| *** chlong has quit IRC | 00:11 | |
| *** fawadkhaliq has quit IRC | 00:15 | |
| *** fawadkhaliq has joined #openstack-barbican | 00:17 | |
| *** gyee has quit IRC | 00:20 | |
| *** fawadkhaliq has quit IRC | 00:28 | |
| *** fawadkhaliq has joined #openstack-barbican | 00:30 | |
| *** zz_dimtruck is now known as dimtruck | 00:32 | |
| *** fawadkhaliq has quit IRC | 00:34 | |
| *** fawadkhaliq has joined #openstack-barbican | 00:35 | |
| *** fawadkhaliq has quit IRC | 00:41 | |
| *** woodster_ has quit IRC | 00:57 | |
| *** cheneydc has joined #openstack-barbican | 01:01 | |
| *** fawadkhaliq has joined #openstack-barbican | 01:08 | |
| *** fredyx10 has joined #openstack-barbican | 01:09 | |
| *** tkelsey has joined #openstack-barbican | 01:09 | |
| *** fawadkhaliq has quit IRC | 01:11 | |
| *** tkelsey has quit IRC | 01:14 | |
| *** Kevin_Zheng has joined #openstack-barbican | 01:15 | |
| *** fredyx10 has quit IRC | 01:26 | |
| *** chlong has joined #openstack-barbican | 01:36 | |
| *** fawadkhaliq has joined #openstack-barbican | 01:56 | |
| *** jorge_munoz has quit IRC | 02:13 | |
| *** fawadkhaliq has quit IRC | 02:27 | |
| openstackgerrit | Reedip proposed openstack/python-barbicanclient: Fix argument order for assertEqual to (exp, obs) https://review.openstack.org/263988 | 02:35 |
|---|---|---|
| *** xaeth has quit IRC | 03:53 | |
| *** fawadkhaliq has joined #openstack-barbican | 04:03 | |
| *** dimtruck is now known as zz_dimtruck | 04:14 | |
| *** fawadkhaliq has quit IRC | 04:27 | |
| *** fawadkhaliq has joined #openstack-barbican | 04:27 | |
| *** mp1 has joined #openstack-barbican | 04:41 | |
| *** dave-mccowan has quit IRC | 04:45 | |
| *** chlong has quit IRC | 04:56 | |
| *** tkelsey has joined #openstack-barbican | 05:10 | |
| *** mp1 has quit IRC | 05:12 | |
| *** chlong has joined #openstack-barbican | 05:13 | |
| *** tkelsey has quit IRC | 05:15 | |
| *** fawadkhaliq has quit IRC | 05:32 | |
| *** fawadkhaliq has joined #openstack-barbican | 05:32 | |
| *** pcaruana has quit IRC | 05:48 | |
| *** chlong has quit IRC | 06:08 | |
| openstackgerrit | Anh Tran proposed openstack/barbican: Removes redundant "to" https://review.openstack.org/296899 | 06:11 |
| *** jaosorior has joined #openstack-barbican | 06:15 | |
| *** jaosorior has quit IRC | 06:17 | |
| *** jaosorior has joined #openstack-barbican | 06:18 | |
| *** chlong has joined #openstack-barbican | 06:22 | |
| *** fawadkhaliq has quit IRC | 06:53 | |
| openstackgerrit | Anh Tran proposed openstack/barbican: Removes redundants https://review.openstack.org/296899 | 07:25 |
| *** pcaruana has joined #openstack-barbican | 07:32 | |
| *** scheuran has joined #openstack-barbican | 07:48 | |
| *** chlong has quit IRC | 08:38 | |
| *** tkelsey has joined #openstack-barbican | 08:47 | |
| *** cheneydc has quit IRC | 10:25 | |
| *** jaosorior has quit IRC | 10:34 | |
| *** jaosorior has joined #openstack-barbican | 10:43 | |
| *** viktors has joined #openstack-barbican | 11:15 | |
| viktors | folks, I have a newbie question about the barbican usage - can I use it without openstack to store passwords securely (from person with root ssh access to server)? | 11:30 |
| zigo | Guys, I have a problem running barbican-db-manage upgrade with the RC1: | 11:31 |
| zigo | 2016-03-24 11:30:17.089 16678 ERROR barbican.cmd.db_manage ProgrammingError: (_mysql_exceptions.ProgrammingError) (1146, "Table 'barbicandb.tenant_secret' doesn't exist") [SQL: u'ALTER TABLE tenant_secret DROP FOREIGN KEY tenant_secret_ibfk_1'] | 11:32 |
| zigo | 2016-03-24 11:30:17.089 16678 ERROR barbican.cmd.db_manage | 11:32 |
| zigo | ERROR: (_mysql_exceptions.ProgrammingError) (1146, "Table 'barbicandb.tenant_secret' doesn't exist") [SQL: u'ALTER TABLE tenant_secret DROP FOREIGN KEY tenant_secret_ibfk_1'] | 11:32 |
| zigo | Is it a known issue, and is there a fix for it? | 11:32 |
| zigo | jaosorior: ^ | 11:38 |
| zigo | hockeynut: ^ | 11:40 |
| *** dave-mccowan has joined #openstack-barbican | 12:17 | |
| *** rellerreller has joined #openstack-barbican | 12:18 | |
| *** cheneydc has joined #openstack-barbican | 12:24 | |
| *** alee has quit IRC | 12:24 | |
| *** dongc has joined #openstack-barbican | 12:30 | |
| *** cheneydc has quit IRC | 12:32 | |
| *** dongc is now known as cheneydc | 12:32 | |
| *** zz_dimtruck is now known as dimtruck | 13:20 | |
| *** xaeth has joined #openstack-barbican | 13:24 | |
| zigo | I got also other failures with barbican-keystone-listener, I need help to get it fixed. | 13:25 |
| zigo | Otherwise, this Debian package will be a really bad shape... :( | 13:25 |
| zigo | dave-mccowan: jvrbanac_ jaosorior rellerreller reaperhulk hockeynut anyone around? | 13:30 |
| *** jmckind has joined #openstack-barbican | 13:39 | |
| *** alee has joined #openstack-barbican | 13:40 | |
| *** fredyx10 has joined #openstack-barbican | 13:41 | |
| *** dimtruck is now known as zz_dimtruck | 13:44 | |
| *** cheneydc has quit IRC | 13:57 | |
| *** cheneydc has joined #openstack-barbican | 14:09 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 14:09 | |
| *** woodster_ has joined #openstack-barbican | 14:11 | |
| *** zz_dimtruck is now known as dimtruck | 14:14 | |
| *** spotz_zzz is now known as spotz | 14:15 | |
| rellerreller | zigo what's up | 14:20 |
| zigo | rellerreller: This: | 14:23 |
| zigo | Guys, I have a problem running barbican-db-manage upgrade with the RC1: | 14:23 |
| zigo | 2016-03-24 11:30:17.089 16678 ERROR barbican.cmd.db_manage ProgrammingError: (_mysql_exceptions.ProgrammingError) (1146, "Table 'barbicandb.tenant_secret' doesn't exist") [SQL: u'ALTER TABLE tenant_secret DROP FOREIGN KEY tenant_secret_ibfk_1'] | 14:23 |
| zigo | 2016-03-24 11:30:17.089 16678 ERROR barbican.cmd.db_manage | 14:23 |
| zigo | ERROR: (_mysql_exceptions.ProgrammingError) (1146, "Table 'barbicandb.tenant_secret' doesn't exist") [SQL: u'ALTER TABLE tenant_secret DROP FOREIGN KEY tenant_secret_ibfk_1'] | 14:23 |
| zigo | rellerreller: The migration is broken. | 14:23 |
| rellerreller | zigo what version are you migrating from and to? | 14:24 |
| zigo | rellerreller: From nothing to rc1. | 14:24 |
| zigo | rellerreller: Just installing the Debian package and trying to do the db migration. | 14:24 |
| rellerreller | zigo that makes sense based upon the error | 14:24 |
| zigo | rellerreller: I had to produce that patch to make it work: http://anonscm.debian.org/cgit/openstack/barbican.git/tree/debian/patches/repair-broken-migration-scripts.patch | 14:25 |
| zigo | rellerreller: It's wrong in many ways, I know, so it'd be better to have something from you guys (upstream). | 14:25 |
| rellerreller | zigo I'm not so familiar with barbican-db-manage at the moment, but the problem is that there were no tables to start with. | 14:26 |
| rellerreller | zigo I would have to look to see if the script was intended for migrations only or to create new tables as well. | 14:26 |
| zigo | rellerreller: Also, barbican-keystone-listener refuses to start. | 14:27 |
| rellerreller | zigo I don't know what redrobot and others had intended for the script. | 14:27 |
| zigo | rellerreller: http://paste.openstack.org/show/491722/ | 14:27 |
| rellerreller | zigo that's odd. I wonder why certificate_manager cannot be found. Any ideas why that is not in python path? | 14:29 |
| zigo | rellerreller: Well, IT IS in the python path !!! | 14:30 |
| rellerreller | zigo I saw this "ImportError: cannot import name certificate_manager" in error message. That's why I thought that. | 14:31 |
| zigo | rellerreller: Look at that one: | 14:32 |
| zigo | http://paste.openstack.org/show/491723/ | 14:32 |
| zigo | It doesn't work the first time, it does the 2nd time !!! | 14:32 |
| woodster_ | rellerreller: zigo This alembic version script should get called initially to stand up tables: https://github.com/openstack/barbican/blob/master/barbican/model/migration/alembic_migrations/versions/juno_initial.py | 14:33 |
| rellerreller | zigo ??? I'm stumped by this. | 14:34 |
| zigo | woodster_: How would I start this juno_initial.py then? | 14:34 |
| zigo | Just execute it? | 14:34 |
| *** asingh has joined #openstack-barbican | 14:36 | |
| woodster_ | zigo: This should do it for you on a fresh db: barbican-db-manage --dburl $DB_MGR_CONN upgrade -v head | 14:36 |
| *** jaosorior has quit IRC | 14:37 | |
| zigo | woodster_: Ok, will try (I'm on a call, so will do after it). | 14:37 |
| woodster_ | zigo: you should see that it stepping thru all the alembic scripts as it runs that command | 14:37 |
| *** jvrbanac_ is now known as jvrbanac | 14:49 | |
| *** jorge_munoz has joined #openstack-barbican | 14:51 | |
| *** cheneydc has quit IRC | 14:53 | |
