| *** chlong has quit IRC | 00:01 | |
| *** mp1 has left #openstack-barbican | 00:05 | |
| *** DuncanT has quit IRC | 00:15 | |
| *** DuncanT has joined #openstack-barbican | 00:16 | |
| *** su_zhang has joined #openstack-barbican | 00:17 | |
| *** chlong has joined #openstack-barbican | 00:17 | |
| *** woodster_ has quit IRC | 00:36 | |
| *** kebray has joined #openstack-barbican | 00:49 | |
| *** cheneydc has joined #openstack-barbican | 02:21 | |
| *** kebray has quit IRC | 02:22 | |
| *** Nirupama has joined #openstack-barbican | 02:32 | |
| *** su_zhang has quit IRC | 02:55 | |
| *** yuanying has quit IRC | 03:22 | |
| *** yuanying has joined #openstack-barbican | 03:22 | |
| *** yuanying has quit IRC | 04:06 | |
| *** kebray has joined #openstack-barbican | 04:08 | |
| *** kebray has quit IRC | 04:30 | |
| *** kebray has joined #openstack-barbican | 04:30 | |
| *** zz_dimtruck is now known as dimtruck | 04:51 | |
| *** sidx64 has joined #openstack-barbican | 04:53 | |
| *** Kevin_Zheng has quit IRC | 05:02 | |
| *** chlong has quit IRC | 05:05 | |
| *** chlong has joined #openstack-barbican | 05:17 | |
| *** chlong has quit IRC | 05:25 | |
| *** Nirupama has quit IRC | 05:30 | |
| *** chlong has joined #openstack-barbican | 05:38 | |
| *** DuncanT_ has joined #openstack-barbican | 05:42 | |
| *** sidx64_Cern has joined #openstack-barbican | 05:45 | |
| *** _junghans_ has joined #openstack-barbican | 05:46 | |
| *** sidx64_Cern has quit IRC | 05:46 | |
| *** sidx64_Cern has joined #openstack-barbican | 05:46 | |
| *** sidx64 has quit IRC | 05:47 | |
| *** dimtruck_ has joined #openstack-barbican | 05:48 | |
| *** DuncanT has quit IRC | 05:49 | |
| *** dimtruck has quit IRC | 05:49 | |
| *** jamielennox has quit IRC | 05:49 | |
| *** _jungh4ns has quit IRC | 05:49 | |
| *** eglute has quit IRC | 05:49 | |
| *** dimtruck_ is now known as dimtruck | 05:49 | |
| *** DuncanT_ is now known as DuncanT | 05:51 | |
| *** eglute has joined #openstack-barbican | 05:55 | |
| *** sidx64_Cern is now known as sidx64 | 06:03 | |
| *** jamielennox|away has joined #openstack-barbican | 06:07 | |
| *** jamielennox|away is now known as jamielennox | 06:07 | |
| *** _junghans_ is now known as _jungh4ns | 06:07 | |
| *** su_zhang has joined #openstack-barbican | 06:09 | |
| *** dongc has joined #openstack-barbican | 06:19 | |
| *** kebray has quit IRC | 06:20 | |
| *** cheneydc has quit IRC | 06:21 | |
| *** dongc is now known as cheneydc | 06:21 | |
| *** dave-mccowan has quit IRC | 06:21 | |
| *** chlong has quit IRC | 06:41 | |
| *** Nirupama has joined #openstack-barbican | 06:42 | |
| *** chlong has joined #openstack-barbican | 06:46 | |
| *** dongc has joined #openstack-barbican | 06:48 | |
| *** cheneydc has quit IRC | 06:48 | |
| *** dongc is now known as cheneydc | 06:48 | |
| *** Nirupama has quit IRC | 07:01 | |
| *** jaosorior has joined #openstack-barbican | 07:26 | |
| *** scheuran has joined #openstack-barbican | 07:26 | |
| *** jaosorior has quit IRC | 07:26 | |
| *** jaosorior has joined #openstack-barbican | 07:27 | |
| *** jaosorior has quit IRC | 07:41 | |
| *** chlong has quit IRC | 07:46 | |
| *** dimtruck is now known as zz_dimtruck | 08:03 | |
| *** su_zhang has quit IRC | 08:23 | |
| *** Nirupama has joined #openstack-barbican | 08:31 | |
| *** zz_dimtruck is now known as dimtruck | 08:47 | |
| *** dimtruck is now known as zz_dimtruck | 08:56 | |
| *** openstackgerrit has quit IRC | 10:02 | |
| *** openstackgerrit_ has joined #openstack-barbican | 10:02 | |
| *** openstackgerrit_ has quit IRC | 10:03 | |
