| *** lixiaoy1 has quit IRC | 00:27 | |
| *** gyee has quit IRC | 00:28 | |
| *** su_zhang has quit IRC | 00:30 | |
| *** zz_dimtruck is now known as dimtruck | 00:51 | |
| *** dave-mccowan has quit IRC | 01:06 | |
| *** dimtruck is now known as zz_dimtruck | 01:08 | |
| *** chlong has joined #openstack-barbican | 01:19 | |
| *** dave-mccowan has joined #openstack-barbican | 01:29 | |
| *** jamielennox is now known as jamielennox|away | 01:50 | |
| *** jamielennox|away is now known as jamielennox | 02:00 | |
| *** diazjf has joined #openstack-barbican | 02:07 | |
| *** su_zhang has joined #openstack-barbican | 02:34 | |
| *** rm_work has quit IRC | 02:48 | |
| *** rm_work has joined #openstack-barbican | 02:52 | |
| *** ntpttr has quit IRC | 02:53 | |
| *** jamielennox is now known as jamielennox|away | 02:56 | |
| *** diazjf has quit IRC | 02:58 | |
| *** ntpttr has joined #openstack-barbican | 03:00 | |
| openstackgerrit | Cao Xuan Hoang proposed openstack/barbican: TrivialFix: Remove logging import unused https://review.openstack.org/360859 | 03:02 |
|---|---|---|
| *** jamielennox|away is now known as jamielennox | 03:10 | |
| openstackgerrit | Cao Xuan Hoang proposed openstack/barbican: TrivialFix: Remove cfg import unused https://review.openstack.org/360865 | 03:17 |
| *** chlong has quit IRC | 03:37 | |
| *** su_zhang has quit IRC | 03:49 | |
| *** su_zhang has joined #openstack-barbican | 03:49 | |
| *** su_zhang has quit IRC | 03:54 | |
| *** dave-mccowan has quit IRC | 04:09 | |
| *** chlong has joined #openstack-barbican | 04:10 | |
| *** su_zhang has joined #openstack-barbican | 04:15 | |
| *** jaosorior has joined #openstack-barbican | 04:46 | |
| *** su_zhang has quit IRC | 04:58 | |
| *** su_zhang has joined #openstack-barbican | 04:59 | |
| *** su_zhang has quit IRC | 05:03 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/barbican: Updated from global requirements https://review.openstack.org/352315 | 05:06 |
| *** chlong has quit IRC | 05:21 | |
| *** andreas_s has joined #openstack-barbican | 07:00 | |
| openstackgerrit | gengchc2 proposed openstack/castellan: Correct castellan reraising of exception https://review.openstack.org/360927 | 07:13 |
| *** jaosorior is now known as jaosorior_brb | 07:22 | |
| *** openstackgerrit has quit IRC | 08:18 | |
| *** openstackgerrit has joined #openstack-barbican | 08:18 | |
| *** jaosorior_brb is now known as jaosorior | 08:59 | |
| *** tkelsey has joined #openstack-barbican | 09:32 | |
| *** xek has joined #openstack-barbican | 09:47 | |
| *** xek has quit IRC | 09:47 | |
| *** xek has joined #openstack-barbican | 09:48 | |
| *** shohel has joined #openstack-barbican | 11:35 | |
| *** jaosorior has quit IRC | 11:53 | |
| *** jaosorior has joined #openstack-barbican | 11:54 | |
| *** woodster_ has joined #openstack-barbican | 12:34 | |
| *** nkinder has joined #openstack-barbican | 12:37 | |
| *** alee has quit IRC | 12:54 | |
| *** dave-mccowan has joined #openstack-barbican | 13:12 | |
| openstackgerrit | Pankaj Khandar proposed openstack/barbican: Remove consumer check for project_id to match containers https://review.openstack.org/251168 | 13:25 |
| *** shohel has quit IRC | 13:44 | |
| *** alee has joined #openstack-barbican | 13:55 | |
| *** zz_dimtruck is now known as dimtruck | 14:06 | |
| *** dimtruck is now known as zz_dimtruck | 14:16 | |
| *** su_zhang has joined #openstack-barbican | 14:18 | |
| *** michauds has joined #openstack-barbican | 14:18 | |
| *** randallburt has joined #openstack-barbican | 14:20 | |
| *** randallburt1 has joined #openstack-barbican | 14:22 | |
| *** randallburt has quit IRC | 14:24 | |
| *** zz_dimtruck is now known as dimtruck | 14:24 | |
| *** spotz_zzz is now known as spotz | 14:26 | |
| *** su_zhang has quit IRC | 14:28 | |
| *** su_zhang has joined #openstack-barbican | 14:29 | |
| *** chlong has joined #openstack-barbican | 14:32 | |
