)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":10295,"name":"mariam john","email":"mariamj@us.ibm.com","username":"mariamj"},"change_message_id":"a966501a560575e1ddbb89f81280bb705c096758","unresolved":false,"context_lines":[{"line_number":11,"context_line":"members of the Trove team of the request that will be made of the"},{"line_number":12,"context_line":"underlying projects."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: I2742b870fc448fda153f62e4f9e53f7d08f1f394"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"7a016987_5a3bb3eb","line":14,"updated":"2015-05-28 12:47:17.000000000","message":"Shouldnt we mention the blueprint here as well?","commit_id":"26f757270891bc48789d454bb0886eff0ca64640"},{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"d6e55a0d82ec460f5d1fb294025c0f898aeb1a59","unresolved":false,"context_lines":[{"line_number":11,"context_line":"members of the Trove team of the request that will be made of the"},{"line_number":12,"context_line":"underlying projects."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: I2742b870fc448fda153f62e4f9e53f7d08f1f394"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"7a016987_f1dddd70","line":14,"in_reply_to":"7a016987_5a3bb3eb","updated":"2015-05-28 15:17:24.000000000","message":"sure","commit_id":"26f757270891bc48789d454bb0886eff0ca64640"}],"specs/liberty/protected-instances.rst":[{"author":{"_account_id":10295,"name":"mariam john","email":"mariamj@us.ibm.com","username":"mariamj"},"change_message_id":"a966501a560575e1ddbb89f81280bb705c096758","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":12,"context_line":"Title of the Spec"},{"line_number":13,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":".. sectnum::"},{"line_number":16,"context_line":".. contents::"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a016987_3ae0f7f9","line":13,"updated":"2015-05-28 12:47:17.000000000","message":"Need to give a title.","commit_id":"26f757270891bc48789d454bb0886eff0ca64640"},{"author":{"_account_id":10295,"name":"mariam john","email":"mariamj@us.ibm.com","username":"mariamj"},"change_message_id":"a966501a560575e1ddbb89f81280bb705c096758","unresolved":false,"context_lines":[{"line_number":34,"context_line":"directly."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"It would be highly advantageous if Trove were able, for example, to"},{"line_number":37,"context_line":"provision protected resources from Nova and Cinder and use these to"},{"line_number":38,"context_line":"launch a VM on which to run a database. This protected VM would be"},{"line_number":39,"context_line":"hidden from direct manipulation by the user, using Nova commands that"},{"line_number":40,"context_line":"Trove considered to be potentially harmful."}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a016987_daf2039a","line":37,"updated":"2015-05-28 12:47:17.000000000","message":"Are we targeting Nova and Cinder only for this release (you also mentioned Swift and Nuetron above, so was curious)?","commit_id":"26f757270891bc48789d454bb0886eff0ca64640"},{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"d6e55a0d82ec460f5d1fb294025c0f898aeb1a59","unresolved":false,"context_lines":[{"line_number":34,"context_line":"directly."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"It would be highly advantageous if Trove were able, for example, to"},{"line_number":37,"context_line":"provision protected resources from Nova and Cinder and use these to"},{"line_number":38,"context_line":"launch a VM on which to run a database. This protected VM would be"},{"line_number":39,"context_line":"hidden from direct manipulation by the user, using Nova commands that"},{"line_number":40,"context_line":"Trove considered to be potentially harmful."}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a016987_310ff5e2","line":37,"in_reply_to":"7a016987_daf2039a","updated":"2015-05-28 15:17:24.000000000","message":"yes","commit_id":"26f757270891bc48789d454bb0886eff0ca64640"},{"author":{"_account_id":10295,"name":"mariam john","email":"mariamj@us.ibm.com","username":"mariamj"},"change_message_id":"a966501a560575e1ddbb89f81280bb705c096758","unresolved":false,"context_lines":[{"line_number":38,"context_line":"launch a VM on which to run a database. This protected VM would be"},{"line_number":39,"context_line":"hidden from direct manipulation by the user, using Nova commands that"},{"line_number":40,"context_line":"Trove considered to be potentially harmful."