*** ryanpetrello has joined #openstack-barbican | 00:31 | |
*** ryanpetrello has quit IRC | 00:47 | |
*** ryanpetrello has joined #openstack-barbican | 01:03 | |
*** ryanpetrello has quit IRC | 01:25 | |
*** ryanpetrello has joined #openstack-barbican | 01:26 | |
*** ryanpetrello has quit IRC | 01:38 | |
*** zz_dimtruck is now known as dimtruck | 02:46 | |
*** dave-mccowan has quit IRC | 04:29 | |
*** dimtruck is now known as zz_dimtruck | 05:21 | |
*** jamielennox is now known as jamielennox|away | 05:34 | |
*** jamielennox|away is now known as jamielennox | 05:41 | |
*** zz_dimtruck is now known as dimtruck | 05:42 | |
*** dimtruck is now known as zz_dimtruck | 05:54 | |
*** miqui has quit IRC | 06:22 | |
*** ryanpetrello has joined #openstack-barbican | 06:23 | |
*** ryanpetrello has quit IRC | 07:02 | |
*** jaosorior has joined #openstack-barbican | 08:19 | |
*** openstackgerrit has quit IRC | 11:48 | |
*** openstackgerrit has joined #openstack-barbican | 11:49 | |
*** ryanpetrello has joined #openstack-barbican | 12:41 | |
*** rm_work is now known as rm_work|away | 12:45 | |
*** ryanpetrello has quit IRC | 12:54 | |
*** ryanpetrello_ has joined #openstack-barbican | 12:54 | |
*** ryanpetrello_ is now known as ryanpetrello | 12:54 | |
*** rcarrill` has left #openstack-barbican | 13:04 | |
*** dave-mccowan has joined #openstack-barbican | 13:21 | |
*** dave-mccowan_ has joined #openstack-barbican | 13:24 | |
*** dave-mccowan has quit IRC | 13:25 | |
*** dave-mccowan_ is now known as dave-mccowan | 13:25 | |
*** SheenaG1 has joined #openstack-barbican | 13:38 | |
*** ryanpetrello has quit IRC | 13:53 | |
*** jaosorior has quit IRC | 13:53 | |
*** kgriffs|afk is now known as kgriffs | 13:55 | |
*** ryanpetrello has joined #openstack-barbican | 13:59 | |
*** nkinder has quit IRC | 14:05 | |
*** ayoung has quit IRC | 14:18 | |
*** ryanpetrello has quit IRC | 14:19 | |
*** zz_dimtruck is now known as dimtruck | 14:20 | |
*** alee has quit IRC | 14:22 | |
*** ayoung has joined #openstack-barbican | 14:26 | |
*** ametts has joined #openstack-barbican | 14:28 | |
*** ryanpetrello has joined #openstack-barbican | 14:36 | |
*** dave-mccowan has quit IRC | 14:37 | |
*** stanzi has joined #openstack-barbican | 14:40 | |
*** tdink has joined #openstack-barbican | 14:42 | |
*** dimtruck is now known as zz_dimtruck | 14:43 | |
*** nkinder has joined #openstack-barbican | 14:57 | |
*** dave-mccowan has joined #openstack-barbican | 14:57 | |
*** tdink has quit IRC | 14:59 | |
*** stanzi has quit IRC | 15:00 | |
*** stanzi has joined #openstack-barbican | 15:01 | |
*** stanzi has quit IRC | 15:05 | |
*** stanzi has joined #openstack-barbican | 15:06 | |
*** zz_dimtruck is now known as dimtruck | 15:09 | |
*** jaosorior has joined #openstack-barbican | 15:16 | |
*** stanzi has quit IRC | 15:27 | |
*** stanzi has joined #openstack-barbican | 15:27 | |
*** stanzi_ has joined #openstack-barbican | 15:29 | |
*** atiwari has joined #openstack-barbican | 15:30 | |
*** stanzi has quit IRC | 15:32 | |
*** SheenaG1 has left #openstack-barbican | 15:32 | |
*** SheenaG1 has joined #openstack-barbican | 15:32 | |
*** rsyed_away is now known as rsyed | 15:33 | |
*** JeffF has joined #openstack-barbican | 15:41 | |
*** rsyed has left #openstack-barbican | 15:42 | |
*** gyee has joined #openstack-barbican | 15:47 | |
*** tdink has joined #openstack-barbican | 15:58 | |
*** paul_glass has joined #openstack-barbican | 15:58 | |
*** darrenmoffat2 has joined #openstack-barbican | 16:02 | |
*** akoneru has joined #openstack-barbican | 16:02 | |
openstackgerrit | Douglas Mendizábal proposed openstack/barbican: Use canonical name for coverage job https://review.openstack.org/134981 | 16:03 |
