Open Stack

Scott Moser <smoser at ubuntu.com> wrote on 05/13/2013 02:33:01 PM:

>
> You seem to assume there that ipmi or other power control is on the same
> network as the pxe boot or other network that the user needs to use.
> I dont think that is necessarily true. That may be a silly/broken
> limitation of ipmi (ipmi does have shortcomings for untrusted occupant).

I'd say for private configurations, shared IPMI and NIC port is a
defensible strategy for cost-reduction.

In public configurations, I don't think IPMI and NIC should be shared in a
physical sense.

In terms of untrusted occupant, I think if baremetal had a platform to work
with that was durable (signed firmware in the critical path) and
scrub-friendly (to fix the components not signed and tamper resistant),
then in the general case a malicious tenant could knock a baremetal
resource out of commision to the point of requiring manual trust
restoration (i.e. making the system unable to be remotely controlled via
secure channel.  There are, however, configurations that distrust the OS
completely (e.g. our Flex servers won't let credentials be manipulated via
KCS).

>
>
>
> _______________________________________________
> OpenStack-dev mailing list
> OpenStack-dev at lists.openstack.org
> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20130513/4e0b7ef5/attachment.html>