| *** cheneydc has quit IRC | 10:05 | |
| *** sidx64_Cern has joined #openstack-barbican | 10:26 | |
| *** sidx64 has quit IRC | 10:29 | |
| *** sidx64_Cern is now known as sidx64 | 10:45 | |
| *** zz_dimtruck is now known as dimtruck | 10:47 | |
| *** dimtruck is now known as zz_dimtruck | 11:01 | |
| *** su_zhang has joined #openstack-barbican | 11:03 | |
| *** su_zhang has quit IRC | 11:08 | |
| *** jaosorior has joined #openstack-barbican | 11:36 | |
| *** openstackgerrit has joined #openstack-barbican | 11:53 | |
| *** openstackgerrit has quit IRC | 11:54 | |
| *** openstackgerrit_ has joined #openstack-barbican | 11:54 | |
| *** openstackgerrit_ is now known as openstackgerrit | 11:55 | |
| *** openstackgerrit has quit IRC | 11:59 | |
| *** openstackgerrit has joined #openstack-barbican | 12:07 | |
| *** prazumovsky has joined #openstack-barbican | 12:08 | |
| prazumovsky | Hello! I reported new bug, take a look, please: https://bugs.launchpad.net/barbican/+bug/1540339 | 12:18 |
|---|---|---|
| openstack | Launchpad bug 1540339 in Barbican "Barbican secret get request returns deleted objects" [Undecided,New] | 12:18 |
| jaosorior | prazumovsky: Sure, will check it out | 12:21 |
| jaosorior | thanks! | 12:21 |
| *** jaosorior has quit IRC | 12:21 | |
| *** jaosorior has joined #openstack-barbican | 12:21 | |
| *** sidx64_Cern has joined #openstack-barbican | 12:40 | |
| *** sidx64 has quit IRC | 12:43 | |
| *** zz_dimtruck is now known as dimtruck | 12:52 | |
| *** sidx64_Cern has quit IRC | 12:57 | |
| *** jaosorior has quit IRC | 13:00 | |
| *** dimtruck is now known as zz_dimtruck | 13:01 | |
| *** xek__ is now known as xek | 13:12 | |
| *** dave-mccowan has joined #openstack-barbican | 13:22 | |
| *** su_zhang has joined #openstack-barbican | 13:51 | |
| *** cheneydc has joined #openstack-barbican | 13:53 | |
| *** cheneydc has quit IRC | 13:54 | |
| *** zz_dimtruck is now known as dimtruck | 14:12 | |
| *** nelsnelson has joined #openstack-barbican | 14:17 | |
| *** nelsnels_ has quit IRC | 14:17 | |
| *** edtubill has joined #openstack-barbican | 14:19 | |
| *** nelsnelson has quit IRC | 14:20 | |
| *** nelsnelson has joined #openstack-barbican | 14:21 | |
| *** kfarr has joined #openstack-barbican | 14:26 | |
| *** Nirupama has quit IRC | 14:28 | |
| *** prazumovsky has quit IRC | 14:42 | |
| *** dimtruck is now known as zz_dimtruck | 14:50 | |
| *** jmckind has joined #openstack-barbican | 14:59 | |
| *** kfarr has quit IRC | 15:03 | |
| *** spotz_zzz is now known as spotz | 15:04 | |
| *** sidx64 has joined #openstack-barbican | 15:12 | |
| *** woodster_ has joined #openstack-barbican | 15:16 | |
| *** kebray has joined #openstack-barbican | 15:22 | |
| *** jorge_munoz has joined #openstack-barbican | 15:29 | |
| *** silos has joined #openstack-barbican | 15:49 | |
| *** rellerreller has joined #openstack-barbican | 15:57 | |
| *** mp1 has joined #openstack-barbican | 15:59 | |
| *** dave-mccowan has quit IRC | 16:03 | |
| *** jhfeng has joined #openstack-barbican | 16:03 | |
| *** dave-mccowan has joined #openstack-barbican | 16:18 | |
| *** anteaya has quit IRC | 16:18 | |
| *** diazjf has joined #openstack-barbican | 16:25 | |
| *** sidx64 has quit IRC | 16:29 | |
| *** diazjf has quit IRC | 16:30 | |
| *** kebray has quit IRC | 16:31 | |
| *** diazjf has joined #openstack-barbican | 16:34 | |
| *** kebray has joined #openstack-barbican | 16:34 | |
| *** kebray has quit IRC | 16:38 | |
| *** pwp has joined #openstack-barbican | 16:45 | |
