Wednesday, 2015-02-25

*** woodster_ has quit IRC00:00
*** crc32 has quit IRC00:11
*** woodster_ has joined #openstack-barbican00:17
*** kebray has joined #openstack-barbican00:18
*** kebray has quit IRC00:21
*** kebray has joined #openstack-barbican00:22
*** david-lyle is now known as david-lyle_afk00:25
*** nkinder has joined #openstack-barbican00:33
*** jkf has quit IRC00:35
*** kgriffs|afk is now known as kgriffs00:35
*** jaosorior has quit IRC00:41
*** kgriffs is now known as kgriffs|afk00:46
*** openstack has joined #openstack-barbican01:11
*** mjg59 has quit IRC01:16
*** elmiko has quit IRC01:16
*** redrobot has quit IRC01:16
*** morganfainberg has quit IRC01:16
*** elmiko has joined #openstack-barbican01:20
*** mjg59 has joined #openstack-barbican01:20
*** redrobot has joined #openstack-barbican01:20
*** morganfainberg has joined #openstack-barbican01:20
*** sendak.freenode.net sets mode: +o redrobot01:20
*** SheenaG1 has joined #openstack-barbican01:29
*** SheenaG11 has quit IRC01:32
*** gyee has quit IRC01:35
*** mordred has quit IRC01:35
*** anteaya has quit IRC01:35
*** igueths has quit IRC01:35
*** greghaynes has quit IRC01:35
*** gyee has joined #openstack-barbican01:39
*** igueths has joined #openstack-barbican01:39
*** greghaynes has joined #openstack-barbican01:39
*** mordred has joined #openstack-barbican01:39
*** anteaya has joined #openstack-barbican01:39
*** gyee has quit IRC01:40
*** mordred has quit IRC01:40
*** anteaya has quit IRC01:40
*** igueths has quit IRC01:40
*** greghaynes has quit IRC01:40
*** david-lyle_afk has quit IRC01:40
*** gyee has joined #openstack-barbican01:41
*** igueths has joined #openstack-barbican01:41
*** greghaynes has joined #openstack-barbican01:41
*** mordred has joined #openstack-barbican01:41
*** anteaya has joined #openstack-barbican01:41
*** gyee has quit IRC01:56
*** jamielennox is now known as jamielennox|away01:58
*** david-lyle_afk has joined #openstack-barbican01:59
*** mjg59 has quit IRC02:03
*** mjg59 has joined #openstack-barbican02:04
*** jamielennox|away is now known as jamielennox02:06
*** david-lyle_afk has quit IRC02:10
*** david-lyle_afk has joined #openstack-barbican02:16
*** jamielennox is now known as jamielennox|away02:17
*** jamielennox|away is now known as jamielennox02:27
*** jamielennox is now known as jamielennox|away02:38
*** jamielennox|away is now known as jamielennox02:47
*** zz_dimtruck is now known as dimtruck02:59
*** jamielennox is now known as jamielennox|away03:22
*** igueths has quit IRC03:30
*** jamielennox|away is now known as jamielennox03:33
openstackgerritJamie Lennox proposed openstack/python-barbicanclient: Convert CRUD tests to requests-mock  https://review.openstack.org/14844704:19
openstackgerritJamie Lennox proposed openstack/python-barbicanclient: Convert CRUD tests to requests-mock  https://review.openstack.org/14844704:21
openstackgerritJamie Lennox proposed openstack/python-barbicanclient: Additional requests-mock testing  https://review.openstack.org/14844904:28
openstackgerritJamie Lennox proposed openstack/python-barbicanclient: Remove cyclical dependency  https://review.openstack.org/14844804:28
*** crc32 has joined #openstack-barbican04:37
*** crc32 has quit IRC04:44
*** dimtruck is now known as zz_dimtruck04:51
*** kgriffs|afk is now known as kgriffs04:54
*** crc32 has joined #openstack-barbican05:50
*** zz_dimtruck is now known as dimtruck06:15
*** crc32 has quit IRC06:20
*** dimtruck is now known as zz_dimtruck06:25
*** kebray has quit IRC07:57
*** woodster_ has quit IRC08:30
*** jaosorior has joined #openstack-barbican08:30
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: Refactor Orders resource to use repository factories  https://review.openstack.org/15880209:13
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: Enable secret decrypt through 'payload' resource  https://review.openstack.org/15706809:21
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: Enable secret decrypt through 'payload' resource  https://review.openstack.org/15706809:40
*** kgriffs is now known as kgriffs|afk09:49
*** darrenmoffat1 has joined #openstack-barbican10:03
*** darrenmoffat has quit IRC10:03
*** kgriffs|afk is now known as kgriffs10:51
*** kgriffs is now known as kgriffs|afk11:01
*** jaosorior has quit IRC12:01
*** woodster_ has joined #openstack-barbican12:30
*** kgriffs|afk is now known as kgriffs12:40
*** kgriffs is now known as kgriffs|afk12:50
*** jaosorior has joined #openstack-barbican12:55
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: Enable secret decrypt through 'payload' resource  https://review.openstack.org/15706813:09
