You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@mesos.apache.org by Zhitao Li <zh...@gmail.com> on 2018/04/19 17:57:09 UTC
Questions about secret handling in Mesos
Hello,
We at Uber plan to use volume/secret isolator to send secrets from Uber
framework to Mesos agent.
For this purpose, we are referring to these documents:
- File based secrets design doc
<https://docs.google.com/document/d/18raiiUfxTh-JBvjd6RyHe_TOScY87G_bMi5zBzMZmpc/edit#>
and slides
<http://schd.ws/hosted_files/mesosconasia2017/70/Secrets%20Management%20in%20Mesos.pdf>
.
- Apache Mesos secrets documentation
<http://mesos.apache.org/documentation/latest/secrets/>
Could you please confirm that the following assumptions are correct?
- Mesos agent and master will never log the secret data at any logging
level;
- Mesos agent and master will never expose the secret data as part of
any API response;
- Mesos agent and master will never store the secret in any persistent
storage, but only on tmpfs or ramfs;
- When the secret is first downloaded on the mesos agent, it will be
stored as "root" on the tmpfs/ramfs before being mounted in the container
ramfs.
If above assumptions are true, then I would like to see them documented in
this as part of the Apache Mesos secrets documentation
<http://mesos.apache.org/documentation/latest/secrets/>. Otherwise, we'd
like to have a design discussion with maintainer of the isolator.
We appreciate your help regarding this. Thanks!
Regards,
Aditya And Zhitao
Re: Questions about secret handling in Mesos
Posted by Lawrence Rau <la...@mac.com>.
doesn’t seem a great place for a secret; depending on how the host is handling swap and your tolerance for risk of leakage via ram content recovery.
..larry
> On Apr 21, 2018, at 9:02 AM, Qian Zhang <zh...@gmail.com> wrote:
>
> Hi Aditya,
>
> Yeah, you are right. `hostSecretPath` is a sub-directory under agent's runtime dir, and the default value of agent's runtime dir is `/var/run/mesos` which is a tmpfs. So the secret is written to tmpfs on agent host.
>
>
> Regards,
> Qian Zhang
>
> On Sat, Apr 21, 2018 at 8:19 AM, Aditya Bhave <adityacb@uber.com <ma...@uber.com>> wrote:
> Hi Qian,
>
> Secret is written to file at hostSecretPath which is derived like this:
>
> const string hostSecretPath = path::join(flags.runtime_dir, SECRET_DIR, stringify(id::UUID::random()));
> Also,
> const string hostSecretTmpDir = path::join(flags.runtime_dir, SECRET_DIR);
> Is the hostSecretTmpDir not located on tmpfs? The dir name alludes to this.
>
> Thanks,
> -Aditya
>
> On Fri, Apr 20, 2018 at 5:05 PM, Qian Zhang <zhq527725@gmail.com <ma...@gmail.com>> wrote:
> > When the secret is first downloaded on the mesos agent, it will be stored as "root" on the tmpfs/ramfs before being mounted in the container ramfs.
>
> It seems the secret is not stored on the tmpfs/ramfs on the agent host, we just write it into a file <https://github.com/apache/mesos/blob/1.5.0/src/slave/containerizer/mesos/isolators/volume/secret.cpp#L281> under the agent's runtime directory, and then move it into the ramfs <https://github.com/apache/mesos/blob/1.5.0/src/slave/containerizer/mesos/isolators/volume/secret.cpp#L260:L267> in the container when the container is launched.
>
>
> Regards,
> Qian Zhang
>
> On Fri, Apr 20, 2018 at 2:47 PM, Gilbert Song <gilbert@apache.org <ma...@apache.org>> wrote:
> IIUC, your assumptions are all correct.
>
> @Kapil, could you please confirm? Maybe we could improve the document at the next Docathon.
>
> Gilbert
>
> On Thu, Apr 19, 2018 at 10:57 AM, Zhitao Li <zhitaoli.cs@gmail.com <ma...@gmail.com>> wrote:
> Hello,
>
> We at Uber plan to use volume/secret isolator to send secrets from Uber
> framework to Mesos agent.
