)]}'
{"doc/admin-guide-cloud/source/keystone_fernet_token_faq.rst":[{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"60f3667d84e99d5fa161c4964af460078bf004e7","unresolved":false,"context_lines":[{"line_number":9,"context_line":"      distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT"},{"line_number":10,"context_line":"      WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the"},{"line_number":11,"context_line":"      License for the specific language governing permissions and limitations"},{"line_number":12,"context_line":"      under the License."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":15,"context_line":"Fernet - Frequently Asked Questions"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_09d30f61","line":12,"updated":"2015-11-12 15:24:45.000000000","message":"No need to add licence headers for our documentation, please remove.","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47539d161bf8e90541043c7500fd3042c142a75f","unresolved":false,"context_lines":[{"line_number":9,"context_line":"      distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT"},{"line_number":10,"context_line":"      WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the"},{"line_number":11,"context_line":"      License for the specific language governing permissions and limitations"},{"line_number":12,"context_line":"      under the License."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":15,"context_line":"Fernet - Frequently Asked Questions"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_58ec7fba","line":12,"in_reply_to":"da85f559_09d30f61","updated":"2015-11-12 16:58:06.000000000","message":"Done","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"dfe88c0fb63a84e41b0d96610e151a553dcc6049","unresolved":false,"context_lines":[{"line_number":30,"context_line":"* Primary Key: There is only ever one primary key in a key repository. The"},{"line_number":31,"context_line":"  primary key is allowed to create and validate tokens. This key is always"},{"line_number":32,"context_line":"  named as ``1`` in the key repository."},{"line_number":33,"context_line":"* Secondary Key: The secondary key was at one point a primary key, but has"},{"line_number":34,"context_line":"  since been demoted in place of another primary. It is only allowed to"},{"line_number":35,"context_line":"  validate tokens. Since it was the primary at some point in time, its"},{"line_number":36,"context_line":"  existence in the key repository is justified because keystone needs the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_23c2b4e9","line":33,"updated":"2015-11-12 15:19:46.000000000","message":"you can have multiple secondary keys? If so, this should be \"Secondary Keys\"","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47539d161bf8e90541043c7500fd3042c142a75f","unresolved":false,"context_lines":[{"line_number":30,"context_line":"* Primary Key: There is only ever one primary key in a key repository. The"},{"line_number":31,"context_line":"  primary key is allowed to create and validate tokens. This key is always"},{"line_number":32,"context_line":"  named as ``1`` in the key repository."},{"line_number":33,"context_line":"* Secondary Key: The secondary key was at one point a primary key, but has"},{"line_number":34,"context_line":"  since been demoted in place of another primary. It is only allowed to"},{"line_number":35,"context_line":"  validate tokens. Since it was the primary at some point in time, its"},{"line_number":36,"context_line":"  existence in the key repository is justified because keystone needs the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_7842a3af","line":33,"in_reply_to":"da85f559_23c2b4e9","updated":"2015-11-12 16:58:06.000000000","message":"Done","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"dfe88c0fb63a84e41b0d96610e151a553dcc6049","unresolved":false,"context_lines":[{"line_number":37,"context_line":"  ability to validate tokens that were created with old primary keys. This key"},{"line_number":38,"context_line":"  is always named higher than ``1`` in the key repository, since ``1`` is"},{"line_number":39,"context_line":"  reserved for the primary key."},{"line_number":40,"context_line":"* Staged Key: The staged key is a special key that shares some similarities"},{"line_number":41,"context_line":"  with secondary keys. Just like secondary keys, staged keys have the ability"},{"line_number":42,"context_line":"  to validate tokens. Unlike secondary keys, staged keys have never been a"},{"line_number":43,"context_line":"  primary key. In fact, they are opposites in that since because a staged key"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_e3458c6e","line":40,"updated":"2015-11-12 15:19:46.000000000","message":"There can only be 1 staged key?\n\nAlso, does there have to be a staged key?","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47539d161bf8e90541043c7500fd3042c142a75f","unresolved":false,"context_lines":[{"line_number":37,"context_line":"  ability to validate tokens that were created with old primary keys. This key"},{"line_number":38,"context_line":"  is always named higher than ``1`` in the key repository, since ``1`` is"},{"line_number":39,"context_line":"  reserved for the primary key."},{"line_number":40,"context_line":"* Staged Key: The staged key is a special key that shares some similarities"},{"line_number":41,"context_line":"  with secondary keys. Just like secondary keys, staged keys have the ability"},{"line_number":42,"context_line":"  to validate tokens. Unlike secondary keys, staged keys have never been a"},{"line_number":43,"context_line":"  primary key. In fact, they are opposites in that since because a staged key"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_d8d2afd0","line":40,"in_reply_to":"da85f559_e3458c6e","updated":"2015-11-12 16:58:06.000000000","message":"Yes and yes, done.","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"dfe88c0fb63a84e41b0d96610e151a553dcc6049","unresolved":false,"context_lines":[{"line_number":84,"context_line":"Do Fernet tokens still expires?"},{"line_number":85,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Yes, Fernet tokens can expires just like any of keystone\u0027s other token formats."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Why should I choose Fernet tokens over UUID tokens?"},{"line_number":90,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_c61e565e","line":87,"updated":"2015-11-12 15:19:46.000000000","message":"change \"expires\" to \"expire\"\n\nYou might want to note in this section that if the key that encrypted the token is not availalbe on the system (typically because the secondary key was rotated out) then the token will be invalid (essentialy expired).","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47539d161bf8e90541043c7500fd3042c142a75f","unresolved":false,"context_lines":[{"line_number":84,"context_line":"Do Fernet tokens still expires?"},{"line_number":85,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Yes, Fernet tokens can expires just like any of keystone\u0027s other token formats."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Why should I choose Fernet tokens over UUID tokens?"},{"line_number":90,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_588d5fd1","line":87,"in_reply_to":"da85f559_c61e565e","updated":"2015-11-12 16:58:06.000000000","message":"Yeah, I think that might serve as a better question.","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"dfe88c0fb63a84e41b0d96610e151a553dcc6049","unresolved":false,"context_lines":[{"line_number":90,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"Even though Fernet tokens operate very similar to UUID tokens, they do not"},{"line_number":93,"context_line":"require persistence. Meaning, the database no longer suffers bloat as a side"},{"line_number":94,"context_line":"effect of authentication."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Why should I choose Fernet tokens over PKI or PKIZ tokens?"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_069e9eb8","line":93,"updated":"2015-11-12 15:19:46.000000000","message":"Remove \"Meaning\"","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47539d161bf8e90541043c7500fd3042c142a75f","unresolved":false,"context_lines":[{"line_number":90,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"Even though Fernet tokens operate very similar to UUID tokens, they do not"},{"line_number":93,"context_line":"require persistence. Meaning, the database no longer suffers bloat as a side"},{"line_number":94,"context_line":"effect of authentication."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Why should I choose Fernet tokens over PKI or PKIZ tokens?"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_58a47f49","line":93,"in_reply_to":"da85f559_069e9eb8","updated":"2015-11-12 16:58:06.000000000","message":"Done","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"dfe88c0fb63a84e41b0d96610e151a553dcc6049","unresolved":false,"context_lines":[{"line_number":101,"context_line":"tokens. PKI and PKIZ tokens still require persistent storage and can sometimes"},{"line_number":102,"context_line":"cause issues with their size depending on the size of the deployment. This"},{"line_number":103,"context_line":"issue is mitigated when switching to Fernet because Fernet tokens are kept"},{"line_number":104,"context_line":"under a 250 character limit in standard deployments."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Must you rotate and distribute keys from the same keystone node every rotation?"},{"line_number":107,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_26888270","line":104,"updated":"2015-11-12 15:19:46.000000000","message":"change \"character\" to \"byte\"","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47539d161bf8e90541043c7500fd3042c142a75f","unresolved":false,"context_lines":[{"line_number":101,"context_line":"tokens. PKI and PKIZ tokens still require persistent storage and can sometimes"},{"line_number":102,"context_line":"cause issues with their size depending on the size of the deployment. This"},{"line_number":103,"context_line":"issue is mitigated when switching to Fernet because Fernet tokens are kept"},{"line_number":104,"context_line":"under a 250 character limit in standard deployments."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Must you rotate and distribute keys from the same keystone node every rotation?"},{"line_number":107,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_987507cc","line":104,"in_reply_to":"da85f559_26888270","updated":"2015-11-12 16:58:06.000000000","message":"Done","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"dfe88c0fb63a84e41b0d96610e151a553dcc6049","unresolved":false,"context_lines":[{"line_number":107,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"No, but the relationship between rotation and distribution should be lock-step."},{"line_number":110,"context_line":"Mean, once you rotate keys on one keystone node, the key repository from that"},{"line_number":111,"context_line":"node should be distributed to the rest of the cluster. Once you confirm that"},{"line_number":112,"context_line":"each node has the same key repository state, you could rotate and distribute"},{"line_number":113,"context_line":"from any other node in the cluster."}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_26ef221f","line":110,"updated":"2015-11-12 15:19:46.000000000","message":"Remove \"Mean\"","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47539d161bf8e90541043c7500fd3042c142a75f","unresolved":false,"context_lines":[{"line_number":107,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"No, but the relationship between rotation and distribution should be lock-step."},{"line_number":110,"context_line":"Mean, once you rotate keys on one keystone node, the key repository from that"},{"line_number":111,"context_line":"node should be distributed to the rest of the cluster. Once you confirm that"},{"line_number":112,"context_line":"each node has the same key repository state, you could rotate and distribute"},{"line_number":113,"context_line":"from any other node in the cluster."}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_f84c539f","line":110,"in_reply_to":"da85f559_26ef221f","updated":"2015-11-12 16:58:06.000000000","message":"Done","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"dfe88c0fb63a84e41b0d96610e151a553dcc6049","unresolved":false,"context_lines":[{"line_number":110,"context_line":"Mean, once you rotate keys on one keystone node, the key repository from that"},{"line_number":111,"context_line":"node should be distributed to the rest of the cluster. Once you confirm that"},{"line_number":112,"context_line":"each node has the same key repository state, you could rotate and distribute"},{"line_number":113,"context_line":"from any other node in the cluster."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"How do I add new keystone nodes to a deployment?"},{"line_number":116,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_46bd8600","line":113,"updated":"2015-11-12 15:19:46.000000000","message":"This should say what happens if the advice isn\u0027t followed.","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47539d161bf8e90541043c7500fd3042c142a75f","unresolved":false,"context_lines":[{"line_number":110,"context_line":"Mean, once you rotate keys on one keystone node, the key repository from that"},{"line_number":111,"context_line":"node should be distributed to the rest of the cluster. Once you confirm that"},{"line_number":112,"context_line":"each node has the same key repository state, you could rotate and distribute"},{"line_number":113,"context_line":"from any other node in the cluster."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"How do I add new keystone nodes to a deployment?"},{"line_number":116,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_4cfda0af","line":113,"in_reply_to":"da85f559_46bd8600","updated":"2015-11-12 16:58:06.000000000","message":"Done","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"dfe88c0fb63a84e41b0d96610e151a553dcc6049","unresolved":false,"context_lines":[{"line_number":116,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"The keys used to create Fernet tokens should be treated like super secret"},{"line_number":119,"context_line":"configuration files. Before a node is allowed to join an existing cluster,"},{"line_number":120,"context_line":"issuing and validating tokens, it should have the same key repository state as"},{"line_number":121,"context_line":"the rest of the nodes in the cluster. This can be done by distributing the"},{"line_number":122,"context_line":"current key repository from an existing node in the cluster."}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_a61eb209","line":119,"updated":"2015-11-12 15:19:46.000000000","message":"suggest add an example of other secret config files -- maybe the SSL private key is a good example.","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47539d161bf8e90541043c7500fd3042c142a75f","unresolved":false,"context_lines":[{"line_number":116,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"The keys used to create Fernet tokens should be treated like super secret"},{"line_number":119,"context_line":"configuration files. Before a node is allowed to join an existing cluster,"},{"line_number":120,"context_line":"issuing and validating tokens, it should have the same key repository state as"},{"line_number":121,"context_line":"the rest of the nodes in the cluster. This can be done by distributing the"},{"line_number":122,"context_line":"current key repository from an existing node in the cluster."}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_0cd9d856","line":119,"in_reply_to":"da85f559_a61eb209","updated":"2015-11-12 16:58:06.000000000","message":"Done","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"dfe88c0fb63a84e41b0d96610e151a553dcc6049","unresolved":false,"context_lines":[{"line_number":128,"context_line":"deployments. If you only have one keystone node serving requests in your"},{"line_number":129,"context_line":"deployment distribution is unnecessary."