| *** cheneydc has joined #openstack-barbican | 14:54 | |
| *** jorge_munoz_ has joined #openstack-barbican | 14:55 | |
| *** jorge_munoz has quit IRC | 14:56 | |
| *** jorge_munoz_ is now known as jorge_munoz | 14:56 | |
| *** cheneydc has quit IRC | 14:59 | |
| *** cheneydc has joined #openstack-barbican | 15:01 | |
| zigo | woodster_: Doing what you just wrote does exactly the same error. | 15:01 |
| zigo | 2016-03-24 15:01:01.954 32258 ERROR barbican.cmd.db_manage InternalError: (pymysql.err.InternalError) (1025, u"Error on rename of './barbicandb/#sql-232b_ec0' to './barbicandb/orders' (errno: 150)") [SQL: u'ALTER TABLE orders CHANGE tenant_id project_id VARCHAR(36) NULL'] | 15:01 |
| zigo | 2016-03-24 15:01:01.954 32258 ERROR barbican.cmd.db_manage | 15:01 |
| zigo | ERROR: (pymysql.err.InternalError) (1025, u"Error on rename of './barbicandb/#sql-232b_ec0' to './barbicandb/orders' (errno: 150)") [SQL: u'ALTER TABLE orders CHANGE tenant_id project_id VARCHAR(36) NULL | 15:01 |
| *** cheneydc has quit IRC | 15:03 | |
| zigo | So, the 795737bb3c3_change_tenants_to_projects.py is having issues, as I wrote. | 15:06 |
| zigo | _change_fk_to_project( | 15:06 |
| zigo | ctx, con, 'orders', 'orders_ibfk_1', 'orders_project_fk') <--- That one is failing over. | 15:06 |
| *** silos has joined #openstack-barbican | 15:08 | |
| *** dave-mccowan has quit IRC | 15:13 | |
| *** david-lyle has quit IRC | 15:13 | |
| *** yuanying has quit IRC | 15:13 | |
| *** arunkant has quit IRC | 15:13 | |
| *** david-lyle has joined #openstack-barbican | 15:17 | |
| *** cheneydc has joined #openstack-barbican | 15:18 | |
| woodster_ | zigo: are you are starting with a completely clean db? | 15:27 |
| zigo | woodster_: Yes. | 15:28 |
| * woodster_ Adding gate checks for alembic/migration testing to our newton etherpad... | 15:28 | |
| woodster_ | zigo: we run those scripts against postgres locally, and upstream devstack testing uses sqlalchemy to populate the db at time zero | 15:29 |
| *** dave-mccowan has joined #openstack-barbican | 15:29 | |
| *** yuanying has joined #openstack-barbican | 15:29 | |
| *** arunkant has joined #openstack-barbican | 15:29 | |
| zigo | woodster_: Oh, so you're not trying MySQL ? | 15:29 |
| zigo | woodster_: Probably there's a problem with using MySQL then, no? | 15:29 |
| woodster_ | zigo: we are moving to that but I don't believe the move has been completed as of yet | 15:30 |
| woodster_ | zigo: that's what it seems :\ | 15:35 |
| *** arunkant_ has joined #openstack-barbican | 15:36 | |
| woodster_ | zigo: Looks like silos might have seen the same issue?: https://review.openstack.org/#/c/292523/1/barbican/model/migration/alembic_migrations/versions/795737bb3c3_change_tenants_to_projects.py | 15:40 |
| woodster_ | zigo: my gut is that something changed with alembic, because these version files are pretty old now | 15:41 |
| silos | woodster, zigo: I was trying to add the alembic/migration testing stuff, but that patch needs to get merged. | 15:45 |
| zigo | woodster_: Oh... So just patch this 1 into a 2 ? :) | 15:53 |
| zigo | I mean 2 -> 1 | 15:53 |
| zigo | Oh ok. | 15:54 |
| zigo | Will just apply that one patch! :) | 15:54 |
| arunkant_ | jaosorior: ping | 15:55 |
| *** agrebennikov has joined #openstack-barbican | 15:56 | |
| *** jmckind_ has joined #openstack-barbican | 15:57 | |
| *** jmckind has quit IRC | 15:58 | |
| *** agrebennikov has quit IRC | 16:00 | |
| *** asingh has quit IRC | 16:00 | |
| *** silos has quit IRC | 16:01 | |
| *** asingh has joined #openstack-barbican | 16:01 | |
| *** silos has joined #openstack-barbican | 16:02 | |
| *** agrebennikov has joined #openstack-barbican | 16:08 | |
| *** gyee has joined #openstack-barbican | 16:12 | |
| *** jmckind_ has quit IRC | 16:18 | |
| *** jmckind has joined #openstack-barbican | 16:20 | |
| *** cheneydc has quit IRC | 16:20 | |
| *** fredyx101 has joined #openstack-barbican | 16:32 | |
| *** fredyx10 has quit IRC | 16:34 | |
| *** silos has quit IRC | 16:50 | |
| *** fredyx101 has quit IRC | 16:54 | |
| *** silos has joined #openstack-barbican | 16:55 | |
| *** tkelsey has quit IRC | 17:00 | |
| *** openstackgerrit has quit IRC | 17:01 | |
| *** tkelsey has joined #openstack-barbican | 17:01 | |
| *** openstackgerrit has joined #openstack-barbican | 17:01 | |
| *** scheuran has quit IRC | 17:02 | |
