)]}'
{"cinder/templates/bin/_create-internal-tenant-id.sh.tpl":[{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"7c426f5279d2b426d67b6f7955ce8aff62db771d","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"5fc1f717_ec4d159a","updated":"2019-03-27 14:59:56.000000000","message":"could we handle this in the same way we do for ironic, nova and neutron where we dynamically create config snippets, eg:\n* https://github.com/openstack/openstack-helm/blob/master/ironic/templates/bin/_retreive-cleaning-network.sh.tpl\n* https://github.com/openstack/openstack-helm/blob/master/ironic/templates/bin/_ironic-conductor.sh.tpl#L28","commit_id":"901dd9e3280dd0ec89987840003d255768eb209b"},{"author":{"_account_id":28948,"name":"Liang Fang","email":"liang.a.fang@intel.com","username":"liang"},"change_message_id":"55779b79b948de9ac1b5d31c1f3bba7f20a82304","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"5fc1f717_1bc76298","in_reply_to":"5fc1f717_ec4d159a","updated":"2019-03-28 14:47:03.000000000","message":"make sense, thanks, modified.","commit_id":"901dd9e3280dd0ec89987840003d255768eb209b"},{"author":{"_account_id":29668,"name":"cheng li","email":"cheng1.li@intel.com","username":"chengli3"},"change_message_id":"5ccaf9de97626140abd03e7fd4d5961a56b044cc","unresolved":false,"context_lines":[{"line_number":1,"context_line":"#!/bin/bash"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"{{/*"},{"line_number":4,"context_line":"Copyright 2017 The Openstack-Helm Authors."},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"Licensed under the Apache License, Version 2.0 (the \"License\");"},{"line_number":7,"context_line":"you may not use this file except in compliance with the License."}],"source_content_type":"text/x-smarty","patch_set":4,"id":"5fc1f717_fe7a5fb8","line":4,"range":{"start_line":4,"start_character":10,"end_line":4,"end_character":14},"updated":"2019-03-31 06:26:44.000000000","message":"Would this be 2019 instead?","commit_id":"d62150939d72710e65ee369215fa8476284041a7"},{"author":{"_account_id":28948,"name":"Liang Fang","email":"liang.a.fang@intel.com","username":"liang"},"change_message_id":"385b30ecbfa1fc6238321d7c09af6f85a9a79388","unresolved":false,"context_lines":[{"line_number":1,"context_line":"#!/bin/bash"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"{{/*"},{"line_number":4,"context_line":"Copyright 2017 The Openstack-Helm Authors."},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"Licensed under the Apache License, Version 2.0 (the \"License\");"},{"line_number":7,"context_line":"you may not use this file except in compliance with the License."}],"source_content_type":"text/x-smarty","patch_set":4,"id":"5fc1f717_0f95b388","line":4,"range":{"start_line":4,"start_character":10,"end_line":4,"end_character":14},"in_reply_to":"5fc1f717_fe7a5fb8","updated":"2019-04-01 00:31:11.000000000","message":"Done","commit_id":"d62150939d72710e65ee369215fa8476284041a7"},{"author":{"_account_id":29668,"name":"cheng li","email":"cheng1.li@intel.com","username":"chengli3"},"change_message_id":"5ccaf9de97626140abd03e7fd4d5961a56b044cc","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    --domain\u003d\"${USER_DOMAIN_ID}\" \\"},{"line_number":28,"context_line":"    --project-domain\u003d\"${PROJECT_DOMAIN_ID}\" \\"},{"line_number":29,"context_line":"    --project\u003d\"${USER_PROJECT_ID}\" \\"},{"line_number":30,"context_line":"    --password\u003d\"Dontneeded1*\" \\"},{"line_number":31,"context_line":"    \"${INTERNAL_USER_NAME}\");"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"tee /etc/cinder/conf/internal_tenant.conf \u003c\u003cEOF"}],"source_content_type":"text/x-smarty","patch_set":4,"id":"5fc1f717_1e22cbbb","line":30,"range":{"start_line":30,"start_character":16,"end_line":30,"end_character":28},"updated":"2019-03-31 06:26:44.000000000","message":"This expose the password, anyone can login with this password if he/she knows the cinder internal user name. I think we need a way to create *real* internal user.","commit_id":"d62150939d72710e65ee369215fa8476284041a7"},{"author":{"_account_id":28948,"name":"Liang