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Key distribution is a problem best approached from the deployments current"},{"line_number":132,"context_line":"configuration management system (i.e. ``ansible``, ``chef``, ``puppet``). Since"},{"line_number":133,"context_line":"not all deployments use the same configuration management systems, it makes"},{"line_number":134,"context_line":"sense to explore options around what is already available for managing keys,"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_46f026c9","line":131,"updated":"2015-11-12 15:19:46.000000000","message":"change \"deployments\" to \"deployment\u0027s\"","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47539d161bf8e90541043c7500fd3042c142a75f","unresolved":false,"context_lines":[{"line_number":128,"context_line":"deployments. If you only have one keystone node serving requests in your"},{"line_number":129,"context_line":"deployment distribution is unnecessary."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Key distribution is a problem best approached from the deployments current"},{"line_number":132,"context_line":"configuration management system (i.e. ``ansible``, ``chef``, ``puppet``). Since"},{"line_number":133,"context_line":"not all deployments use the same configuration management systems, it makes"},{"line_number":134,"context_line":"sense to explore options around what is already available for managing keys,"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_0cc0f84e","line":131,"in_reply_to":"da85f559_46f026c9","updated":"2015-11-12 16:58:06.000000000","message":"Done","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"dfe88c0fb63a84e41b0d96610e151a553dcc6049","unresolved":false,"context_lines":[{"line_number":129,"context_line":"deployment distribution is unnecessary."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Key distribution is a problem best approached from the deployments current"},{"line_number":132,"context_line":"configuration management system (i.e. ``ansible``, ``chef``, ``puppet``). Since"},{"line_number":133,"context_line":"not all deployments use the same configuration management systems, it makes"},{"line_number":134,"context_line":"sense to explore options around what is already available for managing keys,"},{"line_number":135,"context_line":"while keeping the secrecy of the keys in mind.  Many of these tools can"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_86d12e25","line":132,"updated":"2015-11-12 15:19:46.000000000","message":"change \"i.e.\" to \"e.g.,\"\n\nAlso, remove `` from ansible, chef, and puppet.","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47539d161bf8e90541043c7500fd3042c142a75f","unresolved":false,"context_lines":[{"line_number":129,"context_line":"deployment distribution is unnecessary."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Key distribution is a problem best approached from the deployments current"},{"line_number":132,"context_line":"configuration management system (i.e. ``ansible``, ``chef``, ``puppet``). Since"},{"line_number":133,"context_line":"not all deployments use the same configuration management systems, it makes"},{"line_number":134,"context_line":"sense to explore options around what is already available for managing keys,"},{"line_number":135,"context_line":"while keeping the secrecy of the keys in mind.  Many of these tools can"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_4cc28054","line":132,"in_reply_to":"da85f559_86d12e25","updated":"2015-11-12 16:58:06.000000000","message":"Done","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"dfe88c0fb63a84e41b0d96610e151a553dcc6049","unresolved":false,"context_lines":[{"line_number":136,"context_line":"leverage something like ``rsync`` to manage your key distribution."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Key rotation is a single operation that promotes the current staged key to"},{"line_number":139,"context_line":"primary, creates a new staged key, and prunes old keys. It\u0027s easiest to do this"},{"line_number":140,"context_line":"on a single node and verify the rotation took place properly before"},{"line_number":141,"context_line":"distributing key repository to the rest of the cluster. The concept behind the"},{"line_number":142,"context_line":"staged key breaks the expectation that key rotation and key distribution have"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_6699aa78","line":139,"updated":"2015-11-12 15:19:46.000000000","message":"change \"old keys\" to \"old secondary keys\"","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47539d161bf8e90541043c7500fd3042c142a75f","unresolved":false,"context_lines":[{"line_number":136,"context_line":"leverage something like ``rsync`` to manage your key distribution."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Key rotation is a single operation that promotes the current staged key to"},{"line_number":139,"context_line":"primary, creates a new staged key, and prunes old keys. It\u0027s easiest to do this"},{"line_number":140,"context_line":"on a single node and verify the rotation took place properly before"},{"line_number":141,"context_line":"distributing key repository to the rest of the cluster. The concept behind the"},{"line_number":142,"context_line":"staged key breaks the expectation that key rotation and key distribution have"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_ccac30a1","line":139,"in_reply_to":"da85f559_6699aa78","updated":"2015-11-12 16:58:06.000000000","message":"Done","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"dfe88c0fb63a84e41b0d96610e151a553dcc6049","unresolved":false,"context_lines":[{"line_number":138,"context_line":"Key rotation is a single operation that promotes the current staged key to"},{"line_number":139,"context_line":"primary, creates a new staged key, and prunes old keys. It\u0027s easiest to do this"},{"line_number":140,"context_line":"on a single node and verify the rotation took place properly before"},{"line_number":141,"context_line":"distributing key repository to the rest of the cluster. The concept behind the"},{"line_number":142,"context_line":"staged key breaks the expectation that key rotation and key distribution have"},{"line_number":143,"context_line":"to be done in a single step. With the staged key, we have time to inspect the"},{"line_number":144,"context_line":"new key repository before syncing state with the rest of the cluster. Key"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_2695e231","line":141,"updated":"2015-11-12 15:19:46.000000000","message":"change \"distributing key repository\" to \"distributing the key repository\"","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47539d161bf8e90541043c7500fd3042c142a75f","unresolved":false,"context_lines":[{"line_number":138,"context_line":"Key rotation is a single operation that promotes the current staged key to"},{"line_number":139,"context_line":"primary, creates a new staged key, and prunes old keys. It\u0027s easiest to do this"},{"line_number":140,"context_line":"on a single node and verify the rotation took place properly before"},{"line_number":141,"context_line":"distributing key repository to the rest of the cluster. The concept behind the"},{"line_number":142,"context_line":"staged key breaks the expectation that key rotation and key distribution have"},{"line_number":143,"context_line":"to be done in a single step. With the staged key, we have time to inspect the"},{"line_number":144,"context_line":"new key repository before syncing state with the rest of the cluster. Key"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_ac80ccf7","line":141,"in_reply_to":"da85f559_2695e231","updated":"2015-11-12 16:58:06.000000000","message":"Done","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"dfe88c0fb63a84e41b0d96610e151a553dcc6049","unresolved":false,"context_lines":[{"line_number":153,"context_line":"      i) If no, investigate issues with the particular keystone host you"},{"line_number":154,"context_line":"         rotated keys on. Fernet keys are small and the operation for rotation"},{"line_number":155,"context_line":"         is fairly trivial. There shouldn\u0027t be much room for error in key"},{"line_number":156,"context_line":"         rotation. It\u0027s possible that keystone doesn\u0027t have the ability to"},{"line_number":157,"context_line":"         write new keys to the key repository. Log output from"},{"line_number":158,"context_line":"         ``keystone-manage fernet_rotate`` should give more information into"},{"line_number":159,"context_line":"         specific failures."}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_06b9becb","line":156,"updated":"2015-11-12 15:19:46.000000000","message":"change \"keystone\" to \"the user\"","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47539d161bf8e90541043c7500fd3042c142a75f","unresolved":false,"context_lines":[{"line_number":153,"context_line":"      i) If no, investigate issues with the particular keystone host you"},{"line_number":154,"context_line":"         rotated keys on. Fernet keys are small and the operation for rotation"},{"line_number":155,"context_line":"         is fairly trivial. There shouldn\u0027t be much room for error in key"},{"line_number":156,"context_line":"         rotation. It\u0027s possible that keystone doesn\u0027t have the ability to"},{"line_number":157,"context_line":"         write new keys to the key repository. Log output from"},{"line_number":158,"context_line":"         ``keystone-manage fernet_rotate`` should give more information into"},{"line_number":159,"context_line":"         specific failures."}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_ec91f447","line":156,"in_reply_to":"da85f559_06b9becb","updated":"2015-11-12 16:58:06.000000000","message":"Done","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"dfe88c0fb63a84e41b0d96610e151a553dcc6049","unresolved":false,"context_lines":[{"line_number":159,"context_line":"         specific failures."},{"line_number":160,"context_line":"      ii) If yes, you should see a new staged key, the old staged key should be"},{"line_number":161,"context_line":"          the new primary, and depending on the ``max_active_keys`` limit you"},{"line_number":162,"context_line":"          have set you might have keys that were pruned. At this point, the"},{"line_number":163,"context_line":"          node that you rotated on will be creating Fernet tokens with a"},{"line_number":164,"context_line":"          primary key that all other nodes should have. This is why we checked"},{"line_number":165,"context_line":"          the state of all key repositories in Step 1. All other nodes in the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_26e3a2da","line":162,"updated":"2015-11-12 15:19:46.000000000","message":"change \"keys\" to \"secondary keys\"","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47539d161bf8e90541043c7500fd3042c142a75f","unresolved":false,"context_lines":[{"line_number":159,"context_line":"         specific failures."},{"line_number":160,"context_line":"      ii) If yes, you should see a new staged key, the old staged key should be"},{"line_number":161,"context_line":"          the new primary, and depending on the ``max_active_keys`` limit you"},{"line_number":162,"context_line":"          have set you might have keys that were pruned. At this point, the"},{"line_number":163,"context_line":"          node that you rotated on will be creating Fernet tokens with a"},{"line_number":164,"context_line":"          primary key that all other nodes should have. This is why we checked"},{"line_number":165,"context_line":"          the state of all key repositories in Step 1. All other nodes in the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_4ca7e0a6","line":162,"in_reply_to":"da85f559_26e3a2da","updated":"2015-11-12 16:58:06.000000000","message":"Done","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"dfe88c0fb63a84e41b0d96610e151a553dcc6049","unresolved":false,"context_lines":[{"line_number":161,"context_line":"          the new primary, and depending on the ``max_active_keys`` limit you"},{"line_number":162,"context_line":"          have set you might have keys that were pruned. At this point, the"},{"line_number":163,"context_line":"          node that you rotated on will be creating Fernet tokens with a"},{"line_number":164,"context_line":"          primary key that all other nodes should have. This is why we checked"},{"line_number":165,"context_line":"          the state of all key repositories in Step 1. All other nodes in the"},{"line_number":166,"context_line":"          cluster should be able to decrypt tokens created with the new"},{"line_number":167,"context_line":"          primary. At this point, we\u0027re ready to distribute the new key set."}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_86428eac","line":164,"updated":"2015-11-12 15:19:46.000000000","message":"change \"should have\" to \"should have as the staging key\"","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47539d161bf8e90541043c7500fd3042c142a75f","unresolved":false,"context_lines":[{"line_number":161,"context_line":"          the new primary, and depending on the ``max_active_keys`` limit you"},{"line_number":162,"context_line":"          have set you might have keys that were pruned. At this point, the"},{"line_number":163,"context_line":"          node that you rotated on will be creating Fernet tokens with a"},{"line_number":164,"context_line":"          primary key that all other nodes should have. This is why we checked"},{"line_number":165,"context_line":"          the state of all key repositories in Step 1. All other nodes in the"},{"line_number":166,"context_line":"          cluster should be able to decrypt tokens created with the new"},{"line_number":167,"context_line":"          primary. At this point, we\u0027re ready to distribute the new key set."}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_0c18f8d1","line":164,"in_reply_to":"da85f559_86428eac","updated":"2015-11-12 16:58:06.000000000","message":"Done","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"dfe88c0fb63a84e41b0d96610e151a553dcc6049","unresolved":false,"context_lines":[{"line_number":187,"context_line":"creating them. With staged keys the penalty of key rotation is low, allowing an"},{"line_number":188,"context_line":"operator to err on the side of security and rotate weekly, daily, or even"},{"line_number":189,"context_line":"hourly. Ultimately, this should be less time than it takes an attacker to break"},{"line_number":190,"context_line":"a AES256 key and a SHA256 HMAC."},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"Is a Fernet token still a bearer token?"},{"line_number":193,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_6671aa0b","line":190,"updated":"2015-11-12 15:19:46.000000000","message":"You should note that the secondary keys have to stick around as long as the token is valid, so if the token is valid for 24 hours and the keys are rotated hourly you\u0027ll have to keep at least 24 keys around.\n\nDoesn\u0027t this indicate that it\u0027s not useful to rotate every hour, or to keep keys around longer than the token expiration?\n\nYou also might want to note that if a key is compromised then the attacker can create tokens with whatever authority they want. For example, they can create themselves a token for an admin on any project.","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"47539d161bf8e90541043c7500fd3042c142a75f","unresolved":false,"context_lines":[{"line_number":187,"context_line":"creating them. With staged keys the penalty of key rotation is low, allowing an"},{"line_number":188,"context_line":"operator to err on the side of security and rotate weekly, daily, or even"},{"line_number":189,"context_line":"hourly. Ultimately, this should be less time than it takes an attacker to break"},{"line_number":190,"context_line":"a AES256 key and a SHA256 HMAC."},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"Is a Fernet token still a bearer token?"},{"line_number":193,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da85f559_4c29209a","line":190,"in_reply_to":"da85f559_6671aa0b","updated":"2015-11-12 16:58:06.000000000","message":"Done","commit_id":"6810b92a9ef9196dc9e74bb418b8ad64602a0689"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":6,"context_line":"of the Fernet token format in Kilo."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"What are the different types of keys?"