| *** tkelsey has joined #openstack-barbican | 00:10 | |
| *** tkelsey has quit IRC | 00:14 | |
| *** gyee has quit IRC | 00:16 | |
| *** woodster_ has quit IRC | 00:40 | |
| *** woodster_ has joined #openstack-barbican | 00:42 | |
| *** kgriffs is now known as kgriffs|afk | 01:19 | |
| *** alee_afk is now known as alee_ | 01:42 | |
| *** kgriffs|afk is now known as kgriffs | 02:20 | |
| *** kgriffs is now known as kgriffs|afk | 02:29 | |
| *** zz_dimtruck is now known as dimtruck | 03:13 | |
| *** tkelsey has joined #openstack-barbican | 03:22 | |
| *** tkelsey has quit IRC | 03:27 | |
| *** SheenaG has joined #openstack-barbican | 03:59 | |
| *** xaeth_afk is now known as xaeth | 04:02 | |
| *** xaeth is now known as xaeth_afk | 04:03 | |
| *** everjeje has joined #openstack-barbican | 04:03 | |
| *** SheenaG has quit IRC | 04:04 | |
| *** dimtruck is now known as zz_dimtruck | 04:32 | |
| openstackgerrit | Adam Harwell proposed openstack/barbican: Use the new Devstack external plugin method https://review.openstack.org/167885 | 05:36 |
|---|---|---|
| rm_work | redrobot: ^^ https://gist.github.com/rm-you/70f0b779970402e9baba | 05:55 |
| rm_work | redrobot: makes devstack a lot easier | 05:55 |
| rm_work | woodster_ / alee / hockeynut / jvrbanac ^^ comments welcome, pretty much just a reshuffle of the existing scripts | 05:56 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/barbican: Imported Translations from Transifex https://review.openstack.org/167894 | 06:07 |
| *** kebray has quit IRC | 06:14 | |
| *** jamielennox is now known as jamielennox|away | 06:16 | |
| openstackgerrit | Adam Harwell proposed openstack/barbican: Use the new Devstack external plugin method https://review.openstack.org/167885 | 06:20 |
| *** chlong has quit IRC | 06:45 | |
| *** tkelsey has joined #openstack-barbican | 07:46 | |
| *** everjeje has quit IRC | 07:46 | |
| *** everjeje has joined #openstack-barbican | 07:54 | |
| *** rm_you| has quit IRC | 07:59 | |
| *** jaosorior has joined #openstack-barbican | 08:01 | |
| *** rm_work is now known as rm_work|away | 08:03 | |
| *** woodster_ has quit IRC | 08:20 | |
| openstackgerrit | Everardo Padilla Saca proposed openstack/barbican: Add utf-8 decoding for Content-Type https://review.openstack.org/165056 | 08:56 |
| *** gitorres has joined #openstack-barbican | 09:45 | |
| *** gitorres has left #openstack-barbican | 09:45 | |
| *** jorge_munoz has quit IRC | 10:06 | |
| *** jorge_munoz has joined #openstack-barbican | 10:14 | |
| *** alpha_ori has quit IRC | 11:18 | |
| *** nickrmc84 has joined #openstack-barbican | 11:18 | |
| *** nkinder_ has joined #openstack-barbican | 11:18 | |
| *** alpha_ori_ has joined #openstack-barbican | 11:18 | |
| *** alpha_ori_ is now known as alpha_ori | 11:18 | |
| *** mordred_ has joined #openstack-barbican | 11:20 | |
| *** jenkins-keep has quit IRC | 11:25 | |
| *** chlong has joined #openstack-barbican | 11:26 | |
| *** nkinder has quit IRC | 11:30 | |
| *** nickrmc83 has quit IRC | 11:30 | |
| *** dhellmann has quit IRC | 11:30 | |
| *** mordred has quit IRC | 11:30 | |
| *** anteaya has quit IRC | 11:30 | |
| *** xaeth_afk has quit IRC | 11:30 | |
| *** mordred_ is now known as mordred | 11:30 | |
| *** dhellmann has joined #openstack-barbican | 11:33 | |
| *** xaeth_afk has joined #openstack-barbican | 11:33 | |
| *** anteaya has joined #openstack-barbican | 11:39 | |
| *** woodster_ has joined #openstack-barbican | 12:15 | |
| *** zz_dimtruck is now known as dimtruck | 12:28 | |
| *** alee_ has quit IRC | 12:49 | |
| *** alee has quit IRC | 12:49 | |
| *** alee has joined #openstack-barbican | 13:02 | |
