Skip to content

Commit 74c8370

Browse files
author
Mauricio Harley
committed
Barbican Support for Luna HSM
Signed-off-by: Mauricio Harley <[email protected]>
1 parent 36ae13a commit 74c8370

17 files changed

+466
-43
lines changed

‎api/bases/barbican.openstack.org_barbicanapis.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,8 @@ spec:
8282
type: boolean
8383
enabledSecretStores:
8484
items:
85+
description: This SecretStore type is used by the EnabledSecretStores
86+
variable inside the specification.
8587
enum:
8688
- simple_crypto
8789
- pkcs11
@@ -477,7 +479,6 @@ spec:
477479
- containerImage
478480
- databaseHostname
479481
- databaseInstance
480-
- enabledSecretStores
481482
- rabbitMqClusterName
482483
- serviceAccount
483484
type: object

‎api/bases/barbican.openstack.org_barbicankeystonelisteners.yaml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,20 @@ spec:
7676
files. Those get added to the service config dir in /etc/<service>
7777
. TODO: -> implement'
7878
type: object
79+
enabledSecretStores:
80+
items:
81+
description: This SecretStore type is used by the EnabledSecretStores
82+
variable inside the specification.
83+
enum:
84+
- simple_crypto
85+
- pkcs11
86+
type: string
87+
maxItems: 2
88+
minItems: 1
89+
type: array
90+
globalDefaultSecretStore:
91+
default: simple_crypto
92+
type: string
7993
networkAttachments:
8094
description: NetworkAttachments is a list of NetworkAttachment resource
8195
names to expose the services to the given network
@@ -105,6 +119,72 @@ spec:
105119
default: SimpleCryptoKEK
106120
type: string
107121
type: object
122+
pkcs11:
123+
description: BarbicanPKCS11Template - Includes all common HSM properties
124+
properties:
125+
hsmCertificates:
126+
additionalProperties:
127+
type: string
128+
description: 'The HSM certificates. The map''s key is the OpenShift
129+
secret storing the certificate, and the value is the mounting
130+
point (e.g., "luna-certificates": "/usr/local/luna/config/certs").'
131+
type: object
132+
hsmClientAddress:
133+
description: The IP address of the client connecting to the HSM
134+
(X.Y.Z.K)
135+
type: string
136+
hsmEnabled:
137+
default: false
138+
type: boolean
139+
hsmHMACLabel:
140+
description: Label to identify HMAC key in the HSM (must not be
141+
the same as MKEK label)
142+
type: string
143+
hsmIpAddress:
144+
description: The HSM's IPv4 address (X.Y.Z.K)
145+
type: string
146+
hsmLibraryPath:
147+
description: Path to vendor's PKCS11 library
148+
type: string
149+
hsmLoggingLevel:
150+
default: 4
151+
description: Level of logging, where 0 means "no logging" and
152+
7 means "debug".
153+
maximum: 7
154+
minimum: 0
155+
type: integer
156+
hsmLogin:
157+
description: OpenShift secret storing the password to login to
158+
PKCS11 session
159+
type: string
160+
hsmMKEKLabel:
161+
description: Label to identify master KEK in the HSM (must not
162+
be the same as HMAC label)
163+
type: string
164+
hsmMKEKLength:
165+
default: 32
166+
description: Length in bytes of master KEK
167+
type: integer
168+
hsmSlotId:
169+
default: 1
170+
description: HSM Slot ID that contains the token device to be
171+
used
172+
type: integer
173+
hsmTokenLabel:
174+
description: Token label used to identify the token to be used.
175+
Required when token_serial_number is not specified.
176+
type: string
177+
hsmTokenSerialNumber:
178+
default: "12345678"
179+
description: Token serial number used to identify the token to
180+
be used. Required when the device has multiple tokens with the
181+
same label.
182+
type: string
183+
hsmType:
184+
description: 'A string containing the HSM type (currently supported:
185+
"trustway", "luna", "ncipher").'
186+
type: string
187+
type: object
108188
rabbitMqClusterName:
109189
default: rabbitmq
110190
description: RabbitMQ instance name Needed to request a transportURL