},{"line_number":9,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"A key repository is required by keystone in order to create Fernet tokens."},{"line_number":12,"context_line":"These keys are used to encrypt and decrypt the information that makes up the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_44ac838c","line":9,"updated":"2015-11-13 01:53:02.000000000","message":"For consistency, these should be ~~~~~ (and ditto for the rest)","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":6,"context_line":"of the Fernet token format in Kilo."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"What are the different types of keys?"},{"line_number":9,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"A key repository is required by keystone in order to create Fernet tokens."},{"line_number":12,"context_line":"These keys are used to encrypt and decrypt the information that makes up the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_f99f464e","line":9,"in_reply_to":"da85f559_44ac838c","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10897,"name":"Joseph Robinson","email":"josephremail@gmail.com","username":"RobiJoe"},"change_message_id":"2ddab062f7887cc45e548428a189d9cb9632317f","unresolved":false,"context_lines":[{"line_number":7,"context_line":""},{"line_number":8,"context_line":"What are the different types of keys?"},{"line_number":9,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"A key repository is required by keystone in order to create Fernet tokens."},{"line_number":12,"context_line":"These keys are used to encrypt and decrypt the information that makes up the"},{"line_number":13,"context_line":"payload of the token. Each key in the repository can have one of three states."}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_3facea8b","line":10,"updated":"2015-11-13 02:27:45.000000000","message":"Please address Alex\u0027s comment here. For .rst titles and headings, and to line up with the User Guide titles and headings structure, the Contributor Guide has the markup for the heading levels http://docs.openstack.org/contributor-guide/rst-conv/titles.html.\n\nAs an example (sorry, not the best example because of the way these comments render):\n\n\u003d\u003d\u003d\u003d\u003d\n\nFernet ...\n\n\u003d\u003d\u003d\u003d\u003d\n\nWhat are the different types of keys?\n ~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n...","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":7,"context_line":""},{"line_number":8,"context_line":"What are the different types of keys?"},{"line_number":9,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"A key repository is required by keystone in order to create Fernet tokens."},{"line_number":12,"context_line":"These keys are used to encrypt and decrypt the information that makes up the"},{"line_number":13,"context_line":"payload of the token. Each key in the repository can have one of three states."}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_792fd6f6","line":10,"in_reply_to":"da85f559_3facea8b","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":41,"context_line":"primary key can actually create new keystone tokens but all key types can"},{"line_number":42,"context_line":"validate tokens. The staged key is special given the order of events and the"},{"line_number":43,"context_line":"attributes of each key. The staged key is the only key in the repository that"},{"line_number":44,"context_line":"**hasn\u0027t** had a chance to create any tokens yet, but it\u0027s still allowed to"},{"line_number":45,"context_line":"decrypt tokens. This gives operators the chance to perform a key rotation on"},{"line_number":46,"context_line":"one keystone node, and distribute the new key set over a span of time. This"},{"line_number":47,"context_line":"doesn\u0027t require the distribution to take place in an ultra short period of time"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_e4b337e8","line":44,"updated":"2015-11-13 01:53:02.000000000","message":"has not*\n\nit is*","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":41,"context_line":"primary key can actually create new keystone tokens but all key types can"},{"line_number":42,"context_line":"validate tokens. The staged key is special given the order of events and the"},{"line_number":43,"context_line":"attributes of each key. The staged key is the only key in the repository that"},{"line_number":44,"context_line":"**hasn\u0027t** had a chance to create any tokens yet, but it\u0027s still allowed to"},{"line_number":45,"context_line":"decrypt tokens. This gives operators the chance to perform a key rotation on"},{"line_number":46,"context_line":"one keystone node, and distribute the new key set over a span of time. This"},{"line_number":47,"context_line":"doesn\u0027t require the distribution to take place in an ultra short period of time"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_797d96e6","line":44,"in_reply_to":"da85f559_e4b337e8","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":44,"context_line":"**hasn\u0027t** had a chance to create any tokens yet, but it\u0027s still allowed to"},{"line_number":45,"context_line":"decrypt tokens. This gives operators the chance to perform a key rotation on"},{"line_number":46,"context_line":"one keystone node, and distribute the new key set over a span of time. This"},{"line_number":47,"context_line":"doesn\u0027t require the distribution to take place in an ultra short period of time"},{"line_number":48,"context_line":"for fear of not being able to validate tokens created by a different node in"},{"line_number":49,"context_line":"the cluster."},{"line_number":50,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_a4c68f47","line":47,"updated":"2015-11-13 01:53:02.000000000","message":"does not*","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":44,"context_line":"**hasn\u0027t** had a chance to create any tokens yet, but it\u0027s still allowed to"},{"line_number":45,"context_line":"decrypt tokens. This gives operators the chance to perform a key rotation on"},{"line_number":46,"context_line":"one keystone node, and distribute the new key set over a span of time. This"},{"line_number":47,"context_line":"doesn\u0027t require the distribution to take place in an ultra short period of time"},{"line_number":48,"context_line":"for fear of not being able to validate tokens created by a different node in"},{"line_number":49,"context_line":"the cluster."},{"line_number":50,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_d96cc238","line":47,"in_reply_to":"da85f559_a4c68f47","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":65,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"There is a key rotation mechanism built into the ``keystone-manage`` command"},{"line_number":68,"context_line":"line utility. This mechanism only focuses on rotating keys and doesn\u0027t make an"},{"line_number":69,"context_line":"effort to distribute keys across keystone nodes. The distribution of key across"},{"line_number":70,"context_line":"a keystone deployment is best handled through configuration management tooling."},{"line_number":71,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_64d747ee","line":68,"updated":"2015-11-13 01:53:02.000000000","message":"does not*","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":65,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"There is a key rotation mechanism built into the ``keystone-manage`` command"},{"line_number":68,"context_line":"line utility. This mechanism only focuses on rotating keys and doesn\u0027t make an"},{"line_number":69,"context_line":"effort to distribute keys across keystone nodes. The distribution of key across"},{"line_number":70,"context_line":"a keystone deployment is best handled through configuration management tooling."},{"line_number":71,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_f950a660","line":68,"in_reply_to":"da85f559_64d747ee","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10897,"name":"Joseph Robinson","email":"josephremail@gmail.com","username":"RobiJoe"},"change_message_id":"2ddab062f7887cc45e548428a189d9cb9632317f","unresolved":false,"context_lines":[{"line_number":92,"context_line":"under a 250 byte limit in standard deployments."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Must you rotate and distribute keys from the same keystone node every rotation?"},{"line_number":95,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"No, but the relationship between rotation and distribution should be lock-step."},{"line_number":98,"context_line":"Once you rotate keys on one keystone node, the key repository from that node"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_ffdbc21f","line":95,"updated":"2015-11-13 02:27:45.000000000","message":"Stay in first person here:\nShould I rotate and distribute keys form the same keystone node every rotation?","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":92,"context_line":"under a 250 byte limit in standard deployments."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Must you rotate and distribute keys from the same keystone node every rotation?"},{"line_number":95,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"No, but the relationship between rotation and distribution should be lock-step."},{"line_number":98,"context_line":"Once you rotate keys on one keystone node, the key repository from that node"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_19d00ac9","line":95,"in_reply_to":"da85f559_ffdbc21f","updated":"2015-11-13 14:28:13.000000000","message":"Good point. Done, thanks!","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":100,"context_line":"node has the same key repository state, you could rotate and distribute from"},{"line_number":101,"context_line":"any other node in the cluster."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"If the rotation and distribution aren\u0027t lock-step, a single keystone node in"},{"line_number":104,"context_line":"the deployment will be creating tokens with a primary key that no other node"},{"line_number":105,"context_line":"has as a staged key. This will cause tokens generated from one keystone node to"},{"line_number":106,"context_line":"fail validation on others."}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_c4fcf374","line":103,"updated":"2015-11-13 01:53:02.000000000","message":"are not*","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":100,"context_line":"node has the same key repository state, you could rotate and distribute from"},{"line_number":101,"context_line":"any other node in the cluster."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"If the rotation and distribution aren\u0027t lock-step, a single keystone node in"},{"line_number":104,"context_line":"the deployment will be creating tokens with a primary key that no other node"},{"line_number":105,"context_line":"has as a staged key. This will cause tokens generated from one keystone node to"},{"line_number":106,"context_line":"fail validation on others."}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_d901223b","line":103,"in_reply_to":"da85f559_c4fcf374","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10897,"name":"Joseph Robinson","email":"josephremail@gmail.com","username":"RobiJoe"},"change_message_id":"2ddab062f7887cc45e548428a189d9cb9632317f","unresolved":false,"context_lines":[{"line_number":101,"context_line":"any other node in the cluster."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"If the rotation and distribution aren\u0027t lock-step, a single keystone node in"},{"line_number":104,"context_line":"the deployment will be creating tokens with a primary key that no other node"},{"line_number":105,"context_line":"has as a staged key. This will cause tokens generated from one keystone node to"},{"line_number":106,"context_line":"fail validation on others."},{"line_number":107,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_df011e6c","line":104,"updated":"2015-11-13 02:27:45.000000000","message":"Active voice here: ...a single keystone node in the deployment will create tokens with a primary key that no other node has as a staged key.","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":101,"context_line":"any other node in the cluster."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"If the rotation and distribution aren\u0027t lock-step, a single keystone node in"},{"line_number":104,"context_line":"the deployment will be creating tokens with a primary key that no other node"},{"line_number":105,"context_line":"has as a staged key. This will cause tokens generated from one keystone node to"},{"line_number":106,"context_line":"fail validation on others."},{"line_number":107,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_8c8fd674","line":104,"in_reply_to":"da85f559_df011e6c","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":126,"context_line":"configuration management system. Since not all deployments use the same"},{"line_number":127,"context_line":"configuration management systems, it makes sense to explore options around what"},{"line_number":128,"context_line":"is already available for managing keys, while keeping the secrecy of the keys"},{"line_number":129,"context_line":"in mind.  Many of these tools can leverage something like ``rsync`` to manage"},{"line_number":130,"context_line":"your key distribution."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"Key rotation is a single operation that promotes the current staged key to"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_042afbe7","line":129,"updated":"2015-11-13 01:53:02.000000000","message":"Remove the double space after the period here","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":126,"context_line":"configuration management system. Since not all deployments use the same"},{"line_number":127,"context_line":"configuration management systems, it makes sense to explore options around what"},{"line_number":128,"context_line":"is already available for managing keys, while keeping the secrecy of the keys"},{"line_number":129,"context_line":"in mind.  Many of these tools can leverage something like ``rsync`` to manage"},{"line_number":130,"context_line":"your key distribution."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"Key rotation is a single operation that promotes the current staged key to"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_4ccfaeb3","line":129,"in_reply_to":"da85f559_042afbe7","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":130,"context_line":"your key distribution."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"Key rotation is a single operation that promotes the current staged key to"},{"line_number":133,"context_line":"primary, creates a new staged key, and prunes old secondary keys. It\u0027s easiest"},{"line_number":134,"context_line":"to do this on a single node and verify the rotation took place properly before"},{"line_number":135,"context_line":"distributing the key repository to the rest of the cluster. The concept behind"},{"line_number":136,"context_line":"the staged key breaks the expectation that key rotation and key distribution"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_c4339361","line":133,"updated":"2015-11-13 01:53:02.000000000","message":"It is*","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":130,"context_line":"your key distribution."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"Key rotation is a single operation that promotes the current staged key to"},{"line_number":133,"context_line":"primary, creates a new staged key, and prunes old secondary keys. It\u0027s easiest"},{"line_number":134,"context_line":"to do this on a single node and verify the rotation took place properly before"},{"line_number":135,"context_line":"distributing the key repository to the rest of the cluster. The concept behind"},{"line_number":136,"context_line":"the staged key breaks the expectation that key rotation and key distribution"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_ecc0e27e","line":133,"in_reply_to":"da85f559_c4339361","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":140,"context_line":"succeeds. The following might help illustrate the isolation and workflow"},{"line_number":141,"context_line":"between key rotation and key distribution."