Merge "change CryptoPluginManager to be instantiated in the module scope"

barbican/plugin/crypto/crypto.py

@@ -14,14 +14,12 @@
 import abc
 
 from oslo.config import cfg
-from stevedore import named
 
 import six
 
 from barbican.common import exception
 from barbican.common import utils
 from barbican.openstack.common import gettextutils as u
-from barbican.plugin.interface import secret_store
 
 LOG = utils.getLogger(__name__)
 
@@ -369,57 +367,3 @@ class CryptoPluginBase(object):
         :param algorithm: String algorithm name if needed
         """
         raise NotImplementedError  # pragma: no cover
-
-
-class CryptoPluginManager(named.NamedExtensionManager):
-    def __init__(self, conf=CONF, invoke_on_load=True,
-                 invoke_args=(), invoke_kwargs={}):
-        super(CryptoPluginManager, self).__init__(
-            conf.crypto.namespace,
-            conf.crypto.enabled_crypto_plugins,
-            invoke_on_load=invoke_on_load,
-            invoke_args=invoke_args,
-            invoke_kwds=invoke_kwargs
-        )
-
-    def get_plugin_store_generate(self, type_needed, algorithm=None,
-                                  bit_length=None, mode=None):
-        """Gets a secret store or generate plugin that supports provided type.
-
-        :param type_needed: PluginSupportTypes that contains details on the
-        type of plugin required
-        :returns: CryptoPluginBase plugin implementation
-        """
-
-        if len(self.extensions) < 1:
-            raise CryptoPluginNotFound()
-
-        for ext in self.extensions:
-            if ext.obj.supports(type_needed, algorithm, bit_length, mode):
-                plugin = ext.obj
-                break
-        else:
-            raise secret_store.SecretStorePluginNotFound()
-
-        return plugin
-
-    def get_plugin_retrieve(self, plugin_name_for_store):
-        """Gets a secret retrieve plugin that supports the provided type.
-
-        :param type_needed: PluginSupportTypes that contains details on the
-        type of plugin required
-        :returns: CryptoPluginBase plugin implementation
-        """
-
-        if len(self.extensions) < 1:
-            raise CryptoPluginNotFound()
-
-        for ext in self.extensions:
-            decrypting_plugin = ext.obj
-            plugin_name = utils.generate_fullname_for(decrypting_plugin)
-            if plugin_name == plugin_name_for_store:
-                break
-        else:
-            raise secret_store.SecretStorePluginNotFound()
-
-        return decrypting_plugin

barbican/plugin/crypto/manager.py

@@ -0,0 +1,83 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from oslo.config import cfg
+from stevedore import named
+
+from barbican.common import utils
+from barbican.plugin.crypto import crypto
+from barbican.plugin.interface import secret_store
+
+CONF = cfg.CONF
+
+
+class _CryptoPluginManager(named.NamedExtensionManager):
+    def __init__(self, conf=CONF, invoke_on_load=True,
+                 invoke_args=(), invoke_kwargs={}):
+        """Each time this class is initialized it will load a new instance
+        of each enabled crypto plugin. This is undesirable, so rather than
+        initializing a new instance of this class use the PLUGIN_MANAGER
+        at the module level.
+        """
+        super(_CryptoPluginManager, self).__init__(
+            conf.crypto.namespace,
+            conf.crypto.enabled_crypto_plugins,
+            invoke_on_load=invoke_on_load,
+            invoke_args=invoke_args,
+            invoke_kwds=invoke_kwargs
+        )
+
+    def get_plugin_store_generate(self, type_needed, algorithm=None,
+                                  bit_length=None, mode=None):
+        """Gets a secret store or generate plugin that supports provided type.
+
+        :param type_needed: PluginSupportTypes that contains details on the
+        type of plugin required
+        :returns: CryptoPluginBase plugin implementation
+        """
+
+        if len(self.extensions) < 1:
+            raise crypto.CryptoPluginNotFound()
+
+        for ext in self.extensions:
+            if ext.obj.supports(type_needed, algorithm, bit_length, mode):
+                plugin = ext.obj
+                break
+        else:
+            raise secret_store.SecretStorePluginNotFound()
+
+        return plugin
+
+    def get_plugin_retrieve(self, plugin_name_for_store):
+        """Gets a secret retrieve plugin that supports the provided type.
+
+        :param type_needed: PluginSupportTypes that contains details on the
+        type of plugin required
+        :returns: CryptoPluginBase plugin implementation
+        """
+
+        if len(self.extensions) < 1:
+            raise crypto.CryptoPluginNotFound()
+
+        for ext in self.extensions:
+            decrypting_plugin = ext.obj
+            plugin_name = utils.generate_fullname_for(decrypting_plugin)
+            if plugin_name == plugin_name_for_store:
+                break
+        else:
+            raise secret_store.SecretStorePluginNotFound()
+
+        return decrypting_plugin
+
+
+PLUGIN_MANAGER = _CryptoPluginManager()

barbican/plugin/store_crypto.py

@@ -18,6 +18,7 @@ from oslo.config import cfg
 from barbican.common import utils
 from barbican.model import models
 from barbican.plugin.crypto import crypto
+from barbican.plugin.crypto import manager
 from barbican.plugin.interface import secret_store as sstore
 
 CONF = cfg.CONF
@@ -44,10 +45,9 @@ class StoreCryptoAdapterPlugin(sstore.SecretStoreBase):
         """
 
         # Find HSM-style 'crypto' plugin.
-        encrypting_plugin = crypto.CryptoPluginManager()\
-            .get_plugin_store_generate(
-                crypto.PluginSupportTypes.ENCRYPT_DECRYPT
-            )
+        encrypting_plugin = manager.PLUGIN_MANAGER.get_plugin_store_generate(
+            crypto.PluginSupportTypes.ENCRYPT_DECRYPT
+        )
 
         # Find or create a key encryption key metadata.
         kek_datum_model, kek_meta_dto = self._find_or_create_kek_objects(
@@ -85,7 +85,7 @@ class StoreCryptoAdapterPlugin(sstore.SecretStoreBase):
         datum_model = context.secret_model.encrypted_data[0]
 
         # Find HSM-style 'crypto' plugin.
-        decrypting_plugin = crypto.CryptoPluginManager().get_plugin_retrieve(
+        decrypting_plugin = manager.PLUGIN_MANAGER.get_plugin_retrieve(
             datum_model.kek_meta_tenant.plugin_name)
 
         # wrap the KEKDatum instance in our DTO
@@ -123,11 +123,11 @@ class StoreCryptoAdapterPlugin(sstore.SecretStoreBase):
         plugin_type = self._determine_generation_type(key_spec.alg)
         if crypto.PluginSupportTypes.SYMMETRIC_KEY_GENERATION != plugin_type:
             raise sstore.SecretAlgorithmNotSupportedException(key_spec.alg)
-        generating_plugin = crypto.CryptoPluginManager()\
-            .get_plugin_store_generate(plugin_type,
-                                       key_spec.alg,
-                                       key_spec.bit_length,
-                                       key_spec.mode)
+        generating_plugin = manager.PLUGIN_MANAGER.get_plugin_store_generate(
+            plugin_type,
+            key_spec.alg,
+            key_spec.bit_length,
+            key_spec.mode)
 
         # Find or create a key encryption key metadata.
         kek_datum_model, kek_meta_dto = self._find_or_create_kek_objects(