)]}'
{"keystone/templates/bin/_cred-clean.py.tpl":[{"author":{"_account_id":28025,"name":"Randeep Jalli","email":"rj2083@att.com","username":"randeep.jalli"},"change_message_id":"61a5e51982f630fea62ffe87f4a7108481f22632","unresolved":false,"context_lines":[{"line_number":111,"context_line":"# Delete all entries from credential table"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"try:"},{"line_number":114,"context_line":"    cmd \u003d \"DELETE FROM credential\""},{"line_number":115,"context_line":"    user_engine.execute(cmd)"},{"line_number":116,"context_line":"    logger.info(\u0027Deleted all entries in credential table\u0027)"},{"line_number":117,"context_line":"except:"}],"source_content_type":"text/x-smarty","patch_set":13,"id":"9fdfeff1_5c8261ca","line":114,"updated":"2019-02-07 15:33:12.000000000","message":"you probably want to limit this with like a where or something, like where username\u003dblah right? or are you doing that somewhere above?","commit_id":"170b1b1db3c0fc8d3da7ad47e7d8a951c7e66711"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"1270cdc1df130dc11d6c0aff9d874878abaea858","unresolved":false,"context_lines":[{"line_number":111,"context_line":"# Delete all entries from credential table"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"try:"},{"line_number":114,"context_line":"    cmd \u003d \"DELETE FROM credential\""},{"line_number":115,"context_line":"    user_engine.execute(cmd)"},{"line_number":116,"context_line":"    logger.info(\u0027Deleted all entries in credential table\u0027)"},{"line_number":117,"context_line":"except:"}],"source_content_type":"text/x-smarty","patch_set":13,"id":"9fdfeff1_6dcade6e","line":114,"in_reply_to":"9fdfeff1_5c8261ca","updated":"2019-02-11 20:25:27.000000000","message":"Once all of the credential keys are deleted, the encrypted blobs are unrecoverable regardless of the user.","commit_id":"170b1b1db3c0fc8d3da7ad47e7d8a951c7e66711"},{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"5521f09fd5411226ccc396b23ce6030bf304af01","unresolved":false,"context_lines":[{"line_number":111,"context_line":"# Delete all entries from credential table"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"try:"},{"line_number":114,"context_line":"    cmd \u003d \"DELETE FROM credential\""},{"line_number":115,"context_line":"    user_engine.execute(cmd)"},{"line_number":116,"context_line":"    logger.info(\u0027Deleted all entries in credential table\u0027)"},{"line_number":117,"context_line":"except:"}],"source_content_type":"text/x-smarty","patch_set":14,"id":"9fdfeff1_17e4d33b","line":114,"range":{"start_line":114,"start_character":11,"end_line":114,"end_character":34},"updated":"2019-02-20 04:51:18.000000000","message":"If in my keystone bootstrap script I have a line:\n\n   openstack ec2 credentials create --project P --user U ...\n\nand the deployment goes through a helm test and would this undo the bootstrap? Similarly, if a user runs an upgrade after credentials are added post the first helm test, would running the helm test a second time cause the entire table to be cleansed.","commit_id":"cedc1db76a285a6677d96523c03e3cdbb7f34612"}],"keystone/templates/job-credential-cleanup.yaml":[{"author":{"_account_id":26365,"name":"Bryan Strassner","email":"strassner.bryan@gmail.com","username":"bryan-strassner"},"change_message_id":"deb56ad356478f66de5ea4962b25b2943a5906f5","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{{/*"},{"line_number":2,"context_line":"Copyright 2017 The Openstack-Helm Authors."},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"Licensed under the Apache License, Version 2.0 (the \"License\");"},{"line_number":5,"context_line":"you may not use this file except in compliance with the License."}],"source_content_type":"text/x-yaml","patch_set":10,"id":"9fdfeff1_70a12a46","line":2,"range":{"start_line":2,"start_character":13,"end_line":2,"end_character":14},"updated":"2019-01-29 14:13:07.000000000","message":"2019?","commit_id":"73c4f43ad8b624c0ef455870e90b81c91739eaac"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"0f11461193b6c1d0bb93a94e5cc67eb54ccd258b","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{{/*"},{"line_number":2,"context_line":"Copyright 2017 The Openstack-Helm Authors."},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"Licensed under the Apache License, Version 2.0 (the \"License\");"},{"line_number":5,"context_line":"you may not use this file except in compliance with the License."}],"source_content_type":"text/x-yaml","patch_set":10,"id":"9fdfeff1_93c4d3f6","line":2,"range":{"start_line":2,"start_character":13,"end_line":2,"end_character":14},"in_reply_to":"9fdfeff1_70a12a46","updated":"2019-01-29 19:26:20.000000000","message":"Done","commit_id":"73c4f43ad8b624c0ef455870e90b81c91739eaac"},{"author":{"_account_id":26365,"name":"Bryan Strassner","email":"strassner.bryan@gmail.com","username":"bryan-strassner"},"change_message_id":"deb56ad356478f66de5ea4962b25b2943a5906f5","unresolved":false,"context_lines":[{"line_number":31,"context_line":"metadata:"},{"line_number":32,"context_line":"  name: \"keystone-credential-cleanup\""},{"line_number":33,"context_line":"  annotations:"},{"line_number":34,"context_line":"    \"helm.sh/hook\": pre-delete"},{"line_number":35,"context_line":"    \"helm.sh/hook-delete-policy\": hook-succeed"},{"line_number":36,"context_line":"spec:"},{"line_number":37,"context_line":"  template:"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"9fdfeff1_108a1ebe","line":34,"range":{"start_line":34,"start_character":0,"end_line":34,"end_character":30},"updated":"2019-01-29 14:13:07.000000000","message":"How will this job interact with a delete/purge as initiated by e.g. Armada in the case of a failed install?  While this is not ever the intended flow (to purge the release and try again), would this then result in all credentials still being wiped, even those added manually (and not via chart overrides)?","commit_id":"73c4f43ad8b624c0ef455870e90b81c91739eaac"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"0b8eafa322fe6b4d95d2bd09e188fbbbaf15bd4d","unresolved":false,"context_lines":[{"line_number":31,"context_line":"metadata:"},{"line_number":32,"context_line":"  name: \"keystone-credential-cleanup\""},{"line_number":33,"context_line":"  annotations:"},{"line_number":34,"context_line":"    \"helm.sh/hook\": pre-delete"},{"line_number":35,"context_line":"    \"helm.sh/hook-delete-policy\": hook-succeed"},{"line_number":36,"context_line":"spec:"},{"line_number":37,"context_line":"  template:"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"9fdfeff1_33fde76d","line":34,"range":{"start_line":34,"start_character":0,"end_line":34,"end_character":30},"in_reply_to":"9fdfeff1_108a1ebe","updated":"2019-01-29 19:15:58.000000000","message":"I\u0027m not 100% familiar with the workflow of Armada or if it handles the credential keys, but when you purge keystone, the credential keys are also purged, which makes the credentials stored in the DB unable to be decrypted.\n\nSo yes, if the release is purged to try again, any credentials in the database will be wiped. Note that this hook can be disabled in value.yaml by setting manifests.job_credential_cleanup to False, so any different use-case could take advantage of that.","commit_id":"73c4f43ad8b624c0ef455870e90b81c91739eaac"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"f2819e978b06aad7c81400f4c1ef7ab3b8e21ef5","unresolved":false,"context_lines":[{"line_number":65,"context_line":"            - name: OPENSTACK_CONFIG_DB_KEY"},{"line_number":66,"context_line":"              value: {{ $dbToClean.configDbKey | quote }}"},{"line_number":67,"context_line":"{{- end }}"},{"line_number":68,"context_line":"{{- if eq $dbToCleanType \"secret\" }}"},{"line_number":69,"context_line":"            - name: DB_CONNECTION"},{"line_number":70,"context_line":"              valueFrom:"},{"line_number":71,"context_line":"                secretKeyRef:"},{"line_number":72,"context_line":"                  name: {{ $dbToClean.userSecret | quote }}"},{"line_number":73,"context_line":"                  key: DB_CONNECTION"},{"line_number":74,"context_line":"{{- end }}"},{"line_number":75,"context_line":"          command:"},{"line_number":76,"context_line":"            - python"},{"line_number":77,"context_line":"            - /tmp/cred-clean.py"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"9fdfeff1_75c0e051","line":74,"range":{"start_line":68,"start_character":0,"end_line":74,"end_character":10},"updated":"2019-01-18 19:26:19.000000000","message":"when would we ever not use the keystone config file for this?","commit_id":"73c4f43ad8b624c0ef455870e90b81c91739eaac"},{"author":{"_account_id":28025,"name":"Randeep Jalli","email":"rj2083@att.com","username":"randeep.jalli"},"change_message_id":"61a5e51982f630fea62ffe87f4a7108481f22632","unresolved":false,"context_lines":[{"line_number":31,"context_line":"metadata:"},{"line_number":32,"context_line":"  name: \"keystone-credential-cleanup\""},{"line_number":33,"context_line":"  annotations:"},{"line_number":34,"context_line":"    \"helm.sh/hook\": pre-delete"},{"line_number":35,"context_line":"    \"helm.sh/hook-delete-policy\": hook-succeed"},{"line_number":36,"context_line":"spec:"},{"line_number":37,"context_line":"  template:"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"9fdfeff1_1cda99e8","line":34,"updated":"2019-02-07 15:33:12.000000000","message":"do you also wanna have this run on like pre-upgrade for if you wanna do a password roll? Or the username changes? \n\nAlso maybe pre-install, just in case the user is left over in the DB after a failed install?","commit_id":"170b1b1db3c0fc8d3da7ad47e7d8a951c7e66711"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"1270cdc1df130dc11d6c0aff9d874878abaea858","unresolved":false,"context_lines":[{"line_number":31,"context_line":"metadata:"},{"line_number":32,"context_line":"  name: \"keystone-credential-cleanup\""},{"line_number":33,"context_line":"  annotations:"},{"line_number":34,"context_line":"    \"helm.sh/hook\": pre-delete"},{"line_number":35,"context_line":"    \"helm.sh/hook-delete-policy\": hook-succeed"},{"line_number":36,"context_line":"spec:"},{"line_number":37,"context_line":"  template:"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"9fdfeff1_adb8c6e4","line":34,"in_reply_to":"9fdfeff1_1cda99e8","updated":"2019-02-11 20:25:27.000000000","message":"This is not username/password credentials (an unfortunate naming scheme here). It\u0027s for additional blob encryption[0]\n\n[0] https://specs.openstack.org/openstack/keystone-specs/specs/keystone/newton/credential-encryption.html","commit_id":"170b1b1db3c0fc8d3da7ad47e7d8a951c7e66711"}]}