},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"1. Ensure all keystone nodes in the deployment have the same key repository."},{"line_number":144,"context_line":"2. Pick a keystone node in the cluster to rotate from."},{"line_number":145,"context_line":"3. Rotate keys."},{"line_number":146,"context_line":"    a) Was is successful?"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_a450cf5f","line":143,"updated":"2015-11-13 01:53:02.000000000","message":"We tend to use #. for numbered lists, it doesn\u0027t make a terrible difference in the output.","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":146,"context_line":"    a) Was is successful?"},{"line_number":147,"context_line":"        i) If no, investigate issues with the particular keystone host you"},{"line_number":148,"context_line":"           rotated keys on. Fernet keys are small and the operation for"},{"line_number":149,"context_line":"           rotation is fairly trivial. There shouldn\u0027t be much room for error"},{"line_number":150,"context_line":"           in key rotation. It\u0027s possible that the user doesn\u0027t have the"},{"line_number":151,"context_line":"           ability to write new keys to the key repository. Log output from"},{"line_number":152,"context_line":"           ``keystone-manage fernet_rotate`` should give more information into"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_644ae7ae","line":149,"updated":"2015-11-13 01:53:02.000000000","message":"should not*","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":146,"context_line":"    a) Was is successful?"},{"line_number":147,"context_line":"        i) If no, investigate issues with the particular keystone host you"},{"line_number":148,"context_line":"           rotated keys on. Fernet keys are small and the operation for"},{"line_number":149,"context_line":"           rotation is fairly trivial. There shouldn\u0027t be much room for error"},{"line_number":150,"context_line":"           in key rotation. It\u0027s possible that the user doesn\u0027t have the"},{"line_number":151,"context_line":"           ability to write new keys to the key repository. Log output from"},{"line_number":152,"context_line":"           ``keystone-manage fernet_rotate`` should give more information into"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_6cd71224","line":149,"in_reply_to":"da85f559_644ae7ae","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":147,"context_line":"        i) If no, investigate issues with the particular keystone host you"},{"line_number":148,"context_line":"           rotated keys on. Fernet keys are small and the operation for"},{"line_number":149,"context_line":"           rotation is fairly trivial. There shouldn\u0027t be much room for error"},{"line_number":150,"context_line":"           in key rotation. It\u0027s possible that the user doesn\u0027t have the"},{"line_number":151,"context_line":"           ability to write new keys to the key repository. Log output from"},{"line_number":152,"context_line":"           ``keystone-manage fernet_rotate`` should give more information into"},{"line_number":153,"context_line":"           specific failures."}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_24cb7f20","line":150,"updated":"2015-11-13 01:53:02.000000000","message":"it is* does not*","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":147,"context_line":"        i) If no, investigate issues with the particular keystone host you"},{"line_number":148,"context_line":"           rotated keys on. Fernet keys are small and the operation for"},{"line_number":149,"context_line":"           rotation is fairly trivial. There shouldn\u0027t be much room for error"},{"line_number":150,"context_line":"           in key rotation. It\u0027s possible that the user doesn\u0027t have the"},{"line_number":151,"context_line":"           ability to write new keys to the key repository. Log output from"},{"line_number":152,"context_line":"           ``keystone-manage fernet_rotate`` should give more information into"},{"line_number":153,"context_line":"           specific failures."}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_2ce10aff","line":150,"in_reply_to":"da85f559_24cb7f20","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":151,"context_line":"           ability to write new keys to the key repository. Log output from"},{"line_number":152,"context_line":"           ``keystone-manage fernet_rotate`` should give more information into"},{"line_number":153,"context_line":"           specific failures."},{"line_number":154,"context_line":"        ii) If yes, you should see a new staged key, the old staged key should"},{"line_number":155,"context_line":"            be the new primary, and depending on the ``max_active_keys`` limit"},{"line_number":156,"context_line":"            you have set you might have secondary keys that were pruned. At"},{"line_number":157,"context_line":"            this point, the node that you rotated on will be creating Fernet"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_a4d76fbe","line":154,"updated":"2015-11-13 01:53:02.000000000","message":"\"...new staged key. The old staged key should...\"","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":151,"context_line":"           ability to write new keys to the key repository. Log output from"},{"line_number":152,"context_line":"           ``keystone-manage fernet_rotate`` should give more information into"},{"line_number":153,"context_line":"           specific failures."},{"line_number":154,"context_line":"        ii) If yes, you should see a new staged key, the old staged key should"},{"line_number":155,"context_line":"            be the new primary, and depending on the ``max_active_keys`` limit"},{"line_number":156,"context_line":"            you have set you might have secondary keys that were pruned. At"},{"line_number":157,"context_line":"            this point, the node that you rotated on will be creating Fernet"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_cccdde87","line":154,"in_reply_to":"da85f559_a4d76fbe","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":159,"context_line":"            staged key. This is why we checked the state of all key"},{"line_number":160,"context_line":"            repositories in Step one. All other nodes in the cluster should be"},{"line_number":161,"context_line":"            able to decrypt tokens created with the new primary. At this point,"},{"line_number":162,"context_line":"            we\u0027re ready to distribute the new key set."},{"line_number":163,"context_line":"4. Distribute the new key repository."},{"line_number":164,"context_line":"    a) Was it successful?"},{"line_number":165,"context_line":"        i) If yes, you should be able to confirm that all nodes in the cluster"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_44e483ab","line":162,"updated":"2015-11-13 01:53:02.000000000","message":"we are*","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":159,"context_line":"            staged key. This is why we checked the state of all key"},{"line_number":160,"context_line":"            repositories in Step one. All other nodes in the cluster should be"},{"line_number":161,"context_line":"            able to decrypt tokens created with the new primary. At this point,"},{"line_number":162,"context_line":"            we\u0027re ready to distribute the new key set."},{"line_number":163,"context_line":"4. Distribute the new key repository."},{"line_number":164,"context_line":"    a) Was it successful?"},{"line_number":165,"context_line":"        i) If yes, you should be able to confirm that all nodes in the cluster"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_2cafca95","line":162,"in_reply_to":"da85f559_44e483ab","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":170,"context_line":"        ii) If no, try distributing again. Remember that we already rotated the"},{"line_number":171,"context_line":"            repository and performing another rotation at this point will"},{"line_number":172,"context_line":"            result in tokens that can\u0027t be validated across certain hosts."},{"line_number":173,"context_line":"            Specifically, the hosts that didn\u0027t get the latest key set. You"},{"line_number":174,"context_line":"            should be able to execute distribution of keys until it\u0027s"},{"line_number":175,"context_line":"            successful. If certain nodes have issues syncing, it could be"},{"line_number":176,"context_line":"            permission or network issues and those should be resolved before"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_e4a2574b","line":173,"updated":"2015-11-13 01:53:02.000000000","message":"did not*","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":170,"context_line":"        ii) If no, try distributing again. Remember that we already rotated the"},{"line_number":171,"context_line":"            repository and performing another rotation at this point will"},{"line_number":172,"context_line":"            result in tokens that can\u0027t be validated across certain hosts."},{"line_number":173,"context_line":"            Specifically, the hosts that didn\u0027t get the latest key set. You"},{"line_number":174,"context_line":"            should be able to execute distribution of keys until it\u0027s"},{"line_number":175,"context_line":"            successful. If certain nodes have issues syncing, it could be"},{"line_number":176,"context_line":"            permission or network issues and those should be resolved before"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_ac72da47","line":173,"in_reply_to":"da85f559_e4a2574b","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":171,"context_line":"            repository and performing another rotation at this point will"},{"line_number":172,"context_line":"            result in tokens that can\u0027t be validated across certain hosts."},{"line_number":173,"context_line":"            Specifically, the hosts that didn\u0027t get the latest key set. You"},{"line_number":174,"context_line":"            should be able to execute distribution of keys until it\u0027s"},{"line_number":175,"context_line":"            successful. If certain nodes have issues syncing, it could be"},{"line_number":176,"context_line":"            permission or network issues and those should be resolved before"},{"line_number":177,"context_line":"            subsequent rotations anyway."}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_a4852fae","line":174,"updated":"2015-11-13 01:53:02.000000000","message":"it is*","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":171,"context_line":"            repository and performing another rotation at this point will"},{"line_number":172,"context_line":"            result in tokens that can\u0027t be validated across certain hosts."},{"line_number":173,"context_line":"            Specifically, the hosts that didn\u0027t get the latest key set. You"},{"line_number":174,"context_line":"            should be able to execute distribution of keys until it\u0027s"},{"line_number":175,"context_line":"            successful. If certain nodes have issues syncing, it could be"},{"line_number":176,"context_line":"            permission or network issues and those should be resolved before"},{"line_number":177,"context_line":"            subsequent rotations anyway."}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_4c8ece28","line":174,"in_reply_to":"da85f559_a4852fae","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":183,"context_line":"creating them. With staged keys the penalty of key rotation is low, allowing an"},{"line_number":184,"context_line":"operator to err on the side of security and rotate weekly, daily, or even"},{"line_number":185,"context_line":"hourly. Ultimately, this should be less time than it takes an attacker to break"},{"line_number":186,"context_line":"a AES256 key and a SHA256 HMAC."},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Is a Fernet token still a bearer token?"},{"line_number":189,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_24c05fe0","line":186,"updated":"2015-11-13 01:53:02.000000000","message":"``AES256`` ``SHA256 HMAC``","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":183,"context_line":"creating them. With staged keys the penalty of key rotation is low, allowing an"},{"line_number":184,"context_line":"operator to err on the side of security and rotate weekly, daily, or even"},{"line_number":185,"context_line":"hourly. Ultimately, this should be less time than it takes an attacker to break"},{"line_number":186,"context_line":"a AES256 key and a SHA256 HMAC."},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Is a Fernet token still a bearer token?"},{"line_number":189,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_8cacb68d","line":186,"in_reply_to":"da85f559_24c05fe0","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":189,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"Yes, and they follow exactly the same validation path as ``uuid`` tokens, with"},{"line_number":192,"context_line":"the exception of being persisted in a backend. If someone compromises your"},{"line_number":193,"context_line":"Fernet token, they have the power to do all the operations you are allowed to"},{"line_number":194,"context_line":"do."},{"line_number":195,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_2467ff26","line":192,"updated":"2015-11-13 01:53:02.000000000","message":"we used \u0027back end\u0027 as two words. If you have any other instances of that throughout your docs, please change this","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":189,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"Yes, and they follow exactly the same validation path as ``uuid`` tokens, with"},{"line_number":192,"context_line":"the exception of being persisted in a backend. If someone compromises your"},{"line_number":193,"context_line":"Fernet token, they have the power to do all the operations you are allowed to"},{"line_number":194,"context_line":"do."},{"line_number":195,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_ccd07efa","line":192,"in_reply_to":"da85f559_2467ff26","updated":"2015-11-13 14:28:13.000000000","message":"Done, I think you caught the only one :)","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":215,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"Using Fernet tokens requires some awareness around token expiration and the"},{"line_number":218,"context_line":"key life-cycle. You don\u0027t want to rotate so often that secondary keys are"},{"line_number":219,"context_line":"removed that might still be needed to decrypt unexpired tokens. If this"},{"line_number":220,"context_line":"happens, the token won\u0027t be decrypt-able because the key the was used to create"},{"line_number":221,"context_line":"it is now gone. On the other hand, you should be able to safely remove keys"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_4480038c","line":218,"updated":"2015-11-13 01:53:02.000000000","message":"do not*","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":215,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"Using Fernet tokens requires some awareness around token expiration and the"},{"line_number":218,"context_line":"key life-cycle. You don\u0027t want to rotate so often that secondary keys are"},{"line_number":219,"context_line":"removed that might still be needed to decrypt unexpired tokens. If this"},{"line_number":220,"context_line":"happens, the token won\u0027t be decrypt-able because the key the was used to create"},{"line_number":221,"context_line":"it is now gone. On the other hand, you should be able to safely remove keys"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_2c026a70","line":218,"in_reply_to":"da85f559_4480038c","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":217,"context_line":"Using Fernet tokens requires some awareness around token expiration and the"},{"line_number":218,"context_line":"key life-cycle. You don\u0027t want to rotate so often that secondary keys are"},{"line_number":219,"context_line":"removed that might still be needed to decrypt unexpired tokens. If this"},{"line_number":220,"context_line":"happens, the token won\u0027t be decrypt-able because the key the was used to create"},{"line_number":221,"context_line":"it is now gone. On the other hand, you should be able to safely remove keys"},{"line_number":222,"context_line":"that are no longer creating or validating any tokens."