*** ametts has quit IRC | 00:14 | |
*** kebray has joined #openstack-barbican | 00:19 | |
*** ryanpetrello has joined #openstack-barbican | 00:19 | |
*** kebray has quit IRC | 00:34 | |
*** kebray has joined #openstack-barbican | 00:35 | |
*** stanzi has joined #openstack-barbican | 00:37 | |
*** Stanzi_ has joined #openstack-barbican | 00:37 | |
*** Stanzi_ has quit IRC | 00:51 | |
*** stanzi has quit IRC | 00:51 | |
*** stanzi has joined #openstack-barbican | 00:51 | |
*** Stanzi_ has joined #openstack-barbican | 00:51 | |
*** Stanzi_ has quit IRC | 00:56 | |
*** stanzi has quit IRC | 00:56 | |
*** bdpayne_ has quit IRC | 01:25 | |
*** ryanpetrello has quit IRC | 01:40 | |
*** tkelsey has joined #openstack-barbican | 01:43 | |
*** tkelsey has quit IRC | 01:47 | |
*** rm_work is now known as rm_work|away | 01:51 | |
*** ryanpetrello has joined #openstack-barbican | 01:57 | |
*** ryanpetrello has quit IRC | 02:13 | |
*** stanzi_ has joined #openstack-barbican | 02:35 | |
*** Stanzi has joined #openstack-barbican | 02:35 | |
*** stanzi_ has quit IRC | 02:43 | |
*** Stanzi has quit IRC | 02:43 | |
*** ajc_ has joined #openstack-barbican | 03:04 | |
*** ryanpetrello has joined #openstack-barbican | 03:15 | |
*** tkelsey has joined #openstack-barbican | 03:44 | |
*** ajc_ has quit IRC | 03:45 | |
*** lisa1 has joined #openstack-barbican | 03:46 | |
*** tkelsey has quit IRC | 03:49 | |
*** lisa1 has quit IRC | 03:51 | |
*** dave-mccowan has quit IRC | 04:53 | |
*** woodster_ has quit IRC | 05:00 | |
*** woodster_ has joined #openstack-barbican | 05:08 | |
*** ryanpetrello has quit IRC | 05:18 | |
*** rm_work|away is now known as rm_work | 05:21 | |
*** lisa1 has joined #openstack-barbican | 05:35 | |
*** lisa1 has quit IRC | 05:39 | |
*** rm_work is now known as rm_work|away | 05:43 | |
*** kebray_ has joined #openstack-barbican | 06:11 | |
*** kebray has quit IRC | 06:13 | |
*** jamielennox is now known as jamielennox|away | 06:25 | |
*** lisa1 has joined #openstack-barbican | 06:29 | |
*** kebray_ has quit IRC | 06:31 | |
*** lisa1 has quit IRC | 06:33 | |
*** Stanzi has joined #openstack-barbican | 06:35 | |
*** stanzi_ has joined #openstack-barbican | 06:35 | |
*** stanzi_ has quit IRC | 06:39 | |
*** Stanzi has quit IRC | 06:39 | |
*** ryanpetrello has joined #openstack-barbican | 07:03 | |
*** ryanpetrello has quit IRC | 07:07 | |
*** woodster_ has quit IRC | 07:20 | |
*** lisa1 has joined #openstack-barbican | 07:23 | |
*** lisa1 has quit IRC | 07:28 | |
*** tkelsey has joined #openstack-barbican | 07:45 | |
*** tkelsey has quit IRC | 07:50 | |
*** lisa2 has joined #openstack-barbican | 08:17 | |
*** lisa2 has quit IRC | 08:22 | |
*** david-ly_ has quit IRC | 09:32 | |
*** david-lyle has joined #openstack-barbican | 09:33 | |
*** david-lyle has quit IRC | 09:38 | |
*** dimtruck is now known as zz_dimtruck | 09:42 | |
*** lisa3 has joined #openstack-barbican | 10:06 | |
*** lisa3 has quit IRC | 10:10 | |
*** darrenmoffat has quit IRC | 10:22 | |
*** darrenmoffat has joined #openstack-barbican | 10:22 | |
*** woodster_ has joined #openstack-barbican | 13:10 | |
*** dave-mccowan has joined #openstack-barbican | 13:14 | |
*** dave-mccowan_ has joined #openstack-barbican | 13:21 | |
*** dave-mccowan has quit IRC | 13:21 | |
*** dave-mccowan_ is now known as dave-mccowan | 13:21 | |
*** lisa2 has joined #openstack-barbican | 13:50 | |
*** ryanpetrello_ has joined #openstack-barbican | 14:17 | |
*** ryanpetrello_ is now known as ryanpetrello | 14:19 | |
*** ametts has joined #openstack-barbican | 14:30 | |
*** dave-mccowan has quit IRC | 14:47 | |
*** stanzi_ has