<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle22
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:186064023;
mso-list-type:hybrid;
mso-list-template-ids:21379330 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1
{mso-list-id:568812035;
mso-list-type:hybrid;
mso-list-template-ids:21379330 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l1:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l2
{mso-list-id:597786594;
mso-list-template-ids:-1661062294;}
@list l2:level1
{mso-level-start-at:2;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l2:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l3
{mso-list-id:838276586;
mso-list-template-ids:-302457184;}
@list l3:level1
{mso-level-start-at:2;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l4
{mso-list-id:1095246641;
mso-list-type:hybrid;
mso-list-template-ids:-28172372 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l4:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l4:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l4:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l4:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l4:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l4:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l4:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l4:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l4:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l5
{mso-list-id:1558784693;
mso-list-template-ids:1290016470;}
@list l6
{mso-list-id:1755666882;
mso-list-template-ids:1242704072;}
@list l6:level1
{mso-level-start-at:3;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l7
{mso-list-id:2091809644;
mso-list-template-ids:2029295926;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-CA" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Thanks Shuicheng.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">I want to comment on this:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<ol style="margin-top:0cm" start="1" type="1">
<li class="MsoListParagraph" style="margin-left:0cm;mso-list:l0 level1 lfo6"><span lang="EN-US">“stx_admin” password info will be updated automatically when host admin account’s password is changed.<o:p></o:p></span></li></ol>
<p class="MsoNormal"><b><i><span lang="EN-US">[Bart] What mechanism will be used to do this?<o:p></o:p></span></i></b></p>
<p class="MsoNormal"><i><span lang="EN-US">[Shuicheng] There is a keystone listener in sysinv which could receive notification when admin password is changed. So we could sync the new password to stxadmin account by sysinv.<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"> I need save stxadmin current password in keyring also, in order to communicate with keystone to update the new password.<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"> BTW, I am not sure whether this sync is must or not. There are 2 ways to handle the password of stxadmin.<o:p></o:p></span></i></p>
<ol style="margin-top:0cm" start="1" type="1">
<ol style="margin-top:0cm" start="1" type="a">
<li class="MsoListParagraph" style="margin-left:0cm;mso-list:l0 level2 lfo6"><i><span lang="EN-US">Create stxadmin account with a random complex password, and leave it unchanged.<o:p></o:p></span></i></li><li class="MsoListParagraph" style="margin-left:0cm;mso-list:l0 level2 lfo6"><i><span lang="EN-US">Use host admin password, and update it when host admin’s password is changed.<o:p></o:p></span></i></li></ol>
</ol>
<p class="MsoNormal" style="margin-left:36.0pt"><i><span lang="EN-US">1<sup>st</sup> method will make code simpler and easy to maintain. What is your suggestion for it? Thanks.<o:p></o:p></span></i></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">I don’t think sysinv communicates with the OpenStack application at all, so I don’t think it should be involved in handling any password changes. I think you will need to store the stxadmin
password in keyring, so it is accessible to the VIM – you can do that from wherever you are creating the stxadmin user. My preference would be option a above – use a random complex password for the new stxadmin user and do not support changes to this password.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Bart<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Lin, Shuicheng <shuicheng.lin@intel.com>
<br>
<b>Sent:</b> August 7, 2020 3:47 AM<br>
<b>To:</b> Wensley, Barton <Barton.Wensley@windriver.com>; starlingx-discuss@lists.starlingx.io<br>
<b>Subject:</b> RE: Solution for LP1887755: openstack app's admin account gets locked after change password<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US">Hi Bart,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Please see my reply inline.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">For the admin password info in pod secrets, I am not sure when and how it is used.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Openstack services communicate with each other don’t use admin auth. So no other issue is found yet after admin password change.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I will do more test later.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">Best Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Shuicheng<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Wensley, Barton <<a href="mailto:Barton.Wensley@windriver.com">Barton.Wensley@windriver.com</a>>
<br>
<b>Sent:</b> Thursday, August 6, 2020 9:20 PM<br>
<b>To:</b> <a href="mailto:starlingx-discuss@lists.starlingx.io">starlingx-discuss@lists.starlingx.io</a><br>
