)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":18795,"name":"mkarpin","email":"mkarpin@mirantis.com","username":"nkarpin"},"change_message_id":"188411b5dc20e05585883aaa097029ef8bd70bdd","unresolved":false,"context_lines":[{"line_number":13,"context_line":"node and then copy the keys to the others,"},{"line_number":14,"context_line":"deployments using a central configuration server"},{"line_number":15,"context_line":"do not usually follow workflows like this. Instead"},{"line_number":16,"context_line":"the keys are generated off server, and manged in a"},{"line_number":17,"context_line":"central data store."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"This change follows the pattern set for credentials"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"7a8ec9b2_80dfe867","line":16,"range":{"start_line":16,"start_character":39,"end_line":16,"end_character":45},"updated":"2016-09-16 12:31:20.000000000","message":"managed","commit_id":"96b2aed2f5e86766cd4668ae5a0573d926519be9"}],"manifests/init.pp":[{"author":{"_account_id":3153,"name":"Emilien Macchi","email":"emilien@redhat.com","username":"emilienm"},"change_message_id":"a557582a85c463ad1d7899de1ea7e2460b20ab27","unresolved":false,"context_lines":[{"line_number":422,"context_line":"#"},{"line_number":423,"context_line":"# [*fernet_max_active_keys*]"},{"line_number":424,"context_line":"#   (Optional) Number of maximum active Fernet keys. Integer \u003e 0."},{"line_number":425,"context_line":"#   Defaults to $::os_service_default"},{"line_number":426,"context_line":"# [*fernet_keys*]"},{"line_number":427,"context_line":"#   (Optional) Hash of Keystone fernet keys"},{"line_number":428,"context_line":"#   If you enable this parameter, make sure enable_fernet_setup is set to True."}],"source_content_type":"text/x-puppet","patch_set":2,"id":"7a8ec9b2_ef66c9eb","line":425,"updated":"2016-09-16 17:55:00.000000000","message":"add an ligne with \"#\" please.","commit_id":"e9f10cafec319f500a90732e7eab5a6b78d16eaa"},{"author":{"_account_id":7423,"name":"Cody Herriges","email":"cody@herriges.org","username":"ody"},"change_message_id":"91357314130cbf68de9a9f3706ef6f60c149126a","unresolved":false,"context_lines":[{"line_number":435,"context_line":"# [*fernet_keys*]"},{"line_number":436,"context_line":"#   (Optional) Hash of Keystone fernet keys"},{"line_number":437,"context_line":"#   If you enable this parameter, make sure enable_fernet_setup is set to True."},{"line_number":438,"context_line":"#   Example of valid value:"},{"line_number":439,"context_line":"#   fernet_keys:"},{"line_number":440,"context_line":"#     /etc/keystone/fernet-keys/0:"},{"line_number":441,"context_line":"#       content: t-WdduhORSqoyAykuqWAQSYjg2rSRuJYySgI2xh48CI\u003d"}],"source_content_type":"text/x-puppet","patch_set":4,"id":"5a8bc5a2_a2599300","line":438,"updated":"2016-09-23 16:36:10.000000000","message":"This example is misleading as it looks like a python hash instead of a Puppet one and it also doesn\u0027t match acceptance test.","commit_id":"574a807eae061b86346a3005189e87aad3b70152"},{"author":{"_account_id":3153,"name":"Emilien Macchi","email":"emilien@redhat.com","username":"emilienm"},"change_message_id":"ea25dab0f1b0d1830557aff26a931033a0872d60","unresolved":false,"context_lines":[{"line_number":435,"context_line":"# [*fernet_keys*]"},{"line_number":436,"context_line":"#   (Optional) Hash of Keystone fernet keys"},{"line_number":437,"context_line":"#   If you enable this parameter, make sure enable_fernet_setup is set to True."},{"line_number":438,"context_line":"#   Example of valid value:"},{"line_number":439,"context_line":"#   fernet_keys:"},{"line_number":440,"context_line":"#     /etc/keystone/fernet-keys/0:"},{"line_number":441,"context_line":"#       content: t-WdduhORSqoyAykuqWAQSYjg2rSRuJYySgI2xh48CI\u003d"}],"source_content_type":"text/x-puppet","patch_set":4,"id":"5a8bc5a2_d3d90585","line":438,"in_reply_to":"5a8bc5a2_a2599300","updated":"2016-09-24 02:39:47.000000000","message":"yes but if so, please do it for credentials too","commit_id":"574a807eae061b86346a3005189e87aad3b70152"},{"author":{"_account_id":9500,"name":"Matt Fischer","email":"matt@mattfischer.com","username":"mfisch"},"change_message_id":"89d2e0fe001b6b17dfbb1fd2c2528ee8c99b1266","unresolved":false,"context_lines":[{"line_number":445,"context_line":"#   Note: defaults to false so keystone-manage fernet_setup will be executed."},{"line_number":446,"context_line":"#   Otherwise Puppet will manage keys with File resource."},{"line_number":447,"context_line":"#   Defaults to false"},{"line_number":448,"context_line":"#"},{"line_number":449,"context_line":"# [*enable_credential_setup*]"},{"line_number":450,"context_line":"#   (Optional) Setup keystone for credentials."