>
> For this purpose, we are referring to these documents:
>
> - File based secrets design doc
> <https://docs.google.com/document/d/18raiiUfxTh-JBvjd6RyHe_TOScY87G_bMi5zBzMZmpc/edit# <https://docs.google.com/document/d/18raiiUfxTh-JBvjd6RyHe_TOScY87G_bMi5zBzMZmpc/edit#>>
> and slides
> <http://schd.ws/hosted_files/mesosconasia2017/70/Secrets%20Management%20in%20Mesos.pdf <http://schd.ws/hosted_files/mesosconasia2017/70/Secrets%20Management%20in%20Mesos.pdf>>
> .
> - Apache Mesos secrets documentation
> <http://mesos.apache.org/documentation/latest/secrets/ <http://mesos.apache.org/documentation/latest/secrets/>>
>
> Could you please confirm that the following assumptions are correct?
>
> - Mesos agent and master will never log the secret data at any logging
> level;
> - Mesos agent and master will never expose the secret data as part of
> any API response;
> - Mesos agent and master will never store the secret in any persistent
> storage, but only on tmpfs or ramfs;
> - When the secret is first downloaded on the mesos agent, it will be
> stored as "root" on the tmpfs/ramfs before being mounted in the container
> ramfs.
>
> If above assumptions are true, then I would like to see them documented in
> this as part of the Apache Mesos secrets documentation
> <http://mesos.apache.org/documentation/latest/secrets/ <http://mesos.apache.org/documentation/latest/secrets/>>. Otherwise, we'd
> like to have a design discussion with maintainer of the isolator.
>
> We appreciate your help regarding this. Thanks!
>
> Regards,
> Aditya And Zhitao
>
>
>
>
Re: Questions about secret handling in Mesos
Posted by Qian Zhang <zh...@gmail.com>.
Hi Aditya,
Yeah, you are right. `hostSecretPath` is a sub-directory under agent's
runtime dir, and the default value of agent's runtime dir is `/var/run/mesos`
which is a tmpfs. So the secret is written to tmpfs on agent host.
Regards,
Qian Zhang
On Sat, Apr 21, 2018 at 8:19 AM, Aditya Bhave <ad...@uber.com> wrote:
> Hi Qian,
>
> Secret is written to file at hostSecretPath which is derived like this:
>
> const string hostSecretPath = path::join(flags.runtime_dir, SECRET_DIR,
> stringify(id::UUID::random()));
> Also,
> const string hostSecretTmpDir = path::join(flags.runtime_dir, SECRET_DIR);
> Is the hostSecretTmpDir not located on tmpfs? The dir name alludes to
> this.
>
> Thanks,
> -Aditya
>
> On Fri, Apr 20, 2018 at 5:05 PM, Qian Zhang <zh...@gmail.com> wrote:
>
>> > When the secret is first downloaded on the mesos agent, it will be
>> stored as "root" on the tmpfs/ramfs before being mounted in the container
>> ramfs.
>>
>> It seems the secret is not stored on the tmpfs/ramfs on the agent host,
>> we just write it into a file
>> <https://github.com/apache/mesos/blob/1.5.0/src/slave/containerizer/mesos/isolators/volume/secret.cpp#L281>
>> under the agent's runtime directory, and then move it into the ramfs
>> <https://github.com/apache/mesos/blob/1.5.0/src/slave/containerizer/mesos/isolators/volume/secret.cpp#L260:L267>
>> in the container when the container is launched.
>>
>>
>> Regards,
>> Qian Zhang
>>
>> On Fri, Apr 20, 2018 at 2:47 PM, Gilbert Song <gi...@apache.org> wrote:
>>
>>> IIUC, your assumptions are all correct.
>>>
>>> @Kapil, could you please confirm? Maybe we could improve the document at
>>> the next Docathon.
>>>
>>> Gilbert
>>>
>>> On Thu, Apr 19, 2018 at 10:57 AM, Zhitao Li <zh...@gmail.com>
>>> wrote:
>>>
>>>> Hello,
>>>>
>>>> We at Uber plan to use volume/secret isolator to send secrets from Uber
>>>> framework to Mesos agent.
>>>>
>>>> For this purpose, we are referring to these documents:
>>>>
>>>> - File based secrets design doc
>>>> <https://docs.google.com/document/d/18raiiUfxTh-JBvjd6RyHe_
>>>> TOScY87G_bMi5zBzMZmpc/edit#>
>>>> and slides
>>>> <http://schd.ws/hosted_files/mesosconasia2017/70/Secrets%20
>>>> Management%20in%20Mesos.pdf>
>>>> .