joined #openstack-barbican | 14:59 | |
*** Stanzi has joined #openstack-barbican | 14:59 | |
*** Stanzi has quit IRC | 15:00 | |
*** stanzi_ has quit IRC | 15:00 | |
*** stanzi has joined #openstack-barbican | 15:01 | |
*** Stanzi_ has joined #openstack-barbican | 15:01 | |
*** Stanzi_ has quit IRC | 15:06 | |
*** stanzi has quit IRC | 15:06 | |
*** hyakuhei has quit IRC | 15:15 | |
woodster_ | alee, reaperhulk, jvrbanac so is this CR stalled out? :) https://review.openstack.org/#/c/127353/ I figure we should work to get closure on the essential bps today if possible | 15:16 |
---|---|---|
*** dave-mccowan has joined #openstack-barbican | 15:24 | |
*** hyakuhei has joined #openstack-barbican | 15:28 | |
*** jorge_munoz has joined #openstack-barbican | 15:31 | |
*** lisa2 has quit IRC | 15:35 | |
alee | woodster_, I'll try to get a new version up shortly. Let me check to see if there are still areas that are undetermined. | 15:37 |
woodster_ | alee, sounds good | 15:39 |
*** kebray has joined #openstack-barbican | 15:53 | |
*** zz_dimtruck is now known as dimtruck | 15:55 | |
*** atiwari has joined #openstack-barbican | 16:01 | |
*** lisa2 has joined #openstack-barbican | 16:02 | |
*** paul_glass has joined #openstack-barbican | 16:10 | |
*** lisa2 has quit IRC | 16:50 | |
*** kebray has quit IRC | 16:57 | |
*** kebray has joined #openstack-barbican | 16:58 | |
*** gyee has joined #openstack-barbican | 16:58 | |
*** rm_work|away is now known as rm_work | 17:03 | |
rm_work | yeah, we need that one pretty badly <_< | 17:04 |
*** lisa2 has joined #openstack-barbican | 17:05 | |
rm_work | woodster_: so on my bugfix change, it should actually be a change to mime_types.py to make the method we use for content_types read from the metadata instead?\ | 17:07 |
*** lisa2 has quit IRC | 17:12 | |
*** lisa2 has joined #openstack-barbican | 17:13 | |
*** lisaclark has joined #openstack-barbican | 17:18 | |
*** atiwari has quit IRC | 17:37 | |
*** lisaclark has quit IRC | 17:38 | |
*** lisa2 has quit IRC | 17:41 | |
*** kebray has quit IRC | 17:41 | |
woodster_ | rm_work: I believe so, so non-HSM secret gets work correctly. I think you should still pass along the content type to the store_crytpo flow though as you are doing in that CR. Eventually we need to not put that data in two places :\ | 17:48 |
rm_work | err so keep the change I added, but ALSO fixed mime_types.py to load from the other location? | 17:49 |
woodster_ | rm_work, well do the minimum you need to fix the problem, but it hopefully supports secret gets for secret_stores and HSM stores. | 17:52 |
rm_work | k | 17:55 |
rm_work | is it possible for me to test that easily? I don't know if those require licenses or something | 17:56 |
*** kebray has joined #openstack-barbican | 17:56 | |
*** bdpayne has joined #openstack-barbican | 18:10 | |
openstackgerrit | Adam Harwell proposed openstack/barbican: Fix content_type loading to be consistent https://review.openstack.org/142895 | 18:29 |
rm_work | woodster_: ^^ | 18:29 |
alee | woodster_, ping | 18:31 |
alee | redrobot, ping | 18:32 |
alee | dave-mccowan, ping | 18:32 |
rm_work | alee: ^^ | 18:39 |
woodster_ | alee, pong. Btw, redrobot is in his homeland for the next 2-3 weeks | 18:40 |
rm_work | woodster_: you want secret_metadata to be authoritative over encrypted_data? | 18:41 |
rm_work | woodster_: I figured it would be fine to cascade, and that since the encrypted_data content_types are more "fine-grained" (it seems?) they would be authoritative | 18:41 |
