)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"change_message_id":"cedb3013455c47bf535a5debde13f8712fa2ab01","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"c219e83f_03dddbc0","updated":"2025-06-09 13:57:22.000000000","message":"@amy@demarco.com hello, if possible, please review article 😊","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"5d781f9be721fd444ded00597349f70ecf89e611","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"855923fe_774937b0","updated":"2025-06-24 15:46:49.000000000","message":"Pass 1","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"},{"author":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"change_message_id":"239e16dcb73556fb21a52710a489789da4e0b866","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"f7be7ca8_4b186b46","updated":"2025-07-28 16:36:11.000000000","message":"@amy@demarco.com hello Amy, please review this MR again in you free time 😊","commit_id":"a7314603962874b6b2b4236e411af30d8b19002f"},{"author":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"change_message_id":"5f27e734b44bd6fb6e348d39e6afe719d894acc2","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"128f0003_7098f0c7","updated":"2025-08-14 15:54:37.000000000","message":"@noonedeadpunk@gmail.com hello, may be you can process merge this MR, please?","commit_id":"4040a622471f326a5958ed4b4805eb58b691b230"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"55319445412b54ddae37b3ed4c7ea6aa4ec81b01","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"e387c6cb_def92d5a","updated":"2025-07-28 17:10:00.000000000","message":"A few minor grammar fixes but content looked good","commit_id":"4040a622471f326a5958ed4b4805eb58b691b230"}],"doc/source/user/security/password-rotation.rst":[{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"5d781f9be721fd444ded00597349f70ecf89e611","unresolved":true,"context_lines":[{"line_number":4,"context_line":".. warning::"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"   The playbooks do not guarantee password rotation with zero downtime in an"},{"line_number":7,"context_line":"   existing environment. A downtime for the service is expected between"},{"line_number":8,"context_line":"   password is reset on backend and services are restarted to apply new value."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"All service passwords are defined and stored as Ansible variables in"}],"source_content_type":"text/x-rst","patch_set":2,"id":"29b4b3f9_9c129541","line":7,"range":{"start_line":7,"start_character":25,"end_line":7,"end_character":28},"updated":"2025-06-24 15:46:49.000000000","message":"```suggestion\n   existing environment. Downtime for the service is expected between\n```","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"e7adaf7f7d1a5a4e11a4eb221af8f4ce013dff90","unresolved":false,"context_lines":[{"line_number":4,"context_line":".. warning::"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"   The playbooks do not guarantee password rotation with zero downtime in an"},{"line_number":7,"context_line":"   existing environment. A downtime for the service is expected between"},{"line_number":8,"context_line":"   password is reset on backend and services are restarted to apply new value."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"All service passwords are defined and stored as Ansible variables in"}],"source_content_type":"text/x-rst","patch_set":2,"id":"2f4f1eab_bf49d36b","line":7,"range":{"start_line":7,"start_character":25,"end_line":7,"end_character":28},"in_reply_to":"29b4b3f9_9c129541","updated":"2025-06-24 18:38:53.000000000","message":"Fix applied.","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"5d781f9be721fd444ded00597349f70ecf89e611","unresolved":true,"context_lines":[{"line_number":9,"context_line":""},{"line_number":10,"context_line":"All service passwords are defined and stored as Ansible variables in"},{"line_number":11,"context_line":"OpenStack-Ansible."},{"line_number":12,"context_line":"With that operator is able to store passwords in an encrypted format using"},{"line_number":13,"context_line":"`Ansible Vault \u003chttp://docs.ansible.com/playbooks_vault.html\u003e`_"},{"line_number":14,"context_line":"or define them as a lookup to `SOPS \u003chttps://getsops.io/\u003e`_ or `OpenBao \u003chttps://openbao.org/\u003e`_"},{"line_number":15,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5655d299_71120ce6","line":12,"range":{"start_line":12,"start_character":0,"end_line":12,"end_character":18},"updated":"2025-06-24 15:46:49.000000000","message":"```suggestion\nThis allows the operator to store passwords in an encrypted format using\n```","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"e7adaf7f7d1a5a4e11a4eb221af8f4ce013dff90","unresolved":false,"context_lines":[{"line_number":9,"context_line":""},{"line_number":10,"context_line":"All service passwords are defined and stored as Ansible variables in"},{"line_number":11,"context_line":"OpenStack-Ansible."},{"line_number":12,"context_line":"With that operator is able to store passwords in an encrypted format using"},{"line_number":13,"context_line":"`Ansible Vault \u003chttp://docs.ansible.com/playbooks_vault.html\u003e`_"},{"line_number":14,"context_line":"or define them as a lookup to `SOPS \u003chttps://getsops.io/\u003e`_ or `OpenBao \u003chttps://openbao.org/\u003e`_"},{"line_number":15,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"09d13aec_9d9cdfec","line":12,"range":{"start_line":12,"start_character":0,"end_line":12,"end_character":18},"in_reply_to":"5655d299_71120ce6","updated":"2025-06-24 18:38:53.000000000","message":"Fix applied.","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"},{"author":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"change_message_id":"26e1ec087213a8016312f8b6db709e3d275800b1","unresolved":true,"context_lines":[{"line_number":10,"context_line":"All service passwords are defined and stored as Ansible variables in"},{"line_number":11,"context_line":"OpenStack-Ansible."},{"line_number":12,"context_line":"With that operator is able to store passwords in an encrypted format using"},{"line_number":13,"context_line":"`Ansible Vault \u003chttp://docs.ansible.com/playbooks_vault.html\u003e`_"},{"line_number":14,"context_line":"or define them as a lookup to `SOPS \u003chttps://getsops.io/\u003e`_ or `OpenBao \u003chttps://openbao.org/\u003e`_"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Typical password change process does include following steps:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"a991aa42_5ab99fb5","line":13,"updated":"2025-06-09 19:14:17.000000000","message":"https://docs.ansible.com/ansible/latest/vault_guide/index.html","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"},{"author":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"change_message_id":"a8f72df507be3897305d8bea5fc06d62b52ae49e","unresolved":false,"context_lines":[{"line_number":10,"context_line":"All service passwords are defined and stored as Ansible variables in"},{"line_number":11,"context_line":"OpenStack-Ansible."},{"line_number":12,"context_line":"With that operator is able to store passwords in an encrypted format using"},{"line_number":13,"context_line":"`Ansible Vault \u003chttp://docs.ansible.com/playbooks_vault.html\u003e`_"},{"line_number":14,"context_line":"or define them as a lookup to `SOPS \u003chttps://getsops.io/\u003e`_ or `OpenBao \u003chttps://openbao.org/\u003e`_"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Typical password change process does include following steps:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5555a868_be389dc3","line":13,"in_reply_to":"a991aa42_5ab99fb5","updated":"2025-06-24 18:48:53.000000000","message":"Done","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"5d781f9be721fd444ded00597349f70ecf89e611","unresolved":true,"context_lines":[{"line_number":13,"context_line":"`Ansible Vault \u003chttp://docs.ansible.com/playbooks_vault.html\u003e`_"},{"line_number":14,"context_line":"or define them as a lookup to `SOPS \u003chttps://getsops.io/\u003e`_ or `OpenBao \u003chttps://openbao.org/\u003e`_"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Typical password change process does include following steps:"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"#. Define a new password in Ansible variables (or where defined lookup is pointing to)."},{"line_number":19,"context_line":"#. Change password on an infrastructure backend (i.e. MariaDB, RabbitMQ, etc.)."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5aaad13e_8b40dd9f","line":16,"range":{"start_line":16,"start_character":24,"end_line":16,"end_character":38},"updated":"2025-06-24 15:46:49.000000000","message":"```suggestion\nTypical password change processes include the following steps:\n```","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"e7adaf7f7d1a5a4e11a4eb221af8f4ce013dff90","unresolved":false,"context_lines":[{"line_number":13,"context_line":"`Ansible Vault \u003chttp://docs.ansible.com/playbooks_vault.html\u003e`_"},{"line_number":14,"context_line":"or define them as a lookup to `SOPS \u003chttps://getsops.io/\u003e`_ or `OpenBao \u003chttps://openbao.org/\u003e`_"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Typical password change process does include following steps:"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"#. Define a new password in Ansible variables (or where defined lookup is pointing to)."},{"line_number":19,"context_line":"#. Change password on an infrastructure backend (i.e. MariaDB, RabbitMQ, etc.)."}],"source_content_type":"text/x-rst","patch_set":2,"id":"9ca87ccf_7f498311","line":16,"range":{"start_line":16,"start_character":24,"end_line":16,"end_character":38},"in_reply_to":"5aaad13e_8b40dd9f","updated":"2025-06-24 18:38:53.000000000","message":"Fix applied.","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"5d781f9be721fd444ded00597349f70ecf89e611","unresolved":true,"context_lines":[{"line_number":21,"context_line":"#. Restart the service to apply new configuration."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Due to the variety of methods which can be used for storing and defining"},{"line_number":24,"context_line":"Ansible variables, we will leave a process of changing password definition out"},{"line_number":25,"context_line":"of scope of this article, and will focus solely on the process of applying"},{"line_number":26,"context_line":"new passwords to the environment."},{"line_number":27,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"926e7bcd_b70f9095","line":24,"range":{"start_line":24,"start_character":33,"end_line":24,"end_character":42},"updated":"2025-06-24 15:46:49.000000000","message":"```suggestion\nAnsible variables, we will leave the process of changing password definition out\n```","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"e7adaf7f7d1a5a4e11a4eb221af8f4ce013dff90","unresolved":false,"context_lines":[{"line_number":21,"context_line":"#. Restart the service to apply new configuration."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Due to the variety of methods which can be used for storing and defining"},{"line_number":24,"context_line":"Ansible variables, we will leave a process of changing password definition out"},{"line_number":25,"context_line":"of scope of this article, and will focus solely on the process of applying"},{"line_number":26,"context_line":"new passwords to the environment."},{"line_number":27,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"a127be6b_04087688","line":24,"range":{"start_line":24,"start_character":33,"end_line":24,"end_character":42},"in_reply_to":"926e7bcd_b70f9095","updated":"2025-06-24 18:38:53.000000000","message":"Fix applied.","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"5d781f9be721fd444ded00597349f70ecf89e611","unresolved":true,"context_lines":[{"line_number":35,"context_line":"* MariaDB"},{"line_number":36,"context_line":"* RabbitMQ"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"As a service downtime is expected once password is changed for any of these"},{"line_number":39,"context_line":"backends until the service is restarted, it is important to ensure that playbook"},{"line_number":40,"context_line":"will execute as fast as possible. For that, we will use a set of specific tags"},{"line_number":41,"context_line":"and variables for each \"backend\" individually."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"For examples below, we will take Nova as a sample service, as Nova may struggle"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bb57e2d9_1de95709","line":40,"range":{"start_line":38,"start_character":0,"end_line":40,"end_character":33},"updated":"2025-06-24 15:46:49.000000000","message":"This is unclear","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"74262cfb272dcf6816e69c839e3433cd50376bd9","unresolved":false,"context_lines":[{"line_number":35,"context_line":"* MariaDB"},{"line_number":36,"context_line":"* RabbitMQ"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"As a service downtime is expected once password is changed for any of these"},{"line_number":39,"context_line":"backends until the service is restarted, it is important to ensure that playbook"},{"line_number":40,"context_line":"will execute as fast as possible. For that, we will use a set of specific tags"},{"line_number":41,"context_line":"and variables for each \"backend\" individually."