to":"df7087c5_c3d14725","updated":"2018-03-13 16:29:43.000000000","message":"Ahh, it can be retrieved from the context? I wasn\u0027t sure, thought I was going to have to go to the pecan request object to get it. Though, I also use the client_addr to pass through but that may not really matter, just seemed nice to do.","commit_id":"66156e9731050ad09a4eae1247388ea1cb793b7b"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"550213f92d705e1ab42404ff26bb797d86907aaf","unresolved":false,"context_lines":[{"line_number":66,"context_line":"        bc.acls.create("},{"line_number":67,"context_line":"            entity_ref\u003dref,"},{"line_number":68,"context_line":"            # is this the right keystone userid, or should we auth to get it?"},{"line_number":69,"context_line":"            users\u003d(CONF.keystone_authtoken.username,)"},{"line_number":70,"context_line":"        )"}],"source_content_type":"text/x-python","patch_set":1,"id":"df7087c5_c32947e6","line":69,"range":{"start_line":69,"start_character":24,"end_line":69,"end_character":42},"updated":"2018-03-13 16:06:38.000000000","message":"This should be service_auth I think","commit_id":"66156e9731050ad09a4eae1247388ea1cb793b7b"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"e40eacb2db5e63e624a1c065dd28a1a4d815d225","unresolved":false,"context_lines":[{"line_number":66,"context_line":"        bc.acls.create("},{"line_number":67,"context_line":"            entity_ref\u003dref,"},{"line_number":68,"context_line":"            # is this the right keystone userid, or should we auth to get it?"},{"line_number":69,"context_line":"            users\u003d(CONF.keystone_authtoken.username,)"},{"line_number":70,"context_line":"        )"}],"source_content_type":"text/x-python","patch_set":1,"id":"df7087c5_d626e715","line":69,"range":{"start_line":69,"start_character":24,"end_line":69,"end_character":42},"in_reply_to":"df7087c5_c32947e6","updated":"2018-03-13 16:29:43.000000000","message":"k, though still not quite sure if the \"username\" is the same as what it\u0027s expecting for \"keystone user id\" or not. it might be.","commit_id":"66156e9731050ad09a4eae1247388ea1cb793b7b"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"a8ef324f2e348bca7d07bbd18f0cc4f7d0131723","unresolved":false,"context_lines":[{"line_number":57,"context_line":""},{"line_number":58,"context_line":"        # use barbican client to set the ACLs"},{"line_number":59,"context_line":"        bc \u003d cls.get_barbican_client_user_auth(context)"},{"line_number":60,"context_line":"        acl \u003d bc.acls.get(ref)"},{"line_number":61,"context_line":"        read_oper \u003d acl.get(\u0027read\u0027)"},{"line_number":62,"context_line":"        if user_id not in read_oper.users:"},{"line_number":63,"context_line":"            read_oper.users.append(user_id)"}],"source_content_type":"text/x-python","patch_set":9,"id":"5f7c97a3_94308257","line":60,"updated":"2018-06-08 18:45:19.000000000","message":"Ahh, I didn\u0027t actually read the ACL API fully, whoops","commit_id":"f0dd64f4cbed33361bb04142fe12ff8bfcea4114"},{"author":{"_account_id":6469,"name":"Carlos Gonçalves","display_name":"Carlos Goncalves","email":"cgoncalves@redhat.com","username":"cgoncalves"},"change_message_id":"93323b8a8e68204ba625b57c52c724aa9639afb7","unresolved":false,"context_lines":[{"line_number":57,"context_line":""},{"line_number":58,"context_line":"        # use barbican client to set the ACLs"},{"line_number":59,"context_line":"        bc \u003d cls.get_barbican_client_user_auth(context)"},{"line_number":60,"context_line":"        acl \u003d bc.acls.get(ref)"},{"line_number":61,"context_line":"        read_oper \u003d acl.get(\u0027read\u0027)"},{"line_number":62,"context_line":"        if user_id not in read_oper.users:"},{"line_number":63,"context_line":"            read_oper.users.append(user_id)"}],"source_content_type":"text/x-python","patch_set":9,"id":"5f7c97a3_f39f82ff","line":60,"in_reply_to":"5f7c97a3_94308257","updated":"2018-06-11 09:06:26.000000000","message":"the session was also incorrect. user and project set were from the octavia service hence calling Barbican API as \u0027admin\u0027 user and \u0027admin\u0027 project (defaults in devstack).","commit_id":"f0dd64f4cbed33361bb04142fe12ff8bfcea4114"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"439df9dbff57ccc7d92b160f45b35916120fe378","unresolved":false,"context_lines":[{"line_number":57,"context_line":""},{"line_number":58,"context_line":"        # use barbican client to set