)]}'
{"specs/instance-users.rst":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"5204e64644992ebfe0deb7aa64c570dc55800e7a","unresolved":false,"context_lines":[{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Instances need a secure way of getting fresh Keystone Tokens so that they can"},{"line_number":23,"context_line":"talk to other OpenStack services."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"It is very challenging to get secrets securely to Instances today. Especially"},{"line_number":26,"context_line":"in light of AutoScaling. Barbican is the official OpenStack secret store, but"}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa7ab95a_65702ea5","line":23,"range":{"start_line":23,"start_character":8,"end_line":23,"end_character":13},"updated":"2016-09-02 14:02:25.000000000","message":"remove other, instances are not OpenStack services","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"5204e64644992ebfe0deb7aa64c570dc55800e7a","unresolved":false,"context_lines":[{"line_number":43,"context_line":"Other considerations:"},{"line_number":44,"context_line":" * Keystone is moving away from being an Identity provider due to scaling"},{"line_number":45,"context_line":"   issues. They therefore have strongly requested instance users be"},{"line_number":46,"context_line":"   implemented with some form of federated identity. They are implementing a"},{"line_number":47,"context_line":"   simple x509 based federation, and would prefer it to be used."},{"line_number":48,"context_line":" * Barbican provides an x509 CA."},{"line_number":49,"context_line":" * Nova UserData\u0027s not very secure. It outlasts an Instances deletion due to"},{"line_number":50,"context_line":"   Soft Deletes."}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa7ab95a_10bc02ba","line":47,"range":{"start_line":46,"start_character":53,"end_line":47,"end_character":64},"updated":"2016-09-02 14:02:25.000000000","message":"Are you talking about tokenless auth [1] ? We support it since the Liberty release.\n\n[1] http://docs.openstack.org/developer/keystone/configure_tokenless_x509.html","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"8aa2bb83269dbe1787cebbaa828ebc45446c5e5e","unresolved":false,"context_lines":[{"line_number":45,"context_line":"   issues. They therefore have strongly requested instance users be"},{"line_number":46,"context_line":"   implemented with some form of federated identity. They are implementing a"},{"line_number":47,"context_line":"   simple x509 based federation, and would prefer it to be used."},{"line_number":48,"context_line":" * Barbican provides an x509 CA."},{"line_number":49,"context_line":" * Nova UserData\u0027s not very secure. It outlasts an Instances deletion due to"},{"line_number":50,"context_line":"   Soft Deletes."},{"line_number":51,"context_line":" * Instances can exist for a very long time. (Pets. Years...)"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a2fa921_9ffbf146","line":48,"updated":"2015-10-09 12:53:50.000000000","message":"Sort of, it provides an abstraction to a few CAs that allow you to see the status of oustanding requests or \"orders\" and retrieve certificates if the CA has approved/signed them.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":4190,"name":"lifeless","email":"robertc@robertcollins.net","username":"lifeless"},"change_message_id":"f06a57ef67a9d379921fc693ab164c3ac160c240","unresolved":false,"context_lines":[{"line_number":47,"context_line":"   simple x509 based federation, and would prefer it to be used."},{"line_number":48,"context_line":" * Barbican provides an x509 CA."},{"line_number":49,"context_line":" * Nova UserData\u0027s not very secure. It outlasts an Instances deletion due to"},{"line_number":50,"context_line":"   Soft Deletes."},{"line_number":51,"context_line":" * Instances can exist for a very long time. (Pets. Years...)"},{"line_number":52,"context_line":" * Instances can be shut down, suspended or shelved for significant periods of"},{"line_number":53,"context_line":"   time. (Can\u0027t refresh certificates before they expire)"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_aa8e38ce","line":50,"updated":"2015-09-22 01:39:48.000000000","message":"OTOH that data is within the cloud exactly as barbican itself is. So I\u0027m not sure that this matters much.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":47,"context_line":"   simple x509 based federation, and would prefer it to be used."},{"line_number":48,"context_line":" * Barbican provides an x509 CA."},{"line_number":49,"context_line":" * Nova UserData\u0027s not very secure. It outlasts an Instances deletion due to"},{"line_number":50,"context_line":"   Soft Deletes."},{"line_number":51,"context_line":" * Instances can exist for a very long time. (Pets. Years...)"},{"line_number":52,"context_line":" * Instances can be shut down, suspended or shelved for significant periods of"},{"line_number":53,"context_line":"   time. (Can\u0027t refresh certificates before they expire)"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a1b2928_6204f4bf","line":50,"in_reply_to":"9a8ffd7b_b0d072f7","updated":"2016-04-11 23:48:25.000000000","message":"With PKI, the Cloud itself doesn\u0027t need full authentication knowledge. Just a way to do some handshaking with pubkeys. That can be made much more secure then simply storing a secret in a db.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"4a5ecc6e4b1884ae3056c22ba252ae223a40eaaf","unresolved":false,"context_lines":[{"line_number":47,"context_line":"   simple x509 based federation, and would prefer it to be used."},{"line_number":48,"context_line":" * Barbican provides an x509 CA."},{"line_number":49,"context_line":" * Nova UserData\u0027s not very secure. It outlasts an Instances deletion due to"},{"line_number":50,"context_line":"   Soft Deletes."},{"line_number":51,"context_line":" * Instances can exist for a very long time. (Pets. Years...)"},{"line_number":52,"context_line":" * Instances can be shut down, suspended or shelved for significant periods of"},{"line_number":53,"context_line":"   time. (Can\u0027t refresh certificates before they expire)"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a8ffd7b_b0d072f7","line":50,"in_reply_to":"ba15a1d1_aa8e38ce","updated":"2015-11-27 03:08:35.000000000","message":"Barbican doesn\u0027t have to store them in plaintext in the database / message queue like nova would. HSM/KEK would give better protection than nova database which is hopefully backed up in many places and shouldn\u0027t store secrets.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"4a5ecc6e4b1884ae3056c22ba252ae223a40eaaf","unresolved":false,"context_lines":[{"line_number":48,"context_line":" * Barbican provides an x509 CA."},{"line_number":49,"context_line":" * Nova UserData\u0027s not very secure. It outlasts an Instances deletion due to"},{"line_number":50,"context_line":"   Soft Deletes."},{"line_number":51,"context_line":" * Instances can exist for a very long time. (Pets. Years...)"},{"line_number":52,"context_line":" * Instances can be shut down, suspended or shelved for significant periods of"},{"line_number":53,"context_line":"   time. (Can\u0027t refresh certificates before they expire)"},{"line_number":54,"context_line":" * Instances can be snapshotted. Secrets stored on the root drive will get"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a8ffd7b_b0c9525b","line":51,"range":{"start_line":51,"start_character":46,"end_line":51,"end_character":51},"updated":"2015-11-27 03:08:35.000000000","message":"Nit: Is this a pets/cattle reference? It may not be clear to everyone. Months/years would be better.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":48,"context_line":" * Barbican provides an x509 CA."