| *** stevemar_ has joined #openstack-barbican | 00:00 | |
| *** stevemar_ has quit IRC | 00:42 | |
| *** stevemar_ has joined #openstack-barbican | 00:44 | |
| *** mixos has joined #openstack-barbican | 00:47 | |
| *** stevemar_ has quit IRC | 00:49 | |
| *** lisaclark1 has joined #openstack-barbican | 01:02 | |
| *** mixos has quit IRC | 01:04 | |
| *** lisaclark_ has quit IRC | 01:33 | |
| *** eglute has quit IRC | 01:33 | |
| *** jilly has quit IRC | 01:34 | |
| *** ryanpetrello has quit IRC | 01:34 | |
| *** rm_work has quit IRC | 01:34 | |
| *** jamielennox has quit IRC | 01:34 | |
| *** reaperhulk has quit IRC | 01:34 | |
| *** spotz has quit IRC | 01:34 | |
| *** alee has quit IRC | 01:35 | |
| *** jroll has quit IRC | 01:35 | |
| *** reaperhulk has joined #openstack-barbican | 01:37 | |
| *** spotz has joined #openstack-barbican | 01:38 | |
| *** jroll has joined #openstack-barbican | 01:38 | |
| *** eglute has joined #openstack-barbican | 01:38 | |
| *** ryanpetrello has joined #openstack-barbican | 01:38 | |
| *** jillysciarilly has joined #openstack-barbican | 01:38 | |
| *** rm_work has joined #openstack-barbican | 01:38 | |
| *** rm_work has quit IRC | 01:38 | |
| *** rm_work has joined #openstack-barbican | 01:38 | |
| *** alee has joined #openstack-barbican | 01:38 | |
| *** lisaclark_ has joined #openstack-barbican | 01:40 | |
| *** jamielennox has joined #openstack-barbican | 01:41 | |
| *** Kevin_Zheng has joined #openstack-barbican | 02:21 | |
| *** dave-mccowan has joined #openstack-barbican | 02:21 | |
| *** lisaclark1 has quit IRC | 02:22 | |
| *** kebray has joined #openstack-barbican | 02:24 | |
| *** pdesai has joined #openstack-barbican | 03:06 | |
| *** pdesai has quit IRC | 03:19 | |
| *** spotz is now known as spotz_zzz | 04:21 | |
| *** stupidnic has joined #openstack-barbican | 04:56 | |
| *** dave-mccowan has quit IRC | 05:39 | |
| *** jvrbanac has joined #openstack-barbican | 05:48 | |
| *** stevemar_ has joined #openstack-barbican | 06:11 | |
| *** stevemar_ has quit IRC | 06:14 | |
| *** shakamunyi has joined #openstack-barbican | 06:21 | |
| *** jamielennox is now known as jamielennox|away | 06:25 | |
| *** dhellmann has quit IRC | 06:28 | |
| *** dhellmann has joined #openstack-barbican | 06:28 | |
| *** dhellmann has quit IRC | 06:34 | |
| *** dhellmann has joined #openstack-barbican | 06:34 | |
| *** shakamunyi has quit IRC | 06:39 | |
| *** shakamunyi has joined #openstack-barbican | 06:54 | |
| *** jaosorior has joined #openstack-barbican | 06:59 | |
| *** kebray has quit IRC | 07:07 | |
| *** jilly has joined #openstack-barbican | 07:14 | |
| *** rm_work| has joined #openstack-barbican | 07:14 | |
| *** zz_dimtruck has joined #openstack-barbican | 07:14 | |
| *** dimtruck has quit IRC | 07:15 | |
| *** zz_dimtruck is now known as dimtruck | 07:15 | |
| *** rm_work has quit IRC | 07:15 | |
| *** jillysciarilly has quit IRC | 07:15 | |
| *** lisaclark has quit IRC | 07:15 | |
| *** tristanC has quit IRC | 07:15 | |
| *** rm_work| is now known as rm_work | 07:15 | |
| *** rm_work has quit IRC | 07:15 | |
| *** rm_work has joined #openstack-barbican | 07:15 | |
| *** tristanC has joined #openstack-barbican | 07:20 | |
| *** lisaclark has joined #openstack-barbican | 07:22 | |
| *** shohel has joined #openstack-barbican | 07:39 | |
| *** jaosorior has quit IRC | 08:44 | |
| openstackgerrit | Merged openstack/python-barbicanclient: Update Readme to include new/updated CLI commands https://review.openstack.org/243772 | 08:47 |
|---|---|---|
| *** jaosorior has joined #openstack-barbican | 08:51 | |
| *** tkelsey has joined #openstack-barbican | 09:07 | |
| *** xek_ is now known as xek | 09:22 | |
| *** everjeje has joined #openstack-barbican | 09:51 | |
| *** shohel1 has joined #openstack-barbican | 10:03 | |
| openstackgerrit | Atsushi SAKAI proposed openstack/barbican: Fix troubleshooting.rst broken link https://review.openstack.org/245684 | 10:03 |
| *** shohel has quit IRC | 10:05 | |
| *** openstackgerrit has quit IRC | 10:16 | |
| *** openstackgerrit has joined #openstack-barbican | 10:17 | |
| *** shohel1 has quit IRC | 10:58 | |
