-
Bug
-
Resolution: Unresolved
-
Undefined
-
None
-
None
-
None
-
False
-
-
False
-
?
-
rhos-ops-platform-services-security
-
None
-
-
-
-
-
Important
Barbican config should allow seamless admin controlled migrations, evacuations, unshelve operations for encrypted volumes
The default config will fail for admin directed operations like migrations, evacuations, unshelve operations with the following:
Key manager error: Forbidden: Secret payload retrieval attempt not allowed - please review your user/project privileges
This impacts features like instanceHA and Watcher also.
Here is a policy work-around for this issue (from Douglas Mendizábal)
spec:
...
barbican:
...
template:
barbicanAPI:
customServiceConfig: |
[oslo_policy]
policy_file=/etc/barbican/barbican.conf.d/policy.yaml
defaultConfigOverwrite:
policy.yaml: |
"secret:decrypt": "role:admin or rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private) or rule:secret_acl_read"