the ACLs"},{"line_number":59,"context_line":"        bc \u003d cls.get_barbican_client_user_auth(context)"},{"line_number":60,"context_line":"        acl \u003d bc.acls.get(ref)"},{"line_number":61,"context_line":"        read_oper \u003d acl.get(\u0027read\u0027)"},{"line_number":62,"context_line":"        if user_id not in read_oper.users:"},{"line_number":63,"context_line":"            read_oper.users.append(user_id)"}],"source_content_type":"text/x-python","patch_set":9,"id":"5f7c97a3_2899ea6b","line":60,"in_reply_to":"5f7c97a3_f39f82ff","updated":"2018-06-11 17:20:35.000000000","message":"well, it didn\u0027t really matter as we immediately just replaced that auth with the user auth -- the old session was just used to get the right URL from the catalog. At least, that was the intent, maybe I didn\u0027t do it right?","commit_id":"f0dd64f4cbed33361bb04142fe12ff8bfcea4114"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"a8ef324f2e348bca7d07bbd18f0cc4f7d0131723","unresolved":false,"context_lines":[{"line_number":64,"context_line":"            acl.submit()"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"    @classmethod"},{"line_number":67,"context_line":"    def revoke_secret_access(cls, context, ref):"},{"line_number":68,"context_line":"        # get a normal session"},{"line_number":69,"context_line":"        ksession \u003d keystone.KeystoneSession()"},{"line_number":70,"context_line":"        user_id \u003d ksession.get_service_user_id()"}],"source_content_type":"text/x-python","patch_set":9,"id":"5f7c97a3_543e6a29","line":67,"updated":"2018-06-08 18:45:19.000000000","message":"We don\u0027t want this -- see one of my other comments.","commit_id":"f0dd64f4cbed33361bb04142fe12ff8bfcea4114"}],"octavia/certificates/common/barbican.py":[{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"a8ef324f2e348bca7d07bbd18f0cc4f7d0131723","unresolved":false,"context_lines":[{"line_number":79,"context_line":"        \"\"\""},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"    @abc.abstractmethod"},{"line_number":82,"context_line":"    def revoke_secret_access(self, context, ref):"},{"line_number":83,"context_line":"        \"\"\"Revoke access of Octavia keystone user to a secret."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"        :param context: pecan context object"}],"source_content_type":"text/x-python","patch_set":9,"id":"5f7c97a3_b4357e47","line":82,"updated":"2018-06-08 18:45:19.000000000","message":"I was specifically not doing this, because this could easily break things -- imagine creating two LBs or even two listeners that use the same certificate. We would set ACLs twice (idempotent) and then if they delete this one, now the other listener can\u0027t access the cert data. \n\nUnfortunately, we just have to say \"once on, never off\" for our ACLs.","commit_id":"f0dd64f4cbed33361bb04142fe12ff8bfcea4114"},{"author":{"_account_id":6469,"name":"Carlos Gonçalves","display_name":"Carlos Goncalves","email":"cgoncalves@redhat.com","username":"cgoncalves"},"change_message_id":"93323b8a8e68204ba625b57c52c724aa9639afb7","unresolved":false,"context_lines":[{"line_number":79,"context_line":"        \"\"\""},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"    @abc.abstractmethod"},{"line_number":82,"context_line":"    def revoke_secret_access(self, context, ref):"},{"line_number":83,"context_line":"        \"\"\"Revoke access of Octavia keystone user to a secret."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"        :param context: pecan context object"}],"source_content_type":"text/x-python","patch_set":9,"id":"5f7c97a3_81e907e4","line":82,"in_reply_to":"5f7c97a3_b4357e47","updated":"2018-06-11 09:06:26.000000000","message":"Unless I\u0027m missing something, I\u0027ve addressed that in:\n\nhttps://review.openstack.org/#/c/552549/9/octavia/api/v2/controllers/listener.py@381\n\nhttps://review.openstack.org/#/c/552549/9/octavia/api/v2/controllers/listener.py@390\n\n\n\n\n\n[centos@rdocloud-devstack2 octavia-ssl]$ openstack acl get http://192.168.2.7/key-manager/v1/secrets/630ae0ba-d785-4bb1-9684-5e64e7ac5049\n+----------------+----------------+-------+---------------------------+---------------------------+------------------------------------------------------------------------------------+\n| Operation Type | Project Access | Users | Created                   | Updated                   | Secret ACL Ref                                                                     |\n+----------------+----------------+-------+---------------------------+---------------------------+------------------------------------------------------------------------------------+\n| read           | True           | []    | 2018-06-08T11:21:39+00:00 | 2018-06-11T09:00:36+00:00 | http://192.168.2.7/key-manager/v1/secrets/630ae0ba-d785-4bb1-9684-5e64e7ac5049/acl |\n+----------------+----------------+-------+---------------------------+---------------------------+------------------------------------------------------------------------------------+\n[centos@rdocloud-devstack2 octavia-ssl]$ openstack loadbalancer listener create --protocol-port 443 --protocol TERMINATED_HTTPS --name listener1 --default-tls-container\u003d\"http://192.168.2.7/key-manager/v1/secrets/630ae0ba-d785-4bb1-9684-5e64e7ac5049\" lb1\n+---------------------------+--------------------------------------------------------------------------------+\n| Field                     | Value                                                                          |\n+---------------------------+--------------------------------------------------------------------------------+\n| admin_state_up            | True                                                                           |\n| connection_limit          | -1                                                                             |\n| created_at                | 2018-06-11T09:00:47                                                            |\n| default_pool_id           | None                                                                           |\n| default_tls_container_ref | http://192.168.2.7/key-manager/v1/secrets/630ae0ba-d785-4bb1-9684-5e64e7ac5049 |\n| description               |                                                                                |\n| id                        | 542cc609-4e26-43c6-954a-019813c787c8                                           |\n| insert_headers            | None                                                                           |\n| l7policies                |                                                                                |\n| loadbalancers             | 37aad5d6-10ba-4946-bba6-3b561b3c0ba1                                           |\n| name                      | listener1                                                                      |\n| operating_status          | OFFLINE                                                                        |\n| project_id                | 56f826c7cec84821a8bc5a4cfa3521e6                                               |\n| protocol                  | TERMINATED_HTTPS                                                               |\n| protocol_port             | 443                                                                            |\n| provisioning_status       | PENDING_CREATE                                                                 |\n| sni_container_refs        | []                                                                             |\n| timeout_client_data       | 50000                                                                          |\n| timeout_member_connect    | 5000                                                                           |\n| timeout_member_data       | 50000                                                                          |\n| timeout_tcp_inspect       | 0                                                                              |\n| updated_at                | None                                                                           |\n+---------------------------+--------------------------------------------------------------------------------+\n[centos@rdocloud-devstack2 octavia-ssl]$ openstack loadbalancer listener create --protocol-port 444 --protocol TERMINATED_HTTPS --name listener2 --default-tls-container\u003d\"http://192.168.2.7/key-manager/v1/secrets/630ae0ba-d785-4bb1-9684-5e64e7ac5049\" lb1\n+---------------------------+--------------------------------------------------------------------------------+\n| Field                     | Value                                                                          |\n+---------------------------+--------------------------------------------------------------------------------+\n| admin_state_up            | True                                                                           |\n| connection_limit          | -1                                                                             |\n| created_at                | 2018-06-11T09:00:52                                                            |\n| default_pool_id           | None                                                                           |\n| default_tls_container_ref | http://192.168.2.7/key-manager/v1/secrets/630ae0ba-d785-4bb1-9684-5e64e7ac5049 |\n| description               |                                                                                |\n| id                        | 4412fb33-6597-4343-a47d-4c2ffd4c0eff                                           |\n| insert_headers            | None                                                                           |\n| l7policies                |                                                                                |\n| loadbalancers             | 37aad5d6-10ba-4946-bba6-3b561b3c0ba1                                           |\n| name                      | listener2                                                                      |\n| operating_status          | OFFLINE                                                                        |\n| project_id                | 56f826c7cec84821a8bc5a4cfa3521e6                                               |\n| protocol                  | TERMINATED_HTTPS                                                               |\n| protocol_port             | 444                                                                            |\n| provisioning_status       | PENDING_CREATE                                                                 |\n| sni_container_refs        | []                                                                             |\n| timeout_client_data       | 50000                                                                          |\n| timeout_member_connect    | 5000                                                                           |\n| timeout_member_data       | 50000                                                                          |\n| timeout_tcp_inspect       | 0                                                                              |\n| updated_at                | None                                                                           |\n+---------------------------+--------------------------------------------------------------------------------+\n[centos@rdocloud-devstack2 octavia-ssl]$ openstack acl get http://192.168.2.7/key-manager/v1/secrets/630ae0ba-d785-4bb1-9684-5e64e7ac5049                                                                          +----------------+----------------+---------------------------------------+---------------------------+---------------------------+------------------------------------------------------------------------------------+\n| Operation Type | Project Access | Users                                 | Created                   | Updated                   | Secret ACL Ref                                                                     |\n+----------------+----------------+---------------------------------------+---------------------------+---------------------------+------------------------------------------------------------------------------------+\n| read           | True           | [u\u00270dfe762b698a4e6daad154fa9a59bb97\u0027] | 2018-06-08T11:21:39+00:00 | 2018-06-11T09:00:47+00:00 | http://192.168.2.7/key-manager/v1/secrets/630ae0ba-d785-4bb1-9684-5e64e7ac5049/acl |\n+----------------+----------------+---------------------------------------+---------------------------+---------------------------+------------------------------------------------------------------------------------+\n[centos@rdocloud-devstack2 octavia-ssl]$ openstack loadbalancer listener delete listener2                                                                                                                          [centos@rdocloud-devstack2 octavia-ssl]$ openstack acl get http://192.168.2.7/key-manager/v1/secrets/630ae0ba-d785-4bb1-9684-5e64e7ac5049\n+----------------+----------------+---------------------------------------+---------------------------+---------------------------+------------------------------------------------------------------------------------+\n| Operation Type | Project Access | Users                                 | Created                   | Updated                   | Secret ACL Ref                                                                     |\n+----------------+----------------+---------------------------------------+---------------------------+---------------------------+------------------------------------------------------------------------------------+\n| read           | True           | [u\u00270dfe762b698a4e6daad154fa9a59bb97\u0027] | 2018-06-08T11:21:39+00:00 | 2018-06-11T09:00:47+00:00 | http://192.168.2.7/key-manager/v1/secrets/630ae0ba-d785-4bb1-9684-5e64e7ac5049/acl |\n+----------------+----------------+---------------------------------------+---------------------------+---------------------------+------------------------------------------------------------------------------------+","commit_id":"f0dd64f4cbed33361bb04142fe12ff8bfcea4114"}],"octavia/certificates/manager/barbican.py":[{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"550213f92d705e1ab42404ff26bb797d86907aaf","unresolved":false,"context_lines":[{"line_number":120,"context_line":"                # explicitly violating the spirit of the flag by creating ACLs"},{"line_number":121,"context_line":"                # on the objects... And, technically we could still fail after"},{"line_number":122,"context_line":"                # this happens, and leave random ACLs on their secrets."},{"line_number":123,"context_line":"                self.auth.ensure_secret_access(cert_ref)"},{"line_number":124,"context_line":"            return pkcs12.PKCS12Cert(cert_secret.payload)"},{"line_number":125,"context_line":"        except Exception:"},{"line_number":126,"context_line":"            # If our get fails, try with the legacy driver."}],"source_content_type":"text/x-python","patch_set":1,"id":"df7087c5_165a1f29","line":123,"updated":"2018-03-13 16:06:38.000000000","message":"So, I think I envisioned this differently.\nI expected we would add an explicit call out from the API listener controller code that adds these ACLs when the user is doing a listener create and update that adds the ACL, such that if we aren\u0027t successful we can error back at creation time.","commit_id":"66156e9731050ad09a4eae1247388ea1cb793b7b"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"e40eacb2db5e63e624a1c065dd28a1a4d815d225","unresolved":false,"context_lines":[{"line_number":120,"context_line":"                # explicitly violating the spirit of the flag by creating ACLs"},{"line_number":121,"context_line":"                # on the objects... And, technically we could still fail after"},{"line_number":122,"context_line":"                # this happens, and leave random ACLs on their secrets."},{"line_number":123,"context_line":"                self.auth.ensure_secret_access(cert_ref)"},{"line_number":124,"context_line":"            return pkcs12.PKCS12Cert(cert_secret.payload)"},{"line_number":125,"context_line":"        except Exception:"},{"line_number":126,"context_line":"            # If our get fails, try with the legacy driver."}],"source_content_type":"text/x-python","patch_set":1,"id":"df7087c5_561bb7ce","line":123,"in_reply_to":"df7087c5_165a1f29","updated":"2018-03-13 16:29:43.000000000","message":"Yeah, that\u0027s the idea ... It\u0027s just that, what we ALREADY do is call this with check_only at that time. So, that\u0027s already where we are.\n\nAnd, to do this we need to have the refs for the secrets, which for the new driver is only one ref but for the legacy driver is a bunch of them and requires doing at least one fetch to Barbican.\n\nAlso, I just realized, I need to do this actually before we even check, as the check will fail without the ACLs existing. T_T\nSo, we REALLY won\u0027t have a choice, and there will be an even greater chance we leave ACLs sitting around. \u003e_\u003e","commit_id":"66156e9731050ad09a4eae1247388ea1cb793b7b"},{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"a8ef324f2e348bca7d07bbd18f0cc4f7d0131723","unresolved":false,"context_lines":[{"line_number":148,"context_line":"        LOG.debug(\u0027Setting project ACL for certificate secret...\u0027)"},{"line_number":149,"context_line":"        self.auth.ensure_secret_access(context, cert_ref)"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"    def unset_acls(self, context, cert_ref):"},{"line_number":152,"context_line":"        LOG.debug(\u0027Unsetting project ACL for certificate secret...