)]}'
{"doc/source/discussion/components.rst":[{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"a7814d31123bf0fb4ba29c399fe0356d0a5b34d9","unresolved":false,"context_lines":[{"line_number":199,"context_line":""},{"line_number":200,"context_line":"   .. attr:: auth_credential"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"      The authentication credential."},{"line_number":203,"context_line":""},{"line_number":204,"context_line":""},{"line_number":205,"context_line":".. _scheduler:"}],"source_content_type":"text/x-rst","patch_set":16,"id":"1fa4df85_926feffa","line":202,"updated":"2020-03-05 18:01:53.000000000","message":"In nodepool, we have user/password separate.  Even though the config formats are different, I think it would make sense to be consistent.  Either approach has its benefits, but how about we pick one?","commit_id":"2b4df82d1ddd6bee942395b7d5b026022a5e9e34"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"039f84e1df6c9abe01f08ed10fa7969eeca025be","unresolved":false,"context_lines":[{"line_number":199,"context_line":""},{"line_number":200,"context_line":"   .. attr:: auth_credential"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"      The authentication credential."},{"line_number":203,"context_line":""},{"line_number":204,"context_line":""},{"line_number":205,"context_line":".. _scheduler:"}],"source_content_type":"text/x-rst","patch_set":16,"id":"1fa4df85_f41942d6","line":202,"in_reply_to":"1fa4df85_926feffa","updated":"2020-03-09 21:36:46.000000000","message":"Next PS copies the config attribute from nodepool.","commit_id":"2b4df82d1ddd6bee942395b7d5b026022a5e9e34"}],"releasenotes/notes/zookeeper-auth-4e3c69c26bb60ce1.yaml":[{"author":{"_account_id":3099,"name":"David Shrewsbury","email":"dshrewsb@redhat.com","username":"dshrews"},"change_message_id":"232d2351f3096da938ac171ea63884693cd4abf4","unresolved":false,"context_lines":[{"line_number":5,"context_line":"    auth_credential options."},{"line_number":6,"context_line":"upgrade:"},{"line_number":7,"context_line":"  - |"},{"line_number":8,"context_line":"    Before changing zookeeper-auth, use the zookeeper-update-auth script"},{"line_number":9,"context_line":"    from nodepool to update node acls. Both Nodepool and Zuul needs to"},{"line_number":10,"context_line":"    be restarted after setting zookeeper-auth."}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_d5531116","line":8,"range":{"start_line":8,"start_character":44,"end_line":8,"end_character":65},"updated":"2020-03-05 18:15:35.000000000","message":"nodepool-update-zk-auth appears to be the actual name.\n\nAlso, zuul also creates zookeeper nodes that nodepool knows nothing about (e.g., hold request znodes). We need a separate script, I think.","commit_id":"2b4df82d1ddd6bee942395b7d5b026022a5e9e34"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"039f84e1df6c9abe01f08ed10fa7969eeca025be","unresolved":false,"context_lines":[{"line_number":5,"context_line":"    auth_credential options."},{"line_number":6,"context_line":"upgrade:"},{"line_number":7,"context_line":"  - |"},{"line_number":8,"context_line":"    Before changing zookeeper-auth, use the zookeeper-update-auth script"},{"line_number":9,"context_line":"    from nodepool to update node acls. Both Nodepool and Zuul needs to"},{"line_number":10,"context_line":"    be restarted after setting zookeeper-auth."}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_b40f4a86","line":8,"range":{"start_line":8,"start_character":44,"end_line":8,"end_character":65},"in_reply_to":"1fa4df85_d5531116","updated":"2020-03-09 21:36:46.000000000","message":"Done","commit_id":"2b4df82d1ddd6bee942395b7d5b026022a5e9e34"}],"tests/base.py":[{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"a7814d31123bf0fb4ba29c399fe0356d0a5b34d9","unresolved":false,"context_lines":[{"line_number":2841,"context_line":"        self.host_keys \u003d None"},{"line_number":2842,"context_line":"        # Only the username is needed for sasl acl"},{"line_number":2843,"context_line":"        self.acl \u003d (kazoo.security.make_acl("},{"line_number":2844,"context_line":"            zk_auth[0], zk_auth[1].split(\u0027:\u0027)[0], all\u003dTrue),)"},{"line_number":2845,"context_line":"        self.client \u003d kazoo.client.KazooClient("},{"line_number":2846,"context_line":"            hosts\u003d\u0027%s:%s%s\u0027 % (host, port, chroot),"},{"line_number":2847,"context_line":"            auth_data\u003d(zk_auth,),"}],"source_content_type":"text/x-python","patch_set":16,"id":"1fa4df85_32787bc2","line":2844,"updated":"2020-03-05 18:01:53.000000000","message":"Whenever we split, we should probably handle the case where there is no password, so that kerberos can be