| -openstackstatus- NOTICE: gerrit stopped emitting stream events around 11:30 utc and has now been restarted. please recheck any changes currently missing results from jenkins | 13:11 | |
| *** nkinder_ has quit IRC | 13:21 | |
| *** alee has quit IRC | 13:35 | |
| *** nickrmc84 has quit IRC | 13:42 | |
| *** nickrmc83 has joined #openstack-barbican | 13:43 | |
| *** paul_glass has joined #openstack-barbican | 14:04 | |
| *** rm_work|away is now known as rm_work | 14:08 | |
| *** nkinder has joined #openstack-barbican | 14:25 | |
| *** kebray has joined #openstack-barbican | 14:26 | |
| *** kgriffs|afk is now known as kgriffs | 14:31 | |
| *** kebray has quit IRC | 14:39 | |
| *** mdarby has joined #openstack-barbican | 14:43 | |
| *** tkelsey has quit IRC | 14:44 | |
| *** kebray has joined #openstack-barbican | 15:00 | |
| *** rm_mobile has joined #openstack-barbican | 15:10 | |
| rm_mobile | Anyone have ideas about how to be codependent on an infra config change? https://review.openstack.org/#/c/167885/ | 15:18 |
| rm_mobile | I guess maybe I should ask infra :P | 15:19 |
| *** kgriffs is now known as kgriffs|afk | 15:25 | |
| *** xaeth_afk is now known as xaeth | 15:27 | |
| openstackgerrit | Everardo Padilla Saca proposed openstack/barbican: Catch UnicodeEncodeError, avoiding unwanted HTTP 500 error https://review.openstack.org/167044 | 15:28 |
| *** kebray has quit IRC | 15:31 | |
| *** kgriffs|afk is now known as kgriffs | 15:35 | |
| *** gyee has joined #openstack-barbican | 15:36 | |
| *** dimtruck is now known as zz_dimtruck | 15:39 | |
| chellygel | would love some quick stat boosting reviews on my docs changes o/ | 15:39 |
| chellygel | https://review.openstack.org/#/c/167029/ | 15:39 |
| chellygel | https://review.openstack.org/#/c/167820/ | 15:40 |
| reaperhulk | workflow'd | 15:40 |
| *** nickrmc83 has quit IRC | 15:40 | |
| reaperhulk | and asked a question on the second one | 15:41 |
| *** zz_dimtruck is now known as dimtruck | 15:41 | |
| *** nickrmc83 has joined #openstack-barbican | 15:42 | |
| chellygel | replied, basically -- javascript was in the doc previously as per jvrbanac's initial change | 15:43 |
| chellygel | i've used bash in the other doc | 15:43 |
| chellygel | not sure what it should be for this code block example | 15:43 |
| openstackgerrit | John Wood proposed openstack/barbican: Restore worker tasks processing catching exceptions https://review.openstack.org/168039 | 15:43 |
| jvrbanac | reaperhulk, chellygel, yeaahh that was copy-pasta from the other rst docs. It sorta made sense because it syntax highlighted the json correctly lol | 15:44 |
| reaperhulk | so...let's change that | 15:47 |
| reaperhulk | "none" might be all we want here | 15:48 |
| reaperhulk | otherwise you can check the pygments lexer list http://pygments.org/docs/lexers/ | 15:48 |
| jvrbanac | reaperhulk, for that one yeah I guess none would be best. I'll toss together a CR to change the others | 15:51 |
| chellygel | no jvrbanac i'll take care of it | 15:53 |
| chellygel | same cr | 15:53 |
| chellygel | its a minor line change | 15:53 |
| jvrbanac | chellygel, I meant for the ones not in your cr | 15:53 |
| chellygel | i know | 15:53 |
| chellygel | its the same file | 15:53 |
| chellygel | nbd | 15:53 |
| chellygel | aka im about to push up the change | 15:53 |
| chellygel | lol | 15:53 |
| chellygel | i will leave itt set to json for the Metadata Response because it is json | 15:54 |
| jvrbanac | chellygel, ok. | 15:54 |
| chellygel | and the request for post | 15:54 |
| openstackgerrit | Chelsea Winfree proposed openstack/barbican: Completing secret reference documentation https://review.openstack.org/167820 | 15:56 |
