| *** dgonzalez has quit IRC | 00:08 | |
| *** dgonzalez has joined #openstack-barbican | 00:15 | |
| *** dimtruck is now known as zz_dimtruck | 00:34 | |
| *** alee has quit IRC | 00:59 | |
| *** jamielennox is now known as jamielennox|away | 01:09 | |
| *** mixos has joined #openstack-barbican | 01:33 | |
| *** jamielennox|away is now known as jamielennox | 01:43 | |
| *** jamielennox is now known as jamielennox|away | 01:53 | |
| *** zz_dimtruck is now known as dimtruck | 02:14 | |
| *** dimtruck is now known as zz_dimtruck | 02:36 | |
| *** jamielennox|away is now known as jamielennox | 02:43 | |
| *** mixos has quit IRC | 02:46 | |
| *** Kevin_Zheng has joined #openstack-barbican | 03:34 | |
| *** jsheeren has joined #openstack-barbican | 06:04 | |
| *** pcaruana has joined #openstack-barbican | 06:46 | |
| *** andreas_s has joined #openstack-barbican | 06:47 | |
| *** rhagarty__ has quit IRC | 07:17 | |
| *** rhagarty__ has joined #openstack-barbican | 07:18 | |
| *** chlong has quit IRC | 07:52 | |
| *** chlong has joined #openstack-barbican | 08:04 | |
| *** jsheeren has quit IRC | 08:22 | |
| *** jsheeren has joined #openstack-barbican | 08:22 | |
| *** alee has joined #openstack-barbican | 08:33 | |
| *** alee has quit IRC | 08:40 | |
| *** alee has joined #openstack-barbican | 08:45 | |
| *** alee has quit IRC | 09:04 | |
| *** jsheeren has quit IRC | 10:58 | |
| *** jsheeren has joined #openstack-barbican | 11:05 | |
| *** alee has joined #openstack-barbican | 11:50 | |
| *** alee has quit IRC | 11:55 | |
| *** chlong has quit IRC | 12:12 | |
| *** alee has joined #openstack-barbican | 12:14 | |
| *** openstackgerrit has quit IRC | 12:19 | |
| *** openstackgerrit has joined #openstack-barbican | 12:19 | |
| *** alee_ has joined #openstack-barbican | 12:36 | |
| *** alee has quit IRC | 12:39 | |
| jsheeren | anyone here got experience with octavia and https terminated tls listeners? | 12:41 |
|---|---|---|
| *** chlong has joined #openstack-barbican | 12:43 | |
| *** jmckind has joined #openstack-barbican | 13:02 | |
| *** woodster_ has joined #openstack-barbican | 14:05 | |
| *** permalac has quit IRC | 14:14 | |
| alee_ | redrobot, ping | 14:21 |
| *** spotz_zzz is now known as spotz | 14:22 | |
| *** randallburt has joined #openstack-barbican | 14:29 | |
| *** randallburt1 has joined #openstack-barbican | 14:31 | |
| *** randallburt has quit IRC | 14:33 | |
| *** sigmavirus_away is now known as sigmavirus | 14:33 | |
| *** sigmavirus is now known as bops | 14:33 | |
| *** bops is now known as sigmavirus | 14:34 | |
| *** jsheeren has quit IRC | 14:50 | |
| redrobot | alee_ pong | 15:03 |
| alee_ | redrobot, hey -- did you ever set up those deployment docs? | 15:04 |
| alee_ | redrobot, so that folks know how do deploy barbican .. | 15:04 |
| redrobot | alee_ nope. that stuff is all in flux right now... nobody could give me a straight answer on how to get them up there | 15:04 |
| redrobot | alee_ I suppose we could start documenting in our own docs and then move them when the doc team has their stuff figured out | 15:05 |
| alee_ | yeah - thats probably best | 15:05 |
| *** diazjf has joined #openstack-barbican | 15:06 | |
| alee_ | redrobot, I'll probably have a little time to work on this next week | 15:07 |
| redrobot | alee_ cool, I'll get a CR up with a skeleton in our own repo | 15:07 |
| alee_ | redrobot ok | 15:07 |
| alee_ | diazjf, ping | 15:08 |
| diazjf | redrobot, hey I'll be sending an email on the mailing list later this week for the midcycle. I'll keep everyone on this channel up to date! | 15:09 |
| diazjf | alee_ pong | 15:09 |
| alee_ | diazjf, I was going to ask about the midcycle actually | 15:09 |
| alee_ | as well as the barbican workshop .. | 15:09 |
| alee_ | diazjf, have you already submitted the barbican workshop ? | 15:10 |
| redrobot | diazjf cool | 15:10 |
| alee_ | redrobot, diazjf do we have confirmed dates / plans for the midcycle? | 15:10 |