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This is a request for the creation of a mechanism that would establish"},{"line_number":43,"context_line":"a class of protected resources that could be provisioned in this"},{"line_number":44,"context_line":"way. From the conversation(s) at summit it appears that this"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a016987_bae06797","line":41,"updated":"2015-05-28 12:47:17.000000000","message":"Would it be helpful to list some of these commands as an example. I was under the impression that Trove launched an instance using SSH credentials which prevented a direct manipulation unless a user somehow got hold of the SSH keys. I am sure I am missing something here.","commit_id":"26f757270891bc48789d454bb0886eff0ca64640"},{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"d6e55a0d82ec460f5d1fb294025c0f898aeb1a59","unresolved":false,"context_lines":[{"line_number":38,"context_line":"launch a VM on which to run a database. This protected VM would be"},{"line_number":39,"context_line":"hidden from direct manipulation by the user, using Nova commands that"},{"line_number":40,"context_line":"Trove considered to be potentially harmful."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This is a request for the creation of a mechanism that would establish"},{"line_number":43,"context_line":"a class of protected resources that could be provisioned in this"},{"line_number":44,"context_line":"way. From the conversation(s) at summit it appears that this"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a016987_91ec69f4","line":41,"in_reply_to":"7a016987_bae06797","updated":"2015-05-28 15:17:24.000000000","message":"I\u0027ll add a list of commands. I think ssh has little to do with this.","commit_id":"26f757270891bc48789d454bb0886eff0ca64640"},{"author":{"_account_id":10295,"name":"mariam john","email":"mariamj@us.ibm.com","username":"mariamj"},"change_message_id":"a966501a560575e1ddbb89f81280bb705c096758","unresolved":false,"context_lines":[{"line_number":71,"context_line":"that some operations are not permitted on the protected"},{"line_number":72,"context_line":"instance. Further, a protected instance would not appear in the output"},{"line_number":73,"context_line":"of .list. command."},{"line_number":74,"context_line":" "},{"line_number":75,"context_line":"Optionally, the .list. command may obscure the instance ID of the"},{"line_number":76,"context_line":"protected instance and the owner of the instance would be the Trove"},{"line_number":77,"context_line":"service which had the instance ID that it received at instance"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a016987_daaa0319","line":74,"updated":"2015-05-28 12:47:17.000000000","message":"There is an empty space here. Also, who defines the set of operations that are not permitted on a protected instance - Trove or Nova/Cinder.","commit_id":"26f757270891bc48789d454bb0886eff0ca64640"},{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"d6e55a0d82ec460f5d1fb294025c0f898aeb1a59","unresolved":false,"context_lines":[{"line_number":71,"context_line":"that some operations are not permitted on the protected"},{"line_number":72,"context_line":"instance. Further, a protected instance would not appear in the output"},{"line_number":73,"context_line":"of .list. command."},{"line_number":74,"context_line":" "},{"line_number":75,"context_line":"Optionally, the .list. command may obscure the instance ID of the"},{"line_number":76,"context_line":"protected instance and the owner of the instance would be the Trove"},{"line_number":77,"context_line":"service which had the instance ID that it received at instance"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a016987_51a4b1b7","line":74,"in_reply_to":"7a016987_daaa0319","updated":"2015-05-28 15:17:24.000000000","message":"good question, I\u0027d like Nova and Cinder\u0027s input on this; they are the experts on their systems.","commit_id":"26f757270891bc48789d454bb0886eff0ca64640"},{"author":{"_account_id":10295,"name":"mariam john","email":"mariamj@us.ibm.com","username":"mariamj"},"change_message_id":"a966501a560575e1ddbb89f81280bb705c096758","unresolved":false,"context_lines":[{"line_number":182,"context_line":"Documentation Impact"},{"line_number":183,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"This will be documented in the user guid."},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"References"},{"line_number":188,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a016987_6fbd8fd6","line":185,"updated":"2015-05-28 12:47:17.000000000","message":"typo-guide","commit_id":"26f757270891bc48789d454bb0886eff0ca64640"},{"author":{"_account_id":12613,"name":"Mark Kirkwood","email":"mark.kirkwood@gmail.com","username":"markir9"},"change_message_id":"83b0e7400da59deee7bada1bc7379de110068734","unresolved":false,"context_lines":[{"line_number":13,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Projects like Trove require the ability to launch instances of"},{"line_number":16,"context_line":"resources from projects like Nova, Cinder, Swift, and Neutron but bad"},{"line_number":17,"context_line":"things happen when a user directly interacts with these instances. It"},{"line_number":18,"context_line":"would therefore be advantageous to have a class of instances which are"},{"line_number":19,"context_line":"protected from direct user actions."