>>>> - Apache Mesos secrets documentation
>>>> <http://mesos.apache.org/documentation/latest/secrets/>
>>>>
>>>> Could you please confirm that the following assumptions are correct?
>>>>
>>>> - Mesos agent and master will never log the secret data at any
>>>> logging
>>>> level;
>>>> - Mesos agent and master will never expose the secret data as part of
>>>> any API response;
>>>> - Mesos agent and master will never store the secret in any
>>>> persistent
>>>> storage, but only on tmpfs or ramfs;
>>>> - When the secret is first downloaded on the mesos agent, it will be
>>>> stored as "root" on the tmpfs/ramfs before being mounted in the
>>>> container
>>>> ramfs.
>>>>
>>>> If above assumptions are true, then I would like to see them documented
>>>> in
>>>> this as part of the Apache Mesos secrets documentation
>>>> <http://mesos.apache.org/documentation/latest/secrets/>. Otherwise,
>>>> we'd
>>>> like to have a design discussion with maintainer of the isolator.
>>>>
>>>> We appreciate your help regarding this. Thanks!
>>>>
>>>> Regards,
>>>> Aditya And Zhitao
>>>>
>>>
>>>
>>
>
Re: Questions about secret handling in Mesos
Posted by Qian Zhang <zh...@gmail.com>.
Hi Aditya,
Yeah, you are right. `hostSecretPath` is a sub-directory under agent's
runtime dir, and the default value of agent's runtime dir is `/var/run/mesos`
which is a tmpfs. So the secret is written to tmpfs on agent host.
Regards,
Qian Zhang
On Sat, Apr 21, 2018 at 8:19 AM, Aditya Bhave <ad...@uber.com> wrote:
> Hi Qian,
>
> Secret is written to file at hostSecretPath which is derived like this:
>
> const string hostSecretPath = path::join(flags.runtime_dir, SECRET_DIR,
> stringify(id::UUID::random()));
> Also,
> const string hostSecretTmpDir = path::join(flags.runtime_dir, SECRET_DIR);
> Is the hostSecretTmpDir not located on tmpfs? The dir name alludes to
> this.
>
> Thanks,
> -Aditya
>
> On Fri, Apr 20, 2018 at 5:05 PM, Qian Zhang <zh...@gmail.com> wrote:
>
>> > When the secret is first downloaded on the mesos agent, it will be
>> stored as "root" on the tmpfs/ramfs before being mounted in the container
>> ramfs.
>>
>> It seems the secret is not stored on the tmpfs/ramfs on the agent host,
>> we just write it into a file
>> <https://github.com/apache/mesos/blob/1.5.0/src/slave/containerizer/mesos/isolators/volume/secret.cpp#L281>
>> under the agent's runtime directory, and then move it into the ramfs
>> <https://github.com/apache/mesos/blob/1.5.0/src/slave/containerizer/mesos/isolators/volume/secret.cpp#L260:L267>
>> in the container when the container is launched.
>>
>>
>> Regards,
>> Qian Zhang
>>
>> On Fri, Apr 20, 2018 at 2:47 PM, Gilbert Song <gi...@apache.org> wrote:
>>
>>> IIUC, your assumptions are all correct.
>>>
>>> @Kapil, could you please confirm? Maybe we could improve the document at
>>> the next Docathon.
>>>
>>> Gilbert
>>>
>>> On Thu, Apr 19, 2018 at 10:57 AM, Zhitao Li <zh...@gmail.com>
>>> wrote:
>>>
>>>> Hello,
>>>>
>>>> We at Uber plan to use volume/secret isolator to send secrets from Uber
>>>> framework to Mesos agent.
>>>>
>>>> For this purpose, we are referring to these documents:
>>>>
>>>> - File based secrets design doc
>>>> <https://docs.google.com/document/d/18raiiUfxTh-JBvjd6RyHe_
>>>> TOScY87G_bMi5zBzMZmpc/edit#>
>>>> and slides
>>>> <http://schd.ws/hosted_files/mesosconasia2017/70/Secrets%20
>>>> Management%20in%20Mesos.pdf>
>>>> .
>>>> - Apache Mesos secrets documentation
>>>> <http://mesos.apache.org/documentation/latest/secrets/>
>>>>
>>>> Could you please confirm that the following assumptions are correct?
