<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Barbican depends on Keystone though for authentication. Its not a silver bullet here.<br>
<br>
Kevin<br>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF984009"><font face="Tahoma" size="2" color="#000000"><b>From:</b> Dolph Mathews [dolph.mathews@gmail.com]<br>
<b>Sent:</b> Monday, July 27, 2015 10:53 AM<br>
<b>To:</b> OpenStack Development Mailing List (not for usage questions)<br>
<b>Subject:</b> Re: [openstack-dev] [Keystone][Fernet] HA SQL backend for Fernet keys<br>
</font><br>
</div>
<div></div>
<div>
<div dir="ltr">
<div>Although using a node's *local* filesystem requires external configuration management to manage the distribution of rotated keys, it's always available, easy to secure, and can be updated atomically per node. Note that Fernet's rotation strategy uses a
staged key that can be distributed to all nodes in advance of it being used to create new tokens.<br>
</div>
<div><br>
</div>
<div>Also be aware that you wouldn't want to store encryption keys in plaintext in a shared database, so you must introduce an additional layer of complexity to solve that problem.</div>
<div><br>
</div>
<div>Barbican seems like much more logical next-step beyond the local filesystem, as it shifts the burden onto a system explicitly designed to handle this issue (albeit in a multitenant environment).</div>
<div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Mon, Jul 27, 2015 at 12:01 PM, Alexander Makarov <span dir="ltr">
<<a href="mailto:amakarov@mirantis.com" target="_blank">amakarov@mirantis.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">Greetings!
<div><br>
</div>
<div>I'd like to discuss pro's and contra's of having Fernet encryption keys stored in a database backend.</div>
<div>The idea itself emerged during discussion about synchronizing rotated keys in HA environment.</div>
<div>Now Fernet keys are stored in the filesystem that has some availability issues in unstable cluster.</div>
<div>OTOH, making SQL highly available is considered easier than that for a filesystem.</div>
<span class="HOEnZb"><font color="#888888">
<div>
<div><br>
</div>
-- <br>
<div>
<div dir="ltr">
<div>
<div dir="ltr"><font style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px" color="#000000">Kind Regards,</font><br style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px">
<font style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px" color="#000000">Alexander Makarov,</font><br style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px">
<font style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px" color="#000000">Senior Software Developer,</font><br style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px">
<br style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px">
<font style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px" color="#000000">Mirantis, Inc.</font><br style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px">
<font style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px" color="#000000">35b/3, Vorontsovskaya St., 109147, Moscow, Russia</font><br style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px">
<br style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px">
<font style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px" color="#000000">Tel.:
<a href="tel:%2B7%20%28495%29%20640-49-04" value="+74956404904" target="_blank">+7 (495) 640-49-04</a></font><br style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px">
<font style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px" color="#000000">Tel.:
<a href="tel:%2B7%20%28926%29%20204-50-60" value="+79262045060" target="_blank">+7 (926) 204-50-60</a></font><br style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px">
<br style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px">
<font style="color:rgb(0,0,0); font-family:Cantarell; font-size:15px" color="#000000">Skype: MAKAPOB.AJIEKCAHDP</font><br>
</div>
</div>
</div>
</div>
</div>
</font></span></div>
<br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">
OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>