# octavia.certificates.manager package

## Submodules

## octavia.certificates.manager.barbican module

Cert manager implementation for Barbican using a single PKCS12 secret

class BarbicanCertManager

  Bases: `CertManager`

  Certificate Manager that wraps the Barbican client API.

  delete_cert(context, cert_ref, resource_ref, service_name=None)

    Deregister as a consumer for the specified cert.

    Parameters:

      - context – Oslo context of the request

      - cert_ref – the UUID of the cert to retrieve

      - resource_ref – Full HATEOAS reference to the consuming resource

      - service_name – Friendly name for the consuming service

    Raises:

      Exception – if deregistration fails

  get_cert(context, cert_ref, resource_ref=None, check_only=False, service_name=None)

    Retrieves the specified cert and registers as a consumer.

    Parameters:

      - context – Oslo context of the request

      - cert_ref – the UUID of the cert to retrieve

      - resource_ref – Full HATEOAS reference to the consuming resource

      - check_only – Read Certificate data without registering

      - service_name – Friendly name for the consuming service

    Returns:

      octavia.certificates.common.Cert representation of the certificate data

    Raises:

      Exception – if certificate retrieval fails

  get_secret(context, secret_ref)

    Retrieves a secret payload by reference.

    Parameters:

      - context – Oslo context of the request

      - secret_ref – The secret reference ID

    Returns:

      The secret payload

    Raises:

      CertificateStorageException – if retrieval fails

  set_acls(context, cert_ref)

    Adds ACLs so Octavia can access the cert objects.

    If the specified cert does not exist or the addition of ACLs fails for any reason, a CertificateStorageException should be raised.

  store_cert(context, certificate, private_key, intermediates=None, private_key_passphrase=None, expiration=None, name='PKCS12 Certificate Bundle')

    Stores a certificate in the certificate manager.

    Parameters:

      - context – Oslo context of the request

      - certificate – PEM encoded TLS certificate

      - private_key – private key for the supplied certificate

      - intermediates – ordered and concatenated intermediate certs

      - private_key_passphrase – optional passphrase for the supplied key

      - expiration – the expiration time of the cert in ISO 8601 format

      - name – a friendly name for the cert

    Returns:

      the container_ref of the stored cert

    Raises:

      Exception – if certificate storage fails

  unset_acls(context, cert_ref)

    Remove ACLs so Octavia can access the cert objects.

    If the specified cert does not exist or the removal of ACLs fails for any reason, a CertificateStorageException should be raised.

## octavia.certificates.manager.barbican_legacy module

Legacy cert manager implementation for Barbican (container+secrets)

class BarbicanCertManager(auth=None)

  Bases: `CertManager`

  Certificate Manager that wraps the Barbican client API.

  delete_cert(context, cert_ref, resource_ref, service_name=None)

    Deregister as a consumer for the specified cert.

    Parameters:

      - context – Oslo context of the request

      - cert_ref – the UUID of the cert to retrieve

      - resource_ref – Full HATEOAS reference to the consuming resource

      - service_name – Friendly name for the consuming service

    Raises:

      Exception – if deregistration fails

  get_cert(context, cert_ref, resource_ref=None, check_only=False, service_name=None)

    Retrieves the specified cert and registers as a consumer.

    Parameters:

      - context – Oslo context of the request

      - cert_ref – the UUID of the cert to retrieve

      - resource_ref – Full HATEOAS reference to the consuming resource

      - check_only – Read Certificate data without registering

      - service_name – Friendly name for the consuming service

    Returns:

      octavia.certificates.common.Cert representation of the certificate data

    Raises:

      Exception – if certificate retrieval fails

  get_secret(context, secret_ref)

    Retrieves a secret payload by reference.

    If the specified secret does not exist, a CertificateStorageException should be raised.

  set_acls(context, cert_ref)

    Adds ACLs so Octavia can access the cert objects.

