<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Please see
<a href="https://review.openstack.org/#/c/186617" target="_blank">https://review.openstack.org/#/c/186617</a> - Nova Instance Users and review.<br>
<br>
We're working hard on trying to get heat -> nova -> instance -> barbican secret storage workflow working smoothly.<br>
<br>
Also related are: <a href="https://review.openstack.org/#/c/190404/" target="_blank">
https://review.openstack.org/#/c/190404/</a> - Barbican ACL's and <a href="https://review.openstack.org/#/c/190732/" target="_blank">
https://review.openstack.org/#/c/190732/</a> - Unscoped Service Catalog.<br>
<br>
Thanks,<br>
Kevin<br>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF629598"><font face="Tahoma" size="2" color="#000000"><b>From:</b> Madhuri Rai [madhuri.rai07@gmail.com]<br>
<b>Sent:</b> Sunday, June 14, 2015 10:30 PM<br>
<b>To:</b> OpenStack Development Mailing List (not for usage questions)<br>
<b>Subject:</b> [openstack-dev] [Magnum] TLS Support in Magnum<br>
</font><br>
</div>
<div></div>
<div>
<div dir="ltr">
<div>
<div>
<div>
<div><font size="2" color="003366">Hi All,<br>
<br>
<font color="003366">This is to bring the blueprint </font><a href="https://blueprints.launchpad.net/magnum/+spec/secure-kubernetes" target="_blank">secure-kubernetes</a><font color="003366"> in di<font color="003366">scussion. I have
<font color="003366">been trying to figure out <font color="003366">what could be the possible change
<font color="003366">area to support this feature in Magnum.</font></font></font></font></font> Below is just a rough idea on ho<font color="003366">w to proceed further on it.</font><br>
<br>
<font color="003366">Th<font color="003366">is task can be further broken in smaller
<font color="003366">pieces.</font></font></font><br>
<br>
<b>1. Add support for TLS in python-k8sclient.</b><br>
</font>
<div style="margin-left:40px"><font size="2" color="003366">The current auto-generated code doesn't support TLS. So this work will be to add TLS support in kubernetes python APIs.</font><br>
</div>
<font size="2" color="003366"><br>
<b>2. Add support for Barbican in Magnum.</b><br>
</font>
<div style="margin-left:40px"><font size="2" color="003366">Barbican will be used to store all the keys and certificates.</font><br>
</div>
<font size="2" color="003366"><br>
<b>3. Add support of TLS in Magnum.</b><br>
</font>
<div style="margin-left:40px"><font size="2" color="003366">This work mainly involves supporting the use of key and certificates in magnum to support TLS.</font><br>
<font size="2" color="003366"></font><br>
<font size="2" color="003366">The user generates the keys, certificates and store them in Barbican. Now there is two way to access these keys while creating a bay.</font><br>
<font size="2" color="003366"></font><br>
<font size="2" color="003366">1. Heat will access Barbican directly.</font><br>
<font size="2" color="003366">While creating bay, the user will provide this key and heat templates will fetch this key from Barbican.</font><br>
<font size="2" color="003366"></font><br>
<font size="2" color="003366"></font><br>
<font size="2" color="003366">2. Magnum-conductor access Barbican.</font><br>
<font size="2" color="003366">While creating bay, the user will provide this key and then Magnum-conductor will fetch this key from Barbican and provide this key to heat.</font><br>
<font size="2" color="003366"></font><br>
<font size="2" color="003366">Then heat will copy this files on kubernetes master node. Then bay will use this key to start a Kubernetes services signed with these keys.</font><br>
</div>
<font size="2" color="003366"><br>
<b><font color="003366"><br>
</font></b><font color="003366"><font color="003366"><font color="003366"></font></font></font></font></div>
<font size="2" color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366">After
<font color="003366">discussion when we all come to same point, I will create <font color="003366">
separate</font> blueprint<font color="003366">s for each task. <br>
</font></font>I am currently working on configuring Kubernetes <font color="003366">
services with TLS <font color="003366">keys.<br>
<br>
</font></font></font></font></font></font></font></font></div>
<font size="2" color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366">Please provide your suggest<font color="003366">ions if any.</font></font><br>
<br>
<br>
</font></font></font></font></font></font></font></font></div>
<font size="2" color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366">Reg<font color="003366">ar<font color="003366">ds,<br>
</font></font></font></font></font></font></font></font></font></font></font></div>
<font size="2" color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366"><font color="003366">Madhuri</font><br>
</font></font></font></font></font></font></font></font></font></font></font></div>
</div>
</div>
</div>
</body>
</html>