‎api/bases/barbican.openstack.org_barbicans.yaml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -592,6 +592,20 @@ spec:
592592
to add additional files. Those get added to the service config dir
593593
in /etc/<service> . TODO(dmendiza): -> implement'
594594
type: object
595+
enabledSecretStores:
596+
items:
597+
description: This SecretStore type is used by the EnabledSecretStores
598+
variable inside the specification.
599+
enum:
600+
- simple_crypto
601+
- pkcs11
602+
type: string
603+
maxItems: 2
604+
minItems: 1
605+
type: array
606+
globalDefaultSecretStore:
607+
default: simple_crypto
608+
type: string
595609
nodeSelector:
596610
additionalProperties:
597611
type: string
@@ -615,6 +629,72 @@ spec:
615629
default: SimpleCryptoKEK
616630
type: string
617631
type: object
632+
pkcs11:
633+
description: BarbicanPKCS11Template - Includes all common HSM properties
634+
properties:
635+
hsmCertificates:
636+
additionalProperties:
637+
type: string
638+
description: 'The HSM certificates. The map''s key is the OpenShift
639+
secret storing the certificate, and the value is the mounting
640+
point (e.g., "luna-certificates": "/usr/local/luna/config/certs").'
641+
type: object
642+
hsmClientAddress:
643+
description: The IP address of the client connecting to the HSM
644+
(X.Y.Z.K)
645+
type: string
646+
hsmEnabled:
647+
default: false
648+
type: boolean
649+
hsmHMACLabel:
650+
description: Label to identify HMAC key in the HSM (must not be
651+
the same as MKEK label)
652+
type: string
653+
hsmIpAddress:
654+
description: The HSM's IPv4 address (X.Y.Z.K)
655+
type: string
656+
hsmLibraryPath:
657+
description: Path to vendor's PKCS11 library
658+
type: string
659+
hsmLoggingLevel:
660+
default: 4
661+
description: Level of logging, where 0 means "no logging" and
662+
7 means "debug".
663+
maximum: 7
664+
minimum: 0
665+
type: integer
666+
hsmLogin:
667+
description: OpenShift secret storing the password to login to
668+
PKCS11 session
669+
type: string
670+
hsmMKEKLabel:
671+
description: Label to identify master KEK in the HSM (must not
672+
be the same as HMAC label)
673+
type: string
674+
hsmMKEKLength:
675+
default: 32
676+
description: Length in bytes of master KEK
677+
type: integer
678+
hsmSlotId:
679+
default: 1
680+
description: HSM Slot ID that contains the token device to be
681+
used
682+
type: integer
683+
hsmTokenLabel:
684+
description: Token label used to identify the token to be used.
685+
Required when token_serial_number is not specified.
686+
type: string
687+
hsmTokenSerialNumber:
688+
default: "12345678"
689+
description: Token serial number used to identify the token to
690+
be used. Required when the device has multiple tokens with the
691+
same label.
692+
type: string
693+
hsmType:
694+
description: 'A string containing the HSM type (currently supported:
695+
"trustway", "luna", "ncipher").'
696+
type: string
697+
type: object
618698
preserveJobs:
619699
default: false
620700
description: PreserveJobs - do not delete jobs after they finished

‎api/bases/barbican.openstack.org_barbicanworkers.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,8 @@ spec:
7676
type: object
7777
enabledSecretStores:
7878
items:
79+
description: This SecretStore type is used by the EnabledSecretStores
80+
variable inside the specification.
7981
enum:
8082
- simple_crypto
8183
- pkcs11
@@ -274,7 +276,6 @@ spec:
274276
- containerImage
275277
- databaseHostname
276278
- databaseInstance
277-
- enabledSecretStores
278279
- rabbitMqClusterName
279280
- serviceAccount
280281
type: object

‎api/v1beta1/barbican_types.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,18 @@ type BarbicanSpec struct {
4747
BarbicanWorker BarbicanWorkerTemplate `json:"barbicanWorker"`
4848

4949
BarbicanKeystoneListener BarbicanKeystoneListenerTemplate `json:"barbicanKeystoneListener"`
50+
51+
// +kubebuilder:validation:Optional
52+
PKCS11 BarbicanPKCS11Template `json:"pkcs11,omitempty"`
53+
54+
// +kubebuilder:validation:Optional
55+
// +kubebuilder:validation:MinItems=1
56+
// +kubebuilder:validation:MaxItems=2
57+
EnabledSecretStores []SecretStore `json:"enabledSecretStores,omitempty"`
58+
59+
// +kubebuilder:validation:Optional
60+
// +kubebuilder:default="simple_crypto"
61+
GlobalDefaultSecretStore string `json:"globalDefaultSecretStore"`
5062
}
5163

5264
// BarbicanSpecCore defines the desired state of Barbican, for use with the OpenStackControlplane CR (no containerImages)

‎api/v1beta1/barbicankeystonelistener_types.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,18 @@ type BarbicanKeystoneListenerTemplateCore struct {
4343
type BarbicanKeystoneListenerSpec struct {
4444
BarbicanTemplate `json:",inline"`
4545

46+
// +kubebuilder:validation:Optional
47+
PKCS11 BarbicanPKCS11Template `json:"pkcs11,omitempty"`
48+
49+
// +kubebuilder:validation:Optional
50+
// +kubebuilder:validation:MinItems=1
51+
// +kubebuilder:validation:MaxItems=2
52+
EnabledSecretStores []SecretStore `json:"enabledSecretStores,omitempty"`
53+
54+
// +kubebuilder:validation:Optional
55+
// +kubebuilder:default="simple_crypto"
56+
GlobalDefaultSecretStore string `json:"globalDefaultSecretStore"`
57+
4658
BarbicanKeystoneListenerTemplate `json:",inline"`
4759
DatabaseHostname string `json:"databaseHostname"`
4860

‎api/v1beta1/common_types.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,10 @@ type BarbicanComponentTemplate struct {
101101
NetworkAttachments []string `json:"networkAttachments,omitempty"`
102102
}
103103

104+
// +kubebuilder:validation:Enum=simple_crypto;pkcs11
105+
// This SecretStore type is used by the EnabledSecretStores variable inside the specification.
106+
type SecretStore string
107+
104108
// BarbicanPKCS11Template - Includes all common HSM properties
105109
type BarbicanPKCS11Template struct {
106110
// +kubebuilder:validation:Optional

‎api/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 12 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/barbican.openstack.org_barbicanapis.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,8 @@ spec:
8282
type: boolean
8383
enabledSecretStores:
8484
items:
85+
description: This SecretStore type is used by the EnabledSecretStores
86+
variable inside the specification.
8587
enum:
8688
- simple_crypto
8789
- pkcs11
@@ -477,7 +479,6 @@ spec:
477479
- containerImage
478480
- databaseHostname
479481
- databaseInstance
480-
- enabledSecretStores
481482
- rabbitMqClusterName
482483
- serviceAccount
483484
type: object

0 commit comments

Comments
 (0)