Thursday, 2015-06-04

*** gyee has quit IRC00:23
*** xaeth is now known as xaeth_afk01:00
*** openstack has joined #openstack-barbican01:21
-cameron.freenode.net- [freenode-info] why register and identify? your IRC nick is how people know you. http://freenode.net/faq.shtml#nicksetup01:21
*** openstack has joined #openstack-barbican01:36
*** stanzi has joined #openstack-barbican01:42
*** openstack has quit IRC01:52
*** openstack has joined #openstack-barbican01:53
*** stanzi has quit IRC02:15
*** nelsnelson has quit IRC02:21
*** stanzi has joined #openstack-barbican02:23
*** nkinder_ has quit IRC02:27
*** nelsnelson has joined #openstack-barbican02:35
*** nkinder_ has joined #openstack-barbican02:39
*** nelsnelson has quit IRC02:48
*** stanzi has quit IRC03:11
*** stanzi has joined #openstack-barbican03:11
*** stanzi has quit IRC03:56
*** dave-mccowan has quit IRC03:57
*** stanzi has joined #openstack-barbican03:57
*** stanzi_ has joined #openstack-barbican04:06
*** stanzi has quit IRC04:10
*** mordred has quit IRC04:21
*** mordred has joined #openstack-barbican04:25
*** stanzi_ has quit IRC04:35
*** xaeth_afk is now known as xaeth04:58
*** xaeth is now known as xaeth_afk05:39
*** stanzi has joined #openstack-barbican05:45
*** stanzi has quit IRC05:50
*** epequeno has quit IRC06:40
*** woodster_ has quit IRC07:00
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: service_enabled instead of environment variable for dogtag  https://review.openstack.org/18518107:31
nickrmc83chellygel: ello. I've added a comment to the review about the prompt. Looks good to me.07:33
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: Display all versions info in versions controller  https://review.openstack.org/17860107:37
*** chlong has quit IRC07:44
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: service_enabled instead of environment variable for dogtag  https://review.openstack.org/18518107:58
*** tkelsey has joined #openstack-barbican09:06
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: service_enabled instead of environment variable for dogtag  https://review.openstack.org/18518109:19
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: Display all versions info in versions controller  https://review.openstack.org/17860109:36
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: service_enabled instead of environment variable for dogtag  https://review.openstack.org/18518109:38
*** jaosorior has joined #openstack-barbican09:45
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: service_enabled instead of environment variable for dogtag  https://review.openstack.org/18518110:04
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: Display all versions info in versions controller  https://review.openstack.org/17860110:18
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: service_enabled instead of environment variable for dogtag  https://review.openstack.org/18518110:34
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: service_enabled instead of environment variable for dogtag  https://review.openstack.org/18518110:46
*** woodster_ has joined #openstack-barbican11:00
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: service_enabled instead of environment variable for dogtag  https://review.openstack.org/18518111:12
jaosorioralee: ping11:43
*** darrenmoffat has quit IRC11:48
*** darrenmoffat has joined #openstack-barbican11:49
jaosorioralee: Well, you'll see this when you're back. Regarding the dogtag gate: https://review.openstack.org/#/c/185181/11:55
jaosorioralee: it seems that it's running the tests. And now the gate actually gets configured http://logs.openstack.org/81/185181/12/experimental/gate-barbican-dogtag-devstack-dsvm-f21/df96282/logs/etc/barbican/barbican-api.conf.txt.gz11:56
jaosorioralee: But it seems to be failing the tests... for some reason Barbican is throwing this error: SecretStorePluginsNotConfigured: No secret store plugins have been configured11:57
jaosoriorsame with the certificate plugins12:00
jaosoriorwoodster_: If you're around, maybe you could also take a look. At least if there's something wrong in the config file12:01
jaosoriorperhaps the namespace is wrong?12:01
thervejaosorior, Possibly a dependency issue?12:05
thervejaosorior, "Could not load 'dogtag': No module named nss.nss" from the logs12:05
jaosoriortherve: aaaah mssed that one12:06
jaosoriortherve: know where that comes from?12:08
therveUsed to, let me check :)12:09
thervejaosorior, https://pypi.python.org/pypi/python-nss/ I believe12:10
jaosoriortherve: you da man!12:11
