[nova][entropy] what are your rate limits??
Hello Openstack Discuss, I am doing some investigation into instance entropy and was wondering what settings others are using with regard to rate limiting entropy supplied by the hypervisor. Specifically, we're adding the "hw_rng:allowed=True" nova flavor property to pass libvirt the relevant config, but need to decide the appropriate rate limiting settings to prevent instances from being greedy with entropy but still retain a comfortable level for themselves. I've done some experimenting (100 bytes/s is possibly a minimum, but still allows a comfortable value of ~1000 for free entropy in instances) I'm also curious to hear other's experiences when it comes to entropy in Openstack: * What sources of entropy did you use in the hypervisor? * Issues you've faced which was caused by insufficient entropy (instance or host) Note, this is for a public cloud scenario, should that impact any suggestions you have. Regards, Jordan
On 8/9/19 5:31 AM, Jordan Ansell wrote:
* What sources of entropy did you use in the hypervisor?
When we need a real, trust-able, source of entropy, we use a ChaosKey. https://altusmetrum.org/ChaosKey/ Otherwise, we just install haveged on the host. That's not ideal, but costs nothing, and better having entropy starvation. I hope this helps, Cheers, Thomas Goirand (zigo)
participants (2)
-
Jordan Ansell
-
Thomas Goirand