)]}'
{"security-guide/section_security-services-for-instances.xml":[{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"e14efb6de2e6d5639ece33c3e0cbe584a19cd194","unresolved":false,"context_lines":[{"line_number":89,"context_line":"        attempt to have instances for a tenant reside on as many different hosts"},{"line_number":90,"context_line":"        as possible for availability or fault tolerance reasons.\u003c/para\u003e"},{"line_number":91,"context_line":"      \u003cpara\u003eThe use of scheduler filters may be used to segregate"},{"line_number":92,"context_line":"        customers, data, or even discard machines of the cloud that"},{"line_number":93,"context_line":"        cannot be attested as secure. This generally applies to all"},{"line_number":94,"context_line":"        OpenStack projects offering a scheduler. When building a cloud,"},{"line_number":95,"context_line":"        you may choose to implement scheduling filters for a variety of"}],"source_content_type":"application/xml","patch_set":2,"id":"da86d52c_d2b76883","line":92,"updated":"2015-02-18 19:37:17.000000000","message":"segregate data?","commit_id":"bcd27eeed3ddcb46c35b75bbfe3302988933bcdb"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"e14efb6de2e6d5639ece33c3e0cbe584a19cd194","unresolved":false,"context_lines":[{"line_number":103,"context_line":"          \u003c/listitem\u003e"},{"line_number":104,"context_line":"          \u003clistitem\u003e\u003cpara\u003eImage based filters - This delegates instance"},{"line_number":105,"context_line":"            creation based on the image used, such as the operating"},{"line_number":106,"context_line":"            system of the vm or type of image used.\u003c/para\u003e \u003c/listitem\u003e"},{"line_number":107,"context_line":"          \u003clistitem\u003e\u003cpara\u003eEnvironment based filters - This filter will"},{"line_number":108,"context_line":"            create an instance based on external details such as in a"},{"line_number":109,"context_line":"            specific IP space, across availability zones, or on the"}],"source_content_type":"application/xml","patch_set":2,"id":"da86d52c_d26e88ff","line":106,"updated":"2015-02-18 19:37:17.000000000","message":"VM","commit_id":"bcd27eeed3ddcb46c35b75bbfe3302988933bcdb"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"e14efb6de2e6d5639ece33c3e0cbe584a19cd194","unresolved":false,"context_lines":[{"line_number":114,"context_line":"          \u003c/listitem\u003e"},{"line_number":115,"context_line":"      \u003c/orderedlist\u003e"},{"line_number":116,"context_line":"      \u003cpara\u003eMultiple filters can be applied at once, such as the"},{"line_number":117,"context_line":"        ServerGroupAffinity filter to ensure an instance is created on"},{"line_number":118,"context_line":"        a member of a specific set of hosts and ServerGroupAntiAffinity"},{"line_number":119,"context_line":"        filter to ensure that same instance is not created on another"},{"line_number":120,"context_line":"        specific set of hosts. These filters should be analyzed"}],"source_content_type":"application/xml","patch_set":2,"id":"da86d52c_724a3c84","line":117,"updated":"2015-02-18 19:37:17.000000000","message":"\u003cliteral\u003e on ServerGroupAffinity","commit_id":"bcd27eeed3ddcb46c35b75bbfe3302988933bcdb"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"e14efb6de2e6d5639ece33c3e0cbe584a19cd194","unresolved":false,"context_lines":[{"line_number":115,"context_line":"      \u003c/orderedlist\u003e"},{"line_number":116,"context_line":"      \u003cpara\u003eMultiple filters can be applied at once, such as the"},{"line_number":117,"context_line":"        ServerGroupAffinity filter to ensure an instance is created on"},{"line_number":118,"context_line":"        a member of a specific set of hosts and ServerGroupAntiAffinity"},{"line_number":119,"context_line":"        filter to ensure that same instance is not created on another"},{"line_number":120,"context_line":"        specific set of hosts. These filters should be analyzed"},{"line_number":121,"context_line":"        carefully to ensure they do not conflict with each other and"}],"source_content_type":"application/xml","patch_set":2,"id":"da86d52c_f25d4c49","line":118,"updated":"2015-02-18 19:37:17.000000000","message":"\u003cliteral\u003e on ServerGroupAntiAffinity","commit_id":"bcd27eeed3ddcb46c35b75bbfe3302988933bcdb"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"e14efb6de2e6d5639ece33c3e0cbe584a19cd194","unresolved":false,"context_lines":[{"line_number":127,"context_line":"          \u003cimagedata contentdepth\u003d\"100%\" fileref\u003d\"static/filteringWorkflow1.png\" format\u003d\"PNG\" scalefit\u003d\"1\" width\u003d\"100%\"/\u003e"},{"line_number":128,"context_line":"        \u003c/imageobject\u003e"},{"line_number":129,"context_line":"      \u003c/inlinemediaobject\u003e\u003c/para\u003e"},{"line_number":130,"context_line":"      \u003cpara\u003eThe GroupAffinity and GroupAntiAffinity filters conflict"},{"line_number":131,"context_line":"        and should not both be enabled at the same time.