Support for PKCS11 password/PIN in a separate file

[Josselin Mouette]

We’re using barbican with a HSM and we would very much like the PKCS#11 PIN/password to access this HSM to remain in memory and to never land on disk.

To support that, it seems logical, as most software handling PKCS11 allows, to put it in a separate file instead of barbican.conf.

The attached patch allows this.

[Grzegorz Grasza (xek)]

An alternative might be to use environment variables, which should already be supported:

https://specs.openstack.org/openstack/oslo-specs/specs/rocky/config-from-environment.html

Note that I didn't test this, but if you do, and this would cover your use case, please leave a comment.

[Josselin Mouette (jmouette)]

Thanks a lot for your suggestion, which I didn’t know about. This makes sense on the paper; unfortunately we are also using kolla-ansible, which hardcodes all the docker configuration in a way that proposes very little customization. The only practical one we have is the extra_volumes passed to docker, making it easy to setup a file in a given volume.

Using environment variables would also make the setup a bit more contrived, since the secure file containing the password would have to be read before being put in the environment (otherwise you’re just moving the problem from barbican.conf to your docker configuration). But for setups other than kolla-ansible, I guess it could work.

[Josselin Mouette (jmouette)]

Whoops, I just saw the zuul output and this is embarrassing. I uploaded the wrong patch version (missing a comma).