| *** stanzi has quit IRC | 00:10 | |
| *** stanzi has joined #openstack-barbican | 00:16 | |
| *** david-lyle has quit IRC | 00:24 | |
| *** kfox1111 has quit IRC | 00:34 | |
| *** SheenaG has quit IRC | 00:42 | |
| *** zz_dimtruck is now known as dimtruck | 01:05 | |
| *** stanzi has quit IRC | 01:11 | |
| *** SheenaG has joined #openstack-barbican | 01:33 | |
| *** gyee_ has quit IRC | 01:40 | |
| *** david-lyle has joined #openstack-barbican | 02:08 | |
| *** kebray has joined #openstack-barbican | 02:10 | |
| *** SheenaG has quit IRC | 02:28 | |
| *** kebray has quit IRC | 02:45 | |
| *** kebray has joined #openstack-barbican | 02:51 | |
| *** nkinder__ has quit IRC | 03:08 | |
| *** stanzi has joined #openstack-barbican | 03:34 | |
| *** stanzi has quit IRC | 03:35 | |
| *** redrobot has quit IRC | 03:55 | |
| *** dimtruck is now known as zz_dimtruck | 04:02 | |
| *** stanzi has joined #openstack-barbican | 05:20 | |
| *** stanzi has quit IRC | 05:20 | |
| *** stanzi has joined #openstack-barbican | 05:32 | |
| *** stanzi has quit IRC | 05:44 | |
| *** Nirupama has joined #openstack-barbican | 06:07 | |
| *** shohel has joined #openstack-barbican | 06:31 | |
| *** kebray has quit IRC | 06:57 | |
| *** nickrmc83 has joined #openstack-barbican | 06:59 | |
| *** greghaynes has quit IRC | 07:08 | |
| *** greghaynes has joined #openstack-barbican | 07:10 | |
| *** chlong has quit IRC | 07:18 | |
| *** woodster_ has quit IRC | 07:21 | |
| *** shohel has quit IRC | 08:11 | |
| *** shohel has joined #openstack-barbican | 08:11 | |
| *** jaosorior has joined #openstack-barbican | 08:27 | |
| *** nickrmc84 has joined #openstack-barbican | 08:27 | |
| *** nickrmc83 has quit IRC | 08:29 | |
| *** nickrmc84 has quit IRC | 08:29 | |
| *** nickrmc83 has joined #openstack-barbican | 08:30 | |
| *** chlong has joined #openstack-barbican | 09:00 | |
| *** chlong has quit IRC | 09:07 | |
| *** chlong has joined #openstack-barbican | 09:21 | |
| *** nickrmc83 has quit IRC | 09:26 | |
| *** shohel has quit IRC | 10:38 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/barbican: Add project_id to Secret model https://review.openstack.org/181025 | 11:10 |
|---|---|---|
| *** SheenaG has joined #openstack-barbican | 11:10 | |
| *** nickrmc83 has joined #openstack-barbican | 11:21 | |
| *** SheenaG has quit IRC | 12:25 | |
| *** SheenaG has joined #openstack-barbican | 12:26 | |
| *** nickrmc83 has quit IRC | 12:31 | |
| *** nickrmc83 has joined #openstack-barbican | 12:31 | |
| *** redrobot has joined #openstack-barbican | 12:41 | |
| *** redrobot is now known as Guest74993 | 12:42 | |
| *** Guest74993 is now known as el_robot_rojo | 12:43 | |
| *** el_robot_rojo is now known as redrobot | 12:44 | |
| *** rellerreller has joined #openstack-barbican | 13:44 | |
| *** alee has joined #openstack-barbican | 13:45 | |
| jaosorior | alee | 13:47 |
| jaosorior | dogtag is off experimental | 13:48 |
| alee | jaosorior, yay | 13:51 |
| alee | jaosorior, are the tests passing? | 13:51 |
| jaosorior | so far | 13:51 |
| jaosorior | I was doing a bunch of check experimentals before the project-config CR landed, and it was passing | 13:52 |
| jaosorior | and these two (which I would appreciate if you review) https://review.openstack.org/#/c/178601/ https://review.openstack.org/#/c/181025/ actually ran with dogtag in the standard gate, and it passes | 13:53 |
| alee | jaosorior, nice segue :) | 13:54 |
| jaosorior | TIL the word segue :P | 13:55 |
| redrobot | alee jaosorior \o/ | 13:59 |
| *** stanzi has joined #openstack-barbican | 13:59 | |
| jaosorior | yay :D | 14:02 |
| jaosorior | redrobot: You might want to take a look at this: https://www.mail-archive.com/openstack-dev@lists.openstack.org/msg55739.html | 14:02 |
| *** zz_dimtruck is now known as dimtruck | 14:02 | |
| redrobot | jaosorior ah yeah... it's on my to-do list. | 14:03 |
| jaosorior | redrobot: How's stuff otherwise? | 14:04 |
| redrobot | jaosorior pretty good, thanks! Doing some Kilo backporting today | 14:05 |
| jaosorior | redrobot: I saw. Wanted to give a score to the "500 if no payload" CR but I couldn't :/ | 14:05 |
| redrobot | jaosorior hmm... weird... I'll have to check on stable branch permissions | 14:06 |
| *** woodster_ has joined #openstack-barbican | 14:09 | |
| *** kfarr has joined #openstack-barbican | 14:11 | |
| *** SheenaG has quit IRC | 14:17 | |
| *** insequent has quit IRC | 14:21 | |
| *** pglass has joined #openstack-barbican | 14:22 | |
| *** stanzi has quit IRC | 14:23 | |
| rellerreller | jaosorior ping woodster_ to review that patch about the project ID. If he is ok with db question I raised then I will +2. Then you just need a workflow. | 14:24 |
| *** stanzi has joined #openstack-barbican | 14:24 | |
| jaosorior | redrobot: Now I could score the CR :/ weird | 14:24 |
| jaosorior | woodster_ are you around? | 14:24 |
| woodster_ | jaosorior: heading into work, how are things? | 14:26 |
| *** SheenaG has joined #openstack-barbican | 14:27 | |
| woodster_ | rellerreller: I'll catch up in a bit | 14:27 |
| rellerreller | woodster_ no worries. Travel safely. | 14:27 |
