| *** claudiub has quit IRC | 00:05 | |
| *** david-ly_ has joined #openstack-barbican | 00:06 | |
| *** david-lyle has quit IRC | 00:08 | |
| *** nkinder has joined #openstack-barbican | 00:09 | |
| *** gyee_ has quit IRC | 00:17 | |
| *** SheenaG has quit IRC | 00:19 | |
| *** darrenmoffat has quit IRC | 00:29 | |
| *** darrenmoffat has joined #openstack-barbican | 00:30 | |
| *** zz_dimtruck is now known as dimtruck | 00:31 | |
| *** nkinder has quit IRC | 00:53 | |
| *** kfarr has joined #openstack-barbican | 00:58 | |
| *** david-ly_ is now known as david-lyle | 01:36 | |
| *** SheenaG has joined #openstack-barbican | 01:39 | |
| *** dimtruck is now known as zz_dimtruck | 01:54 | |
| *** dontalton has quit IRC | 01:56 | |
| *** SheenaG has quit IRC | 02:07 | |
| *** rm_work is now known as rm_work|away | 02:18 | |
| *** nkinder has joined #openstack-barbican | 02:33 | |
| *** zz_dimtruck is now known as dimtruck | 02:50 | |
| *** stanzi has joined #openstack-barbican | 02:57 | |
| *** dave-mccowan has quit IRC | 02:59 | |
| *** kfarr has quit IRC | 03:01 | |
| *** stanzi has quit IRC | 03:01 | |
| *** kebray has joined #openstack-barbican | 03:18 | |
| *** kfarr has joined #openstack-barbican | 03:35 | |
| *** dave-mccowan has joined #openstack-barbican | 03:37 | |
| *** dimtruck is now known as zz_dimtruck | 03:58 | |
| *** kfarr has quit IRC | 04:06 | |
| *** kebray has quit IRC | 04:29 | |
| *** kebray has joined #openstack-barbican | 04:30 | |
| *** arunkant_ has joined #openstack-barbican | 04:35 | |
| *** arunkant__ has joined #openstack-barbican | 04:37 | |
| *** arunkant has quit IRC | 04:38 | |
| *** arunkant_ has quit IRC | 04:41 | |
| *** arunkant has joined #openstack-barbican | 04:42 | |
| *** arunkant__ has quit IRC | 04:44 | |
| *** rm_work|away is now known as rm_work | 05:13 | |
| *** arunkant_ has joined #openstack-barbican | 06:17 | |
| *** arunkant__ has joined #openstack-barbican | 06:18 | |
| *** shohel has joined #openstack-barbican | 06:19 | |
| *** arunkant has quit IRC | 06:20 | |
| *** arunkant_ has quit IRC | 06:22 | |
| *** epequeno has quit IRC | 06:37 | |
| *** jaosorior has joined #openstack-barbican | 06:41 | |
| *** kebray has quit IRC | 07:06 | |
| openstackgerrit | Merged openstack/barbican: Remove left over reference to admin endpoint https://review.openstack.org/195251 | 07:07 |
|---|---|---|
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/python-barbicanclient: Use keystone discovery instead of endpoint_override https://review.openstack.org/195453 | 08:45 |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/python-barbicanclient: Use keystone discovery instead of endpoint_override https://review.openstack.org/195453 | 08:46 |
| *** nkinder has quit IRC | 10:03 | |
| *** nkinder has joined #openstack-barbican | 10:04 | |
| *** nkinder has quit IRC | 10:28 | |
| *** nkinder has joined #openstack-barbican | 10:47 | |
| *** david-lyle has quit IRC | 11:17 | |
| *** david-lyle has joined #openstack-barbican | 11:21 | |
| *** zz_dimtruck is now known as dimtruck | 12:30 | |
| *** david-ly_ has joined #openstack-barbican | 12:35 | |
| *** david-lyle has quit IRC | 12:39 | |
| *** SheenaG has joined #openstack-barbican | 13:16 | |
| *** SheenaG has quit IRC | 13:16 | |
| *** SheenaG has joined #openstack-barbican | 13:20 | |
| *** crc32 has joined #openstack-barbican | 13:44 | |
| *** pglass has joined #openstack-barbican | 14:10 | |
| *** Kevin_Bishop has joined #openstack-barbican | 14:12 | |
