Skip to content

Commit 5c432fb

Browse files
author
Mauricio Harley
committed
Barbican Support for Luna HSM
Signed-off-by: Mauricio Harley <[email protected]>
1 parent 7e1eb28 commit 5c432fb

8 files changed

+8
-80
lines changed

‎api/bases/barbican.openstack.org_barbicanapis.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@ spec:
8484
default: '["simple_crypto"]'
8585
items:
8686
type: string
87+
maxItems: 5
8788
minItems: 1
8889
type: array
8990
globalDefaultSecretStore:

‎api/bases/barbican.openstack.org_barbicanworkers.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ spec:
7878
default: '["simple_crypto"]'
7979
items:
8080
type: string
81+
maxItems: 5
8182
minItems: 1
8283
type: array
8384
globalDefaultSecretStore:

‎api/v1beta1/barbicanapi_types.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,8 @@ type BarbicanAPISpec struct {
6969

7070
// +kubebuilder:validation:Required
7171
// +kubebuilder:validation:MinItems=1
72+
// +kubebuilder:validation:MaxItems=5
73+
// +kubebuilder:validation:Items:Enum=simple_crypto;kmip;pkcs11;dogtag;vault
7274
// +kubebuilder:default=["simple_crypto"]
7375
EnabledSecretStores []string `json:"enabledSecretStores"`
7476

‎api/v1beta1/barbicanworker_types.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,8 @@ type BarbicanWorkerSpec struct {
5050

5151
// +kubebuilder:validation:Required
5252
// +kubebuilder:validation:MinItems=1
53+
// +kubebuilder:validation:MaxItems=5
54+
// +kubebuilder:validation:Items:Enum=simple_crypto;kmip;pkcs11;dogtag;vault
5355
// +kubebuilder:default=["simple_crypto"]
5456
EnabledSecretStores []string `json:"enabledSecretStores"`
5557

‎config/crd/bases/barbican.openstack.org_barbicanapis.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@ spec:
8484
default: '["simple_crypto"]'
8585
items:
8686
type: string
87+
maxItems: 5
8788
minItems: 1
8889
type: array
8990
globalDefaultSecretStore:

‎config/crd/bases/barbican.openstack.org_barbicanworkers.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ spec:
7878
default: '["simple_crypto"]'
7979
items:
8080
type: string
81+
maxItems: 5
8182
minItems: 1
8283
type: array
8384
globalDefaultSecretStore:

‎controllers/barbicanapi_controller.go‎

Lines changed: 0 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,6 @@ import (
4141
"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
4242
"github.com/openstack-k8s-operators/lib-common/modules/common/util"
4343
mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1"
44-
"golang.org/x/exp/maps"
4544
"k8s.io/apimachinery/pkg/fields"
4645
"k8s.io/apimachinery/pkg/runtime"
4746
"k8s.io/apimachinery/pkg/types"
@@ -353,45 +352,6 @@ func (r *BarbicanAPIReconciler) generateServiceConfigs(
353352
templateParameters["HSMType"] = pkcs11.HSMType
354353
}
355354

356-
// Checking if there's an HSM.
357-
pkcs11 := instance.Spec.PKCS11
358-
if pkcs11.HSMEnabled {
359-
hsmLoginSecret, _, err := secret.GetSecret(ctx, h, pkcs11.HSMLogin, instance.Namespace)
360-
if err != nil {
361-
return err
362-
}
363-
hsmCertificatesSecret, _, err := secret.GetSecret(ctx, h, maps.Keys(pkcs11.HSMCertificates)[0], instance.Namespace)
364-
if err != nil {
365-
return err
366-
}
367-
templateParameters["HSMEnabled"] = pkcs11.HSMEnabled
368-
templateParameters["HSMLibraryPath"] = pkcs11.HSMLibraryPath
369-
templateParameters["HSMTokenSerialNumber"] = pkcs11.HSMTokenSerialNumber
370-
templateParameters["HSMTokenLabel"] = pkcs11.HSMTokenLabel
371-
templateParameters["HSMLogin"] = string(hsmLoginSecret.Data["hsmLogin"])
372-
templateParameters["HSMMKEKLabel"] = pkcs11.HSMMKEKLabel
373-
templateParameters["HSMMKEKLength"] = pkcs11.HSMMKEKLength
374-
templateParameters["HSMHMACLabel"] = pkcs11.HSMHMACLabel
375-
templateParameters["HSMSlotId"] = pkcs11.HSMSlotId
376-
templateParameters["HSMLoggingLevel"] = pkcs11.HSMLoggingLevel
377-
templateParameters["HSMIPAddress"] = pkcs11.HSMIPAddress
378-
templateParameters["HSMClientAddress"] = pkcs11.HSMClientAddress
379-
templateParameters["HSMType"] = pkcs11.HSMType
380-
templateParameters["HSMCertificatesMountPoint"] = maps.Values(pkcs11.HSMCertificates)[0]
381-
for certfile, certificate := range hsmCertificatesSecret.Data {
382-
if strings.HasSuffix(certfile, "Cert.pem") {
383-
templateParameters["HSMServerCertfile"] = certfile
384-
templateParameters["HSMServerCertificate"] = certificate
385-
} else if strings.HasSuffix(certfile, "Key.pem") {
386-
templateParameters["HSMClientKeyFile"] = certfile
387-
templateParameters["HSMClientKey"] = certificate
388-
} else if !(strings.HasSuffix(certfile, "File.pem")) { // Excluding "CAFile.pem".
389-
templateParameters["HSMClientCertfile"] = certfile
390-
templateParameters["HSMClientCertificate"] = certificate
391-
}
392-
}
393-
}
394-
395355
// create httpd vhost template parameters
396356
httpdVhostConfig := map[string]interface{}{}
397357
for _, endpt := range []service.Endpoint{service.EndpointInternal, service.EndpointPublic} {

