-
Story
-
Resolution: Unresolved
-
Major
-
None
-
None
-
None
-
False
-
-
False
-
?
-
?
-
RHOSSTRAT-232 - Support Thales HSM in RHOSO 18.0 [FR2]
-
?
-
?
-
-
Support for Luna HSM requires client software to be installed in the Barbican service image before it can be deployed and configured.
Currently we are testing Luna support by building custom barbican-api and barbican-worker images using a bash script that is proposed to be merged into the barbican-operator repository in this PR: https://github.com/openstack-k8s-operators/barbican-operator/pull/167
This story is for figuring out how exactly we will provide this script (once the PR merges) to customers in RHOSO 18.
Assuming the PR merges into the barbican-operator repo, we will still need to provide it to customers. The contents of the barbican-operator repo are delivered as built container images to be run in OpenShift, but this bash script is intended to be run by the customer in a VM set up as a build environment for images, not by the barbican-operator process delivered in the barbican-operator image.
We need to figure out the best way to provide the bash script outside of the barbican-operator image so that the build process for adding the Thales software to the barbican-api and barbican-worker images can be documented for RHOSO 18. For this story to be complete we need to at least answer these questions:
- Do we need a new RPM that can be dnf-installed by the customer in the build environment they will prepare?
- Do we tell customers instead to clone the upstream GitHub repo? - This may be challenging since we can't guarantee that the thing they clone will be what was tested by us in CI.
- Alternatively, do we need to consider building and distributing an image with the Thales client software built in instead of asking our customers to build it themselves? - This will require legal permission from Thales to redistribute, which we may already have given that we are already distributing an OpenShift base image with an old version of their client: https://catalog.redhat.com/partners/detail/thales
- impacts account
-
OSPRH-9535 Luna HSM Integration with barbican-operator
- In Progress
- relates to
-
OSPRH-12623 New Package: ansible-role-rhoso-luna-hsm
- New