Review https://review.openstack.org/#/c/317739/ added a new dynamic
metadata handler to nova. The basic jist is that rather than serving
metadata statically, it can be done dyamically, so that certain values
aren't provided until they are needed, mostly for security purposes
(like credentials to enroll in an AD domain). The metadata is configured
as URLs to a REST service.
Very little is passed into the REST call, mostly UUIDs of the instance,
image, etc. to ensure a stable API. What this means though is that the
REST service may need to make calls into nova or glance to get
information, like looking up the image metadata in glance.
Currently the dynamic metadata handler _can_ generate auth headers if an
authenticated request is made to it, but consider that a common use case
is fetching metadata from within an instance using something like:
% curl http://169.254.169.254/openstack/2016-10-06/vendor_data2.json
This will come into the nova metadata service unauthenticated.
So a few questions:
1. Is it possible to configure paste (I'm a relative newbie) both
authenticated and unauthenticated requests are accepted such that IF an
authenticated request comes it, those credentials can be used, otherwise
fall back to something else?
2. If an unauthenticated request comes in, how best to obtain a token to
use? Is it best to create a service user for the REST services (perhaps
several), use a shared user, something else?
I guess if config_drive is True then this isn't really a problem as the
metadata will be there in the instance already.
thanks
rob
__________________________________________________________________________
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