<b>Subject:</b> Re: [Starlingx-discuss] Solution for LP1887755: openstack app's admin account gets locked after change password<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Resending with only the mailing list in the “To” as it wouldn’t go through otherwise.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Wensley, Barton
<br>
<b>Sent:</b> August 6, 2020 9:17 AM<br>
<b>To:</b> Lin, Shuicheng <<a href="mailto:shuicheng.lin@intel.com">shuicheng.lin@intel.com</a>>; Hu, Yong <<a href="mailto:yong.hu@intel.com">yong.hu@intel.com</a>>; Sun, Austin <<a href="mailto:austin.sun@intel.com">austin.sun@intel.com</a>>; Liu, ZhipengS
<<a href="mailto:zhipengs.liu@intel.com">zhipengs.liu@intel.com</a>>; Church, Robert <<a href="mailto:Robert.Church@windriver.com">Robert.Church@windriver.com</a>>; Friesen, Chris <<a href="mailto:Chris.Friesen@windriver.com">Chris.Friesen@windriver.com</a>>;
Kung, John <<a href="mailto:John.Kung@windriver.com">John.Kung@windriver.com</a>>; Ning, Antai (Andy) <<a href="mailto:Andy.Ning@windriver.com">Andy.Ning@windriver.com</a>>; Penney, Don <<a href="mailto:Don.Penney@windriver.com">Don.Penney@windriver.com</a>>;
<a href="mailto:starlingx-discuss@lists.starlingx.io">starlingx-discuss@lists.starlingx.io</a><br>
<b>Cc:</b> Khalil, Ghada <<a href="mailto:Ghada.Khalil@windriver.com">Ghada.Khalil@windriver.com</a>>; Miller, Frank <<a href="mailto:Frank.Miller@windriver.com">Frank.Miller@windriver.com</a>>; Wold, Saul <<a href="mailto:saul.wold@intel.com">saul.wold@intel.com</a>>;
Rowsell, Brent <<a href="mailto:Brent.Rowsell@windriver.com">Brent.Rowsell@windriver.com</a>><br>
<b>Subject:</b> RE: Solution for LP1887755: openstack app's admin account gets locked after change password<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Shuicheng,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Your overall approach of creating a new stx-admin user to allow the platform to access the stx-openstack services sounds reasonable to me. I’d like some more details though – see my
questions in your email below.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Another question – how will the pod based openstack services handle the change to the admin password? That needs to be understood as well.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Bart<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Lin, Shuicheng <<a href="mailto:shuicheng.lin@intel.com">shuicheng.lin@intel.com</a>>
<br>
<b>Sent:</b> August 5, 2020 8:24 PM<br>
<b>To:</b> Hu, Yong <<a href="mailto:yong.hu@intel.com">yong.hu@intel.com</a>>; Sun, Austin <<a href="mailto:austin.sun@intel.com">austin.sun@intel.com</a>>; Liu, ZhipengS <<a href="mailto:zhipengs.liu@intel.com">zhipengs.liu@intel.com</a>>; Church, Robert
<<a href="mailto:Robert.Church@windriver.com">Robert.Church@windriver.com</a>>; Friesen, Chris <<a href="mailto:Chris.Friesen@windriver.com">Chris.Friesen@windriver.com</a>>; Wensley, Barton <<a href="mailto:Barton.Wensley@windriver.com">Barton.Wensley@windriver.com</a>>;
Kung, John <<a href="mailto:John.Kung@windriver.com">John.Kung@windriver.com</a>>; Ning, Antai (Andy) <<a href="mailto:Andy.Ning@windriver.com">Andy.Ning@windriver.com</a>>; Penney, Don <<a href="mailto:Don.Penney@windriver.com">Don.Penney@windriver.com</a>>;
<a href="mailto:starlingx-discuss@lists.starlingx.io">starlingx-discuss@lists.starlingx.io</a><br>
<b>Cc:</b> Khalil, Ghada <<a href="mailto:Ghada.Khalil@windriver.com">Ghada.Khalil@windriver.com</a>>; Miller, Frank <<a href="mailto:Frank.Miller@windriver.com">Frank.Miller@windriver.com</a>>; Wold, Saul <<a href="mailto:saul.wold@intel.com">saul.wold@intel.com</a>>;
Rowsell, Brent <<a href="mailto:Brent.Rowsell@windriver.com">Brent.Rowsell@windriver.com</a>><br>
<b>Subject:</b> RE: Solution for LP1887755: openstack app's admin account gets locked after change password<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US">+ mail list.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">Best Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Shuicheng<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Lin, Shuicheng
<br>
<b>Sent:</b> Wednesday, August 5, 2020 7:04 PM<br>
<b>To:</b> Hu, Yong <<a href="mailto:yong.hu@intel.com">yong.hu@intel.com</a>>; Sun, Austin <<a href="mailto:austin.sun@intel.com">austin.sun@intel.com</a>>; Liu, ZhipengS <<a href="mailto:zhipengs.liu@intel.com">zhipengs.liu@intel.com</a>>; Church, Robert
<<a href="mailto:Robert.Church@windriver.com">Robert.Church@windriver.com</a>>; Friesen, Chris <<a href="mailto:Chris.Friesen@windriver.com">Chris.Friesen@windriver.com</a>>; Wensley, Barton <<a href="mailto:Barton.Wensley@windriver.com">Barton.Wensley@windriver.com</a>>;
'Kung, John' <<a href="mailto:John.Kung@windriver.com">John.Kung@windriver.com</a>>; Ning, Antai (Andy) <<a href="mailto:Andy.Ning@windriver.com">Andy.Ning@windriver.com</a>>; Penney, Don <<a href="mailto:Don.Penney@windriver.com">Don.Penney@windriver.com</a>><br>
<b>Cc:</b> Khalil, Ghada <<a href="mailto:Ghada.Khalil@windriver.com">Ghada.Khalil@windriver.com</a>>; 'Miller, Frank' <<a href="mailto:Frank.Miller@windriver.com">Frank.Miller@windriver.com</a>>; Wold, Saul <<a href="mailto:saul.wold@intel.com">saul.wold@intel.com</a>>;
Rowsell, Brent <<a href="mailto:Brent.Rowsell@windriver.com">Brent.Rowsell@windriver.com</a>><br>
