openstack/kolla-ansible
Code Issues Proposed changes

Merge "Barbican simple_crypto plugin broken - invalid key"

Browse Source
This commit is contained in:
Jenkins 2017-06-26 08:58:03 +00:00 committed by Gerrit Code Review
commit be8f64492c
3 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ansible/roles/barbican/templates/barbican.conf.j2
View File

@ -40,7 +40,7 @@ hmac_label = 'kolla_hmac'
{% if barbican_crypto_plugin == 'simple_crypto' %} {% if barbican_crypto_plugin == 'simple_crypto' %}
[simple_crypto_plugin] [simple_crypto_plugin]
# the kek should be a 32-byte value which is base64 encoded # the kek should be a 32-byte value which is base64 encoded
kek = '{{ barbican_crypto_password }}' kek = '{{ barbican_crypto_key }}'
{% endif %} {% endif %}

1
etc/kolla/passwords.yml
View File

@ -31,7 +31,6 @@ barbican_database_password:
barbican_keystone_password: barbican_keystone_password:
barbican_p11_password: barbican_p11_password:
barbican_crypto_key: barbican_crypto_key:
barbican_crypto_password:
keystone_admin_password: keystone_admin_password:
keystone_database_password: keystone_database_password:

21
releasenotes/notes/barbican-simple-crypto-key-f3cd3b8b210ab237.yaml Normal file
View File

@ -0,0 +1,21 @@
---
upgrade:
- |
Fixes an issue with the barbican service when using the ``simple_crypto``
plugin whereby an invalid value is generated and used as the plugin's
encryption key.
The encryption key is configured via the ``[simple_crypto_plugin]: kek``
configuration option in ``barbican.conf``. This option was previously
configured using the kolla-ansible variable ``barbican_crypto_password``,
but is now configured using ``barbican_crypto_key`` which uses the correct
format.
Operators that have set ``barbican_crypto_password`` to a valid value
to work around this issue should ensure that ``barbican_crypto_key``
is configured in ``passwords.yml`` with the same value that was used for
``barbican_crypto_password``. This will ensure that existing barbican
secrets can be decrypted.
The variable ``barbican_crypto_password`` may safely be removed from
``passwords.yml``.