| openstackgerrit | Arun Kant proposed openstack/barbican-specs: Adding spec for supporting multiple secret store backends https://review.openstack.org/263972 | 00:05 |
|---|---|---|
| *** edtubill has joined #openstack-barbican | 00:11 | |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding API docs for multiple backend support changes. https://review.openstack.org/341803 | 00:31 |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding rest API for secret-stores resource (Part 4) https://review.openstack.org/358162 | 00:33 |
| *** diazjf has joined #openstack-barbican | 01:00 | |
| *** jamielennox is now known as jamielennox|away | 01:11 | |
| *** jamielennox|away is now known as jamielennox | 01:16 | |
| *** su_zhang has quit IRC | 01:26 | |
| *** diazjf has quit IRC | 01:34 | |
| *** hockeynut has quit IRC | 01:36 | |
| *** dave-mccowan has joined #openstack-barbican | 02:34 | |
| *** jamielennox is now known as jamielennox|away | 02:49 | |
| *** dave-mccowan has quit IRC | 02:56 | |
| *** dave-mccowan has joined #openstack-barbican | 02:59 | |
| *** jamielennox|away is now known as jamielennox | 03:06 | |
| *** dave-mccowan has quit IRC | 03:21 | |
| *** diazjf has joined #openstack-barbican | 03:24 | |
| *** diazjf has quit IRC | 03:32 | |
| *** su_zhang has joined #openstack-barbican | 04:39 | |
| *** jamielennox is now known as jamielennox|away | 04:49 | |
| *** edtubill has quit IRC | 04:50 | |
| *** jaosorior has joined #openstack-barbican | 05:10 | |
| *** jamielennox|away is now known as jamielennox | 05:23 | |
| *** su_zhang has quit IRC | 05:26 | |
| *** su_zhang has joined #openstack-barbican | 05:26 | |
| *** jamielennox is now known as jamielennox|away | 06:11 | |
| *** pcaruana has joined #openstack-barbican | 06:14 | |
| *** woodster_ has quit IRC | 06:19 | |
| *** andreas_s has joined #openstack-barbican | 06:43 | |
| *** su_zhang has quit IRC | 06:48 | |
| *** su_zhang has joined #openstack-barbican | 06:48 | |
| *** su_zhang has quit IRC | 06:52 | |
| *** f13o has quit IRC | 06:53 | |
| *** shohel has joined #openstack-barbican | 07:13 | |
| openstackgerrit | gecong proposed openstack/barbican: Remove white space between print and () https://review.openstack.org/359013 | 07:50 |
| *** openstackgerrit has quit IRC | 08:03 | |
| *** openstackgerrit has joined #openstack-barbican | 08:04 | |
| *** f13o has joined #openstack-barbican | 08:07 | |
| *** f13o has quit IRC | 08:31 | |
| *** lixiaoy1 has joined #openstack-barbican | 09:36 | |
| *** shohel has quit IRC | 10:07 | |
| *** shohel has joined #openstack-barbican | 10:08 | |
| *** ntpttr has quit IRC | 10:30 | |
| *** ntpttr has joined #openstack-barbican | 10:35 | |
| *** shohel has quit IRC | 11:30 | |
| *** shohel has joined #openstack-barbican | 11:30 | |
| *** jaosorior has quit IRC | 11:50 | |
| *** jaosorior has joined #openstack-barbican | 11:51 | |
| *** phschwartz has quit IRC | 12:14 | |
| *** nkinder has joined #openstack-barbican | 12:31 | |
| *** phschwartz has joined #openstack-barbican | 12:38 | |
| *** alee has quit IRC | 12:39 | |
| *** dave-mccowan has joined #openstack-barbican | 12:45 | |
| *** chlong has quit IRC | 12:56 | |
| *** woodster_ has joined #openstack-barbican | 12:56 | |
| *** chlong has joined #openstack-barbican | 13:13 | |
| *** alee has joined #openstack-barbican | 13:29 | |
| *** dmsimard has joined #openstack-barbican | 13:51 | |
| dmsimard | Hi #openstack-barbican o/ A recent commit in Cinder seems to have broken encrypted volumes with Barbican. I'm not very familiar with this and would appreciate if someone could help. We've filed a bug about it https://bugs.launchpad.net/cinder/+bug/1615059 | 13:52 |
| openstack | Launchpad bug 1615059 in Cinder "Cinder fails to create a crypted volume when barbican is used as key manager" [Undecided,In progress] - Assigned to Lisa Li (lisali) | 13:52 |