jaosoriorI'll upload the fix after the gym12:11
*** chlong has joined #openstack-barbican12:20
*** alee has quit IRC12:31
*** rellerreller has joined #openstack-barbican12:34
*** rellerreller has quit IRC12:44
*** rellerreller has joined #openstack-barbican12:47
*** rellerreller has quit IRC12:59
*** rellerreller has joined #openstack-barbican12:59
*** nelsnelson has joined #openstack-barbican13:15
*** alee has joined #openstack-barbican13:31
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: service_enabled instead of environment variable for dogtag  https://review.openstack.org/18518113:44
aleejaosorior, hopefully it will work this time round13:46
jaosorioralee: It's close dude :D at least now it actually gets configured13:46
alee:)13:47
*** SheenaG has joined #openstack-barbican13:47
aleejaosorior, I need to add python-nss to the dogtag docs ..13:47
jaosoriorwhich docs?13:47
aleejaosorior, I'm actually surprised it was not pulled in as a dependency13:48
aleeneed to look into that13:48
aleejaosorior, getting link -- it will be good for you to review13:48
aleejaosorior, https://review.openstack.org/#/c/186771/13:48
jaosoriorI see13:49
*** zz_dimtruck is now known as dimtruck13:54
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: service_enabled instead of environment variable for dogtag  https://review.openstack.org/18518114:05
*** pglbutt has joined #openstack-barbican14:05
*** kfarr has joined #openstack-barbican14:06
*** SheenaG has quit IRC14:06
aleejaosorior, you forgot to check experimental -- just did it14:07
jaosorioralee: thanks14:09
jaosorioralee: might also be worth adding in some documentation that for fedora, openldap-devel is needed to install barbican14:10
aleejaosorior, I think thats in the quick start guide perhaps?14:12
aleejaosorior, yeah - the dev setup guide has a section for ubuntu but not fedora .  need to add that14:14
aleejaosorior, it would be nice to have a small note in the dogtag setup guide on how to set it up using devstack.14:15
aleejaosorior, perhaps you can add that as a dependent CR?  Or once this CR lands ..14:17
jaosorioralee: sure14:17
aleejaosorior, presumably once your CR lands, its a simple invocation of devstack with certain options enabled?14:19
aleeafter all thats what the gate job does, right?14:20
*** Kevin_Bishop has joined #openstack-barbican14:21
jaosoriorUhm... the gate job uses some separate scripts from the devstack-gate repo. So I'm not sure if it works the same way (lots of sourcing of script happens in between). But rm_work might know :D14:22
*** SheenaG has joined #openstack-barbican14:22
jaosorioralee: but in theory, to my understanding, it should be quite straight forward because of that flag14:30
*** silos has joined #openstack-barbican14:39
jaosorioralee: well, now the error log got pretty interesting14:39
aleejaosorior, looking14:39
aleejaosorior, a bunch of stuff passed and a bunch of stuff failed ..14:42
jaosorioralee: I'll be away for a couple of hours. But ping me if you find something. I'll get back to this when I'm back14:43
aleejaosorior, will do thanks14:43
therveThe SEC_ERROR_BAD_DATABASE at the beginning looks suspicious14:46
aleejaosorior, wonder what this is -- 2015-06-04 14:30:45.906 13235 CRITICAL barbican [-] OperationalError: (OperationalError) (1071, 'Specified key was too long; max key length is 767 bytes') 'CREATE INDEX values_index ON container_consumer_metadata (container_id, name, `URL`)' ()14:46
aleetherve, yup14:46
*** chlong has quit IRC14:47
aleetherve, yeah - I think thats it14:47
aleeback in a few mins ..14:47
*** alee is now known as alee_brb14:47
therveTje index error is strange, it's supposed to be a warning I think14:49
*** nelsnels_ has joined #openstack-barbican14:54
alee_brbtherve, yeah - I expect thats a test case that was supposed to fail.14:54
alee_brbtherve, jaosorior need to look at the scripts to see if/how the nss client db is being set up14:55
alee_brbmaybe a permissions error14:56
*** nelsnelson has quit IRC14:56
*** rellerreller has quit IRC14:59
*** alee_brb is now known as alee14:59
thervealee, I don't see how /etc/barbican/alias is created15:02
aleetherve, that might be it ..15:03
aleetherve, it should be created15:12
aleedogtag.py line 8815:13
aleecryptoutil.NSSCryptoProvider.setup_database(15:13
alee                nss_db_path, nss_password, over_write=True)15:13
aleewhich will make the dir if it does not exist15:14
