openstack
/
tripleo-heat-templates
Code Issues Proposed changes

Added Barbican option BarbicanPkcs11AlwaysSetCkaSensitive 

Added support for setting the Barbican option
always_set_cka_sensitive.  The option defaults to true as
needed by Safenet HSMs.  It is set to false in the ATOS
and Thales HSM environments.

Change-Id: If3fa975e8243dfe30ef67ec81db891943a94a9d5
Story: 2004734
This commit is contained in:
Douglas Mendizábal 2019-01-17 08:48:42 -06:00
parent efe9b8fa1f
commit 9012fff849
6 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docker/services/barbican-api.yaml
View File

@ -95,6 +95,10 @@ parameters:
description: Cryptoki Mechanism used to generate Master HMAC Key
type: string
default: 'CKM_AES_KEY_GEN'
BarbicanPkcs11AlwaysSetCkaSensitive:
description: Always set CKA_SENSITIVE=CK_TRUE
type: boolean
default: true
ThalesHSMNetworkName:
description: The network that the HSM is listening on.
type: string

1
environments/barbican-backend-pkcs11-atos.yaml
View File

@ -17,6 +17,7 @@ parameter_defaults:
BarbicanPkcs11CryptoHMACLabel: 'barbican_hmac_0'
BarbicanPkcs11CryptoATOSEnabled: true
BarbicanPkcs11CryptoEnabled: true
BarbicanPkcs11AlwaysSetCkaSensitive: false
ATOSVars:
atos_client_working_dir: /tmp/atos_client_install
# atos_client_iso_location:

1
environments/barbican-backend-pkcs11-thales.yaml
View File

@ -18,6 +18,7 @@ parameter_defaults:
BarbicanPkcs11CryptoHMACLabel: 'barbican_hmac_0'
BarbicanPkcs11CryptoThalesEnabled: true
BarbicanPkcs11CryptoEnabled: true
BarbicanPkcs11AlwaysSetCkaSensitive: false
ThalesVars:
thales_client_working_dir: /tmp/thales_client_install
# thales_client_tarball_location: URI where the CipherTools tarball can be downloaded.

3
environments/barbican-backend-pkcs11.yaml
View File

@ -11,7 +11,8 @@ parameter_defaults:
# BarbicanPkcs11CryptoHMACLabel: Label for the HMAC key
# BarbicanPkcs11CryptoSlotId: Slot Id for the HSM
# BarbicanPkcs11CryptoGlobalDefault: Whether this plugin is the global default plugin
BarbicanPkcs11CryptoEnabled: true
BarbicanPkcs11CryptoEnabled: true
BarbicanPkcs11AlwaysSetCkaSensitive: true
resource_registry:
OS::TripleO::Services::BarbicanBackendPkcs11Crypto: ../puppet/services/barbican-backend-pkcs11-crypto.yaml

5
puppet/services/barbican-backend-pkcs11-crypto.yaml
View File

@ -72,6 +72,10 @@ parameters:
description: Generate IVs for CKM_AES_GCM encryption mechanism
type: boolean
default: true
BarbicanPkcs11AlwaysSetCkaSensitive:
description: Always set CKA_SENSITIVE=CK_TRUE
type: boolean
default: true
BarbicanPkcs11CryptoGlobalDefault:
description: Whether this plugin is the global default plugin
type: boolean
@ -93,4 +97,5 @@ outputs:
barbican::plugins::p11_crypto::p11_crypto_plugin_hmac_key_type: {get_param: BarbicanPkcs11CryptoHMACKeyType}
barbican::plugins::p11_crypto::p11_crypto_plugin_hmac_keygen_mechanism: {get_param: BarbicanPkcs11CryptoHMACKeygenMechanism}
barbican::plugins::p11_crypto::p11_crypto_plugin_aes_gcm_generate_iv: {get_param: BarbicanPkcs11CryptoAESGCMGenerateIV}
barbican::plugins::p11_crypto::p11_crypto_plugin_always_set_cka_sensitive: {get_param: BarbicanPkcs11AlwaysSetCkaSensitive}
barbican::plugins::p11_crypto::global_default: {get_param: BarbicanPkcs11CryptoGlobalDefault}

5
releasenotes/notes/added-new-barbican-option-always-set-cka-sensitive-7a9dc31290899cac.yaml Normal file
View File

@ -0,0 +1,5 @@
---
features:
- |
Added a new Barbican option `BarbicanPkcs11AlwaysSetCkaSensitive`. The
default value is `true`.