    If the specified cert does not exist or the addition of ACLs fails for any reason, a CertificateStorageException should be raised.

  store_cert(context, certificate, private_key, intermediates=None, private_key_passphrase=None, expiration=None, name=None)

    Stores a certificate in the certificate manager.

    Parameters:

      - context – Oslo context of the request

      - certificate – PEM encoded TLS certificate

      - private_key – private key for the supplied certificate

      - intermediates – ordered and concatenated intermediate certs

      - private_key_passphrase – optional passphrase for the supplied key

      - expiration – the expiration time of the cert in ISO 8601 format

      - name – a friendly name for the cert

    Returns:

      the container_ref of the stored cert

    Raises:

      Exception – if certificate storage fails

  unset_acls(context, cert_ref)

    Remove ACLs so Octavia can access the cert objects.

    If the specified cert does not exist or the removal of ACLs fails for any reason, a CertificateStorageException should be raised.

## octavia.certificates.manager.castellan_mgr module

Cert manager implementation for Castellan

class CastellanCertManager

  Bases: `CertManager`

  Certificate Manager for the Castellan library.

  delete_cert(context, cert_ref, resource_ref, service_name=None)

    Deletes the specified cert.

    If the specified cert does not exist, a CertificateStorageException should be raised.

  get_cert(context, cert_ref, resource_ref=None, check_only=False, service_name=None)

    Retrieves the specified cert.

    If check_only is True, don’t perform any sort of registration. If the specified cert does not exist, a CertificateStorageException should be raised.

  get_secret(context, secret_ref)

    Retrieves a secret payload by reference.

    If the specified secret does not exist, a CertificateStorageException should be raised.

  set_acls(context, cert_ref)

    Adds ACLs so Octavia can access the cert objects.

    If the specified cert does not exist or the addition of ACLs fails for any reason, a CertificateStorageException should be raised.

  store_cert(context, certificate, private_key, intermediates=None, private_key_passphrase=None, expiration=None, name='PKCS12 Certificate Bundle')

    Stores (i.e., registers) a cert with the cert manager.

    This method stores the specified cert and returns its UUID that identifies it within the cert manager. If storage of the certificate data fails, a CertificateStorageException should be raised.

  unset_acls(context, cert_ref)

    Remove ACLs so Octavia can access the cert objects.

    If the specified cert does not exist or the removal of ACLs fails for any reason, a CertificateStorageException should be raised.

## octavia.certificates.manager.cert_mgr module

Certificate manager API

class CertManager

  Bases: `object`

  Base Cert Manager Interface

  A Cert Manager is responsible for managing certificates for TLS.

  abstractmethod delete_cert(context, cert_ref, resource_ref, service_name=None)

    Deletes the specified cert.

    If the specified cert does not exist, a CertificateStorageException should be raised.

  abstractmethod get_cert(context, cert_ref, resource_ref=None, check_only=False, service_name=None)

    Retrieves the specified cert.

    If check_only is True, don’t perform any sort of registration. If the specified cert does not exist, a CertificateStorageException should be raised.

  abstractmethod get_secret(context, secret_ref)

    Retrieves a secret payload by reference.

    If the specified secret does not exist, a CertificateStorageException should be raised.

  abstractmethod set_acls(context, cert_ref)

    Adds ACLs so Octavia can access the cert objects.

    If the specified cert does not exist or the addition of ACLs fails for any reason, a CertificateStorageException should be raised.

  abstractmethod store_cert(context, certificate, private_key, intermediates=None, private_key_passphrase=None, expiration=None, name=None)

    Stores (i.e., registers) a cert with the cert manager.

    This method stores the specified cert and returns its UUID that identifies it within the cert manager. If storage of the certificate data fails, a CertificateStorageException should be raised.

  abstractmethod unset_acls(context, cert_ref)

    Remove ACLs so Octavia can access the cert objects.

