openstack/barbican
Code Issues Proposed changes

Enable KV mountpoint configuration for Vault

Browse Source 
Add configuration option to support end-user configuration of the
KV store mountpoint used in Vault for storage of keys.

Change-Id: I4f136f5f356e3f25df09a513f0a7683082f5ce0f
Related-Bug: 1797148
Depends-On: I625a819c2b9b542677258de709a9c520fb86858b
This commit is contained in:
James Page
2018-10-10 17:05:21 +01:00
parent 77d94ff6a9
commit 4e1d8ae5a0
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
barbican/plugin/vault_secret_store.py
View File

@@ -23,6 +23,7 @@ from oslo_log import log
LOG = log.getLogger(__name__) LOG = log.getLogger(__name__)
DEFAULT_VAULT_URL = "http://127.0.0.1:8200" DEFAULT_VAULT_URL = "http://127.0.0.1:8200"
DEFAULT_MOUNTPOINT = "secret"
vault_opt_group = cfg.OptGroup(name='vault_plugin', title='Vault Plugin') vault_opt_group = cfg.OptGroup(name='vault_plugin', title='Vault Plugin')
vault_opts = [ vault_opts = [
@@ -32,6 +33,10 @@ vault_opts = [
help='AppRole role_id for authentication with vault'), help='AppRole role_id for authentication with vault'),
cfg.StrOpt('approle_secret_id', cfg.StrOpt('approle_secret_id',
help='AppRole secret_id for authentication with vault'), help='AppRole secret_id for authentication with vault'),
cfg.StrOpt('kv_mountpoint',
default=DEFAULT_MOUNTPOINT,
help='Mountpoint of KV store in Vault to use, for example: '
'{}'.format(DEFAULT_MOUNTPOINT)),
cfg.StrOpt('vault_url', cfg.StrOpt('vault_url',
default=DEFAULT_VAULT_URL, default=DEFAULT_VAULT_URL,
help='Use this endpoint to connect to Vault, for example: ' help='Use this endpoint to connect to Vault, for example: '
@@ -75,6 +80,7 @@ class VaultSecretStore(css.CastellanSecretStore):
vault_root_token_id=conf.vault_plugin.root_token_id, vault_root_token_id=conf.vault_plugin.root_token_id,
vault_approle_role_id=conf.vault_plugin.approle_role_id, vault_approle_role_id=conf.vault_plugin.approle_role_id,
vault_approle_secret_id=conf.vault_plugin.approle_secret_id, vault_approle_secret_id=conf.vault_plugin.approle_secret_id,
vault_kv_mountpoint=conf.vault_plugin.kv_mountpoint,
vault_url=conf.vault_plugin.vault_url, vault_url=conf.vault_plugin.vault_url,
vault_ssl_ca_crt_file=conf.vault_plugin.ssl_ca_crt_file, vault_ssl_ca_crt_file=conf.vault_plugin.ssl_ca_crt_file,
vault_use_ssl=conf.vault_plugin.use_ssl vault_use_ssl=conf.vault_plugin.use_ssl