Merge "py3: Work with proper native string paths in crypto meta"

openstack/swift

Code Issues Proposed changes

Browse Source

This commit is contained in:

Zuul

2020年08月30日 04:11:59 +00:00

committed by Gerrit Code Review

parent 8ea227a0e5 7d429318dd

commit 7015ac2fdc

4 changed files with 310 additions and 17 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

27
etc/keymaster.conf-sample

View File

@@ -1,4 +1,13 @@

[keymaster]

# Over time, the format of crypto metadata on disk may change slightly to resolve

# ambiguities. In general, you want to be writing the newest version, but to

# ensure that all writes can still be read during rolling upgrades, there's the

# option to write older formats as well.

# Before upgrading from Swift 2.20.0 or earlier, ensure this is set to 1

# Before upgrading from Swift 2.25.0 or earlier, ensure this is set to at most 2

# After upgrading all proxy servers, set this to 3 (currently the highest version)

# meta_version_to_write = 3

# Sets the root secret from which encryption keys are derived. This must be set

# before first use to a value that is a base64 encoding of at least 32 bytes.

# The security of all encrypted data critically depends on this key, therefore

@@ -16,6 +25,15 @@

# backends that use Keystone for authentication. Currently, the only

# implemented backend is for Barbican.

# Over time, the format of crypto metadata on disk may change slightly to resolve

# ambiguities. In general, you want to be writing the newest version, but to

# ensure that all writes can still be read during rolling upgrades, there's the

# option to write older formats as well.

# Before upgrading from Swift 2.20.0 or earlier, ensure this is set to 1

# Before upgrading from Swift 2.25.0 or earlier, ensure this is set to at most 2

# After upgrading all proxy servers, set this to 3 (currently the highest version)

# meta_version_to_write = 3

# The api_class tells Castellan which key manager to use to access the external

# key management system. The default value that accesses Barbican is

# castellan.key_manager.barbican_key_manager.BarbicanKeyManager.

@@ -79,6 +97,15 @@

# The kmip_keymaster section is used to configure a keymaster that fetches an

# encryption root secret from a KMIP service.

# Over time, the format of crypto metadata on disk may change slightly to resolve

# ambiguities. In general, you want to be writing the newest version, but to

# ensure that all writes can still be read during rolling upgrades, there's the

# option to write older formats as well.

# Before upgrading from Swift 2.20.0 or earlier, ensure this is set to 1

# Before upgrading from Swift 2.25.0 or earlier, ensure this is set to at most 2

# After upgrading all proxy servers, set this to 3 (currently the highest version)

# meta_version_to_write = 3

# The value of the ``key_id`` option should be the unique identifier for a

# secret that will be retrieved from the KMIP service. The secret should be an

# AES-256 symmetric key.

12
etc/proxy-server.conf-sample

View File

@@ -1117,6 +1117,18 @@ use = egg:swift#copy

[filter:keymaster]

use = egg:swift#keymaster

# Over time, the format of crypto metadata on disk may change slightly to resolve

# ambiguities. In general, you want to be writing the newest version, but to

# ensure that all writes can still be read during rolling upgrades, there's the

# option to write older formats as well.

# Before upgrading from Swift 2.20.0 or Swift 2.19.1 or earlier, ensure this is set to 1

# Before upgrading from Swift 2.25.0 or earlier, ensure this is set to at most 2

# After upgrading all proxy servers, set this to 3 (currently the highest version)

#

# The default is currently 2 to support upgrades with no configuration changes,

# but may change to 3 in the future.

meta_version_to_write = 2

# Sets the root secret from which encryption keys are derived. This must be set

# before first use to a value that is a base64 encoding of at least 32 bytes.

# The security of all encrypted data critically depends on this key, therefore