Performing security operations Red Hat OpenStack Services on OpenShift 18.0 Operating security services in a Red Hat OpenStack Services on OpenShift environment OpenStack Documentation Team rhos-docs@redhat.com

Commands:
openstack role add --user user1 --user-domain Default --project demo --project-domain Default <role>
openstack role add --user user1 --user-domain Default --system all <role>
openstack flavor list --os-cloud <cloud_name>
`export OS_CLOUD=<cloud_name>`
openstack network create internal-network
openstack network create internal-network --project testing
openstack role list
openstack role show admin
openstack role add --user user1 --user-domain Default --project demo --project-domain Default <role>
openstack role add --user user1 --user-domain Default --system all <role>
openstack quota show [PROJECT-ID]
openstack quota show f0ba064c24ca4176ac55a45635ca561f +-----------------------+-------+ | Resource | Limit | +-----------------------+-------+ | cores | 20 | | instances | 10 | | ram | 51200 | | volumes | 10 | | snapshots | 10 | | gigabytes | 1000 | | backups | 10 | | volumes___DEFAULT__ | -1 | | gigabytes___DEFAULT__ | -1 | | snapshots___DEFAULT__ | -1 | | groups | 10 | | trunk | -1 | | networks | 100 | | ports | 500 | | rbac_policies | 10 | | routers | 10 | | subnets | 100 | | subnet_pools | -1 | | fixed-ips | -1 | | injected-file-size | 10240 | | injected-path-size | 255 | | injected-files | 5 | | key-pairs | 100 | | properties | 128 | | server-groups | 10 | | server-group-members | 10 | | floating-ips | 50 | | secgroup-rules | 100 | | secgroups | 10 | | backup-gigabytes | 1000 | | per-volume-gigabytes | -1 | +-----------------------+-------+
openstack domain create corp
+-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | | | enabled | True | | id | 6059b0b93b8d4ddb9d31ea47de93f0ab | | name | corp | | options | {} | | tags | [] | +-------------+----------------------------------+
openstack project create private-cloud --domain corp
+-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | | | domain_id | 6059b0b93b8d4ddb9d31ea47de93f0ab | | enabled | True | | id | e86f182e16e24441b71c7296585c2e21 | | is_domain | False | | name | private-cloud | | options | {} | | parent_id | 6059b0b93b8d4ddb9d31ea47de93f0ab | | tags | [] | +-------------+----------------------------------+
openstack project create dev --parent private-cloud --domain corp
+-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | | | domain_id | 6059b0b93b8d4ddb9d31ea47de93f0ab | | enabled | True | | id | 71f05cdd5b8a45d4b1a928bfe7c2e20d | | is_domain | False | | name | dev | | options | {} | | parent_id | e86f182e16e24441b71c7296585c2e21 | | tags | [] | +-------------+----------------------------------+
openstack project create qa --parent private-cloud --domain corp
+-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | | | domain_id | 6059b0b93b8d4ddb9d31ea47de93f0ab | | enabled | True | | id | 03801ad929b84c8fb091bf3248e6db68 | | is_domain | False | | name | qa | | options | {} | | parent_id | e86f182e16e24441b71c7296585c2e21 | | tags | [] | +-------------+----------------------------------+
openstack role assignment list --project private-cloud
openstack role list
+----------------------------------+-----------------+ | ID | Name | +----------------------------------+-----------------+ | 01d92614cd224a589bdf3b171afc5488 | admin | | 034e4620ed3d45969dfe8992af001514 | member | | 0aa377a807df4149b0a8c69b9560b106 | ResellerAdmin | | cfea5760d9c948e7b362abc1d06e557f | reader | | d5cb454559e44b47aaa8821df4e11af1 | swiftoperator | | ef3d3f510a474d6c860b4098ad658a29 | service | +----------------------------------+-----------------+
openstack role add --user user1 --user-domain corp --project private-cloud member
openstack role add --user user1 --user-domain corp --project private-cloud member --inherited
openstack role assignment list --effective --user user1 --user-domain corp
+----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+ | Role | User | Group | Project | Domain | Inherited | +----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+ | 034e4620ed3d45969dfe8992af001514 | 10b5b34df21d485ca044433818d134be | | c50d5cf4fe2e4929b98af5abdec3fd64 | | False | | 034e4620ed3d45969dfe8992af001514 | 10b5b34df21d485ca044433818d134be | | 11fccd8369824baa9fc87cf01023fd87 | | True | | 034e4620ed3d45969dfe8992af001514 | 10b5b34df21d485ca044433818d134be | | b4f1d6f59ddf413fa040f062a0234871 | | True | +----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+
openstack role remove --user user1 --project private-cloud member
openstack role assignment list --effective --user user1 --user-domain corp
+----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+ | Role | User | Group | Project | Domain | Inherited | +----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+ | 034e4620ed3d45969dfe8992af001514 | 10b5b34df21d485ca044433818d134be | | 11fccd8369824baa9fc87cf01023fd87 | | True | | 034e4620ed3d45969dfe8992af001514 | 10b5b34df21d485ca044433818d134be | | b4f1d6f59ddf413fa040f062a0234871 | | True | +----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+
openstack role remove --user user1 --project private-cloud member --inherited
openstack role assignment list --effective --user user1 --user-domain corp
openstack domain list
+----------------------------------+------------------+---------+--------------------+ | ID | Name | Enabled | Description | +----------------------------------+------------------+---------+--------------------+ | 3abefa6f32c14db9a9703bf5ce6863e1 | TestDomain | True | | | 69436408fdcb44ab9e111691f8e9216d | corp | True | | | a4f61a8feb8d4253b260054c6aa41adb | federated_domain | True | | | default | Default | True | The default domain | +----------------------------------+------------------+---------+--------------------+
openstack domain create TestDomain
+-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | | | enabled | True | | id | 3abefa6f32c14db9a9703bf5ce6863e1 | | name | TestDomain | +-------------+----------------------------------+
openstack domain show TestDomain
+-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | | | enabled | True | | id | 3abefa6f32c14db9a9703bf5ce6863e1 | | name | TestDomain | +-------------+----------------------------------+
openstack domain set TestDomain --disable
openstack domain show TestDomain
+-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | | | enabled | False | | id | 3abefa6f32c14db9a9703bf5ce6863e1 | | name | TestDomain | +-------------+----------------------------------+
openstack domain set TestDomain --enable
openstack project create AppCreds
openstack user create --project AppCreds --password-prompt AppCredsUser
openstack role add --user AppCredsUser --project AppCreds member
This is a clouds.yaml file, which can be used by OpenStack tools as a source of configuration on how to connect to a cloud. If this is your only cloud, just put this file in ~/.config/openstack/clouds.yaml and tools like python-openstackclient will just work with no further config. (You will need to add your password to the auth section) If you have more than one cloud account, add the cloud entry to the clouds section of your existing file and you can refer to them by name with OS_CLOUD=openstack or --os-cloud=openstack clouds: openstack: auth: auth_url: http://10.0.0.10:5000/v3 application_credential_id: "6d141f23732b498e99db8186136c611b" application_credential_secret: "<example secret value>" region_name: "regionOne" interface: "public" identity_api_version: 3 auth_type: "v3applicationcredential"
openstack --os-cloud=openstack token issue +------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | +------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | expires | 2018-08-29T05:37:29+0000 | | id | gAAAAABbhiMJ4TxxFlTMdsYJpfStsGotPrns0lnpvJq9ILtdi-NKqisWBeNiJlUXwmnoGQDh2CMyK9OeTsuEXnJNmFfKjxiHWmcQVYzAhMKo6_QMUtu_Qm6mtpzYYHBrUGboa_Ay0LBuFDtsjtgtvJ-r8G3TsJMowbKF-yo--O_XLhERU_QQVl3hl8zmMRdmLh_P9Cbhuolt | | project_id | 1a74eabbf05c41baadd716179bb9e1da | | user_id | ef679eeddfd14f8b86becfd7e1dc84f2 | +------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
[keystone_authtoken] auth_url = http://10.0.0.10:5000/v3 auth_type = v3applicationcredential application_credential_id = "6cb5fa6a13184e6fab65ba2108adf50c" application_credential_secret = "<example password>"
openstack application credential create --description "App Creds - All roles" AppCredsUser +--------------+----------------------------------------------------------------------------------------+ | Field | Value | +--------------+----------------------------------------------------------------------------------------+ | description | App Creds - All roles | | expires_at | None | | id | fc17651c2c114fd6813f86fdbb430053 | | name | AppCredsUser | | project_id | 507663d0cfe244f8bc0694e6ed54d886 | | roles | member reader admin | | secret | fVnqa6I_XeRDDkmQnB5lx361W1jHtOtw3ci_mf_tOID-09MrPAzkU7mv-by8ykEhEa1QLPFJLNV4cS2Roo9lOg | | unrestricted | False | +--------------+----------------------------------------------------------------------------------------+