},{"line_number":451,"context_line":"#   In a cluster environment where multiple Keystone nodes are running, you might"}],"source_content_type":"text/x-puppet","patch_set":4,"id":"5a8bc5a2_50a5ebb2","line":448,"updated":"2016-09-24 01:37:33.000000000","message":"other cores: is it worth mentioning here that you should use something like eyaml to store these or is that left to the reader.","commit_id":"574a807eae061b86346a3005189e87aad3b70152"},{"author":{"_account_id":3153,"name":"Emilien Macchi","email":"emilien@redhat.com","username":"emilienm"},"change_message_id":"ea25dab0f1b0d1830557aff26a931033a0872d60","unresolved":false,"context_lines":[{"line_number":445,"context_line":"#   Note: defaults to false so keystone-manage fernet_setup will be executed."},{"line_number":446,"context_line":"#   Otherwise Puppet will manage keys with File resource."},{"line_number":447,"context_line":"#   Defaults to false"},{"line_number":448,"context_line":"#"},{"line_number":449,"context_line":"# [*enable_credential_setup*]"},{"line_number":450,"context_line":"#   (Optional) Setup keystone for credentials."},{"line_number":451,"context_line":"#   In a cluster environment where multiple Keystone nodes are running, you might"}],"source_content_type":"text/x-puppet","patch_set":4,"id":"5a8bc5a2_93f77df4","line":448,"in_reply_to":"5a8bc5a2_50a5ebb2","updated":"2016-09-24 02:39:47.000000000","message":"yes but if so, please do it for credentials too","commit_id":"574a807eae061b86346a3005189e87aad3b70152"},{"author":{"_account_id":9500,"name":"Matt Fischer","email":"matt@mattfischer.com","username":"mfisch"},"change_message_id":"89d2e0fe001b6b17dfbb1fd2c2528ee8c99b1266","unresolved":false,"context_lines":[{"line_number":1132,"context_line":"      create_resources(\u0027file\u0027, $fernet_keys, {"},{"line_number":1133,"context_line":"          \u0027owner\u0027     \u003d\u003e $keystone_user,"},{"line_number":1134,"context_line":"          \u0027group\u0027     \u003d\u003e $keystone_group,"},{"line_number":1135,"context_line":"          \u0027subscribe\u0027 \u003d\u003e \u0027Anchor[keystone::install::end]\u0027,"},{"line_number":1136,"context_line":"        }"},{"line_number":1137,"context_line":"      )"},{"line_number":1138,"context_line":"    } else {"}],"source_content_type":"text/x-puppet","patch_set":4,"id":"5a8bc5a2_10c5235a","line":1135,"updated":"2016-09-24 01:37:33.000000000","message":"Recommend setting mode \u003d\u003e \u00270600\u0027","commit_id":"574a807eae061b86346a3005189e87aad3b70152"}],"releasenotes/notes/keystone-fernet-setup-227ef6d380519cce.yaml":[{"author":{"_account_id":18795,"name":"mkarpin","email":"mkarpin@mirantis.com","username":"nkarpin"},"change_message_id":"188411b5dc20e05585883aaa097029ef8bd70bdd","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"    Note, if fernet_keys parameter is set to a valid hash, keystone-manage won\u0027t"},{"line_number":10,"context_line":"    be used to generate credential keys but Puppet will manage file resources for each"},{"line_number":11,"context_line":"    key in the hash. It allows  iensures that a the keys are synchronized in a "},{"line_number":12,"context_line":"    multinode environment."}],"source_content_type":"text/x-yaml","patch_set":1,"id":"7a8ec9b2_20f0d4fd","line":11,"updated":"2016-09-16 12:31:20.000000000","message":"please remove an extra space","commit_id":"96b2aed2f5e86766cd4668ae5a0573d926519be9"},{"author":{"_account_id":9500,"name":"Matt Fischer","email":"matt@mattfischer.com","username":"mfisch"},"change_message_id":"89d2e0fe001b6b17dfbb1fd2c2528ee8c99b1266","unresolved":false,"context_lines":[{"line_number":9,"context_line":"    Note, if fernet_keys parameter is set to a valid hash, keystone-manage won\u0027t"},{"line_number":10,"context_line":"    be used to generate credential keys but Puppet will manage file resources for each"},{"line_number":11,"context_line":"    key in the hash. It allows  iensures that a the keys are synchronized in a"},{"line_number":12,"context_line":"    multinode environment."}],"source_content_type":"text/x-yaml","patch_set":4,"id":"5a8bc5a2_30a21faf","line":12,"updated":"2016-09-24 01:37:33.000000000","message":"typo iensures","commit_id":"574a807eae061b86346a3005189e87aad3b70152"},{"author":{"_account_id":18795,"name":"mkarpin","email":"mkarpin@mirantis.com","username":"nkarpin"},"change_message_id":"6618938d78f1398cf012067492d6953ef5d298a5","unresolved":false,"context_lines":[{"line_number":3,"context_line":"  - keystone-manage can be used to setup Keystone Fernet Keys.  Disabled by default"},{"line_number":4,"context_line":"    as long as the proper version of keystone is not in UCA."},{"line_number":5,"context_line":"    Upstream Keystone is moving to Fernet token support as the default provider."},{"line_number":6,"context_line":"    With recent issues witj PKI, Fernet is the only viable token format for"},{"line_number":7,"context_line":"    multisite."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"    Note, if fernet_keys parameter is set to a valid hash, keystone-manage won\u0027t"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"3a98d1f4_58bab724","line":6,"range":{"start_line":6,"start_character":23,"end_line":6,"end_character":27},"updated":"2016-09-29 07:33:19.000000000","message":"nit: with","commit_id":"cf5a131cd70c3c82f2d11c717198f754fdaba7c7"}]}