Fang","email":"liang.a.fang@intel.com","username":"liang"},"change_message_id":"385b30ecbfa1fc6238321d7c09af6f85a9a79388","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    --domain\u003d\"${USER_DOMAIN_ID}\" \\"},{"line_number":28,"context_line":"    --project-domain\u003d\"${PROJECT_DOMAIN_ID}\" \\"},{"line_number":29,"context_line":"    --project\u003d\"${USER_PROJECT_ID}\" \\"},{"line_number":30,"context_line":"    --password\u003d\"Dontneeded1*\" \\"},{"line_number":31,"context_line":"    \"${INTERNAL_USER_NAME}\");"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"tee /etc/cinder/conf/internal_tenant.conf \u003c\u003cEOF"}],"source_content_type":"text/x-smarty","patch_set":4,"id":"5fc1f717_ef8b8765","line":30,"range":{"start_line":30,"start_character":16,"end_line":30,"end_character":28},"in_reply_to":"5fc1f717_1e22cbbb","updated":"2019-04-01 00:31:11.000000000","message":"good catch. Let\u0027s do like devstack, remove the password, so this account just used to hold resource, no authentication feature","commit_id":"d62150939d72710e65ee369215fa8476284041a7"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"295c51643dd8517dc42f29367c43f9e443ac9c8f","unresolved":false,"context_lines":[{"line_number":19,"context_line":"set -ex"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"USER_PROJECT_ID\u003d$(openstack project create --or-show --enable -f value -c id \\"},{"line_number":23,"context_line":"    --domain\u003d\"${PROJECT_DOMAIN_ID}\" \\"},{"line_number":24,"context_line":"    \"${INTERNAL_PROJECT_NAME}\");"},{"line_number":25,"context_line":""}],"source_content_type":"text/x-smarty","patch_set":6,"id":"5fc1f717_0243a140","line":22,"range":{"start_line":22,"start_character":36,"end_line":22,"end_character":52},"updated":"2019-04-09 14:49:23.000000000","message":"rather than create --or-show, i think it would be better to create a job that performs this action, and then we are left with retrieval only occurring here. The rationale here is that some operators are moving towards auditing and locking down user creation in the SQL backend to come from only certain workloads, and we also gain some more intuitive visibility into what the charts are doing via the objects created. This would follow the same pattern used for non-keystone based objects, eg the management of the cleaning network in the ironic chart.","commit_id":"35eee9546d04684f3875ad879fc379ee454bc319"},{"author":{"_account_id":28948,"name":"Liang Fang","email":"liang.a.fang@intel.com","username":"liang"},"change_message_id":"497605e91b7ca588e1547e274e60667f883378c4","unresolved":false,"context_lines":[{"line_number":19,"context_line":"set -ex"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"USER_PROJECT_ID\u003d$(openstack project create --or-show --enable -f value -c id \\"},{"line_number":23,"context_line":"    --domain\u003d\"${PROJECT_DOMAIN_ID}\" \\"},{"line_number":24,"context_line":"    \"${INTERNAL_PROJECT_NAME}\");"},{"line_number":25,"context_line":""}],"source_content_type":"text/x-smarty","patch_set":6,"id":"3fce034c_456dcc96","line":22,"range":{"start_line":22,"start_character":36,"end_line":22,"end_character":52},"in_reply_to":"5fc1f717_0243a140","updated":"2019-04-12 14:43:05.000000000","message":"Thanks, I uploaded patchset 7, not sure if I followed your comment or not.","commit_id":"35eee9546d04684f3875ad879fc379ee454bc319"},{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"e6c84bd594b9740990522af9be1954e2500e19f1","unresolved":false,"context_lines":[{"line_number":29,"context_line":"    --project\u003d\"${USER_PROJECT_ID}\" \\"},{"line_number":30,"context_line":"    \"${INTERNAL_USER_NAME}\");"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"tee /etc/cinder/conf/internal_tenant.conf \u003c\u003cEOF"},{"line_number":33,"context_line":"[DEFAULT]"},{"line_number":34,"context_line":"cinder_internal_tenant_project_id \u003d ${USER_PROJECT_ID}"},{"line_number":35,"context_line":"cinder_internal_tenant_user_id \u003d ${USER_ID}"},{"line_number":36,"context_line":"EOF"}],"source_content_type":"text/x-smarty","patch_set":6,"id":"5fc1f717_35df0667","line":36,"range":{"start_line":32,"start_character":0,"end_line":36,"end_character":3},"updated":"2019-04-09 