<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
<div><br>
</div>
<div><br>
</div>
<div>On 11/25/15, 11:33 AM, "Ben Swartzlander" <<a href="mailto:ben@swartzlander.org">ben@swartzlander.org</a>> wrote:</div>
<div><br>
</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div>On 11/24/2015 03:27 PM, Nathan Reller wrote:</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div>the cinder admin and the nova admin are ALWAYS the same people</div>
</blockquote>
<div><br>
</div>
<div>There is interest in hybrid clouds where the Nova and Cinder services</div>
<div>are managed by different providers. The customer would place higher</div>
<div>trust in Nova because you must trust the compute service, and the</div>
<div>customer would place less trust in Cinder. One way to achieve this</div>
<div>would be to have all encryption done by Nova. Cinder would simply see</div>
<div>encrypted data and provide a good cheap storage solution for data.</div>
<div><br>
</div>
<div>Consider a company with sensitive data. They can run the compute nodes</div>
<div>themselves and offload Cinder service to some third-party service.</div>
<div>This way they are the only ones who can manage the machines that see</div>
<div>the plaintext.</div>
</blockquote>
<div><br>
</div>
<div>If you have that level of paranoia, I suggest running LUKS inside the </div>
<div>guest VM and not relying on OpenStack to handle your encryption. Then </div>
<div>you don't have to worry about whether nova is sharing your keys with </div>
<div>cinder because even nova won't have them.</div>
</blockquote>
<div>That approach isn't actually more secure — anyone with root access to the compute host can dump the VM's memory to extract the encryption keys.</div>
<div><br>
</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div>Trying to design a system where we expect nova to do data encryption but</div>
<div>not cinder will not work in the long run. The eventual result will be </div>
<div>that nova will have to take on most of the functionality of cinder and </div>
<div>we'll be back to the nova-volume days.</div>
</blockquote>
<div>Could you explain further what you mean by "nova will have to take on most of the functionality of cinder"? In the current design, Nova is still passing data blocks to Cinder for storage – they're just encrypted instead of plaintext. That doesn't seem
to subvert the functionality of Cinder or reimplement it.</div>
<div><br>
</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div>Also in case it's not obvious, if you use different providers for</div>
<div>compute and storage, your performance is going to be absolutely terrible.</div>
</blockquote>
<div>The general idea is probably separation of duties, which contradicts the original statement that "the cinder admin and the nova admin are ALWAYS the same people." Is there an operational reason that these admins
<span style="font-weight: bold;">must</span> be the same person, or is that just typical?</div>
<div><br>
</div>
<div>Joel</div>
<div><br>
</div>
</body>
</html>