| diazjf | alee_ so its gonna be Aug 15 - 17 Barbican, Aug 17 - 19 Security. Austin, Texas | 15:10 |
| redrobot | alee_ waiting on diazjf to confirm | 15:10 |
| alee_ | ibm or rackspace? | 15:11 |
| diazjf | alee_ ibm | 15:11 |
| alee_ | cool | 15:11 |
| alee_ | diazjf, and the barbican workshop? have you submitted the talk proposal? | 15:11 |
| diazjf | alee_ not yet, we have until the 15. I wanna get redrobot in on it | 15:12 |
| redrobot | diazjf I'm in! ;) | 15:12 |
| alee_ | diazjf, I thought it was the 13th .. | 15:12 |
| diazjf | alee_ your right! | 15:13 |
| diazjf | you're* | 15:13 |
| alee_ | diazjf, yeah - so coming up soon .. | 15:13 |
| alee_ | hyakuhei, same topic .. | 15:14 |
| alee_ | hyakuhei, if we're going to do a "PKI in Openstack" talk, we need to submit soon. | 15:14 |
| diazjf | alee_, redrobot, how many people are allowed for a workshop? | 15:16 |
| diazjf | I think we should get all/most cores in on it | 15:16 |
| redrobot | diazjf alee_ in Paris we had 2 presenters and 3 people on the floor to help with questions | 15:16 |
| diazjf | redrobot, so register it as a panel? | 15:16 |
| redrobot | diazjf I _think_ there's a way to say it's a workshop? | 15:16 |
| diazjf | redrobot, cool I'll look into it | 15:18 |
| alee_ | diazjf, redrobot looks like only panel and presentation | 15:21 |
| alee_ | diazjf, redrobot but panel allows 4 speakers and 1 moderator | 15:21 |
| alee_ | while preso has max 3 speakers | 15:21 |
| redrobot | alee_ diazjf yeah, but we need a room with tables so people can use their laptops | 15:22 |
| alee_ | redrobot, understood - there just is no workshop category | 15:22 |
| alee_ | on the call for preso page | 15:23 |
| diazjf | alee_ redrobot, Ill choose panel and from there I can choose hand-on workshop in the general topic | 15:23 |
| alee_ | diazjf, cool | 15:23 |
| alee_ | redrobot, diazjf note that it seems like speaker bios are mandatory and need to be in before the deadline most likely | 15:25 |
| diazjf | alee_ I'll set a deadline for myself to register the talk by tomorrow afternoon. I'll make sure to email everyone on the talk to fill out their bio | 15:26 |
| alee_ | diazjf, cool thanks | 15:27 |
| alee_ | diazjf, redrobot ya'll wouldn't remember where the tempest test to test encrypted volumes is, would you? | 15:28 |
| diazjf | alee_ https://github.com/openstack/tempest/blob/dcc559792320d6cd087f658a3c49a88104493dc5/tempest/scenario/test_encrypted_cinder_volumes.py ? | 15:30 |
| alee_ | diazjf, awesome thanks! | 15:31 |
| *** openstackgerrit has quit IRC | 15:33 | |
| *** openstackgerrit has joined #openstack-barbican | 15:33 | |
| *** jmckind_ has joined #openstack-barbican | 15:35 | |
| *** jmckind has quit IRC | 15:38 | |
| *** zz_dimtruck is now known as dimtruck | 15:43 | |
| *** gyee has joined #openstack-barbican | 15:45 | |
| *** jmckind_ has quit IRC | 15:46 | |
| *** jmckind has joined #openstack-barbican | 15:48 | |
| *** andreas_s has quit IRC | 16:07 | |
| *** kebray has joined #openstack-barbican | 16:09 | |
| *** pcaruana has quit IRC | 16:33 | |
| *** alee has joined #openstack-barbican | 16:48 | |
| *** alee_ has quit IRC | 16:48 | |
| *** diazjf has quit IRC | 16:59 | |
| *** permalac has joined #openstack-barbican | 17:09 | |
| *** randallburt1 has quit IRC | 17:46 | |
| *** randallburt has joined #openstack-barbican | 17:49 | |
| -openstackstatus- NOTICE: Job instability resulting from a block storage connectivity error on mirror.iad.rax.openstack.org has been corrected; jobs running in rax-iad should be more reliable again. | 18:13 | |
| *** diazjf has joined #openstack-barbican | 18:27 | |
| *** diazjf has quit IRC | 18:31 | |
| *** diazjf has joined #openstack-barbican | 18:34 | |
| *** diazjf has quit IRC | 18:40 | |
| *** diazjf has joined #openstack-barbican | 18:54 | |
| *** diazjf has quit IRC | 18:57 | |
| *** diazjf has joined #openstack-barbican | 19:00 | |
| openstackgerrit | Pankaj Khandar proposed openstack/barbican: Insecure default PROTOCOL_TLSv1 version in KMIP plugin https://review.openstack.org/330688 | 19:11 |
