---
id: castellan
version: "5.8.0"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# castellan — Generic Key Manager interface for OpenStack

License: permissive · Maintenance: active · Downloads: 133.0K/mo

## What it is and what it does

Castellan is a generic key manager abstraction layer for OpenStack that provides a consistent Python interface to cryptographic key storage and retrieval. Rather than coupling OpenStack services directly to a specific key manager implementation, Castellan acts as a plugin-based gateway, allowing different backends to be swapped without changing application code.

The package depends on cryptography, python-barbicanclient, and several oslo libraries for configuration, logging, and context management. It uses stevedore for plugin discovery and keystoneauth1 for OpenStack authentication. This makes it suitable for OpenStack operators and developers building services that need to manage secrets securely without hard-coding a particular key manager choice.

Use it for:

- Abstract key manager interactions in OpenStack services so they can work with multiple backends
- Store and retrieve encryption keys for data protection in OpenStack deployments
- Integrate with key management systems through a unified API
- Build OpenStack applications that need cryptographic key management without backend lock-in

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Castellan provides a unified interface for interacting with key management services in OpenStack environments, abstracting away the complexity of different key manager backends.

Yes, if you are building or operating OpenStack services that need key management. The package is actively maintained, has no known vulnerabilities, and provides genuine value by decoupling your code from a specific key manager. If you are not working within an OpenStack environment or do not need key manager abstraction, it is not relevant.

## Install

pip install castellan
uv add castellan
poetry add castellan

## Installing castellan

Before you install: Low install friction with a pure-Python wheel and active maintenance. The dependency chain includes 11 runtime packages, mostly from the oslo and OpenStack ecosystems; all are standard library-style components with established track records.

License in practice: Licensed under Apache-2.0 (permissive), allowing commercial and private use with minimal restrictions; suitable for proprietary OpenStack deployments.

Quickstart:

pip install castellan

from castellan import key_manager

manager = key_manager.KeyManager()
key = manager.create_key()

Requires Python 3.11 or later; intended for use within OpenStack environments where a key manager backend is configured and accessible.

Verify before relying:

- Whether the package works standalone or requires a running OpenStack/Barbican deployment
- Configuration details and environment variables needed to initialize the key manager
- Supported key manager backends beyond python-barbicanclient
- Specific key creation and retrieval method signatures and parameters

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 133.0K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

openstack key management, key manager interface, cryptographic key storage, openstack secrets management, barbican client wrapper, key manager abstraction layer, openstack, key-management, cryptography

[View on SkillFed](https://skillfed.io/packages/castellan) · [View on PyPI](https://pypi.org/project/castellan/)