Barbican密钥管理器服务

Barbican服务介绍

Key Manager 服务 (barbican) 提供机密数据的安全存储、配置和管理。这包括密钥材料，例如对称密钥、非对称密钥、证书和原始二进制数据。

Barbican 是 OpenStack 的key管理组件，定位在提供 REST API 来安全存储、提供和管理“秘密”。

Barbican最常用的功能是作为OpenStack环境中的密钥生成器，为各种加解密操作提供支持;同时，Barbican还可以保存OpenStack环境中的用户机密数据。

节点	IP
controller	10.60.3.7
compute	10.60.3.21

控制节点安装服务

执行iaas-install-barbican.sh安装脚本

[root@controller ~]# iaas-install-barbican.sh

使用Barbican服务

使用openstack命令创建一个名为secret01的secret

[root@controller ~]# openstack secret store --name secret01 --payload secretkey
+---------------+-----------------------------------------------------------------------+
| Field         | Value                                                                 |
+---------------+-----------------------------------------------------------------------+
| Secret href   | http://localhost:9311/v1/secrets/0c75b604-1cae-4172-b632-b769f1d649e3 |
| Name          | secret01                                                              |
| Created       | None                                                                  |
| Status        | None                                                                  |
| Content types | None                                                                  |
| Algorithm     | aes                                                                   |
| Bit length    | 256                                                                   |
| Secret type   | opaque                                                                |
| Mode          | cbc                                                                   |
| Expiration    | None                                                                  |
+---------------+-----------------------------------------------------------------------+

查询secret列表信息

[root@controller ~]# openstack secret list
+-----------------------------------------------------------------------+----------+---------------------------+--------+-----------------------------+-----------+------------+-------------+------+------------+
| Secret href                                                           | Name     | Created                   | Status | Content types               | Algorithm | Bit length | Secret type | Mode | Expiration |
+-----------------------------------------------------------------------+----------+---------------------------+--------+-----------------------------+-----------+------------+-------------+------+------------+
| http://localhost:9311/v1/secrets/0c75b604-1cae-4172-b632-b769f1d649e3 | secret01 | 2022-05-07T11:52:35+00:00 | ACTIVE | {u'default': u'text/plain'} | aes       |        256 | opaque      | cbc  | None       |
+-----------------------------------------------------------------------+----------+---------------------------+--------+-----------------------------+-----------+------------+-------------+------+------------+

使用命令获取secret01密钥的元数据

[root@controller ~]# openstack secret get http://localhost:9311/v1/secrets/0c75b604-1cae-4172-b632-b769f1d649e3
+---------------+-----------------------------------------------------------------------+
| Field         | Value                                                                 |
+---------------+-----------------------------------------------------------------------+
| Secret href   | http://localhost:9311/v1/secrets/0c75b604-1cae-4172-b632-b769f1d649e3 |
| Name          | secret01                                                              |
| Created       | 2022-05-07T11:52:35+00:00                                             |
| Status        | ACTIVE                                                                |
| Content types | {u'default': u'text/plain'}                                           |
| Algorithm     | aes                                                                   |
| Bit length    | 256                                                                   |
| Secret type   | opaque                                                                |
| Mode          | cbc                                                                   |
| Expiration    | None                                                                  |
+---------------+-----------------------------------------------------------------------+

通过命令获取secret01密钥的数据

[root@controller ~]# openstack secret get http://localhost:9311/v1/secrets/0c75b604-1cae-4172-b632-b769f1d649e3 --payload
+---------+-----------+
| Field   | Value     |
+---------+-----------+
| Payload | secretkey |
+---------+-----------+

使用openstack命令生成并存储密钥

[root@controller ~]# openstack secret order create --name secret02 --algorithm aes --bit-length 256 --mode cbc --payload-content-type application/octet-stream key
+----------------+----------------------------------------------------------------------+
| Field          | Value                                                                |
+----------------+----------------------------------------------------------------------+
| Order href     | http://localhost:9311/v1/orders/a8f2d133-c089-496b-ace3-3a9f540205b1 |
| Type           | Key                                                                  |
| Container href | N/A                                                                  |
| Secret href    | None                                                                 |
| Created        | None                                                                 |
| Status         | None                                                                 |
| Error code     | None                                                                 |
| Error message  | None                                                                 |
+----------------+----------------------------------------------------------------------+

通过命令显示生成的密钥列表

[root@controller ~]# openstack secret order list
+----------------------------------------------------------------------+------+----------------+-----------------------------------------------------------------------+---------------------------+--------+------------+---------------+
| Order href                                                           | Type | Container href | Secret href                                                           | Created                   | Status | Error code | Error message |
+----------------------------------------------------------------------+------+----------------+-----------------------------------------------------------------------+---------------------------+--------+------------+---------------+
| http://localhost:9311/v1/orders/a8f2d133-c089-496b-ace3-3a9f540205b1 | Key  | N/A            | http://localhost:9311/v1/secrets/3a22d487-c7c9-49f6-9f0c-6c282fd8878a | 2022-05-07T12:00:52+00:00 | ACTIVE | None       | None          |
+----------------------------------------------------------------------+------+----------------+-----------------------------------------------------------------------+---------------------------+--------+------------+---------------+

使用命令显示生成的密钥

[root@controller ~]# openstack secret order get http://localhost:9311/v1/orders/a8f2d133-c089-496b-ace3-3a9f540205b1
+----------------+-----------------------------------------------------------------------+
| Field          | Value                                                                 |
+----------------+-----------------------------------------------------------------------+
| Order href     | http://localhost:9311/v1/orders/a8f2d133-c089-496b-ace3-3a9f540205b1  |
| Type           | Key                                                                   |
| Container href | N/A                                                                   |
| Secret href    | http://localhost:9311/v1/secrets/3a22d487-c7c9-49f6-9f0c-6c282fd8878a |
| Created        | 2022-05-07T12:00:52+00:00                                             |
| Status         | ACTIVE                                                                |
| Error code     | None                                                                  |
| Error message  | None                                                                  |
+----------------+-----------------------------------------------------------------------+

显示生成的密钥的元数据

[root@controller ~]# openstack secret get http://localhost:9311/v1/secrets/3a22d487-c7c9-49f6-9f0c-6c282fd8878a
+---------------+-----------------------------------------------------------------------+
| Field         | Value                                                                 |
+---------------+-----------------------------------------------------------------------+
| Secret href   | http://localhost:9311/v1/secrets/3a22d487-c7c9-49f6-9f0c-6c282fd8878a |
| Name          | secret02                                                              |
| Created       | 2022-05-07T12:00:52+00:00                                             |
| Status        | ACTIVE                                                                |
| Content types | {u'default': u'application/octet-stream'}                             |
| Algorithm     | aes                                                                   |
| Bit length    | 256                                                                   |
| Secret type   | symmetric                                                             |
| Mode          | cbc                                                                   |
| Expiration    | None                                                                  |
+---------------+-----------------------------------------------------------------------+

注意查看获取的地址,secret herf 和order herf 不要弄错,上述实验中，只对应熟悉barbican密钥服务所使用的环境操作