| *** ametts has quit IRC | 00:01 | |
| *** chlong has joined #openstack-barbican | 00:06 | |
| *** kebray has quit IRC | 00:10 | |
| *** kgriffs is now known as kgriffs|afk | 00:22 | |
| *** kgriffs|afk is now known as kgriffs | 00:22 | |
| *** atiwari has quit IRC | 00:26 | |
| *** jkf has quit IRC | 00:34 | |
| *** ryanpetrello has joined #openstack-barbican | 00:35 | |
| *** ryanpetrello has quit IRC | 00:39 | |
| *** kgriffs is now known as kgriffs|afk | 00:42 | |
| *** rm_mobile| has joined #openstack-barbican | 00:49 | |
| *** rm_mobile| has quit IRC | 00:49 | |
| *** rm_mobile has quit IRC | 00:52 | |
| *** ryanpetrello has joined #openstack-barbican | 01:00 | |
| *** jaosorior has quit IRC | 01:03 | |
| *** ryanpetrello has quit IRC | 01:07 | |
| *** ryanpetrello has joined #openstack-barbican | 01:09 | |
| *** ryanpetrello has quit IRC | 01:18 | |
| *** gyee has quit IRC | 01:21 | |
| *** ryanpetrello has joined #openstack-barbican | 01:32 | |
| *** ryanpetrello has quit IRC | 01:37 | |
| *** bdpayne has quit IRC | 01:42 | |
| *** david-lyle has joined #openstack-barbican | 01:43 | |
| *** david-lyle has quit IRC | 02:06 | |
| *** kebray has joined #openstack-barbican | 02:14 | |
| *** kebray has quit IRC | 02:15 | |
| *** david-lyle has joined #openstack-barbican | 02:16 | |
| *** david-lyle has quit IRC | 02:19 | |
| *** kebray has joined #openstack-barbican | 02:22 | |
| *** david-lyle has joined #openstack-barbican | 02:23 | |
| *** david-lyle has quit IRC | 02:42 | |
| *** david-lyle has joined #openstack-barbican | 02:43 | |
| *** david-lyle has quit IRC | 02:49 | |
| *** zz_dimtruck is now known as dimtruck | 02:50 | |
| *** woodster_ has quit IRC | 02:50 | |
| *** david-lyle has joined #openstack-barbican | 02:56 | |
| *** ryanpetrello has joined #openstack-barbican | 02:58 | |
| *** crc32 has quit IRC | 03:07 | |
| *** david-lyle has quit IRC | 03:32 | |
| *** ryanpetrello has quit IRC | 03:54 | |
| *** chlong has quit IRC | 04:06 | |
| *** woodster_ has joined #openstack-barbican | 04:11 | |
| *** chlong has joined #openstack-barbican | 04:11 | |
| *** chlong_ has joined #openstack-barbican | 04:13 | |
| *** chlong has quit IRC | 04:17 | |
| *** chlong_ has quit IRC | 04:18 | |
| *** chlong has joined #openstack-barbican | 04:24 | |
| *** chlong_ has joined #openstack-barbican | 04:26 | |
| *** chlong has quit IRC | 04:27 | |
| *** chlong__ has joined #openstack-barbican | 04:28 | |
| *** chlong_ has quit IRC | 04:29 | |
| *** chlong_ has joined #openstack-barbican | 04:29 | |
| *** chlong_ has quit IRC | 04:32 | |
| *** chlong has joined #openstack-barbican | 04:32 | |
| *** chlong__ has quit IRC | 04:33 | |
| *** chlong has quit IRC | 04:34 | |
| *** rm_you| is now known as rm_you | 04:51 | |
| *** chlong has joined #openstack-barbican | 05:00 | |
| *** chlong_ has joined #openstack-barbican | 05:01 | |
| *** jamielennox is now known as jamielennox|away | 05:02 | |
| *** chlong has quit IRC | 05:04 | |
| *** jamielennox|away is now known as jamielennox | 05:05 | |
| *** chlong__ has joined #openstack-barbican | 05:06 | |
| *** chlong_ has quit IRC | 05:09 | |
| *** chlong has joined #openstack-barbican | 05:12 | |
| *** chlong__ has quit IRC | 05:12 | |
| *** chlong has quit IRC | 05:12 | |
| *** kebray has quit IRC | 05:16 | |
| *** kebray has joined #openstack-barbican | 05:19 | |
| *** jamielennox is now known as jamielennox|away | 05:22 | |
| *** jamielennox|away is now known as jamielennox | 05:22 | |
| *** ayoung has quit IRC | 05:23 | |
| *** chlong has joined #openstack-barbican | 05:25 | |
| *** ayoung has joined #openstack-barbican | 05:25 | |
| *** chlong has quit IRC | 05:31 | |
| *** chlong has joined #openstack-barbican | 05:31 | |
| *** chlong has quit IRC | 05:34 | |
| *** Nirupama has joined #openstack-barbican | 05:36 | |
| *** chlong has joined #openstack-barbican | 05:40 | |
| *** chlong_ has joined #openstack-barbican | 05:41 | |
| *** chlong has quit IRC | 05:45 | |
| *** trey has quit IRC | 06:10 | |
| *** dimtruck is now known as zz_dimtruck | 06:15 | |
| *** woodster_ has quit IRC | 06:20 | |
| *** kebray has quit IRC | 06:58 | |
| *** jamielennox is now known as jamielennox|away | 07:24 | |
| *** chlong_ has quit IRC | 07:39 | |
| *** jamielennox|away is now known as jamielennox | 10:34 | |
| *** Nirupama has quit IRC | 11:47 | |
| *** jamielennox is now known as jamielennox|away | 12:03 | |
| *** chlong_ has joined #openstack-barbican | 12:09 | |
| *** woodster_ has joined #openstack-barbican | 13:00 | |
| *** ayoung has quit IRC | 13:27 | |
| *** darrenmoffat has quit IRC | 13:27 | |
| *** darrenmoffat has joined #openstack-barbican | 13:28 | |
| *** alee has quit IRC | 13:48 | |
| *** chlong_ has quit IRC | 13:56 | |
