Tuesday, 2015-02-03

*** rtom has joined #openstack-barbican00:01
*** kgriffs is now known as kgriffs|afk00:07
*** rm_work is now known as rm_work|away00:16
*** zz_dimtruck is now known as dimtruck00:17
*** kebray has quit IRC00:34
*** rtom has quit IRC00:39
*** chipmanc has joined #openstack-barbican00:41
*** jraim has quit IRC01:09
*** briancurtin has quit IRC01:11
*** jraim has joined #openstack-barbican01:14
*** briancurtin has joined #openstack-barbican01:18
*** lisaclark1 has quit IRC01:18
openstackgerritSteve Heyman proposed openstack/barbican: Add the ability to use either identity v2 or v3 API  https://review.openstack.org/15227701:18
openstackgerritSteve Heyman proposed openstack/barbican: Add the ability to use either identity v2 or v3 API  https://review.openstack.org/15227701:32
*** bdpayne has quit IRC01:40
*** gyee has quit IRC01:45
*** kgriffs|afk is now known as kgriffs01:46
*** rm_you|wtf has left #openstack-barbican01:54
*** rm_you|wtf has joined #openstack-barbican01:54
*** kgriffs is now known as kgriffs|afk01:55
*** SheenaG1 has joined #openstack-barbican02:18
*** crc32 has joined #openstack-barbican02:31
*** crc32 has quit IRC02:31
*** crc32 has joined #openstack-barbican02:36
*** jkf has quit IRC02:45
*** crc32 has quit IRC02:52
*** crc32 has joined #openstack-barbican02:54
*** rm_you| has joined #openstack-barbican02:55
*** rm_you|wtf has quit IRC02:56
*** SheenaG1 has quit IRC02:59
*** chipmanc has quit IRC03:04
*** kebray has joined #openstack-barbican03:06
*** crc32 has quit IRC03:08
*** kebray has quit IRC03:08
*** chipmanc has joined #openstack-barbican03:09
*** kebray has joined #openstack-barbican03:13
*** ajc_ has joined #openstack-barbican03:20
*** kgriffs|afk is now known as kgriffs03:35
*** kgriffs is now known as kgriffs|afk03:44
*** xaeth_afk is now known as xaeth03:47
*** crc32 has joined #openstack-barbican03:59
*** cchipman has joined #openstack-barbican04:00
*** chipmanc has quit IRC04:01
*** kgriffs|afk is now known as kgriffs04:35
*** rm_you has joined #openstack-barbican04:38
*** rm_you has quit IRC04:38
*** rm_you has joined #openstack-barbican04:38
*** rm_you| has quit IRC04:39
*** cchipman has quit IRC04:41
*** kgriffs is now known as kgriffs|afk04:45
*** xaeth is now known as xaeth_afk05:18
*** Nirupama has joined #openstack-barbican05:35
*** dougwig has quit IRC05:38
*** dougwig has joined #openstack-barbican05:38
*** erw has quit IRC05:55
*** erw has joined #openstack-barbican05:55
*** jaosorior has joined #openstack-barbican06:09
openstackgerritOpenStack Proposal Bot proposed openstack/barbican: Imported Translations from Transifex  https://review.openstack.org/15240306:10
*** kgriffs|afk is now known as kgriffs06:24
*** kgriffs is now known as kgriffs|afk06:34
*** nkinder has joined #openstack-barbican07:22
jaosoriorjamielennox: ping07:43
*** chlong has quit IRC07:56
*** kgriffs|afk is now known as kgriffs08:13
jamielennoxjaosorior: if it's relatively quick...08:16
jaosoriorjust a quick ping about your CRs in python-barbicanclient. You pushed some really good stuff there, but it doesn't pass the gate, got some time for them any time soon?08:19
*** kgriffs is now known as kgriffs|afk08:22
*** darrenmoffat has joined #openstack-barbican08:42
*** woodster_ has quit IRC08:46
*** kebray has quit IRC09:16
*** kgriffs|afk is now known as kgriffs10:02
*** kgriffs is now known as kgriffs|afk10:11
*** darrenmoffat has left #openstack-barbican10:40
*** tkelsey has joined #openstack-barbican11:05
*** kgriffs|afk is now known as kgriffs11:50
*** Nirupama has quit IRC11:56
*** kgriffs is now known as kgriffs|afk12:00
*** chlong has joined #openstack-barbican12:06
*** woodster_ has joined #openstack-barbican12:41
*** tkelsey_ has joined #openstack-barbican12:49
*** crc32 has quit IRC12:57
*** tkelsey has quit IRC12:57
*** ajc_ has quit IRC12:58
openstackgerritTim Kelsey proposed openstack/barbican-specs: Adding spec for Barbican MKEK Model.  https://review.openstack.org/14894813:32
