Mailing-List: contact dev-help@cloudstack.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cloudstack.apache.org
Received-SPF: pass (nike.apache.org: domain of terbolous@gmail.com designates
 209.85.212.177 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <F91A3BFF-7602-4344-8F60-07DB6EB24A8F@stratosec.co>
References: <F91A3BFF-7602-4344-8F60-07DB6EB24A8F@stratosec.co>
Date: Wed, 28 Jan 2015 21:58:39 +0100
Message-ID: 
 <CAP997UfNk3G+pqDo9bExraVs=ODgPxfr9dqbHrs9CxbtTs=cag@mail.gmail.com>
Subject: Re: [DISCUSS] we need a better SSVM solution
From: Erik Weber <terbolous@gmail.com>
To: dev <dev@cloudstack.apache.org>
Content-Type: multipart/alternative; boundary=001a11c2283ac96a44050dbca282

--001a11c2283ac96a44050dbca282
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Jan 28, 2015 at 9:44 PM, John Kinsella <jlk@stratosec.co> wrote:

> Every time there=E2=80=99s an issue (security or otherwise) with the syst=
em VM
> ISOs, it=E2=80=99s a relative pain to fix. They=E2=80=99re sort of a clos=
ed system, people
> know little (relative to other ACS parts, IMHO) about their innards, and
> updating them is more difficult than it should be.
>
> I=E2=80=99d love to see a Better Way. I think these things could be dynam=
ically
> built, with the option to have them connect to a configuration management
> (CM) system such as Puppet, Chef, Salt-Stack or whatever else floats
> people=E2=80=99s boat.
>
>
Totally agree, but we should consider the fact that users might not use our
builds and make it equally easy to update with a custom one.

One possible use case:
> * User installs new ACS system.
> * User logs into mgmt server, goes to Templates area, clicks button to
> fetch default SSVM image. UI allows providing alternative URL, other
> options as needed.
> * (time passes)
> * Security issue is announced. User goes back into Templates area, select=
s
> SSVM template, clicks =E2=80=9CDownload updated template=E2=80=9D and it =
does. Under
> infrastructure/system VMs and infrastrucutre/virtual routers, there=E2=80=
=99s
> buttons to update one or more running instances to use the new template
>
>
If the user is using one of the published templates, why not just download
the new one and send a notification that a new template is ready and that
systemvms should be scheduled for a restart?


> Another possible use case:
> * User installs new ACS system
> * User uploads SSVM template that has CM agent configured to talk to thei=
r
> CM server (I=E2=80=99ve been wanting to lab this for a while now)
> * As ACS creates system VMs, they phone home to CM server, it provides
> them with instructions to install various packages and config as needed t=
o
> be domr/console proxy/whatever. We provide basic =E2=80=9Crecipes=E2=80=
=9D for CM systems
> for people to use and grow from.
> * Security issue is announced. User updates recipe in CM system, a few
> minutes later the SSVMs are up-to-date.
>
> Modification on that use case: We ship the SSVM with puppet/chef/blah
> installed, part of the SSVM =E2=80=9Cpatch=E2=80=9D process configures ap=
propriate CM
> system.
>
> What might make the second use case easier would be to have some hooks in
> ACS that when a system is created/destroyed/modified, it informs 3rd part=
y
> via API.
>
> (Obviously API calls for all of the above to allow process without
> touching the UI)
>
> Thoughts?
>
>
I've wondered for quite some time why we haven't had a simple checkbox in
the template register view that says 'Use as System VM' or similar.

Anyway, huge +1

--=20
Erik

--001a11c2283ac96a44050dbca282--