| chellygel | ^ plz re review | 15:56 |
| woodster_ | chellygel, jvrbanac for https://review.openstack.org/#/c/167820/ I see there is mention of PUT-ing to the 'payload' resource. I believe we are only doing GETs from 'payload' now. | 16:02 |
| *** rm_mobile has quit IRC | 16:04 | |
| openstackgerrit | Merged openstack/barbican: Adding more detail to the secrets quickstart guide https://review.openstack.org/167029 | 16:06 |
| *** xaeth is now known as xaeth_afk | 16:13 | |
| *** rm_mobile has joined #openstack-barbican | 16:18 | |
| *** rm_mobile has quit IRC | 16:18 | |
| *** rm_mobile has joined #openstack-barbican | 16:18 | |
| *** jkf has joined #openstack-barbican | 16:21 | |
| chellygel | woodster_, jvrbanac should i remove that section then? | 16:22 |
| *** rm_mobile| has joined #openstack-barbican | 16:22 | |
| *** kebray has joined #openstack-barbican | 16:23 | |
| *** rm_mobile has quit IRC | 16:23 | |
| *** rm_mobile| is now known as rm_mobile | 16:23 | |
| woodster_ | chellygel, jvrbanac I'd say yes. I only see GET supported here for example: https://github.com/openstack/barbican/blob/master/barbican/api/controllers/secrets.py#L134 | 16:24 |
| chellygel | alright, i will remove it and push here in a sec | 16:28 |
| *** ccneill has joined #openstack-barbican | 16:30 | |
| *** chlong has quit IRC | 16:31 | |
| woodster_ | chellygel, thanks! In retrospect it would have been nice to support PUT payload...easier to remove from docs than to add to code at this point... | 16:32 |
| woodster_ | just curious if anyone has used docker to setup the entire barbican network (so queues and workers too)? | 16:33 |
| openstackgerrit | Chelsea Winfree proposed openstack/barbican: Completing secret reference documentation https://review.openstack.org/167820 | 16:34 |
| chellygel | ^ woodster_ | 16:34 |
| woodster_ | chellygel, thanks for that rock. But I'd like a rock without line #365 please. :) Sorry I didn't spot that earlier, but that payload resource only supports decryption...for getting the metadata you have to use GET on secrets still. | 16:37 |
| openstackgerrit | Merged openstack/barbican: Imported Translations from Transifex https://review.openstack.org/167894 | 16:37 |
| chellygel | what on 365 | 16:38 |
| woodster_ | chellygel, that line just needs to be removed | 16:40 |
| chellygel | application/json - Returns secret metadata | 16:40 |
| chellygel | this? | 16:40 |
| woodster_ | yep | 16:41 |
| openstackgerrit | Chelsea Winfree proposed openstack/barbican: Completing secret reference documentation https://review.openstack.org/167820 | 16:41 |
| woodster_ | only payload decryption is supported | 16:41 |
| chellygel | woodster, this rock has your name on it | 16:41 |
| chellygel | i dont mind playing hte rock game | 16:42 |
| chellygel | good and accurate docs are critical for us | 16:42 |
| woodster_ | chellygel, that rock rocks! +2 | 16:42 |
| chellygel | thanks woodster! | 16:42 |
| chellygel | if i could get a few others to push that a long, i would be most appreciative -- its just a small 60 line doc change | 16:42 |
| chellygel | with tables! not huge paragraphs! | 16:43 |
| woodster_ | chellygel, well if it lowers the frustration level from folks using Barbican that's awesome. Glad you all are updating those things...are we close to being able to obsolete that cloudkeep wiki API page then? | 16:43 |
| chellygel | i wouldnt say so yet | 16:43 |
| chellygel | we still have a lot of ground to cover | 16:43 |
| chellygel | this was just secrets, not orders or containers | 16:43 |
| chellygel | i think the quickstart guide could use a lot more details also | 16:44 |
