The nova.scheduler.filters.trusted_filter Module

Filter to add support for Trusted Computing Pools.

Filter that only schedules tasks on a host if the integrity (trust) of that host matches the trust requested in the `extra_specs’ for the flavor. The `extra_specs’ will contain a key/value pair where the key is `trust’. The value of this pair (`trusted’/`untrusted’) must match the integrity of that host (obtained from the Attestation service) before the task can be scheduled on that host.

Note that the parameters to control access to the Attestation Service are in the `nova.conf’ file in a separate `trust’ section. For example, the config file will look something like:

[DEFAULT] verbose=True ... [trust] server=attester.mynetwork.com

Details on the specific parameters can be found in the file `trust_attest.py’.

Details on setting up and using an Attestation Service can be found at the Open Attestation project at:

class AttestationService

Bases: httplib.HTTPSConnection

do_attestation(host)
class HTTPSClientAuthConnection(host, port, key_file, cert_file, ca_file, timeout=None)

Bases: httplib.HTTPSConnection

Class to make a HTTPS connection, with support for full client-based SSL Authentication

connect()

Connect to a host on a given (SSL) port. If ca_file is pointing somewhere, use it to check Server Certificate.

Redefined/copied and extended from httplib.py:1105 (Python 2.6.x). This is needed to pass cert_reqs=ssl.CERT_REQUIRED as parameter to ssl.wrap_socket(), which forces SSL to check server certificate against our client certificate.

class TrustedFilter

Bases: nova.scheduler.filters.BaseHostFilter

Trusted filter to support Trusted Compute Pools.

host_passes(host_state, filter_properties)

Previous topic

The nova.scheduler.filters.retry_filter Module

Next topic

The nova.scheduler.filters.type_filter Module

This Page