| *** ayoung has joined #openstack-barbican | 14:26 | |
| *** ametts has joined #openstack-barbican | 14:48 | |
| *** kgriffs|afk is now known as kgriffs | 14:50 | |
| *** zz_dimtruck is now known as dimtruck | 14:56 | |
| *** paul_glass has joined #openstack-barbican | 14:58 | |
| *** alee has joined #openstack-barbican | 15:04 | |
| *** lisaclark1 has joined #openstack-barbican | 15:23 | |
| *** kebray has joined #openstack-barbican | 15:27 | |
| *** kebray has quit IRC | 15:28 | |
| *** kebray has joined #openstack-barbican | 15:32 | |
| *** rellerreller has joined #openstack-barbican | 15:33 | |
| *** kebray has quit IRC | 15:35 | |
| *** nkinder is now known as nkinder_away | 15:40 | |
| *** SheenaG1 has joined #openstack-barbican | 15:41 | |
| *** ryanpetrello has joined #openstack-barbican | 15:50 | |
| *** lisaclark1 has quit IRC | 15:55 | |
| *** lisaclark1 has joined #openstack-barbican | 15:55 | |
| *** kebray has joined #openstack-barbican | 15:56 | |
| *** SheenaG1 has quit IRC | 16:06 | |
| *** SheenaG1 has joined #openstack-barbican | 16:16 | |
| woodster_ | alee, are all your db issues worked out? | 16:27 |
|---|---|---|
| alee | woodster_, so far, I think so -- see the patch I attached | 16:28 |
| alee | woodster_, I had some questions in the tests for ProjectCA etc .. | 16:28 |
| alee | woodster_, and I may get your help later in creating the alembic scripts | 16:28 |
| alee | woodster_, working on a first pass for the repos and controllers now. | 16:29 |
| woodster_ | alee, I had sent this after you left I think: this is how I've done db migrations in the past: https://github.com/cloudkeep/barbican/wiki/Database-Migrations | 16:29 |
| *** dimtruck is now known as zz_dimtruck | 16:30 | |
| alee | woodster_, yup saw that .. I need to try it once I get through this next set of patches | 16:30 |
| alee | woodster_, I'm hoping to have a first pass of the "Identify CAs" feature working by the end of the week. | 16:31 |
| woodster_ | alee, no problem. I'll take a look at the patch today | 16:31 |
| alee | then go back to focus on "stored key" enrollment case next week. | 16:31 |
| alee | woodster_, you started implementing the scheduler for cert request processing yet? | 16:32 |
| *** zz_dimtruck is now known as dimtruck | 16:35 | |
| woodster_ | alee, yes, we have been creating stories to get that work done. I'll going to be revisiting that sub-status stuff we had discussed end of Aug last year as well. | 16:38 |
| *** jorge_munoz has joined #openstack-barbican | 16:39 | |
| alee | woodster_, ok -- quick question on pecan --> say I want to create a method in my controller for POST /cas/{ca_id}/add-to-project | 16:40 |
| alee | woodster_, how do I define that so it gets routed correctly? | 16:41 |
| ryanpetrello | alee: http://pecan.readthedocs.org/en/latest/rest.html | 16:41 |
| ryanpetrello | "Writing RESTful Web Services with Generic Controllers" is how the Barbican folks write their controllers | 16:42 |
| woodster_ | alee, well you start with the app.py's create_main_app() method's RootController to setup the base resources, like the /cas one there | 16:42 |
| woodster_ | alee, so you'd have a CasController probably hooked in there | 16:43 |
| alee | woodster_, right I get that far -- so .. for example .. | 16:43 |
| woodster_ | alee, that CasController would then have a _lookup method that is used to work on the next slash element int he resources...so the /cas/{ca_id} part there | 16:44 |
| woodster_ | alee, so that would be a CaController...yep | 16:44 |
| alee | I know that to define GET /cas/{ca_id}/cacert , I need a method called cacert() in CAController | 16:44 |
| alee | ryanpetrello, woodster_ - so now I need to know how to define the method in CAController for POST /cas/{ca_id}/add-to-project | 16:45 |
| alee | presumably I need something like def add_to_project() | 16:46 |
| alee | how do I get that to route fro POST /add_to_project ? | 16:46 |
| alee | looks like I need to define _custom_actions() ? | 16:46 |
| ryanpetrello | you could also use a `_lookup` | 16:47 |
| ryanpetrello | with a dictionary that mapped the path chunk to some handler | 16:47 |
| alee | ryanpetrello, you have an example somewhere? | 16:48 |
| ryanpetrello | I can create one, gimme a bit | 16:48 |
| alee | ryanpetrello, thanks -- coz I need to map both the path add-to-project --> add_to_project and define the method | 16:49 |
| ryanpetrello | k | 16:49 |
| ryanpetrello | you only want to handle POST ? | 16:49 |
| alee | ryanpetrello, for this path yes | 16:50 |
| woodster_ | It seems like the @expose def my_function approach is the cleanest? | 16:50 |
| ryanpetrello | yea, there are a handful of ways to do this | 16:50 |
| *** hyakuhei has joined #openstack-barbican | 16:50 | |
