Language / Язык: English | Русский
This project is a laboratory simulator, not a production OpenStack cloud.
- Default passwords (
secret) are intentional for labs. TICKET_SIGNING_KEY/secret.ticketSigningKeymust be rotated before any shared or internet-facing deployment.- Bundled Postgres passwords in values/compose are lab defaults.
| Surface | Risk |
|---|---|
Compose ports on 0.0.0.0 |
Entire API surface reachable on the host |
| Helm Ingress | Public HTTPS to Keystone/UI; other OS ports need explicit exposure |
| Read-only root FS (Helm) | Reduces container write surface |
- Compose: optional nginx TLS on
:443with lab cert underdocker/tls/ - Helm: terminate TLS at Ingress + cert-manager (recommended)
- Real Keystone federation / Fernet key rotation semantics
- oslo.policy rule parity
- Multi-tenant isolation beyond project_id filters in handlers
Treat all data as disposable lab fixtures.