| *** noslzzp has joined #openstack-barbican | 00:37 | |
| *** hieulq has joined #openstack-barbican | 00:43 | |
| *** noslzzp has quit IRC | 01:29 | |
| *** noslzzp has joined #openstack-barbican | 01:30 | |
| *** liujiong has joined #openstack-barbican | 01:46 | |
| *** namnh has joined #openstack-barbican | 02:21 | |
| openstackgerrit | Dave McCowan proposed openstack/barbican master: Fix Race Condition in get_or_create_project() https://review.openstack.org/514103 | 02:23 |
|---|---|---|
| *** dave-mccowan has quit IRC | 03:05 | |
| *** hieulq has quit IRC | 03:23 | |
| *** hieulq has joined #openstack-barbican | 03:23 | |
| *** jaosorior has joined #openstack-barbican | 05:02 | |
| *** nickFro has joined #openstack-barbican | 06:29 | |
| *** nickFro has quit IRC | 06:36 | |
| *** nickFro has joined #openstack-barbican | 07:00 | |
| *** pcaruana has joined #openstack-barbican | 07:00 | |
| *** serlex has joined #openstack-barbican | 07:02 | |
| nickFro | Time | 07:03 |
| nickFro | :time | 07:03 |
| *** nickFro has quit IRC | 07:16 | |
| openstackgerrit | Nam Nguyen Hoai proposed openstack/barbican master: Migrate to Zuul v3 https://review.openstack.org/509348 | 08:40 |
| openstackgerrit | Merged openstack/barbican master: Fix Race Condition in get_or_create_project() https://review.openstack.org/514103 | 09:10 |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/barbican master: Use oslo.messaging's filter_rule for keystone notificatoins https://review.openstack.org/514201 | 09:51 |
| openstackgerrit | Juan Antonio Osorio Robles proposed openstack/barbican master: Use oslo.messaging's filter_rule for keystone notifications https://review.openstack.org/514201 | 09:57 |
| *** liujiong has quit IRC | 09:58 | |
| *** liujiong has joined #openstack-barbican | 09:59 | |
| *** liujiong has quit IRC | 10:20 | |
| *** namnh has quit IRC | 10:22 | |
| *** pbourke has quit IRC | 10:37 | |
| *** pbourke has joined #openstack-barbican | 10:39 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/barbican master: Updated from global requirements https://review.openstack.org/511098 | 10:55 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/castellan master: Updated from global requirements https://review.openstack.org/511100 | 10:55 |
| *** dave-mccowan has joined #openstack-barbican | 11:03 | |
| *** raildo has joined #openstack-barbican | 12:13 | |
| *** raildo has quit IRC | 12:13 | |
| *** raildo has joined #openstack-barbican | 12:20 | |
| *** pcaruana has quit IRC | 12:41 | |
| openstackgerrit | Murali Annamneni proposed openstack/barbican master: Use oslo.db options for database sync and upgrade https://review.openstack.org/463865 | 14:07 |
| *** jaosorior has quit IRC | 14:08 | |
| *** namnh has joined #openstack-barbican | 14:18 | |
| *** peter-hamilton has joined #openstack-barbican | 14:44 | |
| *** jaosorior has joined #openstack-barbican | 14:57 | |
| *** agrebennikov has joined #openstack-barbican | 15:44 | |
| *** salmankhan has joined #openstack-barbican | 16:35 | |
| *** jaosorior has quit IRC | 16:35 | |
| *** jaosorior has joined #openstack-barbican | 16:36 | |
| *** salmankhan has quit IRC | 16:39 | |
| *** serlex has quit IRC | 16:58 | |
| *** rmascena has joined #openstack-barbican | 17:28 | |
| *** raildo has quit IRC | 17:30 | |
| *** abishop has joined #openstack-barbican | 17:35 | |
| abishop | dave-mccowan: do you recall our earlier discussion (mostly on openstack-dev list) of the cinder/nova ConfKeyManager? | 17:47 |
| dave-mccowan | hi abishop. yes | 17:51 |
| abishop | so I have another idea ;-) | 17:51 |
| abishop | I understand the concern that you and kfarr expressed about adding ConfKeyManager to Castellan | 17:51 |
| abishop | but I will need a way to solve the user's problem of how to migrate from the ConfKeyManager to Barbican without disrupting service | 17:52 |
| abishop | I have a WPI that basically provides a read-only "migration" layer so that requests for the all-zeros key ID return the value that would be returned by the ConfKeyManager | 17:53 |
| abishop | rather than trying to describe, I thought I might toss it up for a WIP review and see if it addresses your concerns | 17:54 |
| dave-mccowan | sure, that sounds good. | 17:55 |
| abishop | so I guess this is not much more than a heads-up, but I do want to keep searching for a workable solution | 17:55 |
| abishop | will add kfarr, too (don't see her often on irc) | 17:56 |
| abishop | separate topic, but do you know who is familiar with the Barbican policy stuff that controls the ability to create secrets? | 17:57 |
| dave-mccowan | i'll take a look. i certainly think your migration feature is super important, so i'm sure we'll find the appropriate solution. | 17:58 |
| abishop | cool, thx | 17:58 |
| dave-mccowan | abishop it's pretty well documented. i'll find a link, unless you have a specific question. | 17:58 |
| abishop | the 2nd topic is the cinder code I hope will be able to create a new barbican key for each entry in its volumes and snapshots tables | 17:59 |
| abishop | but I don't think the "cinder" user is able to create barbican keys | 17:59 |
| abishop | first hack at some code failed due to auth error when trying to create a key order | 18:00 |
| dave-mccowan | my recollection is that cinder passes through the user's credentials | 18:00 |
| abishop | sure, when doing so on behalf of a user request | 18:01 |
| abishop | this would be cinder itself trying to create keys, as it attempts to replace old all-zeros confkeys with new Barbican key IDs | 18:01 |
| *** namnh has quit IRC | 18:03 | |
| dave-mccowan | sorry, getting pulled away. back in an hour | 18:04 |
| abishop | k, thx | 18:04 |
| *** salmankhan has joined #openstack-barbican | 18:20 | |
| *** namnh has joined #openstack-barbican | 19:03 | |
| dave-mccowan | abishop ping | 19:06 |
| abishop | dave-mccowan: hey | 19:07 |
| dave-mccowan | Barbican permissions are done by project. The default method is role based (RBAC). The four roles are Admin, Creator, Observer, Auditor. Admin and Creator roles have permissions to create secrets for a project. | 19:08 |
| *** namnh has quit IRC | 19:08 | |
| dave-mccowan | So, if a project owner wants to give the cinder user permission to write secrets for his project, he'd do a "openstack role add" to assign the "cinder" user the role of "creator" in project "foo". | 19:09 |
| dave-mccowan | i think that covers your use case. | 19:09 |
| abishop | hmm, interesting | 19:10 |
| dave-mccowan | Another access method is via ACL, but that only works for giving read access to secrets. | 19:10 |
| abishop | can an ACL also grant ability to delete a secret? | 19:10 |
| dave-mccowan | The third method is to customize the policy.json file, which is not really the way things should be done. | 19:10 |
| dave-mccowan | ACLs have only been implemented for read access so far. | 19:11 |
| abishop | yuck, that's an issue considering we're trying to find a way to essentially create barbican keys on behalf of someone else (the user associated with a volume) | 19:12 |
| abishop | kfarr showed a WIP script that created the barbican key as an admin, and then added an acl for the volume's owner | 19:13 |
| abishop | but cinder wants to delete the key when the volume is deleted | 19:13 |
| abishop | and it sounds like ACL won't allow for that | 19:13 |
| dave-mccowan | abishop RBAC would allow for that. if cinder is given the role of admin for a project, then cinder can create, read, and delete secrets for that project. any user with a role of admin, creator, or observer in the project would also be able to read that secret. | 19:24 |
| dave-mccowan | (giving a service account (cinder) admin privileges for a project might give some heartburn, which is why we added ACLs. | 19:24 |
| dave-mccowan | if cinder needs create and delete privileges, and the user needs read privileges, then ACLS. work. The secrets would be part of the Cinder project, and the user could be given read-only access via ACL. | 19:26 |
| abishop | dave-mccowan: but I don't think that fits the use case. volumes are deleted as requested by a user, and so the key deletion would happen in that context | 19:27 |
| abishop | so if we made the cinder user an admin, it could create barbican keys that are being migrated, but after that it will be the user who provides the context for volume (and key) deletion | 19:28 |
| dave-mccowan | abishop with that case, cinder would need be an admin in potentially several projects. it would need to know which project to create the context for when storing new secrets. | 19:30 |
| abishop | I think it may have that info, but I'm not familiar with how an admin-like cinder user could create a context for another user | 19:31 |
| dave-mccowan | abishop what triggers the migration? if it is an API call from a user, then the provided auth context could be used to create the migrated secrets. | 19:31 |
| abishop | I've read some that suggests it's possible, but I've never seen any details | 19:31 |
| abishop | well, we were hoping to have a cinder thread search for keys to migrate and doing them all | 19:32 |
| abishop | so no user trigger | 19:32 |
| dave-mccowan | lol. it's as if we're trying to find an exploit to hack through barbican's authentication methods. | 19:34 |
| dave-mccowan | it seems we need an action on the user to some extent. if not to request the migration, then to give cinder permissions (assigned role) to do so on its behalf. | 19:35 |
| abishop | yeah, I fear we're trying to do something that's explicitly thwarted | 19:35 |
| abishop | even the idea of giving cinder extra privs will probably give someone the cramps | 19:36 |
| abishop | how ugly would it be to enhance acl to allow user to delete a key that was created by the "cinder" user? | 19:37 |
| dave-mccowan | abishop pretty clean actually. the api is in place, just need to fill in the details, which can be reasonably extrapolated from read ACL code. | 19:39 |
| abishop | cool | 19:40 |
| abishop | the more I think about it, though, the more I think that having cinder (as the "cinder" user) create the keys may be problemattic | 19:41 |
| abishop | kfarr's script would do it as the admin, so there's no need to enhance the cinder user's privs | 19:42 |
| dave-mccowan | abishop seems like the secrets would be owned by cinder's project, for which it would already be an admin. | 19:45 |
| abishop | dave-mccowan: I'm probably not coding the incantation correctly when I tried having the cinder user create a key | 19:46 |
| dave-mccowan | abishop (i assume cinder has a project... i don't know how that works... if each service has their own project, or if the all share the "admin" project, not to be confused with "admin" role or "admin" username) | 19:47 |
| abishop | I'm afraid I don't have much experience with this stuff | 19:47 |
| dave-mccowan | abishop i can look to see what devstack does, but not sure if that will be universal. | 19:48 |
| abishop | dave-mccowan: well, it would be great if I can learn what devstack does as it might provide a pattern I could follow | 19:48 |
| abishop | (btw, it will be a while before I can post that WIP for handling all-zeros key ID. I roached the VM on which I prototyped the code) | 19:49 |
| dave-mccowan | abishop i have a tiny devstack up now, only with barbican and keystone running. The "barbican" user has the "admin" role in the "service" project. | 19:52 |
| dave-mccowan | i would guess that cinder runs with the same role. i can check the next time i start up a bigger deployment. | 19:53 |
| abishop | dave-mccowan: I'll see what I can learn once I finish rebuilding my own devstack | 19:54 |
| dave-mccowan | "openstack role assignment list --user cinder" will tell us what we start with. | 19:55 |
| abishop | thx for tip; good stuff for me to learn | 19:56 |
| *** salmankhan has quit IRC | 20:05 | |
| *** namnh has joined #openstack-barbican | 20:05 | |
| *** namnh has quit IRC | 20:09 | |
| *** salmankhan has joined #openstack-barbican | 20:15 | |
| *** peter-hamilton has quit IRC | 20:31 | |
| *** salmankhan has quit IRC | 20:44 | |
| *** rmascena has quit IRC | 20:50 | |
| *** dave-mccowan has quit IRC | 21:28 | |
| *** namnh has joined #openstack-barbican | 22:07 | |
| *** namnh has quit IRC | 22:11 | |
| *** dave-mccowan has joined #openstack-barbican | 22:49 | |
| *** ssathaye has quit IRC | 23:12 | |
| *** ssathaye has joined #openstack-barbican | 23:13 | |
| *** agrebennikov has quit IRC | 23:19 | |
| *** dave-mccowan has quit IRC | 23:27 | |
| *** namnh has joined #openstack-barbican | 23:56 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!