}],"source_content_type":"text/x-rst","patch_set":4,"id":"5afe65bd_d9f211d2","line":16,"updated":"2015-06-03 23:40:22.000000000","message":"Might need to include Glance as well - as the custom images can contain info that should be protected.","commit_id":"56bcbab80555fcf4d1bae3a03b1af075fa8e892a"},{"author":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"change_message_id":"dd0d6b5eb66a39ebd3ce5729b6dd00c5b082c189","unresolved":false,"context_lines":[{"line_number":13,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Projects like Trove require the ability to launch instances of"},{"line_number":16,"context_line":"resources from projects like Nova, Cinder, Swift, and Neutron but bad"},{"line_number":17,"context_line":"things happen when a user directly interacts with these instances. It"},{"line_number":18,"context_line":"would therefore be advantageous to have a class of instances which are"},{"line_number":19,"context_line":"protected from direct user actions."}],"source_content_type":"text/x-rst","patch_set":4,"id":"5afe65bd_6dd46e1f","line":16,"in_reply_to":"5afe65bd_d9f211d2","updated":"2015-06-04 06:42:59.000000000","message":"FWIW, glance already has support for protected images.","commit_id":"56bcbab80555fcf4d1bae3a03b1af075fa8e892a"},{"author":{"_account_id":11783,"name":"Shayne Burgess","email":"shayne.burgess@hp.com","username":"shayne-burgess"},"change_message_id":"f4baf8fef66e68d063bdad4944fabe558e2bb4c6","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Projects like Trove provision resources from services like Nova,"},{"line_number":28,"context_line":"Cinder, Swift, and Neutron when a user requests a database"},{"line_number":29,"context_line":"instance. These resources are provisioned and managed by Trove and bad"},{"line_number":30,"context_line":"things happen when a user is able to interact with these resources"},{"line_number":31,"context_line":"directly."},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"5afe65bd_631167ac","line":29,"updated":"2015-06-02 19:10:27.000000000","message":"It might be interesting to describe exactly which \"bad\" things you want to protect against in order to drive the implementation/design below.","commit_id":"56bcbab80555fcf4d1bae3a03b1af075fa8e892a"},{"author":{"_account_id":11783,"name":"Shayne Burgess","email":"shayne.burgess@hp.com","username":"shayne-burgess"},"change_message_id":"f4baf8fef66e68d063bdad4944fabe558e2bb4c6","unresolved":false,"context_lines":[{"line_number":65,"context_line":"this was a request for a protected instance."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"A protected instance is identical to an unprotected instance except"},{"line_number":68,"context_line":"that some operations are not permitted on the protected"},{"line_number":69,"context_line":"instance. Further, a protected instance would not appear in the output"},{"line_number":70,"context_line":"of .list. command."},{"line_number":71,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"5afe65bd_7657e702","line":68,"updated":"2015-06-02 19:10:27.000000000","message":"I\u0027m struggling with this a little bit. I think what you want is you want the instance to be \"protected\" as far as the Trove user is concerned because you want the nova instance behind a trust boundary from the user of the database. In addition, you want to be able to provide some \"up-time\" guarantees which you can\u0027t do if the user can ssh into the instance and start messing around with configurations - or accidentally do a nova delete.\n\nOn the flip side though, someone, has to have full access to that instance in order to manage the instance. This person will want to do healing operations, apply patches, debug issues, etc. Who is this person in your proposal here and how do they get access?","commit_id":"56bcbab80555fcf4d1bae3a03b1af075fa8e892a"},{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"ffc84cabe82b02c36148580424eabc1b2a0a1350","unresolved":false,"context_lines":[{"line_number":65,"context_line":"this was a request for a protected instance."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"A protected instance is identical to an unprotected instance except"},{"line_number":68,"context_line":"that some operations are not permitted on the protected"},{"line_number":69,"context_line":"instance. Further, a protected instance would not appear in the output"},{"line_number":70,"context_line":"of .list. command."