---|---|---|
*** alee has joined #openstack-barbican | 16:03 | |
*** darrenmoffat2 has quit IRC | 16:03 | |
alee | redrobot, ping | 16:05 |
redrobot | alee pong | 16:06 |
alee | redrobot, is woodster back today? | 16:06 |
redrobot | alee I _think_ so... but he's not in the office yet. | 16:06 |
alee | redrobot, is there an agenda for today's meeting? | 16:06 |
redrobot | alee not yet it seems https://wiki.openstack.org/wiki/Meetings/Barbican | 16:07 |
redrobot | alee we're supposed to talk about RFC 7030 | 16:07 |
redrobot | I'll add it to the agenda right now | 16:07 |
alee | redrobot, I had some thoughts on certs and cert handling and rfc 7030 -- https://etherpad.openstack.org/p/thoughts_on_certs | 16:08 |
alee | redrobot, perhaps you can reference that as well so folks have a chance to look at some of the ideas there. | 16:08 |
*** tdink has quit IRC | 16:09 | |
redrobot | alee done. good notes btw! Gotta make some time this morning to look over them. | 16:09 |
alee | redrobot, cool - feel free to mark up -- and let me know what you think | 16:10 |
*** david-lyle_afk is now known as david-lyle | 16:11 | |
*** paul_glass has quit IRC | 16:21 | |
*** tdink has joined #openstack-barbican | 16:30 | |
openstackgerrit | Merged openstack/barbican: Updated from global requirements https://review.openstack.org/134764 | 16:31 |
*** SheenaG11 has joined #openstack-barbican | 16:37 | |
*** SheenaG1 has quit IRC | 16:39 | |
*** stanzi_ has quit IRC | 16:44 | |
*** stanzi has joined #openstack-barbican | 16:45 | |
*** woodster_ has joined #openstack-barbican | 16:47 | |
openstackgerrit | Merged openstack/python-barbicanclient: Updated from global requirements https://review.openstack.org/134790 | 16:49 |
*** stanzi has quit IRC | 16:52 | |
*** stanzi has joined #openstack-barbican | 16:52 | |
*** stanzi has quit IRC | 16:58 | |
*** tdink has quit IRC | 16:59 | |
morganfainberg | redrobot, ping | 16:59 |
morganfainberg | redrobot, re: mid-cycle | 16:59 |
redrobot | morganfainberg hiya | 17:02 |
morganfainberg | redrobot, so - trying to line up the last bits for our mid-cycle for keystone | 17:02 |
morganfainberg | redrobot, right now January 19 - 21 (Mon, Tue, Wed) is the clear winner | 17:03 |
morganfainberg | and we have 2 people who can *only* make bay area who want to join, and 4 people who can only make SAT want to join. | 17:03 |
morganfainberg | erm wait | 17:03 |
morganfainberg | strike that | 17:03 |
morganfainberg | January 21 - 23 (Wed, Thu, Fri), is the current leader | 17:03 |
morganfainberg | for dates | 17:04 |
morganfainberg | redrobot, i'm at the point where i'm going to need to make a call on what we're doing lcoation wise. so - figured i'd hit you guys up :) | 17:04 |
redrobot | morganfainberg ok, I still think space should not be a problem for hosting in SAT. I can get you a definitive yes as soon as I poke some people here and at Geekdom. | 17:06 |
morganfainberg | redrobot, yeah SAT i'm sure isn't a huge deal. | 17:06 |
morganfainberg | but if we're doing SAT does that make barbican less happy? how much of a benefit is there if we overlap? | 17:07 |
