"Using MigrationKeyManager to provide support for legacy fixed_key encryption: DuplicateOptError: duplicate option: fixed_key" warnings all over n-api logs in barbican-simple-crypto-devstack-tempest job

[Matt Riedemann]

These warnings are over the nova-api logs in the reference CI job:

http://logs.openstack.org/10/515210/39/check/barbican-simple-crypto-devstack-tempest/7b7f049/logs/screen-n-api.txt.gz?level=TRACE#_Jun_15_18_30_55_364299

Jun 15 18:30:55.364299 ubuntu-xenial-inap-mtl01-0000165445 <email address hidden>[25186]: WARNING castellan.key_manager.migration [None req-9db9d4da-023f-4fa9-b33d-99960b530ebd None None] Using MigrationKeyManager to provide support for legacy fixed_key encryption: DuplicateOptError: duplicate option: fixed_key

I see this in the nova.conf:

[key_manager]
fixed_key = bae3516cc1c0eb18b05440eba8012a4a880a2ee04d584a9c1579445e675b12defdc716ec
backend = barbican

I'm not really sure what it means though. It looks like the warning comes from here:

https://github.com/openstack/castellan/blob/d3446f51b02b5199bb909d5322332fa859de5f57/castellan/key_manager/migration.py#L33

But [key_manager]/fixed_key isn't deprecated, nor is the barbican backend:

https://docs.openstack.org/nova/latest/configuration/config.html#key-manager

Should nova be configured to use these barbican options instead?

https://github.com/openstack/castellan/blob/master/castellan/key_manager/barbican_key_manager.py#L50

[Jonathan Rosser (jrosser)]

This bug report does not appear related to openstack-ansible