DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
Page History
...
- The feature will be implemented and contained in a new plugin.
- It will provide the api for registering the attestation server with cloudstack.
- It will implement a listener for getting host connect notifications. It'll register with the agent manager to get the processConnect callbacks when agent connects to a host. On getting the callback it'll check with the attestation server (if configured) whether the given host is trusted or not. The callback gets called in the following scenarios
- When a new host is added to the infrastructure.
- When management server comes up and connects to the host.
- When the host reboots/boots up, cloudstack will issue a processDisconnect callback when it looses connection and a _processConnect callback on being able to connect again.
...
Migration and HA
Database modifications
A new table will be created in the db to hold the attestation server details. Open Issues 3.
Field name | Type | Allow nulls | Key | Default value |
|---|---|---|---|---|
id | bigint(20) unsigned | No | Primary | Null |
uuid | varchar(40) | Yes | None | Null |
username | varchar(255) | Yes | None | Null |
password | varchar(255) | Yes | None | Null |
Web Services APIs
- registerAttestationServer : A new api to register an attestation server with cloudstack. It will take the details of the attestation server as a parameter and check if a connection can be established to it.
Parameters
Type
Required/Optional
Comments
url
String
Required
Url of the attestation server
username
String
Required
Username with which cloudstack should register and connect with the attestation server
password
String
Required
Password with which cloudstack should register and connect with the attestation server
Test Guidelines
<TBD>
Hypervisor support
...
- The documentation available suggests that the configureWhiteList and registerHost api calls can be used for registering a server for attestation. These apis haven't been tried as part of poc. Need to confirm this. Should we keep the white list configuration and registration of a host out of the scope? Additionally, should management server check with the attestation server if a host is trusted or not and on getting a host not registered exception, register it? Or instead, keep the information on whether a host is registered or not in the db.
- Proposal is to fill the host_details table with an additional attribute for an host on checking if it is trusted or not. Should this information be stored elsewhere, probably in a separate table?
- Should the attestation server details be kept in a new table or can they be kept in the host table itself.
Overview
Content Tools