Support console access for nova VMs
Closed, DuplicatePublic
Actions

Assigned To

Authored By

	Andrew
	Jul 26 2016, 9:37 PM

Description

The attached patch sets console-via-Spice for labs VMs, but does not actually enable the service. My concerns:

Consoles are protected via a token, but I'm not sure how long the tokens last. It seems somewhat insecure to open up consoles that the world can see, protected only by a password (?) and the obscurity and short lifespan of the token.

	Subject	Repo	Branch	Lines +/-
	Set up spice-based remote consoles for Labs instances	operations/puppet	production	+68 -15

Mentioned In: rOPUPaedbb59f2835: Set up spice-based remote consoles for Labs instances
rOPUPeb226c66f2e3: Set up spice-based remote consoles for Labs instances
rOPUP416767160d69: Set up spice-based remote consoles for Labs instances
rOPUPd860346ec626: Set up spice-based remote consoles for Labs instances
rOPUP7c481f909f96: Set up spice-based remote consoles for Labs instances

Update: The default token lifespan is 10 minutes. So, I'm no longer much worried about #2.

This can be set in nova.conf:

Change 301294 had a related patch set uploaded (by Andrew Bogott):
Set up spice-based remote consoles for Labs instances

(Of course if we implement this for real, we should set this up on misc-web so that it doesn't run on http.)

Change 301177 had a related patch set uploaded (by Andrew Bogott):
Add domain labtestspice.wikimedia.org

Change 301294 had a related patch set uploaded (by Andrew Bogott):
Set up spice-based remote consoles for Labs instances

Change 301294 merged by Andrew Bogott:
Set up spice-based remote consoles for Labs instances