},{"line_number":49,"context_line":" * Nova UserData\u0027s not very secure. It outlasts an Instances deletion due to"},{"line_number":50,"context_line":"   Soft Deletes."},{"line_number":51,"context_line":" * Instances can exist for a very long time. (Pets. Years...)"},{"line_number":52,"context_line":" * Instances can be shut down, suspended or shelved for significant periods of"},{"line_number":53,"context_line":"   time. (Can\u0027t refresh certificates before they expire)"},{"line_number":54,"context_line":" * Instances can be snapshotted. Secrets stored on the root drive will get"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a1b2928_82d83055","line":51,"range":{"start_line":51,"start_character":46,"end_line":51,"end_character":51},"in_reply_to":"9a8ffd7b_b0c9525b","updated":"2016-04-11 23:48:25.000000000","message":"Done","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"8aa2bb83269dbe1787cebbaa828ebc45446c5e5e","unresolved":false,"context_lines":[{"line_number":52,"context_line":" * Instances can be shut down, suspended or shelved for significant periods of"},{"line_number":53,"context_line":"   time. (Can\u0027t refresh certificates before they expire)"},{"line_number":54,"context_line":" * Instances can be snapshotted. Secrets stored on the root drive will get"},{"line_number":55,"context_line":"   copied to new instances."},{"line_number":56,"context_line":" * Non root ephemeral drives aren\u0027t snapshotted."},{"line_number":57,"context_line":" * Heat would like to use Zaqar for its Guest Agent. This means Heat Software"},{"line_number":58,"context_line":"   Deployments can not be relied upon."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a2fa921_7fc295ea","line":55,"updated":"2015-10-09 12:53:50.000000000","message":"There\u0027s a few data at rest encryption solutions on the way that should help to address any concerns about the secrets being persisted on-disk.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"4a5ecc6e4b1884ae3056c22ba252ae223a40eaaf","unresolved":false,"context_lines":[{"line_number":52,"context_line":" * Instances can be shut down, suspended or shelved for significant periods of"},{"line_number":53,"context_line":"   time. (Can\u0027t refresh certificates before they expire)"},{"line_number":54,"context_line":" * Instances can be snapshotted. Secrets stored on the root drive will get"},{"line_number":55,"context_line":"   copied to new instances."},{"line_number":56,"context_line":" * Non root ephemeral drives aren\u0027t snapshotted."},{"line_number":57,"context_line":" * Heat would like to use Zaqar for its Guest Agent. This means Heat Software"},{"line_number":58,"context_line":"   Deployments can not be relied upon."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a8ffd7b_f0003a68","line":55,"in_reply_to":"7a2fa921_7fc295ea","updated":"2015-11-27 03:08:35.000000000","message":"I think the issue is less with storing the credentials (this is going to happen anyway as they\u0027re written to files) and more with the fact that the new instance will get duplicate credentials rather than a fresh user.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":52,"context_line":" * Instances can be shut down, suspended or shelved for significant periods of"},{"line_number":53,"context_line":"   time. (Can\u0027t refresh certificates before they expire)"},{"line_number":54,"context_line":" * Instances can be snapshotted. Secrets stored on the root drive will get"},{"line_number":55,"context_line":"   copied to new instances."},{"line_number":56,"context_line":" * Non root ephemeral drives aren\u0027t snapshotted."},{"line_number":57,"context_line":" * Heat would like to use Zaqar for its Guest Agent. This means Heat Software"},{"line_number":58,"context_line":"   Deployments can not be relied upon."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a1b2928_82bf90cf","line":55,"in_reply_to":"9a8ffd7b_f0003a68","updated":"2016-04-11 23:48:25.000000000","message":"This part of the spec was just to lay out the possible issues with any solution proposed. Far too many suggested \"implementations\" didn\u0027t consider all the issues that may be involved with properly solving it. If some of the recent changes can enhance the proposed solution, or make an alternate solution that can work, awesome. :)","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":6601,"name":"James Carey","email":"jecarey@yerac.com","username":"jecarey"},"change_message_id":"001c98c197011bc93f9e582b686f22e17c23f45e","unresolved":false,"context_lines":[{"line_number":58,"context_line":"   Deployments can not be relied upon."},{"line_number":59,"context_line":" * While the Nova MD server is arguably secure for VM\u0027s, It is not for Bare"},{"line_number":60,"context_line":"   Metal."},{"line_number":61,"context_line":" * The Nova MD servver is not trusted by many so can\u0027t be the only mechanism."},{"line_number":62,"context_line":"   ConfigDrive can be an alternative."},{"line_number":63,"context_line":" * ConfigDrive data\u0027s cant be refreshed."},{"line_number":64,"context_line":" * Technologies change. The API should be abstract enough to allow the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da20952f_d42e838b","line":61,"updated":"2015-09-14 21:34:50.000000000","message":"c/servver/server/","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":58,"context_line":"   Deployments can not be relied upon."},{"line_number":59,"context_line":" * While the Nova MD server is arguably secure for VM\u0027s, It is not for Bare"},{"line_number":60,"context_line":"   Metal."},{"line_number":61,"context_line":" * The Nova MD servver is not trusted by many so can\u0027t be the only mechanism."},{"line_number":62,"context_line":"   ConfigDrive can be an alternative."},{"line_number":63,"context_line":" * ConfigDrive data\u0027s cant be refreshed."},{"line_number":64,"context_line":" * Technologies change. The API should be abstract enough to allow the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a1b2928_62a074a0","line":61,"in_reply_to":"da20952f_d42e838b","updated":"2016-04-11 23:48:25.000000000","message":"Done","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":6601,"name":"James Carey","email":"jecarey@yerac.com","username":"jecarey"},"change_message_id":"001c98c197011bc93f9e582b686f22e17c23f45e","unresolved":false,"context_lines":[{"line_number":60,"context_line":"   Metal."},{"line_number":61,"context_line":" * The Nova MD servver is not trusted by many so can\u0027t be the only mechanism."},{"line_number":62,"context_line":"   ConfigDrive can be an alternative."},{"line_number":63,"context_line":" * ConfigDrive data\u0027s cant be refreshed."},{"line_number":64,"context_line":" * Technologies change. The API should be abstract enough to allow the"},{"line_number":65,"context_line":"   Authentication mechanism to change without the user knowing."},{"line_number":66,"context_line":" * If the CA is ever compromised or the certificate algorithm is, there needs"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da20952f_f43947d9","line":63,"updated":"2015-09-14 21:34:50.000000000","message":"c/cant/can\u0027t/","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":60,"context_line":"   Metal."},{"line_number":61,"context_line":" * The Nova MD servver is not trusted by many so can\u0027t be the only mechanism."},{"line_number":62,"context_line":"   ConfigDrive can be an alternative."},{"line_number":63,"context_line":" * ConfigDrive data\u0027s cant be refreshed."},{"line_number":64,"context_line":" * Technologies change. The API should be abstract enough to allow the"},{"line_number":65,"context_line":"   Authentication mechanism to change without the user knowing."