)]}'
{"specs/liberty/approved/hyper-v-vtpm-devices.rst":[{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"1cfc7740126f8f206983dc421288f24b3605c923","unresolved":false,"context_lines":[{"line_number":58,"context_line":"* Specifying the image property ``os_vtpm_device`` with the value ``required``."},{"line_number":59,"context_line":"* Specifying the image property ``os_vtpm_device`` with the value ``optional``"},{"line_number":60,"context_line":"  and the flavor extra spec ``os:vtpm_device with the value ``required``."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"If an instance requires vTPM, the HyperVDriver will have to attach the vTPM"},{"line_number":63,"context_line":"device after the instance was created."},{"line_number":64,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa32b979_b17b87f4","line":61,"updated":"2015-06-24 17:45:10.000000000","message":"I think that alongside creation of the vTPM, we need property(s) to allow the TPM to be populated with data (ie keys).\n\nPerhaps \n\n  os_vtpm\u003dyes|no\n  os_vtpm_keys\u003d\"somekeyref1,somekeyref2,somekeyref3,...\"\n\nIn fact it seems the os_vtpm property is actually redundant - the mere fact that the image contains a list of vtpm keys should be enough to indicate a vTPM device needs to be provided. So perhaps just a os_vtpm_keys image property is required.","commit_id":"10783e016577214533859a490cd21d4bd97d13c6"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"80ab6a36d4e9defa9c2134b88ce8be9a7e1eaea4","unresolved":false,"context_lines":[{"line_number":58,"context_line":"* Specifying the image property ``os_vtpm_device`` with the value ``required``."},{"line_number":59,"context_line":"* Specifying the image property ``os_vtpm_device`` with the value ``optional``"},{"line_number":60,"context_line":"  and the flavor extra spec ``os:vtpm_device with the value ``required``."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"If an instance requires vTPM, the HyperVDriver will have to attach the vTPM"},{"line_number":63,"context_line":"device after the instance was created."},{"line_number":64,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa32b979_1736bc02","line":61,"in_reply_to":"fa32b979_32799193","updated":"2015-06-25 13:39:26.000000000","message":"Your comments don\u0027t really make alot of sense.  Your proposed os_encryption_key_ref from the shielded VMs spec allows the user to specify  a key to add to the vTPM. I\u0027m saying we should just generalize that name to \u0027os_vtpm_keys\u0027 and thus not directly associate it with being a key for the shielded VMs feature.\n\nThe naming doesn\u0027t suggest allowance for mutliple key ref values - we have a limit of 255 on the length of image property values, so we need to consider how may we can list before overflowing that. If the keys are identified by UUIDs, that is a min of 36 characters + separator, so we\u0027d only be able to list 6 keys.\n\nThe mention of backdoors is completely irrelevant here. The tenant user is providing the disk image and the tenant user is providing the image metadata \u0026 keys to go with it. The tenant user is hardly goig to backdoor their own VM are they.","commit_id":"10783e016577214533859a490cd21d4bd97d13c6"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"e33ff4ce2e5f58ae6ddd1890c95d0d3bdc2d21ef","unresolved":false,"context_lines":[{"line_number":58,"context_line":"* Specifying the image property ``os_vtpm_device`` with the value ``required``."},{"line_number":59,"context_line":"* Specifying the image property ``os_vtpm_device`` with the value ``optional``"},{"line_number":60,"context_line":"  and the flavor extra spec ``os:vtpm_device with the value ``required``."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"If an instance requires vTPM, the HyperVDriver will have to attach the vTPM"},{"line_number":63,"context_line":"device after the instance was created."},{"line_number":64,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa32b979_d5485a2f","line":61,"in_reply_to":"fa32b979_67ee9223","updated":"2015-06-25 09:28:47.000000000","message":"In your Shield VMs spec which uses this vTPM feature, you are saying that the user provides a decryption key which is made available to the guest via the vTPM. So I\u0027m saying that instead of special casing the disk encryption key setup, we provide a more general purpose property for populating the keys in the vTPM.","commit_id":"10783e016577214533859a490cd21d4bd97d13c6"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"08ccadd8a367d7aca33d92409fc88e849091f416","unresolved":false,"context_lines":[{"line_number":58,"context_line":"* Specifying the image property ``os_vtpm_device`` with the value ``required``."},{"line_number":59,"context_line":"* Specifying the image property ``os_vtpm_device`` with the value ``optional``"},{"line_number":60,"context_line":"  and the flavor extra spec ``os:vtpm_device with the value ``required``."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"If an instance requires vTPM, the HyperVDriver will have to attach the vTPM"},{"line_number":63,"context_line":"device after the instance was created."},{"line_number":64,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa32b979_67ee9223","line":61,"in_reply_to":"fa32b979_b17b87f4","updated":"2015-06-24 23:21:46.000000000","message":"Adding such properties from outside the guest can be a bit tricky, since the content of the KeyProtector is encrypted by the HGS Key Protection Service. It cannot just be simply altered. Anyways, if it possible, it can be added later, although I can\u0027t imagine a useful scenario.