Hello folks, Various regulations and best practices say that passwords and other secret values should not be stored in plain text in configuration files. There are “secret store” services to manage values that should be kept secure. Castellan provides an abstraction API for accessing those services. [1] In this manner, several different management services can be supported through a single interface. Then, we will be able to use a Castellan reference for those secrets and store it using a proper key store backend, currently Castellan supports Barbican and Vault as a backend, so for this case, we should use a more light solution, such as Custodia[2], which work as Secrets-as-a-Service API, working as a lightweight solution compared with Barbican, besides that, Custodia have some good features like overlayed encryption backend that can be used to store that secret.
Currently, We have that olso.config interface for pluggable drivers in progress[3] also the Custodia backend support for Castellan.[4] We are planning to start the Castellan driver for oslo.config as soon as we have that interface done. In the next few weeks, that will be the Dublin PTG and we are planning to discuss more this topic in the Oslo session[5], so if you are interested in discussing/contribute for this topic and you will be attending the PTG, please add yourself as an interested person in the topic. Also, we are planning to integrate this whole feature with Tripleo in a near feature, so we are planning to discuss with the Tripleo team a proper way to have that supported as well.[6] Finally, if want to be closer to this topic, or if you want to contribute to this feature, we are having weekly meetings on Tuesday at 1600 UTC on #openstack-meeting-3, we will be glad to have you working with us. [1] https://specs.openstack.org/openstack/oslo-specs/specs/queens/oslo-config-drivers.html [2] https://custodia.readthedocs.io/en/latest/readme.html [3] https://review.openstack.org/#/c/513844/ [4] https://review.openstack.org/#/c/515190/ [5] https://etherpad.openstack.org/p/oslo-ptg-rocky [6] https://etherpad.openstack.org/p/tripleo-ptg-rocky [7] https://etherpad.openstack.org/p/oslo-config-plaintext-secrets Cheers, -- Raildo mascena Software Engineer, Identity Managment Red Hat <https://www.redhat.com> <https://red.ht/sig> TRIED. TESTED. TRUSTED. <https://redhat.com/trusted>
__________________________________________________________________________ OpenStack Development Mailing List (not for usage questions) Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
