Uploaded image for project: 'Red Hat OpenStack Services on OpenShift'
  1. Red Hat OpenStack Services on OpenShift
  2. OSPRH-12211

Define Release Delivery for Barbican + Luna images/scripts

XMLWordPrintable

    • Icon: Story Story
    • Resolution: Unresolved
    • Icon: Major Major
    • rhos-18.0 FR 2 (Mar 2025)
    • None
    • None
    • None

      Support for Luna HSM requires client software to be installed in the Barbican service image before it can be deployed and configured.

      Currently we are testing Luna support by building custom barbican-api and barbican-worker images using a bash script that is proposed to be merged into the barbican-operator repository in this PR: https://github.com/openstack-k8s-operators/barbican-operator/pull/167

      This story is for figuring out how exactly we will provide this script (once the PR merges) to customers in RHOSO 18.

      Assuming the PR merges into the barbican-operator repo, we will still need to provide it to customers.  The contents of the barbican-operator repo are delivered as built container images to be run in OpenShift, but this bash script is intended to be run by the customer in a VM set up as a build environment for images, not by the barbican-operator process delivered in the barbican-operator image.

      We need to figure out the best way to provide the bash script outside of the barbican-operator image so that the build process for adding the Thales software to the barbican-api and barbican-worker images can be documented for RHOSO 18.  For this story to be complete we need to at least answer these questions:

      • Do we need a new RPM that can be dnf-installed by the customer in the build environment they will prepare?
      • Do we tell customers instead to clone the upstream GitHub repo? - This may be challenging since we can't guarantee that the thing they clone will be what was tested by us in CI.
      • Alternatively, do we need to consider building and distributing an image with the Thales client software built in instead of asking our customers to build it themselves? - This will require legal permission from Thales to redistribute, which we may already have given that we are already distributing an OpenShift base image with an old version of their client: https://catalog.redhat.com/partners/detail/thales

              rhn-gps-alee Ade Lee
              dmendiza Douglas Mendizabal
              rhos-dfg-security
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:

                  Estimated:
                  Original Estimate - 5 minutes
                  5m
                  Remaining:
                  Remaining Estimate - 1 minute
                  1m
                  Logged:
                  Time Spent - Not Specified Time Not Required
                  Not Specified