},{"line_number":66,"context_line":" * If the CA is ever compromised or the certificate algorithm is, there needs"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a1b2928_828dd033","line":63,"in_reply_to":"da20952f_f43947d9","updated":"2016-04-11 23:48:25.000000000","message":"Done","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":4190,"name":"lifeless","email":"robertc@robertcollins.net","username":"lifeless"},"change_message_id":"f06a57ef67a9d379921fc693ab164c3ac160c240","unresolved":false,"context_lines":[{"line_number":62,"context_line":"   ConfigDrive can be an alternative."},{"line_number":63,"context_line":" * ConfigDrive data\u0027s cant be refreshed."},{"line_number":64,"context_line":" * Technologies change. The API should be abstract enough to allow the"},{"line_number":65,"context_line":"   Authentication mechanism to change without the user knowing."},{"line_number":66,"context_line":" * If the CA is ever compromised or the certificate algorithm is, there needs"},{"line_number":67,"context_line":"   to be a way to reissue all the certificates."},{"line_number":68,"context_line":" * Because so many different hypervisors exist, perhaps part of the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_2a478878","line":65,"updated":"2015-09-22 01:39:48.000000000","message":"I don\u0027t think this point is valid: e.g. if its a request signing mechanism thats brought in the code on the instance has to update to match. I think its a fine aspiration, but not something we can guarantee. Backwards compat would be a better model for tackling \u0027the instances do not need to be modify\u0027.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":62,"context_line":"   ConfigDrive can be an alternative."},{"line_number":63,"context_line":" * ConfigDrive data\u0027s cant be refreshed."},{"line_number":64,"context_line":" * Technologies change. The API should be abstract enough to allow the"},{"line_number":65,"context_line":"   Authentication mechanism to change without the user knowing."},{"line_number":66,"context_line":" * If the CA is ever compromised or the certificate algorithm is, there needs"},{"line_number":67,"context_line":"   to be a way to reissue all the certificates."},{"line_number":68,"context_line":" * Because so many different hypervisors exist, perhaps part of the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a18252c_3ed1adfc","line":65,"in_reply_to":"ba15a1d1_2a478878","updated":"2016-04-11 23:48:25.000000000","message":"Yeah, no I wasn\u0027t suggesting that the clients need a way to be upgradable to support new mechanisms or that backwards compatibility should be dropped. Just that the api should provide the client enough information to know which of potentially multiple ways to authenticate. So far, there hasn\u0027t been a single phase 1 solution discussed that could handle all of the requirements for everyone. So one mechanism might be more appropriate for a given cloud then another one. Its up to the operator to choose the right solution. This requirement just makes that explicit. Though of someone can think of a single good way to solve it for everyone, I\u0027d be happy to drop the requirement.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"8aa2bb83269dbe1787cebbaa828ebc45446c5e5e","unresolved":false,"context_lines":[{"line_number":67,"context_line":"   to be a way to reissue all the certificates."},{"line_number":68,"context_line":" * Because so many different hypervisors exist, perhaps part of the"},{"line_number":69,"context_line":"   authentication mechanism should be left up to the driver. That way, the"},{"line_number":70,"context_line":"   driver can decide which of the tradeoffs are best to make for it."},{"line_number":71,"context_line":" * The app catalog needs instance users to be ubiquitous to make more Cloud"},{"line_number":72,"context_line":"   enabled software to be easily written."},{"line_number":73,"context_line":" * To be ubiquitous, instance users must be easy to implement by operators. As"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a2fa921_9f80d18c","line":70,"updated":"2015-10-09 12:53:50.000000000","message":"I\u0027m not sure what difference any of the hypervisors make? Isn\u0027t this all application layer AuthN/Z we\u0027re talking about?","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"4a5ecc6e4b1884ae3056c22ba252ae223a40eaaf","unresolved":false,"context_lines":[{"line_number":67,"context_line":"   to be a way to reissue all the certificates."},{"line_number":68,"context_line":" * Because so many different hypervisors exist, perhaps part of the"},{"line_number":69,"context_line":"   authentication mechanism should be left up to the driver. That way, the"},{"line_number":70,"context_line":"   driver can decide which of the tradeoffs are best to make for it."},{"line_number":71,"context_line":" * The app catalog needs instance users to be ubiquitous to make more Cloud"},{"line_number":72,"context_line":"   enabled software to be easily written."},{"line_number":73,"context_line":" * To be ubiquitous, instance users must be easy to implement by operators. As"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a8ffd7b_308002c0","line":70,"in_reply_to":"7a2fa921_9f80d18c","updated":"2015-11-27 03:08:35.000000000","message":"Guessing here: I think the idea here is about authenticating who are you giving the credentials to. As in, at the summit the idea was to pass some details in the console. I could imagine a virtio_secrets, or some similar \"secret bus\" that could replace it.\n\nIf I\u0027m wrong, maybe \"authentication mechanism\" should be expanded on with actual use case.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":67,"context_line":"   to be a way to reissue all the certificates."},{"line_number":68,"context_line":" * Because so many different hypervisors exist, perhaps part of the"},{"line_number":69,"context_line":"   authentication mechanism should be left up to the driver. That way, the"},{"line_number":70,"context_line":"   driver can decide which of the tradeoffs are best to make for it."},{"line_number":71,"context_line":" * The app catalog needs instance users to be ubiquitous to make more Cloud"},{"line_number":72,"context_line":"   enabled software to be easily written."},{"line_number":73,"context_line":" * To be ubiquitous, instance users must be easy to implement by operators. As"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a18252c_7e4965d0","line":70,"in_reply_to":"9a8ffd7b_308002c0","updated":"2016-04-11 23:48:25.000000000","message":"Some examples are listed below, but for example:\n * dedicated serial console on the vm.\n * dedicated network port on an ironic instance\n * some specific bmc feature that is not standard\n\nThe goal is to support a minimum secure solution, with plug-ins that may support higher levels of security then the lowest common denominator when features are available that can be taken advantage of. The hypervisor plugin knows the specifics of the hypervisor and can determine what the best approach is.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"8aa2bb83269dbe1787cebbaa828ebc45446c5e5e","unresolved":false,"context_lines":[{"line_number":73,"context_line":" * To be ubiquitous, instance users must be easy to implement by operators. As"},{"line_number":74,"context_line":"   few new services as possible should be added."},{"line_number":75,"context_line":" * CRL\u0027s don\u0027t scale well. Need to decouple the invalidation logic from the"},{"line_number":76,"context_line":"   certificate lifetime. OCSP Perhaps?"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Some Driver specific Phase 1 Authentication options:"},{"line_number":79,"context_line":" * IPMI Console: Authenticated side channel between physical machine and"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a2fa921_3f141d4b","line":76,"updated":"2015-10-09 12:53:50.000000000","message":"Very important point here that I feel perhaps needs highlighting further. The security and assurance of PKI _pivots_ on revocation, without revocation you\u0027re really no-where. \n\nCRL\u0027s don\u0027t scale and they\u0027re horribly non-deterministic in terms of delivery and assertion too.\n\nOSCP basically isn\u0027t supported anywhere outside of web browsers today.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"4a5ecc6e4b1884ae3056c22ba252ae223a40eaaf","unresolved":false,"context_lines":[{"line_number":73,"context_line":" * To be ubiquitous, instance users must be easy to implement by operators. As"},{"line_number":74,"context_line":"   few new services as possible should be added."},{"line_number":75,"context_line":" * CRL\u0027s don\u0027t scale well. Need to decouple the invalidation logic from the"},{"line_number":76,"context_line":"   certificate lifetime. OCSP Perhaps?"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Some Driver specific Phase 1 Authentication options:"},{"line_number":79,"context_line":" * IPMI Console: Authenticated side channel between physical machine and"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a8ffd7b_67dfb169","line":76,"in_reply_to":"7a2fa921_3f141d4b","updated":"2015-11-27 03:08:35.000000000","message":"I\u0027m not sure why the revocation beyond removing the instance is needed here. (Keeping in mind that keystone validates with nova whether the instance is still alive when authenticating.) There are only a few cases I see:\n\n- credentials were stolen from nova: the system is compromised and needs to revoke all certificates - new CA solves that\n- credentials were stolen from the instance: instance is compromised and should be shut down / frozen, not issued new credentials\n- credentials were stolen from communication with keystone: the system is badly compromised since someone can MITM internal connections!\n\nAre there any scenarios where:\n\n- revoking the certificate\n- issuing a new one\n- keeping instance alive\n\nis valid course of action?","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":73,"context_line":" * To be ubiquitous, instance users must be easy to implement by operators. As"},{"line_number":74,"context_line":"   few new services as possible should be added."},{"line_number":75,"context_line":" * CRL\u0027s don\u0027t scale well. Need to decouple the invalidation logic from the"},{"line_number":76,"context_line":"   certificate lifetime. OCSP Perhaps?"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Some Driver specific Phase 1 Authentication options:"},{"line_number":79,"context_line":" * IPMI Console: Authenticated side channel between physical machine and"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a18252c_fe8295c7","line":76,"in_reply_to":"9a8ffd7b_67dfb169","updated":"2016-04-11 23:48:25.000000000","message":"Its the \"keystone validates with nova\" thing that this was intended to address. You need some way to invalidate the credentials when the instance is deleted. OSCP\u0027s one option that could be used, but there are lots of others. The use case of being able to get a fresh cert after it expires while the instance is not running can handle revoking a compromised cert too. Just invalidate it, and the instance can ask for a fresh one.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"8aa2bb83269dbe1787cebbaa828ebc45446c5e5e","unresolved":false,"context_lines":[{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Some Driver specific Phase 1 Authentication options:"},{"line_number":79,"context_line":" * IPMI Console: Authenticated side channel between physical machine and"},{"line_number":80,"context_line":"   Instance."},{"line_number":81,"context_line":" * Hypervisor -\u003e VM:"},{"line_number":82,"context_line":"   * IP based Service in network namespace on Hypervisor attached only to VM."},{"line_number":83,"context_line":"   * Extra ephemeral disk created/written by Hypervisor."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a2fa921_22564006","line":80,"updated":"2015-10-09 12:53:50.000000000","message":"Authenticated but often not very well protected.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Some Driver specific Phase 1 Authentication options:"},{"line_number":79,"context_line":" * IPMI Console: Authenticated side channel between physical machine and"},{"line_number":80,"context_line":"   Instance."},{"line_number":81,"context_line":" * Hypervisor -\u003e VM:"},{"line_number":82,"context_line":"   * IP based Service in network namespace on Hypervisor attached only to VM."},{"line_number":83,"context_line":"   * Extra ephemeral disk created/written by Hypervisor."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a18252c_7e77a502","line":80,"in_reply_to":"7a2fa921_22564006","updated":"2016-04-11 23:48:25.000000000","message":"Agreed. Its the lowest common denominator I could find between all of the Nova Plugins. There are more specific drivers that could be developed to be better, and thats what the plugin requirement is about.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":4190,"name":"lifeless","email":"robertc@robertcollins.net","username":"lifeless"},"change_message_id":"f06a57ef67a9d379921fc693ab164c3ac160c240","unresolved":false,"context_lines":[{"line_number":79,"context_line":" * IPMI Console: Authenticated side channel between physical machine and"},{"line_number":80,"context_line":"   Instance."},{"line_number":81,"context_line":" * Hypervisor -\u003e VM:"},{"line_number":82,"context_line":"   * IP based Service in network namespace on Hypervisor attached only to VM."},{"line_number":83,"context_line":"   * Extra ephemeral disk created/written by Hypervisor."},{"line_number":84,"context_line":" * Nova Metadata service (Has authentication by IP address and Antispoofing"},{"line_number":85,"context_line":"   rules.)"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_0a12c462","line":82,"updated":"2015-09-22 01:39:48.000000000","message":"Thats what the metadata server is. How would that be different?","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":79,"context_line":" * IPMI Console: Authenticated side channel between physical machine and"},{"line_number":80,"context_line":"   Instance."},{"line_number":81,"context_line":" * Hypervisor -\u003e VM:"},{"line_number":82,"context_line":"   * IP based Service in network namespace on Hypervisor attached only to VM."},{"line_number":83,"context_line":"   * Extra ephemeral disk created/written by Hypervisor."},{"line_number":84,"context_line":" * Nova Metadata service (Has authentication by IP address and Antispoofing"},{"line_number":85,"context_line":"   rules.)"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a18252c_de5eb975","line":82,"in_reply_to":"ba15a1d1_0a12c462","updated":"2016-04-11 23:48:25.000000000","message":"some folks were worried about extending the metadata server to be a writeable endpoint. This would isolate the service only to the compute node the vm is on. Its just one possibility.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":4190,"name":"lifeless","email":"robertc@robertcollins.net","username":"lifeless"},"change_message_id":"f06a57ef67a9d379921fc693ab164c3ac160c240","unresolved":false,"context_lines":[{"line_number":80,"context_line":"   Instance."},{"line_number":81,"context_line":" * Hypervisor -\u003e VM:"},{"line_number":82,"context_line":"   * IP based Service in network namespace on Hypervisor attached only to VM."},{"line_number":83,"context_line":"   * Extra ephemeral disk created/written by Hypervisor."},{"line_number":84,"context_line":" * Nova Metadata service (Has authentication by IP address and Antispoofing"},{"line_number":85,"context_line":"   rules.)"},{"line_number":86,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_2a154848","line":83,"updated":"2015-09-22 01:39:48.000000000","message":"This has exactly the same problem config drive does: it can\u0027t be updated.