From bd702000b74fbb904686e38d6735d42d2e1df3f8 Mon Sep 17 00:00:00 2001 From: Mauricio Harley Date: Fri, 20 Sep 2024 15:26:56 +0000 Subject: [PATCH 1/6] Adding script to customize images for Eviden Trustway --- hack/automation_scripts.md | 43 +++++++++++++++ hack/build_custom_image-eviden.sh | 88 +++++++++++++++++++++++++++++++ 2 files changed, 131 insertions(+) create mode 100644 hack/automation_scripts.md create mode 100755 hack/build_custom_image-eviden.sh diff --git a/hack/automation_scripts.md b/hack/automation_scripts.md new file mode 100644 index 00000000..a9d5ae7e --- /dev/null +++ b/hack/automation_scripts.md @@ -0,0 +1,43 @@ +# Automation Scripts + +## Build Custom Container Images + +This script is meant to be used when the environment where Barbican will work has an HSM (Hardware Security Module) in place. +Since Barbican is able to store secrets when an HSM is present, it needs to be made aware of such presence. Two components +are directly affected by the presence of an HSM: Barbican API and Barbican Worker. The default container images do not have +any HSM client software embedded in them since each manufacturer may have specifics on how their software can be distributed. + +Therefore, the container images need to be customized to include such client software. Depending on the vendor, the installation +procedures might differ. You need to run the script corresponding to the vendor you use. + +### Eviden Trustway (previously, ATOS) + +For the Eviden (previously, ATOS) Trustway HSMs, you will use the `build_custom_image-eviden.sh` script. The usage is as follows: + +```bash +$ bash build_custom_image-eviden.sh +``` + +where: +* `registry_host`: corresponds to the FQDN (Fully Qualified Domain Name) of the registry that holds the default container images. +Example: quay.io. +* `namespace`: it's an internal repository organization that matches the OpenStack distribution with an operating system. Example: `podified-antelope-centos9`. +* `barbican-api_image_tag`: because OpenStack container images may not have the usual `latest` tag, you may need to manually obtain and provide the newest tag. Example: `75c508097e39a3423d9f2eef86648c4e`. +* `barbican-worker_image_tag`: something similar happens for the Barbican Worker image. Example: `71849c7583fa95ee18dcc0c73c93569d`. +* `eviden_iso_file`: this is the filename of the ISO file holding the Eviden HSM client software. Example: `Proteccio3.00.03.iso`. **Please put it in the same directory as this script.** + +>**Note 1**
+**You need to edit the `build_custom_image-eviden.sh` script to include your username on the container registry.
This is necessary since one of the final steps the script takes is to push the new customized image to the registry.** + +>**Note 2**
+**You must install both, `podman` and `buildah` for this script to successfully execute.** + +The script proceeds as follows: +1. Pulls with `podman` the container images of Barbican API and Barbican Worker from the provided registry host. +2. Creates a temporary directory and mounts the ISO client file on it. +3. Creates two `Dockerfile`s (`Dockerfile.barbican-api` and `Dockerfile.barbican-worker`), for the two new container images. These files have instructions to copy and invoke the Eviden's installation script. +4. Builds the new images with `buildah`. At this stage, temporary containers will be created to execute the client software installation. +5. Pushes the new image to the registry host you provided as parameter. **For this sake, the script needs to be edited to have your username on this registry host.