‎controllers/barbicanworker_controller.go‎

Lines changed: 0 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,6 @@ import (
4040
nad "github.com/openstack-k8s-operators/lib-common/modules/common/networkattachment"
4141
"github.com/openstack-k8s-operators/lib-common/modules/common/secret"
4242
"github.com/openstack-k8s-operators/lib-common/modules/common/util"
43-
"golang.org/x/exp/maps"
4443
"k8s.io/apimachinery/pkg/fields"
4544
"k8s.io/apimachinery/pkg/runtime"
4645
"k8s.io/apimachinery/pkg/types"
@@ -306,45 +305,6 @@ func (r *BarbicanWorkerReconciler) generateServiceConfigs(
306305
templateParameters["HSMType"] = pkcs11.HSMType
307306
}
308307

309-
// Checking if there's an HSM.
310-
pkcs11 := instance.Spec.PKCS11
311-
if pkcs11.HSMEnabled {
312-
hsmLoginSecret, _, err := secret.GetSecret(ctx, h, pkcs11.HSMLogin, instance.Namespace)
313-
if err != nil {
314-
return err
315-
}
316-
hsmCertificatesSecret, _, err := secret.GetSecret(ctx, h, maps.Keys(pkcs11.HSMCertificates)[0], instance.Namespace)
317-
if err != nil {
318-
return err
319-
}
320-
templateParameters["HSMEnabled"] = pkcs11.HSMEnabled
321-
templateParameters["HSMLibraryPath"] = pkcs11.HSMLibraryPath
322-
templateParameters["HSMTokenSerialNumber"] = pkcs11.HSMTokenSerialNumber
323-
templateParameters["HSMTokenLabel"] = pkcs11.HSMTokenLabel
324-
templateParameters["HSMLogin"] = string(hsmLoginSecret.Data["hsmLogin"])
325-
templateParameters["HSMMKEKLabel"] = pkcs11.HSMMKEKLabel
326-
templateParameters["HSMMKEKLength"] = pkcs11.HSMMKEKLength
327-
templateParameters["HSMHMACLabel"] = pkcs11.HSMHMACLabel
328-
templateParameters["HSMSlotId"] = pkcs11.HSMSlotId
329-
templateParameters["HSMLoggingLevel"] = pkcs11.HSMLoggingLevel
330-
templateParameters["HSMIPAddress"] = pkcs11.HSMIPAddress
331-
templateParameters["HSMClientAddress"] = pkcs11.HSMClientAddress
332-
templateParameters["HSMType"] = pkcs11.HSMType
333-
templateParameters["HSMCertificatesMountPoint"] = maps.Values(pkcs11.HSMCertificates)[0]
334-
for certfile, certificate := range hsmCertificatesSecret.Data {
335-
if strings.HasSuffix(certfile, "Cert.pem") {
336-
templateParameters["HSMServerCertfile"] = certfile
337-
templateParameters["HSMServerCertificate"] = certificate
338-
} else if strings.HasSuffix(certfile, "Key.pem") {
339-
templateParameters["HSMClientKeyFile"] = certfile
340-
templateParameters["HSMClientKey"] = certificate
341-
} else if !(strings.HasSuffix(certfile, "File.pem")) { // Excluding "CAFile.pem".
342-
templateParameters["HSMClientCertfile"] = certfile
343-
templateParameters["HSMClientCertificate"] = certificate
344-
}
345-
}
346-
}
347-
348308
return GenerateConfigsGeneric(ctx, h, instance, envVars, templateParameters, customData, labels, false)
349309
}
350310

0 commit comments

Comments
 (0)