| chellygel | but we are definitely closer in that regard! | 16:44 |
| woodster_ | chellygel, yeah and there are new features that are not documented either. Chipping away at it all though | 16:44 |
| *** kebray has quit IRC | 16:51 | |
| rm_mobile | Woodster_: https://review.openstack.org/#/c/167885/ | 16:53 |
| rm_mobile | Any objections to switching devstack methods? | 16:54 |
| *** jkf has quit IRC | 16:54 | |
| *** jkf has joined #openstack-barbican | 16:58 | |
| redrobot | rm_mobile I would just ask to make sure this isn't going to break the client devstack gate | 16:58 |
| rm_mobile | It'll break any dsvm gate checks until they're updated | 16:59 |
| woodster_ | could we put this off until RC1 is cut? I think it would require rebasing a lot of pending FFE CRs | 17:00 |
| *** arunkant_ has joined #openstack-barbican | 17:00 | |
| *** kgriffs is now known as kgriffs|afk | 17:00 | |
| *** tkelsey has joined #openstack-barbican | 17:01 | |
| *** xaeth_afk is now known as xaeth | 17:06 | |
| *** kgriffs|afk is now known as kgriffs | 17:07 | |
| *** gyee has quit IRC | 17:07 | |
| *** kgriffs has left #openstack-barbican | 17:09 | |
| arunkant_ | jaosorior, replied to your comments on https://review.openstack.org/#/c/164334/ . Can you please look and accordingly I will make the change later. | 17:13 |
| *** darrenmoffat has quit IRC | 17:15 | |
| *** darrenmoffat has joined #openstack-barbican | 17:16 | |
| *** alee has joined #openstack-barbican | 17:25 | |
| alee | woodster_, ping | 17:25 |
| woodster_ | alee, howdy | 17:34 |
| alee | woodster_, howdy | 17:38 |
| alee | just going through the functional tests | 17:38 |
| alee | woodster_, I have it all running with your CRs and just going through making sure the state machine sets things correctly | 17:39 |
| woodster_ | do you mean the sub-status stuff, or the retry stuff? | 17:40 |
| alee | woodster_, just wanted to confirm with you. In the case where we want to terminate the order in an error state, we simply need to throw an excecption. It looks like for the most part, | 17:41 |
| alee | the error status and message is set by the handling of the exception | 17:41 |
| alee | and we don't have to set it explicitly | 17:41 |
| woodster_ | alee, that's correct, but this CR needs to land to make that work correctly: https://review.openstack.org/#/c/168039/ | 17:41 |
| alee | sub-status | 17:42 |
| woodster_ | alee, so the sub-status stuff should only be used if the order needs to stay PENDING after a task completes | 17:42 |
| alee | ok | 17:43 |
| woodster_ | redrobot, jvrbanac can you guys take a look at this one too? https://review.openstack.org/#/c/168039/ Just restores the worker-side no-rollback flow from before | 17:43 |
| alee | anyways - with your current crs, it looks like the error_status and error_status_message are being set | 17:43 |
| *** everjeje has quit IRC | 17:56 | |
| *** ccneill has quit IRC | 18:06 | |
| arunkant_ | alee, redrobot, rm_work and other barbicaneers..can you guys review ACL related changes. There are 5 related changes and clearly needs your attention for reviews especially on part 2, 3, 4, 5 | 18:12 |
| rm_mobile | Woodster_: oh yeah, no rush. Just want to make sure people are cool with the direction, and try to figure out how to cogate with the infra change if possible | 18:13 |
| *** gyee has joined #openstack-barbican | 18:16 | |
| *** jkf has quit IRC | 18:17 | |
| *** jkf has joined #openstack-barbican | 18:21 | |
| *** gyee has quit IRC | 18:24 | |
| *** jkf has quit IRC | 18:25 | |
| *** jkf has joined #openstack-barbican | 18:26 | |
| *** gyee has joined #openstack-barbican | 18:28 | |
