mirror of
https://github.com/optim-enterprises-bv/openstack-helm.git
synced 2025-12-25 17:27:33 +00:00
ce1b2630d2
When using the simple_crypto_plugin (which is enabled by default),
secrets are encrypted with per-project keys, and those keys are
encrypted (or wrapped) with a master key encryption key (KEK, or MKEK).
The wrapped project keys are stored in the database. The KEK is stored
in the barbican configuration file.
If no KEK is specified, a well-known default is used. There is no native
Barbican support for rotating the KEK. Changing the KEK would cause loss
of access to all secrets, because Barbican would be unable to unwrap the
project keys.
This change adds support for upgrading the Helm chart while changing the
KEK. A script can be executed during the db-sync job that decrypts the
project keys with the old KEK, and rewraps them with the new KEK. Note
that no secrets are actually modified during this procedure, and the
project keys are not actually changed.
To use this feature, specify the following values:
conf:
barbican:
simple_crypto_plugin:
kek: # new KEK, 32-bytes of data, base64-encoded
simple_crypto_kek_rewrap:
old_kek: # old KEK, 32-bytes of data, base64-encoded
Change-Id: I462085b89ef80985b42149cccf865e6c5f0f5a53
============== OpenStack-Helm ============== Mission ------- The goal of OpenStack-Helm is to provide a collection of Helm charts that simply, resiliently, and flexibly deploy OpenStack and related services on Kubernetes. Communication ------------- * Join us on `IRC <irc://chat.oftc.net/openstack-helm>`_: #openstack-helm on oftc * Community `IRC Meetings <http://eavesdrop.openstack.org/#OpenStack-Helm_Team_Meeting>`_: [Every Tuesday @ 3PM UTC], #openstack-meeting-alt on oftc * Meeting Agenda Items: `Agenda <https://etherpad.openstack.org/p/openstack-helm-meeting-agenda>`_ * Join us on `Slack <https://kubernetes.slack.com/messages/C3WERB7DE/>`_ - #openstack-helm Storyboard ---------- Bugs and enhancements are tracked via OpenStack-Helm's `Storyboard <https://storyboard.openstack.org/#!/project_group/64>`_. Installation and Development ---------------------------- Please review our `documentation <https://docs.openstack.org/openstack-helm/latest/>`_. For quick installation, evaluation, and convenience, we have a kubeadm based all-in-one solution that runs in a Docker container. The Kubeadm-AIO set up can be found `here <https://docs.openstack.org/openstack-helm/latest/install/developer/index.html>`_. This project is under active development. We encourage anyone interested in OpenStack-Helm to review our `Installation <https://docs.openstack.org/openstack-helm/latest/install/index.html>`_ documentation. Feel free to ask questions or check out our current `Storyboard backlog <https://storyboard.openstack.org/#!/project_group/64>`_. To evaluate a multinode installation, follow the `Bare Metal <https://docs.openstack.org/openstack-helm/latest/install/multinode.html>`_ install guide. Repository ---------- Developers wishing to work on the OpenStack-Helm project should always base their work on the latest code, available from the OpenStack-Helm git repository. `OpenStack-Helm git repository <https://opendev.org/openstack/openstack-helm/>`_ Contributing ------------ We welcome contributions. Check out `this <CONTRIBUTING.rst>`_ document if you would like to get involved.