<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Sun, Apr 6, 2014 at 9:36 AM, Russell Bryant <span dir="ltr"><<a href="mailto:rbryant@redhat.com" target="_blank">rbryant@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>On 04/06/2014 09:02 AM, Christopher Yeoh wrote:<br>
> On Sun, Apr 6, 2014 at 10:06 AM, Hopper, Justin <<a href="mailto:justin.hopper@hp.com" target="_blank">justin.hopper@hp.com</a><br>
</div><div><div>> <mailto:<a href="mailto:justin.hopper@hp.com" target="_blank">justin.hopper@hp.com</a>>> wrote:<br>
><br>
> Russell,<br>
><br>
> At this point the guard that Nova needs to provide around the instance<br>
> does not need to be complex. It would even suffice to keep those<br>
> instances hidden from such operations as łnova list˛ when invoked by<br>
> directly by the user.<br>
><br>
><br>
> Are you looking for something to prevent accidental manipulation of an<br>
> instance created by Trove or intentional changes as well? Whilst doing<br>
> some filtering in nova list is simple on the surface, we don't try to<br>
> keep server uuids secret in the API, so its likely that sort of<br>
> information will leak through other parts of the API say through volume<br>
> or networking interfaces. Having to enforce another level of permissions<br>
> throughout the API would be a considerable change. Also it would<br>
> introduce inconsistencies into the information returned by Nova - eg<br>
> does quota/usage information returned to the user include the server<br>
> that Trove created or is that meant to be adjusted as well?<br>
><br>
> If you need a high level of support from the Nova API to hide servers,<br>
> then if its possible, as Russell suggests to get what you want by<br>
> building on top of the Nova API using additional identities then I think<br>
> that would be the way to go. If you're just looking for a simple way to<br>
> offer to Trove clients a filtered list of servers, then perhaps Trove<br>
> could offer a server list call which is a proxy to Nova and filters out<br>
> the servers which are Trove specific since Trove knows which ones it<br>
> created.<br>
<br>
</div></div>Yeah, I would *really* prefer to go the route of having trove own all<br>
instances from the perspective of Nova. Trove is what is really<br>
managing these instances, and it already has to keep track of what<br>
instances are associated with which user.<br>
<br></blockquote><div>Although this approach would work, there are some manageability issues with it. When trove is managing 100’s of nova instances, then things tend to break down when looking directly at the Trove tenant through the Nova API and trying to piece together the associations, what resource failed to provision, etc.</div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
It sounds like what you really want is for Trove to own the instances,<br>
so I think we need to get down to very specifically won't work with that<br>
approach.<br>
<br>
For example, is it a billing thing? As it stands, all notifications for<br>
trove managed instances will have the user's info in them. Do you not<br>
want to lose that? If that's the problem, that seems solvable with a<br>
much simpler approach.<br>
<div><div><br></div></div></blockquote><div><br></div><div>We have for the most part solved the billing issue since Trove does maintain the association, and able to send events on-behalf of the correct user. We would lose out on the additional layer of checks that Nova provides, such as Rate Limiting per project, Quotas enforced at the Nova layer. The trove tenant would essentially need full access without any such limits.</div>
<div><br></div><div>Since we’d prefer to keep these checks at the Infrastructure layer intact for Users that interact with the Trove API, I think the issue goes beyond just filtering them out from the API. </div><div><br>
</div><div>One idea that we’ve floated around is possibly introducing a ‘shadow’ tenant, that allows Services like Trove to create Nova / Cinder / Neutron resources on behalf of the actual tenant. The resources owned by this shadow tenant would only be visible / manipulated by a higher-level Service. This could require some Service token to be provided along with the original tenant token.</div>
<div><br></div><div>Example: POST /v2/{shadow_tenant_id}/servers</div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div>
--<br>
Russell Bryant<br>
<br>
_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</div></div></blockquote></div><br></div></div>