| *** nelsnelson has quit IRC | 00:11 | |
| *** david-lyle has quit IRC | 00:20 | |
| *** kebray has quit IRC | 00:45 | |
| *** nelsnelson has joined #openstack-barbican | 00:46 | |
| jvrbanac | alee, sry. Meeting heavy day. I don't think anyone is currently tackling writing docs for orders yet. | 01:22 |
|---|---|---|
| *** jamielennox|away is now known as jamielennox | 01:23 | |
| *** david-lyle has joined #openstack-barbican | 01:35 | |
| *** zz_dimtruck is now known as dimtruck | 01:47 | |
| *** dave-mccowan has joined #openstack-barbican | 02:00 | |
| *** SheenaG1 has quit IRC | 02:03 | |
| *** david-lyle has quit IRC | 02:33 | |
| *** gyee has quit IRC | 02:36 | |
| *** pglass has quit IRC | 02:42 | |
| *** kebray has joined #openstack-barbican | 02:53 | |
| *** kebray has quit IRC | 02:53 | |
| *** nelsnelson has quit IRC | 02:53 | |
| *** nelsnelson has joined #openstack-barbican | 02:54 | |
| *** dave-mccowan has quit IRC | 03:04 | |
| *** kebray has joined #openstack-barbican | 03:08 | |
| *** david-lyle has joined #openstack-barbican | 03:11 | |
| *** dave-mccowan has joined #openstack-barbican | 03:36 | |
| *** jaosorior has joined #openstack-barbican | 03:44 | |
| rm_work | jaosorior: back to TX | 03:52 |
| rm_work | i hadn't gone back yet | 03:52 |
| jaosorior | rm_work: aaah, that makes sense | 03:55 |
| jaosorior | damn, jetlag is hitting pretty hard again, woke up at 4am X_x | 03:55 |
| *** dave-mccowan has quit IRC | 04:09 | |
| *** dimtruck is now known as zz_dimtruck | 04:15 | |
| *** kebray_ has joined #openstack-barbican | 06:32 | |
| *** kebray has quit IRC | 06:36 | |
| *** nickrmc83 has joined #openstack-barbican | 07:32 | |
| *** chlong has quit IRC | 07:45 | |
| *** kebray_ has quit IRC | 08:03 | |
| *** everjeje has joined #openstack-barbican | 08:17 | |
| *** jaosorior has quit IRC | 09:42 | |
| *** openstack has joined #openstack-barbican | 11:37 | |
| *** darrenmoffat has joined #openstack-barbican | 11:37 | |
| *** jaosorior has joined #openstack-barbican | 12:19 | |
| *** rellerreller has joined #openstack-barbican | 12:41 | |
| *** dave-mccowan has joined #openstack-barbican | 13:48 | |
| *** zz_dimtruck is now known as dimtruck | 14:03 | |
| *** pglass has joined #openstack-barbican | 14:05 | |
| *** chlong has joined #openstack-barbican | 14:05 | |
| *** kfarr has joined #openstack-barbican | 14:10 | |
| *** nelsnelson has quit IRC | 14:38 | |
| *** silos has joined #openstack-barbican | 14:42 | |
| *** nelsnelson has joined #openstack-barbican | 14:53 | |
| silos | hey all. At the conference I heard someone is working on a way to hook up multiple KLM's to barbican. I'm interested in learning more about this and getting my hands dirty with it myself. Could someone point me in the direction of who is in charge of this? | 15:08 |
| redrobot | hi silos! I'm not sure what a KLM is? | 15:09 |
| silos | redrobot: Ah. sorry. It's an instance of a KMIP server. | 15:11 |
| *** kebray has joined #openstack-barbican | 15:11 | |
| silos | redrobot: I think I messed up the acronyms :/. I meant trying to hook up multiple KMIP servers. | 15:12 |
| kfarr | silos, I remember Joel was talking to that person, but I don't know his name. I can ping Joel to see if he remembers | 15:16 |
| redrobot | silos hmm... well, I'm not entirely sure we would want to do that. Currently barbican can support an arbitrary number of plugins, but I don't think we can have more than one instance of a particular type. | 15:17 |
| silos | kfarr: thanks! | 15:17 |
| redrobot | silos we actually have a blueprint to change the way plugins are loaded to have just one read/write plugin and many read-only plugins | 15:17 |
| redrobot | silos https://blueprints.launchpad.net/barbican/+spec/active-secret-store | 15:17 |
| silos | redrobot: ah. I see. | 15:18 |
