)]}'
{"doc/source/specs/stx-6.0/approved/security-2008675-kubernetes-rootca-update.rst":[{"author":{"_account_id":26026,"name":"Greg Waines","email":"greg.waines@windriver.com","username":"gwaines"},"change_message_id":"8d70a5a14b2db2f5139981d43367b675e8aa6202","unresolved":true,"context_lines":[{"line_number":26,"context_line":"certificates signed by the root CA certificate in a rolling fashion (ie.,"},{"line_number":27,"context_line":"minimal impact on the applications and services running in the cluster)."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Currently Kubernetes doesn\u0027t provide such a mechanism out of the box. A manual"},{"line_number":30,"context_line":"update procedure is possible but it\u0027s lengthy and error-prone. This feature"},{"line_number":31,"context_line":"is to introduce a set of CLI/REST APIs and execution orchestration to simplify"},{"line_number":32,"context_line":"the procedure."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"40d5ad38_9dd0e2cb","line":30,"range":{"start_line":29,"start_character":70,"end_line":30,"end_character":62},"updated":"2021-03-16 12:51:54.000000000","message":"Should provide a link to kubernetes upstream documentation of this procedure.","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":28676,"name":"Andy Ning","email":"andy.ning@windriver.com","username":"andy.wrs"},"change_message_id":"ce2840c64ab74f482f6ace1355e7530925409e15","unresolved":false,"context_lines":[{"line_number":26,"context_line":"certificates signed by the root CA certificate in a rolling fashion (ie.,"},{"line_number":27,"context_line":"minimal impact on the applications and services running in the cluster)."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Currently Kubernetes doesn\u0027t provide such a mechanism out of the box. A manual"},{"line_number":30,"context_line":"update procedure is possible but it\u0027s lengthy and error-prone. This feature"},{"line_number":31,"context_line":"is to introduce a set of CLI/REST APIs and execution orchestration to simplify"},{"line_number":32,"context_line":"the procedure."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"47f466b7_d80c7be8","line":30,"range":{"start_line":29,"start_character":70,"end_line":30,"end_character":62},"in_reply_to":"40d5ad38_9dd0e2cb","updated":"2021-03-17 20:08:29.000000000","message":"Ack","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":9926,"name":"John Kung","email":"john.kung@windriver.com","username":"jkung"},"change_message_id":"e262b9f9cb6ca9c7f5bc20f50fd03902a03322eb","unresolved":true,"context_lines":[{"line_number":34,"context_line":"Use Cases"},{"line_number":35,"context_line":"---------"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"* The cluster\u0027s root CA certificate approachs its expiry date, the cloud admin"},{"line_number":38,"context_line":"  need to update the root CA certicate in order for the cluster to function"},{"line_number":39,"context_line":"  continously."},{"line_number":40,"context_line":"* The cloud admin decides to update the root CA certificate with a new one for"}],"source_content_type":"text/x-rst","patch_set":1,"id":"602f4c65_bf1dd77d","line":37,"range":{"start_line":37,"start_character":36,"end_line":37,"end_character":45},"updated":"2021-03-16 13:22:32.000000000","message":"approaches","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":28676,"name":"Andy Ning","email":"andy.ning@windriver.com","username":"andy.wrs"},"change_message_id":"ce2840c64ab74f482f6ace1355e7530925409e15","unresolved":false,"context_lines":[{"line_number":34,"context_line":"Use Cases"},{"line_number":35,"context_line":"---------"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"* The cluster\u0027s root CA certificate approachs its expiry date, the cloud admin"},{"line_number":38,"context_line":"  need to update the root CA certicate in order for the cluster to function"},{"line_number":39,"context_line":"  continously."},{"line_number":40,"context_line":"* The cloud admin decides to update the root CA certificate with a new one for"}],"source_content_type":"text/x-rst","patch_set":1,"id":"358a92c7_4e30b31d","line":37,"range":{"start_line":37,"start_character":36,"end_line":37,"end_character":45},"in_reply_to":"602f4c65_bf1dd77d","updated":"2021-03-17 20:08:29.000000000","message":"Ack","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":26026,"name":"Greg Waines","email":"greg.waines@windriver.com","username":"gwaines"},"change_message_id":"8d70a5a14b2db2f5139981d43367b675e8aa6202","unresolved":true,"context_lines":[{"line_number":54,"context_line":"third phase is to remove the old root CA certficate from components\u0027 and pods\u0027"},{"line_number":55,"context_line":"trusted CA bundle so that only the new root CA certificate is trusted."