\u003c/para\u003e"},{"line_number":132,"context_line":"      \u003cpara\u003eThe \u003cliteral\u003eDiskFilter\u003c/literal\u003e filter is capable of"},{"line_number":133,"context_line":"        oversubscribing disk space. While not normally an issue, this"}],"source_content_type":"application/xml","patch_set":2,"id":"da86d52c_32544421","line":130,"updated":"2015-02-18 19:37:17.000000000","message":"\u003cliteral\u003e","commit_id":"bcd27eeed3ddcb46c35b75bbfe3302988933bcdb"},{"author":{"_account_id":2807,"name":"Bryan D. Payne","email":"bdpayne@acm.org","username":"bdpayne"},"change_message_id":"e14efb6de2e6d5639ece33c3e0cbe584a19cd194","unresolved":false,"context_lines":[{"line_number":134,"context_line":"        can be a concern on storage devices that are thinly"},{"line_number":135,"context_line":"        provisioned, and this filter should be used with well-tested"},{"line_number":136,"context_line":"        quotas applied.\u003c/para\u003e"},{"line_number":137,"context_line":"      \u003cpara\u003eWe recommend you disable filters that parse things that are"},{"line_number":138,"context_line":"        provided by users or are able to be manipulated such as"},{"line_number":139,"context_line":"        metadata.\u003c/para\u003e"},{"line_number":140,"context_line":"    \u003c/section\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"da86d52c_5228d896","line":137,"updated":"2015-02-18 19:37:17.000000000","message":"/s/things/input/ that is provided","commit_id":"bcd27eeed3ddcb46c35b75bbfe3302988933bcdb"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"5cbbbd4efc8607f351de323148fef505097929d4","unresolved":false,"context_lines":[{"line_number":88,"context_line":"        if data isolation was a primary concern. Conversely one could"},{"line_number":89,"context_line":"        attempt to have instances for a tenant reside on as many different hosts"},{"line_number":90,"context_line":"        as possible for availability or fault tolerance reasons.\u003c/para\u003e"},{"line_number":91,"context_line":"      \u003cpara\u003eThe use of scheduler filters may be used to segregate"},{"line_number":92,"context_line":"        customer data, or even discard machines of the cloud that cannot"},{"line_number":93,"context_line":"        be attested as secure. This generally applies to all OpenStack"},{"line_number":94,"context_line":"        projects offering a scheduler. When building a cloud, you may"}],"source_content_type":"application/xml","patch_set":3,"id":"da86d52c_78185b84","line":91,"updated":"2015-02-18 20:24:40.000000000","message":"use and used - reads badly.\n\nPerhaps: \u0027Scheduler filters may be used to segregate\u0027","commit_id":"3044c0ce9a1af2e34345a35a8fcf08586a18d93c"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"a7239699496609c6df82f5f4471ebae97534d77b","unresolved":false,"context_lines":[{"line_number":94,"context_line":"        offering a scheduler. When building a cloud, you may choose to"},{"line_number":95,"context_line":"        implement scheduling filters for a variety of security-related"},{"line_number":96,"context_line":"        purposes.\u003c/para\u003e"},{"line_number":97,"context_line":"      \u003cpara\u003eSchedulers fall under four main categories:\u003c/para\u003e"},{"line_number":98,"context_line":"      \u003corderedlist\u003e"},{"line_number":99,"context_line":"          \u003clistitem\u003e\u003cpara\u003eResource based filters - These filters will"},{"line_number":100,"context_line":"            create an instance based on the utilization of the"}],"source_content_type":"application/xml","patch_set":4,"id":"da86d52c_ec248cc7","line":97,"updated":"2015-02-18 20:50:59.000000000","message":"should this be \"Scheduler filters fall under...