)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"cc4796cec278983d0d135373a967f1ef30a21350","unresolved":false,"context_lines":[{"line_number":15,"context_line":"    intervals [reboot, yearly, annually, monthly, weekly, daily, hourly] to all"},{"line_number":16,"context_line":"    hosts from any keystone fernet host."},{"line_number":17,"context_line":"  * Fixes the section in `keystone.conf` which was named \"fernet_key\" instead"},{"line_number":18,"context_line":"    of \"fernet_token\"."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Change-Id: I50f6a852930728631f5c681a8aa0f1321d7424ac"},{"line_number":21,"context_line":"Related-Bug: #1463569"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"ba3cc151_3d980fc0","line":18,"updated":"2015-06-30 20:41:09.000000000","message":"s/fernet_token/fernet_tokens/\n\nhttps://github.com/openstack/keystone/blob/7a88015a9f4956526ae259f69d4ce8f5335dec01/etc/keystone.conf.sample#L764\n\nthis is super nit picky and I don\u0027t think it mandates a respin of the patch by any means, just documenting.","commit_id":"df3edca7a6def8869479feb98ea815f0bc7d30a4"}],"playbooks/roles/os_keystone/defaults/main.yml":[{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"28083cae7c540bdc6942b8b03b348d2ff238d12c","unresolved":false,"context_lines":[{"line_number":25,"context_line":"keystone_system_user_name: keystone"},{"line_number":26,"context_line":"keystone_system_group_name: keystone"},{"line_number":27,"context_line":"keystone_system_service_name: apache2"},{"line_number":28,"context_line":"keystone_system_shell: /bin/bash"},{"line_number":29,"context_line":"keystone_system_comment: keystone system user"},{"line_number":30,"context_line":"keystone_system_user_home: \"/var/lib/{{ keystone_system_user_name }}\""},{"line_number":31,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_f3a53647","line":28,"updated":"2015-06-26 14:32:11.000000000","message":"Does this perhaps introduce a security issue in that the keystone user could be logged into using a brute-force password hack? It may be better to leave the user shell at /bin/false but ensure that the CLI for the rsync executes using /bin/bash as the shell on the cli?","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"1980b0881f88b72aa0f40a19c1bda60c92dc7a50","unresolved":false,"context_lines":[{"line_number":25,"context_line":"keystone_system_user_name: keystone"},{"line_number":26,"context_line":"keystone_system_group_name: keystone"},{"line_number":27,"context_line":"keystone_system_service_name: apache2"},{"line_number":28,"context_line":"keystone_system_shell: /bin/bash"},{"line_number":29,"context_line":"keystone_system_comment: keystone system user"},{"line_number":30,"context_line":"keystone_system_user_home: \"/var/lib/{{ keystone_system_user_name }}\""},{"line_number":31,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_5e72e6b1","line":28,"in_reply_to":"fa32b979_a82df8a9","updated":"2015-06-26 15:10:56.000000000","message":"Never-mind, this can not be done without a shell because the underlying process is rsysnc. That said, the password is a randomly generated password between 16 - 64 characters long which should be very difficult to brute force in addition to the fact that by default in our containers password authentication for ssh has been disabled so there shouldn\u0027t be any issue with having the keystone user compromised with a bash shell from the perspective of network accessibility. The only way I can see where the keystone user password could be used to gain access to the keystone user would be to have access to the host where you could attach to the keystone container using the lxc-attach command.","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"06bc6060bd9437e71f5392d4c7ffbb222b329d46","unresolved":false,"context_lines":[{"line_number":25,"context_line":"keystone_system_user_name: keystone"},{"line_number":26,"context_line":"keystone_system_group_name: keystone"},{"line_number":27,"context_line":"keystone_system_service_name: apache2"},{"line_number":28,"context_line":"keystone_system_shell: /bin/bash"},{"line_number":29,"context_line":"keystone_system_comment: keystone system user"},{"line_number":30,"context_line":"keystone_system_user_home: \"/var/lib/{{ keystone_system_user_name }}\""},{"line_number":31,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_a82df8a9","line":28,"in_reply_to":"fa32b979_f3a53647","updated":"2015-06-26 14:50:47.000000000","message":"Done","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"}],"playbooks/roles/os_keystone/tasks/keystone_fernet.yml":[{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"686bb81af23a22cfd83080d049b9360504079855","unresolved":false,"context_lines":[{"line_number":21,"context_line":"  