Page History

...

• Whenever management server connects to a host, the processConnect callback routine gets triggered for the plugin.
• It verifies if attestation check is enabled in the global config and if an attestation server has been registered.
• It opens a connection to the attestation server with the credentials registered with cloudstack.
• It then checks the assertion attributes for the host; i.e if the host is trusted or not. For that it makes an api.getSamlForHost(<HostIp>) call.
  • If a host assertion not available exception is thrown, it means the whitelist configuration for the host hasn't been done and it hasn't been registered with the attestation server.
  • To do so, a the whitelist configuration and registration , of host a configureWhiteList followed by registerHost api calls are made to the attestation server. Open Issue 1.
  • These calls will be needed only when management server connects to a host for the first time.
• The assertion attributes are checked to make sure the host is trusted. Accordingly the host_details table is updated with a new name value pair 'trusted':true/false. Open Issue 2.

Deploying an instance on a trusted host

Migration and HA

1. When hosts are listed for migration of an instance, if an instance is using an offering which requires trusted host, the host allocators will be updated to not to include hosts that are not trusted (information stored in the host_details table in the db). These hosts will be marked as 'Unsuitable' for migration (as seen in UI).
2. Migration of instances using offering requiring trusted hosts, to untrusted hosts will be allowed. However, an alert will be raised to bring this to administrators attention.
3. If an instance using a offering requiring trusted hosts goes down and HA is triggered for it, management server will try to bring it up on host that is trusted. If no trusted hosts are available HA for the instance will fail.

Database modifications

A new table will be created in the db to hold the attestation server details. Open Issues Issue 3.

...