Add Barbican HSM custom image support #1087
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: mauricioharley The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/1b53de6c9a2849c79dc4aa80b085abf9 ❌ openstack-k8s-operators-content-provider TIMED_OUT in 30m 50s |
mauricioharley
force-pushed
the
add_barbican_hsm_custom_images
branch
from
930ce8c to
5cab4b9
Compare
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/878e4bc064754b5b9c13143ccbaeb73c ✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 52m 49s |
mauricioharley
force-pushed
the
add_barbican_hsm_custom_images
branch
from
5cab4b9 to
6bdd302
Compare
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/2ddd43e605d04fafb4837dc118d6190b ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 40m 48s |
Introduces additional parameter support for both TripleO and Standalone deployments to enable users to provide custom environment configurations without modifying deployment scripts. Changes: - Export TRIPLEO_ADDITIONAL_ENV and STANDALONE_ADDITIONAL_ENV variables in respective deployment scripts - Copy additional environment files to target systems when specified - Conditionally include additional environment files in openstack-tripleo deployment commands using -e flag Signed-off-by: Mauricio Harley <[email protected]>
- Add new Makefile variables for HSM-enabled Barbican deployments: BARBICAN_API_IMAGE, BARBICAN_WORKER_IMAGE, BARBICAN_HSM_ENABLED - Add conditional logic to use custom images when HSM is enabled - Update barbican_deploy_prep target to handle custom image deployment - Add HSM backend selection in standalone openstack.sh script - Support PKCS#11 backend when BARBICAN_HSM_ENABLED=true Signed-off-by: Mauricio Harley <[email protected]>
mauricioharley
force-pushed
the
add_barbican_hsm_custom_images
branch
from
6bdd302 to
8966724
Compare
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/8cecff0901ab4f7ab66cda2593291936 ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 39m 34s |
1 participant
This PR introduces support for deploying Barbican with Hardware Security Module (HSM) capabilities using custom container images.
Changes
Makefile Updates
BARBICAN_API_IMAGE,BARBICAN_WORKER_IMAGE, andBARBICAN_HSM_ENABLEDto control HSM deploymentsBARBICAN_HSM_ENABLED=true, custom images are used if provided via the new variablesbarbican_deploy_preptarget to properly handle custom image deployment with correct image pathsopenstack_inittarget exportsStandalone Script Updates
devsetup/standalone/openstack.shto conditionally select between:barbican-backend-pkcs11.yamlwhen HSM is enabledbarbican-backend-simple-crypto.yamlfor standard deploymentsUsage
To deploy Barbican with HSM support:
make openstack BARBICAN_HSM_ENABLED=true \ BARBICAN_API_IMAGE=<your-hsm-api-image> \ BARBICAN_WORKER_IMAGE=<your-hsm-worker-image>