morganfainberg | second, i def. am interested in the security team's meetup if they are doing one. | 17:07 |
morganfainberg | for *ahem* obvious reasons | 17:07 |
redrobot | morganfainberg :) ... Yes, Rob was definitely interested in having a mid-cycle meetup as well. He wants to either have it co-incide with Barbican and/or Keystone, or have them far enough apart to where it's not a pain to go to both. | 17:08 |
morganfainberg | ++ | 17:08 |
morganfainberg | redrobot, so as much as I'd like the bay area for Keystone -- I *think* we're going to need to do SAT again just based upon the poll. | 17:11 |
*** kebray has joined #openstack-barbican | 17:19 | |
*** bdpayne has joined #openstack-barbican | 17:20 | |
*** atiwari has quit IRC | 17:23 | |
*** atiwari has joined #openstack-barbican | 17:23 | |
*** atiwari has quit IRC | 17:31 | |
*** atiwari has joined #openstack-barbican | 17:32 | |
openstackgerrit | Merged openstack/barbican: Use canonical name for coverage job https://review.openstack.org/134981 | 17:46 |
*** jaosorior has quit IRC | 17:53 | |
SheenaG11 | dstufft: you still working on the architecture PR? | 17:53 |
*** bdpayne has quit IRC | 17:53 | |
dstufft | SheenaG11: yea, was just asking wood for clarification on a comment | 17:53 |
SheenaG11 | dstufft: sweet, ty - sorry for bugging :-) | 17:54 |
*** stanzi has joined #openstack-barbican | 17:57 | |
*** rm_work|away is now known as rm_work | 18:00 | |
*** tdink has joined #openstack-barbican | 18:02 | |
*** stanzi has quit IRC | 18:04 | |
*** stanzi has joined #openstack-barbican | 18:04 | |
*** tdink has quit IRC | 18:13 | |
*** tdink has joined #openstack-barbican | 18:13 | |
openstackgerrit | Donald Stufft proposed openstack/barbican: Port the Architecture, Dataflow, and Project Strucure docs https://review.openstack.org/132304 | 18:15 |
*** bdpayne has joined #openstack-barbican | 18:18 | |
*** tdink has quit IRC | 18:18 | |
*** rellerreller has joined #openstack-barbican | 18:22 | |
*** akoneru is now known as akoneru_lunch | 18:23 | |
*** gyee has quit IRC | 18:45 | |
*** gyee has joined #openstack-barbican | 18:45 | |
*** SheenaG11 has quit IRC | 18:48 | |
*** dave-mccowan has quit IRC | 18:48 | |
*** SheenaG1 has joined #openstack-barbican | 18:53 | |
*** rellerreller has quit IRC | 18:57 | |
*** rellerreller has joined #openstack-barbican | 19:05 | |
*** tdink has joined #openstack-barbican | 19:06 | |
*** dave-mccowan has joined #openstack-barbican | 19:08 | |
*** SheenaG1 has quit IRC | 19:17 | |
*** stanzi has quit IRC | 19:20 | |
*** jaosorior has joined #openstack-barbican | 19:21 | |
*** liam_ has joined #openstack-barbican | 19:26 | |
*** liam_ is now known as Guest63751 | 19:26 | |
*** Guest63751 has quit IRC | 19:26 | |
*** bdpayne has quit IRC | 19:29 | |
*** bdpayne has joined #openstack-barbican | 19:29 | |
*** bdpayne has quit IRC | 19:31 | |
*** stanzi has joined #openstack-barbican | 19:36 | |
*** bdpayne has joined #openstack-barbican | 19:36 | |
*** bdpayne has quit IRC | 19:40 | |
*** rtom has joined #openstack-barbican | 19:45 | |
*** SheenaG1 has joined #openstack-barbican | 19:46 | |
*** SheenaG11 has joined #openstack-barbican | 19:47 | |
*** bdpayne has joined #openstack-barbican | 19:49 | |
*** atiwari has quit IRC | 19:49 | |
*** SheenaG1 has quit IRC | 19:51 | |
*** darrenmoffat has quit IRC | 19:53 | |
*** darrenmoffat has joined #openstack-barbican | 19:54 | |
redrobot | Weekly meeting starts in 5 minutes on #openstack-meeting-alt | 19:56 |