| *** woodster_ has joined #openstack-barbican | 14:42 | |
| *** kfarr has joined #openstack-barbican | 14:46 | |
| *** shohel has quit IRC | 15:00 | |
| *** david-ly_ is now known as david-lyle | 15:01 | |
| *** shohel has joined #openstack-barbican | 15:03 | |
| *** diazjf has joined #openstack-barbican | 15:12 | |
| *** igueths has joined #openstack-barbican | 15:39 | |
| *** silos has joined #openstack-barbican | 15:39 | |
| *** tkelsey has joined #openstack-barbican | 15:50 | |
| *** arunkant_ has joined #openstack-barbican | 15:59 | |
| *** arunkant__ has quit IRC | 16:03 | |
| *** kfarr1 has joined #openstack-barbican | 16:03 | |
| *** kfarr has quit IRC | 16:05 | |
| dave-mccowan | ping arunkant_ | 16:16 |
| hockeynut | good day barbicaneers! I am in search of someone knowledgeable in sqlalchemy | 16:18 |
| hockeynut | I shall describe my problem now: | 16:18 |
| hockeynut | adding a filter to GET /orders like the name= filter on secrets | 16:19 |
| hockeynut | but order names live in their meta | 16:19 |
| hockeynut | and meta is a json blob | 16:19 |
| hockeynut | tried this: query = query.filter(models.Order.meta['name'].like(meta_arg)) | 16:20 |
| hockeynut | but fails "operator gettitem is not supported on this expression" | 16:20 |
| *** kfarr1 has quit IRC | 16:20 | |
| hockeynut | so, how can I filter on the 'name' field in meta ? | 16:20 |
| hockeynut | </question> | 16:20 |
| woodster_ | hockeynut: can you just pull all orders back but only count the ones with a specific name in the meta data client side? | 16:22 |
| hockeynut | since I am testing orders paging that seems like cheating | 16:23 |
| hockeynut | looks like changing "like" to "contains" on the filter is helping | 16:28 |
| *** diazjf has quit IRC | 16:30 | |
| *** shohel1 has joined #openstack-barbican | 16:31 | |
| *** kfarr has joined #openstack-barbican | 16:34 | |
| *** shohel has quit IRC | 16:34 | |
| *** diazjf has joined #openstack-barbican | 16:35 | |
| *** jaosorior has quit IRC | 16:35 | |
| *** shohel1 has quit IRC | 16:37 | |
| openstackgerrit | Merged openstack/barbican: Added unit test around bug related to who can modify ACL. https://review.openstack.org/179547 | 16:45 |
| *** igueths has quit IRC | 16:53 | |
| *** igueths has joined #openstack-barbican | 16:54 | |
| arunkant_ | dave-mccowan: yes. | 16:54 |
| dave-mccowan | arunkant_ is there a spec or documentation that is updated to the latest implementation of ACLs? | 17:00 |
| *** kfarr has quit IRC | 17:01 | |
| *** shohel has joined #openstack-barbican | 17:05 | |
| redrobot | dave-mccowan http://docs.openstack.org/developer/barbican/api/reference/acls.html | 17:09 |
| dave-mccowan | arunkant_ thanks. i must have had an old link. one specific question: should project-access:false, prevent an admin from accessing a secret? i think it should not, but it appears that current code does. what do you think? | 17:10 |
| woodster_ | dave-mccowan: I thought an admin of a project's secret does have access? | 17:14 |
| redrobot | dave-mccowan woodster_ agreed. project admin should always have access | 17:15 |
| dave-mccowan | woodster_, arunkant_ i would have guessed so too, but i'm working on functional tests and my admin user is getting 403 | 17:15 |
| dave-mccowan | woodster_ redrobot arunkant_ #agreed. i'll open a bug and fix it. | 17:17 |
| *** kfarr has joined #openstack-barbican | 17:18 | |
| *** mmdurrant has joined #openstack-barbican | 17:35 | |
