You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cloudstack.apache.org by "benj-n (via GitHub)" <gi...@apache.org> on 2024/07/22 20:26:01 UTC
[D] Mandatory to have management service listening on IP on default NIC? [cloudstack]
GitHub user benj-n created a discussion: Mandatory to have management service listening on IP on default NIC?
Hi,
In the recent changes related to security [1], some certificate validation has been introduced:
"Validate incoming cluster service requests are from peer management servers based on the server's certificate dns name"
As a matter of fact, those certificates also contain IP addresses in the SAN field.
However, it looks like the IP addresses are extracted from the default NIC only [2].
As I understand it, that means, from now on, if we want to use IP for cross-management and management-hosts communication, then it is mandatory to have the management service listening on an IP on the default NIC (the one holding the route to the default gateway). Otherwise, certificates won't be validated.
Am I reading this right?
Any other people with such deployments (e.g. using an IP from a second interface) ? Did you find a way to circumvent this?
Thank you,
-Benjamin.
[1] [commit/2cf838cc1d19298fe874b6abfcc9bbf88c7c6e49](https://github.com/apache/cloudstack/commit/2cf838cc1d19298fe874b6abfcc9bbf88c7c6e49)
[2] [RootCAProvider.java](https://github.com/apache/cloudstack/blob/9f4c8959743d2f53faae6fc5d68e88ddc20e21a3/plugins/ca/root-ca/src/main/java/org/apache/cloudstack/ca/provider/RootCAProvider.java#L378)
GitHub link: https://github.com/apache/cloudstack/discussions/9429
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Mandatory to have management service listening on IP on default NIC? [cloudstack]
Posted by "JoaoJandre (via GitHub)" <gi...@apache.org>.
GitHub user JoaoJandre closed the discussion with a comment: Mandatory to have management service listening on IP on default NIC?
Hello @rohityadavcloud and @benj-n, actually since 4.19 (see #7728) you can inform the CIDR of your management network in the `management.network.cidr` configuration and ACS will add the MGMT's IP in this network as an alternative name in the self-signed certificate, even if the network is not the default network for your management nodes.
GitHub link: https://github.com/apache/cloudstack/discussions/9429#discussioncomment-12997276
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Mandatory to have management service listening on IP on default NIC? [cloudstack]
Posted by "rohityadavcloud (via GitHub)" <gi...@apache.org>.
GitHub user rohityadavcloud added a comment to the discussion: Mandatory to have management service listening on IP on default NIC?
@benj-n per https://github.com/apache/cloudstack/blob/main/plugins/ca/root-ca/src/main/java/org/apache/cloudstack/ca/provider/RootCAProvider.java#L372 the mgmt server certificate should have all the IPs of the default nic - this is only used to communicate b/w mgmt server - mgmt server & not b/w agent (kvm host) & mgmt server. What you can do it to keep the default nic of your mgmt server hosts on the same subnet/cidr.
GitHub link: https://github.com/apache/cloudstack/discussions/9429#discussioncomment-10144552
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] Mandatory to have management service listening on IP on default NIC? [cloudstack]
Posted by "benj-n (via GitHub)" <gi...@apache.org>.
GitHub user benj-n closed a discussion: Mandatory to have management service listening on IP on default NIC?
Hi,
In the recent changes related to security [1], some certificate validation has been introduced:
"Validate incoming cluster service requests are from peer management servers based on the server's certificate dns name"
As a matter of fact, those certificates also contain IP addresses in the SAN field.
However, it looks like the IP addresses are extracted from the default NIC only [2].
As I understand it, that means, from now on, if we want to use IP for cross-management and management-hosts communication, then it is mandatory to have the management service listening on an IP on the default NIC (the one holding the route to the default gateway). Otherwise, certificates won't be validated.
Am I reading this right?
Any other people with such deployments (e.g. using an IP from a second interface) ? Did you find a way to circumvent this?
Thank you,
-Benjamin.
[1] [commit/2cf838cc1d19298fe874b6abfcc9bbf88c7c6e49](https://github.com/apache/cloudstack/commit/2cf838cc1d19298fe874b6abfcc9bbf88c7c6e49)
[2] [RootCAProvider.java](https://github.com/apache/cloudstack/blob/9f4c8959743d2f53faae6fc5d68e88ddc20e21a3/plugins/ca/root-ca/src/main/java/org/apache/cloudstack/ca/provider/RootCAProvider.java#L378)
GitHub link: https://github.com/apache/cloudstack/discussions/9429
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org