openstack-ansible

Allow providing ceph with keys instead of pulling them out of mon nodes

Bug #1606977 reported by Michał Jastrzębski
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
openstack-ansible
Confirmed
Wishlist
Qin Wang

Bug Description

Currently OSA requires access to ceph-mon node to pull out keys. This might be security problem if corporate policy dictates that ceph nodes is off limits. OSA should have ability to provide all the access details as part of configuration instead of forcing pulling it's on it's own.

https://github.com/openstack/openstack-ansible/blob/master/playbooks/roles/ceph_client/tasks/ceph_auth.yml#L21-L40 <- in essence, this task should be optional.

Michał Jastrzębski (inc007)
Changed in openstack-ansible:
assignee: nobody → Michał Jastrzębski (inc007)
Revision history for this message
Jean-Philippe Evrard (jean-philippe-evrard) wrote :

Hello,

Thanks for your bug submission.
For your information, you can provide your own ceph configuration by filling the ceph_conf_file variable.

However I'm not really sure about what you mention as off-limits.

The ceph-client role is made in such way that nodes (compute nodes for example) will connect on the ceph cluster to fetch what's needed for its good behavior: it's not the deploy node that will fetch these secrets.

According to my understanding, no security is breached or off-limits: the compute nodes HAVE TO have access on the mons anyway -- at least to have a well functioning system later.

Could you further explain?

Thank you in advance.

Jean-Philippe Evrard (jean-philippe-evrard)
Changed in openstack-ansible:
importance: Undecided → Wishlist
status: New → Confirmed
Revision history for this message
Jean-Philippe Evrard (jean-philippe-evrard) wrote :

Hello,

We discussed this bug during our bug triage process - I understand better now that sshing into the mon host could be what you consider as off-limits.

We agreed that it could be indeed wise to feed the process with keys in an offline manner, with variables for example.

We move this bug to confirmed and established it as a wishlist item.

Qin Wang (qwang)
Changed in openstack-ansible:
assignee: Michał Jastrzębski (inc007) → Qin Wang (qwang)
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.