Remove kolla entrypoint pattern from Barbican, harden SecurityContext

[stuggi]

Removes kolla_start/kolla_set_configs/config.json staging across all five Barbican workloads (API, worker, keystone-listener, db-sync, pkcs11-prep), replacing it with direct volume mounts at final config paths and hardcoded service commands.

Key changes:

• Replace kolla_start with /usr/sbin/httpd -DFOREGROUND (API), barbican-worker (worker), barbican-keystone-listener (listener), barbican-manage db upgrade (dbsync)
• Remove all kolla_set_configs, KOLLA_CONFIG_STRATEGY, KOLLA_BOOTSTRAP env vars and the kolla_extend_start script
• Delete all config.json templates (barbican-api-config.json, barbican-dbsync-config.json, barbican-worker-config.json, barbican-keystone-listener-config.json, barbican-pkcs11-prep-config.json) and launcher scripts (barbican-worker, barbican-keystone-listener)
• Remove PKCS11ClientDataPath from template parameters (no longer needed without kolla config.json staging)
• Mount configs via SubPath to /etc/barbican/, /etc/httpd/, /etc/my.cnf, /var/www/cgi-bin/barbican/main
• Add emptyDir volumes for writable paths (/run/httpd, /var/log/httpd, /var/log/barbican) using lib-common volume.WritableDirVolume/Mount helpers with standardized constants (volume.RunHttpdVolumeName, volume.VarLogHttpdVolumeName, etc.)
• Use pod.RestrictiveSecurityContext and RestrictivePodSecurityContext from lib-common for all workloads, setting ReadOnlyRootFilesystem, dropping ALL capabilities, and enabling seccomp RuntimeDefault
• Set AutomountServiceAccountToken=false on all workloads -- none need k8s API access (ServiceAccountName is kept for SCC binding)
• Import BarbicanUID from lib-common modules/serviceuser
• Config Secret DefaultMode set to 0440 (owner-read + group-read, most restrictive -- all SubPath mounts are ReadOnly: true)
• Override TLS CertMount/KeyMount to /etc/pki/tls/ for Apache
• Grant nonroot-v2 SCC alongside anyuid in both the +kubebuilder:rbac marker and the hardcoded rbacRules slice passed to ReconcileRbac() (the RBAC lives in two places -- the marker feeds the operator's ClusterRole, while rbacRules creates the runtime Role/RoleBinding for the workload ServiceAccount; both must be updated)
• Update httpd.conf: User/Group barbican
• Support custom config overwrite keys via dynamic SubPath mounts into /etc/barbican/ with backwards-compatible directory mount at /etc/barbican/barbican.conf.d/
• Update functional and kuttl tests

Found and fixed two real staging-vs-final path bugs that only kolla's copy step was masking: BarbicanAPI's per-endpoint TLS cert/key were falling back to lib-common's default staging mount instead of the path 10-barbican_wsgi_main.conf actually expects, and HSM/PKCS11 client data was mounted at an internal staging constant instead of the user-configured ClientDataPath the vendor library reads from.

Note: the PKCS11 prep Job still runs as root (RunAsUser: 0) because the vendor HSM client library setup performed by
generate_pkcs11_keys.sh is not verified to work under a non-root UID without real HSM hardware. The anyuid SCC grant is legitimate for this workload and cannot be dropped while the pkcs11-prep Job shares a ServiceAccount with the other Barbican services.

Jira: OSPRH-33504
Jira: OSPRH-33503

Depends-On: openstack-k8s-operators/lib-common#728

[centosinfra-prod-github-app]

This change depends on a change that failed to merge.

Change openstack-k8s-operators/lib-common#728 is needed.

[stuggi]

/test barbican-operator-build-deploy-kuttl

[stuggi]

/test barbican-operator-build-deploy-kuttl

[abays]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: abays, stuggi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [abays,stuggi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Deydra71]

/lgtm

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: d8a57080-18a3-42b9-86b6-8d6ee48bb501

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Deydra71]

/lgtm