| chellygel | if anyone has a workflow: https://review.openstack.org/#/c/167820/ | 18:35 |
| openstackgerrit | Merged openstack/barbican: Add utf-8 decoding for Content-Type https://review.openstack.org/165056 | 18:44 |
| *** igueths has joined #openstack-barbican | 18:46 | |
| *** ccneill has joined #openstack-barbican | 18:48 | |
| *** nickrmc83 has quit IRC | 18:53 | |
| *** nickrmc83 has joined #openstack-barbican | 18:53 | |
| openstackgerrit | Merged openstack/barbican: Completing secret reference documentation https://review.openstack.org/167820 | 19:06 |
| openstackgerrit | Charles Neill proposed openstack/barbican: Security tests for Container resources https://review.openstack.org/164875 | 19:16 |
| *** crc32 has joined #openstack-barbican | 19:17 | |
| openstackgerrit | Douglas Mendizábal proposed openstack/python-barbicanclient: Consolidate Payload Exceptions https://review.openstack.org/168116 | 19:19 |
| *** crc32 has quit IRC | 19:19 | |
| *** rellerreller has joined #openstack-barbican | 19:20 | |
| *** rm_mobile has quit IRC | 19:23 | |
| *** crc32 has joined #openstack-barbican | 19:30 | |
| woodster_ | rm_mobile, hockeynut A devstack question please. If I want to have another process running along with the current uwsgi one, can I just add a line to the start_barbican() function here?: https://github.com/openstack/barbican/blob/master/contrib/devstack/lib/barbican#L179 | 19:36 |
| *** xaeth is now known as xaeth_afk | 19:37 | |
| *** ccneill has quit IRC | 19:40 | |
| rm_work | I believe so | 19:43 |
| rm_work | screen_it barbican2 "secondprocess start command" | 19:44 |
| rm_work | so, stop_barbican is lulzy because "killall -9 uwsgi" | 19:44 |
| rm_work | and who knows if we're the only uwsgi process on the machine | 19:44 |
| rm_work | little bit rude :P | 19:44 |
| *** xaeth_afk is now known as xaeth | 19:45 | |
| woodster_ | rm_work oh yeah that is low brow for sure | 19:47 |
| woodster_ | rm_work, I haven't done much with devstack...is docker locally the newest/easiest way now? | 19:48 |
| *** openstackgerrit has quit IRC | 19:52 | |
| *** openstackgerrit has joined #openstack-barbican | 19:52 | |
| woodster_ | alee, btw I make comments to yours on this CR: https://review.openstack.org/#/c/166497/ | 19:54 |
| woodster_ | redrobot, do you know if the tox -e pep8 checks have changed? I see passes on my local machine that fail in the gate | 19:56 |
| redrobot | woodster_ try recreating your env. (tox -r -e pep8) since we did change the version of hacking in test-requirements.txt | 19:56 |
| chellygel | hey alee, woodster_ hoping to set up time with the both of you to discuss initial steps for our OpenStack talk -- alee when is a good day for you next week? Monday or Tuesday maybe? | 19:56 |
| woodster_ | redrobot, ah got it, thanks! | 19:57 |
| chellygel | i was thinking we would do a google hangout session to chat about it | 19:57 |
| alee | chellygel, tuesday is probably better for me | 19:57 |
| woodster_ | chellgel, that works for me. I'll be out mid afternoon on Monday and we just have to steer around Tuesday planning stuff | 19:57 |
| chellygel | how about 4pm EST ? alee woodster_ ? | 19:58 |
| chellygel | 3 CST for us | 19:58 |
| alee | chellygel, you picked the one time when I have a meeting on tuesday | 19:58 |
| chellygel | bhaha. | 19:58 |
| chellygel | hmm what about wednesday? | 19:59 |
| alee | chellygel, wed is open for me | 19:59 |
| chellygel | Wednesday at say 2:30 EST | 19:59 |
| alee | ok | 19:59 |
| chellygel | woodster_, is that okay? | 19:59 |
| woodster_ | chellygel, is that an April Fools joke??? That works for me | 20:00 |
| chellygel | hahaha | 20:00 |
| chellygel | preferred email alee ? | 20:01 |