},{"line_number":223,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_647d07b1","line":220,"updated":"2015-11-13 01:53:02.000000000","message":"will not*\n\n\"If this happens, you will not be able to decrypt the token because the key that was used to create it is now gone.\"","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":217,"context_line":"Using Fernet tokens requires some awareness around token expiration and the"},{"line_number":218,"context_line":"key life-cycle. You don\u0027t want to rotate so often that secondary keys are"},{"line_number":219,"context_line":"removed that might still be needed to decrypt unexpired tokens. If this"},{"line_number":220,"context_line":"happens, the token won\u0027t be decrypt-able because the key the was used to create"},{"line_number":221,"context_line":"it is now gone. On the other hand, you should be able to safely remove keys"},{"line_number":222,"context_line":"that are no longer creating or validating any tokens."},{"line_number":223,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_4c11eeae","line":220,"in_reply_to":"da85f559_647d07b1","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":218,"context_line":"key life-cycle. You don\u0027t want to rotate so often that secondary keys are"},{"line_number":219,"context_line":"removed that might still be needed to decrypt unexpired tokens. If this"},{"line_number":220,"context_line":"happens, the token won\u0027t be decrypt-able because the key the was used to create"},{"line_number":221,"context_line":"it is now gone. On the other hand, you should be able to safely remove keys"},{"line_number":222,"context_line":"that are no longer creating or validating any tokens."},{"line_number":223,"context_line":""},{"line_number":224,"context_line":"For example, let\u0027s say our tokens are valid for 24 hours and we want to rotate"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_c442b368","line":221,"updated":"2015-11-13 01:53:02.000000000","message":"Avoid using casual phrases like \u0027on the other hand\u0027 - remove if you can, please.","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":218,"context_line":"key life-cycle. You don\u0027t want to rotate so often that secondary keys are"},{"line_number":219,"context_line":"removed that might still be needed to decrypt unexpired tokens. If this"},{"line_number":220,"context_line":"happens, the token won\u0027t be decrypt-able because the key the was used to create"},{"line_number":221,"context_line":"it is now gone. On the other hand, you should be able to safely remove keys"},{"line_number":222,"context_line":"that are no longer creating or validating any tokens."},{"line_number":223,"context_line":""},{"line_number":224,"context_line":"For example, let\u0027s say our tokens are valid for 24 hours and we want to rotate"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_cc539e6b","line":221,"in_reply_to":"da85f559_c442b368","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":221,"context_line":"it is now gone. On the other hand, you should be able to safely remove keys"},{"line_number":222,"context_line":"that are no longer creating or validating any tokens."},{"line_number":223,"context_line":""},{"line_number":224,"context_line":"For example, let\u0027s say our tokens are valid for 24 hours and we want to rotate"},{"line_number":225,"context_line":"keys every six hours. We\u0027ll need to make sure tokens that were created at 08:00"},{"line_number":226,"context_line":"AM on Monday are still valid at 07:00 AM on Tuesday, assuming they weren\u0027t"},{"line_number":227,"context_line":"prematurely revoked. To accomplish this, we\u0027ll want to make sure we set"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_a45a0f4f","line":224,"updated":"2015-11-13 01:53:02.000000000","message":"\"For example, your token is valid for 24 hours...\"","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":221,"context_line":"it is now gone. On the other hand, you should be able to safely remove keys"},{"line_number":222,"context_line":"that are no longer creating or validating any tokens."},{"line_number":223,"context_line":""},{"line_number":224,"context_line":"For example, let\u0027s say our tokens are valid for 24 hours and we want to rotate"},{"line_number":225,"context_line":"keys every six hours. We\u0027ll need to make sure tokens that were created at 08:00"},{"line_number":226,"context_line":"AM on Monday are still valid at 07:00 AM on Tuesday, assuming they weren\u0027t"},{"line_number":227,"context_line":"prematurely revoked. To accomplish this, we\u0027ll want to make sure we set"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_4c948ee7","line":224,"in_reply_to":"da85f559_a45a0f4f","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":222,"context_line":"that are no longer creating or validating any tokens."},{"line_number":223,"context_line":""},{"line_number":224,"context_line":"For example, let\u0027s say our tokens are valid for 24 hours and we want to rotate"},{"line_number":225,"context_line":"keys every six hours. We\u0027ll need to make sure tokens that were created at 08:00"},{"line_number":226,"context_line":"AM on Monday are still valid at 07:00 AM on Tuesday, assuming they weren\u0027t"},{"line_number":227,"context_line":"prematurely revoked. To accomplish this, we\u0027ll want to make sure we set"},{"line_number":228,"context_line":"``max_active_keys\u003d6`` in our keystone configuration file. This will allow us to"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_4457a326","line":225,"updated":"2015-11-13 01:53:02.000000000","message":"We will*","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":222,"context_line":"that are no longer creating or validating any tokens."},{"line_number":223,"context_line":""},{"line_number":224,"context_line":"For example, let\u0027s say our tokens are valid for 24 hours and we want to rotate"},{"line_number":225,"context_line":"keys every six hours. We\u0027ll need to make sure tokens that were created at 08:00"},{"line_number":226,"context_line":"AM on Monday are still valid at 07:00 AM on Tuesday, assuming they weren\u0027t"},{"line_number":227,"context_line":"prematurely revoked. To accomplish this, we\u0027ll want to make sure we set"},{"line_number":228,"context_line":"``max_active_keys\u003d6`` in our keystone configuration file. This will allow us to"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_8cfb5647","line":225,"in_reply_to":"da85f559_4457a326","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":223,"context_line":""},{"line_number":224,"context_line":"For example, let\u0027s say our tokens are valid for 24 hours and we want to rotate"},{"line_number":225,"context_line":"keys every six hours. We\u0027ll need to make sure tokens that were created at 08:00"},{"line_number":226,"context_line":"AM on Monday are still valid at 07:00 AM on Tuesday, assuming they weren\u0027t"},{"line_number":227,"context_line":"prematurely revoked. To accomplish this, we\u0027ll want to make sure we set"},{"line_number":228,"context_line":"``max_active_keys\u003d6`` in our keystone configuration file. This will allow us to"},{"line_number":229,"context_line":"hold all keys that might still be required to validate a previous token, but"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_8424abc6","line":226,"updated":"2015-11-13 01:53:02.000000000","message":"were not*","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":223,"context_line":""},{"line_number":224,"context_line":"For example, let\u0027s say our tokens are valid for 24 hours and we want to rotate"},{"line_number":225,"context_line":"keys every six hours. We\u0027ll need to make sure tokens that were created at 08:00"},{"line_number":226,"context_line":"AM on Monday are still valid at 07:00 AM on Tuesday, assuming they weren\u0027t"},{"line_number":227,"context_line":"prematurely revoked. To accomplish this, we\u0027ll want to make sure we set"},{"line_number":228,"context_line":"``max_active_keys\u003d6`` in our keystone configuration file. This will allow us to"},{"line_number":229,"context_line":"hold all keys that might still be required to validate a previous token, but"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_ecfea237","line":226,"in_reply_to":"da85f559_8424abc6","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":224,"context_line":"For example, let\u0027s say our tokens are valid for 24 hours and we want to rotate"},{"line_number":225,"context_line":"keys every six hours. We\u0027ll need to make sure tokens that were created at 08:00"},{"line_number":226,"context_line":"AM on Monday are still valid at 07:00 AM on Tuesday, assuming they weren\u0027t"},{"line_number":227,"context_line":"prematurely revoked. To accomplish this, we\u0027ll want to make sure we set"},{"line_number":228,"context_line":"``max_active_keys\u003d6`` in our keystone configuration file. This will allow us to"},{"line_number":229,"context_line":"hold all keys that might still be required to validate a previous token, but"},{"line_number":230,"context_line":"keeps the key repository limited to only the keys that are needed."}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_a421afb6","line":227,"updated":"2015-11-13 01:53:02.000000000","message":"we will","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":224,"context_line":"For example, let\u0027s say our tokens are valid for 24 hours and we want to rotate"},{"line_number":225,"context_line":"keys every six hours. We\u0027ll need to make sure tokens that were created at 08:00"},{"line_number":226,"context_line":"AM on Monday are still valid at 07:00 AM on Tuesday, assuming they weren\u0027t"},{"line_number":227,"context_line":"prematurely revoked. To accomplish this, we\u0027ll want to make sure we set"},{"line_number":228,"context_line":"``max_active_keys\u003d6`` in our keystone configuration file. This will allow us to"},{"line_number":229,"context_line":"hold all keys that might still be required to validate a previous token, but"},{"line_number":230,"context_line":"keeps the key repository limited to only the keys that are needed."}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_2cecaa8e","line":227,"in_reply_to":"da85f559_a421afb6","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":238,"context_line":"    max_active_keys \u003d (token_expiration / rotation_frequency) + 2"},{"line_number":239,"context_line":""},{"line_number":240,"context_line":"The reason for adding two additional keys to the count is to include the staged"},{"line_number":241,"context_line":"key and a buffer key. This can be shown based on the previous example. Let\u0027s"},{"line_number":242,"context_line":"say we initially setup the key repository at 6:00 AM on Monday, and the initial"},{"line_number":243,"context_line":"state looks like::"},{"line_number":244,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_840b4b2b","line":241,"updated":"2015-11-13 01:53:02.000000000","message":"\"We initially set up the key repository...\"","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":238,"context_line":"    max_active_keys \u003d (token_expiration / rotation_frequency) + 2"},{"line_number":239,"context_line":""},{"line_number":240,"context_line":"The reason for adding two additional keys to the count is to include the staged"},{"line_number":241,"context_line":"key and a buffer key. This can be shown based on the previous example. Let\u0027s"},{"line_number":242,"context_line":"say we initially setup the key repository at 6:00 AM on Monday, and the initial"},{"line_number":243,"context_line":"state looks like::"},{"line_number":244,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_6c671226","line":241,"in_reply_to":"da85f559_840b4b2b","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10897,"name":"Joseph Robinson","email":"josephremail@gmail.com","username":"RobiJoe"},"change_message_id":"2ddab062f7887cc45e548428a189d9cb9632317f","unresolved":false,"context_lines":[{"line_number":248,"context_line":"    -rw------- 1 keystone keystone   44 0    (staged key)"},{"line_number":249,"context_line":"    -rw------- 1 keystone keystone   44 1    (primary key)"},{"line_number":250,"context_line":""},{"line_number":251,"context_line":"All tokens created after 6:00 AM will be encrypted with key ``1``. At 12:00 PM"},{"line_number":252,"context_line":"we will rotate keys again, resulting in::"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"    $ ls -la /etc/keystone/fernet-keys/"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_1fcb2620","line":251,"updated":"2015-11-13 02:27:45.000000000","message":"Switch to active voice: ...created after 6:00am are encrypted with a key ``1``.","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":248,"context_line":"    -rw------- 1 keystone keystone   44 0    (staged key)"},{"line_number":249,"context_line":"    -rw------- 1 keystone keystone   44 1    (primary key)"},{"line_number":250,"context_line":""},{"line_number":251,"context_line":"All tokens created after 6:00 AM will be encrypted with key ``1``. At 12:00 PM"},{"line_number":252,"context_line":"we will rotate keys again, resulting in::"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"    $ ls -la /etc/keystone/fernet-keys/"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_4c49ee8d","line":251,"in_reply_to":"da85f559_1fcb2620","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":271,"context_line":"    -rw------- 1 keystone keystone   44 2    (secondary key)"},{"line_number":272,"context_line":"    -rw------- 1 keystone keystone   44 3    (primary key)"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"It\u0027s still possible to validate tokens issued from 6:00 AM - 5:59 PM because"},{"line_number":275,"context_line":"keys ``1`` and ``2`` exist as secondary keys. Every token issued until 11:59 PM"},{"line_number":276,"context_line":"will be encrypted with key ``3``, and at 12:00 AM we do our next rotation::"},{"line_number":277,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_bf077a17","line":274,"updated":"2015-11-13 01:53:02.000000000","message":"It is*","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":271,"context_line":"    -rw------- 1 keystone keystone   44 2    (secondary key)"},{"line_number":272,"context_line":"    -rw------- 1 keystone keystone   44 3    (primary key)"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"It\u0027s still possible to validate tokens issued from 6:00 AM - 5:59 PM because"},{"line_number":275,"context_line":"keys ``1`` and ``2`` exist as secondary keys. Every token issued until 11:59 PM"},{"line_number":276,"context_line":"will be encrypted with key ``3``, and at 12:00 AM we do our next rotation::"},{"line_number":277,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_0c43e66d","line":274,"in_reply_to":"da85f559_bf077a17","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"41a5e46de0064ae9af9468bcea3138a6788f42d8","unresolved":false,"context_lines":[{"line_number":299,"context_line":"    -rw------- 1 keystone keystone   44 4    (secondary key)"},{"line_number":300,"context_line":"    -rw------- 1 keystone keystone   44 5    (primary key)"},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"Tokens will naturally expire after 6:00 AM, but we won\u0027t be able to remove key"},{"line_number":303,"context_line":"``1`` until the next rotation because it encrypted all tokens from 6:00 AM -"},{"line_number":304,"context_line":"12:00 PM the day before. Once we do our next rotation, which is at 12:00 PM,"},{"line_number":305,"context_line":"the ``1`` key will be pruned from the repository::"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_df0cbe3d","line":302,"updated":"2015-11-13 01:53:02.000000000","message":"will not*","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"63dfe6fa52f76b57c67381691c74445987f669c7","unresolved":false,"context_lines":[{"line_number":299,"context_line":"    -rw------- 1 keystone keystone   44 4    (secondary key)"},{"line_number":300,"context_line":"    -rw------- 1 keystone keystone   44 5    (primary key)"},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"Tokens will naturally expire after 6:00 AM, but we won\u0027t be able to remove key"},{"line_number":303,"context_line":"``1`` until the next rotation because it encrypted all tokens from 6:00 AM -"},{"line_number":304,"context_line":"12:00 PM the day before. Once we do our next rotation, which is at 12:00 PM,"},{"line_number":305,"context_line":"the ``1`` key will be pruned from the repository::"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da85f559_0f567806","line":302,"in_reply_to":"da85f559_df0cbe3d","updated":"2015-11-13 14:28:13.000000000","message":"Done","commit_id":"0fbb925ab5f8a06010a2b73002b47ed520b94b8d"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"1c977ef80e80cde14931b70c28e2f692a9cce1d9","unresolved":false,"context_lines":[{"line_number":14,"context_line":"The state of the key determines how a key is used with Fernet tokens. The"},{"line_number":15,"context_line":"different types are as follows:"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"* Primary Key: There is only ever one primary key in a key repository. The"},{"line_number":18,"context_line":"  primary key is allowed to create and validate tokens. This key is always"},{"line_number":19,"context_line":"  named as ``1`` in the key repository."