Tuesday, 2018-04-24

*** pcaruana has quit IRC00:02
*** rmascena__ has quit IRC00:25
*** tonyb has quit IRC00:33
*** tonyb has joined #openstack-barbican00:35
*** namnh has joined #openstack-barbican00:42
zhongjun_alee__ : Hi01:53
alee__zhongjun_, hi - starting the weekly meeting in a couple minutes01:57
zhongjun_alee__:  oh, enjoy your meeting01:59
alee__zhongjun_, you;re welcome to join if you like01:59
alee__its the barbican weekly meeting01:59
alee__#startmeeting barbican02:00
zhongjun_alee__: Which channel02:00
openstackMeeting started Tue Apr 24 02:00:24 2018 UTC and is due to finish in 60 minutes.  The chair is alee__. Information about MeetBot at http://wiki.debian.org/MeetBot.02:00
openstackUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.02:00
*** openstack changes topic to " (Meeting topic: barbican)"02:00
openstackThe meeting name has been set to 'barbican'02:00
alee__#topic roll call02:00
*** openstack changes topic to "roll call (Meeting topic: barbican)"02:00
alee__namnh?02:01
zhongjun_hi02:01
namnhalee__: hi alee02:01
alee__hi namnh zhongjun_02:02
namnhi am waitting the weekly meeting02:02
alee__this is it :)02:02
alee__in case you missed it, we moved the meeting to now02:03
namnhyes,02:03
alee__because afterthe change to daylight savings time, the time was a little too late in the steate02:03
alee__states02:03
alee__I dont see Jeremy though02:04
namnhyeah, it is still good to me02:04
alee__well -lets get started02:04
alee__#topic rocky02:05
*** openstack changes topic to "rocky (Meeting topic: barbican)"02:05
alee__milestone 1 build was released last week02:05
alee__I submitted the build on friday morning with dave's help02:05
alee__you probably noticed a bunch of patches meing merged at that time.02:06
alee__we're planning on doing some stable branch releases this week02:06
alee__as well as possibly some client releases02:06
alee__we're still  on track for our rocky deliverables ..02:07
alee__https://etherpad.openstack.org/p/barbican-tracker-rocky02:07
alee__although we want to try and get most of our features in by milestone 2 if we can02:08
alee__including the OVO patches02:08
alee__questions/comments on the rocky builds / schedule?02:08
alee__#topic PTG02:09
*** openstack changes topic to "PTG (Meeting topic: barbican)"02:09
alee__the next PTG is scheduled for september in denver IIRC02:10
alee__will either of you guys attend?02:10
alee__namnh, zhongjun_ ?02:11
namnhi'm not sure about whether i can join, it depends on my company02:11
namnhor TSP:)02:12
zhongjun_alee_ I cloud attend to next PTG02:12
alee__namnh, sure - I figured most folks would not know by now -- I just know that the cheaper "early bird pricing" is supposed to expire relatively early02:13
alee__like in the next few weeks02:13
alee__so good to sign up if you plan to attend02:13
alee__zhongjun_, good to know!02:13
alee__also helps me let them know how many will attend for barbican for planning purposes02:14
namnhalee__: sure, i will ask some guys in our company02:14
alee__cool02:14
alee__zhongjun_, perhaps a little intro -- I don't think I've seen you attend the weekly meeting before?02:15
zhongjun_I have a simple question02:15
alee__unless I forgot the nick02:15
zhongjun_yes02:16
zhongjun_This is my first time02:16
alee__zhongjun_, great - tell us a little about you, and what your interest in barbican is02:16
namnhzhongjun_: welcome to barbican team :)02:16
alee__and welcome :)02:16
zhongjun_I usually work on manila02:16
zhongjun_We are trying to use manila in huawei02:17
alee__ok - and you're trying to integrate using barbican with manila?02:18
zhongjun_But I am a new guy, and I don't know the detail about barbican02:19
zhongjun_alee__ : This is my patches:  https://review.openstack.org/#/q/owner:jun.zhongjun2%2540gmail.com+status:merged02:19
zhongjun_alee__ : Not sure now02:19
zhongjun_namnh:  thanks02:20
alee__great -- so how can we help you?02:20
