Nova Support for Glance Image Signing

Registered by Dane Fichter on 2015-06-05

In order to support Glance's image signing feature, we need to add accompanying functionality to Nova. This will allow Nova to verify signed images before booting and create signed images.

This accompanies the functionality described in the spec here: https://review.openstack.org/#/c/177948/

Blueprint information

Status:
Started
Approver:
John Garbutt
Priority:
Low
Drafter:
Dane Fichter
Direction:
Needs approval
Assignee:
Dane Fichter
Definition:
Pending Approval
Series goal:
None
Implementation:
Good progress
Milestone target:
None
Started by
John Garbutt on 2015-12-04

Related branches

Sprints

Whiteboard

Gerrit topic: https://review.openstack.org/#q,topic:bp/nova-support-image-signing,n,z

Addressed by: https://review.openstack.org/188874
    Nova Support of Glance Image Signing & Encryption

Addressed by: https://review.openstack.org/189843
    Nova support for image-signing

Addressed by: https://review.openstack.org/256066
    Add Castellan to requirements

Addressed by: https://review.openstack.org/256069
    Add signature_utils module

Addressed by: https://review.openstack.org/256072
    Add unit tests for signature_utils module

Addressed by: https://review.openstack.org/312210
    Signature verification for cached images

Addressed by: https://review.openstack.org/312225
    Trusted flavors

Addressed by: https://review.openstack.org/343654
    Add image verification spec for Ocata

Note: This work is mainly being addressed by these two new blueprints:
    Trusted Flavors - https://blueprints.launchpad.net/nova/+spec/nova-trusted-flavors
    Certificate Validation - https://blueprints.launchpad.net/nova/+spec/nova-validate-certificates

(?)

Work Items

Work items:
Spec for Ocata cycle detailing the certificate validation process and integration plan for Nova: TODO
Merge certificate validation functionality into openstack/cursive. Integrate this functionality into Nova's image signature verification: TODO

This blueprint contains Public information 
Everyone can see this information.

Subscribers

No subscribers.