| *** ccneill has joined #openstack-barbican | 16:49 | |
| openstackgerrit | skseeker proposed openstack/barbican: LOG.warn is deprecated in python3 https://review.openstack.org/274785 | 16:49 |
| *** mp1 has quit IRC | 16:49 | |
| *** silos has quit IRC | 16:50 | |
| *** mp1 has joined #openstack-barbican | 16:51 | |
| *** pdesai has joined #openstack-barbican | 16:59 | |
| *** diazjf has quit IRC | 17:02 | |
| *** diazjf has joined #openstack-barbican | 17:03 | |
| *** silos has joined #openstack-barbican | 17:04 | |
| *** zz_dimtruck is now known as dimtruck | 17:07 | |
| *** pwp has quit IRC | 17:09 | |
| *** pwp has joined #openstack-barbican | 17:09 | |
| *** su_zhang has quit IRC | 17:16 | |
| *** gyee has joined #openstack-barbican | 17:17 | |
| *** scheuran has quit IRC | 17:17 | |
| *** diazjf has quit IRC | 17:28 | |
| *** diazjf has joined #openstack-barbican | 17:32 | |
| *** diazjf has quit IRC | 17:37 | |
| *** mp1 has quit IRC | 17:45 | |
| *** diazjf has joined #openstack-barbican | 17:51 | |
| *** kebray has joined #openstack-barbican | 17:51 | |
| *** kfarr has joined #openstack-barbican | 17:55 | |
| openstackgerrit | Arun Kant proposed openstack/barbican-specs: Adding spec for supporting multiple secret store backends https://review.openstack.org/263972 | 17:57 |
| *** jmckind has quit IRC | 18:01 | |
| *** jaosorior has joined #openstack-barbican | 18:05 | |
| *** silos has quit IRC | 18:06 | |
| *** rellerreller has quit IRC | 18:16 | |
| *** su_zhang has joined #openstack-barbican | 18:30 | |
| *** jaosorior has quit IRC | 18:41 | |
| *** fnaval has quit IRC | 18:44 | |
| *** mp1 has joined #openstack-barbican | 18:50 | |
| *** su_zhang has quit IRC | 19:01 | |
| *** su_zhang has joined #openstack-barbican | 19:01 | |
| *** ccneill has quit IRC | 19:07 | |
| *** silos has joined #openstack-barbican | 19:08 | |
| *** jmckind has joined #openstack-barbican | 19:09 | |
| *** su_zhang has quit IRC | 19:19 | |
| *** su_zhang has joined #openstack-barbican | 19:19 | |
| openstackgerrit | Kaitlin Farr proposed openstack/castellan: Update MockKeyManager to use given algorithm https://review.openstack.org/274861 | 19:19 |
| *** ccneill has joined #openstack-barbican | 19:20 | |
| *** kebray has quit IRC | 19:26 | |
| *** kebray has joined #openstack-barbican | 19:27 | |
| *** diazjf has quit IRC | 19:38 | |
| *** kfarr has quit IRC | 19:45 | |
| *** diazjf has joined #openstack-barbican | 19:52 | |
| *** pwp has quit IRC | 19:56 | |
| *** dave-mccowan has quit IRC | 19:57 | |
| *** maxabidi has joined #openstack-barbican | 20:00 | |
| *** kfarr has joined #openstack-barbican | 20:01 | |
| *** pwp has joined #openstack-barbican | 20:03 | |
| *** pwp has quit IRC | 20:04 | |
| *** rellerreller has joined #openstack-barbican | 20:04 | |
| *** kfarr has quit IRC | 20:05 | |
| *** pwp has joined #openstack-barbican | 20:06 | |
| *** pwp has quit IRC | 20:08 | |
| *** kfarr has joined #openstack-barbican | 20:10 | |
| *** pwp has joined #openstack-barbican | 20:14 | |
| *** dave-mccowan has joined #openstack-barbican | 20:16 | |
| *** kebray has quit IRC | 20:19 | |
| *** pwp has quit IRC | 20:21 | |
| *** pwp has joined #openstack-barbican | 20:21 | |
| *** su_zhang has quit IRC | 20:23 | |
| *** maxabidi has quit IRC | 20:34 | |
| alee | diazjf, want to meet right now? | 20:34 |
| diazjf | alee, sure | 20:34 |
| *** pwp has quit IRC | 20:34 | |
| alee | diazjf, actually give me about 5 mins | 20:35 |
| diazjf | alee, no worries, ping me when you get a chance | 20:35 |