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":80,"context_line":"   Instance."},{"line_number":81,"context_line":" * Hypervisor -\u003e VM:"},{"line_number":82,"context_line":"   * IP based Service in network namespace on Hypervisor attached only to VM."},{"line_number":83,"context_line":"   * Extra ephemeral disk created/written by Hypervisor."},{"line_number":84,"context_line":" * Nova Metadata service (Has authentication by IP address and Antispoofing"},{"line_number":85,"context_line":"   rules.)"},{"line_number":86,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a18252c_5e4bc9b0","line":83,"in_reply_to":"ba15a1d1_2a154848","updated":"2016-04-11 23:48:25.000000000","message":"For a vm case, it could be updated. If the disk image was iso9660, attached as a cd. it could be removed, updated, reattached as needed to refresh keys. The same could potentially be done with bmc\u0027s supporting virutal cd drives.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"4a5ecc6e4b1884ae3056c22ba252ae223a40eaaf","unresolved":false,"context_lines":[{"line_number":82,"context_line":"   * IP based Service in network namespace on Hypervisor attached only to VM."},{"line_number":83,"context_line":"   * Extra ephemeral disk created/written by Hypervisor."},{"line_number":84,"context_line":" * Nova Metadata service (Has authentication by IP address and Antispoofing"},{"line_number":85,"context_line":"   rules.)"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Amazon ran into the same exact issue and have details of their implementation"},{"line_number":88,"context_line":"here:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a8ffd7b_30f56256","line":85,"updated":"2015-11-27 03:08:35.000000000","message":"Nit: could use a note why current metadata is insufficient (or just reference: same as UserData point above)","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":82,"context_line":"   * IP based Service in network namespace on Hypervisor attached only to VM."},{"line_number":83,"context_line":"   * Extra ephemeral disk created/written by Hypervisor."},{"line_number":84,"context_line":" * Nova Metadata service (Has authentication by IP address and Antispoofing"},{"line_number":85,"context_line":"   rules.)"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Amazon ran into the same exact issue and have details of their implementation"},{"line_number":88,"context_line":"here:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a18252c_3e89adcb","line":85,"in_reply_to":"9a8ffd7b_30f56256","updated":"2016-04-11 23:48:25.000000000","message":"Done","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"ebce324237c8fb87d57bf921ff178a7b55817d54","unresolved":false,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"Proposed change"},{"line_number":136,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Do to considerations in the Problem Description there should be two phases to"},{"line_number":139,"context_line":"the Authentication:"},{"line_number":140,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a061dce_a2d4df1f","line":137,"updated":"2016-04-06 20:59:55.000000000","message":"I\u0027d like to propose a modified workflow.  The first step is carried out by the VM itself, and it generates a keypair.\n\nSecond it sends a notification to Nova that the keypair has been generated, adn \n\nThird the compute instance reads the public key off the instance via direct filesystem accces of the running VM.\n\nFourth the compute instance sends the public key, along with the VMs identifier, to the conductor node, which records the association in the database.\n\nWe now add a new API to Nova which is \"get pubkey for instace.\"  The Pub key can then be verified by Barbican durn a CSR validation stage prior to certificate signing.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"cdfe018062740ec3497525ee8100175bf3af89c2","unresolved":false,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"Proposed change"},{"line_number":136,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Do to considerations in the Problem Description there should be two phases to"},{"line_number":139,"context_line":"the Authentication:"},{"line_number":140,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a122d0e_4253ec6c","line":137,"in_reply_to":"5a18252c_deba396e","updated":"2016-04-21 13:40:14.000000000","message":"To be clear, Nova has deprecated any functions that directly read the file system of the VM. Most of the \"inject\" is now done via config drive or metadata service to avoid these actions.\n\nIf you don\u0027t involve Nova, you could use a user agent script to create the keypair and register it with Barbican, prehaps using some one time token that has been obtained to store those details?\n\nI think we should talk about how to do this without Nova, then look at how to make the process easier for users.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"Proposed change"},{"line_number":136,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Do to considerations in the Problem Description there should be two phases to"},{"line_number":139,"context_line":"the Authentication:"},{"line_number":140,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a18252c_deba396e","line":137,"in_reply_to":"9a061dce_a2d4df1f","updated":"2016-04-11 23:48:25.000000000","message":"Reading the key off the filesystem won\u0027t work for non vm cases. The rest I think would work well though.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":6601,"name":"James Carey","email":"jecarey@yerac.com","username":"jecarey"},"change_message_id":"001c98c197011bc93f9e582b686f22e17c23f45e","unresolved":false,"context_lines":[{"line_number":135,"context_line":"Proposed change"},{"line_number":136,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Do to considerations in the Problem Description there should be two phases to"},{"line_number":139,"context_line":"the Authentication:"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"1. Driver specific authentication from Instance to Instance User Service to"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da20952f_b4e66f42","line":138,"updated":"2015-09-14 21:34:50.000000000","message":"c/Do/Due/","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":4190,"name":"lifeless","email":"robertc@robertcollins.net","username":"lifeless"},"change_message_id":"f06a57ef67a9d379921fc693ab164c3ac160c240","unresolved":false,"context_lines":[{"line_number":141,"context_line":"1. Driver specific authentication from Instance to Instance User Service to"},{"line_number":142,"context_line":"   get a fresh Keystone Certificate for the Instance."},{"line_number":143,"context_line":"2. A certificate issued for the Instance so that it can authenticate with"},{"line_number":144,"context_line":"   Keystone and get a Keystone Token."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"Initial Phase 1 workflow with Serial Console:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_bde76011","line":144,"updated":"2015-09-22 01:39:48.000000000","message":"Why can\u0027t we do precisely what AWS did? Use the metadata service. That would avoid creating a certificate for every instance and all the overhead that that implies and will have to be managed.\n\nDownsides I can see:\n - deployments that haven\u0027t deployed the metadata service would need to do so to offer this facility. Because it can be deployed namespace-local (plus the other antispoof rules we have), it is secure against spoofing, tampering and interception.\n - baremetal metadata deployments are a little more complex - but per deployment solvable. It breaks down like this:\n   - if the deployment is doing instance network isolation (like rackspace\u0027s onmetal does) then the metadata server is isolated and immune to hostile attack.