File ardana-barbican-8.0+git.1534266594.8136db7.obscpio of Package ardana-barbican

Overview Repositories Revisions Requests Users Attributes Meta

File ardana-barbican-8.0+git.1534266594.8136db7.obscpio of Package ardana-barbican (Revision 23abecc37cf5db54ca92513c3f451845)

Currently displaying revision 23abecc37cf5db54ca92513c3f451845 , Show latest

07070100DE2177000081A4000003E800000064000000015B730CE200000083000001030000000400000000000000000000003C00000000ardana-barbican-8.0+git.1534266594.8136db7/.copyrightignoreroles/KEYMGR-API/templates/generate_kek
roles/KEYMGR-API/README.md
roles/KEYMGR-API/templates/api-logging.conf.j2
.copyrightignore
07070100DE2175000081A4000003E800000064000000015B730CE200000084000001030000000400000000000000000000003600000000ardana-barbican-8.0+git.1534266594.8136db7/.gitreview[gerrit]
host=gerrit.suse.provo.cloud
port=29418
project=ardana/barbican-ansible.git
defaultremote=ardana
defaultbranch=stable/pike
07070100DE2172000081A4000003E800000064000000015B730CE20000000C000001030000000400000000000000000000003900000000ardana-barbican-8.0+git.1534266594.8136db7/.rsync-filter- ardana-ci
07070100DE2173000081A4000003E800000064000000015B730CE20000279F000001030000000400000000000000000000003300000000ardana-barbican-8.0+git.1534266594.8136db7/LICENSE
                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/

TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

1. Definitions.

"License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.

"Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

"Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.

"You" (or "Your") shall mean an individual or Legal Entity
      exercising permissions granted by this License.

"Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.

"Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.

"Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a
      copyright notice that is included in or attached to the work
      (an example is provided in the Appendix below).

"Derivative Works" shall mean any work, whether in Source or Object
      form, that is based on (or derived from) the Work and for which the
      editorial revisions, annotations, elaborations, or other modifications
      represent, as a whole, an original work of authorship. For the purposes
      of this License, Derivative Works shall not include works that remain
      separable from, or merely link (or bind by name) to the interfaces of,
      the Work and Derivative Works thereof.

"Contribution" shall mean any work of authorship, including
      the original version of the Work and any modifications or additions
      to that Work or Derivative Works thereof, that is intentionally
      submitted to Licensor for inclusion in the Work by the copyright owner
      or by an individual or Legal Entity authorized to submit on behalf of
      the copyright owner. For the purposes of this definition, "submitted"
      means any form of electronic, verbal, or written communication sent
      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise
      designated in writing by the copyright owner as "Not a Contribution."

"Contributor" shall mean Licensor and any individual or Legal Entity
      on behalf of whom a Contribution has been received by Licensor and
      subsequently incorporated within the Work.

2. Grant of Copyright License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      copyright license to reproduce, prepare Derivative Works of,
      publicly display, publicly perform, sublicense, and distribute the
      Work and such Derivative Works in Source or Object form.

3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed.

4. Redistribution. You may reproduce and distribute copies of the
      Work or Derivative Works thereof in any medium, with or without
      modifications, and in Source or Object form, provided that You
      meet the following conditions:

(a) You must give any other recipients of the Work or
          Derivative Works a copy of this License; and

(b) You must cause any modified files to carry prominent notices
          stating that You changed the files; and

(c) You must retain, in the Source form of any Derivative Works
          that You distribute, all copyright, patent, trademark, and
          attribution notices from the Source form of the Work,
          excluding those notices that do not pertain to any part of
          the Derivative Works; and

(d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution
          notices within Derivative Works that You distribute, alongside
          or as an addendum to the NOTICE text from the Work, provided
          that such additional attribution notices cannot be construed
          as modifying the License.

You may add Your own copyright statement to Your modifications and
      may provide additional or different license terms and conditions
      for use, reproduction, or distribution of Your modifications, or
      for any such Derivative Works as a whole, provided Your use,
      reproduction, and distribution of the Work otherwise complies with
      the conditions stated in this License.

5. Submission of Contributions. Unless You explicitly state otherwise,
      any Contribution intentionally submitted for inclusion in the Work
      by You to the Licensor shall be under the terms and conditions of
      this License, without any additional terms or conditions.
      Notwithstanding the above, nothing herein shall supersede or modify
      the terms of any separate license agreement you may have executed
      with Licensor regarding such Contributions.

6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.

7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. You are solely responsible for determining the
      appropriateness of using or redistributing the Work and assume any
      risks associated with Your exercise of permissions under this License.

8. Limitation of Liability. In no event and under no legal theory,
      whether in tort (including negligence), contract, or otherwise,
      unless required by applicable law (such as deliberate and grossly
      negligent acts) or agreed to in writing, shall any Contributor be
      liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.

9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only
      on Your own behalf and on Your sole responsibility, not on behalf
      of any other Contributor, and only if You agree to indemnify,
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.

07070100DE2181000081A4000003E800000064000000015B730CE2000002A1000001030000000400000000000000000000003500000000ardana-barbican-8.0+git.1534266594.8136db7/README.mdREADME
======

This repository contains the following roles

- KEYMGR-API:         Barbican API server
 - KEYMGR-WKR:         Barbican worker process for async order processing
 - barbican-common:    Common variable and task declarations
 - barbican-monitor:   Local and remote monitoring of Barbican API

The verbs:
- configure - configure the service/role
- install   - install the service/role
- start     - start the service/role
- stop      - stop the service/role

The operations:
- deploy       - deploy the service (install, configure and start)
- reconfigure  - reconfigures the service

Refer to README.md at roles/KEYMGR-API/ for reconfiguration instructions

07070100DE217C000081A4000003E800000064000000015B730CE20000036F000001030000000400000000000000000000004300000000ardana-barbican-8.0+git.1534266594.8136db7/_barbican-configure.yml#
# (c) Copyright 2015 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- hosts: KEYMGR-API
  gather_facts: True
  roles:
    - KEYMGR-API
  tasks:
    - include: roles/KEYMGR-API/tasks/configure.yml

- hosts: KEYMGR-WKR
  roles:
    - KEYMGR-WKR
  tasks:
    - include: roles/KEYMGR-WKR/tasks/configure.yml07070100DE217B000081A4000003E800000064000000015B730CE200000368000001030000000400000000000000000000004100000000ardana-barbican-8.0+git.1534266594.8136db7/_barbican-install.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- hosts: KEYMGR-API
  roles:
    - role: KEYMGR-API
  tasks:
    - include: roles/KEYMGR-API/tasks/install.yml

- hosts: KEYMGR-WKR
  roles:
    - role: KEYMGR-WKR
  tasks:
    - include: roles/KEYMGR-WKR/tasks/install.yml
07070100DE217F000081A4000003E800000064000000015B730CE2000002EA000001030000000400000000000000000000004A00000000ardana-barbican-8.0+git.1534266594.8136db7/_barbican-schedule-restart.yml#
# (c) Copyright 2018 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---
# Schedule a restart of all barbican services using ardana_notify_... variables
- hosts: all
  tasks:
    - include: roles/barbican-common/tasks/_schedule_restart.yml07070100DE216D000041ED000003E800000064000000045B730CE200000000000001030000000400000000000000000000003500000000ardana-barbican-8.0+git.1534266594.8136db7/ardana-ci07070100DE2171000041ED000003E800000064000000035B730CE200000000000001030000000400000000000000000000003D00000000ardana-barbican-8.0+git.1534266594.8136db7/ardana-ci/project07070100E02243000041ED000003E800000064000000035B730CE200000000000001030000000400000000000000000000004900000000ardana-barbican-8.0+git.1534266594.8136db7/ardana-ci/project/input-model07070100E02244000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004E00000000ardana-barbican-8.0+git.1534266594.8136db7/ardana-ci/project/input-model/data07070100E02246000081A4000003E800000064000000015B730CE200000594000001030000000400000000000000000000006000000000ardana-barbican-8.0+git.1534266594.8136db7/ardana-ci/project/input-model/data/control_plane.yml#
# (c) Copyright 2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---
  product:
    version: 2

control-planes:
    - name: ccp
      control-plane-prefix: ccp
      region-name: region1
      failure-zones:
        - AZ1
        - AZ2
        - AZ3

common-service-components:
        - lifecycle-manager-target
        - openstack-client

clusters:
        - name: cluster0
          cluster-prefix: c0
          server-role:
            - SERVER1-ROLE
            - SERVER2-ROLE
            - SERVER3-ROLE
          member-count: 3
          allocation-policy: strict
          service-components:
            - lifecycle-manager
            - ntp-server
            - mysql
            - ip-cluster
            - rabbitmq
            - keystone-client
            - keystone-api
            - barbican-api
            - barbican-worker
07070100E02245000081A4000003E800000064000000015B730CE2000005CF000001030000000400000000000000000000005A00000000ardana-barbican-8.0+git.1534266594.8136db7/ardana-ci/project/input-model/data/servers.yml#
# (c) Copyright 2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---
  product:
    version: 2

baremetal:
    netmask: 255.255.255.0
    subnet: 192.168.110.0
    server-interface: eth2

servers:

- id: server1
      ip-addr: 192.168.110.3
      role: SERVER1-ROLE
      server-group: AZ1
      mac-addr: a4:93:0c:4f:7c:73
      nic-mapping: VAGRANT
      ilo-ip: 192.168.109.3
      ilo-password: password
      ilo-user: admin

- id: server2
      ip-addr: 192.168.110.4
      role: SERVER2-ROLE
      server-group: AZ2
      mac-addr: b2:72:8d:ac:7c:6f
      nic-mapping: VAGRANT
      ilo-ip: 192.168.109.4
      ilo-password: password
      ilo-user: admin

- id: server3
      ip-addr: 192.168.110.5
      role: SERVER3-ROLE
      server-group: AZ3
      mac-addr: 8a:8e:64:55:43:76
      nic-mapping: VAGRANT
      ilo-ip: 192.168.109.5
      ilo-password: password
      ilo-user: admin

07070100DE216E000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000003B00000000ardana-barbican-8.0+git.1534266594.8136db7/ardana-ci/tests07070100DE2170000081A4000003E800000064000000015B730CE200000400000001030000000400000000000000000000004A00000000ardana-barbican-8.0+git.1534266594.8136db7/ardana-ci/tests/test-plan.yaml#
# (c) Copyright 2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---
- name: Test reconfigure
  logfile: testsuite-reconfigure.log
  prefix: reconfigure
  playbooks:
    - barbican-reconfigure.yml

- name: Validate barbican
  exec:
    - validate-barbican.bash

- name: Test reboot
  logfile: reboot.log
  prefix: reboot
  vms:
    - reboot: server2
  exec:
    - ansible-playbook -i hosts/verb_hosts barbican-start.yml
    - validate-barbican.bash

07070100DE216F000081ED000003E800000064000000015B730CE200000308000001030000000400000000000000000000005200000000ardana-barbican-8.0+git.1534266594.8136db7/ardana-ci/tests/validate-barbican.bash#
# (c) Copyright 2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#

#!/bin/bash

ansible-playbook -i hosts/verb_hosts barbican-status.yml

if [ $? -eq 0 ]
then
  echo "Ok"
else
  echo "Fail"
  exit 1
fi

07070100DE2180000081A4000003E800000064000000015B730CE20000039F000001030000000400000000000000000000004A00000000ardana-barbican-8.0+git.1534266594.8136db7/barbican-configure-monasca.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- hosts: KEYMGR-API:&MON-AGN
  roles:
    - role: barbican-monitor
  tasks:
    - include: roles/barbican-monitor/tasks/local_monitor.yml

- hosts: KEYMGR-API:&MON-AGN
  roles:
    - role: barbican-monitor
  tasks:
    - include: roles/barbican-monitor/tasks/remote_monitor.yml
07070100DE217D000081A4000003E800000064000000015B730CE20000043A000001030000000400000000000000000000003F00000000ardana-barbican-8.0+git.1534266594.8136db7/barbican-deploy.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

# Register necessary user, barbican roles, role assignment for api service.
- hosts: KEYMGR-API
  roles:
    - role: KEYMGR-API
  tasks:
    - include: roles/KEYMGR-API/tasks/keystone_conf.yml
      ansible_python_interpreter:
        "{{ KEY_CLI.vars.keystone_client_python_interpreter }}"

- include: _barbican-install.yml

- include: _barbican-configure.yml
- include: barbican-start.yml
- include: barbican-configure-monasca.yml
07070100DE2179000081A4000003E800000064000000015B730CE200000432000001030000000400000000000000000000005700000000ardana-barbican-8.0+git.1534266594.8136db7/barbican-reconfigure-credentials-change.yml#
# (c) Copyright 2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---
- include: _barbican-configure.yml

- hosts: KEYMGR-API
  roles:
    - KEYMGR-API
  tasks:
    - include: roles/KEYMGR-API/tasks/configure.yml

- hosts: KEYMGR-API
  roles:
    - KEYMGR-API
  # This task should be set to run-once
  tasks:
    - include: roles/KEYMGR-API/tasks/keystone_change_pwd.yml
      ansible_python_interpreter:
        "{{ KEY_CLI.vars.keystone_client_python_interpreter }}"

- include: barbican-start.yml

07070100DE216C000081A4000003E800000064000000015B730CE2000005EB000001030000000400000000000000000000004400000000ardana-barbican-8.0+git.1534266594.8136db7/barbican-reconfigure.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- hosts: KEYMGR-API
  gather_facts: True
  roles:
    - KEYMGR-API
  tasks:
    - include: roles/KEYMGR-API/tasks/configure.yml

- hosts: KEYMGR-WKR
  roles:
    - KEYMGR-WKR
  tasks:
    - include: roles/KEYMGR-WKR/tasks/configure.yml

# Split the tasks to enable serial restart
- hosts: KEYMGR-API
  serial: "50%"
  roles:
    - role: KEYMGR-API
  tasks:
    - include: roles/KEYMGR-API/tasks/start.yml

- hosts: KEYMGR-WKR
  serial: "50%"
  roles:
    - role: KEYMGR-WKR
  tasks:
    - include: roles/KEYMGR-WKR/tasks/start.yml

- include: barbican-configure-monasca.yml
07070100DE2174000081A4000003E800000064000000015B730CE20000028D000001030000000400000000000000000000004000000000ardana-barbican-8.0+git.1534266594.8136db7/barbican-restart.yml#
# (c) Copyright 2018 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---
- include: _barbican-schedule-restart.yml

- include: barbican-start.yml
07070100DE2178000081A4000003E800000064000000015B730CE20000037C000001030000000400000000000000000000003E00000000ardana-barbican-8.0+git.1534266594.8136db7/barbican-start.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- hosts: KEYMGR-API
  serial: 1
  roles:
    - role: KEYMGR-API
  tasks:
    - include: roles/KEYMGR-API/tasks/start.yml

- hosts: KEYMGR-WKR
  serial: 1
  roles:
    - role: KEYMGR-WKR
  tasks:
    - include: roles/KEYMGR-WKR/tasks/start.yml
07070100DE217E000081A4000003E800000064000000015B730CE200000310000001030000000400000000000000000000003F00000000ardana-barbican-8.0+git.1534266594.8136db7/barbican-status.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- hosts: KEYMGR-API
  max_fail_percentage: 0
  roles:
    - role: KEYMGR-API
  tasks:
    - include: roles/KEYMGR-API/tasks/status.yml
07070100DE217A000081A4000003E800000064000000015B730CE200000362000001030000000400000000000000000000003D00000000ardana-barbican-8.0+git.1534266594.8136db7/barbican-stop.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- hosts: KEYMGR-API
  roles:
    - role: KEYMGR-API
  tasks:
    - include: roles/KEYMGR-API/tasks/stop.yml

- hosts: KEYMGR-WKR
  roles:
    - role: KEYMGR-WKR
  tasks:
    - include: roles/KEYMGR-WKR/tasks/stop.yml
07070100DE2176000081A4000003E800000064000000015B730CE200000345000001030000000400000000000000000000004000000000ardana-barbican-8.0+git.1534266594.8136db7/barbican-upgrade.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---
- include: barbican-status.yml
- include: barbican-stop.yml
- include: _barbican-install.yml
- include: _barbican-configure.yml
- include: barbican-start.yml
- include: barbican-status.yml
07070100E0224A000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000003200000000ardana-barbican-8.0+git.1534266594.8136db7/config07070100E0224B000081A4000003E800000064000000015B730CE2000004B2000001030000000400000000000000000000004800000000ardana-barbican-8.0+git.1534266594.8136db7/config/barbican-symlinks.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

symlinks:
  "barbican/barbican.conf.j2": roles/KEYMGR-API/templates/barbican.conf.j2
  "barbican/barbican_deploy_config.yml": roles/barbican-common/vars/barbican_deploy_config.yml
  "barbican/barbican_kmip_plugin_config_sample.yml": roles/KEYMGR-API/files/samples/barbican_kmip_plugin_config_sample.yml
  "barbican/barbican_pkcs11_plugin_config_sample.yml": roles/KEYMGR-API/files/samples/ardana/barbican_pkcs11_plugin_config_sample.yml
  "barbican/policy.json": roles/KEYMGR-API/templates/policy.json
  "barbican/README.md": roles/KEYMGR-API/README.md
07070100E02247000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000003A00000000ardana-barbican-8.0+git.1534266594.8136db7/filter_plugins07070100E02249000081ED000003E800000064000000015B730CE200000748000001030000000400000000000000000000005900000000ardana-barbican-8.0+git.1534266594.8136db7/filter_plugins/barbican_master_key_decrypt.py#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#

import base64
import imp
import os.path

path = os.path.dirname(os.path.realpath(__file__))

ardanaencrypt = imp.load_source('ardanaencrypt', path + '/../ardanaencrypt.py')

encryption_class = 'openssl'

ardanaencrypt_class = getattr(ardanaencrypt, encryption_class)

# Method to decrypt the Customer defined encrypted key
# It will only decrypt the key with prefix @ardana@
# Customer define this key, barbican_customer_master_key, in
# roles/barbican-common/vars/barbican_deploy_config.yml

def barbican_master_key_decrypt(value, *args, **kw):
    prefix = None
    if value.startswith(ardanaencrypt_class.prefix):
        prefix = ardanaencrypt_class.prefix
    # For upgrade cases, need to support existing encrypted values which may
    # have legacy prefix in-use.
    elif value.startswith(ardanaencrypt_class.legacy_prefix):
        prefix = ardanaencrypt_class.legacy_prefix

if prefix is None:
        return value
    else:
        obj = ardanaencrypt_class()
        return obj.decrypt(base64.urlsafe_b64decode(
            value.encode('ascii', 'ignore')[len(prefix):]))

class FilterModule(object):
    def filters(self):
        return {'barbican_master_key_decrypt': barbican_master_key_decrypt}
07070100E02248000081A4000003E800000064000000015B730CE200000707000001030000000400000000000000000000004D00000000ardana-barbican-8.0+git.1534266594.8136db7/filter_plugins/check_variables.py#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# Create variable value validation filter

def is_str_set(my_var, do_define_check=True):
    """Returns True if variable is set to a non-blank value.

Input value is stripped on both end to make sure it has value.
    """
    if do_define_check:
        try:
            my_var
        except NameError:
            my_var = None
    if my_var is None:
        return False
    elif isinstance(my_var, (int, long)):
        return my_var  # return natural number as-is
    else:
        return my_var and my_var.strip() != ''

def is_bool_true(my_var, do_define_check=True):
    """Check variable value can be converted to boolean True

Case-insensitive input value of True, yes or 1 is treated as boolean True.
    """
    if do_define_check:
        try:
            my_var
        except NameError:
            my_var = None
    if my_var and type(my_var) == type(True):
        return my_var
    else:
        return my_var and my_var.strip().lower() in ['yes', 'true', '1', 'on']

class FilterModule(object):

def filters(self):
        return {'is_str_set': is_str_set,
                'is_bool_true': is_bool_true,
                }
07070100E428D2000041ED000003E800000064000000065B730CE200000000000001030000000400000000000000000000003100000000ardana-barbican-8.0+git.1534266594.8136db7/roles07070100E8197C000041ED000003E800000064000000095B730CE200000000000001030000000400000000000000000000003C00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API07070100E81996000081A4000003E800000064000000015B730CE20000439E000001030000000400000000000000000000004600000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/README.mdREADME
======

## First Time Initial Master Key Setup
When Barbican is used with *simple_crypto_plugin* as secret store backend, its
master key needs to be defined **before initial deployment**. This backend is
used when secrets are stored in its database. If you don't specify key before
deployment, default master key is used (not recommended practice).

** Once master key is set, it must not be modified. **

** Earlier if you defined your own encrypted master key, Before you run any playbooks **
** remember that you need to export that encryption key in the following environment variable: **
** export ARDANA_USER_PASSWORD_ENCRYPT_KEY=<encryption key> **
** For more details on this, please refer to official Ardana OpenStack/Barbican documentation **

** If you are upgrading and already have the master key defined from previous version or installation, check **
** ~/openstack/ardana/ansible/roles/barbican-common/vars/barbican_deploy_config.yml **
** for *barbican_customer_master_key* value, if the value does not have a prefix "@ardana@" **
** that means it is not encrypted. It is highly recommended to encrypt this value **
* Encrypt the existing key during upgrade
  * setup the environment variable ARDANA_USER_PASSWORD_ENCRYPT_KEY which contain the key
  used to encrypt barbican master key.
  * Note: Before you run any playbooks, remember that you need to export the encryption key in the
  following environment variable. For instructions *
  * export ARDANA_USER_PASSWORD_ENCRYPT_KEY=<USER_ENCRYPTION_KEY>
  * execute
    * python *roles/KEYMGR-API/templates/generate_kek <barbican_customer_master_key>*
  * Master key is generated at stdout
  * Set above master key in file  ~/openstack/ardana/ansible/roles/barbican-common/vars/barbican_deploy_config.yml
    * Replace existing *barbican_customer_master_key* value with above generated
      master key
    * Commit the change in git repository.
    * *cd ~/openstack/ardana/ansible/*
    * *ansible-playbook -i hosts/localhost ready-deployment.yml*
    * Once master key is set, continue with cloud deployment.

** It is not recommended to change the master key during the upgrade process **
** Changing master key will result in read error for existing secrets as they were **
** encrypted using previous master key. **

* Generate master key using provided python *generate_kek* script on deployer node
  * setup the environment variable ARDANA_USER_PASSWORD_ENCRYPT_KEY which contain the key
  used to encrypt barbican master key.
  * export ARDANA_USER_PASSWORD_ENCRYPT_KEY=<USER_ENCRYPTION_KEY>
  * python  *roles/KEYMGR-API/templates/generate_kek*
* Master key is generated at stdout from previous command
* Set above master key in file  ~/openstack/ardana/ansible/roles/barbican-common/vars/barbican_deploy_config.yml
  * Replace existing *barbican_customer_master_key* value with above generated
  master key
  * Commit the change in git repository.
  * *cd ~/openstack/ardana/ansible/*
  * *ansible-playbook -i hosts/localhost ready-deployment.yml*
* Once master key is set, continue with cloud deployment.

# Configurable Values

There are different configurable entries for Barbican.

1. Configuration entries that are available upstream in *barbican.conf*. This has upstream defined configurable values.
2. Deployment specific configuration which are not part of *barbican.conf* like
log_level, process count etc.

