Passphrase parameters are considered to be secret information and
should not appear in logs even when debug is enabled.
This change marks the following two passphrase parameters as secrets
and ensures actual values are hidden in oslo.config debug logs.
- [certificates] server_certs_key_passphrase
- [certificates] ca_private_key_passphrase
Change-Id: I623aa9b42ea40bdf420f124b981b7755e6c630f8
Fernet checks[1] for 32 characters long key, so Octavia should validate
the value provided for server_certs_key_passphrase, to reject an invalid
passphrase as early as possible.
This[2] Red Hat Bug showed a case in which an invalid passphrase got
configured, and as a result, Octavia was unable to create any
load balancers.
Related-bug: #1833942
[1] 784676de33/src/cryptography/fernet.py (L36)
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1723051
Change-Id: I334364d4654491bc0d289472ca9ab5fe462d5139
This affects only the internal certificates that we generate and install
on Amphorae for use with the amphora-agent.
Change-Id: I8c3eb71246d339bd2d43092cce4e6122a49e9534
Octavia creates certificates and keys to manage encrypted
communication channel to amphorae.
When debug is enabled, the python taskflow module will log
all the information we provide to tasks (and sub-flows)
when we create amphorae or handle with anything related to
certificates and keys management (rotations, etc).
There are ways to tell taskflow to exclude specific things
from being logged (e.g., I136081045787c1bbe3ee846d5845a34201c57864).
While this handles some information in specific flows from being
logged, it is susceptive to code changes.
To avoid an everlasting whack-a-mole game, this patch will merely
encrypt sensitive information so we can safely log it and decrypts
it only when we need to use it.
Change-Id: I06d329ca53bc36bd27f7870ae7c7ca0cf18575b2
A basic local filesystem implementation of CertManager and
a local pyOpenSSL implementation of CertGenerator.
Change-Id: I0eb0476afaad8a1bbb2eaaf90564eb63f7872546
Partially-implements: blueprint tls-data-security
Takashi Kajinami