<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div><br>
</div>
<div>The most basic requirement here for Magnum is that it needs a safe place to store credentials. A safe place can not be provided by just a library or even by just a daemon. Secure storage is provided by either hardware solution (an HSM) or a software
solution (SoftHSM, DogTag, IPA, IdM). A project should give a variety of secure storage options to the user.</div>
<div><br>
</div>
<div>On this, we have competing requirements. Devs need a turnkey option for easy testing locally or in the gate. Users kicking the tires want a realistic solution they try out easily with DevStack. Operators who already have secure storage deployed for
their cloud want an option that plugs into their existing HSMs. </div>
<div><br>
</div>
<div>Any roll-your-own option is not going to meet all of these requirements.</div>
<div><br>
</div>
<div>A good example, that does meet all of these requirements, is the key manager implementation in Nova and Cinder. [1] [2]</div>
<div><br>
</div>
<div>Nova and Cinder work together to provide volume encryption, and like Magnum, have a need to store and share keys securely. Using a plugin architecture, and the Barbican API, they implement a variety of key storage options:</div>
<div>- Fixed key allows for insecure stand alone operation, running only Nova and Cinder</div>
<div>- Barbican with static key, allows for easy deployment that can be started within DevStack by few lines of config.</div>
<div>- Barbican with a secure backend, allows for production grade secure storage of keys that has been tested on a variety of HSMs and software options.</div>
<div><br>
</div>
<div>Barbican's adoption is growing. Nova, Cinder, Neutron LBaaS, Sahara, and Magnum all have implementations using Barbican. Swift and DNSSec also have use cases. There are both RPM and Debian packages available for Barbican. There are (at least tech preview)
versions of puppet modules, Ansible playbooks, and DevStack plugins to deploy Barbican.</div>
<div><br>
</div>
<div>In summary, I think using Barbican absorbs the complexity of doing secure storage correctly. It gives operators production grade secure storage options, while giving devs easier options.</div>
<div><br>
</div>
<div>--Dave McCowan</div>
<div><br>
</div>
<div>[1] https://github.com/openstack/nova/tree/master/nova/keymgr</div>
<div></div>
<div>[2] https://github.com/openstack/cinder/tree/master/cinder/keymgr</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Hongbin Lu <<a href="mailto:hongbin.lu@huawei.com">hongbin.lu@huawei.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>"OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Date: </span>Friday, March 18, 2016 at 10:52 PM<br>
<span style="font-weight:bold">To: </span>"OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [openstack-dev] [magnum] High Availability<br>
</div>
<div><br>
</div>
<div xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1730347199;
mso-list-type:hybrid;
mso-list-template-ids:88516946 -455693920 269025283 269025285 269025281 269025283 269025285 269025281 269025283 269025285;}
@list l0:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:?;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;
mso-fareast-font-family:SimSun;
mso-bidi-font-family:"Times New Roman";}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div lang="EN-CA" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">OK. If using Keystone is not acceptable, I am going to propose a new approach:<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-18.0pt;mso-list:l0 level1 lfo1"><!--[if !supportLists]--><span style="font-size: 11pt; color: rgb(31, 73, 125);"><span style="mso-list:Ignore">·<span style="font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">
</span></span></span><!--[endif]--><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Store data in Magnum DB<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-18.0pt;mso-list:l0 level1 lfo1"><!--[if !supportLists]--><span style="font-size: 11pt; color: rgb(31, 73, 125);"><span style="mso-list:Ignore">·<span style="font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">
</span></span></span><!--[endif]--><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Encrypt data before writing it to DB<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-18.0pt;mso-list:l0 level1 lfo1"><!--[if !supportLists]--><span style="font-size: 11pt; color: rgb(31, 73, 125);"><span style="mso-list:Ignore">·<span style="font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">
</span></span></span><!--[endif]--><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Decrypt data after loading it from DB<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-18.0pt;mso-list:l0 level1 lfo1"><!--[if !supportLists]--><span style="font-size: 11pt; color: rgb(31, 73, 125);"><span style="mso-list:Ignore">·<span style="font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">
</span></span></span><!--[endif]--><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Have the encryption/decryption key stored in config file<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-18.0pt;mso-list:l0 level1 lfo1"><!--[if !supportLists]--><span style="font-size: 11pt; color: rgb(31, 73, 125);"><span style="mso-list:Ignore">·<span style="font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';">
</span></span></span><!--[endif]--><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Use encryption/decryption algorithm provided by a library<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">The approach above is the exact approach used by Heat to protect hidden parameters [1]. Compared to the Barbican option, this approach is much lighter
and simpler, and provides a basic level of data protection. This option is a good supplement to the Barbican option, which is heavy but provides advanced level of protection. It will fit into the use cases that users don’t want to install Barbican but want
a basic protection.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">If you disagree, I would request you to justify why this approach works for Heat but not for Magnum. Also, I also wonder if Heat has a plan to set
a hard dependency on Barbican for just protecting the hidden parameters.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">If you don’t like code duplication between Magnum and Heat, I would suggest to move the implementation to a oslo library to make it DRY. Thoughts?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">[1]
<a href="https://specs.openstack.org/openstack/heat-specs/specs/juno/encrypt-hidden-parameters.html">
https://specs.openstack.org/openstack/heat-specs/specs/juno/encrypt-hidden-parameters.html</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Best regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Hongbin<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size: 10pt; font-family: Tahoma, sans-serif;">From:</span></b><span lang="EN-US" style="font-size: 10pt; font-family: Tahoma, sans-serif;"> David Stanek [<a href="mailto:dstanek@dstanek.com">mailto:dstanek@dstanek.com</a>]
<br>
<b>Sent:</b> March-18-16 4:12 PM<br>
<b>To:</b> OpenStack Development Mailing List (not for usage questions)<br>
<b>Subject:</b> Re: [openstack-dev] [magnum] High Availability<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Fri, Mar 18, 2016 at 4:03 PM Douglas Mendizábal <<a href="mailto:douglas.mendizabal@rackspace.com">douglas.mendizabal@rackspace.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<p class="MsoNormal" style="margin-bottom:12.0pt">[snip]<br>
><br>
> Regarding the Keystone solution, I'd like to hear the Keystone team's feadback on that. It definitely sounds to me like you're trying to put a square peg in a round hole.<br>
><o:p></o:p></p>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I believe that using Keystone for this is a mistake. As mentioned in the blueprint, Keystone is not encrypting the data so magnum would be on the hook to do it. So that means that if security is a requirement you'd have to duplicate more
than just code. magnum would start having a larger security burden. Since we have a system designed to securely store data I think that's the best place for data that needs to be secure.<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</span>
</body>
</html>