<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Fri, Apr 4, 2014 at 3:10 PM, Ling Gao <span dir="ltr"><<a href="mailto:linggao@us.ibm.com" target="_blank">linggao@us.ibm.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><font face="sans-serif">Hello </font><font size="3">Vladimir,</font>
<br><font size="3"> I would prefer an agent-less node,
meaning the agent is only used under the ramdisk OS to collect hw info,
to do firmware updates and to install nodes etc. In this sense, the agent
running as root is fine. Once the node is installed, the agent should be
out of the picture. I have been working with HPC customers, in that environment
they prefer as less memory prints as possible. Even as a ordinary tenant,
I do not feel secure to have some agents running on my node. For the firmware
update on the fly, I do not know how many customers will trust us doing
it while their critical application is running. Even they do and ready
to do it, Ironic can then send an agent to the node through scp/wget as
admin/root and quickly do it and then kill the agent on the node.
Just my 2 cents.</font>
<br><br></blockquote><div><br></div><div>+1<br></div><div><br> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br><font color="#5f5f5f" face="sans-serif" size="1">From:
</font><font face="sans-serif" size="1">Vladimir Kozhukalov
<<a href="mailto:vkozhukalov@mirantis.com" target="_blank">vkozhukalov@mirantis.com</a>></font>
<br><font color="#5f5f5f" face="sans-serif" size="1">To:
</font><font face="sans-serif" size="1">"OpenStack Development
Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>>,
</font>
<br><font color="#5f5f5f" face="sans-serif" size="1">Date:
</font><font face="sans-serif" size="1">04/04/2014 08:24 AM</font>
<br><font color="#5f5f5f" face="sans-serif" size="1">Subject:
</font><font face="sans-serif" size="1">[openstack-dev]
[Ironic][Agent]</font>
<br>
<hr noshade>
<br>
<br>
<br><font size="3">Hello, everyone,</font>
<br>
<br><font size="3">I'd like to involve more people to express their opinions
about the way how we are going to run Ironic-python-agent. I mean should
we run it with root privileges or not.</font>
<br>
<br><font size="3">From the very beginning agent is supposed to run under
ramdisk OS and it is intended to make disk partitioning, RAID configuring,
firmware updates and other stuff according to installing OS. Looks like
we always will run agent with root privileges. Right? There are no reasons
to limit agent permissions.</font>
<br>
<br><font size="3">On the other hand, it is easy to imagine a situation when
you want to run agent on every node of your cluster after installing OS.
It could be useful to keep hardware info consistent (for example, many
hardware configurations allow one to add hard drives in run time). It also
could be useful for "on the fly" firmware updates. It could be
useful for "on the fly" manipulations with lvm groups/volumes
and so on. </font>
<br>
<br><font size="3">Frankly, I am not even sure that we need to run agent
with root privileges even in ramdisk OS, because, for example, there are
some system default limitations such as number of connections, number of
open files, etc. which are different for root and ordinary user and potentially
can influence agent behaviour. Besides, it is possible that some vulnerabilities
will be found in the future and they potentially could be used to compromise
agent and damage hardware configuration. </font>
<br>
<br><font size="3">Consequently, it is better to run agent under ordinary
user even under ramdisk OS and use rootwrap if agent needs to run commands
with root privileges. I know that rootwrap has some performance issues
</font><a href="http://lists.openstack.org/pipermail/openstack-dev/2014-March/029017.html" target="_blank"><font color="blue" size="3"><u>http://lists.openstack.org/pipermail/openstack-dev/2014-March/029017.html</u></font></a><font size="3">
but it is still pretty suitable for ironic agent use case.</font>
<br>
<br><font size="3">It would be great to hear as many opinions as possible
according to this case.</font>
<br>
<br>
<br><font size="3">Vladimir Kozhukalov</font><tt><font>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
</font></tt><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank"><tt><font>http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</font></tt></a><tt><font><br>
</font></tt>
<br><br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div></div>