tkelsey_thanks jaosorior13:36
*** tkelsey_ is now known as tkelsey13:37
*** alee has quit IRC13:44
jaosoriortkelsey: no prob14:27
*** dimtruck is now known as zz_dimtruck14:30
*** ajc_ has joined #openstack-barbican14:31
*** lisaclark1 has joined #openstack-barbican14:33
*** woodster_ has quit IRC14:46
*** zz_dimtruck is now known as dimtruck14:57
*** alee has joined #openstack-barbican14:59
*** rm_work|away is now known as rm_work15:10
*** xaeth_afk is now known as xaeth15:13
*** paul_glass has joined #openstack-barbican15:13
*** woodster_ has joined #openstack-barbican15:16
*** lisaclark1 has quit IRC15:20
*** lisaclark1 has joined #openstack-barbican15:25
openstackgerritMerged openstack/castellan: Add openstack/common log and policy modules  https://review.openstack.org/15137115:27
*** kgriffs|afk is now known as kgriffs15:31
*** kgriffs is now known as kgriffs|afk15:32
*** kgriffs|afk is now known as kgriffs15:32
*** lisaclark1 has quit IRC15:39
rm_workhockeynut: let me know when you're around15:39
openstackgerritMerged openstack/barbican: Trivial refactors to secret controller  https://review.openstack.org/15167015:41
openstackgerritMerged openstack/barbican: Add support for simple cmc requests to Dogtag plugin  https://review.openstack.org/14661115:41
openstackgerritMerged openstack/barbican: Imported Translations from Transifex  https://review.openstack.org/15240315:47
*** ajc_ has quit IRC15:56
*** atiwari has quit IRC16:01
woodster_arunkant, alee, rm_work I added comments to the per secret CR. Arun, please see if that helps with your concerns.16:11
rm_workhmm k16:11
*** kebray has joined #openstack-barbican16:13
rm_workwoodster_ / alee: basically I am good with it once you make the changes you promised :)16:16
jaosorioris anybody here acquainted with tempest?16:17
rm_workjaosorior: working on it... that is actually why we need to talk to hockeynut :P16:17
rm_workjaosorior: you trying to figure out tempest tests currently?16:17
rm_workjaosorior: there's a whole group of us sitting in a room at our hackathon for neutron-lbaas, all beating our heads against tempest and trying to figure out how to start our project's first set of tempest tests16:18
aleerm_work, woodster_ arunkant -- I'll try get a new versioin out today16:19
jaosoriorrm_work: Well, do you know what the process is for... if a change will actually change how tempest expects things to be (say an API change or something of the sort) what's the process you have to follow?16:20
*** SheenaG1 has joined #openstack-barbican16:21
*** TobiasE has joined #openstack-barbican16:21
*** bdpayne has joined #openstack-barbican16:28
*** dimtruck is now known as zz_dimtruck16:28
*** zz_dimtruck is now known as dimtruck16:33
*** lisaclark1 has joined #openstack-barbican16:35
*** SheenaG11 has joined #openstack-barbican16:36
hockeynutrm_work o/16:37
rm_workcool, talk to fnaval16:37
hockeynutrm_work ok - in meetings now, will check in with him16:37
*** lisaclark1 has quit IRC16:37
rm_work:P16:37
rm_workhe'll PM you16:38
*** lisaclark1 has joined #openstack-barbican16:38
*** crc32 has joined #openstack-barbican16:38
*** SheenaG1 has quit IRC16:38
rm_workhockeynut: oh actually I have a question too -- in a devstack install, what credentials are the functionaltests trying to use? I'm getting InvalidCredentials exceptions in all the tests16:40
rm_workI have all the admin stuff set in /etc/tempest/tempest.conf16:41
rm_workI have: admin_username=admin16:42
rm_workadmin_tenant_name=admin16:42
rm_workadmin_password=password16:42
rm_workthat used to be all I needed to set16:42
hockeynutrm_work see barbican/etc/dev_tempest.conf16:50
rm_workhockeynut: talking to tdink_ and it looks like the whole way the tests run has changed since I last did this :P16:50
hockeynutrm_work he's in the same meeting with me.  Are you talking about running locally or in the gate?16:52
rm_workin my devstack VM16:52