| dmsimard | There was a review that attempts to fix the issue but it uncovers another problem -- I guess encrypted volumes through barbican as a key manager is largely untested in Cinder | 13:53 |
| woodster_ | dmsimard: kfarr is the most knowledgeable about the encrypted workflows. alee did you ever get cinder workflows working in your setup? | 13:56 |
| alee | woodster_, I did indeed. in fact it appears that its through my setup (RDO CI) that this issue was uncovered .. | 13:58 |
| dmsimard | alee: yeah, it was, actually :) | 13:59 |
| dmsimard | alee: RDO CI typically runs ahead of puppet-openstack-integration, we pull their tests and run them outside of the gate | 14:00 |
| dmsimard | alee: but the issue also reproduced upstream in https://review.openstack.org/#/c/357645/ | 14:00 |
| alee | dmsimard, OK will investigate | 14:02 |
| *** pcaruana has quit IRC | 14:02 | |
| dmsimard | alee: thanks, appreciate it. | 14:04 |
| dmsimard | The issue is bound to reproduce in Ubuntu as well, they just don't update their packages as often :) | 14:05 |
| *** zz_dimtruck is now known as dimtruck | 14:17 | |
| *** pcaruana has joined #openstack-barbican | 14:17 | |
| *** edtubill has joined #openstack-barbican | 14:17 | |
| *** spotz_zzz is now known as spotz | 14:29 | |
| *** jaosorior is now known as jaosorior_away | 14:32 | |
| *** randallburt has joined #openstack-barbican | 14:50 | |
| *** randallburt1 has joined #openstack-barbican | 14:52 | |
| *** randallburt has quit IRC | 14:55 | |
| *** shohel has quit IRC | 14:56 | |
| *** hockeynut has joined #openstack-barbican | 14:58 | |
| *** edtubill has quit IRC | 15:07 | |
| *** andreas_s has quit IRC | 15:25 | |
| alee | dmsimard, ping | 15:38 |
| alee | dmsimard, the reason you get a failure now is because something is wonky with the barbican config | 15:39 |
| alee | dmsimard, for some reason, no secret_store plugins are enabled | 15:39 |
| alee | dmsimard, you guys are running whats in puppet-openstack-integration ? | 15:40 |
| *** pcaruana has quit IRC | 15:56 | |
| woodster_ | alee: Only the initial attempt to load a plugin gives you the root cause exception to the load. I think we need to save the initial root cause exception when plugins are loaded by stevedore, and then re-output that stacktrace for plugin load attempts after that. | 15:59 |
| *** jaosorior_away is now known as jaosorior | 16:00 | |
| *** michauds has joined #openstack-barbican | 16:08 | |
| *** pcaruana has joined #openstack-barbican | 16:09 | |
| *** nkinder has quit IRC | 16:11 | |
| *** jaosorior has quit IRC | 16:18 | |
| dmsimard | alee: yeah. | 16:36 |
| dmsimard | alee: we're running puppet-openstack-integration but outside the gate | 16:36 |
| dmsimard | alee: although I guess it also reproduces in the gate as per the review I sent you | 16:36 |
| *** nkinder has joined #openstack-barbican | 17:05 | |
| alee | dmsimard, its pretty weird that the barbican config is messed up. | 17:07 |
| dmsimard | alee: not going to disagree | 17:08 |
| alee | dmsimard, ok - I think the basic fix is to be explicit in which plugins will be enabled | 17:19 |
| alee | dmsimard, this will need to be a change in openstack-puppet-integration | 17:19 |
| alee | dmsimard, I can put up a change, and you can link to it? | 17:20 |
| dmsimard | alee: there's a couple layers involved, I won't be able to exactly test both your change and the cinder "fix" simultaneously | 17:21 |
| dmsimard | if the cinder fix looks good to you, we can pressure them to merge it | 17:22 |
| dmsimard | and then once we build a package with that review, we can rebase https://review.openstack.org/#/c/357645/ with an up-to-date repo on top of your puppet-openstack-integration fix | 17:22 |