| *** kfarr1 has joined #openstack-barbican | 14:28 | |
| jaosorior | woodster_: All good, dude. No worries, we'll bother you when you're at the office :P | 14:29 |
| *** kfarr has quit IRC | 14:29 | |
| *** SheenaG1 has joined #openstack-barbican | 14:29 | |
| *** SheenaG has quit IRC | 14:31 | |
| *** kfarr1 has quit IRC | 14:32 | |
| jaosorior | redrobot, alee: Should the dogtag related changes be ported to kilo/stable too? | 14:39 |
| woodster_ | rellerreller: jaosorior looking at the CR now... | 14:39 |
| alee | jaosorior, redrobot that would be nice | 14:41 |
| woodster_ | rellerreller: jaosorior yeah migrations are tricky...ideally you mod the schema first (but still work with current code), then make the code works with both old schema and new (but new records use the new schema), then make a migration that catches the old records up to the new schema, then clean up the code to only use the new schema | 14:42 |
| *** Nirupama has quit IRC | 14:43 | |
| jaosorior | woodster_: For the record, mind answering that in the CR? :D | 14:47 |
| rellerreller | woodster_ that sounds extremely complicated, especially for items that are mutable. I do not envy you :) | 14:47 |
| *** kfarr has joined #openstack-barbican | 14:48 | |
| openstackgerrit | Kevin Bishop proposed openstack/barbican: Replace oslo incubator code with i18n https://review.openstack.org/192231 | 14:50 |
| woodster_ | rellerreller: well, I think it would be easier to test this sort of thing if we were using grenade tests. Zero downtime is tricky though :\ | 14:50 |
| woodster_ | jaosorior: will do | 14:50 |
| *** Kevin_Bishop has joined #openstack-barbican | 14:51 | |
| *** stanzi has quit IRC | 14:55 | |
| redrobot | jaosorior alee which dogtag changes? I've already ported the critical bugfix for the base64 issue. | 14:59 |
| jaosorior | redrobot: https://review.openstack.org/#/c/189379/ without this CR you cannot run the SecretStore and the CA plugins at the same time | 15:01 |
| *** kebray has joined #openstack-barbican | 15:01 | |
| *** kebray has quit IRC | 15:01 | |
| alee | redrobot, there were changes in the way we set up the certdb for the ca/kra client certs. we needed these to get both secretStore and CA plugin at the same time. | 15:01 |
| redrobot | jaosorior hmm... k. wanna file a bug for it against the Kilo branch? | 15:01 |
| *** kebray has joined #openstack-barbican | 15:02 | |
| jaosorior | well, I gotta go, but I could file it in an hour or so | 15:02 |
| *** rellerreller has quit IRC | 15:02 | |
| redrobot | jaosorior sure, just ping me when you get a chance to file it | 15:02 |
| jaosorior | sure | 15:02 |
| *** xaeth_afk is now known as xaeth | 15:02 | |
| jaosorior | alee: You could file it too though | 15:02 |
| alee | jaosorior, either way .. I'm ok with you filing it :) | 15:03 |
| *** kfarr has quit IRC | 15:04 | |
| *** rellerreller has joined #openstack-barbican | 15:04 | |
| alee | jaosorior, otherwise if you want to take off, I can do it now .. | 15:04 |
| woodster_ | rellerreller: Hey Nate, you might also run the migration situation by Joel to get his opinion on things | 15:05 |
| rellerreller | woodster_ I can do that to see what he thinks. | 15:05 |
| *** stanzi has joined #openstack-barbican | 15:09 | |
| *** stanzi has quit IRC | 15:15 | |
| alee | woodster_, ping | 15:18 |
| alee | woodster_, jaosorior , redrobot , rellerreller , chellygel -- need some looks at https://review.openstack.org/#/c/187236/ please | 15:20 |
| *** kfox1111 has joined #openstack-barbican | 15:21 | |
| *** kfarr has joined #openstack-barbican | 15:21 | |
| kfox1111 | so, what is the difference between Castellan, Certmonger and Anchor? | 15:22 |
| *** stanzi has joined #openstack-barbican | 15:23 | |
| kfox1111 | The latter two have both been recommended to the Magnum folks in a thread recently on the mailing list. | 15:23 |
| redrobot | kfox1111 Castellan is a key manager interface. Allows app devs to add a puggable key manager to their app, thus allowing use of Barbican or other backends if barbican is not available. | 15:24 |
| kfox1111 | I'm thinking the same reasoning may affect the nova instance user spec I've been working on. | 15:24 |
| kfox1111 | how does it relate to the other two though? | 15:24 |
| kfox1111 | competitor? | 15:24 |
| redrobot | kfox1111 Certmonger is a daemon that runs in a node and monitors TLS certificate status, and is able to reprovision a TLS cert when it's about to expire. | 15:25 |
| kfox1111 | ah. | 15:25 |
| openstackgerrit | Kevin Bishop proposed openstack/barbican: Replace oslo incubator code with i18n https://review.openstack.org/192231 | 15:25 |
| redrobot | kfox1111 Anchor is a Certificate Authority, it provisions short-lived TLS certificates | 15:25 |
| kfox1111 | hmmm... ok. | 15:25 |
| kfox1111 | so Castellan's probably what magnum would want to use. | 15:26 |
| redrobot | kfox1111 I haven't had a chance to catch up on the Magnum thread, but I have it on my todo list for today. | 15:26 |
| kfox1111 | same goes for the nova instance spec. | 15:26 |
| kfox1111 | would you be apposed to me s/barbican/castellan/ in the nova instance user spec? | 15:26 |
| *** kfarr has quit IRC | 15:26 | |
| redrobot | kfox1111 not at all... I think the majority of Service projects will probably benefit from Castellan | 15:27 |
| *** rm_you| has quit IRC | 15:27 | |
| redrobot | kfox1111 the only downside of Castellan is that it will probably never issue TLS certs | 15:27 |
| kfox1111 | for the keystone user ca stuff? | 15:27 |
| *** rm_you| has joined #openstack-barbican | 15:27 | |
| *** elmiko has joined #openstack-barbican | 15:28 | |
| kfox1111 | it wont have an api for it, or it wont do it directly? | 15:28 |
| redrobot | kfox1111 won't have an API for it. | 15:28 |
| kfox1111 | don't think it will work for the instance user thing then. | 15:29 |
| kfox1111 | well... let me make sure I get this streight. | 15:29 |
| redrobot | kfox1111 yeah, I still haven't fully groked the User CA spec. I think Barbican would be issuing x509 certs for ID purposes? | 15:29 |
| kfox1111 | the instance user thing will need a CA for producing x509 user certs. It can be a self signed CA though. | 15:30 |
| kfox1111 | yeah. exactly. | 15:30 |
| redrobot | kfox1111 and possibly we would need a new root per User/Project? | 15:30 |
| kfox1111 | no, one for all of nova should be fine. | 15:30 |
| kfox1111 | some attribute for instance uuid would be stuck in. | 15:31 |
| kfox1111 | then keystone can validate that if it came from Nova's CA, it trusts it as user instance_uuid. | 15:31 |
| redrobot | kfox1111 I think there's a handful of specs in review that would be needed for this all to work | 15:32 |
| kfox1111 | :/ k. | 15:32 |
| redrobot | kfox1111 like being able to assing a preferred CA to a user | 15:32 |
| kfox1111 | doable in the liberty time frame? | 15:32 |
| redrobot | kfox1111 possibly. They're on the roadmap for Liberty, but so is a ton of other stuff :-\ | 15:33 |
| kfox1111 | hmm.... | 15:33 |
| alee | kfox1111, redrobot - I think a lot of what I see you are looking for is already there. | 15:33 |
| redrobot | alee I was thinking about the per-user sub-CAs | 15:33 |
| redrobot | alee so we can assign a CA to the Nova service user | 15:33 |
| alee | kfox1111, is there a spec which describes what you're looking for?> | 15:33 |
| alee | redrobot, well sure - but I was not clear thats what he was looking for .. | 15:34 |
| kfox1111 | alee: yeah. just a sec. | 15:34 |
| kfox1111 | https://review.openstack.org/#/c/186617/ | 15:34 |
| kfox1111 | I need a CA for Nova to create x509 user certs that no one else can use, so that Keystone can trust certs from the CA. | 15:35 |
| redrobot | kfox1111 and Barbican will be storing all certs? | 15:35 |
| kfox1111 | There are probably many differnet ways to skin that cat. | 15:35 |
| kfox1111 | At least provisioning them. | 15:36 |
| kfox1111 | I'm thinking for now, nova will store them once issued so a second round trip per call isn't needed. | 15:36 |
| alee | kfox1111, awesome, this is exactly the kind of thing we are adding subcas to dogtag for. | 15:37 |
| *** stanzi has quit IRC | 15:37 | |
| kfox1111 | cool. | 15:37 |
| alee | kfox1111, in fact the immediate user case we had was to create a subca for a puppet domain | 15:37 |
| kfox1111 | ah. interesting. :) | 15:37 |
| alee | (within ipa) but its the exact same mechanism | 15:38 |
| kfox1111 | I asked earlier, but this seems like an ideal time. | 15:38 |
| kfox1111 | has anyone talked with the designate folks about integration? | 15:38 |
| alee | so there are a few blueprints that are out there .. | 15:38 |
| kfox1111 | we really need a way to get tls certs for subdomains we're allowing tenants to own. | 15:38 |
| redrobot | kfox1111 nope, haven't talked to any designate folks | 15:38 |
| kfox1111 | the dns stuff is really cool, but if you can't secure it by putting tls on it, it really hurts. :/ | 15:39 |
| alee | kfox1111, redrobot https://review.openstack.org/#/c/187236/ | 15:39 |
| alee | redrobot, which incidentally needs a look-see please | 15:39 |
| alee | that exposes being able to generate a subca by a project admin | 15:39 |
| redrobot | alee hehe... I'd say you're by far the most pro-active review getter :-P | 15:39 |
| alee | :) | 15:40 |
| kfox1111 | alee: thanks. having a look. | 15:40 |
| *** kfarr has joined #openstack-barbican | 15:40 | |
| alee | that will expose the functionality that dogtag implements through barbican | 15:40 |
| alee | kfox1111, and then as a client - well there would be lots of options depending on how you want to do it | 15:41 |
| alee | nova could use barbican-client, or maybe if you're doing this on a node, kyou use certmonger | 15:41 |
| kfox1111 | not done reading the spec yet. so far it looks good. it does imply what's in kilo would work for my use case though, while being more manual? | 15:42 |
| kfox1111 | alee, yeah, nova's the one using the cert, not the instance so probably juts barbican-client. | 15:43 |
| kfox1111 | was thinking about Castellan, but if it can't do CA stuff then it woudln't work. | 15:43 |
| alee | kfox1111, right - there are discussions of castellan eventually being able to do cert stuff -- I think that will make another round at Tokyo. | 15:44 |
