雜記
記錄一下最近研究barbican組件的個(gè)人理解肛响。
barbican主要是密鑰管理的。存儲(chǔ)（store secret）的時(shí)候有各種文件格式（text\plain）古话，獲取的時(shí)候根據(jù)它是證書嫁怀，私鑰進(jìn)行格式化刃唐，比如x509。
{'text/plain': 'text/plain',
'text/plain;charset=utf-8': 'text/plain',
'text/plain; charset=utf-8': 'text/plain',
'application/octet-stream': 'application/octet-stream',
'application/pkcs8': 'application/pkcs8',
'application/aes': 'application/aes'}
tips：ocatavia可以對(duì)pkcs12證書進(jìn)行格式化（當(dāng)然也是封裝的接口）减宣，一般情況下盐须，獲取的證書默認(rèn)進(jìn)行pkcs12格式化的，同時(shí)也兼容了barbican原生的證書格式化漆腌。包括監(jiān)聽器綁定證書的方式也同lbv2不一樣贼邓，并沒有采用容器的方式（實(shí)際pkcs12也可以看著是容器）。
barbican后端支持多種存儲(chǔ)闷尿，所以官網(wǎng)提供了多個(gè)插件：
[secretstore]
# Set to True when multiple plugin backends support is needed
enable_multiple_secret_stores = True
stores_lookup_suffix = software, kmip, pkcs11, dogtag
[secretstore:software]
secret_store_plugin = store_crypto
crypto_plugin = simple_crypto
[secretstore:kmip]
secret_store_plugin = kmip_plugin
global_default = True
[secretstore:dogtag]
secret_store_plugin = dogtag_plugin
[secretstore:pkcs11]
secret_store_plugin = store_crypto
crypto_plugin = p11_crypto
目前barbican自身代碼塑径，限定了pkcs8,pkcs11,x509等格式的支持程度。
lbv2支持的私鑰是pkcs8(??????)證書是x509悠砚，octvia在代碼里增加了pkcs12的代碼文件晓勇，并新增/certificate/manager/barbican.py可實(shí)現(xiàn)barbican對(duì)pkcs12的支持，所以私鑰和證書都可以支持pkcs12
https://developer.openstack.org/api-guide/key-manager/containers.html#certificate-containers
https://docs.openstack.org/releasenotes/octavia/queens.html
Users can now use a reference to a single PKCS12 bundle as their default_tls_container_ref instead of a Barbican container with individual secret objects. PKCS12 supports bundling a private key, certificate, and intermediates. Private keys can no longer be passphrase protected when using PKCS12 bundles. No configuration change is necessary to enable this feature. Users may simply begin using this. Any use of the old style containers will be detected and automatically fall back to using the old Barbican driver.
Certificate bundles can now be stored in any backend Castellan supports, and can be retrieved via a Castellan driver, even if Barbican is not deployed.
創(chuàng)建證書容器的body如下：
{
"type": "certificate",
"status": "ACTIVE",
"name": "Example.com Certificates",
"consumers": [],
"container_ref": "https://{barbican_host}/v1/containers/{uuid}",
"secret_refs": [
{
"name": "certificate",
"secret_ref": "https://{barbican_host}/v1/secrets/{uuid}"
},
{
"name": "private_key",
"secret_ref": "https://{barbican_host}/v1/secrets/{uuid}"
},
{
"name": "private_key_passphrase",
"secret_ref": "https://{barbican_host}/v1/secrets/{uuid}"
},
{
"name": "intermediates",
"secret_ref": "https://{barbican_host}/v1/secrets/{uuid}"
}
],
"created": "2015-03-30T21:10:45.417835",
"updated": "2015-03-30T21:10:45.417835"
}
證書容器是用來(lái)存儲(chǔ)證書相關(guān)的密鑰灌旧，需要指定以下幾種type绑咱，其中certificate是必須指定，其余的均是可選的枢泰。
A certificate container is used for storing the following secrets that are relevant to certificates:
certificate
private_key (optional)
private_key_passphrase (optional)
intermediates (optional)
The payload for the secret referenced as the “certificate” is expected to be a PEM formatted x509 certificate.
The payload for the secret referenced as the “intermediates” is expected to be a PEM formatted PKCS7 certificate chain.
參考
http://www.iceyao.com.cn/2017/11/19/Neutron-lbaas%E4%BB%A3%E7%90%86https%E5%AE%9E%E8%B7%B5/
https://docs.openstack.org/barbican/latest/install/barbican-backend.html
https://docs.openstack.org/barbican/latest/configuration/plugin_backends.html
https://developer.openstack.org/api-guide/key-manager/containers.html#certificate-containers
https://docs.openstack.org/releasenotes/octavia/queens.html
個(gè)人分析描融，歡迎指正，若轉(zhuǎn)載請(qǐng)注明出處衡蚂！
歡迎訪問(wèn)我的主頁(yè)
