<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1" class="" style="word-wrap:break-word">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">If your asking the cloud provider to go through the effort to install Magnum, its not that much extra effort to install Barbican at the same time. Making it a dependency isn't too
bad then IMHO.<br>
<br>
Thanks,<br>
Kevin<br>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF686760"><font face="Tahoma" size="2" color="#000000"><b>From:</b> Adrian Otto [adrian.otto@rackspace.com]<br>
<b>Sent:</b> Sunday, June 14, 2015 11:09 PM<br>
<b>To:</b> OpenStack Development Mailing List (not for usage questions)<br>
<b>Subject:</b> Re: [openstack-dev] [Magnum] TLS Support in Magnum<br>
</font><br>
</div>
<div></div>
<div>Madhuri,
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Jun 14, 2015, at 10:30 PM, Madhuri Rai <<a href="mailto:madhuri.rai07@gmail.com" class="" target="_blank">madhuri.rai07@gmail.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class="">
<div class="">
<div class="">
<div class="">
<div class=""><font class="" size="2" color="003366">Hi All,<br class="">
<br class="">
<font class="" color="003366">This is to bring the blueprint </font><a href="https://blueprints.launchpad.net/magnum/+spec/secure-kubernetes" class="" target="_blank">secure-kubernetes</a><font class="" color="003366"> in di<font class="" color="003366">scussion.
I have <font class="" color="003366">been trying to figure out <font class="" color="003366">
what could be the possible change <font class="" color="003366">area to support this feature in Magnum.</font></font></font></font></font></font> Below is just a rough idea on ho<font class="" color="003366">w to proceed further on it.</font><br class="">
<br class="">
<font class="" color="003366">Th<font class="" color="003366">is task can be further broken in smaller
<font class="" color="003366">pieces.</font></font></font><br class="">
<br class="">
<b class="">1. Add support for TLS in python-k8sclient.</b><br class="">
<div class="" style="margin-left:40px"><font class="" size="2" color="003366">The current auto-generated code doesn't support TLS. So this work will be to add TLS support in kubernetes python APIs.</font><br class="">
</div>
<font class="" size="2" color="003366"><br class="">
<b class="">2. Add support for Barbican in Magnum.</b><br class="">
</font>
<div class="" style="margin-left:40px"><font class="" size="2" color="003366">Barbican will be used to store all the keys and certificates.</font><br class="">
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
Keep in mind that not all clouds will support Barbican yet, so this approach could impair adoption of Magnum until Barbican is universally supported. It might be worth considering a solution that would generate all keys on the client, and copy them to the Bay
master for communication with other Bay nodes. This is less secure than using Barbican, but would allow for use of Magnum before Barbican is adopted.</div>
<div><br class="">
</div>
<div>If both methods were supported, the Barbican method should be the default, and we should put warning messages in the config file so that when the administrator relaxes the setting to use the non-Barbican configuration he/she is made aware that it requires
a less secure mode of operation.</div>
<div><br class="">
</div>
<div>My suggestion is to completely implement the Barbican support first, and follow up that implementation with a non-Barbican option as a second iteration for the feature.</div>
<div><br class="">
</div>
<div>Another possibility would be for Magnum to use its own private installation of Barbican in cases where it is not available in the service catalog. I dislike this option because it creates an operational burden for maintaining the private Barbican service,
and additional complexities with securing it.</div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">
<div dir="ltr" class="">
<div class="">
<div class="">
<div class="">
<div class=""><font class="" size="2" color="003366"><b class="">3. Add support of TLS in Magnum.</b><br class="">
</font>
<div class="" style="margin-left:40px"><font class="" size="2" color="003366">This work mainly involves supporting the use of key and certificates in magnum to support TLS.</font><br class="">
<font class="" size="2" color="003366"></font><br class="">
<font class="" size="2" color="003366">The user generates the keys, certificates and store them in Barbican. Now there is two way to access these keys while creating a bay.</font><br class="">
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
Rather than "the user generates the keys…", perhaps it might be better to word that as "the magnum client library code generates the keys for the user…”.</div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">
<div dir="ltr" class="">
<div class="">
<div class="">
<div class="">
<div class="">
<div class="" style="margin-left:40px"><font class="" size="2" color="003366"></font><font class="" size="2" color="003366">1. Heat will access Barbican directly.</font><br class="">
<font class="" size="2" color="003366">While creating bay, the user will provide this key and heat templates will fetch this key from Barbican.</font><br class="">
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
I think you mean that Heat will use the Barbican key to fetch the TLS key for accessing the native API service running on the Bay.</div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">
<div dir="ltr" class="">
<div class="">
<div class="">
<div class="">
<div class="">
<div class="" style="margin-left:40px"><font class="" size="2" color="003366">2. Magnum-conductor access Barbican.</font><br class="">
<font class="" size="2" color="003366">While creating bay, the user will provide this key and then Magnum-conductor will fetch this key from Barbican and provide this key to heat.</font><br class="">
<font class="" size="2" color="003366"></font><br class="">
<font class="" size="2" color="003366">Then heat will copy this files on kubernetes master node. Then bay will use this key to start a Kubernetes services signed with these keys.</font><br class="">
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
Make sure that the Barbican keys used by Heat and magnum-conductor to store the various TLS certificates/keys are unique per tenant and per bay, and are not shared among multiple tenants. We don’t want it to ever be possible to trick Magnum into revealing secrets
belonging to other tenants.</div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">
<div dir="ltr" class="">
<div class="">
<div class="">
<div class="">
<div class=""><font class="" size="2" color="003366"><font class="" color="003366"><font class="" color="003366"><font class="" color="003366"></font></font></font></font></div>
<font class="" size="2" color="003366"><font class="" color="003366"><font class="" color="003366"><font class="" color="003366"><font class="" color="003366"><font class="" color="003366">After
<font class="" color="003366">discussion when we all come to same point, I will create
<font class="" color="003366">separate</font> blueprint<font class="" color="003366">s for each task.
<br class="">
</font></font>I am currently working on configuring Kubernetes <font class="" color="003366">
services with TLS <font class="" color="003366">keys.<br class="">
<br class="">
</font></font></font></font></font></font></font></font></div>
<font class="" size="2" color="003366"><font class="" color="003366">Please provide your suggest<font class="" color="003366">ions if any.</font></font><br class="">
</font></div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
Thanks for kicking off this discussion.</div>
<div><br class="">
</div>
<div>Regards,</div>
<div><br class="">
</div>
<div>Adrian</div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">
<div dir="ltr" class="">
<div class="">
<div class=""><font class="" size="2" color="003366"><br class="">
<br class="">
</font></div>
<font class="" size="2" color="003366"><font class="" color="003366"><font class="" color="003366"><font class="" color="003366"><font class="" color="003366"><font class="" color="003366"><font class="" color="003366"><font class="" color="003366"><font class="" color="003366">Reg<font class="" color="003366">ar<font class="" color="003366">ds,<br class="">
</font></font></font></font></font></font></font></font></font></font></font></div>
<font class="" size="2" color="003366"><font class="" color="003366">Madhuri</font><br class="">
</font></div>
__________________________________________________________________________<br class="">
OpenStack Development Mailing List (not for usage questions)<br class="">
Unsubscribe: <a href="mailto:OpenStack-dev-request@lists.openstack.org" class="" target="_blank">
OpenStack-dev-request@lists.openstack.org</a>?subject:unsubscribe<br class="">
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" class="" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br class="">
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</div>
</body>
</html>