Browse Source

add "verify_ssl_path" config for barbican key manager

Now we cann't use the verify_ssl if we set True, so we
add the "verify_ssl_path" config to solve it.

Closes-Bug: #1876102
(cherry picked from commit 89f311dfbd)

Change-Id: I83bafe5b7e0c4cca67f773858007fb59d98a93a5
tags/1.2.3^0
ramboman 3 months ago
committed by Luigi Toscano
parent
commit
46575f02e8
4 changed files with 30 additions and 5 deletions
  1. +12
    -3
      castellan/key_manager/barbican_key_manager.py
  2. +5
    -0
      castellan/options.py
  3. +7
    -2
      castellan/tests/unit/test_options.py
  4. +6
    -0
      releasenotes/notes/bug-1876102-7c7288fb6e90b11d.yaml

+ 12
- 3
castellan/key_manager/barbican_key_manager.py View File

@@ -69,7 +69,14 @@ barbican_opts = [
cfg.BoolOpt('verify_ssl',
default=True,
help='Specifies if insecure TLS (https) requests. If False, '
'the server\'s certificate will not be validated'),
'the server\'s certificate will not be validated, if '
'True, we can set the verify_ssl_path config meanwhile.'),
cfg.StrOpt('verify_ssl_path',
default=None,
help='A path to a bundle or CA certs to check against, or '
'None for requests to attempt to locate and use '
'certificates which verify_ssh is True. If verify_ssl '
'is False, this is ignored.'),
cfg.StrOpt('barbican_endpoint_type',
default='public',
choices=['public', 'internal', 'admin'],
@@ -122,8 +129,10 @@ class BarbicanKeyManager(key_manager.KeyManager):

try:
auth = self._get_keystone_auth(context)
sess = session.Session(auth=auth,
verify=self.conf.barbican.verify_ssl)
verify_ssl = self.conf.barbican.verify_ssl
verify_ssl_path = self.conf.barbican.verify_ssl_path
verify = verify_ssl and verify_ssl_path or verify_ssl
sess = session.Session(auth=auth, verify=verify)

self._barbican_endpoint = self._get_barbican_endpoint(auth, sess)
self._barbican_client = barbican_client_import.Client(


+ 5
- 0
castellan/options.py View File

@@ -39,6 +39,7 @@ _DEFAULT_LOGGING_CONTEXT_FORMAT = ('%(asctime)s.%(msecs)03d %(process)d '
def set_defaults(conf, backend=None, barbican_endpoint=None,
barbican_api_version=None, auth_endpoint=None,
retry_delay=None, number_of_retries=None, verify_ssl=None,
verify_ssl_path=None,
api_class=None, vault_root_token_id=None,
vault_approle_role_id=None, vault_approle_secret_id=None,
vault_kv_mountpoint=None, vault_url=None,
@@ -55,6 +56,7 @@ def set_defaults(conf, backend=None, barbican_endpoint=None,
:param retry_delay: Use this attribute to set retry delay.
:param number_of_retries: Use this attribute to set number of retries.
:param verify_ssl: Use this to specify if ssl should be verified.
:param verify_ssl_path: Use this to specify the CA path.
:param vault_root_token_id: Use this for the root token id for vault.
:param vault_approle_role_id: Use this for the approle role_id for vault.
:param vault_approle_secret_id: Use this for the approle secret_id
@@ -96,6 +98,9 @@ def set_defaults(conf, backend=None, barbican_endpoint=None,
if verify_ssl is not None:
conf.set_default('verify_ssl', verify_ssl,
group=bkm.BARBICAN_OPT_GROUP)
if verify_ssl_path is not None:
conf.set_default('verify_ssl_path', verify_ssl_path,
group=bkm.BARBICAN_OPT_GROUP)
if barbican_endpoint_type is not None:
conf.set_default('barbican_endpoint_type', barbican_endpoint_type,
group=bkm.BARBICAN_OPT_GROUP)


+ 7
- 2
castellan/tests/unit/test_options.py View File

@@ -62,11 +62,16 @@ class TestOptions(base.TestCase):
self.assertEqual(number_of_retries,
conf.get(bkm.BARBICAN_OPT_GROUP).number_of_retries)

verify_ssl = True
options.set_defaults(conf, verify_ssl=True)
verify_ssl = False
options.set_defaults(conf, verify_ssl=False)
self.assertEqual(verify_ssl,
conf.get(bkm.BARBICAN_OPT_GROUP).verify_ssl)

verify_ssl_path = '/mnt'
options.set_defaults(conf, verify_ssl_path='/mnt')
self.assertEqual(verify_ssl_path,
conf.barbican.verify_ssl_path)

barbican_endpoint_type = 'internal'
options.set_defaults(conf, barbican_endpoint_type='internal')
result_type = conf.get(bkm.BARBICAN_OPT_GROUP).barbican_endpoint_type


+ 6
- 0
releasenotes/notes/bug-1876102-7c7288fb6e90b11d.yaml View File

@@ -0,0 +1,6 @@
---
fixes:
- |
Add a new parameter, ``verify_ssl_path``, that can be used to
configure the path to CA certs when verifying requests to
Barbican.

Loading…
Cancel
Save