| alee | dmsimard, well - kfarr is the exper t here on the cinder side - but it looks good to me so far | 17:23 |
| dmsimard | alee: kfarr actually -1'd it https://review.openstack.org/#/c/358670/ | 17:23 |
| alee | dmsimard, well - I'd defer to her -- I dont know this code .. she seemed to have an objecttion to a change not done in the mock key managger test | 17:25 |
| dmsimard | and the contributor is in APAC /me sighs | 17:26 |
| alee | dmsimard, so most likely the change is ok except for incorrect mock key manager test | 17:26 |
| alee | dmsimard, anyways I'll put my change up | 17:26 |
| dmsimard | alee: is it forward compatible ? | 17:27 |
| alee | should be .. its just makiong explicit what was not before | 17:27 |
| *** su_zhang has joined #openstack-barbican | 17:29 | |
| *** hockeynut has quit IRC | 17:33 | |
| alee | dmsimard, https://review.openstack.org/359363 | 17:36 |
| dmsimard | alee: ack, ty | 17:37 |
| arunkant | alee, can you re-review multi-backend spec ( https://review.openstack.org/#/c/263972/) and API docs review..change is in API response only as per redrobot comments | 17:38 |
| alee | arunkant, will do | 17:39 |
| arunkant | redrobot: can you review API docs (https://review.openstack.org/#/c/341803) . I was hoping if these 2 can be merged by this week. | 17:39 |
| alee | woodster_, ping | 17:51 |
| *** su_zhang has quit IRC | 17:51 | |
| *** su_zhang has joined #openstack-barbican | 17:51 | |
| alee | woodster_, redrobot I'm trying to figure out whats going on with plugin loads .. | 17:52 |
| alee | woodster_, redrobot if I look in secret_store.py , I see default plugins being defined .. | 17:52 |
| *** zhugaoxiao has joined #openstack-barbican | 17:53 | |
| alee | woodster_, redrobot but when I look at store_crypto.py, I do not see a default plugin there .. | 17:55 |
| *** Administrator__ has quit IRC | 17:55 | |
| woodster_ | alee: The repo is self contained with the default insecure plugin | 17:55 |
| alee | woodster_, redrobot - should there be? | 17:55 |
| alee | woodster_, redrobot but is it? | 17:56 |
| alee | woodster_, redrobot that is -- where is the definition of a default store_crypto plugin? | 17:57 |
| woodster_ | alee: looking now.... | 17:57 |
| woodster_ | alee: this is the one: https://github.com/openstack/barbican/blob/master/barbican/plugin/crypto/simple_crypto.py | 17:58 |
| * woodster_ default one used that is | 17:58 | |
| *** dimtruck is now known as zz_dimtruck | 17:59 | |
| alee | woodster_, right - but there is no default setting for enabled_crypto_plugin | 17:59 |
| alee | woodster_, unless its here --? barbican/barbican/plugin/crypto/manager.py ? | 18:00 |
| *** su_zhang has quit IRC | 18:00 | |
| *** su_zhang has joined #openstack-barbican | 18:01 | |
| *** zz_dimtruck is now known as dimtruck | 18:01 | |
| *** jamielennox|away is now known as jamielennox | 18:01 | |
| *** su_zhang has quit IRC | 18:01 | |
| *** su_zhang has joined #openstack-barbican | 18:02 | |
| *** su_zhang has quit IRC | 18:02 | |
| *** su_zhang has joined #openstack-barbican | 18:02 | |
| woodster_ | alee: So this configures the plugin: https://github.com/openstack/barbican/blob/master/etc/barbican/barbican.conf#L260 | 18:05 |
| woodster_ | alee: and this defines the possible choices: https://github.com/openstack/barbican/blob/master/setup.cfg#L42 | 18:06 |
| alee | woodster_, so lets imagine that barbican.conf has no value for enabled_secretstore_plugins or enabled_crypto_plugins | 18:07 |
| alee | woodster_, what happens then? | 18:07 |
| woodster_ | alee: well that could be a problem :) | 18:07 |
| alee | woodster_, would it? or should it be? | 18:08 |
| alee | woodster_, https://github.com/openstack/barbican/blob/master/barbican/plugin/crypto/manager.py#L32 | 18:08 |
