<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<p>Hello,</p>
<p><br>
</p>
<p>Just to clarify that this is already possible when using puppet-nova, it's up to the deployment to</p>
<p>make sure the database parameters for the classes is set.</p>
<p><br>
</p>
<p>We've been running without database <span style="font-size:12pt">credentials in nova.conf on our compute nodes for years.</span></p>
<p><span style="font-size:12pt"><br>
</span></p>
<p><span style="font-size:12pt">Best regards</span></p>
<p><span style="font-size:12pt">Tobias</span></p>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Thomas Goirand <zigo@debian.org><br>
<b>Sent:</b> Saturday, November 21, 2020 2:47:23 AM<br>
<b>To:</b> openstack maillist<br>
<b>Subject:</b> Re: [nova][tripleo][rpm-packaging][kolla][puppet][debian][osa] Nova enforces that no DB credentials are allowed for the nova-compute service</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">On 11/18/20 8:24 PM, Dan Smith wrote:<br>
> which things are<br>
> _not_allowed_ to be set for a service (such as db credentials on the<br>
> compute).<br>
<br>
I still don't understand why this is forbidden.<br>
<br>
Sure, I understand what people wrote: that it is a security problem.<br>
<br>
Can't nova-compute just *ignore* the db credentials, and then everyone<br>
is done with it, and moves on? That's a much more easy way to handle<br>
this problem, IMO.<br>
<br>
Cheers,<br>
<br>
Thomas Goirand (zigo)<br>
<br>
</div>
</span></font>
</body>
</html>