*** rellerreller has joined #openstack-barbican13:50
*** SheenaG11 has joined #openstack-barbican14:10
*** SheenaG1 has quit IRC14:11
*** nkinder has quit IRC14:18
*** kgriffs|afk is now known as kgriffs14:26
*** lisaclark1 has joined #openstack-barbican14:30
*** kgriffs is now known as kgriffs|afk14:36
*** lisaclark1 has quit IRC14:39
*** david-lyle_afk is now known as david-lyle14:48
*** ametts has joined #openstack-barbican14:58
*** lisaclark1 has joined #openstack-barbican15:01
*** xaeth_afk is now known as xaeth15:02
*** zz_dimtruck is now known as dimtruck15:03
jaosoriorwoodster_, tdink_, hockeynut, redrobot: I uploaded another patchset for the 'payload' resource adding https://review.openstack.org/157068  Nothing really changed in the code, I just ended up adding the APIImpact flag.15:04
*** paul_glass has joined #openstack-barbican15:05
jaosoriorredrobot: Also, I responded to your comment regarding the urljoin... And couldn't use it in that section of the code. due to that part not being an absolute url15:05
*** openstackgerrit has quit IRC15:08
*** openstackgerrit has joined #openstack-barbican15:08
*** nkinder has joined #openstack-barbican15:08
*** mordred has quit IRC15:22
*** mordred has joined #openstack-barbican15:22
*** lisaclark1 has quit IRC15:26
*** kebray has joined #openstack-barbican15:29
*** kebray has quit IRC15:29
*** kebray has joined #openstack-barbican15:30
*** lisaclark1 has joined #openstack-barbican15:31
*** igueths has joined #openstack-barbican15:33
*** kebray has quit IRC15:36
*** kgriffs|afk is now known as kgriffs15:37
*** kgriffs is now known as kgriffs|afk15:46
*** kgriffs|afk is now known as kgriffs15:50
*** kgriffs is now known as kgriffs|afk15:51
*** lisaclark1 has quit IRC16:06
*** dave-mccowan has joined #openstack-barbican16:17
*** lisaclark1 has joined #openstack-barbican16:18
*** kgriffs|afk is now known as kgriffs16:25
*** kgriffs is now known as kgriffs|afk16:27
*** dimtruck is now known as zz_dimtruck16:27
*** kfox1111 has joined #openstack-barbican16:27
*** alee has quit IRC16:36
*** alee has joined #openstack-barbican16:36
*** openstackstatus has joined #openstack-barbican16:42
*** ChanServ sets mode: +v openstackstatus16:42
*** lisaclark1 has quit IRC16:42
*** rellerreller has quit IRC17:16
*** lisaclark1 has joined #openstack-barbican17:18
*** lisaclark1 has quit IRC17:22
*** jamielennox is now known as jamielennox|away17:22
*** lisaclark1 has joined #openstack-barbican17:22
*** jamielennox|away is now known as jamielennox17:30
*** crc32 has joined #openstack-barbican17:31
*** igueths has quit IRC17:33
*** jkf has joined #openstack-barbican17:36
*** kgriffs|afk is now known as kgriffs17:37
kfox1111so, is there ever a time when a container will have a secret on a uri other then the server hosting the container?17:38
*** gyee has joined #openstack-barbican17:38
*** lisaclark1 has quit IRC17:39
*** zz_dimtruck is now known as dimtruck17:40
*** jkf has quit IRC17:42
*** jkf has joined #openstack-barbican17:46
*** kgriffs is now known as kgriffs|afk17:47
*** rellerreller has joined #openstack-barbican17:47
woodster_kfox1111: not at this time and probably never, though federation might challenge this17:49
woodster_reaperhulk: redrobot fyi ^^^17:50
kfox1111k. just weirded out that the container requires a full url for a secret.17:53
reaperhulkYeah we talked about this at the midcycle meetup and the consensus was we should explicitly require the same uri as the server.17:54
kfox1111hmm... k.17:55
*** nkinder has quit IRC17:56
kfox1111can a secret be associated with multiple containers?17:56
*** jamielennox is now known as jamielennox|away18:02
*** jamielennox|away is now known as jamielennox18:15
*** dimtruck is now known as zz_dimtruck18:19
*** zz_dimtruck is now known as dimtruck18:32
*** dimtruck is now known as zz_dimtruck18:34
*** xaeth is now known as xaeth_afk18:41
*** crc32 has quit IRC18:43
*** crc32 has joined #openstack-barbican18:50
woodster_kfox1111: I believe18:55
woodster_It can be18:55
