Skip to content

[hooks] Modular Barbican secret-stores enable + migrate live test - #4307

Draft
vakwetu wants to merge 3 commits into
openstack-k8s-operators:mainfrom
vakwetu:feature/triple-store-fortanix-luna
Draft

[hooks] Modular Barbican secret-stores enable + migrate live test#4307
vakwetu wants to merge 3 commits into
openstack-k8s-operators:mainfrom
vakwetu:feature/triple-store-fortanix-luna

Conversation

@vakwetu

@vakwetu vakwetu commented Oct 27, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Add modular barbican-secret-stores/enable.yml hook driven by a job instance list so Fortanix KMIP, Luna PKCS11, Proteccio, and software/simple_crypto can be combined without combo-specific playbooks.
  • Add migrate live-test hook that discovers store catalogue UUIDs and asserts secret_store_id after OSC / barbican-manage migrate.

Related-Issue: #OSPRH-35280

Test plan

  • Wire via ci-framework-jobs Fortanix+Luna triple-store job and ci-framework-testproject check
  • Confirm enable hook configures stores and migrate post_tests pass

Assisted-by: Composer

@vakwetu
[hooks] Add Barbican secret-store migrate live test hook
a790f2e 
Tempest cannot prove a secret changed backends. This hook discovers
enabled stores via openstacksdk (catalogue UUIDs required by the
migrate API), creates a secret on the global default, and migrates
it to each other store with OSC and barbican-manage secret migrate,
asserting secret_store_id via GET metadata (microversion 1.3).
Coverage per destination: OSC round-trip, barbican-manage round-trip,
dry-run; metadata-only conflict once.

Related-Issue: #OSPRH-35280

Assisted-by: Composer <noreply@cursor.com>
@vakwetu
[hooks] Add modular Barbican secret-stores enable hook
abb450b 
Drive prep/config from a job instance list (id/type/provider) so
Fortanix, Luna, Proteccio, and software can be combined without
combo-specific playbooks. Default list is software/simple_crypto.
Provider settings live on each store entry. Shared
resolve_from_param_or_file helper loads HSM PINs from a parameter
or materialised file key. Fortanix is cert-only auth with PEMs
fetched from lookaside URLs. Enforce operator MaxItems=1 for now.

Assisted-by: Composer <noreply@cursor.com>
@openshift-ci

openshift-ci Bot commented Oct 27, 2026

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@openshift-ci

openshift-ci Bot commented Oct 27, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign nemarjan for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@vakwetu
[hooks] Overlay KMIP Client.key at 0400 until operator fix
693fb17 
Temporary ExtraMounts SubPath until barbican-operator#502 is in
openstack-operator-index:latest. Matches testproject throwaway.

Assisted-by: Composer
Signed-off-by: Ade Lee <alee@redhat.com>
@centosinfra-prod-github-app

centosinfra-prod-github-app Bot commented Oct 28, 2026

Copy link
Copy Markdown

Build succeeded (check pipeline).
https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/0cccdfcc60d149098174969c041fbd88

✔️ openstack-k8s-operators-content-provider SUCCESS in 6h 45m 51s
✔️ podified-multinode-edpm-deployment-crc SUCCESS in 1h 20m 49s
✔️ podified-multinode-edpm-deployment-crc-centos-10 SUCCESS in 1h 19m 06s
✔️ cifmw-crc-podified-edpm-baremetal SUCCESS in 1h 31m 10s
❌ cifmw-crc-podified-edpm-baremetal-minor-update FAILURE in 2h 02m 51s (non-voting)
✔️ periodic-podified-edpm-baremetal-minor-update-bootc-master-ocp-crc SUCCESS in 1h 53m 53s (non-voting)
✔️ openstack-k8s-operators-content-provider-bootc SUCCESS in 6h 05m 06s
✔️ cifmw-crc-podified-edpm-baremetal-bootc SUCCESS in 1h 22m 03s
✔️ noop SUCCESS in 0s
✔️ cifmw-pod-ansible-test SUCCESS in 8m 51s
✔️ cifmw-pod-pre-commit SUCCESS in 8m 43s

