42 lines
2.3 KiB
YAML
42 lines
2.3 KiB
YAML
# A Heat environment file to enable the barbican PKCS11 crypto backend with
|
|
# a Lunasa HSM.
|
|
# Note that barbican needs to be enabled in order to use this.
|
|
parameter_defaults:
|
|
# In order to use this backend, you need to uncomment these values and
|
|
# provide the appropriate values.
|
|
#
|
|
# BarbicanPkcs11CryptoLogin: Password (PIN) to login to PKCS11 session
|
|
# BarbicanPkcs11CryptoSlotId: Slot Id for the HSM. Note that this parameter is only
|
|
# strictly required when setting up the Lunasa client in non-HA mode. In HA
|
|
# mode, whatever value is placed here will be overridden by the dynamically generated
|
|
# slot for the HA group created on the client.
|
|
# BarbicanPkcs11CryptoGlobalDefault: Whether this plugin is the global default plugin
|
|
|
|
BarbicanPkcs11CryptoLibraryPath: '/usr/lib/libCryptoki2_64.so'
|
|
BarbicanPkcs11CryptoEncryptionMechanism: 'CKM_AES_CBC'
|
|
BarbicanPkcs11CryptoHMACKeyType: 'CKK_AES'
|
|
BarbicanPkcs11CryptoHMACKeygenMechanism: 'CKM_AES_KEY_GEN'
|
|
BarbicanPkcs11CryptoMKEKLabel: 'barbican_mkek_0'
|
|
BarbicanPkcs11CryptoMKEKLength: '32'
|
|
BarbicanPkcs11CryptoHMACLabel: 'barbican_hmac_0'
|
|
BarbicanPkcs11CryptoLunasaEnabled: true
|
|
BarbicanPkcs11CryptoEnabled: true
|
|
BarbicanPkcs11AlwaysSetCkaSensitive: true
|
|
LunasaVars:
|
|
# lunasa_client_tarball_location: URI where the CipherTools tarball can be downloaded.
|
|
# lunasa_client_tarball_name: Filename for the CipherTools tarball.
|
|
# lunasa_client_installer_path: path to install.sh in the tarball.
|
|
# lunasa_hsms: A list of HSMs with the following format:
|
|
# lunasa_hsms:
|
|
# - name: Name of the HSM
|
|
# hostname: Hostname for the HSM
|
|
# admin_password: admin password for the HSM
|
|
# partition: HSM partition for this client to be assigned
|
|
# partition_serial: serial number for the partition
|
|
# client_ip: IP for the client - TODO: figure out how to pass this correctly
|
|
# lunasa_ha_label: HA group label Required only for HA mode. This will trigger the
|
|
# installer to create an HA group comprising of the HSMs in lunasa_hsms.
|
|
# lunasa_partition_password: PKCS#11 password for the partitition
|
|
resource_registry:
|
|
OS::TripleO::Services::BarbicanBackendPkcs11Crypto: ../deployment/barbican/barbican-backend-pkcs11-crypto-puppet.yaml
|