| *** kebray has joined #openstack-barbican | 00:09 | |
| *** chlong has joined #openstack-barbican | 00:10 | |
| *** vivek-ebay has quit IRC | 00:21 | |
| *** vivek-ebay has joined #openstack-barbican | 00:24 | |
| *** vivek-ebay has quit IRC | 00:36 | |
| *** everjeje has quit IRC | 00:52 | |
| *** chlong has quit IRC | 01:02 | |
| *** openstackgerrit has quit IRC | 01:16 | |
| *** openstackgerrit has joined #openstack-barbican | 01:16 | |
| *** vivek-ebay has joined #openstack-barbican | 01:36 | |
| *** vivek-ebay has quit IRC | 01:41 | |
| *** chlong has joined #openstack-barbican | 01:53 | |
| *** jamielennox|away is now known as jamielennox | 02:14 | |
| *** yuanying has quit IRC | 02:34 | |
| *** yuanying has joined #openstack-barbican | 02:37 | |
| *** Nirupama has joined #openstack-barbican | 02:44 | |
| *** kebray has quit IRC | 02:49 | |
| *** dave-mccowan has quit IRC | 02:52 | |
| *** vivek-ebay has joined #openstack-barbican | 02:52 | |
| *** dimtruck has quit IRC | 03:23 | |
| *** ryanpetrello has quit IRC | 03:24 | |
| *** eglute has quit IRC | 03:25 | |
| *** ryanpetrello has joined #openstack-barbican | 03:29 | |
| *** eglute has joined #openstack-barbican | 03:29 | |
| *** zz_dimtruck has joined #openstack-barbican | 03:30 | |
| *** zz_dimtruck is now known as dimtruck | 03:30 | |
| *** edtubill has joined #openstack-barbican | 03:42 | |
| *** vivek-ebay has quit IRC | 03:45 | |
| *** chlong has quit IRC | 04:02 | |
| *** chlong has joined #openstack-barbican | 05:04 | |
| *** edtubill has quit IRC | 05:27 | |
| *** chlong has quit IRC | 05:30 | |
| *** chlong has joined #openstack-barbican | 05:45 | |
| *** chlong has quit IRC | 06:06 | |
| *** chlong has joined #openstack-barbican | 06:09 | |
| *** chlong has quit IRC | 06:11 | |
| *** chlong has joined #openstack-barbican | 06:11 | |
| *** jaosorior has joined #openstack-barbican | 06:21 | |
| *** shohel has joined #openstack-barbican | 06:27 | |
| *** Kevin_Zheng has joined #openstack-barbican | 06:43 | |
| *** chlong has quit IRC | 07:53 | |
| *** shohel has quit IRC | 08:04 | |
| *** shohel1 has joined #openstack-barbican | 08:04 | |
| *** everjeje has joined #openstack-barbican | 08:05 | |
| *** jaosorior has quit IRC | 08:15 | |
| *** darrenmoffat has joined #openstack-barbican | 08:36 | |
| *** mmdurrant has quit IRC | 10:08 | |
| *** shohel1 has quit IRC | 10:11 | |
| *** shohel has joined #openstack-barbican | 10:11 | |
| *** openstackgerrit has quit IRC | 10:16 | |
| *** openstackgerrit has joined #openstack-barbican | 10:16 | |
| *** peter-hamilton has joined #openstack-barbican | 11:00 | |
| *** chlong has joined #openstack-barbican | 11:01 | |
| *** shohel has quit IRC | 11:04 | |
| *** dave-mccowan has joined #openstack-barbican | 11:36 | |
| *** chlong_ has joined #openstack-barbican | 11:44 | |
| *** shohel has joined #openstack-barbican | 11:46 | |
| *** chlong_ has quit IRC | 11:48 | |
| *** shohel has quit IRC | 11:53 | |
| *** shohel1 has joined #openstack-barbican | 11:53 | |
| *** Nirupama has quit IRC | 11:57 | |
| *** mmdurrant has joined #openstack-barbican | 11:58 | |
| *** openstackgerrit has quit IRC | 12:16 | |
| *** openstackgerrit has joined #openstack-barbican | 12:16 | |
| *** jaosorior has joined #openstack-barbican | 12:41 | |
| *** codekobe has quit IRC | 12:52 | |
| *** codekobe has joined #openstack-barbican | 12:53 | |
| *** Kevin_Zheng has quit IRC | 12:53 | |
| *** Kevin_Zheng has joined #openstack-barbican | 12:53 | |
| *** SheenaG has joined #openstack-barbican | 13:06 | |
| *** SheenaG has left #openstack-barbican | 13:06 | |
| *** openstackgerrit has quit IRC | 13:16 | |
| *** openstackgerrit has joined #openstack-barbican | 13:16 | |
| *** spotz_zzz is now known as spotz | 14:05 | |
| *** nelsnelson has joined #openstack-barbican | 14:16 | |
| *** kfarr has joined #openstack-barbican | 14:17 | |
| *** david-lyle has quit IRC | 14:19 | |
| *** peter-hamilton has quit IRC | 14:19 | |
| *** edtubill has joined #openstack-barbican | 14:22 | |
| *** jorge_munoz has joined #openstack-barbican | 14:27 | |
| *** silos has joined #openstack-barbican | 14:30 | |
| *** rellerreller has joined #openstack-barbican | 14:36 | |
| openstackgerrit | Ade Lee proposed openstack/barbican: Add DELETE functionality for subCAs https://review.openstack.org/222474 | 14:59 |
|---|---|---|
| *** alee_afk is now known as alee | 14:59 | |
| alee | jaosorior, dave-mccowan , kfarr - resubmitted latest subca patch | 15:00 |
| alee | with comments addressed. Please review ^^ | 15:00 |
| *** peter-hamilton has joined #openstack-barbican | 15:00 | |
| dave-mccowan | alee looking. | 15:00 |
| alee | dave-mccowan, thanks! | 15:00 |
| dave-mccowan | alee is there much left on the subca to-do list? | 15:01 |
| alee | dave-mccowan, just a couple of things -- are you interested in doing something ? :) | 15:01 |
| *** xaeth_afk is now known as xaeth | 15:01 | |
| dave-mccowan | coding barbican is usually more interesting than my day job.... | 15:02 |
| alee | dave-mccowan, sure - It would be great to get the help .. let me think. | 15:02 |
| alee | dave-mccowan, after this patch, jaosorior had a patch in which he created a new decorator for the tests -- I was planning on taking that over and rebasing on top of my patch. | 15:03 |
| jaosorior | alee: Checking out your patch | 15:03 |
| alee | dave-mccowan, then there needs to be a check to confirm that any cert requests that go to a subca only succeed if the project owns the subca | 15:04 |
| alee | jaosorior, thanks | 15:04 |
| jaosorior | alee: So you're gonna take over my patch and fix the issue in the project-CAs? | 15:04 |
| *** shohel1 has quit IRC | 15:05 | |
| alee | dave-mccowan, and there is a need to make intermediates work correctly in snakeoil ca | 15:05 |
| alee | those are the last three items | 15:05 |
| alee | jaosorior, was planning to -- unless you want to keep it and shepherd it through | 15:05 |
| jaosorior | alee: I don't think I'll have time for the next couple of days. I have a lot to do with the installer work | 15:06 |
| *** david-lyle has joined #openstack-barbican | 15:06 | |
| alee | jaosorior, yup - thats what I figured | 15:06 |
| dave-mccowan | alee what about "priming the pump" at initialization, instead of at first POST? | 15:06 |
| alee | dave-mccowan, oh yeah - If you could look into that - that would be great | 15:06 |
| jaosorior | alee: The patch LGTM; Gotta see if it passes the gate then I'll score | 15:07 |
| jaosorior | let me know when it does | 15:07 |
| alee | jaosorior, cool thanks - will do | 15:07 |
| alee | dave-mccowan, let me know which you decide to take on | 15:08 |
| dave-mccowan | alee i can look at pump priming today. did you have any ideas on how to solve that one? | 15:09 |
| alee | dave-mccowan, haven't thought about it too much but its ok to have the current code that refreshes the ca table where it is. The main problem is simply to figure out a way to call that same function sometime on startup too. | 15:10 |
| alee | ie. on startup - iterate through ca plugins and call the refresh() function | 15:11 |
| alee | dave-mccowan, I don't know exactly where startup code resides here | 15:11 |
| *** silos has quit IRC | 15:11 | |
| *** silos has joined #openstack-barbican | 15:12 | |
| jaosorior | alee: The startup of what? | 15:12 |
| alee | jaosorior, startup of the server / application I guess .. | 15:13 |
| alee | maybe the /cas controller? | 15:13 |
| jaosorior | alee, dave-mccowan: You want to look at the barbican.api.app module | 15:14 |
| *** silos has left #openstack-barbican | 15:14 | |
| *** edtubill has quit IRC | 15:14 | |
| jaosorior | alee, dave-mccowan: Also, the controllers are initiated in the barbican.api.controllers.versions module | 15:14 |
| dave-mccowan | jaosorior so it's cool to add extra (non-controller) init code to api/app.py? | 15:16 |
| *** silos1 has joined #openstack-barbican | 15:16 | |
| jaosorior | dave-mccowan: Well, barbican.api.app is actually where we initiate the database | 15:16 |
| *** nkinder has joined #openstack-barbican | 15:17 | |
| jaosorior | I see no problem with initiating some plugins there too | 15:17 |
| dave-mccowan | jaosorior. cool, that looks straightforward. | 15:19 |
| jaosorior | dave-mccowan: No prob | 15:19 |
| dave-mccowan | alee does kilo have the same issue? should i plan to back port it? | 15:20 |
| alee | dave-mccowan, yes it does | 15:20 |
| alee | dave-mccowan, and thats not a bad idea | 15:21 |
| dave-mccowan | alee ok. i'll open a bug (if i can't find one already open) and submit patches for both branches. | 15:22 |
| alee | dave-mccowan, cool thanks! | 15:22 |
| dave-mccowan | alee your new patch LGTM. i'll join ozz on gate-watch. :-) | 15:23 |
| alee | :) | 15:25 |
| *** ccneill has joined #openstack-barbican | 15:27 | |
| *** DTadrzak has quit IRC | 15:28 | |
| *** woodster_ has joined #openstack-barbican | 15:33 | |
| *** diazjf has joined #openstack-barbican | 15:35 | |
| *** edtubill has joined #openstack-barbican | 15:45 | |
| *** kebray has joined #openstack-barbican | 15:53 | |
| openstackgerrit | Elvin Tubillara proposed openstack/barbican: WIP Add filter to secret list for acl secrets https://review.openstack.org/222328 | 15:57 |
| openstackgerrit | Fernando Diaz proposed openstack/barbican: Use testr for running functional tests and documentation https://review.openstack.org/218117 | 15:59 |
| *** openstackgerrit has quit IRC | 16:01 | |
| *** openstackgerrit has joined #openstack-barbican | 16:01 | |
| hockeynut | diazjf howdy - on that case sensitive thing I was just concerned that someone might set the env var to "true" which would fail the comparison | 16:03 |
| *** kebray has quit IRC | 16:07 | |
| openstackgerrit | Kaitlin Farr proposed openstack/castellan: Standardize Barbican error messages https://review.openstack.org/223204 | 16:09 |
| *** kfarr has quit IRC | 16:10 | |
| *** gyee has joined #openstack-barbican | 16:24 | |
| alee | dave-mccowan, jaosorior , peter-hamilton thanks for review | 16:25 |
| alee | jaosorior, interesting question about project cas | 16:25 |
| alee | jaosorior, so you had added a test which basically says that if I add a project ca, then if I list cas, then only the project ca should show up. | 16:26 |
| alee | then if I remove the project ca, the all the cas show up. | 16:26 |
| jaosorior | alee: Yup | 16:27 |
| jaosorior | That's what I was assuming in the test | 16:27 |
| alee | but this makes using project cas difficult, because if I wanted to add multiple project cas, how would I know what other cas are there to add? | 16:27 |
| alee | jaosorior, I suppose we could do something like this -- we return all cas if the user is a project admin , and only the project cas if the user is a non-project admin | 16:29 |
| jaosorior | alee: That's true; uhm... might have done the wrong assumption then. I'm guessing then there should be a way to list the CAs that are set for the project. Just didn't see a controler doing that | 16:29 |
| jaosorior | alee: That sounds like a better approach | 16:29 |
| alee | jaosorior, well -- I think you can list the project cas but that might be limited to admins --checking .. | 16:30 |
| alee | jaosorior, you're right - there is no method to list project cas | 16:32 |
| jaosorior | alee: So, I suggest normal users should have a limited scope when trying to list CAs | 16:33 |
| jaosorior | and admins should see them all; And filtering should be possible for the admin to know which CAs have already been assigned to a project | 16:33 |
| alee | jaosorior, something like GET /cas/project-cas=True ? | 16:35 |
| alee | jaosorior, this would be used by the admin to just select project-cas if any are defined .. | 16:36 |
| jaosorior | Could be that, or GET /cas?project-cas=True | 16:36 |
| alee | jaosorior, sorry - thats what I meant to say | 16:36 |
| jaosorior | yeah, something like that could be possible | 16:36 |
| *** silos1 has left #openstack-barbican | 16:37 | |
| alee | ok | 16:37 |
| jaosorior | the other option could be something such as | 16:37 |
| jaosorior | GET /cas/project-cas | 16:37 |
| alee | right | 16:37 |
| dave-mccowan | +1 for a project admin who can "add-to-project" and "remove-from-project", there should be a way for him to list | 16:37 |
| alee | dave-mccowan, you have a preference for either of the methods above ? | 16:38 |
| jaosorior | dave-mccowan: | 16:38 |
| alee | GET /cas/project-cas or GET /cas?project-cas=True | 16:39 |
| jaosorior | alee, dave-mccowan: Here the thing is that if we add the resource /cas/project-cas then that resource potentially is also available to the non-admin uers | 16:39 |
| jaosorior | *users | 16:39 |
| dave-mccowan | i think GET /cas/project-cas matches the current api better | 16:39 |
| jaosorior | so then we would have two calls | 16:39 |
| alee | jaosorior, well we would set the acl to project-admins only | 16:40 |
| jaosorior | For an admin GET /cas/ would list all the CAs available, while get /cas/project-cas would list the ones that have been assigned to the project. | 16:40 |
| jaosorior | Confusion comes for a non-admin user | 16:40 |
| jaosorior | True | 16:40 |
| jaosorior | but to be honest, I would suggest using the filter | 16:40 |
| jaosorior | since that way we wouldn't need to add another rule in the policy | 16:41 |
| jaosorior | but, of course, if you guys think adding the separate resource is the best solution, then that's fine | 16:41 |
| alee | its a tough choice -- I see arguments both ways | 16:43 |
| diazjf | thanks hockeynut, gotcha. I was thinking it was the env variable. I'll change it in a few mins | 16:44 |
| alee | dave-mccowan, jaosorior I do think a separate resource would match the current api better | 16:44 |
| openstackgerrit | Fernando Diaz proposed openstack/barbican: Remove .pyc files before performing functional tests https://review.openstack.org/223219 | 16:45 |
| dave-mccowan | the behavior for any call should not change depending on caller's permissions. even if your a service-admin, there should be no confusion if you're asking for "my cas" or "my cloud's cas". i think the separate resource helps with that too. | 16:45 |
| jaosorior | alee: I'm trying to look at it from the sysadmin's side. Since another resource to have in mind when tweaking policy files is not so nice | 16:45 |
| jaosorior | dave-mccowan: Shouldn't it? I think admins should have the ability to view more resources than the regular folk | 16:46 |
| alee | dave-mccowan, I thought that we are still talking about limiting non-admin users GET /cas to just project cas? | 16:47 |
| alee | and having admins get all cas .. | 16:48 |
| *** silos1 has joined #openstack-barbican | 16:48 | |
| *** silos1 has left #openstack-barbican | 16:48 | |
| alee | jaosorior, dave-mccowan so while I think having a separate resource matches the api a bit more and may be easier to use - using a filter would highlight the differences in data returned with GET /cas for different roles more | 16:51 |
| jaosorior | I'm not even sure if it would be easier to ues | 16:51 |
| jaosorior | * use | 16:51 |
| jaosorior | in the end, related to the model, we are still talking about the same resource, which is a CA | 16:52 |
| jaosorior | only thing is that if it belongs to a project, it has an extra attribute. | 16:52 |
| jaosorior | Now my question is, how can we differentiate when displaying project CAs, and displaying subCAs, since those two "subclasses" of CAs have very similar attribute | 16:53 |
| jaosorior | *attributes | 16:53 |
| * redrobot pokes head in | 16:53 | |
| redrobot | totally jumping in the middle of this, but I tend to agree with dave-mccowan that service-admin users should have their own endpoints for managment tasks | 16:54 |
| jaosorior | redrobot: Although, here more than a management task, is about displaying CAs that meet certain criteria. So more than a management task, it's actually a matter of filtering, IMO | 16:55 |
| openstackgerrit | Merged openstack/barbican: Add DELETE functionality for subCAs https://review.openstack.org/222474 | 16:55 |
| alee | woohoo! | 16:55 |
| alee | jaosorior, redrobot , dave-mccowan - so here are the requirements .. | 16:56 |
| dave-mccowan | would an etherpad give us more bandwidth to sort this out? | 16:56 |
| alee | dave-mccowan, yeah | 16:56 |
| openstackgerrit | Fernando Diaz proposed openstack/barbican: Use testr for running functional tests and documentation https://review.openstack.org/218117 | 16:56 |
| alee | dave-mccowan, jaosorior , redrobot https://etherpad.openstack.org/p/project-cas -- still blank right now , but I'm adding .. | 16:57 |
| jaosorior | alee: I suggest you add some explanation about project CAs, and subCAs, since that will come also into the picture | 16:58 |
| alee | jaosorior, ok | 16:58 |
| openstackgerrit | Fernando Diaz proposed openstack/barbican: Remove .pyc files before performing functional tests https://review.openstack.org/223219 | 17:03 |
| jaosorior | Gonna have some dinner, I'll be back in a bit | 17:05 |
| *** peter-hamilton has quit IRC | 17:06 | |
| alee | redrobot, jaosorior , dave-mccowan put in stuff - please add as makes sense | 17:14 |
| alee | I'm incling more towards filters .. | 17:14 |
| alee | dave-mccowan, redrobot is that you editing? | 17:15 |
| jaosorior | food is in the making :P . But I do think filters actually will make sysadmin's lives easier and also make sense in the way that, what really differentiates projectCAs from normal CAs is just one attribute | 17:15 |
| jaosorior | alee: It was me, I also added one question in the etherpad chat | 17:16 |
| alee | jaosorior, right I put that under the admins .. | 17:16 |
| openstackgerrit | Jason Fritcher proposed openstack/barbican-specs: Blueprint defining healthcheck API endpoint. https://review.openstack.org/207317 | 17:16 |
| alee | jaosorior, 2.d | 17:17 |
| alee | elmiko, ping | 17:28 |
| *** everjeje has quit IRC | 17:42 | |
| openstackgerrit | Fernando Diaz proposed openstack/python-barbicanclient: Change tox to use testr for functional tests https://review.openstack.org/219124 | 17:59 |
| alee | jaosorior, dave-mccowan you guys need to select more distinct colors :) | 18:01 |
| jaosorior | Done | 18:02 |
| alee | well thats distinct :) | 18:02 |
| jaosorior | hahaha indeed | 18:02 |
| jaosorior | looks horrible, but it works | 18:02 |
| alee | I feel like the teacher just graded my assignment .. | 18:03 |
| *** rellerreller has quit IRC | 18:07 | |
| elmiko | alee: hey | 18:09 |
| alee | jaosorior, dave-mccowan what about the all-cas option? | 18:09 |
| alee | elmiko, can you look at https://etherpad.openstack.org/p/project-cas | 18:09 |
| alee | elmiko, and see what you suggest. | 18:09 |
| elmiko | alee: sure thing | 18:10 |
| dave-mccowan | alee that works for me for function-wise. i can't say i love the naming of resources, but can live with it. | 18:13 |
| *** silos1 has joined #openstack-barbican | 18:14 | |
| *** openstackgerrit has quit IRC | 18:16 | |
| *** openstackgerrit has joined #openstack-barbican | 18:16 | |
| elmiko | alee: looking at the pad, i could use some help understanding. if i do a `GET /cas` is there a reason why that should be different for average Joe and admin. why doesn't it just return whatever cas they can see in their project? | 18:20 |
| elmiko | i like the simpler approach of `GET /cas` returning whatever you can see, then using filters to a pair it down | 18:21 |
| alee | elmiko, the idea is that if the admin user created some project cas., then users would not be able to submit requests to any ca other than those project cas | 18:22 |
| alee | (or subcas) | 18:22 |
| alee | elmiko, so for Joe User to see a bunch of cas available that he could not send requests to is confusing | 18:23 |
| elmiko | yea definitely | 18:23 |
| alee | elmiko, so joe users view should be constrained | 18:23 |
| elmiko | agreed | 18:23 |
| alee | elmiko, but if the admins view is also constrained, then he cannot see other cas to make into project cas | 18:23 |
| elmiko | is there a reason it can't be restrained based on the identity from the credentials provided during a `GET /cas` call? | 18:23 |
| jaosorior | I still think the filtered approach if actually more useful, since from the start you are already basing the result on access control | 18:24 |
| elmiko | jaosorior: +1, in general i like the filtering approach. i'm just trying to understand the problem a little more fully | 18:25 |
| alee | elmiko, dave-mccowan , jaosorior - the original idea was to let admin see everything it could - and to constrain using filters. | 18:25 |
| jaosorior | the barbican meeting is in 1.5 hours, right? | 18:25 |
| rm_work | I believe so | 18:25 |
| dave-mccowan | elmiko we wanted constraints between user and admin to be defined and enforce based on the policy.json file, not hard coded in python. | 18:25 |
| jaosorior | excellent | 18:25 |
| elmiko | dave-mccowan: ahh, ok. that makes sense | 18:26 |
| dave-mccowan | elmiko that's why we wanted separate resources for GET /v1/cas (all user access) and GET /v1/all-cas (admin only access) | 18:26 |
| alee | elmiko, and hence the idea of having a separate endpoint for admins to get to | 18:26 |
| elmiko | seems like having a /cas and /cas/all, or something similar, and allowing filters on those endpoints sounds reasonable to me | 18:27 |
| elmiko | yup, all sounds very rational | 18:27 |
| alee | dave-mccowan, I still like GET /cas/all-cas instead of GET /all-cas | 18:27 |
| *** everjeje has joined #openstack-barbican | 18:27 | |
| dave-mccowan | alee yea... that's a perpetual typo. i want the root to always be /cas/ | 18:28 |
| alee | elmiko, but yeah - thats the gist of the issue | 18:28 |
| *** david-lyle has quit IRC | 18:29 | |
| dave-mccowan | alee what do you think about /v1/cas/all instead of /v1/cas/all-cas, like elmiko said above? | 18:29 |
| alee | elmiko, so based on that - you're in favor of the approach in line 39-45? | 18:29 |
| alee | yeah all instead of all-cas | 18:29 |
| elmiko | alee: yea, | 18:29 |
| elmiko | "option 1" as it were, sounds reasonable to me | 18:30 |
| alee | elmiko, actually thats option 0? right? | 18:32 |
| elmiko | alee: oh yea. sorry | 18:32 |
| alee | elmiko, dave-mccowan jaosorior we still need an endpoint for service admins to list all cas independant of project | 18:34 |
| elmiko | alee: is that different than an admin listing them all? | 18:34 |
| dave-mccowan | alee is that what GET /v1/cas/projects does? | 18:35 |
| alee | elmiko, yes when we say admin , we mean project admin , which means restricted to just whats available to a porject to use | 18:36 |
| dave-mccowan | elmiko we have project-admins who have admin role over one project, and service-admin users that can affect cross-project resources. | 18:36 |
| alee | elmiko, service admin means all cas for all projects | 18:36 |
| alee | dave-mccowan, no -- let me see .. | 18:37 |
| alee | dave-mccowan, GET /cas/foo/projects is defined | 18:37 |
| alee | it says give me all the projects that have been associated with a given ca | 18:38 |
| alee | rather than give me all cas independent of project | 18:38 |
| dave-mccowan | alee does a service-admin need access to all info? for the quotas feature, the service-admin is not a super-admin, he just has the ability to set the defaults. | 18:38 |
| alee | dave-mccowan, I'm ok with deferring that capability until we know its needed | 18:38 |
| alee | dave-mccowan, I think you brought it up :) | 18:39 |
| elmiko | alee: ok, thanks for the breakdown. if the goal is to use the endpoint acls to limit these calls then you just need endpoints for the user, the project admin, and a service admin. is that accurate? | 18:39 |
| alee | right | 18:41 |
| elmiko | so like, /cas /cas/all /cas/project ? | 18:41 |
| alee | elmiko, the original thought was to use filters on a single endpoint (GET /cas) but then that results in policy being written in code instead of policy.json | 18:42 |
| elmiko | and like the rest of barbican, project is in the headers | 18:42 |
| alee | and I think we need /cas (for regular user and admin) /cas/all | 18:42 |
| elmiko | alee: yea, got that. i don't think the api-wg has guidance related to this, but separate endpoints doesn't seem unreasnable given the explanation. | 18:42 |
| alee | for service user - I'm not sure we need that right now. | 18:43 |
| alee | but if we did it might be .,. | 18:43 |
| elmiko | well, wouldn't /cas/all denote the service user, whereas /cas/project denotes the project admin? | 18:43 |
| alee | GET /cas/all-projects | 18:43 |
| elmiko | ah, ok | 18:43 |
| alee | elmiko, dave-mccowan , jaosorior , redrobot -ok thanks looks like we have consensus | 18:45 |
| alee | Option 0 it is then. | 18:45 |
| dave-mccowan | alee ship it! | 18:46 |
| elmiko | hehe, np alee, glad to help out =) | 18:47 |
| dave-mccowan | alee what happens if i remove-from-project the preferred CA, assuming i have a second project CA? | 18:49 |
| alee | dave-mccowan, that one should become preferred-CA | 18:50 |
| *** rellerreller has joined #openstack-barbican | 18:50 | |
| alee | dave-mccowan, looking to see what the code actually does now :) | 18:51 |
| alee | dave-mccowan, actually it doesn't seem to do that :/ | 18:53 |
| alee | dave-mccowan, I suppose we should do something like this -- if more than one project ca, then fail (409 conflict) | 18:54 |
| alee | after all we may not be able to figure out which one to transfer preferrred-ness to | 18:55 |
| dave-mccowan | alee we have the create-date timestamp. if the first one is defaulted to first-in, we should go FIFO. if the user never set a preferred, he may not even be aware of preferredness. | 18:57 |
| *** kebray has joined #openstack-barbican | 19:01 | |
| *** xaeth is now known as xaeth_afk | 19:04 | |
| *** SheenaG has joined #openstack-barbican | 19:12 | |
| *** lisaclark1 has joined #openstack-barbican | 19:13 | |
| jaosorior | alee: what was the consensus? | 19:13 |
| *** kebray has quit IRC | 19:20 | |
| alee | jaosorior, Option 0 | 19:22 |
| alee | jaosorior, line 39 | 19:22 |
| jaosorior | Well, if everybody agrees it's the right way to go, then sure | 19:23 |
| jaosorior | who will implement it? | 19:23 |
| alee | well thats me unless someone else steps up | 19:23 |
| alee | jaosorior, I'm trying to run your patch and for some reason its not even trying to run/skip any of the tests annotated by your new annotation | 19:26 |
| alee | like it doesn't even knwo they are tests .. | 19:26 |
| alee | jaosorior, are you sure your decorator was working? | 19:29 |
| jaosorior | alee: Well, the gate seems to be running the tests http://logs.openstack.org/83/222583/5/check/gate-barbican-devstack-dsvm/da086ba/console.html.gz#_2015-09-11_15_27_27_949 | 19:30 |
| alee | jaosorior, so it does .. | 19:31 |
| alee | jaosorior, maybe its a merging thing .. looking | 19:31 |
| *** david-lyle has joined #openstack-barbican | 19:34 | |
| *** SheenaG has left #openstack-barbican | 19:48 | |
| openstackgerrit | Elvin Tubillara proposed openstack/barbican: Add filter to secret list for acl secrets https://review.openstack.org/222328 | 19:49 |
| *** vivek-ebay has joined #openstack-barbican | 19:52 | |
| *** kfarr has joined #openstack-barbican | 19:56 | |
| redrobot | Weekly meeting is starting now on #openstack-meeting-alt | 20:00 |
| *** vivek-ebay has quit IRC | 20:02 | |
| alee | jaosorior, its weird -- on my local setup its not finding any of the tests annotated by the annotation - and its also running functionaltests.api.v1.functional.test_cas.ProjectCATestCase.send_test_order .. | 20:03 |
| jaosorior | whaaat... | 20:04 |
| jaosorior | that's weird... | 20:04 |
| alee | which is obviously not of the form test_... | 20:04 |
| alee | yeah .. | 20:04 |
| jaosorior | alee: Although, I'm not sure if the gate is running the tests differently than you do in tox | 20:04 |
| alee | jaosorior, did you try running locally in tox? | 20:05 |
| jaosorior | alee: no, I was rellying on the gate. And I believe tox is using nose as opposed to the gate which is using testr | 20:06 |
| jaosorior | alee: It's what diazjf is trying to address in some of his CRs | 20:06 |
| jaosorior | alee: https://review.openstack.org/#/c/218117/ | 20:06 |
| jaosorior | which I will merge now | 20:06 |
| alee | jaosorior, so with that merge, we'll be using testr in tox? | 20:07 |
| jaosorior | alee: Yup | 20:07 |
| diazjf | jaosorior, alee, awesome!! | 20:07 |
| alee | jaosorior, how do you run a single test using testr? | 20:07 |
| alee | diazjf, ^^ | 20:08 |
| alee | or a single test suite? | 20:08 |
| diazjf | alee, downlaod my patch above | 20:08 |
| diazjf | You can specify it after tox -e functional | 20:08 |
| diazjf | see https://review.openstack.org/#/c/218117/27/doc/source/testing.rst | 20:08 |
| alee | cool - I'll try it | 20:09 |
| *** peter-hamilton has joined #openstack-barbican | 20:10 | |
| diazjf | alee, let me know :) | 20:15 |
| *** jaosorior has quit IRC | 20:18 | |
| *** vivek-ebay has joined #openstack-barbican | 20:30 | |
| *** openstackgerrit has quit IRC | 20:31 | |
| *** openstackgerrit has joined #openstack-barbican | 20:31 | |
| *** vivek-ebay has quit IRC | 20:34 | |
| *** pglbutt has joined #openstack-barbican | 20:34 | |
| *** pglbutt has quit IRC | 20:38 | |
| openstackgerrit | Merged openstack/barbican: Use testr for running functional tests and documentation https://review.openstack.org/218117 | 20:46 |
| *** rellerreller has quit IRC | 21:07 | |
| redrobot | dave-mccowan can you check to see if you're able to +2 ? | 21:08 |
| dave-mccowan | redrobot yep. i am. yikes! | 21:09 |
| redrobot | dave-mccowan remember, with great power comes great responsibility. ;) | 21:09 |
| *** kebray has joined #openstack-barbican | 21:11 | |
| alee | dave-mccowan, yay! | 21:26 |
| *** vivek-ebay has joined #openstack-barbican | 21:28 | |
| peter-hamilton | dave-mccowan: congrats! | 21:31 |
| *** pglbutt has joined #openstack-barbican | 21:33 | |
| *** pglbutt has quit IRC | 21:33 | |
| rm_work | redrobot: you around? | 21:35 |
| redrobot | rm o/ | 21:35 |
| rm_work | redrobot: PM | 21:35 |
| *** lisaclark1 has quit IRC | 21:40 | |
| *** vivek-eb_ has joined #openstack-barbican | 21:43 | |
| *** silos1 has left #openstack-barbican | 21:44 | |
| *** vivek-ebay has quit IRC | 21:44 | |
| *** openstackgerrit has quit IRC | 21:46 | |
| *** openstackgerrit has joined #openstack-barbican | 21:46 | |
| *** vivek-eb_ has quit IRC | 21:48 | |
| *** lisaclark1 has joined #openstack-barbican | 22:02 | |
| *** diazjf has left #openstack-barbican | 22:13 | |
| *** dave-mccowan has quit IRC | 22:14 | |
| *** edtubill has quit IRC | 22:14 | |
| *** peter-hamilton has quit IRC | 22:14 | |
| *** nelsnelson has quit IRC | 22:15 | |
| *** kfarr has quit IRC | 22:17 | |
| *** lisaclark1 has quit IRC | 22:26 | |
| *** lisaclark1 has joined #openstack-barbican | 22:26 | |
| *** spotz is now known as spotz_zzz | 22:27 | |
| *** lisaclark1 has quit IRC | 22:31 | |
| *** kfarr has joined #openstack-barbican | 22:31 | |
| *** dimtruck is now known as zz_dimtruck | 22:32 | |
| *** everjeje has quit IRC | 22:42 | |
| *** kebray has quit IRC | 22:52 | |
| kfarr | redrobot, are you there? | 23:04 |
| *** dave-mccowan has joined #openstack-barbican | 23:04 | |
| *** zz_dimtruck is now known as dimtruck | 23:09 | |
| *** david-lyle has quit IRC | 23:20 | |
| *** kfarr has quit IRC | 23:23 | |
| *** dimtruck is now known as zz_dimtruck | 23:39 | |
| *** zz_dimtruck is now known as dimtruck | 23:48 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!