Re: RFC: New APIs for delegation of privileged operations

2022-12-08 Thread Daniel P . Berrangé
On Thu, Dec 08, 2022 at 10:12:22AM +0100, Martin Kletzander wrote: > On Wed, Dec 07, 2022 at 12:07:11PM +, Daniel P. Berrangé wrote: > > On Wed, Dec 07, 2022 at 12:42:06PM +0100, Martin Kletzander wrote: > > > On Thu, Dec 01, 2022 at 10:17:49AM +, Daniel P. Berrangé wrote: > > > > The other

Re: RFC: New APIs for delegation of privileged operations

2022-12-08 Thread Martin Kletzander
On Wed, Dec 07, 2022 at 12:07:11PM +, Daniel P. Berrangé wrote: On Wed, Dec 07, 2022 at 12:42:06PM +0100, Martin Kletzander wrote: On Thu, Dec 01, 2022 at 10:17:49AM +, Daniel P. Berrangé wrote: > The other end of the > > virInternalSetProcessSetMaxMemLockHandler > > wouldn't have abili

Re: RFC: New APIs for delegation of privileged operations

2022-12-07 Thread Daniel P . Berrangé
On Wed, Dec 07, 2022 at 12:42:06PM +0100, Martin Kletzander wrote: > On Thu, Dec 01, 2022 at 10:17:49AM +, Daniel P. Berrangé wrote: > > The other end of the > > > > virInternalSetProcessSetMaxMemLockHandler > > > > wouldn't have ability to validate the VM identity even if we > > passed it,

Re: RFC: New APIs for delegation of privileged operations

2022-12-07 Thread Martin Kletzander
On Thu, Dec 01, 2022 at 10:17:49AM +, Daniel P. Berrangé wrote: On Wed, Nov 30, 2022 at 09:47:02AM +0100, Peter Krempa wrote: On Tue, Nov 29, 2022 at 09:05:33 -0800, Andrea Bolognani wrote: [...] > Proposal > > > In order to address the issues outlined above, I propose that we > i

Re: [kubevirt-dev] Re: RFC: New APIs for delegation of privileged operations

2022-12-02 Thread Andrew Burden
This should now be working as intended. Sorry for the inconvenience, folks. On Thu, Dec 1, 2022 at 12:36 PM Daniel P. Berrangé wrote: > On Thu, Dec 01, 2022 at 11:17:02AM +0100, Andrew Burden wrote: > > Hello, > > Yeah that's how the kubevirt-dev mailing list works - or is supposed to > > work

Re: [kubevirt-dev] Re: RFC: New APIs for delegation of privileged operations

2022-12-01 Thread Daniel P . Berrangé
On Thu, Dec 01, 2022 at 11:17:02AM +0100, Andrew Burden wrote: > Hello, > Yeah that's how the kubevirt-dev mailing list works - or is supposed to > work - as well. Emails from non-members are pending until manually > approved. I don't see anything pending though so we have an issue there. > Perhaps

Re: [kubevirt-dev] Re: RFC: New APIs for delegation of privileged operations

2022-12-01 Thread Daniel P . Berrangé
On Thu, Dec 01, 2022 at 11:17:02AM +0100, Andrew Burden wrote: > Hello, > Yeah that's how the kubevirt-dev mailing list works - or is supposed to > work - as well. Emails from non-members are pending until manually > approved. I don't see anything pending though so we have an issue there. > Perhaps

Re: [kubevirt-dev] Re: RFC: New APIs for delegation of privileged operations

2022-12-01 Thread Andrew Burden
Hello, Yeah that's how the kubevirt-dev mailing list works - or is supposed to work - as well. Emails from non-members are pending until manually approved. I don't see anything pending though so we have an issue there. Perhaps the mechanism in googlegroups is being thrown off by the inclusion of a

Re: RFC: New APIs for delegation of privileged operations

2022-12-01 Thread Daniel P . Berrangé
On Wed, Nov 30, 2022 at 09:47:02AM +0100, Peter Krempa wrote: > On Tue, Nov 29, 2022 at 09:05:33 -0800, Andrea Bolognani wrote: > > [...] > > > Proposal > > > > > > In order to address the issues outlined above, I propose that we > > introduce a new set of APIs in libvirt. > > > > Thes

Re: [kubevirt-dev] Re: RFC: New APIs for delegation of privileged operations

2022-12-01 Thread Stu Gott
On Wed, Nov 30, 2022 at 11:48 AM Andrea Bolognani wrote: > On Tue, Nov 29, 2022 at 09:05:33AM -0800, Andrea Bolognani wrote: > > Hi, > > > > this is a proposal for introducing a new family of APIs in libvirt, > > with the goal of improving integration with management applications. > > > > KubeVir

Re: RFC: New APIs for delegation of privileged operations

2022-11-30 Thread Andrea Bolognani
On Tue, Nov 29, 2022 at 09:05:33AM -0800, Andrea Bolognani wrote: > Hi, > > this is a proposal for introducing a new family of APIs in libvirt, > with the goal of improving integration with management applications. > > KubeVirt is intended to be the primary consumer of these APIs. This proposal wa

Re: [kubevirt-dev] RFC: New APIs for delegation of privileged operations

2022-11-30 Thread Daniel P . Berrangé
On Tue, Nov 29, 2022 at 06:23:07PM +, Fox, Kevin M wrote: > Would a regular libvirt installation benefit from having > libvirtd run untrusted too (I think so)? especially if its > on the network? so instead of making it plugable, maybe the > architecture should be updated and libvirtd never doe

Re: RFC: New APIs for delegation of privileged operations

2022-11-30 Thread Daniel P . Berrangé
On Tue, Nov 29, 2022 at 09:05:33AM -0800, Andrea Bolognani wrote: > Proposal > > > In order to address the issues outlined above, I propose that we > introduce a new set of APIs in libvirt. > > These APIs would expose some of the inner workings of libvirt, and > as such would come with *

Re: [kubevirt-dev] RFC: New APIs for delegation of privileged operations

2022-11-30 Thread Fox, Kevin M
] RFC: New APIs for delegation of privileged operations Check twice before you click! This email originated from outside PNNL. Hi, this is a proposal for introducing a new family of APIs in libvirt, with the goal of improving integration with management applications. KubeVirt is intended to be

Re: RFC: New APIs for delegation of privileged operations

2022-11-30 Thread Peter Krempa
On Tue, Nov 29, 2022 at 09:05:33 -0800, Andrea Bolognani wrote: [...] > Proposal > > > In order to address the issues outlined above, I propose that we > introduce a new set of APIs in libvirt. > > These APIs would expose some of the inner workings of libvirt, and > as such would come

RFC: New APIs for delegation of privileged operations

2022-11-29 Thread Andrea Bolognani
Hi, this is a proposal for introducing a new family of APIs in libvirt, with the goal of improving integration with management applications. KubeVirt is intended to be the primary consumer of these APIs. Background -- KubeVirt makes it possible to run VMs on a Kubernetes cluster, side