)]}'
{"playbooks/roles/os_keystone/tasks/keystone_ldap_setup.yml":[{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"0ff5ca2de6a75cc3c44a530b77c722b637bccaa8","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    - keystone-ldap-domain-create"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"- name: Create Keystone LDAP domain configs"},{"line_number":30,"context_line":"  template:"},{"line_number":31,"context_line":"    src: keystone.domain.conf.j2"},{"line_number":32,"context_line":"    dest: \"{{ keystone_ldap_domain_config_dir }}/keystone.{{ item.key }}.conf\""},{"line_number":33,"context_line":"    owner: \"{{ keystone_system_user_name }}\""}],"source_content_type":"text/x-yaml","patch_set":15,"id":"9a68dd71_627de9e6","line":30,"updated":"2016-01-26 14:36:47.000000000","message":"Why is this not using the config_template instead of the base template module. It would be beneficial to be able to poke options in to a domain configuration file as needed without having to template every possible option, even if the current available options are limited.","commit_id":"54808a7802cfa1f30f036d78840fe1cfceca0e95"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"5342d083ea692dcb9b5da959565d3f37a3d2a433","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    - keystone-ldap-domain-create"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"- name: Create Keystone LDAP domain configs"},{"line_number":30,"context_line":"  template:"},{"line_number":31,"context_line":"    src: keystone.domain.conf.j2"},{"line_number":32,"context_line":"    dest: \"{{ keystone_ldap_domain_config_dir }}/keystone.{{ item.key }}.conf\""},{"line_number":33,"context_line":"    owner: \"{{ keystone_system_user_name }}\""}],"source_content_type":"text/x-yaml","patch_set":15,"id":"9a68dd71_27cffbb4","line":30,"in_reply_to":"9a68dd71_4c2a5480","updated":"2016-01-26 16:01:59.000000000","message":"while there are no other options currently upstream the likelihood that there will be in the future is quite high, and we know other options already exist in the wild that are not specifically upstream. So this is more of a future proofing effort.","commit_id":"54808a7802cfa1f30f036d78840fe1cfceca0e95"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"ae0a22738372587cd85fd127ec0b5da7e9319956","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    - keystone-ldap-domain-create"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"- name: Create Keystone LDAP domain configs"},{"line_number":30,"context_line":"  template:"},{"line_number":31,"context_line":"    src: keystone.domain.conf.j2"},{"line_number":32,"context_line":"    dest: \"{{ keystone_ldap_domain_config_dir }}/keystone.{{ item.key }}.conf\""},{"line_number":33,"context_line":"    owner: \"{{ keystone_system_user_name }}\""}],"source_content_type":"text/x-yaml","patch_set":15,"id":"9a68dd71_b8530e6c","line":30,"in_reply_to":"9a68dd71_627de9e6","updated":"2016-01-26 15:06:06.000000000","message":"All options implemented are in a key-value pair, so all the options are already available.\n\nThere wouldn\u0027t be a way to know what to name the override on a per domain basis because the domain name used is up to the user.\n\nI guess the config_template could be used, but then I\u0027d have to figure out how to implement some sort of user driven name for config override dicts.","commit_id":"54808a7802cfa1f30f036d78840fe1cfceca0e95"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"f2f5503f1bf0c3c8a5c949892015bf833798b1f5","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    - keystone-ldap-domain-create"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"- name: Create Keystone LDAP domain configs"},{"line_number":30,"context_line":"  template:"},{"line_number":31,"context_line":"    src: keystone.domain.conf.j2"},{"line_number":32,"context_line":"    dest: \"{{ keystone_ldap_domain_config_dir }}/keystone.{{ item.key }}.conf\""},{"line_number":33,"context_line":"    owner: \"{{ keystone_system_user_name }}\""}],"source_content_type":"text/x-yaml","patch_set":15,"id":"9a68dd71_bb39c8da","line":30,"in_reply_to":"9a68dd71_b8530e6c","updated":"2016-01-26 15:12:07.000000000","message":"Not all options are implemented in the K/V pair, the option to specify the driver is not present and is/should be user configurable.\n\nWe could change the `keystone_ldap` dict such that it includes more data similar to how we have the neutron plugins data structure.","commit_id":"54808a7802cfa1f30f036d78840fe1cfceca0e95"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"a5734d412dd4cd40bcfccafb394cae3cdd1ebd48","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    - keystone-ldap-domain-create"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"- name: Create Keystone LDAP domain configs"},{"line_number":30,"context_line":"  template:"},{"line_number":31,"context_line":"    src: keystone.domain.conf.j2"},{"line_number":32,"context_line":"    dest: \"{{ keystone_ldap_domain_config_dir }}/keystone.