Re: [Openstack-operators] [nova] Metadata service over virtio-vsock

2017-02-21 Thread Daniel P. Berrange
On Tue, Feb 21, 2017 at 10:08:54AM -0500, David Medberry wrote: > Doesn't the virtio solution assume/require a libvirt or more exactly a > QEMU/KVM based hypervisor? > > What about the N-1 other hypervisors? vsock is an equivalent of UNIX domain sockets, for host<->guest communication that was in

Re: [Openstack-operators] [nova] Metadata service over virtio-vsock

2017-02-21 Thread David Medberry
Doesn't the virtio solution assume/require a libvirt or more exactly a QEMU/KVM based hypervisor? What about the N-1 other hypervisors? I think the idea of a "hot remove, hot add" of the configdrive has some merit (but remember it is not always ISO-9660 but could be VFAT as well to aid in some mi

Re: [Openstack-operators] [nova] Metadata service over virtio-vsock

2017-02-21 Thread Daniel P. Berrange
On Tue, Feb 21, 2017 at 01:09:43PM +, Jeremy Stanley wrote: > On 2017-02-21 06:24:20 -0500 (-0500), Clint Byrum wrote: > [...] > > Why not just make it a virtual USB drive that ejects and > > re-attaches on changes? > [...] > > Is there a graceful way to trigger that from the host so that the

Re: [Openstack-operators] [nova] Metadata service over virtio-vsock

2017-02-21 Thread Jeremy Stanley
On 2017-02-21 06:24:20 -0500 (-0500), Clint Byrum wrote: [...] > Why not just make it a virtual USB drive that ejects and > re-attaches on changes? [...] Is there a graceful way to trigger that from the host so that the guest knows to unmount it prior to ejection? Or is that not actually necessary

Re: [Openstack-operators] [nova] Metadata service over virtio-vsock

2017-02-21 Thread Clint Byrum
Excerpts from Daniel P. Berrange's message of 2017-02-21 10:40:02 +: > On Mon, Feb 20, 2017 at 02:36:15PM -0500, Clint Byrum wrote: > > What exactly is the security concern of the metadata service? Perhaps > > those concerns can be addressed directly? > > > > I ask because anything that requir

Re: [Openstack-operators] [nova] Metadata service over virtio-vsock

2017-02-21 Thread Daniel P. Berrange
On Mon, Feb 20, 2017 at 02:36:15PM -0500, Clint Byrum wrote: > What exactly is the security concern of the metadata service? Perhaps > those concerns can be addressed directly? > > I ask because anything that requires special software on the guest is > a non-starter IMO. virtio is a Linux thing, s

Re: [Openstack-operators] [nova] Metadata service over virtio-vsock

2017-02-21 Thread Daniel P. Berrange
On Mon, Feb 20, 2017 at 08:08:00PM +, Jeremy Stanley wrote: > On 2017-02-20 14:36:15 -0500 (-0500), Clint Byrum wrote: > > What exactly is the security concern of the metadata service? Perhaps > > those concerns can be addressed directly? > [...] > > A few I'm aware of: > > 1. It's something

Re: [Openstack-operators] [nova] Metadata service over virtio-vsock

2017-02-20 Thread Clint Byrum
Excerpts from Jeremy Stanley's message of 2017-02-20 20:08:00 +: > On 2017-02-20 14:36:15 -0500 (-0500), Clint Byrum wrote: > > What exactly is the security concern of the metadata service? Perhaps > > those concerns can be addressed directly? > [...] > > A few I'm aware of: > Thanks! > 1.

Re: [Openstack-operators] [nova] Metadata service over virtio-vsock

2017-02-20 Thread Jeremy Stanley
On 2017-02-20 14:36:15 -0500 (-0500), Clint Byrum wrote: > What exactly is the security concern of the metadata service? Perhaps > those concerns can be addressed directly? [...] A few I'm aware of: 1. It's something that runs in the control plane but needs to be reachable from untrusted server i

Re: [Openstack-operators] [nova] Metadata service over virtio-vsock

2017-02-20 Thread Clint Byrum
What exactly is the security concern of the metadata service? Perhaps those concerns can be addressed directly? I ask because anything that requires special software on the guest is a non-starter IMO. virtio is a Linux thing, so what does this do for users of Windows? FreeBSD? etc. Excerpts from

[Openstack-operators] [nova] Metadata service over virtio-vsock

2017-02-20 Thread Artom Lifshitz
We've been having a discussion [1] in openstack-dev about how to best expose dynamic metadata that changes over a server's lifetime to the server. The specific use case is device role tagging with hotplugged devices, where a network interface or volume is attached with a role tag, and the guest wou