1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
.. _encrypting-properties:
=================================
Managing Sensitive Data in Murano
=================================
Overview
--------
If you are developing a Murano application that manages sensitive data such as
passwords, user data, etc, you may want to ensure this is stored in a secure
manner in the Murano backend.
Murano offers two `yaql` functions to do this, `encryptData` and
`decryptData`.
.. note:: Barbican or a similar compatible secret storage backend must be
configured to use this feature.
Configuring
-----------
Murano makes use of Castellan_ to manage encryption using a supported secret
storage backend. As of OpenStack Pike, Barbican_ is the only supported
backend, and hence is the one tested by the Murano community.
To configure Murano to use Barbican, place the following configuration into
`murano-engine.conf`::
[key_manager]
auth_type = keystone_password
auth_url = <keystone_url>
username = <username>
password = <password>
user_domain_name = <domain_name>
Similarly, place the following configuration into `_50_murano.py` to configure
the murano-dashboard end::
KEY_MANAGER = {
'auth_url': '<keystone_url>/v3',
'username': '<username>',
'user_domain_name': '<domain_name>',
'password': '<password>',
'project_name': '<project_name>',
'project_domain_name': '<domain_name>'
}
.. note:: Horizon config must be valid Python, so the quotes above are important.
Example
-------
`encryptData(foo)`: Call to encrypt string `foo` in storage. Will return a
`uuid` which is used to retrieve the encrypted value.
`decryptData(foo_key)`: Call to decrypt and retrieve the value represented by
`foo_key` from storage.
There is an example application available in the murano repository_.
.. _Castellan: https://github.com/openstack/castellan
.. _Barbican: https://github.com/openstack/barbican
.. _repository: https://git.openstack.org/cgit/openstack/murano/tree/contrib/packages/EncryptionDemo
|
