Skip to content

Commit 7e1eb28

Browse files
author
Mauricio Harley
committed
Barbican Support for Luna HSM
Signed-off-by: Mauricio Harley <[email protected]>
1 parent 1a44bca commit 7e1eb28

11 files changed

+135
-31
lines changed

‎api/bases/barbican.openstack.org_barbicanapis.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ spec:
8181
policies
8282
type: boolean
8383
enabledSecretStores:
84-
default: Enum=simple_crypto
84+
default: '["simple_crypto"]'
8585
items:
8686
type: string
8787
minItems: 1

‎api/bases/barbican.openstack.org_barbicanworkers.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ spec:
7575
. TODO: -> implement'
7676
type: object
7777
enabledSecretStores:
78-
default: Enum=simple_crypto
78+
default: '["simple_crypto"]'
7979
items:
8080
type: string
8181
minItems: 1

‎api/v1beta1/barbicanapi_types.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,11 +64,12 @@ type BarbicanAPISpec struct {
6464

6565
BarbicanAPITemplate `json:",inline"`
6666

67+
// +kubebuilder:validation:Optional
6768
PKCS11 BarbicanPKCS11Template `json:"pkcs11,omitempty"`
6869

6970
// +kubebuilder:validation:Required
7071
// +kubebuilder:validation:MinItems=1
71-
// +kubebuilder:default=Enum=simple_crypto
72+
// +kubebuilder:default=["simple_crypto"]
7273
EnabledSecretStores []string `json:"enabledSecretStores"`
7374

7475
// +kubebuilder:validation:Optional

‎api/v1beta1/barbicanworker_types.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,11 +45,12 @@ type BarbicanWorkerSpec struct {
4545

4646
BarbicanWorkerTemplate `json:",inline"`
4747

48+
// +kubebuilder:validation:Optional
4849
PKCS11 BarbicanPKCS11Template `json:"pkcs11,omitempty"`
4950

5051
// +kubebuilder:validation:Required
5152
// +kubebuilder:validation:MinItems=1
52-
// +kubebuilder:default=Enum=simple_crypto
53+
// +kubebuilder:default=["simple_crypto"]
5354
EnabledSecretStores []string `json:"enabledSecretStores"`
5455

5556
// +kubebuilder:validation:Optional

‎config/crd/bases/barbican.openstack.org_barbicanapis.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ spec:
8181
policies
8282
type: boolean
8383
enabledSecretStores:
84-
default: Enum=simple_crypto
84+
default: '["simple_crypto"]'
8585
items:
8686
type: string
8787
minItems: 1

‎config/crd/bases/barbican.openstack.org_barbicanworkers.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ spec:
7575
. TODO: -> implement'
7676
type: object
7777
enabledSecretStores:
78-
default: Enum=simple_crypto
78+
default: '["simple_crypto"]'
7979
items:
8080
type: string
8181
minItems: 1

‎controllers/barbicanapi_controller.go‎

Lines changed: 34 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ package controllers
1919
import (
2020
"context"
2121
"fmt"
22+
"slices"
2223
"strings"
2324
"time"
2425

@@ -317,14 +318,39 @@ func (r *BarbicanAPIReconciler) generateServiceConfigs(
317318
instance.Spec.DatabaseHostname,
318319
barbican.DatabaseName,
319320
),
320-
"KeystoneAuthURL": keystoneInternalURL,
321-
"ServicePassword": string(ospSecret.Data[instance.Spec.PasswordSelectors.Service]),
322-
"ServiceUser": instance.Spec.ServiceUser,
323-
"ServiceURL": "https://barbican.openstack.svc:9311",
324-
"TransportURL": string(transportURLSecret.Data["transport_url"]),
325-
"LogFile": fmt.Sprintf("%s%s.log", barbican.BarbicanLogPath, instance.Name),
326-
"SimpleCryptoKEK": string(simpleCryptoSecret.Data[instance.Spec.PasswordSelectors.SimpleCryptoKEK]),
327-
"EnableSecureRBAC": instance.Spec.EnableSecureRBAC,
321+
"KeystoneAuthURL": keystoneInternalURL,
322+
"ServicePassword": string(ospSecret.Data[instance.Spec.PasswordSelectors.Service]),
323+
"ServiceUser": instance.Spec.ServiceUser,
324+
"ServiceURL": "https://barbican.openstack.svc:9311",
325+
"TransportURL": string(transportURLSecret.Data["transport_url"]),
326+
"LogFile": fmt.Sprintf("%s%s.log", barbican.BarbicanLogPath, instance.Name),
327+
"SimpleCryptoKEK": string(simpleCryptoSecret.Data[instance.Spec.PasswordSelectors.SimpleCryptoKEK]),
328+
"EnableSecureRBAC": instance.Spec.EnableSecureRBAC,
329+
"EnabledSecretStores": strings.Join(instance.Spec.EnabledSecretStores, ","),
330+
"GlobalDefaultSecretStore": instance.Spec.GlobalDefaultSecretStore,
331+
"SimpleCryptoEnabled": slices.Contains(instance.Spec.EnabledSecretStores, "simple_crypto"),
332+
"PKCS11CryptoEnabled": slices.Contains(instance.Spec.EnabledSecretStores, "pkcs11_crypto"),
333+
}
334+
335+
// Checking if there's an HSM.
336+
pkcs11 := instance.Spec.PKCS11
337+
if len(pkcs11.HSMLibraryPath) > 0 {
338+
hsmLoginSecret, _, err := secret.GetSecret(ctx, h, pkcs11.HSMLogin, instance.Namespace)
339+
if err != nil {
340+
return err
341+
}
342+
templateParameters["HSMLibraryPath"] = pkcs11.HSMLibraryPath
343+
templateParameters["HSMTokenSerialNumber"] = pkcs11.HSMTokenSerialNumber
344+
templateParameters["HSMTokenLabel"] = pkcs11.HSMTokenLabel
345+
templateParameters["HSMLogin"] = string(hsmLoginSecret.Data["hsmLogin"])
346+
templateParameters["HSMMKEKLabel"] = pkcs11.HSMMKEKLabel
347+
templateParameters["HSMMKEKLength"] = pkcs11.HSMMKEKLength
348+
templateParameters["HSMHMACLabel"] = pkcs11.HSMHMACLabel
349+
templateParameters["HSMSlotId"] = pkcs11.HSMSlotId
350+
templateParameters["HSMLoggingLevel"] = pkcs11.HSMLoggingLevel
351+
templateParameters["HSMIPAddress"] = pkcs11.HSMIPAddress
352+
templateParameters["HSMClientAddress"] = pkcs11.HSMClientAddress
353+
templateParameters["HSMType"] = pkcs11.HSMType
328354
}
329355

330356
// Checking if there's an HSM.

‎controllers/barbicanworker_controller.go‎

Lines changed: 29 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ package controllers
1919
import (
2020
"context"
2121
"fmt"
22+
"slices"
2223
"strings"
2324
"time"
2425

@@ -275,9 +276,34 @@ func (r *BarbicanWorkerReconciler) generateServiceConfigs(
275276
instance.Spec.DatabaseHostname,
276277
barbican.DatabaseName,
277278
),
278-
"TransportURL": string(transportURLSecret.Data["transport_url"]),
279-
"LogFile": fmt.Sprintf("%s%s.log", barbican.BarbicanLogPath, instance.Name),
280-
"SimpleCryptoKEK": string(simpleCryptoSecret.Data[instance.Spec.PasswordSelectors.SimpleCryptoKEK]),
279+
"TransportURL": string(transportURLSecret.Data["transport_url"]),
280+
"LogFile": fmt.Sprintf("%s%s.log", barbican.BarbicanLogPath, instance.Name),
281+
"SimpleCryptoKEK": string(simpleCryptoSecret.Data[instance.Spec.PasswordSelectors.SimpleCryptoKEK]),
282+
"EnabledSecretStores": strings.Join(instance.Spec.EnabledSecretStores, ","),
283+
"GlobalDefaultSecretStore": instance.Spec.GlobalDefaultSecretStore,
284+
"SimpleCryptoEnabled": slices.Contains(instance.Spec.EnabledSecretStores, "simple_crypto"),
285+
"PKCS11CryptoEnabled": slices.Contains(instance.Spec.EnabledSecretStores, "pkcs11_crypto"),
286+
}
287+
288+
// Checking if there's an HSM.
289+
pkcs11 := instance.Spec.PKCS11
290+
if len(pkcs11.HSMLibraryPath) > 0 {
291+
hsmLoginSecret, _, err := secret.GetSecret(ctx, h, pkcs11.HSMLogin, instance.Namespace)
292+
if err != nil {
293+
return err
294+
}
295+
templateParameters["HSMLibraryPath"] = pkcs11.HSMLibraryPath
296+
templateParameters["HSMTokenSerialNumber"] = pkcs11.HSMTokenSerialNumber
297+
templateParameters["HSMTokenLabel"] = pkcs11.HSMTokenLabel
298+
templateParameters["HSMLogin"] = string(hsmLoginSecret.Data["hsmLogin"])
299+
templateParameters["HSMMKEKLabel"] = pkcs11.HSMMKEKLabel
300+
templateParameters["HSMMKEKLength"] = pkcs11.HSMMKEKLength
301+
templateParameters["HSMHMACLabel"] = pkcs11.HSMHMACLabel
302+
templateParameters["HSMSlotId"] = pkcs11.HSMSlotId
303+
templateParameters["HSMLoggingLevel"] = pkcs11.HSMLoggingLevel
304+
templateParameters["HSMIPAddress"] = pkcs11.HSMIPAddress
305+
templateParameters["HSMClientAddress"] = pkcs11.HSMClientAddress
306+
templateParameters["HSMType"] = pkcs11.HSMType
281307
}
282308

