Current Series Release Notes

22.0.0-39

New Features

• Barbican now has a new microversion 1.2 with a behaviour change when deleting secrets. If a secret has consumers registered it cannot be deleted in this microversion until the consumers are removed.

  Use the force query parameter with a truthy value to force the deletion.

• Barbican now supports generation of Guru Meditation Reports using oslo.reports libary.

• The following options have been added to the vault_plugin section.

  • kv_path

  • kv_version

Upgrade Notes

• Python 3.9 and 3.10 support has been dropped. The minimum version of Python now supported is Python 3.11.

• The enforce_scope and enforce_new_defaults options in the [oslo_policy] section of barbican.conf now default to True (as set by oslo.policy). The previous barbican-level overrides that forced these options to False have been removed.

  Operators using the legacy RBAC roles (admin, creator, observer, audit) must migrate to the new SRBAC roles:

  • admin — project-scoped administrative operations

  • member — general read/write access within a project

  • reader — read-only access within a project

  To temporarily opt out and continue using the legacy policy defaults, set the following in barbican.conf:

  [oslo_policy]
  enforce_scope = False
  enforce_new_defaults = False
  

  Note that the legacy policy defaults are deprecated and will be removed in a future release.

• The barbican-wsgi-api WSGI script has been removed. Deployment tooling should instead reference the Python module paths for this services, barbican.wsgi.api, if their chosen WSGI server supports this (gunicorn, uWSGI) or implement a .wsgi script themselves if not (mod_wsgi).

• The [DEFAULT] host_href option now defaults to None, which makes barbican-api to detect the base url according to the WSGI environments.

Deprecation Notes

• The [vault_plugin] use_ssl option has been deprecated, because it has had no effect.

• Using an empty string for the [DEFAULT] host_href option is deprecated. Unset the option instead.

Security Issues

• Barbican now enforces Secure RBAC (SRBAC) by default. Tokens must be project-scoped and carry the appropriate new roles (reader, member, or admin) to access Key Manager resources. System-scoped and domain-scoped tokens are rejected for all project-scoped API operations.

Bug Fixes

• Fixed a bug where SecretACLsController and ContainerACLsController overrode ACLMixin.get_acl_tuple(), returning incomplete target data that was missing ACL fields such as read_project_access. This caused the secret_is_not_private policy rule to always evaluate to False, resulting in HTTP 403 for project members who are not the secret owner when enforce_new_defaults is enabled. See bug 2069378.