| alee | or maybe the midcycle. | 15:44 |
| alee | kfox1111, well yes - although this only works using dogtag as a ca backend | 15:45 |
| redrobot | alee kfox1111 well, I think Castellan will be able to store Certs, but will probably never be able to issue them | 15:45 |
| *** kfarr has quit IRC | 15:45 | |
| redrobot | alee kfox1111 the problem is typical key storage devices don't also act as CAs | 15:45 |
| kfox1111 | can you restrict one of the ca's in kilo to a specific project? | 15:45 |
| alee | kfox1111, yes | 15:46 |
| kfox1111 | ok. | 15:46 |
| alee | kfox1111, thats in the cas interface I put in in kilo | 15:46 |
| *** SheenaG1 has quit IRC | 15:46 | |
| alee | kfox1111, at some point, I'll get around to writing api docs for that | 15:46 |
| alee | kfox1111, let me find the blueprint | 15:46 |
| kfox1111 | ok cool. | 15:47 |
| alee | kfox1111, https://review.openstack.org/#/c/129048/ | 15:48 |
| kfox1111 | redrobot: I don't quite follow. | 15:48 |
| redrobot | kfox1111 Castellan allows you to have different key manager backends. Barbican is one choice, but other choices would include KMIP devices, PCKS#11 devices, etc. | 15:49 |
| redrobot | kfox1111 usually these types of devices don't act as CAs that can provision certs | 15:49 |
| redrobot | kfox1111 so the Castellan abstraction could never have CA capabilities because it would force people using non-barbican devices to deploy some sort of CA | 15:49 |
| kfox1111 | redrobot: But does Castellan have an api to provision x509 user certs? | 15:50 |
| redrobot | kfox1111 I don't think so. Currently provisioning can only be done for symmetric keys (such as for AES encryption) and Asymmetric RSA keys. | 15:51 |
| kfox1111 | ah. so Castellan's targeting the lowest common denominator with its api? | 15:51 |
| redrobot | kfox1111 indeed. | 15:51 |
| kfox1111 | I understand. | 15:51 |
| alee | kfox1111, think of castellan as an interface to a secret storage device -- and thats it -- x509 cert issuance is a totally different function and probably should be a totally different interface | 15:52 |
| kfox1111 | ok. so at the moment, barbicanclient's the only option. | 15:52 |
| alee | or certmonger .. | 15:52 |
| alee | kfox1111, I'm working on patches to have certmonger talk to barbican | 15:53 |
| kfox1111 | cool. not sure how certmonger would fit into the user cert workflow though. | 15:54 |
| redrobot | yeah, seems that certmonger would be overkill for a single cert issue | 15:54 |
| kfox1111 | the user cert's would be stored in the nova database, so the nova metadata server can scale across nodes. | 15:55 |
| kfox1111 | I'd think certmonger would cause issues with scaling that out. | 15:55 |
| redrobot | brb, gotta run to a meeting | 15:56 |
| kfox1111 | redrobot: k. thanks. | 15:57 |
| alee | kfox1111, so let me try and understand how this would work -- nova would provision a cert for a user -- does it generate the private key and the csr? | 15:57 |
| alee | kfox1111, and then store that private key locally? | 15:58 |
| *** SheenaG has joined #openstack-barbican | 15:58 | |
| kfox1111 | hadn't really thought through that part, but yeah, it could. | 15:58 |
| alee | kfox1111, so the private key gets pushed down when the vm is configured? | 15:59 |
| kfox1111 | nova keeps the private key. never hands it to the vm. if the vm asks for a keystone token, | 15:59 |
| kfox1111 | the nova metadata data server contacts keystone using the user cert it created for that vm, and gets a fresh keystone token, | 15:59 |
| kfox1111 | and hands it back to the vm. | 15:59 |
| kfox1111 | the vm can then use the keystone token to talk to whatever it needs to/has permission to. | 16:00 |
| *** kfarr has joined #openstack-barbican | 16:00 | |
| *** alee is now known as alee_afk | 16:00 | |
| kfox1111 | that way, someone can't just go run off with the vm's user cert and use it outside of the vm. | 16:00 |
| *** nickrmc83 has quit IRC | 16:01 | |
| kfox1111 | and the vm still has an easy way to fetch fresh tokens. | 16:01 |
| *** kfarr_ has joined #openstack-barbican | 16:02 | |
| *** kebray has quit IRC | 16:04 | |
| *** kfarr has quit IRC | 16:04 | |
| *** chadlung has joined #openstack-barbican | 16:05 | |
| *** kebray has joined #openstack-barbican | 16:05 | |
| *** alee_afk is now known as alee | 16:06 | |
| *** elmiko has quit IRC | 16:10 | |
| *** dimtruck is now known as zz_dimtruck | 16:10 | |
| *** zz_dimtruck is now known as dimtruck | 16:12 | |
| *** SheenaG1 has joined #openstack-barbican | 16:18 | |
| *** SheenaG has quit IRC | 16:19 | |
| *** kfarr has joined #openstack-barbican | 16:20 | |
| *** insequent has joined #openstack-barbican | 16:21 | |
| *** kfarr has quit IRC | 16:43 | |
| alee | jaosorior, https://review.openstack.org/#/c/127823/2/specs/liberty/api-add-copy-constructor.rst,cm | 16:45 |
| alee | jaosorior, so if copy_id is provided and any other parameters are provided, we should throw an error? | 16:46 |
| *** kfox1111 has quit IRC | 16:49 | |
| *** kfox1111 has joined #openstack-barbican | 16:50 | |
| openstackgerrit | Kevin Bishop proposed openstack/barbican: Replace oslo incubator code with oslo_utils https://review.openstack.org/191960 | 16:51 |
