Package: redstone
redstone - A Pythonic IBM Cloud SDKRedstone is a Python library for interacting with IBM Cloud services.It currently includes support for IBM KeyProtect, IBM Kubernetes Service (IKS), and some
platform services like ResourceController and IAM.Contributions in the form of feedback, patches, or bugs are appreciated.InstallationUsagers-cryptors-keyprotectInstallationYou can installredstonewith:$pip3installredstone# alternatively, you can do a user install if you are not an admin on your box$pip3install--userredstoneUsageA default session is created for you on first access, which can be used to access service interfaces scoped to that account.
Default sessions will read an API key from the conventionalIBMCLOUD_API_KEYenvironment variable.Using the default session to get a CIS (Cloud Internet Services) client:>>>importredstone>>>importos>>>cis=redstone.service("CIS",service_instance_id=os.environ.get("CIS_CRN"))>>>cis<redstone.client.CISobjectat0x...>>>>sorted(map(lambdax:x.get("name"),cis.pools()))['au-syd','eu-de','eu-de-ams','eu-de-fra','eu-de-private','eu-gb','eu-gb-private','eu-syd-private','jp-tok','jp-tok-02','jp-tok-04','preprod','private-jp-tok','private-us-south','us-east','us-east-private','us-south']>>>Build your own session for interacting with multiple regions and/or accounts within the same Python context:>>>production=redstone.Session(...region="us-south",...iam_api_key=os.environ.get("IBMCLOUD_API_KEY")...)>>>production<redstone.Sessionobjectat0x...>>>>rc=production.service("ResourceController")>>>rc<redstone.client.ResourceControllerobjectat0x...>>>>instance_id,instance_crn=rc.create_instance(name="mykpinstance")>>>instance_crn'crn:v1:bluemix:public:kms:us-south:a/...::'>>>kp=production.service("KeyProtect",service_instance_id=instance_id)>>>key=kp.create(name="mykey")>>>key.get("name")'mykey'>>>kp.delete(key.get("id"))>>>rc.delete_instance(instance_crn)>>>Encrypting data using redstone.crypto with KeyProtectRedstone includes support for directly encrypting and decrypting files or other data using IBM KeyProtect as a key provider.
There are two ways to use the crypto functionality, a CLI tool and the python module.rs-crypto CLI toolUpon installing the redstone module with pip, it will also install a command-line script underrs-cryptothat can
be used to encrypt and decrypt.The script will read the API key used to interact with KeyProtect from theIBMCLOUD_API_KEYenvironment variable.Encrypting a file is straight forward with theencryptcommmand. The encrypted data will be printed to stdout, and
can be redirected to a file.IBMCLOUD_API_KEY=...rs-cryptoencrypt--key-crns"crn:v1... crn:v1..."my-super-secret-file.txt>my-encrypted-fileDecrypting is similar. Note that the tool will print raw bytes to stdout, so you will probably want
to redirect to a file if the original data was binary.IBMCLOUD_API_KEY=...rs-cryptodecryptmy-encrypted-file>my-decrypted-fileThe output of encrypt can be fed directly back to decrypt.# you can also pipe directly to stdin by specifying the file as '-'echo"some-secret-data"|rs-cryptoencrypt--key-crns"crn:v1... crn:v1..."-|rs-cryptodecrypt-using redstone.cryptoThe python module is designed to be easy to use, even for those not familiar with python.importosimportsysfromredstoneimportcrypto# NOTE: here we demonstrate how we can use several keys that come from different instances and even different regions# only one of the keys needs to be available for the decrypt operation to succeedcrns=["crn:v1:bluemix:public:kms:us-south:a/...:415ba6f3-43f9-4996-0000-123456789:key:94e2639b-af2f-4f4f-a415-bb63820cf976","crn:v1:bluemix:public:kms:us-east:a/...:077a4670-c2f2-415c-0000-123456789:key:1f5ead7e-a1f4-4d15-9641-80e9aa5c7e12",]ifnotos.getenv("IBMCLOUD_API_KEY"):print("Remember to set 'IBMCLOUD_API_KEY' as the internal client uses that for authentication",file=sys.stderr)sys.exit(1)# read bytes from stdin and encryptmessage,meta=crypto.encrypt(sys.stdin.buffer.read(),key_crns=crns)print("Encrypted value:%r"%message)message,meta=crypto.decrypt(message)print("%r"%message)print("%r"%meta)Finding Key CRNsKeyProtect CRKs to be used for encryption are specified via--key-crnsas a space separated list, or theRSCRYPTO_KEY_CRNSenvironment variable.
Key CRNs can be found via the IBM Cloud Console (KeyProtect UI) or the IBM Cloud CLI. (You will need the kp plugin.)# Using the ic kp plugin to find a CRNickpget-ojson-i$instance_uuid$key_uuid{"id":"94e2639b-af2f-4f4f-a415-bb63820cf976","name":"the-one-key","type":"application/vnd.ibm.kms.key+json","extractable":false,"state":1,"crn":"crn:v1:bluemix:public:kms:us-south:a/....:415ba6f3-43f9-4996-abcd-1234346:key:94e2639b-af2f-4f4f-a415-bb63820cf976"}Using the rs-keyprotect CLIrs-keyprotect is a quick stand-alone CLI utility for interacting with KeyProtect via terminal or shell scripts.# set an API for the account you wish to interact withexportIBMCLOUD_API_KEY=...# list KeyProtect instances in the accountrs-keyprotectlist-instances
IDNAMEREGION
07096bd5-6e6f-4b75-9978-9cbb18ce9a16keyptest1us-south
143ac075-31ad-4bcc-bc9f-c352ea6bd213KeyProtect-y6us-south# list the keys of an instancers-keyprotect-ifb680ac4-e2d7-40c3-8b64-be59b13236cdlist
IDNAMEEXTRACTABLE
52c3eea1-6db7-4dd8-8540-5d95af8c621bkpregress_at_pass_keyFalsee5931fa2-5830-4f12-9cfa-3d0099f79929kpregress_at_pass_keyFalseFor more usage, runrs-keyprotect -handrs-keyprotect <command> -h