<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><base href="x-msg://1479/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I noticed that Trusted Compute Pools weren't documented and took a shot at it here, based on the wiki and these emails: <a href="https://review.openstack.org/16783">https://review.openstack.org/16783</a><div><br></div><div>I believe that adding these lines to nova.conf in Folsom will enable the trust filter:</div><div><br></div><div><div>scheduler_available_filters=nova.scheduler.filters.standard_filters</div><div>scheduler_available_filters=nova.scheduler.filters.trusted_filter</div><div>scheduler_default_filters=AvailabilityZoneFilter,RamFilter,ComputeFilter,TrustedFilter</div><div><br></div><div>However, if this isn't right, somebody let me know and I'll fix it in the docs.</div><div><br></div><div><br></div><div><div apple-content-edited="true">
<span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Take care,</div><div><br></div><div>Lorin</div><div>--</div><div>Lorin Hochstein</div><div>Lead Architect - Cloud Services</div><div>Nimbis Services, Inc.</div><div><a href="https://www.nimbisservices.com/">www.nimbisservices.com</a></div><div><br></div></div></span><br class="Apple-interchange-newline"></div><br class="Apple-interchange-newline"></span><br class="Apple-interchange-newline">
</div>
<br><div><div>On Nov 22, 2012, at 3:23 AM, "Jiang, Yunhong" <<a href="mailto:yunhong.jiang@intel.com">yunhong.jiang@intel.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="ZH-CN" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US" style="font-size: 10.5pt; color: rgb(31, 73, 125); ">I think trusted_filter is not in the scheduler_default_filters, so you have to make sure it’s used by the filter scheduler.<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US" style="font-size: 10.5pt; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US" style="font-size: 10.5pt; color: rgb(31, 73, 125); ">Thanks<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US" style="font-size: 10.5pt; color: rgb(31, 73, 125); ">--jyh<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US" style="font-size: 10.5pt; color: rgb(31, 73, 125); "> </span></div><div style="border-style: none none none solid; border-left-width: 1.5pt; border-left-color: blue; padding: 0cm 0cm 0cm 4pt; "><div><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0cm 0cm; "><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><b><span lang="EN-US" style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span lang="EN-US" style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span><a href="mailto:openstack-bounces+yunhong.jiang=intel.com@lists.launchpad.net">openstack-bounces+yunhong.jiang=intel.com@lists.launchpad.net</a> [mailto:openstack-<a href="mailto:bounces+yunhong.jiang=intel.com@lists.launchpad.net">bounces+yunhong.jiang=intel.com@lists.launchpad.net</a>]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Dale, StewartX T<br><b>Sent:</b><span class="Apple-converted-space"> </span>Thursday, November 22, 2012 7:28 AM<br><b>To:</b><span class="Apple-converted-space"> </span><a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>[Openstack] Getting Trusted Compute Pools working in Open Stack Folsom<o:p></o:p></span></div></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US"> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US">Hi All,<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US"> <o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US"> I am trying to get trusted compute pools working in my installation of open stack Folsom but so far am unable to get it to work. Currently when I spawn a new instance I don't see any interaction with the attestation server and the instance spawns just fine on a untrusted host. I have followed all the documentation I could find on TCP (<a href="http://wiki.openstack.org/TrustedComputingPools" target="_blank" style="color: purple; text-decoration: underline; ">http://wiki.openstack.org/TrustedComputingPools</a> ,<span class="Apple-converted-space"> </span><a href="https://github.com/openstack/nova/blob/stable/folsom/nova/scheduler/filters/trusted_filter.py" target="_blank" style="color: purple; text-decoration: underline; ">https://github.com/openstack/nova/blob/stable/folsom/nova/scheduler/filters/trusted_filter.py</a> ) but am still having no luck so I am hoping I missed something while setting it up. Hopefully someone can point out what I am doing wrong.<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US"> <o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US">Steps to Setup TCP:<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US">1. Set the following value in nova.conf<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US"> scheduler_driver=nova.scheduler.filter_scheduler.FilterScheduler<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US"> 2. Add "trusted_computing" section to nova.conf<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US"> [trusted_computing]<br> server=10.x.x.x<br> port=8181<br> server_ca_file=/etc/nova/ssl.10.1.71.206.crt<br> api_url=/AttestationService/resources/PollHosts<br> auth_blob=i-am-openstack <o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US">3. Add the "trusted" requirement to an existing flavor by running<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US"> nova-manage instance_type set_key m1.tiny trust:trusted_host trusted<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US">4. Restart nova-compute and nova-scheduler service<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US"> <o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US">At this point I test it by going to openstack page -> projects -> instances and launching a new instance of m1.tiny. At this point I should see a connection attempt on the attestion server (which I don't) and then the instance fail to launch (which it doesn't) since the host is untrusted. My version of open stack is Folsom and nova is 2012.2. <o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US"> Hopefully someone can point out my mistake or what I am missing.<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US" style="color: rgb(136, 136, 136); "> <o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US" style="color: rgb(136, 136, 136); ">-Stewart<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span lang="EN-US"> </span></div></div></div>_______________________________________________<br>Mailing list: <a href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a><br>Post to : <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>Unsubscribe : <a href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a><br>More help : <a href="https://help.launchpad.net/ListHelp">https://help.launchpad.net/ListHelp</a></div></blockquote></div><br></div></div></body></html>