    If the specified cert does not exist or the removal of ACLs fails for any reason, a CertificateStorageException should be raised.

## octavia.certificates.manager.local module

class LocalCertManager

  Bases: `CertManager`

  Cert Manager Interface that stores data locally.

  static delete_cert(context, cert_ref, **kwargs)

    Deletes the specified cert.

    Parameters:

      - context – Ignored in this implementation

      - cert_ref – the UUID of the cert to delete

    Raises:

      CertificateStorageException – if certificate deletion fails

  static get_cert(context, cert_ref, **kwargs)

    Retrieves the specified cert.

    Parameters:

      - context – Ignored in this implementation

      - cert_ref – the UUID of the cert to retrieve

    Returns:

      octavia.certificates.common.Cert representation of the certificate data

    Raises:

      CertificateStorageException – if certificate retrieval fails

  static get_secret(context, secret_ref)

    Retrieves a secret payload by reference.

    Parameters:

      - context – Ignored in this implementation

      - secret_ref – The secret reference ID

    Returns:

      The secret payload

    Raises:

      CertificateStorageException – if secret retrieval fails

  set_acls(context, cert_ref)

    Adds ACLs so Octavia can access the cert objects.

    If the specified cert does not exist or the addition of ACLs fails for any reason, a CertificateStorageException should be raised.

  static store_cert(context, certificate, private_key, intermediates=None, private_key_passphrase=None, **kwargs)

    Stores (i.e., registers) a cert with the cert manager.

    This method stores the specified cert to the filesystem and returns a UUID that can be used to retrieve it.

    Parameters:

      - context – Ignored in this implementation

      - certificate – PEM encoded TLS certificate

      - private_key – private key for the supplied certificate

      - intermediates – ordered and concatenated intermediate certs

      - private_key_passphrase – optional passphrase for the supplied key

    Returns:

      the UUID of the stored cert

    Raises:

      CertificateStorageException – if certificate storage fails

  unset_acls(context, cert_ref)

    Remove ACLs so Octavia can access the cert objects.

    If the specified cert does not exist or the removal of ACLs fails for any reason, a CertificateStorageException should be raised.

## octavia.certificates.manager.noop module

class NoopCertManager

  Bases: `CertManager`

  Cert manager implementation for no-op operations

  delete_cert(context, cert_ref, resource_ref, service_name=None)

    Deletes the specified cert.

    If the specified cert does not exist, a CertificateStorageException should be raised.

  get_cert(context, cert_ref, check_only=True, **kwargs) → Cert

    Retrieves the specified cert.

    If check_only is True, don’t perform any sort of registration. If the specified cert does not exist, a CertificateStorageException should be raised.

  get_secret(context, secret_ref) → Cert

    Retrieves a secret payload by reference.

    If the specified secret does not exist, a CertificateStorageException should be raised.

  property local_cert
  set_acls(context, cert_ref)

    Adds ACLs so Octavia can access the cert objects.

    If the specified cert does not exist or the addition of ACLs fails for any reason, a CertificateStorageException should be raised.

  store_cert(context, certificate, private_key, intermediates=None, private_key_passphrase=None, **kwargs) → Cert

    Stores (i.e., registers) a cert with the cert manager.

    This method stores the specified cert to the filesystem and returns a UUID that can be used to retrieve it.

    Parameters:

      - context – Ignored in this implementation

      - certificate – PEM encoded TLS certificate

      - private_key – private key for the supplied certificate

      - intermediates – ordered and concatenated intermediate certs

      - private_key_passphrase – optional passphrase for the supplied key

    Returns:

      the UUID of the stored cert

    Raises:

      CertificateStorageException – if certificate storage fails

  unset_acls(context, cert_ref)

    Remove ACLs so Octavia can access the cert objects.

    If the specified cert does not exist or the removal of ACLs fails for any reason, a CertificateStorageException should be raised.

## Module contents

this page last updated: 2026-04-13 15:26:39

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug