openstack
/
magnum
Code Issues Proposed changes
Container Infrastructure Management Service for OpenStack
3,306 Commits 6 Branches 53 Tags 94 MiB
Python 73%
Shell 26.7%
Dockerfile 0.3%
Go to file
Johannes Grassler 0bb0d6486d Fix CVE-2016-7404 
This commit addresses multiple potential vulnerabilities in
Magnum. It makes the following changes:

* Permissions for /etc/sysconfig/heat-params inside Magnum
  created instances are tightened to 0600 (used to be 0755).
* Certificate retrieval is modified to work without the need
  for a Keystone trust.
* The cluster's Keystone trust id is only passed into
  instances for clusters where that is actually needed. This
  prevents the trustee user from consuming the trust in cases
  where it is not needed.
* The configuration setting trust/cluster_user_trust (False by
  default) is introduced. It needs to be explicitely enabled
  by the cloud operator to allow clusters that need the
  trust_id to be passed into instances to work. Without this
  setting, attempts to create such clusters will fail.

Please note, that none of these changes apply to existing
clusters. They will have to be deleted and rebuilt to benefit
from these changes.

(cherry picked from commit e93d82e8b3)

Changes for backport:

* Moved cluster_user_trust setting to magnum/common/keystone.py
* Resolved merge conflicts.
* Fixed unit tests with configuration overrides.

Change-Id: I408d845ee4fd00d5bcd1e90f0a78f2bba3f2a57a
 		2017-02-22 19:50:02 +01:00
api-ref/source Update name of fedora-atomic image 2016-09-20 09:23:34 -05:00
contrib [suse] Fix OS::stack_id in kubeminion 2016-09-15 11:16:40 +05:30
devstack Fix CVE-2016-7404 2017-02-22 19:50:02 +01:00
doc Make cinder volume optional 2017-02-21 13:14:07 -05:00
etc/magnum Fix CVE-2016-7404 2017-02-22 19:50:02 +01:00
install-guide/source Merge "[install] Fix endpoint creation" into stable/newton 2016-12-14 03:44:01 +00:00
magnum Fix CVE-2016-7404 2017-02-22 19:50:02 +01:00
releasenotes Add missing reno: bp-magnum-lbaasv2-support 2016-10-14 15:16:25 +05:30
specs Merge "Fix typos for Magnum" 2016-07-04 03:03:57 +00:00
tools Improve tox.ini to easy developer's life 2015-11-03 17:44:38 +08:00
.coveragerc Cleanup coverage configuration 2016-08-28 21:11:07 +01:00
.gitignore Compare test coverage with the master branch 2016-08-29 14:28:59 +02:00
.gitreview Update .gitreview for stable/newton 2016-09-19 13:57:31 -04:00
.mailmap Initial commit from github (squashed) 2014-11-18 09:23:37 -05:00
.testr.conf Remove minion dependency on master 2016-03-04 07:41:12 -05:00
CONTRIBUTING.rst Workflow documentation is now in infra-manual 2014-12-05 03:30:45 +00:00
HACKING.rst Add hacking rule for explicit import of _ function 2016-07-29 23:17:06 +05:30
LICENSE Initial commit from github (squashed) 2014-11-18 09:23:37 -05:00
README.rst Fix the representation of REST 2015-09-01 08:40:39 +05:30
babel.cfg Initial commit from github (squashed) 2014-11-18 09:23:37 -05:00
cover.sh Compare test coverage with the master branch 2016-08-29 14:28:59 +02:00
functional_creds.conf.sample Update name of fedora-atomic image 2016-09-20 09:23:34 -05:00
requirements.txt Updated from global requirements 2016-09-15 20:20:16 +00:00
setup.cfg Merge "modify the home-page info with the developer documentation" 2016-09-16 08:09:18 +00:00
setup.py Updated from global requirements 2015-09-17 12:12:49 +00:00
test-requirements.txt Init api-ref structure and requirements 2016-08-29 22:44:08 +07:00
tox.ini Update UPPER_CONSTRAINTS_FILE for stable/newton 2016-09-19 13:57:34 -04:00

README.rst

Magnum

Magnum is an OpenStack project which offers container orchestration engines for deploying and managing containers as first class resources in OpenStack.

For more information, please refer to the following resources: