Skip to content

Commit 5cc4fc0

Browse files
author
Mauricio Harley
committed
Barbican Support for Luna HSM
Signed-off-by: Mauricio Harley <[email protected]>
1 parent 937f88a commit 5cc4fc0

10 files changed

+92
-36
lines changed

‎api/bases/barbican.openstack.org_barbicanapis.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,10 +81,12 @@ spec:
8181
policies
8282
type: boolean
8383
enabledSecretStores:
84-
default: '["simple_crypto"]'
8584
items:
85+
enum:
86+
- simple_crypto
87+
- pkcs11
8688
type: string
87-
maxItems: 5
89+
maxItems: 2
8890
minItems: 1
8991
type: array
9092
globalDefaultSecretStore:

‎api/bases/barbican.openstack.org_barbicanworkers.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,10 +75,12 @@ spec:
7575
. TODO: -> implement'
7676
type: object
7777
enabledSecretStores:
78-
default: '["simple_crypto"]'
7978
items:
79+
enum:
80+
- simple_crypto
81+
- pkcs11
8082
type: string
81-
maxItems: 5
83+
maxItems: 2
8284
minItems: 1
8385
type: array
8486
globalDefaultSecretStore:

‎api/v1beta1/barbicanapi_types.go‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,9 @@ type APIOverrideSpec struct {
5858
Service map[service.Endpoint]service.RoutedOverrideSpec `json:"service,omitempty"`
5959
}
6060

61+
// +kubebuilder:validation:Enum=simple_crypto;pkcs11
62+
type SecretStore string
63+
6164
// BarbicanAPISpec defines the desired state of BarbicanAPI
6265
type BarbicanAPISpec struct {
6366
BarbicanTemplate `json:",inline"`
@@ -67,12 +70,10 @@ type BarbicanAPISpec struct {
6770
// +kubebuilder:validation:Optional
6871
PKCS11 BarbicanPKCS11Template `json:"pkcs11,omitempty"`
6972

70-
// +kubebuilder:validation:Required
73+
// +kubebuilder:validation:Optional
7174
// +kubebuilder:validation:MinItems=1
72-
// +kubebuilder:validation:MaxItems=5
73-
// +kubebuilder:validation:Items:Enum=simple_crypto;kmip;pkcs11;dogtag;vault
74-
// +kubebuilder:default=["simple_crypto"]
75-
EnabledSecretStores []string `json:"enabledSecretStores"`
75+
// +kubebuilder:validation:MaxItems=2
76+
EnabledSecretStores []SecretStore `json:"enabledSecretStores,omitempty"`
7677

7778
// +kubebuilder:validation:Optional
7879
// +kubebuilder:default="simple_crypto"

‎api/v1beta1/barbicanworker_types.go‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -48,12 +48,10 @@ type BarbicanWorkerSpec struct {
4848
// +kubebuilder:validation:Optional
4949
PKCS11 BarbicanPKCS11Template `json:"pkcs11,omitempty"`
5050

51-
// +kubebuilder:validation:Required
51+
// +kubebuilder:validation:Optional
5252
// +kubebuilder:validation:MinItems=1
53-
// +kubebuilder:validation:MaxItems=5
54-
// +kubebuilder:validation:Items:Enum=simple_crypto;kmip;pkcs11;dogtag;vault
55-
// +kubebuilder:default=["simple_crypto"]
56-
EnabledSecretStores []string `json:"enabledSecretStores"`
53+
// +kubebuilder:validation:MaxItems=2
54+
EnabledSecretStores []SecretStore `json:"enabledSecretStores"`
5755

5856
// +kubebuilder:validation:Optional
5957
// +kubebuilder:default="simple_crypto"

‎api/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/barbican.openstack.org_barbicanapis.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,10 +81,12 @@ spec:
8181
policies
8282
type: boolean
8383
enabledSecretStores:
84-
default: '["simple_crypto"]'
8584
items:
85+
enum:
86+
- simple_crypto
87+
- pkcs11
8688
type: string
87-
maxItems: 5
89+
maxItems: 2
8890
minItems: 1
8991
type: array
9092
globalDefaultSecretStore:

‎config/crd/bases/barbican.openstack.org_barbicanworkers.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,10 +75,12 @@ spec:
7575
. TODO: -> implement'
7676
type: object
7777
enabledSecretStores:
78-
default: '["simple_crypto"]'
7978
items:
79+
enum:
80+
- simple_crypto
81+
- pkcs11
8082
type: string
81-
maxItems: 5
83+
maxItems: 2
8284
minItems: 1
8385
type: array
8486
globalDefaultSecretStore:

‎controllers/barbicanapi_controller.go‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -310,6 +310,21 @@ func (r *BarbicanAPIReconciler) generateServiceConfigs(
310310

311311
databaseAccount := db.GetAccount()
312312
databaseSecret := db.GetSecret()
313+
enabledSecretStores := []string{}
314+
if len(instance.Spec.EnabledSecretStores) == 0 {
315+
enabledSecretStores = []string{"simple_crypto"}
316+
} else {
317+
for _, value := range instance.Spec.EnabledSecretStores {
318+
enabledSecretStores = append(enabledSecretStores, string(value))
319+
}
320+
}
321+
globalDefaultSecretStore := ""
322+
if len(instance.Spec.GlobalDefaultSecretStore) == 0 {
323+
globalDefaultSecretStore = "simple_crypto"
324+
} else {
325+
globalDefaultSecretStore = instance.Spec.GlobalDefaultSecretStore
326+
}
327+
313328
templateParameters := map[string]interface{}{
314329
"DatabaseConnection": fmt.Sprintf("mysql+pymysql://%s:%s@%s/%s?read_default_file=/etc/my.cnf",
315330
databaseAccount.Spec.UserName,
@@ -325,19 +340,20 @@ func (r *BarbicanAPIReconciler) generateServiceConfigs(
325340
"LogFile": fmt.Sprintf("%s%s.log", barbican.BarbicanLogPath, instance.Name),
326341
"SimpleCryptoKEK": string(simpleCryptoSecret.Data[instance.Spec.PasswordSelectors.SimpleCryptoKEK]),
327342
"EnableSecureRBAC": instance.Spec.EnableSecureRBAC,
328-
"EnabledSecretStores": strings.Join(instance.Spec.EnabledSecretStores, ","),
329-
"GlobalDefaultSecretStore": instance.Spec.GlobalDefaultSecretStore,
330-
"SimpleCryptoEnabled": slices.Contains(instance.Spec.EnabledSecretStores, "simple_crypto"),
331-
"PKCS11CryptoEnabled": slices.Contains(instance.Spec.EnabledSecretStores, "pkcs11_crypto"),
343+
"EnabledSecretStores": strings.Join(enabledSecretStores, ","),
344+
"GlobalDefaultSecretStore": globalDefaultSecretStore,
345+
"SimpleCryptoEnabled": slices.Contains(enabledSecretStores, "simple_crypto"),
346+
"PKCS11CryptoEnabled": slices.Contains(enabledSecretStores, "pkcs11"),
332347
}
333348

334349
// Checking if there's an HSM.
335-
pkcs11 := instance.Spec.PKCS11
336-
if len(pkcs11.HSMLibraryPath) > 0 {
350+
if slices.Contains(enabledSecretStores, "pkcs11") {
351+
pkcs11 := instance.Spec.PKCS11
337352
hsmLoginSecret, _, err := secret.GetSecret(ctx, h, pkcs11.HSMLogin, instance.Namespace)
338353
if err != nil {
339354
return err
340355
}
356+
templateParameters["HSMEnabled"] = true
341357
templateParameters["HSMLibraryPath"] = pkcs11.HSMLibraryPath
342358
templateParameters["HSMTokenSerialNumber"] = pkcs11.HSMTokenSerialNumber
343359
templateParameters["HSMTokenLabel"] = pkcs11.HSMTokenLabel

‎controllers/barbicanworker_controller.go‎

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -267,6 +267,20 @@ func (r *BarbicanWorkerReconciler) generateServiceConfigs(
267267

268268
databaseAccount := db.GetAccount()
269269
databaseSecret := db.GetSecret()
270+
enabledSecretStores := []string{}
271+
if len(instance.Spec.EnabledSecretStores) == 0 {
272+
enabledSecretStores = []string{"simple_crypto"}
273+
} else {
274+
for _, value := range instance.Spec.EnabledSecretStores {
275+
enabledSecretStores = append(enabledSecretStores, string(value))
276+
}
277+
}
278+
globalDefaultSecretStore := ""
279+
if len(instance.Spec.GlobalDefaultSecretStore) == 0 {
280+
globalDefaultSecretStore = "simple_crypto"
281+
} else {
282+
globalDefaultSecretStore = instance.Spec.GlobalDefaultSecretStore
283+
}
270284