*** rellerreller has quit IRC | 19:58 | |
*** tkelsey has joined #openstack-barbican | 19:58 | |
jaosorior | ah, still get confused about the time | 19:59 |
jaosorior | thought it was in an hour | 20:00 |
reaperhulk | UTC no DST makes for some confusion, heh | 20:01 |
*** SheenaG11 has quit IRC | 20:01 | |
*** rellerreller has joined #openstack-barbican | 20:05 | |
*** SheenaG1 has joined #openstack-barbican | 20:05 | |
*** akoneru_lunch is now known as akoneru | 20:11 | |
*** stanzi has quit IRC | 20:22 | |
*** stanzi has joined #openstack-barbican | 20:23 | |
*** jorge_munoz has joined #openstack-barbican | 20:25 | |
*** tdink has quit IRC | 20:40 | |
*** SheenaG1 has quit IRC | 20:40 | |
*** atiwari has joined #openstack-barbican | 20:40 | |
*** tdink has joined #openstack-barbican | 20:41 | |
*** stanzi has quit IRC | 20:43 | |
*** openstackgerrit has quit IRC | 20:49 | |
*** openstackgerrit has joined #openstack-barbican | 20:49 | |
reaperhulk | after party | 21:00 |
tkelsey | o/ | 21:00 |
redrobot | o/ | 21:00 |
hyakuhei | o/ | 21:00 |
rm_work | redrobot: I have an implementation here using PyOpenSSL locally: https://review.openstack.org/#/c/132578/ | 21:00 |
alee | o/ yee hah! | 21:00 |
jaosorior | O_O | 21:00 |
rm_work | see: generator / manager | 21:01 |
redrobot | rm_work yep, I recall you talking about it. | 21:01 |
woodster_ | o/ | 21:01 |
rm_work | err, generator is PyOpenSSL, manager is just... files | 21:01 |
rm_work | it's not designed to be secure, it's a PoC development implementation | 21:01 |
atiwari | redrobot, are we done with meeting? | 21:01 |
alee | atiwari, this is the after party | 21:02 |
rm_work | but anyway, I'll be copy/pasting that CertManager/CertGenerator interface from Octavia to Neutron | 21:02 |
rm_work | which doesn't seem ideal to me | 21:02 |
redrobot | atiwari yes meeting ended 2 minutes ago. | 21:02 |
atiwari | redrobot, it has to be 2 MT | 21:02 |
alee | rm_work, so -- what about rather using an interface in certmonger? | 21:02 |
rm_work | and it should probably live in Castellan (or whatever) along with the KeyManager interface | 21:02 |
*** kaitlin-farr has joined #openstack-barbican | 21:02 | |
rm_work | alee: well, we'd still need something to interface with Certmonger | 21:03 |
rm_work | and I'd argue that whatever that is should essentially also use this interface as defined | 21:03 |
alee | rm_work, one of the things I suggested was to add a python interface to certmonger | 21:03 |
redrobot | atiwari meeting is scheduled in UTC https://wiki.openstack.org/wiki/Meetings#Barbican_Meeting .. it changes in US when DST starts/ends | 21:03 |
rm_work | yeah | 21:03 |
rm_work | and that would be good | 21:03 |
rm_work | but | 21:03 |
alee | rm_work, it needs to be written - but it could essentially do what you suggest | 21:03 |
rm_work | right | 21:04 |
rm_work | but that would be USED to make an implementation for CertManager | 21:04 |
atiwari | redrobot, never mind I think my calender still not in sync | 21:04 |
rm_work | alee: https://review.openstack.org/#/c/131889/9/octavia/certificates/manager/cert_mgr.py | 21:04 |
rm_work | remember we're just talking about abstractions | 21:04 |
alee | rm_work, how many levels of indirection do we need? | 21:05 |
rm_work | there's a lot of candidates for implementations, of which Certmonger is the most promising | 21:05 |
rm_work | alee: yeah, I ask that a lot | 21:05 |
rm_work | but in this case I think it makes sense | 21:05 |
rm_work | what if you *don't* want to use Certmonger? :/ | 21:05 |
alee | what other candidates are there out there? | 21:05 |
rm_work | well | 21:05 |
rm_work | https://review.openstack.org/#/c/132578/ | 21:05 |
rm_work | there's one | 21:05 |
rm_work | not that it's usable in production :P | 21:06 |
*** bubbva has quit IRC | 21:06 | |
*** bubbva has joined #openstack-barbican | 21:06 | |
alee | rm_work, yeah - thats my point. I'm all for creating an interface is there are plenty of viable options out there. | 21:07 |
rm_work | i mean, there's one example, i can't imagine there aren't others | 21:07 |
*** SheenaG1 has joined #openstack-barbican | 21:07 | |
rm_work | I just don't know that tying Certmonger directly into Neutron as a hard dependency is a great idea | 21:08 |
hyakuhei | No it isn't | 21:08 |
hyakuhei | It's a bad idea for a whole bunch of the things Neutron wants to do | 21:09 |
hyakuhei | Well, I'm thinking of LBaaS/Octavia actually | 21:09 |
rm_work | yeah | 21:09 |
rm_work | I'm the LBaaS/Octavia dev that's working on TLS support :P | 21:09 |
rm_work | so yes | 21:09 |
alee | hyakuhei, rm_work - why is it a bad idea? | 21:10 |
hyakuhei | heh yeah. CertMonger doesn't make much sense there to my basic understanding of what you're trying to do | 21:10 |
rm_work | yeah it's a bit of overkill | 21:10 |
hyakuhei | I'd expect you to just use barbican-client | 21:10 |
rm_work | yes | 21:10 |
rm_work | that is the plan | 21:10 |
alee | rm_work, there is no need to track the certs? | 21:10 |
rm_work | nope | 21:11 |
rm_work | also, we're talking about two distinct things here | 21:11 |
rm_work | CertManager and CertGenerator | 21:11 |
rm_work | CertManager is just storing already-defined (user-defined) certs in Barbican, and retrieving them | 21:11 |
rm_work | they're *just secrets* | 21:11 |
rm_work | has nothing to do with CAs, etc | 21:11 |
rm_work | the problem with KeyMgr is that it only accounts for Secrets, not Containers | 21:12 |
rm_work | we just need a Container version of KeyMgr, at the end of the day | 21:12 |
alee | rm_work, fair enough - but I wouldn't call that a CertManager then. | 21:12 |
rm_work | now, for CertGenerator, we might look at something like Certmonger as an implementation | 21:12 |
rm_work | but more likely we could just go straight to Barbican | 21:13 |
rm_work | having the extra service would be a lot of overhead and would add to our security workflow | 21:13 |
rm_work | we're trying to limit touchpoints | 21:13 |
rm_work | alee: what would you call it? | 21:13 |
rm_work | ContainerManager? | 21:13 |
rm_work | >_> | 21:13 |
alee | potentially yes | 21:14 |
rm_work | well, KeyMgr doesn't suppose RSAContainers for some reason | 21:14 |
rm_work | *support | 21:14 |
rm_work | not sure why | 21:14 |
rm_work | maybe if it did, then we could use it | 21:14 |
rm_work | since it would have to support Containers generically | 21:14 |
alee | maybe it should | 21:14 |
rm_work | so, that's the discussion I'd like to have | 21:14 |
rm_work | and when I said "merge CertManager into the project with KeyMgr", what I really meant was "get that functionality in there somehow" | 21:15 |
rm_work | whether it's explicitly another class or not | 21:15 |
alee | it seems like KeyMgr should probably support retrival of groups of secrets | 21:15 |
rm_work | their current implementation does not | 21:15 |
rm_work | and is very much not useful to us | 21:15 |
rm_work | but if it were designed with CertManagement in mind | 21:15 |
alee | after all - as you say - its just retrieving secrets | 21:15 |
rm_work | it might be worthwhile | 21:16 |
* hyakuhei has been informed that he's done for the night. Cheers all | 21:16 | |
rm_work | heh | 21:16 |
woodster_ | castillan is intended to break that barbican dependency for integrated projects though, and allow for other key mgr impls. In my mind that extends to secrets and containers. The cert stuff is pulling some orders functioanlity (via cert orders) into the mix it sounds like. | 21:16 |
* rm_work waves at hyakuhei | 21:16 | |
tkelsey | later hyakuhei | 21:16 |
rm_work | woodster_: yes and no | 21:17 |
rm_work | woodster_: CertManager -- is not | 21:17 |
woodster_ | hyakuhei, good night | 21:17 |
rm_work | woodster_: CertGenerator -- is | 21:17 |
rm_work | I don't care about CertGenerator | 21:17 |
rm_work | that can be custom in our repo | 21:17 |
rm_work | CertManager is the part that I think should be merged | 21:17 |
woodster_ | rm_work, got you | 21:17 |
tkelsey | think I'm going to follow hyakuhei's good example. Later all. | 21:18 |
woodster_ | well, if it means we don't have to come up with yet another repo name... | 21:18 |
woodster_ | tkelsey, good night as well.. | 21:18 |
redrobot | laters tkelsey | 21:18 |
alee | rm_work, as for going to barbican directly for CertGenerator - you still have to answr the question of what parameters need to be passed for the cert request. if we decide to make that cmc requests in general, then you have to support cmc functionality. | 21:18 |
rm_work | yeah, I just want to propose that WHATEVER you end up writing as the interface project, should support Container handling as well as just Secrets | 21:18 |
rm_work | alee: yeah I'm not super concerned about that | 21:18 |
rm_work | the implementation would handle it | 21:19 |
*** stanzi has joined #openstack-barbican | 21:19 | |
alee | rm_work, and if we'll do that in certmonger - no need to re-implement. | 21:19 |
rm_work | well | 21:19 |
rm_work | see: https://review.openstack.org/#/c/132578/9/octavia/certificates/generator/local.py | 21:19 |
rm_work | or https://review.openstack.org/#/c/132578/9/octavia/tests/unit/certificates/generator/test_local.py | 21:19 |
rm_work | that is the use-case | 21:19 |
rm_work | in the test file | 21:19 |
rm_work | local_cert_gen.LocalCertGenerator.sign_cert(csr) | 21:19 |
rm_work | the sign_cert method takes a CSR and returns a cert | 21:20 |
rm_work | how that's done is up to the implementation -- if Barbican ends up using CMC as its interface, I'd write something to convert it to that and pass it to Barbican using some config-values to fill in anything static | 21:20 |
rm_work | right now: https://review.openstack.org/#/c/132580/8/octavia/certificates/generator/barbican.py | 21:21 |
rm_work | not so useful :) | 21:21 |
alee | rm_work, yup | 21:21 |
rm_work | i really doubt we'll end up using anything as heavy as Certmonger | 21:22 |
*** tkelsey has quit IRC | 21:22 | |
rm_work | but to understand why, you REALLY have to understand our use-case | 21:22 |
rm_work | which is admittedly a bit odd | 21:22 |
rm_work | Octavia uses one-time throwaway certs | 21:22 |
rm_work | ... kinda | 21:23 |
alee | rm_work, not sure why you think certmonger is "heavy" - its a C app that just talks either directly to a CA or potentially to barnican | 21:23 |
openstackgerrit | Merged openstack/barbican: Added test to check that an expired secret cannot be retrieved https://review.openstack.org/134292 | 21:24 |
alee | rm_work, but we can debate that later. | 21:24 |
rm_work | alee: it's something else running on the syste, | 21:24 |
rm_work | *system | 21:24 |
rm_work | that we have to install and maintain | 21:24 |
rm_work | anyway, http://docs.octavia.io/review/130659/specs/version0.5/tls-data-security.html | 21:24 |
rm_work | Diagram 1 is CertManager, Diagram 2 is CertGenerator | 21:25 |
*** stanzi has quit IRC | 21:25 | |
alee | rm_work, woodster_ there are two ways to look at this for cert management. One is that we are just retrieving collections of secrets. One is that we have generated a cert and we need to get it back. | 21:25 |
*** stanzi has joined #openstack-barbican | 21:26 | |
rm_work | alee: yes, thus two interfaces | 21:26 |
rm_work | though we actually *don't* need the generated cert to be stored at all | 21:26 |
rm_work | it's essentially throwaway | 21:26 |
rm_work | we will never need to retrieve it again | 21:27 |
rm_work | and if we lose it, no one cares | 21:27 |
alee | rm_work, sure - in the general case, it may need to be retrieved later | 21:27 |
rm_work | yes, which is why CertGenerator isn't really something we feel needs to be shared | 21:27 |
rm_work | we'll keep that local to our project | 21:27 |
rm_work | CertManager is the part that needs to be shared | 21:27 |
alee | ok fair enough | 21:27 |
alee | woodster_, reaperhulk, redrobot - anyone else still around? | 21:29 |
rm_work | it's funny, because when we do use Barbican for CertGenerator, we'll have to make it immediately delete the Cert data from Barbican after it generates it and retrieves it >_> | 21:29 |
rm_work | or else we'd end up with a TON of cruft | 21:30 |
redrobot | alee o/ | 21:30 |
woodster_ | alee, yep still around. rm_work, I think that is why we'd talked about maybe having a synchronous API option for such throwaway certs | 21:31 |
*** rellerreller has quit IRC | 21:31 | |
alee | woodster_, reaperhulk , rm_work, redrobot what do you guys think about using cmc requests as the new standard cert api? | 21:33 |
alee | (and anyone else) | 21:34 |
woodster_ | alee, I think we might need to allow for more than one format perhaps, including csrs? We've also talked about use cases where barbican generates the private key and then the CSR. So maybe we need a 'format' key added to the 'meta' field to specify this? | 21:38 |
alee | woodster_, well rememebr that simple cmc == pkcs10 | 21:39 |
alee | ie. same as csr. | 21:39 |
alee | woodster_, so we could support simple cmc == csr, full cmc | 21:40 |
woodster_ | alee, I guess that's true. So are you thinking CMC plus a CA flavor/id reference? | 21:40 |
woodster_ | ...on the order request that is | 21:40 |
alee | and then potentially the other case, where we provide a refernce to a secret and barnican generates a csr | 21:40 |
alee | yup - flavor/id for sure | 21:41 |
alee | this is starting to sound like a spec I need to write .. | 21:41 |