when: \u003e"},{"line_number":22,"context_line":"    inventory_hostname \u003d\u003d groups[\u0027keystone_all\u0027][0]"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"- include: keystone_fernet_keys_autorotate.yml"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"ba3cc151_745ebb13","line":24,"updated":"2015-06-30 17:19:05.000000000","message":"Shouldn\u0027t this only run on keystone[0] - otherwise the rotation will happen on all keystone containers? I thought the idea was to rotate on keystone[0] and distribute the new keys to all containers.","commit_id":"df3edca7a6def8869479feb98ea815f0bc7d30a4"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"428916a67c9a4551d7ee60bc695e8617ea80efd9","unresolved":false,"context_lines":[{"line_number":21,"context_line":"  when: \u003e"},{"line_number":22,"context_line":"    inventory_hostname \u003d\u003d groups[\u0027keystone_all\u0027][0]"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"- include: keystone_fernet_keys_autorotate.yml"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"ba3cc151_749b1b73","line":24,"in_reply_to":"ba3cc151_745ebb13","updated":"2015-06-30 17:24:31.000000000","message":"the auto-rotation section happens on all hosts. Within that include the first node will auto-rotate on a set time frame while all other nodes will get the auto-rotation script which allows root the ability to login to any keystone node and rotate at will while ensuring all keystone nodes remain in-sync. Building this out like so makes it possible for a user to add nodes to the environment at will.","commit_id":"df3edca7a6def8869479feb98ea815f0bc7d30a4"}],"playbooks/roles/os_keystone/tasks/keystone_fernet_keys_autorotate.yml":[{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"ea7835dada6bbc7223cebf8b0e4f1ac143b16609","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    dest: \"/opt/keystone-fernet-rotate.sh\""},{"line_number":20,"context_line":"    owner: \"{{ keystone_system_user_name }}\""},{"line_number":21,"context_line":"    group: \"{{ keystone_system_group_name }}\""},{"line_number":22,"context_line":"    mode: \"0755\""},{"line_number":23,"context_line":"  tags:"},{"line_number":24,"context_line":"    - keystone-fernet-auto-rotate"},{"line_number":25,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_3ef602fa","line":22,"updated":"2015-06-26 15:15:09.000000000","message":"Do we want everyone to be able to read \u0026 execute the script? I am guessing this is so someone can ssh in as root and run it without switching to the keystone user, right? We might want a comment to that effect in the event security-minded folks (but not actual security experts) come through and want to say this is unnecesssary.","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"7696a67a26b3aa7340434d708f20711f3ea855ff","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    dest: \"/opt/keystone-fernet-rotate.sh\""},{"line_number":20,"context_line":"    owner: \"{{ keystone_system_user_name }}\""},{"line_number":21,"context_line":"    group: \"{{ keystone_system_group_name }}\""},{"line_number":22,"context_line":"    mode: \"0755\""},{"line_number":23,"context_line":"  tags:"},{"line_number":24,"context_line":"    - keystone-fernet-auto-rotate"},{"line_number":25,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_7e07aa81","line":22,"in_reply_to":"fa32b979_3ef602fa","updated":"2015-06-26 15:31:12.000000000","message":"Done","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":12807,"name":"Steve Lewis (stevelle)","email":"stevelle@gmail.com","username":"stevelle"},"change_message_id":"a6f9d9f8e6c67bdc93ae50ee07255bd6e2f39348","unresolved":false,"context_lines":[{"line_number":34,"context_line":"    name: \"Fernet auto rotate job\""},{"line_number":35,"context_line":"    special_time: \"{{ keystone_fernet_rotation }}\""},{"line_number":36,"context_line":"    user: \"keystone\""},{"line_number":37,"context_line":"    job: \"/opt/keystone-fernet-rotate.sh\""},{"line_number":38,"context_line":"    cron_file: keystone-fernet-rotate"},{"line_number":39,"context_line":"  when: \u003e"},{"line_number":40,"context_line":"    inventory_hostname \u003d\u003d groups[\u0027keystone_all\u0027][0]"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"ba3cc151_b7722ce4","line":37,"updated":"2015-06-30 01:26:03.000000000","message":"I would like to see the output of the job collected in centralized logging.","commit_id":"dc1f647324cac63e8570695f36c3f6a394571294"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"6ee81c3f5122c4c788bd0e8aa8a0197476ccb6ea","unresolved":false,"context_lines":[{"line_number":34,"context_line":"    name: \"Fernet auto rotate