Chapter 7. Validate glance images After enabling Barbican, you can configure the Image Service (glance) to verify that an uploaded image has not been tampered with. In this implementation, the image is first signed with a key that is stored in barbican. The image is then uploaded to glance, along with the accompanying signing information. As a result, the image's signature is verified before each use, with the instance build process failing if the signature does not match. Barbican's integration with glance means that you can use the openssl command with your private key to sign glance images before uploading them. 7.1. Enable glance image validation In your environment file, enable image verification with the VerifyGlanceSignatures: True setting. You must re-run the openstack overcloud deploy command for this setting to take effect. To verify that glance image validation is enabled, run the following command on an overcloud Compute node: Note If you use Ceph as the back end for the Image and Compute services, a CoW clone is created. Therefore, Image signing verification cannot be performed. 7.2. Validate an image To configure a glance image for validation, complete the following steps: Confirm that glance is configured to use barbican: Generate a private key and convert it to the required format: Add the key to the barbican secret store: Note Record the resulting UUID for use in a later step. In this example, the certificate's UUID is 5df14c2b-f221-4a02-948e-48a61edd3f5b . Use private_key.pem to sign the image and generate the .signature file. For example: Convert the resulting .signature file into base64 format: Load the base64 value into a variable to use it in the subsequent command: Upload the signed image to glance. For img_signature_certificate_uuid , you must specify the UUID of the signing key you previously uploaded to barbican: You can view glance's image validation activities in the Compute log: /var/log/containers/nova/nova-compute.log . For example, you can expect the following entry when the instance is booted:

Commands:
sudo crudini --get /var/lib/config-data/puppet-generated/nova_libvirt/etc/nova/nova.conf glance verify_glance_signatures
sudo crudini --get /var/lib/config-data/puppet-generated/glance_api/etc/glance/glance-api.conf key_manager backend castellan.key_manager.barbican_key_manager.BarbicanKeyManager
openssl genrsa -out private_key.pem 1024 openssl rsa -pubout -in private_key.pem -out public_key.pem openssl req -new -key private_key.pem -out cert_request.csr openssl x509 -req -days 14 -in cert_request.csr -signkey private_key.pem -out x509_signing_cert.crt
source ~/overcloudrc openstack secret store --name signing-cert --algorithm RSA --secret-type certificate --payload-content-type "application/octet-stream" --payload-content-encoding base64 --payload "USD(base64 x509_signing_cert.crt)" -c 'Secret href' -f value https://192.168.123.170:9311/v1/secrets/5df14c2b-f221-4a02-948e-48a61edd3f5b
openssl dgst -sha256 -sign private_key.pem -sigopt rsa_padding_mode:pss -out cirros-0.4.0.signature cirros-0.4.0-x86_64-disk.img
base64 -w 0 cirros-0.4.0.signature > cirros-0.4.0.signature.b64
cirros_signature_b64=USD(cat cirros-0.4.0.signature.b64)
openstack image create --container-format bare --disk-format qcow2 --property img_signature="USDcirros_signature_b64" --property img_signature_certificate_uuid="5df14c2b-f221-4a02-948e-48a61edd3f5b" --property img_signature_hash_method="SHA-256" --property img_signature_key_type="RSA-PSS" cirros_0_4_0_signed --file cirros-0.4.0-x86_64-disk.img +--------------------------------+----------------------------------------------------------------------------------+ | Property | Value | +--------------------------------+----------------------------------------------------------------------------------+ | checksum | None | | container_format | bare | | created_at | 2018-01-23T05:37:31Z | | disk_format | qcow2 | | id | d3396fa0-2ea2-4832-8a77-d36fa3f2ab27 | | img_signature | lcI7nGgoKxnCyOcsJ4abbEZEpzXByFPIgiPeiT+Otjz0yvW00KNN3fI0AA6tn9EXrp7fb2xBDE4UaO3v | | | IFquV/s3mU4LcCiGdBAl3pGsMlmZZIQFVNcUPOaayS1kQYKY7kxYmU9iq/AZYyPw37KQI52smC/zoO54 | | | zZ+JpnfwIsM= | | img_signature_certificate_uuid | ba3641c2-6a3d-445a-8543-851a68110eab | | img_signature_hash_method | SHA-256 | | img_signature_key_type | RSA-PSS | | min_disk | 0 | | min_ram | 0 | | name | cirros_0_4_0_signed | | owner | 9f812310df904e6ea01e1bacb84c9f1a | | protected | False | | size | None | | status | queued | | tags | [] | | updated_at | 2018-01-23T05:37:31Z | | virtual_size | None | | visibility | shared | +--------------------------------+----------------------------------------------------------------------------------+
2018-05-24 12:48:35.256 1 INFO nova.image.glance [req-7c271904-4975-4771-9d26-cbea6c0ade31 b464b2fd2a2140e9a88bbdacf67bdd8c a3db2f2beaee454182c95b646fa7331f - default default] Image signature verification succeeded for image d3396fa0-2ea2-4832-8a77-d36fa3f2ab27