The following section describes the mechanism used for overriding or changing those
configuration entries.

* To change configuration entries used by Barbican API service config i.e. barbican.conf
   * Edit the files *roles/KEYMGR-API/templates/barbican.conf.j2*  to add or
   change any config settings
   * Make sure that you don't change any values under {{ }} in above mentioned file.

* To change, configurable properties which are not part of Barbican API service config
  such as log level
    * Edit the files  *roles/barbican-common/vars/barbican_deploy_config.yml* to
    change any config settings
    * Here you can only change values, can't add any new settings
    * For log level, replace current value with new log level e.g.
        * *barbican_loglevel: "DEBUG"*

To make above changes effective, Barbican reconfigure playbook needs to be executed
which deploys the new settings on its API nodes.

* cd ~/openstack/ardana/ansible/
* ansible-playbook -i hosts/localhost ready-deployment.yml
* cd ~/scratch/ansible/next/ardana/ansible
* *ansible-playbook -i hosts/verb_hosts barbican-reconfigure.yml*

## Tested/Supported Features

### Enable or Disable Auditing
  * Auditing feature can be disabled or enabled by following steps.
    * Edit the file  ~/openstack/my_cloud/definition/cloudConfig.yml
    * All audit related configuration is defined under `audit-settings` section.
        * Please note that valid yaml syntax need to be followed when specifying values.
    * Service name defined under `enabled-services` or `disabled-services` override
      the default setting (i.e. `default: enabled` or `default: disabled`)
    * To enable auditing, make sure that `barbican` service name is within
      `enabled-services` list of `audit-settings` section or is **not** present in
      `disabled-services` list when `default: enabled`.
    * To disable auditing for barbican service specifically, make sure that `barbican`
      service name is within `disabled-services` list of `audit-settings`
      section or is **not** present in `enabled-services` list when
      `default: disabled`.
    * It is incorrect to specify service name in both list. If its specified, then
      `enabled-services` value takes precedence.
    * Commit the change in git repository.
    * *cd ~/openstack/ardana/ansible/*
    * *ansible-playbook -i hosts/localhost config-processor-run.yml*
    * *ansible-playbook -i hosts/localhost ready-deployment.yml*
    * *cd ~/scratch/ansible/next/ardana/ansible*
  * *ansible-playbook -i hosts/verb_hosts barbican-reconfigure.yml*

### Enable or Disable KMIP Plugin
  * (Step 1) To populate or change clients certificate on Barbican nodes.
      * For KMIP device, SSL client certificate is needed as generally HSM devices
        require 2-way SSL for security reasons.
        * Get needed client certificate, client private key and client root CA recognized
        by HSM device.
        * These certificate information is provided to Barbican service via reconfigure
        playbook.
        * Look into KMIP certificates sample file barbican_kmip_plugin_config_sample.yml
        * Copy this file to a temporary directory e.g. /tmp/kmip_plugin_certs.yml
        * Edit the file to provide either client certificates as absolute file paths (i.e.
        `client_cert_file_path`, `client_key_file_path`, `client_cacert_file_path`) or
         pasting certificate content directly into the file (i.e. in `client_cert_content`,
         `client_key_content`, `client_cacert_content`).
       * *ansible-playbook  -i hosts/verb_hosts barbican-reconfigure.yml -e@/tmp/kmip_plugin_certs.yml*

* (Step 2) To provide or update HSM connection credential for Barbican service
      * In this step, KMIP plugin connection details are provided to service.
          * Edit the files  ~/openstack/ardana/ansible/roles/barbican-common/vars/barbican_deploy_config.yml
          * Change the value `use_kmip_secretstore_plugin` to True to use KMIP
            plugin or False to use default secret store plugin (`store_crypto`).
          * Provide KMIP client connection credentials and KMIP server
            hostname and port.
          * Commit the change in git repository.
          * *cd ~/openstack/ardana/ansible/*
          * ansible-playbook -i hosts/localhost ready-deployment.yml
          * *cd ~/scratch/ansible/next/ardana/ansible*
      * *ansible-playbook -i hosts/verb_hosts barbican-reconfigure.yml*

```
Note: If preferred, actions described in step 1 can be executed without reconfigure
playbook execution. And reconfigure playbook action can be executed at the end of
step 2 actions. This can reduce reconfigure need in initial setup.

ansible-playbook  -i hosts/verb_hosts barbican-reconfigure.yml -e@/tmp/kmip_plugin_certs.yml

Individual step 1 and step 2 are needed when client certificates or HSM connection
information needs to be updated.
```

#### Troubleshooting KMIP Plugin Setup

1.  Make sure that in Certificate Signing Request (CSR) 'Common Name' field must
match the *barbican_kmip_username* value defined in
*roles/barbican-common/vars/barbican_deploy_config.yml*. Otherwise you may see
*Internal Server Error* in Barbican for create secret request which does not
translate well into this issue.

2. Currently Barbican does not return clear related error with regards to client
certificate setup and its connectivity with KMIP server. During secret create
request, general *Internal Server Error* is returned when certificate is invalid
or missing any of needed client certificate data (client certificate, key and CA
root certificate).

### Enable or Disable PKCS11 Plugin

* (Step 1) Import and install the PKCS11 library debian package.
    * This is a one-time setup to install pkcs11 package on barbican nodes.
    * Make sure you are on deployer node
    * If not present, Create the directory
      /home/stack/third-party/barbican/pkgs/debian
    * Populate the directory with the full set of debian packages which has
      HSM specific PKCS11 library
    * Run the 3rd-party import playbook:
      *cd ~/openstack/ardana/ansible/
      *ansible-playbook -i hosts/localhost third-party-import.yml*
      *cd ~/scratch/ansible/next/ardana/ansible
      *ansible-playbook -i hosts/verb_hosts osconfig-run.yml*
    * This will import the above packages to the Ardana thirdparty repo,
      and ready for installation, this will ensure that
      /etc/apt/source.list.d entry exists for the third-party apt repo.
      For example
      You can import hppkcs11 (<eskm_pkcs11_package_version>.deb), which is PKCS11
      library for ESKM (Enterprise Secure Key Manager) HSM
    * Once the library package is imported into third party repository
      you can install the library package by running barbican playbook
      by passing extra ansible variable `barbican_pkcs11_package_name,
      if the given package is not present on the controller nodes
      it will install the latest version from the 3rd party repository, like
    * *ansible-playbook  -i hosts/verb_hosts barbican-reconfigure.yml --extra-vars "barbican_pkcs11_package_name=hppkcs11"*
    * Or if you want to install specific version of the package, or
      upgrade or downgrade from the one you have on the controller nodes,
      you can pass the version info to the playbook, like
      *ansible-playbook  -i hosts/verb_hosts barbican-reconfigure.yml --extra-vars "barbican_pkcs11_package_name=hppkcs11=0.2.1"*
    * Above step would install provided package on controller node in its
      default location.

* (Step 2) To provide or update HSM connection credential for Barbican service
      * In this step, PKCS11 plugin connection details are provided to service.
          * Edit the files  ~/openstack/ardana/ansible/roles/barbican-common/vars/barbican_deploy_config.yml
          * Change the value `use_pkcs11_crypto_plugin` to True to use PKCS11
            plugin crypto setup. False is used to indicate other plugin setup usage.
          * Provide details for PKCS11 client connection. Details needed are
            * session password
            * expected location for vendor specific pkcs11 shared library on
              Barbican nodes. Provide absolute path on **controller** node.
            * label used for master kek
            * label used for hmac key
          * If PKCS11 provider is ESKM, then `barbican_pkcs11_provider_is_eskm`
            flag can be set to True and playbooks will use default paths for
            library and its certificate location.
          * Commit the change in git repository.
          * *cd ~/openstack/ardana/ansible/*
          * ansible-playbook -i hosts/localhost ready-deployment.yml
          * *cd ~/scratch/ansible/next/ardana/ansible*
      * *ansible-playbook -i hosts/verb_hosts barbican-reconfigure.yml*
      * If PKCS11 provider is ESKM, then `barbican_pkcs11_provider_is_eskm` flag can be set to True
        and playbooks will use default paths for library and its certificate location

* (Step 3) *** Atalla ESKM Specific Setup Only ***
     Please note that PKCS11 provider may have some custom configuration steps
     and those needs to be done manually. This specific step is just provided
     for ESKM PKCS11 connector.
     In this step, ESKM KMIP server address is set or updated.
    * For ESKM PKCS11 connector, there is connection configuration information
      needed by its PKCS11 connector e.g. KMIP server address, token firmware
      version and various flags needed for PKCS11 session.
    * Customer is expected to provide KMIP server address.
    * Barbican playbook provides following mechanism to generate related
      configuration with customer provided KMIP server address. For any other
      customization, customer is expected to refer ESKM PKCS11 documentation and
      make those changes manually on controller nodes hosting Barbican service.
    * Edit the files  ~/openstack/ardana/ansible/roles/barbican-common/vars/barbican_deploy_config.yml
    * Set the value for `barbican_pkcs11_eskm_kmip_host`, `barbican_pkcs11_eskm_kmip_port`
    * Commit the change in git repository.
    * *cd ~/openstack/ardana/ansible/*
    * ansible-playbook -i hosts/localhost ready-deployment.yml
    * *cd ~/scratch/ansible/next/ardana/ansible*
    * *ansible-playbook  -i hosts/verb_hosts barbican-reconfigure.yml --extra-vars "barbican_pkcs11_eskm_generate_conf=True"*

* (Step 4) To populate or change clients certificate on Barbican nodes.
      * For PKCS11 device, SSL client certificate is needed as generally HSM devices
        require 2-way SSL for security reasons.
        * Get needed client certificate, client private key and client root CA recognized
        by HSM device.
        * These certificate information is provided to Barbican service via reconfigure
        playbook.
        * Look into HSM certificates sample file barbican_pkcs11_plugin_config_sample.yml
        * Copy this file to a temporary directory e.g. /tmp/pkcs11_plugin_certs.yml
        * Edit the file to provide either client certificates as absolute file paths (i.e.
        `client_cert_file_path`, `client_key_file_path`, `client_cacert_file_path`) or
         pasting certificate content directly into the file (i.e. in `client_cert_content`,
         `client_key_content`, `client_cacert_content`).
        * Edit the file  ~/openstack/ardana/ansible/roles/barbican-common/vars/barbican_deploy_config.yml
          for pkcs11 certificate locations.
        * Provide expected path for client side certificates on barbican nodes.
            * `barbican_pkcs11_client_cert_path` - client certificate file path
            * `barbican_pkcs11_client_key_path` - Private key file path created
                via CSR generation
            * `barbican_pkcs11_client_cacert_path` - root CA recognized by HSM
                device and used for CSR signing.
        * Commit the change in git repository.
        * *cd ~/openstack/ardana/ansible/*
        * ansible-playbook -i hosts/localhost ready-deployment.yml
        * *cd ~/scratch/ansible/next/ardana/ansible*
      * *ansible-playbook -i hosts/verb_hosts barbican-reconfigure.yml -e@/tmp/pkcs11_plugin_certs.yml*

* (Step 5) Generate labels for master kek and hmac key used for PKCS11 plugin.
    This is one-time setup which generates needed mkek and hmac labels. As a
    pre-requisite, Step 2, (+ Step 2b in ESKM HSM case) and Step 3 needs to be done
    beforehand.
    * *ansible-playbook -i hosts/verb_hosts barbican-reconfigure.yml --extra-vars "barbican_pkcs11_generate_labels=True"*

```
Note: If preferred, actions described in step 1 (except running 3rd-party import playbook), 2, 3 and 4 can be executed
together. Just make sure that all PKCS11 specific variables are configured
correctly in barbican_deploy_config.yml and single space is present between
variables defined via 'extra-vars' option

ansible-playbook  -i hosts/verb_hosts barbican-reconfigure.yml \
    --extra-vars "barbican_pkcs11_package_name=hppkcs11 \
    barbican_pkcs11_generate_labels=True" \
    -e@/tmp/pkcs11_plugin_certs.yml

For ESKM, combined step is as follows (with generate conf file option).

ansible-playbook  -i hosts/verb_hosts barbican-reconfigure.yml \
    --extra-vars "barbican_pkcs11_package_name=hppkcs11 \
    barbican_pkcs11_eskm_generate_conf=True \
    barbican_pkcs11_generate_labels=True" \
    -e@/tmp/pkcs11_plugin_certs.yml

Individual step 1, step 2, step 3 or step 4 are needed when pkc11 library,
client certificates or HSM connection information needs to be updated.
```

#### Troubleshooting PKCS11 Plugin Setup

1. With ESKM device, make sure that in Certificate Signing Request (CSR)
'Common Name' field must exist in HSM as a local user. Otherwise you may see
*Internal Server Error* in Barbican for create secret request which does not
translate well into this issue.
07070100E81981000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004500000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/defaults07070100E81982000081A4000003E800000064000000015B730CE200000323000001030000000400000000000000000000004E00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/defaults/main.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017-2018 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

component_service_name: "{{ barbican_api_service_name }}"

notification_driver_name: "log"
audit_filter: ""
logging_conf_file_name: api-logging.conf
07070100E81990000041ED000003E800000064000000035B730CE200000000000001030000000400000000000000000000004200000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/files07070100E81991000041ED000003E800000064000000035B730CE200000000000001030000000400000000000000000000004A00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/files/samples07070100EA231D000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000005100000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/files/samples/ardana07070100EA2321000081A4000003E800000064000000015B730CE200001872000001030000000400000000000000000000007A00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/files/samples/ardana/barbican_pkcs11_plugin_config_sample.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

barbican_pkcs11_plugin_conf:

# Either use file path to provide client certificate details or add cert
  # content directly in related content variables defined below.

# File paths takes precedance over cert content if both are provided.
  # Here file path refers to local filesystem path where ansible is
  # executed.
  client_cert_file_path:
  client_key_file_path:
  client_cacert_file_path:

# Following are samples which customer needs to replace with their
  # own content here or via file path approach mentioned above.
  client_cert_content: |
    -----BEGIN CERTIFICATE-----
    MIIDvzCCAqegAwIBAgIBHTANBgkqhkiG9w0BAQsFADCBjDELMAkGA1UEBhMCVVMx
    EzARBgNVBAgTCkNhbGlmb3JuaWExEjAQBgNVBAcTCVN1bm55dmFsZTEMMAoGA1UE
    ChMDSFBFMQ8wDQYDVQQLEwZBdGFsbGExFDASBgNVBAMTC3Z0ZXNrbS1rbWlwMR8w
    HQYJKoZIhvcNAQkBFhB0ZXN0QGV4YW1wbGUuY29tMB4XDTE2MDUwODIzMDYyNFoX
    DTI2MDEzMTIzMDYyNFowgZYxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTESMBAG
    A1UEBwwJU3Vubnl2YWxlMQwwCgYDVQQKDANIUEUxFzAVBgNVBAsMDkNsb3VkIFNl
    cnZpY2VzMR0wGwYDVQQDDBRob3M0X2JhcmJpY2FuX3BrY3MxMTEgMB4GCSqGSIb3
    DQEJARYRYXJ1bi5rYW50QGhwZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
    ggEKAoIBAQCz2E6xXR+o9alGz+GsWh1eCs1CUQsQWOFgbSwWNDv8xNZRBVuKVirS
    scx3D+ziI6UbB4rOsRfX8ib5ICQXskaMScyVOm3oQo6YDuOMAM0C3Bal2C00q8Dv
    5JAiEt7rOV4dg4bKtZbV+nQiumFduecbrBQ05hYs/bY8Lfh3v6AF0zLqY4dG/zA2
    oYPXQCPV/jV3lGrlwXn/U1nWD2AcIRjq+anf7V4iUdsuaybzfcVIw0GEPg2Fhsgk
    IxKPOFE1hGOTcygk0ATdxdCUtHuQVLkpA2neTPcEMTFitJMn0yhncOxjWiON0CKe
    UGzBoBfdl7r/gA2UxdtQe0FlnXY4zDY/AgMBAAGjIDAeMAkGA1UdEwQCMAAwEQYJ
    YIZIAYb4QgEBBAQDAgeAMA0GCSqGSIb3DQEBCwUAA4IBAQDFUham8kfqkJwCGJpY
    QqGd4MtOxUAj+OevNkZjEdnJd7SXQFKNwCNxw231XRuk0w6otuzOv+PniwLhy2IS
    HowPaKtDmzncfwp01p5U/+E062bjEqlCN7N4dNoSjUuveoEwROI5Opo/wfLhKOuw
    InUz14Le6VyJ9PdcLZmKWpnYQRytiPcNadIwt19fxja7CBJ+bX/NSdX/b1/fMeN9
    8xmOn0ruoKdfD4cx/fVmMc+cV49elRKObaIaBgSQTWvjQIx8RWVPdMbQST36SlHK
    3YLCDn/97rSkOUGAz7ZGJXJGACzHsM9o1cix6y8rKco+kqGvqkBAJZoIByg0ER07
    CM0u
    -----END CERTIFICATE-----
  client_key_content: |
    -----BEGIN PRIVATE KEY-----
    MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCz2E6xXR+o9alG
    z+GsWh1eCs1CUQsQWOFgbSwWNDv8xNZRBVuKVirSscx3D+ziI6UbB4rOsRfX8ib5
    ICQXskaMScyVOm3oQo6YDuOMAM0C3Bal2C00q8Dv5JAiEt7rOV4dg4bKtZbV+nQi
    umFduecbrBQ05hYs/bY8Lfh3v6AF0zLqY4dG/zA2oYPXQCPV/jV3lGrlwXn/U1nW
    D2AcIRjq+anf7V4iUdsuaybzfcVIw0GEPg2FhsgkIxKPOFE1hGOTcygk0ATdxdCU
    tHuQVLkpA2neTPcEMTFitJMn0yhncOxjWiON0CKeUGzBoBfdl7r/gA2UxdtQe0Fl
    nXY4zDY/AgMBAAECggEBAKqY2nTmiDzG4483bLQIO2lUx8ZLiDo2hXvps3NQk0LA
    GSh784yzFiYM4I5kfek5tMmCCwrr9Fk07AFPms0boE49RyKbbVxvnkHhhbntnItE
    6PriqGcZMYieAJdB3VG2dm96r2ckf/N0g6vZrriwuuiGABj51TlSZgaJ+PLmxE4g
    pUYHFe4PFm9mvwVG++hFrCqMuyE/RZKmkvUoGElkEUDXFsYYV15+lAsd4FojO4pZ
    2g7UkL8Q7g/Kr5WyRKfYdes4rdhd2/yIH3tXGTgclUqCDFDsKj4+C4x0BwV3ReCp
    SzKAbxjAeoEqJFez41uYk9gsx2MDCpcqxSvgn55krxkCgYEA2PNRBkXJtkVc/igD
    SOIFWKiX+0yctKBZj062RR78uXCxZ5rSpRZL1VoAs7bFZKNRsXaMhAQOH/dHBFqq
    v+daZHY48pZg5t7YF3pxS2TaFAXIZ870H8qnM+JLwPqldiBiapp6dEbR0Hwky0rn
    c2eOhWa8FzO/a18F7LFpxo0rBdUCgYEA1Dc8jnc2Z6tMis6g9i8UIkPSGcfKPjAE
    rSxKvX9K0L3zcoXw3b4bsoiG0ROmTAZ8QVxnxjKNZPSCv4fMOpXMnGEu6/Gi7ofk
    DuXhPqj2Nu3GLLBhmEOOiYz6qgU5m7Hu2D7rj/4YZQL3VK5oP2R5JUDve4zI5GXP
    Kp2rXBjFMcMCgYEA0mBH/rwn2Q80GOU2IjPCmXGLR03IW8NudXAPgcGFslEcRuo0
    P4/6Y15OdfbTPT6+FkduBQplpAvGmutMzqCK4AZgPKUkPFx10XaTbFfUvTvKVRez
    VSzPrJlRekXTs1O9+7/m5OBTz0bC6zusaxVNeADifeFZSsYvWZHEj5wOzy0CgYBA
    Ul2wcMG0ul8A05BGDg70M8pCtiO+pZ9FPd+JgEOU8X4QgDh5fV23x1nVlTcaY/zV
    csShdkEVEGdw1iA4wZ6651npedwAoH+nZFXZQC0giQFAGlX6aL+TQX/YeKz1XAEg
    2jFb+5A5TaTZreM7E6EEgaIUuJ9LWvBn4lJGH9vlMQKBgB9SGeF32EPSzl/M8FOF
    /+5k1QKKB+a0sqYhUKYrf2cAhBk67516jPRUDQAEcuXOkuZi6wb5sHrQvWCJHzVJ
    Ddzr5HHGX+PNRkt/tx+tnV74i0IAJJlhgqizuVtrOSaz3DEKH03d/4K9CJDPODpp
    esf1sUXCyOs6hvJguTFB3hvI
    -----END PRIVATE KEY-----
  client_cacert_content: |
    -----BEGIN CERTIFICATE-----
    MIIEgjCCA2qgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjDELMAkGA1UEBhMCVVMx
    EzARBgNVBAgTCkNhbGlmb3JuaWExEjAQBgNVBAcTCVN1bm55dmFsZTEMMAoGA1UE
    ChMDSFBFMQ8wDQYDVQQLEwZBdGFsbGExFDASBgNVBAMTC3Z0ZXNrbS1rbWlwMR8w
    HQYJKoZIhvcNAQkBFhB0ZXN0QGV4YW1wbGUuY29tMB4XDTE2MDIwMjIyMjAwOVoX
    DTI2MDEzMTIyMjAwOVowgYwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9y
    bmlhMRIwEAYDVQQHEwlTdW5ueXZhbGUxDDAKBgNVBAoTA0hQRTEPMA0GA1UECxMG
    QXRhbGxhMRQwEgYDVQQDEwt2dGVza20ta21pcDEfMB0GCSqGSIb3DQEJARYQdGVz
    dEBleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM0P
    whdtq7KTFjD5RSeb8aOR3M4su9sO4iwXHkeXgQ3lEzDK9bdT+E5d/jhjmhmVafkL
    S6hdvKlf5lTaQ3INZrLCERj1n+valARbdlloRmKAm1s8BaZatPATuEvGJz1tnMpF
    y8eUO88kQMDam17HKfeAxU+G50P7NodnjFMv/6nLpKAYBi6ERHO8rdhLoYSqDahH
    Tlp9xcxhFBunMMkM06w8u8htoXDfA9vW8G/EeymZj0fRVJV2E1VkdasJ7ncK20d2
    9cCFy2tfJ5sZlHPy6UBGcsgzytJx/bnzniBCBCv+MZWqBTfioTZCs+ufYASh8DPG
    AaCJlEgN7uY2Zv3FBNsCAwEAAaOB7DCB6TAdBgNVHQ4EFgQU8JpCrRunXm9ht2Zd
    90XHLMIrY0swgbkGA1UdIwSBsTCBroAU8JpCrRunXm9ht2Zd90XHLMIrY0uhgZKk
    gY8wgYwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRIwEAYDVQQH
    EwlTdW5ueXZhbGUxDDAKBgNVBAoTA0hQRTEPMA0GA1UECxMGQXRhbGxhMRQwEgYD
    VQQDEwt2dGVza20ta21pcDEfMB0GCSqGSIb3DQEJARYQdGVzdEBleGFtcGxlLmNv
    bYIBADAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQASJDJCRZcIvwr0
    L0GUuTf5eR4Z1i8AUvs8j2JB7xz+DOukBL7Ty9qQr1hFnq6ArNFa3c//oBwCLzlF
    eHr5Jz80u2MnR6xO/jBRI58j7jqednFEEkH8L5VGtbT4AZLqMwuJxLDHHpHZ5gef
    3FzAeP3frE7ALLJH4LFuL95hJ1GlNf0S6axJyZ5jKIbOic6r57/BWD5Fjr0GTw1L
    NckGzGjtiHqAZ5kmx19PzYwpV682hd5m9np6gvIfFRIwswlLwOL00qqQ7fkJnrIM
    Dh9ICkgZ3SZZxxyiQ8UV/SDta2P7FVDmRdRsV4B3OI/Z5zcqgZlm+Z3F1q5WvkqU
    Sc8quzS0
    -----END CERTIFICATE-----
07070100EA231F000081A4000003E800000064000000015B730CE200000657000001030000000400000000000000000000006600000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/files/samples/ardana/sample_pkcs11_ca.pem-----BEGIN CERTIFICATE-----
MIIEgjCCA2qgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBjDELMAkGA1UEBhMCVVMx
EzARBgNVBAgTCkNhbGlmb3JuaWExEjAQBgNVBAcTCVN1bm55dmFsZTEMMAoGA1UE
ChMDSFBFMQ8wDQYDVQQLEwZBdGFsbGExFDASBgNVBAMTC3Z0ZXNrbS1rbWlwMR8w
HQYJKoZIhvcNAQkBFhB0ZXN0QGV4YW1wbGUuY29tMB4XDTE2MDIwMjIyMjAwOVoX
DTI2MDEzMTIyMjAwOVowgYwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9y
bmlhMRIwEAYDVQQHEwlTdW5ueXZhbGUxDDAKBgNVBAoTA0hQRTEPMA0GA1UECxMG
QXRhbGxhMRQwEgYDVQQDEwt2dGVza20ta21pcDEfMB0GCSqGSIb3DQEJARYQdGVz
dEBleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM0P
whdtq7KTFjD5RSeb8aOR3M4su9sO4iwXHkeXgQ3lEzDK9bdT+E5d/jhjmhmVafkL
S6hdvKlf5lTaQ3INZrLCERj1n+valARbdlloRmKAm1s8BaZatPATuEvGJz1tnMpF
y8eUO88kQMDam17HKfeAxU+G50P7NodnjFMv/6nLpKAYBi6ERHO8rdhLoYSqDahH
Tlp9xcxhFBunMMkM06w8u8htoXDfA9vW8G/EeymZj0fRVJV2E1VkdasJ7ncK20d2
9cCFy2tfJ5sZlHPy6UBGcsgzytJx/bnzniBCBCv+MZWqBTfioTZCs+ufYASh8DPG
AaCJlEgN7uY2Zv3FBNsCAwEAAaOB7DCB6TAdBgNVHQ4EFgQU8JpCrRunXm9ht2Zd
90XHLMIrY0swgbkGA1UdIwSBsTCBroAU8JpCrRunXm9ht2Zd90XHLMIrY0uhgZKk
gY8wgYwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRIwEAYDVQQH
EwlTdW5ueXZhbGUxDDAKBgNVBAoTA0hQRTEPMA0GA1UECxMGQXRhbGxhMRQwEgYD
VQQDEwt2dGVza20ta21pcDEfMB0GCSqGSIb3DQEJARYQdGVzdEBleGFtcGxlLmNv
bYIBADAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQASJDJCRZcIvwr0
L0GUuTf5eR4Z1i8AUvs8j2JB7xz+DOukBL7Ty9qQr1hFnq6ArNFa3c//oBwCLzlF
eHr5Jz80u2MnR6xO/jBRI58j7jqednFEEkH8L5VGtbT4AZLqMwuJxLDHHpHZ5gef
3FzAeP3frE7ALLJH4LFuL95hJ1GlNf0S6axJyZ5jKIbOic6r57/BWD5Fjr0GTw1L
NckGzGjtiHqAZ5kmx19PzYwpV682hd5m9np6gvIfFRIwswlLwOL00qqQ7fkJnrIM
Dh9ICkgZ3SZZxxyiQ8UV/SDta2P7FVDmRdRsV4B3OI/Z5zcqgZlm+Z3F1q5WvkqU
Sc8quzS0
-----END CERTIFICATE-----
07070100EA2320000081A4000003E800000064000000015B730CE20000054F000001030000000400000000000000000000006A00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/files/samples/ardana/sample_pkcs11_client.pem-----BEGIN CERTIFICATE-----
MIIDvzCCAqegAwIBAgIBHTANBgkqhkiG9w0BAQsFADCBjDELMAkGA1UEBhMCVVMx
EzARBgNVBAgTCkNhbGlmb3JuaWExEjAQBgNVBAcTCVN1bm55dmFsZTEMMAoGA1UE
ChMDSFBFMQ8wDQYDVQQLEwZBdGFsbGExFDASBgNVBAMTC3Z0ZXNrbS1rbWlwMR8w
HQYJKoZIhvcNAQkBFhB0ZXN0QGV4YW1wbGUuY29tMB4XDTE2MDUwODIzMDYyNFoX
DTI2MDEzMTIzMDYyNFowgZYxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTESMBAG
A1UEBwwJU3Vubnl2YWxlMQwwCgYDVQQKDANIUEUxFzAVBgNVBAsMDkNsb3VkIFNl
cnZpY2VzMR0wGwYDVQQDDBRob3M0X2JhcmJpY2FuX3BrY3MxMTEgMB4GCSqGSIb3
DQEJARYRYXJ1bi5rYW50QGhwZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQCz2E6xXR+o9alGz+GsWh1eCs1CUQsQWOFgbSwWNDv8xNZRBVuKVirS
scx3D+ziI6UbB4rOsRfX8ib5ICQXskaMScyVOm3oQo6YDuOMAM0C3Bal2C00q8Dv
5JAiEt7rOV4dg4bKtZbV+nQiumFduecbrBQ05hYs/bY8Lfh3v6AF0zLqY4dG/zA2
oYPXQCPV/jV3lGrlwXn/U1nWD2AcIRjq+anf7V4iUdsuaybzfcVIw0GEPg2Fhsgk
IxKPOFE1hGOTcygk0ATdxdCUtHuQVLkpA2neTPcEMTFitJMn0yhncOxjWiON0CKe
UGzBoBfdl7r/gA2UxdtQe0FlnXY4zDY/AgMBAAGjIDAeMAkGA1UdEwQCMAAwEQYJ
YIZIAYb4QgEBBAQDAgeAMA0GCSqGSIb3DQEBCwUAA4IBAQDFUham8kfqkJwCGJpY
QqGd4MtOxUAj+OevNkZjEdnJd7SXQFKNwCNxw231XRuk0w6otuzOv+PniwLhy2IS
HowPaKtDmzncfwp01p5U/+E062bjEqlCN7N4dNoSjUuveoEwROI5Opo/wfLhKOuw
InUz14Le6VyJ9PdcLZmKWpnYQRytiPcNadIwt19fxja7CBJ+bX/NSdX/b1/fMeN9
8xmOn0ruoKdfD4cx/fVmMc+cV49elRKObaIaBgSQTWvjQIx8RWVPdMbQST36SlHK
3YLCDn/97rSkOUGAz7ZGJXJGACzHsM9o1cix6y8rKco+kqGvqkBAJZoIByg0ER07
CM0u
-----END CERTIFICATE-----
07070100EA231E000081A4000003E800000064000000015B730CE2000006A8000001030000000400000000000000000000007500000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/files/samples/ardana/sample_pkcs11_client_privateKey.pem-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCz2E6xXR+o9alG
z+GsWh1eCs1CUQsQWOFgbSwWNDv8xNZRBVuKVirSscx3D+ziI6UbB4rOsRfX8ib5
ICQXskaMScyVOm3oQo6YDuOMAM0C3Bal2C00q8Dv5JAiEt7rOV4dg4bKtZbV+nQi
umFduecbrBQ05hYs/bY8Lfh3v6AF0zLqY4dG/zA2oYPXQCPV/jV3lGrlwXn/U1nW
D2AcIRjq+anf7V4iUdsuaybzfcVIw0GEPg2FhsgkIxKPOFE1hGOTcygk0ATdxdCU
tHuQVLkpA2neTPcEMTFitJMn0yhncOxjWiON0CKeUGzBoBfdl7r/gA2UxdtQe0Fl
nXY4zDY/AgMBAAECggEBAKqY2nTmiDzG4483bLQIO2lUx8ZLiDo2hXvps3NQk0LA
GSh784yzFiYM4I5kfek5tMmCCwrr9Fk07AFPms0boE49RyKbbVxvnkHhhbntnItE
6PriqGcZMYieAJdB3VG2dm96r2ckf/N0g6vZrriwuuiGABj51TlSZgaJ+PLmxE4g
pUYHFe4PFm9mvwVG++hFrCqMuyE/RZKmkvUoGElkEUDXFsYYV15+lAsd4FojO4pZ
2g7UkL8Q7g/Kr5WyRKfYdes4rdhd2/yIH3tXGTgclUqCDFDsKj4+C4x0BwV3ReCp
SzKAbxjAeoEqJFez41uYk9gsx2MDCpcqxSvgn55krxkCgYEA2PNRBkXJtkVc/igD
SOIFWKiX+0yctKBZj062RR78uXCxZ5rSpRZL1VoAs7bFZKNRsXaMhAQOH/dHBFqq
v+daZHY48pZg5t7YF3pxS2TaFAXIZ870H8qnM+JLwPqldiBiapp6dEbR0Hwky0rn
c2eOhWa8FzO/a18F7LFpxo0rBdUCgYEA1Dc8jnc2Z6tMis6g9i8UIkPSGcfKPjAE
rSxKvX9K0L3zcoXw3b4bsoiG0ROmTAZ8QVxnxjKNZPSCv4fMOpXMnGEu6/Gi7ofk
DuXhPqj2Nu3GLLBhmEOOiYz6qgU5m7Hu2D7rj/4YZQL3VK5oP2R5JUDve4zI5GXP
Kp2rXBjFMcMCgYEA0mBH/rwn2Q80GOU2IjPCmXGLR03IW8NudXAPgcGFslEcRuo0
P4/6Y15OdfbTPT6+FkduBQplpAvGmutMzqCK4AZgPKUkPFx10XaTbFfUvTvKVRez
VSzPrJlRekXTs1O9+7/m5OBTz0bC6zusaxVNeADifeFZSsYvWZHEj5wOzy0CgYBA
Ul2wcMG0ul8A05BGDg70M8pCtiO+pZ9FPd+JgEOU8X4QgDh5fV23x1nVlTcaY/zV
csShdkEVEGdw1iA4wZ6651npedwAoH+nZFXZQC0giQFAGlX6aL+TQX/YeKz1XAEg
2jFb+5A5TaTZreM7E6EEgaIUuJ9LWvBn4lJGH9vlMQKBgB9SGeF32EPSzl/M8FOF
/+5k1QKKB+a0sqYhUKYrf2cAhBk67516jPRUDQAEcuXOkuZi6wb5sHrQvWCJHzVJ
Ddzr5HHGX+PNRkt/tx+tnV74i0IAJJlhgqizuVtrOSaz3DEKH03d/4K9CJDPODpp
esf1sUXCyOs6hvJguTFB3hvI
-----END PRIVATE KEY-----
07070100E81994000081A4000003E800000064000000015B730CE200001886000001030000000400000000000000000000007100000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/files/samples/barbican_kmip_plugin_config_sample.yml#
# (c) Copyright 2015 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

barbican_kmip_plugin_conf:

# Either use file path to provide client certificate details or add cert
  # content directly in related content variables defined below.

# Following are samples which customer needs to replace with their
  # own content here or via file path approach mentioned above.
  client_cert_content: |
    -----BEGIN CERTIFICATE-----
    MIID0jCCArqgAwIBAgICAKQwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
    MQswCQYDVQQIEwJDTzEUMBIGA1UEBxMLRnQuIENvbGxpbnMxGDAWBgNVBAoTD0hl
    d2xldHQgUGFja2FyZDEMMAoGA1UECxMDQ1RMMRYwFAYDVQQDFA1LTUlQX0xvY2Fs
    X0NBMSIwIAYJKoZIhvcNAQkBFhNkYW4uYXNoYmF1Z2hAaHAuY29tMB4XDTE1MDkx
    NjA3MjIyMVoXDTI0MDEyNTA3MjIyMVowgaAxCzAJBgNVBAYTAlVTMQswCQYDVQQI
    DAJDQTESMBAGA1UEBwwJU3Vubnl2YWxlMSMwIQYDVQQKDBpIZXdsZXR0IFBhY2th
    cmQgRW50ZXJwcmlzZTESMBAGA1UECwwJSFBFIENsb3VkMRUwEwYDVQQDDAxobG1f
    YmFyYmljYW4xIDAeBgkqhkiG9w0BCQEWEWFydW4ua2FudEBocGUuY29tMIIBIjAN
    BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArjYVZzdsSMsk520UD1E94jl0/AZG
    LlsAB152dEP5E9C3mXzQZYvfApMh8PFc53gZwLBCb4joy1r8mZj/e7CwCUuo1cJH
    R9xnhwdK3RLeRbU3dfW838++5Kc1nW8ofLtCwQ6tD1Ye2SDWKQmfvk3ocX/o81ff
    s8chvPpBH9N3nU/p5+f7bNuQBG7Uj2/JTExuqMAwWmdBZz1OCGFaJRF0DEd9WJzL
    Hdaf83ZknyKREb7CETDmxBRST4KLfLZYpLb9MWjmCgotoX3nTuEh9LhhLIdy1jKd
    7KI1MJSisLYwINLaqtpEeZcPehCHthdd4y29ZMUmhh8MRihwfW1a4HGUOQIDAQAB
    oyAwHjAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIHgDANBgkqhkiG9w0BAQsF
    AAOCAQEArRJa3dypsHD7JYxvT9nlB0FzRAmLrdfMaC8UD4UxHDfBZK1QDEc6IOyA
    0jpAmHTt7MoJN7f3MzX1M4Iu5tyUHNq1KWjtwHwEX7FrTm6G7ZOxhPiPim4BClFd
    FLoX/jlWyjzl5tjj10+26x5IuUtC+U5JUzEBY3j/q+lAO+Og2MTiJVnWm03ilsXt
    biRskNJZVtvbU71lF27Oy5rpPwhTcJ4EgRsMp7GmnlYdaT4/yRFLIBpWrtB3kooG
    Gyr8ICB8HJSWpM340f/YGIeLkoXGAWyqrxykH+fMnyCs7ctjH5B24u4y5En4q3gW
    L7x0qB6Zaf3IBkOZqf5bMfAQoKfxww==
    -----END CERTIFICATE-----
  client_key_content: |
    -----BEGIN RSA PRIVATE KEY-----
    MIIEowIBAAKCAQEArjYVZzdsSMsk520UD1E94jl0/AZGLlsAB152dEP5E9C3mXzQ
    ZYvfApMh8PFc53gZwLBCb4joy1r8mZj/e7CwCUuo1cJHR9xnhwdK3RLeRbU3dfW8
    38++5Kc1nW8ofLtCwQ6tD1Ye2SDWKQmfvk3ocX/o81ffs8chvPpBH9N3nU/p5+f7
    bNuQBG7Uj2/JTExuqMAwWmdBZz1OCGFaJRF0DEd9WJzLHdaf83ZknyKREb7CETDm
    xBRST4KLfLZYpLb9MWjmCgotoX3nTuEh9LhhLIdy1jKd7KI1MJSisLYwINLaqtpE
    eZcPehCHthdd4y29ZMUmhh8MRihwfW1a4HGUOQIDAQABAoIBAA2CUCKS36i9Z/0y
    Li4J5LyYLAQnEGYj1Fq97n2Rj80DkFksnpRhRkfS1Pz0Gnowi/6vLFetzC+IvLHE
    dXtH9j6iSVNaH2DpLHYCEMIX5niNVuGkzqKkX28nsDanGgKiGskRtEXOLdI0g6bn
    AiYlsHKssom8NLKiLHGVDlvDcDEYkpA2WXXFvfUtI3Twu6o/T/Pf3ytcTPpa8yvG
    K2eR+Wr6HJ6Wc7rELaNFSqcDWRqRPG8bI5bUucDOxmOZac6j5ZsrpVgnZDHO78NX
    bnrHwXzS1Hm8oT6tFQTUbzjSJb7EbgS8JXdW4zWTd3zDdkq7rX2CNSGfzAz3wSl2
    KkKSfqkCgYEA02MnqDmsUDkm6lYVva+WomMgyZvfOYDhca10tP5rBAXaZGP764tn
    PhD5KTyvOZrgBhLbsGZZVlQEwg8EKiS9vAj/POZqIs2wdH6nAni1FTRCQ2gScty0
    IgS9iIYbO31FNbfGxqNDSbLDQGpzZ8U+b12YjhhCS45e/Twvm3AeyiMCgYEA0vpg
    7vMmMgvOFDtbbOKUcLu1NgViO8B7N5idf6+Y/QYlydVXtujH0Yp9VisKDew5W1vy
    8sQTAibJSY+OpchTT4LSNf6dGmIAWQIJeIjlkAvMoCNqeHiw77ZlWvwXc4jydAc3
    pl0cIdaupeLQo+WeSthXe1JPuOv76xVZXeC4R/MCgYBdQTENlePewFfaqX+N3xil
    KvYb+xfPVnwemlcSQesUK0DdaP6KO0Wgq/w/pPXog9qw00D34S8oVoiC0/0SWoMZ
    oR54z22jTPq7aeRjwrygTh2tfwwkgBk3qL+0qvT4mZsex6R5nSziJmrc0Bl5fhq9
    Jp1Wkn0st/JP5W1bNWtf4QKBgEqt8e3jB5wjbZjfweby9RRKfURX94OrCHKPhQCT
    iZXWvT2KVPgbwc88NE1yAqcW/N6H16FzIj9at1lghV/NXx//8KTIMZgLJJBdFjki
    TBAG/TGaF6/5GLhhWdMw9KQiz5+ehmZPAww/T6bMeInrV3KqzZyLcEjGz29RKUb/
    qntdAoGBANMBU9yDbQgvDSCor24DJ/gnXRPuF3W7VlnzCbu8twRK9JZJplD+jS58
    98DmYxBio8+wQWQdiAPRRthtnvhSWL67oYACPwvWUJJ+D18HfpWCEgCmBU3a8ZHc
    AaW8rRXtMZzuujGgAbA1hpf5z1lHuiG/X7/XMDVGiRALMyBbHV57
    -----END RSA PRIVATE KEY-----
  client_cacert_content: |
    -----BEGIN CERTIFICATE-----
    MIIEmjCCA4KgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBlDELMAkGA1UEBhMCVVMx
    CzAJBgNVBAgTAkNPMRQwEgYDVQQHEwtGdC4gQ29sbGluczEYMBYGA1UEChMPSGV3
    bGV0dCBQYWNrYXJkMQwwCgYDVQQLEwNDVEwxFjAUBgNVBAMUDUtNSVBfTG9jYWxf
    Q0ExIjAgBgkqhkiG9w0BCQEWE2Rhbi5hc2hiYXVnaEBocC5jb20wHhcNMTQwMTI2
    MTcwOTU4WhcNMjQwMTI1MTcwOTU4WjCBlDELMAkGA1UEBhMCVVMxCzAJBgNVBAgT
    AkNPMRQwEgYDVQQHEwtGdC4gQ29sbGluczEYMBYGA1UEChMPSGV3bGV0dCBQYWNr
    YXJkMQwwCgYDVQQLEwNDVEwxFjAUBgNVBAMUDUtNSVBfTG9jYWxfQ0ExIjAgBgkq
    hkiG9w0BCQEWE2Rhbi5hc2hiYXVnaEBocC5jb20wggEiMA0GCSqGSIb3DQEBAQUA
    A4IBDwAwggEKAoIBAQDvEv7rJQRKYddVZePjqVlEJDFq4UVfV7CUXaTs/fxQcRhF
    BJ2cof90EhcbSeA/YFolIJjQLwKzg53zNryCIW4TKqS5Y6nvALxI3Y3tak2Vp9Gy
    PXOfn4Bz0Z2o0E1u4tXvXtuAFBGs760vC6u5KbAgy/xjeO6kpVZCK5KGH7hJ4sBC
    J8b6UOir9m4lAg4K9Yia57uyJkt9LBDWhclv5DOF8LLvLjDca9eXocbDoulUhs94
    QugbUB0GYEdLPtMYwZiIwvNsuIdn8NIAzW/SJ2AnnYZZqo9CHALdxJg0MCHpOKKA
    u8nDcZHAUJOkKUQgNtkFq2gx0N8uCJWqzkEQIaXlAgMBAAGjgfQwgfEwHQYDVR0O
    BBYEFPZqSMXT2ooyVvXZ01Fxe3OvPhafMIHBBgNVHSMEgbkwgbaAFPZqSMXT2ooy
    VvXZ01Fxe3OvPhafoYGapIGXMIGUMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ08x
    FDASBgNVBAcTC0Z0LiBDb2xsaW5zMRgwFgYDVQQKEw9IZXdsZXR0IFBhY2thcmQx
    DDAKBgNVBAsTA0NUTDEWMBQGA1UEAxQNS01JUF9Mb2NhbF9DQTEiMCAGCSqGSIb3
    DQEJARYTZGFuLmFzaGJhdWdoQGhwLmNvbYIBADAMBgNVHRMEBTADAQH/MA0GCSqG
    SIb3DQEBCwUAA4IBAQDOqlaGPXwq186iCXeI9QN9aVW+IZUXiBFdeXYd0F6My/vq
    pop7/R+4IbS3cBUo5hYkEVo6hk9IeKYCHrD7e1QbWfgCfRijhudwmCj80bQcAb+D
    Mu4N4SltOrhMTOl4VSjwdZyRJHSqf4FrgXAqGCfASKOGSyOXfr9qBSn/iqmRaUYm
    fFgsCh6/co2fozkRfgdsdR0MBp1FpV/dMXJqHHLSZB/P126GuYProQmbY0K1uQGU
    FAimEB/a2E+A0oxwuHmhMg0kOpDuXIWn4BW+Z6z5h1j3PFyg/CZ548Fz0XOgvXC7
    Ejpkd+5R+24HloruUV1R2EYvmlr8UMFX80og11u+
    -----END CERTIFICATE-----
07070100E81995000081A4000003E800000064000000015B730CE200000677000001030000000400000000000000000000005D00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/files/samples/sample_kmip_ca.crt-----BEGIN CERTIFICATE-----
MIIEmjCCA4KgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBlDELMAkGA1UEBhMCVVMx
CzAJBgNVBAgTAkNPMRQwEgYDVQQHEwtGdC4gQ29sbGluczEYMBYGA1UEChMPSGV3
bGV0dCBQYWNrYXJkMQwwCgYDVQQLEwNDVEwxFjAUBgNVBAMUDUtNSVBfTG9jYWxf
Q0ExIjAgBgkqhkiG9w0BCQEWE2Rhbi5hc2hiYXVnaEBocC5jb20wHhcNMTQwMTI2
MTcwOTU4WhcNMjQwMTI1MTcwOTU4WjCBlDELMAkGA1UEBhMCVVMxCzAJBgNVBAgT
AkNPMRQwEgYDVQQHEwtGdC4gQ29sbGluczEYMBYGA1UEChMPSGV3bGV0dCBQYWNr
YXJkMQwwCgYDVQQLEwNDVEwxFjAUBgNVBAMUDUtNSVBfTG9jYWxfQ0ExIjAgBgkq
hkiG9w0BCQEWE2Rhbi5hc2hiYXVnaEBocC5jb20wggEiMA0GCSqGSIb3DQEBAQUA
A4IBDwAwggEKAoIBAQDvEv7rJQRKYddVZePjqVlEJDFq4UVfV7CUXaTs/fxQcRhF
BJ2cof90EhcbSeA/YFolIJjQLwKzg53zNryCIW4TKqS5Y6nvALxI3Y3tak2Vp9Gy
PXOfn4Bz0Z2o0E1u4tXvXtuAFBGs760vC6u5KbAgy/xjeO6kpVZCK5KGH7hJ4sBC
J8b6UOir9m4lAg4K9Yia57uyJkt9LBDWhclv5DOF8LLvLjDca9eXocbDoulUhs94
QugbUB0GYEdLPtMYwZiIwvNsuIdn8NIAzW/SJ2AnnYZZqo9CHALdxJg0MCHpOKKA
u8nDcZHAUJOkKUQgNtkFq2gx0N8uCJWqzkEQIaXlAgMBAAGjgfQwgfEwHQYDVR0O
BBYEFPZqSMXT2ooyVvXZ01Fxe3OvPhafMIHBBgNVHSMEgbkwgbaAFPZqSMXT2ooy
VvXZ01Fxe3OvPhafoYGapIGXMIGUMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ08x
FDASBgNVBAcTC0Z0LiBDb2xsaW5zMRgwFgYDVQQKEw9IZXdsZXR0IFBhY2thcmQx
DDAKBgNVBAsTA0NUTDEWMBQGA1UEAxQNS01JUF9Mb2NhbF9DQTEiMCAGCSqGSIb3
DQEJARYTZGFuLmFzaGJhdWdoQGhwLmNvbYIBADAMBgNVHRMEBTADAQH/MA0GCSqG
SIb3DQEBCwUAA4IBAQDOqlaGPXwq186iCXeI9QN9aVW+IZUXiBFdeXYd0F6My/vq
pop7/R+4IbS3cBUo5hYkEVo6hk9IeKYCHrD7e1QbWfgCfRijhudwmCj80bQcAb+D
Mu4N4SltOrhMTOl4VSjwdZyRJHSqf4FrgXAqGCfASKOGSyOXfr9qBSn/iqmRaUYm
fFgsCh6/co2fozkRfgdsdR0MBp1FpV/dMXJqHHLSZB/P126GuYProQmbY0K1uQGU
FAimEB/a2E+A0oxwuHmhMg0kOpDuXIWn4BW+Z6z5h1j3PFyg/CZ548Fz0XOgvXC7
Ejpkd+5R+24HloruUV1R2EYvmlr8UMFX80og11u+
-----END CERTIFICATE-----
07070100E81992000081A4000003E800000064000000015B730CE20000056A000001030000000400000000000000000000006100000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/files/samples/sample_kmip_client.crt-----BEGIN CERTIFICATE-----
MIID0jCCArqgAwIBAgICAKQwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
MQswCQYDVQQIEwJDTzEUMBIGA1UEBxMLRnQuIENvbGxpbnMxGDAWBgNVBAoTD0hl
d2xldHQgUGFja2FyZDEMMAoGA1UECxMDQ1RMMRYwFAYDVQQDFA1LTUlQX0xvY2Fs
X0NBMSIwIAYJKoZIhvcNAQkBFhNkYW4uYXNoYmF1Z2hAaHAuY29tMB4XDTE1MDkx
NjA3MjIyMVoXDTI0MDEyNTA3MjIyMVowgaAxCzAJBgNVBAYTAlVTMQswCQYDVQQI
DAJDQTESMBAGA1UEBwwJU3Vubnl2YWxlMSMwIQYDVQQKDBpIZXdsZXR0IFBhY2th
cmQgRW50ZXJwcmlzZTESMBAGA1UECwwJSFBFIENsb3VkMRUwEwYDVQQDDAxobG1f
YmFyYmljYW4xIDAeBgkqhkiG9w0BCQEWEWFydW4ua2FudEBocGUuY29tMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArjYVZzdsSMsk520UD1E94jl0/AZG
LlsAB152dEP5E9C3mXzQZYvfApMh8PFc53gZwLBCb4joy1r8mZj/e7CwCUuo1cJH
R9xnhwdK3RLeRbU3dfW838++5Kc1nW8ofLtCwQ6tD1Ye2SDWKQmfvk3ocX/o81ff
s8chvPpBH9N3nU/p5+f7bNuQBG7Uj2/JTExuqMAwWmdBZz1OCGFaJRF0DEd9WJzL
Hdaf83ZknyKREb7CETDmxBRST4KLfLZYpLb9MWjmCgotoX3nTuEh9LhhLIdy1jKd
7KI1MJSisLYwINLaqtpEeZcPehCHthdd4y29ZMUmhh8MRihwfW1a4HGUOQIDAQAB
oyAwHjAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIHgDANBgkqhkiG9w0BAQsF
AAOCAQEArRJa3dypsHD7JYxvT9nlB0FzRAmLrdfMaC8UD4UxHDfBZK1QDEc6IOyA
0jpAmHTt7MoJN7f3MzX1M4Iu5tyUHNq1KWjtwHwEX7FrTm6G7ZOxhPiPim4BClFd
FLoX/jlWyjzl5tjj10+26x5IuUtC+U5JUzEBY3j/q+lAO+Og2MTiJVnWm03ilsXt
biRskNJZVtvbU71lF27Oy5rpPwhTcJ4EgRsMp7GmnlYdaT4/yRFLIBpWrtB3kooG
Gyr8ICB8HJSWpM340f/YGIeLkoXGAWyqrxykH+fMnyCs7ctjH5B24u4y5En4q3gW
L7x0qB6Zaf3IBkOZqf5bMfAQoKfxww==
-----END CERTIFICATE-----07070100E81993000081A4000003E800000064000000015B730CE20000068B000001030000000400000000000000000000006100000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/files/samples/sample_kmip_client.key-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEArjYVZzdsSMsk520UD1E94jl0/AZGLlsAB152dEP5E9C3mXzQ
ZYvfApMh8PFc53gZwLBCb4joy1r8mZj/e7CwCUuo1cJHR9xnhwdK3RLeRbU3dfW8
38++5Kc1nW8ofLtCwQ6tD1Ye2SDWKQmfvk3ocX/o81ffs8chvPpBH9N3nU/p5+f7
bNuQBG7Uj2/JTExuqMAwWmdBZz1OCGFaJRF0DEd9WJzLHdaf83ZknyKREb7CETDm
xBRST4KLfLZYpLb9MWjmCgotoX3nTuEh9LhhLIdy1jKd7KI1MJSisLYwINLaqtpE
eZcPehCHthdd4y29ZMUmhh8MRihwfW1a4HGUOQIDAQABAoIBAA2CUCKS36i9Z/0y
Li4J5LyYLAQnEGYj1Fq97n2Rj80DkFksnpRhRkfS1Pz0Gnowi/6vLFetzC+IvLHE
dXtH9j6iSVNaH2DpLHYCEMIX5niNVuGkzqKkX28nsDanGgKiGskRtEXOLdI0g6bn
AiYlsHKssom8NLKiLHGVDlvDcDEYkpA2WXXFvfUtI3Twu6o/T/Pf3ytcTPpa8yvG
K2eR+Wr6HJ6Wc7rELaNFSqcDWRqRPG8bI5bUucDOxmOZac6j5ZsrpVgnZDHO78NX
bnrHwXzS1Hm8oT6tFQTUbzjSJb7EbgS8JXdW4zWTd3zDdkq7rX2CNSGfzAz3wSl2
KkKSfqkCgYEA02MnqDmsUDkm6lYVva+WomMgyZvfOYDhca10tP5rBAXaZGP764tn
PhD5KTyvOZrgBhLbsGZZVlQEwg8EKiS9vAj/POZqIs2wdH6nAni1FTRCQ2gScty0
IgS9iIYbO31FNbfGxqNDSbLDQGpzZ8U+b12YjhhCS45e/Twvm3AeyiMCgYEA0vpg
7vMmMgvOFDtbbOKUcLu1NgViO8B7N5idf6+Y/QYlydVXtujH0Yp9VisKDew5W1vy
8sQTAibJSY+OpchTT4LSNf6dGmIAWQIJeIjlkAvMoCNqeHiw77ZlWvwXc4jydAc3
pl0cIdaupeLQo+WeSthXe1JPuOv76xVZXeC4R/MCgYBdQTENlePewFfaqX+N3xil
KvYb+xfPVnwemlcSQesUK0DdaP6KO0Wgq/w/pPXog9qw00D34S8oVoiC0/0SWoMZ
oR54z22jTPq7aeRjwrygTh2tfwwkgBk3qL+0qvT4mZsex6R5nSziJmrc0Bl5fhq9
Jp1Wkn0st/JP5W1bNWtf4QKBgEqt8e3jB5wjbZjfweby9RRKfURX94OrCHKPhQCT
iZXWvT2KVPgbwc88NE1yAqcW/N6H16FzIj9at1lghV/NXx//8KTIMZgLJJBdFjki
TBAG/TGaF6/5GLhhWdMw9KQiz5+ehmZPAww/T6bMeInrV3KqzZyLcEjGz29RKUb/
qntdAoGBANMBU9yDbQgvDSCor24DJ/gnXRPuF3W7VlnzCbu8twRK9JZJplD+jS58
98DmYxBio8+wQWQdiAPRRthtnvhSWL67oYACPwvWUJJ+D18HfpWCEgCmBU3a8ZHc
AaW8rRXtMZzuujGgAbA1hpf5z1lHuiG/X7/XMDVGiRALMyBbHV57
-----END RSA PRIVATE KEY-----
07070100E8197D000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004500000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/handlers07070100E8197E000081A4000003E800000064000000015B730CE200000371000001030000000400000000000000000000004E00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/handlers/main.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

# Handlers for Barbican

- name: restart barbican
  service:
    name: barbican
    state: restarted
    sleep: 20

# Handlers for Babrican API

- name: barbican_api_config_change
  set_fact:
    barbican_api_restart_required: True
07070100E8197F000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004100000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/meta07070100E81980000081A4000003E800000064000000015B730CE2000002C3000001030000000400000000000000000000004A00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/meta/main.yml#
# (c) Copyright 2015 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017-2018 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

dependencies:
  - role: barbican-common
  - role: FND-AP2
07070100EA2322000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004200000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks07070100EA2328000081A4000003E800000064000000015B730CE200000846000001030000000400000000000000000000005A00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks/_configure_auditing.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- name: KEYMGR-API | _configure_auditing | echo barbican auditing enable flag
  debug:
    msg: "barbican_api_audit_enable = {{ barbican_api_audit_enable }}"
  tags:
    - barbican
    - barbican_debug
  when: barbican_debug is defined

- name: KEYMGR-API | _configure_auditing  |
    Set notification_driver, audit_filter facts when audit enabled
  set_fact:
    audit_filter: "audit"
    notification_driver_name: "log"
  when: barbican_api_audit_enable | bool
  tags:
    - barbican

- name: KEYMGR-API | _configure_auditing  |
    Set notification_driver, audit_filter facts when audit disabled
  set_fact:
    audit_filter: ""
    notification_driver_name: "noop"
  when: barbican_api_audit_enable | bool == False
  tags:
    - barbican

- name: KEYMGR-API | _configure_auditing |
    Create auditing logging directory if not there
  file:
    path: "{{ barbican_audit_log_base_location }}/barbican"
    owner: "{{ barbican_user }}"
    group: "{{ barbican_group }}"
    mode: 0755
    state: directory
  become: yes
  when: barbican_api_audit_enable | bool
  tags:
    - barbican

- name: KEYMGR-API | _configure_auditing  | Touch the audit log file
  file:
    path: "{{ item }}"
    owner: "{{ barbican_user }}"
    group: "{{ barbican_centralized_log_group }}"
    mode: 0640
    state: touch
  become: yes
  with_items:
    - "{{ barbican_audit_log_base_location }}/barbican/barbican-audit.log"
  when: barbican_api_audit_enable | bool
  tags:
    - barbican
07070100EA232B000081A4000003E800000064000000015B730CE2000002D0000001030000000400000000000000000000006400000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks/_configure_deployment_options.yml#
# (c) Copyright 2015 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

# We are adding here once again to enable reconfiguration of process counts
07070100EA232C000081A4000003E800000064000000015B730CE20000061B000001030000000400000000000000000000005D00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks/_configure_kmip_plugin.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- name: KEYMGR-API | _configure_kmip_plugin |
    barbican use kmip plugin flag value
  debug:
    msg: "use_kmip_secretstore_plugin = {{ use_kmip_secretstore_plugin }}"
  when: barbican_debug is defined
  tags:
    - barbican

- name: KEYMGR-API | _configure_kmip_plugin |
    Configure secretstore to kmip plugin if enabled
  set_fact:
    barbican_secretstore_plugins: "kmip_plugin"
    barbican_enabled_crypto_plugins: "simple_crypto"
  when: use_kmip_secretstore_plugin
  tags:
    - barbican

- name: KEYMGR-API | _configure_kmip_plugin |
    Configure secretstore to store crypto if kmip plugin not enabled
  set_fact:
    barbican_kmip_username:
    barbican_kmip_password:
    barbican_kmip_host:
    barbican_kmip_port:
    barbican_kmip_client_key_path:
    barbican_kmip_client_cert_path:
    barbican_kmip_client_cacert_path:
  when: use_kmip_secretstore_plugin | bool == False
  tags:
    - barbican
07070100EA232E000081A4000003E800000064000000015B730CE200000F67000001030000000400000000000000000000006300000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks/_configure_kmip_plugin_certs.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

# Used primarily to pass kmip client cert certs from ansible control machine
# to nodes running barbican service.

- name: KEYMGR-API | _configure_kmip_plugin_certs |
    Display variables related to KMIP plugin settings
  debug:
    var: barbican_kmip_plugin_conf.client_cert_content
  when: barbican_debug is defined
  tags:
    - barbican

- name: KEYMGR-API | _configure_kmip_plugin_certs  |
    Identify client cert content from file if set
  set_fact:
    kmip_client_cert_content:
      "{{ lookup('file', barbican_kmip_plugin_conf.client_cert_file_path) }}"
  when:
    barbican_kmip_plugin_conf.client_cert_file_path is defined and
    barbican_kmip_plugin_conf.client_cert_file_path and
    barbican_kmip_plugin_conf.client_cert_file_path | trim != ''
  tags:
    - barbican

- name: KEYMGR-API | _configure_kmip_plugin_certs  |
    Read client cert content from variable when file content not provided
  set_fact:
    kmip_client_cert_content:
      "{{ barbican_kmip_plugin_conf.client_cert_content }}"
  when: kmip_client_cert_content is not defined
  tags:
    - barbican

- name: KEYMGR-API | _configure_kmip_plugin_certs  |
    Identify client key content from file if set
  set_fact:
    kmip_client_key_content:
      "{{ lookup('file', barbican_kmip_plugin_conf.client_key_file_path) }}"
  when:
    barbican_kmip_plugin_conf.client_key_file_path is defined and
    barbican_kmip_plugin_conf.client_key_file_path and
    barbican_kmip_plugin_conf.client_key_file_path | trim != ''
  tags:
    - barbican

- name: KEYMGR-API | _configure_kmip_plugin_certs  |
    Read client key content from variable when file content not provided
  set_fact:
    kmip_client_key_content:
      "{{ barbican_kmip_plugin_conf.client_key_content }}"
  when: kmip_client_key_content is not defined
  tags:
    - barbican

- name: KEYMGR-API | _configure_kmip_plugin_certs  |
    Identify client cacert content from file if set
  set_fact:
    kmip_client_cacert_content:
      "{{ lookup('file', barbican_kmip_plugin_conf.client_cacert_file_path) }}"
  when:
    barbican_kmip_plugin_conf.client_cacert_file_path is defined and
    barbican_kmip_plugin_conf.client_cacert_file_path and
    barbican_kmip_plugin_conf.client_cacert_file_path | trim != ''
  tags:
    - barbican

- name: KEYMGR-API | _configure_kmip_plugin_certs  |
    Read client cacert content from variable when file content not provided
  set_fact:
    kmip_client_cacert_content:
      "{{ barbican_kmip_plugin_conf.client_cacert_content }}"
  when: kmip_client_cacert_content is not defined
  tags:
    - barbican

- name: KEYMGR-API | _configure_kmip_plugin_certs  |
    Copy KMIP client certs file
  copy:
    content: "{{ item.content }}"
    dest: "{{ item.dest }}"
    owner: "{{ barbican_user }}"
    group: "{{ barbican_group }}"
    mode: 0400
  become: yes
  become_user: "{{ barbican_user }}"
  with_items:
    - { content: "{{ kmip_client_cert_content }}",
      dest: "{{ barbican_kmip_client_cert_path }}" }
    - { content: "{{ kmip_client_key_content }}",
      dest: "{{ barbican_kmip_client_key_path }}" }
    - { content: "{{ kmip_client_cacert_content }}",
      dest: "{{ barbican_kmip_client_cacert_path }}"}
  no_log: True
  register: ardana_notify_barbican_api_restart_required
  tags:
    - barbican
07070100EA2329000081A4000003E800000064000000015B730CE2000005FA000001030000000400000000000000000000005C00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks/_configure_master_key.yml#
# (c) Copyright 2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---
- name: KEYMGR-API | _configure_master_key |
    Use default master key if not yet initialized
  set_fact:
    barbican_simple_crypto_master_key:
      "{{ barbican_default_master_key }}"
  when:
    barbican_secretstore_plugins ==
    "store_crypto" and (barbican_simple_crypto_master_key == "None"
    or not barbican_simple_crypto_master_key)
  tags:
    - barbican

- name: KEYMGR-API | _configure_master_key |
    Set barbican_simple_crypto_master_key to None if KMIP is Configured
  set_fact:
    barbican_simple_crypto_master_key: "None"
  when: use_kmip_secretstore_plugin

- name: KEYMGR-API | _configure_master_key | Print existing master key values
  debug:
    msg: "barbican_simple_crypto_master_key =
    {{ barbican_simple_crypto_master_key }},
    barbican_customer_master_key: {{ barbican_customer_master_key }}"
  when: barbican_debug is defined
  tags:
    - barbican
07070100EA232A000081A4000003E800000064000000015B730CE200001ABA000001030000000400000000000000000000005F00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks/_configure_pkcs11_plugin.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- name: KEYMGR-API | _configure_pkcs11_plugin |
    barbican use pkcs11 plugin flag value
  debug:
    msg: "use_pkcs11_crypto_plugin = {{ use_pkcs11_crypto_plugin }}"
  when: barbican_debug is defined
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin |
    Configure secretstore to pkcs11 plugin if enabled
  set_fact:
    barbican_secretstore_plugins: "store_crypto"
    barbican_enabled_crypto_plugins: "p11_crypto"
  when: use_pkcs11_crypto_plugin
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin |
    Configure pkcs11 settings to default if pkc11 plugin not enabled
  set_fact:
    barbican_pkcs11_session_password:
    barbican_pkcs11_mkek_label:
    barbican_pkcs11_hmac_label:
    barbican_pkcs11_library_path:
  when: use_pkcs11_crypto_plugin | bool == False
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin |
    Set library path on controller when ESKM pkcs11 connector flag is set
  set_fact:
    barbican_pkcs11_library_path:
      "{{ barbican_pkcs11_eskm_connector_library_path }}"
  when: barbican_pkcs11_provider_is_eskm | is_bool_true and
    barbican_pkcs11_library_path | is_str_set == False
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin |
    Install pkcs11 debian package on controller from third party repo
  apt:
    name: "{{ barbican_pkcs11_package_name }}"
    state: "present"
    force: yes
  become: yes
  when: barbican_pkcs11_package_name | is_str_set
  register: ardana_notify_barbican_api_restart_required
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin |
    Read stat for ESKM connector base path on controller
  stat:
    path: "{{ barbican_pkcs11_eskm_connector_base_path }}"
  become: yes
  when: barbican_pkcs11_eskm_generate_conf | is_bool_true
  register: barbican_pkcs11_eskm_connector_base_path_result
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin |
    Check stat for ESKM connector base path on controller
  fail:
    msg: "Missing ESKM pkcs11 connector at path
      '{{ barbican_pkcs11_eskm_connector_base_path }}'"
  when: barbican_pkcs11_eskm_connector_base_path_result is defined and
        barbican_pkcs11_eskm_connector_base_path_result.stat.exists == False
  tags:
    - barbican

- include: _configure_pkcs11_plugin_certs.yml
  when: barbican_pkcs11_plugin_conf is defined

- name: KEYMGR-API | _configure_pkcs11_plugin |
    Generate ESKM PKCS11 connector conf file
  shell: >
    {{ barbican_pkcs11_eskm_connector_base_path }}/bin/controlencryption
    --setserver={{ barbican_pkcs11_eskm_kmip_host }}
    --port={{ barbican_pkcs11_eskm_kmip_port }}
  args:
    chdir: "{{ barbican_pkcs11_eskm_connector_base_path }}/bin"
    executable: /bin/bash
  become: yes
  when: barbican_pkcs11_eskm_generate_conf | is_bool_true and
        barbican_pkcs11_eskm_kmip_host | is_str_set and
        barbican_pkcs11_eskm_kmip_port | is_str_set
  register: eskm_pkcs11_generate_conf_result
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin |
    Result for PKCS11 connector conf generation
  debug:
    msg: "eskm_pkcs11_generate_conf_result =
      {{ eskm_pkcs11_generate_conf_result }}"
  when: eskm_pkcs11_generate_conf_result is defined
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin |
    Update pkcs11 conf values in generated config.conf file
  lineinfile:
    dest: "{{ barbican_pkcs11_eskm_connector_base_path }}/conf/config.conf"
    regexp: "{{ item.regexp }}"
    line: "{{ item.value }}"
    state: "present"
  become: yes
  with_items:
    - { regexp: "^sessionObjectCleanup=true",
      value: "sessionObjectCleanup=false" }
    - { regexp: "^requireSignVerify=true",
      value: "requireSignVerify=false" }
  when: eskm_pkcs11_generate_conf_result | success

# In generate label ignore error case when provided mkek label already exists
# to keep generation behavior idempotent
- name: KEYMGR-API | _configure_pkcs11_plugin | Generate pkcs11 mkek label
  command: >
      {{ barbican_bin_dir }}/barbican-manage hsm gen_mkek
      --library-path {{ barbican_pkcs11_library_path }}
      --passphrase {{ barbican_pkcs11_session_password }}
      --slot-id {{ barbican_pkcs11_slot_id }}
      --label '{{ barbican_pkcs11_mkek_label }}'
  become: yes
  when: barbican_pkcs11_generate_labels | is_bool_true and
        barbican_pkcs11_library_path | is_str_set and
        barbican_pkcs11_session_password | is_str_set and
        barbican_pkcs11_mkek_label | is_str_set
  register: pkcs11_generate_mkek_label_result
  failed_when: (pkcs11_generate_mkek_label_result | failed and
    'already exists' not in pkcs11_generate_mkek_label_result.stdout)
  run_once: True
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin |
    Result for PKCS11 mkek label generation
  debug:
    msg: "pkcs11_generate_mkek_label_result =
      {{ pkcs11_generate_mkek_label_result }}"
  when: pkcs11_generate_mkek_label_result is defined
  tags:
    - barbican

# In generate label ignore error case when provided hmac label already exists
# to keep generation behavior idempotent
- name: KEYMGR-API | _configure_pkcs11_plugin | Generate pkcs11 hmac label
  command: >
      {{ barbican_bin_dir }}/barbican-manage hsm gen_hmac
      --library-path {{ barbican_pkcs11_library_path }}
      --passphrase {{ barbican_pkcs11_session_password }}
      --slot-id {{ barbican_pkcs11_slot_id }}
      --label '{{ barbican_pkcs11_hmac_label }}'
  become: yes
  when: barbican_pkcs11_generate_labels | is_bool_true and
        barbican_pkcs11_library_path | is_str_set and
        barbican_pkcs11_session_password | is_str_set and
        barbican_pkcs11_hmac_label | is_str_set
  register: pkcs11_generate_hmac_label_result
  failed_when: (pkcs11_generate_hmac_label_result | failed and
    'already exists' not in pkcs11_generate_hmac_label_result.stdout)
  run_once: True
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin |
    Result for PKCS11 hmac label generation
  debug:
    msg: "pkcs11_generate_hmac_label_result =
      {{ pkcs11_generate_hmac_label_result }}"
  when: pkcs11_generate_hmac_label_result is defined
  tags:
    - barbican
07070100EA2327000081A4000003E800000064000000015B730CE2000010E3000001030000000400000000000000000000006500000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks/_configure_pkcs11_plugin_certs.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

# Used primarily to pass pkcs11 client certificates from ansible control
# machine to nodes running barbican service.

- name: KEYMGR-API | _configure_pkcs11_plugin_certs |
    Display variables related to PKCS11 plugin settings
  debug: var=barbican_pkcs11_plugin_conf.client_cert_content
  when: barbican_debug is defined
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin_certs  |
    Identify client cert content from file if set
  set_fact:
    pkcs11_client_cert_content:
      "{{ lookup('file', barbican_pkcs11_plugin_conf.client_cert_file_path) }}"
  when: barbican_pkcs11_plugin_conf.client_cert_file_path | is_str_set
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin_certs  |
    Read client cert content from variable when file content not provided
  set_fact:
    pkcs11_client_cert_content:
      "{{ barbican_pkcs11_plugin_conf.client_cert_content }}"
  when: pkcs11_client_cert_content is not defined
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin_certs  |
    Identify client key content from file if set
  set_fact:
    pkcs11_client_key_content:
      "{{ lookup('file', barbican_pkcs11_plugin_conf.client_key_file_path) }}"
  when: barbican_pkcs11_plugin_conf.client_key_file_path | is_str_set
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin_certs  |
    Read client key content from variable when file content not provided
  set_fact:
    pkcs11_client_key_content:
      "{{ barbican_pkcs11_plugin_conf.client_key_content }}"
  when: pkcs11_client_key_content is not defined
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin_certs  |
    Identify client cacert content from file if set
  set_fact:
    pkcs11_client_cacert_content:
      "{{ lookup('file',
        barbican_pkcs11_plugin_conf.client_cacert_file_path) }}"
  when: barbican_pkcs11_plugin_conf.client_cacert_file_path | is_str_set
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin_certs  |
    Read client cacert content from variable when file content not provided
  set_fact:
    pkcs11_client_cacert_content:
      "{{ barbican_pkcs11_plugin_conf.client_cacert_content }}"
  when: pkcs11_client_cacert_content is not defined
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin_certs  |
    Set certs path on controller when ESKM pkcs11 connector flag is set
  set_fact:
    barbican_pkcs11_client_cert_path:
      "{{ barbican_pkcs11_eskm_connector_client_cert_path }}"
    barbican_pkcs11_client_key_path:
      "{{ barbican_pkcs11_eskm_connector_client_key_path }}"
    barbican_pkcs11_client_cacert_path:
      "{{ barbican_pkcs11_eskm_connector_client_cacert_path }}"
  when: barbican_pkcs11_provider_is_eskm | is_bool_true and
    barbican_pkcs11_client_cert_path | is_str_set == False and
    barbican_pkcs11_client_key_path | is_str_set == False and
    barbican_pkcs11_client_cacert_path | is_str_set == False
  tags:
    - barbican

- name: KEYMGR-API | _configure_pkcs11_plugin_certs  |
    Copy PKCS11 client certs file
  copy:
    content: "{{ item.content }}"
    dest: "{{ item.dest }}"
    owner: "{{ barbican_user }}"
    group: "{{ barbican_group }}"
    mode: 0400
  become: yes
  with_items:
    - { content: "{{ pkcs11_client_cert_content }}",
          dest: "{{ barbican_pkcs11_client_cert_path }}" }
    - { content: "{{ pkcs11_client_key_content }}",
          dest: "{{ barbican_pkcs11_client_key_path }}" }
    - { content: "{{ pkcs11_client_cacert_content }}",
          dest: "{{ barbican_pkcs11_client_cacert_path }}"}
  no_log: True
  register: ardana_notify_barbican_api_restart_required
  tags:
    - barbican
07070100EA2332000081A4000003E800000064000000015B730CE200000348000001030000000400000000000000000000005700000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks/_configure_vhost.yml#
# (c) Copyright 2018 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---
- name: KEYMGR-API | configure | configure barbican-api vhost
  become: yes
  template:
    src: barbican-api-modwsgi.conf.j2
    dest: "{{ apache2_vhost_dir }}/barbican-api-modwsgi.vhost"
    mode: 0644
  register: ardana_notify_barbican_api_restart_required
07070100EA232F000081A4000003E800000064000000015B730CE200000BEE000001030000000400000000000000000000005D00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks/_validate_plugins_conf.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- name: KEYMGR-API | _validate_plugins_conf |
    Configure to default when pkcs11 and kmip plugin is not enabled
  set_fact:
    barbican_secretstore_plugins: "store_crypto"
    barbican_enabled_crypto_plugins: "simple_crypto"
  when: use_pkcs11_crypto_plugin | bool == False and
    use_kmip_secretstore_plugin | bool == False
  tags:
    - barbican

- name: KEYMGR-API | _validate_plugins_conf |
    Fail that both pkcs11 and kmip plugins are  enabled
  fail:
    msg: "Both pkcs11 and kmip plugin cannot be enabled at the same time"
  when: use_pkcs11_crypto_plugin | bool == True and
    use_kmip_secretstore_plugin | bool == True
  tags:
    - barbican

- name: KEYMGR-API | _validate_plugins_conf |
    Fail when library path is not set for pkcs11 plugin
  fail:
    msg: "For pkcs11, required pkcs11 library path is not set"
  when: use_pkcs11_crypto_plugin | is_bool_true and
    barbican_pkcs11_library_path | is_str_set| bool == False
  tags:
    - barbican

- name: KEYMGR-API | _validate_plugins_conf |
    Fail when needed pkcs11 generate mkek variables are not set
  fail:
    msg: "For pkcs11, required pkcs11 library path,
      passphrase or mkek label is not set"
  when: barbican_pkcs11_generate_labels | is_bool_true and (
        barbican_pkcs11_library_path | is_str_set | bool == False or
        barbican_pkcs11_session_password | is_str_set | bool == False or
        barbican_pkcs11_mkek_label | is_str_set | bool == False)
  tags:
    - barbican

- name: KEYMGR-API | _validate_plugins_conf |
    Fail when needed pkcs11 generate hmac variables are not set
  fail:
    msg: "For pkcs11, required pkcs11 library path, passphrase or mkek label
      is not set"
  when: barbican_pkcs11_generate_labels | is_bool_true and (
        barbican_pkcs11_library_path | is_str_set | bool == False or
        barbican_pkcs11_session_password | is_str_set | bool == False or
        barbican_pkcs11_hmac_label | is_str_set | bool == False)
  tags:
    - barbican

- name: KEYMGR-API | _validate_plugins_conf |
    Fail when needed ESKM pkcs11 generate conf variables are not set
  fail:
    msg: "For ESKM pkcs11 conf generation, required kmip host and port
      is not set"
  when: barbican_pkcs11_eskm_generate_conf | is_bool_true and (
        barbican_pkcs11_eskm_kmip_host | is_str_set == False or
        barbican_pkcs11_eskm_kmip_port | is_str_set == False)
  tags:
    - barbican07070100EA2326000081A4000003E800000064000000015B730CE2000015F5000001030000000400000000000000000000005000000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks/configure.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017-2018 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- name: KEYMGR-API | configure | echo remote user
  debug:
    msg: "ansible_ssh_user = {{ ansible_ssh_user }}"
  when: barbican_debug is defined

- name: KEYMGR-API | configure |
    Set installed component specific directories path
  include: ../../barbican-common/tasks/_set_directories.yml
  vars:
    install_package_result: "{{ barbican_api_install_result }}"

- name: KEYMGR-API | configure  | set api config dir location
  set_fact:
    barbican_api_config_dir: "{{ barbican_conf_dir }}"

- name: KEYMGR-API | configure  | Touch the log file
  file:
    path: "{{ item }}"
    owner: "{{ barbican_user }}"
    group: "{{ barbican_centralized_log_group }}"
    mode: 0640
    state: touch
  become: yes
  with_items:
    - "/var/log/barbican/barbican.log"
    - "/var/log/barbican/barbican-json.log"
    - "/var/log/barbican/barbican-api.log"
    - "/var/log/barbican/barbican-access.log"
    - "/var/log/barbican/barbican-monitor.log"
  tags:
    - barbican

# Configure and set all necessary variables used in templates.
# This way template can detect changes from existing file content
# and notify restart if changed. Do not change/set file content
# later via crudini as that will always result in changes
# and hence server restart.
- name: KEYMGR-API | configure | Includes features configuration playbook
  include: configure_features.yml

- name: KEYMGR-API | configure  |
    Copies policy, barbican.conf, paste ini, api logging, audit map
    vassal files
  template:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
    mode: "{{ item.mode }}"
  become: yes
  become_user: "{{ barbican_user }}"
  with_items:
    - { src: "policy.json",
      dest: "{{ barbican_conf_dir }}/policy.json", mode: "0400"}
    - { src: "barbican.conf.j2",
      dest: "{{ barbican_conf_dir }}/{{ barbican_api_conf_file }}",
      mode: "0600"}
    - { src: "barbican-api-paste.ini.j2",
      dest: "{{ barbican_conf_dir }}/barbican-api-paste.ini", mode: "0600"}
    - { src: "api-logging.conf.j2",
      dest: "{{ barbican_conf_dir }}/api-logging.conf", mode: "0600"}
    - { src: "api_audit_map.conf.j2",
      dest: "{{ barbican_conf_dir }}/api_audit_map.conf", mode: "0400"}
    - { src: "vassals_barbican-api.ini.j2",
      dest: "{{ barbican_conf_dir }}/vassals/barbican-api.ini", mode: "0600"}
  register: ardana_notify_barbican_api_restart_required
  tags:
    - barbican

- name: KEYMGR-API | configure | notify api restart if changed
  debug:
    msg: "barbican api conf file(s) have changed so barbican-api
          restart needed"
  when:  ardana_notify_barbican_api_restart_required.changed

- name: KEYMGR-API | configure | Create barbican WSGI directory
  become: yes
  file:
    path: "{{ www_root }}/barbican"
    owner: "{{ barbican_user }}"
    group: "{{ barbican_group }}"
    mode: 0755
    state: directory
  tags:
    - barbican

- name: KEYMGR-API | configure | Create symbolic link for the barbican-api startup
  become: yes
  file:
    src: "{{ barbican_venv_dir }}/bin/barbican-wsgi-api"
    dest: "{{ www_root }}/barbican/api"
    owner: root
    group: root
    state: link

- name: KEYMGR-API | configure | Configure the barbican_api_server vhost (SUSE)
  include: _configure_vhost.yml

- name: KEYMGR-API | configure | Create barbican conf symlinks
  become: yes
  file:
    src: "{{ barbican_conf_dir }}/{{ item }}"
    dest: "/etc/barbican/{{ item }}"
    owner: "{{ barbican_user }}"
    group: "{{ barbican_group }}"
    state: link
  with_items:
    - "{{ barbican_api_conf_file }}"
    - barbican-api-paste.ini
    - api_audit_map.conf
    - api-logging.conf
    - policy.json
    - vassals/barbican-api.ini
  tags:
    - barbican

- name: KEYMGR-API | configure | echo ardanauser_home
  debug:
    msg: "ardanauser_home = {{ ardanauser_home }}"

- name: KEYMGR-API | configure  | Copy barbican client env file
  template:
    src: "{{ item }}"
    dest: "{{ ardanauser_home }}"
    owner: "{{ ardanauser }}"
    group: "{{ ardanauser }}"
    mode: "0600"
  with_items:
    - barbican.osrc
  tags:
    - barbican

- name: KEYMGR-API | configure  | Copy barbican client env file to deployer
  template:
    src: "{{ item }}"
    dest: "{{ ardanauser_home }}"
    owner: "{{ ardanauser }}"
    group: "{{ ardanauser }}"
    mode: "0600"
  delegate_to: localhost
  with_items:
    - barbican.osrc
  tags:
    - barbican

- name: KEYMGR-API | configure |
    Create/Upgrade Barbican database via barbican-manage command script
  command: >
    "{{ barbican_bin_dir }}/barbican-manage"
    db upgrade {{ barbican_database_connection_string }}
    --version "{{ barbican_db_version }}"
  run_once: True
  become: yes
  become_user: "{{ barbican_user }}"
  tags:
    - barbican

- name: KEYMGR-API | configure | Create barbican-manage command symlink
  become: yes
  file:
    src: "{{ barbican_bin_dir }}/{{ item }}"
    dest: "/usr/local/bin/{{ item }}"
    state: link
  with_items:
    - "barbican-manage"
  tags:
    - barbican
07070100EA2333000081A4000003E800000064000000015B730CE200000433000001030000000400000000000000000000005900000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks/configure_features.yml#
# (c) Copyright 2015-2017 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- include: _configure_deployment_options.yml

- include: _configure_auditing.yml

- include: _configure_kmip_plugin_certs.yml
  when: barbican_kmip_plugin_conf is defined

- include: _configure_kmip_plugin.yml

# ESKM pkcs11 package is available as debian only
- include: _configure_pkcs11_plugin.yml
  when: ansible_os_family | lower == 'debian'

- include: _validate_plugins_conf.yml

- include: _configure_master_key.yml

07070100EA2325000081A4000003E800000064000000015B730CE200000FAD000001030000000400000000000000000000004E00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks/install.yml#
# (c) Copyright 2015-2017 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017-2018 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

# Some of these libraries are already in base node install. No harm in listing
# here.
# python-httplib2 is an ansible dependency for the module uri
- name: KEYMGR-API | install | Install OS specific required packages (legacy)
  become: yes
  package:
    state: present
    name: "{{ item }}"
  with_items: barbican_package_dependencies
  tags:
    - barbican

- name: KEYMGR-API | install | Install OS specific required packages
  become: yes
  package:
    state: present
    name: "{{ item }}"
  with_items:
    - crudini
  when: deployer_media_legacy_layout|bool == False
  tags:
    - barbican

- name: KEYMGR-API | install | Add group '{{ barbican_group }}'
  become: yes
  group:
    name: "{{ barbican_group }}"
    state: present
  tags:
    - barbican

- name: KEYMGR-API | install | Add user '{{ barbican_user }}'
  become: yes
  user:
    name: "{{ barbican_user }}"
    group: "{{ barbican_group }}"
    createhome: yes
    home: "{{ barbican_home_dir }}"
    shell: /bin/true
    state: present
  tags:
    - barbican

- name: KEYMGR-API | install | Update Home directory permission
  become: yes
  file:
    path: "{{ barbican_home_dir }}"
    mode: 0750
    state: directory
  tags:
    - barbican

- name: KEYMGR-API | install | Update venv cache
  become: yes
  install_package:
    cache: update

- name: KEYMGR-API | install | Install Barbican from barbican venv
  become: yes
  install_package:
    name: barbican
    service: "{{ barbican_api_service_name }}"
    state: present
    activate: act_off
  register: barbican_api_install_result
  notify: barbican_api_config_change
  tags:
    - barbican

- name: KEYMGR-API | install | Install packge result echo
  debug:
    msg: "barbican_api_install_result = {{ barbican_api_install_result }}"

- include: ../../barbican-common/tasks/_set_directories.yml
  vars:
    install_package_result: "{{ barbican_api_install_result }}"

- name: KEYMGR-API | install | Create barbican config directories only
  become: yes
  file:
    path: "{{ item.name }}"
    owner: "{{ barbican_user }}"
    group: "{{ barbican_group }}"
    mode: "{{ item.mode }}"
    state: "directory"
  with_items:
    - { name: "{{ barbican_conf_dir }}", mode: "0755" }
    - { name: "{{ barbican_conf_dir }}/vassals", mode: "0755" }
    - { name: "{{ barbican_conf_dir }}/ssl/certs", mode: "0755" }
  tags:
    - barbican

- name: KEYMGR-API | install | Create /etc/barbican directories only
  become: yes
  file:
    path: "{{ item.name }}"
    owner: "{{ barbican_user }}"
    group: "{{ barbican_group }}"
    mode: "{{ item.mode }}"
    state: "directory"
  with_items:
    - { name: /etc/barbican, mode: "u+rwx,g+rx,o+rx" }
    - { name: /etc/barbican/vassals, mode: "u+rwx,g+rx,o+rx" }
    - { name: /etc/barbican/ssl/certs, mode: "u+rwx,g-rx,o-rx" }
  tags:
    - barbican

- name: KEYMGR-API | install | print venv
  debug:
    msg: "Barbican venv dir = {{ barbican_venv_dir }},
    bin dir = {{ barbican_bin_dir }},
    conf dir = {{ barbican_conf_dir }},
    share dir = {{ barbican_share_dir }}"
  tags:
    - barbican
    - barbican_debug
  when: barbican_debug is defined

- name: KEYMGR-API | install | Create logging directory
  become: yes
  file:
    path: /var/log/barbican
    owner: "{{ barbican_user }}"
    group: "{{ barbican_group }}"
    mode: 0755
    state: directory
  tags:
    - barbican
07070100EA2324000081A4000003E800000064000000015B730CE2000007B2000001030000000400000000000000000000005A00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks/keystone_change_pwd.yml#
# (c) Copyright 2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- name: KEYMGR-API | keystone_change_pwd | Get a domain scoped token
  keystone_v3:
    endpoint: "{{ keystone.admin_url }}/v3"
    login_username: "{{ keystone.admin_user }}"
    login_password: "{{ keystone.admin_password }}"
    login_user_domain_name: "{{ keystone.default_domain_name }}"
    login_domain_name: "{{ keystone.default_domain_name }}"
    action: "token_get"
  register: domain_scoped_token_result
  run_once: True
  tags:
    - barbican

- name: KEYMGR-API | keystone_change_pwd |
    Update Barbican Service User password
  keystone_v3:
    login_token: "{{ domain_scoped_token_result.result }}"
    endpoint: "{{ keystone.admin_url }}/v3"
    action: "reset_password_by_admin"
    user_name: "{{ barbican_service_user }}"
    user_password: "{{ barbican_service_password }}"
    user_domain_name: "{{ barbican_admin_domain_name }}"
  run_once: True
  tags:
    - barbican

- name: KEYMGR-API | keystone_change_pwd | Update Barbican Admin User password
  keystone_v3:
    login_token: "{{ domain_scoped_token_result.result }}"
    endpoint: "{{ keystone.admin_url }}/v3"
    action: "reset_password_by_admin"
    user_name: "{{ barbican_admin_user }}"
    user_password: "{{ barbican_admin_user_password }}"
    user_domain_name: "{{ barbican_admin_domain_name }}"
  run_once: True
  tags:
    - barbican
07070100EA2323000081A4000003E800000064000000015B730CE200001ABC000001030000000400000000000000000000005400000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks/keystone_conf.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- name: KEYMGR-API | keystone_conf | Get a domain scoped token
  keystone_v3:
    endpoint: "{{ keystone.admin_url }}/v3"
    login_username: "{{ keystone.admin_user }}"
    login_password: "{{ keystone.admin_password }}"
    login_user_domain_name: "{{ keystone.default_domain_name }}"
    login_domain_name: "{{ keystone.default_domain_name }}"
    action: "token_get"
  register: domain_scoped_token_result
  run_once: True
  tags:
    - barbican

- name: KEYMGR-API | keystone_conf | Create Barbican Service User
  become: yes
  keystone_v3:
    login_token: "{{ domain_scoped_token_result.result }}"
    endpoint: "{{ keystone.admin_url }}/v3"
    action: "create_user"
    user_name: "{{ barbican_service_user }}"
    user_password: "{{ barbican_service_password }}"
    description:
      "Bootstrap Account: Service User used by Barbican for token validation
      (created via barbican deploy)"
    user_domain_name: "{{ barbican_admin_domain_name }}"
  run_once: True
  tags:
    - barbican

- name: KEYMGR-API | keystone_conf | Create Barbican Admin User
  become: yes
  keystone_v3:
    login_token: "{{ domain_scoped_token_result.result }}"
    endpoint: "{{ keystone.admin_url }}/v3"
    action: "create_user"
    user_name: "{{ barbican_admin_user }}"
    user_password: "{{ barbican_admin_user_password }}"
    description:
      "Bootstrap Account: Barbican Service Admin user
      (created via barbican deploy)"
    user_domain_name: "{{ barbican_admin_domain_name }}"
  run_once: True
  tags:
    - barbican

- name: KEYMGR-API | keystone_conf | Create Barbican specific roles
  keystone_v3:
    login_token: "{{ domain_scoped_token_result.result }}"
    endpoint: "{{ keystone.admin_url }}/v3"
    action: "create_role"
    role_name: "{{ item.role_name }}"
    description: "{{ item.description }}"
  with_items:
    - { role_name: "{{ barbican_creator_role }}",
      description: "Bootstrap Role: creator role
      (created via barbican deploy)" }
    - { role_name: "{{ barbican_observer_role }}",
      description: "Bootstrap Role: observer role
      (created via barbican deploy)" }
    - { role_name: "{{ barbican_auditor_role }}",
      description: "Bootstrap Role: auditor role
      (created via barbican deploy)" }
    - { role_name: "{{ barbican_admin_role }}",
      description: "Bootstrap Role: admin role
      (created via barbican deploy)" }
    - { role_name: "{{ barbican_service_admin_role }}",
      description: "Bootstrap Role: service admin role
      (created via barbican deploy)" }
  run_once: True
  tags:
    - barbican

