2e08ffd6d3
This patch introduces an optional backend encryption for the Barbican API service. When used in conjunction with enabling TLS for service API endpoints, network communcation will be encrypted end to end, from client through HAProxy to the Barbican service. Change-Id: I62a43b36ebe4a03230bf944980b45e4b6938871b Partially-Implements: blueprint add-ssl-internal-network
53 lines
1.8 KiB
Django/Jinja
53 lines
1.8 KiB
Django/Jinja
{
|
|
"command": "uwsgi --master --emperor /etc/barbican/vassals --logto /var/log/kolla/barbican/barbican-api.log --logfile-chmod 644",
|
|
"config_files": [
|
|
{
|
|
"source": "{{ container_config_directory }}/barbican.conf",
|
|
"dest": "/etc/barbican/barbican.conf",
|
|
"owner": "barbican",
|
|
"perm": "0600"
|
|
},
|
|
{
|
|
"source": "{{ container_config_directory }}/vassals/barbican-api.ini",
|
|
"dest": "/etc/barbican/vassals/barbican-api.ini",
|
|
"owner": "barbican",
|
|
"perm": "0600"
|
|
},
|
|
{
|
|
"source": "{{ container_config_directory }}/barbican-api-paste.ini",
|
|
"dest": "/etc/barbican/barbican-api-paste.ini",
|
|
"owner": "barbican",
|
|
"perm": "0600",
|
|
"optional": true
|
|
}{% if barbican_enable_tls_backend | bool %},
|
|
{
|
|
"source": "{{ container_config_directory }}/barbican-cert.pem",
|
|
"dest": "/etc/barbican/certs/barbican-cert.pem",
|
|
"owner": "barbican",
|
|
"perm": "0600"
|
|
},
|
|
{
|
|
"source": "{{ container_config_directory }}/barbican-key.pem",
|
|
"dest": "/etc/barbican/certs/barbican-key.pem",
|
|
"owner": "barbican",
|
|
"perm": "0600"
|
|
}{% endif %}{% if barbican_policy_file is defined %},
|
|
{
|
|
"source": "{{ container_config_directory }}/{{ barbican_policy_file }}",
|
|
"dest": "/etc/barbican/{{ barbican_policy_file }}",
|
|
"owner": "barbican",
|
|
"perm": "0600"
|
|
}{% endif %}
|
|
],
|
|
"permissions": [
|
|
{
|
|
"path": "/var/lib/barbican",
|
|
"owner": "barbican:barbican"
|
|
},
|
|
{
|
|
"path": "/var/log/kolla/barbican",
|
|
"owner": "barbican:barbican"
|
|
}
|
|
]
|
|
}
|