\n   - if the deployment is not doing instance network isolation, then either\n     - its using an out of band boot mechanism (e.g. iLO)\n        - which is not typically updateable\n     - it is vulnerable to boot time attacks between instances\n\nSo basically we\u0027d be raising the bar - requiring network isolation - for baremetal deployments that wanted to do this.\n\nOn the other other hand we do try quite hard to support both config drive and metadata server, so I understand the desire to use something that supports both. But  I think we need a much simpler design.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"5204e64644992ebfe0deb7aa64c570dc55800e7a","unresolved":false,"context_lines":[{"line_number":141,"context_line":"1. Driver specific authentication from Instance to Instance User Service to"},{"line_number":142,"context_line":"   get a fresh Keystone Certificate for the Instance."},{"line_number":143,"context_line":"2. A certificate issued for the Instance so that it can authenticate with"},{"line_number":144,"context_line":"   Keystone and get a Keystone Token."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"Initial Phase 1 workflow with Serial Console:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa7ab95a_b07436fe","line":144,"in_reply_to":"5a18252c_fe3a95e6","updated":"2016-09-02 14:02:25.000000000","message":"Also, configuring keystone for tokenless auth for each instance in the cloud will be something expensive to create and maintain, as it requires adding the trusted certificate to the list \u0026 creating a mapping (like a federation mapping) to define what roles that certificate gives. See:  http://docs.openstack.org/developer/keystone/configure_tokenless_x509.html#keystone-configuration\n\nAlso remember the roles will vary depending on what operations you want the instance to be able to perform","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"4a5ecc6e4b1884ae3056c22ba252ae223a40eaaf","unresolved":false,"context_lines":[{"line_number":141,"context_line":"1. Driver specific authentication from Instance to Instance User Service to"},{"line_number":142,"context_line":"   get a fresh Keystone Certificate for the Instance."},{"line_number":143,"context_line":"2. A certificate issued for the Instance so that it can authenticate with"},{"line_number":144,"context_line":"   Keystone and get a Keystone Token."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"Initial Phase 1 workflow with Serial Console:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a8ffd7b_e4a2bfad","line":144,"in_reply_to":"7a2fa921_62ec382a","updated":"2015-11-27 03:08:35.000000000","message":"Another +0.5. This would complicate the metadata in a few ways however. Not easily cacheable anymore if we need any revocation mechanism and probably shouldn\u0027t be stored in nova\u0027s userdata as mentioned above.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":141,"context_line":"1. Driver specific authentication from Instance to Instance User Service to"},{"line_number":142,"context_line":"   get a fresh Keystone Certificate for the Instance."},{"line_number":143,"context_line":"2. A certificate issued for the Instance so that it can authenticate with"},{"line_number":144,"context_line":"   Keystone and get a Keystone Token."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"Initial Phase 1 workflow with Serial Console:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a18252c_fe3a95e6","line":144,"in_reply_to":"9a8ffd7b_e4a2bfad","updated":"2016-04-11 23:48:25.000000000","message":"I origionally spec\u0027ed it out as just a metadata server change as per AWS. I even implemented it once. I was told by the Nova PTL that it was unacceptable to rely on just the Metadata server and any attempt to do so would be shot down. That was what birthed this spec.\n\nI\u0027d be happy if nova re-evaluated that stance, but until then, I think the spec as is is our only path forward.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"8aa2bb83269dbe1787cebbaa828ebc45446c5e5e","unresolved":false,"context_lines":[{"line_number":141,"context_line":"1. Driver specific authentication from Instance to Instance User Service to"},{"line_number":142,"context_line":"   get a fresh Keystone Certificate for the Instance."},{"line_number":143,"context_line":"2. A certificate issued for the Instance so that it can authenticate with"},{"line_number":144,"context_line":"   Keystone and get a Keystone Token."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"Initial Phase 1 workflow with Serial Console:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a2fa921_62ec382a","line":144,"in_reply_to":"ba15a1d1_bde76011","updated":"2015-10-09 12:53:50.000000000","message":"+0.5 - I think I agree with this :)","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9664,"name":"amrith","email":"amrith.kumar@gmail.com","username":"amrith"},"change_message_id":"f94ffb4d093894867276391619420fdf15bd24a7","unresolved":false,"context_lines":[{"line_number":159,"context_line":"   certificate retrieval."},{"line_number":160,"context_line":" * The Instance keeps trying to fetch the certificate from the tempurl until it"},{"line_number":161,"context_line":"   becomes authorized or a specified timeout happens."},{"line_number":162,"context_line":" * Certificate is retrieved by the Instance."},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"Phase 2, Instance already has certificate, wants a token:"},{"line_number":165,"context_line":" * Instance contacts the Meta Data server and retrieves the Keystone endpoint"}],"source_content_type":"text/x-rst","patch_set":1,"id":"bacf61ea_a1f874c4","line":162,"updated":"2016-07-29 16:07:04.000000000","message":"where does the instance store the certificate?\n\nIsn\u0027t the certificate stored on the instance then susceptible to compromise?","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":4190,"name":"lifeless","email":"robertc@robertcollins.net","username":"lifeless"},"change_message_id":"f06a57ef67a9d379921fc693ab164c3ac160c240","unresolved":false,"context_lines":[{"line_number":166,"context_line":"   or fetches the Keystone endpoint from ConfigDrive."},{"line_number":167,"context_line":" * Instance contacts Keystone using the Instance User Certificate it obtained"},{"line_number":168,"context_line":"   through Phase 1, getting back a token."},{"line_number":169,"context_line":""},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"------------------------------------------"},{"line_number":172,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_5da404b8","line":169,"updated":"2015-09-22 01:39:48.000000000","message":"I\u0027m really worried about overloading the serial console this way. It seems fragile and likely to be subject to interference from systemd/getty etc.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":166,"context_line":"   or fetches the Keystone endpoint from ConfigDrive."},{"line_number":167,"context_line":" * Instance contacts Keystone using the Instance User Certificate it obtained"},{"line_number":168,"context_line":"   through Phase 1, getting back a token."},{"line_number":169,"context_line":""},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"------------------------------------------"},{"line_number":172,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a18252c_c9fe0105","line":169,"in_reply_to":"7a2fa921_02dc6471","updated":"2016-04-11 23:48:25.000000000","message":"I think it can be done securely, but like you, I think its a bit of a hack and may be somewhat fragile. Printing the info out multiple times over a few seconds will make it more reliable but slower. Thats why I recommend a plugable solution and the plugins can implement it in a more robust way. Plugins though mandates Nova be involved in the solution. Something that\u0027s been pushed back on by the Nova team a lot.