X509-proposal
Revision as of 22:14, 17 January 2012 by Anotherjesse (talk)
X509 Certs
Nova has an x509 cert store that it uses for the ec2 bundling image process and the cloudpipe vpn system. Currently the code runs inside the API server - which leads to issues if you want to want to run the api server on multiple boxes.
STATUS: DRAFT
Overview:
- move x509 into a nova-manager, run from a host that manages the CA directory
- openstack (admin-only?) extension for management - there is some (deprecated) usage in the ec2/admin.py
- use rpc to communicate between API and x509 manager
- api is a wrapper around most of the nova/crypto.py interface
[ OS API ] <=> [ x509-manager ] <=> [ crypto logic ]
Manager
Create a nova-x509 bin that is a nova-manager. A manager in nova is a process that: has flags, has an RPC and DB connection.
The manager
