<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 04/05/2016 11:42 AM, Fox, Kevin M
wrote:<br>
</div>
<blockquote
cite="mid:1A3C52DFCD06494D8528644858247BF01B913794@EX10MBOX03.pnnl.gov"
type="cite">Yeah, and they just deprecated vendor data plugins
too, which eliminates my other workaround. :/<br>
<br>
We need to really discuss this problem at the summit and get a
viable path forward. Its just getting worse. :/<br>
<br>
Thanks,<br>
Kevin<br>
<div style="font-family: Times New Roman; color: #000000;
font-size: 16px">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF319107"><font
face="Tahoma" size="2" color="#000000"><b>From:</b> Juan
Antonio Osorio [<a class="moz-txt-link-abbreviated" href="mailto:jaosorior@gmail.com">jaosorior@gmail.com</a>]<br>
<b>Sent:</b> Tuesday, April 05, 2016 5:16 AM<br>
<b>To:</b> OpenStack Development Mailing List (not for usage
questions)<br>
<b>Subject:</b> Re: [openstack-dev] [TripleO] FreeIPA
integration<br>
</font><br>
</div>
<div>
<div dir="ltr"><br>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, Apr 5, 2016 at 2:45 PM,
Fox, Kevin M <span dir="ltr">
<<a moz-do-not-send="true"
href="mailto:Kevin.Fox@pnnl.gov" target="_blank">Kevin.Fox@pnnl.gov</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex; border-left:1px #ccc solid; padding-left:1ex">
<div>This sounds suspiciously like, "how do you get a
secret to the instance to get a secret from the
secret store" issue.... :)<br>
</div>
</blockquote>
<div>Yeah, sounds pretty familiar. We were using the
nova hooks mechanism for this means, but it was
deprecated recently. So bummer :/
<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex; border-left:1px #ccc solid; padding-left:1ex">
<div><br>
Nova instance user spec again?<br>
<br>
Thanks,<br>
Kevin </div>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
Yep, and we need a solution. I think the right solution is a
keypair generated on the instance, public key posted by the instace
to the hypervisor and stored with the instance data in the
database. I wrote that to the mailing list earlier today.<br>
<br>
A basic rule of a private key is that it never leaves the machine on
which it is generated. The rest falls out from there.<br>
</body>
</html>