Skip to content

Commit 3cab58f

Browse files
Mauricio Harleyvakwetu
Mauricio Harley
and
vakwetu
committed
Barbican support for Thales Luna HSM
Signed-off-by: Mauricio Harley <[email protected]> Co-authored-by: Ade Lee <[email protected]>
1 parent e1b6b7c commit 3cab58f

22 files changed

+1221
-14
lines changed

‎api/bases/barbican.openstack.org_barbicanapis.yaml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,25 @@ spec:
8080
description: EnableSecureRBAC - Enable Consistent and Secure RBAC
8181
policies
8282
type: boolean
83+
enabledSecretStores:
84+
items:
85+
description: This SecretStore type is used by the EnabledSecretStores
86+
variable inside the specification.
87+
enum:
88+
- simple_crypto
89+
- pkcs11
90+
type: string
91+
maxItems: 2
92+
minItems: 1
93+
type: array
94+
globalDefaultSecretStore:
95+
default: simple_crypto
96+
description: This SecretStore type is used by the EnabledSecretStores
97+
variable inside the specification.
98+
enum:
99+
- simple_crypto
100+
- pkcs11
101+
type: string
83102
networkAttachments:
84103
description: NetworkAttachments is a list of NetworkAttachment resource
85104
names to expose the services to the given network
@@ -283,6 +302,77 @@ spec:
283302
default: SimpleCryptoKEK
284303
type: string
285304
type: object
305+
pkcs11:
306+
description: BarbicanPKCS11Template - Includes all common HSM properties
307+
properties:
308+
hsmCertificatesMountPoint:
309+
description: The mounting point where the certificates will be
310+
copied to (e.g., /usr/local/luna/config/certs).
311+
type: string
312+
hsmCertificatesSecret:
313+
description: The OpenShift secret that stores the HSM certificates.
314+
type: string
315+
hsmClientAddress:
316+
description: The IP address of the client connecting to the HSM
317+
(X.Y.Z.K)
318+
type: string
319+
hsmEnabled:
320+
default: false
321+
type: boolean
322+
hsmHMACLabel:
323+
description: Label to identify HMAC key in the HSM (must not be
324+
the same as MKEK label)
325+
type: string
326+
hsmIpAddress:
327+
description: The HSM's IPv4 address (X.Y.Z.K)
328+
type: string
329+
hsmLibraryPath:
330+
description: Path to vendor's PKCS11 library
331+
type: string
332+
hsmLoggingLevel:
333+
default: 4
334+
description: Level of logging, where 0 means "no logging" and
335+
7 means "debug".
336+
maximum: 7
337+
minimum: 0
338+
type: integer
339+
hsmLoginSecret:
340+
description: OpenShift secret that stores the password to login
341+
to the PKCS11 session
342+
type: string
343+
hsmMKEKLabel:
344+
description: Label to identify master KEK in the HSM (must not
345+
be the same as HMAC label)
346+
type: string
347+
hsmMKEKLength:
348+
default: 32
349+
description: Length in bytes of master KEK
350+
type: integer
351+
hsmSlotId:
352+
description: HSM Slot ID that contains the token device to be
353+
used
354+
type: string
355+
hsmTokenLabel:
356+
description: Token label used to identify the token to be used.
357+
Required when token_serial_number is not specified.
358+
type: string
359+
hsmTokenSerialNumber:
360+
description: Token serial number used to identify the token to
361+
be used. Required when the device has multiple tokens with the
362+
same label.
363+
type: string
364+
hsmType:
365+
description: 'A string containing the HSM type (currently supported:
366+
"trustway", "luna", "ncipher").'
367+
type: string
368+
required:
369+
- hsmHMACLabel
370+
- hsmIpAddress
371+
- hsmLibraryPath
372+
- hsmLoginSecret
373+
- hsmMKEKLabel
374+
- hsmType
375+
type: object
286376
rabbitMqClusterName:
287377
default: rabbitmq
288378
description: RabbitMQ instance name Needed to request a transportURL