job\""},{"line_number":35,"context_line":"    special_time: \"{{ keystone_fernet_rotation }}\""},{"line_number":36,"context_line":"    user: \"keystone\""},{"line_number":37,"context_line":"    job: \"/opt/keystone-fernet-rotate.sh\""},{"line_number":38,"context_line":"    cron_file: keystone-fernet-rotate"},{"line_number":39,"context_line":"  when: \u003e"},{"line_number":40,"context_line":"    inventory_hostname \u003d\u003d groups[\u0027keystone_all\u0027][0]"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"ba3cc151_2ac9b978","line":37,"in_reply_to":"ba3cc151_3f234abf","updated":"2015-06-30 14:55:28.000000000","message":"It does not due to how the context changes in the execution. I\u0027ve changed the script to use the system logger for execution.","commit_id":"dc1f647324cac63e8570695f36c3f6a394571294"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"6ee81c3f5122c4c788bd0e8aa8a0197476ccb6ea","unresolved":false,"context_lines":[{"line_number":34,"context_line":"    name: \"Fernet auto rotate job\""},{"line_number":35,"context_line":"    special_time: \"{{ keystone_fernet_rotation }}\""},{"line_number":36,"context_line":"    user: \"keystone\""},{"line_number":37,"context_line":"    job: \"/opt/keystone-fernet-rotate.sh\""},{"line_number":38,"context_line":"    cron_file: keystone-fernet-rotate"},{"line_number":39,"context_line":"  when: \u003e"},{"line_number":40,"context_line":"    inventory_hostname \u003d\u003d groups[\u0027keystone_all\u0027][0]"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"ba3cc151_8ae32505","line":37,"in_reply_to":"ba3cc151_b7722ce4","updated":"2015-06-30 14:55:28.000000000","message":"Done","commit_id":"dc1f647324cac63e8570695f36c3f6a394571294"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"772ef0c39dbf355ffd68608548bc5d08c85bb620","unresolved":false,"context_lines":[{"line_number":34,"context_line":"    name: \"Fernet auto rotate job\""},{"line_number":35,"context_line":"    special_time: \"{{ keystone_fernet_rotation }}\""},{"line_number":36,"context_line":"    user: \"keystone\""},{"line_number":37,"context_line":"    job: \"/opt/keystone-fernet-rotate.sh\""},{"line_number":38,"context_line":"    cron_file: keystone-fernet-rotate"},{"line_number":39,"context_line":"  when: \u003e"},{"line_number":40,"context_line":"    inventory_hostname \u003d\u003d groups[\u0027keystone_all\u0027][0]"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"ba3cc151_3f234abf","line":37,"in_reply_to":"ba3cc151_b7722ce4","updated":"2015-06-30 08:32:34.000000000","message":"Won\u0027t any output of the script go to the cron log anyway?","commit_id":"dc1f647324cac63e8570695f36c3f6a394571294"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"23cc96cd283f6514055704d8c8fb1774f74154f3","unresolved":false,"context_lines":[{"line_number":18,"context_line":"#  executed will always change it\u0027s user context to the keystone user before"},{"line_number":19,"context_line":"#  execution and while the script may be world read/executable its contains only"},{"line_number":20,"context_line":"#  the necessary bits that are required to run the rotate and sync commands."},{"line_number":21,"context_line":"- name: Drop fernet key auto rotate script"},{"line_number":22,"context_line":"  template:"},{"line_number":23,"context_line":"    src: \"keystone-fernet-rotate.sh.j2\""},{"line_number":24,"context_line":"    dest: \"{{ keystone_fernet_auto_rotation_script }}\""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"ba3cc151_cf99b7c5","line":21,"updated":"2015-07-02 19:23:51.000000000","message":"Do you need to drop this script for all hosts or just groups[\u0027keystone_all\u0027][0]?","commit_id":"df3edca7a6def8869479feb98ea815f0bc7d30a4"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"e6ba90e0e38a6081ebe2b75dfeefd9c7a54da952","unresolved":false,"context_lines":[{"line_number":18,"context_line":"#  executed will always change it\u0027s user context to the keystone user before"},{"line_number":19,"context_line":"#  execution and while the script may be world read/executable its contains only"},{"line_number":20,"context_line":"#  the necessary bits that are required to run the rotate and sync commands."},{"line_number":21,"context_line":"- name: Drop fernet key auto rotate script"},{"line_number":22,"context_line":"  template:"},{"line_number":23,"context_line":"    src: \"keystone-fernet-rotate.sh.j2\""},{"line_number":24,"context_line":"    dest: \"{{ keystone_fernet_auto_rotation_script }}\""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"ba3cc151_0180d3f3","line":21,"in_reply_to":"ba3cc151_cf99b7c5","updated":"2015-07-02 19:52:51.000000000","message":"The rotation script is dropped everywhere so that the keys can be rotated by root via any keystone host while the subsequent cron, which runs the script, will only be executed on keysotne_all[0]","commit_id":"df3edca7a6def8869479feb98ea815f0bc7d30a4"}],"playbooks/roles/os_keystone/tasks/keystone_key_create.yml":[{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"06bc6060bd9437e71f5392d4c7ffbb222b329d46","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"fa32b979_881b5480","updated":"2015-06-26 14:50:47.000000000","message":"Done.","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"28083cae7c540bdc6942b8b03b348d2ff238d12c","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    - \"{{ keystone_system_user_home }}/.ssh/id_rsa\""},{"line_number":23,"context_line":"    - \"{{ keystone_system_user_home }}/.ssh/id_rsa.pub\""},{"line_number":24,"context_line":"  tags:"},{"line_number":25,"context_line":"    - swift-key"},{"line_number":26,"context_line":"    - swift-key-create"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"- name: Create the swift SSH key if it doesnt exist"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_a51be172","line":25,"updated":"2015-06-26 14:32:11.000000000","message":"s/swift/keystone/","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"28083cae7c540bdc6942b8b03b348d2ff238d12c","unresolved":false,"context_lines":[{"line_number":23,"context_line":"    - \"{{ keystone_system_user_home }}/.ssh/id_rsa.pub\""},{"line_number":24,"context_line":"  tags:"},{"line_number":25,"context_line":"    - swift-key"},{"line_number":26,"context_line":"    - swift-key-create"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"- name: Create the swift SSH key if it doesnt exist"},{"line_number":29,"context_line":"  command: |"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_8529fd8b","line":26,"updated":"2015-06-26 14:32:11.000000000","message":"s/swift/keystone/","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"28083cae7c540bdc6942b8b03b348d2ff238d12c","unresolved":false,"context_lines":[{"line_number":25,"context_line":"    - swift-key"},{"line_number":26,"context_line":"    - swift-key-create"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"- name: Create the swift SSH key if it doesnt exist"},{"line_number":29,"context_line":"  command: |"},{"line_number":30,"context_line":"    ssh-keygen -f {{ keystone_system_user_home }}/.ssh/id_rsa -t rsa -q -N \"\""},{"line_number":31,"context_line":"  sudo: yes"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_5310a259","line":28,"updated":"2015-06-26 14:32:11.000000000","message":"s/swift/keystone/","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"28083cae7c540bdc6942b8b03b348d2ff238d12c","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  sudo: yes"},{"line_number":32,"context_line":"  sudo_user: \"{{ keystone_system_user_name }}\""},{"line_number":33,"context_line":"  tags:"},{"line_number":34,"context_line":"    - swift-key"},{"line_number":35,"context_line":"    - swift-key-create"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"- name: Create empty \u0027authorized_keys\u0027 file"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_e53809d7","line":34,"updated":"2015-06-26 14:32:11.000000000","message":"s/swift/keystone/","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"28083cae7c540bdc6942b8b03b348d2ff238d12c","unresolved":false,"context_lines":[{"line_number":32,"context_line":"  sudo_user: \"{{ keystone_system_user_name }}\""},{"line_number":33,"context_line":"  tags:"},{"line_number":34,"context_line":"    - swift-key"},{"line_number":35,"context_line":"    - swift-key-create"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"- name: Create empty \u0027authorized_keys\u0027 file"},{"line_number":38,"context_line":"  file:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_a53201f1","line":35,"updated":"2015-06-26 14:32:11.000000000","message":"s/swift/keystone/","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"28083cae7c540bdc6942b8b03b348d2ff238d12c","unresolved":false,"context_lines":[{"line_number":39,"context_line":"    path: \"{{ keystone_system_user_home }}/.ssh/authorized_keys\""},{"line_number":40,"context_line":"    state: \"touch\""},{"line_number":41,"context_line":"  tags:"},{"line_number":42,"context_line":"    - swift-key"},{"line_number":43,"context_line":"    - swift-key-create"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"- name: Change permissions on the generated keys"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_654b9960","line":42,"updated":"2015-06-26 14:32:11.000000000","message":"s/swift/keystone/","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"28083cae7c540bdc6942b8b03b348d2ff238d12c","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    state: \"touch\""},{"line_number":41,"context_line":"  tags:"},{"line_number":42,"context_line":"    - swift-key"},{"line_number":43,"context_line":"    - swift-key-create"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"- name: Change permissions on the generated keys"},{"line_number":46,"context_line":"  file:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_455a152c","line":43,"updated":"2015-06-26 14:32:11.000000000","message":"s/swift/keystone/","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"28083cae7c540bdc6942b8b03b348d2ff238d12c","unresolved":false,"context_lines":[{"line_number":53,"context_line":"    - { path: \"{{ keystone_system_user_home }}/.ssh/id_rsa\", mode: \"0600\" }"},{"line_number":54,"context_line":"    - { path: \"{{ keystone_system_user_home }}/.ssh/id_rsa.pub\", mode: \"0644\" }"},{"line_number":55,"context_line":"  tags:"},{"line_number":56,"context_line":"    - swift-key"},{"line_number":57,"context_line":"    - swift-key-create"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"- name: Get public key contents"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_c546254f","line":56,"updated":"2015-06-26 14:32:11.000000000","message":"s/swift/keystone/","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"28083cae7c540bdc6942b8b03b348d2ff238d12c","unresolved":false,"context_lines":[{"line_number":54,"context_line":"    - { path: \"{{ keystone_system_user_home }}/.ssh/id_rsa.pub\", mode: \"0644\" }"},{"line_number":55,"context_line":"  tags:"},{"line_number":56,"context_line":"    - swift-key"},{"line_number":57,"context_line":"    - swift-key-create"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"- name: Get public key contents"},{"line_number":60,"context_line":"  command: |"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_6572b9b2","line":57,"updated":"2015-06-26 14:32:11.000000000","message":"s/swift/keystone/","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"28083cae7c540bdc6942b8b03b348d2ff238d12c","unresolved":false,"context_lines":[{"line_number":62,"context_line":"  register: keystone_pub"},{"line_number":63,"context_line":"  changed_when: false"},{"line_number":64,"context_line":"  tags:"},{"line_number":65,"context_line":"    - swift-key"},{"line_number":66,"context_line":"    - swift-key-create"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"- name: Build authorized keys"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_e566c9ed","line":65,"updated":"2015-06-26 14:32:11.000000000","message":"s/swift/keystone/","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"28083cae7c540bdc6942b8b03b348d2ff238d12c","unresolved":false,"context_lines":[{"line_number":63,"context_line":"  changed_when: false"},{"line_number":64,"context_line":"  tags:"},{"line_number":65,"context_line":"    - swift-key"},{"line_number":66,"context_line":"    - swift-key-create"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"- name: Build authorized keys"},{"line_number":69,"context_line":"  shell: |"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_a560c1d0","line":66,"updated":"2015-06-26 14:32:11.000000000","message":"s/swift/keystone/","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"28083cae7c540bdc6942b8b03b348d2ff238d12c","unresolved":false,"context_lines":[{"line_number":70,"context_line":"    echo \"{{ keystone_pub.stdout }}\" | tee -a {{ keystone_system_user_home }}/.ssh/authorized_keys"},{"line_number":71,"context_line":"  delegate_to: \"{{ groups[\u0027keystone_all\u0027][0] }}\""},{"line_number":72,"context_line":"  tags:"},{"line_number":73,"context_line":"    - swift-key"},{"line_number":74,"context_line":"    - swift-key-create"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_c55dc516","line":73,"updated":"2015-06-26 14:32:11.000000000","message":"s/swift/keystone/","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"28083cae7c540bdc6942b8b03b348d2ff238d12c","unresolved":false,"context_lines":[{"line_number":71,"context_line":"  delegate_to: \"{{ groups[\u0027keystone_all\u0027][0] }}\""},{"line_number":72,"context_line":"  tags:"},{"line_number":73,"context_line":"    - swift-key"},{"line_number":74,"context_line":"    - swift-key-create"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_e5ad69eb","line":74,"updated":"2015-06-26 14:32:11.000000000","message":"s/swift/keystone/","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"}],"playbooks/roles/os_keystone/tasks/keystone_key_setup.yml":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8ff9a16a333bdc010c9ede560ec75cec50faf981","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"# Copyright 2014, Rackspace US, Inc."