)]}'
{"packstack/puppet/modules/packstack/manifests/nova/compute.pp":[{"author":{"_account_id":23811,"name":"Oliver Walsh","email":"owalsh@redhat.com","username":"owalsh"},"change_message_id":"ee53d49ed91a870eea8fd7fdb49be004a2e2c378","unresolved":false,"context_lines":[{"line_number":33,"context_line":"        require \u003d\u003e Package[\u0027openstack-nova-migration\u0027],"},{"line_number":34,"context_line":"      }"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"      include ssh::server"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"      ssh::server::match_block { \u0027nova_migration allow\u0027:"},{"line_number":39,"context_line":"        name    \u003d\u003e \u0027nova_migration\u0027,"}],"source_content_type":"text/x-puppet","patch_set":1,"id":"3f044301_b0ed84b8","line":36,"range":{"start_line":36,"start_character":6,"end_line":36,"end_character":25},"updated":"2017-05-11 10:53:49.000000000","message":"Be aware that there are side-effects. This now manages /etc/ssh/sshd_config and will set the contents to the puppet-ssh defaults.","commit_id":"2460d7305b0c33f86d84d9fe5e30ce2915af7a52"},{"author":{"_account_id":13294,"name":"Javier Peña","email":"jpena@redhat.com","username":"jpena"},"change_message_id":"7cd30337f5bed001611491544a1e175099cefb0b","unresolved":false,"context_lines":[{"line_number":33,"context_line":"        require \u003d\u003e Package[\u0027openstack-nova-migration\u0027],"},{"line_number":34,"context_line":"      }"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"      include ssh::server"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"      ssh::server::match_block { \u0027nova_migration allow\u0027:"},{"line_number":39,"context_line":"        name    \u003d\u003e \u0027nova_migration\u0027,"}],"source_content_type":"text/x-puppet","patch_set":1,"id":"3f044301_f625440a","line":36,"range":{"start_line":36,"start_character":6,"end_line":36,"end_character":25},"in_reply_to":"3f044301_b0ed84b8","updated":"2017-05-11 12:30:01.000000000","message":"Yes, I know :-/. I\u0027m going to think about potential alternatives, but I don\u0027t know how clean they will be.","commit_id":"2460d7305b0c33f86d84d9fe5e30ce2915af7a52"},{"author":{"_account_id":23811,"name":"Oliver Walsh","email":"owalsh@redhat.com","username":"owalsh"},"change_message_id":"ecb39cba16696ebb7a886fc2a23cb087070278b0","unresolved":false,"context_lines":[{"line_number":33,"context_line":"        require \u003d\u003e Package[\u0027openstack-nova-migration\u0027],"},{"line_number":34,"context_line":"      }"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"      augeas{\u0027Match block for user nova_migration\u0027:"},{"line_number":37,"context_line":"        context \u003d\u003e \u0027/files/etc/ssh/sshd_config\u0027,"},{"line_number":38,"context_line":"        changes \u003d\u003e ["},{"line_number":39,"context_line":"          \u0027set Match[User nova_migration]/Condition/User nova_migration\u0027,"},{"line_number":40,"context_line":"          \u0027set Match[Condition/User \u003d \"nova_migration\"]/Settings/AllowTcpForwarding no\u0027,"},{"line_number":41,"context_line":"          \u0027set Match[Condition/User \u003d \"nova_migration\"]/Settings/AuthorizedKeysFile /etc/nova/migration/authorized_keys\u0027,"},{"line_number":42,"context_line":"          \u0027set Match[Condition/User \u003d \"nova_migration\"]/Settings/ForceCommand /bin/nova-migration-wrapper\u0027,"},{"line_number":43,"context_line":"          \u0027set Match[Condition/User \u003d \"nova_migration\"]/Settings/PasswordAuthentication no\u0027,"},{"line_number":44,"context_line":"          \u0027set Match[Condition/User \u003d \"nova_migration\"]/Settings/X11Forwarding no\u0027,"},{"line_number":45,"context_line":"         ],"},{"line_number":46,"context_line":"        onlyif \u003d\u003e \u0027match Match[Condition/User \u003d \"nova_migration\"] size \u003d\u003d 0\u0027,"},{"line_number":47,"context_line":"        notify \u003d\u003e Service[\u0027sshd\u0027]"},{"line_number":48,"context_line":"      }"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"      service {\u0027sshd\u0027:"},{"line_number":51,"context_line":"        ensure  \u003d\u003e running,"}],"source_content_type":"text/x-puppet","patch_set":2,"id":"3f044301_2b11fe04","line":48,"range":{"start_line":36,"start_character":6,"end_line":48,"end_character":7},"updated":"2017-05-11 20:53:48.000000000","message":"Not nearly as evil as I expected :-)","commit_id":"7e993f14f1266866bc32b175104bceca43850720"}],"packstack/puppet/modules/packstack/manifests/nova/compute/libvirt.pp":[{"author":{"_account_id":23811,"name":"Oliver Walsh","email":"owalsh@redhat.com","username":"owalsh"},"change_message_id":"ecb39cba16696ebb7a886fc2a23cb087070278b0","unresolved":false,"context_lines":[{"line_number":30,"context_line":"    $migrate_transport \u003d hiera(\u0027CONFIG_NOVA_COMPUTE_MIGRATE_PROTOCOL\u0027)"},{"line_number":31,"context_line":"    if $migrate_transport \u003d\u003d \u0027ssh\u0027 {"},{"line_number":32,"context_line":"      $client_extraparams \u003d {"},{"line_number":33,"context_line":"        no_verify \u003d\u003e 1,"},{"line_number":34,"context_line":"        keyfile   \u003d\u003e \u0027/etc/nova/migration/identity\u0027,"},{"line_number":35,"context_line":"      }"},{"line_number":36,"context_line":"    } else {"}],"source_content_type":"text/x-puppet","patch_set":2,"id":"3f044301_2b59fe33","line":33,"range":{"start_line":33,"start_character":8,"end_line":33,"end_character":22},"updated":"2017-05-11 20:53:48.000000000","message":"This makes it vulnerable to a MITM attack, but I guess we can\u0027t setup ssh known_hosts with packstack.\n\nMaybe should have a config option to disable this if the known hosts have been setup manually.","commit_id":"7e993f14f1266866bc32b175104bceca43850720"},{"author":{"_account_id":13294,"name":"Javier Peña","email":"jpena@redhat.com","username":"jpena"},"change_message_id":"d106417af28e8f3d454c06a758e613fe812f171c","unresolved":false,"context_lines":[{"line_number":30,"context_line":"    $migrate_transport \u003d hiera(\u0027CONFIG_NOVA_COMPUTE_MIGRATE_PROTOCOL\u0027)"},{"line_number":31,"context_line":"    if $migrate_transport \u003d\u003d \u0027ssh\u0027 {"},{"line_number":32,"context_line":"      $client_extraparams \u003d {"},{"line_number":33,"context_line":"        no_verify \u003d\u003e 1,"},{"line_number":34,"context_line":"        keyfile   \u003d\u003e \u0027/etc/nova/migration/identity\u0027,"},{"line_number":35,"context_line":"      }"},{"line_number":36,"context_line":"    } else {"}],"source_content_type":"text/x-puppet","patch_set":2,"id":"3f044301_eb778f9f","line":33,"range":{"start_line":33,"start_character":8,"end_line":33,"end_character":22},"in_reply_to":"3f044301_2b59fe33","updated":"2017-05-12 09:00:57.000000000","message":"Let me run some tests. I think we collect the SSH host keys of each compute node, so in theory we should be able to verify them.","commit_id":"7e993f14f1266866bc32b175104bceca43850720"}]}