| *** shohel has joined #openstack-barbican | 11:01 | |
| *** stevemar_ has joined #openstack-barbican | 11:12 | |
| *** stevemar_ has quit IRC | 11:15 | |
| *** xek has quit IRC | 11:47 | |
| *** shohel has quit IRC | 12:35 | |
| *** openstack has joined #openstack-barbican | 12:48 | |
| *** dave-mccowan has joined #openstack-barbican | 13:08 | |
| *** jaosorior has quit IRC | 13:16 | |
| *** jaosorior has joined #openstack-barbican | 13:17 | |
| *** stevemar_ has joined #openstack-barbican | 13:33 | |
| *** lisaclark_ has quit IRC | 13:52 | |
| *** lisaclark_ has joined #openstack-barbican | 13:52 | |
| *** DuncanT has quit IRC | 13:53 | |
| *** DuncanT has joined #openstack-barbican | 13:56 | |
| *** darrenmoffat has quit IRC | 14:07 | |
| *** darrenmoffat has joined #openstack-barbican | 14:07 | |
| *** dimtruck is now known as zz_dimtruck | 14:12 | |
| *** zz_dimtruck is now known as dimtruck | 14:15 | |
| *** rellerreller has joined #openstack-barbican | 14:17 | |
| *** silos has joined #openstack-barbican | 14:38 | |
| silos | rellerreller: ping | 14:44 |
| rellerreller | silos pong | 14:47 |
| *** jmckind has joined #openstack-barbican | 14:49 | |
| silos | rellerreller: I wanted to propose a spec for a kmip_key_manager in Castellan. Is there a castellan-specs github? or should the spec go elsewhere? | 14:49 |
| rellerreller | silos that is a good question. I'm not sure off hand. I think we had been putting them in Barbican specs. | 14:50 |
| rellerreller | silos I think in Barbican specs, but maybe we should create a Castellan specs. | 14:50 |
| silos | I'd +1 that. | 14:51 |
| silos | rellerreller ^ | 14:51 |
| rellerreller | silos bring it up today at the Barbican meeting. I'll check with kfarr as well. | 14:51 |
| rellerreller | silos I am also excited to have a KMIP key manager! | 14:52 |
| silos | rellerreller: me too. I'll add it to the agenda. thanks. | 14:52 |
| rellerreller | silos thank you | 14:53 |
| *** jmckind_ has joined #openstack-barbican | 14:54 | |
| *** jmckind has quit IRC | 14:55 | |
| *** spotz_zzz is now known as spotz | 14:59 | |
| *** jhfeng has joined #openstack-barbican | 15:07 | |
| *** jaosorior has quit IRC | 15:08 | |
| *** jaosorior has joined #openstack-barbican | 15:08 | |
| alee | rellerreller, has support been added for cinder for key management for backup encrypted volumes? | 15:26 |
| *** kebray has joined #openstack-barbican | 15:28 | |
| rellerreller | alee I'm not sure off hand. I know there are several use cases that we had to consider. I believe we do support it, but I'm not sure. | 15:28 |
| rellerreller | alee I can ask joel-coffman later today. | 15:28 |
| alee | rellerreller, that would be great thanks. | 15:29 |
| rellerreller | alee np. Sorry I don't know off hand. There are lots of different use cases for encrypting the cinder volumes and ephemeral storage. I can't keep them all straight. | 15:29 |
| alee | rellerreller, I think I remember hearing about this - and if I recall correctly, we actually copy the key precisely for this reason. | 15:29 |
| rellerreller | alee I agree. | 15:30 |
| *** silos has quit IRC | 15:56 | |
| *** ccneill has joined #openstack-barbican | 16:01 | |
| *** silos has joined #openstack-barbican | 16:02 | |
| *** lisaclark1 has joined #openstack-barbican | 16:03 | |
| *** lisaclark1 has quit IRC | 16:03 | |
| *** lisaclark1 has joined #openstack-barbican | 16:03 | |
| *** _edmund has joined #openstack-barbican | 16:06 | |
| *** rellerreller has quit IRC | 16:06 | |
| *** arunkant has quit IRC | 16:15 | |
| *** arunkant has joined #openstack-barbican | 16:30 | |
| openstackgerrit | Merged openstack/barbican: Remove unused scrub variables in barbican.conf https://review.openstack.org/244174 | 16:31 |
| *** jaosorior has quit IRC | 16:31 | |
| *** jaosorior has joined #openstack-barbican | 16:31 | |
| *** rhagarty__ has quit IRC | 16:33 | |
| *** diazjf has joined #openstack-barbican | 16:35 | |
| *** lisaclark1 has quit IRC | 16:36 | |
| *** lisaclark1 has joined #openstack-barbican | 16:39 | |
| *** rhagarty has joined #openstack-barbican | 16:39 | |
| *** mixos has joined #openstack-barbican | 16:44 | |
| *** lisaclark1 has quit IRC | 16:44 | |