| alee | woodster_, https://github.com/openstack/barbican/blob/master/barbican/plugin/interface/secret_store.py#L33 | 18:09 |
| alee | woodster_, the way that works -- shouldn't the default plugin be the simple_crypto one? | 18:10 |
| woodster_ | alee: well, I know the nova team has moved to a no-config file needed approach | 18:11 |
| alee | woodster_, right - the idea being presumably that it just works out of the box | 18:12 |
| woodster_ | alee: yeah that should load the things. So what specific error are you seeing? | 18:12 |
| *** hockeynut has joined #openstack-barbican | 18:13 | |
| alee | woodster_, no plugin found :/ | 18:13 |
| alee | woodster_, getting link | 18:13 |
| woodster_ | alee: you have to look at the stack trace the first time no plug founds is seen after boot up | 18:13 |
| alee | woodster_, here is the config file http://46.231.132.68:8080/v1/AUTH_b50e80d3969f441a8b7b1fe831003e0a/rdoartifacts/96/1896/2/check/gate-weirdo-dlrn-master-puppet-scenario002/Zcba3f8dc095a4a87aac6d4b86ae00230/artifacts/puppet-openstack/logs/etc/barbican/barbican.conf.txt.gz | 18:13 |
| woodster_ | alee: I can't hit that host...can you pastebin it? | 18:14 |
| alee | woodster_, log file .. | 18:14 |
| alee | woodster_, really .. didn't think it was internal ... | 18:15 |
| alee | woodster_, ok - just a sec | 18:15 |
| alee | woodster_, http://paste.ophttp://paste.openstack.org/show/562530/ | 18:16 |
| alee | woodster_, config http://paste.openstack.org/show/562531 | 18:17 |
| woodster_ | alee: it is not able to find a plugin to support the type order....we probably should make that error message more explicit, like "Could not find a secret storage backend to support generating a secret of type 'xyz'" | 18:21 |
| woodster_ | alee: well, a 'crypto backend' rather than 'secret storage backend' | 18:21 |
| alee | woodster_, right - but the simple crypto plugin does support generating a secret | 18:22 |
| dmsimard | alee: that host isn't internal | 18:23 |
| dmsimard | alee: it's a public swift cluster | 18:23 |
| dmsimard | woodster_: ^ | 18:23 |
| woodster_ | dmsimard: oh that makes sense | 18:24 |
| woodster_ | alee: the simple crypto does support some generation: https://github.com/openstack/barbican/blob/master/barbican/plugin/crypto/simple_crypto.py#L202 | 18:24 |
| woodster_ | it would help if we logged out what the order info was when that failure occurs | 18:25 |
| woodster_ | so basically whatever generation is being request is failing that above method most likely | 18:25 |
| alee | woodster_, we can get that from the cinder-api logs here .. just a sec .. | 18:26 |
| alee | woodster_, if you can get to that -- http://logs.openstack.org/45/357645/4/check/gate-puppet-openstack-integration-3-scenario002-tempest-centos-7/3273ca7/logs/cinder/cinder-api.txt.gz#_2016-08-22_08_01_11_492 | 18:27 |
| alee | woodster_, sorry not the rright one .. | 18:27 |
| woodster_ | alee: oh cool, I just saw cinder key errors in there :) | 18:29 |
| * woodster_ didn't know they were using task flow now | 18:29 | |
| alee | woodster_, paste.openstack.org/show/562532/ | 18:29 |
| woodster_ | alee: 512 aes is not supported: https://github.com/openstack/barbican/blob/master/barbican/plugin/crypto/crypto.py#L54 | 18:31 |
| alee | woodster_, yes indeed :) | 18:31 |
| alee | dmsimard, ^^ | 18:32 |
| woodster_ | so better logging would have made that 10x more obvious at least. | 18:32 |
| alee | woodster_, yeah | 18:32 |
| dmsimard | so cinder is passing a keylength that is too high for what is supported by that plugin ? | 18:32 |
| woodster_ | alee: do you have any cycles to put up a CR to improve the exception message? | 18:32 |
| alee | woodster_, yeah - and I'll up the plugin too | 18:33 |
| woodster_ | dmsimard: I don't think the plugin would have a problem with 512, but our 'is supports 512' checker is rejecting it | 18:33 |