04:45:41.000000000","message":"do we not want to just mount this configuration file directly instead of doing a tee, iirc, if someone wants to make the container filesystem readonly, would this not fail?","commit_id":"35eee9546d04684f3875ad879fc379ee454bc319"},{"author":{"_account_id":28948,"name":"Liang Fang","email":"liang.a.fang@intel.com","username":"liang"},"change_message_id":"581f0564fa3421382173927a52ac7e219837b2b2","unresolved":false,"context_lines":[{"line_number":29,"context_line":"    --project\u003d\"${USER_PROJECT_ID}\" \\"},{"line_number":30,"context_line":"    \"${INTERNAL_USER_NAME}\");"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"tee /etc/cinder/conf/internal_tenant.conf \u003c\u003cEOF"},{"line_number":33,"context_line":"[DEFAULT]"},{"line_number":34,"context_line":"cinder_internal_tenant_project_id \u003d ${USER_PROJECT_ID}"},{"line_number":35,"context_line":"cinder_internal_tenant_user_id \u003d ${USER_ID}"},{"line_number":36,"context_line":"EOF"}],"source_content_type":"text/x-smarty","patch_set":6,"id":"5fc1f717_f8d6534f","line":36,"range":{"start_line":32,"start_character":0,"end_line":36,"end_character":3},"in_reply_to":"5fc1f717_35df0667","updated":"2019-04-09 06:08:20.000000000","message":"Thanks for your comment. I take a look of the code, using of tee in this way is common in openstack-helm, e.g.\nneutron: https://github.com/openstack/openstack-helm/blob/master/neutron/templates/bin/_neutron-openvswitch-agent-init.sh.tpl\nnova: https://github.com/openstack/openstack-helm/blob/master/nova/templates/bin/_nova-compute-init.sh.tpl\nironic: https://github.com/openstack/openstack-helm/blob/master/ironic/templates/bin/_retreive-cleaning-network.sh.tpl","commit_id":"35eee9546d04684f3875ad879fc379ee454bc319"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"295c51643dd8517dc42f29367c43f9e443ac9c8f","unresolved":false,"context_lines":[{"line_number":29,"context_line":"    --project\u003d\"${USER_PROJECT_ID}\" \\"},{"line_number":30,"context_line":"    \"${INTERNAL_USER_NAME}\");"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"tee /etc/cinder/conf/internal_tenant.conf \u003c\u003cEOF"},{"line_number":33,"context_line":"[DEFAULT]"},{"line_number":34,"context_line":"cinder_internal_tenant_project_id \u003d ${USER_PROJECT_ID}"},{"line_number":35,"context_line":"cinder_internal_tenant_user_id \u003d ${USER_ID}"},{"line_number":36,"context_line":"EOF"}],"source_content_type":"text/x-smarty","patch_set":6,"id":"5fc1f717_025c0117","line":36,"range":{"start_line":32,"start_character":0,"end_line":36,"end_character":3},"in_reply_to":"5fc1f717_f8d6534f","updated":"2019-04-09 14:49:23.000000000","message":"Liang - as you point out this pattern is used in many places in openstack-helm, i think its fully appropriate here.","commit_id":"35eee9546d04684f3875ad879fc379ee454bc319"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"e6fad6a35c6655761856adf175bf9f7ed46bd08d","unresolved":false,"context_lines":[{"line_number":19,"context_line":"set -ex"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"USER_PROJECT_ID\u003d$(openstack project create --enable -f value -c id \\"},{"line_number":23,"context_line":"    --domain\u003d\"${PROJECT_DOMAIN_ID}\" \\"},{"line_number":24,"context_line":"    \"${INTERNAL_PROJECT_NAME}\");"},{"line_number":25,"context_line":""}],"source_content_type":"text/x-smarty","patch_set":7,"id":"3fce034c_4b99251d","line":22,"range":{"start_line":22,"start_character":36,"end_line":22,"end_character":42},"updated":"2019-04-16 15:57:00.000000000","message":"should also have --or-show","commit_id":"c4c00e60778c5b50346dd1c0aa1aa6fe1a426854"},{"author":{"_account_id":28948,"name":"Liang Fang","email":"liang.a.fang@intel.com","username":"liang"},"change_message_id":"5a3dc4a249949cea2a4724c5e91a72a35d19b8ed","unresolved":false,"context_lines":[{"line_number":19,"context_line":"set -ex"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"USER_PROJECT_ID\u003d$(openstack project create --enable -f value -c id \\"},{"line_number":23,"context_line":"    --domain\u003d\"${PROJECT_DOMAIN_ID}\" \\"},{"line_number":24,"context_line":"    \"${INTERNAL_PROJECT_NAME}\");"},{"line_number":25,"context_line":""}],"source_content_type":"text/x-smarty","patch_set":7,"id":"3fce034c_0e824b50","line":22,"range":{"start_line":22,"start_character":36,"end_line":22,"end_character":42},"in_reply_to":"3fce034c_4b99251d","updated":"2019-04-16 16:13:46.000000000","message":"Good catch, thanks!","commit_id":"c4c00e60778c5b50346dd1c0aa1aa6fe1a426854"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"e6fad6a35c6655761856adf175bf9f7ed46bd08d","unresolved":false,"context_lines":[{"line_number":23,"context_line":"    --domain\u003d\"${PROJECT_DOMAIN_ID}\" \\"},{"line_number":24,"context_line":"    \"${INTERNAL_PROJECT_NAME}\");"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"USER_ID\u003d$(openstack user create --enable -f value -c id \\"},{"line_number":27,"context_line":"    --domain\u003d\"${USER_DOMAIN_ID}\" \\"},{"line_number":28,"context_line":"    --project-domain\u003d\"${PROJECT_DOMAIN_ID}\" \\"},{"line_number":29,"context_line":"    --project\u003d\"${USER_PROJECT_ID}\" \\"}],"source_content_type":"text/x-smarty","patch_set":7,"id":"3fce034c_cb8435b4","line":26,"range":{"start_line":26,"start_character":25,"end_line":26,"end_character":31},"updated":"2019-04-16 15:57:00.000000000","message":"should also have --or-show","commit_id":"c4c00e60778c5b50346dd1c0aa1aa6fe1a426854"}],"cinder/templates/deployment-volume.yaml":[{"author":{"_account_id":29668,"name":"cheng li","email":"cheng1.li@intel.com","username":"chengli3"},"change_message_id":"5ccaf9de97626140abd03e7fd4d5961a56b044cc","unresolved":false,"context_lines":[{"line_number":129,"context_line":"              mountPath: /tmp/cinder-volume.sh"},{"line_number":130,"context_line":"              subPath: cinder-volume.sh"},{"line_number":131,"context_line":"              readOnly: true"},{"line_number":132,"context_line":"            - name: etccinder"},{"line_number":133,"context_line":"              mountPath: /etc/cinder/conf"},{"line_number":134,"context_line":"            - name: cinder-etc"},{"line_number":135,"context_line":"              mountPath: /etc/cinder/cinder.conf"},{"line_number":136,"context_line":"              subPath: cinder.conf"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"5fc1f717_5e6a93ed","line":133,"range":{"start_line":132,"start_character":12,"end_line":133,"end_character":41},"updated":"2019-03-31 06:26:44.000000000","message":"Will this hide the original content under \u0027/etc/cinder/conf\u0027 in container? I would suggest to put this generated file under /tmp, as it\u0027s not persistent across pod. The neutron ovs code[1] could be the reference.\n\n[1] https://github.com/openstack/openstack-helm/blob/19a9026d67c1489d83c13eb40b04553ddea50e55/neutron/templates/daemonset-ovs-agent.yaml#L93-L94","commit_id":"d62150939d72710e65ee369215fa8476284041a7"},{"author":{"_account_id":28948,"name":"Liang Fang","email":"liang.a.fang@intel.com","username":"liang"},"change_message_id":"385b30ecbfa1fc6238321d7c09af6f85a9a79388","unresolved":false,"context_lines":[{"line_number":129,"context_line":"              mountPath: /tmp/cinder-volume.sh"},{"line_number":130,"context_line":"              subPath: cinder-volume.sh"},{"line_number":131,"context_line":"              readOnly: true"},{"line_number":132,"context_line":"            - name: etccinder"},{"line_number":133,"context_line":"              mountPath: /etc/cinder/conf"},{"line_number":134,"context_line":"            - name: cinder-etc"},{"line_number":135,"context_line":"              mountPath: /etc/cinder/cinder.conf"},{"line_number":136,"context_line":"              subPath: cinder.conf"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"5fc1f717_afeb3f10","line":133,"range":{"start_line":132,"start_character":12,"end_line":133,"end_character":41},"in_reply_to":"5fc1f717_5e6a93ed","updated":"2019-04-01 00:31:11.000000000","message":"this will not hide files under \u0027/etc/cinder/conf\u0027. there\u0027re some other files such as backends.conf in this folder.","commit_id":"d62150939d72710e65ee369215fa8476284041a7"}]}