},{"line_number":71,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"5afe65bd_07e872b3","line":68,"in_reply_to":"5afe65bd_7657e702","updated":"2015-06-03 01:48:48.000000000","message":"Only trove (the controller) would have access to the instance id therefore only trove would be able to manage the instance.\n\nOf course, someone could compromise the instance via it\u0027s IP address but that is up to the security in your guest image.","commit_id":"56bcbab80555fcf4d1bae3a03b1af075fa8e892a"},{"author":{"_account_id":6413,"name":"Victoria Martinez de la Cruz","email":"victoria@redhat.com","username":"vkmc"},"change_message_id":"9a67acc350c2268e3431b7557e1fb9b40b645835","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Commands that could (for example) be prevented on a protected Nova"},{"line_number":83,"context_line":"instance include:"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"nova list"},{"line_number":86,"context_line":"nova backup"},{"line_number":87,"context_line":"nova clear-password"},{"line_number":88,"context_line":"nova image-create"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5afe65bd_6c5dd9e8","line":85,"updated":"2015-06-02 18:02:30.000000000","message":"We could use the help of a security expert and get some advice on the commands that should be prevented.","commit_id":"56bcbab80555fcf4d1bae3a03b1af075fa8e892a"},{"author":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"change_message_id":"51f50af43688d0dad20fc9a2d444ef4281a638eb","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Commands that could (for example) be prevented on a protected Nova"},{"line_number":83,"context_line":"instance include:"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"nova list"},{"line_number":86,"context_line":"nova backup"},{"line_number":87,"context_line":"nova clear-password"},{"line_number":88,"context_line":"nova image-create"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a016987_93653546","line":85,"updated":"2015-06-01 12:55:17.000000000","message":"nit: you may want to use `*` here to render the list properly","commit_id":"56bcbab80555fcf4d1bae3a03b1af075fa8e892a"},{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"ffc84cabe82b02c36148580424eabc1b2a0a1350","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Commands that could (for example) be prevented on a protected Nova"},{"line_number":83,"context_line":"instance include:"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"nova list"},{"line_number":86,"context_line":"nova backup"},{"line_number":87,"context_line":"nova clear-password"},{"line_number":88,"context_line":"nova image-create"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5afe65bd_27080e91","line":85,"in_reply_to":"5afe65bd_6c5dd9e8","updated":"2015-06-03 01:48:48.000000000","message":"I\u0027d expect Nova (for example) to know how to do that for Nova. Same for other projects.","commit_id":"56bcbab80555fcf4d1bae3a03b1af075fa8e892a"},{"author":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"change_message_id":"4963ca5a93d072ecf9a5a483be8175cc9d601009","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Commands that could (for example) be prevented on a protected Nova"},{"line_number":83,"context_line":"instance include:"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"nova list"},{"line_number":86,"context_line":"nova backup"},{"line_number":87,"context_line":"nova clear-password"},{"line_number":88,"context_line":"nova image-create"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5afe65bd_6fc4985e","line":85,"in_reply_to":"5afe65bd_a7cd1e5f","updated":"2015-06-03 06:05:39.000000000","message":"my bad. I just wanted to say that you should use `*` to have proper bullets. Otherwise, the rst list is not going to be rendered properly. See: http://docs-draft.openstack.org/57/186357/4/check/gate-trove-specs-docs/d50ff6e//doc/build/html/specs/liberty/protected-instances.html","commit_id":"56bcbab80555fcf4d1bae3a03b1af075fa8e892a"},{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"ffc84cabe82b02c36148580424eabc1b2a0a1350","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Commands that could (for example) be prevented on a protected Nova"},{"line_number":83,"context_line":"instance include:"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"nova list"},{"line_number":86,"context_line":"nova backup"},{"line_number":87,"context_line":"nova clear-password"},{"line_number":88,"context_line":"nova image-create"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5afe65bd_a7cd1e5f","line":85,"in_reply_to":"7a016987_93653546","updated":"2015-06-03 01:48:48.000000000","message":"I don\u0027t know what you mean (Flavio).","commit_id":"56bcbab80555fcf4d1bae3a03b1af075fa8e892a"},{"author":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"change_message_id":"51f50af43688d0dad20fc9a2d444ef4281a638eb","unresolved":false,"context_lines":[{"line_number":153,"context_line":"messaging system, some changes possibly in Keystone to provide a"},{"line_number":154,"context_line":"notion of a protected sub-tenant, and so on."