<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Nov 21, 2013 at 2:08 PM, Jarret Raim <span dir="ltr"><<a href="mailto:jarret.raim@rackspace.com" target="_blank">jarret.raim@rackspace.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">The Barbican team has been taking a look at the KDS feature and the<br>
proposed patch and I think this may be better placed in Barbican rather<br>
than Keystone. The patch, from what I can tell, seems to require that a<br>
service account create & use a key under its own tenant. In this use case,<br>
Barbican can handle the entire exchange and Keystone can just provide<br>
auth/auth for the process. This would allow for some great additional<br>
features including guaranteed entropy and additional security through the<br>
use of HSMs, auditing / logging, etc.<br>
<br>
Barbican is pretty far along at this point and it doesn¹t appear to be a<br>
huge amount of work to move the patch over as it doesn¹t seem to use any<br>
Keystone internals.<br>
<br>
What would people think about this approach? We¹re happy to help move the<br>
patch over and I¹m certainly happy to merge it as it feels like a good<br>
feature for barbican.<br></blockquote><div><br></div><div>++ I'd like to help make this happen over the next milestone (it's a bit late to see significant traction here in icehouse-m1). I've *just* started porting small bits of the proposed implementation over to barbican here:</div>
<div><br></div><div> <a href="https://review.openstack.org/#/c/57787/">https://review.openstack.org/#/c/57787/</a></div><div><br></div><div>I'll do what I can here, but if anyone has the cycles to pick this up and run with it, please do!</div>
<div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<span><font color="#888888"><br>
<br>
<br>
<br>
Jarret<br>
</font></span><div><div><br>
<br>
<br>
<br>
<br>
<br>
On 11/21/13, 12:55 AM, "Russell Bryant" <<a href="mailto:rbryant@redhat.com" target="_blank">rbryant@redhat.com</a>> wrote:<br>
<br>
>Greetings,<br>
><br>
>I'd like to check in on the status of this API addition:<br>
><br>
> <a href="https://review.openstack.org/#/c/40692/" target="_blank">https://review.openstack.org/#/c/40692/</a><br>
><br>
>The last comment is:<br>
><br>
> "propose against stackforge as discussed at summit?"<br>
><br>
>I don't see a session about this and from a quick look, don't see notes<br>
>related to it in other session etherpads.<br>
><br>
>When was this discussed? Can you summarize it?<br></div></div></blockquote><div><br></div><div>As ayoung mentioned, this was just the result of a couple hallway meetings-- there weren't any hard conclusions made, but the gist is that key distribution falls outside of keystone's current scope but deserves first class development attention. The reference to "stackforge" was intentionally non-specific on my part, as we had discussed both a standalone key distribution service or including it with barbican. After discussing it with the barbican team post-summit, I'm confident that they're the right team to maintain it and it's the best long term decision.</div>
<div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div><div>
><br>
>Last I heard, this was just being deferred to be merged early in<br>
>Icehouse [1].<br>
><br>
>This is blocking one of the most important security features for<br>
>OpenStack, IMO (trusted messaging) [2]. We've been talking about it for<br>
>years. Someone has finally made some real progress on it and I feel<br>
>like it has been given little to no attention.<br>
><br>
>I'm not thrilled about the prospect of this going into a new project for<br>
>multiple reasons.<br>
><br>
> - Given the priority and how long this has been dragging out, having to<br>
>wait for a new project to make its way into OpenStack is not very<br>
>appealing.<br>
><br>
> - A new project needs to be able to stand on its own legs. It needs to<br>
>have a reasonably sized development team to make it sustainable. Is<br>
>this big enough for that?</div></div></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>
<div>
><br>
>What's the thinking on this?<br>
><br>
>[1]<br>
><a href="http://lists.openstack.org/pipermail/openstack-dev/2013-August/013992.html" target="_blank">http://lists.openstack.org/pipermail/openstack-dev/2013-August/013992.html</a><br>
>[2] <a href="https://review.openstack.org/#/c/37913/" target="_blank">https://review.openstack.org/#/c/37913/</a><br>
><br>
>--<br>
>Russell Bryant<br>
><br>
>_______________________________________________<br>
>OpenStack-dev mailing list<br>
><a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br>
<br>
_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div><br></div>-Dolph
</div></div>