openstack application credential create --description "App Creds - Member" --role member AppCredsUser +--------------+----------------------------------------------------------------------------------------+ | Field | Value | +--------------+----------------------------------------------------------------------------------------+ | description | App Creds - Member | | expires_at | None | | id | e21e7f4b578240f79814085a169c9a44 | | name | AppCredsUser | | project_id | 507663d0cfe244f8bc0694e6ed54d886 | | roles | member | | secret | XCLVUTYIreFhpMqLVB5XXovs_z9JdoZWpdwrkaG1qi5GQcmBMUFG7cN2htzMlFe5T5mdPsnf5JMNbu0Ih-4aCg | | unrestricted | False | +--------------+----------------------------------------------------------------------------------------+
openstack application credential delete AppCredsUser
openstack application credential create --description "App Creds 2 - Member" --role member AppCred2
openstack --os-cloud=openstack token issue
+------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | +------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | expires | 2018-08-29T05:37:29+0000 | | id | gAAAAABbhiMJ4TxxFlTMdsYJpfStsGotPrns0lnpvJq9ILtdi-NKqisWBeNiJlUXwmnoGQDh2CMyK9OeTsuEXnJNmFfKjxiHWmcQVYzAhMKo6_QMUtu_Qm6mtpzYYHBrUGboa_Ay0LBuFDtsjtgtvJ-r8G3TsJMowbKF-yo--O_XLhERU_QQVl3hl8zmMRdmLh_P9Cbhuolt | | project_id | 1a74eabbf05c41baadd716179bb9e1da | | user_id | ef679eeddfd14f8b86becfd7e1dc84f2 | +------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
openstack secret list
+------------------------------------------------------------------------------------+------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+ | Secret href | Name | Created | Status | Content types | Algorithm | Bit length | Secret type | Mode | Expiration | +------------------------------------------------------------------------------------+------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+ | https://192.168.123.169:9311/v1/secrets/24845e6d-64a5-4071-ba99-0fdd1046172e | None | 2018-01-22T02:23:15+00:00 | ACTIVE | {u'default': u'application/octet-stream'} | aes | 256 | symmetric | None | None | +------------------------------------------------------------------------------------+------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+
openstack secret store --name testSecret --payload 'TestPayload'
+---------------+------------------------------------------------------------------------------------+ | Field | Value | +---------------+------------------------------------------------------------------------------------+ | Secret href | https://192.168.123.163:9311/v1/secrets/ecc7b2a4-f0b0-47ba-b451-0f7d42bc1746 | | Name | testSecret | | Created | None | | Status | None | | Content types | None | | Algorithm | aes | | Bit length | 256 | | Secret type | opaque | | Mode | cbc | | Expiration | None | +---------------+------------------------------------------------------------------------------------+
openstack secret update https://192.168.123.163:9311/v1/secrets/ca34a264-fd09-44a1-8856-c6e7116c3b16 'TestPayload-updated'
openstack secret delete https://192.168.123.163:9311/v1/secrets/ecc7b2a4-f0b0-47ba-b451-0f7d42bc1746
openstack secret order create --name swift_key --algorithm aes --mode ctr --bit-length 256 --payload-content-type=application/octet-stream key
+----------------+-----------------------------------------------------------------------------------+ | Field | Value | +----------------+-----------------------------------------------------------------------------------+ | Order href | https://192.168.123.173:9311/v1/orders/043383fe-d504-42cf-a9b1-bc328d0b4832 | | Type | Key | | Container href | N/A | | Secret href | None | | Created | None | | Status | None | | Error code | None | | Error message | None | +----------------+-----------------------------------------------------------------------------------+
openstack secret order get https://192.168.123.173:9311/v1/orders/043383fe-d504-42cf-a9b1-bc328d0b4832