| *** kfarr has quit IRC | 17:40 | |
| *** kebray has joined #openstack-barbican | 17:46 | |
| *** diazjf has quit IRC | 17:55 | |
| *** kfarr has joined #openstack-barbican | 17:56 | |
| *** dimtruck is now known as zz_dimtruck | 17:57 | |
| *** dontalton has joined #openstack-barbican | 18:02 | |
| *** husanu5 has joined #openstack-barbican | 18:02 | |
| *** zz_dimtruck is now known as dimtruck | 18:09 | |
| *** husanu5 has quit IRC | 18:14 | |
| *** diazjf has joined #openstack-barbican | 18:24 | |
| *** tkelsey has quit IRC | 18:35 | |
| *** xaeth_afk is now known as xaeth | 18:37 | |
| *** dontalton has quit IRC | 18:44 | |
| *** xaeth is now known as xaeth_afk | 18:53 | |
| *** dimtruck is now known as zz_dimtruck | 19:00 | |
| *** zz_dimtruck is now known as dimtruck | 19:09 | |
| *** Kevin_Bishop has quit IRC | 20:19 | |
| *** claudiub|2 has joined #openstack-barbican | 20:27 | |
| *** Kevin_Bishop has joined #openstack-barbican | 20:28 | |
| claudiub|2 | hello. can anyone here answer some barbican questions I have? | 20:31 |
| redrobot | claudiub|2 what's up? | 20:31 |
| claudiub|2 | redrobot: Hi. So, I'm interested in finding out how barbican works, for blueprint purposes. Basically, I want to store some secret keys via Barbican | 20:32 |
| claudiub|2 | redrobot: now, my question is, how the authentication is done? | 20:32 |
| claudiub|2 | redrobot: I mean, not everyone should have access to the secrets, right? | 20:32 |
| redrobot | claudiub|2 right, so barbican was designed to be an openstack service from the beginning, so authentication is deferred to Keystone (or an external auth system that can provide the same request headers that Keystone provides) | 20:33 |
| redrobot | claudiub|2 barbican segregates secrets at the project level | 20:34 |
| redrobot | and access is granted based on the role a particular user has within that project | 20:35 |
| claudiub|2 | redrobot: from what I can see in the quick start guide, the requests are done through curl. | 20:35 |
| claudiub|2 | redrobot: How can barbican tell that the requester is a legit user? I can only see the -H 'X-Project-Id:1234' | 20:36 |
| rm_work | X-Auth-Token | 20:36 |
| rm_work | takes a keystone auth token, the same as other projects -- might not be in the docs? | 20:37 |
| redrobot | claudiub|2 in a real deployment users would not be allowed to specify their own X-Project-Id | 20:37 |
| redrobot | claudiub|2 quick start examples assume a development (non-production) barbican instance | 20:37 |
| claudiub|2 | rm_work: I see. well, https://github.com/cloudkeep/barbican/wiki/Barbican-Quick-Start-Guide doesn't contain any X-Auth-Token | 20:38 |
| claudiub|2 | redrobot: I see. | 20:38 |
| redrobot | claudiub|2 in a real deployment the user would provide an X-Auth-Token acquired from Keystone, and Barbican would be configured to use keystonemiddleware to validate the token and set the X-Project-Id | 20:38 |
| rm_work | In production, just pass X-Auth-Token in the headers and you'll be good :) | 20:38 |
| claudiub|2 | redrobot: rm_work: got, thanks. :) | 20:39 |
| claudiub|2 | got it * | 20:39 |
| * redrobot makes a note to clarify this in the Quick Start guide | 20:39 | |
| claudiub|2 | also, will there be a client released? | 20:39 |
| rm_work | python-barbicanclient exists | 20:39 |
| redrobot | claudiub|2 https://pypi.python.org/pypi/python-barbicanclient/3.2.0 | 20:40 |
| rm_work | and is usable (though lacks some of the newer features, like ACL) | 20:40 |