namnhzhongjun_: cool, what is your question?02:21
zhongjun_In aws cloud, we have host key and data key. But in barbican, I only see the data key named secret02:22
zhongjun_Do we have the API to manage the key  and data key in barbican02:23
zhongjun_key:  https://docs.aws.amazon.com/kms/latest/APIReference/API_CreateKey.html02:23
zhongjun_datakey: https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html02:24
alee__zhongjun_, whats the difference between a host key and a data key?02:24
zhongjun_alee__:  We generate datakey by key.02:25
alee__zhongjun_, ok - I think I see what you are talking about02:25
alee__zhongjun_, so barbican has a fairly simple interface02:26
alee__zhongjun_, basically , you store, generate or retrieve a secret02:26
alee__and that secret could be some data, a password, or a key02:26
alee__now those secrets are stored in a back-end02:27
alee__and they are of course stored encrypted02:27
alee__the secrets are encrypted using a key encryption key02:27
alee__and if you use for instance the pkcs11 backend, they are stored encrypted by a tenant specific key encryption key02:28
alee__the kek usually never leaves the barbican system though02:28
alee__if you wanted to pre-encrypt you own keys using a kek the user could retrieve, you could do that, but you'd have to manage all of that02:29
alee__thats not in the api02:29
alee__does that make sens?02:30
alee__sense?02:30
zhongjun_So we don't have a API to manage  " a tenant specific key encryption key" like the aws does02:30
alee__zhongjun_, right02:31
zhongjun_It is up to the backend02:31
alee__zhongjun_, if you are using the pkcs11 plugin for instance, a tenant specific kek is automatically geerated when the first secret is stored y that tenant02:31
alee__correct02:32
alee__there is no need for the user to explicitly request -- or ever retrieve that kek02:32
zhongjun_Maybe the user want to use the same  tenant specific kek02:33
alee__zhongjun_, the barbican api is pretty simple.  right now users have no facility to manage their keks02:34
alee__zhongjun_, an interesting idea - which has come up before - would be add this kind of feature02:35
zhongjun_Do we have plan to implement the feature about support user to manage their keks02:35
alee__that is - take a small amount of data and a reference to a secret the user owns - and encrypt the secret with the kek02:35
alee__zhongjun_, there is no such ffeature currently planned02:36
zhongjun_Is there a link?02:36
alee__if you'd like to propose it, feel free to write a spec02:36
alee__zhongjun_, I'd have to check - not sure a spec was ever written for it02:36
zhongjun_okay, thanks, that make sense02:37
alee__if there is enough interest/ use case, we could certainly work to get it in02:37
zhongjun_got it02:38
alee__cool - anything else?02:38
zhongjun_not now02:38
alee__ok02:38
alee__#topic OVO patches02:38
*** openstack changes topic to "OVO patches (Meeting topic: barbican)"02:38
alee__namnh, I suggested that we do a google hangout to try and get the reviews on your patches going02:39
alee__since that has helped in the past in terms of getting series od patches approved02:39
alee__unfortunately neither dave nor jeremy are here02:40
alee__and it probably makes sense to do one collectively02:40
namnhalee__: it's ok to me. btw, i'd like to notify you about the status of OVO02:40
alee__please do02:40
namnhcurrenly, there two first patch set are really for reviewing02:41
namnhhttps://review.openstack.org/#/c/559014/02:41
namnhhttps://review.openstack.org/#/c/499004/02:41
namnhi am replacing each resource like secret, order, acl, etc to use OVO02:42
namnhon my local02:42
*** annp has quit IRC02:42
namnhmaybe, i will push a patch to replace ACL resource using OVO02:42
namnhtoday02:42
alee__are any of these new classes actually being used in the functional/unit tests?02:43
namnhyou can see it as an example02:43
alee__eh?02:44
