RepoMirrors/ceph
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2025-03-11 02:39:05 +00:00
Code Issues Packages Projects Releases Wiki Activity
dcac1dbe62
ceph/qa/suites/rgw/crypt/2-kms/vault_kv.yaml

26 lines
734 B
YAML
Raw Normal View History

rgw: add SSE-KMS with Vault using token auth Restructure SSE-KMS tests which now has 3 scenarios for each KMS backend: Barbican, Vault, and testing (keys stored in ceph.conf). Signed-off-by: Andrea Baglioni <andrea.baglioni@workday.com> Signed-off-by: Sergio de Carvalho <sergio.carvalho@workday.com>
2019-09-09 13:12:24 +00:00
overrides:
qa/rgw: use config overrides for vault kms backend Signed-off-by: Casey Bodley <cbodley@redhat.com>
2019-10-15 15:29:30 +00:00
ceph:
conf:
client:
rgw crypt s3 kms backend: vault
rgw crypt vault auth: token
rgw: improvements to SSE-KMS with Vault * Minor improvements to Vault documentation * Add teuthology tests for Transit secrets engine * Add unit tests for KV secrets engine, minor improvements to Transit secrets engine * use string_view::npos instead of string::npos Signed-off-by: Andrea Baglioni <andrea.baglioni@workday.com> Signed-off-by: Sergio de Carvalho <sergio.carvalho@workday.com>
2019-11-07 15:33:14 +00:00
rgw crypt vault secret engine: kv
rgw: improvements to SSE-KMS with Vault * add 'rgw crypt vault prefix' config setting to allow restricting secret space in Vault where RGW can retrieve keys from * refuse Vault token file if permissions are too open * improve concatenation of URL paths to avoid constructing an invalid URL (missing or double '/') * doc: clarify SSE-KMS keys must be 256-bit long and base64 encoded, document Vault policies and tokens, plus other minor doc improvements * qa: check SHA256 signature of Vault zip download * qa: fix teuthology tests broken by previous PR which made SSE-KMS backend default to Barbican Signed-off-by: Andrea Baglioni <andrea.baglioni@workday.com> Signed-off-by: Sergio de Carvalho <sergio.carvalho@workday.com>
2019-10-14 10:39:45 +00:00
rgw crypt vault prefix: /v1/kv/data
rgw: add SSE-KMS with Vault using token auth Restructure SSE-KMS tests which now has 3 scenarios for each KMS backend: Barbican, Vault, and testing (keys stored in ceph.conf). Signed-off-by: Andrea Baglioni <andrea.baglioni@workday.com> Signed-off-by: Sergio de Carvalho <sergio.carvalho@workday.com>
2019-09-09 13:12:24 +00:00
rgw:
client.0:
use-vault-role: client.0
tasks:
- vault:
client.0:
rgw: improvements to SSE-KMS with Vault * add 'rgw crypt vault prefix' config setting to allow restricting secret space in Vault where RGW can retrieve keys from * refuse Vault token file if permissions are too open * improve concatenation of URL paths to avoid constructing an invalid URL (missing or double '/') * doc: clarify SSE-KMS keys must be 256-bit long and base64 encoded, document Vault policies and tokens, plus other minor doc improvements * qa: check SHA256 signature of Vault zip download * qa: fix teuthology tests broken by previous PR which made SSE-KMS backend default to Barbican Signed-off-by: Andrea Baglioni <andrea.baglioni@workday.com> Signed-off-by: Sergio de Carvalho <sergio.carvalho@workday.com>
2019-10-14 10:39:45 +00:00
install_url: https://releases.hashicorp.com/vault/1.2.2/vault_1.2.2_linux_amd64.zip
install_sha256: 7725b35d9ca8be3668abe63481f0731ca4730509419b4eb29fa0b0baa4798458
rgw: add SSE-KMS with Vault using token auth Restructure SSE-KMS tests which now has 3 scenarios for each KMS backend: Barbican, Vault, and testing (keys stored in ceph.conf). Signed-off-by: Andrea Baglioni <andrea.baglioni@workday.com> Signed-off-by: Sergio de Carvalho <sergio.carvalho@workday.com>
2019-09-09 13:12:24 +00:00
root_token: test_root_token