- name: KEYMGR-API | keystone_conf |
    Create role assignment for Barbican service user with keystone service role
    in service project
  become: yes
  keystone_v3:
    action: "grant_project_role"
    login_token: "{{ domain_scoped_token_result.result }}"
    endpoint: "{{ keystone.admin_url }}/v3"
    user_name: "{{ barbican_service_user }}"
    project_name: "{{ keystone.service_tenant_name }}"
    user_domain_name: "{{ barbican_admin_domain_name }}"
    project_domain_name: "{{ barbican_admin_domain_name }}"
    role_name: "{{ keystone_service_role }}"
  run_once: True
  tags:
    - barbican

- name: KEYMGR-API | keystone_conf |
    Create role assignment for Barbican admin user with Keystone admin role in
    admin project
  become: yes
  keystone_v3:
    action: "grant_project_role"
    login_token: "{{ domain_scoped_token_result.result }}"
    endpoint: "{{ keystone.admin_url }}/v3"
    user_name: "{{ barbican_admin_user }}"
    project_name: "{{ keystone.admin_tenant_name }}"
    user_domain_name: "{{ barbican_admin_domain_name }}"
    project_domain_name: "{{ barbican_admin_domain_name }}"
    role_name: "{{ keystone.admin_role }}"
  run_once: True
  tags:
    - barbican

- name: KEYMGR-API | keystone_conf |
    Create role assignment for Barbican admin user with Barbican admin role in
    admin project
  become: yes
  keystone_v3:
    action: "grant_project_role"
    login_token: "{{ domain_scoped_token_result.result }}"
    endpoint: "{{ keystone.admin_url }}/v3"
    user_name: "{{ barbican_admin_user }}"
    project_name: "{{ keystone.admin_tenant_name }}"
    user_domain_name: "{{ barbican_admin_domain_name }}"
    project_domain_name: "{{ barbican_admin_domain_name }}"
    role_name: "{{ barbican_admin_role }}"
  run_once: True
  tags:
    - barbican

- name: KEYMGR-API | keystone_conf |
    Create role assignment for Barbican admin user with Barbican service admin
    role in admin project
  become: yes
  keystone_v3:
    action: "grant_project_role"
    login_token: "{{ domain_scoped_token_result.result }}"
    endpoint: "{{ keystone.admin_url }}/v3"
    user_name: "{{ barbican_admin_user }}"
    project_name: "{{ keystone.admin_tenant_name }}"
    user_domain_name: "{{ barbican_admin_domain_name }}"
    project_domain_name: "{{ barbican_admin_domain_name }}"
    role_name: "{{ barbican_service_admin_role }}"
  run_once: True
  tags:
    - barbican

- name: KEYMGR-API | keystone_conf |
    Create role assignment for Keystone admin user with Barbican admin role in
    admin project
  become: yes
  keystone_v3:
    action: "grant_project_role"
    login_token: "{{ domain_scoped_token_result.result }}"
    endpoint: "{{ keystone.admin_url }}/v3"
    user_name: "{{ keystone.admin_user }}"
    project_name: "{{ keystone.admin_tenant_name }}"
    user_domain_name: "{{ barbican_admin_domain_name }}"
    project_domain_name: "{{ barbican_admin_domain_name }}"
    role_name: "{{ barbican_admin_role }}"
  run_once: True
  tags:
    - barbican

- name: KEYMGR-API | keystone_conf |
    Create role assignment for Keystone admin user with Barbican service admin
    role in admin project
  become: yes
  keystone_v3:
    action: "grant_project_role"
    login_token: "{{ domain_scoped_token_result.result }}"
    endpoint: "{{ keystone.admin_url }}/v3"
    user_name: "{{ keystone.admin_user }}"
    project_name: "{{ keystone.admin_tenant_name }}"
    user_domain_name: "{{ barbican_admin_domain_name }}"
    project_domain_name: "{{ barbican_admin_domain_name }}"
    role_name: "{{ barbican_service_admin_role }}"
  run_once: True
  tags:
    - barbican
07070100EA232D000081A4000003E800000064000000015B730CE2000007DD000001030000000400000000000000000000004C00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks/start.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017-2018 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

# Restart or start Barbican API
- name: KEYMGR-API | start | Activate the latest install
  install_package:
    name: barbican
    service: "{{ barbican_api_service_name }}"
    activate: act_on
    version: "{{ barbican_api_install_result.version }}"
  become: yes
  when: barbican_api_install_result is defined
  register: barbican_api_activate_result
  tags:
    - barbican

- name: KEYMGR-API | start | Activate barbican packge result echo
  debug:
    msg: "barbican_api_activate_result = {{ barbican_api_activate_result }}"
  when: barbican_api_activate_result is defined

- name: KEYMGR-API | start | Enable barbican_api_server vhost (apache)
  file:
    src: "{{ apache2_vhost_dir }}/barbican-api-modwsgi.vhost"
    dest: "{{ apache2_vhost_dir }}/barbican-api-modwsgi.conf"
    state: link
  become: yes
  register: barbican_api_a2_enable_vhost_result

- name: KEYMGR-API | start | Restart or start Barbican API (apache)
  include: "{{ playbook_dir }}/roles/FND-AP2/tasks/start_reload.yml"
  vars:
    apache_reload_requested: "{{
      barbican_api_a2_enable_vhost_result is defined and
      barbican_api_a2_enable_vhost_result.changed }}"
    apache_restart_requested: "{{ (
        ardana_notify_barbican_api_restart_required is defined and
        ardana_notify_barbican_api_restart_required.changed
      ) or barbican_api_restart_required }}"

07070100EA2331000081A4000003E800000064000000015B730CE2000005A0000001030000000400000000000000000000004D00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks/status.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- name:  KEYMGR-API | status | Add some delay
  pause:
    seconds: 3

- name:  KEYMGR-API | status | Register barbican status
  uri:
    url: "http://{{ barbican_api_network_address }}:{{ barbican_api_port }}"
    status_code: 300
    timeout: 600
  register: barbican_status_result
  failed_when: False
  tags:
    - barbican

- name:  KEYMGR-API | status | Check status
  debug:
    msg: "Barbican Status is {{ barbican_status_result }}"
  when: barbican_status_result

- name:  KEYMGR-API | status | Register local barbican status
  uri:
    url: "http://127.0.0.1:{{ barbican_api_port }}"
    status_code: 300
    timeout: 600
  register: barbican_status_result
  when: barbican_status_result.status is not defined
        or barbican_status_result.status != 300
  tags:
    - barbican
07070100EA2330000081A4000003E800000064000000015B730CE2000003C2000001030000000400000000000000000000004B00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/tasks/stop.yml#
# (c) Copyright 2015 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017-2018 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- name: KEYMGR-API | stop | Disable Barbican API vhost (apache)
  file:
    state: absent
    path: "{{ apache2_vhost_dir }}/barbican-api-modwsgi.conf"
  become: yes

- name: KEYMGR-API | stop | Reload apache so that Barbican API is stopped (apache)
  service:
    name: apache2
    state: reloaded
  become: yes
07070100E81985000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004600000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/templates07070100E81988000081A4000003E800000064000000015B730CE200000A3B000001030000000400000000000000000000005A00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/templates/api-logging.conf.j2{#
#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
#}
[loggers]
keys: root, iso8601{%- if barbican_api_audit_enable|bool %}, audit{% endif %}

[handlers]
keys: watchedfile, logstash{%- if barbican_api_audit_enable|bool %}, auditfile{% endif %}

[formatters]
keys:  debug,minimal, normal, logstash

###########
# Loggers #
###########

[logger_root]
qualname: root
handlers: watchedfile, logstash
level: NOTSET

[logger_iso8601]
qualname: iso8601
handlers: watchedfile, logstash
level: INFO

{%- if barbican_api_audit_enable|bool %}

[logger_audit]
qualname: oslo.messaging.notification.audit
handlers: auditfile
propagate: 0
level: INFO

{% endif %}

################
# Log Handlers #
################

# Writes to disk
[handler_watchedfile]
class: handlers.WatchedFileHandler
args: ('/var/log/barbican/barbican.log',)
formatter = debug
level: {{ barbican_loglevel }}

# Writes JSON to disk, beaver will ship to logstash
[handler_logstash]
class: handlers.WatchedFileHandler
args: ('/var/log/barbican/barbican-json.log',)
formatter= logstash
level: {{ barbican_logstash_loglevel }}

{%- if barbican_api_audit_enable|bool %}

[handler_auditfile]
class: handlers.WatchedFileHandler
args: ('{{ barbican_audit_log_base_location }}/barbican/barbican-audit.log',)
formatter = minimal
level: INFO

{% endif %}

##################
# Log Formatters #
##################

[formatter_minimal]
format=%(message)s

[formatter_normal]
format=(%(name)s): %(asctime)s %(levelname)s %(message)s

[formatter_debug]
format=(%(name)s): %(asctime)s %(levelname)s %(module)s %(funcName)s %(message)s

# datefmt must be set otherwise you end up with too many (msecs) fields
[formatter_context]
class: oslo_log.formatters.ContextFormatter
args: (datefmt=datefmt)
format: %(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user)s %(tenant)s] %(instance)s%(message)s
datefmt: %Y-%m-%d %H:%M:%S

# the "format" attr actually sets the "type"
[formatter_logstash]
class = logstash.LogstashFormatterVersion1
format = barbican
07070100E8198E000081A4000003E800000064000000015B730CE200000473000001030000000400000000000000000000005C00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/templates/api_audit_map.conf.j2{#
#
# (c) Copyright 2015 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
#}
[DEFAULT]
# default target endpoint type
# should match the endpoint type defined in service catalog
target_endpoint_type = key-manager

# map urls ending with specific text to a unique action
[custom_actions]
secrets/get = read/list
acl/get = read

# possible end path of api requests
[path_keywords]
#defaults = None
secrets=
containers=
orders=
#cas=None
quotas=

# map endpoint type defined in service catalog to CADF typeURI
[service_endpoints]
key-manager = service/security/keymanager
07070100E8198C000081A4000003E800000064000000015B730CE20000047D000001030000000400000000000000000000006300000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/templates/barbican-api-modwsgi.conf.j2{#
# (c) Copyright 2018 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
#}

Listen {{ barbican_api_network_address }}:{{ barbican_api_port }}

<VirtualHost {{ barbican_api_network_address }}:{{ barbican_api_port }}>
    WSGIDaemonProcess barbican-api user={{ barbican_user }} group={{ barbican_group }} processes=3 threads=4 python-path={{ barbican_venv_dir }}:{{barbican_venv_dir }}/lib/python2.7/site-packages/ display-name=barbican-api
    WSGIScriptAlias / {{ www_root }}/barbican/api
    WSGIProcessGroup barbican-api
    ErrorLog /var/log/barbican/barbican-api.log
    CustomLog /var/log/barbican/barbican-api.log combined
</VirtualHost>
07070100E8198A000081A4000003E800000064000000015B730CE200000A9A000001030000000400000000000000000000006000000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/templates/barbican-api-paste.ini.j2{#
#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
#}
[composite:main]
use = egg:Paste#urlmap
/: barbican_version
/v1: barbican-api-keystone

# Use this pipeline for Barbican API - versions no authentication
[pipeline:barbican_version]
pipeline = cors http_proxy_to_wsgi versionapp

# Use this pipeline for Barbican API - DEFAULT no authentication
[pipeline:barbican_api]
pipeline = cors http_proxy_to_wsgi unauthenticated-context apiapp

#Use this pipeline to activate a repoze.profile middleware and HTTP port,
#  to provide profiling information for the REST API processing.
[pipeline:barbican-profile]
pipeline = cors http_proxy_to_wsgi unauthenticated-context egg:Paste#cgitb egg:Paste#httpexceptions profile apiapp

#Use this pipeline for keystone auth
[pipeline:barbican-api-keystone]
pipeline = cors http_proxy_to_wsgi authtoken context {{ audit_filter }} apiapp

#Use this pipeline for keystone auth with audit feature
[pipeline:barbican-api-keystone-audit]
pipeline = http_proxy_to_wsgi authtoken context audit apiapp

[app:apiapp]
paste.app_factory = barbican.api.app:create_main_app

[app:versionapp]
paste.app_factory = barbican.api.app:create_version_app

[filter:simple]
paste.filter_factory = barbican.api.middleware.simple:SimpleFilter.factory

[filter:unauthenticated-context]
paste.filter_factory = barbican.api.middleware.context:UnauthenticatedContextMiddleware.factory

[filter:context]
paste.filter_factory = barbican.api.middleware.context:ContextMiddleware.factory

[filter:audit]
paste.filter_factory = keystonemiddleware.audit:filter_factory
audit_map_file = {{ barbican_conf_dir }}/api_audit_map.conf

[filter:authtoken]
paste.filter_factory = keystonemiddleware.auth_token:filter_factory

[filter:profile]
use = egg:repoze.profile
log_filename = myapp.profile
cachegrind_filename = cachegrind.out.myapp
discard_first_request = true
path = /__profile__
flush_at_shutdown = true
unwind = false

[filter:cors]
paste.filter_factory = oslo_middleware.cors:filter_factory
oslo_config_project = barbican

[filter:http_proxy_to_wsgi]
paste.filter_factory = oslo_middleware:HTTPProxyToWSGI.factory
07070100E81987000081A4000003E800000064000000015B730CE200003B02000001030000000400000000000000000000005700000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/templates/barbican.conf.j2{#
#
# (c) Copyright 2015-2017 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017-2018 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
#}
# Please don't change any values under curly braces
[DEFAULT]
# Show more verbose log output (sets INFO log level output)
#verbose = True

# Show debugging output in logs (sets DEBUG log level output)
#debug = True

# Address to bind the API server
#bind_host = {{ barbican_api_network_address }}

# Port to bind the API server to
#bind_port = {{ barbican_api_port }}

# Host name, for use in HATEOS-style references
#  Note: Typically this would be the load balanced endpoint that clients would use
#  communicate back with this service.
# host_href = {{ barbican_internal_endpoint }}
host_href =

# Log to this file. Make sure you do not set the same log
# file for both the API and registry servers!
#log_file = /var/log/barbican/api.log
log_config_append = "{{ barbican_conf_dir }}/{{ logging_conf_file_name }}"

# Backlog requests when creating socket
backlog = 4096

# TCP_KEEPIDLE value in seconds when creating socket.
# Not supported on OS X.
#tcp_keepidle = 600

# Maximum allowed http request size against the barbican-api
max_allowed_secret_in_bytes = 10000
max_allowed_request_size_in_bytes = 1000000

# SQLAlchemy connection string for the reference implementation
# registry server. Any valid SQLAlchemy connection string is fine.
# See: http://www.sqlalchemy.org/docs/05/reference/sqlalchemy/connections.html#sqlalchemy.create_engine
# Uncomment this for local dev, putting db in project directory:
#sql_connection = sqlite:///barbican.sqlite
# Note: For absolute addresses, use '////' slashes after 'sqlite:'
# Uncomment for a more global development environment
sql_connection = {{ barbican_database_connection_string }}

# Don't auto create/upgrade database as part of server startup
db_auto_create = False

# Period in seconds after which SQLAlchemy should reestablish its connection
# to the database.
#
# MySQL uses a default `wait_timeout` of 8 hours, after which it will drop
# idle connections. This can result in 'MySQL Gone Away' exceptions. If you
# notice this, you can lower this value to ensure that SQLAlchemy reconnects
# before MySQL can drop the connection.
sql_idle_timeout = 3600

# Accepts a class imported from the sqlalchemy.pool module, and handles the
# details of building the pool for you. If commented out, SQLAlchemy
# will select based on the database dialect. Other options are QueuePool
# (for SQLAlchemy-managed connections) and NullPool (to disabled SQLAlchemy
# management of connections).
# See http://docs.sqlalchemy.org/en/latest/core/pooling.html for more details.
sql_pool_class = QueuePool

sql_retry_interval=1
sql_max_retries=60

# Show SQLAlchemy pool-related debugging output in logs (sets DEBUG log level
# output) if specified.
#sql_pool_logging = True

# Size of pool used by SQLAlchemy. This is the largest number of connections
# that will be kept persistently in the pool. Can be set to 0 to indicate no
# size limit. To disable pooling, use a NullPool with sql_pool_class instead.
# Comment out to allow SQLAlchemy to select the default.
sql_pool_size = 5

# The maximum overflow size of the pool used by SQLAlchemy. When the number of
# checked-out connections reaches the size set in sql_pool_size, additional
# connections will be returned up to this limit. It follows then that the
# total number of simultaneous connections the pool will allow is
# sql_pool_size + sql_pool_max_overflow. Can be set to -1 to indicate no
# overflow limit, so no limit will be placed on the total number of concurrent
# connections. Comment out to allow SQLAlchemy to select the default.
sql_pool_max_overflow = 10

# Default page size for the 'limit' paging URL parameter.
default_limit_paging = 10

# Maximum page size for the 'limit' paging URL parameter.
max_limit_paging = 100

# Role used to identify an authenticated user as administrator
#admin_role = admin

# Allow unauthenticated users to access the API with read-only
# privileges. This only applies when using ContextMiddleware.
#allow_anonymous_access = False

# Allow access to version 1 of barbican api
#enable_v1_api = True

# Allow access to version 2 of barbican api
#enable_v2_api = True

# ================= SSL Options ===============================

# Certificate file to use when starting API server securely
#cert_file = {{ barbican_api_ssl_client_key }}

# Private key file to use when starting API server securely
#key_file = {{ barbican_api_ssl_client_cert }}

# CA certificate file to use to verify connecting clients
#ca_file = {{ barbican_api_ssl_ca_cert }}

# ================= Security Options ==========================

# AES key for encrypting store 'location' metadata, including
# -- if used -- Swift or S3 credentials
# Should be set to a random string of length 16, 24 or 32 bytes
#metadata_encryption_key = <16, 24 or 32 char registry metadata key>

# For HA, specify queue nodes in cluster as 'user@host:5672', comma delimited, ending with '/offset':
#   For example: transport_url = rabbit://guest@192.168.50.8:5672,guest@192.168.50.9:5672/
transport_url = {{ barbican_transport_url }}

# oslo notification driver for sending audit events via audit middleware.
# Meaningful only when middleware is enabled in barbican paste ini file.
# This is oslo config MultiStrOpt so can be defined multiple times in case
# there is need to route audit event to messaging as well as log.
# notification_driver = messagingv2
# notification_driver = log
notification_driver = {{ notification_driver_name }}

# ================= Queue Options - oslo.messaging ==========================

[oslo_messaging_rabbit]
# Rabbit and HA configuration:
#ampq_durable_queues = True
ssl = {{ barbican_rabbit_use_ssl }}

[keystone_authtoken]
auth_type = password
auth_url = {{ keystone.identity_url }}
username = {{ barbican_service_user }}
password = {{ barbican_service_password }}
user_domain_name = {{ keystone.default_domain_name }}
project_name = {{ keystone.service_tenant_name }}
project_domain_name = {{ keystone.default_domain_name }}
cafile = {{ keystone.ca_file }}
service_token_roles_required = true
service_token_roles = admin
memcached_servers = {{ memcached_servers }}
memcache_security_strategy = ENCRYPT
memcache_secret_key = {{ memcache_secret_key }}
memcache_pool_socket_timeout = 1

# ======== OpenStack policy - oslo_policy ===============

[oslo_policy]

# ======== OpenStack policy integration
# JSON file representing policy (string value)
policy_file=/etc/barbican/policy.json

# Rule checked when requested rule is not found (string value)
policy_default_rule=default

# ================= Queue Options - Application ==========================

[queue]
# Enable queuing asynchronous messaging.
#   Set false to invoke worker tasks synchronously (i.e. no-queue standalone mode)
enable = False

# Namespace for the queue
namespace = 'barbican'

# Topic for the queue
topic = 'barbican.workers'

# Version for the task API
version = '1.1'

# Server name for RPC service
server_name = 'barbican.queue'

# Number of asynchronous worker processes.
# When greater than 1, then that many additional worker processes are
# created for asynchronous worker functionality.
asynchronous_workers = 1

# ================= Retry/Scheduler Options ==========================

[retry_scheduler]
# Seconds (float) to wait between starting retry scheduler
initial_delay_seconds = 10.0

# Seconds (float) to wait between starting retry scheduler
periodic_interval_max_seconds = 10.0

# ====================== Quota Options ===============================

[quotas]
# For each resource, the default maximum number that can be used for
# a project is set below.  This value can be overridden for each
# project through the API.  A negative value means no limit.  A zero
# value effectively disables the resource.

# default number of secrets allowed per project
quota_secrets = -1

# default number of orders allowed per project
quota_orders = -1

# default number of containers allowed per project
quota_containers = -1

# default number of consumers allowed per project
quota_consumers = -1

# default number of CAs allowed per project
quota_cas = -1

# ================= Keystone Notification Options - Application ===============

[keystone_notifications]

# Keystone notification functionality uses transport related configuration
# from barbican common configuration as defined under
# 'Queue Options - oslo.messaging' comments.
# The HA related configuration is also shared with notification server.

