Key Manager CLI Reference - Polystack Documentation

Overview

The openstack secret command group manages secrets, containers, and access control policies in the Polystack Key Manager service.

Prerequisites

CLI installed and authenticated — see CLI Setup
Python barbicanclient installed: pip install python-barbicanclient

Secrets

openstack secret list

openstack secret store \
  --name db-password \
  --secret-type passphrase \
  --payload "my-secure-password"

openstack secret order create \
  --name aes-key \
  --algorithm aes \
  --bit-length 256 \
  --mode cbc \
  key

openstack secret store \
  --name tls-cert \
  --secret-type certificate \
  --file /path/to/cert.pem \
  --payload-content-type "application/octet-stream"

openstack secret get <secret-href>

openstack secret get --payload <secret-href>

openstack secret delete <secret-href>

Containers

openstack secret container list

openstack secret container create \
  --name my-tls \
  --type certificate \
  --secret "certificate=<cert-href>" \
  --secret "private_key=<key-href>"

openstack secret container get <container-href>

openstack secret container delete <container-href>

Orders (Key Generation)

openstack secret order list

openstack secret order create \
  --name my-key \
  --algorithm aes \
  --bit-length 256 \
  key

openstack secret order get <order-href>

openstack secret order delete <order-href>

ACLs

openstack acl get <secret-href>

openstack acl submit \
  --user <user-id> \
  --operation-type read \
  <secret-href>

openstack acl delete <secret-href>

Next Steps

Store Secrets Guide

Guide to storing and retrieving secrets securely

Certificates Guide

Manage TLS certificates and certificate orders