+----------------+------------------------------------------------------------------------------------+ | Field | Value | +----------------+------------------------------------------------------------------------------------+ | Order href | https://192.168.123.173:9311/v1/orders/043383fe-d504-42cf-a9b1-bc328d0b4832 | | Type | Key | | Container href | N/A | | Secret href | https://192.168.123.173:9311/v1/secrets/efcfec49-b9a3-4425-a9b6-5ba69cb18719 | | Created | 2018-01-24T04:24:33+00:00 | | Status | ACTIVE | | Error code | None | | Error message | None | +----------------+------------------------------------------------------------------------------------+
openstack secret get https://192.168.123.173:9311/v1/secrets/efcfec49-b9a3-4425-a9b6-5ba69cb18719
+---------------+------------------------------------------------------------------------------------+ | Field | Value | +---------------+------------------------------------------------------------------------------------+ | Secret href | https://192.168.123.173:9311/v1/secrets/efcfec49-b9a3-4425-a9b6-5ba69cb18719 | | Name | swift_key | | Created | 2018-01-24T04:24:33+00:00 | | Status | ACTIVE | | Content types | {u'default': u'application/octet-stream'} | | Algorithm | aes | | Bit length | 256 | | Secret type | symmetric | | Mode | ctr | | Expiration | None | +---------------+------------------------------------------------------------------------------------+
openstack volume type create --encryption-provider nova.volume.encryptors.luks.LuksEncryptor --encryption-cipher aes-xts-plain64 --encryption-key-size 256 --encryption-control-location front-end LuksEncryptor-Template-256
+-------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | +-------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | description | None | | encryption | cipher='aes-xts-plain64', control_location='front-end', encryption_id='9df604d0-8584-4ce8-b450-e13e6316c4d3', key_size='256', provider='nova.volume.encryptors.luks.LuksEncryptor' | | id | 78898a82-8f4c-44b2-a460-40a5da9e4d59 | | is_public | True | | name | LuksEncryptor-Template-256 | +-------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
openstack volume create --size 1 --type LuksEncryptor-Template-256 'Encrypted-Test-Volume'
+---------------------+--------------------------------------+ | Field | Value | +---------------------+--------------------------------------+ | attachments | [] | | availability_zone | nova | | bootable | false | | consistencygroup_id | None | | created_at | 2018-01-22T00:19:06.000000 | | description | None | | encrypted | True | | id | a361fd0b-882a-46cc-a669-c633630b5c93 | | migration_status | None | | multiattach | False | | name | Encrypted-Test-Volume | | properties | | | replication_status | None | | size | 1 | | snapshot_id | None | | source_volid | None | | status | creating | | type | LuksEncryptor-Template-256 | | updated_at | None | | user_id | 0e73cb3111614365a144e7f8f1a972af | +---------------------+--------------------------------------+
cinder --os-volume-api-version 3.64 volume show Encrypted-Test-Volume
+------------------------------+-------------------------------------+ |Property |Value | +------------------------------+-------------------------------------+ |attached_servers |[] | |attachment_ids |[] | |availability_zone |nova | |bootable |false | |cluster_name |None | |consistencygroup_id |None | |created_at |2022-07-28T17:35:26.000000 | |description |None | |encrypted |True | |encryption_key_id |0944b8a8-de09-4413-b2ed-38f6c4591dd4 | |group_id |None | |id |a0b51b97-0392-460a-abfa-093022a120f3 | |metadata | | |migration_status |None | |multiattach |False | |name |vol | |os-vol-host-attr:host |hostgroup@tripleo_iscsi#tripleo_iscsi| |os-vol-mig-status-attr:migstat|None | |os-vol-mig-status-attr:name_id|None | |os-vol-tenant-attr:tenant_id |a2071ece39b3440aa82395ff7707996f | |provider_id |None | |replication_status |None | |service_uuid |471f0805-072e-4256-b447-c7dd10ceb807 | |shared_targets |False | |size |1 | |snapshot_id |None | |source_volid |None | |status |available | |updated_at |2022-07-28T17:35:26.000000 | |user_id |ba311b5c2b8e438c951d1137333669d4 | |volume_type |LUKS | |volume_type_id |cc188ace-f73d-4af5-bf5a-d70ccc5a401c | +------------------------------+-------------------------------------+
openstack secret list