used.","commit_id":"2b4df82d1ddd6bee942395b7d5b026022a5e9e34"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"039f84e1df6c9abe01f08ed10fa7969eeca025be","unresolved":false,"context_lines":[{"line_number":2841,"context_line":"        self.host_keys \u003d None"},{"line_number":2842,"context_line":"        # Only the username is needed for sasl acl"},{"line_number":2843,"context_line":"        self.acl \u003d (kazoo.security.make_acl("},{"line_number":2844,"context_line":"            zk_auth[0], zk_auth[1].split(\u0027:\u0027)[0], all\u003dTrue),)"},{"line_number":2845,"context_line":"        self.client \u003d kazoo.client.KazooClient("},{"line_number":2846,"context_line":"            hosts\u003d\u0027%s:%s%s\u0027 % (host, port, chroot),"},{"line_number":2847,"context_line":"            auth_data\u003d(zk_auth,),"}],"source_content_type":"text/x-python","patch_set":16,"id":"1fa4df85_d47be6f1","line":2844,"in_reply_to":"1fa4df85_32787bc2","updated":"2020-03-09 21:36:46.000000000","message":"As discussed over IRC, this first implementation only support SASL.","commit_id":"2b4df82d1ddd6bee942395b7d5b026022a5e9e34"}],"zuul/cmd/update_zk_auth.py":[{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"c981bf6dee3c80db4ee7f824060c9e36f3b55164","unresolved":false,"context_lines":[{"line_number":42,"context_line":"        zk_acl \u003d zk_auth.getACL()"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"        if not self.args.chroot:"},{"line_number":45,"context_line":"            self.args.chroot \u003d [\"/zuul\", \"/nodepool\"]"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"        zk \u003d zuul.zk.ZooKeeper()"},{"line_number":48,"context_line":"        zk.connect(zookeeper_hosts, auth_data\u003dzk_auth)"}],"source_content_type":"text/x-python","patch_set":21,"id":"1fa4df85_c048f65c","line":45,"updated":"2020-03-10 16:41:57.000000000","message":"I think this should be separate from chroot.\n\nThe chroot option lets someone host zuul and nodepool within a larger namespace.  Like \"/something/zuul\".  What we should do with the \u0027--chroot\u0027 argument is pass that into the kazoo client constructor.  Separately, the list of \"root\" nodes (within the chroot), that is, \u0027zuul\u0027 and \u0027nodepool\u0027, should be fixed in this script.  There\u0027s no reason for us to manage anything else.\n\nNodepool has a config file option to pass in a chroot.  It looks like we forgot to add that to Zuul.  Effectively, it\u0027s not possible to use a chroot with Zuul and Nodepool.  But let\u0027s just fix the chroot option in this script, then later we can add the option to Zuul.","commit_id":"00454b6525b5a02bf7163eab203a15ef14dc8160"}],"zuul/zk.py":[{"author":{"_account_id":16068,"name":"Tobias Henkel","email":"tobias.henkel@bmw.de","username":"tobias.henkel"},"change_message_id":"d4c9fdbfed6d7a5153cf08029fde9ee69309fdb8","unresolved":false,"context_lines":[{"line_number":125,"context_line":"                read_only\u003dread_only,"},{"line_number":126,"context_line":"                timeout\u003dtimeout,"},{"line_number":127,"context_line":"                auth_data\u003dauth_data,"},{"line_number":128,"context_line":"                default_acl\u003dacl)"},{"line_number":129,"context_line":"            self.client.add_listener(self._connection_listener)"},{"line_number":130,"context_line":"            # Manually retry initial connection attempt"},{"line_number":131,"context_line":"            while True:"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_87632dac","line":128,"range":{"start_line":128,"start_character":16,"end_line":128,"end_character":31},"updated":"2018-12-09 11:31:05.000000000","message":"As I understood from kazoo docs this will only affect new znodes. So all already existing znodes won\u0027t be protected. I think we should make this clear in the docs.\n\nAlso did I understand this correctly that every client can just supply any credentials and zk will accept them. Then each client will supply acls so only specific clients can use specific data?","commit_id":"c3a6a1f5721e7f47d1434814b646732133f16c75"},{"author":{"_account_id":16068,"name":"Tobias Henkel","email":"tobias.henkel@bmw.de","username":"tobias.henkel"},"change_message_id":"07e4c8cd85ae1da352088523b4d28a8f53840898","unresolved":false,"context_lines":[{"line_number":125,"context_line":"                read_only\u003dread_only,"},{"line_number":126,"context_line":"                timeout\u003dtimeout,"},{"line_number":127,"context_line":"                auth_data\u003dauth_data,"},{"line_number":128,"context_line":"                default_acl\u003dacl)"},{"line_number":129,"context_line":"            self.client.add_listener(self._connection_listener)"},{"line_number":130,"context_line":"            # Manually retry initial