Ubuntu 24.04
Sponsored Link

OpenStack Caracal : Barbican 利用方法2024/05/22

 

OpenStack Key Manager Service(Barbican)の利用方法です。

当例では以下のような環境を例に Barbican をインストールしています。

------------+--------------------------+--------------------------+------------
            |                          |                          |
        eth0|10.0.0.30             eth0|10.0.0.50             eth0|10.0.0.51
+-----------+-----------+  +-----------+-----------+  +-----------+-----------+
|   [ dlp.srv.world ]   |  | [ network.srv.world ] |  |  [ node01.srv.world ] |
|     (Control Node)    |  |     (Network Node)    |  |     (Compute Node)    |
|                       |  |                       |  |                       |
|  MariaDB    RabbitMQ  |  |  Neutron L2/L3 Agent  |  |        Libvirt        |
|  Memcached  Nginx     |  |   Neutron Metadata    |  |      Nova Compute     |
|  Keystone   httpd     |  |     Open vSwitch      |  |    Neutron L2 Agent   |
|  Glance     Nova API  |  |     iSCSI Target      |  |      Open vSwitch     |
|  Neutron Server       |  |     Cinder Volume     |  |                       |
|  Neutron Metadata     |  |     Heat API/Engine   |  |                       |
|  Cinder API           |  |                       |  |                       |
|  Barbican API         |  |                       |  |                       |
+-----------------------+  +-----------------------+  +-----------------------+

[1] Barbican の基本的な利用方法です。
# キーを格納 : --name [キーの名称] --payload [キーのデータ]

root@dlp ~(keystone)#
openstack secret store --name secret01 --payload secretkey

+---------------+--------------------------------------------------------------+
| Field         | Value                                                        |
+---------------+--------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/6e016110-cc91-41e1-    |
|               | 8444-bd79719f15b2                                            |
| Name          | secret01                                                     |
| Created       | None                                                         |
| Status        | None                                                         |
| Content types | None                                                         |
| Algorithm     | aes                                                          |
| Bit length    | 256                                                          |
| Secret type   | opaque                                                       |
| Mode          | cbc                                                          |
| Expiration    | None                                                         |
+---------------+--------------------------------------------------------------+

# キーの一覧を表示

root@dlp ~(keystone)#
openstack secret list

+-------------+----------+----------+--------+---------------+-----------+------------+-------------+------+------------+
| Secret href | Name     | Created  | Status | Content types | Algorithm | Bit length | Secret type | Mode | Expiration |
+-------------+----------+----------+--------+---------------+-----------+------------+-------------+------+------------+
| https://dlp | secret01 | 2024-05- | ACTIVE | {'default': ' | aes       |        256 | opaque      | cbc  | None       |
| .srv.world: |          | 22T01:58 |        | application/o |           |            |             |      |            |
| 9311/v1/sec |          | :08+00:0 |        | ctet-stream'} |           |            |             |      |            |
| rets/6e0161 |          | 0        |        |               |           |            |             |      |            |
| 10-cc91-    |          |          |        |               |           |            |             |      |            |
| 41e1-8444-  |          |          |        |               |           |            |             |      |            |
| bd79719f15b |          |          |        |               |           |            |             |      |            |
| 2           |          |          |        |               |           |            |             |      |            |
+-------------+----------+----------+--------+---------------+-----------+------------+-------------+------+------------+

# 格納したキーのメタデータを参照

root@dlp ~(keystone)#
openstack secret get https://dlp.srv.world:9311/v1/secrets/6e016110-cc91-41e1-8444-bd79719f15b2

+---------------+--------------------------------------------------------------+
| Field         | Value                                                        |
+---------------+--------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/6e016110-cc91-41e1-    |
|               | 8444-bd79719f15b2                                            |
| Name          | secret01                                                     |
| Created       | 2024-05-22T01:58:08+00:00                                    |
| Status        | ACTIVE                                                       |
| Content types | {'default': 'application/octet-stream'}                      |
| Algorithm     | aes                                                          |
| Bit length    | 256                                                          |
| Secret type   | opaque                                                       |
| Mode          | cbc                                                          |
| Expiration    | None                                                         |
+---------------+--------------------------------------------------------------+

