Re: [openstack-dev] [murano][barbican] Encrypting sensitive properties

2017-06-01 Thread Paul Bourke
Thanks for that Kirill. Optional sounds good. Right now I'm leaning towards encrypting the full object model in the database rather than selective attributes, I can't think of a reason not to do this and it makes things more transparent and straight forward for the user. I've added a spec for

Re: [openstack-dev] [murano][barbican] Encrypting sensitive properties

2017-05-31 Thread Kirill Zaitsev
As long as this integration is optional (i.e. no barbican — no encryption) It feels ok to me. We have a very similar integration with congress, yet you can deploy murano with or without it. As for the way to convey this, I believe metadata attributes were designed to answer use-cases like this

[openstack-dev] [murano][barbican] Encrypting sensitive properties

2017-05-25 Thread Paul Bourke
Hi all, I've been looking at a blueprint[0] logged for Murano which involves encrypting parts of the object model stored in the database that may contain passwords or sensitive information. I wanted to see if people had any thoughts or preferences on how this should be done. On the face of