| alee | alee@redhat.com | 20:01 |
| chellygel | sent! :) | 20:02 |
| chellygel | thanks guys | 20:02 |
| chellygel | i scheduled it for 30 min, but im open until 3:30 your time | 20:02 |
| rm_work | woodster_: dunno, I just use RAX VMs for devstack, generally faster and more portable (especially since I run OSX, so no docker for me) | 20:30 |
| *** xaeth is now known as xaeth_afk | 20:32 | |
| *** ccneill has joined #openstack-barbican | 20:37 | |
| *** rellerreller has quit IRC | 20:38 | |
| *** xaeth_afk is now known as xaeth | 20:42 | |
| openstackgerrit | Thomas Dinkjian proposed openstack/python-barbicanclient: Negative tests for orders https://review.openstack.org/168150 | 20:47 |
| reaperhulk | rm_work: boot2docker makes it so you can use docker without even knowing you're actually running it inside a VM | 20:49 |
| rm_work | hmm, will check that out | 20:50 |
| openstackgerrit | John Wood proposed openstack/barbican: Allow business logic and plugins to retry tasks https://review.openstack.org/165594 | 20:52 |
| rm_work | oh god it is auto-running Terminal | 20:52 |
| rm_work | which is so f'ed on my system T_T | 20:52 |
| woodster_ | reaperhulk, are you running devstack from within docker? | 20:56 |
| reaperhulk | I make it a point to never run devstack | 20:56 |
| reaperhulk | So, no | 20:56 |
| reaperhulk | :) | 20:56 |
| woodster_ | ha! | 20:56 |
| rm_work | heh | 20:56 |
| woodster_ | ugh tox -r does not rebuild my tox env apparently....rm -rf .tox/ does :) | 21:00 |
| openstackgerrit | Steve Heyman proposed openstack/barbican: Add ability to run secrets tests in parallel https://review.openstack.org/141138 | 21:00 |
| rm_work | woodster_: err wat | 21:01 |
| hockeynut | jvrbanac jaosorior chellygel and anyone else - would love some comments on https://review.openstack.org/#/c/141138/ | 21:02 |
| woodster_ | rm_work, yeah I've been trying to figure out why local pep8 runs differently than the gate. redrobot mentioned hacking was updated. But even after -r I was still getting success. Rm the .tox folder finally got my local pep8 in line. | 21:02 |
| rm_work | wtf | 21:02 |
| rm_work | `tox -r` should not fail :/ | 21:02 |
| openstackgerrit | John Wood proposed openstack/barbican: Restore worker tasks processing catching exceptions https://review.openstack.org/168039 | 21:03 |
| rm_work | woodster_: the best part about the devstack change I put up: it could never merge, and as long as I rebase it, I can already use it :) | 21:04 |
| woodster_ | rm_work, oh you mean for local devstack checking? | 21:05 |
| rm_work | we're about to start using it for our Octavia devstack testing | 21:06 |
| rm_work | since the enable_plugin line allows us to specify the changeref | 21:06 |
| woodster_ | rm_work sounds interesting | 21:10 |
| rm_work | yeah, simplifies things a bit | 21:12 |
| woodster_ | alee regarding the naming of that new dict 'barbican_meta_dto' passed into certificate methods. I'd like to change that to something like 'extended_meta_dto' or some such, to distinguish from the private barbican-core related metadata. I'm referring to line #86 in certificate_resources.py of https://review.openstack.org/#/c/167110 | 21:13 |
| alee | woodster_, yeah - I'm fine with that | 21:19 |
| *** mragupat has joined #openstack-barbican | 21:19 | |
| *** jamielennox|away is now known as jamielennox | 21:21 | |
| jvrbanac | Does anyone remember why we used "name" in secret_refs for a container? | 21:23 |
| jvrbanac | woodster_, redrobot, alee ^ | 21:23 |
| redrobot | jvrbanac you mean, why is it a name-> ref mapping instead of just a list of refs? | 21:24 |
