cloud state requirements

Michal Fojtik mfojtik at redhat.com
Mon May 28 13:00:16 UTC 2012


On 05/28/12, Jan Provaznik wrote:
> >>TODO: how to handle credentials? will the stateful app keep credentails
> >>permanently for each instance being checked?
> >
> >As much as this worries me from a security standpoint, I don't see
> >another way around this - cloud API's generally don't allow any
> >delegation of auth.
> >
> >There's a couple more TODO's connected to credentials:
> >
> >TODO: how are credentials changes handled (user revokes API Key and
> >generates a new one) ? [not for the first cut]
> >
> 
> We might allow update action for the Instance resource, this can then be
> easily called from Conductor.

Or we can create a SHA1 from credentials and use it to identify the hooks
in instances. Then two clients will not be able to see their hooks.

> >TODO: when are stored credentials purged ? We want to make sure we get
> >rid of them as quickly as possible.
> >
> 
> I would say that credentials are deleted together with the instance with
> which they are associated.

Also we need to purge them when they become invalid. Mean when we are not
longer able to authenticate to backend cloud.

> 
> Jan

-- 
Michal Fojtik
Sr. Software Engineer, Deltacloud API (http://deltacloud.org)



More information about the aeolus-devel mailing list