Ubuntu 20.04
Sponsored Link

OpenStack Wallaby : How to use Barbican2021/04/20

 
This is how to use OpenStack Key Manager Service (Barbican).
This example is based on the environment like follows.
------------+---------------------------+---------------------------+------------
            |                           |                           |
        eth0|10.0.0.30              eth0|10.0.0.50              eth0|10.0.0.51
+-----------+-----------+   +-----------+-----------+   +-----------+-----------+
|    [ Control Node ]   |   |    [ Storage Node ]   |   |    [ Compute Node ]   |
|                       |   |                       |   |                       |
|  MariaDB    RabbitMQ  |   |      Open vSwitch     |   |        Libvirt        |
|  Memcached  httpd     |   |     Neutron Server    |   |     Nova Compute      |
|  Keystone   Glance    |   |       OVN-Northd      |   |      Open vSwitch     |
|  Nova API             |   |     Cinder Volume     |   |   OVN Metadata Agent  |
|  Cinder API           |   |     iSCSI Target      |   |     OVN-Controller    |
|  Barbican API         |   |    Heat API/Engine    |   |                       |
+-----------------------+   +-----------------------+   +-----------------------+

[1] This is the basic usage of Barbican.
# store a key : --name [key's name] --payload [key's data]

root@dlp ~(keystone)#
openstack secret store --name secret01 --payload secretkey

+---------------+-----------------------------------------------------------------------+
| Field         | Value                                                                 |
+---------------+-----------------------------------------------------------------------+
| Secret href   | http://10.0.0.30:9311/v1/secrets/e56f3746-3484-4bd3-b06c-82c68a53d6e4 |
| Name          | secret01                                                              |
| Created       | None                                                                  |
| Status        | None                                                                  |
| Content types | None                                                                  |
| Algorithm     | aes                                                                   |
| Bit length    | 256                                                                   |
| Secret type   | opaque                                                                |
| Mode          | cbc                                                                   |
| Expiration    | None                                                                  |
+---------------+-----------------------------------------------------------------------+

# show keys list

root@dlp ~(keystone)#
openstack secret list

+-----------------------------------------------------------------------+----------+---------------------------
| Secret href                                                           | Name     | Created                   
+-----------------------------------------------------------------------+----------+---------------------------
| http://10.0.0.30:9311/v1/secrets/e56f3746-3484-4bd3-b06c-82c68a53d6e4 | secret01 | 2021-04-20T01:36:50+00:00 
+-----------------------------------------------------------------------+----------+---------------------------
+--------+-----------------------------------------+-----------+------------+-------------+------+------------+
| Status | Content types                           | Algorithm | Bit length | Secret type | Mode | Expiration |
+--------+-----------------------------------------+-----------+------------+-------------+------+------------+
| ACTIVE | {'default': 'application/octet-stream'} | aes       |        256 | opaque      | cbc  | None       |
+--------+-----------------------------------------+-----------+------------+-------------+------+------------+

# get metadata of a key

root@dlp ~(keystone)#
openstack secret get http://10.0.0.30:9311/v1/secrets/e56f3746-3484-4bd3-b06c-82c68a53d6e4

+---------------+-----------------------------------------------------------------------+
| Field         | Value                                                                 |
+---------------+-----------------------------------------------------------------------+
| Secret href   | http://10.0.0.30:9311/v1/secrets/e56f3746-3484-4bd3-b06c-82c68a53d6e4 |
| Name          | secret01                                                              |
| Created       | 2021-04-20T01:36:50+00:00                                             |
| Status        | ACTIVE                                                                |
| Content types | {'default': 'application/octet-stream'}                               |
| Algorithm     | aes                                                                   |
| Bit length    | 256                                                                   |
| Secret type   | opaque                                                                |
| Mode          | cbc                                                                   |
| Expiration    | None                                                                  |
+---------------+-----------------------------------------------------------------------+

# get data of a key

root@dlp ~(keystone)#
openstack secret get http://10.0.0.30:9311/v1/secrets/e56f3746-3484-4bd3-b06c-82c68a53d6e4 --payload

+---------+-----------+
| Field   | Value     |
+---------+-----------+
| Payload | secretkey |
+---------+-----------+

# generate and store a key

root@dlp ~(keystone)#
openstack secret order create --name secret02 --algorithm aes --bit-length 256 \
--mode cbc --payload-content-type application/octet-stream key

+----------------+----------------------------------------------------------------------+
| Field          | Value                                                                |
+----------------+----------------------------------------------------------------------+
| Order href     | http://10.0.0.30:9311/v1/orders/941f058b-9b9f-4983-9abd-548e99716b2b |
| Type           | Key                                                                  |
| Container href | N/A                                                                  |
| Secret href    | None                                                                 |
| Created        | None                                                                 |
| Status         | None                                                                 |
| Error code     | None                                                                 |
| Error message  | None                                                                 |
+----------------+----------------------------------------------------------------------+

# show generated keys list

root@dlp ~(keystone)#
openstack secret order list

+----------------------------------------------------------------------+------+----------------
| Order href                                                           | Type | Container href 
+----------------------------------------------------------------------+------+----------------
| http://10.0.0.30:9311/v1/orders/941f058b-9b9f-4983-9abd-548e99716b2b | Key  | N/A            
+----------------------------------------------------------------------+------+----------------
+-----------------------------------------------------------------------+---------------------------+--------+------------+---------------+
| Secret href                                                           | Created                   | Status | Error code | Error message |
+-----------------------------------------------------------------------+---------------------------+--------+------------+---------------+
| http://10.0.0.30:9311/v1/secrets/2ccec2e8-beb7-40a9-90c7-f4cfa4bfb090 | 2021-04-20T01:38:52+00:00 | ACTIVE | None       | None          |
+-----------------------------------------------------------------------+---------------------------+--------+------------+---------------+

# show a generated key

root@dlp ~(keystone)#
openstack secret order get http://10.0.0.30:9311/v1/orders/941f058b-9b9f-4983-9abd-548e99716b2b

+----------------+-----------------------------------------------------------------------+
| Field          | Value                                                                 |
+----------------+-----------------------------------------------------------------------+
| Order href     | http://10.0.0.30:9311/v1/orders/941f058b-9b9f-4983-9abd-548e99716b2b  |
| Type           | Key                                                                   |
| Container href | N/A                                                                   |
| Secret href    | http://10.0.0.30:9311/v1/secrets/2ccec2e8-beb7-40a9-90c7-f4cfa4bfb090 |
| Created        | 2021-04-20T01:38:52+00:00                                             |
| Status         | ACTIVE                                                                |
| Error code     | None                                                                  |
| Error message  | None                                                                  |
+----------------+-----------------------------------------------------------------------+

# show metadata of a generated key

root@dlp ~(keystone)#
openstack secret get http://10.0.0.30:9311/v1/secrets/2ccec2e8-beb7-40a9-90c7-f4cfa4bfb090

+---------------+-----------------------------------------------------------------------+
| Field         | Value                                                                 |
+---------------+-----------------------------------------------------------------------+
| Secret href   | http://10.0.0.30:9311/v1/secrets/2ccec2e8-beb7-40a9-90c7-f4cfa4bfb090 |
| Name          | secret02                                                              |
| Created       | 2021-04-20T01:38:52+00:00                                             |
| Status        | ACTIVE                                                                |
| Content types | {'default': 'application/octet-stream'}                               |
| Algorithm     | aes                                                                   |
| Bit length    | 256                                                                   |
| Secret type   | symmetric                                                             |
| Mode          | cbc                                                                   |
| Expiration    | None                                                                  |
+---------------+-----------------------------------------------------------------------+
Matched Content