kms_keymaster: allow specifying barbican_endpoint

Code Issues Proposed changes

Under a multi-region deployment with a single Keystone server,
specifying the Keystone auth credentials isn't enough. Indeed,
Castellan succeeds when logging-in, but may use the wrong
Barbican endpoint (if there are 2 Barbican deployed). This is
what happened to us, when deploying our 2nd region.
They way to fix it would be to tell Castellan what region to use,
unfortunately, there's no such option in Castellan. Though we may
specify the barbican_endpoint, which is what this patch allows.
Change-Id: Ib7f4219ef5fdef65e9cfd5701e28b5288741783e

This commit is contained in:

Thomas Goirand

2024年06月13日 11:27:55 +02:00

parent 1d5b1d746e

commit 90da23c7d2

2 changed files with 8 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

6
etc/keymaster.conf-sample

View File

@@ -93,6 +93,12 @@

# domain_id = changeme

# domain_name = changeme

# If running on a multi-region cluster, Castellan may select the wrong

# endpoint for Barbican. To avoid this, set this to the URL of the

# correct barbican endpoint. If there is only a single Barbican service

# in your deployment, it is fine to leave this unconfigured.

# barbican_endpoint =

[kmip_keymaster]

# The kmip_keymaster section is used to configure a keymaster that fetches an

# encryption root secret from a KMIP service.

kms_keymaster: allow specifying barbican_endpoint

6 etc/keymaster.conf-sample Unescape Escape View File

6
etc/keymaster.conf-sample

View File