From d2d4b53d47df3b1a250c21404a8ec140873d4ce5 Mon Sep 17 00:00:00 2001 From: Mark Goddard Date: Fri, 4 Mar 2022 17:57:24 +0000 Subject: libvirt: support SASL authentication In Kolla Ansible OpenStack deployments, by default, libvirt is configured to allow read-write access via an unauthenticated, unencrypted TCP connection, using the internal API network. This is to facilitate migration between hosts. By default, Kolla Ansible does not use encryption for services on the internal network (and did not support it until Ussuri). However, most other services on the internal network are at least authenticated (usually via passwords), ensuring that they cannot be used by anyone with access to the network, unless they have credentials. The main issue here is the lack of authentication. Any client with access to the internal network is able to connect to the libvirt TCP port and make arbitrary changes to the hypervisor. This could include starting a VM, modifying an existing VM, etc. Given the flexibility of the domain options, it could be seen as equivalent to having root access to the hypervisor. Kolla Ansible supports libvirt TLS [1] since the Train release, using client and server certificates for mutual authentication and encryption. However, this feature is not enabled by default, and requires certificates to be generated for each compute host. This change adds support for libvirt SASL authentication, and enables it by default. This provides base level of security. Deployments requiring further security should use libvirt TLS. [1] https://docs.openstack.org/kolla-ansible/latest/reference/compute/libvirt-guide.html#libvirt-tls Depends-On: https://review.opendev.org/c/openstack/kolla/+/833021 Closes-Bug: #1964013 Change-Id: Ia91ceeb609e4cdb144433122b443028c0278b71e --- etc/kolla/passwords.yml | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'etc/kolla/passwords.yml') diff --git a/etc/kolla/passwords.yml b/etc/kolla/passwords.yml index b343496b9..33667cd8d 100644 --- a/etc/kolla/passwords.yml +++ b/etc/kolla/passwords.yml @@ -253,3 +253,8 @@ keystone_federation_openid_crypto_password: # Ceph RadosGW options #################### ceph_rgw_keystone_password: + +################## +# libvirt options +################## +libvirt_sasl_password: -- cgit v1.2.3