},{"line_number":20,"context_line":"* Secondary Key: Secondary key was at one point a primary key, but has"}],"source_content_type":"text/x-rst","patch_set":6,"id":"da85f559_dee1ffd1","line":17,"updated":"2015-11-13 16:14:48.000000000","message":"I suggest to use a definition list instead:\n\nPrimary key\n  There is only...\n\nAnd lowercase \"key\" in these cases","commit_id":"e9021acbbe97b1c6c88ba6a2b963d879fcefbf7d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c96f1c87f8b4b05c75d0e30b51e7f24ad45f4762","unresolved":false,"context_lines":[{"line_number":14,"context_line":"The state of the key determines how a key is used with Fernet tokens. The"},{"line_number":15,"context_line":"different types are as follows:"},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"* Primary Key: There is only ever one primary key in a key repository. The"},{"line_number":18,"context_line":"  primary key is allowed to create and validate tokens. This key is always"},{"line_number":19,"context_line":"  named as ``1`` in the key repository."},{"line_number":20,"context_line":"* Secondary Key: Secondary key was at one point a primary key, but has"}],"source_content_type":"text/x-rst","patch_set":6,"id":"da85f559_50f658d8","line":17,"in_reply_to":"da85f559_dee1ffd1","updated":"2015-11-13 20:11:24.000000000","message":"Done","commit_id":"e9021acbbe97b1c6c88ba6a2b963d879fcefbf7d"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"1c977ef80e80cde14931b70c28e2f692a9cce1d9","unresolved":false,"context_lines":[{"line_number":17,"context_line":"* Primary Key: There is only ever one primary key in a key repository. The"},{"line_number":18,"context_line":"  primary key is allowed to create and validate tokens. This key is always"},{"line_number":19,"context_line":"  named as ``1`` in the key repository."},{"line_number":20,"context_line":"* Secondary Key: Secondary key was at one point a primary key, but has"},{"line_number":21,"context_line":"  since been demoted in place of another primary. It is only allowed to"},{"line_number":22,"context_line":"  validate tokens. Since it was the primary at some point in time, its"},{"line_number":23,"context_line":"  existence in the key repository is justified because keystone needs the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"da85f559_fedac316","line":20,"updated":"2015-11-13 16:14:48.000000000","message":"The secondary...","commit_id":"e9021acbbe97b1c6c88ba6a2b963d879fcefbf7d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c96f1c87f8b4b05c75d0e30b51e7f24ad45f4762","unresolved":false,"context_lines":[{"line_number":17,"context_line":"* Primary Key: There is only ever one primary key in a key repository. The"},{"line_number":18,"context_line":"  primary key is allowed to create and validate tokens. This key is always"},{"line_number":19,"context_line":"  named as ``1`` in the key repository."},{"line_number":20,"context_line":"* Secondary Key: Secondary key was at one point a primary key, but has"},{"line_number":21,"context_line":"  since been demoted in place of another primary. It is only allowed to"},{"line_number":22,"context_line":"  validate tokens. Since it was the primary at some point in time, its"},{"line_number":23,"context_line":"  existence in the key repository is justified because keystone needs the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"da85f559_109c5068","line":20,"in_reply_to":"da85f559_fedac316","updated":"2015-11-13 20:11:24.000000000","message":"Done","commit_id":"e9021acbbe97b1c6c88ba6a2b963d879fcefbf7d"},{"author":{"_account_id":17832,"name":"Linette Williams","email":"stemke@us.ibm.com","username":"lwilliams"},"change_message_id":"10ac863edd4f621bd4a1944ab3d9f1b60bcdcf6e","unresolved":false,"context_lines":[{"line_number":20,"context_line":"* Secondary Key: Secondary key was at one point a primary key, but has"},{"line_number":21,"context_line":"  since been demoted in place of another primary. It is only allowed to"},{"line_number":22,"context_line":"  validate tokens. Since it was the primary at some point in time, its"},{"line_number":23,"context_line":"  existence in the key repository is justified because keystone needs the"},{"line_number":24,"context_line":"  ability to validate tokens that were created with old primary keys. This key"},{"line_number":25,"context_line":"  is always named higher than ``1`` in the key repository, since ``1`` is"},{"line_number":26,"context_line":"  reserved for the primary key."}],"source_content_type":"text/x-rst","patch_set":6,"id":"da85f559_21034c11","line":23,"updated":"2015-11-13 16:42:03.000000000","message":"suggest: per guidelines, keep an eye on sentence length when possible. maybe something like \"....existence in the key repository is justified. Keystone needs the....\" as an example.","commit_id":"e9021acbbe97b1c6c88ba6a2b963d879fcefbf7d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c96f1c87f8b4b05c75d0e30b51e7f24ad45f4762","unresolved":false,"context_lines":[{"line_number":20,"context_line":"* Secondary Key: Secondary key was at one point a primary key, but has"},{"line_number":21,"context_line":"  since been demoted in place of another primary. It is only allowed to"},{"line_number":22,"context_line":"  validate tokens. Since it was the primary at some point in time, its"},{"line_number":23,"context_line":"  existence in the key repository is justified because keystone needs the"},{"line_number":24,"context_line":"  ability to validate tokens that were created with old primary keys. This key"},{"line_number":25,"context_line":"  is always named higher than ``1`` in the key repository, since ``1`` is"},{"line_number":26,"context_line":"  reserved for the primary key."}],"source_content_type":"text/x-rst","patch_set":6,"id":"da85f559_d0ba48c0","line":23,"in_reply_to":"da85f559_21034c11","updated":"2015-11-13 20:11:24.000000000","message":"Nice, good catch.","commit_id":"e9021acbbe97b1c6c88ba6a2b963d879fcefbf7d"},{"author":{"_account_id":17832,"name":"Linette Williams","email":"stemke@us.ibm.com","username":"lwilliams"},"change_message_id":"10ac863edd4f621bd4a1944ab3d9f1b60bcdcf6e","unresolved":false,"context_lines":[{"line_number":25,"context_line":"  is always named higher than ``1`` in the key repository, since ``1`` is"},{"line_number":26,"context_line":"  reserved for the primary key."},{"line_number":27,"context_line":"* Staged Key: The staged key is a special key that shares some similarities"},{"line_number":28,"context_line":"  with secondary keys. The can only ever be one staged key in a repository and"},{"line_number":29,"context_line":"  it must exist. Just like secondary keys, staged keys have the ability to"},{"line_number":30,"context_line":"  validate tokens. Unlike secondary keys, staged keys have never been a primary"},{"line_number":31,"context_line":"  key. In fact, they are opposites in that since because a staged key will"}],"source_content_type":"text/x-rst","patch_set":6,"id":"da85f559_4413fe5c","line":28,"updated":"2015-11-13 16:42:03.000000000","message":"typo: The can only... change to \"There can only...\"","commit_id":"e9021acbbe97b1c6c88ba6a2b963d879fcefbf7d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c96f1c87f8b4b05c75d0e30b51e7f24ad45f4762","unresolved":false,"context_lines":[{"line_number":25,"context_line":"  is always named higher than ``1`` in the key repository, since ``1`` is"},{"line_number":26,"context_line":"  reserved for the primary key."},{"line_number":27,"context_line":"* Staged Key: The staged key is a special key that shares some similarities"},{"line_number":28,"context_line":"  with secondary keys. The can only ever be one staged key in a repository and"},{"line_number":29,"context_line":"  it must exist. Just like secondary keys, staged keys have the ability to"},{"line_number":30,"context_line":"  validate tokens. Unlike secondary keys, staged keys have never been a primary"},{"line_number":31,"context_line":"  key. In fact, they are opposites in that since because a staged key will"}],"source_content_type":"text/x-rst","patch_set":6,"id":"da85f559_5092d858","line":28,"in_reply_to":"da85f559_4413fe5c","updated":"2015-11-13 20:11:24.000000000","message":"Done","commit_id":"e9021acbbe97b1c6c88ba6a2b963d879fcefbf7d"},{"author":{"_account_id":17832,"name":"Linette Williams","email":"stemke@us.ibm.com","username":"lwilliams"},"change_message_id":"10ac863edd4f621bd4a1944ab3d9f1b60bcdcf6e","unresolved":false,"context_lines":[{"line_number":28,"context_line":"  with secondary keys. The can only ever be one staged key in a repository and"},{"line_number":29,"context_line":"  it must exist. Just like secondary keys, staged keys have the ability to"},{"line_number":30,"context_line":"  validate tokens. Unlike secondary keys, staged keys have never been a primary"},{"line_number":31,"context_line":"  key. In fact, they are opposites in that since because a staged key will"},{"line_number":32,"context_line":"  always be the next primary key. This helps clarify the name they carry"},{"line_number":33,"context_line":"  because they are the next key **staged** to be the primary key. This key is"},{"line_number":34,"context_line":"  always named as ``0`` in the key repository."}],"source_content_type":"text/x-rst","patch_set":6,"id":"da85f559_c425aeae","line":31,"updated":"2015-11-13 16:42:03.000000000","message":"suggest something like: In fact, they are opposites since the staged key is always the next primary key? (wording was a little awkward for me)","commit_id":"e9021acbbe97b1c6c88ba6a2b963d879fcefbf7d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c96f1c87f8b4b05c75d0e30b51e7f24ad45f4762","unresolved":false,"context_lines":[{"line_number":28,"context_line":"  with secondary keys. The can only ever be one staged key in a repository and"},{"line_number":29,"context_line":"  it must exist. Just like secondary keys, staged keys have the ability to"},{"line_number":30,"context_line":"  validate tokens. Unlike secondary keys, staged keys have never been a primary"},{"line_number":31,"context_line":"  key. In fact, they are opposites in that since because a staged key will"},{"line_number":32,"context_line":"  always be the next primary key. This helps clarify the name they carry"},{"line_number":33,"context_line":"  because they are the next key **staged** to be the primary key. This key is"},{"line_number":34,"context_line":"  always named as ``0`` in the key repository."}],"source_content_type":"text/x-rst","patch_set":6,"id":"da85f559_10c1b02e","line":31,"in_reply_to":"da85f559_c425aeae","updated":"2015-11-13 20:11:24.000000000","message":"Done","commit_id":"e9021acbbe97b1c6c88ba6a2b963d879fcefbf7d"},{"author":{"_account_id":17832,"name":"Linette Williams","email":"stemke@us.ibm.com","username":"lwilliams"},"change_message_id":"10ac863edd4f621bd4a1944ab3d9f1b60bcdcf6e","unresolved":false,"context_lines":[{"line_number":36,"context_line":"So, how does a staged key help me and why do I care about it?"},{"line_number":37,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Fernet keys have a natural life-cycle. Each key starts as a staged key, is"},{"line_number":40,"context_line":"promoted to be the primary key, and then demoted to the secondary key. Only the"},{"line_number":41,"context_line":"primary key can actually create new keystone tokens but all key types can"},{"line_number":42,"context_line":"validate tokens. The staged key is special given the order of events and the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"da85f559_043416dc","line":39,"updated":"2015-11-13 16:42:03.000000000","message":"lifecycle","commit_id":"e9021acbbe97b1c6c88ba6a2b963d879fcefbf7d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c96f1c87f8b4b05c75d0e30b51e7f24ad45f4762","unresolved":false,"context_lines":[{"line_number":36,"context_line":"So, how does a staged key help me and why do I care about it?"},{"line_number":37,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Fernet keys have a natural life-cycle. Each key starts as a staged key, is"},{"line_number":40,"context_line":"promoted to be the primary key, and then demoted to the secondary key. Only the"},{"line_number":41,"context_line":"primary key can actually create new keystone tokens but all key types can"},{"line_number":42,"context_line":"validate tokens. The staged key is special given the order of events and the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"da85f559_f0daec16","line":39,"in_reply_to":"da85f559_043416dc","updated":"2015-11-13 20:11:24.000000000","message":"Done","commit_id":"e9021acbbe97b1c6c88ba6a2b963d879fcefbf7d"},{"author":{"_account_id":17832,"name":"Linette Williams","email":"stemke@us.ibm.com","username":"lwilliams"},"change_message_id":"10ac863edd4f621bd4a1944ab3d9f1b60bcdcf6e","unresolved":false,"context_lines":[{"line_number":215,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"Using Fernet tokens requires some awareness around token expiration and the key"},{"line_number":218,"context_line":"life-cycle. You do not want to rotate so often that secondary keys are removed"},{"line_number":219,"context_line":"that might still be needed to decrypt unexpired tokens. If this happens, you"},{"line_number":220,"context_line":"will not be able to decrypt the token because the key the was used to create it"},{"line_number":221,"context_line":"is now gone. Only remove keys that you know are not being used to create or"}],"source_content_type":"text/x-rst","patch_set":6,"id":"da85f559_8456c604","line":218,"updated":"2015-11-13 16:42:03.000000000","message":"lifecycle","commit_id":"e9021acbbe97b1c6c88ba6a2b963d879fcefbf7d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c96f1c87f8b4b05c75d0e30b51e7f24ad45f4762","unresolved":false,"context_lines":[{"line_number":215,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"Using Fernet tokens requires some awareness around token expiration and the key"},{"line_number":218,"context_line":"life-cycle. You do not want to rotate so often that secondary keys are removed"},{"line_number":219,"context_line":"that might still be needed to decrypt unexpired tokens. If this happens, you"},{"line_number":220,"context_line":"will not be able to decrypt the token because the key the was used to create it"},{"line_number":221,"context_line":"is now gone. Only remove keys that you know are not being used to create or"}],"source_content_type":"text/x-rst","patch_set":6,"id":"da85f559_30f8747c","line":218,"in_reply_to":"da85f559_8456c604","updated":"2015-11-13 20:11:24.000000000","message":"Done","commit_id":"e9021acbbe97b1c6c88ba6a2b963d879fcefbf7d"},{"author":{"_account_id":17832,"name":"Linette Williams","email":"stemke@us.ibm.com","username":"lwilliams"},"change_message_id":"fd53e7e2c4adee4c6c2e1868e6edd95f5908ed7f","unresolved":false,"context_lines":[{"line_number":19,"context_line":"  allowed to encrypt and decrypt tokens. This key is always named as the"},{"line_number":20,"context_line":"  highest index in the repository."