inecs
6033967e6a
Ship Keystone auth, multi-service handlers (Yoga→Dalmatian), Compose/Helm packaging, API contract packs, and pytest/Pulumi coverage labs.
1.0 KiB
1.0 KiB
Language / Язык: English | Русский
Security
This project is a laboratory simulator, not a production OpenStack cloud.
Trust boundary
- Default passwords (
secret) are intentional for labs. TICKET_SIGNING_KEY/secret.ticketSigningKeymust be rotated before any shared or internet-facing deployment.- Bundled Postgres passwords in values/compose are lab defaults.
Network exposure
| Surface | Risk |
|---|---|
Compose ports on 0.0.0.0 |
Entire API surface reachable on the host |
| Helm Ingress | Public HTTPS to Keystone/UI; other OS ports need explicit exposure |
| Read-only root FS (Helm) | Reduces container write surface |
TLS
- Compose: optional nginx TLS on
:443with lab cert underdocker/tls/ - Helm: terminate TLS at Ingress + cert-manager (recommended)
What is not implemented
- Real Keystone federation / Fernet key rotation semantics
- oslo.policy rule parity
- Multi-tenant isolation beyond project_id filters in handlers
Treat all data as disposable lab fixtures.