| diazjf | rellerreller, kfarr, I'm also gonna work on adding 'created' to castellan objects. Let me know what you think about the comment in https://review.openstack.org/#/c/238150/11/castellan/common/objects/opaque_data.py, also since I'll be using POSIX time, I'll do the conversion here: https://review.openstack.org/#/c/238150/11/castellan/key_manager/barbican_key_manager.py | 20:37 |
| diazjf | rellerreller, kfarr, and thanks for all the reviews, y'all have been extremely helpful | 20:38 |
| rellerreller | diazjf np | 20:38 |
| kfarr | diazjf, thanks for all the great work! | 20:38 |
| diazjf | thanks :) | 20:39 |
| woodster_ | jkf: jhfeng I was curious if you guys are using a lightweight threading deployment for your HSM deploys, vs a multi process one? Seems you wouldn't need the thread locking in the HSM code if you were using the latter approach, so was curious | 20:41 |
| *** kebray has joined #openstack-barbican | 20:44 | |
| *** silos has quit IRC | 20:44 | |
| jkf | woodster_: I added locking around the caches after talking with jhfeng and findout out he's using threading in his environment. Most people avoid threads in python, but considering how barbican with pkcs11 is really io constrained, it sorta makes sense, so I didn't want to force people into the single-threaded route by not having thread-safe code. | 20:45 |
| jkf | I'm tempted to try threading in my environment just to see what kind of difference it makes. The threading will also allow better cache utilization, as each process in the multi-process model has its own cache and can't share with the other processes. That also means more duplicated session keys on the HSMs. | 20:46 |
| jhfeng | woodster_: I was testing barbican using uWSGi, and enabled multi-threading. but in our prod env, i think threading mode wouldn't be used. | 20:48 |
| woodster_ | jkf: I recall that some folks (reaperhulk jvrbanac) had noticed performance issues with thread locks in the past, so was curious if you had seen similar slow downs. I agree with the better caching argument, but I'm a bit concerned about mixing python threading and eventlet (used for the queuing/messaging stuff) together. | 20:49 |
| woodster_ | jhfeng: had you tried to use multi-processing instead? | 20:50 |
| jkf | woodster_: uncontested locks are really fast. The performance numbers I generated were with locking around the caches, so performance isn't bad. | 20:50 |
| jhfeng | woodster_: yes | 20:51 |
| *** silos has joined #openstack-barbican | 20:51 | |
| woodster_ | jkf: good to know | 20:51 |
| woodster_ | jhfeng: do you recall if the performance was about the same between multi-thread and multi-process? | 20:52 |
| jhfeng | woodster_ i didn't notice big difference using process vs threading mode | 20:53 |
| jkf | woodster_: One thing I can't tell you is how well the locking plays with eventlet, but I imagine you would have similar issues with it as with threading, depending on how it broke up the streams of execution. | 20:53 |
| woodster_ | jkf: I figure it comes down to how well the magical eventlet monkey patching works with threading | 20:54 |
| jkf | Have I mentioned how much I hate eventlet? :) | 20:54 |
| reaperhulk | it's awful. | 20:54 |
| reaperhulk | I actually have been playing in PKCS11 land again recently | 20:54 |
| woodster_ | jkf: ha, yeah that is why I'm so squeamish about it all | 20:54 |
| reaperhulk | https://github.com/reaperhulk/cryptography-pkcs11/blob/master/src/cryptography_pkcs11/session_pool.py#L49 here is a random experimental session pool :) | 20:54 |