*** nelsnelson has joined #openstack-barbican15:20
*** arunkant_ has joined #openstack-barbican15:22
*** nelsnels_ has quit IRC15:22
*** nelsnels_ has joined #openstack-barbican15:26
*** xaeth_afk is now known as xaeth15:26
*** nelsnelson has quit IRC15:27
*** nelsnelson has joined #openstack-barbican15:33
*** gyee has joined #openstack-barbican15:33
*** nelsnels_ has quit IRC15:33
*** kebray has joined #openstack-barbican15:35
chellygelreaperhulk, https://review.openstack.org/#/c/186800/  would appreciate the review on the key generation script if you get the chance. :) would happily give a demo too if that'd help15:36
*** nelsnelson has quit IRC15:38
arunkant_alee, _woodster, redrobot : ACL flag rename is up for review: https://review.openstack.org/#/c/188208/ .  Will be able to start ACL related barbican client changes after this15:59
*** nickrmc83 has quit IRC16:02
*** xaeth is now known as xaeth_afk16:04
openstackgerritOpenStack Proposal Bot proposed openstack/barbican: Updated from global requirements  https://review.openstack.org/18847016:16
*** dolphm has joined #openstack-barbican16:24
dolphmwoodster_: is there a barbican spec for ACLs? (or more specifically, for user groups in ACLs?)16:25
woodster_dolphm: not right now but I planned to put one up.16:25
dolphmwoodster_: actually this looks to be the base ACL spec? https://github.com/openstack/barbican-specs/blob/master/specs/kilo/add-per-secret-policy.rst16:26
woodster_dolphm: it would be very much like the user-based ACL that we have now though...http://docs.openstack.org/developer/barbican/api/reference/acls.html16:26
dolphmit actually mentions groups and a blocker on keystone - perfect for my needs16:26
woodster_dolphm: sounds good, thanks!16:27
dolphmwoodster_: i'm writing the spec for keystone now! just wanted something to reference on the barbican side. the api reference looks handy16:27
woodster_dolphm: it is a work in progress, but should give you the gist of the feature. Thanks again for the Keystone-side help16:28
dolphmwoodster_: /salute16:28
woodster_redrobot: So is the plan to have the final version of ACL (with project-access) ported into a final Kilo? If so, we don't need migration scripts from creator-only -> project-access, correct?16:30
woodster_arunkant_: ^^^^16:30
*** kebray has quit IRC16:36
*** kebray has joined #openstack-barbican16:38
jaosorioralee, therve: any findings?16:44
aleejaosorior, I think therve is onto something16:44
aleejaosorior, the latest dogtag code will create the directory for the nss certdb (for the client) if its not there.16:45
aleeI'm not sure if thats whats in the repo though16:45
aleejaosorior, so I think we should create the directory just in case16:46
aleeand see if that makes a difference16:46
aleejaosorior, ie. create the directory /etc/barbican/alias16:46
aleeand set ownership to the barbican user16:46
jaosoriorOk16:51
redrobotwoodster_ I'm thinking maybe the migration script is a different CR, so we can just cherry pick project-access16:52
jaosorioralee: what version of dogtag already created the directory?16:53
alee jaosorior I'm not sure offhand16:55
aleejaosorior, lets see if this works16:56
*** silos has left #openstack-barbican17:03
jaosorioralee: Alright, now I'm home. So, what part should be creating that directory? ca? kra?17:09
aleejaosorior, its needed for the kra17:10
jaosorioralright17:10
openstackgerritJuan Antonio Osorio Robles proposed openstack/barbican: service_enabled instead of environment variable for dogtag  https://review.openstack.org/18518117:12
aleejaosorior, make sure to check experimental17:13
*** Corpsman has joined #openstack-barbican17:30
jaosorioralee: same errors17:39
aleejaosorior, looking17:39
jaosorior NSPRError: (SEC_ERROR_BAD_DATABASE) security library: bad database.17:40
aleejaosorior, right - thats supposed to be in /etc/barbican/alias17:44
jaosoriorWhich is created here: https://review.openstack.org/#/c/185181/15/contrib/devstack/lib/barbican in line 7317:46
*** gyee has quit IRC17:49
aleejaosorior, actually -- I think we may need to make one change ..17:50
jaosoriorwhat's up?17:51
aleejaosorior, in ..17:51
aleeetc/barbican/barbican-api.conf17:51
aleechange nss_db_path_ca = '/etc/barbican/alias-ca' to /etc/barbican/alias17:52
jaosoriorwhy not just create /etc/barbican/alias-ca instead?17:52
aleejaosorior, I think when I did my testing it worked better with a single db17:53
aleejaosorior, lets try that in any case and see if that improves things17:53
aleejaosorior, it may also be worthwhile printing some stuff to the logs ..17:53
aleejaosorior, maybe at the end of the test17:54
aleethings like --17:54
aleels -l /etc/barbican/alias17:54
aleecertutil -L -d /etc/barbican/alias17:54
