Choose timezone
Your profile timezone:
HEPiX Virtualisation Working Group Meeting
→
Europe/Zurich
Phone conference
Phone conference
Description
<sl>
Dial +41227676000 and enter access code 0186715 followed by #
Key ##1 to mute/unmute your phone
</sl>
HEPiX Virtulisation WG meeting minutes 2010-03-29
Present (in no particular order):
Tony Cass, CERN
Romain Wartel, CERN
Ewan MacMahon, Oxford
James Adams, RAL
Ian Collier, RAL
Martin Bly, RAL
Jens Jensen, RAL
David Kelsey, RAL
John Gordon, RAL
Keith Chadwick, FNAL
Sander Klous, NIKEF
Thomas Finnern, DESY
Owen Synge, DESY
Ian Gable, University of Victoria
Michel Jouvin, GRIF
Andrea Chierici, INFN Bologna
Please note that the conference system appears to have dropped the recording of the last third of the meeting. Hence, I've had to reply on my lackluster notes. Please correct me where necessary.
1. Previous Minutes
- Tony asked for comments on the previous minutes, particularly since Ian felt they were somewhat vague.
- Dave mentioned that this could have been the result of a vague discussion.
- There were no comments.
2. David Kelsey: discussion on the state of Policy Document.
- Dave has just seen Thomas Finnern's contribution to the list and he will process it shortly.
- Dave met with the JSPG last week fate to face and he gave a brief summary of the discussion at the meeting. They decided on two names for the for the roles we have been discussing: producer, and endorser. It was felt that the previous word 'approver' suggested to much.
- Each endorser would have list of endorsed images, and the list would would be signed.
- Dave plans a new revision of the Policy document incorporating comments by next week.
3. Cataloguing & Distribution (Ewan MacMahon, Martin Bly & Owen Synge)
- Martin went through theImage Distribution Draft. Please read the document for accurate summary of what Martin said.
- Tony commented on the necessity of having a certificate per images. He commented that there are two models (1) a signed images, with a signed list of endorsed images or (2) certificates for individual images.
- Romain commented that we need to avoid having to do two checksums on the image due to the expensive nature of that operation.
- Owen commented that one of the reasons for using certificates for individual images is that you can reuse CRL mechanism for expiry.
- David commented that use of certificates would be rather heavy weight, and assigning them in a trustworthy way would be rather time consuming.
- David commented that it may not be possible to demand that the producer sign the image (say for example RedHat provided images), in this case we can rely on the endorser.
- Tony asked that the issue of having individual certificates for images be resolved by the security group, rather then the distribution group. This would avoid discussing it in two different places. Both Owen and Martin agreed.
- David mentioned that during the discussion with JSPG that there was a question about the need for expiry dates. The feeling was that a mechanism for revocation was good enough to accomplish expiry.
- Michel commented that he felt it was a burden to have an expiry date for images that may still be useful, and expire for no particularly reason.
- John Gordon was concerned about having old images turning up in the absence of an expiry date. He also commented that he doesn't expect that images will have particularly long lifetimes given the frequency of OS patches.
- Romain commented that we must require that endorsers do their work properly.
- Tony commented that revocation by endorsers is preferable to relying on expiry dates because this will require active evolvement from the endorsers. If endorsers fail to revoke their images in a timely fashion we will know not to trust them. Michel commented that he supported this exactly.
- Ewan commented that having expiry was a failsafe mechanism for cases such as people forgetting about an image or leaving their job. John commented that this was the point he way trying to make.
- There was some discussion about if running VM instances should be patched. Not sure is there was a conclusion here; the group needs to decide if image sites can patch images or should simply refuse to instantiate an image if they have concerns. Romain said that some fixes might not require a reboot. Tony commented that in practice this does not happen frequently i.e. nodes are normally taken offline and rebooted for security patches. Romain agreed with this.
- Martin commented that he would like to be able to use the same cataloging and verification tools for the site locally produced images( which may have no use outside the site) as would be used for externally produced images.
- Tony commented that his preference was that we create something that is usable soon, and may not be as automated as we would like. We can work on improving it after we have something that is usable.
- Owen commented that the distribution group needs input from the security group with regards to the certificate per image issue to proceed.
- Ewan suggested the distribution group proceed assuming that endorsers provide a list of valid images and define the cataloguing needs for consumer sites. Tony approved of this suggestion, asking that the group possibly consider an initial basic mechanism that could be implemented quickly (but which should nevertheless be secure) to be followed if necessary by a more complete mechanism to be delivered later. Tony was keen to avoid ending up in the MUPJ situation where deployment of glexec/scas has taken a very long time; he hoped instead that we would be able to move quickly to actually using created images, not waiting for tool deployment. Romain suggested that we ought to be able to move quickly to deployment as many existing tools could be reused.
4. Next meetings
- Dave will produce another revision of the Policy document to be discussed During the April 12 meeting. The revised document should be available well before April 12th so the catalogue/distribution group can review this before April 12th, but there might not be time for discussion at that meeting.
- Face to face meeting: WIll occur Friday of HEPiX Lisbon (April 23, 2010), likely starting at 11:00 after coffee. Tony said that he hope we would be able to make significant progress on the creation policy documents and the cataloguing/distribution mechanism at the meeting, leaving us to then concentrate on technical issues such as contextualisation at future phone conferences.
There are minutes attached to this event.
Show them.