| woodster_ | I guess if we want to lookup a controller to handle things though (my preference), we should use the _lookup approach if possible | 16:51 |
| *** jorge_munoz has quit IRC | 16:51 | |
| alee | woodster_, @expose def my_function still needs some decorators to go from add_to_project -> add-to-project , and define the method -- but I'll wait to see what ryanpetrello comes up with :) | 16:53 |
| woodster_ | ryanpetrello, thanks once again for your help! | 16:54 |
| ryanpetrello | yea, thinking about a saner way to do this | 16:54 |
| ryanpetrello | this is one aspect of pecan that's annoying - when you want a path that isn't a valid Python function name | 16:54 |
| alee | woodster_, incidentally, I'm booked to be at the mid-cycle. staying at the Omni. | 16:54 |
| alee | yup | 16:55 |
| woodster_ | alee, nice! I need to actually get my hotel booked | 16:55 |
| *** tkelsey has joined #openstack-barbican | 16:57 | |
| *** kebray has quit IRC | 17:01 | |
| *** bdpayne has joined #openstack-barbican | 17:03 | |
| woodster_ | alee, in the cert spec (http://specs.openstack.org/openstack/barbican-specs/specs/kilo/certificate-order-api.html) option 3, is that a public key ref there, or really a private/public key pair (in a container)? I'm just thinking that a CSR signed by private key has to be generated by barbican for option 3, to then send to the CA to cut the cert. | 17:03 |
| alee | woodster_, yeah - I need to update that spec. | 17:04 |
| woodster_ | alee, ok, just making sure I'm following it! That will be a mode we use here frequently I think | 17:04 |
| alee | woodster_, when I did the implementation, I realized that I needed to get the private key to sign the csr | 17:04 |
| alee | woodster_, so I changed it to be a reference to the container | 17:05 |
| ryanpetrello | alee: are you planning on handling different methods for `add-to-project` ? | 17:07 |
| ryanpetrello | or only HTTP POST? | 17:07 |
| alee | woodster_, I'm assuming that the path we want is /cas/{id}/add-to-project instead of .../add_to_project, right? | 17:08 |
| alee | ryanpetrello, just POST | 17:08 |
| alee | ryanpetrello, I have a few paths like this -- but they are all POST | 17:09 |
| ryanpetrello | okay | 17:09 |
| ryanpetrello | so I'm trying to think of the least gross way to accomplish this | 17:09 |
| ryanpetrello | because of the - in the path | 17:09 |
| ryanpetrello | I want to maybe take this and turn it into a generalized decorator at some point for pecan | 17:09 |
| ryanpetrello | maybe something where you could do @expose(alternate_path='add-to-project') | 17:10 |
| alee | right .. that would be a good idea -- thats exactly the decorator I was looking for :) | 17:10 |
| ryanpetrello | https://gist.github.com/ryanpetrello/363fa3b3f00472d997fd | 17:10 |
| ryanpetrello | but for now, this is what said decorator would actually be doing | 17:10 |
| rm_work | redrobot: are you guys driving to austin every morning for the thing, or are you hotel-ing? | 17:10 |
| ryanpetrello | might actually be a class decorator or something | 17:11 |
| ryanpetrello | I dunno, I need to come up with a syntax I like here | 17:11 |
| redrobot | rm_work Barbican mid-cycle? We're hoteling... Most people are staying at the Omni | 17:11 |
| ryanpetrello | this is a pecan complaint I've seen before, and I don't really have a great approach to it | 17:11 |
| *** jorge_munoz has joined #openstack-barbican | 17:11 | |
| ryanpetrello | you could also accomplish the same thing with a _lookup that mapped the special name to the method, but I like that less | 17:11 |
| rm_work | redrobot: k… i am debating what i want to do, because "cheap" is the operative requirement | 17:11 |
| redrobot | rm_work I'll probably be staying somewhere cheaper so I can go there the night before, instead of having to drive out the day of... | 17:11 |
| alee | ryanpetrello, cool - thanks -- I can work with this. | 17:12 |
| ryanpetrello | okay, cool | 17:12 |
| ryanpetrello | I'll be thinking about a way to provide a helper for this sort of thing in pecan | 17:12 |
| alee | ryanpetrello, right - this would be something that would come up if the convention is to use "-" for instance | 17:12 |
| ryanpetrello | the correct approach for that implementation, though, is probably overriding __getattr__ on the class | 17:12 |
| ryanpetrello | because that's how pecan's object dispatch traversal on path chunks works | 17:12 |
| ryanpetrello | it looks to see if the instance has a member/attribute with that name | 17:13 |
| *** kebray has joined #openstack-barbican | 17:13 | |
| ryanpetrello | (and then ensure's that it's marked with @expose) | 17:13 |
| ryanpetrello | s/ensure's/ensures | 17:13 |
| rm_work | rellerreller: today i will probably be taking a crack at doing the whole Castellan first-review, just FYI -- i have the time, and I figure I'd give it a shot, not sure if you guys have had time to get there yet | 17:14 |
| rellerreller | We are working on submitting the code for that | 17:14 |
| rellerreller | rm_work what were you planning on doing? | 17:14 |
| rm_work | rellerreller: ok, should I do it too so we have two examples to look at? or should I just sit and wait? :P | 17:15 |
| rm_work | I don't mind either way | 17:15 |
| rm_work | but this is pretty much what is on my plate for the day | 17:15 |
| rm_work | day/week | 17:15 |
| rellerreller | rm_work We are planning to submit the code for the KeyManager interface. | 17:15 |
| rm_work | was going to do the keymgr + certmgr in the layout i was hoping to see, with the contrib dir for implementations | 17:16 |
| rm_work | just as a "what-if" example | 17:16 |
| rm_work | but I guess I thought you guys were busier / further out | 17:16 |
| rellerreller | rm_work You can add the certmgr. I do not think there will be overalp with our stuff | 17:16 |
| rm_work | rellerreller: I wanted to do it as a followup, because there might be, but also I want to make sure things are all consistent | 17:17 |
| rellerreller | I know bpoulos is working on getting the code in for you guys soon. | 17:17 |
| rm_work | ok | 17:17 |
| rellerreller | right | 17:17 |
| rm_work | then maybe I will just wait? but i have this burning desire to get an example up :P | 17:17 |
| rm_work | just don't want to seem like I'm jumping the gun / ignoring your work | 17:17 |
| rm_work | i'll wait | 17:18 |
| rellerreller | I would like if we could contribute the KeyManager code, but I do not mind on the other stuff | 17:18 |
| rm_work | yeah that is why i recommended it to begin with, since that was your code | 17:18 |
| rm_work | maybe I can find other reviews to keep me busy | 17:18 |
| rm_work | in the meantime | 17:18 |
| rellerreller | We probably need to work on the other stuff (layout, tox, etc) together anyways, so adding that stuff in there is ok with me | 17:18 |
| rm_work | yeah I had some specific thoughts on the directory/package structure | 17:19 |
| rm_work | maybe I can get the tox stuff building? if Briana is just focused on the keymgr code | 17:20 |
| rm_work | or… bleh i should just wait | 17:20 |
| rm_work | it's fine, I can occupy myself for a day or two at least :) | 17:20 |
| alee | ryanpetrello, can I just return self.name in the __get_attr__ in case of no match? that way I only need to define overrrides there .. | 17:20 |
| rellerreller | I told Brianna to join the irc today | 17:21 |
| rm_work | alright, i'll let her fill me in when she's ready | 17:21 |
| rellerreller | I will tell her to contact you and you guys can work on the specifics | 17:21 |
| ryanpetrello | well, keep in mind that __getattr__ is only being called if Python can't already find an attribute of that name, so in this case, you're implementing a fallback | 17:21 |
| rellerreller | Does that work, rm_work? | 17:21 |
| ryanpetrello | (that should raise an AttributeError if it can't resolve the name) | 17:21 |
| rm_work | yeah that's fine | 17:21 |
| rm_work | no rush | 17:21 |
| alee | ah cool | 17:21 |
| rellerreller | Excellent | 17:21 |
| rm_work | i'm about to head to lunch after a few more review comments anyway | 17:22 |
| rellerreller | Enjoy :) | 17:22 |
| ryanpetrello | alee: ^ | 17:22 |
| alee | ryanpetrello, gotcha thanks | 17:23 |
| ryanpetrello | alee: I'm brainstorming on a way to do this in pecan | 17:23 |
| ryanpetrello | maybe something like `@expose(path='some-path-foo')` | 17:23 |
| ryanpetrello | like an alternative path | 17:23 |
| alee | ryanpetrello, yes - that would be nicer | 17:24 |
| woodster_ | ryanpetrello, alee, it seems like the _lookup approach using the map is the best approach for the current pecan version though? | 17:24 |
| alee | woodster_, do you mean this ? https://gist.github.com/ryanpetrello/363fa3b3f00472d997fd | 17:26 |
| woodster_ | alee, oh I see, yeah that makes sense. Does that work then? | 17:27 |
| alee | woodster_, I'll let you know :) | 17:28 |
| woodster_ | alee, rm_work, so are we ready to cut https://review.openstack.org/#/c/127353?? :) I can't wait for rm_work to go CrAzY on that one!!! | 17:36 |
| alee | woodster_, I didn't get the idea that rm_work was going to be working on the server side of that anytime soon .. | 17:37 |
| alee | woodster_, rm_work - but if he is - I'll get up another version tout de suite. | 17:38 |
| *** lisaclark1 has quit IRC | 17:38 | |
| alee | woodster_, rm_work - its going to take me some to time to finish cert stuff, and "identifying cas' first -- so if we can get someone else to start implementing "per secret acls", that would really help. | 17:39 |
| woodster_ | alee, I was merely hopeful that rm_work could get cycles to work on that RBAC stuff, but probably wishful thinking | 17:42 |
| rm_work | heh | 17:43 |
| *** hyakuhei has quit IRC | 17:43 | |
| alee | woodster_, I merely hopeful too :) | 17:43 |
| rm_work | well, i could use something to do TODAY while I wait for briana on castellan :P | 17:43 |
| rm_work | I assumed I would be doing mostly the client side stuff on that | 17:43 |
| rm_work | but i can maybe assist | 17:43 |
| rm_work | will be back after lunch in like 1.5h | 17:44 |
| alee | rm_work, it might take a little more than a day :) | 17:44 |
| rm_work | alee: :P | 17:44 |
| alee | (or half day as the case would be) | 17:44 |
| rm_work | heh | 17:44 |
| alee | rm_work, woodster_ I'll try get out a new version of the spec by end of the week, so that we can merge it by beginning of next week | 17:45 |
| rm_work | I'll take a look at the latest spec and we can discuss what I might be able to help out with | 17:45 |
| *** lisaclark1 has joined #openstack-barbican | 17:45 | |
| rm_work | kk | 17:45 |
| alee | that way if rm_work ends up having some time .. | 17:45 |
| woodster_ | rm_work, alee I'll settle for that! | 17:45 |
| alee | rm_work, and that would be great | 17:45 |
| rm_work | it's "necessary for lbaas"… so | 17:45 |
| rm_work | keep in mind that my sprint planning is NEXT THURSDAY | 17:45 |
| alee | rm_work, there are certainly subtasks that need to be figured out | 17:46 |
| rm_work | so having a job for me by that point would be good | 17:46 |
| woodster_ | rm_work that's what I've been sayin' :) | 17:46 |
| rm_work | otherwise i might get tasked out elsewhere | 17:46 |
| alee | rm_work, oh - finding a job for you is quite easy :) | 17:46 |
| woodster_ | rm_work that's what I'm concerned about...look 'busy' over there please | 17:46 |
| rm_work | kk… but i need to be able to explain the components by thursday :P | 17:46 |
| alee | rm_work, take a look at latest spec and we'll chat after lunch | 17:47 |
| woodster_ | rm_work, that bp is probably close enough to do that anyway | 17:47 |
| rm_work | kk | 17:47 |
| rm_work | bbl | 17:47 |
| *** lisaclark1 has quit IRC | 17:49 | |
| *** lisaclark1 has joined #openstack-barbican | 17:49 | |
| *** ayoung is now known as ayoung-gym | 17:50 | |
| *** lisaclark1 has quit IRC | 17:53 | |
| *** miqui_ has joined #openstack-barbican | 17:54 | |
| *** hyakuhei has joined #openstack-barbican | 18:00 | |
| *** jkf has joined #openstack-barbican | 18:01 | |
| *** dimtruck is now known as zz_dimtruck | 18:01 | |
| *** alee is now known as alee_lunch | 18:01 | |
| *** bdpayne has quit IRC | 18:02 | |
| *** zz_dimtruck is now known as dimtruck | 18:07 | |
| *** crc32 has joined #openstack-barbican | 18:08 | |
| *** jorge_munoz has quit IRC | 18:08 | |
| *** jorge_munoz has joined #openstack-barbican | 18:13 | |
| *** hyakuhei has quit IRC | 18:17 | |
| *** hyakuhei has joined #openstack-barbican | 18:17 | |
| *** rellerreller has quit IRC | 18:19 | |
| *** jaosorior has joined #openstack-barbican | 18:23 | |
| elmiko | hey folks, i'm doing some research into the possibility of using barbican in sahara. i'm having a little confusion about the general usage of barb, would anyone be willing to talk me through a few common use cases? | 18:26 |
| elmiko | or point me at some docs =) | 18:26 |
| *** hyakuhei has quit IRC | 18:26 | |
| reaperhulk | elmiko: our team is at lunch but someone can help you a bit this afternoon | 18:29 |
| reaperhulk | well, most of our team that is ;) | 18:30 |
| elmiko | reaperhulk: awesome, thanks! | 18:30 |
| *** rellerreller has joined #openstack-barbican | 18:30 | |
| *** hyakuhei has joined #openstack-barbican | 18:35 | |
| *** rcarrillocruz has joined #openstack-barbican | 18:40 | |
| openstackgerrit | Merged openstack/barbican: Enable functional tests to take a regex from tox https://review.openstack.org/146468 | 18:42 |
| *** dimtruck is now known as zz_dimtruck | 18:53 | |
| *** jorge_munoz_ has joined #openstack-barbican | 18:53 | |
| *** jorge_munoz has quit IRC | 18:54 | |
| *** jorge_munoz_ is now known as jorge_munoz | 18:54 | |
| *** zz_dimtruck is now known as dimtruck | 18:56 | |
| *** tkelsey has quit IRC | 19:02 | |
| *** hyakuhei has quit IRC | 19:03 | |
| *** gyee has joined #openstack-barbican | 19:10 | |
| *** lisaclark1 has joined #openstack-barbican | 19:12 | |
| *** kgriffs is now known as kgriffs|afk | 19:12 | |
| *** kgriffs|afk is now known as kgriffs | 19:13 | |
| *** lisaclark1 has quit IRC | 19:14 | |
| *** hyakuhei has joined #openstack-barbican | 19:22 | |
| *** hyakuhei has quit IRC | 19:23 | |