+------------------------------------------------------------------------------------+------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+ | Secret href | Name | Created | Status | Content types | Algorithm | Bit length | Secret type | Mode | Expiration | +------------------------------------------------------------------------------------+------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+ | https://192.168.123.169:9311/v1/secrets/0944b8a8-de09-4413-b2ed-38f6c4591dd4 | None | 2018-01-22T02:23:15+00:00 | ACTIVE | {u'default': u'application/octet-stream'} | aes | 256 | symmetric | None | None | +------------------------------------------------------------------------------------+------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+
openstack server add volume testInstance Encrypted-Test-Volume
openssl genrsa -out private_key.pem 1024
openssl rsa -pubout -in private_key.pem -out public_key.pem
openssl req -new -key private_key.pem -out cert_request.csr
openssl x509 -req -days 14 -in cert_request.csr -signkey private_key.pem -out new_cert.crt
openstack secret store --name test --algorithm RSA --secret-type certificate --payload-content-type "application/octet-stream" --payload-content-encoding base64 --payload "USD(base64 new_cert.crt)"
+---------------+-----------------------------------------------------------------------+ | Field | Value | +---------------+-----------------------------------------------------------------------+ | Secret href | http://127.0.0.1:9311/v1/secrets/cd7cc675-e573-419c-8fff-33a72734a243 | +---------------+-----------------------------------------------------------------------+
echo <This is my image> > <myimage>
openssl dgst -sha512 -sign private_key.pem -sigopt rsa_padding_mode:pss -out myimage.signature myimage
base64 -w 0 myimage.signature > myimage.signature.b64
image_signature=USD(cat myimage.signature.b64)
openstack image-create --name <my_signed_image> --container-format bare --disk-format qcow2 --property img_signature="USDimage_signature" --property img_signature_certificate_uuid="USDcert_uuid" --property img_signature_hash_method='SHA-512' --property img_signature_key_type='RSA-PSS' < myimage
openstack image save --file <local_file_name> <snapshot_image_name>
openstack image set --property img_signature="USDimage_signature" --property img_signature_certificate_uuid="<cd7cc675-e573-419c-8fff-33a72734a243>" --property img_signature_hash_method="SHA-512" --property img_signature_key_type="RSA-PSS" <snapshot_image_id>
rm <local_file_name>
get secret osp-secret -o yaml | grep BarbicanSimpleCryptoKEK | awk '{print USD2}' | base64 -d > kek.txt
DB_PASS=USD(oc get secret osp-secret -o yaml | grep DbRootPassword | awk '{print USD2}' | base64 -d)
oc exec -it openstack-galera-0 -- mysqldump -u root -p"USD{DB_PASS}" barbican > barbican_db_backup.sql
ll total 36 -rw-rw-r--. 1 tripleo-admin tripleo-admin 36715 Jun 19 18:31 barbican_db_backup.sql
echo <barbican_key> | base64 YmFyYmljYW5fc2ltcGxlX2N5cHRvX2tlawo=
oc edit secret osp-secret
. BarbicanDatabasePassword: cGFzc3dvcmQK BarbicanPassword: cGFzc3dvcmQK BarbicanSimpleCryptoKEK: YmFyYmljYW5fc2ltcGxlX2N5cHRvX2tlawo= CeilometerPassword: cGFzc3dvcmQK CinderDatabasePassword: cGFzc3dvcmQK CinderPassword: cGFzc3dvcmQK DatabasePassword: cGFzc3dvcmQK .
DB_PASS=USD(oc get secret osp-secret -o yaml | grep DbRootPassword | awk '{print USD2}' | base64 -d)
oc exec openstack-galera-0 -- mysql -u root -p"USD{DB_PASS}" barbican < <sql_backup>
Defaulted container "galera" out of: galera, mysql-bootstrap (init)
oc exec -n openstack -t openstackclient -- openstack secret list +------------------------------------------------------------------------+------------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+ | Secret href | Name | Created | Status | Content types | Algorithm | Bit length | Secret type | Mode | Expiration | +------------------------------------------------------------------------+------------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+ | http://10.0.0.104:9311/v1/secrets/93f62cfd-e008-401f-be74-bf057c88b04a | testSecret | 2018-06-19T18:25:25+00:00 | ACTIVE | {u'default': u'text/plain'} | aes | 256 | opaque | cbc | None | | http://10.0.0.104:9311/v1/secrets/f664b5cf-5221-47e5-9887-608972a5fefb | swift_key | 2018-06-19T18:24:40+00:00 | ACTIVE | {u'default': u'application/octet-stream'} | aes | 256 | symmetric | ctr | None | +------------------------------------------------------------------------+------------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+