<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style>
<!--
@font-face
{font-family:SimSun}
@font-face
{font-family:SimSun}
@font-face
{font-family:Calibri}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif"}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline}
span.EmailStyle17
{font-family:"Calibri","sans-serif";
color:#1F497D}
@page WordSection1
{margin:72.0pt 72.0pt 72.0pt 72.0pt}
-->
</style><style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1" lang="EN-CA" link="blue" vlink="purple">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">+1. Thanks for starting the discussion.<br>
<br>
We may need a spec for it. The support in k8s currently is marked experimental (thankfully) and is insufficient. It currently only supports username/password authentication via keystone v2. There's an issue in the works to fix it in k8s:<br>
https://github.com/kubernetes/kubernetes/issues/24982<br>
<br>
tl:dr; To fix it, we will need keystone token authentication, which will require v3 token authentication. v3 token auth today requires a service account with an admin credential, so the magnum support will need to provision one of those accounts and copy the
appropriate config/credentials to the controllers as well as set the config options.<br>
<br>
I've talked to the keystone team and they believe that the v3 validate token api can be done without an admin credential if a new role was introduced and the policy for that api call was changed to specify the new role. This would make things more secure, but
wouldn't change what magnum would need to do, just which role it would attach to the user it provisions. So I think these two activities can be done in parallel.<br>
<br>
Thanks,<br>
Kevin<br>
<br>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF609320"><font face="Tahoma" color="#000000" size="2"><b>From:</b> Hongbin Lu [hongbin.lu@huawei.com]<br>
<b>Sent:</b> Wednesday, May 04, 2016 8:33 AM<br>
<b>To:</b> OpenStack Development Mailing List (not for usage questions)<br>
<b>Subject:</b> [openstack-dev] [magnum] Add support for using Keystone in k8s bay<br>
</font><br>
</div>
<div></div>
<div>
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Hi team,</span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="color:#1F497D">Based on requests, I propose to add support for Keystone authentication for k8s bay. A blueprint was created for that:</span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="color:#1F497D">https://blueprints.launchpad.net/magnum/+spec/keystone-for-k8s-bay</span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="color:#1F497D">A goal is to enable other OpenStack services to access the APIs of k8s bays. So far, I received a use case from a under-developing Horizon k8s plugin. I believe there will be more similar use cases from other
services. For the implementation, I think it is straightforward. Keystone authentication is already supported in k8s upstream [1]. Magnum could simply add an option for users to turn it on. As an initial step, I suggest to support passing the auth option via
labels (e.g. ‘–labels k8s-auth=keystone’). If Keystone is supported by other COEs in the future, we could promote this option as a baymodel attribute. Thoughts?</span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="color:#1F497D">[1] <a href="http://kubernetes.io/docs/admin/authentication/" target="_blank">
http://kubernetes.io/docs/admin/authentication/</a></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="color:#1F497D">Best regards,</span></p>
<p class="MsoNormal"><span style="color:#1F497D">Hongbin</span></p>
</div>
</div>
</div>
</div>
</body>
</html>