namnhit must be, but currently, i am forcusing on changing UT to pass py2702:44
alee__sorry - just confirming -- in the reviews you listed above, when the various tests run, are they actually using the new OVO classes?02:45
alee__or is there some switch that needs to be toggled - or some further patches that need to land first?02:47
namnhas my plan, i will split two phases. Phase 1: I just only add files which have OVO class. Anh phase 2: i will replace barbican's resource (secret, order, container, ...) using OVO02:47
alee__gotcha - just confirming02:48
namnhso all of these patchs: https://review.openstack.org/#/q/topic:bp/rolling-upgrade+(status:open+OR+status:merged) for phase 0102:48
namnhand I am doing phase 2 on my local to get suitable OVO class02:49
namnhand for now. there are two patch set as i sent the link already for reviewing02:49
alee__namnh, ok -- in reviewing phase 1, then it would be useful for me to understand your methodology02:50
namnhyeah, that's what i mean.02:51
alee__ie. I'd like to gain some idea about what your procedure is for converting a barbican object - say secret or transport key02:51
alee__so that I can get a sense if what you are doing is correct02:51
alee__obviously there will be changes needed as you get to phase 202:51
alee__and the tests actually run against the objects02:52
alee__that what I was looking for mostly with a google hangout -- just a walkthrough02:52
alee__namnh, does that make sense?02:53
namnhyes, tomorrow is good to me02:53
*** annp has joined #openstack-barbican02:54
alee__namnh, ok - lets see if we can get a time when we get either dave or jeremy to join too02:54
alee__that way we can get all the needed reviewers to move this along02:54
alee__I worry that if we take too long, we wont get phase 2 in ..02:55
namnhi understood, i am trying my best02:55
alee__namnh, no worries - you're doing great -- I just dont want a lack of reviews to hold you up02:56
namnhbecause, I still have a feature in oslo.config, that why i don't update anything last weeek02:56
namnhalee__: thanks for understanding02:56
alee__namnh, ack  -- I know we're all wearing many hats :)02:57
namnh:)))02:57
alee__but I think your patches have not gotten reviews because people are scared of starting on them - and am hoping to kick start some reviews02:58
alee__so please send out an email and we can try to schedule a hangout02:58
alee__the time zone thing is tricky but we should be able to make something work.02:59
alee__#topic anything else?02:59
*** openstack changes topic to "anything else? (Meeting topic: barbican)"02:59
namnhthat's all to me03:00
namnh:)03:00
alee__namnh, zhongjun_ thanks for coming -- g'night !03:00
alee__or g'day   as it were ..03:00
alee__#endmeeting03:01
*** openstack changes topic to "Discussion about development of OpenStack Barbican and its client libraries. - Logs: http://eavesdrop.openstack.org/irclogs/%23openstack-barbican/"03:01
openstackMeeting ended Tue Apr 24 03:01:03 2018 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)03:01
openstackMinutes:        http://eavesdrop.openstack.org/meetings/barbican/2018/barbican.2018-04-24-02.00.html03:01
openstackMinutes (text): http://eavesdrop.openstack.org/meetings/barbican/2018/barbican.2018-04-24-02.00.txt03:01
openstackLog:            http://eavesdrop.openstack.org/meetings/barbican/2018/barbican.2018-04-24-02.00.log.html03:01
namnhalee__: :)) thanks03:01
namnhgood night to you, i am starting a new working day :))03:01
zhongjun_Thanks03:02
*** bkopilov has joined #openstack-barbican06:40
bkopilovHi Experts , a quick question . i have an openstack with barbican , when trying to create a sign image get :  - default default] Secret retrieval attempt not allowed - please review your user/project privileges: PolicyNotAuthorized: secret:get is disallowed by policy06:41
bkopilovHow can i fix it ?06:41
*** pcaruana has joined #openstack-barbican06:58
*** jaosorior has joined #openstack-barbican07:08
openstackgerritNam Nguyen Hoai proposed openstack/barbican master: [WIP] Replace ACL resource to use OVO  https://review.openstack.org/56385708:38
openstackgerritNam Nguyen Hoai proposed openstack/barbican master: [WIP] Replace ACL resource to use OVO  https://review.openstack.org/56385708:41
openstackgerritNam Nguyen Hoai proposed openstack/barbican master: [WIP] Replace Transport-key using OVO  https://review.openstack.org/56385808:41
*** jaosorior has quit IRC09:18
*** jaosorior has joined #openstack-barbican09:44
*** namnh has quit IRC09:54
*** annp has quit IRC10:29
*** annp has joined #openstack-barbican10:30
*** jaosorior has quit IRC10:43
*** annp has quit IRC10:46
*** pbourke has quit IRC11:18
*** pbourke has joined #openstack-barbican11:18
*** alee has joined #openstack-barbican11:37
*** alee__ has quit IRC11:39
*** jaosorior has joined #openstack-barbican11:48
*** abishop has joined #openstack-barbican11:52
*** raildo has joined #openstack-barbican12:08
*** zhongjun_ has quit IRC12:09
*** zhongjun_ has joined #openstack-barbican12:09
*** Kevin_Zheng has quit IRC12:11
*** Kevin_Zheng has joined #openstack-barbican12:12
*** jaosorior has quit IRC12:15
*** jaosorior has joined #openstack-barbican12:16
*** alee has quit IRC12:31
*** portdirect has quit IRC12:36
*** portdirect has joined #openstack-barbican12:37
*** Dmitrii-Sh has quit IRC12:37
*** Dmitrii-Sh has joined #openstack-barbican12:37
*** dave-mccowan has joined #openstack-barbican13:16
*** dave-mccowan has quit IRC13:21
*** dave-mccowan has joined #openstack-barbican13:22
*** alee has joined #openstack-barbican13:22
*** jmlowe has quit IRC13:27
*** jaosorior has quit IRC13:55
*** jaosorior has joined #openstack-barbican13:55
*** jaosorior has quit IRC14:07
*** zhongjun_ has quit IRC14:19
*** namnh has joined #openstack-barbican14:35
namnh alee, i just remember that tomorrow is public holiday in vietnam. so i propose the hangout will be changed to the next tomorrow (thursday). what do you think?14:53
aleenamnh, hey - must be late there!14:56
aleenamnh, sorry -- did you send an email out to the list already?14:57
aleeI idn;t see anything14:57
aleedave-mccowan, ping14:57
namnhalee: not yet,14:57
aleedave-mccowan, trying to set up a time for a google hangout to discuss namnh patches14:58
aleeand start the process going of getting them in14:58
namnhalee: you mean the hangout meeting will be the weekly meeting?14:58
aleenamnh, that was my original idea14:58
aleeas everyone would be there14:59
aleeif thats good for you we can try that -- that way hopefully jeremy will be there too14:59
dave-mccowanalee ok.  are you proposing next Monday?  or sometime sooner?15:00
namnhalee: sorry, i missed your idea :(15:00
aleedave-mccowan, namnh either way15:00
aleewhatever makes sense for you guys15:00
aleeif we want to get jeremy there, it might make sense to just schedule for next monday during the weekly meeting15:01
*** redrobot has joined #openstack-barbican15:02
*** redrobot is now known as Guest5042415:03
dave-mccowanalee 10pm EDT would be better for me.  (any night)15:03
namnhalee: the weekly meeting is 9.00 am at vietnam, so i think you can change the time earlier, it is more suitable for you15:03
aleedave-mccowan, namnh lets do next week during the regular meeting15:04
aleewhich is at 10pm EDT15:04
aleeearlier is actually trickier for me (getting kids to bed etc.)15:05
*** jaosorior has joined #openstack-barbican15:05
namnhalee: :))) got it.15:05
aleenamnh, please go ahead and send out an email so that interested parties can join.15:06
dave-mccowan10pm is OK... for some reason i thought it was 11.15:06
aleedave-mccowan, we changed it15:06
aleedave-mccowan, you're not reading your openstack-dev emails anymore :)15:06
namnhalee: summary, the hangout will be on 10 pm EDT15:08
alee(on Monday 30 April)15:08
namnhsure, i will send an email right now15:09
aleecool thanks15:09
dave-mccowanor 0200 UTC on Tuesday May 115:10