*** dave-mccowan has quit IRC18:56
*** kebray has joined #openstack-barbican19:01
*** kgriffs|afk is now known as kgriffs19:05
*** kebray has quit IRC19:07
*** zz_dimtruck is now known as dimtruck19:08
*** kebray has joined #openstack-barbican19:11
hockeynutwoodster_ that's interesting.  If we do the "delete a secret when we delete the container" then we could end up with someone else's container having a stale reference19:12
*** bdpayne has joined #openstack-barbican19:14
*** lisaclark1 has joined #openstack-barbican19:17
*** lisaclark1 has quit IRC19:18
*** lisaclark1 has joined #openstack-barbican19:19
*** lisaclark1 has quit IRC19:24
*** kgriffs is now known as kgriffs|afk19:24
woodster_hockeynut: that's probably true...containers are more of a loose grouping right now19:24
hockeynutyep19:24
*** lisaclark1 has joined #openstack-barbican19:25
hockeynutso if you delete a secret then it could very well be in one (or more) containers - that's an interesting one.19:25
woodster_hockeynut: containers could just be a convenient way to group secrets, and the same secret could be in multiple containers/groups19:28
*** lisaclark1 has quit IRC19:30
hockeynutright - so if I delete secret S that is contained in containers C1, C2 then they will get 404 when trying to use the secret S.  Would be interesting if we had some kind of use count on secrets19:33
kfox1111yeah. refcount would be great.19:50
kfox1111hmm.. ok. so I can use a url like /v1-vm/<container-name>/<container-secret-name>/filename.whatever in the code I add.19:52
kfox1111or just /v1-vm/<container-name>/<container-secret-name>19:52
*** dave-mccowan has joined #openstack-barbican19:55
*** rm_mobile has joined #openstack-barbican19:56
*** rm_mobile has quit IRC19:56
*** rm_mobile has joined #openstack-barbican19:56
*** atiwari has joined #openstack-barbican20:01
*** lisaclark1 has joined #openstack-barbican20:02
*** dimtruck is now known as zz_dimtruck20:09
*** prometheanfire has joined #openstack-barbican20:15
*** prometheanfire has left #openstack-barbican20:17
*** zz_dimtruck is now known as dimtruck20:17
*** nkinder has joined #openstack-barbican20:19
kfox1111is there a way in pecan to just have one get handler for all of a subdirectory?20:24
kfox1111/foo/bar/baz set the handler on /foo and get /bar/baz?20:24
*** kgriffs|afk is now known as kgriffs20:25
woodster_kfox1111: I think Alee ended up doing something like that for his ca resource work20:25
kfox1111hmm... _lookup maybe?20:27
woodster_kfox1111: just recalling, you are wanting a name based way to access secrets via containers correct? We only have this sort of interface now: https://github.com/cloudkeep/barbican/wiki/Application-Programming-Interface#containers-resource20:27
kfox1111yeah. thats what I'm using. what I want to do is be able to with one api call, download the secret given its name and container.20:28
woodster_kfox1111: so you would like to translate between the current and new Apis in middleware correct?20:29
kfox1111middleware would be ok, or I can just add a /v1-vm sub app at the root.20:30
kfox1111and do just the auth in the middleware.20:30
woodster_kfox1111: so is this a custom implementation on your part or do you intend to submit to upstream?20:33
kfox1111I intend to submit it.20:34
redrobotkfox1111 btw, name uniqueness is not guaranteed by Barbican20:34
kfox1111name uniqueness is not guaranteed by barbincan outside of a single container?20:34
*** kgriffs is now known as kgriffs|afk20:35
woodster_redrobot: ha you beat me to it, so was going to ask if my name you meant UUID?20:35
redrobotkfox1111 correct, I can submit 10 secrets all called "my secret" and the api would be ok with that20:35
rm_workI forget whether you can have a container that contains secrets of the same name20:35
rm_workI think actually no20:35
kfox1111yeah. so if the url takes in <container-name>/<containers name for the secret>, that should be unique?20:36
rm_workthough I went through like three iterations of the client library, changing it back and forth to either support that or not20:36
woodster_rm_work: name uniqueness is enforced by validation20:36
redrobotkfox1111no, because container-name is not guaranteed to be unique20:36
redrobotkfox1111 ^^20:36
rm_workwoodster_: it might be enforced elsewire20:36
kfox1111even within a tenant?20:36
redrobotkfox1111 however, names within a container are unique20:36
rm_work^^ yes, this20:36
redrobotkfox1111 however, however, container within name != secret.name20:37