aleesee if there is a valid certdb there and if the transport cert is stored17:55
woodster_redrobot: my thinking was that we could combine migration scripts to add ACL and then just add the project-access field, rather than have one to add creator-only and then another to change that to project-access. It is like squashing commits then, and that negative logic SQL call arunkant_ has in the latest CR wouldn't be needed :)17:58
*** igueths has joined #openstack-barbican18:00
redrobotwoodster_ you mean edit the migration that is already in the repo?18:01
*** barra204 has joined #openstack-barbican18:01
woodster_redrobot: effectively yes. We could do this if we know this hasn't been deployed anywhere.18:03
woodster_redrobot: this is for the final done done Kilo release, so I think we could make that statement18:04
woodster_redrobot: I think that raw SQL statement in the CR's migration will give us grief down the road.18:05
iguethswoodster_: redrobot which CR is this?18:06
*** igueths has quit IRC18:06
*** barra204 has quit IRC18:07
*** igueths has joined #openstack-barbican18:07
woodster_igueths: https://review.openstack.org/#/c/188208/1/barbican/model/migration/alembic_migrations/versions/6a4457517a3_rename_acl_creator_only_to_project_.py,cm18:07
iguethswoodster_: Thanks...Accidentally disconnected earlier.18:07
redrobotwoodster_ I don't think that would work for the Kilo branch18:09
*** silos has joined #openstack-barbican18:09
redrobotwoodster_ we need to be able to upgrade from 2015.1.0 -> 2015.1.1, so we need a migration for the existing column18:10
woodster_redrobot: arunkant_ alee elmiko  Also curious about the PATCH call for ACLs now. We can leave it as is, or else change it to be more in line with this RFC which the API-WG is looking at (https://tools.ietf.org/html/rfc6902), or else ditch it in favor of a PUT based approach (which the API-WG prefers). I'm in the ditch it camp, but open for discussion18:10
woodster_redrobot: my only concern is once Kilo is release for real, that PATCH approach is final for 'v1'.18:11
redrobotwoodster_ which is why I was thinking to do the JSON response change in one cr that uses the existing column and does the inversion in code, and then follow up with a CR that fixes the model.  The second CR wouldn't even be needed in Kilo.  People would get it when they upgrade to Liberty.18:11
woodster_redrobot: oh yeah, if they get unique tags, then you are correct18:11
*** alee is now known as alee_lunch18:12
redrobotwoodster_ arunkant_  the more I think about it, the more I like a code change only CR first.  That way the schema stays the same across both kilo releases, and then either one would be able to migrate to Liberty when it comes out.18:13
woodster_redrobot: that makes sense, but would still need the negative logic migration that arunkant_ has now in Liberty. Maybe better to just get 'er done now then as arunkant_ has now18:13
woodster_redrobot: well, they will run whatever alembic scripts are needed to catch up to master/liberty...should be independent of the tagged release boundaries18:14
redrobotwoodster_ that's true.18:15
redrobotwoodster_ yeah, if we can validate that it works for both MySQL and Postgres, then it should be fine, I think.18:16
woodster_redrobot: (I was just writing this now:) I guess if we could verify that UPDATE call works on MySQL and PostgreSQL we'd be...18:16
woodster_redrobot: part of the barbican borg we are!18:17
redrobotwoodster_ #hivemind18:17
elmikowoodster_: i need to read up on the ACL stuff a little more, sorry but i'm a little out of touch with that side of things18:21
arunkant_woodster_, As part of change, I did try the update statement in MySQL. I don't have postgreSQL so did not get to test that18:22
woodster_elmiko: I was really referring to the PATCH API part of the ACL, which you've already been very helpful with.18:27
woodster_arunkant_: that's cool. Most likely that would work on postgres then18:28
*** SheenaG has quit IRC18:32
*** openstackstatus has joined #openstack-barbican18:39
*** ChanServ sets mode: +v openstackstatus18:39
iguethsarunkant_: woodster_ I was specifically interested in the exact SQL queries that were run, so far they look pretty database agnostic.18:39
iguethss/were run/are run/18:39
-openstackstatus- NOTICE: Gerrit has been restarted to clear an issue with its event stream. Any change events between 17:25 and 18:38 UTC should be rechecked or have their approvals reapplied to initiate testing.18:41
arunkant_iquesths : woodster_ has the concern that update syntax may not work in PostgreSql . I think it might be quite easy to check if one has that db instance18:46
