9012fff849
Added support for setting the Barbican option always_set_cka_sensitive. The option defaults to true as needed by Safenet HSMs. It is set to false in the ATOS and Thales HSM environments. Change-Id: If3fa975e8243dfe30ef67ec81db891943a94a9d5 Story: 2004734
40 lines
2.1 KiB
YAML
40 lines
2.1 KiB
YAML
# A Heat environment file to enable the barbican PKCS11 crypto backend with
|
|
# a Thales HSM.
|
|
# Note that barbican needs to be enabled in order to use this.
|
|
parameter_defaults:
|
|
# In order to use this backend, you need to uncomment these values and
|
|
# provide the appropriate values.
|
|
#
|
|
# BarbicanPkcs11CryptoLogin: Password (PIN) to login to PKCS11 session
|
|
# BarbicanPkcs11CryptoSlotId: Slot Id for the HSM
|
|
# BarbicanPkcs11CryptoGlobalDefault: Whether this plugin is the global default plugin
|
|
|
|
BarbicanPkcs11CryptoLibraryPath: '/opt/nfast/toolkits/pkcs11/libcknfast.so'
|
|
BarbicanPkcs11CryptoEncryptionMechanism: 'CKM_AES_CBC'
|
|
BarbicanPkcs11CryptoHMACKeyType: 'CKK_SHA256_HMAC'
|
|
BarbicanPkcs11CryptoHMACKeygenMechanism: 'CKM_NC_SHA256_HMAC_KEY_GEN'
|
|
BarbicanPkcs11CryptoMKEKLabel: 'barbican_mkek_0'
|
|
BarbicanPkcs11CryptoMKEKLength: '32'
|
|
BarbicanPkcs11CryptoHMACLabel: 'barbican_hmac_0'
|
|
BarbicanPkcs11CryptoThalesEnabled: true
|
|
BarbicanPkcs11CryptoEnabled: true
|
|
BarbicanPkcs11AlwaysSetCkaSensitive: false
|
|
ThalesVars:
|
|
thales_client_working_dir: /tmp/thales_client_install
|
|
# thales_client_tarball_location: URI where the CipherTools tarball can be downloaded.
|
|
# thales_client_tarball_name: Filename for the CipherTools tarball.
|
|
thales_client_path: linux/libc6_11/amd64/nfast
|
|
thales_client_uid: 42481
|
|
thales_client_gid: 42481
|
|
# thales_km_data_location: URL where the RFS kmdata tarball can be downloaded.
|
|
# thales_km_data_tarball_name: Filename for the kmdata tarball.
|
|
# thales_hsm_ip_address: IP address for the HSM
|
|
# thales_rfs_server_ip_address: IP address for the RFS Server.
|
|
# thales_hsm_config_location: The directory where the hsm configuration is stored in
|
|
# your RFS server. e.g. hsm-XXXX-XXXX-XXXX.
|
|
# thales_rfs_user: Username used to log into RFS server.
|
|
# thales_rfs_key: RSA Private key in PEM format used to log into RFS server.
|
|
|
|
resource_registry:
|
|
OS::TripleO::Services::BarbicanBackendPkcs11Crypto: ../puppet/services/barbican-backend-pkcs11-crypto.yaml
|