<div dir="ltr">
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353" face="andale mono, lucida console, monospace">Hi Ton,</font></pre><pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353" face="andale mono, lucida console, monospace">kube-masters will be nova instances only and because any access to nova-instances is already being secured using keystone, I am not able to understand what are the concerns in storing password on master-nodes.</font></pre><pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353" face="andale mono, lucida console, monospace">Can you please list down concerns in our current approach?</font></pre><pre class="" style="border:none;padding:0cm;line-height:0.48cm">-Vikas Choudhary</pre><pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>Hi
everyone,</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"> <i><font face="andale mono, lucida console, monospace"><font style="font-size:9pt">I
am running into a potential issue in implementing the support for</font></font></i></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>load
balancer in k8s services. After a chat with sdake, I would like to</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>run
this by the team for feedback/suggestion.</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>First
let me give a little background for context. In the current k8s</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>cluster,
all k8s pods and services run within a private subnet (on Flannel)</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>and
they can access each other but they cannot be accessed from external</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>network.
The way to publish an endpoint to the external network is by</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>specifying
this attribute in your service manifest:</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"> <i><font face="andale mono, lucida console, monospace"><font style="font-size:9pt">type:
LoadBalancer</font></font></i></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"> <i><font face="andale mono, lucida console, monospace"><font style="font-size:9pt">Then
k8s will talk to OpenStack Neutron to create the load balancer</font></font></i></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>pool,
members, VIP, monitor. The user would associate the VIP with a</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>floating
IP and then the endpoint of the service would be accessible from</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>the
external internet.</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"> <i><font face="andale mono, lucida console, monospace"><font style="font-size:9pt">To
talk to Neutron, k8s needs the user credential and this is stored in</font></font></i></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>a
config file on the master node. This includes the username, tenant
name,</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>password.
When k8s starts up, it will load the config file and create an</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>authenticated
client with Keystone.</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"> <i><font face="andale mono, lucida console, monospace"><font style="font-size:9pt">The
issue we need to find a good solution for is how to handle the</font></font></i></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>password.
With the current effort on security to make Magnum</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>production-ready,
we want to make sure to handle the password properly.</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"> <i><font face="andale mono, lucida console, monospace"><font style="font-size:9pt">Ideally,
the best solution is to pass the authenticated token to k8s to</font></font></i></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>use,
but this will require sizeable change upstream in k8s. We have good</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>reason
to pursue this but it will take time.</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"> <i><font face="andale mono, lucida console, monospace"><font style="font-size:9pt">For
now, my current implementation is as follows:</font></font></i></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"> <i><font face="andale mono, lucida console, monospace"><font style="font-size:9pt">In
a bay-create, magnum client adds the password to the API call</font></font></i></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"> <i><font face="andale mono, lucida console, monospace"><font style="font-size:9pt">(normally
it authenticates and sends the token)</font></font></i></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"> <i><font face="andale mono, lucida console, monospace"><font style="font-size:9pt">The
conductor picks it up and uses it as an input parameter to the heat</font></font></i></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"> <i><font face="andale mono, lucida console, monospace"><font style="font-size:9pt">templates</font></font></i></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"> <i><font face="andale mono, lucida console, monospace"><font style="font-size:9pt">When
configuring the master node, the password is saved in the config</font></font></i></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"> <i><font face="andale mono, lucida console, monospace"><font style="font-size:9pt">file
for k8s services.</font></font></i></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"> <i><font face="andale mono, lucida console, monospace"><font style="font-size:9pt">Magnum
does not store the password internally.</font></font></i></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><br>
</pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"> <i><font face="andale mono, lucida console, monospace"><font style="font-size:9pt">This
is probably not ideal, but it would let us proceed for now. We</font></font></i></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>can
deprecate it later when we have a better solution. So leaving aside</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>the
issue of how k8s should be changed, the question is: is this
approach</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>reasonable
for the time, or is there a better approach?</i></font></font></font></pre>
<pre class="" style="border:none;padding:0cm;line-height:0.48cm"><br>
</pre>
<pre class="" style="margin-bottom:0.5cm;border:none;padding:0cm;line-height:0.48cm"><font color="#535353"><font face="andale mono, lucida console, monospace"><font style="font-size:9pt"><i>Ton
Ngo,</i></font></font></font></pre></div>