hockeynutI think tdink is talking about an issue we've seen with tempest not finding the config file (happens when you run locally in a clean virtualenv)16:55
hockeynuttdink_ ^^16:55
tdink_that is correct, but not sure what might happen with run_tests. i havnt had a change to use runtests since i started getting the problems with credentials in tox16:56
hockeynuttdink_ has a workaround - rm_work you can give it a try and see if that solves your issue.16:57
arunkantwoodster_, still did not follow the creator_rbac_only flag behavior difference. If that flag is False and there are whitelist ACL ids, it still bypasses project-based rbac . So what is difference?16:58
*** TobiasE has left #openstack-barbican16:58
arunkantwoodster_, for that CR, I am assuming creator_rbac_only flag is to indicate private nature of secret or container when True.17:00
*** crc32 has quit IRC17:08
openstackgerritMerged openstack/barbican: Add the ability to use either identity v2 or v3 API  https://review.openstack.org/15227717:08
woodster_arunkant, when it is False, then the current RBAC would be used, per 'current_perms and not_creator_only'.  If the whitelist is also available, then there is an OR clause on that as well17:11
woodster_alee, rm_work: ^^^17:11
*** crc32 has joined #openstack-barbican17:11
woodster_arunkant, I think that is reasonable behavior, as the whitelist could only be there if the creator user adds stuff there17:12
aleewoodster_, arunkant reading comments here and in BP ..17:14
*** kebray has quit IRC17:16
*** kebray has joined #openstack-barbican17:17
aleearunkant, woodster_ think of the whitelist as applying only to users/projects/groups that ordinarily would not have access to the secret because they are not part of the secret creators project.17:17
aleethese users/projects/groups would be granted access if they are whitelisted17:18
aleein that way, the whitelist allows you to expand the access list of a secret.17:18
woodster_jaosorior, alee: Just noting that Venkat has a new version for the quota BP here: https://review.openstack.org/#/c/132091/17:18
jaosoriorI saw, haven't had a chance to review it17:19
rm_worktdink_: ok cool, combination of switching to tox and copying the barbican example tempest conf into /etc/tempest.conf worked17:19
aleeif the whitelist is empty, that the standard acls apply and only those in the creator's project are able to view the secret.17:19
tdink_rm_work: Woohoo!17:20
aleearunkant, woodster_ - the creator_only -- or creator_rbac_only if you prefer flag is a way to restrict the access of the users that would ordinarily be able to get the secret.17:20
aleearunkant, woodster_ - so instead of the creator's project being able to access the secret, only the creator would able to do so.17:21
aleearunkant, woodster_ if you wanted only the creator to be able to access a secret, you would need to set creator_only and whitelist empty.17:22
*** crc32 has quit IRC17:22
arunkantalee: So if that flag is True (I am assuming its a private secret case), and whitelist of ids is there..will those users from whitelist will be able to access that secret ?17:23
aleearunkant, woodster_ -- yes17:23
*** jkf has joined #openstack-barbican17:23
aleearunkant, woodster_ remember you are specifically allowing whitelist users - so presumably you know what you're doing17:23
arunkantalee: Then how its different from that flag being False (not a private secret case)..whitelist id seems to always override17:24
aleearunkant, woodster_ noone may ever configure it this way, but it gives us flexibility in case anyone needs it17:24
aleearunkant, whitelist does in fact always override.  the difference is for users not on the whitelist17:25
*** nkinder has quit IRC17:25
aleearunkant, woodster_  if flag is false, you allow access to users on whitelist and users in the secret creators project.17:26
