Skip to content

Commit 772d803

Browse files
vakwetuvakwetu
committed
Make PKCS11 support more generic
Modify the PKCS11 support to make it more generic and hopefully make it easier to then support different HSM configurations. Updated the PKCS11 functional tests. Fix tls-e kuttl tests
1 parent a09e481 commit 772d803

35 files changed

+758
-1413
lines changed

‎api/bases/barbican.openstack.org_barbicanapis.yaml‎

Lines changed: 12 additions & 99 deletions
Original file line numberDiff line numberDiff line change
@@ -296,6 +296,9 @@ spec:
296296
description: PasswordSelectors - Selectors to identify the ServiceUser
297297
password from the Secret
298298
properties:
299+
pkcs11pin:
300+
default: PKCS11Pin
301+
type: string
299302
service:
300303
default: BarbicanPassword
301304
description: Service - Selector to get the barbican service user
@@ -306,114 +309,24 @@ spec:
306309
type: string
307310
type: object
308311
pkcs11:
309-
description: BarbicanPKCS11Template - Includes all common HSM properties
312+
description: BarbicanPKCS11Template - Includes common HSM properties
310313
properties:
311-
AESGCMGenerateIV:
312-
default: true
313-
description: Generate IVs for CKM_AES_GCM mechanism
314-
type: boolean
315-
HMACKeyType:
316-
default: CKK_GENERIC_SECRET
317-
description: HMAC Key Type
318-
type: string
319-
HMACKeygenMechanism:
320-
default: CKM_GENERIC_SECRET_KEY_GEN
321-
description: HMAC Keygen Mechanism
322-
type: string
323-
HMACLabel:
324-
description: Label to identify HMAC key in the HSM (must not be
325-
the same as MKEK label)
326-
type: string
327-
HMACMechanism:
328-
default: CKM_SHA256_HMAC
329-
description: HMAC Mechanism. This replaces hsm_keywrap_mechanism
330-
type: string
331-
MKEKLabel:
332-
description: Label to identify master KEK in the HSM (must not
333-
be the same as HMAC label)
334-
type: string
335-
MKEKLength:
336-
default: 32
337-
description: Length in bytes of master KEK
338-
type: integer
339-
OSLockingOK:
340-
default: false
341-
description: Set os_locking_ok
342-
type: boolean
343-
alwaysSetCKASensitive:
344-
default: true
345-
description: Always set cka_sensitive
346-
type: boolean
347-
certificatesMountPoint:
348-
description: The mounting point where the certificates will be
349-
copied to (e.g., /usr/local/luna/config/certs).
350-
type: string
351-
certificatesSecret:
352-
description: The OpenShift secret that stores the HSM certificates.
353-
type: string
354-
clientAddress:
355-
description: The IP address of the client connecting to the HSM
356-
(X.Y.Z.K)
357-
type: string
358-
encryptionMechanism:
359-
default: CKM_AES_GCM
360-
description: Secret encryption mechanism
361-
type: string
362-
keyWrapGenerateIV:
363-
default: true
364-
description: Generate IVs for the key wrap mechanism
365-
type: boolean
366-
keyWrapMechanism:
367-
default: CKM_AES_KEY_WRAP_KWP
368-
description: Key wrap mechanism
314+
clientDataPath:
315+
default: /etc/hsm-client
316+
description: Location to which kolla will copy the data in ClientDataSecret.
369317
type: string
370-
libraryPath:
371-
description: Path to vendor's PKCS11 library
318+
clientDataSecret:
319+
description: |-
320+
The OpenShift secret that stores the HSM client data.
321+
These will be mounted to /var/lib/config-data/hsm
372322
type: string
373-
loggingLevel:
374-
default: 4
375-
description: Level of logging, where 0 means "no logging" and
376-
7 means "debug".
377-
maximum: 7
378-
minimum: 0
379-
type: integer
380323
loginSecret:
381324
description: OpenShift secret that stores the password to login
382325
to the PKCS11 session
383326
type: string
384-
serverAddress:
385-
description: The HSM's IPv4 address (X.Y.Z.K)
386-
type: string
387-
slotId:
388-
description: |-
389-
One of TokenSerialNumber, TokenLabels or SlotId must
390-
be defined. SlotId is used if none of the others is defined
391-
type: string
392-
tokenLabels:
393-
description: |-
394-
Token labels used to identify the token to be used.
395-
One of TokenSerialNumber, TokenLabels or SlotId must
396-
be specified. TokenLabels takes priority over SlotId.
397-
This can be a comma separated string of labels
398-
type: string
399-
tokenSerialNumber:
400-
description: |-
401-
Token serial number used to identify the token to be used.
402-
One of TokenSerialNumber, TokenLabels or SlotId must
403-
be defined. TokenSerialNumber takes priority over
404-
TokenLabels and SlotId
405-
type: string
406-
type:
407-
description: 'A string containing the HSM type (currently supported:
408-
"luna").'
409-
type: string
410327
required:
411-
- HMACLabel
412-
- MKEKLabel
413-
- libraryPath
328+
- clientDataSecret
414329
- loginSecret
415-
- serverAddress
416-
- type
417330
type: object
418331
rabbitMqClusterName:
419332
default: rabbitmq