| alee | jvrbanac, private_key, public_key, passphrase | 21:24 |
| jvrbanac | redrobot, no. Like why is it called name? it's really a type | 21:24 |
| jvrbanac | It feels like a type atleast | 21:25 |
| redrobot | jvrbanac I'm not sure what you're talking about then. What is called "name"? | 21:25 |
| redrobot | jvrbanac IIRC containers have both a "name" and a "type" | 21:26 |
| alee | jvrbanac, I suppose in this case for rsa containers or for certs | 21:26 |
| alee | but they really are just all secrets | 21:26 |
| alee | and the idea was to support containers as generic collections of secrets | 21:27 |
| redrobot | jvrbanac Oh I think I understand your question now. | 21:27 |
| jvrbanac | I think I phrased my question wrong. In a container we have a list attribute called secret_refs. with in that list there are dicts with two attributes name and ref | 21:27 |
| jvrbanac | secret_ref | 21:27 |
| redrobot | yes, | 21:28 |
| jvrbanac | why is it called name? | 21:28 |
| redrobot | and for a generic container, you get to provide the "name" | 21:28 |
| redrobot | no idea why... I think of Containers as dicts, so maybe "key" would have been better ? | 21:28 |
| jvrbanac | Well, as I'm writing this doc, I was just thinking about the use case here. The way we do rsa and certificate containers makes it feel like it's a specified type | 21:29 |
| jvrbanac | it just feels weird | 21:30 |
| jvrbanac | I've never noticed it until now lol | 21:30 |
| alee | jvrbanac, thats a specific use case . I also might want to group all my passwords together in a generic container | 21:30 |
| alee | jvrbanac, and then I might have "netflix", "bank", bitcoin_vault", ... | 21:31 |
| jvrbanac | alee, ah | 21:31 |
| alee | in that case, its not a "type" | 21:31 |
| jvrbanac | So it does make sense for a generic container... perhaps we should consider making the restricted cases like rsa and certificate use a different attribute | 21:32 |
| redrobot | jvrbanac ugh... I'd hate to have different ways to access secret refs depending on the content type :-\ | 21:33 |
| redrobot | something to think about for v2 I guess... | 21:33 |
| jvrbanac | yeah...I never thought about it until I'm having to write docs about what this thing does... lol! | 21:35 |
| *** mdarby has quit IRC | 21:38 | |
| openstackgerrit | Douglas Mendizábal proposed openstack/python-barbicanclient: Don't ignore payload_content_encoding if set https://review.openstack.org/168163 | 21:44 |
| rm_work | jvrbanac: yeah it is name because they are named secrets in a container | 21:44 |
| rm_work | jvrbanac: Cert and RSA containers just have "mandatory names" | 21:45 |
| rm_work | why would it need to work differently? | 21:45 |
| *** ccneill has quit IRC | 21:48 | |
| jvrbanac | rm_work, well, it's more of the fact that when they're mandatory, they are treated as types of secrets. Unlike in a generic case where it's just random metadata for the ref. It's the two major different functionalities out a common field. It's just weird to document. | 21:49 |
| jvrbanac | rm_work, when I write docs, I try to come from a "I've never worked with barbican before" mindset. Hense why I was asking the question about why "name" when it looks like a "type" | 21:52 |
| rm_work | well | 21:54 |
| rm_work | it's not strictly a type | 21:54 |
| rm_work | but i guess i could see how it would look that way | 21:54 |
| rm_work | i mean | 21:54 |
| rm_work | for CertRef | 21:55 |
| rm_work | err CertContainer | 21:55 |
| rm_work | certificate | 21:55 |
| rm_work | and | 21:55 |
| rm_work | intermediates | 21:55 |
| rm_work | are both "certificates" | 21:55 |
