<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 255); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Hello Chris,</div>
<div><br>
</div>
<div>I defer to Nate and Kaitlin for things KMIP. </div>
<div><br>
</div>
<div>From a config perspective though, it seems that something needs to decide which KMIP backend handles which secret. Where ever that decision-making logic lives (in Barbican or in a proxy that Barbican talks to), it has to know what KMIP backends are available.
If this list of backends is known/static then it seems that storing these in a config file (like barbican-api.conf) would be acceptable. Keep in mind that more than one Barbican API node might be hitting the same KMIP backends concurrently.</div>
<div><br>
</div>
<div>As for multiple plugins in Barbican, the current approach favors having an instance per plugin class, so IMHO it would be better to have a single multi-KMIP plugin class that handles the above decision logic. This would most likely be your ‘active’ secret
store plugin.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>John</div>
<div><br>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Christopher N Solis <<a href="mailto:cnsolis@us.ibm.com">cnsolis@us.ibm.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>"OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Date: </span>Friday, June 5, 2015 at 12:41 PM<br>
<span style="font-weight:bold">To: </span>"OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>[openstack-dev] [Barbican] Multiple KMIP servers on a single barbican<br>
</div>
<div><br>
</div>
<div>
<div>
<p><font size="2" face="sans-serif">Hey all. </font><br>
<br>
<font size="2" face="sans-serif">I wanted to get people's opinion on allowing barbican to talk to multiple KMIP servers.</font><br>
<font size="2" face="sans-serif">I got good advice from Nathan and John and it seems like it would be pretty easy keeping track of
</font><br>
<font size="2" face="sans-serif">which secret resides in which KMIP applicance. You would just store the url in the DTO.
</font><br>
<font size="2" face="sans-serif">However, in order for barbican to be aware of all KMIP servers wouldn't that mean that each
</font><br>
<font size="2" face="sans-serif">kmip server url would need to be in the barbican-api.conf file? Or somewhere for barbican</font><br>
<font size="2" face="sans-serif">to know that multiple kmip servers are available? I noticed that there is a blueprint to introduce
</font><br>
<font size="2" face="sans-serif">the concept of a single active and multiple inactive secret store plugins so I'm trying to stray away from
</font><br>
<font size="2" face="sans-serif">making multiple active plugins. </font><br>
<br>
<font size="1" face="Arial">Regards,</font><br>
<br>
<font size="1" face="Arial"> </font><font size="3" color="#0000FF" face="Arial"><b> </b></font><font size="2" face="sans-serif">Chris Solis</font></p>
</div>
</div>
</span>
</body>
</html>