openstack-security

OpenStack Security Operations

Security posture management for OpenStack requires defense-in-depth: no single control prevents all threats, so multiple overlapping layers protect the cloud. The defense layers are network segmentation (isolate management from tenant from external traffic), TLS everywhere (encrypt all API communication), RBAC least-privilege (users and services get only the permissions they need), and audit logging (record every authentication and authorization decision).

Security is not a one-time deployment task. Certificates expire. Vulnerabilities are disclosed. Passwords must rotate. Security groups drift. The GUARD agent consumes this skill for continuous security posture assessment, evaluating whether the cloud's security controls remain effective against evolving threats.

In NASA SE terms, security spans multiple phases: Phase B (security design and architecture), Phase C (certificate generation and TLS deployment), Phase D (security audit verification), and Phase E (ongoing security operations). SP-6105 SS 6.4 (Technical Risk Management) provides the framework for identifying, assessing, and mitigating security risks throughout the cloud lifecycle.

Deploy

Security-First Deployment

Kolla-Ansible TLS configuration (globals.yml):

# Enable TLS on all interfaces
kolla_enable_tls_internal: "yes"
kolla_enable_tls_external: "yes"
kolla_copy_ca_into_containers: "yes"

# Certificate paths
kolla_external_fqdn_cert: "/etc/kolla/certificates/haproxy.pem"
kolla_internal_fqdn_cert: "/etc/kolla/certificates/haproxy-internal.pem"
kolla_admin_openrc_cacert: "/etc/kolla/certificates/ca/root.crt"

# Optional: client certificate verification
kolla_enable_tls_backend: "yes"  # Encrypt HAProxy-to-service traffic

Generating certificates:

# Self-signed CA (lab/development)
mkdir -p /etc/kolla/certificates/ca
openssl genrsa -out /etc/kolla/certificates/ca/root.key 4096
openssl req -x509 -new -nodes -key /etc/kolla/certificates/ca/root.key \
  -sha256 -days 3650 -out /etc/kolla/certificates/ca/root.crt \
  -subj "/C=US/ST=Lab/O=OpenStack/CN=Kolla-CA"

# HAProxy certificate (external)
openssl genrsa -out /etc/kolla/certificates/haproxy.key 2048
openssl req -new -key /etc/kolla/certificates/haproxy.key \
  -out /etc/kolla/certificates/haproxy.csr \
  -subj "/C=US/ST=Lab/O=OpenStack/CN=${KOLLA_EXTERNAL_FQDN}" \
  -addext "subjectAltName=DNS:${KOLLA_EXTERNAL_FQDN},IP:${KOLLA_EXTERNAL_VIP}"

openssl x509 -req -in /etc/kolla/certificates/haproxy.csr \
  -CA /etc/kolla/certificates/ca/root.crt \
  -CAkey /etc/kolla/certificates/ca/root.key \
  -CAcreateserial -out /etc/kolla/certificates/haproxy.crt \
  -days 365 -sha256

# Combine into PEM (required by HAProxy)
cat /etc/kolla/certificates/haproxy.crt \
    /etc/kolla/certificates/haproxy.key \
    > /etc/kolla/certificates/haproxy.pem

# Internal certificate (same process with internal FQDN/VIP)
# ... repeat with kolla_internal_fqdn and kolla_internal_vip

HAProxy TLS termination:

HAProxy handles TLS for all OpenStack API endpoints. Kolla-Ansible configures this automatically when TLS is enabled. Verify:

# Check HAProxy is serving TLS
openssl s_client -connect ${KOLLA_EXTERNAL_VIP}:443 -showcerts </dev/null 2>/dev/null | head -20

# Verify certificate chain
openssl s_client -connect ${KOLLA_EXTERNAL_VIP}:5000 -CAfile /etc/kolla/certificates/ca/root.crt </dev/null 2>/dev/null | grep "Verify return code"
# Expected: Verify return code: 0 (ok)

Firewall rules for management network:

# Allow only necessary ports on management interface
firewall-cmd --zone=management --add-service=ssh --permanent
firewall-cmd --zone=management --add-port=5000/tcp --permanent  # Keystone
firewall-cmd --zone=management --add-port=8774/tcp --permanent  # Nova
firewall-cmd --zone=management --add-port=9696/tcp --permanent  # Neutron
firewall-cmd --zone=management --add-port=8776/tcp --permanent  # Cinder
firewall-cmd --zone=management --add-port=9292/tcp --permanent  # Glance
firewall-cmd --zone=management --add-port=8080/tcp --permanent  # Swift
firewall-cmd --zone=management --add-port=8004/tcp --permanent  # Heat
firewall-cmd --zone=management --add-port=443/tcp --permanent   # Horizon
firewall-cmd --zone=management --add-port=3000/tcp --permanent  # Grafana
firewall-cmd --zone=management --add-port=9090/tcp --permanent  # Prometheus
firewall-cmd --reload

# Default deny on all other ports
firewall-cmd --zone=management --set-target=DROP --permanent
firewall-cmd --reload

Security group defaults:

# Create restrictive default security group rules
openstack security group rule delete $(openstack security group rule list default -f value -c ID)
# Start with no rules (default deny)

# Add only SSH and ICMP for management
openstack security group rule create --protocol tcp --dst-port 22 --remote-ip 10.0.0.0/8 default
openstack security group rule create --protocol icmp default

Configure

Certificate Lifecycle Management

Certificate inventory:

| Certificate | Location | Expiry | Rotation Frequency | |-------------|----------|--------|-------------------| | CA root | /etc/kolla/certificates/ca/root.crt | 10 years | Rarely (re-sign all on rotation) | | HAProxy external | /etc/kolla/certificates/haproxy.pem | 1 year | Annually (or before expiry) | | HAProxy internal | /etc/kolla/certificates/haproxy-internal.pem | 1 year | Annually | | Service backend | Per-service in /etc/kolla/<service>/ | 1 year | Annually |

Expiry monitoring:

#!/bin/bash
# check-cert-expiry.sh -- alert on certificates expiring within 30 days
THRESHOLD_DAYS=30
THRESHOLD_SECS=$((THRESHOLD_DAYS * 86400))

for cert in /etc/kolla/certificates/*.pem /etc/kolla/certificates/*.crt; do
  [ -f "$cert" ] || continue
  expiry=$(openssl x509 -in "$cert" -noout -enddate 2>/dev/null | cut -d= -f2)
  expiry_epoch=$(date -d "$expiry" +%s 2>/dev/null)
  now_epoch=$(date +%s)
  remaining=$((expiry_epoch - now_epoch))

  if [ $remaining -lt $THRESHOLD_SECS ]; then
    echo "WARNING: $cert expires in $((remaining / 86400)) days ($expiry)"
  fi
done

Rotation procedure:

# 1. Generate new certificate (see Deploy section)
# 2. Replace PEM file
cp /etc/kolla/certificates/haproxy-new.pem /etc/kolla/certificates/haproxy.pem

# 3. Reconfigure HAProxy to pick up new cert
kolla-ansible -i inventory reconfigure --tags haproxy

# 4. Verify
openssl s_client -connect ${KOLLA_EXTERNAL_VIP}:443 </dev/null 2>/dev/null | openssl x509 -noout -dates

RBAC Policy Customization

Per-service policy files:

Each OpenStack service has a policy.yaml (or policy.json) that defines authorization rules:

# Location: /etc/kolla/<service>/policy.yaml
# Kolla-Ansible merges custom policies with code defaults

# Example: Keystone -- restrict user creation to domain admins
# /etc/kolla/keystone/policy.yaml
"identity:create_user": "rule:admin_required and domain_id:%(target.user.domain_id)s"

# Example: Nova -- restrict flavor management to cloud admins
# /etc/kolla/nova/policy.yaml
"os_compute_api:os-flavor-manage": "role:admin and is_admin_project:True"

# Example: Neutron -- restrict external network creation
# /etc/kolla/neutron/policy.yaml
"create_network:router:external": "role:admin"

Best practices:

• Start with defaults; override only what you need
• Document every policy override with rationale
• Test policy changes with a non-admin user before deploying
• Use oslopolicy-checker to validate policy files

# Validate policy syntax
docker exec nova_api oslopolicy-checker --policy /etc/nova/policy.yaml

Network Segmentation

| Network | Purpose | VLAN/Subnet | Access Control | |---------|---------|-------------|---------------| | Management | API endpoints, admin access | VLAN 100 / 10.0.100.0/24 | Firewall: SSH + API ports only | | Tenant (overlay) | VM-to-VM traffic | VXLAN / 10.0.1.