雜記

記錄一下最近研究barbican組件的個人理解。

barbican主要是密鑰管理的。存儲（store secret）的時候有各種文件格式（text\plain），獲取的時候根據(jù)它是證書，私鑰進行格式化，比如x509。

{'text/plain': 'text/plain',
'text/plain;charset=utf-8': 'text/plain',
'text/plain; charset=utf-8': 'text/plain',
'application/octet-stream': 'application/octet-stream',
'application/pkcs8': 'application/pkcs8',
'application/aes': 'application/aes'}

tips：ocatavia可以對pkcs12證書進行格式化（當然也是封裝的接口），一般情況下，獲取的證書默認進行pkcs12格式化的，同時也兼容了barbican原生的證書格式化。包括監(jiān)聽器綁定證書的方式也同lbv2不一樣，并沒有采用容器的方式（實際pkcs12也可以看著是容器）。

barbican后端支持多種存儲，所以官網(wǎng)提供了多個插件：

[secretstore]
# Set to True when multiple plugin backends support is needed
enable_multiple_secret_stores = True
stores_lookup_suffix = software, kmip, pkcs11, dogtag 
[secretstore:software]
secret_store_plugin = store_crypto
crypto_plugin = simple_crypto
[secretstore:kmip]
secret_store_plugin = kmip_plugin
global_default = True 
[secretstore:dogtag]
secret_store_plugin = dogtag_plugin 
[secretstore:pkcs11]
secret_store_plugin = store_crypto
crypto_plugin = p11_crypto

目前barbican自身代碼，限定了pkcs8,pkcs11,x509等格式的支持程度。
lbv2支持的私鑰是pkcs8(??????)證書是x509，octvia在代碼里增加了pkcs12的代碼文件，并新增/certificate/manager/barbican.py可實現(xiàn)barbican對pkcs12的支持，所以私鑰和證書都可以支持pkcs12
https://developer.openstack.org/api-guide/key-manager/containers.html#certificate-containers
https://docs.openstack.org/releasenotes/octavia/queens.html

Users can now use a reference to a single PKCS12 bundle as their default_tls_container_ref instead of a Barbican container with individual secret objects. PKCS12 supports bundling a private key, certificate, and intermediates. Private keys can no longer be passphrase protected when using PKCS12 bundles. No configuration change is necessary to enable this feature. Users may simply begin using this. Any use of the old style containers will be detected and automatically fall back to using the old Barbican driver.
Certificate bundles can now be stored in any backend Castellan supports, and can be retrieved via a Castellan driver, even if Barbican is not deployed.

創(chuàng)建證書容器的body如下：

{          
    "type": "certificate",
    "status": "ACTIVE",
    "name": "Example.com Certificates",
    "consumers": [],
    "container_ref": "https://{barbican_host}/v1/containers/{uuid}",
    "secret_refs": [
        {
            "name": "certificate",
            "secret_ref": "https://{barbican_host}/v1/secrets/{uuid}"
        },
        {
            "name": "private_key",
            "secret_ref": "https://{barbican_host}/v1/secrets/{uuid}"
        },
        {
            "name": "private_key_passphrase",
            "secret_ref": "https://{barbican_host}/v1/secrets/{uuid}"
        },
        {
            "name": "intermediates",
            "secret_ref": "https://{barbican_host}/v1/secrets/{uuid}"
        }

    ],
    "created": "2015-03-30T21:10:45.417835",
    "updated": "2015-03-30T21:10:45.417835"
}      

證書容器是用來存儲證書相關的密鑰，需要指定以下幾種type，其中certificate是必須指定，其余的均是可選的。

A certificate container is used for storing the following secrets that are relevant to certificates:
certificate
private_key (optional)
private_key_passphrase (optional)
intermediates (optional)
The payload for the secret referenced as the “certificate” is expected to be a PEM formatted x509 certificate.
The payload for the secret referenced as the “intermediates” is expected to be a PEM formatted PKCS7 certificate chain.

參考

http://www.iceyao.com.cn/2017/11/19/Neutron-lbaas%E4%BB%A3%E7%90%86https%E5%AE%9E%E8%B7%B5/
https://docs.openstack.org/barbican/latest/install/barbican-backend.html
https://docs.openstack.org/barbican/latest/configuration/plugin_backends.html
https://developer.openstack.org/api-guide/key-manager/containers.html#certificate-containers
https://docs.openstack.org/releasenotes/octavia/queens.html
個人分析，歡迎指正，若轉(zhuǎn)載請注明出處！
歡迎訪問我的主頁