diff options
author | Amrith Kumar <amrith@amrith.org> | 2016-12-09 10:09:46 -0500 |
---|---|---|
committer | Amrith Kumar <amrith@amrith.org> | 2017-01-11 07:56:35 -0500 |
commit | a7115e22f7fbf7705dfa1f62295aaadc2eb3e115 (patch) | |
tree | 786c4c2b4dbadc64626c689bd0d1600872ba0bd4 /api-ref | |
parent | 46f07e5a2fc41a0b2cf0d803f8f17a7ab43e37a6 (diff) | |
download | trove-a7115e22f7fbf7705dfa1f62295aaadc2eb3e115.tar.gz |
secure oslo_messaging.rpc
This is an interim commit of the changes for secure
oslo-messaging.rpc. In this commit we introduce the code for
serializers that will encrypt all traffic being sent on
oslo_messaging.rpc.
Each guest communicates with the control plane with traffic encrypted
using a per-instance key. This includes both traffic from the
taskmanager to the guest as well as the guest and the conductor.
Per-instance keys are stored in the infrastructure database. These
keys are further encrypted in the database.
Tests that got annoyed have been placated.
Upgrade related changes have been proposed. If an instance has no key,
no encryption is performed. If the guest gets no key, it won't
encrypt, just pass through. When an instance is upgraded, keys are
added.
The output of the trove show command (and the show API) have been
augmented to show which instances are using secure RPC communication
** if the requestor is an administrator **.
A simple caching mechanism for encryption keys has been proposed; this
will avoid the frequent database access to get the encryption
keys. For Ocata, to handle the upgrade case, None as an encryption_key
is a valid one, and is therefore not cached. This is why we can't use
something like lrucache.
A brief writeup has been included in dev docs
(dev/secure_oslo_messaging.rst) which shows how the feature can be
used and would help the documentation team write up the documentation
for this capability.
Change-Id: Iad03f190c99039fd34cbfb0e6aade23de8654b28
DocImpact: see dev/secure_oslo_messaging.rst
Blueprint: secure-oslo-messaging-messages
Related: If0146f08b3c5ad49a277963fcc685f5192d92edb
Related: I04cb76793cbb8b7e404841e9bb864fda93d06504
Diffstat (limited to 'api-ref')
4 files changed, 6 insertions, 2 deletions
diff --git a/api-ref/source/samples/db-mgmt-get-instance-details-response-json-http.txt b/api-ref/source/samples/db-mgmt-get-instance-details-response-json-http.txt index feb89a88..6580c3b8 100644 --- a/api-ref/source/samples/db-mgmt-get-instance-details-response-json-http.txt +++ b/api-ref/source/samples/db-mgmt-get-instance-details-response-json-http.txt @@ -1,5 +1,5 @@ HTTP/1.1 200 OK Content-Type: application/json -Content-Length: 1676 +Content-Length: 1709 Date: Mon, 18 Mar 2013 19:09:17 GMT diff --git a/api-ref/source/samples/db-mgmt-get-instance-details-response.json b/api-ref/source/samples/db-mgmt-get-instance-details-response.json index 203159d6..ef8b7efc 100644 --- a/api-ref/source/samples/db-mgmt-get-instance-details-response.json +++ b/api-ref/source/samples/db-mgmt-get-instance-details-response.json @@ -7,6 +7,7 @@ }, "deleted": false, "deleted_at": null, + "encrypted_rpc_messaging": true, "flavor": { "id": "3", "links": [ @@ -80,3 +81,4 @@ "volume_id": "VOL_44b277eb-39be-4921-be31-3d61b43651d7" } } + diff --git a/api-ref/source/samples/db-mgmt-instance-index-response-json-http.txt b/api-ref/source/samples/db-mgmt-instance-index-response-json-http.txt index 875f0f20..3994d592 100644 --- a/api-ref/source/samples/db-mgmt-instance-index-response-json-http.txt +++ b/api-ref/source/samples/db-mgmt-instance-index-response-json-http.txt @@ -1,5 +1,5 @@ HTTP/1.1 200 OK Content-Type: application/json -Content-Length: 1225 +Content-Length: 1258 Date: Mon, 18 Mar 2013 19:09:17 GMT diff --git a/api-ref/source/samples/db-mgmt-instance-index-response.json b/api-ref/source/samples/db-mgmt-instance-index-response.json index 5736bb17..6b26254a 100644 --- a/api-ref/source/samples/db-mgmt-instance-index-response.json +++ b/api-ref/source/samples/db-mgmt-instance-index-response.json @@ -8,6 +8,7 @@ }, "deleted": false, "deleted_at": null, + "encrypted_rpc_messaging": true, "flavor": { "id": "3", "links": [ @@ -58,3 +59,4 @@ } ] } + |