| dmsimard | woodster_: fair enough | 18:33 |
| alee | dmsimard, there is no reason the plugin should not support that | 18:33 |
| dmsimard | alee: are we the ones passing that 512 value through puppet ? | 18:33 |
| dmsimard | alee: looks like not, a default from cinder ? | 18:34 |
| woodster_ | alee: dmsimard what is the largest aes key size folks are typically generating nowadays? That upper limit should be at least 1024 I'm thinking | 18:34 |
| alee | dmsimard, likely yes -- they probably uppped it | 18:34 |
| dmsimard | woodster_: I have no clue tbh :p | 18:35 |
| *** diazjf has joined #openstack-barbican | 18:36 | |
| dmsimard | alee: looks like it's defined here https://github.com/openstack/cinder/blob/3ad7384913546a71b32b7e321c035183eedfc255/cinder/volume/flows/api/create_volume.py#L364 | 18:36 |
| dmsimard | going upwards to try and figure out where that's from | 18:36 |
| alee | dmsimard, oh thats probably in the tempest test | 18:37 |
| dmsimard | http://docs.openstack.org/mitaka/config-reference/block-storage/volume-encryption.html mentions 512 in the example tests | 18:37 |
| woodster_ | dmsimard: well that error message is a fail for sure...creating a LP bug for that now... | 18:37 |
| dmsimard | alee: oh, right, tempest probably creates a volume type with aes 512 | 18:38 |
| dmsimard | and that's where it fails | 18:38 |
| alee | dmsimard, https://github.com/openstack/tempest/blob/master/tempest/scenario/test_encrypted_cinder_volumes.py#L56 | 18:38 |
| dmsimard | bingo | 18:38 |
| dmsimard | so, two solutions here -- 1) bump the plugin max (what are the impacts?) 2) adapt the tempest test | 18:39 |
| dmsimard | alee: so, just making sure | 18:40 |
| dmsimard | alee: that's the second issue, right ? The second problem I brought up 6 | 18:40 |
| dmsimard | ? | 18:40 |
| alee | dmsimard, interesting - that value has been there for awhile now .. guess it never was really tested with barbcian before :/ | 18:40 |
| dmsimard | alee: cinder doesn't test barbican encrypted volumes upstream | 18:41 |
| dmsimard | this is all RDO CI :D | 18:41 |
| *** su_zhang has quit IRC | 18:41 | |
| alee | dmsimard, glad Emilien made me put it in openstack-puppet-integration :) | 18:41 |
| *** su_zhang has joined #openstack-barbican | 18:41 | |
| woodster_ | dmsimard: alee I'd prefer to add 512, 1024, 2048, 4096 as options (assuming they all actually work without 'sploding) | 18:41 |
| alee | woodster_, +1 | 18:42 |
| dmsimard | alee: /me nods p-o-i has typically better coverage than devstack | 18:42 |
| alee | woodster_, 4096 symmetric key length? | 18:44 |
| alee | woodster_, not sure it makes sense to go beyond 1024 .. | 18:44 |
| woodster_ | alee: sure, why not? :) We'll be a few years ahead of the crowd | 18:44 |
| dmsimard | googling a bit, it doesn't look like 4096 aes is even a thing | 18:45 |
| woodster_ | alee: well at least to 1024 I think | 18:45 |
| alee | woodster_, ok - I'll up to 1024 | 18:45 |
| alee | dmsimard, right - - 4096 and for asymm keys .. | 18:46 |
| dmsimard | 4096 for RSA maybe | 18:46 |
| woodster_ | dmsimard: asymmetric (PKI) is already maxed at 4096 | 18:48 |
| dmsimard | woodster_: did you file a bug for improved exception handling + plugin key length bump ? | 18:48 |
| dmsimard | want to reference it on our end | 18:49 |
| alee | woodster_, https://www.keylength.com/en/4/ | 18:50 |
| dmsimard | alee: so aes-512 isn't even a thing ? | 18:51 |
| woodster_ | dmsimard: alee this is to focus on the error message: https://bugs.launchpad.net/barbican/+bug/1616179 | 18:51 |
| openstack | Launchpad bug 1616179 in Barbican "Error message too vague for no supporting crypto plugin found for secret generation" [Undecided,New] | 18:51 |
| woodster_ | dmsimard: alee I'll submit one for the max aes size | 18:52 |