woodster_ | rm_work: yes. All secret_store plugins should put content-type in the metadata. The HSM plugins (a sub-set of secret-store) will also store it in the encrxypted datum, but that needs to be removed at some point (not for this CR). | 18:42 |
rm_work | but if you'd rather ignore anything in encrypted_data and ONLY read from secret_metadata, that is fine by me, as long as you don't think it'll break anything | 18:42 |
woodster_ | rm_work: you should ignore it just for that method call. No need to cascade to encrypted datum...that is legacy code in there that needs to go. | 18:43 |
rm_work | woodster_: is it *possible* for a secret to not have secret_store_metadata? | 18:43 |
rm_work | I was going to swap the "if not secret.encrypted_datum" with "if not secret.secret_store_metadata" | 18:43 |
rm_work | but I guess possibly that's redundant? | 18:43 |
woodster_ | rm_work, so this line is called for all plugin types (except for 1st step of 2-step secret): https://github.com/openstack/barbican/blob/master/barbican/plugin/resources.py#L355 | 18:46 |
woodster_ | rm_work so content_type is stamped on all stored secrets (that have encrxypted data that is) | 18:46 |
woodster_ | rm_work, the swap sounds good...so no more encrypted_datum logic in that method is needed then | 18:47 |
alee | woodster_, so - just looking over the per-secret spec | 18:49 |
alee | woodster_, there are not a lot edits I need to make -- its mostly deciding what we need to do for kilo and beyond | 18:50 |
alee | woodster_, if its decided -- then I can specify that .. | 18:50 |
rm_work | woodster_: and # TODO(jwood): How deal with merging more than one datum instance? | 18:51 |
rm_work | is no longer valid, right? | 18:51 |
alee | 1. only do get request whitelist for kilo. more detailed acls later (decided?) | 18:51 |
alee | 2. for kilo do project access only .. change default for v2 for L or later (decided?) | 18:52 |
alee | 3. defer concerns on delete for creator till L (decided?) | 18:53 |
alee | 4. seems we have decided on mutable acls | 18:54 |
alee | woodster_, if all is decided as above, I can write it as such in a new version of the spec. | 18:55 |
woodster_ | rm_work: yep you can remove to do | 18:56 |
woodster_ | alee: that sounds right. So if whitelist it only applies to get calls. Project that created secret can still do current operations | 18:59 |
alee | woodster_, right -- ok- thats the way I'll write it up then | 18:59 |
woodster_ | rm_work: ^^^ as this pertains to lbaas use case too | 19:00 |
*** openstack has joined #openstack-barbican | 19:08 | |
rm_work | hmm | 19:08 |
rm_work | alee: one interesting thing is, I'd probably want to tie consumer POST/DELETE requests to the GET whitelist | 19:08 |
rm_work | but I hope that'd be easy | 19:08 |
rm_work | that or, something more complicated requiring a service-account + GET access | 19:08 |
*** woodster_ has joined #openstack-barbican | 19:08 | |
*** openstackstatus has joined #openstack-barbican | 19:09 | |
*** ChanServ sets mode: +v openstackstatus | 19:09 | |
alee | rm_work, hmm | 19:09 |
*** dougwig has joined #openstack-barbican | 19:09 | |
rm_work | the "something more complicated" requires keystone composite-tokens to work | 19:10 |
alee | rm_work, I dont think it will be too hard to do the simple case -- ie. tie consumer POST/DELETE requests to the GET whitelists | 19:14 |
rm_work | yeah | 19:14 |
alee | rm_work, I'll add a note about that in the spec for something to do in a follow-on spec | 19:14 |
rm_work | k | 19:14 |
alee | I think things will be much clearer once we have a framework there. | 19:15 |
rm_work | hopefully | 19:15 |