\u0027)"},{"line_number":153,"context_line":"        self.auth.revoke_secret_access(context, cert_ref)"}],"source_content_type":"text/x-python","patch_set":9,"id":"5f7c97a3_743b6637","line":151,"updated":"2018-06-08 18:45:19.000000000","message":"We don\u0027t want this -- see one of my other comments.","commit_id":"f0dd64f4cbed33361bb04142fe12ff8bfcea4114"},{"author":{"_account_id":15309,"name":"zhaobo","email":"bzhaojyathousandy@gmail.com","username":"ZhaoBo"},"change_message_id":"78d83e4c06c54ba3124632a033d008776beaae13","unresolved":false,"context_lines":[{"line_number":143,"context_line":"            # If the delete failed, it was probably because it isn\u0027t legacy"},{"line_number":144,"context_line":"            # (this will be fixed once Secrets have Consumer registration)."},{"line_number":145,"context_line":"            pass"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"    def set_acls(self, context, cert_ref):"},{"line_number":148,"context_line":"        LOG.debug(\u0027Setting project ACL for certificate secret...\u0027)"},{"line_number":149,"context_line":"        self.auth.ensure_secret_access(context, cert_ref)"}],"source_content_type":"text/x-python","patch_set":10,"id":"5f7c97a3_b747007b","line":146,"updated":"2018-07-13 08:42:15.000000000","message":"I found the barbican.py and barbican_legecy.py contain the same Barbican client wrapper class \"BarbicanCerManager\", just a question, :), why the file still exists?","commit_id":"b71c413b6f3b1edf6a5df1f46bedb42678b91227"}],"octavia/certificates/manager/barbican_legacy.py":[{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"a8ef324f2e348bca7d07bbd18f0cc4f7d0131723","unresolved":false,"context_lines":[{"line_number":204,"context_line":"            self.auth.ensure_secret_access("},{"line_number":205,"context_line":"                context, cert_container.intermediates.secret_ref)"},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"    def unset_acls(self, context, cert_ref):"},{"line_number":208,"context_line":"        LOG.debug(\u0027Unsetting project ACLs for certificate secrets...\u0027)"},{"line_number":209,"context_line":"        self.auth.revoke_secret_access(context, cert_ref)"},{"line_number":210,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"5f7c97a3_144472b7","line":207,"updated":"2018-06-08 18:45:19.000000000","message":"We don\u0027t want this -- see one of my other comments.","commit_id":"f0dd64f4cbed33361bb04142fe12ff8bfcea4114"},{"author":{"_account_id":15309,"name":"zhaobo","email":"bzhaojyathousandy@gmail.com","username":"ZhaoBo"},"change_message_id":"78d83e4c06c54ba3124632a033d008776beaae13","unresolved":false,"context_lines":[{"line_number":183,"context_line":"                LOG.error(\u0027Error deregistering as a consumer of %s: %s\u0027,"},{"line_number":184,"context_line":"                          cert_ref, e)"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"    def set_acls(self, context, cert_ref):"},{"line_number":187,"context_line":"        LOG.debug(\u0027Setting project ACLs for certificate secrets...\u0027)"},{"line_number":188,"context_line":"        self.auth.ensure_secret_access(context, cert_ref)"},{"line_number":189,"context_line":""}],"source_content_type":"text/x-python","patch_set":10,"id":"5f7c97a3_571b0c83","line":186,"updated":"2018-07-13 08:42:15.000000000","message":"This 2 functions just the func name is different, the paras are the same.. How about make it a single one? Just a opinion.","commit_id":"b71c413b6f3b1edf6a5df1f46bedb42678b91227"},{"author":{"_account_id":15309,"name":"zhaobo","email":"bzhaojyathousandy@gmail.com","username":"ZhaoBo"},"change_message_id":"78d83e4c06c54ba3124632a033d008776beaae13","unresolved":false,"context_lines":[{"line_number":184,"context_line":"                          cert_ref, e)"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"    def set_acls(self, context, cert_ref):"},{"line_number":187,"context_line":"        LOG.debug(\u0027Setting project ACLs for certificate secrets...\u0027)"},{"line_number":188,"context_line":"        self.auth.ensure_secret_access(context, cert_ref)"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"        LOG.debug(\u0027Setting project ACLs for certificate secrets...\u0027)"}],"source_content_type":"text/x-python","patch_set":10,"id":"5f7c97a3_ac9013f5","line":187,"range":{"start_line":187,"start_character":0,"end_line":187,"end_character":68},"updated":"2018-07-13 08:42:15.000000000","message":"why this line is the same with L190?","commit_id":"b71c413b6f3b1edf6a5df1f46bedb42678b91227"},{"author":{"_account_id":15309,"name":"zhaobo","email":"bzhaojyathousandy@gmail.com","username":"ZhaoBo"},"change_message_id":"78d83e4c06c54ba3124632a033d008776beaae13","unresolved":false,"context_lines":[{"line_number":205,"context_line":"                context, cert_container.intermediates.secret_ref)"},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"    def unset_acls(self, context, cert_ref):"},{"line_number":208,"context_line":"        LOG.debug(\u0027Unsetting project ACLs for certificate secrets...