},{"line_number":21,"context_line":"Secondary key:"},{"line_number":22,"context_line":"  Secondary key was at one point a primary key, but has been demoted in place"},{"line_number":23,"context_line":"  of another primary key. It is only allowed to decrypt tokens. Since it was"},{"line_number":24,"context_line":"  the primary at some point in time, its existence in the key repository is"},{"line_number":25,"context_line":"  justified. Keystone needs to be able to decrypt tokens that were created with"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da85f559_f3ee71b3","line":22,"updated":"2015-11-13 20:42:47.000000000","message":"\"The secondary key...\" patch 7 is still missing the article that Andreas listed.","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f8d41f72fb5bd9c11d2e57cf3d04095a8bb720c2","unresolved":false,"context_lines":[{"line_number":19,"context_line":"  allowed to encrypt and decrypt tokens. This key is always named as the"},{"line_number":20,"context_line":"  highest index in the repository."},{"line_number":21,"context_line":"Secondary key:"},{"line_number":22,"context_line":"  Secondary key was at one point a primary key, but has been demoted in place"},{"line_number":23,"context_line":"  of another primary key. It is only allowed to decrypt tokens. Since it was"},{"line_number":24,"context_line":"  the primary at some point in time, its existence in the key repository is"},{"line_number":25,"context_line":"  justified. Keystone needs to be able to decrypt tokens that were created with"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ba8a016a_e86d49cd","line":22,"in_reply_to":"da85f559_f3ee71b3","updated":"2015-11-16 14:54:30.000000000","message":"Done, changed from \"Secondary key\" to \"A secondary key ..\" to avoid the confusion of only having a single secondary key. \n\nWhich article is missing?","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8e2f06dc5b29ce3f344056597ae11b939a57cf9c","unresolved":false,"context_lines":[{"line_number":39,"context_line":"Fernet keys have a natural lifecycle. Each key starts as a staged key, is"},{"line_number":40,"context_line":"promoted to be the primary key, and then demoted to be a secondary key. New"},{"line_number":41,"context_line":"tokens can only be encrypted with a primary key. Secondary and staged keys are"},{"line_number":42,"context_line":"never used to encrypt token. The staged key is special given the order of"},{"line_number":43,"context_line":"events and the attributes of each type of key. The staged key is the only key"},{"line_number":44,"context_line":"in the repository that has not had a chance to create any tokens yet, but it is"},{"line_number":45,"context_line":"still allowed to decrypt tokens. As an operator, this gives you the chance to"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da85f559_08297237","line":42,"updated":"2015-11-14 13:40:01.000000000","message":"\"The staged key is special ... \" key?","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f8d41f72fb5bd9c11d2e57cf3d04095a8bb720c2","unresolved":false,"context_lines":[{"line_number":39,"context_line":"Fernet keys have a natural lifecycle. Each key starts as a staged key, is"},{"line_number":40,"context_line":"promoted to be the primary key, and then demoted to be a secondary key. New"},{"line_number":41,"context_line":"tokens can only be encrypted with a primary key. Secondary and staged keys are"},{"line_number":42,"context_line":"never used to encrypt token. The staged key is special given the order of"},{"line_number":43,"context_line":"events and the attributes of each type of key. The staged key is the only key"},{"line_number":44,"context_line":"in the repository that has not had a chance to create any tokens yet, but it is"},{"line_number":45,"context_line":"still allowed to decrypt tokens. As an operator, this gives you the chance to"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ba8a016a_08f8cde4","line":42,"in_reply_to":"da85f559_08297237","updated":"2015-11-16 14:54:30.000000000","message":"Done","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8e2f06dc5b29ce3f344056597ae11b939a57cf9c","unresolved":false,"context_lines":[{"line_number":41,"context_line":"tokens can only be encrypted with a primary key. Secondary and staged keys are"},{"line_number":42,"context_line":"never used to encrypt token. The staged key is special given the order of"},{"line_number":43,"context_line":"events and the attributes of each type of key. The staged key is the only key"},{"line_number":44,"context_line":"in the repository that has not had a chance to create any tokens yet, but it is"},{"line_number":45,"context_line":"still allowed to decrypt tokens. As an operator, this gives you the chance to"},{"line_number":46,"context_line":"perform a key rotation on one keystone node, and distribute the new key set"},{"line_number":47,"context_line":"over a span of time. This does not require the distribution to take place in an"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da85f559_a820664a","line":44,"updated":"2015-11-14 13:40:01.000000000","message":"\"create\"? it doesn\u0027t really create, how about encrypt?","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f8d41f72fb5bd9c11d2e57cf3d04095a8bb720c2","unresolved":false,"context_lines":[{"line_number":41,"context_line":"tokens can only be encrypted with a primary key. Secondary and staged keys are"},{"line_number":42,"context_line":"never used to encrypt token. The staged key is special given the order of"},{"line_number":43,"context_line":"events and the attributes of each type of key. The staged key is the only key"},{"line_number":44,"context_line":"in the repository that has not had a chance to create any tokens yet, but it is"},{"line_number":45,"context_line":"still allowed to decrypt tokens. As an operator, this gives you the chance to"},{"line_number":46,"context_line":"perform a key rotation on one keystone node, and distribute the new key set"},{"line_number":47,"context_line":"over a span of time. This does not require the distribution to take place in an"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ba8a016a_02a42c55","line":44,"in_reply_to":"da85f559_a820664a","updated":"2015-11-16 14:54:30.000000000","message":"Done","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8e2f06dc5b29ce3f344056597ae11b939a57cf9c","unresolved":false,"context_lines":[{"line_number":53,"context_line":""},{"line_number":54,"context_line":"The ``key_repository`` configuration option will tell keystone where to look"},{"line_number":55,"context_line":"for keys. Currently, keystone only supports file-backed key repositories. By"},{"line_number":56,"context_line":"default, the key repository lives in the keystone configuration directory but"},{"line_number":57,"context_line":"it can be specified through keystone\u0027s configuration file:"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"..code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da85f559_88ec82f4","line":56,"updated":"2015-11-14 13:40:01.000000000","message":"the addition of \"keystone configuration directory\" seems weird.\n\n\"... the key repository lives in the directory specified by the ``key_repository`` option in keystone\u0027s configuration file\":","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f8d41f72fb5bd9c11d2e57cf3d04095a8bb720c2","unresolved":false,"context_lines":[{"line_number":53,"context_line":""},{"line_number":54,"context_line":"The ``key_repository`` configuration option will tell keystone where to look"},{"line_number":55,"context_line":"for keys. Currently, keystone only supports file-backed key repositories. By"},{"line_number":56,"context_line":"default, the key repository lives in the keystone configuration directory but"},{"line_number":57,"context_line":"it can be specified through keystone\u0027s configuration file:"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"..code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ba8a016a_05f8b6e4","line":56,"in_reply_to":"da85f559_88ec82f4","updated":"2015-11-16 14:54:30.000000000","message":"Done","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8e2f06dc5b29ce3f344056597ae11b939a57cf9c","unresolved":false,"context_lines":[{"line_number":64,"context_line":"What is the recommended way to rotate and distribute keys?"},{"line_number":65,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Keystone has a key rotation mechanism built into the ``keystone-manage``"},{"line_number":68,"context_line":"command line utility. This mechanism only rotates keys and does not make an"},{"line_number":69,"context_line":"effort to distribute keys across keystone nodes. The distribution of keys"},{"line_number":70,"context_line":"across a keystone deployment is best handled through configuration management"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da85f559_08b732f6","line":67,"updated":"2015-11-14 13:40:01.000000000","message":"this can be said in fewer words:\n\n\"The ``keystone-manage`` command line utility includes a key rotation mechanism.\"","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f8d41f72fb5bd9c11d2e57cf3d04095a8bb720c2","unresolved":false,"context_lines":[{"line_number":64,"context_line":"What is the recommended way to rotate and distribute keys?"},{"line_number":65,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Keystone has a key rotation mechanism built into the ``keystone-manage``"},{"line_number":68,"context_line":"command line utility. This mechanism only rotates keys and does not make an"},{"line_number":69,"context_line":"effort to distribute keys across keystone nodes. The distribution of keys"},{"line_number":70,"context_line":"across a keystone deployment is best handled through configuration management"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ba8a016a_65f182cd","line":67,"in_reply_to":"da85f559_08b732f6","updated":"2015-11-16 14:54:30.000000000","message":"Done","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8e2f06dc5b29ce3f344056597ae11b939a57cf9c","unresolved":false,"context_lines":[{"line_number":78,"context_line":"Why should I choose Fernet tokens over UUID tokens?"},{"line_number":79,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Even though Fernet tokens operate very similar to UUID tokens, they do not"},{"line_number":82,"context_line":"require persistence. The database no longer suffers bloat as a side effect of"},{"line_number":83,"context_line":"authentication. You should not have to prune expired tokens from the database"},{"line_number":84,"context_line":"when using Fernet tokens. Because Fernet tokens do not require persistence,"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da85f559_28a1d6a9","line":81,"updated":"2015-11-14 13:40:01.000000000","message":"similarly*","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f8d41f72fb5bd9c11d2e57cf3d04095a8bb720c2","unresolved":false,"context_lines":[{"line_number":78,"context_line":"Why should I choose Fernet tokens over UUID tokens?"},{"line_number":79,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Even though Fernet tokens operate very similar to UUID tokens, they do not"},{"line_number":82,"context_line":"require persistence. The database no longer suffers bloat as a side effect of"},{"line_number":83,"context_line":"authentication. You should not have to prune expired tokens from the database"},{"line_number":84,"context_line":"when using Fernet tokens. Because Fernet tokens do not require persistence,"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ba8a016a_859ca66a","line":81,"in_reply_to":"da85f559_28a1d6a9","updated":"2015-11-16 14:54:30.000000000","message":"Done","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8e2f06dc5b29ce3f344056597ae11b939a57cf9c","unresolved":false,"context_lines":[{"line_number":79,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Even though Fernet tokens operate very similar to UUID tokens, they do not"},{"line_number":82,"context_line":"require persistence. The database no longer suffers bloat as a side effect of"},{"line_number":83,"context_line":"authentication. You should not have to prune expired tokens from the database"},{"line_number":84,"context_line":"when using Fernet tokens. Because Fernet tokens do not require persistence,"},{"line_number":85,"context_line":"they do not have to be replicated. As long as each keystone node shares the"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da85f559_e8aaee84","line":82,"updated":"2015-11-14 13:40:01.000000000","message":"The *keystone token* database will no longer suffer*","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f8d41f72fb5bd9c11d2e57cf3d04095a8bb720c2","unresolved":false,"context_lines":[{"line_number":79,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Even though Fernet tokens operate very similar to UUID tokens, they do not"},{"line_number":82,"context_line":"require persistence. The database no longer suffers bloat as a side effect of"},{"line_number":83,"context_line":"authentication. You should not have to prune expired tokens from the database"},{"line_number":84,"context_line":"when using Fernet tokens. Because Fernet tokens do not require persistence,"},{"line_number":85,"context_line":"they do not have to be replicated. As long as each keystone node shares the"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ba8a016a_458d5e30","line":82,"in_reply_to":"da85f559_e8aaee84","updated":"2015-11-16 14:54:30.000000000","message":"Done","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8e2f06dc5b29ce3f344056597ae11b939a57cf9c","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Even though Fernet tokens operate very similar to UUID tokens, they do not"},{"line_number":82,"context_line":"require persistence. The database no longer suffers bloat as a side effect of"},{"line_number":83,"context_line":"authentication. You should not have to prune expired tokens from the database"},{"line_number":84,"context_line":"when using Fernet tokens. Because Fernet tokens do not require persistence,"},{"line_number":85,"context_line":"they do not have to be replicated. As long as each keystone node shares the"},{"line_number":86,"context_line":"same key repository, Fernet tokens can be created and validated instantly"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da85f559_689fde5f","line":83,"updated":"2015-11-14 13:40:01.000000000","message":"Pruning expired tokens from the token database will no longer be necessary when using Fernet Tokens","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f8d41f72fb5bd9c11d2e57cf3d04095a8bb720c2","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Even though Fernet tokens operate very similar to UUID tokens, they do not"},{"line_number":82,"context_line":"require persistence. The database no longer suffers bloat as a side effect of"},{"line_number":83,"context_line":"authentication. You should not have to prune expired tokens from the database"},{"line_number":84,"context_line":"when using Fernet tokens. Because Fernet tokens do not require persistence,"},{"line_number":85,"context_line":"they do not have to be replicated. As long as each keystone node shares the"},{"line_number":86,"context_line":"same key repository, Fernet tokens can be created and validated instantly"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ba8a016a_05b516cc","line":83,"in_reply_to":"da85f559_689fde5f","updated":"2015-11-16 14:54:30.000000000","message":"Done","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8e2f06dc5b29ce3f344056597ae11b939a57cf9c","unresolved":false,"context_lines":[{"line_number":84,"context_line":"when using Fernet tokens. Because Fernet tokens do not require persistence,"},{"line_number":85,"context_line":"they do not have to be replicated. As long as each keystone node shares the"},{"line_number":86,"context_line":"same key repository, Fernet tokens can be created and validated instantly"},{"line_number":87,"context_line":"across hosts."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Why should I choose Fernet tokens over PKI or PKIZ tokens?"