<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
tt
{mso-style-priority:99;
font-family:"Courier New";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">+1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> Ling Gao [mailto:linggao@us.ibm.com]
<br>
<b>Sent:</b> Friday, April 04, 2014 10:10 AM<br>
<b>To:</b> OpenStack Development Mailing List (not for usage questions)<br>
<b>Cc:</b> OpenStack Development Mailing List (not for usage questions)<br>
<b>Subject:</b> Re: [openstack-dev] [Ironic][Agent] Ironic-python-agent<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Hello
</span>Vladimir, <br>
I would prefer an agent-less node, meaning the agent is only used under the ramdisk OS to collect hw info, to do firmware updates and to install nodes etc. In this sense, the agent running as root is fine. Once the node is installed, the agent should be
out of the picture. I have been working with HPC customers, in that environment they prefer as less memory prints as possible. Even as a ordinary tenant, I do not feel secure to have some agents running on my node. For the firmware update on the fly, I do
not know how many customers will trust us doing it while their critical application is running. Even they do and ready to do it, Ironic can then send an agent to the node through scp/wget as admin/root and quickly do it and then kill the agent on the node.
Just my 2 cents. <br>
<span style="font-size:10.0pt;font-family:"Arial","sans-serif""><br>
Ling Gao<br>
</span><br>
<br>
<br>
<br>
<span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#5F5F5F">From: </span><span style="font-size:7.5pt;font-family:"Arial","sans-serif"">Vladimir Kozhukalov <<a href="mailto:vkozhukalov@mirantis.com">vkozhukalov@mirantis.com</a>></span>
<br>
<span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#5F5F5F">To: </span><span style="font-size:7.5pt;font-family:"Arial","sans-serif"">"OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>>,
</span><br>
<span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#5F5F5F">Date: </span><span style="font-size:7.5pt;font-family:"Arial","sans-serif"">04/04/2014 08:24 AM</span>
<br>
<span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:#5F5F5F">Subject: </span><span style="font-size:7.5pt;font-family:"Arial","sans-serif"">[openstack-dev] [Ironic][Agent]</span>
<o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" noshade="" style="color:#A0A0A0" align="center">
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
<br>
<br>
Hello, everyone, <br>
<br>
I'd like to involve more people to express their opinions about the way how we are going to run Ironic-python-agent. I mean should we run it with root privileges or not.
<br>
<br>
>From the very beginning agent is supposed to run under ramdisk OS and it is intended to make disk partitioning, RAID configuring, firmware updates and other stuff according to installing OS. Looks like we always will run agent with root privileges. Right? There
are no reasons to limit agent permissions. <br>
<br>
On the other hand, it is easy to imagine a situation when you want to run agent on every node of your cluster after installing OS. It could be useful to keep hardware info consistent (for example, many hardware configurations allow one to add hard drives in
run time). It also could be useful for "on the fly" firmware updates. It could be useful for "on the fly" manipulations with lvm groups/volumes and so on.
<br>
<br>
Frankly, I am not even sure that we need to run agent with root privileges even in ramdisk OS, because, for example, there are some system default limitations such as number of connections, number of open files, etc. which are different for root and ordinary
user and potentially can influence agent behaviour. Besides, it is possible that some vulnerabilities will be found in the future and they potentially could be used to compromise agent and damage hardware configuration.
<br>
<br>
Consequently, it is better to run agent under ordinary user even under ramdisk OS and use rootwrap if agent needs to run commands with root privileges. I know that rootwrap has some performance issues
<a href="http://lists.openstack.org/pipermail/openstack-dev/2014-March/029017.html">
http://lists.openstack.org/pipermail/openstack-dev/2014-March/029017.html</a> but it is still pretty suitable for ironic agent use case.
<br>
<br>
It would be great to hear as many opinions as possible according to this case. <br>
<br>
<br>
Vladimir Kozhukalov<tt><span style="font-size:10.0pt">_______________________________________________</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>OpenStack-dev mailing list</tt><br>
<tt><a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a></tt><br>
</span><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev"><tt><span style="font-size:10.0pt">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</span></tt></a><o:p></o:p></p>
</div>
</div>
</body>
</html>