4bf765758c
This patch works several files that were not in common use back into the documents they should live with. The intended end result of this activity is to make common as lean as possible so it can be more easily translated. Also: Don't include configdrive table in user-guide since it's not relevant for audience Change-Id: Iacd5c68c639e60e8c711cb18351543e477444299
164 lines
7.8 KiB
XML
164 lines
7.8 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
version="5.0"
|
|
xml:id="trusted-compute-pools">
|
|
<title>Trusted compute pools</title>
|
|
<para>Trusted compute pools enable administrators to designate a group of compute hosts as
|
|
trusted. These hosts use hardware-based security features, such as the Intel Trusted
|
|
Execution Technology (TXT), to provide an additional level of security. Combined with an
|
|
external stand-alone, web-based remote attestation server, cloud providers can ensure that
|
|
the compute node runs only software with verified measurements and can ensure a secure cloud
|
|
stack.</para>
|
|
<para>Using the trusted compute pools, cloud subscribers can request services to run on verified
|
|
compute nodes.</para>
|
|
<para>The remote attestation server performs node verification as
|
|
follows:</para>
|
|
<orderedlist>
|
|
<listitem>
|
|
<para>Compute nodes boot with Intel TXT technology
|
|
enabled.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>The compute node BIOS, hypervisor, and OS are
|
|
measured.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>Measured data is sent to the attestation server when challenged by the attestation
|
|
server.</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>The attestation server verifies those measurements against a good and known
|
|
database to determine node trustworthiness.</para>
|
|
</listitem>
|
|
</orderedlist>
|
|
<para>A description of how to set up an attestation service is
|
|
beyond the scope of this document. For an open source project
|
|
that you can use to implement an attestation service, see the
|
|
<link
|
|
xlink:href="https://github.com/OpenAttestation/OpenAttestation"
|
|
>Open Attestation</link> project.</para>
|
|
<mediaobject>
|
|
<imageobject role="fo">
|
|
<imagedata
|
|
fileref="../../common/figures/OpenStackTrustedComputePool1.png"
|
|
format="PNG" contentwidth="6in"/>
|
|
</imageobject>
|
|
<imageobject role="html">
|
|
<imagedata
|
|
fileref="../../common/figures/OpenStackTrustedComputePool1.png"
|
|
format="PNG" contentwidth="6in"/>
|
|
</imageobject>
|
|
</mediaobject>
|
|
<section xml:id="configure_trusted_compute_pools">
|
|
<title>Configure Compute to use trusted compute pools</title>
|
|
<procedure>
|
|
<step>
|
|
<para>Enable scheduling support for trusted compute pools by adding the following
|
|
lines in the <literal>DEFAULT</literal> section in the
|
|
<filename>/etc/nova/nova.conf</filename> file:</para>
|
|
<programlisting language="ini">[DEFAULT]
|
|
compute_scheduler_driver=nova.scheduler.filter_scheduler.FilterScheduler
|
|
scheduler_available_filters=nova.scheduler.filters.all_filters
|
|
scheduler_default_filters=AvailabilityZoneFilter,RamFilter,ComputeFilter,TrustedFilter</programlisting>
|
|
</step>
|
|
<step>
|
|
<para>Specify the connection information for your attestation service by adding the
|
|
following lines to the <literal>trusted_computing</literal> section in the
|
|
<filename>/etc/nova/nova.conf</filename> file:</para>
|
|
<programlisting language="ini">[trusted_computing]
|
|
server=10.1.71.206
|
|
port=8443
|
|
server_ca_file=/etc/nova/ssl.10.1.71.206.crt
|
|
# If using OAT v1.5, use this api_url:
|
|
api_url=/AttestationService/resources
|
|
# If using OAT pre-v1.5, use this api_url:
|
|
#api_url=/OpenAttestationWebServices/V1.0
|
|
auth_blob=i-am-openstack</programlisting>
|
|
<para>Where:</para>
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term>server</term>
|
|
<listitem>
|
|
<para>Host name or IP address of the host that runs the attestation
|
|
service.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term>port</term>
|
|
<listitem>
|
|
<para>HTTPS port for the attestation service.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term>server_ca_file</term>
|
|
<listitem>
|
|
<para>Certificate file used to verify the
|
|
attestation server's identity.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term>api_url</term>
|
|
<listitem>
|
|
<para>The attestation service's URL path.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
<varlistentry>
|
|
<term>auth_blob</term>
|
|
<listitem>
|
|
<para>An authentication blob, which is
|
|
required by the attestation
|
|
service.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
</variablelist>
|
|
</step>
|
|
<step>
|
|
<para>Restart the <systemitem class="service"
|
|
>nova-compute</systemitem> and <systemitem
|
|
class="service">nova-scheduler</systemitem>
|
|
services.</para>
|
|
</step>
|
|
</procedure>
|
|
<section xml:id="config_ref">
|
|
<title>Configuration reference</title>
|
|
<para>To customize the trusted compute pools, use the following configuration
|
|
option settings:
|
|
</para>
|
|
<xi:include href="../../common/tables/nova-trustedcomputing.xml"/>
|
|
</section>
|
|
</section>
|
|
<section xml:id="trusted_flavors">
|
|
<title>Specify trusted flavors</title>
|
|
<para>To designate hosts as trusted:</para>
|
|
<procedure>
|
|
<step>
|
|
<para>Configure one or more flavors as trusted by using the <command>nova
|
|
flavor-key set</command> command. For example, to set the
|
|
<literal>m1.tiny</literal> flavor as trusted:</para>
|
|
<screen><prompt>$</prompt> <userinput>nova flavor-key m1.tiny set trust:trusted_host trusted</userinput></screen>
|
|
</step>
|
|
<step><para>Request that your instance be run on a trusted host, by specifying a trusted flavor when
|
|
booting the instance. For example:</para>
|
|
<screen><prompt>$</prompt> <userinput>nova boot --flavor m1.tiny --key_name myKeypairName --image myImageID newInstanceName</userinput></screen>
|
|
<figure xml:id="concept_trusted_pool">
|
|
<title>Trusted compute pool</title>
|
|
<mediaobject>
|
|
<imageobject role="fo">
|
|
<imagedata
|
|
fileref="../../common/figures/OpenStackTrustedComputePool2.png"
|
|
format="PNG" contentwidth="6in"/>
|
|
</imageobject>
|
|
<imageobject role="html">
|
|
<imagedata
|
|
fileref="../../common/figures/OpenStackTrustedComputePool2.png"
|
|
format="PNG" contentwidth="6in"/>
|
|
</imageobject>
|
|
</mediaobject>
|
|
</figure>
|
|
</step>
|
|
</procedure>
|
|
</section>
|
|
</section>
|