| *** dimtruck is now known as zz_dimtruck | 19:24 | |
| *** gyee has quit IRC | 19:31 | |
| *** kebray has quit IRC | 19:35 | |
| *** zz_dimtruck is now known as dimtruck | 19:43 | |
| *** jsheeren has joined #openstack-barbican | 20:04 | |
| jsheeren | hi everyone | 20:05 |
| jsheeren | so i'm still playing around with octavia, got it running, so i can create loadbalancers, which work fine as advertised | 20:05 |
| jsheeren | unfortunatelly i'm running into an issue with creating https tls listeners | 20:05 |
| jsheeren | it says it can't find the certificates (which are stored in barbican), but using the barbican client i can fetch them without issues | 20:05 |
| jsheeren | logs tell me octavia is pushing the wrong project id to fetch stuff from barbican (it's pushing the service project id instead of the user project id) | 20:05 |
| jsheeren | also, i configured everything to be https | 20:05 |
| jsheeren | yet i see in the logs that there are posts going to http | 20:06 |
| jsheeren | can anyone point me in the right direction where to look? config setting i overlooked? | 20:06 |
| rm_work | jsheeren: octavia uses its service account to get the secrets | 20:06 |
| rm_work | jsheeren: the users need to set up ACLs to allow the octavia user access | 20:06 |
| rm_work | you're missing part of the workflow | 20:06 |
| rm_work | I think there might be docs for that somewhere... | 20:07 |
| jsheeren | rm_work: aha, thanks! so i set up acl for the user that created the certificate containers? (the same users that creates the loadbalancer) | 20:07 |
| rm_work | though... hmm | 20:07 |
| rm_work | jsheeren: yeah, there's an ACL call for the container (and the secrets) that allows another user to READ them | 20:07 |
| jsheeren | yeah i found that docs and octavia are not always easy :-) | 20:07 |
| rm_work | which you'll want to set, with the octavia service user as the target | 20:07 |
| jsheeren | ok, so i set the octavia service user in the acl with read permissions? | 20:08 |
| rm_work | yes | 20:08 |
| *** diazjf has quit IRC | 20:08 | |
| rm_work | but, if you run into issues, let us know | 20:08 |
| jsheeren | ok that makes sense, cause that's the project id that i see in the logs (the octavia service user) | 20:08 |
| rm_work | yep | 20:08 |
| *** dimtruck is now known as zz_dimtruck | 20:09 | |
| jsheeren | rm_work: allright, thank you! i'll look into it right away | 20:09 |
| jsheeren | rm_work: the id that's pushed to barbican by octavia is the one of the service project/tenant | 20:11 |
| jsheeren | can i give a project/tenant (not the user) read rights? | 20:11 |
| rm_work | I believe so? redrobot ? | 20:12 |
| rm_work | hmm | 20:12 |
| * redrobot pokes head in | 20:12 | |
| rm_work | I thought octavia would NEED to use its service-user | 20:12 |
| rm_work | which would be a userID | 20:12 |
| rm_work | it | 20:12 |
| rm_work | * it's using a keystone token for the barican read operation, which *must* be a user, right? | 20:13 |
| rm_work | can't generate a keystone token for a tenant without a user? | 20:13 |
| redrobot | rm_work keystone tokens use a triad of user+project+role | 20:13 |
| rm_work | yeah | 20:13 |
| rm_work | that's what i thought | 20:13 |
| rm_work | jsheeren: it may only be showing you the tenantID, but there *is* a userID | 20:14 |
| *** zz_dimtruck is now known as dimtruck | 20:14 | |
| jsheeren | rm_work: ok | 20:14 |
| redrobot | under normal circumstances barbican checks to make sure the project matches between the token being presented, and the project stored in barbican as the "owner" project | 20:14 |
| redrobot | if the project mismatches it checks the UserID to see if it is in ACL list | 20:14 |
| redrobot | if both fail then you get a 401 | 20:14 |
| jsheeren | redrobot: allright thank you | 20:14 |
| jsheeren | rm_work: also, thanks | 20:15 |
| rm_work | np | 20:15 |
