openstack
/
openstack
Code Issues Proposed changes

Update git submodules 

* Update openstack-helm from branch 'master'
  to 9bdd4fe96f46e3a4fb30ae7910dd970ca0a82c76
  - Merge "Barbican: Add support for master KEK rotation"
  - Barbican: Add support for master KEK rotation
    
    When using the simple_crypto_plugin (which is enabled by default),
    secrets are encrypted with per-project keys, and those keys are
    encrypted (or wrapped) with a master key encryption key (KEK, or MKEK).
    The wrapped project keys are stored in the database. The KEK is stored
    in the barbican configuration file.
    
    If no KEK is specified, a well-known default is used. There is no native
    Barbican support for rotating the KEK. Changing the KEK would cause loss
    of access to all secrets, because Barbican would be unable to unwrap the
    project keys.
    
    This change adds support for upgrading the Helm chart while changing the
    KEK. A script can be executed during the db-sync job that decrypts the
    project keys with the old KEK, and rewraps them with the new KEK. Note
    that no secrets are actually modified during this procedure, and the
    project keys are not actually changed.
    
    To use this feature, specify the following values:
    
        conf:
          barbican:
            simple_crypto_plugin:
              kek: # new KEK, 32-bytes of data, base64-encoded
          simple_crypto_kek_rewrap:
            old_kek: # old KEK, 32-bytes of data, base64-encoded
    
    Change-Id: I462085b89ef80985b42149cccf865e6c5f0f5a53
This commit is contained in:
Zuul 2021-06-08 14:33:32 +00:00 committed by Gerrit Code Review
parent 314d89f4ec
commit 9bfa304be5
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
openstack-helm

@ -1 +1 @@
Subproject commit 92dfcbb7c1adcd78026ed56d12a03e25431a2f77
Subproject commit 9bdd4fe96f46e3a4fb30ae7910dd970ca0a82c76