** +6. Unmounts the ISO client software and deletes the temporary directory created on step 2. + +After this script successfully runs, you can start your Barbican operator deployment. \ No newline at end of file diff --git a/hack/build_custom_image-eviden.sh b/hack/build_custom_image-eviden.sh new file mode 100755 index 00000000..f0e6530b --- /dev/null +++ b/hack/build_custom_image-eviden.sh @@ -0,0 +1,88 @@ +#!/bin/bash +# This script creates a custom container image for both, Barbican API and Barbican Worker, +# including the HSM vendor's client software. +# Vendor: Eviden + +if [ "$#" -ne 5 ]; then + echo "Usage: $0 " + exit 1 +fi + +REGISTRY_HOST=$1 +NAMESPACE=$2 +API_IMAGE_TAG=$3 +WORKER_IMAGE_TAG=$4 +EVIDEN_ISO_FILE=$5 +TEMP_ISO_DIR=iso_eviden +USERNAME=replace_with_your_registry_username + +echo +echo "You need to be logged into your registry for this script to work." +echo "If you're not logged in, stop this script now and log in with 'podman login'." + +echo +echo "Downloading Barbican API image..." +podman pull $REGISTRY_HOST/$NAMESPACE/openstack-barbican-api:$API_IMAGE_TAG +echo +echo "Downloading Barbican Worker image..." +podman pull $REGISTRY_HOST/$NAMESPACE/openstack-barbican-worker:$WORKER_IMAGE_TAG + +echo +echo "Locally mounting ISO client file..." +mkdir $TEMP_ISO_DIR +sudo mount -o loop $EVIDEN_ISO_FILE $TEMP_ISO_DIR +if [ "$?" -ne 0 ]; then + echo "Unable to locally mount the HSM client file. Exiting." + exit 2 +fi + +echo +echo "Creating Dockerfile for barbican-api..." +cat < Dockerfile.barbican-api +FROM $REGISTRY_HOST/$NAMESPACE/openstack-barbican-api:$API_IMAGE_TAG + +USER root +RUN mkdir /tmp/iso +COPY $TEMP_ISO_DIR/ /tmp/iso/ + +RUN cd /tmp/iso/Linux; { echo "e"; echo "n"; echo; } | bash install.sh +RUN rm -rf /tmp/iso +EOF + +echo +echo "Creating Dockerfile for barbican-worker..." +cat < Dockerfile.barbican-worker +FROM $REGISTRY_HOST/$NAMESPACE/openstack-barbican-worker:$API_IMAGE_TAG + +USER root +RUN mkdir /tmp/iso +COPY $TEMP_ISO_DIR/ /tmp/iso/ + +RUN cd /tmp/iso/Linux; { echo "e"; echo "n"; echo; } | bash install.sh +RUN rm -rf /tmp/iso +EOF + +echo +echo "Building new container images..." +buildah bud -t barbican-api-custom:$API_IMAGE_TAG -f Dockerfile.barbican-api +buildah bud -t barbican-worker-custom:$WORKER_IMAGE_TAG -f Dockerfile.barbican-worker + +echo "Pushing new images to the registry..." +# Replace the registry URL with the appropriate one for your environment +REGISTRY_URL=$(REGISTRY_HOST)/$(USERNAME) + +podman tag barbican-api-custom:$API_IMAGE_TAG $REGISTRY_URL/barbican-api-custom:$API_IMAGE_TAG +podman push $REGISTRY_URL/barbican-api-custom:$API_IMAGE_TAG + +podman tag barbican-worker-custom:$WORKER_IMAGE_TAG $REGISTRY_URL/barbican-worker-custom:$WORKER_IMAGE_TAG +podman push $REGISTRY_URL/barbican-worker-custom:$WORKER_IMAGE_TAG + +echo +echo "Unmounting ISO client file..." +sudo umount $TEMP_ISO_DIR +if [ "$?" -ne 0 ]; then + echo "Unable to unmount the HSM client file. Do it manually." + exit 3 +fi +rmdir $TEMP_ISO_DIR +echo "Done." From f82b9889480036580085940ccd567fcfbb818e4e Mon Sep 17 00:00:00 2001 From: Mauricio Harley Date: Fri, 20 Sep 2024 15:26:56 +0000 Subject: [PATCH 2/6] Adding script to customize images for Eviden Trustway --- hack/automation_scripts.md | 8 +++++--- hack/build_custom_image-eviden.sh | 16 +++++++++------- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/hack/automation_scripts.md b/hack/automation_scripts.md index a9d5ae7e..d71d17f1 100644 --- a/hack/automation_scripts.md +++ b/hack/automation_scripts.md @@ -15,16 +15,18 @@ procedures might differ. You need to run the script corresponding to the vendor For the Eviden (previously, ATOS) Trustway HSMs, you will use the `build_custom_image-eviden.sh` script. The usage is as follows: ```bash -$ bash build_custom_image-eviden.sh +$ bash build_custom_image-eviden.sh ``` where: -* `registry_host`: corresponds to the FQDN (Fully Qualified Domain