[openstack-dev] Unified Guest Agent proposal

Clint Byrum clint at fewbar.com
Tue Dec 10 21:02:41 UTC 2013


Excerpts from Dmitry Mescheryakov's message of 2013-12-10 12:37:37 -0800:
> >> What is the exact scenario you're trying to avoid?
> 
> It is DDoS attack on either transport (AMQP / ZeroMQ provider) or server
> (Salt / Our own self-written server). Looking at the design, it doesn't
> look like the attack could be somehow contained within a tenant it is
> coming from.
> 

We can push a tenant-specific route for the metadata server, and a tenant
specific endpoint for in-agent things. Still simpler than hypervisor-aware
guests. I haven't seen anybody ask for this yet, though I'm sure if they
run into these problems it will be the next logical step.

> In the current OpenStack design I see only one similarly vulnerable
> component - metadata server. Keeping that in mind, maybe I just
> overestimate the threat?
> 

Anything you expose to the users is "vulnerable". By using the localized
hypervisor scheme you're now making the compute node itself vulnerable.
Only now you're asking that an already complicated thing (nova-compute)
add another job, rate limiting.



More information about the OpenStack-dev mailing list