CentOS 7
Sponsored Link

OpenStack Pike : How to use Barbican2017/09/10

 
How to use the OpenStack Key Manager Service (Barbican).
This example is based on the emvironment like follows.
     ------------+---------------------------+---------------------------+------------
                 |                           |                           |
             eth0|10.0.0.30              eth0|10.0.0.50              eth0|10.0.0.51
     +-----------+-----------+   +-----------+-----------+   +-----------+-----------+
     |    [ Control Node ]   |   |    [ Network Node ]   |   |    [ Compute Node ]   |
     |                       |   |                       |   |                       |
     |  MariaDB    RabbitMQ  |   |      Open vSwitch     |   |        Libvirt        |
     |  Memcached  httpd     |   |        L2 Agent       |   |     Nova Compute      |
     |  Keystone   Glance    |   |        L3 Agent       |   |      Open vSwitch     |
     |  Nova API             |   |     Metadata Agent    |   |        L2 Agent       |
     |  Neutron Server       |   |     Cinder-Volume     |   |                       |
     |  Metadata Agent       |   |                       |   |                       |
     |  Cinder API           |   |                       |   |                       |
     |  Barbican API         |   |                       |   |                       |
     +-----------------------+   +-----------------------+   +-----------------------+

[1] Here is the basic usage of Barbican.
# store a key : --name [key's name] --payload [key's data]

[root@dlp ~(keystone)]#
openstack secret store --name secret01 --payload secretkey

+---------------+-----------------------------------------------------------------------+
| Field         | Value                                                                 |
+---------------+-----------------------------------------------------------------------+
| Secret href   | http://10.0.0.30:9311/v1/secrets/905e6796-f8e9-4db2-85c5-eaacff594f35 |
| Name          | secret01                                                              |
| Created       | None                                                                  |
| Status        | None                                                                  |
| Content types | None                                                                  |
| Algorithm     | aes                                                                   |
| Bit length    | 256                                                                   |
| Secret type   | opaque                                                                |
| Mode          | cbc                                                                   |
| Expiration    | None                                                                  |
+---------------+-----------------------------------------------------------------------+

# show key list

[root@dlp ~(keystone)]#
openstack secret list

+-----------------------------------------------------------------------+----------
| Secret href                                                           | Name     
+-----------------------------------------------------------------------+----------
| http://10.0.0.30:9311/v1/secrets/905e6796-f8e9-4db2-85c5-eaacff594f35 | secret01 
+-----------------------------------------------------------------------+----------
+---------------------------+--------+-----------------------------+-----------
| Created                   | Status | Content types               | Algorithm 
+---------------------------+--------+-----------------------------+-----------
| 2017-09-11T01:36:22+00:00 | ACTIVE | {u'default': u'text/plain'} | aes       
+---------------------------+--------+-----------------------------+-----------
+------------+-------------+------+------------+
| Bit length | Secret type | Mode | Expiration |
+------------+-------------+------+------------+
|        256 | opaque      | cbc  | None       |
+------------+-------------+------+------------+

# get metadata of a key

[root@dlp ~(keystone)]#
openstack secret get http://10.0.0.30:9311/v1/secrets/905e6796-f8e9-4db2-85c5-eaacff594f35

+---------------+-----------------------------------------------------------------------+
| Field         | Value                                                                 |
+---------------+-----------------------------------------------------------------------+
| Secret href   | http://10.0.0.30:9311/v1/secrets/905e6796-f8e9-4db2-85c5-eaacff594f35 |
| Name          | secret01                                                              |
| Created       | 2017-09-11T01:36:22+00:00                                             |
| Status        | ACTIVE                                                                |
| Content types | {u'default': u'text/plain'}                                           |
| Algorithm     | aes                                                                   |
| Bit length    | 256                                                                   |
| Secret type   | opaque                                                                |
| Mode          | cbc                                                                   |
| Expiration    | None                                                                  |
+---------------+-----------------------------------------------------------------------+