connection attempt"},{"line_number":131,"context_line":"            while True:"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_bd3af8c1","line":128,"range":{"start_line":128,"start_character":16,"end_line":128,"end_character":31},"in_reply_to":"3f79a3b5_423183ba","updated":"2018-12-09 17:04:13.000000000","message":"Yes, I think we should add that to the upgrade note in zuul as well. Also we need to add the full-shutdown-upgrade requirement to the upgrade note.","commit_id":"c3a6a1f5721e7f47d1434814b646732133f16c75"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"5f068b5a790d15a2aa757dc0bf521038552e167c","unresolved":false,"context_lines":[{"line_number":125,"context_line":"                read_only\u003dread_only,"},{"line_number":126,"context_line":"                timeout\u003dtimeout,"},{"line_number":127,"context_line":"                auth_data\u003dauth_data,"},{"line_number":128,"context_line":"                default_acl\u003dacl)"},{"line_number":129,"context_line":"            self.client.add_listener(self._connection_listener)"},{"line_number":130,"context_line":"            # Manually retry initial connection attempt"},{"line_number":131,"context_line":"            while True:"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_423183ba","line":128,"range":{"start_line":128,"start_character":16,"end_line":128,"end_character":31},"in_reply_to":"3f79a3b5_87632dac","updated":"2018-12-09 14:14:01.000000000","message":"The znodes update procedure is marked as WIP in the nodepool change: https://review.openstack.org/619155 . Should I copy the procedure in Zuul with the upgrade note?\n\nAFAIU, security is enforced per node acl, which has to be provided by the client. Nodepool and Zuul would have to be upgraded simultaneously using the same set of credentials.","commit_id":"c3a6a1f5721e7f47d1434814b646732133f16c75"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"0bdadbea8ae74c4e40c88c4264c8e64d8c921215","unresolved":false,"context_lines":[{"line_number":125,"context_line":"                read_only\u003dread_only,"},{"line_number":126,"context_line":"                timeout\u003dtimeout,"},{"line_number":127,"context_line":"                auth_data\u003dauth_data,"},{"line_number":128,"context_line":"                default_acl\u003dacl)"},{"line_number":129,"context_line":"            self.client.add_listener(self._connection_listener)"},{"line_number":130,"context_line":"            # Manually retry initial connection attempt"},{"line_number":131,"context_line":"            while True:"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f79a3b5_18bbf3be","line":128,"range":{"start_line":128,"start_character":16,"end_line":128,"end_character":31},"in_reply_to":"3f79a3b5_bd3af8c1","updated":"2018-12-10 09:22:57.000000000","message":"Done","commit_id":"c3a6a1f5721e7f47d1434814b646732133f16c75"},{"author":{"_account_id":1,"name":"James E. Blair","email":"jim@acmegating.com","username":"corvus"},"change_message_id":"a7814d31123bf0fb4ba29c399fe0356d0a5b34d9","unresolved":false,"context_lines":[{"line_number":133,"context_line":"        if self.client is None:"},{"line_number":134,"context_line":"            if auth_data:"},{"line_number":135,"context_line":"                acl \u003d (kazoo.security.make_acl("},{"line_number":136,"context_line":"                    auth_data[0], auth_data[1], all\u003dTrue),)"},{"line_number":137,"context_line":"                auth_data \u003d (auth_data,)"},{"line_number":138,"context_line":"            else:"},{"line_number":139,"context_line":"                acl \u003d None"}],"source_content_type":"text/x-python","patch_set":16,"id":"1fa4df85_5275f7c9","line":136,"updated":"2020-03-05 18:01:53.000000000","message":"Is this going to encode the password in the acl too?","commit_id":"2b4df82d1ddd6bee942395b7d5b026022a5e9e34"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"039f84e1df6c9abe01f08ed10fa7969eeca025be","unresolved":false,"context_lines":[{"line_number":133,"context_line":"        if self.client is None:"},{"line_number":134,"context_line":"            if auth_data:"},{"line_number":135,"context_line":"                acl \u003d (kazoo.security.make_acl("},{"line_number":136,"context_line":"                    auth_data[0], auth_data[1], all\u003dTrue),)"},{"line_number":137,"context_line":"                auth_data \u003d (auth_data,)"},{"line_number":138,"context_line":"            else:"},{"line_number":139,"context_line":"                acl \u003d None"}],"source_content_type":"text/x-python","patch_set":16,"id":"1fa4df85_f47e22e2","line":136,"in_reply_to":"1fa4df85_5275f7c9","updated":"2020-03-09 21:36:46.000000000","message":"Not in PS17","commit_id":"2b4df82d1ddd6bee942395b7d5b026022a5e9e34"}]}