| *** su_zhang has quit IRC | 14:33 | |
| *** rhagarty has quit IRC | 14:45 | |
| *** andreas_s has quit IRC | 14:56 | |
| *** hockeynut has joined #openstack-barbican | 15:03 | |
| *** michauds has quit IRC | 15:27 | |
| *** pcaruana has quit IRC | 15:33 | |
| *** rm_mobile has joined #openstack-barbican | 15:45 | |
| *** michauds has joined #openstack-barbican | 15:58 | |
| *** jaosorior has quit IRC | 15:58 | |
| *** chlong has quit IRC | 16:07 | |
| *** edtubill has joined #openstack-barbican | 16:08 | |
| *** nkinder has quit IRC | 16:15 | |
| *** chlong has joined #openstack-barbican | 16:19 | |
| *** diazjf has joined #openstack-barbican | 16:20 | |
| diazjf | redrobot ping | 16:22 |
| redrobot | diazjf pong sucka! | 16:22 |
| diazjf | redrobot, wassup man! yo, have you ever seen an instance where Barbican eats up like 60% CPU outputs no logs, is still running, simple_crypto and regular queue. | 16:23 |
| redrobot | diazjf negative, I haven't done much with simple_crypto | 16:24 |
| redrobot | diazjf maybe arunkant has some insight? | 16:24 |
| diazjf | redrobot, ok I did swap out the pkcs-11 plugin for simple since I thought it may have been the HSM, but still had problems | 16:24 |
| diazjf | arunkant, redrobot, http://paste.openstack.org/show/564020/ | 16:25 |
| *** hockeynut has quit IRC | 16:28 | |
| arunkant | diazjf, how are you running uwsgi..is it using nginx for webserver ? Are there 11 instances of uwsgi worker processes? | 16:29 |
| diazjf | arunkant webserver, we should only have 8 which are child and 2 master. | 16:32 |
| *** dimtruck is now known as zz_dimtruck | 16:34 | |
| *** david-lyle has joined #openstack-barbican | 16:36 | |
| diazjf | arunkant behavior only happens in 1/3 nodes, same deploy | 16:37 |
| *** tkelsey has quit IRC | 16:39 | |
| *** nkinder has joined #openstack-barbican | 16:46 | |
| arunkant | diazjf : sorry..got distracted..not sure why cpu is taking as there is nothing much cpu intensive logic in barbican. Are you using threads by any chance? | 16:47 |
| arunkant | diazjf: nothing else ring bells ..you may want to isolate whether cpu is taking time in user code or kernel calls. I think there is way to check that. | 16:49 |
| arunkant | redrobot: ping .. | 16:55 |
| diazjf | arunkant, thanks man. I'll keep debugging | 17:00 |
| *** chlong has quit IRC | 17:02 | |
| *** su_zhang has joined #openstack-barbican | 17:03 | |
| openstackgerrit | Pankaj Khandar proposed openstack/barbican: Remove consumer check for project_id to match containers https://review.openstack.org/251168 | 17:03 |
| *** nkinder has quit IRC | 17:04 | |
| *** diazjf has quit IRC | 17:06 | |
| *** diazjf has joined #openstack-barbican | 17:16 | |
| *** zz_dimtruck is now known as dimtruck | 17:37 | |
| *** rm_mobile has quit IRC | 17:46 | |
| *** rm_mobile has joined #openstack-barbican | 17:46 | |
| *** rm_mobile has quit IRC | 17:46 | |
| *** rm_mobile has joined #openstack-barbican | 17:46 | |
| *** diazjf has quit IRC | 18:03 | |
| *** rm_mobile has quit IRC | 18:13 | |
| *** ntpttr has quit IRC | 18:27 | |
| *** ntpttr has joined #openstack-barbican | 18:28 | |
| *** ntpttr has quit IRC | 18:28 | |
| *** ntpttr- has joined #openstack-barbican | 18:28 | |
| *** phschwartz has quit IRC | 18:31 | |
| *** tkelsey has joined #openstack-barbican | 18:36 | |
| *** su_zhang has quit IRC | 18:40 | |
| *** tkelsey has quit IRC | 18:41 | |
| *** phschwartz has joined #openstack-barbican | 18:58 | |
| *** su_zhang has joined #openstack-barbican | 19:11 | |
| *** su_zhang has quit IRC | 19:16 | |
| *** michauds has quit IRC | 19:18 | |
| *** michauds has joined #openstack-barbican | 19:18 | |
| *** alee has quit IRC | 19:19 | |
| *** michauds has quit IRC | 19:22 | |
| *** michauds has joined #openstack-barbican | 19:23 | |
| *** spotz is now known as spotz_zzz | 19:32 | |
| *** jraim has quit IRC | 20:02 | |