‎api/bases/barbican.openstack.org_barbicankeystonelisteners.yaml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,25 @@ spec:
7676
files. Those get added to the service config dir in /etc/<service>
7777
. TODO: -> implement'
7878
type: object
79+
enabledSecretStores:
80+
items:
81+
description: This SecretStore type is used by the EnabledSecretStores
82+
variable inside the specification.
83+
enum:
84+
- simple_crypto
85+
- pkcs11
86+
type: string
87+
maxItems: 2
88+
minItems: 1
89+
type: array
90+
globalDefaultSecretStore:
91+
default: simple_crypto
92+
description: This SecretStore type is used by the EnabledSecretStores
93+
variable inside the specification.
94+
enum:
95+
- simple_crypto
96+
- pkcs11
97+
type: string
7998
networkAttachments:
8099
description: NetworkAttachments is a list of NetworkAttachment resource
81100
names to expose the services to the given network
@@ -105,6 +124,77 @@ spec:
105124
default: SimpleCryptoKEK
106125
type: string
107126
type: object
127+
pkcs11:
128+
description: BarbicanPKCS11Template - Includes all common HSM properties
129+
properties:
130+
hsmCertificatesMountPoint:
131+
description: The mounting point where the certificates will be
132+
copied to (e.g., /usr/local/luna/config/certs).
133+
type: string
134+
hsmCertificatesSecret:
135+
description: The OpenShift secret that stores the HSM certificates.
136+
type: string
137+
hsmClientAddress:
138+
description: The IP address of the client connecting to the HSM
139+
(X.Y.Z.K)
140+
type: string
141+
hsmEnabled:
142+
default: false
143+
type: boolean
144+
hsmHMACLabel:
145+
description: Label to identify HMAC key in the HSM (must not be
146+
the same as MKEK label)
147+
type: string
148+
hsmIpAddress:
149+
description: The HSM's IPv4 address (X.Y.Z.K)
150+
type: string
151+
hsmLibraryPath:
152+
description: Path to vendor's PKCS11 library
153+
type: string
154+
hsmLoggingLevel:
155+
default: 4
156+
description: Level of logging, where 0 means "no logging" and
157+
7 means "debug".
158+
maximum: 7
159+
minimum: 0
160+
type: integer
161+
hsmLoginSecret:
162+
description: OpenShift secret that stores the password to login
163+
to the PKCS11 session
164+
type: string
165+
hsmMKEKLabel:
166+
description: Label to identify master KEK in the HSM (must not
167+
be the same as HMAC label)
168+
type: string
169+
hsmMKEKLength:
170+
default: 32
171+
description: Length in bytes of master KEK
172+
type: integer
173+
hsmSlotId:
174+
description: HSM Slot ID that contains the token device to be
175+
used
176+
type: string
177+
hsmTokenLabel:
178+
description: Token label used to identify the token to be used.
179+
Required when token_serial_number is not specified.
180+
type: string
181+
hsmTokenSerialNumber:
182+
description: Token serial number used to identify the token to
183+
be used. Required when the device has multiple tokens with the
184+
same label.
185+
type: string
186+
hsmType:
187+
description: 'A string containing the HSM type (currently supported:
188+
"trustway", "luna", "ncipher").'
189+
type: string
190+
required:
191+
- hsmHMACLabel
192+
- hsmIpAddress
193+
- hsmLibraryPath
194+
- hsmLoginSecret
195+
- hsmMKEKLabel
196+
- hsmType
197+
type: object
108198
rabbitMqClusterName:
109199
default: rabbitmq
110200
description: RabbitMQ instance name Needed to request a transportURL

‎api/bases/barbican.openstack.org_barbicans.yaml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -592,6 +592,25 @@ spec:
592592
to add additional files. Those get added to the service config dir
593593
in /etc/<service> . TODO(dmendiza): -> implement'
594594
type: object
595+
enabledSecretStores:
596+
items:
597+
description: This SecretStore type is used by the EnabledSecretStores
598+
variable inside the specification.
599+
enum:
600+
- simple_crypto
601+
- pkcs11
602+
type: string
603+
maxItems: 2
604+
minItems: 1
605+
type: array
606+
globalDefaultSecretStore:
607+
default: simple_crypto
608+
description: This SecretStore type is used by the EnabledSecretStores
609+
variable inside the specification.
610+
enum:
611+
- simple_crypto
612+
- pkcs11
613+
type: string
595614
nodeSelector:
596615
additionalProperties:
597616
type: string
@@ -615,6 +634,77 @@ spec:
615634
default: SimpleCryptoKEK
616635
type: string
617636
type: object
637+
pkcs11:
638+
description: BarbicanPKCS11Template - Includes all common HSM properties
639+
properties:
640+
hsmCertificatesMountPoint:
641+
description: The mounting point where the certificates will be
642+
copied to (e.g., /usr/local/luna/config/certs).
643+
type: string
644+
hsmCertificatesSecret:
645+
description: The OpenShift secret that stores the HSM certificates.
646+
type: string
647+
hsmClientAddress:
648+
description: The IP address of the client connecting to the HSM
649+
(X.Y.Z.K)
650+
type: string
651+
hsmEnabled:
652+
default: false
653+
type: boolean
654+
hsmHMACLabel:
655+
description: Label to identify HMAC key in the HSM (must not be
656+
the same as MKEK label)
657+
type: string
658+
hsmIpAddress:
659+
description: The HSM's IPv4 address (X.Y.Z.K)
660+
type: string
661+
hsmLibraryPath:
662+
description: Path to vendor's PKCS11 library
663+
type: string
664+
hsmLoggingLevel:
665+
default: 4
666+
description: Level of logging, where 0 means "no logging" and
667+
7 means "debug".
668+
maximum: 7
669+
minimum: 0
670+
type: integer
671+
hsmLoginSecret:
672+
description: OpenShift secret that stores the password to login
673+
to the PKCS11 session
674+
type: string
675+
hsmMKEKLabel:
676+
description: Label to identify master KEK in the HSM (must not
677+
be the same as HMAC label)
678+
type: string
679+
hsmMKEKLength:
680+
default: 32
681+
description: Length in bytes of master KEK
682+
type: integer
683+
hsmSlotId:
684+
description: HSM Slot ID that contains the token device to be
685+
used
686+
type: string
687+
hsmTokenLabel:
688+
description: Token label used to identify the token to be used.
689+
Required when token_serial_number is not specified.
690+
type: string
691+
hsmTokenSerialNumber:
692+
description: Token serial number used to identify the token to
693+
be used. Required when the device has multiple tokens with the
694+
same label.
695+
type: string
696+
hsmType:
697+
description: 'A string containing the HSM type (currently supported:
698+
"trustway", "luna", "ncipher").'
699+
type: string
700+
required:
701+
- hsmHMACLabel
702+
- hsmIpAddress
703+
- hsmLibraryPath
704+
- hsmLoginSecret
705+
- hsmMKEKLabel
706+
- hsmType
707+
type: object
618708
preserveJobs:
619709
default: false
620710
description: PreserveJobs - do not delete jobs after they finished

0 commit comments

Comments
 (0)