rm_workContainer 1234-5678-90123 can't have two secrets inside it with the tag "thing"20:37
kfox1111are container names for a given tenant unique?20:37
rm_work(note I said "tag")20:37
rm_workkfox1111: no20:37
redrobotkfox1111 no, we only enforce uniqueness on UUIDs20:37
rm_workI could have ten containers named "mycontainer"20:37
rm_workbut each "mycontainer" *could not* have multiple secrets tagged "thing"20:37
kfox1111ok... so what I can do is the same thing the rest of the openstack api's do. have it take container-name or containeruuid.20:37
rm_workthough the actual secret names might not be "thing"20:37
rm_workit's a bit weird20:38
kfox1111if the user does something stupid like naming to containers the same thing, they can use a uuid.20:38
rm_workkfox1111: that actually makes sense to me20:38
rm_workbeing consistently wonky with the rest of the OpenStack APIs :P20:38
rm_workor at least, CLIs20:38
kfox1111:)20:38
rm_workit's wonky, but it's consistent, and I value consistency VERY hightly20:38
rm_work*highly20:38
woodster_So the resource ID could be UUID or name?20:40
kfox1111yeah. me too. thats one reason I was so surprised the secret was a uri in the container, not a uuid.20:40
kfox1111yeah. that should work.20:40
*** ametts has quit IRC20:41
woodster_ kfox1111 so what happens when more than one container matches? You get a list instead of individual response?20:42
kfox1111or a error.20:42
openstackgerritThomas Dinkjian proposed openstack/python-barbicanclient: Adds positive orders functional tests  https://review.openstack.org/15845420:44
kfox1111probably should just look at the other openstack api's and see what they do in that case.20:45
kfox1111maybe a not unique http code or something.20:45
woodster_kfox1111: if you intend to submit as a CR it might be good to put up a blue print first20:46
kfox1111yeah... not too much time yet.20:46
kfox1111I'm deploying a cloud for some users, and I have a choice. Use our msc-keyserver for it, or tweak barbican to make it work.20:47
kfox1111I'm ok having to tell users they need to change api's slightly. but wouldn't want to switch technologies, or delay a long time.20:47
kfox1111I figure I'll get something working, then submit a spec/some code.20:47
kfox1111I've been given about 2 days now to work on making barbican work. :/20:48
*** lisaclark1 has quit IRC20:48
kfox1111if it works, then I can ask for some more time to do it really right.20:48
kfox1111odd. the _lookup thing looks like it almost works, but is throwing a 302 all the time. :/20:55
*** atiwari has quit IRC20:58
*** dimtruck is now known as zz_dimtruck20:59
kfox1111I'm not getting debug logging I think I should... is there a debug flag in places other then the api.config?21:01
*** lisaclark1 has joined #openstack-barbican21:02
*** kebray has quit IRC21:07
*** zz_dimtruck is now known as dimtruck21:08
*** kfox1111 has quit IRC21:11
*** alee is now known as alee_afk21:12
*** kebray has joined #openstack-barbican21:12
*** rellerreller has quit IRC21:15
*** alee_afk has quit IRC21:16
*** dimtruck is now known as zz_dimtruck21:18
*** zz_dimtruck is now known as dimtruck21:21
*** kebray has quit IRC21:26
*** alee has joined #openstack-barbican21:44
*** lisaclark1 has quit IRC21:45
*** kebray has joined #openstack-barbican21:46
*** dimtruck is now known as zz_dimtruck21:49
*** lisaclark1 has joined #openstack-barbican21:59
*** jaosorior has quit IRC22:02
*** zz_dimtruck is now known as dimtruck22:03
openstackgerritDouglas Mendizábal proposed openstack/barbican: Remove version from endpoints in catalog  https://review.openstack.org/12786522:07
*** kebray has quit IRC22:13
*** jkf has quit IRC22:14
*** dave-mccowan has quit IRC22:19
*** alee has quit IRC22:35
*** lisaclark1 has quit IRC22:39
*** jorge_munoz has quit IRC22:48
*** kfox1111 has joined #openstack-barbican22:49
kfox1111so in a Controller, how do you get info in the context?22:52
*** crc32 has quit IRC23:00
*** gyee has quit IRC23:20
*** alee has joined #openstack-barbican23:39
*** paul_glass has quit IRC23:42
*** chlong has quit IRC23:43
*** chlong_ has quit IRC23:44
*** chlong has joined #openstack-barbican23:48
*** dimtruck is now known as zz_dimtruck23:48
kfox1111hmm... can I just call _on_get_secret_payload directly from another api function?23:53

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!