)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"51dda5722c691ce96390a8575b85550c58608dde","unresolved":false,"context_lines":[{"line_number":7,"context_line":"fix barbican integration"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Added auth_url to the context we pass to castellan"},{"line_number":10,"context_line":"library. In a change [1] intended to deprecate the use"},{"line_number":11,"context_line":"of auth_endpoint passed as the oslo config, it actually"},{"line_number":12,"context_line":"completely removed the use of it[2], so this change became"},{"line_number":13,"context_line":"necessary or the integration is broken."},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"7f96bb07_a081eb4c","line":11,"range":{"start_line":10,"start_character":25,"end_line":11,"end_character":16},"updated":"2018-01-12 20:57:40.000000000","message":"Wait, I\u0027m confused. If auth_endpoint is deprecated, shouldn\u0027t we be updating our configs to use auth_url instead? But I see *auth_url* being added as a deprecated name for *auth_endpoint* in the patch...","commit_id":"aa946161cf54c7aa7aa31de4d0099aecf63fa2e2"},{"author":{"_account_id":9625,"name":"Thiago da Silva","email":"thiagodasilva@gmail.com","username":"thiago"},"change_message_id":"6cd37d0be4d23b2cb1079efc93cad91d0bc2b8d7","unresolved":false,"context_lines":[{"line_number":7,"context_line":"fix barbican integration"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Added auth_url to the context we pass to castellan"},{"line_number":10,"context_line":"library. In a change [1] intended to deprecate the use"},{"line_number":11,"context_line":"of auth_endpoint passed as the oslo config, it actually"},{"line_number":12,"context_line":"completely removed the use of it[2], so this change became"},{"line_number":13,"context_line":"necessary or the integration is broken."},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"7f96bb07_ad023bb3","line":11,"range":{"start_line":10,"start_character":25,"end_line":11,"end_character":16},"in_reply_to":"7f96bb07_a081eb4c","updated":"2018-01-13 19:37:19.000000000","message":"I wrestled a bit with this one. I don\u0027t think it\u0027s actually necessary that we carry over the name change from castellan, so I leaned on keeping things stable.\n\nOTOH, I noticed that we even considered using auth_url at some point since. You can notice that option name being mistakenly left in place in this comment[1]\n\n[1] - https://github.com/openstack/swift/blob/2.16.0/etc/keymaster.conf-sample#L54","commit_id":"aa946161cf54c7aa7aa31de4d0099aecf63fa2e2"}],"etc/keymaster.conf-sample":[{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"ee1d00a792165547b64d51d7483980cfed21b72b","unresolved":false,"context_lines":[{"line_number":53,"context_line":""},{"line_number":54,"context_line":"# The Keystone URL to authenticate to. The value of auth_url may be"},{"line_number":55,"context_line":"# set according to the value of auth_uri in [filter:authtoken] in"},{"line_number":56,"context_line":"# proxy-server.conf. Currently, the only supported version of the Identity API"},{"line_number":57,"context_line":"# is v3, which requires that the url end in \"/v3\"."},{"line_number":58,"context_line":"# auth_endpoint \u003d http://keystonehost:5000/v3"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"# The project and user domain names may optionally be specified. If they are"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7f96bb07_f594e58c","side":"PARENT","line":57,"range":{"start_line":56,"start_character":21,"end_line":57,"end_character":49},"updated":"2018-01-19 01:43:01.000000000","message":"This advice is still useful, it seems:\n\n 2018-01-19 01:27:30.398 1514 ERROR castellan.key_manager.barbican_key_manager [-] Error creating Barbican client: (http://localhost:35357/v2.0/tokens): The resource could not be found. (HTTP 404) (Request-ID: req-3db419a1-c124-4252-b0a7-9e6b1db0dd09): NotFound: (http://localhost:35357/v2.0/tokens): The resource could not be found. (HTTP 404) (Request-ID: req-3db419a1-c124-4252-b0a7-9e6b1db0dd09)\n 2018-01-19 01:27:30.398 1514 CRITICAL castellan [-] Unhandled error: KeyManagerError: Key manager error: (http://localhost:35357/v2.0/tokens): The resource could not be found. (HTTP 404) (Request-ID: req-3db419a1-c124-4252-b0a7-9e6b1db0dd09)\n\nI get further with a trailing \"/v3\"...","commit_id":"b0242f4fdc7d77b6c328ead519310d9ebb85f193"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"cbfa31c79f377faf78f6f56fb415025ff6ef38dc","unresolved":false,"context_lines":[{"line_number":19,"context_line":"# The api_class tells Castellan which key manager to use to access the external"},{"line_number":20,"context_line":"# key management system. The default value that accesses Barbican is"},{"line_number":21,"context_line":"# castellan.key_manager.barbican_key_manager.BarbicanKeyManager."