| *** rellerreller has quit IRC | 16:53 | |
| notmyname | I'm going to a meetup tonight about https://hashicorp.com/blog/vault.html. anything I should pay close attention to? | 16:53 |
| *** stanzi has joined #openstack-barbican | 16:56 | |
| *** stanzi has quit IRC | 17:01 | |
| *** kfarr has joined #openstack-barbican | 17:03 | |
| *** kfarr_ has quit IRC | 17:10 | |
| *** kfarr has quit IRC | 17:11 | |
| *** alee has quit IRC | 17:12 | |
| *** kebray has quit IRC | 17:13 | |
| openstackgerrit | Kevin Bishop proposed openstack/barbican: Replace oslo incubator code with i18n https://review.openstack.org/192231 | 17:13 |
| kfox1111 | any rdoish rpm's for barbican yet? any documentation on the CA features of barbican? | 17:24 |
| *** alee has joined #openstack-barbican | 17:24 | |
| kfox1111 | any rdoish rpm's for barbican yet? any documentation on the CA features of barbican? | 17:24 |
| openstackgerrit | Ade Lee proposed openstack/barbican-specs: Added spec for copy constructor for secrets and containers https://review.openstack.org/127823 | 17:24 |
| *** gyee has quit IRC | 17:24 | |
| alee | kfox1111, we're working on the rdo rpms for barbican -- elmiko and xaeth are getting barbican into fedora and from there to rdo | 17:26 |
| alee | kfox1111, as for ca docs .. | 17:26 |
| *** gyee has joined #openstack-barbican | 17:26 | |
| alee | kfox1111, https://review.openstack.org/186771 | 17:27 |
| kfox1111 | cool. thanks. | 17:28 |
| kfox1111 | any link to the fedora rpms? | 17:28 |
| alee | kfox1111, just to the review - just a sec | 17:28 |
| kfox1111 | ok. thanks. | 17:28 |
| alee | kfox1111, https://bugzilla.redhat.com/show_bug.cgi?id=1190269 | 17:29 |
| openstack | bugzilla.redhat.com bug 1190269 in Package Review "Review Request: openstack-barbican - Secrets as a Service" [Medium,Assigned] - Assigned to karlthered | 17:29 |
| kfox1111 | awesome. thanks. :) | 17:30 |
| * kfox1111 sighs | 17:30 | |
| kfox1111 | I always have to reset my redhat bugzilla password.... | 17:30 |
| alee | interesting -- guess some bot picked that up .. | 17:30 |
| kfox1111 | yup. :) | 17:30 |
| alee | jaosorior, woodster_ modified https://review.openstack.org/127823 as requested .. | 17:32 |
| alee | woodster_, jaosorior , rellerreller, kfarr ^^ | 17:32 |
| *** SheenaG1 has quit IRC | 17:33 | |
| kfox1111 | arg. the rpm's still held up by the lack of a start script? | 17:41 |
| *** stanzi has joined #openstack-barbican | 17:44 | |
| *** kfarr has joined #openstack-barbican | 17:45 | |
| alee | kfox1111, yeah -- but what we've decided is to get things going initially with a simple start script that usess uwsgi | 17:46 |
| alee | kfox1111, concurrently elmiko will work on a wsgi container | 17:47 |
| alee | that can be deployed as an apache module | 17:47 |
| alee | kfox1111, thats the approach we will ultimately used in rdo | 17:47 |
| *** Kevin_Bishop has quit IRC | 17:48 | |
| alee | elmiko is out for a few days but he'll pick that up when he gets back. | 17:48 |
| *** stanzi has quit IRC | 17:51 | |
| *** Kevin_Bishop has joined #openstack-barbican | 17:52 | |
| kfox1111 | ok. thanks. | 17:54 |
| kfox1111 | somewhat curious. almost noone of the other openstack services run in apache. why not do what they are doing? | 17:55 |
| alee | kfox1111, keystone is running in apache | 17:58 |
| kfox1111 | it can run in apache. no rdo deployment works that way out of the box today. | 17:59 |
| kfox1111 | the only thing using apache is horizon. | 17:59 |
| alee | kfox1111, running in apache makes some things a lot easier -- like setting up tls for instance, or running certain auth modules for instance | 18:00 |
| alee | kfox1111, yeah - but I think thats the direction we want to go. | 18:00 |
| kfox1111 | all of the other modules are broken for tls. We've had to put haproxy in front of them all to do tls. | 18:00 |
| kfox1111 | so I'm not sure what apache really buys you. :/ | 18:00 |
| kfox1111 | the auth modules make sense for kesytone. | 18:01 |
| kfox1111 | I'm not sure what barbican in apache buys though. | 18:01 |
| *** stanzi has joined #openstack-barbican | 18:02 | |
| *** elmiko has joined #openstack-barbican | 18:02 | |
| alee | kfox1111, a consistent deployment perhaps ? after all we'll do it in the way that at least a couple other services does it .. | 18:03 |
| alee | kfox1111, and we fix tls for keystone, and horizon and barbican , and .. | 18:03 |
| kfox1111 | barbican in apache is inconsistent with everything else. ;) | 18:04 |
| alee | kfox1111, everything else is inconsistent with everything else .. | 18:05 |
| kfox1111 | nova, neutron, glance, swift, rados gw, designate, sahara, .... all run out of seperate systemd units. | 18:05 |
| kfox1111 | they are all consistant in that you use systemctl to start/stop their pieces. horizon and maybe keystone are the exceptions currently. | 18:06 |
| kfox1111 | you can disover them with systemctl | grep openstack-project-name too. | 18:07 |
| alee | kfox1111, there is no reason to think that just because barbican is deployed behind apache, it wont have systemd start/stop scripts as well. | 18:09 |