| *** lisaclark1 has joined #openstack-barbican | 16:49 | |
| rm_work | lisaclark / lisaclark1 | 16:53 |
| rm_work | lisaclark_: | 16:53 |
| openstackgerrit | Merged openstack/barbican: Updated from global requirements https://review.openstack.org/245235 | 16:56 |
| spotz | 3 lisaclarks:) | 16:57 |
| *** silos has quit IRC | 16:58 | |
| *** igueths has joined #openstack-barbican | 16:58 | |
| *** rhagarty has quit IRC | 17:01 | |
| openstackgerrit | Merged openstack/barbican: Fix troubleshooting.rst broken link https://review.openstack.org/245684 | 17:04 |
| rm_work | such lisaclark | 17:05 |
| *** lisaclark1 has quit IRC | 17:05 | |
| *** rhagarty has joined #openstack-barbican | 17:06 | |
| *** silos has joined #openstack-barbican | 17:08 | |
| *** rhagarty has quit IRC | 17:08 | |
| *** rhagarty has joined #openstack-barbican | 17:22 | |
| *** diazjf has quit IRC | 17:24 | |
| *** pdesai has joined #openstack-barbican | 17:28 | |
| *** diazjf has joined #openstack-barbican | 17:35 | |
| *** igueths has quit IRC | 17:39 | |
| openstackgerrit | Fernando Diaz proposed openstack/python-barbicanclient: Allow Barbican Secrets to be Updated via File https://review.openstack.org/242635 | 17:41 |
| redrobot | rm_work hey lisaclark is OOO today | 17:44 |
| rm_work | kk | 17:44 |
| rm_work | I'm about to go to sleep anyway | 17:44 |
| redrobot | rm_work still in JST? | 17:44 |
| rm_work | just needed to get an endpoint, you can prolly PM it to me | 17:44 |
| rm_work | yeah | 17:44 |
| rm_work | head back Sunday | 17:44 |
| redrobot | rm_work word.. enjoy your last week! | 17:45 |
| rm_work | thanks :) | 17:45 |
| redrobot | rm_work oh and definitely do go to the Robot Restaurant. | 17:45 |
| rm_work | heh alright will add that to the list | 17:46 |
| rm_work | next up is owls | 17:46 |
| rm_work | http://akiba2960.com/ | 17:46 |
| openstackgerrit | Fernando Diaz proposed openstack/barbican-specs: Blueprint for allowing file input to Barbican Client https://review.openstack.org/243753 | 17:48 |
| *** igueths has joined #openstack-barbican | 17:54 | |
| openstackgerrit | Elvin Tubillara proposed openstack/barbican-specs: Create spec for cron job garbage collector for barbican database https://review.openstack.org/243806 | 17:58 |
| *** edtubill has joined #openstack-barbican | 17:58 | |
| *** edtubill has quit IRC | 17:59 | |
| *** edtubill has joined #openstack-barbican | 18:02 | |
| *** gyee has joined #openstack-barbican | 18:04 | |
| *** jmckind_ has quit IRC | 18:07 | |
| *** edtubill has quit IRC | 18:07 | |
| *** edtubill has joined #openstack-barbican | 18:08 | |
| *** edtubill has quit IRC | 18:10 | |
| *** edtubill has joined #openstack-barbican | 18:11 | |
| *** edtubill has quit IRC | 18:14 | |
| *** silos has quit IRC | 18:16 | |
| *** edtubill has joined #openstack-barbican | 18:17 | |
| *** kfarr has joined #openstack-barbican | 18:17 | |
| *** igueths has quit IRC | 18:19 | |
| openstackgerrit | Merged openstack/barbican: Remove kombu useless requirement https://review.openstack.org/245451 | 18:20 |
| openstackgerrit | Merged openstack/barbican: Remove useless requirements https://review.openstack.org/245453 | 18:20 |
| *** rellerreller has joined #openstack-barbican | 18:28 | |
| jkf | jhfeng: I've added description of my changes to your etherpad. | 18:30 |
| jhfeng | jkf: great thanks. we need get people to review it. | 18:31 |
| *** igueths has joined #openstack-barbican | 18:33 | |
| *** diazjf has quit IRC | 18:42 | |
| notmyname | what channel is the barbican meeting in? | 18:46 |
| kfarr | notmyname, openstack-meeting-alt | 18:49 |
| notmyname | in 70 minutes, right? | 18:49 |
| kfarr | notmyname, correct! | 18:49 |
| *** ccneill has quit IRC | 18:50 | |
| *** melgibson has joined #openstack-barbican | 18:52 | |
| *** melgibson has quit IRC | 18:54 | |
| *** melgibson has joined #openstack-barbican | 19:00 | |
| *** diazjf has joined #openstack-barbican | 19:02 | |
| *** ccneill has joined #openstack-barbican | 19:05 | |
| *** melgibson has quit IRC | 19:12 | |
| *** melgibson has joined #openstack-barbican | 19:14 | |