‎api/bases/barbican.openstack.org_barbicankeystonelisteners.yaml‎

Lines changed: 12 additions & 99 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,9 @@ spec:
130130
description: PasswordSelectors - Selectors to identify the ServiceUser
131131
password from the Secret
132132
properties:
133+
pkcs11pin:
134+
default: PKCS11Pin
135+
type: string
133136
service:
134137
default: BarbicanPassword
135138
description: Service - Selector to get the barbican service user
@@ -140,114 +143,24 @@ spec:
140143
type: string
141144
type: object
142145
pkcs11:
143-
description: BarbicanPKCS11Template - Includes all common HSM properties
146+
description: BarbicanPKCS11Template - Includes common HSM properties
144147
properties:
145-
AESGCMGenerateIV:
146-
default: true
147-
description: Generate IVs for CKM_AES_GCM mechanism
148-
type: boolean
149-
HMACKeyType:
150-
default: CKK_GENERIC_SECRET
151-
description: HMAC Key Type
152-
type: string
153-
HMACKeygenMechanism:
154-
default: CKM_GENERIC_SECRET_KEY_GEN
155-
description: HMAC Keygen Mechanism
156-
type: string
157-
HMACLabel:
158-
description: Label to identify HMAC key in the HSM (must not be
159-
the same as MKEK label)
160-
type: string
161-
HMACMechanism:
162-
default: CKM_SHA256_HMAC
163-
description: HMAC Mechanism. This replaces hsm_keywrap_mechanism
164-
type: string
165-
MKEKLabel:
166-
description: Label to identify master KEK in the HSM (must not
167-
be the same as HMAC label)
168-
type: string
169-
MKEKLength:
170-
default: 32
171-
description: Length in bytes of master KEK
172-
type: integer
173-
OSLockingOK:
174-
default: false
175-
description: Set os_locking_ok
176-
type: boolean
177-
alwaysSetCKASensitive:
178-
default: true
179-
description: Always set cka_sensitive
180-
type: boolean
181-
certificatesMountPoint:
182-
description: The mounting point where the certificates will be
183-
copied to (e.g., /usr/local/luna/config/certs).
184-
type: string
185-
certificatesSecret:
186-
description: The OpenShift secret that stores the HSM certificates.
187-
type: string
188-
clientAddress:
189-
description: The IP address of the client connecting to the HSM
190-
(X.Y.Z.K)
191-
type: string
192-
encryptionMechanism:
193-
default: CKM_AES_GCM
194-
description: Secret encryption mechanism
195-
type: string
196-
keyWrapGenerateIV:
197-
default: true
198-
description: Generate IVs for the key wrap mechanism
199-
type: boolean
200-
keyWrapMechanism:
201-
default: CKM_AES_KEY_WRAP_KWP
202-
description: Key wrap mechanism
148+
clientDataPath:
149+
default: /etc/hsm-client
150+
description: Location to which kolla will copy the data in ClientDataSecret.
203151
type: string
204-
libraryPath:
205-
description: Path to vendor's PKCS11 library
152+
clientDataSecret:
153+
description: |-
154+
The OpenShift secret that stores the HSM client data.
155+
These will be mounted to /var/lib/config-data/hsm
206156
type: string
207-
loggingLevel:
208-
default: 4
209-
description: Level of logging, where 0 means "no logging" and
210-
7 means "debug".
211-
maximum: 7
212-
minimum: 0
213-
type: integer
214157
loginSecret:
215158
description: OpenShift secret that stores the password to login
216159
to the PKCS11 session
217160
type: string
218-
serverAddress:
219-
description: The HSM's IPv4 address (X.Y.Z.K)
220-
type: string
221-
slotId:
222-
description: |-
223-
One of TokenSerialNumber, TokenLabels or SlotId must
224-
be defined. SlotId is used if none of the others is defined
225-
type: string
226-
tokenLabels:
227-
description: |-
228-
Token labels used to identify the token to be used.
229-
One of TokenSerialNumber, TokenLabels or SlotId must
230-
be specified. TokenLabels takes priority over SlotId.
231-
This can be a comma separated string of labels
232-
type: string
233-
tokenSerialNumber:
234-
description: |-
235-
Token serial number used to identify the token to be used.
236-
One of TokenSerialNumber, TokenLabels or SlotId must
237-
be defined. TokenSerialNumber takes priority over
238-
TokenLabels and SlotId
239-
type: string
240-
type:
241-
description: 'A string containing the HSM type (currently supported:
242-
"luna").'
243-
type: string
244161
required:
245-
- HMACLabel
246-
- MKEKLabel
247-
- libraryPath
162+
- clientDataSecret
248163
- loginSecret
249-
- serverAddress
250-
- type
251164
type: object
252165
rabbitMqClusterName:
253166
default: rabbitmq

0 commit comments

Comments
 (0)