<div dir="ltr"><div><br>Hello folks,<br><br>Since this topic have been discussed for a while, I'll give some updates on our current progress and which is the next steps for that.<br><br>Yesterday, The spec for oslo.config drivers has been approved [1] and we started that implementation [2] for that spec. After that, we should be able to implement a Castellan driver for oslo.config, which will provide the ability to use Castellan reference for those secrets and store it using a proper key store backend.<br>Besides that, we are implementing the Custodia support to the key manager to store/fetch secrets on Castellan [3].<br><br>Finally, as next steps for Rocky release, we should discuss (maybe in the next PTG) some points like using some deployment tool like Ansible or puppet, through the TripleO service, to create those secrets and store it properly on Custodia, following that Castellan driver for oslo.config. So, later, we will be able to restore it properly in the configuration files.<br><br>[1] <a href="https://review.openstack.org/#/c/454897/7">https://review.openstack.org/#/c/454897/7</a><br>[2] <a href="https://review.openstack.org/#/c/513844/">https://review.openstack.org/#/c/513844/</a><br>[3] <a href="https://review.openstack.org/#/c/515190/">https://review.openstack.org/#/c/515190/</a><br><br></div>Regards,<br><div><br><div class="gmail_quote"><div dir="ltr">On Mon, Nov 20, 2017 at 1:42 PM Doug Hellmann <<a href="mailto:doug@doughellmann.com">doug@doughellmann.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Excerpts from Jay Pipes's message of 2017-11-20 11:02:33 -0500:<br>
> On 11/20/2017 10:19 AM, Doug Hellmann wrote:<br>
> > The spec for adding pluggable drivers to oslo.config is ready for a<br>
> > final queens review [1]. The latest draft should be simpler to implement<br>
> > (important given where we are in the schedule) at the expense of always<br>
> > requiring at least one configuration file to specify the location of<br>
> > other configuration sources. We can improve on that design in the future<br>
> > when we have the drivers working.<br>
><br>
> Hi Doug. Is this spec crucial for various PCI/security-minded folks to<br>
> review due to how plaintext configuration options are currently handled<br>
> for sensitive things like password and user/project IDs?<br>
><br>
> Best,<br>
> -jay<br>
><br>
<br>
The spec is meant to enable securely storing secrets, but it's<br>
foundation work before the secret store driver can actually be<br>
implemented so it doesn't go into a lot of detail about the castellan<br>
driver. Still, I would appreciate if the folks interested in that<br>
feature look at it.<br>
<br>
Doug<br>
<br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</blockquote></div></div></div><div dir="ltr">-- <br></div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div class="inbox-inbox-inbox-sig-container" id="inbox-inbox-inbox-standard-target">
<p class="inbox-inbox-inbox-fullname-container" style="font-weight:bold;margin:0px;padding:0px;font-size:14px;text-transform:uppercase"><span class="inbox-inbox-inbox-firstname-container">Raildo </span> <span class="inbox-inbox-inbox-lastname-container">mascena</span></p>
<p class="inbox-inbox-inbox-position-container" style="font-weight:normal;font-size:10px;margin:0px 0px 4px;text-transform:uppercase"><span class="inbox-inbox-inbox-position">Software Engineer, Identity Managment</span></p>
<p class="inbox-inbox-inbox-legal-container" style="font-weight:normal;margin:0px;font-size:10px;color:rgb(153,153,153)"><a class="inbox-inbox-inbox-redhat-anchor" style="color:rgb(0,136,206);font-size:10px;margin:0px;text-decoration:none;font-family:"overpass",sans-serif" href="https://www.redhat.com" target="_blank">Red Hat <span><br><br></span></a></p>
<table border="0"><tbody><tr><td width="100px"><a href="https://red.ht/sig"> <img src="https://www.redhat.com/files/brand/email/sig-redhat.png" width="90" height="auto"></a> </td>
<td class="inbox-inbox-inbox-promo" style="font-weight:normal;font-size:10px">
<div class="inbox-inbox-inbox-promo inbox-inbox-inbox-promo-1"><a href="https://redhat.com/trusted" style="text-decoration:none;color:rgb(204,0,0);font-weight:bold">TRIED. TESTED. TRUSTED.</a></div>
</td></tr></tbody></table>
</div></div></div>