| kfox1111 | for barbican? | 18:09 |
| alee | sure | 18:09 |
| kfox1111 | the unit files will add/remove a site out of apache and kick it? | 18:10 |
| alee | kfox1111, could be | 18:10 |
| kfox1111 | seems... less then ideal... | 18:11 |
| kfox1111 | I'm sure it would work, but it somehow feels dirty... | 18:11 |
| *** Kevin_Bishop has quit IRC | 18:12 | |
| alee | kfox1111, you raise some good points and we'll look at how horizon/keystone do things when deciding how to move forward | 18:12 |
| kfox1111 | horizon is just slid in apache. it just uses apache's start/stop. | 18:13 |
| kfox1111 | keystone isn't ever shipped inside apache today by rdo. so its totally up to the admin to do that if they want today. | 18:13 |
| *** stanzi has quit IRC | 18:14 | |
| kfox1111 | thanks. :) | 18:14 |
| *** stanzi has joined #openstack-barbican | 18:14 | |
| alee | kfox1111, are acls something that would be needed for subcas as woodster_ suggests? | 18:20 |
| kfox1111 | I could potentially see it being useful, but not entirely sure... | 18:21 |
| kfox1111 | might be more useful if subcas can be nested?[C | 18:22 |
| kfox1111 | Its not clear how Designate and Barbican ultimately will hook together. the teams haven't discussed things yet. | 18:22 |
| kfox1111 | Designate lets you create a subdomain on one project, then transfer it to another. | 18:22 |
| kfox1111 | I can see maybe creating a ca, then transfering the subca along with the subdomain? | 18:23 |
| kfox1111 | though maybe thats just a transfer, not an acl thing. | 18:23 |
| *** Kevin_Bishop has joined #openstack-barbican | 18:24 | |
| alee | kfox1111, woodster_ right - well - lets say you create a sub ca. This gives you an entry ca_id in the ca table. this entry will have your project_id as the owner in the table. | 18:24 |
| alee | (at least thats how the spec is currently written) | 18:24 |
| *** crc32 has joined #openstack-barbican | 18:24 | |
| alee | now you can ask for a sub_ca of that ca_id | 18:25 |
| alee | so that would be a nested sub ca | 18:25 |
| alee | and that entry would also have your project_id | 18:25 |
| *** silos has joined #openstack-barbican | 18:25 | |
| alee | only users that were members of that project would be able to use the subca or the sub-sub-ca | 18:26 |
| alee | ie. list/view/get certs from | 18:26 |
| alee | kfox1111, would that work in your case? | 18:27 |
| kfox1111 | k. | 18:27 |
| kfox1111 | maybe? | 18:27 |
| alee | kfox1111, or would we need to add the concept of an acl? | 18:27 |
| kfox1111 | honestly, I don't quite understand how subca's work with tls... | 18:27 |
| kfox1111 | I think we'd need to add transfers ala desigate or cinder. | 18:27 |
| kfox1111 | where you can change the project_id of that subca. | 18:28 |
| kfox1111 | you'd want somehow to tag the subca as only being athorative for a particular subdomain. | 18:28 |
| alee | so what acls do is allow you to specify other users that might not be in that project to use the subca | 18:28 |
| *** crc32 has quit IRC | 18:29 | |
| kfox1111 | yeah, if you could add an acl of the other project on the subca, you wouldn't need a transfer then. | 18:29 |
| alee | kfox1111, right .. ok - so acls would be useful. | 18:30 |
| kfox1111 | yeah, I guess I can see a concrete case for it. | 18:31 |
| *** kebray has joined #openstack-barbican | 18:32 | |
| alee | kfox1111, I'm just wondering if it needs to be there at the beginning - or if we should add in M .. | 18:32 |
| alee | or can be deferred to M | 18:32 |
| kfox1111 | I'd really like to solve the, how does barbican deal with ssl certs for designate subdomains issue, | 18:33 |
| kfox1111 | but may be a bigger challange then can be solved in Liberty? | 18:34 |
| kfox1111 | the solution may actually be not to use subca's though. not sure. | 18:34 |
| kfox1111 | I'm not sure you can designate a subca for a dns subdomain at all. :/ | 18:34 |
| kfox1111 | have any experience with that? | 18:35 |
| alee | kfox1111, hmm .. seems we need some designate folks .. | 18:35 |
| *** Kevin_Bishop has quit IRC | 18:36 | |
| alee | let me talk to a couple of folks and get back to you. Whats a concise description of the problem ? | 18:36 |
| kfox1111 | perhaps? they are very much just in the dns world. this is tls stuff thats only very tangentially related to dns. | 18:36 |
| kfox1111 | ok. how about an example workflow... | 18:36 |
| kfox1111 | I'm a cloud admin. our cloud owns cloud.pnnl.gov. | 18:36 |
| kfox1111 | I have designate managing it, and its owned by tenant "mgmt". | 18:37 |
| kfox1111 | I have a new project comealong named "foo". I create a keystone tenant "foo", and a designate subdomain, "foo.cloud.pnnl.gov", and transfer the designate subdomain to project foo. | 18:38 |
| kfox1111 | now foo can create vm's, and create all the dns entries they want under x.foo.cloud.pnnl.gov. | 18:38 |
| kfox1111 | user now wants to point their web browser at their webserver https://myserver.foo.cloud.pnnl.gov.... | 18:38 |
| kfox1111 | we need a way to get them a cert that says myserver.foo.cloud.pnnl.gov. | 18:39 |
| kfox1111 | and never allow them a cert outside of foo.cloud.pnnl.gov. | 18:39 |
| kfox1111 | make sense? | 18:40 |
| *** elmiko has quit IRC | 18:40 | |
| kfox1111 | maybe designate needs some kind of barbican integration, or visa versa for this use case. | 18:41 |
| *** crc32 has joined #openstack-barbican | 18:43 | |
| alee | kfox1111, right - so you're saying you need a ca for foo.cloud.pnnl.gov that issues certs for that domain. and your web browser would need to import and trust the ca cert for that ca. | 18:44 |
| * kfox1111 winces | 18:44 | |
| *** ngupta has joined #openstack-barbican | 18:44 | |
| kfox1111 | I think that may be too much of a burdon for every user that needs to use the websites to import all the ca's. | 18:44 |
| kfox1111 | we need some kind of chain of trust so you only have to import the root ca. | 18:45 |
| kfox1111 | a lot of our users are going to end up being research scientists. sending them instructions for importing a root ca every time a new project comes along won't fly. they'd rather just use a self signed cert and accept the risk I think. :/ | 18:45 |
| alee | kfox1111, I say a root at foo.cloud.pnnl.gov because you said "never allow them a cert outside of foo.cloud.pnnl.gov" | 18:47 |
| alee | what did you mean by "never allow them a cert"? | 18:48 |
| alee | you can always have a root at "cloud.pnnl.gov" which they would import | 18:49 |
| alee | and have a subca at foo.cloud.pnnl.gov | 18:49 |
| alee | which would issue certs for that doamin | 18:50 |
| kfox1111 | and using that subca, they wouldn't be able to get a bar.cloud.pnnl.gov signature? | 18:51 |
| kfox1111 | I wasn't sure there was a mechanism in place to enforce that. | 18:51 |
| *** stanzi has quit IRC | 18:52 | |
| alee | right - I'm not sure there is .. | 18:52 |
| kfox1111 | then subca's may or may not help solve the issue. :/ | 18:53 |
| kfox1111 | barbican can wrap an api around it to enforce it though, or designate can filter the request before it goes to barbican and run everything through designate. | 18:53 |
| kfox1111 | not sure what the best way there is. | 18:53 |
| *** stanzi has joined #openstack-barbican | 18:54 | |
| alee | kfox1111, right - maybe it depends on the scale of the problem. If I have a big project that wants to ensure this -- then maybe importing a new ca root is not unreasonable. | 18:54 |
| alee | kfox1111, for small ad-hoc projects, a root ca would suffix | 18:54 |
| alee | suffice | 18:55 |
| kfox1111 | sure, if all your users totally trust all your ca's. | 18:55 |
| kfox1111 | I've seen organizations that use their root ca to man in the middle listen to all https traffic too. :/ | 18:55 |
| kfox1111 | I think barbican probably either needs a dns aware api, so that you can request a cert associated with a domain you own, | 18:56 |
| kfox1111 | or designate has the api, and calls into barbican to do it. | 18:57 |
| alee | kfox1111, sounds like a spec is needed :) | 18:57 |
| kfox1111 | yeah. :/ | 18:57 |
| kfox1111 | I've got 5 more specs minimum on my plate right now. :/ | 18:57 |
| kfox1111 | this instance user thing's killing me. | 18:57 |
| kfox1111 | it went from one spec, to like 12 so far. | 18:57 |
| *** everjeje has quit IRC | 18:57 | |
| kfox1111 | and each spec's taking weeks to get through, since most of the projects tend to be very very silo'd. :/ | 18:58 |
| kfox1111 | I'll add it to my spec to submit todo list if you don't get to it first. | 18:59 |
| kfox1111 | these specs really tend to suck to write though, since its not clear if it belongs to designate or barbican. :/ | 18:59 |
| *** pglbutt has joined #openstack-barbican | 19:02 | |
| *** pglass has quit IRC | 19:03 | |
| alee | kfox1111, woodster_ - updated https://review.openstack.org/#/c/187236/1 with comments. | 19:04 |
| arunkant | In local environment, when barbican is started. It starts 2 WSGI processes. Does anybody know where to control this number of processes? Need to remote debug and cannot do with two processes running. | 19:05 |
| alee | woodster_, kfox1111 let me know if acl can be deferred - and I'll update accordingly with a new version. | 19:05 |
| *** Kevin_Bishop has joined #openstack-barbican | 19:06 | |
| *** Kevin_Bishop has quit IRC | 19:11 | |
| kfox1111 | If the subca can be restrected to enforcing only for a subdomain, think acl's right away make sense. otherwise, it can wait I think. | 19:14 |
| *** silos has left #openstack-barbican | 19:16 | |
| jaosorior | alee: now I'm back | 19:17 |
| jaosorior | regarding this one https://review.openstack.org/#/c/127823/2/specs/liberty/api-add-copy-constructor.rst,cm | 19:17 |
| jaosorior | alee: I don't have a strong opinion if we should throw an error whether extra parameters are given if copy_id is issued, whatever you see fit. Only thing is that I thought it would be unnecessary to require anything but copy_id, if that's all we really want from that request | 19:18 |
| alee | jaosorior, right -- In the latest iteration, I think I make it clearer that only copy_id is needed and we would throw an error otherwise | 19:21 |
| alee | jaosorior, so feel free to add that +2 | 19:21 |
| jaosorior | I +1ed only it cause of an extra whitespace | 19:22 |