| *** mp11 has joined #openstack-barbican | 20:54 | |
| *** jhfeng_ has joined #openstack-barbican | 20:55 | |
| woodster_ | reaperhulk: sorry to hear that Paul :) | 20:55 |
| reaperhulk | (and yeah, cryptography-pkcs11 lets you use cryptography's APIs with PKCS11) | 20:55 |
| *** diazjf1 has joined #openstack-barbican | 20:55 | |
| reaperhulk | it's also not production ready by a long shot | 20:56 |
| *** mp1 has quit IRC | 20:56 | |
| alee | diazjf, now? | 20:56 |
| *** diazjf has quit IRC | 20:57 | |
| rellerreller | arunkant comments on spec, https://etherpad.openstack.org/p/key-wrapping | 20:57 |
| *** edtubill has quit IRC | 20:57 | |
| woodster_ | reaperhulk: are you recommending threading vs multi-process for p11 usage as well then? I presume the latter would require locking primitives in the c-layer managing the p11 interface | 20:57 |
| jkf | reaperhulk: Neat. I'll check it out and see how you're doing things. | 20:58 |
| *** ngupta has quit IRC | 20:58 | |
| *** jhfeng has quit IRC | 20:58 | |
| diazjf1 | alee, ready | 20:59 |
| alee | diazjf1, can you set up a google hangout? | 20:59 |
| diazjf1 | alee, gimme 2 mins | 20:59 |
| *** pwp has joined #openstack-barbican | 20:59 | |
| *** ngupta has joined #openstack-barbican | 21:00 | |
| reaperhulk | jkf: I dunno if the way I'm doing things is really great, I just decided to try a completely different method :) It still doesn't do anything like handle out of memory and there are edge cases where sessions don't get closed, etc | 21:00 |
| reaperhulk | woodster_: Multi-process does solve some problems by forcing the PKCS11 lib to do the threading for you, but it's not practical for my use case (where cryptography's APIs need to appear identical) | 21:01 |
| diazjf1 | https://hangouts.google.com/call/pydxcjxdcyz7mwa3zzfldd4beua | 21:01 |
| diazjf1 | alee ^ | 21:01 |
| diazjf1 | alee: https://review.openstack.org/#/c/263462/ this is the patch I reviewed | 21:01 |
| alee | diazjf1, I'm in the hangout | 21:02 |
| alee | well I was .. | 21:02 |
| diazjf1 | hmm | 21:02 |
| diazjf1 | try again | 21:03 |
| alee | hmm .. you are not allowed to join this video call. | 21:03 |
| alee | You're not allowed to join this video call. | 21:03 |
| *** rellerreller has quit IRC | 21:04 | |
| alee | jsut a sec .. brb | 21:04 |
| diazjf1 | alee, I'll try setting it up again | 21:04 |
| jkf | woodster_: The pkcs11 standard itself pushes threads vs processes and you can share resources easily between threads. Load a session key once and then use it from multiple threads for operations. The issue really that I see is how much does Python's threading support affect things. | 21:04 |
| diazjf1 | alee https://hangouts.google.com/call/abj5dbxctef457sq4fwt5jlcwya | 21:04 |
| jkf | Since we're mainly io bound, it could be beneficial here. Needs more testing I think. | 21:05 |
| woodster_ | jkf, reaperhulk thanks I think we'll evaluate the multi-threaded approach first then | 21:06 |
| *** pwp has quit IRC | 21:07 | |
| *** pwp has joined #openstack-barbican | 21:07 | |
| jkf | reaperhulk: How would you like feedback on that code? | 21:07 |
| alee | diazjf1, no dice -- let me try setting one up | 21:08 |
| diazjf1 | ok cool | 21:08 |
| *** fnaval has joined #openstack-barbican | 21:08 | |
| *** jmckind has quit IRC | 21:09 | |
| alee | diazjf1, try again --- I think I got it | 21:09 |
| diazjf1 | alee https://hangouts.google.com/hangouts/_/fiu.edu/puppet | 21:09 |
| diazjf1 | I changed a setting try now | 21:10 |
| reaperhulk | jkf: you can drop comments on the commit if you want or else you can just open issues on the repo | 21:11 |