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"We will wrap up this update procedure by sysinv CLI commands and supporting"},{"line_number":58,"context_line":"APIs. The end user can then use these CLI commands to accomplish cluster root"},{"line_number":59,"context_line":"CA certifcate update."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Changes include adding new system CLI commands and sysinv REST APIs to the"},{"line_number":62,"context_line":"existing framework, adding logic to sysinv conductor to generate required"}],"source_content_type":"text/x-rst","patch_set":1,"id":"371f34d4_4b056a25","line":59,"range":{"start_line":57,"start_character":0,"end_line":59,"end_character":21},"updated":"2021-03-16 12:51:54.000000000","message":"Should maybe high-light that this is being done to hide the complexities of the underlying procedure, add in semantic checks and overall provides a simpler, less error-prone procedure.\n\nCould also mention this is analogous to the approach taken for other complex multi-host procedures such as k8s-upgrade, patching and upgrades.","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":9926,"name":"John Kung","email":"john.kung@windriver.com","username":"jkung"},"change_message_id":"e262b9f9cb6ca9c7f5bc20f50fd03902a03322eb","unresolved":true,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"We will wrap up this update procedure by sysinv CLI commands and supporting"},{"line_number":58,"context_line":"APIs. The end user can then use these CLI commands to accomplish cluster root"},{"line_number":59,"context_line":"CA certifcate update."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Changes include adding new system CLI commands and sysinv REST APIs to the"},{"line_number":62,"context_line":"existing framework, adding logic to sysinv conductor to generate required"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ca84e71a_606f69b2","line":59,"range":{"start_line":59,"start_character":3,"end_line":59,"end_character":14},"updated":"2021-03-16 13:22:32.000000000","message":"certificate","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":28676,"name":"Andy Ning","email":"andy.ning@windriver.com","username":"andy.wrs"},"change_message_id":"ce2840c64ab74f482f6ace1355e7530925409e15","unresolved":false,"context_lines":[{"line_number":54,"context_line":"third phase is to remove the old root CA certficate from components\u0027 and pods\u0027"},{"line_number":55,"context_line":"trusted CA bundle so that only the new root CA certificate is trusted."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"We will wrap up this update procedure by sysinv CLI commands and supporting"},{"line_number":58,"context_line":"APIs. The end user can then use these CLI commands to accomplish cluster root"},{"line_number":59,"context_line":"CA certifcate update."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Changes include adding new system CLI commands and sysinv REST APIs to the"},{"line_number":62,"context_line":"existing framework, adding logic to sysinv conductor to generate required"}],"source_content_type":"text/x-rst","patch_set":1,"id":"95059026_76e3e663","line":59,"range":{"start_line":57,"start_character":0,"end_line":59,"end_character":21},"in_reply_to":"371f34d4_4b056a25","updated":"2021-03-17 20:08:29.000000000","message":"Ack","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":28676,"name":"Andy Ning","email":"andy.ning@windriver.com","username":"andy.wrs"},"change_message_id":"ce2840c64ab74f482f6ace1355e7530925409e15","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"We will wrap up this update procedure by sysinv CLI commands and supporting"},{"line_number":58,"context_line":"APIs. The end user can then use these CLI commands to accomplish cluster root"},{"line_number":59,"context_line":"CA certifcate update."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Changes include adding new system CLI commands and sysinv REST APIs to the"},{"line_number":62,"context_line":"existing framework, adding logic to sysinv conductor to generate required"}],"source_content_type":"text/x-rst","patch_set":1,"id":"e78bb61f_9f6fb372","line":59,"range":{"start_line":59,"start_character":3,"end_line":59,"end_character":14},"in_reply_to":"ca84e71a_606f69b2","updated":"2021-03-17 20:08:29.000000000","message":"Ack","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":26026,"name":"Greg Waines","email":"greg.waines@windriver.com","username":"gwaines"},"change_message_id":"8d70a5a14b2db2f5139981d43367b675e8aa6202","unresolved":true,"context_lines":[{"line_number":68,"context_line":"orchestration is the second layer for executing the update across all hosts in"},{"line_number":69,"context_line":"a cluster, by utilizing support from sysinv. DC Orchestration is the very top"},{"line_number":70,"context_line":"layer for executing VIM orchestration across all subclouds of a DC system."