| *** ayoung-gym is now known as ayoung | 19:24 | |
| *** lisaclark1 has joined #openstack-barbican | 19:25 | |
| *** SheenaG1 has quit IRC | 19:25 | |
| *** SheenaG1 has joined #openstack-barbican | 19:28 | |
| *** hyakuhei has joined #openstack-barbican | 19:29 | |
| *** hyakuhei has quit IRC | 19:29 | |
| *** alee_lunch is now known as alee | 19:43 | |
| *** david-lyle has joined #openstack-barbican | 19:49 | |
| hockeynut | dstufft https://review.openstack.org/#/c/147160/ liked the latest recheck... | 19:53 |
| *** lisaclark1 has quit IRC | 20:01 | |
| *** jorge_munoz has quit IRC | 20:03 | |
| *** rellerreller has quit IRC | 20:07 | |
| jaosorior | hockeynut: answered your comment regarding this CR https://review.openstack.org/#/c/146467/ | 20:10 |
| *** kgriffs is now known as kgriffs|afk | 20:10 | |
| hockeynut | jaosorior thanks, +2'd it | 20:11 |
| jaosorior | yay :D | 20:11 |
| *** jorge_munoz has joined #openstack-barbican | 20:12 | |
| *** kgriffs|afk is now known as kgriffs | 20:13 | |
| elmiko | hey folks, i was poking around earlier but i think everyone was at lunch. i'm curious if anyone would talk me through some common use cases for barbican? | 20:14 |
| elmiko | i'm doing some research on how we can integrate barb usage in sahara | 20:14 |
| elmiko | i have a few ideas, but i think i might be doing things in a weird(read: non-standard) way | 20:14 |
| *** david-lyle has quit IRC | 20:15 | |
| redrobot | elmiko I guess the first use case we worked towards was storage of cryptographic keys. e.g. I need to do some crypto work, but instead of keeping the key in a local file I can fetch it from barbican. | 20:19 |
| elmiko | redrobot: ok, that makes sense from the docs. would you store the cleartext key? | 20:20 |
| redrobot | elmiko so rellerreller is working on this BP https://review.openstack.org/#/c/145073/ to solidify the exact formats for keys. as of now barbican just stores a binary blob and it's up to you to decide what format that will be. | 20:22 |
| elmiko | redrobot: ok, so if i wanted to encrypt a secret and store it in barbican, that would be proper? | 20:22 |
| redrobot | elmiko as long as it's something small, it should be ok. we have a (configurable) limit of 10K on a secret | 20:23 |
| redrobot | elmiko this is because we don't want to be a general storage service | 20:23 |
| elmiko | redrobot: yea, nothing huge just like a password or something | 20:23 |
| redrobot | elmiko ie, we dont want to be "encrypted swift" | 20:23 |
| elmiko | redrobot: gotcha | 20:23 |
| elmiko | redrobot: i'm a little confused about hitting the /secrets endpoints too, is it the case that i do not need an X-Auth-Token to hit these in a live environment? | 20:24 |
| redrobot | elmiko we have this Django app we've been working on for hack days called Stockade. It's a password management and sharing site (ie to share passwords in a team) that stores the PWs in Barbican https://github.com/cloudkeep/stockade | 20:25 |
| elmiko | redrobot: cool, i will check that out | 20:25 |
| redrobot | elmiko in a live environment we expect that barbican would be deployed alongside keystone, so you would need to auth with Keystone first, then use the token to talk to Barbican | 20:26 |
| elmiko | redrobot: ok, that makes sense | 20:26 |
| elmiko | redrobot: part of what i'm researching is the idea that our controller node could encrypt something using the public part of a key from the target, then store that ciphertext something in barbican, the target would then grab the something from barbican and us it's private key to decrypt. | 20:28 |
| elmiko | redrobot: but i had been playing with the local version of barb and using it without keystone auth... | 20:28 |
| elmiko | (which was actually making my job easier) | 20:29 |
| *** kebray has quit IRC | 20:29 | |
| redrobot | elmiko in that case I would think you'd want to store the private/public keys in Barbican. The ciphertext should be ok to store anywhere since it's encrypted. :) | 20:29 |
| elmiko | redrobot: yea, you can see some of my confusion | 20:30 |
| elmiko | redrobot: in this case though we would still need to have some credentials at our target for getting access to barbican. i feel like i'm stuck in a real chicken/egg situation | 20:30 |
| redrobot | elmiko hehe, yeah... key management is hard... a few folks have described it as just "moving the goalpost" | 20:32 |
| elmiko | redrobot: totally... | 20:32 |
| elmiko | redrobot: many thanks for talking that through with me, i've got much more to think about now =) | 20:33 |
| redrobot | elmiko in the case of swift, maybe they'd have a key per tenant, so they would need to manage thousands of keys, so it's easier to just manage the one set of keystone credentials and let Barbican worry about the individual keys. | 20:33 |
| redrobot | elmiko you're welcome! let me know if can help with anything else... | 20:34 |
| elmiko | redrobot: that's similar to what we are doing now. we create a proxy user then assign a trust to that user and distribute those credentials to our nodes. | 20:34 |
| elmiko | redrobot: but i'm still concerned about having the cleartext creds on the nodes, but i guess it might be unavoidable | 20:35 |
| elmiko | redrobot: i was trying to think of something slick where we could use pub/priv rsa keys from the nodes to encrypt a secret and allow the nodes to unencrypt. at least it wouldnt' be cleartext then. | 20:35 |
| elmiko | i'm trying to avoid the whole goalpost moving operation | 20:36 |
| redrobot | elmiko there's been a few ideas tossed around to address that issue. One that I find really interesting is a project that we're calling Postern. It's totall vaporware, but the idea is to have some sort of enrollment mechanism (I'm not 100% on how enrollment would work) but then the agent would run on the box and mount a virtual file system, so that an app can just read secrets as if they were files. | 20:38 |
| redrobot | elmiko https://github.com/cloudkeep/postern | 20:38 |
| elmiko | redrobot: interesting... | 20:38 |
| elmiko | lol, you weren't kidding about the vapor! | 20:38 |
| *** ayoung is now known as ayoung-afk | 20:39 | |
| redrobot | elmiko hehe yeah... there was a POC at one point... I think there's a YouTube video somewhere of jraim demoing it. | 20:40 |
| elmiko | redrobot: thanks again, back to the drawing board for me | 20:42 |
| *** ayoung-afk has quit IRC | 20:44 | |
| *** dimtruck is now known as zz_dimtruck | 20:46 | |
| *** paul_glass has quit IRC | 20:48 | |
| *** zz_dimtruck is now known as dimtruck | 20:52 | |
| rm_work | elmiko: also there will soon be an Interface (the Castellan project) to simplify key/cert management in Barbican | 20:59 |
| elmiko | rm_work: thanks, i've got that one starred. i haven't dug too deeply yet, is it possible to start playing around with it? | 21:01 |
| rm_work | elmiko: it should be easy to start playing around with Barbican in general (i take it you already have), but the interface is already in Cinder as "keymgr" and you could look at what that is doing | 21:01 |
| rm_work | as that is the basis for Castellan | 21:01 |
| rm_work | as well as the CertManager interface that is in stackforge/Octavia | 21:02 |
| elmiko | rm_work: awesome, thanks! | 21:04 |
| *** dimtruck is now known as zz_dimtruck | 21:05 | |
| rm_work | if you need i could probably provide links | 21:05 |
| rm_work | Octavia: https://github.com/stackforge/octavia/tree/master/octavia/certificates | 21:05 |
| rm_work | you'd be interested mostly in the stuff in common and manager | 21:06 |
| rm_work | generator is ... WIP | 21:06 |
| rm_work | (if you care about certs) | 21:06 |
| elmiko | ok, don't think i've ever seen this stuff before | 21:06 |
| *** lisaclark1 has joined #openstack-barbican | 21:06 | |
| rm_work | we're pretty bleeding-edge over here on the Octavia/LBaaS team :P | 21:06 |
| *** kebray has joined #openstack-barbican | 21:06 | |
| alee | rm_work, ping me when you've had a chance to re-read the latest per-secret bp | 21:06 |
| *** lisaclark1 has quit IRC | 21:06 | |
| rm_work | did it update? k | 21:06 |
| *** lisaclark1 has joined #openstack-barbican | 21:07 | |
| rm_work | err, it still has my -1 | 21:07 |
| alee | rm_work, sorry - let me rephrase -- I have not updated yet -- I'll get that by end of week (or so) | 21:07 |
| rm_work | ah | 21:07 |
| alee | but I think we can still discuss assigning work based on what is there | 21:07 |
| rm_work | yeah i'll look really quick | 21:07 |
| alee | its close enough as it is | 21:08 |
| *** kgriffs is now known as kgriffs|afk | 21:09 | |
| *** kgriffs|afk is now known as kgriffs | 21:15 | |
| *** chlong_ has joined #openstack-barbican | 21:21 | |
| *** SheenaG1 has quit IRC | 21:24 | |
| *** lisaclark1 has quit IRC | 21:31 | |
| *** ayoung has joined #openstack-barbican | 21:31 | |
| *** SheenaG1 has joined #openstack-barbican | 21:37 | |
| *** jorge_munoz has quit IRC | 21:45 | |
| *** david-lyle has joined #openstack-barbican | 21:46 | |
| *** kebray has quit IRC | 21:48 | |
| *** chlong_ has quit IRC | 21:50 | |
| *** jorge_munoz has joined #openstack-barbican | 21:52 | |
| *** zz_dimtruck is now known as dimtruck | 21:54 | |
| *** kebray has joined #openstack-barbican | 21:58 | |
| *** jorge_munoz has quit IRC | 21:59 | |
| *** jorge_munoz has joined #openstack-barbican | 22:00 | |
| *** gyee_ has joined #openstack-barbican | 22:02 | |
| *** gyee has quit IRC | 22:06 | |
| *** dimtruck is now known as zz_dimtruck | 22:11 | |
| openstackgerrit | Nathan Reller proposed openstack/barbican-specs: Content Types https://review.openstack.org/145073 | 22:13 |
| openstackgerrit | Nathan Reller proposed openstack/barbican-specs: Content Types https://review.openstack.org/145073 | 22:14 |
| *** jhfeng has joined #openstack-barbican | 22:19 | |
| *** ayoung has quit IRC | 22:20 | |
| *** rcarrillocruz has left #openstack-barbican | 22:21 | |
| jhfeng | Does Barbican only support SafeNet HSM ? | 22:22 |
| jhfeng | or only tested with SafeNet HSM ? | 22:22 |
| *** david-lyle has quit IRC | 22:27 | |
| *** ryanpetrello has quit IRC | 22:32 | |
| woodster_ | jhfeng: there is also KMIP plugin. We are actively working thru issues with the safe net plugin now | 22:35 |
| *** david-lyle has joined #openstack-barbican | 22:37 | |
| *** alee has quit IRC | 22:38 | |
| *** SheenaG1 has quit IRC | 22:38 | |
| jhfeng | woodster_: ok thanks. I want to use pkcs11 plugin directly if possible. and I'm having IBM HSM adapter | 22:39 |
| jhfeng | so my guess is noone has tested with IBM HSM yet | 22:40 |
| jhfeng | is there docuement on how to config ? in order to use HSM, , i mean safenet HSM | 22:41 |
| woodster_ | jhfeng: not yet but in theory it's just a matter of changing vendor constants I think, but reaperhulk is the expert on that stuff...he might be in the channel tomorrow or could send him an email too if need quicker answer | 22:43 |
| *** openstack has joined #openstack-barbican | 23:01 | |
| *** ryanpetrello has joined #openstack-barbican | 23:06 | |
| *** mordred has joined #openstack-barbican | 23:06 | |
| *** morganfainberg has joined #openstack-barbican | 23:06 | |
| *** david-lyle has joined #openstack-barbican | 23:06 | |
| *** Guest49876 has joined #openstack-barbican | 23:06 | |
| *** samueldmq has joined #openstack-barbican | 23:06 | |
| *** kebray_ has joined #openstack-barbican | 23:06 | |
| *** jhfeng has joined #openstack-barbican | 23:06 | |
| *** jaosorior has joined #openstack-barbican | 23:06 | |
| *** miqui_ has joined #openstack-barbican | 23:06 | |
| *** darrenmoffat has joined #openstack-barbican | 23:06 | |
| *** woodster_ has joined #openstack-barbican | 23:06 | |
| *** jraim has joined #openstack-barbican | 23:06 | |
| *** rm_you has joined #openstack-barbican | 23:06 | |
| *** dstanek has joined #openstack-barbican | 23:06 | |
| *** hockeynut has joined #openstack-barbican | 23:06 | |
| *** insequent has joined #openstack-barbican | 23:06 | |
| *** lisaclark has joined #openstack-barbican | 23:06 | |
| *** chellygel has joined #openstack-barbican | 23:06 | |
| *** jillysciarilly has joined #openstack-barbican | 23:06 | |
| *** openstackgerrit has joined #openstack-barbican | 23:06 | |
| *** anteaya has joined #openstack-barbican | 23:06 | |
| *** dstufft has joined #openstack-barbican | 23:06 | |
| *** greghaynes has joined #openstack-barbican | 23:06 | |
| *** toabctl has joined #openstack-barbican | 23:06 | |
| *** erw has joined #openstack-barbican | 23:07 | |
| *** openstackgerrit has quit IRC | 23:07 | |
| *** elmiko has joined #openstack-barbican | 23:08 | |
| *** ametts has joined #openstack-barbican | 23:08 | |
| *** lbragstad has quit IRC | 23:09 | |
| *** kgriffs|afk is now known as kgriffs | 23:09 | |
| *** lbragstad has joined #openstack-barbican | 23:11 | |
| *** reaperhulk has joined #openstack-barbican | 23:12 | |
| *** codekobe has joined #openstack-barbican | 23:12 | |
| *** jkf has joined #openstack-barbican | 23:12 | |
| *** nkinder_away has joined #openstack-barbican | 23:12 | |
| *** redrobot has joined #openstack-barbican | 23:12 | |
| *** openstackgerrit has joined #openstack-barbican | 23:13 | |
| *** ayoung has joined #openstack-barbican | 23:13 | |
| *** jkf has quit IRC | 23:14 | |
| *** redrobot is now known as Guest29310 | 23:14 | |
| *** alpha_ori has joined #openstack-barbican | 23:15 | |
| *** crc32 has joined #openstack-barbican | 23:16 | |
| woodster_ | jhfeng: Paul's email is paul.kehrer@rackspace.com | 23:21 |
| *** ryanpetrello has quit IRC | 23:22 | |
| *** dougwig has joined #openstack-barbican | 23:23 | |
| woodster_ | jhfeng: Nate's email (for info on KMIP) is Nathan.Reller@jhuapl.edu | 23:24 |
| *** david-lyle has quit IRC | 23:24 | |
| *** erw has quit IRC | 23:28 | |
| *** erw has joined #openstack-barbican | 23:28 | |
| *** dougwig has quit IRC | 23:31 | |
| *** dougwig has joined #openstack-barbican | 23:31 | |
| *** alee has joined #openstack-barbican | 23:31 | |
| *** jaosorior has quit IRC | 23:33 | |
| *** ametts has quit IRC | 23:40 | |
| *** chlong has joined #openstack-barbican | 23:40 | |
| *** miqui_ has quit IRC | 23:52 | |
| *** crc32 has quit IRC | 23:54 | |
| *** jhfeng has quit IRC | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!