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"8aa2bb83269dbe1787cebbaa828ebc45446c5e5e","unresolved":false,"context_lines":[{"line_number":166,"context_line":"   or fetches the Keystone endpoint from ConfigDrive."},{"line_number":167,"context_line":" * Instance contacts Keystone using the Instance User Certificate it obtained"},{"line_number":168,"context_line":"   through Phase 1, getting back a token."},{"line_number":169,"context_line":""},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"------------------------------------------"},{"line_number":172,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a2fa921_02dc6471","line":169,"in_reply_to":"ba15a1d1_5da404b8","updated":"2015-10-09 12:53:50.000000000","message":"+1 [Security]","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":6601,"name":"James Carey","email":"jecarey@yerac.com","username":"jecarey"},"change_message_id":"001c98c197011bc93f9e582b686f22e17c23f45e","unresolved":false,"context_lines":[{"line_number":191,"context_line":"   services are undesirable."},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"Diagram showing basic workflow. It shows:"},{"line_number":194,"context_line":" * User getting a user getting back the instance user id (To allow its use with"},{"line_number":195,"context_line":"   setting up acl\u0027s. not shown in diagram,"},{"line_number":196,"context_line":" * Phase 1 Authentication using SerialConsoleLog plugin"},{"line_number":197,"context_line":" * Phase 2 Authentication to let the Instance get a Token that can be used to"}],"source_content_type":"text/x-rst","patch_set":1,"id":"da20952f_14771b3c","line":194,"updated":"2015-09-14 21:34:50.000000000","message":"c/User getting a user getting/User getting/\n\nWhere does the parenthetical phrase end?","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":191,"context_line":"   services are undesirable."},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"Diagram showing basic workflow. It shows:"},{"line_number":194,"context_line":" * User getting a user getting back the instance user id (To allow its use with"},{"line_number":195,"context_line":"   setting up acl\u0027s. not shown in diagram,"},{"line_number":196,"context_line":" * Phase 1 Authentication using SerialConsoleLog plugin"},{"line_number":197,"context_line":" * Phase 2 Authentication to let the Instance get a Token that can be used to"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a18252c_4913115d","line":194,"in_reply_to":"da20952f_14771b3c","updated":"2016-04-11 23:48:25.000000000","message":"Done","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"415391853059460b8f3258fdf70115f20762d21e","unresolved":false,"context_lines":[{"line_number":199,"context_line":""},{"line_number":200,"context_line":"::"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":" User              Nova         Instance        Barbican       Keystone"},{"line_number":203,"context_line":"  + Create Instance +             +                +               +"},{"line_number":204,"context_line":"  | \u0026 precreate     |             |                | Get User ID   |"},{"line_number":205,"context_line":"  | User ID         |             |                | From Instance |"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_49610ad2","line":202,"updated":"2015-09-18 11:17:19.000000000","message":"I still think we need to first get this working without Nova doing anything special.\n\nThat was we can use this with magnum, and non-openstack clouds as users might require.\n\nIt also has the handy advantage that is makes the amount of code Nova would have to hold minimal, which is clearly something I am very worried about.\n\nIt its current form I would -2 a nova spec for this design, because it increases the scope of Nova too much.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":199,"context_line":""},{"line_number":200,"context_line":"::"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":" User              Nova         Instance        Barbican       Keystone"},{"line_number":203,"context_line":"  + Create Instance +             +                +               +"},{"line_number":204,"context_line":"  | \u0026 precreate     |             |                | Get User ID   |"},{"line_number":205,"context_line":"  | User ID         |             |                | From Instance |"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a18252c_293e95b8","line":202,"in_reply_to":"9a8ffd7b_e464ff22","updated":"2016-04-11 23:48:25.000000000","message":"The problem is, Magnum needs instance users too, to deploy its own stuff. They too are hacking around the lack of instance users just like every other advanced service built on top of Nova.\n\nFor containers, Kubernetes provides its own secret store, and potentially Kuryr could hook it back into Barbican.\n\nI don\u0027t think Magnum needs to share the instance user code with Nova. I think it just needs to be a consumer of it.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"4a5ecc6e4b1884ae3056c22ba252ae223a40eaaf","unresolved":false,"context_lines":[{"line_number":199,"context_line":""},{"line_number":200,"context_line":"::"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":" User              Nova         Instance        Barbican       Keystone"},{"line_number":203,"context_line":"  + Create Instance +             +                +               +"},{"line_number":204,"context_line":"  | \u0026 precreate     |             |                | Get User ID   |"},{"line_number":205,"context_line":"  | User ID         |             |                | From Instance |"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a8ffd7b_e464ff22","line":202,"in_reply_to":"ba15a1d1_49610ad2","updated":"2015-11-27 03:08:35.000000000","message":"Isn\u0027t this request a big scope creep though? I mean, nova has a problem that needs to be solved. Current solutions don\u0027t generalise to containers very well, I mean magnum containers don\u0027t even have metadata service, right? If there\u0027s a valid solution that solves magnum\u0027s issues, it should be included, but if nobody can propose what it is, then it would be bad to hold off on something great for current nova users.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"415391853059460b8f3258fdf70115f20762d21e","unresolved":false,"context_lines":[{"line_number":253,"context_line":"  |                 |             | Token          |               |"},{"line_number":254,"context_line":""},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"The following changes will therefore be needed to be made to Nova:"},{"line_number":257,"context_line":" * The DB will be modified to add the following fields to an instance"},{"line_number":258,"context_line":"   * instance_user_id - The instance_user_id associated with an Instance. Its"},{"line_number":259,"context_line":"   nullable. It is null if an instance user has not been created yet."}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_29885670","line":256,"updated":"2015-09-18 11:17:19.000000000","message":"I just don\u0027t see what this has to be so coupled to Nova.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":253,"context_line":"  |                 |             | Token          |               |"},{"line_number":254,"context_line":""},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"The following changes will therefore be needed to be made to Nova:"},{"line_number":257,"context_line":" * The DB will be modified to add the following fields to an instance"},{"line_number":258,"context_line":"   * instance_user_id - The instance_user_id associated with an Instance. Its"},{"line_number":259,"context_line":"   nullable. It is null if an instance user has not been created yet."