| jaosorior | Actually commented on the CR already | 19:22 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-barbicanclient: Updated from global requirements https://review.openstack.org/192383 | 19:22 |
| *** Kevin_Bishop has joined #openstack-barbican | 19:23 | |
| *** xaeth is now known as xaeth_afk | 19:24 | |
| jaosorior | redrobot, alee, hockeynut, woodster: this CR has been unreviewed for a whiiiile, got some time to check it out? https://review.openstack.org/#/c/178601/ | 19:26 |
| alee | aargh - whitespace | 19:26 |
| jaosorior | I recommend a git hook to detect those | 19:27 |
| jaosorior | alee: https://gist.github.com/mxgrn/663933 | 19:29 |
| jaosorior | alee: aaah, this actually has better instructions for git http://makandracards.com/makandra/11541-how-to-not-leave-trailing-whitespace-using-your-editor-or-git | 19:29 |
| openstackgerrit | Ade Lee proposed openstack/barbican-specs: Added spec for copy constructor for secrets and containers https://review.openstack.org/127823 | 19:36 |
| alee | jaosorior, woodster_ redrobot ^^ | 19:36 |
| *** kebray has quit IRC | 19:49 | |
| openstackgerrit | Doug Hellmann proposed openstack/barbican: Update version for Liberty https://review.openstack.org/192413 | 19:51 |
| *** stanzi has quit IRC | 19:54 | |
| *** SheenaG has joined #openstack-barbican | 19:58 | |
| *** insequent has quit IRC | 19:58 | |
| openstackgerrit | Ade Lee proposed openstack/barbican: Added Certificate API Docs and Quick Start Guides https://review.openstack.org/186771 | 19:59 |
| alee | woodster_, ^^ updated as per request | 19:59 |
| alee | woodster_, redrobot , chellygel , jaosorior ^^ get out those +2s please | 19:59 |
| *** kfox1111 has quit IRC | 20:03 | |
| *** pglass has joined #openstack-barbican | 20:06 | |
| *** kebray has joined #openstack-barbican | 20:07 | |
| *** chadlung has quit IRC | 20:09 | |
| *** pglbutt has quit IRC | 20:10 | |
| *** Kevin_Bishop has quit IRC | 20:12 | |
| *** Kevin_Bishop has joined #openstack-barbican | 20:17 | |
| *** stanzi has joined #openstack-barbican | 20:24 | |
| *** Kevin_Bishop has quit IRC | 20:44 | |
| jaosorior | alee: left some questions on that CR, but just minor stuff | 20:47 |
| alee | jaosorior, thanks -- what time is it for you btw? | 20:47 |
| jaosorior | 11:47 | 20:47 |
| jaosorior | at night | 20:47 |
| alee | jaosorior, oh ok - not as bad as I thought :) | 20:48 |
| jaosorior | so basically beer&code o' clock | 20:48 |
| alee | :) | 20:48 |
| alee | jaosorior, I think thats black licorice tar and code time .. | 20:48 |
| jaosorior | hahaha, next time I'll bring more of those haha | 20:48 |
| alee | jaosorior, definitely -- although I'll make sure not to drink some before starting to climb a mountain .. | 20:49 |
| jaosorior | hahahaha, it made sense at the time | 20:49 |
| *** xaeth_afk is now known as xaeth | 20:49 | |
| alee | jaosorior, sadly yes - it did. | 20:50 |
| *** elmiko has joined #openstack-barbican | 20:50 | |
| *** kfarr has left #openstack-barbican | 21:06 | |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/barbican: Add project_id to Secret model https://review.openstack.org/181025 | 21:07 |
| *** stanzi has quit IRC | 21:07 | |
| jaosorior | redrobot, alee: by the way, for some strange reason I no longer see the errors I used to see in tox... and honestly I have no idea how it started working | 21:12 |
| alee | jaosorior, I have not tried again recently - will do that again today | 21:12 |
| *** dimtruck is now known as zz_dimtruck | 21:13 | |
| *** elmiko has quit IRC | 21:18 | |
| *** Daviey has quit IRC | 21:30 | |
| *** stanzi_ has joined #openstack-barbican | 21:38 | |
| *** stanzi_ has quit IRC | 21:47 | |
| *** chadlung has joined #openstack-barbican | 21:58 | |
| *** chadlung has quit IRC | 22:02 | |
| *** pglass has quit IRC | 22:10 | |
| *** kfarr1 has joined #openstack-barbican | 22:11 | |
| *** kfarr1 has left #openstack-barbican | 22:12 | |
| *** xaeth is now known as xaeth_afk | 22:14 | |
| *** SheenaG has quit IRC | 22:27 | |
| *** openstackgerrit has quit IRC | 22:38 | |
| *** openstackgerrit has joined #openstack-barbican | 22:39 | |
| *** darrenmoffat has quit IRC | 22:44 | |
| *** darrenmoffat has joined #openstack-barbican | 22:44 | |
| *** zz_dimtruck is now known as dimtruck | 22:50 | |
| openstackgerrit | Ade Lee proposed openstack/barbican-specs: Add mechanism for automated certificate renewals https://review.openstack.org/192453 | 22:57 |
| *** chadlung has joined #openstack-barbican | 22:59 | |
| *** chadlung has quit IRC | 23:03 | |
| *** chlong has quit IRC | 23:15 | |
| *** alee has quit IRC | 23:20 | |
| *** elmiko has joined #openstack-barbican | 23:24 | |
| *** elmiko has quit IRC | 23:28 | |
| *** kfox1111 has joined #openstack-barbican | 23:31 | |
| *** jaosorior has quit IRC | 23:35 | |
| *** stanzi has joined #openstack-barbican | 23:41 | |
| *** kfarr has joined #openstack-barbican | 23:46 | |
| *** kfarr has left #openstack-barbican | 23:46 | |
| *** stanzi has quit IRC | 23:53 | |
| *** chadlung has joined #openstack-barbican | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!