barbican — Interactions

Interactions — barbican — branch stable/2026.2

Branch stable/2026.2 @ de32745a7a4f — repository https://opendev.org/openstack/barbican — analysed on 2026-10-29

1. Database

1.1 Access pattern

• SQLAlchemy 2 ORM on an oslo.db engine (barbican/model/repositories.py:196) with a thread-local scoped_session (barbican/model/repositories.py:113). Every API request is one transaction: Pecan's TransactionHook calls repositories.start / commit / rollback / clear around the handler (barbican/api/hooks.py:41); a GET is "read only" for Pecan but uses the same session.
• POST /v1/orders commits inside the handler before casting to the worker, so the worker can read the order (barbican/api/controllers/orders.py:197). Quotas are committed explicitly too (barbican/common/quota.py:112).
• Workers wrap each task in its own transaction (barbican/queue/server.py:72); the Keystone listener and the retry scheduler do the same (barbican/tasks/keystone_consumer.py:47, barbican/queue/retry_scheduler.py:135).
• No SELECT … FOR UPDATE anywhere. Concurrency is handled by unique constraints and "catch the duplicate, re-read": project creation (barbican/common/resources.py:52), consumer registration (barbican/model/repositories.py:1460). Concurrent KEK creation can leave several active KEKs; the oldest is kept, the others are deactivated on the next use (barbican/model/repositories.py:965).
• Schema: [DEFAULT] db_auto_create = True creates the tables from the models and stamps Alembic head, or runs the upgrade when alembic_version exists (barbican/model/repositories.py:230); production runs barbican-manage db upgrade (barbican/cmd/barbican_manage.py:115). Alembic head on this branch: 8c74e2d7f1ff (3 revisions since the Ocata rebase).
• Soft delete: most tables carry deleted/deleted_at (barbican/model/models.py:209); reads filter deleted = false; barbican-manage db clean purges (barbican/model/clean.py:458).

1.2 Tables

The exact DDL is in _rewrite/schema-sqlite-migrated_stable-2026.2.sql (migrations, the reference) and _rewrite/schema-mysql_stable-2026.2.sql / schema-postgresql_stable-2026.2.sql (models); _rewrite/schema-diff_stable-2026.2.md shows no difference between models and migrations.

1.3 Representative queries

• Secret list (barbican/model/repositories.py:590): sql SELECT secrets.* FROM secrets JOIN projects ON projects.id = secrets.project_id WHERE secrets.deleted = 0 AND (secrets.expiration IS NULL OR secrets.expiration > :now) AND secrets.name LIKE :name ... -- optional filters AND projects.external_id = :project ORDER BY ... LIMIT :limit OFFSET :offset; -- plus a COUNT(*) of the same query for "total" With acl_only=true the project join is replaced by JOIN secret_acls JOIN secret_acl_users WHERE secret_acl_users.user_id = :user (barbican/model/repositories.py:640).
• Secret by id (barbican/model/repositories.py:759): by id, not deleted, not expired — without project filter (the project check is the policy's job, barbican/api/controllers/secrets.py:366).
• Active KEK (barbican/model/repositories.py:1000): SELECT * FROM kek_data WHERE project_id = :p AND plugin_name = :fqcn AND active AND NOT deleted ORDER BY created_at.
• Quota count: SELECT COUNT(*) of the project's non-deleted entities of the type (barbican/model/repositories.py:495).

2. AMQP / RabbitMQ (oslo.messaging)

2.1 Topology

The RPC target is Target(topic='barbican.workers', namespace='barbican', version='1.1', server='barbican.queue') (barbican/common/config.py:116); the server uses DefaultRPCAccessPolicy (barbican/queue/__init__.py:80). Exceptions allowed to travel back: barbican.common.exception (barbican/queue/__init__.py:36).

2.2 RPC methods

There are no calls (barbican/queue/client.py:58 exists but is unused). When [queue] enable = False the same method is invoked in-process (barbican/queue/client.py:63).

