4.2. 使用密钥管理器服务

流程

1. 添加 kek secret：

   $ oc set data secret/osp-secret "BarbicanSimpleCryptoKEK=$($CONTROLLER1_SSH "python3 -c \"import configparser; c = configparser.ConfigParser(); c.read('/var/lib/config-data/puppet-generated/barbican/etc/barbican/barbican.conf'); print(c['simple_crypto_plugin']['kek'])\"")"

2. 对 OpenStackControlPlane CR 进行补丁来部署 Key Manager 服务：

   $ oc patch openstackcontrolplane openstack --type=merge --patch '
   spec:
     barbican:
       enabled: true
       apiOverride:
         route: {}
       template:
         databaseInstance: openstack
         databaseAccount: barbican
         rabbitMqClusterName: rabbitmq
         secret: osp-secret
         simpleCryptoBackendSecret: osp-secret
         serviceAccount: barbican
         serviceUser: barbican
         passwordSelectors:
           service: BarbicanPassword
           simplecryptokek: BarbicanSimpleCryptoKEK
         barbicanAPI:
           replicas: 1
           override:
             service:
               internal:
                 metadata:
                   annotations:
                     metallb.universe.tf/address-pool: internalapi
                     metallb.universe.tf/allow-shared-ip: internalapi
                     metallb.universe.tf/loadBalancerIPs: 172.17.0.80 

   1

   
                 spec:
                   type: LoadBalancer
         barbicanWorker:
           replicas: 1
         barbicanKeystoneListener:
           replicas: 1
   '

   1

   如果使用 IPv6，请将负载均衡器 IP 更改为环境中的负载均衡器 IP，如 metallb.universe.tf/loadBalancerIPs: fd00:bbbb::80。