Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use unrestricted app cred for capi mgmt node and 2ndary restricted app creds for capo and for CSI and OCCM #109

Closed
garloff opened this issue Jan 6, 2022 · 4 comments
Closed

Use unrestricted app cred for capi mgmt node and 2ndary restricted app creds for capo and for CSI and OCCM #109

garloff opened this issue Jan 6, 2022 · 4 comments
Labels
Container Issues or pull requests relevant for Team 2: Container Infra and Tooling enhancement New feature or request Sprint Izmir Sprint Izmir (2023, cwk 32+33)

Comments

@garloff
Copy link
Member

garloff commented Jan 6, 2022 •
edited
Loading

We should have capability to create further app creds for clusters on the capi mgmt node.
This is a first step into managing clusters across clouds from the same mgmt node.

We should then create two (!) restricted app creds per cluster:

  • One is for capo: This one can not be accessed / abused from within the workload cluster.
  • One if for CSI and OCCM, allowing create OpenStack resources (loadbalancers, volumes, ...) from within the workload cluster

The latter is subject to abuse if hostile users within the cluster want to do evil things. So be prepared to independently revoke these app creds.
@garloff garloff changed the title Use unrestricted app cred for capo and 2ndary restricted app cred for CSI and OCCM Use unrestricted app cred for capi mgmt node and 2ndary restricted app creds for capo and for CSI and OCCM Jan 6, 2022
@garloff
Copy link
Member Author

garloff commented Jan 7, 2022

This should also prepare for having multiple clouds configured in ~/.config/openstack/clouds.yaml and secrets.yaml and avoid assuming particular formatting of it. (It could as well have std user/password combo in there.)

This also nicely decouples the need for OCCM clouds.yaml to have project_id (despite using appcreds, where std openstackclient does neither need nor tolerate project_id).

@garloff garloff mentioned this issue Jan 26, 2022
Closed
@garloff garloff mentioned this issue Mar 8, 2022
Closed
@garloff garloff mentioned this issue Mar 17, 2022
Merged
garloff added a commit that referenced this issue Mar 17, 2022
@garloff
Make mgmt node appcred unrestricted.
c11c49c 
This will allow subordinate appcreds per cluster (#109),
which are however not yet implemented.
As this affects the mgmt node creation, we want to have it
done already, as the incremental changes then can be done
without recreation of the mgmt node.

Signed-off-by: Kurt Garloff <kurt@garloff.de>
@garloff garloff mentioned this issue Mar 17, 2022
Merged
garloff added a commit that referenced this issue Mar 17, 2022
@garloff
Make mgmt node appcred unrestricted. (#177)
48507bd 
This will allow subordinate appcreds per cluster (#109),
which are however not yet implemented.
As this affects the mgmt node creation, we want to have it
done already, as the incremental changes then can be done
without recreation of the mgmt node.

Signed-off-by: Kurt Garloff <kurt@garloff.de>
@garloff
Copy link
Member Author

garloff commented Mar 17, 2022

Work on deployment node done (we generate an unrestricted application credential, #177),
but not yet the creation of per-cluster app-creds.

@garloff garloff added the enhancement New feature or request label Mar 17, 2022
garloff added a commit that referenced this issue May 13, 2022
@garloff
Start moving app cred creation to cluster creation.
59669b4 
We want to be able to have an app cred per cluster (instead of
a global per mgmt host one). This is implementing #109.

Signed-off-by: Kurt Garloff <kurt@garloff.de>
@garloff garloff mentioned this issue Jul 3, 2022
Merged
@garloff
Copy link
Member Author

garloff commented Jul 3, 2022

This is fully addressed in PR #226.
Once the PR is merged, we can close this one.

garloff added a commit that referenced this issue Jul 11, 2022
@garloff
Feat/per cluster appcred (#226)
4e3f620 
* Start moving app cred creation to cluster creation.

We want to be able to have an app cred per cluster (instead of
a global per mgmt host one). This is implementing #109.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* Tool to generate/manipulate clouds.yaml.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* Split out app cred creation and clouds.yaml creation.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* Bug fixes.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* Clean up appcred again.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* Some fixed for app cred cleanup.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* Use print-cloud to remove clouds. Allow secret oupput.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* Fix OLD_OPENSTACK_CLOUD storage, use it for appcred mgmt.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* Fixes.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* Stop outputting b64 encoded secrets.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* project_id needs to be in auth section.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* Only clean up app-cred ... when we use them.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* Be careful backing up clouds.yaml.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* Be informative about app cred.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* Only create OLD_OPENSTACK_CLOUD backup if needed.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* Leave existing clusters alone. Robust clouds.yaml config generation.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* Output note on new OS_CLOUD.

Signed-off-by: Kurt Garloff <kurt@garloff.de>

* Clean per-cluster appcred in cleanup.

Signed-off-by: Kurt Garloff <kurt@garloff.de>
@tibeer tibeer mentioned this issue Mar 29, 2023
Closed
@chess-knight
Copy link
Member

@garloff can you close this one, please?

@chess-knight chess-knight added the Container Issues or pull requests relevant for Team 2: Container Infra and Tooling label Aug 16, 2023
@garloff garloff closed this as completed Aug 16, 2023
@jschoone jschoone added the Sprint Izmir Sprint Izmir (2023, cwk 32+33) label Feb 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Container Issues or pull requests relevant for Team 2: Container Infra and Tooling enhancement New feature or request Sprint Izmir Sprint Izmir (2023, cwk 32+33)
Projects
Sovereign Cloud Stack
Archived in project
Milestone
No milestone
Development

No branches or pull requests
3 participants
@jschoone @garloff @chess-knight