- OpenStack Cloud Security
- Fabio Alessandro Locati
- 472字
- 2021-07-16 13:28:20
Future components
Since the OpenStack community is increasing its size very quickly, the OpenStack Technical Committee has created a procedure to accept new components as part of OpenStack.
To grant maximum safety and code-continuity, it has been decided that the new components have to pass a given time in incubation. In this period, the component has to show a few releases as if they were already parts of OpenStack before they can be promoted to official components. This makes the incubation process pretty long but you can be assured that only high quality components are allowed to be officially part of OpenStack.
Due to this long process, we already know that some components that will soon become part of OpenStack. The following components are being considered to be part of the next release (Kilo) and some of them will very likely be integrated. These components are explained next.
Ironic – bare metal provisioning
The ironic goal is to provide the same interface that is used to create virtual instances in OpenStack to create real (bare metal) machines as well. The main goal of this is to help a system administrator to centralize the administration of the machines.
Amazon does not provide any service that is comparable to Ironic.
Zaqar – cloud messaging
Zaqar is a cloud messaging service for web developers. The service features a RESTful API, which developers can use to send messages between various components of their software and mobile applications. During the early phase of the development of Zaqar, it was known as Marconi, but since has been renamed.
Zaqar can be compared to Amazon's Amazon Simple Queue Service (SQS) service, but with the additional support for event broadcasting. Also, some features of Zaqar can be found in Amazon's Amazon Simple Notification Service (SNS).
Manila – file sharing
Manila is a file sharing service provider. Manila volumes are accessible as NFS and CIFS volumes, as well as through the RESTful interface. Manila also supports ACL at the file level. It can use GlusterFS, NetApp, and IBM GPFS volumes as backends.
Manila can be compared to Amazon's AWS Storage Gateway.
Designate – DNS
Designate is a DNS-as-a-service provider. It is able to manage multiple DNS instances for redundancy reasons and to keep them all synchronized properly. Multiple backends can be used such as PowerDNS, NSD4, FreeIPA, DynECT, and BIND9.
Designate can be compared to Amazon's Amazon Route 53.
Barbican – key management
Barbican is a key (secrets) manager for OpenStack. Barbican handles many types of secrets, including:
- Symmetric keys that can be used to encrypt Swift containers and Cinder block storages
- Asymmetric keys that can be used for secure communications such as SSL/TLS, encrypted e-mails, and SSH
- Raw secrets that can be used to keep secure data in Barbican
Barbican can be compared to Amazon's AWS Key Management Service (KMS).