| *** kebray has quit IRC | 00:16 | |
| *** mkam has quit IRC | 00:22 | |
| *** juantwo has joined #openstack-barbican | 00:28 | |
| *** ayoung-dadmode is now known as ayoung | 00:33 | |
| *** juantwo has quit IRC | 01:06 | |
| *** juantwo has joined #openstack-barbican | 01:06 | |
| *** lisaclark1 has joined #openstack-barbican | 01:15 | |
| *** SheenaG1 has joined #openstack-barbican | 01:43 | |
| *** SheenaG11 has quit IRC | 01:46 | |
| *** paul_glass has joined #openstack-barbican | 01:50 | |
| *** paul_glass has quit IRC | 01:55 | |
| *** bdpayne has joined #openstack-barbican | 02:22 | |
| *** bdpayne has quit IRC | 02:22 | |
| *** lisaclark1 has quit IRC | 02:31 | |
| *** akoneru has quit IRC | 03:21 | |
| *** ayoung has quit IRC | 04:04 | |
| *** gyee has joined #openstack-barbican | 04:11 | |
| *** rsyed_away is now known as rsyed | 04:43 | |
| *** rsyed is now known as rsyed_away | 04:58 | |
| *** juantwo has quit IRC | 05:02 | |
| *** rsyed_away is now known as rsyed | 05:05 | |
| *** rsyed is now known as rsyed_away | 05:05 | |
| *** gyee has quit IRC | 05:19 | |
| *** jaosorior has joined #openstack-barbican | 07:50 | |
| *** woodster_ has quit IRC | 08:00 | |
| *** jamielennox_ has joined #openstack-barbican | 09:28 | |
| *** jamielennox_ has quit IRC | 09:53 | |
| *** SheenaG1 has quit IRC | 11:06 | |
| *** SheenaG1 has joined #openstack-barbican | 11:07 | |
| *** juantwo has joined #openstack-barbican | 12:14 | |
| *** paul_glass has joined #openstack-barbican | 12:18 | |
| *** ryanpetrello has quit IRC | 12:34 | |
| *** ryanpetrello has joined #openstack-barbican | 12:34 | |
| *** alee has quit IRC | 12:52 | |
| *** ryanpetrello has quit IRC | 13:02 | |
| *** ryanpetrello has joined #openstack-barbican | 13:05 | |
| *** ryanpetrello has quit IRC | 13:06 | |
| *** ryanpetrello has joined #openstack-barbican | 13:11 | |
| *** SheenaG1 has quit IRC | 13:13 | |
| *** nkinder has quit IRC | 13:14 | |
| *** ryanpetrello_ has joined #openstack-barbican | 13:26 | |
| *** tdink has joined #openstack-barbican | 13:35 | |
| *** paul_glass has quit IRC | 13:41 | |
| *** lisaclark1 has joined #openstack-barbican | 13:45 | |
| *** lisaclark1 has quit IRC | 13:45 | |
| *** paul_glass has joined #openstack-barbican | 13:46 | |
| *** paul_glass has quit IRC | 13:47 | |
| *** paul_glass has joined #openstack-barbican | 13:47 | |
| *** rsyed_away is now known as rsyed | 13:51 | |
| *** lisaclark1 has joined #openstack-barbican | 13:57 | |
| *** ryanpetrello has quit IRC | 13:59 | |
| *** ryanpetrello_ is now known as ryanpetrello | 13:59 | |
| *** zz_dimtruck is now known as dimtruck | 14:02 | |
| openstackgerrit | John Wood proposed a change to openstack/barbican: Add certificate plugin page https://review.openstack.org/131440 | 14:02 |
|---|---|---|
| *** woodster_ has joined #openstack-barbican | 14:03 | |
| *** lisaclark1 has quit IRC | 14:03 | |
| *** nkinder has joined #openstack-barbican | 14:05 | |
| *** alee has joined #openstack-barbican | 14:05 | |
| *** akoneru has joined #openstack-barbican | 14:10 | |
| *** lisaclark1 has joined #openstack-barbican | 14:16 | |
| *** mkam has joined #openstack-barbican | 14:17 | |
| *** kebray has joined #openstack-barbican | 14:21 | |
| *** kgriffs|afk is now known as kgriffs | 14:22 | |
| *** lisaclark1 has quit IRC | 14:24 | |
| *** tdink has quit IRC | 14:26 | |
| *** tdink has joined #openstack-barbican | 14:27 | |
| *** tdink_ has joined #openstack-barbican | 14:39 | |
| *** ayoung has joined #openstack-barbican | 14:42 | |
| *** tdink has quit IRC | 14:42 | |
| *** mkam has quit IRC | 14:43 | |
| *** mkam has joined #openstack-barbican | 14:43 | |
| *** kgriffs is now known as kgriffs|afk | 14:46 | |
| *** ayoung has quit IRC | 14:46 | |
| *** kgriffs|afk is now known as kgriffs | 14:48 | |
| *** kgriffs is now known as kgriffs|afk | 14:48 | |
| *** paul_glass has quit IRC | 14:59 | |
| *** ayoung has joined #openstack-barbican | 15:00 | |
| *** paul_glass has joined #openstack-barbican | 15:09 | |
| *** lisaclark1 has joined #openstack-barbican | 15:10 | |
| *** lisaclark1 has quit IRC | 15:16 | |
| *** lisaclark1 has joined #openstack-barbican | 15:17 | |
| *** SheenaG1 has joined #openstack-barbican | 15:18 | |
| *** SheenaG1 has quit IRC | 15:23 | |
| *** jorge_munoz has joined #openstack-barbican | 15:25 | |
| *** SheenaG1 has joined #openstack-barbican | 15:25 | |
| *** dimtruck is now known as zz_dimtruck | 15:30 | |
| *** zz_dimtruck is now known as dimtruck | 15:36 | |
| openstackgerrit | Paul Kehrer proposed a change to openstack/barbican: sync global requirements now that pecan 0.8 is out https://review.openstack.org/129281 | 15:45 |
| alee | redrobot, ping | 15:47 |
| redrobot | alee pong | 15:48 |
| alee | redrobot, akoneru and I have questions about your rpm scripts | 15:48 |
| alee | and spec file | 15:48 |
| redrobot | ah yes, I got his email and have not had a chance to reply >_< | 15:48 |
| alee | redrobot, akoneru is working on creating rpms for fedora/rhos | 15:48 |
| alee | redrobot, you have time to answer questions now? | 15:49 |
| redrobot | Yeah, I should be able to. | 15:49 |
| alee | redrobot, so I notice that you have broken up the deliverables into serveral rpms | 15:49 |
| *** lisaclark1 has quit IRC | 15:50 | |
| redrobot | yes, I think we split it up into 3 rpms | 15:50 |
| alee | barbican-common, barbican-api, barbican-worker, barbican-keystone-listener | 15:50 |
| alee | whats the rationale for what goes in each package? | 15:51 |
| redrobot | alee so, barbican-common includes pretty much all of the python code | 15:52 |
| redrobot | barbican-api adds the bits needed for the api. I think it's just the upstart scripts that manage the api. | 15:53 |
| redrobot | one assumption of the current spec file is that uwsgi will be used in front of the api | 15:53 |
| redrobot | that may not be true for a general-purpose package | 15:53 |
| redrobot | barbican-worker includes just the script to run the worker process | 15:53 |
| *** lisaclark1 has joined #openstack-barbican | 15:53 | |
| redrobot | both -api and -worker depend on core | 15:54 |
| redrobot | err common | 15:54 |
| redrobot | barbican-keystone-listener includes the bits that are needed to run the keystone queue consumer. | 15:54 |
| redrobot | I think that one should depend on barbican-common as well, but I can't remember off the top of my head. I didn't write that part. | 15:55 |
| alee | redrobot, are any of these rpms required to be installed on a client? | 15:55 |
| redrobot | no, these are all server side | 15:55 |
| akoneru | redrobot, yeah, it depends on barbican-common | 15:56 |
| redrobot | I don't believe we've done any work to package the client. | 15:56 |
| *** lisaclark1 has quit IRC | 15:56 | |
| alee | redrobot, interesting .. so how do we keep client and server api code in sync? | 15:56 |
| redrobot | that's a good question, and I don't have a good answer for that. The assumption was that the client would be installed from PyPI via pip | 15:57 |
| openstackgerrit | Thomas Dinkjian proposed a change to openstack/barbican: Smoke tests for secrets in Barbican Functional Tests https://review.openstack.org/130372 | 15:57 |
| redrobot | so, the latest client should work with whatever the latest server release is. | 15:58 |
| redrobot | for Juno (2014.2), the client is 3.0.0, which is not yet released. | 15:58 |
| alee | redrobot, I'm just wondering because we do things a little differently in dogtag. we have an rpm that contains the python/java classes that used by both client and server (includign api) | 15:59 |
| redrobot | I see. I think in our case that wouldn't be necessary since we don't share any code between server and client | 16:00 |
| alee | redrobot, well we have api interfaces defined in there .. I'll take look and see if it makes sense to consider changing. | 16:01 |
| alee | redrobot, in any case, if these are all server side, is there any reason to keep them all separate> | 16:01 |
| alee | ? | 16:01 |
| akoneru | redrobot, hmm. i tried running the build_rpm.sh script, but i am unsuccessful as of now, any specific steps i need to follow to get it right? (a doc would be great) | 16:02 |
| redrobot | akoneru the SPEC files are quite old, I wouldn't be surprised if they're stale. build_rpm.sh was supposed to be used by a Jenkins job that was continuously building the packages, but that Jenkins server is offline now. | 16:02 |
| redrobot | alee Originally I split them up for purely aesthetic reasons. The idea was that we could "yum install barbican-api" on the api nodes and "yum install barbican-worker" on the worker nodes. | 16:03 |
| redrobot | alee also, some assumptions can be made in those packages. The api package will start the service, for example. | 16:04 |
| *** gyee has joined #openstack-barbican | 16:04 | |
| alee | redrobot, can you explain to me a little about the worker nodes? | 16:04 |
| alee | redrobot, or is there a arch doc I should look at? | 16:05 |
| redrobot | alee I think the diagram in this wiki is still relevant https://github.com/cloudkeep/barbican/wiki/Architecture | 16:06 |
| alee | redrobot, I see - so the idea is that worker nodes could be on different machines. | 16:08 |
| redrobot | alee the dev configuration doesn't use a queue, so there's no need for worker processes. A live deployment would have dedicated worker nodes that are constantly polling the queue. | 16:08 |
| redrobot | alee yep, that's the idea :) | 16:08 |
| alee | redrobot, have you guys tested deploying like this? | 16:08 |
| redrobot | alee yes, we currently have one environment with 4x api nodes and 4x worker nodes. | 16:09 |
| alee | redrobot, I just want to make sure the separation being done in the rpms is correct. | 16:09 |
| alee | (and it uses the rpms generated by this script)? | 16:09 |
| redrobot | alee we've not yet deployed the keystone consumers. | 16:09 |
| redrobot | alee nope, we decided to go with docker images for packaging. RPMs were not moving fast enough for us in regards to dependencies. | 16:10 |
| alee | ok | 16:10 |
| alee | redrobot, ok - I understand the separation you used now, thanks. | 16:11 |
| alee | redrobot, the keystone listener is a separate process? | 16:11 |
| akoneru | redrobot, alee - that's all the questions i have. i will start looking into the dependencies and spec file now. | 16:12 |
| redrobot | alee yes, I haven't played with it much since it merged a couple of weeks ago, but as I understand it, it is a separate queue polling process as well. | 16:13 |
| alee | redrobot, it would be deployed on the api node though? or would it be deployed on its own box? | 16:13 |
| redrobot | alee I think that it would be deployed to either its own box, or alongside the workers, but preferably not alongside the api. | 16:14 |
| redrobot | alee the idea is that the api is publicly routable, but the worker nodes are not | 16:14 |
| alee | gotcha. | 16:15 |
| alee | redrobot, is python-cryptography required for build/runtime? | 16:16 |
| alee | redrobot, I see that its not in the spec file. | 16:17 |
| redrobot | alee so, python-cryptography (aka pyca/cryptography) is only required for the development (non-hsm) crypto plugin. ... I think. So maybe it should be under the "suggested" part of the spec | 16:18 |
| redrobot | alee I don't think they have an official packager either. We were having to fpm it when we were using rpms. | 16:19 |
| redrobot | alee it's also possible that we may be missing other dependencies. | 16:19 |
| alee | redrobot, so the build succeeds without it? | 16:19 |
| redrobot | yeah, it should. Let me refresh on the build script again | 16:20 |
| * redrobot looks | 16:20 | |
| *** rellerreller has joined #openstack-barbican | 16:20 | |
| alee | redrobot, the only build requirement I see is python2-devel | 16:24 |
| alee | we don't need anything else? | 16:24 |
| redrobot | alee I don't think so. As I understand it "build requirements" is a list of RPMs that need to be installed on the machine where the RPM will be built. I don't think the barbican python source has any build time dependencies other than python. | 16:26 |
| alee | redrobot, we'll find out :) | 16:26 |
| alee | redrobot, do we have any place where we store release tarballs? | 16:27 |
| alee | redrobot, say for juno release .. | 16:27 |
| redrobot | alee not really. Official OpenStack releases are stored in Launchpad. But they only include the Cycle Milestones, RCs and the final release. | 16:27 |
| redrobot | alee ah yes, hang on | 16:27 |
| redrobot | alee this is Juno final https://launchpad.net/barbican/juno/2014.2 | 16:28 |
| alee | redrobot, awesome - perfect thanks | 16:28 |
| * redrobot spins up a centos box to test build_rpm.sh | 16:29 | |
| *** dimtruck is now known as zz_dimtruck | 16:32 | |
| *** paul_glass has quit IRC | 16:32 | |
| *** tdink has joined #openstack-barbican | 16:35 | |
| *** tdink_ has quit IRC | 16:36 | |
| *** zz_dimtruck is now known as dimtruck | 16:37 | |
| *** jaosorior has quit IRC | 17:03 | |
| *** paul_glass has joined #openstack-barbican | 17:12 | |
| *** kebray has quit IRC | 17:26 | |
| *** kebray has joined #openstack-barbican | 17:26 | |
| *** rellerreller has quit IRC | 17:29 | |
| *** lisaclark1 has joined #openstack-barbican | 17:35 | |
| *** lisaclark1 has quit IRC | 17:44 | |
| *** lisaclark1 has joined #openstack-barbican | 17:44 | |
| *** lisaclark2 has joined #openstack-barbican | 17:49 | |
| *** lisaclark2 has quit IRC | 17:50 | |
| *** lisaclark2 has joined #openstack-barbican | 17:51 | |
| *** lisaclark1 has quit IRC | 17:52 | |
| *** dimtruck is now known as zz_dimtruck | 17:59 | |
| *** zz_dimtruck is now known as dimtruck | 18:01 | |
| *** lisaclark2 has quit IRC | 18:09 | |
| *** lisaclark1 has joined #openstack-barbican | 18:09 | |
| *** akoneru is now known as akoneru_lunch | 18:10 | |
| redrobot | akoneru finally had a chance to look at the build_rpm.sh script again | 18:10 |
| redrobot | but you're out to lunch... hehe. | 18:11 |
| rm_work | hmm, should pack up food soon? | 18:34 |
| redrobot | rm_work I think the plan is to leave it there for people to graze | 18:34 |
| chellygel | just take it when you are ready to leave | 18:34 |
| rm_work | heh k i should actually plug in my crockpot then O_o | 18:35 |
| *** kebray has quit IRC | 18:47 | |
| *** kebray has joined #openstack-barbican | 18:51 | |
| *** lisaclark1 has quit IRC | 18:59 | |
| *** lisaclark1 has joined #openstack-barbican | 19:03 | |
| *** paul_glass has quit IRC | 19:04 | |
| *** akoneru_lunch is now known as akoneru | 19:08 | |
| *** codekobe____ is now known as codekobe | 19:14 | |
| akoneru | redrobot, ping | 19:14 |
| alee | redrobot, ping | 19:18 |
| alee | redrobot, spoke with jamielennox . It looks like they will not need the extra design session, so we can use it for a barbican topic. | 19:19 |
| *** lisaclark1 has quit IRC | 19:30 | |
| *** gyee has quit IRC | 19:31 | |
| redrobot | alee awesome | 19:59 |
| *** ayoung has quit IRC | 20:07 | |
| *** nkinder has quit IRC | 20:08 | |
| *** kebray has quit IRC | 20:15 | |
| redrobot | alee how does this sound for the last design session: Barbican per-user entity-level authorization | 20:32 |
| redrobot | The goal of this session is to find the correct OpenStack-wide way forward for providing entity-level authorization (authorization for individual secrets/containers/etc.) There has been a lot of discussion around this topic since last summit without a resolution. Keystone policy currently cannot address this use case, and there is some resistance to adding it to Barbican, since Authorization falls within Keystone's domain. | 20:32 |
| *** lisaclark1 has joined #openstack-barbican | 20:43 | |
| *** kebray has joined #openstack-barbican | 20:44 | |
| *** lisaclark1 has quit IRC | 20:44 | |
| *** lisaclark1 has joined #openstack-barbican | 20:56 | |
| *** lisaclark1 has quit IRC | 20:56 | |
| *** lisaclark1 has joined #openstack-barbican | 20:56 | |
| *** juantwo has quit IRC | 21:00 | |
| *** lisaclark1 has quit IRC | 21:00 | |
| akoneru | redrobot, ping. | 21:03 |
| redrobot | akoneru pong | 21:04 |
| akoneru | redrobot, you were looking for me during lunch? | 21:04 |
| redrobot | akoneru yeah, I was looking at the build_rpm.sh script. | 21:05 |
| redrobot | akoneru as far as I can tell it still works. It does have some prerequistes and assumptions though | 21:05 |
| akoneru | redrobot, oh. ok. Any steps i need to follow? I created a dist directory and placed the tar file there. | 21:06 |
| akoneru | redrobot, i get errors from the rpmbuild command, seems like i need to set some environment variables to get the paths right? | 21:07 |
| *** dimtruck is now known as zz_dimtruck | 21:07 | |
| akoneru | redrobot, i mean rpmbuild on the spec file. | 21:08 |
| redrobot | akoneru yeah, you need to set up a file called ~/.rpmmacros | 21:08 |
| akoneru | redrobot, oh. ok. | 21:08 |
| redrobot | there you can define what %_topdir should be | 21:08 |
| redrobot | also, the build_rpm.sh script assumes you want to GPG sign the build. For dev purposes, you can remove the "--sign" part from the rpmbuild command. | 21:09 |
| redrobot | making the tarball can be done with "python setup.py sdist" | 21:09 |
| redrobot | also, the scripts assumes that PWD is the barbican project root. | 21:09 |
| *** tdink has quit IRC | 21:10 | |
| redrobot | If you get stuck, I can maybe write a step-by-step wiki or something to that effect. | 21:10 |
| akoneru | redrobot, hmm. ok. i will get back to you tomorrow - same time? | 21:11 |
| *** tdink has joined #openstack-barbican | 21:11 | |
| redrobot | akoneru yep, I'll be here all day tomorrow. Also, this guide helped me a lot when I was getting started with RPMs | 21:11 |
| redrobot | https://docs.fedoraproject.org/en-US/Fedora_Draft_Documentation/0.1/html/RPM_Guide/ch-creating-rpms.html | 21:11 |
| akoneru | redrobot, i should get it running with the information you gave me | 21:11 |
| akoneru | redrobot, yeah, i bookmarked it already :). Thanks! | 21:12 |
| *** nkinder has joined #openstack-barbican | 21:12 | |
| *** tdink has quit IRC | 21:13 | |
| *** tdink_ has joined #openstack-barbican | 21:13 | |
| alee | redrobot, sounds good to me although I want to get some ideas also on https://review.openstack.org/127353 | 21:16 |
| alee | that is --- per secret policy | 21:16 |
| redrobot | alee I was going to add that CR to the etherpad for the session. Would definitely be good for attendees to read through that blueprint for context. | 21:17 |
| alee | redrobot, it handles both the case you mentioned above and LBaaS which is currently using trusts | 21:17 |
| alee | redrobot, with the idea that trusts are too heavy handed. | 21:18 |
| alee | (as they are currently formulated) | 21:18 |
| * redrobot nods | 21:18 | |
| redrobot | I hope we can get some keystone folks to join in on the fun | 21:18 |
| alee | so yeah -- you might want to include that in the session description | 21:19 |
| alee | redrobot, yeah - I think keystone folks are essential | 21:19 |
| alee | redrobot, this will be a problem faced by many projects. | 21:19 |
| woodster_ | redrobot: YES to that 4th session topic idea! | 21:22 |
| *** zz_dimtruck is now known as dimtruck | 21:24 | |
| *** alee is now known as alee_on_way_home | 21:42 | |
| *** alee_on_way_home has quit IRC | 21:47 | |
| rm_work | yeah, need some keystone folks to explain why it isn't just handled properly in keystone <_< | 21:49 |
| rm_work | which I get now that it was explained, but i'm still a little bit bitter about | 21:50 |
| *** SheenaG1 has quit IRC | 21:53 | |
| *** akoneru has quit IRC | 21:57 | |
| *** dimtruck is now known as zz_dimtruck | 22:01 | |
| *** kebray has quit IRC | 22:09 | |
| *** kebray has joined #openstack-barbican | 22:10 | |
| *** ryanpetrello has quit IRC | 22:19 | |
| *** rsyed is now known as rsyed_away | 22:36 | |
| *** gyee has joined #openstack-barbican | 22:39 | |
| *** jorge_munoz has quit IRC | 22:42 | |
| *** ryanpetrello has joined #openstack-barbican | 22:44 | |
| *** tdink_ has quit IRC | 22:45 | |
| *** zz_dimtruck is now known as dimtruck | 22:49 | |
| *** ryanpetrello has quit IRC | 22:53 | |
| openstackgerrit | John Vrbanac proposed a change to openstack/barbican: Adding docs around running tests and devstack https://review.openstack.org/130345 | 22:56 |
| openstackgerrit | John Vrbanac proposed a change to openstack/barbican: Adding docs around running tests and devstack https://review.openstack.org/130345 | 22:57 |
| openstackgerrit | John Vrbanac proposed a change to openstack/barbican: Taking a first stab at putting together setup docs https://review.openstack.org/129742 | 23:02 |
| openstackgerrit | Douglas Mendizábal proposed a change to openstack/python-barbicanclient: Update Order models https://review.openstack.org/131598 | 23:02 |
| openstackgerrit | John Vrbanac proposed a change to openstack/barbican: Adding docs around running tests and devstack https://review.openstack.org/130345 | 23:02 |
| openstackgerrit | John Vrbanac proposed a change to openstack/barbican: Adding simple getting involved doc https://review.openstack.org/130381 | 23:03 |
| *** alee_on_way_home has joined #openstack-barbican | 23:04 | |
| *** kebray has quit IRC | 23:07 | |
| *** lisaclark1 has joined #openstack-barbican | 23:17 | |
| *** lisaclark1 has quit IRC | 23:22 | |
| *** mkam has quit IRC | 23:42 | |
| *** rsyed_away is now known as rsyed | 23:53 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!