Castellan

https://docs.openstack.org/castellan/latest
Admin
Castellan is a generic key manager interface for OpenStack that provides a standardized abstraction...
Tokens:4,475
Snippets:53
Trust Score:10
Update:4 weeks ago
Show doc for...
Tokens:
Raw
### Install Castellan with virtualenvwrapper

Source: https://docs.openstack.org/castellan/latest/install/index.html

Creates a virtual environment named 'castellan' using virtualenvwrapper and installs Castellan within it.

```bash
$ mkvirtualenv castellan
$ pip install castellan

```

--------------------------------

### Install Castellan with pip

Source: https://docs.openstack.org/castellan/latest/install/index.html

Installs the Castellan package using pip.

```bash
$ pip install castellan

```

--------------------------------

### Sample functional test configuration file

Source: https://docs.openstack.org/castellan/latest/contributor/testing.html

Example content of the castellan-functional.conf file, showing the [DEFAULT] and [identity] sections with placeholder values for username, password, project_name, and auth_url.

```ini
[DEFAULT]

[identity]
username = 'admin'
password = 'openstack'
project_name = 'admin'
auth_url = 'http://localhost/identity/v3'

```

--------------------------------

### Configuration for token, password, keystone token, and keystone password credentials

Source: https://docs.openstack.org/castellan/latest/user/index.html

Provides configuration examples for the four supported authentication types. The token variable is optional for token auth; keystone auth uses keystoneauth1 plugins and supports additional variables. Set these in the [key_manager] section of the configuration file.

```ini
# token credential
# token variable not required, token can be obtained from context
[key_manager]
auth_type = 'token'
token = '5b4de0bb77064f289f7cc58e33bea8c7'

# password credential
[key_manager]
auth_type = 'password'
username = 'admin'
password = 'passw0rd1'

# keystone token credential
[key_manager]
auth_url = 'http://192.169.5.254:5000'
auth_type = 'keystone_token'
token = '5b4de0bb77064f289f7cc58e33bea8c7'
project_id = 'a1e19934af81420d980a5d02b4afe9fb'

# keystone password credential
[key_manager]
auth_url = 'http://192.169.5.254:5000'
auth_type = 'keystone_password'
username = 'admin'
password = 'passw0rd1'
project_id = '1099302ec608486f9879ba2466c60720'
user_domain_name = 'default'

```

--------------------------------

### Generating sample configuration file with tox

Source: https://docs.openstack.org/castellan/latest/user/index.html

Runs the tox environment 'genconfig' to generate a sample configuration file containing only Castellan's values.

```bash
$ tox -e genconfig

```

--------------------------------

### Create credential context from configuration file

Source: https://docs.openstack.org/castellan/latest/user/index.html

Passes the configuration to a credential factory to generate the appropriate context. The context can then be passed into any key_manager API call.

```python
from castellan.common import utils

CONF = cfg.CONF
CONF(default_config_files=['~/castellan.conf'])
context = utils.credential_factory(conf=CONF)

```

--------------------------------

### Using a predetermined configuration object

Source: https://docs.openstack.org/castellan/latest/user/index.html

Creates a key manager with a custom oslo_config.cfg.ConfigOpts object, allowing explicit configuration control.

```python
from oslo_config import cfg
from castellan import key_manager

conf = cfg.ConfigOpts()
manager = key_manager.API(configuration=conf)

```

--------------------------------

### Add castellan to oslo.config entry point in setup.cfg

Source: https://docs.openstack.org/castellan/latest/user/index.html

Adds the castellan.config entry point to the setup.cfg file so the oslo-config-generator can discover Castellan's configuration options. Uses the default values supplied by the castellan package.

```ini
[entry_points]
oslo.config.opts =
    castellan.config = castellan.options:list_opts

```

--------------------------------

### Generate functional test configuration with tox -e genconfig

Source: https://docs.openstack.org/castellan/latest/contributor/testing.html

Generates a sample configuration file for functional tests. The output file is castellan/etc/castellan/castellan-functional.conf.sample, which must be renamed to castellan-functional.conf and placed in /etc/castellan or ./etc/castellan.

```bash
# Generate a sample configuration file
$ tox -e genconfig

```

--------------------------------

### Parsing the config files

Source: https://docs.openstack.org/castellan/latest/user/index.html

Parses configuration files by setting default_config_files on the global CONF object. Later files overwrite earlier ones; missing files cause an error.

```python
from oslo_config import cfg
from castellan import key_manager

conf=cfg.CONF
config_files = ['~/castellan.conf', '/etc/castellan/castellan.conf']
conf(default_config_files=config_files)
manager = key_manager.API(configuration=conf)

```

--------------------------------

### Using the global CONF object for configuration

Source: https://docs.openstack.org/castellan/latest/user/index.html

Creates a key manager using the global oslo_config.cfg.CONF object. This is the default behavior when no ConfigOpts object is provided.

```python
from castellan import key_manager

manager = key_manager.API()

```

--------------------------------

### Enabling default logging

Source: https://docs.openstack.org/castellan/latest/user/index.html

Enables default logging for Castellan using options.enable_logging() before creating the key manager. This is useful when the application does not use oslo_log.

```python
from castellan import options
from castellan import key_manager

options.enable_logging()
manager = key_manager.API()

```

--------------------------------

### Run unit tests on Python 2.7 with tox -e py27

Source: https://docs.openstack.org/castellan/latest/contributor/testing.html

Executes the unit tests for Python 2.7. Other available environments are py35 and pep8.

```bash
# Executes tests on Python 2.7
$ tox -e py27

