[Starlingx-discuss] Solution for LP1887755: openstack app's admin account gets locked after change password

[Wensley, Barton]

Resending with only the mailing list in the "To" as it wouldn't go through otherwise.

From: Wensley, Barton
Sent: August 6, 2020 9:17 AM
To: Lin, Shuicheng <shuicheng.lin at intel.com>; Hu, Yong <yong.hu at intel.com>; Sun, Austin <austin.sun at intel.com>; Liu, ZhipengS <zhipengs.liu at intel.com>; Church, Robert <Robert.Church at windriver.com>; Friesen, Chris <Chris.Friesen at windriver.com>; Kung, John <John.Kung at windriver.com>; Ning, Antai (Andy) <Andy.Ning at windriver.com>; Penney, Don <Don.Penney at windriver.com>; starlingx-discuss at lists.starlingx.io
Cc: Khalil, Ghada <Ghada.Khalil at windriver.com>; Miller, Frank <Frank.Miller at windriver.com>; Wold, Saul <saul.wold at intel.com>; Rowsell, Brent <Brent.Rowsell at windriver.com>
Subject: RE: Solution for LP1887755: openstack app's admin account gets locked after change password

Shuicheng,

Your overall approach of creating a new stx-admin user to allow the platform to access the stx-openstack services sounds reasonable to me. I'd like some more details though - see my questions in your email below.

Another question - how will the pod based openstack services handle the change to the admin password? That needs to be understood as well.

Bart

From: Lin, Shuicheng <shuicheng.lin at intel.com<mailto:shuicheng.lin at intel.com>>
Sent: August 5, 2020 8:24 PM
To: Hu, Yong <yong.hu at intel.com<mailto:yong.hu at intel.com>>; Sun, Austin <austin.sun at intel.com<mailto:austin.sun at intel.com>>; Liu, ZhipengS <zhipengs.liu at intel.com<mailto:zhipengs.liu at intel.com>>; Church, Robert <Robert.Church at windriver.com<mailto:Robert.Church at windriver.com>>; Friesen, Chris <Chris.Friesen at windriver.com<mailto:Chris.Friesen at windriver.com>>; Wensley, Barton <Barton.Wensley at windriver.com<mailto:Barton.Wensley at windriver.com>>; Kung, John <John.Kung at windriver.com<mailto:John.Kung at windriver.com>>; Ning, Antai (Andy) <Andy.Ning at windriver.com<mailto:Andy.Ning at windriver.com>>; Penney, Don <Don.Penney at windriver.com<mailto:Don.Penney at windriver.com>>; starlingx-discuss at lists.starlingx.io<mailto:starlingx-discuss at lists.starlingx.io>
Cc: Khalil, Ghada <Ghada.Khalil at windriver.com<mailto:Ghada.Khalil at windriver.com>>; Miller, Frank <Frank.Miller at windriver.com<mailto:Frank.Miller at windriver.com>>; Wold, Saul <saul.wold at intel.com<mailto:saul.wold at intel.com>>; Rowsell, Brent <Brent.Rowsell at windriver.com<mailto:Brent.Rowsell at windriver.com>>
Subject: RE: Solution for LP1887755: openstack app's admin account gets locked after change password

+ mail list.

Best Regards
Shuicheng

From: Lin, Shuicheng
Sent: Wednesday, August 5, 2020 7:04 PM
To: Hu, Yong <yong.hu at intel.com<mailto:yong.hu at intel.com>>; Sun, Austin <austin.sun at intel.com<mailto:austin.sun at intel.com>>; Liu, ZhipengS <zhipengs.liu at intel.com<mailto:zhipengs.liu at intel.com>>; Church, Robert <Robert.Church at windriver.com<mailto:Robert.Church at windriver.com>>; Friesen, Chris <Chris.Friesen at windriver.com<mailto:Chris.Friesen at windriver.com>>; Wensley, Barton <Barton.Wensley at windriver.com<mailto:Barton.Wensley at windriver.com>>; 'Kung, John' <John.Kung at windriver.com<mailto:John.Kung at windriver.com>>; Ning, Antai (Andy) <Andy.Ning at windriver.com<mailto:Andy.Ning at windriver.com>>; Penney, Don <Don.Penney at windriver.com<mailto:Don.Penney at windriver.com>>
Cc: Khalil, Ghada <Ghada.Khalil at windriver.com<mailto:Ghada.Khalil at windriver.com>>; 'Miller, Frank' <Frank.Miller at windriver.com<mailto:Frank.Miller at windriver.com>>; Wold, Saul <saul.wold at intel.com<mailto:saul.wold at intel.com>>; Rowsell, Brent <Brent.Rowsell at windriver.com<mailto:Brent.Rowsell at windriver.com>>
Subject: Solution for LP1887755: openstack app's admin account gets locked after change password

Hi all,
Please help loop in any person who have interest for this issue.
Here is the LP link: https://bugs.launchpad.net/starlingx/+bug/1887755

The issue is that there are 2 admin account in STX. 1 for host keystone, 1 for openstack app's keystone.
Both account's password could be changed independently.
For this LP issue, it is openstack app's admin account password is changed, but host flock service doesn't know it, and try to access openstack app's keystone with the old password, and lead to account be locked by keystone.

There are 2  problems here:

  1.  Host flock service doesn't know openstack app's admin password is changed.
  2.  Host flock service cannot get the new password.

So, in order to solve the issue, I plan to create a new account like "stx_admin" in openstack app, which will be used by flock service to communicate with openstack app.
For this "stx_admin" account, it will share the same password as host admin account. And password info will be synced with the host admin account.
So the behavior will like below:

  1.  Admin account "stx_admin" will be created automatically when stx-openstack app is applied.
[Bart] Will this be done through the helm charts in the stx-openstack application? I'd prefer not to use underscores in user names - I think stxadmin or stx-admin would be better.

  1.  "stx_admin" password info will be updated automatically when host admin account's password is changed.
[Bart] What mechanism will be used to do this?

  1.  Host flock service like nfv_vim/pci-irq-affinity-agent will use "stx_admin" account to communicate with stx-openstack app.
  2.  "stx_admin" account and admin account in openstack app are independent of each other.

Please share me your opinion of this solution, and whether there is any other better solution.
I am going to implement it if there is no objection.
Thanks.

Best Regards
Shuicheng

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20200806/d5c49d8d/attachment-0001.html>