Open Stack

> Since you really never want your VMs blocking, I'd suggest just telling
> qemu to use urandom; you can pass it as a parameter to
>    -object rng-random

I think that's probably part of the debate isn't it - if you don't have enough entropy, do you still want to run your VM/container, or do you want to block (or fail after some suitable time) if there is not enough entropy.
I'm presuming not having enough entropy will result in some potential security implications such as weakening to brute force and side channel attacks etc.

For the 'block until there is entropy' option - and I guess this depends what is blocking at current (is it the kernel or the agent) - could we get the agent to bring up the grpc interface and then stall launching the actual container workload until enough entropy is available? (and have that option and the limits set in the kata config file).
> 
> Dave
Graham

---------------------------------------------------------------------
Intel Corporation (UK) Limited
Registered No. 1134945 (England)
Registered Office: Pipers Way, Swindon SN3 1RJ
VAT No: 860 2173 47

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.