| *** su_zhang has joined #openstack-barbican | 20:03 | |
| *** su_zhang has quit IRC | 20:08 | |
| *** alee has joined #openstack-barbican | 20:08 | |
| *** su_zhang has joined #openstack-barbican | 20:17 | |
| *** randallburt1 has quit IRC | 20:22 | |
| *** su_zhang has quit IRC | 20:27 | |
| *** jraim has joined #openstack-barbican | 20:35 | |
| *** edtubill has quit IRC | 20:50 | |
| *** spotz_zzz is now known as spotz | 20:55 | |
| redrobot | arunkant pong | 20:57 |
| arunkant | redrobot : Hi doug.. I have question about procedure for getting exception for multiple backend reviews ..looks like newton feature freeze is on Aug 29 | 20:59 |
| openstackgerrit | Merged openstack/barbican: Updated from global requirements https://review.openstack.org/352315 | 20:59 |
| redrobot | arunkant Yeah, I think we may need one | 20:59 |
| redrobot | arunkant I'll look into it | 20:59 |
| arunkant | redrobot: All of the reviews are ready. It may still will take some time to get it reviewed though. | 21:00 |
| redrobot | arunkant looks like the first patch is failing the gate: https://review.openstack.org/#/c/348092/ | 21:01 |
| redrobot | arunkant the other patches won't be able to land until that one passes since they depend on it | 21:01 |
| arunkant | redrobot: thanks. I have also added same item in next weeks meeting agenda . | 21:02 |
| arunkant | redrobot: I think its a temporary failure as it was passing earlier. If i remember execution was killed ..will check logs again. | 21:03 |
| redrobot | arunkant try a manual recheck, if not it's not going to get re-tested | 21:03 |
| arunkant | redrobot: okay ..just did it.. it was some random failure.. | 21:05 |
| *** su_zhang has joined #openstack-barbican | 21:17 | |
| *** su_zhang has quit IRC | 21:22 | |
| *** su_zhang has joined #openstack-barbican | 21:27 | |
| woodster_ | Just noticed that the secret store crypto adapter doesn't extend the secret store class!: https://github.com/openstack/barbican/blob/master/barbican/plugin/store_crypto.py#L50 | 21:40 |
| woodster_ | redrobot: arunkant alee ^^^^ | 21:40 |
| woodster_ | duck (tape) typing saves the day | 21:41 |
| arunkant | woodster_ : yes..its special type of secret store plugin..adapter..which has its own plugin for crypto operations , different from store operation | 21:43 |
| woodster_ | arunkant: it should extend the secret store base like this one though: https://github.com/openstack/barbican/blob/master/barbican/plugin/kmip_secret_store.py#L142 | 21:44 |
| arunkant | woodster_ : kmip plugin , similar to dogtage kra plugin, does not have any separate crypto operations. All of its SecretStore API operations are self-contained . | 21:47 |
| woodster_ | arunkant: store_crypto is an adapter between the higher level secret store plugins (KMIP, Dogtag are examples), and the lower level 'crypto' plugins (HSM, insecure software plugin). This call is what loads and locates those types of plugins: https://github.com/openstack/barbican/blob/master/barbican/plugin/store_crypto.py#L76 | 21:49 |
| arunkant | woodster_ , yes . In KMIP and dogtag , there is no separate encryption plugin used/needed . So we don't have similar plugin invoked when storing or reading it back. | 21:52 |
| woodster_ | arunkant: my only point is that the store_crypto.py#L50 class above is a secret store class, that should extend the base one. It also needs to override the get_plugin_name() method you are adding, and then delegate to the lower level crypto plugin to get its plugin name. This is the part that was tricky the last time we spoke, as there can currently only be | 21:56 |
| woodster_ | one store crypto adapter class, and one crypto plugin. So with the current code you can have BOTH a PKCS11 AND a software-only plugin | 21:56 |
| *** su_zhang has quit IRC | 22:02 | |
