<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1" bgcolor="#FFFFFF">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Yeah. I'm all for something like that. The solution just needs to meet the requirements listed in
<a href="https://review.openstack.org/222293" target="_blank">https://review.openstack.org/222293</a><br>
<br>
That solution could also probably be reused for an ssh key. The security of openssh vms + nova is pretty bad.<br>
<br>
There should be some kind of way for the vm to post its ssh pubkey to nova, and then have a nova ssh command on the client that pulls the key out of nova api and updates your known hosts with it, to prevent all the man in the middle potential we've lived with
for a long time.<br>
<br>
Thanks,<br>
Kevin<br>
<br>
<br>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF940839"><font color="#000000" face="Tahoma" size="2"><b>From:</b> Adam Young [ayoung@redhat.com]<br>
<b>Sent:</b> Tuesday, April 05, 2016 7:02 PM<br>
<b>To:</b> openstack-dev@lists.openstack.org<br>
<b>Subject:</b> Re: [openstack-dev] [TripleO] FreeIPA integration<br>
</font><br>
</div>
<div></div>
<div>
<div class="moz-cite-prefix">On 04/05/2016 11:42 AM, Fox, Kevin M wrote:<br>
</div>
<blockquote type="cite">Yeah, and they just deprecated vendor data plugins too, which eliminates my other workaround. :/<br>
<br>
We need to really discuss this problem at the summit and get a viable path forward. Its just getting worse. :/<br>
<br>
Thanks,<br>
Kevin<br>
<div style="font-family:Times New Roman; color:#000000; font-size:16px">
<hr tabindex="-1">
<div id="divRpF319107" style="direction:ltr"><font color="#000000" face="Tahoma" size="2"><b>From:</b> Juan Antonio Osorio [<a class="moz-txt-link-abbreviated" href="mailto:jaosorior@gmail.com" target="_blank">jaosorior@gmail.com</a>]<br>
<b>Sent:</b> Tuesday, April 05, 2016 5:16 AM<br>
<b>To:</b> OpenStack Development Mailing List (not for usage questions)<br>
<b>Subject:</b> Re: [openstack-dev] [TripleO] FreeIPA integration<br>
</font><br>
</div>
<div>
<div dir="ltr"><br>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, Apr 5, 2016 at 2:45 PM, Fox, Kevin M <span dir="ltr">
<<a href="mailto:Kevin.Fox@pnnl.gov" target="_blank">Kevin.Fox@pnnl.gov</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex; border-left:1px #ccc solid; padding-left:1ex">
<div>This sounds suspiciously like, "how do you get a secret to the instance to get a secret from the secret store" issue.... :)<br>
</div>
</blockquote>
<div>Yeah, sounds pretty familiar. We were using the nova hooks mechanism for this means, but it was deprecated recently. So bummer :/
<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex; border-left:1px #ccc solid; padding-left:1ex">
<div><br>
Nova instance user spec again?<br>
<br>
Thanks,<br>
Kevin </div>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<br>
Yep, and we need a solution. I think the right solution is a keypair generated on the instance, public key posted by the instace to the hypervisor and stored with the instance data in the database. I wrote that to the mailing list earlier today.<br>
<br>
A basic rule of a private key is that it never leaves the machine on which it is generated. The rest falls out from there.<br>
</div>
</div>
</div>
</body>
</html>