/security

name: openstack-security
description: "OpenStack security operations skill for hardening, certificate management, and security posture assessment of cloud infrastructure. Covers TLS certificate lifecycle (generation, deployment, rotation, expiry monitoring), security group management (default deny, minimum required openings), RBAC policy customization (per-service policy.yaml), network segmentation (management vs tenant vs external), audit logging (Keystone CADF events), vulnerability assessment procedures, compliance auditing, intrusion detection patterns, incident response procedures (credential compromise, instance compromise), password rotation, and API rate limiting. Use when hardening OpenStack, managing certificates, auditing security posture, or responding to security incidents."
user-invocable: true
allowed-tools: Read Grep Glob
metadata:
  extensions:
    gsd-skill-creator:
      version: 1
      createdAt: "2026-02-22"
      triggers:
        intents:
          - "security"
          - "hardening"
          - "certificate"
          - "TLS"
          - "CVE"
          - "vulnerability"
          - "compliance"
          - "audit"
          - "firewall"
          - "security group"
          - "RBAC"
        contexts:
          - "hardening openstack"
          - "managing certificates"
          - "security auditing"
          - "responding to security incident"

OpenStack Security Operations

Security posture management for OpenStack requires defense-in-depth: no single control prevents all threats, so multiple overlapping layers protect the cloud. The defense layers are **network segmentation** (isolate management from tenant from external traffic), **TLS everywhere** (encrypt all API communication), **RBAC least-privilege** (users and services get only the permissions they need), and **audit logging** (record every authentication and authorization decision).

Security is not a one-time deployment task. Certificates expire. Vulnerabilities are disclosed. Passwords must rotate. Security groups drift. The GUARD agent consumes this skill for continuous security posture assessment, evaluating whether the cloud's security controls remain effective against evolving threats.

In NASA SE terms, security spans multiple phases: **Phase B** (security design and architecture), **Phase C** (certificate generation and TLS deployment), **Phase D** (security audit verification), and **Phase E** (ongoing security operations). SP-6105 SS 6.4 (Technical Risk Management) provides the framework for identifying, assessing, and mitigating security risks throughout the cloud lifecycle.

Deploy

Security-First Deployment

**Kolla-Ansible TLS configuration (globals.yml):**

# Enable TLS on all interfaces
kolla_enable_tls_internal: "yes"
kolla_enable_tls_external: "yes"
kolla_copy_ca_into_containers: "yes"

# Certificate paths
kolla_external_fqdn_cert: "/etc/kolla/certificates/haproxy.pem"
kolla_internal_fqdn_cert: "/etc/kolla/certificates/haproxy-internal.pem"
kolla_admin_openrc_cacert: "/etc/kolla/certificates/ca/root.crt"

# Optional: client certificate verification
kolla_enable_tls_backend: "yes"  # Encrypt HAProxy-to-service traffic

**Generating certificates:**

# Self-signed CA (lab/development)
mkdir -p /etc/kolla/certificates/ca
openssl genrsa -out /etc/kolla/certificates/ca/root.key 4096
openssl req -x509 -new -nodes -key /etc/kolla/certificates/ca/root.key \
  -sha256 -days 3650 -out /etc/kolla/certificates/ca/root.crt \
  -subj "/C=US/ST=Lab/O=OpenStack/CN=Kolla-CA"

# HAProxy certificate (external)
openssl genrsa -out /etc/kolla/certificates/haproxy.key 2048
openssl req -new -key /etc/kolla/certificates/haproxy.key \
  -out /etc/kolla/certificates/haproxy.csr \
  -subj "/C=US/ST=Lab/O=OpenStack/CN=${KOLLA_EXTERNAL_FQDN}" \
  -addext "subjectAltName=DNS:${KOLLA_EXTERNAL_FQDN},IP:${KOLLA_EXTERNAL_VIP}"

openssl x509 -req -in /etc/kolla/certificates/haproxy.csr \
  -CA /etc/kolla/certificates/ca/root.crt \
  -CAkey /etc/kolla/certificates/ca/root.key \
  -CAcreateserial -out /etc/kolla/certificates/haproxy.crt \
  -days 365 -sha256

# Combine into PEM (required by HAProxy)
cat /etc/kolla/certificates/haproxy.crt \
    /etc/kolla/certificates/haproxy.key \
    > /etc/kolla/certificates/haproxy.pem

# Internal certificate (same process with internal FQDN/VIP)
# ... repeat with kolla_internal_fqdn and kolla_internal_vip

**HAProxy TLS termination:**

HAProxy handles TLS for all OpenStack API endpoints. Kolla-Ansible configures this automatically when TLS is enabled. Verify:

# Check HAProxy is serving TLS
openssl s_client -connect ${KOLLA_EXTERNAL_VIP}:443 -showcerts </dev/null 2>/dev/null | head -20

# Verify certificate chain
openssl s_client -connect ${KOLLA_EXTERNAL_VIP}:5000 -CAfile /etc/kolla/certificates/ca/root.crt </dev/null 2>/dev/null | grep "Verify return code"
# Expected: Verify return code: 0 (ok)

**Firewall rules for management network:**

# Allow only necessary ports on management interface
firewall-cmd --zone=management --add-service=ssh --permanent
firewall-cmd --zone=management --add-port=5000/tcp --permanent  # Keystone
firewall-cmd --zone=management --add-port=8774/tcp --permanent  # Nova
firewall-cmd --zone=management --add-port=9696/tcp --permanent  # Neutron
firewall-cmd --zone=management --add-port=8776/tcp --permanent  # Cinder
firewall-cmd --zone=management --add-port=9292/tcp --permanent  # Glance
firewall-cmd --zone=management --add-port=8080/tcp --permanent  # Swift
firewall-cmd --zone=management --add-port=8004/tcp --permanent  # Heat
firewall-cmd --zone=management --add-port=443/tcp --permanent   # Horizon
firewall-cmd --zone=management --add-port=3000/tcp --permanent  # Grafana
firewall-cmd --zone=management --add-port=9090/tcp --permanent  # Prometheus
firewall-cmd --reload

# Default deny on all other ports
firewall-cmd --zone=management --set-target=DROP --permanent
firewall-cmd --reload

**Sec