| reaperhulk | I'm happy to take PRs on that as well, with the caveat that everything in the project is subject to change (I think this is the third form of the session pool in the past 4 days since I started working on this) | 21:12 |
| openstackgerrit | Elvin Tubillara proposed openstack/barbican: Simple soft deletion cleanup script https://review.openstack.org/269903 | 21:16 |
| *** edtubill has joined #openstack-barbican | 21:17 | |
| *** jmckind has joined #openstack-barbican | 21:18 | |
| *** pwp has quit IRC | 21:19 | |
| jhfeng_ | reaperhulk: Paul, could you please post the link again ? I was disconnected from channel | 21:20 |
| *** pwp has joined #openstack-barbican | 21:21 | |
| reaperhulk | jhfeng_ sure: https://github.com/reaperhulk/cryptography-pkcs11/blob/master/src/cryptography_pkcs11/session_pool.py is where the session pool lives and https://github.com/reaperhulk/cryptography-pkcs11/ is the project | 21:21 |
| jhfeng_ | reaperhulk: thx | 21:22 |
| reaperhulk | No problem. It probably won't be all that useful to barbican for now, but who knows | 21:23 |
| openstackgerrit | Elvin Tubillara proposed openstack/barbican: Simple soft deletion cleanup script https://review.openstack.org/269903 | 21:26 |
| *** su_zhang has joined #openstack-barbican | 21:30 | |
| *** su_zhang has quit IRC | 21:34 | |
| *** pwp has quit IRC | 21:44 | |
| *** pwp has joined #openstack-barbican | 21:44 | |
| *** pwp has quit IRC | 21:50 | |
| *** pwp has joined #openstack-barbican | 21:57 | |
| *** su_zhang has joined #openstack-barbican | 22:04 | |
| *** su_zhang has quit IRC | 22:08 | |
| *** su_zhang has joined #openstack-barbican | 22:09 | |
| *** su_zhang has quit IRC | 22:10 | |
| *** su_zhang has joined #openstack-barbican | 22:10 | |
| *** chlong has joined #openstack-barbican | 22:10 | |
| *** silos has left #openstack-barbican | 22:33 | |
| jhfeng_ | jkf: ping | 22:38 |
| jkf | jhfeng_: What's up? | 22:38 |
| *** diazjf1 has quit IRC | 22:38 | |
| *** edtubill has quit IRC | 22:38 | |
| *** edtubill has joined #openstack-barbican | 22:39 | |
| jhfeng_ | jkf: is there any reason why we use CKM_AES_CBC_PAD for key wrapping ? | 22:39 |
| *** edtubill has quit IRC | 22:39 | |
| reaperhulk | jhfeng_: historically it was because the HSMs rackspace (and symantec) used for this had severe firmware constraints on the allowable mechanisms in C_WrapKey | 22:40 |
| reaperhulk | they didn't support AES keywrap or AES GCM, both of which would provide authentication and remove the need for the HMAC pass | 22:40 |
| openstackgerrit | Douglas Mendizábal proposed openstack/barbican: Use config option for host reference in versions https://review.openstack.org/274915 | 22:41 |
| jhfeng_ | reaperhulk: ok thanks. i see. | 22:43 |
| *** pwp has quit IRC | 22:45 | |
| jkf | jhfeng_: what he said. :) | 22:46 |
| *** su_zhang has quit IRC | 22:50 | |
| *** su_zhang has joined #openstack-barbican | 22:50 | |
| *** jhfeng_ has quit IRC | 22:59 | |
| *** jmckind has quit IRC | 23:01 | |
| *** yuanying has joined #openstack-barbican | 23:02 | |
| *** david-lyle has quit IRC | 23:15 | |
| *** kfarr has quit IRC | 23:18 | |
| *** spotz is now known as spotz_zzz | 23:22 | |
| *** kebray has quit IRC | 23:34 | |
| *** jamielennox is now known as jamielennox|away | 23:36 | |
| *** dimtruck is now known as zz_dimtruck | 23:38 | |
| *** kragniz_ is now known as kragniz | 23:38 | |
| *** nkinder has quit IRC | 23:54 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!