dave-mccowanalee, do you want to update http://git.openstack.org/cgit/openstack-infra/irc-meetings/tree/meetings/barbican-meeting.yaml15:10
aleedave-mccowan, yeah - let me do that before I forget ..15:11
*** Guest50424 has quit IRC15:12
*** redrobot has joined #openstack-barbican15:23
*** redrobot is now known as Guest9255115:24
*** Guest92551 is now known as redrobot15:25
*** pcaruana has quit IRC15:51
*** jmlowe has joined #openstack-barbican15:55
*** jmlowe has quit IRC15:59
*** pbourke has quit IRC16:04
*** pbourke has joined #openstack-barbican16:04
*** alee_ has joined #openstack-barbican16:22
*** alee has quit IRC16:26
openstackgerritNam Nguyen Hoai proposed openstack/barbican master: Implement OVO for Barbican [1]  https://review.openstack.org/49900416:28
openstackgerritNam Nguyen Hoai proposed openstack/barbican master: Initial OVO for Barbican  https://review.openstack.org/55901416:28
openstackgerritNam Nguyen Hoai proposed openstack/barbican master: [WIP] Implement OVO for Barbican [4]  https://review.openstack.org/52897216:29
openstackgerritNam Nguyen Hoai proposed openstack/barbican master: [WIP] Implement OVO for Barbican [3]  https://review.openstack.org/49941916:29
openstackgerritNam Nguyen Hoai proposed openstack/barbican master: [WIP] Replace Transport-key using OVO  https://review.openstack.org/56385816:31
openstackgerritNam Nguyen Hoai proposed openstack/barbican master: [WIP] Replace Transport-key using OVO  https://review.openstack.org/56385816:36
openstackgerritNam Nguyen Hoai proposed openstack/barbican master: [WIP] Replace secretstore and secretmeta using OVO  https://review.openstack.org/56402516:36
openstackgerritNam Nguyen Hoai proposed openstack/barbican master: [WIP] Replace Transport-key using OVO  https://review.openstack.org/56385816:43
*** pcaruana has joined #openstack-barbican16:43
openstackgerritNam Nguyen Hoai proposed openstack/barbican master: [WIP] Replace secretstore and secretmeta using OVO  https://review.openstack.org/56402516:43
openstackgerritNam Nguyen Hoai proposed openstack/barbican master: [WIP] Implement OVO for Barbican [5]  https://review.openstack.org/50024416:56
*** namnh has quit IRC17:21
*** jaosorior has quit IRC17:24
*** namnh has joined #openstack-barbican17:25
*** namnh has quit IRC17:30
*** namnh has joined #openstack-barbican17:31
*** namnh has quit IRC17:44
*** namnh has joined #openstack-barbican17:45
*** namnh has quit IRC17:55
*** bkopilov has quit IRC17:59
*** namnh has joined #openstack-barbican18:00
*** alee__ has joined #openstack-barbican18:05
*** alee_ has quit IRC18:08
*** namnh has quit IRC18:10
*** bkopilov has joined #openstack-barbican18:20
*** pcaruana has quit IRC18:32
*** diablo_rojo_ has joined #openstack-barbican18:38
*** dims has quit IRC19:02
*** fungi has joined #openstack-barbican19:03
fungialee__: in working on prepping for the storyboard migration, i noticed that the openstack/castellan repository is missing from https://git.openstack.org/cgit/openstack/governance/tree/reference/projects.yaml (is that an oversight?)19:07
*** dims has joined #openstack-barbican19:09
*** raildo has quit IRC20:34
*** raildo has joined #openstack-barbican20:34
alee__fungi, if you grep for castellan, you'll see that its been transferred to oslo control20:42
*** rmascena has joined #openstack-barbican20:44
*** raildo has quit IRC20:46
*** rmascena has quit IRC20:50
*** jmlowe has joined #openstack-barbican20:50
*** jmlowe has quit IRC20:52
*** abishop has quit IRC21:24
*** namnh has joined #openstack-barbican21:37
fungialee__: thanks! i totally did not think to check the rest of the projects.yaml for it, and so should have. sorry for the confusion21:49
*** alee__ has quit IRC22:03
*** namnh has quit IRC22:07
*** dave-mccowan has quit IRC22:15
*** alee__ has joined #openstack-barbican22:44
*** redrobot has quit IRC23:30

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!