\"?","commit_id":"c18ccf2d84eda85f7c0d689b423dded8005ff31d"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"f527be69ea30b4c471d0d84947e5ebaa079b5ea1","unresolved":false,"context_lines":[{"line_number":94,"context_line":"        offering a scheduler. When building a cloud, you may choose to"},{"line_number":95,"context_line":"        implement scheduling filters for a variety of security-related"},{"line_number":96,"context_line":"        purposes.\u003c/para\u003e"},{"line_number":97,"context_line":"      \u003cpara\u003eSchedulers fall under four main categories:\u003c/para\u003e"},{"line_number":98,"context_line":"      \u003corderedlist\u003e"},{"line_number":99,"context_line":"          \u003clistitem\u003e\u003cpara\u003eResource based filters - These filters will"},{"line_number":100,"context_line":"            create an instance based on the utilization of the"}],"source_content_type":"application/xml","patch_set":4,"id":"da86d52c_ef763ed7","line":97,"in_reply_to":"da86d52c_ec248cc7","updated":"2015-02-18 21:07:01.000000000","message":"Good point - they\u0027re actually called \u0027filter schedulers\u0027 in the  other docs, I\u0027ll update this too - thanks!","commit_id":"c18ccf2d84eda85f7c0d689b423dded8005ff31d"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"b19c00d2f62cbf556c2316ff770c2185c2c020af","unresolved":false,"context_lines":[{"line_number":95,"context_line":"        implement scheduling filters for a variety of security-related"},{"line_number":96,"context_line":"        purposes.\u003c/para\u003e"},{"line_number":97,"context_line":"      \u003cpara\u003eFilter schedulers fall under four main categories:\u003c/para\u003e"},{"line_number":98,"context_line":"      \u003corderedlist\u003e"},{"line_number":99,"context_line":"          \u003clistitem\u003e\u003cpara\u003eResource based filters - These filters will"},{"line_number":100,"context_line":"            create an instance based on the utilization of the"},{"line_number":101,"context_line":"            hypervisor host sets and can trigger on free or used"}],"source_content_type":"application/xml","patch_set":5,"id":"da86d52c_f79fccff","line":98,"updated":"2015-02-19 19:32:34.000000000","message":"use a variablelist instead.","commit_id":"0c1afc21ddbe81b76cd1b75815a7b9404cb3e552"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"fb86f755d9b1bb8996c259824df99b823e6e1d9c","unresolved":false,"context_lines":[{"line_number":96,"context_line":"        purposes.\u003c/para\u003e"},{"line_number":97,"context_line":"      \u003cpara\u003eFilter schedulers fall under four main categories:\u003c/para\u003e"},{"line_number":98,"context_line":"      \u003cvariablelist\u003e"},{"line_number":99,"context_line":"          \u003clistitem\u003e\u003cpara\u003eResource based filters - These filters will"},{"line_number":100,"context_line":"            create an instance based on the utilization of the"},{"line_number":101,"context_line":"            hypervisor host sets and can trigger on free or used"},{"line_number":102,"context_line":"            properties such as RAM, IO or CPU utilization.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":6,"id":"da86d52c_3247b21e","line":99,"updated":"2015-02-19 19:44:18.000000000","message":"That\u0027s not a proper variablelist - see https://wiki.openstack.org/wiki/Documentation/Markup_conventions#Term.2Fdescription_or_key.2Fvalue_pairs\n\nyou need \n\u003cvarlistentry\u003eREsource based filter\u003c/varlistentry\u003e\n\u003clistitem\u003e\u003cpara\u003eThese filter...","commit_id":"6f27be23d9cd033886a6e594afd91337219e0e66"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"1663b3abd4b94e3af6cd3aee78b8ee562cecc3a9","unresolved":false,"context_lines":[{"line_number":95,"context_line":"        implement scheduling filters for a variety of security-related"},{"line_number":96,"context_line":"        purposes.\u003c/para\u003e"},{"line_number":97,"context_line":"      \u003cpara\u003eFilter schedulers fall under four main categories:\u003c/para\u003e"},{"line_number":98,"context_line":"      \u003citemizedlist\u003e"},{"line_number":99,"context_line":"        \u003clistitem\u003e"},{"line_number":100,"context_line":"          \u003cvariablelist\u003e"},{"line_number":101,"context_line":"            \u003cvarlistentry\u003e\u003cterm\u003eResource based filters\u003c/term\u003e"}],"source_content_type":"application/xml","patch_set":7,"id":"da86d52c_a6a283f9","line":98,"updated":"2015-02-19 20:05:39.000000000","message":"No need for the outer itemizedlist at all.","commit_id":"88bef606ac75281597ce866792a53706f7747871"}]}