CentOS Stream 9
Sponsored Link

OpenStack Yoga : How to use Barbican2022/06/10

 
This is how to use OpenStack Key Manager Service (Barbican).
This example is based on the environment like follows.
------------+-----------------------------+-----------------------------+------------
            |                             |                             |
        eth0|10.0.0.30                eth0|10.0.0.50                eth0|10.0.0.51
+-----------+-----------+     +-----------+-----------+     +-----------+-----------+
|   [ dlp.srv.world ]   |     | [ network.srv.world ] |     |  [ node01.srv.world ] |
|     (Control Node)    |     |     (Network Node)    |     |     (Compute Node)    |
|                       |     |                       |     |                       |
|  MariaDB    RabbitMQ  |     |      Open vSwitch     |     |        Libvirt        |
|  Memcached  httpd     |     |     Neutron Server    |     |      Nova Compute     |
|  Keystone   Glance    |     |      OVN-Northd       |     |      Open vSwitch     |
|  Nova API  Cinder API |     |     Cinder Volume     |     |   OVN Metadata Agent  |
|  Barbican API         |     |    Heat API/Engine    |     |     OVN-Controller    |
+-----------------------+     +-----------------------+     +-----------------------+

[1] This is the basic usage of Barbican.
# store a key : --name [key's name] --payload [key's data]

[root@dlp ~(keystone)]#
openstack secret store --name secret01 --payload secretkey

+---------------+----------------------------------------------------------------------------+
| Field         | Value                                                                      |
+---------------+----------------------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/b73ead95-e775-4961-a814-61f481fed298 |
| Name          | secret01                                                                   |
| Created       | None                                                                       |
| Status        | None                                                                       |
| Content types | None                                                                       |
| Algorithm     | aes                                                                        |
| Bit length    | 256                                                                        |
| Secret type   | opaque                                                                     |
| Mode          | cbc                                                                        |
| Expiration    | None                                                                       |
+---------------+----------------------------------------------------------------------------+

# show keys list

[root@dlp ~(keystone)]#
openstack secret list

+----------------------------------------------------------------------------+----------+---------------------------
| Secret href                                                                | Name     | Created                   
+----------------------------------------------------------------------------+----------+---------------------------
| https://dlp.srv.world:9311/v1/secrets/b73ead95-e775-4961-a814-61f481fed298 | secret01 | 2022-06-10T04:47:56+00:00 
+----------------------------------------------------------------------------+----------+---------------------------
+--------+-----------------------------------------+-----------+------------+-------------+------+------------+
| Status | Content types                           | Algorithm | Bit length | Secret type | Mode | Expiration |
+--------+-----------------------------------------+-----------+------------+-------------+------+------------+
| ACTIVE | {'default': 'application/octet-stream'} | aes       |        256 | opaque      | cbc  | None       |
+--------+-----------------------------------------+-----------+------------+-------------+------+------------+

# get metadata of a key

[root@dlp ~(keystone)]#
openstack secret get https://dlp.srv.world:9311/v1/secrets/b73ead95-e775-4961-a814-61f481fed298

+---------------+----------------------------------------------------------------------------+
| Field         | Value                                                                      |
+---------------+----------------------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/b73ead95-e775-4961-a814-61f481fed298 |
| Name          | secret01                                                                   |
| Created       | 2022-06-10T04:47:56+00:00                                                  |
| Status        | ACTIVE                                                                     |
| Content types | {'default': 'application/octet-stream'}                                    |
| Algorithm     | aes                                                                        |
| Bit length    | 256                                                                        |
| Secret type   | opaque                                                                     |
| Mode          | cbc                                                                        |
| Expiration    | None                                                                       |
+---------------+----------------------------------------------------------------------------+

# get data of a key

[root@dlp ~(keystone)]#
openstack secret get https://dlp.srv.world:9311/v1/secrets/b73ead95-e775-4961-a814-61f481fed298 --payload

+---------+-----------+
| Field   | Value     |
+---------+-----------+
| Payload | secretkey |
+---------+-----------+

# generate and store a key

[root@dlp ~(keystone)]#
openstack secret order create --name secret02 --algorithm aes --bit-length 256 \
--mode cbc --payload-content-type application/octet-stream key

+----------------+---------------------------------------------------------------------------+
| Field          | Value                                                                     |
+----------------+---------------------------------------------------------------------------+
| Order href     | https://dlp.srv.world:9311/v1/orders/9348f72c-1f23-4cac-8fb0-6f9bc9f27364 |
| Type           | Key                                                                       |
| Container href | N/A                                                                       |
| Secret href    | None                                                                      |
| Created        | None                                                                      |
| Status         | None                                                                      |
| Error code     | None                                                                      |
| Error message  | None                                                                      |
+----------------+---------------------------------------------------------------------------+

# show generated keys list

[root@dlp ~(keystone)]#
openstack secret order list

+---------------------------------------------------------------------------+------+----------------
| Order href                                                                | Type | Container href 
+---------------------------------------------------------------------------+------+----------------
| https://dlp.srv.world:9311/v1/orders/9348f72c-1f23-4cac-8fb0-6f9bc9f27364 | Key  | N/A            
+---------------------------------------------------------------------------+------+----------------
+----------------------------------------------------------------------------+---------------------------+--------+------------+---------------+
| Secret href                                                                | Created                   | Status | Error code | Error message |
+----------------------------------------------------------------------------+---------------------------+--------+------------+---------------+
| https://dlp.srv.world:9311/v1/secrets/b8264edb-ba63-4b32-86b8-0cf24e554028 | 2022-06-10T04:50:14+00:00 | ACTIVE | None       | None          |
+----------------------------------------------------------------------------+---------------------------+--------+------------+---------------+

# show a generated key

[root@dlp ~(keystone)]#
openstack secret order get https://dlp.srv.world:9311/v1/orders/9348f72c-1f23-4cac-8fb0-6f9bc9f27364

+----------------+----------------------------------------------------------------------------+
| Field          | Value                                                                      |
+----------------+----------------------------------------------------------------------------+
| Order href     | https://dlp.srv.world:9311/v1/orders/9348f72c-1f23-4cac-8fb0-6f9bc9f27364  |
| Type           | Key                                                                        |
| Container href | N/A                                                                        |
| Secret href    | https://dlp.srv.world:9311/v1/secrets/b8264edb-ba63-4b32-86b8-0cf24e554028 |
| Created        | 2022-06-10T04:50:14+00:00                                                  |
| Status         | ACTIVE                                                                     |
| Error code     | None                                                                       |
| Error message  | None                                                                       |
+----------------+----------------------------------------------------------------------------+

# show metadata of a generated key

[root@dlp ~(keystone)]#
openstack secret get https://dlp.srv.world:9311/v1/secrets/b8264edb-ba63-4b32-86b8-0cf24e554028

+---------------+----------------------------------------------------------------------------+
| Field         | Value                                                                      |
+---------------+----------------------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/b8264edb-ba63-4b32-86b8-0cf24e554028 |
| Name          | secret02                                                                   |
| Created       | 2022-06-10T04:50:14+00:00                                                  |
| Status        | ACTIVE                                                                     |
| Content types | {'default': 'application/octet-stream'}                                    |
| Algorithm     | aes                                                                        |
| Bit length    | 256                                                                        |
| Secret type   | symmetric                                                                  |
| Mode          | cbc                                                                        |
| Expiration    | None                                                                       |
+---------------+----------------------------------------------------------------------------+
Matched Content