| redrobot | silos last summit (Paris) we agreed that it would be better for barbican to be very explicit about which HSM device is used for storage. We're recommending that people who have more than one device for read/write deploy one barbican per device. | 15:19 |
| *** xaeth_afk is now known as xaeth | 15:20 | |
| redrobot | silos but if you have a strong use case, a blueprint would be the first step in getting the ball rolling. | 15:20 |
| silos | redrobot: that makes sense. | 15:20 |
| *** SheenaG has joined #openstack-barbican | 15:21 | |
| silos | redrobot: I think the idea was that it allows for easier multi-tenancy by being able to hook up multiple plugins to a single barbican. | 15:21 |
| redrobot | silos how so? | 15:23 |
| redrobot | silos are you wanting to provision a device per tenant/domain ? | 15:23 |
| *** nelsnelson has quit IRC | 15:24 | |
| silos | redrobot: yes that's the idea. | 15:28 |
| redrobot | silos interesting.... sounds crazy expensive... I think it could be done with a custom plugin, without having to change the barbican service. It may be worthwhile to write up a blueprint for it. | 15:29 |
| redrobot | silos https://github.com/openstack/barbican-specs | 15:31 |
| silos | redrobot: ah custom plugin! good idea. I'll try and work on a blueprint after hooking up with who is also working on this. | 15:32 |
| darrenmoffat | why expensive ? multi-tenancy doesn't always imply lots of tenants it could just be two or three. Also the back end HSM might be virtualising via different addresses/ports/accounts | 15:32 |
| darrenmoffat | for example customer doing private cloud where the tenants are separated by Line of Buisness or maybe something like PCI-DSS in scope vs out of scope systems | 15:33 |
| redrobot | darrenmoffat I suppose for a small cloud it wouldn't be too bad... I'm still not sure that it would be any more secure than using different keys though. | 15:35 |
| redrobot | I guess it would depend on who has access to the devices? | 15:35 |
| * redrobot shrugs | 15:35 | |
| jaosorior | redrobot: ping | 15:41 |
| redrobot | jaosorior pong | 15:41 |
| jaosorior | can you help me out debugging something from the gate? | 15:42 |
| redrobot | jaosorior I can try. What's up? | 15:42 |
| jaosorior | redrobot: the CR from project-config that this https://review.openstack.org/#/c/185181/ depended on was merged. And I've been trying to run the dogtag gate on it. But the installation fails | 15:42 |
| jaosorior | redrobot: what's weird, is that it seems to fail while installing ldap in the "Install barbican" step | 15:43 |
| jaosorior | http://logs.openstack.org/81/185181/4/experimental/gate-barbican-dogtag-devstack-dsvm-f21/b660119/logs/devstacklog.txt.gz | 15:43 |
| *** SheenaG has quit IRC | 15:43 | |
| *** nelsnelson has joined #openstack-barbican | 15:46 | |
| woodster_ | silos: darrenmoffat Regarding the HSM plugin dev, there is some documentation available here: http://docs.openstack.org/developer/barbican/plugin/crypto.html#plugin-base-class | 15:47 |
| woodster_ | silos: darrenmoffat The 'bind_kek_metadata()' method is invoked for each project-id a secret is stored under (see https://github.com/openstack/barbican/blob/master/barbican/plugin/crypto/crypto.py#L285) | 15:48 |
| *** igueths has joined #openstack-barbican | 15:48 | |
| openstackgerrit | Merged openstack/barbican: Add more users/roles to secret/container RBAC tests https://review.openstack.org/185135 | 15:49 |
| rellerreller | silos Instead of having a new KMIP plugin for each tenant you could modify the existing KMIP plugin to store secrets on a particular KMIP device based on some routing strategy. | 15:50 |
| woodster_ | silos: darrenmoffat Actually scratch all of that...you said this was a multi-KMIP plugin | 15:50 |
| silos | woodster_: thanks. It's still good to have this knowledge | 15:51 |