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The initial version of the spec will cover only the first layer, the sysinv"},{"line_number":73,"context_line":"support for root CA certifcate update."},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"9ec78d4b_8de30fe3","line":71,"updated":"2021-03-16 12:51:54.000000000","message":"Should also mention like the 4th layer ... where cert-manager will manage the K8S Root CA Certificate and Key ... and cert-mon will raise an alarm when the certificate needs to be updated so that user can schedule the orchestration of the k8s Root CA update during a maintenance window.","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":28676,"name":"Andy Ning","email":"andy.ning@windriver.com","username":"andy.wrs"},"change_message_id":"ce2840c64ab74f482f6ace1355e7530925409e15","unresolved":false,"context_lines":[{"line_number":68,"context_line":"orchestration is the second layer for executing the update across all hosts in"},{"line_number":69,"context_line":"a cluster, by utilizing support from sysinv. DC Orchestration is the very top"},{"line_number":70,"context_line":"layer for executing VIM orchestration across all subclouds of a DC system."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The initial version of the spec will cover only the first layer, the sysinv"},{"line_number":73,"context_line":"support for root CA certifcate update."},{"line_number":74,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"0af4ed06_45c5afbf","line":71,"in_reply_to":"9ec78d4b_8de30fe3","updated":"2021-03-17 20:08:29.000000000","message":"Ack","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":9926,"name":"John Kung","email":"john.kung@windriver.com","username":"jkung"},"change_message_id":"e262b9f9cb6ca9c7f5bc20f50fd03902a03322eb","unresolved":true,"context_lines":[{"line_number":77,"context_line":""},{"line_number":78,"context_line":"A new set of sysinv CLI commands will be introduced to simplify the update"},{"line_number":79,"context_line":"procedure. It will be a procedure similar to software upgrade, with a start,"},{"line_number":80,"context_line":"execute and complete cycle. User can retry the command if it fails. And user"},{"line_number":81,"context_line":"can choose to restart the update procedure by uploading or re-generating a new"},{"line_number":82,"context_line":"root CA certficate."},{"line_number":83,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"c359ddf1_cec0d4bf","line":80,"updated":"2021-03-16 13:22:32.000000000","message":"is the platform software upgrade \u0027abort\u0027 concept applicable to certain states?  Reference to reload or regenerate the root CA below.","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":28676,"name":"Andy Ning","email":"andy.ning@windriver.com","username":"andy.wrs"},"change_message_id":"ce2840c64ab74f482f6ace1355e7530925409e15","unresolved":true,"context_lines":[{"line_number":77,"context_line":""},{"line_number":78,"context_line":"A new set of sysinv CLI commands will be introduced to simplify the update"},{"line_number":79,"context_line":"procedure. It will be a procedure similar to software upgrade, with a start,"},{"line_number":80,"context_line":"execute and complete cycle. User can retry the command if it fails. And user"},{"line_number":81,"context_line":"can choose to restart the update procedure by uploading or re-generating a new"},{"line_number":82,"context_line":"root CA certficate."},{"line_number":83,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"c2e850d2_4196e521","line":80,"in_reply_to":"c359ddf1_cec0d4bf","updated":"2021-03-17 20:08:29.000000000","message":"There won\u0027t be support for abort. I\u0027ll rewording the above paragraph as:\n\nA new set of sysinv CLI commands will be introduced to simplify the update\nprocedure. It will be a procedure similar to software upgrade, with a start,\nexecute and complete cycle. There won\u0027t be support for \"abort\", but user can\nretry the command if it fails. And user can choose to restart the update\nprocedure by uploading or re-generating a new root CA certficate. This also\nprovides a mechanism to resume to the original CA certificate if user chooses\nto upload the