283309
// Checking if there's an HSM.

‎templates/barbican/config/00-default.conf‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -44,13 +44,13 @@ enable = true
4444

4545
[secretstore]
4646
enable_multiple_secret_stores = true
47-
stores_lookup_suffix = {{ .enabledSecretStores }}
47+
stores_lookup_suffix = {{ .EnabledSecretStores }}
4848

49-
{{ if .simpleCryptoEnabled }}
50-
[secretstore:simple_crypto]
49+
{{ if .SimpleCryptoEnabled }}
50+
[secretstore:software]
5151
secret_store_plugin = store_crypto
5252
crypto_plugin = simple_crypto
53-
{{ if .globalDefaultSecretStore == ‘simple_crypto’ }}
53+
{{ if .GlobalDefaultSecretStore == "simple_crypto" }}
5454
global_default = true
5555
{{ end }}
5656

@@ -61,21 +61,21 @@ kek = {{ .SimpleCryptoKEK }}
6161
{{ end }}
6262
{{ end }}
6363

64-
{{ if .pkcs11Enabled }}
64+
{{ if .PKCS11Enabled }}
6565
[secretstore:pkcs11]
6666
secret_store_plugin = store_crypto
6767
crypto_plugin = p11_crypto
68-
{{ if .globalDefaultSecretStore == ‘pkcs11’ }}
68+
{{ if .GlobalDefaultSecretStore == "pkcs11" }}
6969
global_default = true
7070
{{ end }}
7171

7272
[p11_crypto_plugin]
73-
library_path = {{ .hsmLibraryPath }}
74-
token_serial_number = {{ .hsmTokenSerialNumber }}
75-
token_label = {{ .hsmTokenLabel }}
76-
login = {{ .hsmLogin }}
77-
mkek_label = {{ .hsmMKEKLabel }}
78-
mkek_length = {{ .hsmMKEKLength }}
79-
hmac_label = {{ .hsmHMACLabel }}
80-
slot_id = {{ .hsmSlotId }
73+
library_path = {{ .HSMLibraryPath }}
74+
token_serial_number = {{ .HSMTokenSerialNumber }}
75+
token_label = {{ .HSMTokenLabel }}
76+
login = {{ .HSMLogin }}
77+
mkek_label = {{ .HSMMKEKLabel }}
78+
mkek_length = {{ .HSMMKEKLength }}
79+
hmac_label = {{ .HSMHMACLabel }}
80+
slot_id = {{ .HSMSlotId }
8181
{{ end }}

‎templates/barbican/config/Chrystoki-conf.json‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{ if .HSMType == "Luna" }}
2+
{
3+
"config_files": [
4+
{
5+
"source": "/var/lib/config-data/default/Crystoki.conf",
6+
"dest": "{{ .HSLibraryPath }}/config/Crystoki.conf",
7+
"owner": "barbican",
8+
"perm": "0600",
9+
"optional": true
10+
}
11+
]
12+
}
13+
{{ end }}

0 commit comments

Comments
 (0)