| *** jorge_munoz has quit IRC | 17:02 | |
| *** diazjf has joined #openstack-barbican | 17:04 | |
| *** asingh has quit IRC | 17:04 | |
| *** asingh has joined #openstack-barbican | 17:05 | |
| *** fredyx10 has joined #openstack-barbican | 17:07 | |
| *** fredyx101 has joined #openstack-barbican | 17:09 | |
| *** fredyx10 has quit IRC | 17:12 | |
| *** jmckind has quit IRC | 17:15 | |
| *** fredyx101 has quit IRC | 17:22 | |
| *** gyee has quit IRC | 17:23 | |
| *** pcaruana has quit IRC | 17:40 | |
| *** silos has quit IRC | 17:43 | |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding support for barbican host href to be derived from wsgi request https://review.openstack.org/282581 | 17:49 |
| *** fredyx10 has joined #openstack-barbican | 17:49 | |
| *** diazjf has quit IRC | 17:55 | |
| *** jorge_munoz has joined #openstack-barbican | 18:03 | |
| openstackgerrit | Merged openstack/barbican: Removes redundants https://review.openstack.org/296899 | 18:08 |
| *** jmckind has joined #openstack-barbican | 18:21 | |
| *** diazjf has joined #openstack-barbican | 18:22 | |
| *** rellerreller has quit IRC | 18:29 | |
| *** silos has joined #openstack-barbican | 18:36 | |
| *** fredyx10 has quit IRC | 19:01 | |
| *** fredyx10 has joined #openstack-barbican | 19:02 | |
| *** diazjf has quit IRC | 19:17 | |
| *** silos1 has joined #openstack-barbican | 19:19 | |
| *** silos has quit IRC | 19:20 | |
| *** silos1 has quit IRC | 19:22 | |
| *** silos has joined #openstack-barbican | 19:24 | |
| *** diazjf has joined #openstack-barbican | 19:25 | |
| *** fredyx10 has quit IRC | 19:43 | |
| *** fredyx10 has joined #openstack-barbican | 19:47 | |
| *** silos1 has joined #openstack-barbican | 19:48 | |
| *** silos1 has quit IRC | 20:06 | |
| *** silos has joined #openstack-barbican | 20:06 | |
| *** gyee has joined #openstack-barbican | 20:06 | |
| zigo | woodster_: https://review.openstack.org/#/c/292523/ fixed the issue with 795737bb3c3_change_tenants_to_projects.py, now I have more in d2780d5aa510_change_url_length.py and 1c0f328bfce0_fixing_composite_primary_keys_and_.py | 20:19 |
| zigo | 2016-03-24 20:15:09.828 25596 ERROR barbican.cmd.db_manage ProgrammingError: (pymysql.err.ProgrammingError) (1146, u"Table 'barbicandb.ContainerConsumerMetadatum' doesn't exist") [SQL: u'ALTER TABLE `ContainerConsumerMetadatum` MODIFY `URL` VARCHAR(255) NULL'] | 20:19 |
| zigo | 2016-03-24 20:15:09.828 25596 ERROR barbican.cmd.db_manage | 20:19 |
| zigo | ERROR: (pymysql.err.ProgrammingError) (1146, u"Table 'barbicandb.ContainerConsumerMetadatum' doesn't exist") [SQL: u'ALTER TABLE `ContainerConsumerMetadatum` MODIFY `URL` VARCHAR(255) NULL'] | 20:19 |
| zigo | So, ContainerConsumerMetadatum doesn't exist ?!? | 20:19 |
| *** fredyx10 has quit IRC | 20:28 | |
| *** fredyx10 has joined #openstack-barbican | 20:31 | |
| *** diazjf has quit IRC | 20:32 | |
| *** diazjf has joined #openstack-barbican | 20:34 | |
| *** silos has quit IRC | 20:35 | |
| *** tkelsey has quit IRC | 20:45 | |
| *** openstackgerrit has quit IRC | 20:48 | |
| *** fredyx10 has quit IRC | 20:48 | |
| *** openstackgerrit has joined #openstack-barbican | 20:49 | |
| *** fredyx10 has joined #openstack-barbican | 20:50 | |
| *** diazjf has quit IRC | 21:03 | |
| *** diazjf has joined #openstack-barbican | 21:08 | |
| *** spotz is now known as spotz_zzz | 21:11 | |
| woodster_ | zigo: hmm, looks like you are right...that version went in recently | 21:13 |
| *** fawadkhaliq has joined #openstack-barbican | 21:13 | |
| woodster_ | redrobot: look like there's an incomplete alembic version up there | 21:15 |
| *** asingh has quit IRC | 21:18 | |
| *** asingh has joined #openstack-barbican | 21:19 | |
| *** asingh has quit IRC | 21:21 | |
| *** asingh has joined #openstack-barbican | 21:21 | |
| *** asingh has quit IRC | 21:26 | |
| *** asingh has joined #openstack-barbican | 21:27 | |
| *** asingh has quit IRC | 21:29 | |
| *** asingh has joined #openstack-barbican | 21:29 | |
| zigo | woodster_: It's a bit frustrating, because I need Barbican to be able to test Magnum ... :/ | 21:32 |
| zigo | woodster_: If I just try: <the-code> except: pass in the mean while, will Barbican continue to work? | 21:33 |
| *** jraim has quit IRC | 21:34 | |
| zigo | woodster_: I also have a problem with barbican-keystone-listener which refused to start. | 21:34 |
| *** asingh has quit IRC | 21:35 | |
| zigo | What is barbican-keystone-listener for btw? I don't even know what it is for ... | 21:35 |
| *** asingh has joined #openstack-barbican | 21:35 | |
| *** jraim has joined #openstack-barbican | 21:36 | |
| *** openstack has joined #openstack-barbican | 21:49 | |
| zigo | woodster_: I still get this though: | 21:50 |
| zigo | # barbican secret container list | 21:50 |
| zigo | Starting new HTTP connection (1): 65.61.144.166 | 21:50 |
| zigo | Starting new HTTP connection (1): 65.61.144.166 | 21:50 |
| zigo | Failed to contact the endpoint at http://65.61.144.166:9311 for discovery. Fallback to using that endpoint as the base url. | 21:50 |
| zigo | Starting new HTTP connection (2): 65.61.144.166 | 21:50 |
| woodster_ | zigo: yep for sure it needs to be fixed | 21:50 |
| zigo | Unable to establish connection to http://65.61.144.166:9311/containers | 21:50 |
| zigo | And the server *IS* up and running, and listening on that port. | 21:50 |
| *** fawadkhaliq has quit IRC | 21:51 | |
| *** jmckind has quit IRC | 21:51 | |
| woodster_ | zigo: are you getting a 400 back? | 21:51 |
| zigo | woodster_: nmap shows the port as open, netstat too. | 21:51 |
| *** fawadkhaliq has joined #openstack-barbican | 21:52 | |
| woodster_ | are you launching via bin/barbican.sh start? | 21:52 |
| woodster_ | zigo: ^^ | 21:52 |
| zigo | http://paste.openstack.org/show/491814/ | 21:52 |
| zigo | Nop, I'm using uwsgi. | 21:52 |
| zigo | woodster_: http://paste.debian.net/418637/ <--- That's my init script. | 21:53 |
| woodster_ | zigo: ...catching up on more recent mods to the startup process here http://docs.openstack.org/developer/barbican/setup/dev.html... | 21:54 |
| zigo | woodster_: Oh, there's a barbican-api daemon now? | 21:55 |
| zigo | That's new then. | 21:56 |
| zigo | woodster_: Does it support the normal --config-file and --log-file options as for the rest of OpenStack ? | 21:56 |
| woodster_ | zigo: I'll have to defer to redrobot for those questions. I'd say if it doesn't we can bring that up in Austin next month | 21:58 |
| *** diazjf has quit IRC | 21:58 | |
| woodster_ | zigo: perhaps try with that script first just to verify the code/configs are set correctly | 21:58 |
| woodster_ | zigo: note that you need to provide the X-Project-Id header with your favorite fake tenant ID as a minimum in the no-auth mode | 21:59 |
| zigo | woodster_: My "favorite fake tenant" ?!? :) | 22:00 |
| woodster_ | zigo: for ACL sorts of operations you'd need to provide one or two other headers | 22:00 |
| zigo | woodster_: Man, I've setup an all-in-one machine with nova, keystone, glance, heat, etc. :) | 22:00 |
| *** yuanying has joined #openstack-barbican | 22:00 | |
| *** arunkant has joined #openstack-barbican | 22:00 | |
| zigo | It's not "fake dev mode", I'm trying to get that package work, just like the rest of OpenStack. | 22:00 |
| woodster_ | zigo: out of the box barbican is in a no-auth 'eval' mode, just to play with the API as quickly as possible | 22:00 |
| woodster_ | zigo: sounds like you are a power user then! | 22:01 |
| zigo | woodster_: I'd like to make it in a good enough shape so that "apt-get install barbican-api barbican-worker" is enough to make it fully work. | 22:01 |
| zigo | woodster_: I maintain ALL of OpenStack in Debian, nearly all alone. | 22:01 |
| zigo | https://qa.debian.org/developer.php?login=openstack-devel@lists.alioth.debian.org | 22:01 |
| woodster_ | zigo: so are you on the debian or red hat packaging side of this then? | 22:02 |
| zigo | 366 packages so far... | 22:02 |
| woodster_ | zigo: ok I'm with you then | 22:02 |
| zigo | :) | 22:02 |
| woodster_ | zigo: I thought you were coming at this from the magnum side of things | 22:02 |
| zigo | woodster_: Well, I was trying to get Magnum to work with the Adrian Otto, then he told me "hey, that box you've setup, it needs Barbican". | 22:02 |
| *** fredyx10 has quit IRC | 22:03 | |
| *** DuncanT has quit IRC | 22:03 | |
| zigo | So I tried, and found out the Barbican package was kind of completely broken... | 22:03 |
| zigo | It used to work for Liberty. | 22:03 |
| woodster_ | zigo: so alee and xaeth have been involved in getting rpm packages created for Barbican....there might be some knowledge share there. As for debian packaging, I'm not sure how much (if any) expertise has been available for that :\ | 22:03 |