arunkantalee: I think..I am confused what is the access level for private or non-private case..if whitelist is always overriding..then still not getting what is the difference. I was thinking..once private flag is True, then override list would not allowed or not looked into for authorization17:26
aleeif flag is true -- then you allow access to members of whitelist and only creator17:27
arunkantokay..if flag is false..then ?17:27
arunkantI mean private flag is false17:28
aleearunkant, woodster_  if flag is false, you allow access to users on whitelist and users in the secret creators project.17:28
arunkantalee, Okay so difference is project-based rbac is disabled or enabled based on flag is True or False. Other access rules remain same...So it private for other users in the same project which has necessary roles17:31
arunkants/private for/ private from17:31
aleeright17:31
aleearunkant, I like it because it gives us what we need and flexibility for someone to specify other accesses using whitelist as needed17:32
*** crc32 has joined #openstack-barbican17:32
arunkantOkay..thanks..now I understand it, it makes sense17:32
*** crc32 has quit IRC17:32
aleecool17:33
aleearunkant, we're going to need a good tech writer to doc it all :)17:33
*** lisaclark1 has quit IRC17:33
arunkantalee, yes and it will fun to write policy rules around this :)17:34
arunkantalee, another question on same CR..what are groups ?17:36
*** atiwari has joined #openstack-barbican17:45
*** jkf has quit IRC17:59
*** jkf has joined #openstack-barbican18:02
*** alee is now known as alee_lunch18:11
*** kgriffs is now known as kgriffs|afk18:18
*** crc32 has joined #openstack-barbican18:18
*** lisaclark1 has joined #openstack-barbican18:30
*** SheenaG11 has quit IRC18:49
*** jkf has quit IRC18:53
*** alee_lunch is now known as alee18:54
*** SheenaG1 has joined #openstack-barbican18:54
*** jkf has joined #openstack-barbican18:55
woodster_alee, arunkant, just catching up on the conversations...19:14
*** kgriffs|afk is now known as kgriffs19:28
*** SheenaG11 has joined #openstack-barbican19:28
*** lisaclark1 has quit IRC19:28
*** lisaclark1 has joined #openstack-barbican19:30
*** dimtruck is now known as zz_dimtruck19:30
*** lisaclark1 has quit IRC19:31
*** SheenaG1 has quit IRC19:31
*** lisaclark1 has joined #openstack-barbican19:31
*** tkelsey has quit IRC19:37
*** lisaclark1 has quit IRC19:43
*** lisaclark1 has joined #openstack-barbican19:52
*** zz_dimtruck is now known as dimtruck19:53
rm_workheyo20:03
rm_work+A maybe? https://review.openstack.org/#/c/125798/20:03
*** chlong has quit IRC20:05
rm_work^_^20:06
*** jorge_munoz has joined #openstack-barbican20:28
*** anteaya has quit IRC20:34
*** kgriffs is now known as kgriffs|afk20:35
*** lisaclark1 has quit IRC20:40
*** lisaclark1 has joined #openstack-barbican20:45
*** lisaclark1 has quit IRC20:50
*** openstackgerrit has quit IRC20:50
*** openstackgerrit has joined #openstack-barbican20:51
*** anteaya has joined #openstack-barbican20:53
*** kgriffs|afk is now known as kgriffs21:01
hockeynutrm_work To be clear:21:03
hockeynut1) today's API will still work21:03
hockeynut2) if you use the additional /payload path then the new semantics apply.21:03
*** dimtruck is now known as zz_dimtruck21:03
rm_workhockeynut: yes21:04
hockeynutgracias!21:05
*** kebray has quit IRC21:05
rm_workbeen waiting on this since October 2 <_<21:06
*** zz_dimtruck is now known as dimtruck21:11
*** SheenaG12 has joined #openstack-barbican21:37
*** SheenaG11 has quit IRC21:39
*** kgriffs is now known as kgriffs|afk21:53
*** kgriffs|afk is now known as kgriffs21:54
*** kebray has joined #openstack-barbican22:00
*** kgriffs is now known as kgriffs|afk22:03
*** nkinder has joined #openstack-barbican22:04
*** lisaclark1 has joined #openstack-barbican22:07
*** lisaclark1 has quit IRC22:10
*** nkinder has quit IRC22:12
*** kebray has quit IRC22:12
*** kgriffs|afk is now known as kgriffs22:19
*** rm_work is now known as rm_work|away22:19
*** SheenaG12 has quit IRC22:20
*** crc32 has quit IRC22:22
*** alee has quit IRC22:24
*** lisaclark1 has joined #openstack-barbican22:25
*** klep has joined #openstack-barbican22:32
klepgreetings. Just starting to try to learn barbican. I was wondering what the best method to store and retrieve ssh keys is. any advice?22:33
