<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" id="owaParaStyle">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">I would really like to see secrets separated from config. Always have... They are two separate things.<br>
<br>
If nothing else, a separate config file so it can be permissioned differently.<br>
<br>
This could be combined with k8s secrets/configmaps better too.<br>
Or make it much easier to version config in git and have secrets somewhere else.<br>
<br>
Thanks,<br>
Kevin<br>
<br>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div id="divRpF527562" style="direction: ltr;"><font size="2" face="Tahoma" color="#000000"><b>From:</b> Raildo Mascena de Sousa Filho [rmascena@redhat.com]<br>
<b>Sent:</b> Friday, August 04, 2017 12:34 PM<br>
<b>To:</b> openstack-dev@lists.openstack.org<br>
<b>Subject:</b> [openstack-dev] [oslo][oslo.config] Pluggable drivers and protect plaintext secrets<br>
</font><br>
</div>
<div></div>
<div>
<div dir="ltr">
<div>
<div>
<div>Hi all, <br>
<br>
We had a couple of discussions with the Oslo team related to implement Pluggable drivers for oslo.config[0] and use those feature to implement support to protect plaintext secret on configuration files[1].
<br>
<br>
</div>
In another hand, due the containerized support on OpenStack services, we have a community effort to implement a k8s ConfigMap support[2][3], which might make us step back and consider how secret management will work, since the config data will need to go into
the configmap *before* the container is launched.<br>
<br>
</div>
So, I would like to see what the community think. Should we continue working on that pluggable drivers and protect plain text secrets support for oslo.config? Makes sense having a PTG session[4] on Oslo to discuss that feature?<br>
<br>
</div>
Thanks for the feedback in advance.<br>
<div>
<div>
<div>
<div><br>
</div>
<div>Cheers,</div>
<br>
[0] <a href="https://review.openstack.org/#/c/454897/" target="_blank">https://review.openstack.org/#/c/454897/</a><br>
[1] <a href="https://review.openstack.org/#/c/474304/" target="_blank">https://review.openstack.org/#/c/474304/</a><br>
[2] <a href="https://github.com/flaper87/keystone-k8s-ansible/blob/6524b768d75a28adf44c74aca77ccf13dd66b1a9/provision-keystone-apb/tasks/main.yaml#L71-L108" target="_blank">
https://github.com/flaper87/keystone-k8s-ansible/blob/6524b768d75a28adf44c74aca77ccf13dd66b1a9/provision-keystone-apb/tasks/main.yaml#L71-L108</a><br>
[3]<a href="https://kubernetes.io/docs/tasks/configure-pod-container/configmap/" target="_blank"> https://kubernetes.io/docs/</a><a href="https://kubernetes.io/docs/tasks/configure-pod-container/configmap/" target="_blank">tasks/configure-pod-container/configmap/</a><br>
[4] <a href="https://etherpad.openstack.org/p/oslo-ptg-queens" target="_blank">https://etherpad.openstack.org/p/oslo-ptg-queens</a></div>
</div>
</div>
</div>
<div dir="ltr">-- <br>
</div>
<div class="gmail_signature">
<div dir="ltr">
<div class="inbox-inbox-inbox-sig-container" id="inbox-inbox-inbox-standard-target">
<p class="inbox-inbox-inbox-fullname-container" style="font-weight:bold; margin:0px; padding:0px; font-size:14px; text-transform:uppercase">
<span class="inbox-inbox-inbox-firstname-container">Raildo </span><span class="inbox-inbox-inbox-lastname-container">mascena</span></p>
<p class="inbox-inbox-inbox-position-container" style="font-weight:normal; font-size:10px; margin:0px 0px 4px; text-transform:uppercase">
<span class="inbox-inbox-inbox-position">Software Engineer, Identity Managment</span></p>
<p class="inbox-inbox-inbox-legal-container" style="font-weight:normal; margin:0px; font-size:10px; color:rgb(153,153,153)">
<a class="inbox-inbox-inbox-redhat-anchor" href="https://www.redhat.com" style="color:rgb(0,136,206); font-size:10px; margin:0px; text-decoration:none; font-family:"overpass",sans-serif" target="_blank">Red Hat
<span><br>
<br>
</span></a></p>
<table border="0">
<tbody>
<tr>
<td width="100px"><a href="https://red.ht/sig" target="_blank"><img src="https://www.redhat.com/files/brand/email/sig-redhat.png" height="auto" width="90"></a>
</td>
<td class="inbox-inbox-inbox-promo" style="font-weight:normal; font-size:10px">
<div class="inbox-inbox-inbox-promo inbox-inbox-inbox-promo-1"><a href="https://redhat.com/trusted" style="text-decoration:none; color:rgb(204,0,0); font-weight:bold" target="_blank">TRIED. TESTED. TRUSTED.</a></div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>