| rellerreller | silos We have talked about that. For instance if one KMIP device cannot handle enough keys then have multiple devices. That requires storing the KMIP device URL in the metadata that is returned. It should not take long. | 15:51 |
| woodster_ | silos: well we have two key management modes...the KMIPs are at a 'secret store' level, whereby the secret storage device is separate from Barbican. The crypto-plugin stuff I mentioned above is a lower level interface whereby Barbican stores the encrypted information in its own database. | 15:52 |
| silos | rellerreller: I think that's what redrobot was hinting at about the custom plugin. Except in this case we would just add that functionality to the KMIP plugin itself instead of creating a new plugin. | 15:53 |
| *** barra204 has quit IRC | 15:54 | |
| silos | woodster_: true true. | 15:55 |
| *** everjeje has quit IRC | 15:57 | |
| woodster_ | silos: rellerreller I think what's missing is adding the project ID to the SecretDTO (here https://github.com/openstack/barbican/blob/master/barbican/plugin/interface/secret_store.py#L279)...so the store_secret() method can use that to select the KMIP backend | 15:59 |
| *** SheenaG has joined #openstack-barbican | 16:00 | |
| rellerreller | woodster_ Yes, you would definitely need that. | 16:01 |
| rellerreller | woodster_ I think I might have noticed that while working on content types. I think if you add that then the HSM secret store would not need the context any longer and could implement the SecretStore interface. | 16:02 |
| rellerreller | woodster_ I _think_ :) | 16:02 |
| *** rellerreller has quit IRC | 16:05 | |
| *** rellerreller has joined #openstack-barbican | 16:07 | |
| *** Kevin_Bishop has joined #openstack-barbican | 16:09 | |
| *** xaeth is now known as xaeth_afk | 16:12 | |
| woodster_ | rellerreller: hmmm...possibly. Now that we are using request-scoped transactions, not as big a deal to hit sqlalchemy multiple times to get the same models (like the project and secret models). | 16:13 |
| *** chadlung has joined #openstack-barbican | 16:34 | |
| *** xaeth_afk is now known as xaeth | 16:53 | |
| *** nickrmc83 has quit IRC | 16:56 | |
| *** kebray has quit IRC | 17:00 | |
| *** kebray has joined #openstack-barbican | 17:04 | |
| *** everjeje has joined #openstack-barbican | 17:23 | |
| arunkant | jaosorior: Can you check my reply comments for https://review.openstack.org/#/c/176558/3 . And let me know what you think. | 17:25 |
| *** chlong has quit IRC | 17:53 | |
| reaperhulk | I got an apology from Hyatt for their terrible elevator system | 17:53 |
| *** kebray has quit IRC | 17:55 | |
| chellygel | reaperhulk, did it have any $$$ with it? | 17:56 |
| reaperhulk | nope | 17:57 |
| chellygel | what a shitty apology :P | 17:58 |
| *** kebray has joined #openstack-barbican | 17:58 | |
| *** SheenaG has left #openstack-barbican | 18:07 | |
| *** Kevin_Bishop has quit IRC | 18:07 | |
| *** Kevin_Bishop has joined #openstack-barbican | 18:19 | |
| *** SheenaG has joined #openstack-barbican | 18:40 | |
| *** dave-mccowan has quit IRC | 18:52 | |
| *** dave-mccowan has joined #openstack-barbican | 19:10 | |
| *** chadlung has quit IRC | 19:16 | |
| *** chadlung has joined #openstack-barbican | 19:16 | |
| *** gyee has joined #openstack-barbican | 19:16 | |
| *** kebray has quit IRC | 19:23 | |
| *** redrobot sets mode: +v chellygel | 19:23 | |
| *** redrobot sets mode: +v alee | 19:23 | |
| *** redrobot sets mode: +v hockeynut | 19:23 | |
| *** redrobot sets mode: +v kfarr | 19:23 | |
| *** redrobot sets mode: +v jvrbanac | 19:23 | |
| *** redrobot sets mode: +v chadlung | 19:24 | |
| *** redrobot sets mode: +v rellerreller | 19:24 | |
| *** redrobot sets mode: +v woodster_ | 19:24 | |
| *** redrobot sets mode: +v jaosorior | 19:26 | |
| *** rellerreller has quit IRC | 19:41 | |
| *** SheenaG has left #openstack-barbican | 19:42 | |
| openstackgerrit | Steve Heyman proposed openstack/barbican: Complete RBAC tests for secrets https://review.openstack.org/186149 | 20:13 |
