Ubuntu 22.04
Sponsored Link

OpenStack Antelope : How to use Barbican2023/03/27

 
This is how to use OpenStack Key Manager Service (Barbican).
This example is based on the environment like follows.
------------+--------------------------+--------------------------+------------
            |                          |                          |
        eth0|10.0.0.30             eth0|10.0.0.50             eth0|10.0.0.51
+-----------+-----------+  +-----------+-----------+  +-----------+-----------+
|   [ dlp.srv.world ]   |  | [ network.srv.world ] |  |  [ node01.srv.world ] |
|     (Control Node)    |  |     (Network Node)    |  |     (Compute Node)    |
|                       |  |                       |  |                       |
|  MariaDB    RabbitMQ  |  |      Open vSwitch     |  |        Libvirt        |
|  Memcached  Nginx     |  |     Neutron Server    |  |      Nova Compute     |
|  Keystone   httpd     |  |      OVN-Northd       |  |      Open vSwitch     |
|  Glance     Nova API  |  |  Nginx  iSCSI Target  |  |   OVN Metadata Agent  |
|  Cinder API           |  |     Cinder Volume     |  |     OVN-Controller    |
|  Barbican API         |  |    Heat API/Engine    |  |                       |
+-----------------------+  +-----------------------+  +-----------------------+

[1] This is the basic usage of Barbican.
# store a key : --name [key's name] --payload [key's data]

root@dlp ~(keystone)#
openstack secret store --name secret01 --payload secretkey

+---------------+----------------------------------------------------------------------------+
| Field         | Value                                                                      |
+---------------+----------------------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/867e40bf-5cdb-46dc-beed-3fc7c18e9e40 |
| Name          | secret01                                                                   |
| Created       | None                                                                       |
| Status        | None                                                                       |
| Content types | None                                                                       |
| Algorithm     | aes                                                                        |
| Bit length    | 256                                                                        |
| Secret type   | opaque                                                                     |
| Mode          | cbc                                                                        |
| Expiration    | None                                                                       |
+---------------+----------------------------------------------------------------------------+

# show keys list

root@dlp ~(keystone)#
openstack secret list

+----------------------------------------------------------------------------+----------+---------------------------
| Secret href                                                                | Name     | Created                   
+----------------------------------------------------------------------------+----------+---------------------------
| https://dlp.srv.world:9311/v1/secrets/867e40bf-5cdb-46dc-beed-3fc7c18e9e40 | secret01 | 2023-03-27T07:46:07+00:00 
+----------------------------------------------------------------------------+----------+---------------------------
+--------+-----------------------------------------+-----------+------------+-------------+------+------------+
| Status | Content types                           | Algorithm | Bit length | Secret type | Mode | Expiration |
+--------+-----------------------------------------+-----------+------------+-------------+------+------------+
| ACTIVE | {'default': 'application/octet-stream'} | aes       |        256 | opaque      | cbc  | None       |
+--------+-----------------------------------------+-----------+------------+-------------+------+------------+

# get metadata of a key

root@dlp ~(keystone)#
openstack secret get https://dlp.srv.world:9311/v1/secrets/867e40bf-5cdb-46dc-beed-3fc7c18e9e40

+---------------+----------------------------------------------------------------------------+
| Field         | Value                                                                      |
+---------------+----------------------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/867e40bf-5cdb-46dc-beed-3fc7c18e9e40 |
| Name          | secret01                                                                   |
| Created       | 2023-03-27T07:46:07+00:00                                                  |
| Status        | ACTIVE                                                                     |
| Content types | {'default': 'application/octet-stream'}                                    |
| Algorithm     | aes                                                                        |
| Bit length    | 256                                                                        |
| Secret type   | opaque                                                                     |
| Mode          | cbc                                                                        |
| Expiration    | None                                                                       |
+---------------+----------------------------------------------------------------------------+

# get data of a key

root@dlp ~(keystone)#
openstack secret get https://dlp.srv.world:9311/v1/secrets/867e40bf-5cdb-46dc-beed-3fc7c18e9e40 --payload

+---------+-----------+
| Field   | Value     |
+---------+-----------+
| Payload | secretkey |
+---------+-----------+

# for the case generate and store a key

root@dlp ~(keystone)#
openstack secret order create --name secret02 --algorithm aes --bit-length 256 \
--mode cbc --payload-content-type application/octet-stream key

+----------------+---------------------------------------------------------------------------+
| Field          | Value                                                                     |
+----------------+---------------------------------------------------------------------------+
| Order href     | https://dlp.srv.world:9311/v1/orders/111627d3-1c6d-485a-adba-db5c27ced4b9 |
| Type           | Key                                                                       |
| Container href | N/A                                                                       |
| Secret href    | None                                                                      |
| Created        | None                                                                      |
| Status         | None                                                                      |
| Error code     | None                                                                      |
| Error message  | None                                                                      |
+----------------+---------------------------------------------------------------------------+

# show generated keys list

root@dlp ~(keystone)#
openstack secret order list

+---------------------------------------------------------------------------+------+----------------
| Order href                                                                | Type | Container href 
+---------------------------------------------------------------------------+------+----------------
| https://dlp.srv.world:9311/v1/orders/111627d3-1c6d-485a-adba-db5c27ced4b9 | Key  | N/A            
+---------------------------------------------------------------------------+------+----------------
+----------------------------------------------------------------------------+---------------------------+--------+------------+---------------+
| Secret href                                                                | Created                   | Status | Error code | Error message |
+----------------------------------------------------------------------------+---------------------------+--------+------------+---------------+
| https://dlp.srv.world:9311/v1/secrets/11cc7617-9eae-4ae5-b65f-be669b134e19 | 2023-03-27T07:48:09+00:00 | ACTIVE | None       | None          |
+----------------------------------------------------------------------------+---------------------------+--------+------------+---------------+

# show a generated key

root@dlp ~(keystone)#
openstack secret order get https://dlp.srv.world:9311/v1/orders/111627d3-1c6d-485a-adba-db5c27ced4b9

+----------------+----------------------------------------------------------------------------+
| Field          | Value                                                                      |
+----------------+----------------------------------------------------------------------------+
| Order href     | https://dlp.srv.world:9311/v1/orders/111627d3-1c6d-485a-adba-db5c27ced4b9  |
| Type           | Key                                                                        |
| Container href | N/A                                                                        |
| Secret href    | https://dlp.srv.world:9311/v1/secrets/11cc7617-9eae-4ae5-b65f-be669b134e19 |
| Created        | 2023-03-27T07:48:09+00:00                                                  |
| Status         | ACTIVE                                                                     |
| Error code     | None                                                                       |
| Error message  | None                                                                       |
+----------------+----------------------------------------------------------------------------+

# show metadata of a generated key

root@dlp ~(keystone)#
openstack secret get https://dlp.srv.world:9311/v1/secrets/11cc7617-9eae-4ae5-b65f-be669b134e19

+---------------+----------------------------------------------------------------------------+
| Field         | Value                                                                      |
+---------------+----------------------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/11cc7617-9eae-4ae5-b65f-be669b134e19 |
| Name          | secret02                                                                   |
| Created       | 2023-03-27T07:48:09+00:00                                                  |
| Status        | ACTIVE                                                                     |
| Content types | {'default': 'application/octet-stream'}                                    |
| Algorithm     | aes                                                                        |
| Bit length    | 256                                                                        |
| Secret type   | symmetric                                                                  |
| Mode          | cbc                                                                        |
| Expiration    | None                                                                       |
+---------------+----------------------------------------------------------------------------+
Matched Content