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"In the final reckoning, this appears to be the best approach."},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Implementation"},{"line_number":159,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a016987_d6a39b41","line":156,"updated":"2015-06-01 12:55:17.000000000","message":"It\u0027d be useful to mention here that one of the reasons this is considered the winning solution by the Trove team is that Trove considers VM to be within its own security boundaries and therefore it prefers to close those boundaries rather than protecting the instance from the inside.\n\nI don\u0027t think this approach covers other cases like an attacker getting access to the controller or simply accessing the DB instance through its floating IP.","commit_id":"56bcbab80555fcf4d1bae3a03b1af075fa8e892a"},{"author":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"change_message_id":"4963ca5a93d072ecf9a5a483be8175cc9d601009","unresolved":false,"context_lines":[{"line_number":153,"context_line":"messaging system, some changes possibly in Keystone to provide a"},{"line_number":154,"context_line":"notion of a protected sub-tenant, and so on."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"In the final reckoning, this appears to be the best approach."},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Implementation"},{"line_number":159,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5afe65bd_af917054","line":156,"in_reply_to":"5afe65bd_6745e6b1","updated":"2015-06-03 06:05:39.000000000","message":"Not sure I follow this last comment","commit_id":"56bcbab80555fcf4d1bae3a03b1af075fa8e892a"},{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"ffc84cabe82b02c36148580424eabc1b2a0a1350","unresolved":false,"context_lines":[{"line_number":153,"context_line":"messaging system, some changes possibly in Keystone to provide a"},{"line_number":154,"context_line":"notion of a protected sub-tenant, and so on."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"In the final reckoning, this appears to be the best approach."},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Implementation"},{"line_number":159,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5afe65bd_6745e6b1","line":156,"in_reply_to":"7a016987_d6a39b41","updated":"2015-06-03 01:48:48.000000000","message":"So, by the same token, the OpenStack controller could be compromised and that is then the same issue.","commit_id":"56bcbab80555fcf4d1bae3a03b1af075fa8e892a"},{"author":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"change_message_id":"51f50af43688d0dad20fc9a2d444ef4281a638eb","unresolved":false,"context_lines":[{"line_number":172,"context_line":"Work Items"},{"line_number":173,"context_line":"----------"},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"Work with other projects to deliver the underlying capabilities."},{"line_number":176,"context_line":"Do the Trove work to integrate with them."},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"Upgrade Implications"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a016987_33b3219a","line":175,"updated":"2015-06-01 12:55:17.000000000","message":"I guess this will require specs in Nova and Cinder too. If so, it\u0027d be better to have those specs approved first (And listed here) since without them, this spec would not be useful.","commit_id":"56bcbab80555fcf4d1bae3a03b1af075fa8e892a"},{"author":{"_account_id":10295,"name":"mariam john","email":"mariamj@us.ibm.com","username":"mariamj"},"change_message_id":"6430e099b7cd6701b6f3c1aed3999deeb9b9a045","unresolved":false,"context_lines":[{"line_number":197,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"This will be documented in the user guid."},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"References"},{"line_number":202,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":203,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a016987_7d69b8f8","line":200,"updated":"2015-05-28 19:22:38.000000000","message":"I think you missed the typo here.","commit_id":"56bcbab80555fcf4d1bae3a03b1af075fa8e892a"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"cc4ea724568d01e24486cd00ce550a5981f74460","unresolved":false,"context_lines":[{"line_number":40,"context_line":"Deployers of Trove have addressed these concerns and are able to"},{"line_number":41,"context_line":"operate a secure Trove system by launching Nova instances in a"},{"line_number":42,"context_line":"different tenant than the end user. The changes to Trove for this are"},{"line_number":43,"context_line":"currently not part of Trove but will be made available shortly."