<b>Subject:</b> Solution for LP1887755: openstack app's admin account gets locked after change password<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Hi all,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Please help loop in any person who have interest for this issue.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Here is the LP link: <a href="https://bugs.launchpad.net/starlingx/+bug/1887755">
https://bugs.launchpad.net/starlingx/+bug/1887755</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The issue is that there are 2 admin account in STX. 1 for host keystone, 1 for openstack app’s keystone.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Both account’s password could be changed independently.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">For this LP issue, it is openstack app’s admin account password is changed, but host flock service doesn’t know it, and try to access openstack app’s keystone with the old password, and lead to account be locked by keystone.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">There are 2 problems here:<o:p></o:p></span></p>
<ol style="margin-top:0cm" start="1" type="1">
<li class="MsoListParagraph" style="margin-left:0cm;mso-list:l4 level1 lfo3"><span lang="EN-US">Host flock service doesn’t know openstack app’s admin password is changed.<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0cm;mso-list:l4 level1 lfo3"><span lang="EN-US">Host flock service cannot get the new password.<o:p></o:p></span></li></ol>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">So, in order to solve the issue, I plan to create a new account like “stx_admin” in openstack app, which will be used by flock service to communicate with openstack app.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">For this “stx_admin” account, it will share the same password as host admin account. And password info will be synced with the host admin account.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">So the behavior will like below:<o:p></o:p></span></p>
<ol style="margin-top:0cm" start="1" type="1">
<li class="MsoListParagraph" style="margin-left:0cm;mso-list:l1 level1 lfo10"><span lang="EN-US">Admin account “stx_admin” will be created automatically when stx-openstack app is applied.<o:p></o:p></span></li></ol>
<p class="MsoNormal"><b><i><span lang="EN-US">[Bart] Will this be done through the helm charts in the stx-openstack application? I’d prefer not to use underscores in user names – I think stxadmin or stx-admin would be better.<o:p></o:p></span></i></b></p>
<p class="MsoNormal"><span lang="EN-US">[Shuicheng] Let me try to create the account by helm charts. Otherwise, I need create it by openstack client cmd after application is applied.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> I will use stxadmin as the name. Thanks for the suggestion.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<ol style="margin-top:0cm" start="2" type="1">
<li class="MsoListParagraph" style="margin-left:0cm;mso-list:l1 level1 lfo10"><span lang="EN-US">“stx_admin” password info will be updated automatically when host admin account’s password is changed.<o:p></o:p></span></li></ol>
<p class="MsoNormal"><b><i><span lang="EN-US">[Bart] What mechanism will be used to do this?<o:p></o:p></span></i></b></p>
<p class="MsoNormal"><i><span lang="EN-US">[Shuicheng] There is a keystone listener in sysinv which could receive notification when admin password is changed. So we could sync the new password to stxadmin account by sysinv.<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"> I need save stxadmin current password in keyring also, in order to communicate with keystone to update the new password.<o:p></o:p></span></i></p>
<p class="MsoNormal"><i><span lang="EN-US"> BTW, I am not sure whether this sync is must or not. There are 2 ways to handle the password of stxadmin.<o:p></o:p></span></i></p>
<ol style="margin-top:0cm" start="2" type="1">
<ol style="margin-top:0cm" start="1" type="a">
<li class="MsoListParagraph" style="margin-left:0cm;mso-list:l1 level2 lfo10"><i><span lang="EN-US">Create stxadmin account with a random complex password, and leave it unchanged.<o:p></o:p></span></i></li><li class="MsoListParagraph" style="margin-left:0cm;mso-list:l1 level2 lfo10"><i><span lang="EN-US">Use host admin password, and update it when host admin’s password is changed.<o:p></o:p></span></i></li></ol>
</ol>
<p class="MsoNormal" style="margin-left:36.0pt"><i><span lang="EN-US">1<sup>st</sup> method will make code simpler and easy to maintain. What is your suggestion for it? Thanks.<o:p></o:p></span></i></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span lang="EN-US"><o:p> </o:p></span></p>
<ol style="margin-top:0cm" start="3" type="1">
<li class="MsoListParagraph" style="margin-left:0cm;mso-list:l1 level1 lfo10"><span lang="EN-US">Host flock service like nfv_vim/pci-irq-affinity-agent will use “stx_admin” account to communicate with stx-openstack app.<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0cm;mso-list:l1 level1 lfo10"><span lang="EN-US">“stx_admin” account and admin account in openstack app are independent of each other.<o:p></o:p></span></li></ol>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Please share me your opinion of this solution, and whether there is any other better solution.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I am going to implement it if there is no objection.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thanks.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Best Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Shuicheng<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</body>
</html>