*** rm_you has quit IRC | 19:16 | |
*** rm_you has joined #openstack-barbican | 19:17 | |
rm_work | woodster_: lol, bunch of tests fail now because they don't set up secret_store_metadata | 19:17 |
woodster_ | rm_work: really? Are they older hsm ones? | 19:19 |
woodster_ | rm_work: also can you run server locally then run the bin/demo script successfully? | 19:21 |
rm_work | this is one: /barbican/tests/api/test_resources.py", line 1118, in test_should_get_secret_meta_for_binary_with_tkey | 19:21 |
rm_work | trying that | 19:22 |
rm_work | hmm no, that script fails | 19:22 |
rm_work | :/ | 19:22 |
rm_work | but not on anything that makes sense for my change <_< | 19:22 |
*** jorge_munoz has quit IRC | 19:25 | |
*** jorge_munoz has joined #openstack-barbican | 19:25 | |
rm_work | yeah WhenGettingPuttingOrDeletingSecretUsingSecretResource does not initialize any secret_meta | 19:28 |
woodster_ | rm_work, that's a bit odd for sure (on the bin/demo... script error) | 19:33 |
alee | woodster_, rm_work where is the link with the details on the mid-cycle? | 19:35 |
alee | found it -- https://wiki.openstack.org/wiki/Sprints/BarbicanKiloSprint | 19:40 |
alee | dave-mccowan, ^^ | 19:40 |
*** lisa1 has joined #openstack-barbican | 19:42 | |
dave-mccowan | alee, thanks | 19:42 |
alee | np | 19:42 |
alee | woodster_, ping | 19:44 |
dave-mccowan | is there a favorite hotel? | 19:44 |
alee | dave-mccowan, SheenaG has been arranging a group rate at a downtown hotel -- the Omni I believe. | 19:45 |
woodster_ | rm_work, yeah that an old test...it really need to add the content-type to secret metadata dict if the encrypted_data passed to create_secret() has that on there | 19:45 |
alee | dave-mccowan, the rate will be around $240/night | 19:45 |
woodster_ | alee, hwllo | 19:45 |
rm_work | woodster_: yeah fixed it | 19:45 |
alee | woodster_, so -- on the per secret thing .. | 19:45 |
woodster_ | rm_work, nice! Is the demo script still not working though? | 19:46 |
rm_work | woodster_: going to look at that next | 19:46 |
alee | line 173 | 19:46 |
*** lisa1 has quit IRC | 19:46 | |
alee | doe sit make sense to rename the parameters there read_users? read_groups? | 19:46 |
alee | read_projects? | 19:46 |
alee | instead of allowed? | 19:46 |
alee | in anticipation of having more detailed acls in future? | 19:47 |
alee | or just leave it as allowed_users? | 19:47 |
woodster_ | alee, that makes sense, unless the thinkng is that per user/group/project you give a list of actions they can do? | 19:48 |
woodster_ | ...in the future that is | 19:48 |
alee | rigtht .. | 19:49 |
alee | woodster_, here is an example of an acl in dogtag -- | 19:50 |
alee | resourceACLS: certServer.general.configuration:read,modify,delete:allow (read) group="Administrators" || group="Auditors" || group="Certificate Manager Agents" || group="Registration Manager Agents";allow (modify,delete) group="Administrators":Administrators, auditors, and agents are allowed to read CMS general configuration but only administrators are allowed to modify and delete | 19:50 |
*** ryanpetrello has quit IRC | 19:50 | |
alee | grouping is done per operation | 19:50 |
alee | but I guess you really could go either way | 19:51 |
*** ryanpetrello has joined #openstack-barbican | 19:51 | |
alee | woodster_, I'm going to need to step out for a bit -- kids christmas party/concert -- and I'm off for the rest of the year as of next week. | 19:53 |
alee | but I'll try get a new version out of the spec and my cert api patches over the next day or so. | 19:54 |
woodster_ | alee that sounds good, enjoy the party! Today is my last day of the year officially anyway | 19:54 |
alee | mine too :) | 19:54 |