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"It would be highly advantageous if Trove were able, for example, to"},{"line_number":46,"context_line":"provision protected resources from Nova and Cinder and use these to"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_32b3699a","line":43,"updated":"2015-06-04 13:04:53.000000000","message":"Thats cool, why do you need any more than that?","commit_id":"0ff3307fd874da2fa1d46dcbec6349a8784bf5f2"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"cc4ea724568d01e24486cd00ce550a5981f74460","unresolved":false,"context_lines":[{"line_number":46,"context_line":"provision protected resources from Nova and Cinder and use these to"},{"line_number":47,"context_line":"launch a VM on which to run a database. This protected VM would be"},{"line_number":48,"context_line":"hidden from direct manipulation by the user, using Nova commands that"},{"line_number":49,"context_line":"Trove considered to be potentially harmful."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"This is a request for the creation of a mechanism that would establish"},{"line_number":52,"context_line":"a class of protected resources that could be provisioned in this"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_1202ad3d","line":49,"updated":"2015-06-04 13:04:53.000000000","message":"Buy why is this better than using another tenant?\n\nWhat are the extra use cases it enables? Is this a concern about quota consumption? I am just very unsure why you need this, from this description.","commit_id":"0ff3307fd874da2fa1d46dcbec6349a8784bf5f2"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"4f1b88e173163c1cdd24c4db0d3e7db121c96a10","unresolved":false,"context_lines":[{"line_number":46,"context_line":"provision protected resources from Nova and Cinder and use these to"},{"line_number":47,"context_line":"launch a VM on which to run a database. This protected VM would be"},{"line_number":48,"context_line":"hidden from direct manipulation by the user, using Nova commands that"},{"line_number":49,"context_line":"Trove considered to be potentially harmful."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"This is a request for the creation of a mechanism that would establish"},{"line_number":52,"context_line":"a class of protected resources that could be provisioned in this"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_633eb0db","line":49,"in_reply_to":"5afe65bd_1202ad3d","updated":"2015-06-04 14:30:18.000000000","message":"I think it\u0027s about visibility to the user, among other things (like quotas and billing). The idea being that you ask trove for resources and it is very clear that it spawned an instance in your tenant in order to do that. You see it happen.","commit_id":"0ff3307fd874da2fa1d46dcbec6349a8784bf5f2"},{"author":{"_account_id":5441,"name":"Andrew Laski","email":"andrew@lascii.com","username":"alaski"},"change_message_id":"f9a834a9642928c9bcc9d2a960c0f640a6f1e08b","unresolved":false,"context_lines":[{"line_number":46,"context_line":"provision protected resources from Nova and Cinder and use these to"},{"line_number":47,"context_line":"launch a VM on which to run a database. This protected VM would be"},{"line_number":48,"context_line":"hidden from direct manipulation by the user, using Nova commands that"},{"line_number":49,"context_line":"Trove considered to be potentially harmful."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"This is a request for the creation of a mechanism that would establish"},{"line_number":52,"context_line":"a class of protected resources that could be provisioned in this"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_43b3b498","line":49,"in_reply_to":"5afe65bd_1202ad3d","updated":"2015-06-04 14:23:26.000000000","message":"There is already a mechanism which would sort of enable this in Nova, \u0027lock\u0027.  If Trove locked an instance as an admin then the user would be effectively barred from manipulating it via the Nova API.\n\nHowever, I think that\u0027s the wrong approach.  The right thing to do is what others have suggested, and use a separate tenant to launch these instances.  This moves quotas to being a Trove concern since user resources aren\u0027t needed or consumed for Trove instances.  This provides isolation in the Nova API, not just from manipulation but also from list/show commands.  I\u0027m assuming that users would want to manage Trove resources via Trove and not want them cluttering up their Nova instance list.  