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"For examples below, we will take Nova as a sample service, as Nova may struggle"}],"source_content_type":"text/x-rst","patch_set":2,"id":"df61f73d_1c79b862","line":40,"range":{"start_line":38,"start_character":0,"end_line":40,"end_character":33},"in_reply_to":"bb57e2d9_1de95709","updated":"2025-07-04 11:01:03.000000000","message":"Done","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"5d781f9be721fd444ded00597349f70ecf89e611","unresolved":true,"context_lines":[{"line_number":40,"context_line":"will execute as fast as possible. For that, we will use a set of specific tags"},{"line_number":41,"context_line":"and variables for each \"backend\" individually."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"For examples below, we will take Nova as a sample service, as Nova may struggle"},{"line_number":44,"context_line":"from playbook runtime most due to amount of hosts which needs to be updated."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"As a common technique, we will disable ``serial`` execution, which is enabled by"}],"source_content_type":"text/x-rst","patch_set":2,"id":"68e0807d_4c3b3b95","line":43,"range":{"start_line":43,"start_character":0,"end_line":43,"end_character":18},"updated":"2025-06-24 15:46:49.000000000","message":"```suggestion\nFor the following examples, we will take Nova as a sample service, as Nova may struggle\n```","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"e7adaf7f7d1a5a4e11a4eb221af8f4ce013dff90","unresolved":false,"context_lines":[{"line_number":40,"context_line":"will execute as fast as possible. For that, we will use a set of specific tags"},{"line_number":41,"context_line":"and variables for each \"backend\" individually."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"For examples below, we will take Nova as a sample service, as Nova may struggle"},{"line_number":44,"context_line":"from playbook runtime most due to amount of hosts which needs to be updated."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"As a common technique, we will disable ``serial`` execution, which is enabled by"}],"source_content_type":"text/x-rst","patch_set":2,"id":"59ffbc8e_8bf6bfbb","line":43,"range":{"start_line":43,"start_character":0,"end_line":43,"end_character":18},"in_reply_to":"68e0807d_4c3b3b95","updated":"2025-06-24 18:38:53.000000000","message":"Fix applied.","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"},{"author":{"_account_id":15993,"name":"Amy Marrich","display_name":"Amy Marrich (spotz)","email":"amy@demarco.com","username":"amarrich"},"change_message_id":"5d781f9be721fd444ded00597349f70ecf89e611","unresolved":true,"context_lines":[{"line_number":56,"context_line":"Changing Keystone password for the service"},{"line_number":57,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"In order to trigger password update in the Keystone for the service, we"},{"line_number":60,"context_line":"need to supply ``service_update_password`` variable."},{"line_number":61,"context_line":"To execute the rotation of the Keystone password for a service like Nova,"},{"line_number":62,"context_line":"you will need to execute playbook like this:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"a6aaf597_2878e748","line":59,"range":{"start_line":59,"start_character":12,"end_line":59,"end_character":28},"updated":"2025-06-24 15:46:49.000000000","message":"```suggestion\nIn order to trigger a password update in Keystone for the service, we\n```","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"},{"author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"change_message_id":"e7adaf7f7d1a5a4e11a4eb221af8f4ce013dff90","unresolved":false,"context_lines":[{"line_number":56,"context_line":"Changing Keystone password for the service"},{"line_number":57,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"In order to trigger password update in the Keystone for the service, we"},{"line_number":60,"context_line":"need to supply ``service_update_password`` variable."},{"line_number":61,"context_line":"To execute the rotation of the Keystone password for a service like Nova,"},{"line_number":62,"context_line":"you will need to execute playbook like this:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"b4dbc702_96bab4ab","line":59,"range":{"start_line":59,"start_character":12,"end_line":59,"end_character":28},"in_reply_to":"a6aaf597_2878e748","updated":"2025-06-24 18:38:53.000000000","message":"Fix applied.","commit_id":"5f8c7a052d85089282fd536b0cd89ef9d236442f"}]}