| redrobot | jvrbanac rm_work I actually had a conversation with someone new to Barbican about this very thing... https://groups.google.com/forum/#!topic/cloudkeep/nscNOcKUjGQ | 21:55 |
| rm_work | redrobot: yeah the confusion there is that someone wrote a bad example | 21:56 |
| redrobot | rm_work keep scrolling dude! | 21:56 |
| rm_work | redrobot: if those had been three different secret refs, i don't think he would have been confused | 21:56 |
| redrobot | rm_work scroll about halfway down, to Generic vs RSA containers | 21:56 |
| rm_work | lol | 21:57 |
| rm_work | "But still my question is that why are we providing the name as private_key , public_key and private_key_passphrase for the same secret reference despite the fact that the secret_ref can only refer to any one of the key type (ie private_key , public_key and private_key_passphrase )." | 21:57 |
| rm_work | err nm that's a quote | 21:57 |
| rm_work | yeah ok | 21:57 |
| *** mragupat has quit IRC | 21:57 | |
| redrobot | What is the importance of RSA type containers holding 3 secrets since we could use generic containers which holds multiple secrets . | 21:57 |
| redrobot | Are the secrets in RSA type containers logically connected or they used for the single client. | 21:57 |
| redrobot | Could you please give an example of Generic Secret so that it helps me to understand the difference between Generic and RSA type containers | 21:57 |
| rm_work | the answer is "there is no importance of the RSA type, except for systems that want a contract" | 21:57 |
| rm_work | otherwise yeah he could use a generic container and do the same thing | 21:58 |
| rm_work | it's for service contracts | 21:58 |
| *** mragupat has joined #openstack-barbican | 21:58 | |
| openstackgerrit | Douglas Mendizábal proposed openstack/python-barbicanclient: Consolidate Payload Exceptions https://review.openstack.org/168116 | 22:02 |
| jvrbanac | rm_work, redrobot it's nothing to worry about in the near-term, but one day, it might be worthwhile to spend some time on the API thinking about UX. | 22:03 |
| jvrbanac | i.e. the eventual progression of an api ;) | 22:03 |
| redrobot | jvrbanac I agree... we need to start a list of grievances with the current API, and once we've spent some time kicking v1 around we can start thinking about v2 | 22:04 |
| * redrobot thinks it's hard to get things right on the first try | 22:04 | |
| jvrbanac | lol yeah | 22:04 |
| *** tkelsey has quit IRC | 22:06 | |
| *** paul_glass has quit IRC | 22:06 | |
| *** nkinder has quit IRC | 22:11 | |
| *** xaeth is now known as xaeth_afk | 22:11 | |
| *** igueths has quit IRC | 22:15 | |
| *** kebray has joined #openstack-barbican | 22:16 | |
| *** dimtruck is now known as zz_dimtruck | 22:28 | |
| *** ccneill has joined #openstack-barbican | 22:33 | |
| openstackgerrit | Charles Neill proposed openstack/barbican: Security tests for Container resources https://review.openstack.org/164875 | 22:37 |
| *** mragupat_ has joined #openstack-barbican | 22:52 | |
| *** mragupat has quit IRC | 22:55 | |
| *** mragupat_ has quit IRC | 22:57 | |
| *** jaosorior has quit IRC | 23:12 | |
| *** rm_you has joined #openstack-barbican | 23:26 | |
| *** arunkant_ has quit IRC | 23:26 | |
| openstackgerrit | Steve Heyman proposed openstack/barbican: Add ability to run secrets tests in parallel https://review.openstack.org/141138 | 23:30 |
| *** chlong has joined #openstack-barbican | 23:33 | |
| *** jkf has quit IRC | 23:40 | |
| woodster_ | jvrbanac, redrobot, rm_work: FWIW, I've added comments about the container/secrets names/types to the L etherpad here: https://etherpad.openstack.org/p/barbican-L-design-sessions | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!