rgw: improvements to SSE-KMS with Vault * Minor improvements to Vault documentation * Add teuthology tests for Transit secrets engine * Add unit tests for KV secrets engine, minor improvements to Transit secrets engine * use string_view::npos instead of string::npos Signed-off-by: Andrea Baglioni <andrea.baglioni@workday.com> Signed-off-by: Sergio de Carvalho <sergio.carvalho@workday.com>
2019-11-07 15:33:14 +00:00
engine: kv
rgw: improvements to SSE-KMS with Vault * add 'rgw crypt vault prefix' config setting to allow restricting secret space in Vault where RGW can retrieve keys from * refuse Vault token file if permissions are too open * improve concatenation of URL paths to avoid constructing an invalid URL (missing or double '/') * doc: clarify SSE-KMS keys must be 256-bit long and base64 encoded, document Vault policies and tokens, plus other minor doc improvements * qa: check SHA256 signature of Vault zip download * qa: fix teuthology tests broken by previous PR which made SSE-KMS backend default to Barbican Signed-off-by: Andrea Baglioni <andrea.baglioni@workday.com> Signed-off-by: Sergio de Carvalho <sergio.carvalho@workday.com>
2019-10-14 10:39:45 +00:00
prefix: /v1/kv/data/
rgw: add SSE-KMS with Vault using token auth Restructure SSE-KMS tests which now has 3 scenarios for each KMS backend: Barbican, Vault, and testing (keys stored in ceph.conf). Signed-off-by: Andrea Baglioni <andrea.baglioni@workday.com> Signed-off-by: Sergio de Carvalho <sergio.carvalho@workday.com>
2019-09-09 13:12:24 +00:00
secrets:
rgw: improvements to SSE-KMS with Vault * add 'rgw crypt vault prefix' config setting to allow restricting secret space in Vault where RGW can retrieve keys from * refuse Vault token file if permissions are too open * improve concatenation of URL paths to avoid constructing an invalid URL (missing or double '/') * doc: clarify SSE-KMS keys must be 256-bit long and base64 encoded, document Vault policies and tokens, plus other minor doc improvements * qa: check SHA256 signature of Vault zip download * qa: fix teuthology tests broken by previous PR which made SSE-KMS backend default to Barbican Signed-off-by: Andrea Baglioni <andrea.baglioni@workday.com> Signed-off-by: Sergio de Carvalho <sergio.carvalho@workday.com>
2019-10-14 10:39:45 +00:00
- path: my-key-1
rgw: add SSE-KMS with Vault using token auth Restructure SSE-KMS tests which now has 3 scenarios for each KMS backend: Barbican, Vault, and testing (keys stored in ceph.conf). Signed-off-by: Andrea Baglioni <andrea.baglioni@workday.com> Signed-off-by: Sergio de Carvalho <sergio.carvalho@workday.com>
2019-09-09 13:12:24 +00:00
secret: a2V5MS5GcWVxKzhzTGNLaGtzQkg5NGVpb1FKcFpGb2c=
rgw: improvements to SSE-KMS with Vault * add 'rgw crypt vault prefix' config setting to allow restricting secret space in Vault where RGW can retrieve keys from * refuse Vault token file if permissions are too open * improve concatenation of URL paths to avoid constructing an invalid URL (missing or double '/') * doc: clarify SSE-KMS keys must be 256-bit long and base64 encoded, document Vault policies and tokens, plus other minor doc improvements * qa: check SHA256 signature of Vault zip download * qa: fix teuthology tests broken by previous PR which made SSE-KMS backend default to Barbican Signed-off-by: Andrea Baglioni <andrea.baglioni@workday.com> Signed-off-by: Sergio de Carvalho <sergio.carvalho@workday.com>
2019-10-14 10:39:45 +00:00
- path: my-key-2
rgw: add SSE-KMS with Vault using token auth Restructure SSE-KMS tests which now has 3 scenarios for each KMS backend: Barbican, Vault, and testing (keys stored in ceph.conf). Signed-off-by: Andrea Baglioni <andrea.baglioni@workday.com> Signed-off-by: Sergio de Carvalho <sergio.carvalho@workday.com>
2019-09-09 13:12:24 +00:00
secret: a2V5Mi5yNUNNMGFzMVdIUVZxcCt5NGVmVGlQQ1k4YWg=
Reference in New Issue Copy Permalink