| zigo | woodster_: I just need a Barbican expert, I'm ok doing the packaging alone! :) | 22:04 |
| woodster_ | zigo: do you mean the rpm one? | 22:04 |
| zigo | woodster_: Could you expand on the "no auth by default" thing? | 22:04 |
| zigo | woodster_: How do I make it use Keystone then? | 22:04 |
| *** asingh has quit IRC | 22:04 | |
| zigo | Did you see this one? http://paste.openstack.org/show/491816/ | 22:04 |
| zigo | It's kind of weirdish ... | 22:05 |
| woodster_ | zigo: so the default paste config sets up barbican no auth: https://github.com/openstack/barbican/blob/master/etc/barbican/barbican-api-paste.ini#L12 | 22:05 |
| zigo | Ah, that's where I should look, thanks ! | 22:05 |
| *** DuncanT has joined #openstack-barbican | 22:05 | |
| woodster_ | zigo: this is the pipeline to use instead if you want keystone in the mix: https://github.com/openstack/barbican/blob/master/etc/barbican/barbican-api-paste.ini#L21 | 22:05 |
| zigo | How can I make it use [pipeline:barbican-api-keystone] then ? | 22:06 |
| woodster_ | zigo: I'm transitioning to the nova/glance side of things, and see they are building paste pipelines dynamically now...barbican is not there yet | 22:06 |
| zigo | woodster_: So, in [composite:main], I should set /v1 to barbican-api-keystone ? | 22:07 |
| woodster_ | zigo: you have to modify that paste conf file to change the 4th line to: /v1: barbican-api-keystone | 22:07 |
| zigo | Right ! :) | 22:07 |
| zigo | Wrote it just before you did. :P | 22:07 |
| woodster_ | zigo: that too! | 22:07 |
| zigo | Doing it and trying again. | 22:07 |
| woodster_ | zigo: please let us know if there are things we should consider changing to make packaging easier | 22:09 |
| zigo | I still get the same trace dump ... | 22:09 |
| woodster_ | zigo: fyi, one thing alee mentioned was that the keystone + audit path doesn't utilize cors | 22:09 |
| zigo | :( | 22:09 |
| woodster_ | zigo: complaining about alembic? | 22:10 |
| woodster_ | zigo: ...and that missing table? | 22:10 |
| zigo | Nop, this one: http://paste.openstack.org/show/491816/ | 22:10 |
| zigo | Failing to do "barbican --debug secret container list" | 22:10 |
| woodster_ | zigo: can you do this just to test barbican svc directly?: curl -v localhost:9311/v1/containers | 22:11 |
| woodster_ | zigo: ...well sub in the IP addrss for localhost | 22:11 |
| *** fawadkhaliq has quit IRC | 22:11 | |
| *** fawadkhaliq has joined #openstack-barbican | 22:12 | |
| woodster_ | zigo: it seems it is trying to use the barbican URL as the auth one | 22:12 |
| zigo | http://paste.openstack.org/show/491819/ | 22:12 |
| zigo | Well, the filter:keystone_authtoken are correct, normally. | 22:13 |
| openstackgerrit | Merged openstack/barbican: Fix correct foreign key constraints https://review.openstack.org/292523 | 22:13 |
| *** dave-mccowan has joined #openstack-barbican | 22:14 | |
| woodster_ | zigo: that looks better...probably just need an X-Auth-Token | 22:14 |
| zigo | Ah, good that one's merged ! :) | 22:14 |
| woodster_ | zigo: yeah, but have a missing table to add still :\ | 22:15 |
| woodster_ | zigo: so I'll confess being out of the loop on the barbican client side of things...I think the plan is to move to an openstack unified CLI but not sure how underway that is. My guess though is that you are missing an auth arg to pass in the auth credentials to the CLI | 22:17 |
| zigo | When I add an X-Auth-Token to that curl command, it doesn't work also. :( | 22:18 |
| woodster_ | zigo: my go to smoke test for secrets: curl -v -k -X POST -H "X-Auth-Token:$TOKEN" -H 'content-type:application/json' -d '{"payload": "my-secret-here", "payload_content_type": "text/plain"}' $KEEP_ENDPOINT/v1/secrets | 22:20 |
| woodster_ | zigo: also note that you need to assign roles to your project/tenant's users | 22:23 |
| woodster_ | zigo: see http://docs.openstack.org/developer/barbican/admin-guide-cloud/access_control.html?highlight=rbac | 22:23 |
| zigo | curl: (7) Failed to connect to 65.61.144.166 port 9311: Connection refused | 22:23 |
| zigo | I don't get why, because the server reaally IS there. | 22:24 |
| zigo | Ah no, not this time, it isn't. | 22:24 |
| zigo | httpserver.serve(application, host='127.0.0.1', port='9311') <--- In bin/barbican-api | 22:25 |
| zigo | Probably 0.0.0.0 would be better ! :) | 22:25 |