| rm_work | good luck, let me know how it works out, our testing on this aspect has been ... sparse | 20:15 |
| redrobot | jsheeren yep, sorry I missed you earlier.... let me know if anything else comes up | 20:15 |
| rm_work | so I am excited to see people using it :P | 20:15 |
| jsheeren | yeah no problem, i'm in a different time zone i guess :-) | 20:16 |
| jsheeren | i'm glad you guys are helping me out! | 20:16 |
| jsheeren | hmm: HTTPNotFound: Not Found. Sorry but your container is in another castle. | 20:25 |
| jsheeren | in the debug log of barbican i can see the sql statements | 20:25 |
| jsheeren | there it is using the service project id as the external id | 20:26 |
| jsheeren | i added the octavia user with the "acl submit" command, read and project access to the container; should this be enought or am i missing something? | 20:27 |
| jsheeren | maybe related, but the last line in the log is: "POST /v1/containers/5680e375-eaa9-4657-8ba2-a605b67179a8/consumers/ HTTP/1.1" 404 359 "-" "keystoneauth1/2.4.0 python-requests/2.9.1 CPython/2.7.11+" | 20:29 |
| jsheeren | this post is coming into http, but i setup the service using https.. | 20:29 |
| *** dimtruck is now known as zz_dimtruck | 20:35 | |
| *** randallburt has quit IRC | 20:36 | |
| jsheeren | on another note: my barbican-keystone-listener fails with the message: Could not load 'simple_certificate_event': cannot import name certificate_manager | 20:37 |
| jsheeren | is there an easy fix for that one? | 20:37 |
| redrobot | jsheeren to be honest, I haven't used the keystone-listener much | 20:43 |
| jsheeren | redrobot: what is it for actually? | 20:44 |
| redrobot | jsheeren listens for Keystone events like account deletion to clean up barbican data | 20:44 |
| jsheeren | ah nice | 20:45 |
| *** zz_dimtruck is now known as dimtruck | 20:47 | |
| jsheeren | hah, i think i found it; it's not the octavia user, but the neutron user that's making the request for the secret container | 20:53 |
| jsheeren | let me check ... | 20:53 |
| rm_work | AH yes | 20:53 |
| rm_work | that sounds right | 20:53 |
| rm_work | actually, i think it will be both <_< | 20:53 |
| rm_work | but, we configure them to share a user in production :/ | 20:53 |
| rm_work | jsheeren: ^^ | 20:53 |
| rm_work | the check is done for validation on the frontend (neutron-lbaas), then the cert is read AGAIN on the backend (octavia) to actually be used | 20:54 |
| rm_work | this will be simplified a lot once neutron-lbaas and octavia are merged | 20:54 |
| *** gyee has joined #openstack-barbican | 20:55 | |
| *** jmckind_ has joined #openstack-barbican | 20:56 | |
| *** jmckind has quit IRC | 20:58 | |
| jsheeren | rm_work: that's an idea to configure it to share a user. might look into that | 21:02 |
| jsheeren | anyway; i added the neutron user to the acl for the secret container AND the secrets; but i'm still getting the "HTTPNotFound: Not Found. Sorry but your container is in another castle." message | 21:03 |
| jsheeren | gah; i need to go, i'll dig deeper in the logs, if i find it, i'll let you know here sometime tomorrow | 21:05 |
| jsheeren | rm_work: thank you for helping | 21:05 |
| jsheeren | redrobot: also, thanks!! | 21:05 |
| rm_work | hmm ok | 21:05 |
| rm_work | i am interested, so keep me posted | 21:05 |
| jsheeren | will do! bye | 21:06 |
| *** jsheeren has quit IRC | 21:06 | |
| *** kebray has joined #openstack-barbican | 21:06 | |
| *** kebray has quit IRC | 21:07 | |
| *** diazjf has joined #openstack-barbican | 21:11 | |
| *** DandyPandy has quit IRC | 21:26 | |
| *** DandyPandy has joined #openstack-barbican | 21:32 | |
| *** diazjf has quit IRC | 21:33 | |
| *** diazjf has joined #openstack-barbican | 21:34 | |
| *** sigmavirus is now known as sigmavirus_away | 21:42 | |
| *** diazjf has quit IRC | 21:43 | |
| *** spotz is now known as spotz_zzz | 22:21 | |
| *** jmckind_ has quit IRC | 22:24 | |
| *** permalac has quit IRC | 23:35 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!