| melgibson | Hi there, I've been taking a look at barbican documentation and I am wondering if there is any installation guide for productive systems? I just found the docu for the insecure dev environment :) | 19:18 |
| redrobot | hi melgibson ... unfortunately we don't have any deployment guides currently | 19:19 |
| redrobot | melgibson but if you have any questions, we can definitely help | 19:19 |
| diazjf | redrobot, rellerreller, I have informed notmyname to attend our meeting today to discuss Authentication in Castellan in the Swift Keymaster. Please checkout https://etherpad.openstack.org/p/swifjt-keymaster-with-castellan | 19:20 |
| redrobot | melgibson First you'll have to decide on a secure backend. Currently supported are DogTag, PKCS#11 Devices (such as SafeNet's Luna SA), and KMIP Devices | 19:20 |
| alee | rellerreller, kfarr so whats the support for barbian in backing up encrypted volumes? | 19:21 |
| redrobot | diazjf I'll take a look at it, thanks | 19:21 |
| *** silos has joined #openstack-barbican | 19:23 | |
| *** rellerreller has quit IRC | 19:24 | |
| melgibson | oh, is there a list of which HSM are supported? | 19:24 |
| kfarr | alee, are you waiting to hear back from rellerreller about that? | 19:24 |
| alee | kfarr, I mentioned it to him this morning and he was going to ask joel .. | 19:24 |
| kfarr | If you're taking snapshots, the key is copied | 19:24 |
| alee | kfarr, if you know the answer though .. | 19:25 |
| diazjf | redrobot thanks. kfarr, also meant to add you to my comment above :) | 19:25 |
| *** edtubill has quit IRC | 19:25 | |
| kfarr | If you're backing up encrypted volumes out-of-band of an openstack service, not so sure | 19:25 |
| kfarr | the key is deleted if you delete the encrypted volume using the "cinder delete" command | 19:26 |
| alee | kfarr, ok so I'm not sure of the different things available to cinder to do backups .. | 19:26 |
| alee | there are snapshots .. are those the same as a full or an incremental backup? | 19:26 |
| kfarr | alee Not really | 19:27 |
| kfarr | I'm looking over http://docs.openstack.org/admin-guide-cloud/blockstorage_volume_backups.html to see how that would work for encrypted volumes | 19:28 |
| alee | kfarr, right -- I was looking at http://docs.openstack.org/developer/cinder/api/cinder.backup.manager.html | 19:29 |
| alee | kfarr, so does that work for encrypted volumes? | 19:29 |
| *** edtubill has joined #openstack-barbican | 19:30 | |
| kfarr | alee, I know rellerreller already told you this, but I'll check with Joel. I'm on a conference call with him right now for an internal meeting, I'll check with him at the end of the meeting | 19:31 |
| *** kebray has quit IRC | 19:31 | |
| alee | kfarr, cool - thanks! | 19:31 |
| alee | kfarr, there is an interesting note there about backing up metadata | 19:32 |
| alee | kfarr, specifically -- "If you specify a UUID encryption key when setting up the volume specifications, the backup metadata ensures that the key will remain valid when you back up and restore the volume." | 19:33 |
| melgibson | thanks redrobot, I've another question, if I don't use Symatec or digicert as CA, is there a way to use barbican with other CAs? | 19:33 |
| alee | melgibson, what CA do you want to use? | 19:34 |
| melgibson | hey alee, something like comodo or GoDaddy | 19:37 |
| alee | melgibson, so if you wanted to use barbican to talk to either of those, you would need to write a plugin to do essentially what the symantec, digicert or dogtag plugins do. | 19:38 |
| melgibson | alee, I see :) | 19:38 |
| alee | melgibson, dogtag is a little different in that you set it up to be your private CA. | 19:39 |
| melgibson | right | 19:39 |
| *** jmckind has joined #openstack-barbican | 19:41 | |
| kfarr | alee are you seeing that in the docs you linked? | 19:42 |
| kfarr | diazjf thanks! I saw your comment. Hopefully it's a good discussion :) | 19:43 |
| elmiko | redrobot: is it cool to add items on the agenda wiki? | 19:48 |
| kfarr | alee, conference call is still going, haven't had a chance to ask yet, but I found this in the code: https://github.com/openstack/cinder/blob/c9eef31820dc385a2c9f4ba24dd1d194f9e7d088/cinder/backup/driver.py#L73-L98 | 19:49 |
