[Openstack] [Heat] Locked Outputs

Andrew Plunk andrew.plunk at RACKSPACE.COM
Wed Nov 6 22:48:33 UTC 2013


Hello All,

Imagine for a minute that you are displaying outputs from heat, but some of those outputs could have sensitive data (think passwords or private keys). It would be beneficial to allow outputs to be accessed once, and then go into a locked state. This could result in the following:

1). After an output is accessed for the first time, the output will become locked, and subsequent calls to the engine to return that output will return nothing.
example:
>show stack 

"outputs": {
  "password": "password"
 }

>show stack

"outputs": {
}


2). Another option is after an output is accessed for the first time, the output will become locked, and subsequent calls to the engine will return the output with a flag saying that this output has been locked, allowing whatever is consuming that output to take the necessary action.
example:

>show stack

"outputs": {
  "password": {
    "value": "password",
    "locked": false
  }
}

>show stack

"outputs": {
  "password": {
    "value": "password",
    "locked": true
  }
}


The outputs section of the template for either case would could look like:
outputs:
  password:
    value: { get_attr: [ some_resource, some_value ] }
    description: The password
    view_once: True


Any feedback would be appreciated. Thanks!
-Andrew Plunk




More information about the Openstack mailing list