},{"line_number":22,"context_line":"# api_class \u003d castellan.key_manager.barbican_key_manager.BarbicanKeyManager"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"# The configuration options below apply to a Barbican KMS being accessed using"},{"line_number":25,"context_line":"# Castellan. If another KMS type is used (by specifying another value for"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7f96bb07_d1cce4bd","line":22,"range":{"start_line":22,"start_character":2,"end_line":22,"end_character":11},"updated":"2018-01-15 17:45:19.000000000","message":"I think I\u0027m fine with holding off on accepting auth_url until we pick up some other modernizations, like using\n\n backend\n\ninstead of needing to know all about castellan internals. See also: https://github.com/openstack/castellan/commit/8980bf7","commit_id":"a9964a7fc3df5e16d066914498e83ac065282e2e"},{"author":{"_account_id":7233,"name":"Matthew Oliver","email":"matt@oliver.net.au","username":"mattoliverau"},"change_message_id":"6cc6735e712a6b01f3cd22ba510b7f4183d4b91b","unresolved":false,"context_lines":[{"line_number":51,"context_line":"# Instead of the project name, the project id may also be used."},{"line_number":52,"context_line":"# project_id \u003d changeme"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"# The Keystone URL to authenticate to. The value of auth_endpoint may be"},{"line_number":55,"context_line":"# set according to the value of auth_uri in [filter:authtoken] in"},{"line_number":56,"context_line":"# proxy-server.conf."},{"line_number":57,"context_line":"# auth_endpoint \u003d http://keystonehost/identity"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"# The project and user domain names may optionally be specified. If they are"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7f96bb07_9a344cfd","line":56,"range":{"start_line":54,"start_character":0,"end_line":56,"end_character":20},"updated":"2018-01-15 04:17:59.000000000","message":"# The Keystone URL to authenticate to. The value of auth_url may be\n# set according to the value of auth_uri in [filter:authtoken] in\n# proxy-server.conf.\n# auth_endpoint or auth_url can be used here, however, auth_endpoint\n# is deprecated and may be removed sometime in the future.\n# auth_url \u003d http://keystonehost/identity","commit_id":"a9964a7fc3df5e16d066914498e83ac065282e2e"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"ee1d00a792165547b64d51d7483980cfed21b72b","unresolved":false,"context_lines":[{"line_number":59,"context_line":"# The project and user domain names may optionally be specified. If they are"},{"line_number":60,"context_line":"# not specified, the default values of \u0027Default\u0027 (for *_domain_name) and"},{"line_number":61,"context_line":"# \u0027default\u0027 (for *_domain_id) are used (note the capitalization)."},{"line_number":62,"context_line":"# project_domain_name \u003d Default"},{"line_number":63,"context_line":"# user_domain_name \u003d Default"},{"line_number":64,"context_line":"# Instead of the project domain name and user domain name, the project domain"},{"line_number":65,"context_line":"# id and user domain id may also be specified."}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7f96bb07_f5d94582","line":62,"updated":"2018-01-19 01:43:01.000000000","message":"...and this may be required??\n\n 2018-01-19 01:30:06.772 1574 ERROR castellan KeyManagerError: Key manager error: Expecting to find domain in project. The server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error. (HTTP 400) (Request-ID: req-6d8a997a-44ed-4a30-a3fe-5e1485d2fefc)","commit_id":"a9964a7fc3df5e16d066914498e83ac065282e2e"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"ee1d00a792165547b64d51d7483980cfed21b72b","unresolved":false,"context_lines":[{"line_number":60,"context_line":"# not specified, the default values of \u0027Default\u0027 (for *_domain_name) and"},{"line_number":61,"context_line":"# \u0027default\u0027 (for *_domain_id) are used (note the capitalization)."},{"line_number":62,"context_line":"# project_domain_name \u003d Default"},{"line_number":63,"context_line":"# user_domain_name \u003d Default"},{"line_number":64,"context_line":"# Instead of the project domain name and user domain name, the project domain"},{"line_number":65,"context_line":"# id and user domain id may also be specified."