| kfarr | looks like the key is copied when you backup the metadata | 19:49 |
| alee | kfarr, is that copying the key or the uuid? | 19:51 |
| kfarr | It creates a copy of the key and stores the uuid of the copy of the key as metadata on the backed-up volume | 19:51 |
| alee | kfarr, interesting .. and what invokes this code? | 19:54 |
| *** silos has quit IRC | 19:55 | |
| *** alpha_ori has quit IRC | 19:55 | |
| alee | kfarr, so this is called on a get() to BackupMetadataAPI | 19:56 |
| *** alpha_ori has joined #openstack-barbican | 19:56 | |
| *** silos1 has joined #openstack-barbican | 19:57 | |
| *** silos1 has left #openstack-barbican | 19:57 | |
| *** redrobot has quit IRC | 19:57 | |
| *** lvh has quit IRC | 19:58 | |
| *** lvh has joined #openstack-barbican | 19:58 | |
| *** Guest98343 has joined #openstack-barbican | 19:58 | |
| *** silos1 has joined #openstack-barbican | 19:59 | |
| *** maxabidi has quit IRC | 20:00 | |
| *** Guest98343 is now known as redrobot | 20:00 | |
| *** rellerreller has joined #openstack-barbican | 20:00 | |
| *** woodster_ has joined #openstack-barbican | 20:06 | |
| *** maxabidi has joined #openstack-barbican | 20:07 | |
| *** jhfeng has quit IRC | 20:16 | |
| *** mixos has quit IRC | 20:16 | |
| *** rhagarty has quit IRC | 20:19 | |
| *** mixos has joined #openstack-barbican | 20:19 | |
| *** jhfeng has joined #openstack-barbican | 20:34 | |
| *** everjeje has quit IRC | 20:37 | |
| *** alee is now known as alee_back_later | 20:40 | |
| *** _edmund1 has joined #openstack-barbican | 20:49 | |
| *** jaosorior has quit IRC | 20:50 | |
| *** _edmund has quit IRC | 20:52 | |
| woodster_ | kfarr: Do you expect many more changes? | 21:00 |
| kfarr | woodster_, rellerreller listed these: context, barbican authentication, kmip impl | 21:01 |
| elmiko | redrobot: some of what i wanted to talk about actually dove-tails nicely on the auth talks | 21:01 |
| redrobot | woodster_ I know elmiko wanted to talk about a Castellan spec as well | 21:01 |
| kfarr | but overall, I don't really see any major changes to the API upcoming | 21:01 |
| elmiko | yea, i'm curious about improving the current auth_url behavior in the barbican key manager | 21:01 |
| kfarr | elmiko, your question was about auto discovering the barbican auth url, yeah? | 21:02 |
| elmiko | kfarr: yea, and it ties in with the auth stuff too | 21:02 |
| redrobot | kfarr elmiko my $0.02 was that autodiscover would be awesome, as long as there is the option to override with a url | 21:02 |
| edtubill | woodster: I was going to make a castellan spec that would help solve the federated barbican problem by dynamically loading keymanager interfaces and endpoints... | 21:02 |
| kfarr | elmiko, I think it already does that! | 21:02 |
| elmiko | so, 2 issues: 1. discovering the barbican endpoint, 2. identity endpoint/auth | 21:03 |
| kfarr | https://github.com/openstack/castellan/blob/master/castellan/key_manager/barbican_key_manager.py#L142-L149 | 21:03 |
| elmiko | kfarr: ok, cool. i must have misread that. i though it was doing something else | 21:03 |
| elmiko | so, second question =) | 21:03 |
| elmiko | can we improve the way auth_url is handled. like, could we first look to the context for an auth object generated by the keystonemiddleware? | 21:04 |
| *** rellerreller has quit IRC | 21:04 | |
| redrobot | elmiko I think that goes back to having a better definition of what the "context" object is | 21:04 |
| elmiko | this would make is easier to create auth sessions and we could avoid some of the need to repeat the auth_url config (when used downstream) | 21:04 |
| kfarr | elmiko, it's highly likely there's a better way to do it, I just don't know what thatis | 21:05 |
| elmiko | redrobot: yea, i could see some sort of castellan.context module to help smooth the transition | 21:05 |
| mixos | @kfarr Do we have a way to bypass SSL cert check in castellan ? So far I don't see it in the castellan code. | 21:05 |
| elmiko | so, i realize diazjf is going to be looking into creating a more full featured solution but, is there room to create some incremental improvements in the meantime? | 21:05 |