```

--------------------------------

### Creating and storing a key

Source: https://docs.openstack.org/castellan/latest/user/index.html

Creates a passphrase secret and stores it using the key manager. The stored key identifier is recorded for later use.

```python
import myapp
from castellan.common.objects import passphrase
from castellan import key_manager

key = passphrase.Passphrase('super_secret_password')
manager = key_manager.API()
stored_key_id = manager.store(myapp.context(), key)

```

--------------------------------

### Add castellan.config namespace to oslo-config-generator conf

Source: https://docs.openstack.org/castellan/latest/user/index.html

Adds the castellan.config namespace to the project's oslo-config-generator configuration file (e.g., etc/oslo-config-generator/myproject.conf) so the generator includes Castellan's options. The output file is specified by output_file.

```ini
[DEFAULT]
output_file = etc/myproject/myproject.conf
namespace = castellan.config

```

--------------------------------

### Run debug environment with tox -e debug

Source: https://docs.openstack.org/castellan/latest/contributor/testing.html

Runs the debug environment to hit a pdb breakpoint. To use, add 'import pdb; pdb.set_trace()' to set the breakpoint in the code.

```bash
# hit the pdb breakpoint
$ tox -e debug

```

--------------------------------

### Changing the key manager provider while using the global configuration

Source: https://docs.openstack.org/castellan/latest/user/index.html

Changes the key manager provider by setting api_class to 'some.other.KeyManager' using the global CONF object.

```python
from oslo_config import cfg
from castellan import options
from castellan import key_manager

options.set_defaults(cfg.CONF, api_class='some.other.KeyManager')
manager = key_manager.API()

```

--------------------------------

### Creating RequestContext from Keystone Client

Source: https://docs.openstack.org/castellan/latest/user/index.html

Creates an oslo context object using a Keystone session and authentication. The resulting context can be passed into any key_manager API call.

```python
from keystoneauth1 import identity
from keystoneauth1 import session
from oslo_context import context

username = 'admin'
password = 'openstack'
project_name = 'admin'
auth_url = 'http://localhost/identity/v3'
auth = identity.Password(auth_url=auth_url,
                         username=username,
                         password=password,
                         project_name=project_name,
                         default_domain_id='default')
sess = session.Session()

ctxt = context.RequestContext(auth_token=auth.get_token(sess),
                              project_id=auth.get_project_id(sess))

```

--------------------------------

### Changing the barbican endpoint

Source: https://docs.openstack.org/castellan/latest/user/index.html

Sets a custom barbican endpoint using options.set_defaults before creating the key manager. The endpoint is passed as a keyword argument.

```python
from oslo_config import cfg
from castellan import options
from castellan import key_manager

conf = cfg.ConfigOpts()
options.set_defaults(conf, barbican_endpoint='http://192.168.0.1:9311/')
manager = key_manager.API(conf)

```

--------------------------------

### Retrieving a key and checking the contents

Source: https://docs.openstack.org/castellan/latest/user/index.html

Retrieves a stored key using its identifier and checks if its encoded value matches the expected passphrase before performing restricted actions.

```python
import myapp
from castellan import key_manager

manager = key_manager.API()
key = manager.get(myapp.context(), stored_key_id)
if key.get_encoded() == 'super_secret_password':
    myapp.do_secret_stuff()

```

--------------------------------

### Run functional tests with tox -e functional

Source: https://docs.openstack.org/castellan/latest/contributor/testing.html

Executes the functional tests. Requires Barbican and Keystone services to be running and configured. By default, the functional tox job uses testr.

```bash
# Execute Barbican Functional Tests
$ tox -e functional

```

--------------------------------

### Run pep8 style check with tox -e pep8

Source: https://docs.openstack.org/castellan/latest/contributor/testing.html

Checks Python code style. Any comments on bad coding style will output to the terminal.

```bash
# Checks python code style
$ tox -e pep8

```

--------------------------------

### Secret consumers

Source: https://docs.openstack.org/castellan/latest/user/index.html

Shows how to list, add, and remove consumers for a secret, and how to delete a secret with or without the force flag. Consumers prevent deletion unless the force flag is used. Note: consumer support is only available for the Barbican backend.

```python
import myapp
from castellan import key_manager

manager = key_manager.API()

# Listing consumers:
stored_secret = self.key_mgr.get(myapp.context(), stored_id)
consumer_list = stored_secret.consumers  # consumers is a list of dicts

# Adding consumers:
consumer = {'service': 'glance',
            'resource_type': 'image',
            'resource_id': 'image_id'}
try:
    manager.add_consumer(myapp.context(), stored_id, consumer)
except NotImplementedError:
    pass  # backends like Vault don't support adding/removing consumers

# Remove the consumer before calling secret delete without the force flag:
try:
    manager.remove_consumer(myapp.context(), stored_id, consumer)
except NotImplementedError:
    pass
manager.delete(myapp.context(), stored_key_id)

# Alternatively, force delete a secret
manager.delete(myapp.context(), stored_key_id, force=True)

```

--------------------------------

### Deleting a key

Source: https://docs.openstack.org/castellan/latest/user/index.html

Deletes a stored key using its identifier. Under normal conditions, this call returns nothing but may raise exceptions for communication, identification, or authorization issues.

```python
import myapp
from castellan import key_manager

manager = key_manager.API()
manager.delete(myapp.context(), stored_key_id)

```
Tokens:
Raw