Thanks Shuicheng.
I want to comment on this:
[Bart] What mechanism will be used to do this?
[Shuicheng] There is a keystone listener in sysinv which could receive notification when admin password is changed. So we could sync the new password to stxadmin account by sysinv.
I need save stxadmin current password in keyring also, in order to communicate with keystone to update the new password.
BTW, I am not sure whether this sync is must or not. There are 2 ways to handle the password of stxadmin.
1st method will make code simpler and easy to maintain. What is your suggestion for it? Thanks.
I don’t think sysinv communicates with the OpenStack application at all, so I don’t think it should be involved in handling any password changes. I think you will need to store the stxadmin
password in keyring, so it is accessible to the VIM – you can do that from wherever you are creating the stxadmin user. My preference would be option a above – use a random complex password for the new stxadmin user and do not support changes to this password.
Bart
From: Lin, Shuicheng <shuicheng.lin@intel.com>
Sent: August 7, 2020 3:47 AM
To: Wensley, Barton <Barton.Wensley@windriver.com>; starlingx-discuss@lists.starlingx.io
Subject: RE: Solution for LP1887755: openstack app's admin account gets locked after change password
Hi Bart,
Please see my reply inline.
For the admin password info in pod secrets, I am not sure when and how it is used.
Openstack services communicate with each other don’t use admin auth. So no other issue is found yet after admin password change.
I will do more test later.
Best Regards
Shuicheng
From: Wensley, Barton <Barton.Wensley@windriver.com>
Sent: Thursday, August 6, 2020 9:20 PM
To: starlingx-discuss@lists.starlingx.io
Subject: Re: [Starlingx-discuss] Solution for LP1887755: openstack app's admin account gets locked after change password
Resending with only the mailing list in the “To” as it wouldn’t go through otherwise.
From: Wensley, Barton
Sent: August 6, 2020 9:17 AM
To: Lin, Shuicheng <shuicheng.lin@intel.com>; Hu, Yong <yong.hu@intel.com>; Sun, Austin <austin.sun@intel.com>; Liu, ZhipengS
<zhipengs.liu@intel.com>; Church, Robert <Robert.Church@windriver.com>; Friesen, Chris <Chris.Friesen@windriver.com>;
Kung, John <John.Kung@windriver.com>; Ning, Antai (Andy) <Andy.Ning@windriver.com>; Penney, Don <Don.Penney@windriver.com>;
starlingx-discuss@lists.starlingx.io
Cc: Khalil, Ghada <Ghada.Khalil@windriver.com>; Miller, Frank <Frank.Miller@windriver.com>; Wold, Saul <saul.wold@intel.com>;
Rowsell, Brent <Brent.Rowsell@windriver.com>
Subject: RE: Solution for LP1887755: openstack app's admin account gets locked after change password
Shuicheng,
Your overall approach of creating a new stx-admin user to allow the platform to access the stx-openstack services sounds reasonable to me. I’d like some more details though – see my
questions in your email below.
Another question – how will the pod based openstack services handle the change to the admin password? That needs to be understood as well.
Bart
From: Lin, Shuicheng <shuicheng.lin@intel.com>
Sent: August 5, 2020 8:24 PM
To: Hu, Yong <yong.hu@intel.com>; Sun, Austin <austin.sun@intel.com>; Liu, ZhipengS <zhipengs.liu@intel.com>; Church, Robert
<Robert.Church@windriver.com>; Friesen, Chris <Chris.Friesen@windriver.com>; Wensley, Barton <Barton.Wensley@windriver.com>;
Kung, John <John.Kung@windriver.com>; Ning, Antai (Andy) <Andy.Ning@windriver.com>; Penney, Don <Don.Penney@windriver.com>;
starlingx-discuss@lists.starlingx.io
Cc: Khalil, Ghada <Ghada.Khalil@windriver.com>; Miller, Frank <Frank.Miller@windriver.com>; Wold, Saul <saul.wold@intel.com>;
Rowsell, Brent <Brent.Rowsell@windriver.com>
Subject: RE: Solution for LP1887755: openstack app's admin account gets locked after change password
+ mail list.
Best Regards
Shuicheng
From: Lin, Shuicheng
Sent: Wednesday, August 5, 2020 7:04 PM
To: Hu, Yong <yong.hu@intel.com>; Sun, Austin <austin.sun@intel.com>; Liu, ZhipengS <zhipengs.liu@intel.com>; Church, Robert
<Robert.Church@windriver.com>; Friesen, Chris <Chris.Friesen@windriver.com>; Wensley, Barton <Barton.Wensley@windriver.com>;
'Kung, John' <John.Kung@windriver.com>; Ning, Antai (Andy) <Andy.Ning@windriver.com>; Penney, Don <Don.Penney@windriver.com>
Cc: Khalil, Ghada <Ghada.Khalil@windriver.com>; 'Miller, Frank' <Frank.Miller@windriver.com>; Wold, Saul <saul.wold@intel.com>;
Rowsell, Brent <Brent.Rowsell@windriver.com>
Subject: Solution for LP1887755: openstack app's admin account gets locked after change password
Hi all,
Please help loop in any person who have interest for this issue.
Here is the LP link:
https://bugs.launchpad.net/starlingx/+bug/1887755
The issue is that there are 2 admin account in STX. 1 for host keystone, 1 for openstack app’s keystone.
Both account’s password could be changed independently.
For this LP issue, it is openstack app’s admin account password is changed, but host flock service doesn’t know it, and try to access openstack app’s keystone with the old password, and lead to account be locked by keystone.
There are 2 problems here:
So, in order to solve the issue, I plan to create a new account like “stx_admin” in openstack app, which will be used by flock service to communicate with openstack app.
For this “stx_admin” account, it will share the same password as host admin account. And password info will be synced with the host admin account.
So the behavior will like below:
[Bart] Will this be done through the helm charts in the stx-openstack application? I’d prefer not to use underscores in user names – I think stxadmin or stx-admin would be better.
[Shuicheng] Let me try to create the account by helm charts. Otherwise, I need create it by openstack client cmd after application is applied.
I will use stxadmin as the name. Thanks for the suggestion.
[Bart] What mechanism will be used to do this?
[Shuicheng] There is a keystone listener in sysinv which could receive notification when admin password is changed. So we could sync the new password to stxadmin account by sysinv.
I need save stxadmin current password in keyring also, in order to communicate with keystone to update the new password.
BTW, I am not sure whether this sync is must or not. There are 2 ways to handle the password of stxadmin.
1st method will make code simpler and easy to maintain. What is your suggestion for it? Thanks.
Please share me your opinion of this solution, and whether there is any other better solution.
I am going to implement it if there is no objection.
Thanks.
Best Regards
Shuicheng