2:23 p.m.
Hi all,
We would like to start testing OS Ceilometer, and I wonder if there are
already plans to provide RPMs for this component.
thanks, cheers, Jan
2:33 p.m.
We would like to start testing OS Ceilometer, and I wonder if there
are already plans to provide RPMs for this component.
Hi Jan,
The first ceilometer release is imminent (i.e. in the next couple days,
timed to coincide with the openstack design summit).
Once the release is out the door, we should be in a position to sort
out the packaging aspects.
Cheers,
Eoghan
2:34 p.m.
Thanks Eoghan,
That's good news!
cheers, Jan
On 10/11/2012 09:33 PM, Eoghan Glynn wrote:
> We would like to start testing OS Ceilometer, and I wonder if there
> are already plans to provide RPMs for this component.
Hi Jan,
The first ceilometer release is imminent (i.e. in the next couple days,
timed to coincide with the openstack design summit).
Once the release is out the door, we should be in a position to sort
out the packaging aspects.
Cheers,
Eoghan
_______________________________________________
cloud mailing list
cloud(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/cloud
11:50 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/11/2012 01:34 PM, Jan van Eldik wrote:
Thanks Eoghan,
That's good news!
cheers, Jan
On 10/11/2012 09:33 PM, Eoghan Glynn wrote:
>
>
>> We would like to start testing OS Ceilometer, and I wonder if
>> there are already plans to provide RPMs for this component.
>
> Hi Jan,
>
> The first ceilometer release is imminent (i.e. in the next couple
> days, timed to coincide with the openstack design summit).
>
> Once the release is out the door, we should be in a position to
> sort out the packaging aspects.
>
> Cheers, Eoghan
Has this code been security audited at all? It seems to me that the
billing portion of OpenStack will likely be a high priority target for
attackers (and naughty users/etc.).
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iQIcBAEBAgAGBQJQd6F9AAoJEBYNRVNeJnmTQsoQAIXroyXdnXZz9P+/m8TujNty
6McaaBbPRBGWLYf1xQCZFwB3HK6WNmHV1r32DdeITe+LO++s5qxEXlB1dY4gxfdx
7ACJbXQW0WlylGPdQh0i0owxDP55JhBJ0VN5JQ7mKHxplq4kHkuOVnVy4KcIiLXY
rZGgz1+zSaMb/Knpz8yL+EDe4rNUpylUtW7UIaig/qPfPzutCQohQW+n9nAdF6rj
n7ULjzfJSo2BuOa94W/nFx5Yl4yepkex1h/6KF1PPD3WCRs31q4ZgfPDyrMjj7i/
HMhbcc9xdNQ0exkk0bX3gp3jK3QKZoSaBiqrN2idJmiJc5wG8uLfszmew+zK499m
Fe2aj1c/WQpFgAMng7qlVY/glPBePP9a632wxvrUNzqcbcS7HTD0ytpfxFLWn4K6
Hyezn8Oj8LZ/xiTAVNJyyrzgJqKq1RGMR7vW6rWjhX1lOXKCp1jIyoA7p8ty8P+e
0q+ykL3iEb8RXHbZxD/wK0RdSaHkgUfOAAarrgqOxoXXGqhoWwKlLInzpySy5Zqg
ZdYWA24utjb84CGrObG7UWqn3az74oDNzooeAsd6rX9OFiFeAgSOR1lBntbMFoo2
L3zved10TBFQh26JBRIxY08tAGbF0tDTJkY25D9V8g8lWFq2GRhbUaihFl8ysfs+
K31ihKyDj55+L6Fnmu1G
=YroX
-----END PGP SIGNATURE-----
2 a.m.
Has this code been security audited at all? It seems to me that the
billing portion of OpenStack will likely be a high priority target
for attackers (and naughty users/etc.).
The security story for Ceilometer definitely needs to be hardened ...
- the usage-related notifications emitted by the openstack services
(nova, glance, cinder ... etc.) are implicitly trusted, i.e. auth
doesn't go beyond the user/password-style mechanisms implemented
by the AMQP provider
- metering messages between ceilometer agents are signed using
a secret stored in plain text in the config file
- the ceilometer API service is not integrated with keystone as yet
so does not do token validation or role-based policy verification
The ceilometer team intends to make progress on the auth story in
the Grizzly timeframe.
Cheers,
Eoghan
2:12 a.m.
> Has this code been security audited at all? It seems to me that
the
> billing portion of OpenStack will likely be a high priority target
> for attackers (and naughty users/etc.).
The security story for Ceilometer definitely needs to be hardened ...
- the usage-related notifications emitted by the openstack services
(nova, glance, cinder ... etc.) are implicitly trusted, i.e. auth
doesn't go beyond the user/password-style mechanisms implemented
by the AMQP provider
I should have qualified that statement with the obvious observation
that if the AMQP infrastructure is compromised in openstack, then
all sorts of badness will ensue, not limited to the metering side
(as the compute, volumes and networking fabric all rely heavily
on RPC over AMQP).
Cheers,
Eoghan
- metering messages between ceilometer agents are signed using
a secret stored in plain text in the config file
- the ceilometer API service is not integrated with keystone as yet
so does not do token validation or role-based policy verification
The ceilometer team intends to make progress on the auth story in
the Grizzly timeframe.
Cheers,
Eoghan
_______________________________________________
cloud mailing list
cloud(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/cloud
8:07 a.m.
Hi Eoghan,
> We would like to start testing OS Ceilometer, and I wonder if
there
> are already plans to provide RPMs for this component.
Hi Jan,
The first ceilometer release is imminent (i.e. in the next couple days,
timed to coincide with the openstack design summit).
Once the release is out the door, we should be in a position to sort
out the packaging aspects.
Has packaging work already started? We would be very happy to test :)
thanks, cheers, Jan
Cheers,
Eoghan
_______________________________________________
cloud mailing list
cloud(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/cloud
12:10 p.m.
----- Original Message -----
Hi Eoghan,
>> We would like to start testing OS Ceilometer, and I wonder if
>> there
>> are already plans to provide RPMs for this component.
>
> Hi Jan,
>
> The first ceilometer release is imminent (i.e. in the next couple
> days,
> timed to coincide with the openstack design summit).
>
> Once the release is out the door, we should be in a position to
> sort
> out the packaging aspects.
Has packaging work already started? We would be very happy to test :)
thanks, cheers, Jan
>
> Cheers,
> Eoghan
> _______________________________________________
> cloud mailing list
> cloud(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/cloud
_______________________________________________
cloud mailing list
cloud(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/cloud
12:11 p.m.
Hi Jan,
This is effort has not started as yet, as there's a fair amount
of churn and instability on-going in ceilometer as we tie down
a better interaction model with nova (avoiding direct DB access
and calls to internal APIs).
Having just been incubated, ceilometer will shortly be joining
the openstack release train. We're planning to sit out the imminent
grizzly-1 milestone, but will be aligned for the subsequent
grizzly-2 milestone (slated for 2013-01-10).
Rather than packaging the initial ceilometer 0.1 release, it would
be more efficient to target our packaging efforts at the g-2
milestone, as there will be very significant differences between
the two versions.
Cheers,
Eoghan
----- Original Message -----
Hi Eoghan,
>> We would like to start testing OS Ceilometer, and I wonder if
>> there
>> are already plans to provide RPMs for this component.
>
> Hi Jan,
>
> The first ceilometer release is imminent (i.e. in the next couple
> days,
> timed to coincide with the openstack design summit).
>
> Once the release is out the door, we should be in a position to
> sort
> out the packaging aspects.
Has packaging work already started? We would be very happy to test :)
thanks, cheers, Jan
>
> Cheers,
> Eoghan
> _______________________________________________
> cloud mailing list
> cloud(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/cloud
_______________________________________________
cloud mailing list
cloud(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/cloud
1:13 p.m.
Thanks for the update Eoghan, this sounds very reasonable to me.
cheers, Jan
On 11/14/2012 07:11 PM, Eoghan Glynn wrote:
Hi Jan,
This is effort has not started as yet, as there's a fair amount
of churn and instability on-going in ceilometer as we tie down
a better interaction model with nova (avoiding direct DB access
and calls to internal APIs).
Having just been incubated, ceilometer will shortly be joining
the openstack release train. We're planning to sit out the imminent
grizzly-1 milestone, but will be aligned for the subsequent
grizzly-2 milestone (slated for 2013-01-10).
Rather than packaging the initial ceilometer 0.1 release, it would
be more efficient to target our packaging efforts at the g-2
milestone, as there will be very significant differences between
the two versions.
Cheers,
Eoghan
----- Original Message -----
> Hi Eoghan,
>
>>> We would like to start testing OS Ceilometer, and I wonder if
>>> there
>>> are already plans to provide RPMs for this component.
>>
>> Hi Jan,
>>
>> The first ceilometer release is imminent (i.e. in the next couple
>> days,
>> timed to coincide with the openstack design summit).
>>
>> Once the release is out the door, we should be in a position to
>> sort
>> out the packaging aspects.
>
> Has packaging work already started? We would be very happy to test :)
>
> thanks, cheers, Jan
>
>
>>
>> Cheers,
>> Eoghan
>> _______________________________________________
>> cloud mailing list
>> cloud(a)lists.fedoraproject.org
>> https://admin.fedoraproject.org/mailman/listinfo/cloud
>
> _______________________________________________
> cloud mailing list
> cloud(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/cloud
>
_______________________________________________
cloud mailing list
cloud(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/cloud
4179
days inactive
4213
days old
9 comments
3 participants
participants (3)
-
Eoghan Glynn -
Jan van Eldik -
Kurt Seifried