Warning:
File .kube/http-cache/58d4363e5b5bd30e095238b0ec5d42f2 found in build home directory during playbook review.rdoproject.org/rdo-jobs/playbooks/base/pre.yaml for job cifmw-pod-pre-commit. Add to preserve-home-paths if safe, or otherwise remove.
File .kube/http-cache/596239d8158c9e304863ae34e9b235c0 found in build home directory during playbook review.rdoproject.org/rdo-jobs/playbooks/base/pre.yaml for job cifmw-pod-pre-commit. Add to preserve-home-paths if safe, or otherwise remove.
File .kube/http-cache/87a697f916b532cf44ccb197ff7ba2e3 found in build home directory during playbook review.rdoproject.org/rdo-jobs/playbooks/base/pre.yaml for job cifmw-pod-pre-commit. Add to preserve-home-paths if safe, or otherwise remove.
File .kube/cache/discovery/38.102.83.186_9023/servergroups.json found in build home directory during playbook review.rdoproject.org/rdo-jobs/playbooks/base/pre.yaml for job cifmw-pod-pre-commit. Add to preserve-home-paths if safe, or otherwise remove.
File .kube/cache/discovery/38.102.83.186_9023/v1/serverresources.json found in build home directory during playbook review.rdoproject.org/rdo-jobs/playbooks/base/pre.yaml for job cifmw-pod-pre-commit. Add to preserve-home-paths if safe, or otherwise remove.
File .ssh/config found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/pod-jobs.yml for job cifmw-pod-pre-commit. Add to preserve-home-paths if safe, or otherwise remove.
File .kube/http-cache/58d4363e5b5bd30e095238b0ec5d42f2 found in build home directory during playbook review.rdoproject.org/rdo-jobs/playbooks/base/pre.yaml for job cifmw-pod-ansible-test. Add to preserve-home-paths if safe, or otherwise remove.
File .kube/http-cache/596239d8158c9e304863ae34e9b235c0 found in build home directory during playbook review.rdoproject.org/rdo-jobs/playbooks/base/pre.yaml for job cifmw-pod-ansible-test. Add to preserve-home-paths if safe, or otherwise remove.
File .kube/http-cache/87a697f916b532cf44ccb197ff7ba2e3 found in build home directory during playbook review.rdoproject.org/rdo-jobs/playbooks/base/pre.yaml for job cifmw-pod-ansible-test. Add to preserve-home-paths if safe, or otherwise remove.
File .kube/cache/discovery/38.102.83.186_9023/servergroups.json found in build home directory during playbook review.rdoproject.org/rdo-jobs/playbooks/base/pre.yaml for job cifmw-pod-ansible-test. Add to preserve-home-paths if safe, or otherwise remove.
File .kube/cache/discovery/38.102.83.186_9023/v1/serverresources.json found in build home directory during playbook review.rdoproject.org/rdo-jobs/playbooks/base/pre.yaml for job cifmw-pod-ansible-test. Add to preserve-home-paths if safe, or otherwise remove.
File .ssh/config found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/pod-jobs.yml for job cifmw-pod-ansible-test. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/518e2164d6fb4a1abebdce43a793a6cc found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job periodic-podified-edpm-baremetal-minor-update-bootc-master-ocp-crc. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/8dcf0ea5a68d44e3b22c24af2c6e22b9 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job periodic-podified-edpm-baremetal-minor-update-bootc-master-ocp-crc. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/f1135eadb45e46048c14cb87340b9045 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job periodic-podified-edpm-baremetal-minor-update-bootc-master-ocp-crc. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/3a689c77faf7458a98d76617ae1faee9 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job periodic-podified-edpm-baremetal-minor-update-bootc-master-ocp-crc. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/518e2164d6fb4a1abebdce43a793a6cc found in build home directory during playbook review.rdoproject.org/config/playbooks/ci-framework-rdo-base/dlrn/dlrn-report.yaml for job periodic-podified-edpm-baremetal-minor-update-bootc-master-ocp-crc. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/d6eac0783d5e4a13afba54eab2834fe8 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job podified-multinode-edpm-deployment-crc-centos-10. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/b9b15652f87a4e6a907775a5be24c9fa found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job podified-multinode-edpm-deployment-crc-centos-10. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/d6eac0783d5e4a13afba54eab2834fe8 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/multinode-autohold.yml for job podified-multinode-edpm-deployment-crc-centos-10. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/b9b15652f87a4e6a907775a5be24c9fa found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/multinode-autohold.yml for job podified-multinode-edpm-deployment-crc-centos-10. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/d6eac0783d5e4a13afba54eab2834fe8 found in build home directory during playbook review.rdoproject.org/config/playbooks/crc/print-machineconfigpool.yaml for job podified-multinode-edpm-deployment-crc-centos-10. Add to preserve-home-paths if safe, or otherwise remove.
