<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">I vote for #3. ;)<br>
<br>
But seriously, please do help review it so we make sure everyone's use cases are handled ok.<br>
<br>
Thanks,<br>
Kevin<br>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF536003"><font face="Tahoma" size="2" color="#000000"><b>From:</b> Íõ»ª [wanghua.humble@gmail.com]<br>
<b>Sent:</b> Thursday, August 13, 2015 6:25 PM<br>
<b>To:</b> OpenStack Development Mailing List (not for usage questions)<br>
<b>Subject:</b> Re: [openstack-dev] [magnum]password for registry v2<br>
</font><br>
</div>
<div></div>
<div>
<div dir="ltr">Hi hongbin,
<div>I have comments in line.</div>
<div><br>
</div>
<div>Thank you.</div>
<div><br>
</div>
<div>Regards,</div>
<div>Wanghua</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Aug 14, 2015 at 6:20 AM, Hongbin Lu <span dir="ltr">
<<a href="mailto:hongbin.lu@huawei.com" target="_blank">hongbin.lu@huawei.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div lang="EN-CA">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d">Hi Wanghua,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d">For the question about how to pass user password to bay nodes, there are several options here:<u></u><u></u></span></p>
<p><u></u><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d"><span>1.<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d">Directly inject the password to bay nodes via cloud-init. This might be the simplest solution. I am not sure if it is OK in security aspect.<u></u><u></u></span></p>
<p><u></u><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d"><span>2.<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d">Inject a scoped Keystone trust to bay nodes and use it to fetch user password from Barbican (suggested by Adrian).</span></p>
</div>
</div>
</blockquote>
<div>If we use trust, who we should let user trust? If we let user trust magnum, then the credential of magnum will occur in vm. I think it is insecure. </div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div lang="EN-CA">
<div>
<p><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d"><u></u><u></u></span></p>
<p><u></u><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d"><span>3.<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d">Leverage the solution proposed by Kevin Fox [1]. This might be a long-term solution.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d">For the security concerns about storing credential in a config file, I need clarification. What is the config file? Is it a dokcer registry v2 config file?
I guess the credential stored there will be used to talk to swift. Is that correct? In general, it is
</span></p>
</div>
</div>
</blockquote>
<div>The credential stored in docker registry v2 config file is used to talk to swift.</div>
<div> </div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div lang="EN-CA">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d">insecure to store user credential inside a VM, because anyone can take a snapshot of the VM and boot another VM from the snapshot. Maybe storing a scoped
credential in the config file could mitigate the security risk. Not sure if there is a better solution.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d">[1]
<a href="https://review.openstack.org/#/c/186617/" target="_blank">https://review.openstack.org/#/c/186617/</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d">Best regards,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d">Hongbin<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"; color:#1f497d"><u></u> <u></u></span></p>
<div style="border:none; border-top:solid #b5c4df 1.0pt; padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:10.0pt; font-family:"Tahoma","sans-serif"" lang="EN-US">From:</span></b><span style="font-size:10.0pt; font-family:"Tahoma","sans-serif"" lang="EN-US">
</span><span style="font-size:10.0pt; font-family:"Microsoft YaHei","sans-serif"" lang="ZH-CN">Íõ»ª</span><span style="font-size:10.0pt; font-family:"Tahoma","sans-serif"" lang="EN-US"> [mailto:<a href="mailto:wanghua.humble@gmail.com" target="_blank">wanghua.humble@gmail.com</a>]
<br>
<b>Sent:</b> August-13-15 4:06 AM<br>
<b>To:</b> OpenStack Development Mailing List (not for usage questions)<br>
<b>Subject:</b> [openstack-dev] [magnum]password for registry v2<u></u><u></u></span></p>
</div>
<div>
<div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Hi all, <u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">In order to add registry v2 to bay nodes[1], authentication information is needed for the registry to upload and download files from swift. The swift storage-driver in registry now needs the parameters as described in [2]. User password
is needed. How can we get the password? <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">1. Let user pass password in baymodel-create.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">2. Use user token to get password from keystone<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Is it suitable to store user password in db?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">It may be insecure to store password in db and expose it to user in a config file even if the password is encrypted. Heat store user password in db before, and now change to keystone trust[3]. But if we use keystone trust, the swift storage-driver
does not support it. If we use trust, we expose magnum user's credential in a config file, which is also insecure.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Is there a secure way to implement this bp?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">[1] <a href="https://blueprints.launchpad.net/magnum/+spec/registryv2-in-master" target="_blank">
https://blueprints.launchpad.net/magnum/+spec/registryv2-in-master</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">[2] <a href="https://github.com/docker/distribution/blob/master/docs/storage-drivers/swift.md" target="_blank">
https://github.com/docker/distribution/blob/master/docs/storage-drivers/swift.md</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">[3] <a href="https://wiki.openstack.org/wiki/Keystone/Trusts" target="_blank">
https://wiki.openstack.org/wiki/Keystone/Trusts</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Regards,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Wanghua<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">
OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</div>
</body>
</html>