original CA certificate.","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":9926,"name":"John Kung","email":"john.kung@windriver.com","username":"jkung"},"change_message_id":"e262b9f9cb6ca9c7f5bc20f50fd03902a03322eb","unresolved":true,"context_lines":[{"line_number":93,"context_line":"2. system kube-rootca-certificate-generate"},{"line_number":94,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"* Generated a new kubernetes root CA certificate"},{"line_number":97,"context_line":"* Change progress state to update-new-rootca-cert-generated"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"2. system kube-rootca-certificate-upload"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1f16535f_73113891","line":96,"range":{"start_line":96,"start_character":2,"end_line":96,"end_character":12},"updated":"2021-03-16 13:22:32.000000000","message":"nit: Generates\n\nIt appears that upon return from command the progress state is updated as this is a synchronous operation","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":28676,"name":"Andy Ning","email":"andy.ning@windriver.com","username":"andy.wrs"},"change_message_id":"ce2840c64ab74f482f6ace1355e7530925409e15","unresolved":true,"context_lines":[{"line_number":93,"context_line":"2. system kube-rootca-certificate-generate"},{"line_number":94,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"* Generated a new kubernetes root CA certificate"},{"line_number":97,"context_line":"* Change progress state to update-new-rootca-cert-generated"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"2. system kube-rootca-certificate-upload"}],"source_content_type":"text/x-rst","patch_set":1,"id":"02939e47_3b322d57","line":96,"range":{"start_line":96,"start_character":2,"end_line":96,"end_character":12},"in_reply_to":"1f16535f_73113891","updated":"2021-03-17 20:08:29.000000000","message":"\u003e nit: Generates\n\u003e \n\u003e It appears that upon return from command the progress state is updated as this is a synchronous operation\n\nYes, we think this call can be complete within 15s, so it is intended to be a sync call.","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":26026,"name":"Greg Waines","email":"greg.waines@windriver.com","username":"gwaines"},"change_message_id":"8d70a5a14b2db2f5139981d43367b675e8aa6202","unresolved":true,"context_lines":[{"line_number":182,"context_line":"---------------------------"},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"TBD"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"Fault Handling"},{"line_number":187,"context_line":"--------------"},{"line_number":188,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"40f3b4de_93958c46","line":185,"updated":"2021-03-16 12:51:54.000000000","message":"Add another TBD section for cert-mon raising an alarm when k8s-root-ca certificate is nearing expiry.","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":28676,"name":"Andy Ning","email":"andy.ning@windriver.com","username":"andy.wrs"},"change_message_id":"ce2840c64ab74f482f6ace1355e7530925409e15","unresolved":false,"context_lines":[{"line_number":182,"context_line":"---------------------------"},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"TBD"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"Fault Handling"},{"line_number":187,"context_line":"--------------"},{"line_number":188,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"bc6febc7_916585d0","line":185,"in_reply_to":"40f3b4de_93958c46","updated":"2021-03-17 20:08:29.000000000","message":"Ack","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":9926,"name":"John Kung","email":"john.kung@windriver.com","username":"jkung"},"change_message_id":"e262b9f9cb6ca9c7f5bc20f50fd03902a03322eb","unresolved":true,"context_lines":[{"line_number":220,"context_line":"we have to handle kubelet client certificates as they are not managed by"},{"line_number":221,"context_line":"kubeadm."},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"Noticeably, this alternative procedure would be a lengthy manual error-prone"},{"line_number":224,"context_line":"procedure."},{"line_number":225,"context_line":""},{"line_number":226,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"f40e2155_5d500d30","line":223,"range":{"start_line":223,"start_character":0,"end_line":223,"end_character":10},"updated":"2021-03-16 13:22:32.000000000","message":"Notably","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":28676,"name":"Andy Ning","email":"andy.ning@windriver.com","username":"andy.wrs"},"change_message_id":"ce2840c64ab74f482f6ace1355e7530925409e15","unresolved":false,"context_lines":[{"line_number":220,"context_line":"we have to handle kubelet client certificates as they are not managed by"},{"line_number":221,"context_line":"kubeadm."},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"Noticeably, this alternative procedure would be a lengthy manual error-prone"},{"line_number":224,"context_line":"procedure."},{"line_number":225,"context_line":""},{"line_number":226,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"6beb24e1_25737e25","line":223,"range":{"start_line":223,"start_character":0,"end_line":223,"end_character":10},"in_reply_to":"f40e2155_5d500d30","updated":"2021-03-17 20:08:29.000000000","message":"Ack","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":26026,"name":"Greg Waines","email":"greg.waines@windriver.com","username":"gwaines"},"change_message_id":"8d70a5a14b2db2f5139981d43367b675e8aa6202","unresolved":true,"context_lines":[{"line_number":416,"context_line":"no changes to the existing security model."},{"line_number":417,"context_line":""},{"line_number":418,"context_line":"The feature is providing a mechanism to update kubernetes certificates."},{"line_number":419,"context_line":"Properly updating certificates will enhance cluster security."},{"line_number":420,"context_line":""},{"line_number":421,"context_line":"Other end user impact"},{"line_number":422,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a094c88_9a56d65a","line":419,"range":{"start_line":419,"start_character":0,"end_line":419,"end_character":9},"updated":"2021-03-16 12:51:54.000000000","message":"? More frequent ?","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":28676,"name":"Andy Ning","email":"andy.ning@windriver.com","username":"andy.wrs"},"change_message_id":"ce2840c64ab74f482f6ace1355e7530925409e15","unresolved":true,"context_lines":[{"line_number":416,"context_line":"no changes to the existing security model."},{"line_number":417,"context_line":""},{"line_number":418,"context_line":"The feature is providing a mechanism to update kubernetes certificates."},{"line_number":419,"context_line":"Properly updating certificates will enhance cluster security."},{"line_number":420,"context_line":""},{"line_number":421,"context_line":"Other end user impact"},{"line_number":422,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ce266955_ee81e62f","line":419,"range":{"start_line":419,"start_character":0,"end_line":419,"end_character":9},"in_reply_to":"9a094c88_9a56d65a","updated":"2021-03-17 20:08:29.000000000","message":"\u003e ? More frequent ?\n\nHow about \"Frequent or routine certificate update will enhance cluster security.\"","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":9926,"name":"John Kung","email":"john.kung@windriver.com","username":"jkung"},"change_message_id":"e262b9f9cb6ca9c7f5bc20f50fd03902a03322eb","unresolved":true,"context_lines":[{"line_number":454,"context_line":"be restarted during the update."},{"line_number":455,"context_line":""},{"line_number":456,"context_line":"Generally speaking, there shouldn\u0027t be any deployment or development activities"},{"line_number":457,"context_line":"on the system when a update is in progress. A maintanence window is a good time"},{"line_number":458,"context_line":"to do the update."},{"line_number":459,"context_line":""},{"line_number":460,"context_line":"Upgrade impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3cc5a736_8f7f104e","line":457,"range":{"start_line":457,"start_character":46,"end_line":457,"end_character":57},"updated":"2021-03-16 13:22:32.000000000","message":"maintenance","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":28676,"name":"Andy Ning","email":"andy.ning@windriver.com","username":"andy.wrs"},"change_message_id":"ce2840c64ab74f482f6ace1355e7530925409e15","unresolved":false,"context_lines":[{"line_number":454,"context_line":"be restarted during the update."},{"line_number":455,"context_line":""},{"line_number":456,"context_line":"Generally speaking, there shouldn\u0027t be any deployment or development activities"},{"line_number":457,"context_line":"on the system when a update is in progress. A maintanence window is a good time"},{"line_number":458,"context_line":"to do the update."