| redrobot | afaik, the context object isnt defined anywhere within Castellan... last time I picked kfarr 's brain it was intended to be an instance of oslo.context provided by something external to Castellan | 21:06 |
| elmiko | redrobot: right, it's assumed that it works like an oslo.context | 21:07 |
| kfarr | Yeah, I was thinking oslo.context was generic enough to handle any auth, especially since most projects I'd looked at were using it, but that's not the case anymore | 21:07 |
| redrobot | elmiko the fastest spec wins? :-O ... hehe... we can work something out with diazjf if you need something to land soon. | 21:07 |
| elmiko | and recently, the keystonemiddleware stuff has gotten really good about putting full auth objects into the context | 21:07 |
| kfarr | mixos which SSL cert check? | 21:07 |
| diazjf | redrobot, elmiko lol. I'm willing to work together | 21:08 |
| elmiko | i just think we could avoid having to use the auth_url and generate a new auth/session based on information that could be present in the context | 21:08 |
| *** rhagarty has joined #openstack-barbican | 21:08 | |
| mixos | @kfarr in case barbican and keystone nodes are using HTTPS. | 21:08 |
| elmiko | diazjf: yea, i have no desire to race for a solution ;) | 21:08 |
| elmiko | that being said, i have a few small suggestions to improve the behavior of the barbican key manager | 21:08 |
| elmiko | my perspective on this, is that it is becoming slightly complex to manipulate castellan while trying to integrate it into the sahara project. i think there are some quality of life features that might help other projects who want to consume castellan/barbican | 21:09 |
| kfarr | elmiko, would be happy to hear them :) | 21:10 |
| elmiko | kfarr: what would be the best way to propose this? (spec, etherpad, patchset, something else) | 21:10 |
| diazjf | elmiko, I'll be contacting you in the following weeks. | 21:11 |
| *** maxabidi has quit IRC | 21:11 | |
| kfarr | Oh hmm, elmiko probably etherpad? If they are small enough, patchset might be fine | 21:11 |
| elmiko | diazjf: awesome =) | 21:11 |
| elmiko | kfarr: ok, i'll make something a little more formal. thanks! | 21:11 |
| mixos | @kfarr For example, from keystoneclient import session sess = session.Session(auth=auth, verify=False) <== verify=False to turn off cert check when connecting HTTPS keystone node/barbican node. When you get time. | 21:12 |
| kfarr | mixos, I am not familiar with how to bypass SSL cert checks for Barbican. Is there a way to do that in python-barbicanclient? | 21:12 |
| redrobot | kfarr there's an "insecure" parameter that can be passed into the Keystone Session before instantiating barbicanclient | 21:13 |
| kfarr | redrobot, oh, ok, then we can probably add a parameter to Castellan to pass it on in the same way? | 21:13 |
| elmiko | redrobot: +1 | 21:14 |
| mixos | @redrobot @kfarr Is this something I can work on ? if missing in castellan. | 21:16 |
| kfarr | mixos, sure! | 21:17 |
| mixos | @kfarr this is rather bug item than spec . correct ? | 21:18 |
| *** jamielennox|away is now known as jamielennox | 21:18 | |
| *** pdesai has quit IRC | 21:18 | |
| kfarr | mixos, yes, probably a bug, but can be tagged as a wishlist item? | 21:19 |
| *** tkelsey has quit IRC | 21:19 | |
| mixos | @kfarr thanks for your answer. will work on it. | 21:19 |
| arunkant | kfarr: Looks like there might be issue in endpoint discovery on castellan side, similar to nova ephermeral bug. https://bugs.launchpad.net/nova/+bug/1505930 | 21:21 |
| openstack | Launchpad bug 1505930 in OpenStack Compute (nova) "Fix key manager service endpoints in devstack Nova ephemeral" [Undecided,In progress] - Assigned to Arun Kant (arunkant-uws) | 21:21 |
| arunkant | kfarr, will need to check that but just saw the link you provided for castellan (its missing version parameter) similar to nova change..https://github.com/openstack/castellan/blob/master/castellan/key_manager/barbican_key_manager.py#L142-L149 | 21:23 |
| arunkant | kfarr: change on nova side: https://review.openstack.org/#/c/243322/2/nova/keymgr/barbican.py,cm | 21:23 |
| kfarr | arunkant thanks for the head's up! that is a strange bug | 21:23 |