271285
templateParameters := map[string]interface{}{
272286
"DatabaseConnection": fmt.Sprintf("mysql+pymysql://%s:%s@%s/%s?read_default_file=/etc/my.cnf",
@@ -278,19 +292,20 @@ func (r *BarbicanWorkerReconciler) generateServiceConfigs(
278292
"TransportURL": string(transportURLSecret.Data["transport_url"]),
279293
"LogFile": fmt.Sprintf("%s%s.log", barbican.BarbicanLogPath, instance.Name),
280294
"SimpleCryptoKEK": string(simpleCryptoSecret.Data[instance.Spec.PasswordSelectors.SimpleCryptoKEK]),
281-
"EnabledSecretStores": strings.Join(instance.Spec.EnabledSecretStores, ","),
282-
"GlobalDefaultSecretStore": instance.Spec.GlobalDefaultSecretStore,
283-
"SimpleCryptoEnabled": slices.Contains(instance.Spec.EnabledSecretStores, "simple_crypto"),
284-
"PKCS11CryptoEnabled": slices.Contains(instance.Spec.EnabledSecretStores, "pkcs11_crypto"),
295+
"EnabledSecretStores": strings.Join(enabledSecretStores, ","),
296+
"GlobalDefaultSecretStore": globalDefaultSecretStore,
297+
"SimpleCryptoEnabled": slices.Contains(enabledSecretStores, "simple_crypto"),
298+
"PKCS11CryptoEnabled": slices.Contains(enabledSecretStores, "pkcs11"),
285299
}
286300

287301
// Checking if there's an HSM.
288-
pkcs11 := instance.Spec.PKCS11
289-
if len(pkcs11.HSMLibraryPath) > 0 {
302+
if slices.Contains(enabledSecretStores, "pkcs11") {
303+
pkcs11 := instance.Spec.PKCS11
290304
hsmLoginSecret, _, err := secret.GetSecret(ctx, h, pkcs11.HSMLogin, instance.Namespace)
291305
if err != nil {
292306
return err
293307
}
308+
templateParameters["HSMEnabled"] = true
294309
templateParameters["HSMLibraryPath"] = pkcs11.HSMLibraryPath
295310
templateParameters["HSMTokenSerialNumber"] = pkcs11.HSMTokenSerialNumber
296311
templateParameters["HSMTokenLabel"] = pkcs11.HSMTokenLabel

‎templates/barbican/config/00-default.conf‎

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -50,14 +50,32 @@ stores_lookup_suffix = {{ .EnabledSecretStores }}
5050
[secretstore:software]
5151
secret_store_plugin = store_crypto
5252
crypto_plugin = simple_crypto
53-
{{ if .GlobalDefaultSecretStore == "simple_crypto" }}
54-
global_default = true
5553
{{ end }}
54+
{{ if eq .GlobalDefaultSecretStore "simple_crypto" }} global_default = true {{ end }}
5655

56+
{{ if .SimpleCryptoEnabled }}
5757
[simple_crypto_plugin]
5858
plugin_name = Software Only Crypto
59-
{{ if (index . "SimpleCryptoKEK") }}
60-
kek = {{ .SimpleCryptoKEK }}
59+
{{ end }}
60+
{{ if (index . "SimpleCryptoKEK") }} kek = {{ .SimpleCryptoKEK }} {{ end }}
61+
62+
{{ if and (index . "HSMEnabled") .HSMEnabled }}
63+
[secretstore:pkcs11]
64+
secret_store_plugin = store_crypto
65+
crypto_plugin = p11_crypto
66+
{{ end }}
67+
{{ if eq .GlobalDefaultSecretStore "pkcs11" }} global_default = true {{ end }}
68+
69+
{{ if and (index . "HSMEnabled") .HSMEnabled }}
70+
[p11_crypto_plugin]
71+
library_path = {{ .HSMLibraryPath }}
72+
token_serial_number = {{ .HSMTokenSerialNumber }}
73+
token_label = {{ .HSMTokenLabel }}
74+
login = {{ .HSMLogin }}
75+
mkek_label = {{ .HSMMKEKLabel }}
76+
mkek_length = {{ .HSMMKEKLength }}
77+
hmac_label = {{ .HSMHMACLabel }}
78+
slot_id = {{ .HSMSlotId }}
6179
{{ end }}
6280
{{ end }}
6381

0 commit comments

Comments
 (0)