{{ item.key }}.conf\""},{"line_number":33,"context_line":"    owner: \"{{ keystone_system_user_name }}\""}],"source_content_type":"text/x-yaml","patch_set":15,"id":"9a68dd71_4c2a5480","line":30,"in_reply_to":"9a68dd71_bb39c8da","updated":"2016-01-26 15:50:13.000000000","message":"Yes, this could be done but it is over-engineering in my opinion. Keystone only supports the LDAP driver in DSBE files. No other backends are supported at all. Why should we cater for more options when there are none upstream?","commit_id":"54808a7802cfa1f30f036d78840fe1cfceca0e95"}],"playbooks/roles/os_keystone/templates/keystone.conf.j2":[{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"fae8343da6244e0e4f6aa6a035eaae09f902f1fd","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"[identity]"},{"line_number":68,"context_line":"driver \u003d {{ keystone_identity_driver }}"},{"line_number":69,"context_line":"{% if keystone_domains is defined %}"},{"line_number":70,"context_line":"domain_config_dir \u003d {{ keystone_domain_config_dir }}"},{"line_number":71,"context_line":"domain_specific_drivers_enabled \u003d True"}],"source_content_type":"text/x-jinja2","patch_set":1,"id":"5a710552_eea2fb4a","line":68,"updated":"2015-12-15 17:15:46.000000000","message":"I think this driver entry should added to an else block. If the driver default, sql, is defined here and also defined in a different domain specific config it\u0027ll cause keystone to stacktrace because the driver is being specified more than once. globally and scoped to a specific domain.","commit_id":"f45997a7aba00d5ce700a1a1185985a906ab0e36"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"26b32e088abe1f0d6b746072f216d19b995cceab","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"[identity]"},{"line_number":68,"context_line":"driver \u003d {{ keystone_identity_driver }}"},{"line_number":69,"context_line":"{% if keystone_domains is defined %}"},{"line_number":70,"context_line":"domain_config_dir \u003d {{ keystone_domain_config_dir }}"},{"line_number":71,"context_line":"domain_specific_drivers_enabled \u003d True"}],"source_content_type":"text/x-jinja2","patch_set":1,"id":"5a710552_d99fcb01","line":68,"in_reply_to":"5a710552_eea2fb4a","updated":"2015-12-15 17:47:37.000000000","message":"Agreed, I think it may be best to always use domain_specific_drivers and configure the default domain to use sql, but allow the config_override to change that if need be.\n\nThis will involved quite a bit more of a change though. I\u0027ll have to update other places which make assumptions around this config.","commit_id":"f45997a7aba00d5ce700a1a1185985a906ab0e36"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"0ff5ca2de6a75cc3c44a530b77c722b637bccaa8","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"[identity]"},{"line_number":67,"context_line":"{% if keystone_ldap.Default is not defined %}"},{"line_number":68,"context_line":"driver \u003d sql"},{"line_number":69,"context_line":"{% endif %}"},{"line_number":70,"context_line":"{% if keystone_ldap | length \u003e 0 %}"},{"line_number":71,"context_line":"domain_config_dir \u003d {{ keystone_ldap_domain_config_dir }}"}],"source_content_type":"text/x-jinja2","patch_set":15,"id":"9a68dd71_62a5e9b3","line":68,"updated":"2016-01-26 14:36:47.000000000","message":"I think this should remain {{ keystone_identity_driver }} while sql and ldap are used as a rule other identity drivers are available and having the option to configure it via variable should remain.","commit_id":"54808a7802cfa1f30f036d78840fe1cfceca0e95"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"ae0a22738372587cd85fd127ec0b5da7e9319956","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"[identity]"},{"line_number":67,"context_line":"{% if keystone_ldap.Default is not defined %}"},{"line_number":68,"context_line":"driver \u003d sql"},{"line_number":69,"context_line":"{% endif %}"},{"line_number":70,"context_line":"{% if keystone_ldap | length \u003e 0 %}"},{"line_number":71,"context_line":"domain_config_dir \u003d {{ keystone_ldap_domain_config_dir }}"}],"source_content_type":"text/x-jinja2","patch_set":15,"id":"9a68dd71_b8da2ee8","line":68,"in_reply_to":"9a68dd71_62a5e9b3","updated":"2016-01-26 15:06:06.000000000","message":"It can be changed to anything a users wants using config overrides. There\u0027s no need to maintain a variable for this purpose.","commit_id":"54808a7802cfa1f30f036d78840fe1cfceca0e95"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"f2f5503f1bf0c3c8a5c949892015bf833798b1f5","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"[identity]"},{"line_number":67,"context_line":"{% if keystone_ldap.Default is not defined %}"},{"line_number":68,"context_line":"driver \u003d sql"},{"line_number":69,"context_line":"{% endif %}"},{"line_number":70,"context_line":"{% if keystone_ldap | length \u003e 0 %}"},{"line_number":71,"context_line":"domain_config_dir \u003d {{ keystone_ldap_domain_config_dir }}"}],"source_content_type":"text/x-jinja2","patch_set":15,"id":"9a68dd71_9b8c0481","line":68,"in_reply_to":"9a68dd71_b8da2ee8","updated":"2016-01-26 15:12:07.000000000","message":"fair enough.","commit_id":"54808a7802cfa1f30f036d78840fe1cfceca0e95"}],"playbooks/roles/os_keystone/templates/keystone.domain.conf.j2":[{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"0ff5ca2de6a75cc3c44a530b77c722b637bccaa8","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# {{ ansible_managed }}"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"[identity]"},{"line_number":4,"context_line":"driver \u003d ldap"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"[ldap]"},{"line_number":7,"context_line":"{% for key, value in item.value | dictsort %}"}],"source_content_type":"text/x-jinja2","patch_set":15,"id":"9a68dd71_82c33d38","line":4,"updated":"2016-01-26 14:36:47.000000000","message":"Would it be possible for us to have this as a user-defined driver? Reason being is that a deployer could have multiple drivers for various domains as the deployment evolves over time.","commit_id":"54808a7802cfa1f30f036d78840fe1cfceca0e95"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"a5734d412dd4cd40bcfccafb394cae3cdd1ebd48","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# {{ ansible_managed }}"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"[identity]"},{"line_number":4,"context_line":"driver \u003d ldap"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"[ldap]"},{"line_number":7,"context_line":"{% for key, value in item.value | dictsort %}"}],"source_content_type":"text/x-jinja2","patch_set":15,"id":"9a68dd71_ac719079","line":4,"in_reply_to":"9a68dd71_3bd2b835","updated":"2016-01-26 15:50:13.000000000","message":"The Keystone cores have explicitly stated that they only support LDAP configuration in the DSBE files and that only one SQL back-end is supported.\n\nI\u0027d be happy to implement the use of the config_template to allow overrides in order to cater for custom drivers.","commit_id":"54808a7802cfa1f30f036d78840fe1cfceca0e95"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"ae0a22738372587cd85fd127ec0b5da7e9319956","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# {{ ansible_managed }}"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"[identity]"},{"line_number":4,"context_line":"driver \u003d ldap"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"[ldap]"},{"line_number":7,"context_line":"{% for key, value in item.value | dictsort %}"}],"source_content_type":"text/x-jinja2","patch_set":15,"id":"9a68dd71_f83986f3","line":4,"in_reply_to":"9a68dd71_82c33d38","updated":"2016-01-26 15:06:06.000000000","message":"Keystone only supports two drivers at this time - SQL, which there can be only one back-end for, and LDAP. The DSBE implementation is only currently designed for LDAP beck-ends.\n\nThis information was sourced from and confirmed with the Keystone core team.","commit_id":"54808a7802cfa1f30f036d78840fe1cfceca0e95"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"5342d083ea692dcb9b5da959565d3f37a3d2a433","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# {{ ansible_managed }}"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"[identity]"},{"line_number":4,"context_line":"driver \u003d ldap"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"[ldap]"},{"line_number":7,"context_line":"{% for key, value in item.value | dictsort %}"}],"source_content_type":"text/x-jinja2","patch_set":15,"id":"9a68dd71_27361bb5","line":4,"in_reply_to":"9a68dd71_ac719079","updated":"2016-01-26 16:01:59.000000000","message":"+1","commit_id":"54808a7802cfa1f30f036d78840fe1cfceca0e95"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"f2f5503f1bf0c3c8a5c949892015bf833798b1f5","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# {{ ansible_managed }}"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"[identity]"},{"line_number":4,"context_line":"driver \u003d ldap"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"[ldap]"},{"line_number":7,"context_line":"{% for key, value in item.value | dictsort %}"}],"source_content_type":"text/x-jinja2","patch_set":15,"id":"9a68dd71_3bd2b835","line":4,"in_reply_to":"9a68dd71_f83986f3","updated":"2016-01-26 15:12:07.000000000","message":"However should the deployment have multiple domains it may be desirable to have additional domains use sql or ldap optionally. Additionally there are third party providers build around keystone that may need/want to make use of their own proprietary code while using this configuration option. If this file supported the config_template instead of the base template module we could simply instruct these advanced users to override the options instead of dealing additional variables.","commit_id":"54808a7802cfa1f30f036d78840fe1cfceca0e95"}]}