RPMs for OpenStack Ceilometer?

[Jan van Eldik]

Hi all,

We would like to start testing OS Ceilometer, and I wonder if there are 
already plans to provide RPMs for this component.

thanks, cheers, Jan

[Eoghan Glynn]

> We would like to start testing OS Ceilometer, and I wonder if there
> are already plans to provide RPMs for this component.

Hi Jan,

The first ceilometer release is imminent (i.e. in the next couple days,
timed to coincide with the openstack design summit).

Once the release is out the door, we should be in a position to sort
out the packaging aspects.

Cheers,
Eoghan

[Jan van Eldik]

Thanks Eoghan,

That's good news!

cheers, Jan

On 10/11/2012 09:33 PM, Eoghan Glynn wrote:
> > We would like to start testing OS Ceilometer, and I wonder if there
> > are already plans to provide RPMs for this component.
>
> Hi Jan,
>
> The first ceilometer release is imminent (i.e. in the next couple days,
> timed to coincide with the openstack design summit).
>
> Once the release is out the door, we should be in a position to sort
> out the packaging aspects.
>
> Cheers,
> Eoghan
> _______________________________________________
> cloud mailing list
> [e-mail]
> https://admin.fedoraproject.org/mailman/listinfo/cloud

[Kurt Seifried]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/11/2012 01:34 PM, Jan van Eldik wrote:
> Thanks Eoghan,
>
> That's good news!
>
> cheers, Jan
>
> On 10/11/2012 09:33 PM, Eoghan Glynn wrote:
> > > We would like to start testing OS Ceilometer, and I wonder if
> > > there are already plans to provide RPMs for this component.
> >
> > Hi Jan,
> >
> > The first ceilometer release is imminent (i.e. in the next couple
> > days, timed to coincide with the openstack design summit).
> >
> > Once the release is out the door, we should be in a position to
> > sort out the packaging aspects.
> >
> > Cheers, Eoghan

Has this code been security audited at all? It seems to me that the
billing portion of OpenStack will likely be a high priority target for
attackers (and naughty users/etc.).

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
>
> iQIcBAEBAgAGBQJQd6F9AAoJEBYNRVNeJnmTQsoQAIXroyXdnXZz9P+/m8TujNty
> 6McaaBbPRBGWLYf1xQCZFwB3HK6WNmHV1r32DdeITe+LO++s5qxEXlB1dY4gxfdx
> 7ACJbXQW0WlylGPdQh0i0owxDP55JhBJ0VN5JQ7mKHxplq4kHkuOVnVy4KcIiLXY
> rZGgz1+zSaMb/Knpz8yL+EDe4rNUpylUtW7UIaig/qPfPzutCQohQW+n9nAdF6rj
> n7ULjzfJSo2BuOa94W/nFx5Yl4yepkex1h/6KF1PPD3WCRs31q4ZgfPDyrMjj7i/
> HMhbcc9xdNQ0exkk0bX3gp3jK3QKZoSaBiqrN2idJmiJc5wG8uLfszmew+zK499m
> Fe2aj1c/WQpFgAMng7qlVY/glPBePP9a632wxvrUNzqcbcS7HTD0ytpfxFLWn4K6
> Hyezn8Oj8LZ/xiTAVNJyyrzgJqKq1RGMR7vW6rWjhX1lOXKCp1jIyoA7p8ty8P+e
> 0q+ykL3iEb8RXHbZxD/wK0RdSaHkgUfOAAarrgqOxoXXGqhoWwKlLInzpySy5Zqg
> ZdYWA24utjb84CGrObG7UWqn3az74oDNzooeAsd6rX9OFiFeAgSOR1lBntbMFoo2
> L3zved10TBFQh26JBRIxY08tAGbF0tDTJkY25D9V8g8lWFq2GRhbUaihFl8ysfs+
> K31ihKyDj55+L6Fnmu1G
> =YroX
> -----END PGP SIGNATURE-----

[Eoghan Glynn]

> Has this code been security audited at all? It seems to me that the
> billing portion of OpenStack will likely be a high priority target
> for attackers (and naughty users/etc.).

The security story for Ceilometer definitely needs to be hardened ...

- the usage-related notifications emitted by the openstack services
  (nova, glance, cinder ... etc.) are implicitly trusted, i.e. auth
  doesn't go beyond the user/password-style mechanisms implemented
  by the AMQP provider

- metering messages between ceilometer agents are signed using
  a secret stored in plain text in the config file

- the ceilometer API service is not integrated with keystone as yet
  so does not do token validation or role-based policy verification

The ceilometer team intends to make progress on the auth story in
the Grizzly timeframe.

Cheers,
Eoghan

[Eoghan Glynn]

> > Has this code been security audited at all? It seems to me that the
> > billing portion of OpenStack will likely be a high priority target
> > for attackers (and naughty users/etc.).
>
> The security story for Ceilometer definitely needs to be hardened ...
> the usage-related notifications emitted by the openstack services
> (nova, glance, cinder ... etc.) are implicitly trusted, i.e. auth
> doesn't go beyond the user/password-style mechanisms implemented
> by the AMQP provider

I should have qualified that statement with the obvious observation
that if the AMQP infrastructure is compromised in openstack, then
all sorts of badness will ensue, not limited to the metering side
(as the compute, volumes and networking fabric all rely heavily
on RPC over AMQP).