},{"line_number":459,"context_line":""},{"line_number":460,"context_line":"Upgrade impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"4ccf800c_b79763e9","line":457,"range":{"start_line":457,"start_character":46,"end_line":457,"end_character":57},"in_reply_to":"3cc5a736_8f7f104e","updated":"2021-03-17 20:08:29.000000000","message":"Ack","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":9926,"name":"John Kung","email":"john.kung@windriver.com","username":"jkung"},"change_message_id":"e262b9f9cb6ca9c7f5bc20f50fd03902a03322eb","unresolved":true,"context_lines":[{"line_number":483,"context_line":""},{"line_number":484,"context_line":"* config"},{"line_number":485,"context_line":"* stx-puppet"},{"line_number":486,"context_line":""},{"line_number":487,"context_line":"Work Items"},{"line_number":488,"context_line":"----------"},{"line_number":489,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"a9bbe97f_20f0917b","line":486,"updated":"2021-03-16 13:22:32.000000000","message":"There are also mentioned (currently, TBD) nfv and distcloud repos","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":28676,"name":"Andy Ning","email":"andy.ning@windriver.com","username":"andy.wrs"},"change_message_id":"ce2840c64ab74f482f6ace1355e7530925409e15","unresolved":true,"context_lines":[{"line_number":483,"context_line":""},{"line_number":484,"context_line":"* config"},{"line_number":485,"context_line":"* stx-puppet"},{"line_number":486,"context_line":""},{"line_number":487,"context_line":"Work Items"},{"line_number":488,"context_line":"----------"},{"line_number":489,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"896752dd_9554c8b2","line":486,"in_reply_to":"a9bbe97f_20f0917b","updated":"2021-03-17 20:08:29.000000000","message":"\u003e There are also mentioned (currently, TBD) nfv and distcloud repos\n\nI\u0027ll re-wording as following to make it clear:\n\nImpacted repo from this spec:\n * config\n * stx-puppet","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":9926,"name":"John Kung","email":"john.kung@windriver.com","username":"jkung"},"change_message_id":"e262b9f9cb6ca9c7f5bc20f50fd03902a03322eb","unresolved":true,"context_lines":[{"line_number":516,"context_line":"  * basic infrastructure"},{"line_number":517,"context_line":"  * semantic checks"},{"line_number":518,"context_line":"  * conductor RPC/implementation (generate hieradata, call agent to apply"},{"line_number":519,"context_line":"    puppet manifests, waiting for result, update host state etc...)"},{"line_number":520,"context_line":"  * agent RPC/implementation (apply puppet manifest, report back config"},{"line_number":521,"context_line":"    status, etc...)"},{"line_number":522,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"2cd6fb2d_bc8925da","line":519,"range":{"start_line":519,"start_character":22,"end_line":519,"end_character":40},"updated":"2021-03-16 13:22:32.000000000","message":"the synchronous wait operations should be identified as potential impact to api responsiveness, other conductor operations, if any","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":28676,"name":"Andy Ning","email":"andy.ning@windriver.com","username":"andy.wrs"},"change_message_id":"ce2840c64ab74f482f6ace1355e7530925409e15","unresolved":true,"context_lines":[{"line_number":516,"context_line":"  * basic infrastructure"},{"line_number":517,"context_line":"  * semantic checks"},{"line_number":518,"context_line":"  * conductor RPC/implementation (generate hieradata, call agent to apply"},{"line_number":519,"context_line":"    puppet manifests, waiting for result, update host state etc...)"},{"line_number":520,"context_line":"  * agent RPC/implementation (apply puppet manifest, report back config"},{"line_number":521,"context_line":"    status, etc...)"},{"line_number":522,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a57e3de_15fcc103","line":519,"range":{"start_line":519,"start_character":22,"end_line":519,"end_character":40},"in_reply_to":"2cd6fb2d_bc8925da","updated":"2021-03-17 20:08:29.000000000","message":"\u003e the synchronous wait operations should be identified as potential impact to api responsiveness, other conductor operations, if any\n\nWhat I mean here is as a work item, conductor will need to handle the apply result. So I\u0027ll re-word \"waiting for result\" to \"handle apply result\". And this will be async instead of sync, as conductor calls config_apply_runtime_manifest() to apply manifest which is a rpc cast call.","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":9926,"name":"John Kung","email":"john.kung@windriver.com","username":"jkung"},"change_message_id":"e262b9f9cb6ca9c7f5bc20f50fd03902a03322eb","unresolved":true,"context_lines":[{"line_number":581,"context_line":"^^^^^^^^^^^^^^"},{"line_number":582,"context_line":""},{"line_number":583,"context_line":"* Upgrade script to create the new tables in sysinv database"},{"line_number":584,"context_line":""},{"line_number":585,"context_line":"Dependencies"},{"line_number":586,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":587,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"a36ce963_7f62fa27","line":584,"updated":"2021-03-16 