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a18252c_096e39c9","line":256,"in_reply_to":"9a8ffd7b_845df348","updated":"2016-04-11 23:48:25.000000000","message":"Yes. ~line 183 describes them.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"4a5ecc6e4b1884ae3056c22ba252ae223a40eaaf","unresolved":false,"context_lines":[{"line_number":253,"context_line":"  |                 |             | Token          |               |"},{"line_number":254,"context_line":""},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"The following changes will therefore be needed to be made to Nova:"},{"line_number":257,"context_line":" * The DB will be modified to add the following fields to an instance"},{"line_number":258,"context_line":"   * instance_user_id - The instance_user_id associated with an Instance. Its"},{"line_number":259,"context_line":"   nullable. It is null if an instance user has not been created yet."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a8ffd7b_845df348","line":256,"in_reply_to":"ba15a1d1_29885670","updated":"2015-11-27 03:08:35.000000000","message":"There are 3 reasons ~line 183.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"8aa2bb83269dbe1787cebbaa828ebc45446c5e5e","unresolved":false,"context_lines":[{"line_number":326,"context_line":"   be returned."},{"line_number":327,"context_line":"   Barbican will be contacted to fetch the certificate and returned to the"},{"line_number":328,"context_line":"   instance if it exists. If it doesn\u0027t, Barbican will be contacted to create"},{"line_number":329,"context_line":"   the certificate."},{"line_number":330,"context_line":"   In either case, if the certificate is not yet ready because it gets"},{"line_number":331,"context_line":"   asynchronously created by Barbican, 503 is returned and the client is"},{"line_number":332,"context_line":"   expected to wait a few seconds and try again."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a2fa921_700ba2d6","line":329,"updated":"2015-10-09 12:53:50.000000000","message":"Barbican doesn\u0027t create certificates it\u0027s passes on requests and abstracts the communication with a CA","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":326,"context_line":"   be returned."},{"line_number":327,"context_line":"   Barbican will be contacted to fetch the certificate and returned to the"},{"line_number":328,"context_line":"   instance if it exists. If it doesn\u0027t, Barbican will be contacted to create"},{"line_number":329,"context_line":"   the certificate."},{"line_number":330,"context_line":"   In either case, if the certificate is not yet ready because it gets"},{"line_number":331,"context_line":"   asynchronously created by Barbican, 503 is returned and the client is"},{"line_number":332,"context_line":"   expected to wait a few seconds and try again."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a18252c_896249d7","line":329,"in_reply_to":"7a2fa921_700ba2d6","updated":"2016-04-11 23:48:25.000000000","message":"True. I don\u0027t think its material to the spec though. If Barbican creates it externally or does it itself, the flow is the same.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"8aa2bb83269dbe1787cebbaa828ebc45446c5e5e","unresolved":false,"context_lines":[{"line_number":329,"context_line":"   the certificate."},{"line_number":330,"context_line":"   In either case, if the certificate is not yet ready because it gets"},{"line_number":331,"context_line":"   asynchronously created by Barbican, 503 is returned and the client is"},{"line_number":332,"context_line":"   expected to wait a few seconds and try again."},{"line_number":333,"context_line":"   Once the certificate is retrieved, the row in the nova database will be"},{"line_number":334,"context_line":"   deleted, preventing further retrieval without a fresh Phase 1 pass."},{"line_number":335,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a2fa921_3028ca32","line":332,"updated":"2015-10-09 12:53:50.000000000","message":"Seconds? Are you expecting the CA to auto-issue Certificates?","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"4a5ecc6e4b1884ae3056c22ba252ae223a40eaaf","unresolved":false,"context_lines":[{"line_number":329,"context_line":"   the certificate."},{"line_number":330,"context_line":"   In either case, if the certificate is not yet ready because it gets"},{"line_number":331,"context_line":"   asynchronously created by Barbican, 503 is returned and the client is"},{"line_number":332,"context_line":"   expected to wait a few seconds and try again."},{"line_number":333,"context_line":"   Once the certificate is retrieved, the row in the nova database will be"},{"line_number":334,"context_line":"   deleted, preventing further retrieval without a fresh Phase 1 pass."},{"line_number":335,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a8ffd7b_e7b721d6","line":332,"in_reply_to":"7a2fa921_3028ca32","updated":"2015-11-27 03:08:35.000000000","message":"For instance users that would be the only way really. If this is going to be used for things like initial registration to chef/puppet or my sshd use case, then auto-issue is he only way.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":329,"context_line":"   the certificate."},{"line_number":330,"context_line":"   In either case, if the certificate is not yet ready because it gets"},{"line_number":331,"context_line":"   asynchronously created by Barbican, 503 is returned and the client is"},{"line_number":332,"context_line":"   expected to wait a few seconds and try again."},{"line_number":333,"context_line":"   Once the certificate is retrieved, the row in the nova database will be"},{"line_number":334,"context_line":"   deleted, preventing further retrieval without a fresh Phase 1 pass."},{"line_number":335,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a18252c_49af91e3","line":332,"in_reply_to":"9a8ffd7b_e7b721d6","updated":"2016-04-11 23:48:25.000000000","message":"Yes. Auto-issue is the only way this will work. If you can stand having a human create a certificate, you might as well just do everything manually. This plumbing wouldn\u0027t be needed.","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":6601,"name":"James Carey","email":"jecarey@yerac.com","username":"jecarey"},"change_message_id":"001c98c197011bc93f9e582b686f22e17c23f45e","unresolved":false,"context_lines":[{"line_number":426,"context_line":"Other end user impact"},{"line_number":427,"context_line":"---------------------"},{"line_number":428,"context_line":""},{"line_number":429,"context_line":"This change will probably will impact the OpenStack unified client to enable"},{"line_number":430,"context_line":"it to easily fetch its user certificate itself."},{"line_number":431,"context_line":""},{"line_number":432,"context_line":"Adding the server create flag to the python-novaclient will also be needed."}],"source_content_type":"text/x-rst","patch_set":1,"id":"da20952f_b7daf115","line":429,"updated":"2015-09-14 21:34:50.000000000","message":"c/will probably will/probably will/","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"7e64aadbb316ccd99791158ea9fdc5d6dccc57f1","unresolved":false,"context_lines":[{"line_number":426,"context_line":"Other end user impact"},{"line_number":427,"context_line":"---------------------"},{"line_number":428,"context_line":""},{"line_number":429,"context_line":"This change will probably will impact the OpenStack unified client to enable"},{"line_number":430,"context_line":"it to easily fetch its user certificate itself."},{"line_number":431,"context_line":""},{"line_number":432,"context_line":"Adding the server create flag to the python-novaclient will also be needed."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a18252c_89b9a931","line":429,"in_reply_to":"da20952f_b7daf115","updated":"2016-04-11 23:48:25.000000000","message":"Done","commit_id":"572ddf4ff0efd163d839a829f037c2bb50adc2fd"}]}