>>>>
>>>> - Mesos agent and master will never log the secret data at any
>>>> logging
>>>> level;
>>>> - Mesos agent and master will never expose the secret data as part of
>>>> any API response;
>>>> - Mesos agent and master will never store the secret in any
>>>> persistent
>>>> storage, but only on tmpfs or ramfs;
>>>> - When the secret is first downloaded on the mesos agent, it will be
>>>> stored as "root" on the tmpfs/ramfs before being mounted in the
>>>> container
>>>> ramfs.
>>>>
>>>> If above assumptions are true, then I would like to see them documented
>>>> in
>>>> this as part of the Apache Mesos secrets documentation
>>>> <http://mesos.apache.org/documentation/latest/secrets/>. Otherwise,
>>>> we'd
>>>> like to have a design discussion with maintainer of the isolator.
>>>>
>>>> We appreciate your help regarding this. Thanks!
>>>>
>>>> Regards,
>>>> Aditya And Zhitao
>>>>
>>>
>>>
>>
>
Re: Questions about secret handling in Mesos
Posted by Qian Zhang <zh...@gmail.com>.
> When the secret is first downloaded on the mesos agent, it will be stored
as "root" on the tmpfs/ramfs before being mounted in the container ramfs.
It seems the secret is not stored on the tmpfs/ramfs on the agent host, we
just write it into a file
<https://github.com/apache/mesos/blob/1.5.0/src/slave/containerizer/mesos/isolators/volume/secret.cpp#L281>
under the agent's runtime directory, and then move it into the ramfs
<https://github.com/apache/mesos/blob/1.5.0/src/slave/containerizer/mesos/isolators/volume/secret.cpp#L260:L267>
in the container when the container is launched.
Regards,
Qian Zhang
On Fri, Apr 20, 2018 at 2:47 PM, Gilbert Song <gi...@apache.org> wrote:
> IIUC, your assumptions are all correct.
>
> @Kapil, could you please confirm? Maybe we could improve the document at
> the next Docathon.
>
> Gilbert
>
> On Thu, Apr 19, 2018 at 10:57 AM, Zhitao Li <zh...@gmail.com> wrote:
>
>> Hello,
>>
>> We at Uber plan to use volume/secret isolator to send secrets from Uber
>> framework to Mesos agent.
>>
>> For this purpose, we are referring to these documents:
>>
>> - File based secrets design doc
>> <https://docs.google.com/document/d/18raiiUfxTh-JBvjd6RyHe_
>> TOScY87G_bMi5zBzMZmpc/edit#>
>> and slides
>> <http://schd.ws/hosted_files/mesosconasia2017/70/Secrets%20
>> Management%20in%20Mesos.pdf>
>> .
>> - Apache Mesos secrets documentation
>> <http://mesos.apache.org/documentation/latest/secrets/>
>>
>> Could you please confirm that the following assumptions are correct?
>>
>> - Mesos agent and master will never log the secret data at any logging
>> level;
>> - Mesos agent and master will never expose the secret data as part of
>> any API response;
>> - Mesos agent and master will never store the secret in any persistent
>> storage, but only on tmpfs or ramfs;
>> - When the secret is first downloaded on the mesos agent, it will be
>> stored as "root" on the tmpfs/ramfs before being mounted in the
>> container
>> ramfs.
>>
>> If above assumptions are true, then I would like to see them documented in
>> this as part of the Apache Mesos secrets documentation
>> <http://mesos.apache.org/documentation/latest/secrets/>. Otherwise, we'd
>> like to have a design discussion with maintainer of the isolator.
>>
>> We appreciate your help regarding this. Thanks!
>>
>> Regards,
>> Aditya And Zhitao
>>
>
>
Re: Questions about secret handling in Mesos
Posted by Qian Zhang <zh...@gmail.com>.
> When the secret is first downloaded on the mesos agent, it will be stored
as "root" on the tmpfs/ramfs before being mounted in the container ramfs.
It seems the secret is not stored on the tmpfs/ramfs on the agent host, we
just write it into a file
<https://github.com/apache/mesos/blob/1.5.0/src/slave/containerizer/mesos/isolators/volume/secret.cpp#L281>
under the agent's runtime directory, and then move it into the ramfs
<https://github.com/apache/mesos/blob/1.5.0/src/slave/containerizer/mesos/isolators/volume/secret.cpp#L260:L267>
in the container when the container is launched.