| claudiub|2 | ah, cool. makes my work easier. :) | 20:40 |
| redrobot | claudiub|2 long term, the client will be deprecated in favor of python-openstacksdk, but that's still a ways out. | 20:40 |
| rm_work | there are some examples of using python-barbicanclient in production, I can link some | 20:41 |
| rm_work | https://github.com/openstack/neutron-lbaas/blob/master/neutron_lbaas/common/cert_manager/barbican_cert_manager.py | 20:41 |
| claudiub|2 | redrobot: rm_work: awesome, thanks for the info folks. :D | 20:42 |
| claudiub|2 | I guess we barbi CAN do the blueprint properly now. :D | 20:43 |
| * chellygel groans | 20:43 | |
| * claudiub|2 hears cricket sounds | 20:43 | |
| chellygel | hahahahaha | 20:43 |
| redrobot | claudiub|2 lol, you're welcome | 20:43 |
| rm_work | lol | 20:43 |
| openstackgerrit | Dave McCowan proposed openstack/barbican: Add Functional Tests for ACLs Using Multiple Users https://review.openstack.org/181291 | 20:44 |
| *** arunkant__ has joined #openstack-barbican | 20:57 | |
| *** arunkant_ has quit IRC | 21:01 | |
| *** rm_work is now known as rm_work|away | 21:02 | |
| *** rm_work|away is now known as rm_work | 21:06 | |
| *** chlong has quit IRC | 21:11 | |
| *** kebray has quit IRC | 21:13 | |
| *** SheenaG has quit IRC | 21:18 | |
| silos | Hey. I noticed it is possible to generate a certificate and retrieve it in barbican. Where is the certificate stored in barbican? Or is it stored in the CA plugin and barbican acts as the middle man? | 21:22 |
| chellygel | silos, it will be stored within a certificate container, which will point to a secret ref for the certificate itself | 21:22 |
| redrobot | silos the CA plugin provisions the certificate by interacting with an external CA. Once the cert is issued, barbican stores it in the SecretStore plugin. | 21:23 |
| *** chlong has joined #openstack-barbican | 21:23 | |
| silos | chellygel redrobot: thanks! | 21:24 |
| silos | :-D | 21:24 |
| chellygel | you can see stuff about containers here silos: http://docs.openstack.org/developer/barbican/api/quickstart/containers.html | 21:25 |
| *** igueths has quit IRC | 21:26 | |
| silos | chellygel: thanks. reading now. | 21:26 |
| *** shohel has quit IRC | 21:39 | |
| *** kebray has joined #openstack-barbican | 21:46 | |
| *** diazjf has left #openstack-barbican | 21:56 | |
| *** silos has left #openstack-barbican | 21:59 | |
| *** chlong has quit IRC | 22:00 | |
| *** rm_work is now known as rm_work|away | 22:09 | |
| *** kfarr has quit IRC | 22:11 | |
| *** SheenaG has joined #openstack-barbican | 22:16 | |
| *** Kevin_Bishop has quit IRC | 22:27 | |
| kfox1111 | redrobot: you there? | 22:31 |
| *** dontalton has joined #openstack-barbican | 22:32 | |
| *** pglass has quit IRC | 22:33 | |
| *** rm_work|away is now known as rm_work | 22:36 | |
| *** dontalton has quit IRC | 22:45 | |
| *** rm_work is now known as rm_work|away | 22:52 | |
| *** dimtruck is now known as zz_dimtruck | 22:57 | |
| openstackgerrit | Doug Hellmann proposed openstack/kite: Drop use of 'oslo' namespace package https://review.openstack.org/195777 | 22:58 |
| openstackgerrit | Merged openstack/python-barbicanclient: Use keystone discovery instead of endpoint_override https://review.openstack.org/195453 | 23:06 |
| *** kebray has quit IRC | 23:41 | |
| *** chlong has joined #openstack-barbican | 23:48 | |
| *** SheenaG has quit IRC | 23:51 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!