2.3 Sample frame (cast process_type_order)

{"oslo.version": "2.0",
 "oslo.message": "{\"method\": \"process_type_order\", \"namespace\": \"barbican\", \"version\": \"1.1\",
   \"args\": {\"order_id\": \"5d1f6a8e-...\", \"project_id\": \"8c13fb9eea6a46388a3bd8316f26ce5c\",
              \"request_id\": \"req-a0e40e18-...\"}, \"_unique_id\": \"...\"}"}

The context is empty ({}, barbican/queue/client.py:56): no user token or roles travel with the task.

2.4 Consumed notification (Keystone)

Sample frame (Keystone basic notification format):

{"event_type": "identity.project.deleted", "publisher_id": "identity.keystone-host",
 "priority": "INFO", "payload": {"resource_info": "2b99a94ad02741978e613fb52dd1f4cd"},
 "message_id": "...", "timestamp": "2026-10-29 07:00:00.000000"}

Barbican emits no notifications of its own (the oslo.messaging notification options are only listed for the audit middleware, etc/oslo-config-generator/barbican.conf:15).

3. Keystone

• Token validation by keystonemiddleware auth_token in the /v1 pipeline (etc/barbican/barbican-api-paste.ini:16, [keystone_authtoken]); it calls GET /v3/auth/tokens with its service token, caches results, and sets X-Identity-Status, X-Project-Id, X-User-Id, X-Roles, X-Service-*… that ContextMiddleware turns into a RequestContext (barbican/api/middleware/context.py:80). is_admin = the role [DEFAULT] admin_role (default admin) is in the token (barbican/api/middleware/context.py:87).
• Optional keystonemiddleware.audit filter (pipeline barbican-api-keystone-audit, etc/barbican/barbican-api-paste.ini:20) emits CADF audit events with etc/barbican/api_audit_map.conf.
• Barbican makes no other outbound Keystone call.

4. Secret-store and crypto back ends

4.1 Plugin contracts

Secret-store plugin (barbican/plugin/interface/secret_store.py:391, namespace barbican.secretstore.plugin, [secretstore] enabled_secretstore_plugins, default store_crypto):

The plugin that stored a secret is found again by its fully qualified class name saved in secret_store_metadata.plugin_name (barbican/plugin/resources.py:345, barbican/plugin/interface/secret_store.py:606).

Crypto plugin (barbican/plugin/crypto/base.py:241, namespace barbican.crypto.plugin, [crypto] enabled_crypto_plugins, default simple_crypto), used only through StoreCryptoAdapterPlugin (barbican/plugin/store_crypto.py:50):

The exact at-rest formats of simple_crypto and p11_crypto are specified in 07 § 3.

4.2 Back ends

Vault secrets written before castellan metadata version 1 are read as legacy (base64 re-encoding heuristics, barbican/plugin/castellan_secret_store.py:57).

4.3 Multiple back ends

With [secretstore] enable_multiple_secret_stores = True, the stores are read from [secretstore:<suffix>] sections listed in stores_lookup_suffix (barbican/plugin/util/multiple_backends.py:32), exactly one of them global_default. New secrets go to the project's preferred store, else to the global default; reads always use the plugin recorded with the secret (barbican/plugin/util/multiple_backends.py:262).

5. Other

• HSM key management CLI (barbican-manage hsm gen_mkek|check_mkek|gen_hmac|check_hmac|rewrap_pkek, barbican/cmd/barbican_manage.py:171): creates the token objects labelled mkek_label (AES, CKA_TOKEN, wrap/unwrap) and hmac_label (sign/verify).
• No subprocess, no files: Barbican writes nothing to disk at run time (except logs); PKCS#11 may read [p11_crypto_plugin] seed_file at start (barbican/plugin/crypto/p11_crypto.py:347).
• Healthcheck: GET /healthcheck, disabled by the file /etc/barbican/healthcheck_disable (etc/barbican/barbican-api-paste.ini:59).

Source: reverse-spec-barbican/03-interactions_stable-2026.2.md. The _rewrite/ and _inventory/ files are not published on the site.