![]() This patchset implements caching lookup and reverse-lookup functions to allow for much faster retrieval of encrypted data from Barbican, which doesn't currently support batched requests in its Secrets API. This behavior is necessary since Deckhand has to potentially retrieve and store up to dozens of secrets per request. Note that data for both lookup functions are invalidated together, as they are tied to the same cache. This change implements caching around arguably the most expensive operation in Deckhand: encryption. By caching encryption itself, the performance of rendering documents thereby increases in a meaningful way, without having to implement much logic to pull it off. A follow up patch set here: https://review.openstack.org/#/c/585842 focuses on caching rendered documents themselves. Change-Id: I0d330690a3c5e899b763ddcaa00d356007aa23fb |
||
---|---|---|
alembic | ||
charts/deckhand | ||
deckhand | ||
doc | ||
etc/deckhand | ||
images/deckhand | ||
releasenotes | ||
tools | ||
.coveragerc | ||
.dockerignore | ||
.gitignore | ||
.gitreview | ||
.stestr.conf | ||
.zuul.yaml | ||
HACKING.rst | ||
LICENSE | ||
Makefile | ||
README.rst | ||
REVIEWING.rst | ||
alembic.ini | ||
entrypoint.sh | ||
requirements.txt | ||
setup.cfg | ||
setup.py | ||
test-requirements.txt | ||
tox.ini |
README.rst
Deckhand
Deckhand is a storage service for YAML-based configuration documents, which are managed through version control and automatically validated. Deckhand provides users with a variety of different document types that describe complex configurations using the features listed below.
Find more documentation for Deckhand on Read the Docs.
Core Responsibilities
- layering - helps reduce duplication in configuration by applying the notion of inheritance to documents
- substitution - provides separation between secret data and other configuration data for security purposes and reduces data duplication by allowing common data to be defined once and substituted elsewhere dynamically
- revision history - maintains well-defined collections of documents within immutable revisions that are meant to operate together, while providing the ability to rollback to previous revisions
- validation - allows services to implement and register different kinds of validations and report errors
- secret management - leverages existing OpenStack APIs -- namely Barbican -- to reliably and securely store sensitive data
Getting Started
For more detailed installation and setup information, please refer to the Getting Started guide.
Testing
Automated Testing
To run unit tests using sqlite, execute:
$ tox -epy27
$ tox -epy35
against a py27- or py35-backed environment, respectively. To run individual unit tests, run:
$ tox -e py27 -- deckhand.tests.unit.db.test_revisions
for example.
To run functional tests:
$ tox -e functional
You can also run a subset of tests via a regex:
$ tox -e functional -- gabbi.suitemaker.test_gabbi_document-crud-success-multi-bucket
Integration Points
Deckhand has the following integration points:
- Barbican (OpenStack Key Manager) provides secure storage for sensitive data.
- Keystone (OpenStack Identity service) provides authentication and support for role based authorization.
- PostgreSQL is used to persist information to correlate workflows with users and history of workflow commands.
Note
Currently, other database back-ends are not supported.
Though, being a low-level service, has many other UCP services that integrate with it, including: