OpenStack Designate Charm

feature: support for hardening library in designate charm

Bug #1659803 reported by Tytus Kurek
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Designate Charm
Triaged
Medium
Unassigned

Bug Description

Currently designate charm is missing support for hardening library. As Ubuntu OpenStack reference architecture recommends running ALL services (including non-core services) excluding Nova Compute, Ceph OSD and Neutron Gateway inside of LXD containers, it is impossible to achieve fully hardened OpenStack infrastructure because of this limitation. In order to resolved that, a support for hardening library should be added to designate charm.

P.S.: I am not able to report this bug under https://bugs.launchpad.net/charms/+source/designate/+filebug

Tags: cpe-onsite
Colin Watson (cjwatson)
affects: launchpad → charm-designate
Revision history for this message
Dmitrii Shcherbakov (dmitriis) wrote :

Steps to do this:
https://bazaar.launchpad.net/~charm-helpers/charm-helpers/devel/view/head:/charmhelpers/contrib/hardening/README.hardening.md

On the hardening framework itself
https://github.com/hardening-io (moved to github.com/dev-sec)

https://github.com/dev-sec
http://dev-sec.io/docs/

OS https://github.com/dev-sec/linux-baseline https://github.com/dev-sec/linux-patch-baseline
SSH https://github.com/dev-sec/ssh-baseline

MySQL https://github.com/dev-sec/mysql-baseline

Apache https://github.com/dev-sec/apache-baseline

Changed in charm-designate:
status: New → Confirmed
Revision history for this message
James Page (james-page) wrote :

We'll probably want to work this into charms.openstack and the base openstack charm layer; that way we can enable it globally across all new reactive charms.

Changed in charm-designate:
importance: Undecided → Wishlist
summary: - Missing support for hardening library in designate charm
+ feature: support for hardening library in designate charm
Changed in charm-designate:
status: Confirmed → Triaged
importance: Wishlist → Medium
Tytus Kurek (tkurek)
tags: added: cpe-onsite
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.