Keystone at the Center of Our Universe
•Télécharger en tant que PPTX, PDF•
1 j'aime•541 vues
Slides from eBay's talk at the OpenStack Summit in Tokyo (Oct 2015) - see https://openstacksummitoctober2015tokyo.sched.org/event/19e95f52289777de81fe04db92f4a082#.VjGHXq4rISQ for details.
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
En vedette
Similaire à Keystone at the Center of Our Universe
Similaire à Keystone at the Center of Our Universe (20)
Plus de Subbu Allamaraju
Plus de Subbu Allamaraju (12)
Dernier
Dernier (20)
Keystone at the Center of Our Universe
- 1. Keystone at the Center of Our Universe Dawei Ding, Fangzhou Xu, Subbu Allamaraju eBay Inc
- 2. What does our universe look like?
- 3. AZs Where can find the cloud? Where do I login? What’s where? Cross-AZ operations User and role management
- 4. VPCs Segmented security zones Same services Different auth and access policies
- 5. Layers Above PaaS, XaaS Kubernetes Other cloud services Headless access
- 7. IAMwithout actually managing users Global, available, secure Semi-trusted cloud services (in the control plane) Untrusted cloud users
- 8. Global Keystone in a Trusted Control Plane Multi-factor authentication API Keys API Extensions
- 9. LB VIP LB VIP LB VIP Donor … DNS routing (affinity based) for DB ks LB VIP ks… ks LB VIP ks… ks LB VIP ks… DNS routing (affinity based) for Keystone service Galera based replication of select tables
- 10. 10 new tokens/sec on average – peak at 100 tokens/sec High write latencies (~400 msec) Started with PKI, moved to PKIZ (60% reduction)
- 13. Two Factor Authentication A per-VPC policy VPC is a property of a project All projects in a given VPC share the policy Entirely dynamic and configuration driven
- 14. POST /v2.0/tokens { "auth": { "passwordCredentials": { "username": "jsmith", "password": "…” } } } Compatible for token generation No changes for token validation Proprietary extensions for resync
- 15. API Key Designed for headless use cases A replacement for username, password tuple Create as many as you like Revoke at will Can be ephemeral
- 16. API Key
- 17. POST /api_key X-Auth-Token A valid auth token (header) source_project_id An optional source project (defaults to current) expires-at An optional expiry role_ids An optional subset of roles group_ids An optional subset of groups ip_addresses An optional subset of sources (default to the project’s compute VPC)
- 18. Limited Authentication Boundary Blocked if the caller source is not whitelisted Blocked if used from a different VPC Blocked if used from a different project
- 20. Thanks