Regards,
Qian Zhang
On Fri, Apr 20, 2018 at 2:47 PM, Gilbert Song <gi...@apache.org> wrote:
> IIUC, your assumptions are all correct.
>
> @Kapil, could you please confirm? Maybe we could improve the document at
> the next Docathon.
>
> Gilbert
>
> On Thu, Apr 19, 2018 at 10:57 AM, Zhitao Li <zh...@gmail.com> wrote:
>
>> Hello,
>>
>> We at Uber plan to use volume/secret isolator to send secrets from Uber
>> framework to Mesos agent.
>>
>> For this purpose, we are referring to these documents:
>>
>> - File based secrets design doc
>> <https://docs.google.com/document/d/18raiiUfxTh-JBvjd6RyHe_
>> TOScY87G_bMi5zBzMZmpc/edit#>
>> and slides
>> <http://schd.ws/hosted_files/mesosconasia2017/70/Secrets%20
>> Management%20in%20Mesos.pdf>
>> .
>> - Apache Mesos secrets documentation
>> <http://mesos.apache.org/documentation/latest/secrets/>
>>
>> Could you please confirm that the following assumptions are correct?
>>
>> - Mesos agent and master will never log the secret data at any logging
>> level;
>> - Mesos agent and master will never expose the secret data as part of
>> any API response;
>> - Mesos agent and master will never store the secret in any persistent
>> storage, but only on tmpfs or ramfs;
>> - When the secret is first downloaded on the mesos agent, it will be
>> stored as "root" on the tmpfs/ramfs before being mounted in the
>> container
>> ramfs.
>>
>> If above assumptions are true, then I would like to see them documented in
>> this as part of the Apache Mesos secrets documentation
>> <http://mesos.apache.org/documentation/latest/secrets/>. Otherwise, we'd
>> like to have a design discussion with maintainer of the isolator.
>>
>> We appreciate your help regarding this. Thanks!
>>
>> Regards,
>> Aditya And Zhitao
>>
>
>
Re: Questions about secret handling in Mesos
Posted by Gilbert Song <gi...@apache.org>.
IIUC, your assumptions are all correct.
@Kapil, could you please confirm? Maybe we could improve the document at
the next Docathon.
Gilbert
On Thu, Apr 19, 2018 at 10:57 AM, Zhitao Li <zh...@gmail.com> wrote:
> Hello,
>
> We at Uber plan to use volume/secret isolator to send secrets from Uber
> framework to Mesos agent.
>
> For this purpose, we are referring to these documents:
>
> - File based secrets design doc
> <https://docs.google.com/document/d/18raiiUfxTh-JBvjd6RyHe_TOScY87G_
> bMi5zBzMZmpc/edit#>
> and slides
> <http://schd.ws/hosted_files/mesosconasia2017/70/Secrets%
> 20Management%20in%20Mesos.pdf>
> .
> - Apache Mesos secrets documentation
> <http://mesos.apache.org/documentation/latest/secrets/>
>
> Could you please confirm that the following assumptions are correct?
>
> - Mesos agent and master will never log the secret data at any logging
> level;
> - Mesos agent and master will never expose the secret data as part of
> any API response;
> - Mesos agent and master will never store the secret in any persistent
> storage, but only on tmpfs or ramfs;
> - When the secret is first downloaded on the mesos agent, it will be
> stored as "root" on the tmpfs/ramfs before being mounted in the
> container
> ramfs.
>
> If above assumptions are true, then I would like to see them documented in
> this as part of the Apache Mesos secrets documentation
> <http://mesos.apache.org/documentation/latest/secrets/>. Otherwise, we'd
> like to have a design discussion with maintainer of the isolator.
>
> We appreciate your help regarding this. Thanks!
>
> Regards,
> Aditya And Zhitao
>
Re: Questions about secret handling in Mesos
Posted by Zhitao Li <zh...@gmail.com>.
Hi Vinod,
I filed a task https://issues.apache.org/jira/browse/MESOS-8909 for this.
If we can agree that this is something worth pursing, I'll try to post some
ideas on whether there is an efficient way to do it.
