Difference between revisions of "X509-proposal"
| Line 17: | Line 17: | ||
== Manager == | == Manager == | ||
| − | Create a nova-x509 bin that is a ''nova-manager''. A manager in nova is a process that: has flags, has an RPC and DB connection. | + | Create a nova-x509 bin that is a ''nova-manager''. A manager in nova is a process that: has flags, has an RPC and DB connection. (example managers are nova-scheduler) |
| − | The | + | == OS API Extension == |
| + | |||
| + | The following are users of the extension: | ||
| + | |||
| + | * the dashboard - for getting certs for users (building a novarc / nova.zip) | ||
| + | ** CRUD around certs for a user (scoped by a tenant) | ||
| + | * cloudpipe - ? | ||
Revision as of 22:17, 17 January 2012
X509 Certs
Nova has an x509 cert store that it uses for the ec2 bundling image process and the cloudpipe vpn system. Currently the code runs inside the API server - which leads to issues if you want to want to run the api server on multiple boxes.
STATUS: DRAFT
Overview:
- move x509 into a nova-manager, run from a host that manages the CA directory
- openstack (admin-only?) extension for management - there is some (deprecated) usage in the ec2/admin.py
- use rpc to communicate between API and x509 manager
- api is a wrapper around most of the nova/crypto.py interface
[ OS API ] <=> [ x509-manager ] <=> [ crypto logic ]
Manager
Create a nova-x509 bin that is a nova-manager. A manager in nova is a process that: has flags, has an RPC and DB connection. (example managers are nova-scheduler)
OS API Extension
The following are users of the extension:
- the dashboard - for getting certs for users (building a novarc / nova.zip)
- CRUD around certs for a user (scoped by a tenant)
- cloudpipe - ?