# True enables keystone notification listener functionality.
enable = False

# The default exchange under which topics are scoped.
# May be overridden by an exchange name specified in the transport_url option.
control_exchange = 'openstack'

# Keystone notification queue topic name.
# This name needs to match one of values mentioned in Keystone deployment's
# 'notification_topics' configuration e.g.
#      notification_topics=notifications, barbican_notifications
# Multiple servers may listen on a topic and messages will be dispatched to one
# of the servers in a round-robin fashion. That's why Barbican service should
# have its own dedicated notification queue so that it receives all of Keystone
# notifications.
topic = 'notifications'

# True enables requeue feature in case of notification processing error.
# Enable this only when underlying transport supports this feature.
allow_requeue = False

# Version of tasks invoked via notifications
version = '1.0'

# Define the number of max threads to be used for notification server
# processing functionality.
thread_pool_size = 10

# ================= Secret Store Plugin ===================
[secretstore]
namespace = barbican.secretstore.plugin
enabled_secretstore_plugins = {{ barbican_secretstore_plugins }}

# ================= Crypto plugin ===================
[crypto]
namespace = barbican.crypto.plugin
enabled_crypto_plugins = {{ barbican_enabled_crypto_plugins }}

[simple_crypto_plugin]
# the kek should be a 32-byte value which is base64 encoded
kek = "{{ barbican_simple_crypto_master_key | barbican_master_key_decrypt }}"

[dogtag_plugin]
pem_path = '/etc/barbican/kra_admin_cert.pem'
dogtag_host = localhost
dogtag_port = 8443
nss_db_path = '/etc/barbican/alias'
nss_db_path_ca = '/etc/barbican/alias-ca'
nss_password = 'password123'
simple_cmc_profile = 'caOtherCert'
ca_expiration_time = 1
plugin_working_dir = '/etc/barbican/dogtag'

[p11_crypto_plugin]
# Path to vendor PKCS11 library
library_path = "{{ barbican_pkcs11_library_path }}"
# Password to login to PKCS11 session
login = "{{ barbican_pkcs11_session_password }}"
# Label to identify master KEK in the HSM (must not be the same as HMAC label)
mkek_label = "{{ barbican_pkcs11_mkek_label }}"
# Length in bytes of master KEK
mkek_length = 32
# Label to identify HMAC key in the HSM (must not be the same as MKEK label)
hmac_label = "{{ barbican_pkcs11_hmac_label }}"
# HSM Slot id (Should correspond to a configured PKCS11 slot). Default: 1
slot_id = {{ barbican_pkcs11_slot_id }}
# Enable Read/Write session with the HSM?
# rw_session = True
# Length of Project KEKs to create
# pkek_length = 32
# How long to cache unwrapped Project KEKs
pkek_cache_ttl = {{ barbican_pkcs11_project_kek_cache_ttl_secs }}
# Max number of items in pkek cache
pkek_cache_limit = {{ barbican_pkcs11_project_kek_cache_size }}
# Disable in case plugin iv generation is not needed e.g. for FIPS enabled HSM
generate_iv = True

# ================== KMIP plugin =====================
[kmip_plugin]
username = {{ barbican_kmip_username }}
password = {{ barbican_kmip_password }}
host = {{ barbican_kmip_host }}
port = {{ barbican_kmip_port }}
keyfile = {{ barbican_kmip_client_key_path }}
certfile = {{ barbican_kmip_client_cert_path }}
ca_certs = {{ barbican_kmip_client_cacert_path }}

# ================= Certificate plugin ===================
[certificate]
namespace = barbican.certificate.plugin
enabled_certificate_plugins = simple_certificate
enabled_certificate_plugins = snakeoil_ca

[certificate_event]
namespace = barbican.certificate.event.plugin
enabled_certificate_event_plugins = simple_certificate_event

[snakeoil_ca_plugin]
ca_cert_path = /etc/barbican/snakeoil-ca.crt
ca_cert_key_path = /etc/barbican/snakeoil-ca.key
ca_cert_chain_path = /etc/barbican/snakeoil-ca.chain
ca_cert_pkcs7_path = /etc/barbican/snakeoil-ca.p7b
subca_cert_key_directory=/etc/barbican/snakeoil-cas

[cors]

#
# From oslo.middleware.cors
#

# Indicate whether this resource may be shared with the domain
# received in the requests "origin" header. (list value)
#allowed_origin = <None>

# Indicate that the actual request can include user credentials
# (boolean value)
#allow_credentials = true

# Indicate which headers are safe to expose to the API. Defaults to
# HTTP Simple Headers. (list value)
#expose_headers = X-Auth-Token, X-Openstack-Request-Id, X-Project-Id, X-Identity-Status, X-User-Id, X-Storage-Token, X-Domain-Id, X-User-Domain-Id, X-Project-Domain-Id, X-Roles

# Maximum cache age of CORS preflight requests. (integer value)
#max_age = 3600

# Indicate which methods can be used during the actual request. (list
# value)
#allow_methods = GET,PUT,POST,DELETE,PATCH

[cors.subdomain]

#
# From oslo.middleware.cors
#

# Indicate whether this resource may be shared with the domain
# received in the requests "origin" header. (list value)
#allowed_origin = <None>

# Indicate that the actual request can include user credentials
# (boolean value)
#allow_credentials = true

# Maximum cache age of CORS preflight requests. (integer value)
#max_age = 3600

# Indicate which methods can be used during the actual request. (list
# value)
#allow_methods = GET,PUT,POST,DELETE,PATCH

# Indicate which header field names may be used during the actual
# request. (list value)
#allow_headers = X-Auth-Token, X-Openstack-Request-Id, X-Project-Id, X-Identity-Status, X-User-Id, X-Storage-Token, X-Domain-Id, X-User-Domain-Id, X-Project-Domain-Id, X-Roles
07070100E8198F000081A4000003E800000064000000015B730CE200000647000001030000000400000000000000000000005400000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/templates/barbican.osrc{#
#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017-2018 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
#}
# Environment variables for Barbican client API.
#export OS_URL={{ keystone.admin_url }}/v3

unset OS_DOMAIN_NAME
unset OS_PROJECT_NAME
unset OS_PROJECT_DOMAIN_NAME

export OS_PROJECT_NAME={{ keystone.admin_tenant_name }}

# Either Project ID or Project Name is required
#export OS_PROJECT_DOMAIN_ID=
export OS_PROJECT_DOMAIN_NAME={{barbican_admin_domain_name}}

# Either Domain User ID or Domain User Name is required
#export OS_USER_DOMAIN_ID=
export OS_USER_DOMAIN_NAME={{barbican_admin_domain_name}}

# Either User ID or Username can be used
#export OS_USER_ID =
export OS_USERNAME={{ barbican_admin_user }}
export OS_PASSWORD={{ barbican_admin_user_password }}

export OS_ENDPOINT_TYPE=internalURL
# OS_AUTH_URL should be your location of Keystone
# Barbican Client defaults to Keystone V3
export OS_AUTH_URL="{{ keystone.auth_url }}/v3"
export BARBICAN_INTERFACE=internal
export OS_IDENTITY_API_VERSION=3
export OS_CACERT={{ trusted_ca_bundle }}
07070100E81986000081A4000003E800000064000000015B730CE2000001EB000001030000000400000000000000000000006000000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/templates/barbican_api_server_start#!/usr/bin/env python

from paste import deploy
from paste import httpserver

def run():

#prop_dir = "{{ barbican_conf_dir }}"
    prop_dir = "/etc/barbican"
    application = deploy.loadapp(
        'config:{prop_dir}/barbican-api-paste.ini'.format(prop_dir=prop_dir),
            name='main')

httpserver.serve(application, host="{{ barbican_api_network_address }}",
                     port='{{ barbican_api_port }}', daemon_threads=True)

if __name__ == '__main__':
    run()
07070100E8198B000081A4000003E800000064000000015B730CE200000612000001030000000400000000000000000000005300000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/templates/generate_kek#!/usr/bin/env python

# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#

import base64
import os
import os.path
import imp
import sys

path = os.path.dirname(os.path.realpath(__file__))

ardanaencrypt = imp.load_source('ardanaencrypt', path + '/../../../ardanaencrypt.py')

encryption_class = 'openssl'

ardanaencrypt_class = getattr(ardanaencrypt, encryption_class)

def generate_key(num_bytes=32, oldKey=None):
    value = base64.urlsafe_b64encode(os.urandom(num_bytes))
    if(len(sys.argv) > 1):
      value = sys.argv[1]

# Make sure input value is not encrypted already
    if (value.startswith(ardanaencrypt_class.prefix) or
        value.startswith(ardanaencrypt_class.legacy_prefix)):
      return value

obj = ardanaencrypt_class()

# More base64 encoding to avoid any new line or special chars
    result = obj.prefix + base64.urlsafe_b64encode(obj.encrypt(value))

return result

if __name__ == '__main__':
    print generate_key()
07070100E8198D000081A4000003E800000064000000015B730CE200001A3E000001030000000400000000000000000000005200000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/templates/policy.json{#
#
# (c) Copyright 2015-2017 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
#}
{
    "admin": "role:{{ barbican_admin_role }}",
    "observer": "role:{{ barbican_observer_role }}",
    "creator": "role:{{ barbican_creator_role }}",
    "audit": "role:{{ barbican_auditor_role }}",
    "service_admin": "role:{{ barbican_service_admin_role }}",
    "admin_or_user_does_not_work": "project_id:%(project_id)s",
    "admin_or_user": "rule:admin or project_id:%(project_id)s",
    "admin_or_creator": "rule:admin or rule:creator",
    "all_but_audit": "rule:admin or rule:observer or rule:creator",
    "all_users": "rule:admin or rule:observer or rule:creator or rule:audit or rule:service_admin",
    "secret_project_match": "project:%(target.secret.project_id)s",
    "secret_acl_read": "'read':%(target.secret.read)s",
    "secret_private_read": "'False':%(target.secret.read_project_access)s",
    "secret_creator_user": "user:%(target.secret.creator_id)s",
    "container_project_match": "project:%(target.container.project_id)s",
    "container_acl_read": "'read':%(target.container.read)s",
    "container_private_read": "'False':%(target.container.read_project_access)s",
    "container_creator_user": "user:%(target.container.creator_id)s",

"secret_non_private_read": "rule:all_users and rule:secret_project_match and not rule:secret_private_read",
    "secret_decrypt_non_private_read": "rule:all_but_audit and rule:secret_project_match and not rule:secret_private_read",
    "container_non_private_read": "rule:all_users and rule:container_project_match and not rule:container_private_read",
    "secret_project_admin": "rule:admin and rule:secret_project_match",
    "secret_project_creator": "rule:creator and rule:secret_project_match and rule:secret_creator_user",
    "container_project_admin": "rule:admin and rule:container_project_match",
    "container_project_creator": "rule:creator and rule:container_project_match and rule:container_creator_user",

"version:get": "@",
    "secret:decrypt": "rule:secret_decrypt_non_private_read or rule:secret_project_creator or rule:secret_project_admin or rule:secret_acl_read",
    "secret:get": "rule:secret_non_private_read or rule:secret_project_creator or rule:secret_project_admin or rule:secret_acl_read",
    "secret:put": "rule:admin_or_creator and rule:secret_project_match",
    "secret:delete": "rule:secret_project_admin or rule:secret_project_creator",
    "secrets:post": "rule:admin_or_creator",
    "secrets:get": "rule:all_but_audit",
    "orders:post": "rule:admin_or_creator",
    "orders:get": "rule:all_but_audit",
    "order:get": "rule:all_users",
    "order:put": "rule:admin_or_creator",
    "order:delete": "rule:admin",
    "consumer:get": "rule:admin or rule:observer or rule:creator or rule:audit or rule:container_non_private_read or rule:container_project_creator or rule:container_project_admin or rule:container_acl_read",
    "consumers:get": "rule:admin or rule:observer or rule:creator or rule:audit or rule:container_non_private_read or rule:container_project_creator or rule:container_project_admin or rule:container_acl_read",
    "consumers:post": "rule:admin or rule:container_non_private_read or rule:container_project_creator or rule:container_project_admin or rule:container_acl_read",
    "consumers:delete": "rule:admin or rule:container_non_private_read or rule:container_project_creator or rule:container_project_admin or rule:container_acl_read",
    "containers:post": "rule:admin_or_creator",
    "containers:get": "rule:all_but_audit",
    "container:get": "rule:container_non_private_read or rule:container_project_creator or rule:container_project_admin or rule:container_acl_read",
    "container:delete": "rule:container_project_admin or rule:container_project_creator",
    "container_secret:post": "rule:admin",
    "container_secret:delete": "rule:admin",
    "transport_key:get": "rule:all_users",
    "transport_key:delete": "rule:admin",
    "transport_keys:get": "rule:all_users",
    "transport_keys:post": "rule:admin",
    "certificate_authorities:get_limited": "rule:all_users",
    "certificate_authorities:get_all": "rule:admin",
    "certificate_authorities:post": "rule:admin",
    "certificate_authorities:get_preferred_ca": "rule:all_users",
    "certificate_authorities:get_global_preferred_ca": "rule:service_admin",
    "certificate_authorities:unset_global_preferred": "rule:service_admin",
    "certificate_authority:delete": "rule:admin",
    "certificate_authority:get": "rule:all_users",
    "certificate_authority:get_cacert": "rule:all_users",
    "certificate_authority:get_ca_cert_chain": "rule:all_users",
    "certificate_authority:get_projects": "rule:service_admin",
    "certificate_authority:add_to_project": "rule:admin",
    "certificate_authority:remove_from_project": "rule:admin",
    "certificate_authority:set_preferred": "rule:admin",
    "certificate_authority:set_global_preferred": "rule:service_admin",
    "secret_acls:put_patch": "rule:secret_project_admin or rule:secret_project_creator",
    "secret_acls:delete": "rule:secret_project_admin or rule:secret_project_creator",
    "secret_acls:get": "rule:all_but_audit and rule:secret_project_match",
    "container_acls:put_patch": "rule:container_project_admin or rule:container_project_creator",
    "container_acls:delete": "rule:container_project_admin or rule:container_project_creator",
    "container_acls:get": "rule:all_but_audit and rule:container_project_match",
    "quotas:get": "rule:all_users",
    "project_quotas:get": "rule:service_admin",
    "project_quotas:put": "rule:service_admin",
    "project_quotas:delete": "rule:service_admin",
    "secret_meta:get": "rule:all_but_audit",
    "secret_meta:post": "rule:admin_or_creator",
    "secret_meta:put": "rule:admin_or_creator",
    "secret_meta:delete": "rule:admin_or_creator",
    "secretstores:get": "rule:admin",
    "secretstores:get_global_default": "rule:admin",
    "secretstores:get_preferred": "rule:admin",
    "secretstore_preferred:post": "rule:admin",
    "secretstore_preferred:delete": "rule:admin",
    "secretstore:get": "rule:admin"
}
07070100E81989000081A4000003E800000064000000015B730CE200000929000001030000000400000000000000000000006200000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/templates/vassals_barbican-api.ini.j2{#
#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
#}
[uwsgi]
socket = {{ barbican_api_network_address }}:{{ barbican_api_port }}
protocol = http
cheaper-algo = spare
cheaper = {{ barbican_api_min_worker_count }}
cheaper-initial = {{ barbican_api_initial_worker_count }}
# windows in seconds. spawns new workers if all workers are busy during this window.
# uwsgi own default is 3. Increasing to 10.
cheaper-overload = 10
workers = {{ barbican_api_max_worker_count }}
threads = {{ barbican_api_threads_count }}
# lazy-apps = true will load application after fork
# lazy-apps = false , fork after loading application to share memory across workers
lazy-apps = false
# try to remove all of generated file/sockets
vacuum = true
#ignore-sigpipe = true
no-default-app = true
memory-report = true
# kill the process instead of reloading when SIGTERM is sent.
die-on-term = true
#the maximum time (in seconds) we wait for workers and other processes to die during reload/shutdown
reload-mercy=5
worker-reload-mercy=5
# disable-logging = true
# send stdout/stderr to the log engine too
pty-log = true
#logger = errorlog syslog
logger = monitorlog file:/var/log/barbican/barbican-monitor.log
logger = file:/var/log/barbican/barbican-access.log
log-route = monitorlog (GET / HTTP/1.\d)
#log-route = errorlog HTTP/1.0" 500
#logto=/var/log/barbican/barbican-access.log
log-format = %(host) - [%(ltime)] "%(method) %(uri) %(proto)" %(status) %(size) "%(referer)" "%(uagent)" "%(micros) micros" "rss: %(rssM) MB" "pid: %(pid)"
procname-prefix-spaced = barbican-api
#plugins = python
venv = {{ barbican_venv_dir }}
paste = config:{{ barbican_conf_dir }}/barbican-api-paste.ini
#paste-logger={{ barbican_conf_dir }}/api-logging.conf
#add-header = Connection: close
07070100E81983000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004100000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/vars07070100E81984000081A4000003E800000064000000015B730CE2000002D6000001030000000400000000000000000000004A00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-API/vars/main.yml#
# (c) Copyright 2015 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#

ardanauser : "{{ ansible_env['USER'] }}"
ardanauser_home: "{{ ansible_env['HOME'] }}"
07070100E62A4A000041ED000003E800000064000000085B730CE200000000000001030000000400000000000000000000003C00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR07070100E62A56000081A4000003E800000064000000015B730CE2000000F8000001030000000400000000000000000000004600000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/README.mdREADME
======

There are different configurable entries for Barbican Worker
1. Configuration entries that go into barbican-worker.conf
2. Deployment specific configuration which are not part of barbican-worker.conf like log_level, process count etc07070100E62A4F000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004500000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/defaults07070100E62A50000081A4000003E800000064000000015B730CE2000002F8000001030000000400000000000000000000004E00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/defaults/main.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017-2018 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

component_service_name: "{{ barbican_worker_service_name }}"

logging_conf_file_name: worker-logging.conf
07070100E62A4B000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004500000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/handlers07070100E62A4C000081A4000003E800000064000000015B730CE2000003B4000001030000000400000000000000000000004E00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/handlers/main.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---
# Handlers for Barbican Worker

- name: restart barbican worker
  service:
    name: "{{ barbican_worker_service_name }}"
    state: "restarted"
    sleep: "20"

# Handlers for Babrican worker config change
- name: barbican_worker_config_change
  set_fact:
    barbican_worker_restart_required: True
07070100E62A4D000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004100000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/meta07070100E62A4E000081A4000003E800000064000000015B730CE2000002C1000001030000000400000000000000000000004A00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/meta/main.yml#
# (c) Copyright 2015 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

dependencies:
  - role: barbican-common
  - role: KEYMGR-API
07070100E81975000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004200000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/tasks07070100E81978000081A4000003E800000064000000015B730CE200000284000001030000000400000000000000000000006400000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/tasks/_configure_deployment_options.yml#
# (c) Copyright 2015 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

07070100E81977000081A4000003E800000064000000015B730CE2000009BF000001030000000400000000000000000000005000000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/tasks/configure.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- include: ../../barbican-common/tasks/_set_directories.yml
  vars:
    install_package_result: "{{ barbican_worker_install_result }}"

- name: KEYMGR-WKR | configure  | Touch the log file
  file:
    path: "{{ item }}"
    owner: "{{ barbican_user }}"
    group: "{{ barbican_centralized_log_group }}"
    mode: 0640
    state: touch
  become: yes
  with_items:
    - "/var/log/barbican/barbican-worker.log"
    - "/var/log/barbican/barbican-worker-json.log"
  tags:
    - barbican

- name: KEYMGR-WKR | configure  | Configure the barbican worker logging conf
  template:
    src: "../../KEYMGR-API/templates/barbican.conf.j2"
    dest: "{{ barbican_conf_dir }}/barbican-worker.conf"
    mode: "0600"
    owner: "{{ barbican_user }}"
    group: "{{ barbican_group }}"
  become: yes
  register: ardana_notify_barbican_worker_restart_required
  tags:
    - barbican

- name: KEYMGR-WKR | configure  | Configure the barbican worker logging conf
  template:
    src: "worker-logging.conf.j2"
    dest: "{{ barbican_conf_dir }}/worker-logging.conf"
    mode: "0600"
    owner: "{{ barbican_user }}"
    group: "{{ barbican_group }}"
  become: yes
  register: ardana_notify_barbican_worker_restart_required
  tags:
    - barbican

- name: KEYMGR-WKR | configure | Create barbican-worker symlinks
  become: yes
  file:
    src: "{{ barbican_conf_dir }}/{{ item }}"
    dest: "/etc/barbican/{{ item }}"
    owner: "{{ barbican_user }}"
    group: "{{ barbican_group }}"
    state: "link"
  with_items:
    - worker-logging.conf
    - barbican-worker.conf
  tags:
    - barbican

- name: KEYMGR-WKR | configure  | Configure the barbican_worker script
  become: yes
  template:
    src: "barbican_worker"
    dest: "{{ barbican_bin_dir }}/barbican_worker"
    mode: "0755"
  register: ardana_notify_barbican_worker_restart_required
  tags:
    - barbican
07070100E8197B000081A4000003E800000064000000015B730CE2000002B1000001030000000400000000000000000000005900000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/tasks/configure_features.yml#
# (c) Copyright 2015 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- include: _configure_deployment_options.yml
07070100E81976000081A4000003E800000064000000015B730CE2000009F2000001030000000400000000000000000000004E00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/tasks/install.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- name: KEYMGR-WKR | install | Update venv cache
  become: yes
  install_package:
    cache: update

- name: KEYMGR-WKR | install | Install Barbican worker from barbican venv
  become: yes
  install_package:
    name: barbican
    service: "{{ barbican_worker_service_name }}"
    state: present
    activate: act_off
  register: barbican_worker_install_result
  notify: barbican_worker_config_change
  tags:
    - barbican

- name: KEYMGR-WKR | install | Install Barbican package result echo
  debug:
    msg: "barbican_worker_install_result =
      {{ barbican_worker_install_result }}"

- include: ../../barbican-common/tasks/_set_directories.yml
  vars:
    install_package_result: "{{ barbican_worker_install_result }}"

- name: KEYMGR-WKR | install | Create barbican worker config directory
  become: yes
  file:
    path: "{{ item.name }}"
    owner: "{{ barbican_user }}"
    group: "{{ barbican_group }}"
    mode: "{{ item.mode }}"
    state: "directory"
    recurse: "yes"
  with_items:
    - { name: "{{ barbican_conf_dir }}", mode: "u+rwx,g+rx,o+rx" }

tags:
    - barbican

- name: KEYMGR-WKR | install | Register barbican-worker as a service
  become: yes
  setup_systemd:
    service: "{{ barbican_worker_service_name }}"
    user: "{{ barbican_user }}"
    group: "{{ barbican_group }}"
    cmd: barbican_worker
    args: >
      --config-file "{{ barbican_conf_dir }}/barbican-worker.conf"
  tags:
    - barbican

- name: KEYMGR-WKR | install | print venv
  debug:
    msg: "Barbican worker venv dir = {{ barbican_venv_dir }},
    bin dir = {{ barbican_bin_dir }}, conf dir = {{ barbican_conf_dir }},
    share dir = {{ barbican_share_dir }}"

- name: KEYMGR-WKR | install | Create logging directory
  become: yes
  file:
    path: /var/log/barbican
    owner: "{{ barbican_user }}"
    group: "{{ barbican_group }}"
    mode: 0775
    state: directory
  tags:
    - barbican
07070100E81979000081A4000003E800000064000000015B730CE200000776000001030000000400000000000000000000004C00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/tasks/start.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

# Restart or start Barbican Worker
- name: KEYMGR-WKR | start | Activate the latest install
  become: yes
  install_package:
    name: barbican-worker
    service: "{{ barbican_worker_service_name }}"
    activate: act_on
    version: "{{ barbican_worker_install_result.version }}"
  register: barbican_worker_activate_result
  when: barbican_worker_install_result is defined
  tags:
    - barbican

- name: KEYMGR-WKR | start | Activate barbican worker result echo
  debug:
    msg: "barbican_worker_activate_result =
    {{ barbican_worker_activate_result }}"
  when: barbican_worker_activate_result is defined

- name: KEYMGR-WKR | start | Restart barbican-worker service
  become: yes
  service:
    name: "{{ barbican_worker_service_name }}"
    state: restarted
  when: (ardana_notify_barbican_worker_restart_required is defined and
        ardana_notify_barbican_worker_restart_required.changed and
        barbican_worker_restarted_result is not defined)
        or barbican_worker_restart_required
  register: barbican_worker_restarted_result
  tags:
    - barbican

- name: KEYMGR-WKR | start | Ensure barbican-worker service is started
  become: yes
  service:
    name: "{{ barbican_worker_service_name }}"
    state: started
  tags:
    - barbican
07070100E8197A000081A4000003E800000064000000015B730CE20000031F000001030000000400000000000000000000004B00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/tasks/stop.yml#
# (c) Copyright 2015 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- name: KEYMGR-WKR | stop | Stop Barbican Worker service/process
  service:
    name: "{{ barbican_worker_service_name }}"
    state: stopped
  become: yes07070100E62A53000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004600000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/templates07070100E62A54000081A4000003E800000064000000015B730CE2000000BF000001030000000400000000000000000000005600000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/templates/barbican_worker#!/bin/bash

CONFIG_DIR={{ barbican_conf_dir }}

echo "Command line arguments: [$@]"

echo "Barbican worker process."
{{ barbican_bin_dir }}/python {{ barbican_bin_dir }}/barbican-worker $@
07070100E62A55000081A4000003E800000064000000015B730CE200000853000001030000000400000000000000000000005D00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/templates/worker-logging.conf.j2{#
#
# (c) Copyright 2015 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
#}
[loggers]
keys: root, iso8601

