Description of problem: As a user, I would like to have DCN edge nodes able to use Barbican (hosted in central site). Support for Barbican in a DCN / Multi stacks context. Currently the central stack is correctly configured (controllers and computes) but the edge stacks are not. We need to apply barbican configuration on the edge stacks for nova, cinder and glance services. Version-Release number of selected component (if applicable): 16.1.0 How reproducible: always Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
I want to refine the problem description to avoid potential misunderstanding. The goal is not to deploy barbican at the edge, but to allow edge nodes to access the barbican service in the control plane (i.e. running in the central site). The edge services that need access to barbican are cinder-volume, glance-api and nova-compute, and this entails configuring a few parameters the services use to access their Key Manager (e.g. barbican). In the control plane, the barbican THT configures the services at [1],[2],[3]. [1] https://opendev.org/openstack/tripleo-heat-templates/src/branch/stable/train/deployment/barbican/barbican-api-container-puppet.yaml#L281 [2] https://opendev.org/openstack/tripleo-heat-templates/src/branch/stable/train/deployment/barbican/barbican-api-container-puppet.yaml#L288 [3] https://opendev.org/openstack/tripleo-heat-templates/src/branch/stable/train/deployment/barbican/barbican-api-container-puppet.yaml#L274 Unfortunately, the control plane's Key Manager hiera data is not exported to the edge sites. The solution I have in mind is to create a new, lightweight "barbican-api-edge" service that provides the relevant data. This new THT will not actually run the barbican service, it will simply generate the same Key Manager settings so that the edge services will access barbican in the control plane.
The patch has merged on upstream stable/train, and will be included in the next import for z2.
Tested on DCN environment with the latest 16.1.2 candidate, with barbican deployed centrally. Verified using: barbican_tempest_plugin.tests.scenario.test_volume_encryption.VolumeEncryptionTest.test_encrypted_cinder_volumes_luks configured to create volumes using the az-dcn2 availability zone (and the associated dcn2) by changing tempest.conf: compute.compute_volume_common_az = az-dcn2 openstack-tempest-23.0.0-0.20200609093435.d432237 barbican-tempest-plugin from commit a4523f3572082e6a9eb2611d0f21798bf3c132d5 (basically 1.1.0).
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Red Hat OpenStack Platform 16.1 bug fix and enhancement advisory), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2020:4284