Name) of the registry that holds the default container images. +* `source_registry_host`: corresponds to the FQDN (Fully Qualified Domain Name) of the registry that holds the default container images. Example: quay.io. * `namespace`: it's an internal repository organization that matches the OpenStack distribution with an operating system. Example: `podified-antelope-centos9`. * `barbican-api_image_tag`: because OpenStack container images may not have the usual `latest` tag, you may need to manually obtain and provide the newest tag. Example: `75c508097e39a3423d9f2eef86648c4e`. * `barbican-worker_image_tag`: something similar happens for the Barbican Worker image. Example: `71849c7583fa95ee18dcc0c73c93569d`. * `eviden_iso_file`: this is the filename of the ISO file holding the Eviden HSM client software. Example: `Proteccio3.00.03.iso`. **Please put it in the same directory as this script.** +* `destination_registry_host`: corresponds to the FQDN (Fully Qualified Domain Name) of the registry that will store the customized container images. +Example: hub.docker.com. >**Note 1**
**You need to edit the `build_custom_image-eviden.sh` script to include your username on the container registry.
This is necessary since one of the final steps the script takes is to push the new customized image to the registry.** @@ -40,4 +42,4 @@ The script proceeds as follows: 5. Pushes the new image to the registry host you provided as parameter. **For this sake, the script needs to be edited to have your username on this registry host.** 6. Unmounts the ISO client software and deletes the temporary directory created on step 2. -After this script successfully runs, you can start your Barbican operator deployment. \ No newline at end of file +After this script successfully runs, you can start your Barbican operator deployment. diff --git a/hack/build_custom_image-eviden.sh b/hack/build_custom_image-eviden.sh index f0e6530b..bcd47121 100755 --- a/hack/build_custom_image-eviden.sh +++ b/hack/build_custom_image-eviden.sh @@ -3,8 +3,8 @@ # including the HSM vendor's client software. # Vendor: Eviden -if [ "$#" -ne 5 ]; then - echo "Usage: $0 " +if [ "$#" -ne 6 ]; then + echo "Usage: $0 " exit 1 fi @@ -13,18 +13,19 @@ NAMESPACE=$2 API_IMAGE_TAG=$3 WORKER_IMAGE_TAG=$4 EVIDEN_ISO_FILE=$5 +DESTINATION_HOST=$6 TEMP_ISO_DIR=iso_eviden -USERNAME=replace_with_your_registry_username +USERNAME=replace_with_your_destination_registry_username echo echo "You need to be logged into your registry for this script to work." echo "If you're not logged in, stop this script now and log in with 'podman login'." echo -echo "Downloading Barbican API image..." +echo "Downloading Barbican API image from source registry..." podman pull $REGISTRY_HOST/$NAMESPACE/openstack-barbican-api:$API_IMAGE_TAG echo -echo "Downloading Barbican Worker image..." +echo "Downloading Barbican Worker image from source registry..." podman pull $REGISTRY_HOST/$NAMESPACE/openstack-barbican-worker:$WORKER_IMAGE_TAG echo @@ -67,9 +68,10 @@ echo "Building new container images..." buildah bud -t barbican-api-custom:$API_IMAGE_TAG -f Dockerfile.barbican-api buildah bud -t barbican-worker-custom:$WORKER_IMAGE_TAG -f Dockerfile.barbican-worker -echo "Pushing new images to the registry..." +echo +echo "Pushing new images to the destination registry..." # Replace the registry URL with the appropriate one for your environment -REGISTRY_URL=$(REGISTRY_HOST)/$(USERNAME) +REGISTRY_URL=$(DESTINATION_HOST)/$(USERNAME) podman tag barbican-api-custom:$API_IMAGE_TAG $REGISTRY_URL/barbican-api-custom:$API_IMAGE_TAG podman push $REGISTRY_URL/barbican-api-custom:$API_IMAGE_TAG From a312ef2177fc37c330a5f8db95a031e2856f4bf0 Mon Sep 17 00:00:00 2001 From: Mauricio Harley Date: Fri, 20 Sep 2024 15:26:56 +0000 Subject: [PATCH 3/6] Adding script to customize images for Eviden Trustway --- hack/automation_scripts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hack/automation_scripts.md b/hack/automation_scripts.md index d71d17f1..730af794 100644 --- a/hack/automation_scripts.md +++ b/hack/automation_scripts.md @@ -21,7 +21,7 @@ $ bash build_custom_image-eviden.sh Date: Fri, 27 Sep 2024 10:35:59 +0000 Subject: [PATCH 4/6] Initial support for Eviden Trustway HSM Signed-off-by: Mauricio Harley --- .../barbican.openstack.org_barbicanapis.yaml | 36 +++++++++++++++ ...arbican.openstack.org_barbicanworkers.yaml | 36 +++++++++++++++ api/v1beta1/barbicanapi_types.go | 3 ++ api/v1beta1/barbicanworker_types.go | 3 ++ api/v1beta1/common_types.go | 38 ++++++++++++++++ api/v1beta1/zz_generated.deepcopy.go | 45 +++++++++++++++++++ .../barbican.openstack.org_barbicanapis.yaml | 36 +++++++++++++++ ...arbican.openstack.org_barbicanworkers.yaml | 36 +++++++++++++++ pkg/barbican/const.go | 3 ++ 9 files changed, 236 insertions(+) diff --git a/api/bases/barbican.openstack.org_barbicanapis.yaml b/api/bases/barbican.openstack.org_barbicanapis.yaml index ea86d1a2..1cb84bb9 100644 --- a/api/bases/barbican.openstack.org_barbicanapis.yaml +++ b/api/bases/barbican.openstack.org_barbicanapis.yaml @@ -35,6 +35,10 @@ spec: spec: description: BarbicanAPISpec defines the desired state of BarbicanAPI properties: + clientCertificate: + description: The OpenShift secret storing the client certificate plus + its key + type: string containerImage: description: ContainerImage - Barbican Container Image URL (will be set to environmental default if empty) @@ -80,6 +84,31 @@ spec: description: EnableSecureRBAC - Enable Consistent and Secure RBAC policies type: boolean + hsmCertificates: + additionalProperties: + type: string + description: The HSM certificates. The map's key is the HSM's IP address + and the value is the OpenShift secret storing the certificate. + type: object + ipAddress: + description: IP address(es) of the HSM(s) + items: + type: string + type: array + loggingLevel: + default: 4 + description: Level of logging, where 0 means "no logging" and 7 means + "debug". + maximum: 7 + minimum: 0 + type: integer + mode: + default: 0 + description: Working mode for the HSM + enum: + - 0 + - 2 + type: integer networkAttachments: description: NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network @@ -283,6 +312,9 @@ spec: default: SimpleCryptoKEK type: string type: object + pin: + description: The OpenShift secret storing the PKCS#11 HSM's password + type: string rabbitMqClusterName: default: rabbitmq description: RabbitMQ instance name Needed to request a transportURL @@ -396,9 +428,13 @@ spec: description: TransportURLSecret - Secret containing RabbitMQ transportURL type: string required: + - clientCertificate - containerImage - databaseHostname - databaseInstance + - hsmCertificates + - ipAddress + - pin - rabbitMqClusterName - serviceAccount type: object diff --git a/api/bases/barbican.openstack.org_barbicanworkers.yaml b/api/bases/barbican.openstack.org_barbicanworkers.yaml index db894a7c..5ba42fb5 100644 --- a/api/bases/barbican.openstack.org_barbicanworkers.yaml +++ b/api/bases/barbican.openstack.org_barbicanworkers.yaml @@ -35,6 +35,10 @@ spec: spec: description: BarbicanWorkerSpec defines the desired state of BarbicanWorker properties: + clientCertificate: + description: The OpenShift secret storing the client certificate plus + its key + type: string containerImage: description: ContainerImage - Barbican Container Image URL (will be set to environmental default if empty) @@ -74,6 +78,31 @@ spec: files. Those get added to the service config dir in /etc/ . TODO: -> implement' type: object + hsmCertificates: + additionalProperties: + type: string + description: The HSM certificates. The map's key is the HSM's IP address + and the value is the OpenShift secret storing the certificate. + type: object + ipAddress: + description: IP address(es) of the HSM(s) + items: + type: string + type: array + loggingLevel: + default: 4 + description: Level of logging, where 0 means "no logging" and 7 means + "debug". + maximum: 7 + minimum: 0 + type: integer + mode: + default: 0 + description: Working mode for the HSM + enum: + - 0 + - 2 + type: integer networkAttachments: description: NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network @@ -103,6 +132,9 @@ spec: default: SimpleCryptoKEK type: string type: object + pin: + description: The OpenShift secret storing the PKCS#11 HSM's password + type: string rabbitMqClusterName: default: rabbitmq description: RabbitMQ instance name Needed to request a transportURL @@ -193,9 +225,13 @@ spec: transportURLSecret: type: string required: + - clientCertificate - containerImage - databaseHostname - databaseInstance + - hsmCertificates + - ipAddress + - pin - rabbitMqClusterName - serviceAccount type: object diff --git a/api/v1beta1/barbicanapi_types.go b/api/v1beta1/barbicanapi_types.go index 007ef0c3..0aaadffa 100644 --- a/api/v1beta1/barbicanapi_types.go +++ b/api/v1beta1/barbicanapi_types.go @@ -64,6 +64,9 @@ type BarbicanAPISpec struct { BarbicanAPITemplate `json:",inline"` + // BarbicanTrustwayTemplate - Representing the presence of an Eviden Trustway HSM + BarbicanTrustwayTemplate `json:",inline"` + // +kubebuilder:validation:Required // DatabaseHostname - Barbican Database Hostname DatabaseHostname string `json:"databaseHostname"` diff --git a/api/v1beta1/barbicanworker_types.go b/api/v1beta1/barbicanworker_types.go index cfef4f17..949543f8 100644 --- a/api/v1beta1/barbicanworker_types.go +++ b/api/v1beta1/barbicanworker_types.go @@ -48,6 +48,9 @@ type BarbicanWorkerSpec struct { TransportURLSecret string `json:"transportURLSecret,omitempty"` + // BarbicanTrustwayTemplate - Representing the presence of an Eviden Trustway HSM + BarbicanTrustwayTemplate `json:",inline"` + // +kubebuilder:validation:Optional // +operator-sdk:csv:customresourcedefinitions:type=spec // TLS - Parameters related to the TLS diff --git a/api/v1beta1/common_types.go b/api/v1beta1/common_types.go index b23275c9..6325b752 100644 --- a/api/v1beta1/common_types.go +++ b/api/v1beta1/common_types.go @@ -101,6 +101,44 @@ type BarbicanComponentTemplate struct { NetworkAttachments []string `json:"networkAttachments,omitempty"` } +// BarbicanHSMTemplate - Variables used by the operator to interact with an HSM +type BarbicanHSMTemplate struct { + // +kubebuilder:validation:Required + // IP address(es) of the HSM(s) + IPAddress []string `json:"ipAddress"` + + // +kubebuilder:validation:Required + // The OpenShift secret storing the PKCS#11 HSM's password + Pin string `json:"pin"` +} + +// BarbicanTrustwayTemplate - Variables specific to Eviden's Trustway Proteccio HSMs +type BarbicanTrustwayTemplate struct { + BarbicanHSMTemplate `json:",inline"` + + // +kubebuilder:validation:Optional + // +kubebuilder:default=4 + // +kubebuilder:validation:Maximum=7 + // +kubebuilder:validation:Minimum=0 + // Level of logging, where 0 means "no logging" and 7 means "debug". + LoggingLevel int `json:"loggingLevel"` + + // +kubebuilder:validation:Required + // The HSM certificates. The map's key is the HSM's IP address and + // the value is the OpenShift secret storing the certificate. + HSMCertificates map[string]string `json:"hsmCertificates"` + + // +kubebuilder:validation:Required + // The OpenShift secret storing the client certificate plus its key + ClientCertificate string `json:"clientCertificate"` + + // +kubebuilder:validation:Optional + // +kubebuilder:default=0 + // +kubebuilder:validation:Enum=0;2 + // Working mode for the HSM + Mode int `json:"mode"` +} + // PasswordSelector to identify the DB and AdminUser password from the Secret type PasswordSelector struct { // +kubebuilder:validation:Optional diff --git a/api/v1beta1/zz_generated.deepcopy.go b/api/v1beta1/zz_generated.deepcopy.go index 18fbc470..59881f29 100644 --- a/api/v1beta1/zz_generated.deepcopy.go +++ b/api/v1beta1/zz_generated.deepcopy.go @@ -140,6 +140,7 @@ func (in *BarbicanAPISpec) DeepCopyInto(out *BarbicanAPISpec) { *out = *in out.BarbicanTemplate = in.BarbicanTemplate in.BarbicanAPITemplate.DeepCopyInto(&out.BarbicanAPITemplate) + in.BarbicanTrustwayTemplate.DeepCopyInto(&out.BarbicanTrustwayTemplate) } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BarbicanAPISpec. @@ -297,6 +298,26 @@ func (in *BarbicanDefaults) DeepCopy() *BarbicanDefaults { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *BarbicanHSMTemplate) DeepCopyInto(out *BarbicanHSMTemplate) { + *out = *in + if in.IPAddress != nil { + in, out := &in.IPAddress, &out.IPAddress + *out = make([]string, len(*in)) + copy(*out, *in) + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BarbicanHSMTemplate. +func (in *BarbicanHSMTemplate) DeepCopy() *BarbicanHSMTemplate { + if in == nil { + return nil + } + out := new(BarbicanHSMTemplate) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *BarbicanKeystoneListener) DeepCopyInto(out *BarbicanKeystoneListener) { *out = *in @@ -595,6 +616,29 @@ func (in *BarbicanTemplate) DeepCopy() *BarbicanTemplate { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *BarbicanTrustwayTemplate) DeepCopyInto(out *BarbicanTrustwayTemplate) { + *out = *in + in.BarbicanHSMTemplate.DeepCopyInto(&out.BarbicanHSMTemplate) + if in.HSMCertificates != nil { + in, out := &in.HSMCertificates, &out.HSMCertificates + *out = make(map[string]string, len(*in)) + for key, val := range *in { + (*out)[key] = val + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BarbicanTrustwayTemplate. +func (in *BarbicanTrustwayTemplate) DeepCopy() *BarbicanTrustwayTemplate { + if in == nil { + return nil + } + out := new(BarbicanTrustwayTemplate) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *BarbicanWorker) DeepCopyInto(out *BarbicanWorker) { *out = *in @@ -659,6 +703,7 @@ func (in *BarbicanWorkerSpec) DeepCopyInto(out *BarbicanWorkerSpec) { *out = *in out.BarbicanTemplate = in.BarbicanTemplate in.BarbicanWorkerTemplate.DeepCopyInto(&out.BarbicanWorkerTemplate) + in.BarbicanTrustwayTemplate.DeepCopyInto(&out.BarbicanTrustwayTemplate) out.TLS = in.TLS } diff --git a/config/crd/bases/barbican.openstack.org_barbicanapis.yaml b/config/crd/bases/barbican.openstack.org_barbicanapis.yaml index ea86d1a2..1cb84bb9 100644 --- a/config/crd/bases/barbican.openstack.org_barbicanapis.yaml +++ b/config/crd/bases/barbican.openstack.org_barbicanapis.yaml @@ -35,6 +35,10 @@ spec: spec: description: BarbicanAPISpec defines the desired state of BarbicanAPI properties: + clientCertificate: + description: The OpenShift secret storing the client certificate plus + its key + type: string containerImage: description: ContainerImage - Barbican Container Image URL (will be set to environmental default if empty) @@ -80,6 +84,31 @@ spec: description: EnableSecureRBAC - Enable Consistent and Secure RBAC policies type: boolean + hsmCertificates: + additionalProperties: + type: string + description: The HSM certificates. The map's key is the HSM's IP address + and the value is the OpenShift secret storing the certificate. + type: object + ipAddress: + description: IP address(es) of the HSM(s) + items: + type: string + type: array + loggingLevel: + default: 4 + description: Level of logging, where 0 means "no logging" and 7 means + "debug". + maximum: 7 + minimum: 0 + type: integer + mode: + default: 0 + description: Working mode for the HSM + enum: + - 0 + - 2 + type: integer networkAttachments: description: NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network @@ -283,6 +312,9 @@ spec: default: SimpleCryptoKEK type: string type: object + pin: + description: The OpenShift secret storing the PKCS#11 HSM's password + type: string rabbitMqClusterName: default: rabbitmq description: RabbitMQ instance name Needed to request a transportURL @@ -396,9 +428,13 @@ spec: description: TransportURLSecret - Secret containing RabbitMQ transportURL type: string required: + - clientCertificate - containerImage - databaseHostname - databaseInstance + - hsmCertificates + - ipAddress + - pin - rabbitMqClusterName - serviceAccount type: object diff --git a/config/crd/bases/barbican.openstack.org_barbicanworkers.yaml b/config/crd/bases/barbican.openstack.org_barbicanworkers.yaml index db894a7c..5ba42fb5 100644 --- a/config/crd/bases/barbican.openstack.org_barbicanworkers.yaml +++ b/config/crd/bases/barbican.openstack.org_barbicanworkers.yaml @@ -35,6 +35,10 @@ spec: spec: description: BarbicanWorkerSpec defines the desired state of BarbicanWorker properties: + clientCertificate: + description: The OpenShift secret storing the client certificate plus + its key + type: string containerImage: description: ContainerImage - Barbican Container Image URL (will be set to environmental default if empty) @@ -74,6 +78,31 @@ spec: files. Those get added to the service config dir in /etc/ . TODO: -> implement' type: object + hsmCertificates: + additionalProperties: + type: string + description: The HSM certificates. The map's key is the HSM's IP address + and the value is the OpenShift secret storing the certificate. + type: object + ipAddress: + description: IP address(es) of the HSM(s) + items: + type: string + type: array + loggingLevel: + default: 4 + description: Level of logging, where 0 means "no logging" and 7 means + "debug". + maximum: 7 + minimum: 0 + type: integer + mode: + default: 0 + description: Working mode for the HSM + enum: + - 0 + - 2 + type: integer networkAttachments: description: NetworkAttachments is a list of NetworkAttachment resource names to expose the services to the given network @@ -103,6 +132,9 @@ spec: default: SimpleCryptoKEK type: string type: object + pin: + description: The OpenShift secret storing the PKCS#11 HSM's password + type: string rabbitMqClusterName: default: rabbitmq description: RabbitMQ instance name Needed to request a transportURL @@ -193,9 +225,13 @@ spec: transportURLSecret: type: string required: + - clientCertificate - containerImage - databaseHostname - databaseInstance + - hsmCertificates + - ipAddress + - pin - rabbitMqClusterName - serviceAccount type: object diff --git a/pkg/barbican/const.go b/pkg/barbican/const.go index 154388c2..ad595095 100644 --- a/pkg/barbican/const.go +++ b/pkg/barbican/const.go @@ -50,4 +50,7 @@ const ( // LogVolume is the default logVolume name used to mount logs on both // BarbicanAPI and the sidecar container LogVolume = "logs" + + // HSM constants + TrustwayLogfileLocation = "/var/log/barbican/proteccio.log" ) From 9bc47ad3019970891e1e1f6086b7b9b4ed69cf94 Mon Sep 17 00:00:00 2001 From: Mauricio Harley Date: Fri, 27 Sep 2024 10:35:59 +0000 Subject: [PATCH 5/6] Initial support for Eviden Trustway HSM Signed-off-by: Mauricio Harley --- api/v1beta1/common_types.