On Thu, Apr 26, 2018 at 3:32 PM, Vinod Kone <vi...@apache.org> wrote:
> We do direct protobuf to JSON conversion for our API endpoints and I don't
> think we do any special case logic for `Secret` type in that conversion. So
> `value` based secrets will have their value show up in v1 (and likely v0)
> API endpoints.
>
> On Mon, Apr 23, 2018 at 9:25 AM, Zhitao Li <zh...@gmail.com> wrote:
>
>> Hi Alexander,
>>
>> We discovered that in our own testing thus do not plan to use the
>> environment variable. For the `volume/secret` case, I believe it's possible
>> to be careful enough so we do not log that, so it's more about whether we
>> want to promise that.
>>
>> What do you think?
>>
>> On Mon, Apr 23, 2018 at 5:13 AM, Alexander Rojas <alexander@mesosphere.io
>> > wrote:
>>
>>>
>>> Hey Zhitao,
>>>
>>> I sadly have to tell you that the first assumption is not correct. If
>>> you use environment based secrets, docker and verbose mode, they will get
>>> printed (see this patch https://reviews.apache.org/r/57846/). The
>>> reason is that the docker command will get logged and it might contain your
>>> secrets. You may end up with some logging line like:
>>>
>>> ```
>>> I0129 14:09:22.444318 docker.cpp:1139] Running docker -H
>>> unix:///var/run/docker.suck run --cpu-shares 25 --memory 278435456 -e
>>> ADMIN_PASSWORD=test_password …
>>> ```
>>>
>>>
>>> On 19. Apr 2018, at 19:57, Zhitao Li <zh...@gmail.com> wrote:
>>>
>>> Hello,
>>>
>>> We at Uber plan to use volume/secret isolator to send secrets from Uber
>>> framework to Mesos agent.
>>>
>>> For this purpose, we are referring to these documents:
>>>
>>> - File based secrets design doc
>>> <https://docs.google.com/document/d/18raiiUfxTh-JBvjd6RyHe_TOScY87G_bMi5zBzMZmpc/edit#>
>>> and slides
>>> <http://schd.ws/hosted_files/mesosconasia2017/70/Secrets%20Management%20in%20Mesos.pdf>
>>> .
>>> - Apache Mesos secrets documentation
>>> <http://mesos.apache.org/documentation/latest/secrets/>
>>>
>>> Could you please confirm that the following assumptions are correct?
>>>
>>> - Mesos agent and master will never log the secret data at any
>>> logging level;
>>> - Mesos agent and master will never expose the secret data as part
>>> of any API response;
>>> - Mesos agent and master will never store the secret in any
>>> persistent storage, but only on tmpfs or ramfs;
>>> - When the secret is first downloaded on the mesos agent, it will be
>>> stored as "root" on the tmpfs/ramfs before being mounted in the container
>>> ramfs.
>>>
>>> If above assumptions are true, then I would like to see them documented
>>> in this as part of the Apache Mesos secrets documentation
>>> <http://mesos.apache.org/documentation/latest/secrets/>. Otherwise,
>>> we'd like to have a design discussion with maintainer of the isolator.
>>>
>>> We appreciate your help regarding this. Thanks!
>>>
>>> Regards,
>>> Aditya And Zhitao
>>>
>>>
>>>
>>
>>
>> --
>> Cheers,
>>
>> Zhitao Li
>>
>
>
--
Cheers,
Zhitao Li
Re: Questions about secret handling in Mesos
Posted by Vinod Kone <vi...@apache.org>.
We do direct protobuf to JSON conversion for our API endpoints and I don't
think we do any special case logic for `Secret` type in that conversion. So
`value` based secrets will have their value show up in v1 (and likely v0)
API endpoints.
On Mon, Apr 23, 2018 at 9:25 AM, Zhitao Li <zh...@gmail.com> wrote:
> Hi Alexander,
>
> We discovered that in our own testing thus do not plan to use the
> environment variable. For the `volume/secret` case, I believe it's possible
> to be careful enough so we do not log that, so it's more about whether we
> want to promise that.
>
> What do you think?
>
> On Mon, Apr 23, 2018 at 5:13 AM, Alexander Rojas <al...@mesosphere.io>
> wrote:
>
>>
>> Hey Zhitao,
>>
>> I sadly have to tell you that the first assumption is not correct. If you
>> use environment based secrets, docker and verbose mode, they will get
>> printed (see this patch https://reviews.apache.org/r/57846/). The reason
>> is that the docker command will get logged and it might contain your
>> secrets. You may end up with some logging line like:
>>
>> ```
>> I0129 14:09:22.444318 docker.cpp:1139] Running docker -H
>> unix:///var/run/docker.suck run --cpu-shares 25 --memory 278435456 -e
>> ADMIN_PASSWORD=test_password …
>> ```
>>
>>
>> On 19. Apr 2018, at 19:57, Zhitao Li <zh...@gmail.com> wrote:
>>
>> Hello,
>>
>> We at Uber plan to use volume/secret isolator to send secrets from Uber
>> framework to Mesos agent.
>>
>> For this purpose, we are referring to these documents:
>>
>> - File based secrets design doc
>> <https://docs.google.com/document/d/18raiiUfxTh-JBvjd6RyHe_TOScY87G_bMi5zBzMZmpc/edit#>
>> and slides
>> <http://schd.ws/hosted_files/mesosconasia2017/70/Secrets%20Management%20in%20Mesos.pdf>
>> .
>> - Apache Mesos secrets documentation
>> <http://mesos.apache.org/documentation/latest/secrets/>
>>
>> Could you please confirm that the following assumptions are correct?
>>
>> - Mesos agent and master will never log the secret data at any
>> logging level;
>> - Mesos agent and master will never expose the secret data as part of
>> any API response;
>> - Mesos agent and master will never store the secret in any
>> persistent storage, but only on tmpfs or ramfs;
>> - When the secret is first downloaded on the mesos agent, it will be
>> stored as "root" on the tmpfs/ramfs before being mounted in the container
>> ramfs.
>>
>> If above assumptions are true, then I would like to see them documented
>> in this as part of the Apache Mesos secrets documentation
>> <http://mesos.apache.org/documentation/latest/secrets/>. Otherwise, we'd
>> like to have a design discussion with maintainer of the isolator.
>>
>> We appreciate your help regarding this. Thanks!
>>
>> Regards,
>> Aditya And Zhitao
>>
>>
>>
>
>
> --
> Cheers,
>
> Zhitao Li
>
Re: Questions about secret handling in Mesos
Posted by Zhitao Li <zh...@gmail.com>.
Hi Alexander,
We discovered that in our own testing thus do not plan to use the
environment variable. For the `volume/secret` case, I believe it's possible
to be careful enough so we do not log that, so it's more about whether we
want to promise that.
What do you think?
On Mon, Apr 23, 2018 at 5:13 AM, Alexander Rojas <al...@mesosphere.io>
wrote:
>
> Hey Zhitao,
>
> I sadly have to tell you that the first assumption is not correct. If you
> use environment based secrets, docker and verbose mode, they will get
> printed (see this patch https://reviews.apache.org/r/57846/). The reason
> is that the docker command will get logged and it might contain your
> secrets. You may end up with some logging line like:
>
> ```
> I0129 14:09:22.444318 docker.cpp:1139] Running docker -H
> unix:///var/run/docker.suck run --cpu-shares 25 --memory 278435456 -e
> ADMIN_PASSWORD=test_password …
> ```
>
>
> On 19. Apr 2018, at 19:57, Zhitao Li <zh...@gmail.com> wrote:
>
> Hello,
>
> We at Uber plan to use volume/secret isolator to send secrets from Uber
> framework to Mesos agent.
>
> For this purpose, we are referring to these documents:
>
> - File based secrets design doc
> <https://docs.google.com/document/d/18raiiUfxTh-JBvjd6RyHe_TOScY87G_bMi5zBzMZmpc/edit#>
> and slides
> <http://schd.ws/hosted_files/mesosconasia2017/70/Secrets%20Management%20in%20Mesos.pdf>
> .
> - Apache Mesos secrets documentation
> <http://mesos.apache.org/documentation/latest/secrets/>
>
> Could you please confirm that the following assumptions are correct?
>
> - Mesos agent and master will never log the secret data at any logging
> level;
> - Mesos agent and master will never expose the secret data as part of
> any API response;
> - Mesos agent and master will never store the secret in any persistent
> storage, but only on tmpfs or ramfs;
> - When the secret is first downloaded on the mesos agent, it will be
> stored as "root" on the tmpfs/ramfs before being mounted in the container
> ramfs.
