Brianna Poulos
8c7ca368b1
This change adds support for the trusted_image_certificates parameter,
which is used to define a list of trusted certificate IDs that can be
used during image signature verification and certificate validation. The
parameter may contain a list of strings, each string representing the ID
of a trusted certificate. The list is restricted to a maximum of 50 IDs.
The list of certificate IDs will be stored in the trusted_certs field of
the instance InstanceExtra and will be used to verify the validity of
the signing certificate of a signed instance image.
The trusted_image_certificates request parameter can be passed to
the server create and rebuild APIs (if allowed by policy):
* POST /servers
* POST /servers/{server_id}/action (rebuild)
The following policy rules were added to restrict the usage of the
``trusted_image_certificates`` request parameter in the server create
and rebuild APIs:
* os_compute_api:servers:create:trusted_certs
* os_compute_api:servers:rebuild:trusted_certs
The trusted_image_certificates parameter will be in the response
body of the following APIs (not restricted by policy):
* GET /servers/detail
* GET /servers/{server_id}
* PUT /servers/{server_id}
* POST /servers/{server_id}/action (rebuild)
APIImpact
Implements blueprint: nova-validate-certificates
Change-Id: Iedd3fea0e86648fae364f075915555dcb2c4f199
94 lines
3.2 KiB
JSON
94 lines
3.2 KiB
JSON
{
|
|
"server": {
|
|
"OS-DCF:diskConfig": "AUTO",
|
|
"OS-EXT-AZ:availability_zone": "nova",
|
|
"OS-EXT-SRV-ATTR:host": "compute",
|
|
"OS-EXT-SRV-ATTR:hostname": "new-server-test",
|
|
"OS-EXT-SRV-ATTR:hypervisor_hostname": "fake-mini",
|
|
"OS-EXT-SRV-ATTR:instance_name": "instance-00000001",
|
|
"OS-EXT-SRV-ATTR:kernel_id": "",
|
|
"OS-EXT-SRV-ATTR:launch_index": 0,
|
|
"OS-EXT-SRV-ATTR:ramdisk_id": "",
|
|
"OS-EXT-SRV-ATTR:reservation_id": "r-ov3q80zj",
|
|
"OS-EXT-SRV-ATTR:root_device_name": "/dev/sda",
|
|
"OS-EXT-SRV-ATTR:user_data": "IyEvYmluL2Jhc2gKL2Jpbi9zdQplY2hvICJJIGFtIGluIHlvdSEiCg==",
|
|
"OS-EXT-STS:power_state": 1,
|
|
"OS-EXT-STS:task_state": null,
|
|
"OS-EXT-STS:vm_state": "active",
|
|
"OS-SRV-USG:launched_at": "2017-02-14T19:23:59.895661",
|
|
"OS-SRV-USG:terminated_at": null,
|
|
"accessIPv4": "1.2.3.4",
|
|
"accessIPv6": "80fe::",
|
|
"addresses": {
|
|
"private": [
|
|
{
|
|
"OS-EXT-IPS-MAC:mac_addr": "aa:bb:cc:dd:ee:ff",
|
|
"OS-EXT-IPS:type": "fixed",
|
|
"addr": "192.168.0.3",
|
|
"version": 4
|
|
}
|
|
]
|
|
},
|
|
"config_drive": "",
|
|
"created": "2017-02-14T19:23:58Z",
|
|
"description": null,
|
|
"flavor": {
|
|
"disk": 1,
|
|
"ephemeral": 0,
|
|
"extra_specs": {
|
|
"hw:cpu_model": "SandyBridge",
|
|
"hw:cpu_policy": "dedicated",
|
|
"hw:mem_page_size": "2048"
|
|
},
|
|
"original_name": "m1.tiny.specs",
|
|
"ram": 512,
|
|
"swap": 0,
|
|
"vcpus": 1
|
|
},
|
|
"hostId": "2091634baaccdc4c5a1d57069c833e402921df696b7f970791b12ec6",
|
|
"host_status": "UP",
|
|
"id": "9168b536-cd40-4630-b43f-b259807c6e87",
|
|
"image": {
|
|
"id": "70a599e0-31e7-49b7-b260-868f441e862b",
|
|
"links": [
|
|
{
|
|
"href": "http://openstack.example.com/6f70656e737461636b20342065766572/images/70a599e0-31e7-49b7-b260-868f441e862b",
|
|
"rel": "bookmark"
|
|
}
|
|
]
|
|
},
|
|
"key_name": null,
|
|
"links": [
|
|
{
|
|
"href": "http://openstack.example.com/v2.1/6f70656e737461636b20342065766572/servers/9168b536-cd40-4630-b43f-b259807c6e87",
|
|
"rel": "self"
|
|
},
|
|
{
|
|
"href": "http://openstack.example.com/6f70656e737461636b20342065766572/servers/9168b536-cd40-4630-b43f-b259807c6e87",
|
|
"rel": "bookmark"
|
|
}
|
|
],
|
|
"locked": false,
|
|
"metadata": {
|
|
"My Server Name": "Apache1"
|
|
},
|
|
"name": "new-server-test",
|
|
"os-extended-volumes:volumes_attached": [],
|
|
"progress": 0,
|
|
"security_groups": [
|
|
{
|
|
"name": "default"
|
|
}
|
|
],
|
|
"status": "ACTIVE",
|
|
"tags": [],
|
|
"tenant_id": "6f70656e737461636b20342065766572",
|
|
"trusted_image_certificates": [
|
|
"0b5d2c72-12cc-4ba6-a8d7-3ff5cc1d8cb8",
|
|
"674736e3-f25c-405c-8362-bbf991e0ce0a"
|
|
],
|
|
"updated": "2017-02-14T19:24:00Z",
|
|
"user_id": "fake"
|
|
}
|
|
}
|