2

I'm currently planning a small OpenStack deployment and I want to use Ceph for object storage (via Rados Gateway) and block storage.

Ceph supports multitenancy. It also supports encryption using key management services like vault or barbican. Since I'm using OpenStack anyways I'd like to go with barbican. If I use barbican I have to create a keystone user which is used to access barbican and store the keys. Doesn't that create a security issue, though?

Let's say I have two tenants, Alice and Bob. They create encrypted buckets. But since all of their keys are stored in barbican using a single user (Ceph's) wouldn't I (since I know the ceph user's password) be able to read the keys and decrypt their data?

Generally speaking, is there a supported use case where multiple users can create encrypted buckets and I wouldn't be able to decrypt their data?

0

You must log in to answer this question.

Browse other questions tagged .