Ubuntu 22.04
Sponsored Link

OpenStack Zed : How to use Barbican
2022/10/10
 
This is how to use OpenStack Key Manager Service (Barbican).
This example is based on the environment like follows.
------------+-----------------------------+-----------------------------+------------
            |                             |                             |
        eth0|10.0.0.30                eth0|10.0.0.50                eth0|10.0.0.51
+-----------+-----------+     +-----------+-----------+     +-----------+-----------+
|   [ dlp.srv.world ]   |     | [ network.srv.world ] |     |  [ node01.srv.world ] |
|     (Control Node)    |     |     (Network Node)    |     |     (Compute Node)    |
|                       |     |                       |     |                       |
|  MariaDB    RabbitMQ  |     |      Open vSwitch     |     |        Libvirt        |
|  Memcached  Nginx     |     |     Neutron Server    |     |      Nova Compute     |
|  Keystone   httpd     |     |      OVN-Northd       |     |      Open vSwitch     |
|  Glance     Nova API  |     |  Nginx  iSCSI Target  |     |   OVN Metadata Agent  |
|  Cinder API           |     |     Cinder Volume     |     |     OVN-Controller    |
|  Barbican API         |     |    Heat API/Engine    |     |                       |
+-----------------------+     +-----------------------+     +-----------------------+

[1] This is the basic usage of Barbican.
# store a key : --name [key's name] --payload [key's data]

root@dlp ~(keystone)#
openstack secret store --name secret01 --payload secretkey

+---------------+----------------------------------------------------------------------------+
| Field         | Value                                                                      |
+---------------+----------------------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/3e02d268-551f-4751-babe-e1f68316dd4d |
| Name          | secret01                                                                   |
| Created       | None                                                                       |
| Status        | None                                                                       |
| Content types | None                                                                       |
| Algorithm     | aes                                                                        |
| Bit length    | 256                                                                        |
| Secret type   | opaque                                                                     |
| Mode          | cbc                                                                        |
| Expiration    | None                                                                       |
+---------------+----------------------------------------------------------------------------+

# show keys list

root@dlp ~(keystone)#
openstack secret list

+----------------------------------------------------------------------------+----------+---------------------------
| Secret href                                                                | Name     | Created                   
+----------------------------------------------------------------------------+----------+---------------------------
| https://dlp.srv.world:9311/v1/secrets/3e02d268-551f-4751-babe-e1f68316dd4d | secret01 | 2022-10-10T04:14:07+00:00 
+----------------------------------------------------------------------------+----------+---------------------------
+--------+-----------------------------------------+-----------+------------+-------------+------+------------+
| Status | Content types                           | Algorithm | Bit length | Secret type | Mode | Expiration |
+--------+-----------------------------------------+-----------+------------+-------------+------+------------+
| ACTIVE | {'default': 'application/octet-stream'} | aes       |        256 | opaque      | cbc  | None       |
+--------+-----------------------------------------+-----------+------------+-------------+------+------------+

# get metadata of a key

root@dlp ~(keystone)#
openstack secret get https://dlp.srv.world:9311/v1/secrets/3e02d268-551f-4751-babe-e1f68316dd4d

+---------------+----------------------------------------------------------------------------+
| Field         | Value                                                                      |
+---------------+----------------------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/3e02d268-551f-4751-babe-e1f68316dd4d |
| Name          | secret01                                                                   |
| Created       | 2022-10-10T04:14:07+00:00                                                  |
| Status        | ACTIVE                                                                     |
| Content types | {'default': 'application/octet-stream'}                                    |
| Algorithm     | aes                                                                        |
| Bit length    | 256                                                                        |
| Secret type   | opaque                                                                     |
| Mode          | cbc                                                                        |
| Expiration    | None                                                                       |
+---------------+----------------------------------------------------------------------------+

# get data of a key

root@dlp ~(keystone)#
openstack secret get https://dlp.srv.world:9311/v1/secrets/3e02d268-551f-4751-babe-e1f68316dd4d --payload

+---------+-----------+
| Field   | Value     |
+---------+-----------+
| Payload | secretkey |
+---------+-----------+

# for the case generate and store a key

root@dlp ~(keystone)#
openstack secret order create --name secret02 --algorithm aes --bit-length 256 \
--mode cbc --payload-content-type application/octet-stream key

+----------------+---------------------------------------------------------------------------+
| Field          | Value                                                                     |
+----------------+---------------------------------------------------------------------------+
| Order href     | https://dlp.srv.world:9311/v1/orders/9d306d0a-18d8-46db-9090-658ad4c341b7 |
| Type           | Key                                                                       |
| Container href | N/A                                                                       |
| Secret href    | None                                                                      |
| Created        | None                                                                      |
| Status         | None                                                                      |
| Error code     | None                                                                      |
| Error message  | None                                                                      |
+----------------+---------------------------------------------------------------------------+

# show generated keys list

root@dlp ~(keystone)#
openstack secret order list

+---------------------------------------------------------------------------+------+----------------
| Order href                                                                | Type | Container href 
+---------------------------------------------------------------------------+------+----------------
| https://dlp.srv.world:9311/v1/orders/9d306d0a-18d8-46db-9090-658ad4c341b7 | Key  | N/A            
+---------------------------------------------------------------------------+------+----------------
+----------------------------------------------------------------------------+---------------------------+--------+------------+---------------+
| Secret href                                                                | Created                   | Status | Error code | Error message |
+----------------------------------------------------------------------------+---------------------------+--------+------------+---------------+
| https://dlp.srv.world:9311/v1/secrets/4e64451c-d276-49ee-ae71-5791b910b57d | 2022-10-10T04:17:23+00:00 | ACTIVE | None       | None          |
+----------------------------------------------------------------------------+---------------------------+--------+------------+---------------+

# show a generated key

root@dlp ~(keystone)#
openstack secret order get https://dlp.srv.world:9311/v1/orders/9d306d0a-18d8-46db-9090-658ad4c341b7

+----------------+----------------------------------------------------------------------------+
| Field          | Value                                                                      |
+----------------+----------------------------------------------------------------------------+
| Order href     | https://dlp.srv.world:9311/v1/orders/9d306d0a-18d8-46db-9090-658ad4c341b7  |
| Type           | Key                                                                        |
| Container href | N/A                                                                        |
| Secret href    | https://dlp.srv.world:9311/v1/secrets/4e64451c-d276-49ee-ae71-5791b910b57d |
| Created        | 2022-10-10T04:17:23+00:00                                                  |
| Status         | ACTIVE                                                                     |
| Error code     | None                                                                       |
| Error message  | None                                                                       |
+----------------+----------------------------------------------------------------------------+

# show metadata of a generated key

root@dlp ~(keystone)#
openstack secret get https://dlp.srv.world:9311/v1/secrets/4e64451c-d276-49ee-ae71-5791b910b57d

+---------------+----------------------------------------------------------------------------+
| Field         | Value                                                                      |
+---------------+----------------------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/4e64451c-d276-49ee-ae71-5791b910b57d |
| Name          | secret02                                                                   |
| Created       | 2022-10-10T04:17:23+00:00                                                  |
| Status        | ACTIVE                                                                     |
| Content types | {'default': 'application/octet-stream'}                                    |
| Algorithm     | aes                                                                        |
| Bit length    | 256                                                                        |
| Secret type   | symmetric                                                                  |
| Mode          | cbc                                                                        |
| Expiration    | None                                                                       |
+---------------+----------------------------------------------------------------------------+
Matched Content