CentOS Stream 9
Sponsored Link

OpenStack Caracal : How to use Barbican2024/08/07

 

This is how to use OpenStack Key Manager Service (Barbican).

This example is based on the environment like follows.

------------+--------------------------+--------------------------+------------
            |                          |                          |
        eth0|10.0.0.30             eth0|10.0.0.50             eth0|10.0.0.51
+-----------+-----------+  +-----------+-----------+  +-----------+-----------+
|   [ dlp.srv.world ]   |  | [ network.srv.world ] |  |  [ node01.srv.world ] |
|     (Control Node)    |  |     (Network Node)    |  |     (Compute Node)    |
|                       |  |                       |  |                       |
|  MariaDB    RabbitMQ  |  |      Open vSwitch     |  |        Libvirt        |
|  Memcached  Nginx     |  |     Neutron Server    |  |      Nova Compute     |
|  Keystone   httpd     |  |      OVN-Northd       |  |      Open vSwitch     |
|  Glance     Nova API  |  |  Nginx  iSCSI Target  |  |   OVN Metadata Agent  |
|  Cinder API           |  |     Cinder Volume     |  |     OVN-Controller    |
|  Barbican API         |  |    Heat API/Engine    |  |                       |
+-----------------------+  +-----------------------+  +-----------------------+

[1] This is the basic usage of Barbican.
# store a key : --name [key's name] --payload [key's data]

[root@dlp ~(keystone)]#
openstack secret store --name secret01 --payload secretkey

+---------------+----------------------------------------------------------------------------+
| Field         | Value                                                                      |
+---------------+----------------------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/2f2b06dd-dc4a-466b-a543-c4ad3541d0bf |
| Name          | secret01                                                                   |
| Created       | None                                                                       |
| Status        | None                                                                       |
| Content types | None                                                                       |
| Algorithm     | aes                                                                        |
| Bit length    | 256                                                                        |
| Secret type   | opaque                                                                     |
| Mode          | cbc                                                                        |
| Expiration    | None                                                                       |
+---------------+----------------------------------------------------------------------------+

# show keys list

[root@dlp ~(keystone)]#
openstack secret list

+----------------------------------------------------------------------------+----------+---------------------------
| Secret href                                                                | Name     | Created                   
+----------------------------------------------------------------------------+----------+---------------------------
| https://dlp.srv.world:9311/v1/secrets/2f2b06dd-dc4a-466b-a543-c4ad3541d0bf | secret01 | 2024-08-07T05:22:57+00:00 
+----------------------------------------------------------------------------+----------+---------------------------
+--------+-----------------------------------------+-----------+------------+-------------+------+------------+
| Status | Content types                           | Algorithm | Bit length | Secret type | Mode | Expiration |
+--------+-----------------------------------------+-----------+------------+-------------+------+------------+
| ACTIVE | {'default': 'application/octet-stream'} | aes       |        256 | opaque      | cbc  | None       |
+--------+-----------------------------------------+-----------+------------+-------------+------+------------+

# get metadata of a key

[root@dlp ~(keystone)]#
openstack secret get https://dlp.srv.world:9311/v1/secrets/2f2b06dd-dc4a-466b-a543-c4ad3541d0bf

+---------------+----------------------------------------------------------------------------+
| Field         | Value                                                                      |
+---------------+----------------------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/2f2b06dd-dc4a-466b-a543-c4ad3541d0bf |
| Name          | secret01                                                                   |
| Created       | 2024-08-07T05:22:57+00:00                                                  |
| Status        | ACTIVE                                                                     |
| Content types | {'default': 'application/octet-stream'}                                    |
| Algorithm     | aes                                                                        |
| Bit length    | 256                                                                        |
| Secret type   | opaque                                                                     |
| Mode          | cbc                                                                        |
| Expiration    | None                                                                       |
+---------------+----------------------------------------------------------------------------+

# get data of a key

[root@dlp ~(keystone)]#
openstack secret get https://dlp.srv.world:9311/v1/secrets/2f2b06dd-dc4a-466b-a543-c4ad3541d0bf --payload

+---------+-----------+
| Field   | Value     |
+---------+-----------+
| Payload | secretkey |
+---------+-----------+

# for the case of generating and storing a key

[root@dlp ~(keystone)]#
openstack secret order create --name secret02 --algorithm aes --bit-length 256 \
--mode cbc --payload-content-type application/octet-stream key

+----------------+---------------------------------------------------------------------------+
| Field          | Value                                                                     |
+----------------+---------------------------------------------------------------------------+
| Order href     | https://dlp.srv.world:9311/v1/orders/148ad9cd-dc6b-4766-9d85-aa8e53cbeea6 |
| Type           | Key                                                                       |
| Container href | N/A                                                                       |
| Secret href    | None                                                                      |
| Created        | None                                                                      |
| Status         | None                                                                      |
| Error code     | None                                                                      |
| Error message  | None                                                                      |
+----------------+---------------------------------------------------------------------------+

# show generated keys list

[root@dlp ~(keystone)]#
openstack secret order list

+---------------------------------------------------------------------------+------+----------------
| Order href                                                                | Type | Container href 
+---------------------------------------------------------------------------+------+----------------
| https://dlp.srv.world:9311/v1/orders/148ad9cd-dc6b-4766-9d85-aa8e53cbeea6 | Key  | N/A            
+---------------------------------------------------------------------------+------+----------------
+----------------------------------------------------------------------------+---------------------------+--------+------------+---------------+
| Secret href                                                                | Created                   | Status | Error code | Error message |
+----------------------------------------------------------------------------+---------------------------+--------+------------+---------------+
| https://dlp.srv.world:9311/v1/secrets/16bf639b-e579-422c-bd59-0412dde74aea | 2024-08-07T05:24:50+00:00 | ACTIVE | None       | None          |
+----------------------------------------------------------------------------+---------------------------+--------+------------+---------------+

# show a generated key

[root@dlp ~(keystone)]#
openstack secret order get https://dlp.srv.world:9311/v1/orders/148ad9cd-dc6b-4766-9d85-aa8e53cbeea6

+----------------+----------------------------------------------------------------------------+
| Field          | Value                                                                      |
+----------------+----------------------------------------------------------------------------+
| Order href     | https://dlp.srv.world:9311/v1/orders/148ad9cd-dc6b-4766-9d85-aa8e53cbeea6  |
| Type           | Key                                                                        |
| Container href | N/A                                                                        |
| Secret href    | https://dlp.srv.world:9311/v1/secrets/16bf639b-e579-422c-bd59-0412dde74aea |
| Created        | 2024-08-07T05:24:50+00:00                                                  |
| Status         | ACTIVE                                                                     |
| Error code     | None                                                                       |
| Error message  | None                                                                       |
+----------------+----------------------------------------------------------------------------+

# show metadata of a generated key

[root@dlp ~(keystone)]#
openstack secret get https://dlp.srv.world:9311/v1/secrets/16bf639b-e579-422c-bd59-0412dde74aea

+---------------+----------------------------------------------------------------------------+
| Field         | Value                                                                      |
+---------------+----------------------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/16bf639b-e579-422c-bd59-0412dde74aea |
| Name          | secret02                                                                   |
| Created       | 2024-08-07T05:24:50+00:00                                                  |
| Status        | ACTIVE                                                                     |
| Content types | {'default': 'application/octet-stream'}                                    |
| Algorithm     | aes                                                                        |
| Bit length    | 256                                                                        |
| Secret type   | symmetric                                                                  |
| Mode          | cbc                                                                        |
| Expiration    | None                                                                       |
+---------------+----------------------------------------------------------------------------+
Matched Content