[handlers]
keys: watchedfile, logstash

[formatters]
keys:  debug,minimal, normal, logstash

###########
# Loggers #
###########

[logger_root]
qualname: root
handlers: watchedfile, logstash
level: NOTSET

[logger_iso8601]
qualname: iso8601
handlers: watchedfile, logstash
level: INFO

################
# Log Handlers #
################

# Writes to disk
[handler_watchedfile]
class: handlers.WatchedFileHandler
args: ('/var/log/barbican/barbican-worker.log',)
formatter = debug
level: {{ barbican_loglevel }}

# Writes JSON to disk, beaver will ship to logstash
[handler_logstash]
class: handlers.WatchedFileHandler
args: ('/var/log/barbican/barbican-worker-json.log',)
formatter= logstash
level: {{ barbican_logstash_loglevel }}

##################
# Log Formatters #
##################

[formatter_minimal]
format=%(message)s

[formatter_normal]
format=(%(name)s): %(asctime)s %(levelname)s %(message)s

[formatter_debug]
format=(%(name)s): %(asctime)s %(levelname)s %(module)s %(funcName)s %(message)s

# the "format" attr actually sets the "type"
[formatter_logstash]
class = logstash.LogstashFormatterVersion1
format = barbican

07070100E62A51000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004100000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/vars07070100E62A52000081A4000003E800000064000000015B730CE2000002DD000001030000000400000000000000000000004A00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/KEYMGR-WKR/vars/main.yml#
# (c) Copyright 2015 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
wkr_ardanauser : "{{ ansible_env['USER'] }}"
wkr_ardanauser_home: "{{ ansible_env['HOME'] }}"
07070100E428DB000041ED000003E800000064000000065B730CE200000000000001030000000400000000000000000000004100000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-common07070100E627FB000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004A00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-common/defaults07070100E62A40000081A4000003E800000064000000015B730CE200001C8B000001030000000400000000000000000000005300000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-common/defaults/main.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017-2018 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

barbican_home_dir: /home/barbican
barbican_user: barbican
barbican_group: barbican
barbican_centralized_log_group: adm

service: barbican

barbican_api_network_address: "{{ host.bind.KEYMGR_API.internal.ip_address }}"
barbican_api_port: "{{ host.bind.KEYMGR_API.internal.port }}"

barbican_bin_dir: "{{ service | bin_dir() }}"
barbican_conf_dir: "{{ service | config_dir() }}/{{service}}"
barbican_share_dir: "{{ service | share_dir() }}"
barbican_venv_dir: "{{ service | venv_dir }}"
barbican_unversioned_conf_dir: "{{ service | config_dir() }}/{{service}}"

barbican_admin_domain_name: "Default"

barbican_admin_role: "{{ KEYMGR_API.vars.barbican_admin_role | default (KEY_API.vars.keystone_admin_role) }}"
barbican_observer_role: "key-manager:observer"
barbican_creator_role: "key-manager:creator"
barbican_auditor_role: "key-manager:auditor"
barbican_service_admin_role: "key-manager:service-admin"
keystone_service_role: service

barbican_api_audit_enable: "{{ KEYMGR.audit.enabled }}"

barbican_audit_log_base_location: "{{ KEYMGR.audit.dir }}"

barbican_admin_user: "{{ KEYMGR_API.vars.barbican_admin_user }}"
barbican_admin_user_password: "{{ KEYMGR_API.vars.barbican_admin_password | quote }}"

barbican_service_user: "{{ KEYMGR_API.vars.barbican_service_user }}"
barbican_service_password: "{{ KEYMGR_API.vars.barbican_service_password | quote }}"
#barbican_service_password: '%random-password%'

barbican_api_conf_file: barbican.conf

barbican_api_service_name: barbican-api
barbican_worker_service_name: barbican-worker

# Keystone specific variables
keystone:
  admin_user: "{{ KEY_API.vars.keystone_admin_user }}"
  admin_password: "{{ KEY_API.vars.keystone_admin_pwd | quote }}"
  default_domain_name: "{{ KEY_API.vars.keystone_default_domain }}"
  admin_tenant_name: "{{ KEY_API.vars.keystone_admin_tenant }}"
  service_tenant_name: "{{ KEY_API.vars.keystone_service_tenant }}"
  admin_role: "{{ KEY_API.vars.keystone_admin_role }}"
  auth_url: "{{ KEYMGR_API.consumes_KEY_API.vips.private[0].url }}"
  identity_url: "{{ KEYMGR_API.consumes_KEY_API.vips.private[0].url }}"
  admin_url: "{{ KEYMGR_API.consumes_KEY_API.vips.private[0].url }}"
  ca_file: "{{ trusted_ca_bundle }}"

memcached_servers: "{% for x in KEYMGR.consumes_FND_MEM.members.private %}{{ x.host }}:{{ x.port }}{%if
 not loop.last %},{% endif %}{% endfor %}"
memcache_secret_key: "{{ KEYMGR.consumes_FND_MEM.vars.memcached.barbican.secret_key | quote }}"

barbican_db_ca_file: "{{ trusted_ca_bundle }}"
barbican_database_connection_string: "mysql+pymysql://{{ KEYMGR_API.consumes_FND_MDB.vars.accounts.barbican.username }}:{{ KEYMGR_API.consumes_FND_MDB.vars.accounts.barbican.password | urlencode }}@{{ KEYMGR_API.consumes_FND_MDB.vips.private[0].host }}/barbican{% if KEYMGR_API.consumes_FND_MDB.vips.private[0].use_tls %}?ssl_ca={{ barbican_db_ca_file }}{% endif %}"

barbican_admin_vip_protocol: "{{ KEYMGR_API.advertises.vips.admin[0].protocol }}"
barbican_admin_vip_host: "{{ KEYMGR_API.advertises.vips.admin[0].host }}"
barbican_admin_vip_port: "{{ KEYMGR_API.advertises.vips.admin[0].port }}"

barbican_internal_vip_protocol: "{{ KEYMGR_API.advertises.vips.private[0].protocol }}"
barbican_internal_vip_host: "{{ KEYMGR_API.advertises.vips.private[0].host }}"
barbican_internal_vip_port: "{{ KEYMGR_API.advertises.vips.private[0].port }}"

barbican_public_vip_protocol: "{{ KEYMGR_API.advertises.vips.public[0].protocol }}"
barbican_public_vip_host: "{{ KEYMGR_API.advertises.vips.public[0].host }}"
barbican_public_vip_port: "{{ KEYMGR_API.advertises.vips.public[0].port }}"

barbican_internal_endpoint: "{{ KEYMGR_API.advertises.vips.private[0].url }}"

# Default master key used for store_crypto plugin
# Mainly defined for CI/CD processing.
#barbican_default_master_key: "3Z8QOImQyi2PAZUHjcqfxkcvZhPlHyXlH2wqjgwRpDI="
barbican_default_master_key: "{{ KEYMGR_API.vars.barbican_master_kek_db_plugin | b64encode }}"

# Value passed to barbican configuration, keep it blank
barbican_simple_crypto_master_key:

barbican_pkcs11_package_name:
barbican_pkcs11_slot_id: 1
barbican_pkcs11_generate_labels: False

barbican_secretstore_plugins:
barbican_enabled_crypto_plugins:

barbican_pkcs11_eskm_generate_conf: False
# ESKM specific path as defined in pkcs11 3rd party library.
barbican_pkcs11_eskm_connector_base_path: "/opt/hpe/eskm_pkcs11"
barbican_pkcs11_eskm_connector_library_path: "{{ barbican_pkcs11_eskm_connector_base_path }}/lib/libhppkcs11.so"
barbican_pkcs11_eskm_connector_client_cert_path: "{{ barbican_pkcs11_eskm_connector_base_path }}/conf/cert.pem"
barbican_pkcs11_eskm_connector_client_key_path: "{{ barbican_pkcs11_eskm_connector_base_path }}/conf/privkey.pem"
barbican_pkcs11_eskm_connector_client_cacert_path: "{{ barbican_pkcs11_eskm_connector_base_path }}/conf/ca.pem"
barbican_pkcs11_eskm_kmip_host:
barbican_pkcs11_eskm_kmip_port: 5696

barbican_pkcs11_project_kek_cache_ttl_secs: 900
barbican_pkcs11_project_kek_cache_size: 100

# Message queue variables
_mq_hosts_list: "{{ KEYMGR_API.consumes_FND_RMQ.members.private | default (KEYMGR_API.consumes_FND_RMQ.members.public) }}"

barbican_control_exchange: openstack
barbican_notification_driver: log

barbican_rabbit_user: "{{ KEYMGR.consumes_FND_RMQ.vars.accounts.barbican.username }}"
barbican_rabbit_password: "{{ KEYMGR.consumes_FND_RMQ.vars.accounts.barbican.password }}"
barbican_rabbit_use_ssl: "{{ KEYMGR.consumes_FND_RMQ.members.private[0].use_tls }}"
barbican_rabbit_hosts_url: >
  {%- for x in _mq_hosts_list -%}
    {{ barbican_rabbit_user }}:{{ barbican_rabbit_password }}@{{ x.host }}:{{ x.port }}{%- if not loop.last -%},{%- endif -%}
  {%- endfor -%}
barbican_transport_url: "rabbit://{{ barbican_rabbit_hosts_url }}//"

barbican_api_ssl_client_key: "{{ barbican_conf_dir }}/ssl/certs/client.key"
barbican_api_ssl_client_cert: "{{ barbican_conf_dir }}/ssl/certs/client.crt"
barbican_api_ssl_ca_cert: "{{ barbican_conf_dir }}/ssl/certs/ca.crt"

barbican_kmip_client_key_path: "/etc/barbican/ssl/certs/kmip_client.key"
barbican_kmip_client_cert_path: "/etc/barbican/ssl/certs/kmip_client.crt"
barbican_kmip_client_cacert_path: "/etc/barbican/ssl/certs/kmip_ca.crt"

barbican_host_set: "{{ groups[verb_hosts.KEYMGR_API]  | default([]) }}"

# Barbican database version, head means version as per included barbican code base
# Please see https://github.com/openstack/barbican/blob/stable/liberty/barbican/cmd/db_manage.py#L72
barbican_db_version: head

# flag set in configure playbooks to trigger services handlers to restart
barbican_restart_required: False
barbican_api_restart_required: False
barbican_worker_restart_required: False
barbican_api_reload_required: False
07070100E428DC000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004600000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-common/meta07070100E428DD000081A4000003E800000064000000015B730CE200000263000001030000000400000000000000000000004F00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-common/meta/main.yml# (c) Copyright 2018 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---
dependencies:
  - role: tls-vars
07070100E62A45000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004700000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-common/tasks07070100E62A46000081A4000003E800000064000000015B730CE20000066B000001030000000400000000000000000000006500000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-common/tasks/_read_existing_master_key.yml#
# (c) Copyright 2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---
- name: barbican-common | _read_existing_master_key |
    Read existing master keks from controller
  shell:
    crudini --get /etc/barbican/{{ barbican_api_conf_file }}
    simple_crypto_plugin kek | sed s/\"//g
  ignore_errors: yes
  become: yes
  register: barbican_existing_master_kek_result
  when:
    barbican_customer_master_key is undefined or
    not barbican_customer_master_key

- name: barbican-common | _read_existing_master_key |
    Use existing master key from controller if present
  ignore_errors: yes
  set_fact:
    barbican_simple_crypto_master_key:
      "{{ barbican_existing_master_kek_result.stdout }}"
  when:
    barbican_customer_master_key is undefined or
    not barbican_customer_master_key

- name: barbican-common | _read_existing_master_key |
    Use customer master key if defined
  set_fact:
    barbican_simple_crypto_master_key:
      "{{ barbican_customer_master_key }}"
  when:
    barbican_customer_master_key is defined and
    barbican_customer_master_key
07070100E62A49000081A4000003E800000064000000015B730CE200000418000001030000000400000000000000000000005D00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-common/tasks/_schedule_restart.yml#
# (c) Copyright 2018 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---
- name: barbican-common | _schedule_restart |
    Schedule a restart for barbican-api
  debug:
    msg: "Trigger a change notification in barbican-api"
  changed_when: true
  register: ardana_notify_barbican_api_restart_required

- name: barbican-common | _schedule_restart |
    Schedule a restart for barbican-worker
  debug:
    msg: "Trigger a change notification in barbican-worker"
  changed_when: true
  register: ardana_notify_barbican_worker_restart_required
07070100E62A47000081A4000003E800000064000000015B730CE200000696000001030000000400000000000000000000005C00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-common/tasks/_set_directories.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- name: barbican-common | _set_directories |
    set service etc directory - configure
  set_fact:
    barbican_bin_dir:
      "{{ component_service_name | bin_dir(install_package_result.version) }}"
    barbican_conf_dir:
      "{{ component_service_name | config_dir(install_package_result.version)
      }}/{{ service }}"
    barbican_share_dir:
      "{{ component_service_name | share_dir(install_package_result.version) }}"
    barbican_venv_dir:
      "{{ component_service_name | venv_dir(install_package_result.version) }}"
  when: install_package_result.version is defined

- name: barbican-common | _set_directories |
    set service etc directory - reconfigure
  set_fact:
    barbican_bin_dir:
      "{{ component_service_name | bin_dir() }}"
    barbican_conf_dir:
      "{{ component_service_name | config_dir() }}/{{ service }}"
    barbican_share_dir:
      "{{ component_service_name | share_dir() }}"
    barbican_venv_dir: "{{ component_service_name | venv_dir }}"
  when: install_package_result.version is undefined
07070100E62A48000081A4000003E800000064000000015B730CE200000985000001030000000400000000000000000000005000000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-common/tasks/main.yml#
# (c) Copyright 2015-2017 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

- name: barbican-common | main | include OS specific variables
  include_vars: "{{ ansible_os_family | lower }}.yml"

- name: barbican-common | main |
    Include vars file with customer barbican configuration values
  include_vars: barbican_deploy_config.yml
  tags:
    - barbican
    - barbican_debug

- include: _read_existing_master_key.yml

- name: barbican-common | main |
    Set max api worker count to 8 if dynamic CPU based count is less than 8
  set_fact:
    barbican_api_max_worker_count: 8
  when: barbican_api_max_worker_count < 8
  tags:
    - barbican

- name: barbican-common | main |
    Increase max api worker count by 4 if incorrectly set to be less than min
    count value.
  debug:
    msg: "WARNING Barbican API max worker count
        [{{ barbican_api_max_worker_count }}] must be greater than
        min worker count [{{ barbican_api_min_worker_count }}].
        Setting max count to be greater by 4."
  tags:
    - barbican
  when: barbican_api_max_worker_count|int <= barbican_api_min_worker_count|int

- name: barbican-common | main |
    Increase max api worker count by 4 if its not set to be greater than min
    count value.
  set_fact:
    barbican_api_max_worker_count: "{{ barbican_api_min_worker_count + 4 }}"
  when: barbican_api_max_worker_count|int <= barbican_api_min_worker_count|int
  tags:
    - barbican

- name: barbican-common | main |
    Display variables that are configured for KEYMGR-API
  debug:
    var: KEYMGR_API
  tags:
    - barbican
    - barbican_debug
  when: barbican_debug is defined
  run_once: True

- name: barbican-common | main | Display variables for the inventory host
  debug:
    var: hostvars[inventory_hostname]
  tags:
    - barbican
    - barbican_debug
  when: barbican_debug is defined
  run_once: True
07070100E62A41000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004600000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-common/vars07070100E62A43000081A4000003E800000064000000015B730CE200001539000001030000000400000000000000000000006100000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-common/vars/barbican_deploy_config.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#

# Possible log levels are INFO/DEBUG/WARN/ERROR
barbican_loglevel: "{{ ardana_loglevel | default('INFO') }}"
barbican_logstash_loglevel: "{{ ardana_loglevel | default('INFO') }}"

#########################################################################################
# Using uwsgi adaptive process spawning to dynamically scale workers.
# See http://uwsgi-docs.readthedocs.org/en/latest/Cheaper.html
# cheaper-algo = spare, cheaper = 4 (min count), cheaper-initial = 6

# Set maximum number of workers that can be spawned. Max value is dynamically
# calculated based on underlying hardware capability.
# If dynamically calculated value is less than 8, then 8 is used.
# Max count needs to be greater than min count (below). If its set to lower or equal
# value, then max count is updated to be 4 higher than min count.
barbican_api_max_worker_count:  "{{ ansible_processor_count * ansible_processor_cores * 2| default('8') }}"

# Minimum number of idle workers to be kept running.
barbican_api_min_worker_count: 4

# Number of workers to create at barbican api server startup
#barbican_api_initial_worker_count: 6
barbican_api_initial_worker_count: 4

# Multi-processing is used instead of threading. Threads are kept 1
# Python threading is useful in high IO load interactions.
barbican_api_threads_count:  1
#########################################################################################

# Customer provided master key during first time barbican initial deployment.
# The key should be a 32-byte value which is base64 encoded.
# This value must be set before cloud deployment (with site.yml) starts.
# Note: Master key should not be changed as there can be existing entries using
# this key for encrypting barbican project kek and secrets.
# barbican_customer_master_key: "3Z8QOImQyi2PAZUHjcqfxkcvZhPlHyXlH2wqjgwRpDI="
barbican_customer_master_key:

#######################################################################
#################### KMIP Plugin Configuration Section #################
#######################################################################
# Flag to reflect whether KMIP plugin is to be used as backend for storing secrets
use_kmip_secretstore_plugin: False

# Note: Connection username needs to match with 'Common Name' provided
# in client cert request (CSR).
barbican_kmip_username:
barbican_kmip_password:
barbican_kmip_host:
barbican_kmip_port:

###############################################################################
#################### PKCS11 Crypto Plugin Configuration Section ###############
###############################################################################

# Set to True when want to use PKCS11 crypto plugin. This plugin stores project
# level kek and master kek in PKCS11 compatible HSM device. Encrypted keys are
# stored in DB using 'store_crypto' secret store plugin. A deployment can use
# HSM device either via PKCS11 crypto model or KMIP plugin model. Both cannot
# be enabled within a single barbican deployment.
use_pkcs11_crypto_plugin: False

barbican_pkcs11_session_password:
barbican_pkcs11_mkek_label:
barbican_pkcs11_hmac_label:

# There is a in-memory cache used with pkcs11 interaction where object handle
# (pointer) to project kek (key encryption key) is stored. This handle is a
# reference to key which is created in HSM as part of unwrap (register/import)
# of 'wrapped_key' column in 'kek_data' table. This handle is added to cache
# when project kek is needed first time on that specific barbican node/process.
# These object handles are destoryed in HSM only when expired handle is
# accessed or cache size limit is reached. This cache cannot be disabled though
# value of ttl seconds or size limit can be reduced if need to limit caching
# behavior.

# pkcs11 project kek (key encryption key) cache time to live (expiry) seconds.
barbican_pkcs11_project_kek_cache_ttl_secs: 900
# pkcs11 project kek (key encryption key) cache max size.
barbican_pkcs11_project_kek_cache_size: 100

# HSM Slot id (Should correspond to a configured PKCS11 slot). Default: 1
# Change here if it needs to be different from default
barbican_pkcs11_slot_id: 1

# Flag to set to True if ESKM is used as HSM otherwise keep it False.
# With following flag set to True, playbook will use ESKM predefined path
# so those are not required in that case.
barbican_pkcs11_provider_is_eskm:
barbican_pkcs11_eskm_kmip_host:
barbican_pkcs11_eskm_kmip_port:

# Following are required paths on controller nodes related to PKCS11 setup.
# With flag barbican_pkcs11_provider_is_eskm as True, following paths are not
# required as default expected paths are used for ESKM PKCS11 library.
barbican_pkcs11_library_path:
barbican_pkcs11_client_cert_path:
barbican_pkcs11_client_key_path:
barbican_pkcs11_client_cacert_path:
07070100E62A42000081A4000003E800000064000000015B730CE2000002DA000001030000000400000000000000000000005100000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-common/vars/debian.yml#
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---
barbican_package_dependencies:
  - python-dev
  - libffi-dev
  - libssl-dev
  - libmysqlclient18
  - libldap2-dev
  - libsasl2-dev
  - python-httplib207070100E62A44000081A4000003E800000064000000015B730CE2000002D4000001030000000400000000000000000000004F00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-common/vars/suse.yml#
# (c) Copyright 2017-2018 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---
barbican_package_dependencies:
  - apache2-mod_wsgi
  - libffi4
  - libmysqlclient18
  - libopenssl1_0_0
  - logrotate
  - python-httplib2
07070100E428D3000041ED000003E800000064000000055B730CE200000000000001030000000400000000000000000000004200000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-monitor07070100E428D4000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004700000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-monitor/meta07070100E428D5000081A4000003E800000064000000015B730CE2000002D4000001030000000400000000000000000000005000000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-monitor/meta/main.yml#
# (c) Copyright 2015 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

dependencies:
  - role: barbican-common
  - {role: monasca-agent, run_mode: Use}07070100E428D8000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004800000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-monitor/tasks07070100E428DA000081A4000003E800000064000000015B730CE20000058E000001030000000400000000000000000000005A00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-monitor/tasks/local_monitor.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#

- name: barbican-monitor | local_monitor |
    Set up check on barbican wsgi process and admin endpoint locally
  become: yes
  monasca_agent_plugin:
    name: "barbican"
    args: "disable_http_check=yes"
  tags:
    - barbican
    - barbican_monitor

- name:  barbican-monitor | local_monitor |
    Setup active check on barbican internal
  become: yes
  monasca_agent_plugin:
    name: "httpcheck"
    args: >
        use_keystone=False
        url=http://{{ barbican_api_network_address }}:{{ item.port }}
        dimensions=service:key-manager,component:barbican-api,api_endpoint:{{ item.api_endpoint }},monitored_host_type:instance
  with_items:
    - [{ api_endpoint: 'internal', port: "{{ barbican_internal_vip_port }}"} ]
  tags:
    - barbican
    - barbican_monitor
07070100E428D9000081A4000003E800000064000000015B730CE200000447000001030000000400000000000000000000005B00000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-monitor/tasks/remote_monitor.yml#
# (c) Copyright 2015-2016 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#

- name: barbican-monitor | remote_monitor |
    Setup http check against Barbican VIP
  become: yes
  monasca_agent_plugin:
    name: "httpcheck"
    args: >
      use_keystone=False
      url={{ item.url }}/
      dimensions=service:key-manager,component:barbican-api,api_endpoint:{{ item.api_endpoint }},monitored_host_type:vip
  with_items:
    - { api_endpoint: 'internal', url: "{{ barbican_internal_endpoint }}"}
  tags:
    - barbican_monitor
07070100E428D6000041ED000003E800000064000000025B730CE200000000000001030000000400000000000000000000004700000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-monitor/vars07070100E428D7000081A4000003E800000064000000015B730CE2000002D9000001030000000400000000000000000000005000000000ardana-barbican-8.0+git.1534266594.8136db7/roles/barbican-monitor/vars/main.yml#
# (c) Copyright 2015 Hewlett Packard Enterprise Development LP
# (c) Copyright 2017 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
---

ardanauser : "{{ ansible_env['USER'] }}"
ardanauser_home: "{{ ansible_env['HOME'] }}"07070100000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000B00000000TRAILER!!!435 blocks

Places

File ardana-barbican-8.0+git.1534266594.8136db7.obscpio of Package ardana-barbican (Revision 23abecc37cf5db54ca92513c3f451845)

Places