},{"line_number":3,"context_line":"#"},{"line_number":4,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\");"},{"line_number":5,"context_line":"# you may not use this file except in compliance with the License."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_db94c88d","line":2,"updated":"2015-06-26 14:56:04.000000000","message":"Why the change from 2015 - 2014?","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"1980b0881f88b72aa0f40a19c1bda60c92dc7a50","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"# Copyright 2014, Rackspace US, Inc."},{"line_number":3,"context_line":"#"},{"line_number":4,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\");"},{"line_number":5,"context_line":"# you may not use this file except in compliance with the License."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_7e77aa9f","line":2,"in_reply_to":"fa32b979_db94c88d","updated":"2015-06-26 15:10:56.000000000","message":"copy and paste error. Done.","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"}],"playbooks/roles/os_keystone/tasks/keystone_key_store.yml":[{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"ea7835dada6bbc7223cebf8b0e4f1ac143b16609","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"# Copyright 2014, Rackspace US, Inc."},{"line_number":3,"context_line":"#"},{"line_number":4,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\");"},{"line_number":5,"context_line":"# you may not use this file except in compliance with the License."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_fef41ad0","line":2,"updated":"2015-06-26 15:15:09.000000000","message":"Should be 2015","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"7696a67a26b3aa7340434d708f20711f3ea855ff","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"# Copyright 2014, Rackspace US, Inc."},{"line_number":3,"context_line":"#"},{"line_number":4,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\");"},{"line_number":5,"context_line":"# you may not use this file except in compliance with the License."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"fa32b979_3eea82ad","line":2,"in_reply_to":"fa32b979_fef41ad0","updated":"2015-06-26 15:31:12.000000000","message":"Done","commit_id":"b9539f0301e3b2af082e8870afe57b7bfd32c4fc"}],"playbooks/roles/os_keystone/tasks/keystone_pre_install.yml":[{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"45d1f1e6fe2c47bf8c8e17f2f90f1789749aa890","unresolved":false,"context_lines":[{"line_number":45,"context_line":"    - { path: \"{{ keystone_ldap_domain_config_dir }}\" }"},{"line_number":46,"context_line":"    - { path: \"/etc/keystone/ssl\" }"},{"line_number":47,"context_line":"    - { path: \"{{ keystone_fernet_tokens_key_repository }}\", mode: \"2750\"}"},{"line_number":48,"context_line":"    - { path: \"/etc/sudoers.d\", mode: \"0750\", owner: \"root\", group: \"root\" }"},{"line_number":49,"context_line":"    - { path: \"{{ keystone_system_user_home }}\" }"},{"line_number":50,"context_line":"    - { path: \"/var/www/cgi-bin\", owner: root, group: root }"},{"line_number":51,"context_line":"    - { path: \"/var/www/cgi-bin/keystone\" }"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"fa32b979_e01b0c7f","line":48,"updated":"2015-06-26 18:42:43.000000000","message":"Unrelated: Should this have mode 2750 too?","commit_id":"dc1f647324cac63e8570695f36c3f6a394571294"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"ab5f5c72650565c3cd4080a98ef3ce96ff824a6e","unresolved":false,"context_lines":[{"line_number":45,"context_line":"    - { path: \"{{ keystone_ldap_domain_config_dir }}\" }"},{"line_number":46,"context_line":"    - { path: \"/etc/keystone/ssl\" }"},{"line_number":47,"context_line":"    - { path: \"{{ keystone_fernet_tokens_key_repository }}\", mode: \"2750\"}"},{"line_number":48,"context_line":"    - { path: \"/etc/sudoers.d\", mode: \"0750\", owner: \"root\", group: \"root\" }"},{"line_number":49,"context_line":"    - { path: \"{{ keystone_system_user_home }}\" }"},{"line_number":50,"context_line":"    - { path: \"/var/www/cgi-bin\", owner: root, group: root }"},{"line_number":51,"context_line":"    - { path: \"/var/www/cgi-bin/keystone\" }"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"fa32b979_7b58118b","line":48,"in_reply_to":"fa32b979_e01b0c7f","updated":"2015-06-26 18:57:52.000000000","message":"default perms on that directory is root,root and 0750. while this should be the case everywhere we\u0027re just making sure. The keystone directory is owned by keystone and we want to enforce that all files made there are group owned by the keystone system user, which is again just a precaution because the keystone-manage fernet.* commands should enforce that for us.","commit_id":"dc1f647324cac63e8570695f36c3f6a394571294"}]}