Cheers,
Eoghan
> metering messages between ceilometer agents are signed using
> a secret stored in plain text in the config file
>
> the ceilometer API service is not integrated with keystone as yet
> so does not do token validation or role-based policy verification
>
> The ceilometer team intends to make progress on the auth story in
> the Grizzly timeframe.
>
> Cheers,
> Eoghan
> _______________________________________________
> cloud mailing list
> [e-mail]
> https://admin.fedoraproject.org/mailman/listinfo/cloud

[Jan van Eldik]

Hi Eoghan,
> > We would like to start testing OS Ceilometer, and I wonder if there
> > are already plans to provide RPMs for this component.
>
> Hi Jan,
>
> The first ceilometer release is imminent (i.e. in the next couple days,
> timed to coincide with the openstack design summit).
>
> Once the release is out the door, we should be in a position to sort
> out the packaging aspects.

Has packaging work already started? We would be very happy to test :)

thanks, cheers, Jan
> Cheers,
> Eoghan
> _______________________________________________
> cloud mailing list
> [e-mail]
> https://admin.fedoraproject.org/mailman/listinfo/cloud

[Eoghan Glynn]

----- Original Message -----
> Hi Eoghan,
> > > We would like to start testing OS Ceilometer, and I wonder if
> > > there
> > > are already plans to provide RPMs for this component.
> >
> > Hi Jan,
> >
> > The first ceilometer release is imminent (i.e. in the next couple
> > days,
> > timed to coincide with the openstack design summit).
> >
> > Once the release is out the door, we should be in a position to
> > sort
> > out the packaging aspects.
>
> Has packaging work already started? We would be very happy to test :)
>        thanks, cheers, Jan
>
>
> > Cheers,
> > Eoghan
> > _______________________________________________
> > cloud mailing list
> > [e-mail]
> > https://admin.fedoraproject.org/mailman/listinfo/cloud
>
> cloud mailing list
> [e-mail]
> https://admin.fedoraproject.org/mailman/listinfo/cloud

[Eoghan Glynn]

Hi Jan,

This is effort has not started as yet, as there's a fair amount
of churn and instability on-going in ceilometer as we tie down
a better interaction model with nova (avoiding direct DB access
and calls to internal APIs).

Having just been incubated, ceilometer will shortly be joining
the openstack release train. We're planning to sit out the imminent
grizzly-1 milestone, but will be aligned for the subsequent
grizzly-2 milestone (slated for 2013-01-10).

Rather than packaging the initial ceilometer 0.1 release, it would
be more efficient to target our packaging efforts at the g-2
milestone, as there will be very significant differences between
the two versions.

Cheers,
Eoghan

----- Original Message -----
> Hi Eoghan,
> > > We would like to start testing OS Ceilometer, and I wonder if
> > > there
> > > are already plans to provide RPMs for this component.
> >
> > Hi Jan,
> >
> > The first ceilometer release is imminent (i.e. in the next couple
> > days,
> > timed to coincide with the openstack design summit).
> >
> > Once the release is out the door, we should be in a position to
> > sort
> > out the packaging aspects.
>
> Has packaging work already started? We would be very happy to test :)
>        thanks, cheers, Jan
>
>
> > Cheers,
> > Eoghan
> > _______________________________________________
> > cloud mailing list
> > [e-mail]
> > https://admin.fedoraproject.org/mailman/listinfo/cloud
>
> cloud mailing list
> [e-mail]
> https://admin.fedoraproject.org/mailman/listinfo/cloud

[Jan van Eldik]

Thanks for the update Eoghan, this sounds very reasonable to me.

cheers, Jan

On 11/14/2012 07:11 PM, Eoghan Glynn wrote:
> Hi Jan,
>
> This is effort has not started as yet, as there's a fair amount
> of churn and instability on-going in ceilometer as we tie down
> a better interaction model with nova (avoiding direct DB access
> and calls to internal APIs).
>
> Having just been incubated, ceilometer will shortly be joining
> the openstack release train. We're planning to sit out the imminent
> grizzly-1 milestone, but will be aligned for the subsequent
> grizzly-2 milestone (slated for 2013-01-10).
>
> Rather than packaging the initial ceilometer 0.1 release, it would
> be more efficient to target our packaging efforts at the g-2
> milestone, as there will be very significant differences between
> the two versions.
>
> Cheers,
> Eoghan
>
> ----- Original Message -----
> > Hi Eoghan,
> > > > We would like to start testing OS Ceilometer, and I wonder if
> > > > there
> > > > are already plans to provide RPMs for this component.
> > >
> > > Hi Jan,
> > >
> > > The first ceilometer release is imminent (i.e. in the next couple
> > > days,
> > > timed to coincide with the openstack design summit).
> > >
> > > Once the release is out the door, we should be in a position to
> > > sort
> > > out the packaging aspects.
> >
> > Has packaging work already started? We would be very happy to test :)
> >         thanks, cheers, Jan
> >
> >
> > > Cheers,
> > > Eoghan
> > > _______________________________________________
> > > cloud mailing list
> > > [e-mail]
> > > https://admin.fedoraproject.org/mailman/listinfo/cloud
> >
> > cloud mailing list
> > [e-mail]
> > https://admin.fedoraproject.org/mailman/listinfo/cloud
>
> cloud mailing list
> [e-mail]
> https://admin.fedoraproject.org/mailman/listinfo/cloud