Add default VIM key for multi-master Tacker
This proposal adds support for a default VIM secret key to share across Tacker nodes in a multi-master cluster. Implements: blueprint vim-key-for-multi-master Change-Id: I2aa6e0d349d7fe3931cf95e0375aafa362a47bd4 Signed-off-by: Hitomi Koba <hi-koba@kddi.com>
This commit is contained in:
Hitomi Koba
@@ -22,6 +22,7 @@ Specifications
|
||||
:glob:
|
||||
:maxdepth: 2
|
||||
|
||||
specs/2025.2/index
|
||||
specs/2025.1/index
|
||||
specs/2024.2/index
|
||||
specs/2024.1/index
|
||||
|
||||
9
specs/2025.2/index.rst
Normal file
9
specs/2025.2/index.rst
Normal file
@@ -0,0 +1,9 @@
|
||||
============================
|
||||
Tacker 2025.2 Specifications
|
||||
============================
|
||||
|
||||
.. toctree::
|
||||
:glob:
|
||||
:maxdepth: 1
|
||||
|
||||
*
|
||||
124
specs/2025.2/placeholder.rst
Normal file
124
specs/2025.2/placeholder.rst
Normal file
@@ -0,0 +1,124 @@
|
||||
..
|
||||
This work is licensed under a Creative Commons Attribution 3.0 Unported
|
||||
License.
|
||||
|
||||
http://creativecommons.org/licenses/by/3.0/legalcode
|
||||
|
||||
==================
|
||||
(Placeholder Spec)
|
||||
==================
|
||||
|
||||
This file is just a placeholder for the specs directory.
|
||||
It will be removed soon after some spec is merged.
|
||||
|
||||
The latest spec template is found at ``specs/template.rst``
|
||||
in the ``tacker-specs`` repository.
|
||||
|
||||
Problem description
|
||||
===================
|
||||
|
||||
Sphinx toctree complains if no file exists in a directory
|
||||
specified in toctree glob.
|
||||
|
||||
Use Cases
|
||||
---------
|
||||
|
||||
None
|
||||
|
||||
Proposed change
|
||||
===============
|
||||
|
||||
Add this file. Please remove later when the another spec is approved.
|
||||
|
||||
Alternatives
|
||||
------------
|
||||
|
||||
None
|
||||
|
||||
Data model impact
|
||||
-----------------
|
||||
|
||||
None
|
||||
|
||||
REST API impact
|
||||
---------------
|
||||
|
||||
None
|
||||
|
||||
Security impact
|
||||
---------------
|
||||
|
||||
None
|
||||
|
||||
Notifications impact
|
||||
--------------------
|
||||
|
||||
None
|
||||
|
||||
Other end user impact
|
||||
---------------------
|
||||
|
||||
None
|
||||
|
||||
Performance Impact
|
||||
------------------
|
||||
|
||||
None
|
||||
|
||||
Other deployer impact
|
||||
---------------------
|
||||
|
||||
None
|
||||
|
||||
Developer impact
|
||||
----------------
|
||||
|
||||
None
|
||||
|
||||
Upgrade impact
|
||||
--------------
|
||||
|
||||
None
|
||||
|
||||
|
||||
Implementation
|
||||
==============
|
||||
|
||||
Assignee(s)
|
||||
-----------
|
||||
|
||||
None
|
||||
|
||||
Work Items
|
||||
----------
|
||||
|
||||
None
|
||||
|
||||
|
||||
Dependencies
|
||||
============
|
||||
|
||||
None
|
||||
|
||||
|
||||
Testing
|
||||
=======
|
||||
|
||||
None
|
||||
|
||||
|
||||
Documentation Impact
|
||||
====================
|
||||
|
||||
None
|
||||
|
||||
References
|
||||
==========
|
||||
|
||||
None
|
||||
|
||||
|
||||
History
|
||||
=======
|
||||
|
||||
None
|
||||
168
specs/2025.2/vim-key-for-multi-master.rst
Normal file
168
specs/2025.2/vim-key-for-multi-master.rst
Normal file
@@ -0,0 +1,168 @@
|
||||
..
|
||||
This work is licensed under a Creative Commons Attribution 3.0 Unported
|
||||
License.
|
||||
|
||||
http://creativecommons.org/licenses/by/3.0/legalcode
|
||||
|
||||
================================================================
|
||||
Add support for a default VIM secret key for multi-master Tacker
|
||||
================================================================
|
||||
|
||||
https://blueprints.launchpad.net/tacker/+spec/vim-key-for-multi-master
|
||||
|
||||
This specification proposes to support a default secret key as a simple feature
|
||||
to share the VIM secret key within a multi-master Tacker cluster.
|
||||
|
||||
|
||||
Problem description
|
||||
===================
|
||||
|
||||
When Tacker is deployed as a multi-master cluster for load balancing, it fails
|
||||
to perform VIM operations such as deleting or updating resources created by
|
||||
another Tacker node.