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/api/v1beta1/common_types.go b/api/v1beta1/common_types.go index 6325b752..a1ff5095 100644 --- a/api/v1beta1/common_types.go +++ b/api/v1beta1/common_types.go @@ -103,11 +103,11 @@ type BarbicanComponentTemplate struct { // BarbicanHSMTemplate - Variables used by the operator to interact with an HSM type BarbicanHSMTemplate struct { - // +kubebuilder:validation:Required + // +kubebuilder:validation:Optional // IP address(es) of the HSM(s) IPAddress []string `json:"ipAddress"` - // +kubebuilder:validation:Required + // +kubebuilder:validation:Optional // The OpenShift secret storing the PKCS#11 HSM's password Pin string `json:"pin"` } @@ -123,12 +123,12 @@ type BarbicanTrustwayTemplate struct { // Level of logging, where 0 means "no logging" and 7 means "debug". LoggingLevel int `json:"loggingLevel"` - // +kubebuilder:validation:Required + // +kubebuilder:validation:Optional // The HSM certificates. The map's key is the HSM's IP address and // the value is the OpenShift secret storing the certificate. HSMCertificates map[string]string `json:"hsmCertificates"` - // +kubebuilder:validation:Required + // +kubebuilder:validation:Optional // The OpenShift secret storing the client certificate plus its key ClientCertificate string `json:"clientCertificate"` From f3197c655e94f8c13ce767e3c10e2d93797d3e6a Mon Sep 17 00:00:00 2001 From: Mauricio Harley Date: Fri, 27 Sep 2024 10:35:59 +0000 Subject: [PATCH 6/6] Initial support for Eviden Trustway HSM Signed-off-by: Mauricio Harley --- api/bases/barbican.openstack.org_barbicanapis.yaml | 4 ---- api/bases/barbican.openstack.org_barbicanworkers.yaml | 4 ---- config/crd/bases/barbican.openstack.org_barbicanapis.yaml | 4 ---- config/crd/bases/barbican.openstack.org_barbicanworkers.yaml | 4 ---- 4 files changed, 16 deletions(-) diff --git a/api/bases/barbican.openstack.org_barbicanapis.yaml b/api/bases/barbican.openstack.org_barbicanapis.yaml index 1cb84bb9..3dcfda7a 100644 --- a/api/bases/barbican.openstack.org_barbicanapis.yaml +++ b/api/bases/barbican.openstack.org_barbicanapis.yaml @@ -428,13 +428,9 @@ spec: description: TransportURLSecret - Secret containing RabbitMQ transportURL type: string required: - - clientCertificate - containerImage - databaseHostname - databaseInstance - - hsmCertificates - - ipAddress - - pin - rabbitMqClusterName - serviceAccount type: object diff --git a/api/bases/barbican.openstack.org_barbicanworkers.yaml b/api/bases/barbican.openstack.org_barbicanworkers.yaml index 5ba42fb5..1d99daf5 100644 --- a/api/bases/barbican.openstack.org_barbicanworkers.yaml +++ b/api/bases/barbican.openstack.org_barbicanworkers.yaml @@ -225,13 +225,9 @@ spec: transportURLSecret: type: string required: - - clientCertificate - containerImage - databaseHostname - databaseInstance - - hsmCertificates - - ipAddress - - pin - rabbitMqClusterName - serviceAccount type: object diff --git a/config/crd/bases/barbican.openstack.org_barbicanapis.yaml b/config/crd/bases/barbican.openstack.org_barbicanapis.yaml index 1cb84bb9..3dcfda7a 100644 --- a/config/crd/bases/barbican.openstack.org_barbicanapis.yaml +++ b/config/crd/bases/barbican.openstack.org_barbicanapis.yaml @@ -428,13 +428,9 @@ spec: description: TransportURLSecret - Secret containing RabbitMQ transportURL type: string required: - - clientCertificate - containerImage - databaseHostname - databaseInstance - - hsmCertificates - - ipAddress - - pin - rabbitMqClusterName - serviceAccount type: object diff --git a/config/crd/bases/barbican.openstack.org_barbicanworkers.yaml b/config/crd/bases/barbican.openstack.org_barbicanworkers.yaml index 5ba42fb5..1d99daf5 100644 --- a/config/crd/bases/barbican.openstack.org_barbicanworkers.yaml +++ b/config/crd/bases/barbican.openstack.org_barbicanworkers.yaml @@ -225,13 +225,9 @@ spec: transportURLSecret: type: string required: - - clientCertificate - containerImage - databaseHostname - databaseInstance - - hsmCertificates - - ipAddress - - pin - rabbitMqClusterName - serviceAccount type: object