*** alee is now known as alee_afk | 19:55 | |
*** alee_afk has quit IRC | 20:04 | |
rm_work | woodster_: nice, me too :P | 20:16 |
woodster_ | rmwork Douglas said you were running the IRC meeting on Monday | 20:18 |
rm_work | lolol | 20:18 |
woodster_ | rmwork just kidding, chellygel is | 20:18 |
rm_work | nice | 20:18 |
rm_work | I might show up | 20:19 |
rm_work | I am trying to get one of my friends a commit in OpenStack, so I may be picking up another bugfix next week on my offtime to help him get started :P | 20:19 |
woodster_ | rm_work, nice! | 20:24 |
rm_work | ugh some of these tests are kinda WTF | 20:25 |
rm_work | still working through fixing them | 20:25 |
*** lisa1 has joined #openstack-barbican | 20:36 | |
*** gyee has quit IRC | 20:39 | |
*** lisa1 has quit IRC | 20:41 | |
chellygel | hope chellygel doesnt forget to do the meeting >_> | 20:41 |
rm_work | chellygel: I'm sure she'll remember | 20:46 |
rm_work | woodster_: does the demo thing work for you? i don't think it will | 20:46 |
rm_work | delete_entity_by_id() takes exactly 3 arguments (2 given) | 20:47 |
rm_work | 2014-12-19 12:46:56.838 51038 TRACE barbican.api.controllers | 20:47 |
rm_work | err | 20:47 |
rm_work | File "/Users/adam6424/IdeaProjects/barbican/barbican/api/controllers/containers.py", line 89, in on_delete | 20:47 |
rm_work | self.consumer_repo.delete_entity_by_id(consumer.id) | 20:47 |
rm_work | so I assume something was updated in a past patch (possibly my fault?) that broke this | 20:47 |
rm_work | I assume the demo will be broken on anything | 20:48 |
woodster_ | rm_work: hmmmm, I think that I've fixed that in my oslo I18n CR hanging around out there. I didn't think it was being tested though. Doing way to many things at once of late :\ | 20:48 |
woodster_ | rm_work: well, if it is passing the basic secret/container crud stuff, that should be ok for your CR. Mine should addess the consumers issue then | 20:49 |
rm_work | woodster_: it's hard to tell since it breaks on like the fourth test and bails | 20:49 |
woodster_ | rm_work, i was more concerned that removing the content-type broke something else | 20:49 |
rm_work | right now I am trying to figure out how my change causes this other test to get a 500 | 20:49 |
rm_work | test_should_raise_to_put_secret_with_unsupported_encoding | 20:50 |
rm_work | doesn't even make sense | 20:51 |
*** gyee has joined #openstack-barbican | 20:55 | |
rm_work | ah got it | 20:56 |
rm_work | my bad | 20:56 |
woodster_ | rm_work thanks for tracking that stuff down | 20:57 |
rm_work | new patchset | 20:57 |
rm_work | if you want to review it before you pop off... err, momentarily | 20:57 |
openstackgerrit | Adam Harwell proposed openstack/barbican: Fix content_type loading to be consistent https://review.openstack.org/142895 | 20:58 |
rm_work | ah and i see the problem, need to pass keystone_id now to the consumer_repo | 21:00 |
rm_work | cool, yep, passes with that fixed, but I'll leave that out and let that fix be merged in your patch elsewhere | 21:00 |
*** darrenmoffat has quit IRC | 21:17 | |
rm_work | woodster_: why is this still stuck? | 21:20 |
rm_work | https://review.openstack.org/#/c/140811/ | 21:20 |
rm_work | you rechecked once... | 21:20 |
woodster_ | I have no idea | 21:20 |
rm_work | 100% of the tests are failing for dsvm | 21:21 |
rm_work | <_< | 21:21 |
rm_work | all with the same error | 21:21 |
rm_work | JSONDecodeError: Expecting value: line 1 column 1 (char 0) | 21:21 |
rm_work | <_< | 21:21 |
rm_work | ie, no response from server | 21:22 |
*** crc32 has joined #openstack-barbican | 21:30 | |
woodster_ | rm_work, yeah, it was working, and then once it got the workflow +1, it started breaking | 21:32 |
