tripleo-heat-templates/environments/barbican-backend-pkcs11-thales.yaml
Douglas Mendizábal 9b67d64208 Add new options for Barbican PKCS#11 backend
This patch adds two new parameters for deploying Barbican with the
PCKS#11 backend `BarbicanPkcs11CryptoTokenLabels` and
`BarbicanPkcs11CryptoOsLockingOk`.

The patch also deprecates `BarbicanPkcs11CryptoTokenLabel` in favor of
the new option that can be set to more than one label.

Depends-On: Iba7013dd6e1b1e4650b25cd4dd8dc1f355ceb538
Change-Id: I1c5059799f613a62a13379eb82ba516a8ed3a15a
(cherry picked from commit 3b4d488a6a)
2021-05-19 15:03:28 +00:00

55 lines
3.0 KiB
YAML

# A Heat environment file to enable the barbican PKCS11 crypto backend with
# a Thales HSM.
# Note that barbican needs to be enabled in order to use this.
parameter_defaults:
# In order to use this backend, you need to uncomment these values and
# provide the appropriate values.
#
# BarbicanPkcs11CryptoLogin: Password (PIN) to login to PKCS11 session
# BarbicanPkcs11CryptoTokenLabels: Label for PKCS#11 token to be used.
# This is typically the label given to the Operator Card Set (OCS)
# BarbicanPkcs11CryptoGlobalDefault: Whether this plugin is the global default plugin
BarbicanPkcs11CryptoLibraryPath: '/opt/nfast/toolkits/pkcs11/libcknfast.so'
BarbicanPkcs11CryptoEncryptionMechanism: 'CKM_AES_CBC'
BarbicanPkcs11CryptoHMACKeyType: 'CKK_SHA256_HMAC'
BarbicanPkcs11CryptoHMACKeygenMechanism: 'CKM_NC_SHA256_HMAC_KEY_GEN'
BarbicanPkcs11CryptoMKEKLabel: 'barbican_mkek_0'
BarbicanPkcs11CryptoMKEKLength: '32'
BarbicanPkcs11CryptoHMACLabel: 'barbican_hmac_0'
BarbicanPkcs11CryptoThalesEnabled: true
BarbicanPkcs11CryptoEnabled: true
BarbicanPkcs11AlwaysSetCkaSensitive: false
ThalesVars:
thales_client_working_dir: /tmp/thales_client_install
# thales_client_tarball_location: URI where the CipherTools tarball can be downloaded.
# thales_client_tarball_name: Filename for the CipherTools tarball.
thales_client_path: linux/libc6_11/amd64/nfast
thales_client_uid: 42481
thales_client_gid: 42481
# thales_km_data_location: URL where the RFS kmdata tarball can be downloaded.
# thales_km_data_tarball_name: Filename for the kmdata tarball.
# nshield_hsms: Dictionary including details about relevant HSMs. If more than HSM
# is in the list, the HSMs will be configured in load sharing mode for HA.
# e.g. nshield_hsms:
# - name: hsm 1
# ip: X.X.X.X
# - name: hsm 2
# ip: Y.Y.Y.Y
# thales_hsm_config_location: The directory where the hsm configuration is stored in
# your RFS server. e.g. hsm-XXXX-XXXX-XXXX.
# thales_rfs_server_ip_address: IP address for the RFS Server.
# thales_rfs_user: Username used to log into RFS server.
# thales_rfs_key: RSA Private key in PEM format used to log into RFS server.
#
# The following parameter are deprecated and can be used to configure connection to a
# single HSM. It is better to use the nshield_hsms parameter above instead:
# thales_hsm_ip_address: IP address for the HSM
#
# This parameter is deprecated and is no longer needed:
# thales_hsm_config_location: The directory where the hsm configuration is stored in
# your RFS server. e.g. hsm-XXXX-XXXX-XXXX.
resource_registry:
OS::TripleO::Services::BarbicanBackendPkcs11Crypto: ../deployment/barbican/barbican-backend-pkcs11-crypto-puppet.yaml