| zigo | Working now it seems ! :) | 22:27 |
| zigo | \o/ | 22:28 |
| zigo | woodster_: Ok, how do I get this to log to /var/log/barbican/barbican-api.log ? | 22:28 |
| woodster_ | zigo: yeah it is intended to get you running locally quickly, but tweaks like that would be good to add to support more options out of the box | 22:28 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 22:31 | |
| woodster_ | zigo: hmmm...I think only stdout by default | 22:31 |
| *** dimtruck is now known as zz_dimtruck | 22:31 | |
| zigo | woodster_: To make my life easier as a package maintaier, I'd suggest: 1/ get barbican-api installed by default in /usr/bin with everything else, using a standard PBR shell-script endpoint. | 22:31 |
| zigo | woodster_: 2/ use oslo-config-generator like everyone else, and get everything in one file, rather than a barbican-api-paste.ini which is very annoying. | 22:32 |
| zigo | woodster_: 3/ Get it to understand standard stuff like --config-file= and such. | 22:32 |
| zigo | So, in short: please implement oslo.config and oslo.log ! :) | 22:32 |
| woodster_ | zigo: is there an example project that you'd recommend emulating? Or maybe all of them? :) | 22:32 |
| zigo | Yeah, mostly all of them are doing that. | 22:33 |
| zigo | Note that I'm far from a python upstream expert... | 22:33 |
| woodster_ | zigo: well, we use both oslo libs by default, but they are probably not connected up propertly at boot time | 22:33 |
| zigo | I can package stuff which I don't even know ! :) | 22:33 |
| zigo | If I need to know, I can dig-up. | 22:33 |
| zigo | But I have no time to do so. | 22:33 |
| zigo | (and no need to either) | 22:34 |
| woodster_ | zigo: are you heading to Austin for the summit by chance? | 22:34 |
| zigo | Yup, I am. | 22:34 |
| zigo | I've been to all summit since Grizzly. | 22:34 |
| zigo | (ie: portland) | 22:34 |
| woodster_ | zigo: ha! Yeah I've been going since Atlanta. It would be good to meet up with you next month. Our project has had more crypto experts on it than packaging experts | 22:36 |
| woodster_ | zigo: for deployments we just let CM handling things, but if libs can make that slicker/cleaner, that good info to know! | 22:37 |
| zigo | woodster_: CM ? | 22:37 |
| *** alee has quit IRC | 22:37 | |
| woodster_ | zigo: btw, I'm adding your suggested steps to our design summit etherpad | 22:37 |
| woodster_ | zigo: config management ala Chef or Ansible | 22:38 |
| zigo | Ah... | 22:38 |
| zigo | Well, CM are mostly using packages. | 22:38 |
| zigo | I deploy everything using packages only and some debconf magic ! :) | 22:38 |
| zigo | In other words, everything can be preseeded, and should work by default just by doing apt-get install | 22:39 |
| zigo | It's all optional though... | 22:39 |
| woodster_ | zigo: sounds slick for sure | 22:39 |
| zigo | The reason is, I can't rely on CM to do the work so I can test my packages. | 22:40 |
| zigo | I have to find ways to test by myself... | 22:40 |
| zigo | CM should be 2nd stage. | 22:40 |
| woodster_ | zigo: make sense | 22:41 |
| *** nkinder has quit IRC | 22:42 | |
| woodster_ | zigo: are you at least unstuck for the moment? | 22:46 |
| zigo | woodster_: I hope so. | 22:46 |
| zigo | woodster_: I'm trying to hard-wire all of this in the package now. | 22:46 |
| zigo | woodster_: The only thing is logging to /var/log/barbican/barbican-api.log | 22:47 |
| zigo | woodster_: Also, barbican-worker doesn't log in /var/log/barbican/barbican-worker.log, and I'd like to fix that. | 22:47 |
| zigo | But at least now, I should get a working package ! :) | 22:48 |
| zigo | woodster_: If I'm correct, this package may end-up in Ubuntu btw. | 22:48 |
| * zigo checks | 22:49 | |
| zigo | Ah no, they seem to produce their own package these days. | 22:49 |
| woodster_ | zigo: hmmm, so did someone over there go thru your pain to get a package up? Or maybe it doesnt' work so bueno? | 22:50 |
| woodster_ | zigo: fwiw, there is this config option: https://github.com/openstack/barbican/blob/master/etc/barbican/barbican.conf#L21 | 22:50 |
| zigo | Ah, so it *does* understand stuff from oslo.config? | 22:51 |
| zigo | In this case, I have nothing to do, and it will automatically log at the correct place: my openstack-pkg-tools scripts will generate a --log-file=/var/log/${PROJECT_NAME}/${NAME}.log | 22:52 |