},{"line_number":66,"context_line":"# project_domain_id \u003d default"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"7f96bb07_556279af","line":63,"updated":"2018-01-19 01:43:01.000000000","message":"this one too...\n\n 2018-01-19 01:33:08.017 1715 ERROR castellan KeyManagerError: Key manager error: Expecting to find domain in user. The server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error. (HTTP 400) (Request-ID: req-f9475948-eef5-4838-9f43-ad67c10cc756)","commit_id":"a9964a7fc3df5e16d066914498e83ac065282e2e"}],"swift/common/middleware/crypto/kms_keymaster.py":[{"author":{"_account_id":20988,"name":"Mathias Bjoerkqvist","email":"mbj@zurich.ibm.com","username":"mathiasb"},"change_message_id":"94359e3a6919060c524061f62b44f47c1fc1fb14","unresolved":false,"context_lines":[{"line_number":59,"context_line":"                                     set(keymaster_opts).intersection(conf))))"},{"line_number":60,"context_line":"            conf \u003d readconf(self.keymaster_config_path, \u0027kms_keymaster\u0027)"},{"line_number":61,"context_line":"        ctxt \u003d keystone_password.KeystonePassword("},{"line_number":62,"context_line":"            auth_url\u003dconf.get(\u0027auth_endpoint\u0027),"},{"line_number":63,"context_line":"            username\u003dconf.get(\u0027username\u0027),"},{"line_number":64,"context_line":"            password\u003dconf.get(\u0027password\u0027),"},{"line_number":65,"context_line":"            project_name\u003dconf.get(\u0027project_name\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"7f96bb07_8c38ccd3","line":62,"range":{"start_line":62,"start_character":12,"end_line":62,"end_character":47},"updated":"2018-01-11 22:36:39.000000000","message":"As long as I also configure \u0027auth_endpoint\u0027 appropriately in [kms_keymaster], this patch fixes the issue in my setup.","commit_id":"aa946161cf54c7aa7aa31de4d0099aecf63fa2e2"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"cbfa31c79f377faf78f6f56fb415025ff6ef38dc","unresolved":false,"context_lines":[{"line_number":58,"context_line":"                                 \", \".join(list("},{"line_number":59,"context_line":"                                     set(keymaster_opts).intersection(conf))))"},{"line_number":60,"context_line":"            conf \u003d readconf(self.keymaster_config_path, \u0027kms_keymaster\u0027)"},{"line_number":61,"context_line":"        ctxt \u003d keystone_password.KeystonePassword("},{"line_number":62,"context_line":"            auth_url\u003dconf.get(\u0027auth_endpoint\u0027),"},{"line_number":63,"context_line":"            username\u003dconf.get(\u0027username\u0027),"},{"line_number":64,"context_line":"            password\u003dconf.get(\u0027password\u0027),"}],"source_content_type":"text/x-python","patch_set":2,"id":"7f96bb07_313bc89c","line":61,"range":{"start_line":61,"start_character":15,"end_line":61,"end_character":49},"updated":"2018-01-15 17:45:19.000000000","message":"Off-topic: I wonder at what point we\u0027ll want to accept\n\n auth_type\n\nas an option...","commit_id":"a9964a7fc3df5e16d066914498e83ac065282e2e"},{"author":{"_account_id":7233,"name":"Matthew Oliver","email":"matt@oliver.net.au","username":"mattoliverau"},"change_message_id":"6cc6735e712a6b01f3cd22ba510b7f4183d4b91b","unresolved":false,"context_lines":[{"line_number":59,"context_line":"                                     set(keymaster_opts).intersection(conf))))"},{"line_number":60,"context_line":"            conf \u003d readconf(self.keymaster_config_path, \u0027kms_keymaster\u0027)"},{"line_number":61,"context_line":"        ctxt \u003d keystone_password.KeystonePassword("},{"line_number":62,"context_line":"            auth_url\u003dconf.get(\u0027auth_endpoint\u0027),"},{"line_number":63,"context_line":"            username\u003dconf.get(\u0027username\u0027),"},{"line_number":64,"context_line":"            password\u003dconf.get(\u0027password\u0027),"},{"line_number":65,"context_line":"            project_name\u003dconf.get(\u0027project_name\u0027),"}],"source_content_type":"text/x-python","patch_set":2,"id":"7f96bb07_fa555051","line":62,"updated":"2018-01-15 04:17:59.000000000","message":"Can we:\n\n  auth_url\u003dconf.get(\u0027auth_url\u0027, config.get(\u0027auth_endpoint\u0027))","commit_id":"a9964a7fc3df5e16d066914498e83ac065282e2e"},{"author":{"_account_id":7233,"name":"Matthew Oliver","email":"matt@oliver.net.au","username":"mattoliverau"},"change_message_id":"8b74c43fbbf17c264967334deda2fe3af84b66be","unresolved":false,"context_lines":[{"line_number":59,"context_line":"                                     