Ubuntu 22.04
Sponsored Link

OpenStack Caracal : Barbican 利用方法2024/04/09

 
OpenStack Key Manager Service(Barbican)の利用方法です。
当例では以下のような環境を例に Barbican をインストールしています。
------------+--------------------------+--------------------------+------------
            |                          |                          |
        eth0|10.0.0.30             eth0|10.0.0.50             eth0|10.0.0.51
+-----------+-----------+  +-----------+-----------+  +-----------+-----------+
|   [ dlp.srv.world ]   |  | [ network.srv.world ] |  |  [ node01.srv.world ] |
|     (Control Node)    |  |     (Network Node)    |  |     (Compute Node)    |
|                       |  |                       |  |                       |
|  MariaDB    RabbitMQ  |  |  Neutron L2/L3 Agent  |  |        Libvirt        |
|  Memcached  Nginx     |  |   Neutron Metadata    |  |      Nova Compute     |
|  Keystone   httpd     |  |     Open vSwitch      |  |    Neutron L2 Agent   |
|  Glance     Nova API  |  |     iSCSI Target      |  |      Open vSwitch     |
|  Neutron Server       |  |     Cinder Volume     |  |                       |
|  Neutron Metadata     |  |     Heat API/Engine   |  |                       |
|  Cinder API           |  |                       |  |                       |
|  Barbican API         |  |                       |  |                       |
+-----------------------+  +-----------------------+  +-----------------------+

[1] Barbican の基本的な利用方法です。
# キーを格納 : --name [キーの名称] --payload [キーのデータ]

root@dlp ~(keystone)#
openstack secret store --name secret01 --payload secretkey

+---------------+--------------------------------------------------------------+
| Field         | Value                                                        |
+---------------+--------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/c1d17a60-d297-4ea7-    |
|               | a2e9-c1e9d370c131                                            |
| Name          | secret01                                                     |
| Created       | None                                                         |
| Status        | None                                                         |
| Content types | None                                                         |
| Algorithm     | aes                                                          |
| Bit length    | 256                                                          |
| Secret type   | opaque                                                       |
| Mode          | cbc                                                          |
| Expiration    | None                                                         |
+---------------+--------------------------------------------------------------+

# キーの一覧を表示

root@dlp ~(keystone)#
openstack secret list

+-------------+----------+----------+--------+---------------+-----------+------------+-------------+------+------------+
| Secret href | Name     | Created  | Status | Content types | Algorithm | Bit length | Secret type | Mode | Expiration |
+-------------+----------+----------+--------+---------------+-----------+------------+-------------+------+------------+
| https://dlp | secret01 | 2024-04- | ACTIVE | {'default': ' | aes       |        256 | opaque      | cbc  | None       |
| .srv.world: |          | 09T07:17 |        | application/o |           |            |             |      |            |
| 9311/v1/sec |          | :39+00:0 |        | ctet-stream'} |           |            |             |      |            |
| rets/c1d17a |          | 0        |        |               |           |            |             |      |            |
| 60-d297-    |          |          |        |               |           |            |             |      |            |
| 4ea7-a2e9-  |          |          |        |               |           |            |             |      |            |
| c1e9d370c13 |          |          |        |               |           |            |             |      |            |
| 1           |          |          |        |               |           |            |             |      |            |
+-------------+----------+----------+--------+---------------+-----------+------------+-------------+------+------------+

# 格納したキーのメタデータを参照

root@dlp ~(keystone)#
openstack secret get https://dlp.srv.world:9311/v1/secrets/c1d17a60-d297-4ea7-a2e9-c1e9d370c131

+---------------+--------------------------------------------------------------+
| Field         | Value                                                        |
+---------------+--------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/c1d17a60-d297-4ea7-    |
|               | a2e9-c1e9d370c131                                            |
| Name          | secret01                                                     |
| Created       | 2024-04-09T07:17:39+00:00                                    |
| Status        | ACTIVE                                                       |
| Content types | {'default': 'application/octet-stream'}                      |
| Algorithm     | aes                                                          |
| Bit length    | 256                                                          |
| Secret type   | opaque                                                       |
| Mode          | cbc                                                          |
| Expiration    | None                                                         |
+---------------+--------------------------------------------------------------+