| zigo | But to what I could tell, it didn't work. | 22:52 |
| zigo | Anyway, let's finish what I'm doing first. | 22:52 |
| zigo | woodster_: BTW, are you based in USA? | 22:54 |
| zigo | You're email is @rackspace ... | 22:55 |
| woodster_ | zigo: well, it works if you mod the barbican.conf file. | 22:55 |
| woodster_ | zigo: I work from the san antonio, tx offic...john.wood@rackspace.com | 22:55 |
| woodster_ | zigo: how about you? | 22:55 |
| zigo | woodster_: That's a common missunderstanding: one CANNOT use log_file within the config file, because daemons are sharing that one file. This needs to be set in the command line, by the startup script. | 22:56 |
| *** chlong has joined #openstack-barbican | 22:56 | |
| zigo | woodster_: Until end of 2014, I was living in China, but since I got hired by Mirantis, I'm back to my own country, France (living in Grenoble, in the French Alpes). | 22:57 |
| woodster_ | zigo: are you aware of docs on this sequence btw? | 22:57 |
| zigo | What do you mean? | 22:57 |
| woodster_ | zigo: wow how wonderful. I flew my wife and two kids out to Paris after the summit...it was paradise. I'd love to live there | 22:57 |
| woodster_ | zigo: well I guess I'm curious about the canonical/proper boot/daemon process...is that documented someplace? Perhaps in deployer guides? | 22:58 |
| zigo | On the upstream side, I'm really not sure. | 22:59 |
| woodster_ | zigo: do you know a product person at Mirantis named Sheena by chance? | 22:59 |
| zigo | I do ! :) | 22:59 |
| woodster_ | woodster_: ha! She was our product person on barbican a while ago. It was a sad day when she left us for Mirantis :( | 23:00 |
| woodster_ | zigo: she lives in Austin now | 23:00 |
| zigo | woodster_: Oh, I thought she was in SF bay area... | 23:00 |
| woodster_ | zigo: No she was living in san antonio as well. if you get a final script up and running would you kick it back, or email it? | 23:06 |
| *** fawadkhaliq has quit IRC | 23:06 | |
| zigo | woodster_: As soon as I have something, I'll upload it to Debian Experimental ! :) | 23:06 |
| *** fawadkhaliq has joined #openstack-barbican | 23:07 | |
| zigo | (that's where Mitaka is until the final release) | 23:07 |
| zigo | (at which point I'll overwrite Liberty by Mitaka in Sid) | 23:07 |
| zigo | LOL, I've pushed barbican-api in /bin instead of /usr/bin ... :P | 23:08 |
| * zigo fixes | 23:08 | |
| zigo | woodster_: What is barbican-functional.conf for? | 23:09 |
| woodster_ | zigo: only used for functional testing barbican | 23:10 |
| zigo | Ok, I guessed it ... :P | 23:10 |
| *** tkelsey has joined #openstack-barbican | 23:13 | |
| *** tkelsey has quit IRC | 23:17 | |
| zigo | woodster_: ok, all seems to be working now, I have backports for both Jessie and Trusty, you can try them if you like. | 23:17 |
| zigo | woodster_: I still didn't fix the logging issue though... | 23:17 |
| zigo | So it logs no-where ... | 23:17 |
| woodster_ | zigo: my gut says it wouldn't take much to get that to work, since we do use olso-logging for all the things | 23:18 |
| woodster_ | zigo: ...but maybe a today worry! | 23:18 |
| zigo | woodster_: Do you want to test out the packages? | 23:19 |
| woodster_ | zigo: I can't do so right now...I'm a bit swamped of late, trying to spin up on things Nova in a hurry | 23:20 |
| woodster_ | zigo: I can promote in the channel tomorrow to see if some can take a look at it | 23:20 |
| zigo | No worries. | 23:20 |
| zigo | woodster_: Thanks a lot for all of your help. | 23:21 |
| woodster_ | zigo: I am grateful you are looking into this though | 23:21 |
| zigo | I'm now uploading the result ! :) | 23:21 |
| woodster_ | zigo: anytime, thank you! | 23:21 |
| woodster_ | zigo: so it would be visible in the experimental packages then? | 23:21 |
| zigo | woodster_: In a few hours, yes. | 23:21 |
| woodster_ | zigo: nice! | 23:22 |
| zigo | woodster_: The next dinstall run is in 2 hours 29 minutes (I just checked). | 23:22 |
| zigo | woodster_: So, there's that, then the time for your local mirror to pickup the new stuff. | 23:22 |
| *** alee has joined #openstack-barbican | 23:26 | |
| zigo | barbican_2.0.0~rc1-2_amd64.changes uploaded | 23:30 |
| zigo | \o/ | 23:30 |
| *** alee has quit IRC | 23:33 | |
| woodster_ | zigo: awesome! | 23:33 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!