This is a similar approach as what Magnum is looking at IIRC.","commit_id":"0ff3307fd874da2fa1d46dcbec6349a8784bf5f2"},{"author":{"_account_id":170,"name":"Mike Perez","email":"thingee@gmail.com","username":"thingee"},"change_message_id":"ae756d481c74a65b6004096041d6730d02a86edd","unresolved":false,"context_lines":[{"line_number":46,"context_line":"provision protected resources from Nova and Cinder and use these to"},{"line_number":47,"context_line":"launch a VM on which to run a database. This protected VM would be"},{"line_number":48,"context_line":"hidden from direct manipulation by the user, using Nova commands that"},{"line_number":49,"context_line":"Trove considered to be potentially harmful."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"This is a request for the creation of a mechanism that would establish"},{"line_number":52,"context_line":"a class of protected resources that could be provisioned in this"}],"source_content_type":"text/x-rst","patch_set":6,"id":"3afb71cf_8d30e29f","line":49,"in_reply_to":"5afe65bd_467f4215","updated":"2015-06-08 18:36:11.000000000","message":"I think I\u0027m also in the same boat as John of understanding why to introduce this added complexity.\n\nIf you lock something, it\u0027s arbitrary what that means to Nova or Cinder. To Trove it means this, to some other project it means this. I don\u0027t like not knowing from Cinder\u0027s perspective why something is locked, and how I figure out how to filter certain operations from the API for different services besides Trove.\n\nThings get complex when the user has a quota with Trove which also feeds into Cinder\u0027s quota. I\u0027m not familiar with Trove\u0027s quotas, but if I want to deploy a database, and I have enough quota within Trove, but Cinder I\u0027m out of volumes. I just want a dang database deployed, I don\u0027t care if the deployer chose to do local storage or remote storage.","commit_id":"0ff3307fd874da2fa1d46dcbec6349a8784bf5f2"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"71d349ea08053c83d94d54686ae3b134fd80067e","unresolved":false,"context_lines":[{"line_number":46,"context_line":"provision protected resources from Nova and Cinder and use these to"},{"line_number":47,"context_line":"launch a VM on which to run a database. This protected VM would be"},{"line_number":48,"context_line":"hidden from direct manipulation by the user, using Nova commands that"},{"line_number":49,"context_line":"Trove considered to be potentially harmful."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"This is a request for the creation of a mechanism that would establish"},{"line_number":52,"context_line":"a class of protected resources that could be provisioned in this"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_467f4215","line":49,"in_reply_to":"5afe65bd_633eb0db","updated":"2015-06-04 14:35:38.000000000","message":"Also, to Andrew\u0027s point: I think the goal for implementation here is to extend nova\u0027s locked-by to include a service, instead of just admin/owner. That way an instance can be locked-by: trove (in some fashion), which is really minimal change for us to enable this.","commit_id":"0ff3307fd874da2fa1d46dcbec6349a8784bf5f2"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"cc4ea724568d01e24486cd00ce550a5981f74460","unresolved":false,"context_lines":[{"line_number":100,"context_line":"nova image-create"},{"line_number":101,"context_line":"nova rescue"},{"line_number":102,"context_line":"nova ssh"},{"line_number":103,"context_line":"nova show"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Commands that could (for example) be prevented on a protected Cinder"},{"line_number":106,"context_line":"volume include:"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_b2c99928","line":103,"updated":"2015-06-04 13:04:53.000000000","message":"If you don\u0027t want any of these operation, why do you want it to belong to that user?\n\nIs this purely for \"billing\" in certain use cases? I am still quite confused what you are trying to do here.","commit_id":"0ff3307fd874da2fa1d46dcbec6349a8784bf5f2"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"cc4ea724568d01e24486cd00ce550a5981f74460","unresolved":false,"context_lines":[{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Both of these solutions are known to work, they are not incredibly"},{"line_number":189,"context_line":"complex to implement, but they are also not trivial. Quota management"},{"line_number":190,"context_line":"is the first thing that must be addressed. There is also the issue of"},{"line_number":191,"context_line":"how an instance provisioned in the name of an alternate user can be"},{"line_number":192,"context_line":"connected to a network provisioned by the user."