castellan

library5.7.0pypypi✓ verified 86d ago

Castellan is a generic key management interface for OpenStack, providing a unified API to manage secrets (symmetric keys, certificates, passphrases) across different backends like Barbican or KMIP. Current version 5.6.0 targets Python >=3.10. Releases follow OpenStack cycle cadence.

auth-security aws

pip install castellan

package ↗homepage ↗

INSTALL

IMPORT

SIG · CASTELLAN

castellan

auth-securitypythonv5.7.0

Install

8.2s avg

Import

575ms

Disk

94MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v5.7.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.582s · 87.7MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 8.2s · import 0.568s · 89MB

94MB installed

● package 94MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

key_manager

✓ from castellan import key_manager

Key manager factory to get backend instances

BarbicanKeyManager

✓ from castellan.key_manager.barbican_key_manager import BarbicanKeyManager

✗ from castellan.barbican_key_manager import BarbicanKeyManager

Wrong path: must include full module path

KMIPKeyManager

✓ from castellan.key_manager.kmip_key_manager import KMIPKeyManager

Key

✓ from castellan.common.objects import Key

✗ from castellan.objects import Key

Key base class is in common.objects

Passphrase

✓ from castellan.common.objects import Passphrase

Basic usage: create a key manager using config, store and retrieve a passphrase.

import os from castellan import key_manager from castellan.common.objects import Passphrase, SymmetricKey conf = { 'key_manager': 'barbican', 'barbican': { 'auth_url': os.environ.get('OS_AUTH_URL', ''), 'project_name': os.environ.get('OS_PROJECT_NAME', ''), } } km = key_manager.KeyManager(conf) # Create a passphrase passphrase = Passphrase('my-secret-passphrase') stored = km.store('default', passphrase) print(f"Stored passphrase with ID: {stored}") # Retrieve retrieved = km.get('default', stored) print(f"Retrieved passphrase: {retrieved.get_encoded()}")

castellan --version

Debug

Known issues

breakingcastellan 5.0.0 dropped support for Python versions <3.10. Ensure your environment uses Python 3.10+.

fix

Upgrade to Python >=3.10 or stay on castellan 4.x for Python 3.8/3.9 support.

affects: >=5.0.0

deprecatedThe configuration option 'castellan_api_version' is deprecated since 3.0.0 and will be removed in a future release. Use 'backend' specific configuration instead.

fix

Switch to backend-specific config options like 'barbican_api_version' if using Barbican.

affects: >=3.0.0

gotchaThe KeyManager constructor expects a dictionary with specific keys (e.g., 'key_manager' for backend type). Passing a flat config won't work; use oslo.config or a nested dict.

fix

Use oslo.config's ConfigOpts or build nested dict as shown in the quickstart.

affects: all

gotchaWhen storing a key, the context argument (e.g., 'default') is required and must match a backend context. Using None may lead to errors in certain backends.

fix

Always provide a non-None context string that corresponds to your backend configuration.

affects: all

Errors

Common errors & fixes

ImportError: cannot import name 'key_manager' from 'castellan'

Incorrect import path; castellan.key_manager is a module, not a top-level attribute.

fix

Use: from castellan import key_manager

castellan.key_manager.KeyManager object has no attribute 'store'

KeyManager is a factory; you must call it to get a backend manager instance.

fix

km = key_manager.KeyManager(conf) then km.store(...)

castellan.common.exception.KeyManagerError: Connection refused

Barbican endpoint is unreachable or misconfigured.

fix

Check OS_AUTH_URL and OS_PROJECT_NAME environment variables, or provide correct barbican_url in config.

Upgrade

Version history

5.7.0latest on PyPI · released May 18, 2026

Audit

Dependencies

keystoneauth1optionalAuthentication for OpenStack identity

oslo.configoptionalConfiguration management

Agent activity

31 hits · last 30 days

node

OpenAI (training)

Resources

packagehttps://pypi.org/project/castellan/ ↗

homepagehttps://docs.openstack.org/castellan/ ↗