rm_work | T_T | 21:33 |
rm_work | makes little sense | 21:33 |
rm_work | it's re-running again now... | 21:33 |
rm_work | check gate == workflow gate | 21:33 |
rm_work | so I don't know why it'd break all the sudden | 21:33 |
woodster_ | rm_work: that work came out of just updating a bunch of messages for i18n and then getting unit tests to cover the broke cover gate. It has been an ordeal to get those CRs landed | 21:34 |
rm_work | yeah | 21:34 |
rm_work | hopefully this one transitions soon from "on approach" :) | 21:34 |
woodster_ | now can't get on Vpn for some reason...going to thera-boot my machine.... | 21:35 |
rm_work | watching https://jenkins03.openstack.org/job/gate-barbican-devstack-dsvm/249/console hopefully | 21:35 |
rm_work | if only devstack didn't take 15m to spin up :( | 21:35 |
rm_work | woodster_: looks like it passed this time O_o | 21:38 |
rm_work | so I guess it's about 20 seconds from merging | 21:38 |
woodster_ | rm_work: wow, 3rd (or 4th/5th?) times the charm, thanks! | 21:40 |
rm_work | heh, hopefully not the same situation as my 20+ retry commit where something was ACTUALLY broken :P | 21:41 |
rm_work | oh god it has to run the test AGAIN!? | 21:43 |
woodster_ | why?? | 21:44 |
*** darrenmoffat has joined #openstack-barbican | 21:45 | |
rm_work | recheck causes it to re-run the "check" check, now it passed that so it's willing to run the "gate" check again >_< | 21:45 |
*** dave-mccowan has quit IRC | 21:50 | |
*** alee_afk has joined #openstack-barbican | 21:55 | |
openstackgerrit | Merged openstack/barbican: Add I18n-related unit tests (Part 2) https://review.openstack.org/140811 | 21:57 |
*** ryanpetrello_ has joined #openstack-barbican | 21:58 | |
*** bdpayne_ has joined #openstack-barbican | 21:59 | |
rm_work | woodster_: ^^ cool | 22:00 |
*** ryanpetrello has quit IRC | 22:01 | |
*** ryanpetrello_ is now known as ryanpetrello | 22:01 | |
*** bdpayne has quit IRC | 22:02 | |
*** dave-mccowan has joined #openstack-barbican | 22:06 | |
*** dave-mccowan_ has joined #openstack-barbican | 22:10 | |
*** dave-mccowan has quit IRC | 22:11 | |
*** dave-mccowan_ is now known as dave-mccowan | 22:11 | |
*** ryanpetrello has quit IRC | 22:13 | |
rm_work | woodster_: now re-review my thing :P https://review.openstack.org/#/c/142895/ | 22:13 |
woodster_ | rm_work, nice! I thought that would never make it to master | 22:15 |
woodster_ | rm_work, thanks for the updated CR. So would you be up for helping with the per-secret RBAC work should that blueprint ever land? :) | 22:18 |
rm_work | *possibly* | 22:18 |
rm_work | It's something I could probably justify | 22:18 |
rm_work | but I don't know much about how RBAC works | 22:18 |
rm_work | I've been faking it up to now :P | 22:18 |
rm_work | always time to learn though | 22:19 |
woodster_ | rm_work, you focus on the lbaas-interaction aspects initially, and that would get a lot of the scaffolding up for the feature overall | 22:20 |
rm_work | k | 22:25 |
rm_work | I'll look into it once the spec lands (and once I have a chance to talk about it during sprint planning) :P | 22:25 |
*** paul_glass has quit IRC | 22:40 | |
*** ayoung has quit IRC | 22:57 | |
woodster_ | rm_work: I meant you 'could' focus... up above there | 23:05 |
*** rm_work is now known as rm_work|away | 23:20 | |
*** ametts has quit IRC | 23:21 | |
*** lisa1 has joined #openstack-barbican | 23:35 | |
*** lisaclark has joined #openstack-barbican | 23:36 | |
*** lisaclark has quit IRC | 23:39 | |
*** lisa1 has quit IRC | 23:40 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!