Browse Source

Add parameters to allow multiple nshield HSMs

With this change, it is possible to configure Barbican to connect
to multiple nShield HSMs in HA mode.

Change-Id: Id086b5e661e01991913c20c0b354800a9b6e2674
changes/79/776179/1
Ade Lee 8 months ago
parent
commit
4e2e984b9b
  1. 13
      deployment/barbican/barbican-api-container-puppet.yaml
  2. 22
      environments/barbican-backend-pkcs11-thales.yaml
  3. 11
      releasenotes/notes/barbican-thales-ha-581fbe9b5ef4dc87.yaml

13
deployment/barbican/barbican-api-container-puppet.yaml

@ -396,9 +396,15 @@ outputs:
{%- endfor %}
params:
$THALES_HSM_NETWORK_NAME: {get_param: ThalesHSMNetworkName}
thales_hsm_ip_address: {get_param: [ThalesVars, thales_hsm_ip_address]}
thales_hsm_config_location: {get_param: [ThalesVars, thales_hsm_config_location]}
thales_rfs_user: {get_param: [ThalesVars, thales_rfs_user]}
nshield_hsms: {get_param: [ThalesVars, nshield_hsms]}
- name: allow using legacy variables for backwards compatibility
set_fact:
nshield_hsms:
- name: Legacy variables HSM
ip: {get_param: [ThalesVars, thales_hsm_ip_address]}
when: nshield_hsms|length == 0
- name: set playbook vars
set_fact:
@ -432,9 +438,8 @@ outputs:
vars:
thales_configure_rfs: true
thales_client_ips: "{{thales_client_ips}}"
thales_hsm_ip_address: "{{thales_hsm_ip_address}}"
thales_hsm_config_location: "{{thales_hsm_config_location}}"
thales_bootstrap_client_ip: "{{thales_bootstrap_client_ip}}"
nshield_hsms: "{{nshield_hsms}}"
roles:
- thales_hsm

22
environments/barbican-backend-pkcs11-thales.yaml

@ -6,7 +6,9 @@ parameter_defaults:
# provide the appropriate values.
#
# BarbicanPkcs11CryptoLogin: Password (PIN) to login to PKCS11 session
# BarbicanPkcs11CryptoSlotId: Slot Id for the HSM
# BarbicanPkcs11CryptoTokenLabel: Label for PKCS#11 token to be used.
# This is typically the label given to the Operator Card Set (OCS)
# BarbicanPkcs11CryptoSlotId (optional): Slot Id for the HSM
# BarbicanPkcs11CryptoGlobalDefault: Whether this plugin is the global default plugin
BarbicanPkcs11CryptoLibraryPath: '/opt/nfast/toolkits/pkcs11/libcknfast.so'
@ -28,12 +30,26 @@ parameter_defaults:
thales_client_gid: 42481
# thales_km_data_location: URL where the RFS kmdata tarball can be downloaded.
# thales_km_data_tarball_name: Filename for the kmdata tarball.
# thales_hsm_ip_address: IP address for the HSM
# thales_rfs_server_ip_address: IP address for the RFS Server.
# nshield_hsms: Dictionary including details about relevant HSMs. If more than HSM
# is in the list, the HSMs will be configured in load sharing mode for HA.
# e.g. nshield_hsms:
# - name: hsm 1
# ip: X.X.X.X
# - name: hsm 2
# ip: Y.Y.Y.Y
# thales_hsm_config_location: The directory where the hsm configuration is stored in
# your RFS server. e.g. hsm-XXXX-XXXX-XXXX.
# thales_rfs_server_ip_address: IP address for the RFS Server.
# thales_rfs_user: Username used to log into RFS server.
# thales_rfs_key: RSA Private key in PEM format used to log into RFS server.
#
# The following parameter are deprecated and can be used to configure connection to a
# single HSM. It is better to use the nshield_hsms parameter above instead:
# thales_hsm_ip_address: IP address for the HSM
#
# This parameter is deprecated and is no longer needed:
# thales_hsm_config_location: The directory where the hsm configuration is stored in
# your RFS server. e.g. hsm-XXXX-XXXX-XXXX.
resource_registry:
OS::TripleO::Services::BarbicanBackendPkcs11Crypto: ../deployment/barbican/barbican-backend-pkcs11-crypto-puppet.yaml

11
releasenotes/notes/barbican-thales-ha-581fbe9b5ef4dc87.yaml

@ -0,0 +1,11 @@
---
features:
- The logic to configure the connection from barbican to nShield HSMs has
been augmented to parse a nshield_hsms parameter, which allows the
specification of multiple HSMs. The underlying ansible role
(ansible-role-thales-hsm) will configure the HSMs in load sharing mode
to provide HA.
deprecations:
- Some parameters within ThalesVars have been deprecated. These are -
thales_hsm_ip_address and thales_hsm_config_location. See
environments/barbican-backend-pkcs11-thales.yaml for details.
Loading…
Cancel
Save