File .ssh/known_hosts.old found in build home directory during playbook review.rdoproject.org/config/playbooks/base-minimal/post-logs.yaml for job podified-multinode-edpm-deployment-crc-centos-10. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/e2c670c415a944949345bb673674e4a5 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job podified-multinode-edpm-deployment-crc. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/6cc29c9c00e74ab1b3d071b7cad90061 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job podified-multinode-edpm-deployment-crc. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/e2c670c415a944949345bb673674e4a5 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/multinode-autohold.yml for job podified-multinode-edpm-deployment-crc. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/6cc29c9c00e74ab1b3d071b7cad90061 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/multinode-autohold.yml for job podified-multinode-edpm-deployment-crc. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/e2c670c415a944949345bb673674e4a5 found in build home directory during playbook review.rdoproject.org/config/playbooks/crc/print-machineconfigpool.yaml for job podified-multinode-edpm-deployment-crc. Add to preserve-home-paths if safe, or otherwise remove.
File .ssh/known_hosts.old found in build home directory during playbook review.rdoproject.org/config/playbooks/base-minimal/post-logs.yaml for job podified-multinode-edpm-deployment-crc. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/38f74742c482410f942a22e2d10a8968 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job cifmw-crc-podified-edpm-baremetal-bootc. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/efe72f9eb3174043ae5ece3e7f77e911 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job cifmw-crc-podified-edpm-baremetal-bootc. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/f16443299872420d8fd16179b28c8661 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job cifmw-crc-podified-edpm-baremetal-bootc. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/4d6cc2393e804379bb35c99f8228c35c found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job cifmw-crc-podified-edpm-baremetal-bootc. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/62dd014ebb11478bbd43b65ef2cd77f6 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job cifmw-crc-podified-edpm-baremetal-bootc. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/9b8e7692ac914d51b1628ca3f5782816 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job cifmw-crc-podified-edpm-baremetal. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/595fc648af584b38a9d12c0c764e56dc found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job cifmw-crc-podified-edpm-baremetal. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/6a55ad7ebfa54ddba612568889261bb3 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job cifmw-crc-podified-edpm-baremetal. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/6fb1f64cfaf647919ac602024d734abf found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job cifmw-crc-podified-edpm-baremetal. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/1e0e1b388e14471b9f701e9417f2b52c found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job cifmw-crc-podified-edpm-baremetal. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/e8a7219137fb499d90dc6273ec208021 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job cifmw-crc-podified-edpm-baremetal-minor-update. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/e824e1defb184529b78fb9dde6dbfa11 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job cifmw-crc-podified-edpm-baremetal-minor-update. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/050c20b4ec104ea08dd0fb104971b6c6 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job cifmw-crc-podified-edpm-baremetal-minor-update. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/c7d2446dc81e463982449d9f0020e25c found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job cifmw-crc-podified-edpm-baremetal-minor-update. Add to preserve-home-paths if safe, or otherwise remove.
File ansible/tmp/05e67cc2df314867bdea7413a75fa4a7 found in build home directory during playbook github.com/openstack-k8s-operators/ci-framework/ci/playbooks/collect-logs.yml for job cifmw-crc-podified-edpm-baremetal-minor-update. Add to preserve-home-paths if safe, or otherwise remove.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

do-not-merge/work-in-progress

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vakwetu