-
Notifications
You must be signed in to change notification settings - Fork 88
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Storage Configuration - Renewal of cloud storage credentials #423
base: development
Are you sure you want to change the base?
Storage Configuration - Renewal of cloud storage credentials #423
Conversation
<xs:documentation>CertPathValidationPolicyID used to validate the renewal endpoint server certificate. If CertPathValidationPolicyID is not configured, the certificate shall not be validated.</xs:documentation> | ||
</xs:annotation> | ||
</xs:element> | ||
<xs:element name="Error" type="xs:string" minOccurs="0"> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
When is this going to be used?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@jmelancongen I just approved #424 and I agree with @ubkr please re-review that PR and update this accordingly. Many kind thanks.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Oh, accidentally resolved the comment early.
This follows the recent PR from Hans #419 so we have at least available information in case the renewal flow breaks unexpectedly. The client will be able to retrieve that error and help narrow down the issue.
To be Added: An OpenAPI document defining the schema of the response that device should expect from the API |
@@ -336,6 +336,11 @@ IN NO EVENT WILL THE CORPORATION OR ITS MEMBERS OR THEIR AFFILIATES BE LIABLE FO | |||
<xs:documentation>Indicates maximum number of storage configurations supported.</xs:documentation> | |||
</xs:annotation> | |||
</xs:attribute> | |||
<xs:attribute name="StorageConfigurationRenewal" type="xs:boolean"> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should this be StorageConfigurationCredentialRenewal as storage configuration is quite a big entity holding lot of configuration fields?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The renewal includes the server uris also, so it felt a bit larger than just credentials. But I'm open to it
@@ -336,6 +336,11 @@ IN NO EVENT WILL THE CORPORATION OR ITS MEMBERS OR THEIR AFFILIATES BE LIABLE FO | |||
<xs:documentation>Indicates maximum number of storage configurations supported.</xs:documentation> | |||
</xs:annotation> | |||
</xs:attribute> | |||
<xs:attribute name="StorageConfigurationRenewal" type="xs:boolean"> | |||
<xs:annotation> | |||
<xs:documentation>Indicates support for renewal of storage configuration.</xs:documentation> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If above comment is accepted, documentation may need to reflect the same?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
added feedback
With the current specification, a cloud provider must continuously renew the credentials assigned to a device using the SetStorageConfiguration API. This means that a cloud provider must keep track of all devices and attempt to refresh this configuration, generally over Uplink, regularly to ensure that there is no loss of recording.
Instead of a manual procedure by the cloud provider, we propose that the device manage the lifecycle of its credentials on its own, by accepting an endpoint to a simple API that provides credentials to the device on-demand. This will allow the device to refresh credentials much faster in case of outages, where the device comes back online after a while and wants to resume recording as quickly as possible.