\n\nAlso, there is the case where vTPM is necessary, but no ``os_vtpm_keys`` is provided.\n\nFreshly spawned instances should spawn with clean vTPMs, which later will be populated by the guest OSes.","commit_id":"10783e016577214533859a490cd21d4bd97d13c6"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"68cd7aa478addcad519c50c73b20397982f0282b","unresolved":false,"context_lines":[{"line_number":58,"context_line":"* Specifying the image property ``os_vtpm_device`` with the value ``required``."},{"line_number":59,"context_line":"* Specifying the image property ``os_vtpm_device`` with the value ``optional``"},{"line_number":60,"context_line":"  and the flavor extra spec ``os:vtpm_device with the value ``required``."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"If an instance requires vTPM, the HyperVDriver will have to attach the vTPM"},{"line_number":63,"context_line":"device after the instance was created."},{"line_number":64,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa32b979_32799193","line":61,"in_reply_to":"fa32b979_b71d9310","updated":"2015-06-25 12:35:46.000000000","message":"If you are referring to adding more keys into the vTPM, outside the guest, that doesn\u0027t sound like a safe thing to do. Plus, can\u0027t really determine if it will conflict with the existing data or it will introduce backdoors.","commit_id":"10783e016577214533859a490cd21d4bd97d13c6"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"ccbe5f80fb33a4d8c9d1720e6c77023209a6a0b3","unresolved":false,"context_lines":[{"line_number":58,"context_line":"* Specifying the image property ``os_vtpm_device`` with the value ``required``."},{"line_number":59,"context_line":"* Specifying the image property ``os_vtpm_device`` with the value ``optional``"},{"line_number":60,"context_line":"  and the flavor extra spec ``os:vtpm_device with the value ``required``."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"If an instance requires vTPM, the HyperVDriver will have to attach the vTPM"},{"line_number":63,"context_line":"device after the instance was created."},{"line_number":64,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa32b979_b71d9310","line":61,"in_reply_to":"fa32b979_d5485a2f","updated":"2015-06-25 12:21:35.000000000","message":"I\u0027ve included the Shielded VM spec into this one. It should simplify things and review.\n\nSo, I\u0027ve made a few changes, I\u0027ve added the ``os_encryption_key_ref`` image property.  If it not added, the vTPM will be created as is, clean, waiting to be populated by the guest OS. If the img prop is provided, it will set that data into the vTPM.\n\nAs for setting multiple keys... the data from os_encryption_key_ref should be a collection of keys anyways.","commit_id":"10783e016577214533859a490cd21d4bd97d13c6"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"b8efccf11032f8c95fce8ca46270cdf151914efa","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"* Specifying the image property ``os_vtpm`` with the value ``required``."},{"line_number":75,"context_line":"* Specifying the image property ``os_vtpm`` with the value ``optional``"},{"line_number":76,"context_line":"  and the flavor extra spec ``os:vtpm`` with the value ``required``."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"The image property ``os_encryption_key_ref`` contains the reference to the"},{"line_number":79,"context_line":"Barbican stored secret. This secret contains data that must be set into the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_fa2d3f46","line":76,"updated":"2015-06-25 13:45:37.000000000","message":"Generally we would not allow an image property to override a flavor property in that way.\n\nie if the flavor says required, then I\u0027d expect the VM to have a vTPM and the image not be permitted to change that.\n\nOnly if the flavour says \u0027optional\u0027 would I expect to allow image property to override that to disabled or required.","commit_id":"98ec1c7bf11a8cb45e26b20e225b3c182cc2995a"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"f7adec4dffaba79253b55d4c59c2388f654855b4","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"* Specifying the image property ``os_vtpm`` with the value ``required``."},{"line_number":75,"context_line":"* Specifying the image property ``os_vtpm`` with the value ``optional``"},{"line_number":76,"context_line":"  and the flavor extra spec ``os:vtpm`` with the value ``required``."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"The image property ``os_encryption_key_ref`` contains the reference to the"},{"line_number":79,"context_line":"Barbican stored secret. This secret contains data that must be set into the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_cd52dc68","line":76,"in_reply_to":"fa32b979_d6e924b9","updated":"2015-06-26 09:23:53.000000000","message":"No, the flavour is the mechanism by which the administrator controls access to resources/features on the host. eg if the cloud admin wishes to control which flavours are able to use the vTPM feature (to charge extra mone for that feature), then the flavour setting must always take priority over the image setting from the tenant user.","commit_id":"98ec1c7bf11a8cb45e26b20e225b3c182cc2995a"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"16b19b842714c411eab0477b2684b683f5820a08","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"* Specifying the image property ``os_vtpm`` with the value ``required``."