set(keymaster_opts).intersection(conf))))"},{"line_number":60,"context_line":"            conf \u003d readconf(self.keymaster_config_path, \u0027kms_keymaster\u0027)"},{"line_number":61,"context_line":"        ctxt \u003d keystone_password.KeystonePassword("},{"line_number":62,"context_line":"            auth_url\u003dconf.get(\u0027auth_endpoint\u0027),"},{"line_number":63,"context_line":"            username\u003dconf.get(\u0027username\u0027),"},{"line_number":64,"context_line":"            password\u003dconf.get(\u0027password\u0027),"},{"line_number":65,"context_line":"            project_name\u003dconf.get(\u0027project_name\u0027),"}],"source_content_type":"text/x-python","patch_set":2,"id":"7f96bb07_65dd036f","line":62,"in_reply_to":"7f96bb07_515534c5","updated":"2018-01-15 22:33:31.000000000","message":"Well based on the above code \u0027auth_url\u0027 :P","commit_id":"a9964a7fc3df5e16d066914498e83ac065282e2e"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"cbfa31c79f377faf78f6f56fb415025ff6ef38dc","unresolved":false,"context_lines":[{"line_number":59,"context_line":"                                     set(keymaster_opts).intersection(conf))))"},{"line_number":60,"context_line":"            conf \u003d readconf(self.keymaster_config_path, \u0027kms_keymaster\u0027)"},{"line_number":61,"context_line":"        ctxt \u003d keystone_password.KeystonePassword("},{"line_number":62,"context_line":"            auth_url\u003dconf.get(\u0027auth_endpoint\u0027),"},{"line_number":63,"context_line":"            username\u003dconf.get(\u0027username\u0027),"},{"line_number":64,"context_line":"            password\u003dconf.get(\u0027password\u0027),"},{"line_number":65,"context_line":"            project_name\u003dconf.get(\u0027project_name\u0027),"}],"source_content_type":"text/x-python","patch_set":2,"id":"7f96bb07_515534c5","line":62,"in_reply_to":"7f96bb07_fa555051","updated":"2018-01-15 17:45:19.000000000","message":"Probably? If both are specified, which should take precedence?","commit_id":"a9964a7fc3df5e16d066914498e83ac065282e2e"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"ee1d00a792165547b64d51d7483980cfed21b72b","unresolved":false,"context_lines":[{"line_number":81,"context_line":"        )"},{"line_number":82,"context_line":"        options.enable_logging()"},{"line_number":83,"context_line":"        manager \u003d key_manager.API(oslo_conf)"},{"line_number":84,"context_line":"        key \u003d manager.get(ctxt, conf.get(\u0027key_id\u0027))"},{"line_number":85,"context_line":"        if key is None:"},{"line_number":86,"context_line":"            raise ValueError(\"Retrieval of encryption root secret with key_id \""},{"line_number":87,"context_line":"                             \"\u0027%s\u0027 returned None.\" % conf.get(\u0027key_id\u0027))"}],"source_content_type":"text/x-python","patch_set":2,"id":"7f96bb07_b543bd3e","line":84,"updated":"2018-01-19 01:43:01.000000000","message":"hmm...\n\n 2018-01-19 01:22:19.644 1067 ERROR castellan.key_manager.barbican_key_manager [-] Error creating Barbican client: \u0027NoneType\u0027 object has no attribute \u0027find\u0027\n 2018-01-19 01:22:19.644 1067 CRITICAL castellan [-] Unhandled error: KeyManagerError: Key manager error: \u0027NoneType\u0027 object has no attribute \u0027find\u0027\n\nleading down into\n\n 2018-01-19 01:22:19.644 1067 ERROR castellan   File \"/usr/local/lib/python2.7/dist-packages/castellan/key_manager/barbican_key_manager.py\", line 556, in get\n 2018-01-19 01:22:19.644 1067 ERROR castellan     secret \u003d self._get_secret(context, managed_object_id)\n 2018-01-19 01:22:19.644 1067 ERROR castellan   File \"/usr/local/lib/python2.7/dist-packages/castellan/key_manager/barbican_key_manager.py\", line 526, in _get_secret\n 2018-01-19 01:22:19.644 1067 ERROR castellan     barbican_client \u003d self._get_barbican_client(context)\n 2018-01-19 01:22:19.644 1067 ERROR castellan   File \"/usr/local/lib/python2.7/dist-packages/castellan/key_manager/barbican_key_manager.py\", line 132, in _get_barbican_client\n 2018-01-19 01:22:19.644 1067 ERROR castellan     raise exception.KeyManagerError(reason\u003de)\n 2018-01-19 01:22:19.644 1067 ERROR castellan KeyManagerError: Key manager error: \u0027NoneType\u0027 object has no attribute \u0027find\u0027\n 2018-01-19 01:22:19.644 1067 ERROR castellan\n\n...I guess it\u0027s because I forgot the auth_endpoint? we should really make that a bit more friendly...","commit_id":"a9964a7fc3df5e16d066914498e83ac065282e2e"}]}