On Mon, Nov 23, 2020 at 11:18, Thomas Goirand <zigo@debian.org> wrote:
On 11/23/20 9:30 AM, Tobias Urdin wrote:
Hello,
Just to clarify that this is already possible when using puppet-nova, it's up to the deployment to
make sure the database parameters for the classes is set.
We've been running without database credentials in nova.conf on our compute nodes for years.
Best regards
Tobias
Hi Tobias,
That's not what I'm suggesting.
I'm suggesting that nova-compute code from upstream simply ignores completely anything related to db connection, so we're done with the topic. That is, if nova-compute process having access to the db is the issue we're trying to fix.
Or is it that the security problem is having the db credentials written in a file on the compute node? If so, isn't having hacked root (or nova) access to a compute node already game-over?
What are we trying to secure here? If that's what I'm thinking (ie: some VM code to escape from guest, and potentially the hacker can gain access to the db), then IMO that's not the way to enforce things. It's not the role of upstream Nova to do this apart from a well enough written documentation.
I always understood this as having a goal to limit the attack surface. So if a VM escapes out of the sandbox and access the hypervisor then limit how may other services get compromised outside of the compromised compute host. Cheers, gibi
Cheers,
Thomas Goirand (zigo)