| *** kebray has joined #openstack-barbican | 20:20 | |
| *** kfarr has quit IRC | 20:22 | |
| *** barra204 has joined #openstack-barbican | 20:35 | |
| *** kebray has quit IRC | 20:48 | |
| *** kebray has joined #openstack-barbican | 20:48 | |
| *** barra204 has quit IRC | 20:50 | |
| dave-mccowan | hockeynut ping | 20:50 |
| hockeynut | dave-mccowan yessir! | 20:50 |
| dave-mccowan | hockeynut are you also adding container_rbac tests? | 20:51 |
| hockeynut | yessir | 20:51 |
| hockeynut | just finishing them up now | 20:51 |
| hockeynut | I broke them up into 2 CRs so they wouldn't be too huge | 20:51 |
| dave-mccowan | cool. i'll review 'em. :-) | 20:52 |
| hockeynut | thx! | 20:55 |
| hockeynut | hey all - looking at this page https://github.com/cloudkeep/barbican/wiki/Role-Based-Access-Control#roles and it implies that you can issue a PUT to a container. I believe that is wrong... | 20:57 |
| redrobot | hockeynut that wiki page needs to die a horrible death. The up-to-date docs are here http://docs.openstack.org/developer/barbican/api/reference/containers.html | 21:10 |
| hockeynut | thanks. given the cloudkeep I figured it was old...but that rbac table is nice (wrong, but nice) | 21:11 |
| woodster_ | hockeynut: redrobot Do we have a new RBAC page now? | 21:19 |
| redrobot | woodster_ I don't think so... unless arunkant added RBAC stuff to his docs... | 21:20 |
| woodster_ | redrobot: he's been working on the ACL stuff I think, not the RBAC stuff | 21:21 |
| redrobot | woodster_ but the two are related.... ie. the ACL stuff affects how RBAC works. | 21:21 |
| woodster_ | redrobot: when the ACL is used to greenlight a secret's access the traditional 4 roles don't apply. They certainly belong together in our docs under 'RBAC', but they do operate differently than the 4-role matrix stuff captured in the original wiki. | 21:23 |
| reaperhulk | redrobot: do you know Jason's email (symantec) | 21:24 |
| jkf | reaperhulk: I can message it to you. | 21:25 |
| reaperhulk | ah, jkf you're here :) | 21:25 |
| reaperhulk | please do, I'm going to send the "let's harass safenet about aes key wrap" email ;) | 21:25 |
| jkf | heheh, will do. | 21:26 |
| *** dave-mccowan has quit IRC | 21:28 | |
| *** dave-mccowan has joined #openstack-barbican | 21:29 | |
| *** pglass has quit IRC | 21:30 | |
| *** pglass has joined #openstack-barbican | 21:31 | |
| *** dave-mccowan has quit IRC | 21:34 | |
| *** silos has left #openstack-barbican | 21:48 | |
| *** xaeth is now known as xaeth_afk | 21:54 | |
| arunkant | redrobot, woodster_, I have not changed any existing container/secret API and just added ACL docs. I don't recall seeing any rbac documentation related to that | 22:00 |
| woodster_ | arunkant: Yeah, the RBAC matrix (with the original 4 roles) need to eventually be added in a future CR. | 22:01 |
| woodster_ | arunkant: redrobot And we still need a 5th role added, that read-only role, at some point too | 22:02 |
| woodster_ | arunkant: redrobot I keep forgetting about that :\ | 22:02 |
| redrobot | woodster_ I can add it to the list of TODOs you signed up for at the Summit :0 | 22:03 |
| *** xaeth_afk is now known as xaeth | 22:04 | |
| arunkant | woodster_ , redrobot, can you guys review ACL changes (doc + code). I have updated docs with statement related to near future change. | 22:05 |
| *** pglass has quit IRC | 22:05 | |
| redrobot | arunkant I'll try to get to it tomorrow. | 22:07 |
| openstackgerrit | Joe Gordon proposed openstack/barbican: Drop incubating theme from docs https://review.openstack.org/186188 | 22:10 |
| openstackgerrit | Joe Gordon proposed openstack/barbican-specs: Drop incubating theme from docs https://review.openstack.org/186191 | 22:12 |
| *** xaeth is now known as xaeth_afk | 22:16 | |
| openstackgerrit | Joe Gordon proposed openstack/python-barbicanclient: Drop incubating theme from docs https://review.openstack.org/186197 | 22:19 |