# 格納したキーのデータを参照

root@dlp ~(keystone)#
openstack secret get https://dlp.srv.world:9311/v1/secrets/6e016110-cc91-41e1-8444-bd79719f15b2 --payload

+---------+-----------+
| Field   | Value     |
+---------+-----------+
| Payload | secretkey |
+---------+-----------+

# キーを生成して格納する場合は以下

root@dlp ~(keystone)#
openstack secret order create --name secret02 --algorithm aes --bit-length 256 \
--mode cbc --payload-content-type application/octet-stream key

+----------------+-------------------------------------------------------------+
| Field          | Value                                                       |
+----------------+-------------------------------------------------------------+
| Order href     | https://dlp.srv.world:9311/v1/orders/22fb3224-e37b-47a4-    |
|                | 96d8-60ca7f117d58                                           |
| Type           | Key                                                         |
| Container href | N/A                                                         |
| Secret href    | None                                                        |
| Created        | None                                                        |
| Status         | None                                                        |
| Error code     | None                                                        |
| Error message  | None                                                        |
+----------------+-------------------------------------------------------------+

# 生成したキーの一覧を表示

root@dlp ~(keystone)#
openstack secret order list

+------------+------+----------------+-------------+----------+--------+------------+---------------+
| Order href | Type | Container href | Secret href | Created  | Status | Error code | Error message |
+------------+------+----------------+-------------+----------+--------+------------+---------------+
| https://dl | Key  | N/A            | https://dlp | 2024-05- | ACTIVE | None       | None          |
| p.srv.worl |      |                | .srv.world: | 22T02:01 |        |            |               |
| d:9311/v1/ |      |                | 9311/v1/sec | :12+00:0 |        |            |               |
| orders/22f |      |                | rets/14c05b | 0        |        |            |               |
| b3224-     |      |                | b4-1832-    |          |        |            |               |
| e37b-47a4- |      |                | 43ad-997e-  |          |        |            |               |
| 96d8-      |      |                | 5369cbf385e |          |        |            |               |
| 60ca7f117d |      |                | 9           |          |        |            |               |
| 58         |      |                |             |          |        |            |               |
+------------+------+----------------+-------------+----------+--------+------------+---------------+

# 生成したキーを参照

root@dlp ~(keystone)#
openstack secret order get https://dlp.srv.world:9311/v1/orders/22fb3224-e37b-47a4-96d8-60ca7f117d58

+----------------+-------------------------------------------------------------+
| Field          | Value                                                       |
+----------------+-------------------------------------------------------------+
| Order href     | https://dlp.srv.world:9311/v1/orders/22fb3224-e37b-47a4-    |
|                | 96d8-60ca7f117d58                                           |
| Type           | Key                                                         |
| Container href | N/A                                                         |
| Secret href    | https://dlp.srv.world:9311/v1/secrets/14c05bb4-1832-43ad-   |
|                | 997e-5369cbf385e9                                           |
| Created        | 2024-05-22T02:01:12+00:00                                   |
| Status         | ACTIVE                                                      |
| Error code     | None                                                        |
| Error message  | None                                                        |
+----------------+-------------------------------------------------------------+

# 生成したキーのメタデータを参照

root@dlp ~(keystone)#
openstack secret get https://dlp.srv.world:9311/v1/secrets/14c05bb4-1832-43ad-997e-5369cbf385e9

+---------------+--------------------------------------------------------------+
| Field         | Value                                                        |
+---------------+--------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/14c05bb4-1832-43ad-    |
|               | 997e-5369cbf385e9                                            |
| Name          | secret02                                                     |
| Created       | 2024-05-22T02:01:12+00:00                                    |
| Status        | ACTIVE                                                       |
| Content types | {'default': 'application/octet-stream'}                      |
| Algorithm     | aes                                                          |
| Bit length    | 256                                                          |
| Secret type   | symmetric                                                    |
| Mode          | cbc                                                          |
| Expiration    | None                                                         |
+---------------+--------------------------------------------------------------+
関連コンテンツ