openstack/tripleo-heat-templates
Code Issues Proposed changes

Add kek_rewrap functionality to Barbican

Browse Source 
Add the ability to rewrap keks when the master key is updated
by simply doing an update.  Also, provide some needed ordering
in the steps involving MKEK and HMAC creation, sync and update.

Change-Id: I5e5a099173e82c04f4e0157049df08c8c7c47045
This commit is contained in:
Ade Lee
2019-03-05 16:34:41 +00:00
parent 17d1ed8d56
commit 80e2dad367
2 changed files with 74 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
releasenotes/notes/add-kek-rewrap-to-barbican-ef930dda85fe1e1d.yaml Normal file
View File

@@ -0,0 +1,7 @@
---
features:
- Added ability to rewrap project KEKs (key encryption keys) when doing an
upgrade. This allows deployers to rewrap KEKs whenever they rotate the
master KEK and HMAC keys when using the PKCS#11 plugin behind Barbican.
- Also added some needed ordering for master key creation, sync and update
when using a Thales HSM behind Barbican.