Subject: [Anima-bootstrap] Scope question

From: Brian E Carpenter <[email-masked]>
Date: Mon, 06 Jul 2015 11:34:43 +1200

The design team charter at
http://trac.tools.ietf.org/wg/anima/trac/wiki/Bootstrap%20Design%20Team%20Charter
leaves two scope questions open for me.

1. Is the scope *all* nodes in a network, or only the nodes taking
part in autonomic operations (i.e. nodes that are part of the ACP
and/or run Anima signaling)?

2. Is the scope limited to physical nodes? Or in other words, do
entities like virtual machines or ASAs inherit credentials from
the physical node containing them?

Regards
   Brian

---

From: Michael Richardson <[email-masked]>
Date: Sun, 05 Jul 2015 20:54:34 -0400

> 1. Is the scope *all* nodes in a network, or only the nodes taking part
    > in autonomic operations (i.e. nodes that are part of the ACP and/or run
    > Anima signaling)?

Only those taking part autonomic operation...

    > entities like virtual machines or ASAs inherit credentials from the
    > physical node containing them?

While I would expect ASAs running on a node to have some kind of access to
the hosts credentials, but we should consider possibility that we need to
issue additional (transitive) credentials to individual ASAs.

As for virtual machines running on a host, in general, they would have to
join the ACP through their own seperate bootstrap process.  As they don't
have vendors, it could be that they would be provisioned through the same
transitive process as the ASAs, once we figure out how to do that.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Toerless Eckert <[email-masked]>
Date: Sun, 5 Jul 2015 20:29:51 -0700

To keep us focussed on moving towards RFCs, i would first
look into the following Prio1:

Prio1, in charter: Bootstrap of certificate on physical 
devices that are AN devices: bootstrap+signaling+ACP+ASA sharing
the certificate.

And then beyond it:

PrioN > 1, in charter: Bootstrap for logical autonomic devices/VMs/ASA
that need separate certificates from the underlying system.

Outside current charter: Reuse of bootstrap in non-AN devices -
eg: without the rest of autonomic and potentially with different
protocols. 

Cheers
    Toerless

On Mon, Jul 06, 2015 at 11:34:43AM +1200, Brian E Carpenter wrote:
> _______________________________________________
> Anima-bootstrap mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/anima-bootstrap

---

From: "Michael Behringer (mbehring)" <[email-masked]>
Date: Sun, 19 Jul 2015 15:18:14 +0000

> -----Original Message-----
> From: Anima-bootstrap [mailto:[email-masked]] On
> Behalf Of Michael Richardson
> Sent: 06 July 2015 02:55
> To: [email-masked]
> Subject: Re: [Anima-bootstrap] Scope question
[...]
> issue additional (transitive) credentials to individual ASAs.

Hmmm... Can you expand on that? So far I'm thinking of a node (virtual or real) to have an identity, and an ASA in my mind is like an application. When would we need a cert for an ASA? 
 
Michael