|
||||
For example, if tacker-0 creates a resource, trying to delete it from tacker-1
|
||||
will fail.
|
||||
|
||||
This is because Tacker generates a new `fernet_key` for each VIM registration
|
||||
and does not have a way to share or sync keys between nodes.
|
||||
To avoid authentication failures, keys must be copied manually between nodes.
|
||||
|
||||
|
||||
Proposed change
|
||||
===============
|
||||
|
||||
Add an option to specify a common default VIM key across Tacker nodes.
|
||||
|
||||
To enable this, a new `default_secret_key` parameter will be added under
|
||||
`[vim_keys]` in `tacker.conf`.
|
||||
|
||||
Administrators will generate a default Fernet key file in advance
|
||||
(e.g., `default.key`), place it in the existing `openstack` directory
|
||||
(default: `/etc/tacker/vim/fernet_keys`) on each Tacker node, and specify
|
||||
the filename using the `default_secret_key` option.
|
||||
|
||||
Example of `tacker.conf`:
|
||||
|
||||
.. code-block:: ini
|
||||
|
||||
[vim_keys]
|
||||
default_secret_key = default.key
|
||||
|
||||
This setting allows the Tacker conductor to use the specified default key
|
||||
when registering a VIM. The value of `default_secret_key` is interpreted as
|
||||
a file located within the `openstack` directory. If the parameter is not set,
|
||||
the current behavior (auto-generating a key per VIM) remains unchanged.
|
||||
|
||||
To set up the default key on each Tacker node, administrators generate
|
||||
a Fernet key using any method.
|
||||
|
||||
For example:
|
||||
|
||||
.. code-block:: bash
|
||||
|
||||
python3 -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())' > /etc/tacker/vim/fernet_keys/default.key
|
||||
|
||||
As part of this improvement, we also plan to provide an official utility
|
||||
(e.g., a new `tacker-db-manage` option or a script under `tools/`) that
|
||||
performs this key generation. While administrators can still generate the key
|
||||
manually as shown above, the recommended approach will be to use the provided
|
||||
tool to ensure consistency.
|
||||
|
||||
The same key file ("default.key") is placed on each Tacker node.
|
||||
This approach is simpler than configuring continuous key synchronization
|
||||
(e.g., using rsync or NFS), and is suitable for environments where the key
|
||||
does not need to change frequently, such as closed or static deployments.
|
||||
|
||||
Alternatives
|
||||
------------
|
||||
|
||||
Set up an additional method to synchronize VIM keys between Tacker nodes
|
||||
(e.g., using rsync or NFS).
|
||||
|
||||
Data model impact
|
||||
-----------------
|
||||
|
||||
None
|
||||
|
||||
REST API impact
|
||||
---------------
|
||||
|
||||
None
|
||||
|
||||
Security impact
|
||||
---------------
|
||||
|
||||
This feature has a minor security impact because the shared secret key must be
|
||||
securely generated, stored, and distributed between Tacker nodes.
|
||||
However, this is optional and generally safe if used in a closed network.
|
||||
|
||||
Notifications impact
|
||||
--------------------
|
||||
|
||||
None
|
||||
|
||||
Other end user impact
|
||||
---------------------
|
||||
|
||||
None
|
||||
|
||||
Performance Impact
|
||||
------------------
|
||||
|
||||
None
|
||||
|
||||
Other deployer impact
|
||||
---------------------
|
||||
|
||||
None
|
||||
|
||||
Developer impact
|
||||
----------------
|
||||
|
||||
None
|
||||
|
||||
Upgrade impact
|
||||
--------------
|
||||
|
||||
None
|
||||
|
||||
Implementation
|
||||
==============
|
||||
|
||||
Assignee(s)
|
||||
-----------
|
||||
|
||||
Primary assignee:
|
||||
Hitomi Koba <hi-koba@kddi.com>
|
||||
|
||||
Work Items
|
||||
----------
|
||||
* Update Docs (`Documentation Impact`_).
|
||||
|
||||
* Update OpenStack Driver (`tacker/nfvo/drivers/vim/openstack_driver.py`) to
|
||||
check the `default_secret_key` config value and branch logic accordingly.
|
||||
|
||||
* Modify other related parts as needed.
|
||||
|
||||
Dependencies
|
||||
============
|
||||
|
||||
None
|
||||
|
||||
Testing
|
||||
=======
|
||||
|
||||
Add unit tests.
|
||||
|
||||
Documentation Impact
|
||||
====================
|
||||
|
||||
* Configuration Options [#conf_options]_
|
||||
|
||||
* Manual Installation [#manual_instrallation]_
|
||||
|
||||
References
|
||||
==========
|
||||
|
||||
.. [#conf_options] https://docs.openstack.org/tacker/latest/configuration/config.html#vim-keys
|
||||
.. [#manual_instrallation] https://docs.openstack.org/tacker/latest/install/manual_installation.html
|
||||
Reference in New Issue
Block a user