# 格納したキーのデータを参照

root@dlp ~(keystone)#
openstack secret get https://dlp.srv.world:9311/v1/secrets/a468213a-091c-4e2d-8e08-23baa38bcc22 --payload

+---------+-----------+
| Field   | Value     |
+---------+-----------+
| Payload | secretkey |
+---------+-----------+

# キーを生成して格納する場合は以下

root@dlp ~(keystone)#
openstack secret order create --name secret02 --algorithm aes --bit-length 256 \
--mode cbc --payload-content-type application/octet-stream key

+----------------+-------------------------------------------------------------+
| Field          | Value                                                       |
+----------------+-------------------------------------------------------------+
| Order href     | https://dlp.srv.world:9311/v1/orders/aa064211-ada4-49a1-    |
|                | b4b5-361c17c72bda                                           |
| Type           | Key                                                         |
| Container href | N/A                                                         |
| Secret href    | None                                                        |
| Created        | None                                                        |
| Status         | None                                                        |
| Error code     | None                                                        |
| Error message  | None                                                        |
+----------------+-------------------------------------------------------------+

# 生成したキーの一覧を表示

root@dlp ~(keystone)#
openstack secret order list

+------------+------+----------------+-------------+----------+--------+------------+---------------+
| Order href | Type | Container href | Secret href | Created  | Status | Error code | Error message |
+------------+------+----------------+-------------+----------+--------+------------+---------------+
| https://dl | Key  | N/A            | https://dlp | 2024-04- | ACTIVE | None       | None          |
| p.srv.worl |      |                | .srv.world: | 09T07:20 |        |            |               |
| d:9311/v1/ |      |                | 9311/v1/sec | :42+00:0 |        |            |               |
| orders/aa0 |      |                | rets/b8c64a | 0        |        |            |               |
| 64211-     |      |                | 5b-e75f-    |          |        |            |               |
| ada4-49a1- |      |                | 4e27-af6d-  |          |        |            |               |
| b4b5-      |      |                | 8974d0005ff |          |        |            |               |
| 361c17c72b |      |                | e           |          |        |            |               |
| da         |      |                |             |          |        |            |               |
+------------+------+----------------+-------------+----------+--------+------------+---------------+

# 生成したキーを参照

root@dlp ~(keystone)#
openstack secret order get https://dlp.srv.world:9311/v1/orders/aa064211-ada4-49a1-b4b5-361c17c72bda

+----------------+-------------------------------------------------------------+
| Field          | Value                                                       |
+----------------+-------------------------------------------------------------+
| Order href     | https://dlp.srv.world:9311/v1/orders/aa064211-ada4-49a1-    |
|                | b4b5-361c17c72bda                                           |
| Type           | Key                                                         |
| Container href | N/A                                                         |
| Secret href    | https://dlp.srv.world:9311/v1/secrets/b8c64a5b-e75f-4e27-   |
|                | af6d-8974d0005ffe                                           |
| Created        | 2024-04-09T07:20:42+00:00                                   |
| Status         | ACTIVE                                                      |
| Error code     | None                                                        |
| Error message  | None                                                        |
+----------------+-------------------------------------------------------------+

# 生成したキーのメタデータを参照

root@dlp ~(keystone)#
openstack secret get https://dlp.srv.world:9311/v1/secrets/b8c64a5b-e75f-4e27-af6d-8974d0005ffe

+---------------+--------------------------------------------------------------+
| Field         | Value                                                        |
+---------------+--------------------------------------------------------------+
| Secret href   | https://dlp.srv.world:9311/v1/secrets/b8c64a5b-e75f-4e27-    |
|               | af6d-8974d0005ffe                                            |
| Name          | secret02                                                     |
| Created       | 2024-04-09T07:20:42+00:00                                    |
| Status        | ACTIVE                                                       |
| Content types | {'default': 'application/octet-stream'}                      |
| Algorithm     | aes                                                          |
| Bit length    | 256                                                          |
| Secret type   | symmetric                                                    |
| Mode          | cbc                                                          |
| Expiration    | None                                                         |
+---------------+--------------------------------------------------------------+
関連コンテンツ