Re: [openstack-dev] [lbaas][octavia] Security/networking questions

2016-02-09 Thread Eichberger, German
All, Some more color on (3) our plan was to allow for multiple management nets (and I was advocating strongly for that) but that somehow got lost in the implementation. For (2) we are still working on our operator API which will include that functionality once we get there :-) German On

[openstack-dev] [lbaas][octavia] Security/networking questions

2016-02-08 Thread Major Hayden
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hey there, I've been doing some work to research how best to implement LBaaSv2 and Octavia within the OpenStack-Ansible project. During that research, I've come up with a few questions. 1) Is it possible for octavia to operate without providing

Re: [openstack-dev] [lbaas][octavia] Security/networking questions

2016-02-08 Thread Michael Johnson
1. Octavia can run under it's own account with the required roles added to that account. 2. Currently the process would be to update the amphora image in glance and trigger a failover of the amphora. 3. It is required. It is a private network between the Octavia controller and the amphora. We

Re: [openstack-dev] [lbaas][octavia] Security/networking questions

2016-02-08 Thread Brandon Logan
Adding my own input: 1. You should be able to add a specific role that the service accounts octavia will have. Then that role can be added to neutron and nova's policy.json. I have not tested this out but that is just a quick off the top of my head solution. 2. What johnsom said. Not ideal