Page History

...

Registering a host for attestation

• A host has to be registered with the attestation server so that it can be checked if it is trusted or not. It can be done with the registerHostWithAttestationServer api.
• The api goes ahead and does whitelisting of the host and then registers the host with the attestation server.
• Trust assertion checks are also done on the host and it is tagged as trusted if the assertion checks are successful.

Checking the trust relationship of an host

• Whenever management server connects to a host, the processConnect callback routine gets triggered for the plugin.
• It verifies if attestation check is enabled in the global config and if an attestation server has been registered for the zone to which the host belongs.
• It opens a connection to the attestation server with the credentials registered with cloudstack.
• It then checks the assertion attributes for the host; i.e if the host is trusted or not. For that it makes an api.getSamlForHost(<HostIp>) call.
  • If a host assertion not available exception is thrown, it means the whitelist configuration for the host hasn't been done and it hasn't been registered with the attestation server.
  • To do the whitelist configuration and registration of host a configureWhiteList followed by registerHost api calls are made to the attestation server.
  • If the host assertion checks return that either the Vmm or Bios assertions are not valid, the host is untrusted.
  • Otherwise the host is trustedThese calls will be needed only when management server connects to a host for the first time.
• The assertion attributes are checked to make sure the host is trusted. Accordingly the host_details table is updated with a new name value pair 'trusted':true/false. Open Issue 2If the host assertion checks are successful and the host is identified to be trusted, it is tagged accordingly. A 'Trusted-Host' tag is applied on the host. If the host is identified to be untrusted, any such tag is removed from the host. The tag applied can be configured through global configuration parameter 'attestation.hosttag'.

Deploying an instance on a trusted host

• A new TrustedHostProcessor will be provided. It will implement AffinityGroupProcessor. It'll exclude all the hosts that are not trusted.
• User can list the processor types available using listAffinityTypes API.
• User can create a trusted group using the types available.
• During VM deployment, user can specify trusted group id to be associated with the instance. Looking at the affinity group, the corresponding plugin that can handle this type will then process to set the deployment scope.

Migration and HA

• service offering can be created with an appropriate host tag, "Trusted-Host" by default.
• Any instance deployed with such a service offering will be placed on a trusted host.
• For such an instance, for migration only a trusted host will be marked as suitable for migration. The administrator may choose to migrate it to an untrusted host.
• Similarly for HA, cloudstack will move it only to a trusted host
• When hosts are listed for migration of an instance, if an instance was deployed with group-id that requires trusted host; untrusted hosts will be marked as unsuitable.
• Migration of instances using offering requiring trusted hosts, to untrusted hosts will be allowed. However, an alert will be raised to bring this to administrators attention.
• If an instance using a offering requiring trusted hosts goes down and HA is triggered for it, management server will try to bring it up on host that is trusted. If no trusted hosts are available HA for the instance will fail.

Database modifications

A new table will be created in the db to hold the attestation server details. Open Issue 4.

...

The feature will be accessible only through apis. Whether a host is trusted or not can be established by looking at its tags.

Open Issues

...

.