2.6. 备份简单的加密加密密钥

流程

1. 在 overcloud 上，生成新的 256 位密钥并将其存储在 barbican 中：

   (overcloud) [stack@undercloud-0 ~]$ openstack secret order create --name swift_key --algorithm aes --mode ctr --bit-length 256 --payload-content-type=application/octet-stream key
   +----------------+-----------------------------------------------------------------------+
   | Field          | Value                                                                 |
   +----------------+-----------------------------------------------------------------------+
   | Order href     | http://10.0.0.104:9311/v1/orders/2a11584d-851c-4bc2-83b7-35d04d3bae86 |
   | Type           | Key                                                                   |
   | Container href | N/A                                                                   |
   | Secret href    | None                                                                  |
   | Created        | None                                                                  |
   | Status         | None                                                                  |
   | Error code     | None                                                                  |
   | Error message  | None                                                                  |
   +----------------+-----------------------------------------------------------------------+

   Copy to Clipboard Toggle word wrap

2. 创建测试 secret：

   (overcloud) [stack@undercloud-0 ~]$ openstack secret store --name testSecret --payload 'TestPayload'
   +---------------+------------------------------------------------------------------------+
   | Field         | Value                                                                  |
   +---------------+------------------------------------------------------------------------+
   | Secret href   | http://10.0.0.104:9311/v1/secrets/93f62cfd-e008-401f-be74-bf057c88b04a |
   | Name          | testSecret                                                             |
   | Created       | None                                                                   |
   | Status        | None                                                                   |
   | Content types | None                                                                   |
   | Algorithm     | aes                                                                    |
   | Bit length    | 256                                                                    |
   | Secret type   | opaque                                                                 |
   | Mode          | cbc                                                                    |
   | Expiration    | None                                                                   |
   +---------------+------------------------------------------------------------------------+

   Copy to Clipboard Toggle word wrap

3. 确认创建了 test secret：

   (overcloud) [stack@undercloud-0 ~]$ openstack secret list
   +------------------------------------------------------------------------+------------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+
   | Secret href                                                            | Name       | Created                   | Status | Content types                             | Algorithm | Bit length | Secret type | Mode | Expiration |
   +------------------------------------------------------------------------+------------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+
   | http://10.0.0.104:9311/v1/secrets/93f62cfd-e008-401f-be74-bf057c88b04a | testSecret | 2018-06-19T18:25:25+00:00 | ACTIVE | {u'default': u'text/plain'}               | aes       |        256 | opaque      | cbc  | None       |
   | http://10.0.0.104:9311/v1/secrets/f664b5cf-5221-47e5-9887-608972a5fefb | swift_key  | 2018-06-19T18:24:40+00:00 | ACTIVE | {u'default': u'application/octet-stream'} | aes       |        256 | symmetric   | ctr  | None       |
   +------------------------------------------------------------------------+------------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+

   Copy to Clipboard Toggle word wrap
4. 将包含主 KEK 的 barbican.conf 文件复制到安全强化的位置。

5. 登录到 controller-0 节点并检索 barbican 用户密码：

   [tripleo-admin@controller-0 ~]$ sudo grep -r "barbican::db::mysql::password" /etc/puppet/hieradata
   /etc/puppet/hieradata/service_configs.json:    "barbican::db::mysql::password": "seDJRsMNRrBdFryCmNUEFPPev",

   Copy to Clipboard Toggle word wrap
   注意

   只有用户 barbican 有权访问 barbican 数据库。因此，需要 barbican 用户密码来备份或恢复数据库。

6. 备份 barbican 数据库：

   [tripleo-admin@controller-0 ~]$ mysqldump -u barbican -p"seDJRsMNRrBdFryCmNUEFPPev" barbican > barbican_db_backup.sql

   Copy to Clipboard Toggle word wrap

7. 检查数据库备份是否存储在 /home/tripleo-admin 中：

   [tripleo-admin@controller-0 ~]$ ll
   total 36
   -rw-rw-r--. 1 tripleo-admin tripleo-admin 36715 Jun 19 18:31 barbican_db_backup.sql

   Copy to Clipboard Toggle word wrap

8. 在 overcloud 上，删除之前创建的 secret，并验证它们是否不再存在：

   (overcloud) [stack@undercloud-0 ~]$ openstack secret delete http://10.0.0.104:9311/v1/secrets/93f62cfd-e008-401f-be74-bf057c88b04a
   (overcloud) [stack@undercloud-0 ~]$ openstack secret delete http://10.0.0.104:9311/v1/secrets/f664b5cf-5221-47e5-9887-608972a5fefb
   (overcloud) [stack@undercloud-0 ~]$ openstack secret list
   
   (overcloud) [stack@undercloud-0 ~]$

   Copy to Clipboard Toggle word wrap