| dmsimard | woodster_: thanks I'll wait | 18:52 |
| alee | woodster_, http://crypto.stackexchange.com/questions/20253/why-we-cant-implement-aes-512-key-size | 18:52 |
| alee | woodster_, I'm not sure aes 512 is even a thing .. | 18:52 |
| *** su_zhang has quit IRC | 18:52 | |
| woodster_ | alee: oh good point! | 18:53 |
| dmsimard | alee: so the fix is in tempest then | 18:53 |
| woodster_ | well, I did say to boost the size only if it actually worked :) | 18:53 |
| dmsimard | alee: we can argue that testing with 256 in tempest is sufficient | 18:53 |
| alee | woodster_, https://www.researchgate.net/publication/220793242_AES-512_512-Bit_Advanced_Encryption_Standard_algorithm_design_and_evaluation | 18:54 |
| dmsimard | however, what's up with those docs http://docs.openstack.org/mitaka/config-reference/block-storage/volume-encryption.html that mention aes-512 | 18:54 |
| dmsimard | the docs mention aes-512 since juno at least | 18:54 |
| alee | dmsimard, well - the same folks that wrote the tempest test wrote the docs | 18:55 |
| dmsimard | lol, you think ? | 18:55 |
| dmsimard | maybe aes-512 is some super secret nsa stuff | 18:55 |
| woodster_ | well I saw a research paper on aes-512, but even NIST isn't testing that yet (see here...just 256 max aes mentioned: http://csrc.nist.gov/groups/STM/cavp/documents/aes/aesval.html) | 18:58 |
| woodster_ | maybe this is no accident?: https://en.wikipedia.org/wiki/Tempest_(codename) | 18:59 |
| * woodster_ the naming of the test framework that is | 19:00 | |
| alee | :) | 19:00 |
| alee | woodster_, I'd be curious if kfarr could provide some feedback here .. | 19:01 |
| woodster_ | alee: she might, but then she'd have to disappear you ;) | 19:06 |
| dmsimard | alee: I'm asking in #openstack-cinder | 19:08 |
| dmsimard | alee: oh but hey, kfarr is actually the one that submitted https://review.openstack.org/#/c/251503 which broke everything T_T | 19:09 |
| alee | :) | 19:09 |
| dmsimard | See the commit message | 19:09 |
| dmsimard | "Another fix will be needed to address the use case of aes-xts with a key size of 512 -- key managers may not be able to create 512 bit AES keys." | 19:09 |
| dmsimard | "Another fix will be needed to address the use case of aes-xts with a key size of 512 -- key managers may not be able to create 512 bit AES keys." | 19:10 |
| dmsimard | er, wrong channel | 19:11 |
| alee | dmsimard, woodster_ ok - I think we need to wait to talk with kfarr | 19:11 |
| alee | and figure out what she's trying to do | 19:11 |
| dmsimard | alee: so I guess aes-xts != aes ? | 19:11 |
| alee | dmsimard, yeah -- or simple plugin doesn | 19:11 |
| alee | does not do much to distinguish | 19:12 |
| dmsimard | alee: so I'd like to file a bug about this so we don't lose track of it. Should I use https://bugs.launchpad.net/cinder/+bug/1514546 which is the bug referenced in kfarr's commit ? | 19:13 |
| openstack | Launchpad bug 1514546 in Cinder "Cinder volume encryption uses default parameters for keys" [Undecided,Fix released] - Assigned to Lisa Li (lisali) | 19:13 |
| alee | dmsimard, sure | 19:13 |
| *** pcaruana has quit IRC | 19:20 | |
| *** hockeynut has quit IRC | 19:28 | |
| *** kfarr has joined #openstack-barbican | 19:30 | |
| *** su_zhang has joined #openstack-barbican | 19:41 | |
| *** su_zhang has quit IRC | 19:46 | |
| openstackgerrit | Arun Kant proposed openstack/barbican: Adding rest API for secret-stores resource (Part 4) https://review.openstack.org/358162 | 19:51 |
| *** kfarr has quit IRC | 19:55 | |
| *** kfarr has joined #openstack-barbican | 19:57 | |
| *** su_zhang has joined #openstack-barbican | 20:08 | |
| openstackgerrit | Max Abidi proposed openstack/python-barbicanclient: Validate key order meta fields. https://review.openstack.org/320100 | 20:09 |