| arunkant | woodster_ : So far, I see through there is logic to create crypto context for adapter plugins as they have additional functionality which is not there in base secret store plugins..e.g.https://github.com/openstack/barbican/blob/master/barbican/plugin/resources.py#L270 | 22:03 |
| woodster_ | arunkant: that's correct...they need more support to work as they are lower level...they don't store secrets for themselves, they rely on barbican to do that | 22:04 |
| *** su_zhang has joined #openstack-barbican | 22:05 | |
| woodster_ | arunkant: so if you want both a PKCS11 and a software plugin installed (for example) you probably need to change things. Somehow you need to tell the secret store crypto adapter to use a specific crypto plugin I'd think. Maybe you've already crossed that bridge though | 22:06 |
| arunkant | woodster_ : I don't have strong preference either way.. I can see the argument to have adapter kind of approach instead of direct sub-classing SecretStoreBase because of their differences in functionality | 22:06 |
| woodster_ | arunkant: well technically that IS a secret store implementation, so it really should in the current implementation extend that base class. That's independent of the multi-backend changes you want to put in | 22:07 |
| arunkant | woodster_ , yes, in multiple backend changes, that's why when we store secret store data..we store both plugin information i.e. store plugin and crypto_plugin | 22:08 |
| arunkant | So even if store plugin is same for PKCS and software only plugin, we can find out which crypto plugin to use based on mapping data available in secret_stores table | 22:09 |
| arunkant | woodster_ , I am talking about project level preference ..not in secrets side metadata. That is same as earlier. | 22:10 |
| woodster_ | arunkant: so your part 3 CR addresses that then? At the end of the day, if you can test that both the PCKS11 and the simple crytpo plugins work at the same time, that's cool | 22:11 |
| woodster_ | arunkant: I mean part 3 appears to address that...not a question sorry | 22:12 |
| arunkant | woodster_ : yes it does..there are unit tests around that https://review.openstack.org/#/c/357544/3/barbican/tests/plugin/util/test_multiple_backends.py ( line 366 onwards) | 22:13 |
| woodster_ | arunkant: I still don't see how the plugin name could be coming from the crypto adapter plugin though. I'd think you need to add your method at line 362 here: https://review.openstack.org/#/c/354285/10/barbican/plugin/interface/secret_store.py ...to the crypto adapter plugin here: | 22:19 |
| woodster_ | https://github.com/openstack/barbican/blob/master/barbican/plugin/store_crypto.py#L50 | 22:19 |
| woodster_ | arunkant: said another way, how is line #58 here getting invoked?: https://review.openstack.org/#/c/354285/10/barbican/plugin/crypto/simple_crypto.py | 22:20 |
| arunkant | woodster_ , name comes from this logic ..https://review.openstack.org/#/c/357544/3/barbican/plugin/util/multiple_backends.py (line 160-162) . If secret store does not plugin name (which is the case for adapter plugin)..it uses crypto plugin name | 22:22 |
| woodster_ | arunkant: ah ok I htink I got it...that's some stout logic in that file | 22:23 |
| woodster_ | arunkant: so you've gotten pkcs11 and simple crypto running at the same time in the same instance then? sounds cool | 22:24 |
| *** michauds has quit IRC | 22:25 | |
| arunkant | woodster_ , yes, I have verified via running functional tests in local environment against db and kmip device ..will further check by adding pkcs11 in mix next week | 22:26 |
| *** dimtruck is now known as zz_dimtruck | 22:27 | |
| woodster_ | arunkant: sounds cool thanks | 22:48 |
| *** spotz is now known as spotz_zzz | 23:03 | |
| *** jraim has quit IRC | 23:09 | |
| *** su_zhang has quit IRC | 23:51 | |
| *** su_zhang has joined #openstack-barbican | 23:56 | |
| *** su_zhang has quit IRC | 23:56 | |
| *** su_zhang has joined #openstack-barbican | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!