},{"line_number":75,"context_line":"* Specifying the image property ``os_vtpm`` with the value ``optional``"},{"line_number":76,"context_line":"  and the flavor extra spec ``os:vtpm`` with the value ``required``."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"The image property ``os_encryption_key_ref`` contains the reference to the"},{"line_number":79,"context_line":"Barbican stored secret. This secret contains data that must be set into the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_d6e924b9","line":76,"in_reply_to":"fa32b979_fa2d3f46","updated":"2015-06-25 21:25:49.000000000","message":"Um, shouldn\u0027t it the other way around? The flavor to override image properties? If an image property says \"optional\", doesn\u0027t the flavor has to say \"required\"?","commit_id":"98ec1c7bf11a8cb45e26b20e225b3c182cc2995a"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"b8efccf11032f8c95fce8ca46270cdf151914efa","unresolved":false,"context_lines":[{"line_number":79,"context_line":"Barbican stored secret. This secret contains data that must be set into the"},{"line_number":80,"context_line":"vTPM. This is mandatory for Shielded VMs. Providing this image property without"},{"line_number":81,"context_line":"requesting a vTPM device will result in an exception. If the Barbican secret"},{"line_number":82,"context_line":"data cannot be fetched, an exception will be raised."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Scheduling is assured by the ImagePropertiesFilter [5], which checks if the"},{"line_number":85,"context_line":"image property ``hypervisor_version_requires`` is satisfied by the given"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_dab4fbf1","line":82,"updated":"2015-06-25 13:45:37.000000000","message":"As mentioned before, I think we should be calling it \u0027os_vtpm_key\u0027 or \u0027os_vtpm_keys\u0027, if we allow multiple keys to be provided.\n\nIf we\u0027re intending to allow multiple keys we should be clear about how may we can support - with 255 limit and 36 bytes  for a uuid string, it seems we could do 6 keys at most with a single property.\n\nWe can we be clear about exactly what we\u0027re going to store in the os_vtpm_keys field - I\u0027m guessing UUID  right now","commit_id":"98ec1c7bf11a8cb45e26b20e225b3c182cc2995a"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"f7adec4dffaba79253b55d4c59c2388f654855b4","unresolved":false,"context_lines":[{"line_number":79,"context_line":"Barbican stored secret. This secret contains data that must be set into the"},{"line_number":80,"context_line":"vTPM. This is mandatory for Shielded VMs. Providing this image property without"},{"line_number":81,"context_line":"requesting a vTPM device will result in an exception. If the Barbican secret"},{"line_number":82,"context_line":"data cannot be fetched, an exception will be raised."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Scheduling is assured by the ImagePropertiesFilter [5], which checks if the"},{"line_number":85,"context_line":"image property ``hypervisor_version_requires`` is satisfied by the given"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_0dfc4471","line":82,"in_reply_to":"fa32b979_7c111953","updated":"2015-06-26 09:23:53.000000000","message":"\u0027ref\u0027 is really redundant naming  - anywhere that includes a UUID or similar is a reference, but we never add \u0027ref\u0027 to the name of such things. Also that doesn\u0027t make it clear that this in fact allows multiple values.\n\nNB also that glance DB is not where the length restriction comes from. In Nova this is stored into the system_metadata table where values are limited to 255 bytes.","commit_id":"98ec1c7bf11a8cb45e26b20e225b3c182cc2995a"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"16b19b842714c411eab0477b2684b683f5820a08","unresolved":false,"context_lines":[{"line_number":79,"context_line":"Barbican stored secret. This secret contains data that must be set into the"},{"line_number":80,"context_line":"vTPM. This is mandatory for Shielded VMs. Providing this image property without"},{"line_number":81,"context_line":"requesting a vTPM device will result in an exception. If the Barbican secret"},{"line_number":82,"context_line":"data cannot be fetched, an exception will be raised."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Scheduling is assured by the ImagePropertiesFilter [5], which checks if the"},{"line_number":85,"context_line":"image property ``hypervisor_version_requires`` is satisfied by the given"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_7c111953","line":82,"in_reply_to":"fa32b979_dab4fbf1","updated":"2015-06-25 21:25:49.000000000","message":"I would rather have ``os_vtpm_key_ref`` (ref, because it is a reference). To be honest, I\u0027m not perfectly sure what the vtpm key format is and if other keys can be added outside the guest, so I cannot guarantee adding those external extra keys is possible, as there is no documentation on this particular idea. This can be discovered during the implementation and a decision can be made based on that.\n\nAs for the property content, anything can be added of any length, as the Value field in the DB is \"Text\". https://github.com/openstack/glance/blob/master/glance/db/sqlalchemy/models.py#L159\n\nSo, the content should be the UUID of the secret. Conf option with the url of Barbican API and credentials must be provided..","commit_id":"98ec1c7bf11a8cb45e26b20e225b3c182cc2995a"}]}