<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><p style="font-family: Helvetica, Arial, sans-serif; font-size: medium; background-color: rgb(255, 255, 255); position: static; z-index: auto;">We have a couple of requests for all of you planning to attend the 18-19th September Policy Mid-cycle summit. </p><p style="font-family: Helvetica, Arial, sans-serif; font-size: medium; background-color: rgb(255, 255, 255);">1. We’re planning on starting with a series of talks describing the state of policy (current and possibly future) in different projects. We've confirmed people for talks on the following projects.</p><p style="font-family: Helvetica, Arial, sans-serif; font-size: medium; background-color: rgb(255, 255, 255); position: static; z-index: auto;">Nova<br>Neutron<br>Congress </p><p style="font-family: Helvetica, Arial, sans-serif; font-size: medium; background-color: rgb(255, 255, 255);">Are there any other projects interested in giving a talk? It could just be a chalk-talk (on the whiteboard), if that makes it easier.</p><p style="font-family: Helvetica, Arial, sans-serif; font-size: medium; background-color: rgb(255, 255, 255); position: static; z-index: auto;">2. We’re planning to use the talks as level-setting for a discussion/workshop on how all our policy efforts might interoperate to better serve OpenStack users. We’d like to drive that discussion by working through one or more use cases that require us to all think about OpenStack policy from a holistic point of view. </p><p style="font-family: Helvetica, Arial, sans-serif; font-size: medium; background-color: rgb(255, 255, 255);">Examples of the kinds of questions we envision trying to answer:</p><ul style="font-family: Helvetica, Arial, sans-serif; font-size: medium; background-color: rgb(255, 255, 255);"><li>How would the OpenStack users communicate their policies to OpenStack? </li><li>Can OpenStack always enforce policies? What about monitoring? Auditing?</li><li>What is the workflow for how OpenStack takes the policies and implements/renders them?</li><li>What happens if there are conflicts between users? How are those conflicts surfaced/resolved?</li><li>What gaps are there? How do we plug them? What’s the roadmap?</li></ul><p style="font-family: Helvetica, Arial, sans-serif; font-size: medium; background-color: rgb(255, 255, 255);">Below is the start of a use case that we think will do the trick. Let’s work together to refine it over email before the summit, so we can hit the ground running. Please reply (to all) with suggestions/alternatives/etc.</p><p style="font-family: Helvetica, Arial, sans-serif; font-size: medium; background-color: rgb(255, 255, 255);">a) Application-developer: My 2-tier PCI app (database tier and web tier) can be deployed either for production or for development. </p><p style="font-family: Helvetica, Arial, sans-serif; font-size: medium; background-color: rgb(255, 255, 255);">When deployed for production, it needs </p><ul style="font-family: Helvetica, Arial, sans-serif; font-size: medium; background-color: rgb(255, 255, 255);"><li>solid-state storage for the DB tier</li><li>all ports but 80 closed on the web tier</li><li>no network communication to DB tier except from the web tier</li><li>no VM in the DB tier can be deployed on the same hypervisor as another VM in the DB tier; same for the web tier</li></ul><p style="font-family: Helvetica, Arial, sans-serif; font-size: medium; background-color: rgb(255, 255, 255);">b) Cloud operator. </p><ul style="font-family: Helvetica, Arial, sans-serif; font-size: medium; background-color: rgb(255, 255, 255);"><li>Applications deployed for production must have access to the internet.</li><li>Applications deployed for production must not be deployed in the DMZ cluster.</li><li>Applications deployed for production should scale based on load.</li><li>Applications deployed for development should have 1 VM instance per tier.</li><li>Every application must use VM images signed by an administrator</li></ul><p style="font-family: Helvetica, Arial, sans-serif; font-size: medium; background-color: rgb(255, 255, 255);"> c) Compliance officer</p><ul style="font-family: Helvetica, Arial, sans-serif; font-size: medium; background-color: rgb(255, 255, 255);"><li>No VM from a PCI app may be located on the same hypervisor as a VM from a non-PCI app.</li></ul><div>
<br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">~ sean</span>
</div>
<br></body></html>