>
> If above assumptions are true, then I would like to see them documented in
> this as part of the Apache Mesos secrets documentation
> <http://mesos.apache.org/documentation/latest/secrets/>. Otherwise, we'd
> like to have a design discussion with maintainer of the isolator.
>
> We appreciate your help regarding this. Thanks!
>
> Regards,
> Aditya And Zhitao
>
>
>
--
Cheers,
Zhitao Li
Re: Questions about secret handling in Mesos
Posted by Alexander Rojas <al...@mesosphere.io>.
Hey Zhitao,
I sadly have to tell you that the first assumption is not correct. If you use environment based secrets, docker and verbose mode, they will get printed (see this patch https://reviews.apache.org/r/57846/ <https://reviews.apache.org/r/57846/>). The reason is that the docker command will get logged and it might contain your secrets. You may end up with some logging line like:
```
I0129 14:09:22.444318 docker.cpp:1139] Running docker -H unix:///var/run/docker.suck <unix:///var/run/docker.suck> run --cpu-shares 25 --memory 278435456 -e ADMIN_PASSWORD=test_password …
```
> On 19. Apr 2018, at 19:57, Zhitao Li <zh...@gmail.com> wrote:
>
> Hello,
>
> We at Uber plan to use volume/secret isolator to send secrets from Uber framework to Mesos agent.
>
> For this purpose, we are referring to these documents:
> File based secrets design doc <https://docs.google.com/document/d/18raiiUfxTh-JBvjd6RyHe_TOScY87G_bMi5zBzMZmpc/edit#>and slides <http://schd.ws/hosted_files/mesosconasia2017/70/Secrets%20Management%20in%20Mesos.pdf>.
> Apache Mesos secrets documentation <http://mesos.apache.org/documentation/latest/secrets/>
> Could you please confirm that the following assumptions are correct?
> Mesos agent and master will never log the secret data at any logging level;
> Mesos agent and master will never expose the secret data as part of any API response;
> Mesos agent and master will never store the secret in any persistent storage, but only on tmpfs or ramfs;
> When the secret is first downloaded on the mesos agent, it will be stored as "root" on the tmpfs/ramfs before being mounted in the container ramfs.
> If above assumptions are true, then I would like to see them documented in this as part of the Apache Mesos secrets documentation <http://mesos.apache.org/documentation/latest/secrets/>. Otherwise, we'd like to have a design discussion with maintainer of the isolator.
>
> We appreciate your help regarding this. Thanks!
>
> Regards,
> Aditya And Zhitao
Re: Questions about secret handling in Mesos
Posted by Gilbert Song <gi...@apache.org>.
IIUC, your assumptions are all correct.
@Kapil, could you please confirm? Maybe we could improve the document at
the next Docathon.
Gilbert
On Thu, Apr 19, 2018 at 10:57 AM, Zhitao Li <zh...@gmail.com> wrote:
> Hello,
>
> We at Uber plan to use volume/secret isolator to send secrets from Uber
> framework to Mesos agent.
>
> For this purpose, we are referring to these documents:
>
> - File based secrets design doc
> <https://docs.google.com/document/d/18raiiUfxTh-JBvjd6RyHe_TOScY87G_
> bMi5zBzMZmpc/edit#>
> and slides
> <http://schd.ws/hosted_files/mesosconasia2017/70/Secrets%
> 20Management%20in%20Mesos.pdf>
> .
> - Apache Mesos secrets documentation
> <http://mesos.apache.org/documentation/latest/secrets/>
>
> Could you please confirm that the following assumptions are correct?
>
> - Mesos agent and master will never log the secret data at any logging
> level;
> - Mesos agent and master will never expose the secret data as part of
> any API response;
> - Mesos agent and master will never store the secret in any persistent
> storage, but only on tmpfs or ramfs;
> - When the secret is first downloaded on the mesos agent, it will be
> stored as "root" on the tmpfs/ramfs before being mounted in the
> container
> ramfs.
>
> If above assumptions are true, then I would like to see them documented in
> this as part of the Apache Mesos secrets documentation
> <http://mesos.apache.org/documentation/latest/secrets/>. Otherwise, we'd
> like to have a design discussion with maintainer of the isolator.
>
> We appreciate your help regarding this. Thanks!
>
> Regards,
> Aditya And Zhitao
>