| arunkant | redrobot | 21:24 |
| kfarr | arunkant, would you like to do the fix in Castellan? Otherwise, I can do it, but it'll be the same code as yours really | 21:26 |
| arunkant | redrobot: Can barbican support multiple secret store backend. Asking as in our deployment, some services want to use HSM backend and some are okay with db backend as per their performance and compliance characteristics ? | 21:26 |
| arunkant | kfarr: Yes, I can do that..first will need to verify if this is an indeed an issue on castellan side. Made the comment made on just glancing the code section from above link. | 21:28 |
| arunkant | woodster_, do you happen to know about 'multiple secret store' support question above ^^^ | 21:31 |
| woodster_ | arunkant: ...catching up...the current secret store plugin approach wasn't intended to support a per-secret/project SLA to route secrets to plugins, but that has been discussed in the past | 21:34 |
| woodster_ | arunkant: it seems possible to install custom plugins that make use of the supported() method to determine which plugin to use with a given secret, but not enabled out of the box | 21:35 |
| woodster_ | regarding castellan and specs, if on a handful more specs are coming over the next release cycle, I'm thinking keeping the specs in barbican should be fine. Is there concern that the combined specs are causing confusion? | 21:37 |
| silos1 | arunkant: diazjf and I tried to work on multiple plugins but we were given the conclusion it had been tried previously and with some problems. This lead us to federated barbican. | 21:37 |
| arunkant | woodster_, okay. So by design, barbican can be configured to use only one active secret store backend? I was looking in the code, it seems that multiple plugins can be configured..https://github.com/openstack/barbican/blob/master/barbican/plugin/interface/secret_store.py#L42 | 21:38 |
| arunkant | woodster_, its multi str option.. but not sure how support for multiple plugin is supported in the flow. | 21:40 |
| redrobot | arunkant technically you can have N backends all be active at once | 21:40 |
| woodster_ | arunkant: you can have multiple backens, but the first one to say it supports a secret operation wins | 21:41 |
| redrobot | arunkant what woodster_ said | 21:41 |
| woodster_ | arunkant: once a secret is stored with a given backend/plugin, only that plugin is used to decrypt it | 21:41 |
| redrobot | arunkant basically, the first one on the list always wins, unless you want to write your own custom plugins that can tell which backend to use based on request paraemeters. | 21:42 |
| woodster_ | arunkant: so the plugin used with the secret is stored with that secret to it can be used again for that secret in the future | 21:42 |
| woodster_ | arunkant: what redrobot said! | 21:42 |
| arunkant | woodster_, oh okay..so which plugin supports meet the new secret input critieria will store it. So client can not specify if it wants to store in specific backend | 21:42 |
| woodster_ | arunkant: correct | 21:42 |
| mixos | @kfarr would you tag this to wishlist : https://bugs.launchpad.net/castellan/+bug/1516793 | 21:43 |
| openstack | Launchpad bug 1516793 in castellan "Castellan should be able to bypass SSL certificate check" [Undecided,New] - Assigned to Sungjin Yook (sungyook) | 21:43 |
| woodster_ | arunkant: per-secret/project SLAs could revisit that though, in a way similar to the ca_id in the cert plugins now | 21:43 |
| mixos | not sure how to do it myself. :- ) | 21:43 |
| jkf | per-project classes of service is something I plan on exploring in the semi-near future as well. | 21:44 |
| arunkant | woodster_, okay. Yes, might be useful to have mechanism to choose secret store backend on per project level..similar to cert plugins. | 21:45 |
| redrobot | arunkant I disagree | 21:46 |
| *** tkelsey has joined #openstack-barbican | 21:46 | |
| redrobot | arunkant if you want different backends, you should deploy different instances of Barbican | 21:46 |
| arunkant | jkf, what classes of service you are thinking of ? | 21:46 |
| redrobot | then it's very easy for the client to decide which barbican to use based on their security requirements | 21:46 |
