barbican — Scenarios

sequenceDiagram
  participant C as castellan (Cinder)
  participant KS as Keystone
  participant API as barbican-api
  participant DB as MariaDB
  C->>API: POST /v1/secrets {payload(b64), payload_content_type: application/octet-stream,<br/>payload_content_encoding: base64, secret_type: symmetric, algorithm: AES, bit_length: 256}
  API->>KS: GET /v3/auth/tokens (keystonemiddleware, cached)
  KS-->>API: 200 token (project, user, roles)
  API->>API: policy secrets:post; NewSecretValidator; quota secrets
  API->>DB: SELECT projects WHERE external_id (INSERT if new)
  API->>DB: SELECT kek_data active for (project, SimpleCryptoPlugin)
  alt first secret of the project
    API->>DB: INSERT kek_data (unbound)
    API->>API: Fernet(master KEK[0]).encrypt(new Fernet key) → plugin_meta
    API->>DB: UPDATE kek_data bind_completed, algorithm=aes, bit_length=128, mode=cbc, plugin_meta
  end
  API->>API: raw = b64decode(payload); token = Fernet(project KEK).encrypt(raw)
  API->>DB: INSERT secrets; INSERT encrypted_data (cypher_text = b64(token), kek_id)
  API->>DB: INSERT secret_store_metadata (plugin_name, content_type)
  API->>DB: COMMIT (TransactionHook)
  API-->>C: 201 Location: /v1/secrets/{id} {"secret_ref"}
  C->>API: GET /v1/secrets/{id} (Accept: application/json)
  API-->>C: 200 {secret_type, algorithm, bit_length, content_types, consumers…}
  C->>API: GET /v1/secrets/{id}/payload (Accept: application/octet-stream)
  API->>API: policy secret:decrypt (ACL dict + creator + project in target)
  API->>DB: SELECT secret, encrypted_data, kek_data (kek_id of the datum)
  API->>API: project KEK = MultiFernet(master KEKs).decrypt(plugin_meta);<br/>raw = Fernet(project KEK).decrypt(b64decode(cypher_text))
  alt wrong master key / tampered data
    API-->>C: 500 "Secret payload retrieval failure seen - please contact site administrator."
  else Accept not supported
    API-->>C: 406 "Secret payload retrieval issue seen - Wrong payload content-type."
  end
  API-->>C: 200 raw bytes

sequenceDiagram
  participant C as castellan
  participant API as barbican-api
  participant DB as MariaDB
  participant MQ as RabbitMQ
  participant W as barbican-worker
  C->>API: POST /v1/orders {"type":"key","meta":{"algorithm":"aes","bit_length":256,"mode":"cbc"}}
  API->>API: TypeOrderValidator; quota orders
  API->>DB: INSERT orders (PENDING); COMMIT
  API->>MQ: cast process_type_order(order_id, project_id, request_id)
  API-->>C: 202 {"order_ref"}
  MQ->>W: process_type_order
  W->>DB: SELECT orders WHERE id AND project.external_id
  W->>W: pick plugin (generate_supports) → store_crypto → simple_crypto.generate_symmetric (os.urandom)
  W->>DB: INSERT secrets, encrypted_data, secret_store_metadata
  alt success
    W->>DB: UPDATE orders SET status=ACTIVE, secret_id
  else failure
    W->>DB: UPDATE orders SET status=ERROR, error_status_code, error_reason
  end
  W->>DB: COMMIT
  loop every retry_delay (1 s), up to number_of_retries (60)
    C->>API: GET /v1/orders/{id}
    API-->>C: 200 {"status": "PENDING" | "ACTIVE" | "ERROR", "secret_ref"…}
  end
  C->>API: DELETE /v1/orders/{id}
  API-->>C: 204

sequenceDiagram
  participant N as Nova (castellan add_consumer)
  participant U as Owner (barbicanclient)
  participant API as barbican-api
  participant DB as MariaDB
  N->>API: POST /v1/secrets/{id}/consumers {"service":"nova","resource_type":"instance","resource_id":"…"}
  API->>DB: INSERT secret_consumer_metadata (or revive soft-deleted row)
  API-->>N: 200 {secret representation with consumers}
  U->>API: DELETE /v1/secrets/{id} (OpenStack-API-Version: key-manager 1.2)
  API->>DB: SELECT consumers of the secret
  alt consumers exist and no force
    API-->>U: 400 "Secret deletion issue seen - Secret cannot be deleted as it has consumers.."
  else ?force=true (barbicanclient sends force=1)
    API->>DB: soft delete secret, encrypted_data, metadata; delete ACLs, consumers
    API-->>U: 204
  end

sequenceDiagram
  participant KS as Keystone
  participant MQ as RabbitMQ (exchange keystone)
  participant L as barbican-keystone-listener
  participant DB as MariaDB
  KS->>MQ: notification identity.project.deleted {resource_info: <project id>}
  MQ->>L: info(ctxt, publisher_id, event_type, payload)
  L->>DB: SELECT projects WHERE external_id
  alt project unknown to Barbican
    L-->>MQ: HANDLED (nothing to do)
  else known
    L->>DB: soft delete containers, secrets (+ children), kek_data, project — one transaction
    alt success
      L->>DB: COMMIT
      L-->>MQ: HANDLED
    else error
      L->>DB: ROLLBACK
      L-->>MQ: REQUEUE (allow_requeue) or HANDLED (dropped)
    end
  end

sequenceDiagram
  participant O as Operator
  participant M as barbican-manage
  participant DB as MariaDB
  O->>O: prepend the new Fernet key to [simple_crypto_plugin] kek (old key kept second)
  O->>M: simple_crypto rewrap_pkek
  M->>DB: SELECT kek_data per project (plugin = SimpleCryptoPlugin)
  M->>M: plugin_meta = MultiFernet([new, old]).rotate(plugin_meta)
  M->>DB: UPDATE kek_data.plugin_meta (one transaction per KEK)
  O->>O: remove the old key from the configuration
  O->>M: simple_crypto new_pkek --project <keystone id>
  M->>DB: deactivate the active KEK, INSERT a new unbound KEK (bound on next use)
  O->>M: simple_crypto rewrap_secrets --project <keystone id>
  M->>M: for each secret: MultiFernet([new pKEK, old pKEK]).rotate(token)
  M->>DB: UPDATE encrypted_data.cypher_text, kek_id = new KEK