13:22:32.000000000","message":"other than the db migrate, there does not appear to be any migration scripts needed under controllerconfig/upgrade-scripts?","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":28676,"name":"Andy Ning","email":"andy.ning@windriver.com","username":"andy.wrs"},"change_message_id":"ce2840c64ab74f482f6ace1355e7530925409e15","unresolved":true,"context_lines":[{"line_number":581,"context_line":"^^^^^^^^^^^^^^"},{"line_number":582,"context_line":""},{"line_number":583,"context_line":"* Upgrade script to create the new tables in sysinv database"},{"line_number":584,"context_line":""},{"line_number":585,"context_line":"Dependencies"},{"line_number":586,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":587,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"f581dd54_7d45a49f","line":584,"in_reply_to":"a36ce963_7f62fa27","updated":"2021-03-17 20:08:29.000000000","message":"Will reword this to:\n* Upgrade script to create the new tables in sysinv database when upgrading\n  from a release without this feature.","commit_id":"a4110226c2e84afa1938e52bb6e4ee411ebdf3c5"},{"author":{"_account_id":28402,"name":"Mingyuan Qi","email":"mingyuan.qi@intel.com","username":"myqi"},"change_message_id":"58be177dd0b8b8b12bee0e242a72fbd6c1286ac7","unresolved":true,"context_lines":[{"line_number":132,"context_line":"* Change progess state to updated-pods-trustBothCAs on success"},{"line_number":133,"context_line":"* Change progess state to updating-pods-trustBothCAs-failed on failure"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"5. system kube-rootca-host-update \u003chostname\u003e --phase\u003dupdateCerts"},{"line_number":136,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"* Update admin.conf\u0027s client cert/key data with new ones signed by the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"28afa9d7_c044c3e0","line":135,"range":{"start_line":135,"start_character":0,"end_line":135,"end_character":3},"updated":"2021-04-01 06:20:40.000000000","message":"what about etcd certificates? Currently the etcd certs are signed by this root CA as well.","commit_id":"8c2f28e24f573568455c7625c6e2688dfe6e4dee"},{"author":{"_account_id":28676,"name":"Andy Ning","email":"andy.ning@windriver.com","username":"andy.wrs"},"change_message_id":"4bdb4a9a67267253e45a590c11b70750a36218f1","unresolved":true,"context_lines":[{"line_number":132,"context_line":"* Change progess state to updated-pods-trustBothCAs on success"},{"line_number":133,"context_line":"* Change progess state to updating-pods-trustBothCAs-failed on failure"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"5. system kube-rootca-host-update \u003chostname\u003e --phase\u003dupdateCerts"},{"line_number":136,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"* Update admin.conf\u0027s client cert/key data with new ones signed by the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"c600367c_bdd88b09","line":135,"range":{"start_line":135,"start_character":0,"end_line":135,"end_character":3},"in_reply_to":"28afa9d7_c044c3e0","updated":"2021-04-01 14:13:40.000000000","message":"\u003e what about etcd certificates? Currently the etcd certs are signed by this root CA as well.\n\nThis spec only cover kubernetes-ca certificates, etcd-ca and front-proxy-ca should be separated from kubernetes-ca. I don\u0027t think it\u0027s a good idea to sign etcd certs with kubernetes-ca. (See my comments on https://review.opendev.org/c/starlingx/ansible-playbooks/+/784006)","commit_id":"8c2f28e24f573568455c7625c6e2688dfe6e4dee"},{"author":{"_account_id":28402,"name":"Mingyuan Qi","email":"mingyuan.qi@intel.com","username":"myqi"},"change_message_id":"5cd0d2ea42e58ad80f7ced6cf8e706eb8692aa08","unresolved":true,"context_lines":[{"line_number":132,"context_line":"* Change progess state to updated-pods-trustBothCAs on success"},{"line_number":133,"context_line":"* Change progess state to updating-pods-trustBothCAs-failed on failure"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"5. system kube-rootca-host-update \u003chostname\u003e --phase\u003dupdateCerts"},{"line_number":136,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"* Update admin.conf\u0027s client cert/key data with new ones signed by the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"057de6f0_bb5aa767","line":135,"range":{"start_line":135,"start_character":0,"end_line":135,"end_character":3},"in_reply_to":"c600367c_bdd88b09","updated":"2021-04-07 01:41:45.000000000","message":"That makes sense, I will give +2","commit_id":"8c2f28e24f573568455c7625c6e2688dfe6e4dee"}]}