| jkf | arunkant: I have a need for two, the full pkcs11 model, and then a hybrid of pkcs11 and simple_crypto, with the hybrid model doing secret operations like simple_crypto, but it uses the mkek in the HSM instead of storing a master key in the config file. | 21:48 |
| arunkant | redrobot: So we are asking services to keep data for barbican endpoints based on feature set. Are there any openstack services which are following this model | 21:49 |
| *** rhagarty_ has joined #openstack-barbican | 21:49 | |
| redrobot | arunkant afaik, there are no projects that provide different service levels | 21:50 |
| *** tkelsey has quit IRC | 21:50 | |
| *** mixos has quit IRC | 21:51 | |
| *** rhagarty has quit IRC | 21:51 | |
| arunkant | redrobot: Yes, this is barbican service feature/ functonality. Like keystone offers factility to use "ldap" or "sql" user store backends based on domain separation. | 21:51 |
| redrobot | arunkant interesting... | 21:53 |
| arunkant | redrobot: I am also not sure how having multiple endpoints per feature set will integrate..like catalog, endpoint discovery features. | 21:54 |
| woodster_ | redrobot: from a performance perspective, it might be good to offer SLAs. We are tipping that way for public cert types, that really only need to be signed in Barbican rather than fully encrypted | 21:54 |
| *** pdesai has joined #openstack-barbican | 21:56 | |
| arunkant | woodster_, performance is one of the reason, some services may not want to opt for HSM based backend. Giving choice to client ( or may be default on tenant level..similar to cert plugin changes) is more flexible as not all of a service data has same compliance requirement. | 22:00 |
| *** silos1 has quit IRC | 22:04 | |
| *** diazjf has quit IRC | 22:04 | |
| *** melgibson has quit IRC | 22:05 | |
| *** silos has joined #openstack-barbican | 22:09 | |
| woodster_ | arunkant: yep, the per-secret SLA could include compliance guarantees as needed | 22:15 |
| *** pdesai has quit IRC | 22:17 | |
| *** diazjf has joined #openstack-barbican | 22:18 | |
| diazjf | redrobot, hockeynut, woodster_, I'll be attending an openstack meetup(http://www.meetup.com/OpenStack-Austin/events/226421170/) on Thursday in Austin. Let me know if you would like me to coordinate a future talk for Barbican? | 22:19 |
| *** rellerreller has joined #openstack-barbican | 22:24 | |
| *** jamielennox is now known as jamielennox|away | 22:27 | |
| *** melgibson has joined #openstack-barbican | 22:27 | |
| *** mixos has joined #openstack-barbican | 22:32 | |
| *** dave-mccowan has quit IRC | 22:32 | |
| *** mixos has quit IRC | 22:34 | |
| *** jhfeng has quit IRC | 22:35 | |
| *** jhfeng has joined #openstack-barbican | 22:35 | |
| *** edtubill has quit IRC | 22:38 | |
| *** silos has quit IRC | 22:39 | |
| *** rellerreller has quit IRC | 22:51 | |
| *** elmiko has quit IRC | 22:54 | |
| *** gyee has quit IRC | 22:54 | |
| *** arunkant has quit IRC | 22:54 | |
| *** therve has quit IRC | 22:54 | |
| *** arunkant has joined #openstack-barbican | 22:55 | |
| *** elmiko has joined #openstack-barbican | 22:56 | |
| *** therve has joined #openstack-barbican | 22:59 | |
| *** jkf_ has joined #openstack-barbican | 23:01 | |
| *** dabukalam has joined #openstack-barbican | 23:02 | |
| *** diazjf has left #openstack-barbican | 23:03 | |
| *** dave-mccowan has joined #openstack-barbican | 23:06 | |
| *** jkf has quit IRC | 23:06 | |
| *** dabukalam_ has quit IRC | 23:06 | |
| *** jkf_ is now known as jkf | 23:06 | |
| *** gyee has joined #openstack-barbican | 23:08 | |
| *** mixos has joined #openstack-barbican | 23:14 | |
| *** pdesai has joined #openstack-barbican | 23:14 | |
| *** igueths has quit IRC | 23:21 | |
| *** _edmund1 has quit IRC | 23:21 | |
| *** jmckind has quit IRC | 23:22 | |
| *** fnaval has joined #openstack-barbican | 23:27 | |
| *** ccneill has quit IRC | 23:32 | |
| *** jamielennox|away is now known as jamielennox | 23:37 | |
| *** dimtruck is now known as zz_dimtruck | 23:43 | |
| *** melgibson has quit IRC | 23:44 | |
| *** melgibson has joined #openstack-barbican | 23:45 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!