| *** SheenaG has joined #openstack-barbican | 22:25 | |
| *** SheenaG has left #openstack-barbican | 22:26 | |
| *** igueths has quit IRC | 22:26 | |
| *** jaosorior has quit IRC | 22:32 | |
| *** nelsnelson has quit IRC | 22:32 | |
| *** dimtruck is now known as zz_dimtruck | 22:35 | |
| openstackgerrit | John Wood proposed openstack/barbican-specs: Add Crypto/HSM MKEK Rotation Support (Light) https://review.openstack.org/181598 | 22:38 |
| *** chadlung has quit IRC | 22:45 | |
| *** Kevin_Bishop has quit IRC | 22:53 | |
| jkf | woodster_: Regarding the key rotation specs, is there a need for two overlapping specs? The light spec covers mkeks, but the heavy weight could changed to cover just the project kek, and the rotations could be handled as two independant steps. | 22:57 |
| jkf | I can think of a few groups in Symantec that might want a much shorter project kek rotation schedule than a more relaxed default and it could be good to have that decoupled from mkek rotations. | 22:58 |
| *** kfox1111 has joined #openstack-barbican | 23:02 | |
| kfox1111 | hey all. | 23:02 |
| kfox1111 | anyone working on rdo barbican rpms yet? | 23:02 |
| woodster_ | jkf: well the lightweight bp replaces wrapped project kek info in place, whereas the heavyweight one calls for adding new wrapped project kek records, as well as updating secrets. They are pretty different logic, so I wouldn't consider them overlapping. If you just wanted to update the project keks (and wrapping them with current MKEK), you'd still be using | 23:02 |
| woodster_ | the heavyweight process I'd say. | 23:02 |
| woodster_ | kfox1111: yes, alee (Ade) and xaeth (Greg Swift here at Rackspace) are working on that...I don't know much beyond that | 23:03 |
| woodster_ | arunkant: I'll take a look at your CRs tonight/tomorrow morning btw | 23:03 |
| jkf | I was just thinking overlapping in that they both describe the mkek process, with the heavy bp going on to describe the project kek process as well. | 23:04 |
| *** chlong has joined #openstack-barbican | 23:05 | |
| kfox1111 | I looked at some packaging a few months ago, I think by maybe those folks, but I need to redeploy it again, and was hoping something was coming soon so I wouldn't have to build it myself. | 23:05 |
| woodster_ | jkf: the project kek processing itself is different between the two though...the lightweight one reuses the generated project kek for example, just re-wrapping with the new MKEK. If you really want a truely new project KEK for your secrets, the heavyweight approach is needed, even if you don't rotate your MKEK. | 23:06 |
| woodster_ | elmiko: are you there? | 23:06 |
| kfox1111 | I've got part of the nova instance user prototype built, and am at the point I need to get it test talking to barbican. | 23:06 |
| kfox1111 | gota see if an unscoped keystone token will work with barbican acl's. | 23:06 |
| woodster_ | kfox1111: elmiko and alee are working together on the RDO side of things I think | 23:06 |
| kfox1111 | ok. I'll try and get a hold of them. thanks. :) | 23:07 |
| jkf | woodster_: Of course, I may be overthinking things and making something out of nothing. :) | 23:11 |
| woodster_ | jkf: I never assume I'm right either! I do think that heavyweight Bo | 23:24 |
| woodster_ | Would work for you though | 23:24 |
| jkf | We'll need both and as long as the two processes are decoupled, in that I can rotate a project kek, without changing the mkek, or change the mkek without having to do more than just rewrap the project keks, I'm good. | 23:25 |
| jkf | I'm out, ttyl. | 23:34 |
| *** nelsnelson has joined #openstack-barbican | 23:36 | |
| *** rellerreller has joined #openstack-barbican | 23:37 | |
| *** everjeje has quit IRC | 23:37 | |
| *** nelsnelson has quit IRC | 23:52 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!