},{"line_number":90,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da85f559_a87ce620","line":87,"updated":"2015-11-14 13:40:01.000000000","message":"we\u0027ve been using \u0027nodes\u0027, suggest nodes and not \u0027hosts\u0027","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f8d41f72fb5bd9c11d2e57cf3d04095a8bb720c2","unresolved":false,"context_lines":[{"line_number":84,"context_line":"when using Fernet tokens. Because Fernet tokens do not require persistence,"},{"line_number":85,"context_line":"they do not have to be replicated. As long as each keystone node shares the"},{"line_number":86,"context_line":"same key repository, Fernet tokens can be created and validated instantly"},{"line_number":87,"context_line":"across hosts."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Why should I choose Fernet tokens over PKI or PKIZ tokens?"},{"line_number":90,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ba8a016a_e5e6d2e7","line":87,"in_reply_to":"da85f559_a87ce620","updated":"2015-11-16 14:54:30.000000000","message":"Done","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8e2f06dc5b29ce3f344056597ae11b939a57cf9c","unresolved":false,"context_lines":[{"line_number":93,"context_line":"addition to the fact that Fernet tokens are much smaller than PKI and PKIZ"},{"line_number":94,"context_line":"tokens. PKI and PKIZ tokens still require persistent storage and can sometimes"},{"line_number":95,"context_line":"cause issues due to their size. This issue is mitigated when switching to"},{"line_number":96,"context_line":"Fernet because Fernet tokens are kept under a 250 byte limit."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Should I rotate and distribute keys from the same keystone node every rotation?"},{"line_number":99,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":7,"id":"da85f559_6876fe3f","line":96,"updated":"2015-11-14 13:40:01.000000000","message":"include a sample size of pki and pkiz to give the reader a number to compare to","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f8d41f72fb5bd9c11d2e57cf3d04095a8bb720c2","unresolved":false,"context_lines":[{"line_number":93,"context_line":"addition to the fact that Fernet tokens are much smaller than PKI and PKIZ"},{"line_number":94,"context_line":"tokens. PKI and PKIZ tokens still require persistent storage and can sometimes"},{"line_number":95,"context_line":"cause issues due to their size. This issue is mitigated when switching to"},{"line_number":96,"context_line":"Fernet because Fernet tokens are kept under a 250 byte limit."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Should I rotate and distribute keys from the same keystone node every rotation?"},{"line_number":99,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ba8a016a_c574eed0","line":96,"in_reply_to":"da85f559_6876fe3f","updated":"2015-11-16 14:54:30.000000000","message":"Done","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":9382,"name":"Shilla Saebi","email":"shilla.saebi@gmail.com","username":"shillasaebi"},"change_message_id":"fcb684e2b80e393030e904642dcb7c0d9e4fdc32","unresolved":false,"context_lines":[{"line_number":181,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"The Fernet tokens that keystone creates are only secure as the keys creating"},{"line_number":184,"context_line":"them. With staged keys the penalty of key rotation is low, allowing an you to"},{"line_number":185,"context_line":"err on the side of security and rotate weekly, daily, or even hourly."},{"line_number":186,"context_line":"Ultimately, this should be less time than it takes an attacker to break a"},{"line_number":187,"context_line":"``AES256`` key and a ``SHA256 HMAC``."}],"source_content_type":"text/x-rst","patch_set":7,"id":"da85f559_acaac3d0","line":184,"updated":"2015-11-13 22:44:56.000000000","message":"allowing an you to err on the side...\nI\u0027m not sure that \"allowing an\" makes sense?","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f8d41f72fb5bd9c11d2e57cf3d04095a8bb720c2","unresolved":false,"context_lines":[{"line_number":181,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"The Fernet tokens that keystone creates are only secure as the keys creating"},{"line_number":184,"context_line":"them. With staged keys the penalty of key rotation is low, allowing an you to"},{"line_number":185,"context_line":"err on the side of security and rotate weekly, daily, or even hourly."},{"line_number":186,"context_line":"Ultimately, this should be less time than it takes an attacker to break a"},{"line_number":187,"context_line":"``AES256`` key and a ``SHA256 HMAC``."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ba8a016a_a55e8a43","line":184,"in_reply_to":"da85f559_acaac3d0","updated":"2015-11-16 14:54:30.000000000","message":"Done","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8e2f06dc5b29ce3f344056597ae11b939a57cf9c","unresolved":false,"context_lines":[{"line_number":189,"context_line":"Is a Fernet token still a bearer token?"},{"line_number":190,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"Yes, and they follow exactly the same validation path as ``uuid`` tokens, with"},{"line_number":193,"context_line":"the exception of being written to, and read from, a back end. If someone"},{"line_number":194,"context_line":"compromises your Fernet token, they have the power to do all the operations you"},{"line_number":195,"context_line":"are allowed to do."}],"source_content_type":"text/x-rst","patch_set":7,"id":"da85f559_e898ae6c","line":192,"updated":"2015-11-14 13:40:01.000000000","message":"we say UUID early, suggest that over ``uuid``","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f8d41f72fb5bd9c11d2e57cf3d04095a8bb720c2","unresolved":false,"context_lines":[{"line_number":189,"context_line":"Is a Fernet token still a bearer token?"},{"line_number":190,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"Yes, and they follow exactly the same validation path as ``uuid`` tokens, with"},{"line_number":193,"context_line":"the exception of being written to, and read from, a back end. If someone"},{"line_number":194,"context_line":"compromises your Fernet token, they have the power to do all the operations you"},{"line_number":195,"context_line":"are allowed to do."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ba8a016a_852ca6ac","line":192,"in_reply_to":"da85f559_e898ae6c","updated":"2015-11-16 14:54:30.000000000","message":"Done","commit_id":"2180f0c381413fb869a989c3f8c4f68afc7fac41"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"71f0b9f0c604ba2c39b8378be985cf4497f007bf","unresolved":false,"context_lines":[{"line_number":41,"context_line":"tokens can only be encrypted with a primary key. Secondary and staged keys are"},{"line_number":42,"context_line":"never used to encrypt token. The staged key is a special key given the order of"},{"line_number":43,"context_line":"events and the attributes of each type of key. The staged key is the only key"},{"line_number":44,"context_line":"in the repository that has not had a chance to create any tokens yet, but it is"},{"line_number":45,"context_line":"still allowed to decrypt tokens. As an operator, this gives you the chance to"},{"line_number":46,"context_line":"perform a key rotation on one keystone node, and distribute the new key set"},{"line_number":47,"context_line":"over a span of time. This does not require the distribution to take place in an"}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba8a016a_4ca49b56","line":44,"updated":"2015-11-16 19:21:35.000000000","message":"s/create/encrypt","commit_id":"727e7eca7e3395913413d3538033bb96c693e84a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"98679bd2ac9bef231ca501f108e874bb4361aefd","unresolved":false,"context_lines":[{"line_number":41,"context_line":"tokens can only be encrypted with a primary key. Secondary and staged keys are"},{"line_number":42,"context_line":"never used to encrypt token. The staged key is a special key given the order of"},{"line_number":43,"context_line":"events and the attributes of each type of key. The staged key is the only key"},{"line_number":44,"context_line":"in the repository that has not had a chance to create any tokens yet, but it is"},{"line_number":45,"context_line":"still allowed to decrypt tokens. As an operator, this gives you the chance to"},{"line_number":46,"context_line":"perform a key rotation on one keystone node, and distribute the new key set"},{"line_number":47,"context_line":"over a span of time. This does not require the distribution to take place in an"}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba8a016a_555c1a25","line":44,"in_reply_to":"ba8a016a_4ca49b56","updated":"2015-11-16 20:01:48.000000000","message":"Done","commit_id":"727e7eca7e3395913413d3538033bb96c693e84a"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"71f0b9f0c604ba2c39b8378be985cf4497f007bf","unresolved":false,"context_lines":[{"line_number":51,"context_line":"Where do I put my key repository?"},{"line_number":52,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"The key repository is specified using the ``key_repository`` option in the"},{"line_number":55,"context_line":"keystone configuration file. The keystone process should be able to read and"},{"line_number":56,"context_line":"write to this location but it should be kept secret otherwise. Currently,"},{"line_number":57,"context_line":"keystone only supports file-backed key repositories."}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba8a016a_acaae717","line":54,"updated":"2015-11-16 19:21:35.000000000","message":"nice clean up","commit_id":"727e7eca7e3395913413d3538033bb96c693e84a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"98679bd2ac9bef231ca501f108e874bb4361aefd","unresolved":false,"context_lines":[{"line_number":51,"context_line":"Where do I put my key repository?"},{"line_number":52,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"The key repository is specified using the ``key_repository`` option in the"},{"line_number":55,"context_line":"keystone configuration file. The keystone process should be able to read and"},{"line_number":56,"context_line":"write to this location but it should be kept secret otherwise. Currently,"},{"line_number":57,"context_line":"keystone only supports file-backed key repositories."}],"source_content_type":"text/x-rst","patch_set":8,"id":"ba8a016a_f5418e3a","line":54,"in_reply_to":"ba8a016a_acaae717","updated":"2015-11-16 20:01:48.000000000","message":"Thanks!","commit_id":"727e7eca7e3395913413d3538033bb96c693e84a"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"141669c766250ac19e739bc05271a1e274795c39","unresolved":false,"context_lines":[{"line_number":96,"context_line":"fernet because fernet tokens are kept under a 250 byte limit. PKI and PKIZ"},{"line_number":97,"context_line":"tokens typically exceed 1600 bytes in length. The length of a PKI or PKIZ token"},{"line_number":98,"context_line":"is dependent on the size of the deployment. Bigger service catalogs will result"},{"line_number":99,"context_line":"in longer token lengths. This pattern doesn\u0027t exist with fernet tokens because"},{"line_number":100,"context_line":"the contents of the encrypted payload is kept to a minimum."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"Should I rotate and distribute keys from the same keystone node every rotation?"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba8a016a_025c0f4a","line":99,"updated":"2015-11-17 00:18:11.000000000","message":"does not*","commit_id":"dea310ce6cb32555f7f768e525359e03eb201fe0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ece8e6a6a94dfb874d1194a282a8968f55eeade4","unresolved":false,"context_lines":[{"line_number":96,"context_line":"fernet because fernet tokens are kept under a 250 byte limit. PKI and PKIZ"},{"line_number":97,"context_line":"tokens typically exceed 1600 bytes in length. The length of a PKI or PKIZ token"},{"line_number":98,"context_line":"is dependent on the size of the deployment. Bigger service catalogs will result"},{"line_number":99,"context_line":"in longer token lengths. This pattern doesn\u0027t exist with fernet tokens because"},{"line_number":100,"context_line":"the contents of the encrypted payload is kept to a minimum."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"Should I rotate and distribute keys from the same keystone node every rotation?"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba8a016a_3bc79997","line":99,"in_reply_to":"ba8a016a_025c0f4a","updated":"2015-11-18 15:33:59.000000000","message":"Done","commit_id":"dea310ce6cb32555f7f768e525359e03eb201fe0"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"141669c766250ac19e739bc05271a1e274795c39","unresolved":false,"context_lines":[{"line_number":153,"context_line":"        i) If no, investigate issues with the particular keystone node you"},{"line_number":154,"context_line":"           rotated keys on. Fernet keys are small and the operation for"},{"line_number":155,"context_line":"           rotation is trivial. There should not be much room for error in key"},{"line_number":156,"context_line":"           rotation. It\u0027s possible that the user does not have the ability to"},{"line_number":157,"context_line":"           write new keys to the key repository. Log output from"},{"line_number":158,"context_line":"           ``keystone-manage fernet_rotate`` should give more information into"},{"line_number":159,"context_line":"           specific failures."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba8a016a_c255a71d","line":156,"updated":"2015-11-17 00:18:11.000000000","message":"It is*","commit_id":"dea310ce6cb32555f7f768e525359e03eb201fe0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ece8e6a6a94dfb874d1194a282a8968f55eeade4","unresolved":false,"context_lines":[{"line_number":153,"context_line":"        i) If no, investigate issues with the particular keystone node you"},{"line_number":154,"context_line":"           rotated keys on. Fernet keys are small and the operation for"},{"line_number":155,"context_line":"           rotation is trivial. There should not be much room for error in key"},{"line_number":156,"context_line":"           rotation. It\u0027s possible that the user does not have the ability to"},{"line_number":157,"context_line":"           write new keys to the key repository. Log output from"},{"line_number":158,"context_line":"           ``keystone-manage fernet_rotate`` should give more information into"},{"line_number":159,"context_line":"           specific failures."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba8a016a_9b44851b","line":156,"in_reply_to":"ba8a016a_c255a71d","updated":"2015-11-18 15:33:59.000000000","message":"Done","commit_id":"dea310ce6cb32555f7f768e525359e03eb201fe0"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"141669c766250ac19e739bc05271a1e274795c39","unresolved":false,"context_lines":[{"line_number":320,"context_line":"    -rw------- 1 keystone keystone   44 6    (primary key)"},{"line_number":321,"context_line":""},{"line_number":322,"context_line":"If keystone were to receive a token that was created between 6:00 AM and 12:00"},{"line_number":323,"context_line":"PM the day before, encrypted with the ``1`` key, it wouldn\u0027t be valid because"},{"line_number":324,"context_line":"it was already expired. This makes it possible for us to remove the ``1`` key"},{"line_number":325,"context_line":"from the repository without negative validation side-effects."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba8a016a_8236bf01","line":323,"updated":"2015-11-17 00:18:11.000000000","message":"would not*","commit_id":"dea310ce6cb32555f7f768e525359e03eb201fe0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ece8e6a6a94dfb874d1194a282a8968f55eeade4","unresolved":false,"context_lines":[{"line_number":320,"context_line":"    -rw------- 1 keystone keystone   44 6    (primary key)"},{"line_number":321,"context_line":""},{"line_number":322,"context_line":"If keystone were to receive a token that was created between 6:00 AM and 12:00"},{"line_number":323,"context_line":"PM the day before, encrypted with the ``1`` key, it wouldn\u0027t be valid because"},{"line_number":324,"context_line":"it was already expired. This makes it possible for us to remove the ``1`` key"},{"line_number":325,"context_line":"from the repository without negative validation side-effects."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ba8a016a_bbd5c91c","line":323,"in_reply_to":"ba8a016a_8236bf01","updated":"2015-11-18 15:33:59.000000000","message":"Done","commit_id":"dea310ce6cb32555f7f768e525359e03eb201fe0"}]}