arunkant_ igueths  ^^^18:46
*** kebray has quit IRC18:49
openstackgerritSteve Heyman proposed openstack/barbican: Complete RBAC tests for containers  https://review.openstack.org/18641018:49
hockeynut^ needs one more +2 and a workflow ^18:50
*** SheenaG has joined #openstack-barbican18:52
*** elmiko is now known as _elmiko18:53
*** Corpsman has left #openstack-barbican18:59
*** tkelsey has quit IRC19:02
*** xaeth_afk is now known as xaeth19:06
iguethsarunkant_: Yeah...You'd just have to drop the DB, or otherwise find a way to initiate an Alembic migration.19:06
iguethsarunkant_: Failing that one can simply do manual testing by logging into an Postgres instance, running suspect queries within a transaction i.e., begin/commit block and then issue an rollback to exit the transaction rather than commit changes.19:07
arunkant_igueths : Actually if there is access to postgress db instance, this kind of check can be ran on any table which has boolean field to simply test the syntax19:08
arunkant_igueths: Yes.19:08
iguethsarunkant_: I don't see why not.19:10
*** alee_lunch is now known as alee19:11
arunkant_igueths: Will be good to see if someone can verify that. I checked on mysql and it works19:12
aleewoodster_, redrobot , arunkant - sorry - what was decided on acl changes?19:14
iguethsarunkant_: I can probably verify...Need to check if I can borrow any of the Postgres instance I presently have access to for this.19:17
iguethsErr instances19:17
iguethsarunkant_: Once I get some definitive output and presuming nobody beats me to it, I'll drop a comment in your CR.19:26
*** elmiko has joined #openstack-barbican19:27
*** silos1 has joined #openstack-barbican19:32
*** silos has quit IRC19:34
*** rellerreller has joined #openstack-barbican19:35
redrobotalee waiting to verify that the migration works with postgresql, if so, the current change should be good.19:41
*** xaeth is now known as xaeth_afk19:45
aleeredrobot, you mean change to "project_access" ?19:53
redrobotalee yeah19:53
aleeredrobot, and then that will go into Kilo?19:54
redrobotalee yep.  then we'll release 2015.1.119:54
aleeredrobot, ok - and PATCH -> PUT changes go into L?19:54
redrobotalee Kilo Service Pack 1 :)19:54
redrobotalee I would think so, yeah19:55
aleeok - I think thats a good idea.  we'll have to keep patch around for a bit - but we can deprecate it19:56
woodster_igueths: thanks for the help19:56
iguethswoodster_: No problem.19:57
*** nelsnelson has joined #openstack-barbican19:59
openstackgerritMerged openstack/barbican: Complete RBAC tests for containers  https://review.openstack.org/18641020:00
*** silos1 has left #openstack-barbican20:05
*** SheenaG has quit IRC20:06
openstackgerritOpenStack Proposal Bot proposed openstack/barbican: Updated from global requirements  https://review.openstack.org/18847020:06
*** nelsnelson has quit IRC20:07
jaosorioralee: the change from alias-ca to alias didn't seem to work :/20:13
openstackgerritJohn Wood proposed openstack/barbican: Add retry server and functional tests to DevStack  https://review.openstack.org/17089620:19
aleejaosorior, hmm .. did you add the extra logs?20:20
aleejaosorior, got to go offline now - back online in about an hour.20:20
*** silos1 has joined #openstack-barbican20:20
*** rellerreller has quit IRC20:21
openstackgerritJohn Wood proposed openstack/barbican: Add retry server and functional tests to DevStack  https://review.openstack.org/17089620:22
*** alee has quit IRC20:25
*** SheenaG has joined #openstack-barbican20:32
*** xaeth_afk is now known as xaeth20:40
*** silos1 has left #openstack-barbican21:00
*** silos1 has joined #openstack-barbican21:01
*** silos1 has left #openstack-barbican21:01
*** operator99 is now known as gyee21:02
*** elmiko has quit IRC21:11
*** kfarr has quit IRC21:18
*** SheenaG1 has joined #openstack-barbican21:22
*** SheenaG has quit IRC21:22
*** pglbutt has quit IRC21:37
*** pglbutt has joined #openstack-barbican21:38
*** pglbutt has quit IRC21:43
*** _elmiko is now known as elmiko21:47
*** alee has joined #openstack-barbican21:47
*** kebray has joined #openstack-barbican21:50
*** Kevin_Bishop has quit IRC22:26
*** igueths has quit IRC22:30
*** kebray has quit IRC22:47
*** kebray has joined #openstack-barbican22:48
*** kebray has quit IRC22:55
*** dimtruck is now known as zz_dimtruck23:07
*** arunkant_ has quit IRC23:17
*** chlong has joined #openstack-barbican23:27
*** xaeth is now known as xaeth_afk23:36

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!