},{"line_number":193,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_b24cf99e","line":190,"updated":"2015-06-04 13:04:53.000000000","message":"What has to be addressed? Does trove not have its own quotas?","commit_id":"0ff3307fd874da2fa1d46dcbec6349a8784bf5f2"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"4f1b88e173163c1cdd24c4db0d3e7db121c96a10","unresolved":false,"context_lines":[{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Both of these solutions are known to work, they are not incredibly"},{"line_number":189,"context_line":"complex to implement, but they are also not trivial. Quota management"},{"line_number":190,"context_line":"is the first thing that must be addressed. There is also the issue of"},{"line_number":191,"context_line":"how an instance provisioned in the name of an alternate user can be"},{"line_number":192,"context_line":"connected to a network provisioned by the user."},{"line_number":193,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_469982c3","line":190,"in_reply_to":"5afe65bd_b24cf99e","updated":"2015-06-04 14:30:18.000000000","message":"Presumably your trove quota is different and separate from your nova quota, and for good reason. If you want trove to be a completely standalone service then it makes sense to just apply to the trove quota and not show the instance to the user. However, if you are a full cloud, then it seems most consistent to apply trove quota and nova quota to a given request. Perhaps you have some trove quota left, but you\u0027re out of quota for new instances.\n\nThe other place this makes sense (IMHO) is in the case of a failure. If I create resources with trove, which spawns an instance that I can see, I can see things like \"hmm, that instance is in error state, which is probably why my trove resources just went away\". That, instead of calling support.","commit_id":"0ff3307fd874da2fa1d46dcbec6349a8784bf5f2"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"cc4ea724568d01e24486cd00ce550a5981f74460","unresolved":false,"context_lines":[{"line_number":192,"context_line":"connected to a network provisioned by the user."},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"In the case of the dedicated Trove service user, there is the issue of"},{"line_number":195,"context_line":"where the service user credentials are stored. In the case of the"},{"line_number":196,"context_line":"shadow user, there is the issue of where the shadow users credentials"},{"line_number":197,"context_line":"are stored and how the mapping is performed from user to shadow user."},{"line_number":198,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_9238ddf0","line":195,"updated":"2015-06-04 13:04:53.000000000","message":"There are some patterns that are used for this already. Not saying they are good.","commit_id":"0ff3307fd874da2fa1d46dcbec6349a8784bf5f2"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"cc4ea724568d01e24486cd00ce550a5981f74460","unresolved":false,"context_lines":[{"line_number":194,"context_line":"In the case of the dedicated Trove service user, there is the issue of"},{"line_number":195,"context_line":"where the service user credentials are stored. In the case of the"},{"line_number":196,"context_line":"shadow user, there is the issue of where the shadow users credentials"},{"line_number":197,"context_line":"are stored and how the mapping is performed from user to shadow user."},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"The reason why the storage location is important is because we must"},{"line_number":200,"context_line":"also consider the implications of having a compromised Trove"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_6d07c018","line":197,"updated":"2015-06-04 13:04:53.000000000","message":"for this approach, I think glance had some ideas.\n\nI think there was one idea that involved using two tokens, a trove token, and the users token, to create a combined tenant that has its own resources and quota (hierarchical quotas might come into play eventually).","commit_id":"0ff3307fd874da2fa1d46dcbec6349a8784bf5f2"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"cc4ea724568d01e24486cd00ce550a5981f74460","unresolved":false,"context_lines":[{"line_number":198,"context_line":""},{"line_number":199,"context_line":"The reason why the storage location is important is because we must"},{"line_number":200,"context_line":"also consider the implications of having a compromised Trove"},{"line_number":201,"context_line":"controller network."},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"These are all solved or solvable problems, they are just non-trivial."},{"line_number":204,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5afe65bd_4d7f6466","line":201,"updated":"2015-06-04 13:04:53.000000000","message":"But the storage is local to the hypervisor, I would presume, rather than using a cinder volume.\n\nIn which case its no different which tenant you use.","commit_id":"0ff3307fd874da2fa1d46dcbec6349a8784bf5f2"}]}