| *** dmsimard has left #openstack-barbican | 20:09 | |
| openstackgerrit | Merged openstack/barbican-specs: Adding spec for supporting multiple secret store backends https://review.openstack.org/263972 | 20:14 |
| *** haplo37__ has joined #openstack-barbican | 20:14 | |
| *** hockeynut has joined #openstack-barbican | 20:27 | |
| *** sigmavirus is now known as sigmavirus|away | 20:29 | |
| *** gyee has joined #openstack-barbican | 20:37 | |
| *** diazjf has quit IRC | 20:38 | |
| *** nkinder has quit IRC | 20:40 | |
| *** diazjf has joined #openstack-barbican | 20:59 | |
| *** su_zhang has quit IRC | 20:59 | |
| *** su_zhang_ has joined #openstack-barbican | 21:01 | |
| woodster_ | alee: That CR from kfarr uses 256 bit keys with 'aes'...are you thinking that is what is causing issues though? | 21:05 |
| alee | woodster_, eh? | 21:06 |
| alee | woodster_, the issue was that the tempest test was asking for aes 512 | 21:06 |
| woodster_ | alee: just trying to catchup on that 512 bit issue...are you thinking this CR is introducing that bug?: https://review.openstack.org/#/c/251503/ | 21:06 |
| woodster_ | alee: oh got it, so not related to that CR then | 21:07 |
| alee | woodster_, it is related in the sense that before this fix, cinder was not passing parameters for bit size | 21:07 |
| alee | and so it was taking the default | 21:07 |
| alee | which was aes 256 | 21:08 |
| woodster_ | alee: ah got it, ok that makes sense then | 21:08 |
| alee | woodster_, now that kfarr fixed the cinder code to actually pass through what was asked for .. | 21:08 |
| alee | woodster_, we realized what was asked for was bogus | 21:08 |
| woodster_ | alee: yep, now it's revealing the problem that was masked before | 21:09 |
| kfarr | alee, woodster_ there's a bunch of underlying problems D: | 21:09 |
| alee | yes - not the least of which is that we dont test encryption with barbicaqn upstream | 21:10 |
| woodster_ | kfarr: none with barbican at least? :) Other than cryptic crypto logging? | 21:10 |
| alee | cryptic crypto indeed | 21:10 |
| kfarr | woodster_ ah, no, not barbican problems. | 21:10 |
| woodster_ | alee: you mean with real backends? Or integrated with other projects? | 21:10 |
| alee | integrated with other projects | 21:11 |
| alee | the only reason we found this was because RDO CI now runs the volume encryption test with barbican | 21:11 |
| woodster_ | alee: so less than 2% adoption rate on integration testing? | 21:11 |
| * woodster_ I did say that with a straight face | 21:13 | |
| *** shohel has joined #openstack-barbican | 21:14 | |
| *** martial_ has joined #openstack-barbican | 21:14 | |
| *** dimtruck is now known as zz_dimtruck | 21:21 | |
| *** zz_dimtruck is now known as dimtruck | 21:23 | |
| *** martial_ has left #openstack-barbican | 21:23 | |
| *** hockeynut has quit IRC | 21:31 | |
| *** su_zhang_ has quit IRC | 21:42 | |
| *** su_zhang has joined #openstack-barbican | 21:42 | |
| *** diazjf has quit IRC | 21:52 | |
| *** diazjf has joined #openstack-barbican | 21:54 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/barbican: Updated from global requirements https://review.openstack.org/352315 | 22:15 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/castellan: Updated from global requirements https://review.openstack.org/352316 | 22:15 |
| *** alee has quit IRC | 22:16 | |
| *** spotz is now known as spotz_zzz | 22:17 | |
| *** diazjf has quit IRC | 22:18 | |
| *** shohel has quit IRC | 22:19 | |
| *** dimtruck is now known as zz_dimtruck | 22:30 | |
| *** michauds has quit IRC | 22:36 | |
| *** alee has joined #openstack-barbican | 23:02 | |
| *** chlong has quit IRC | 23:03 | |
| *** kfarr has quit IRC | 23:19 | |
| *** randallburt1 has quit IRC | 23:44 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!