*** kebray has joined #openstack-barbican22:35
*** crc32 has joined #openstack-barbican22:36
*** lisaclark1 has quit IRC22:45
*** rm_work|away is now known as rm_work23:06
*** xaeth is now known as xaeth_afk23:06
*** kgriffs is now known as kgriffs|afk23:07
*** briancurtin has quit IRC23:08
*** codekobe has quit IRC23:09
*** kgriffs|afk is now known as kgriffs23:10
*** jraim has quit IRC23:10
*** alee has joined #openstack-barbican23:14
*** jaosorior has quit IRC23:16
*** jraim has joined #openstack-barbican23:21
*** kgriffs is now known as kgriffs|afk23:22
*** kgriffs|afk is now known as kgriffs23:23
woodster_klep, you can spin up on Barbican this wiki page: http://docs.openstack.org/developer/barbican/setup/dev.html  After that, you could try some of the example curl commands here: https://github.com/cloudkeep/barbican/wiki/Barbican-Quick-Start-Guide#store-and-retrieve-a-secret-one-step23:27
*** codekobe has joined #openstack-barbican23:29
klepwoodster_: I checked out both links. It was just unclear how to use this for SSH key storage or what the best practices were in those regards23:29
rm_workdamnit hockeynut T_T23:30
rm_work"This is going to be a big win for usability!", -123:30
*** briancurtin has joined #openstack-barbican23:33
woodster_klep, I'm not sure about best practices. If you have a file with the binary key you wish to upload to Barbican for later retrieval, you could either base64 encode it and use this call (https://github.com/cloudkeep/barbican/wiki/Application-Programming-Interface#post) or else use the two step approach to allow upload of your secret23:34
woodster_(https://github.com/cloudkeep/barbican/wiki/Application-Programming-Interface#post)23:34
rm_workwoodster_: can you update https://review.openstack.org/#/c/125798/ for hockeynut?23:35
woodster_klep there is also a python client library that interacts with a Barbican endpoint23:35
klepwoodster_: thanks23:35
woodster_rm_work I;ll take a look23:35
rm_workklep: if you have easy access to spin up new VMs, https://wiki.openstack.org/wiki/BarbicanDevStack#The_Easy_Way makes it easy easy23:35
woodster_klep, you can do similar operations with plain text secrets23:35
klepI was hoping there would be a way to store a secret and retrieve it by name potentially23:37
woodster_klep this also has devstack information: http://docs.openstack.org/developer/barbican/setup/devstack.html23:37
klepcool23:37
rm_workklep: you can filter by secret name on the GET23:41
rm_workso that could work23:41
rm_workbut it'd take two calls, one to get the filtered list, and one to get the actual secret23:41
woodster_klep, all resources in barbican are accessed via their unique UUIDs. rm_work beat me to it regarding the query-parameter filter possible on secret GETs.23:41
*** paul_glass has quit IRC23:41
klepahhhhh cool. I'm going to try some of this outThanks for the help. I'll probably be bugging you again : ) Very fun stuff23:42
woodster_klep no problem please let us know if you run into issues23:43
*** crc32 has quit IRC23:43
*** dimtruck is now known as zz_dimtruck23:52
*** lisaclark1 has joined #openstack-barbican23:52
openstackgerritJohn Wood proposed openstack/barbican-specs: Change GET decrypted secrets to unique URI  https://review.openstack.org/12579823:53
rm_workwoo23:53
*** jkf has quit IRC23:54
*** rm_work is now known as rm_work|away23:54
openstackgerritJohn Wood proposed openstack/barbican-specs: Change GET decrypted secrets to unique URI  https://review.openstack.org/12579823:55
*** kgriffs is now known as kgriffs|afk23:55
*** lisaclark1 has quit IRC23:58
*** lisaclark1 has joined #openstack-barbican23:58

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!