woodster_ | indeed :) | 21:41 |
*** stanzi has quit IRC | 21:42 | |
alee | ok - let me do that and we can continue to discussion in there. | 21:42 |
*** stanzi has joined #openstack-barbican | 21:42 | |
alee | rm_work, I would suggest you think about writing a spec for updating the KeyManager interface for containers too. | 21:43 |
alee | I think thats the right approach for what you are trying to do here. | 21:44 |
alee | which is basically store and retrieve containers of secrets | 21:44 |
woodster_ | rm_work, alee, redrobot, as for the cert manager, it does seem that a simplified interface in castillan would be a good generic way to go. Maybe the way to proceed on that is to create the repo with basic key manager impl first, and then have CRs for adding containers support and cert manager support? | 21:45 |
woodster_ | ...and have discussion continue on in those respective CRs? | 21:45 |
openstackgerrit | Thomas Dinkjian proposed openstack/barbican: Moved secret functional tests to data driven tests https://review.openstack.org/135089 | 21:45 |
alee | yes -- well what rm_work is proposing for CertManager is really retrieving secrets | 21:47 |
alee | and containers of secrets | 21:47 |
*** tkelsey has joined #openstack-barbican | 21:52 | |
*** stanzi has quit IRC | 21:53 | |
*** stanzi has joined #openstack-barbican | 21:54 | |
*** tkelsey has quit IRC | 21:56 | |
*** stanzi has quit IRC | 21:59 | |
*** stanzi has joined #openstack-barbican | 22:00 | |
*** SheenaG11 has joined #openstack-barbican | 22:00 | |
*** SheenaG1 has quit IRC | 22:00 | |
*** stanzi has quit IRC | 22:05 | |
*** stanzi has joined #openstack-barbican | 22:05 | |
*** SheenaG11 has quit IRC | 22:05 | |
*** stanzi has quit IRC | 22:10 | |
*** stanzi has joined #openstack-barbican | 22:11 | |
*** kgriffs is now known as kgriffs|afk | 22:19 | |
rm_work | alee: yes. in fact, the implementation is here: https://review.openstack.org/#/c/132580/8/octavia/certificates/manager/barbican.py | 22:21 |
*** tdink has quit IRC | 22:28 | |
*** stanzi_ has joined #openstack-barbican | 22:33 | |
*** stanzi has quit IRC | 22:33 | |
*** ayoung is now known as ayoung-dadmode | 22:34 | |
*** stanzi_ has quit IRC | 22:41 | |
*** SheenaG1 has joined #openstack-barbican | 22:43 | |
*** dave-mccowan_ has joined #openstack-barbican | 22:45 | |
*** dave-mccowan has quit IRC | 22:47 | |
*** dave-mccowan_ is now known as dave-mccowan | 22:47 | |
*** SheenaG1 has left #openstack-barbican | 22:48 | |
*** JeffF has quit IRC | 22:58 | |
*** ryanpetrello has quit IRC | 23:00 | |
*** akoneru is now known as akoneru_afk | 23:09 | |
*** dimtruck is now known as zz_dimtruck | 23:16 | |
*** kgriffs|afk is now known as kgriffs | 23:19 | |
*** nkinder has quit IRC | 23:20 | |
*** gyee has quit IRC | 23:21 | |
*** rm_work is now known as rm_work|away | 23:22 | |
*** rm_work|away is now known as rm_work | 23:23 | |
*** ametts has quit IRC | 23:23 | |
*** jaosorior has quit IRC | 23:23 | |
*** kaitlin-farr has quit IRC | 23:26 | |
*** kgriffs is now known as kgriffs|afk | 23:29 | |
*** nkinder has joined #openstack-barbican | 23:33 | |
*** tdink has joined #openstack-barbican | 23:42 | |
*** akoneru_afk has quit IRC | 23:44 | |
*** rtom has quit IRC | 23:45 | |
*** tdink has quit IRC | 23:52 | |
*** nkinder has quit IRC | 23:56 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!