# get data of a key

[root@dlp ~(keystone)]#
openstack secret get http://10.0.0.30:9311/v1/secrets/905e6796-f8e9-4db2-85c5-eaacff594f35 --payload

+---------+-----------+
| Field   | Value     |
+---------+-----------+
| Payload | secretkey |
+---------+-----------+

# generate and store a key

[root@dlp ~(keystone)]#
openstack secret order create --name secret02 --algorithm aes --bit-length 256 \
--mode cbc --payload-content-type application/octet-stream key

+----------------+----------------------------------------------------------------------+
| Field          | Value                                                                |
+----------------+----------------------------------------------------------------------+
| Order href     | http://10.0.0.30:9311/v1/orders/13c1b205-426b-4c51-af2e-1722b3b76c66 |
| Type           | Key                                                                  |
| Container href | N/A                                                                  |
| Secret href    | None                                                                 |
| Created        | None                                                                 |
| Status         | None                                                                 |
| Error code     | None                                                                 |
| Error message  | None                                                                 |
+----------------+----------------------------------------------------------------------+

# show generated key list

[root@dlp ~(keystone)]#
openstack secret order list

+----------------------------------------------------------------------+------+----------------
| Order href                                                           | Type | Container href 
+----------------------------------------------------------------------+------+----------------
| http://10.0.0.30:9311/v1/orders/13c1b205-426b-4c51-af2e-1722b3b76c66 | Key  | N/A            
+----------------------------------------------------------------------+------+----------------
+-----------------------------------------------------------------------+---------------------------
| Secret href                                                           | Created                   
+-----------------------------------------------------------------------+---------------------------
| http://10.0.0.30:9311/v1/secrets/e3dd50c3-cafe-4c64-b6d2-4b4398005d79 | 2017-09-11T01:39:16+00:00 
+-----------------------------------------------------------------------+---------------------------
+--------+------------+---------------+
| Status | Error code | Error message |
+--------+------------+---------------+
| ACTIVE | None       | None          |
+--------+------------+---------------+

# show a generated key

[root@dlp ~(keystone)]#
openstack secret order get http://10.0.0.30:9311/v1/orders/13c1b205-426b-4c51-af2e-1722b3b76c66

+----------------+-----------------------------------------------------------------------+
| Field          | Value                                                                 |
+----------------+-----------------------------------------------------------------------+
| Order href     | http://10.0.0.30:9311/v1/orders/13c1b205-426b-4c51-af2e-1722b3b76c66  |
| Type           | Key                                                                   |
| Container href | N/A                                                                   |
| Secret href    | http://10.0.0.30:9311/v1/secrets/e3dd50c3-cafe-4c64-b6d2-4b4398005d79 |
| Created        | 2017-09-11T01:39:16+00:00                                             |
| Status         | ACTIVE                                                                |
| Error code     | None                                                                  |
| Error message  | None                                                                  |
+----------------+-----------------------------------------------------------------------+

# show metadata of a generated key

[root@dlp ~(keystone)]#
openstack secret get http://10.0.0.30:9311/v1/secrets/e3dd50c3-cafe-4c64-b6d2-4b4398005d79

+---------------+-----------------------------------------------------------------------+
| Field         | Value                                                                 |
+---------------+-----------------------------------------------------------------------+
| Secret href   | http://10.0.0.30:9311/v1/secrets/e3dd50c3-cafe-4c64-b6d2-4b4398005d79 |
| Name          | secret02                                                              |
| Created       | 2017-09-11T01:39:16+00:00                                             |
| Status        | ACTIVE                                                                |
| Content types | {u'default': u'application/octet-stream'}                             |
| Algorithm     | aes                                                                   |
| Bit length    | 256                                                                   |
| Secret type   | symmetric                                                             |
| Mode          | cbc                                                                   |
| Expiration    | None                                                                  |
+---------------+-----------------------------------------------------------------------+
Matched Content