On 04/06/14 15:58, Vijendar Komalla wrote:
Hi Devs, I have submitted an WIP review (https://review.openstack.org/#/c/97900/) for Heat parameters encryption blueprint https://blueprints.launchpad.net/heat/+spec/encrypt-hidden-parameters This quick and dirty implementation encrypts all the parameters on on Stack 'store' and decrypts on on Stack 'load'. Following are couple of improvements I am thinking about; 1. Instead of encrypting individual parameters, on Stack 'store' encrypt all the parameters together as a dictionary [something like crypt.encrypt(json.dumps(param_dictionary))]
Yeah, definitely don't encrypt them individually.
2. Just encrypt parameters that were marked as 'hidden', instead of encrypting all parameters I would like to hear your feedback/suggestions.
Just as a heads-up, we will soon need to store the properties of resources too, at which point parameters become the least of our problems. (In fact, in theory we wouldn't even need to store parameters... and probably by the time convergence is completely implemented, we won't.) Which is to say that there's almost certainly no point in discriminating between hidden and non-hidden parameters.
I'll refrain from commenting on whether the extra security this affords is worth the giant pain it causes in debugging, except to say that IMO there should be a config option to disable the feature (and if it's enabled by default, it should probably be disabled by default in e.g. devstack).
cheers, Zane. _______________________________________________ OpenStack-dev mailing list OpenStack-dev@lists.openstack.org http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