\u0027)"},{"line_number":209,"context_line":"        self.auth.revoke_secret_access(context, cert_ref)"},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"        LOG.debug(\u0027Unsetting project ACLs for certificate secrets...\u0027)"}],"source_content_type":"text/x-python","patch_set":10,"id":"5f7c97a3_6c9afb13","line":208,"range":{"start_line":208,"start_character":0,"end_line":208,"end_character":70},"updated":"2018-07-13 08:42:15.000000000","message":"ditto","commit_id":"b71c413b6f3b1edf6a5df1f46bedb42678b91227"}],"octavia/certificates/manager/castellan_mgr.py":[{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"a8ef324f2e348bca7d07bbd18f0cc4f7d0131723","unresolved":false,"context_lines":[{"line_number":67,"context_line":"        # because we assume we have elevated access to the secret store."},{"line_number":68,"context_line":"        pass"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"    def unset_acls(self, context, cert_ref):"},{"line_number":71,"context_line":"        # We don\u0027t manage ACL based access for things retrieved via Castellan"},{"line_number":72,"context_line":"        # because we assume we have elevated access to the secret store."},{"line_number":73,"context_line":"        pass"}],"source_content_type":"text/x-python","patch_set":9,"id":"5f7c97a3_d4135ab7","line":70,"updated":"2018-06-08 18:45:19.000000000","message":"We don\u0027t want this -- see one of my other comments.","commit_id":"f0dd64f4cbed33361bb04142fe12ff8bfcea4114"}],"octavia/certificates/manager/cert_mgr.py":[{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"a8ef324f2e348bca7d07bbd18f0cc4f7d0131723","unresolved":false,"context_lines":[{"line_number":66,"context_line":"        \"\"\""},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"    @abc.abstractmethod"},{"line_number":69,"context_line":"    def unset_acls(self, context, cert_ref):"},{"line_number":70,"context_line":"        \"\"\"Remove ACLs so Octavia can access the cert objects."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"        If the specified cert does not exist or the removal of ACLs fails for"}],"source_content_type":"text/x-python","patch_set":9,"id":"5f7c97a3_f418d6d3","line":69,"updated":"2018-06-08 18:45:19.000000000","message":"We don\u0027t want this -- see one of my other comments.","commit_id":"f0dd64f4cbed33361bb04142fe12ff8bfcea4114"}],"octavia/certificates/manager/local.py":[{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"a8ef324f2e348bca7d07bbd18f0cc4f7d0131723","unresolved":false,"context_lines":[{"line_number":165,"context_line":"        # There is no security on this store, because it\u0027s really dumb"},{"line_number":166,"context_line":"        pass"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"    def unset_acls(self, context, cert_ref):"},{"line_number":169,"context_line":"        # There is no security on this store, because it\u0027s really dumb"},{"line_number":170,"context_line":"        pass"}],"source_content_type":"text/x-python","patch_set":9,"id":"5f7c97a3_94096285","line":168,"updated":"2018-06-08 18:45:19.000000000","message":"We don\u0027t want this -- see one of my other comments.","commit_id":"f0dd64f4cbed33361bb04142fe12ff8bfcea4114"}],"octavia/db/repositories.py":[{"author":{"_account_id":10273,"name":"Adam Harwell","email":"flux.adam@gmail.com","username":"rm_you"},"change_message_id":"a8ef324f2e348bca7d07bbd18f0cc4f7d0131723","unresolved":false,"context_lines":[{"line_number":49,"context_line":"        :param filters: Filters to decide which entities should be retrieved."},{"line_number":50,"context_line":"        :returns: int"},{"line_number":51,"context_line":"        \"\"\""},{"line_number":52,"context_line":"        deleted \u003d filters.pop(\u0027show_deleted\u0027, True)"},{"line_number":53,"context_line":"        query \u003d session.query(self.model_class)"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"        if not deleted:"}],"source_content_type":"text/x-python","patch_set":9,"id":"5f7c97a3_7424c60d","line":52,"updated":"2018-06-08 18:45:19.000000000","message":"Woah, why is this changing in this patch? This is a base repository function that affects a ton of stuff. Did this sneak in here by mistake?","commit_id":"f0dd64f4cbed33361bb04142fe12ff8bfcea4114"}]}