| openstackgerrit | Luigi Toscano proposed openstack/barbican stable/queens: Make broken fedora_latest job n-v https://review.opendev.org/695327 | 00:46 |
|---|---|---|
| openstackgerrit | Luigi Toscano proposed openstack/barbican stable/queens: Don't use branch matching https://review.opendev.org/689463 | 00:46 |
| openstackgerrit | Luigi Toscano proposed openstack/barbican stable/queens: Fix the bug of pep8 and building api-guide https://review.opendev.org/697210 | 00:46 |
| *** tosky has quit IRC | 00:56 | |
| openstackgerrit | Merged openstack/barbican master: Fix the barbicanclient installation not from source https://review.opendev.org/690123 | 01:03 |
| openstackgerrit | Luigi Toscano proposed openstack/barbican stable/train: Fix the barbicanclient installation not from source https://review.opendev.org/697212 | 01:07 |
| *** dpawlik has joined #openstack-barbican | 01:40 | |
| *** dpawlik has quit IRC | 01:45 | |
| *** jmlowe has quit IRC | 04:37 | |
| *** jmlowe has joined #openstack-barbican | 04:40 | |
| *** dave-mccowan has quit IRC | 05:14 | |
| *** dpawlik has joined #openstack-barbican | 05:42 | |
| *** dpawlik has quit IRC | 05:47 | |
| *** pcaruana has joined #openstack-barbican | 06:01 | |
| *** dpawlik has joined #openstack-barbican | 06:45 | |
| *** Luzi has joined #openstack-barbican | 06:53 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/barbican master: Imported Translations from Zanata https://review.opendev.org/694482 | 07:54 |
| *** dpawlik has quit IRC | 08:01 | |
| *** awalende has joined #openstack-barbican | 08:15 | |
| *** spotz has quit IRC | 08:23 | |
| *** pcaruana has quit IRC | 08:24 | |
| *** irclogbot_3 has quit IRC | 08:24 | |
| *** efried has quit IRC | 08:24 | |
| *** aspiers has quit IRC | 08:24 | |
| *** jmccrory has quit IRC | 08:24 | |
| *** strigazi has quit IRC | 08:24 | |
| *** jmlowe has quit IRC | 08:24 | |
| *** njohnston has quit IRC | 08:24 | |
| *** beisner has quit IRC | 08:24 | |
| *** gregwork has quit IRC | 08:24 | |
| *** ade_lee has quit IRC | 08:24 | |
| *** trident has quit IRC | 08:24 | |
| *** openstackgerrit has quit IRC | 08:24 | |
| *** cmurphy has quit IRC | 08:24 | |
| *** mmethot has quit IRC | 08:24 | |
| *** Anticimex has quit IRC | 08:24 | |
| *** coreycb has quit IRC | 08:24 | |
| *** knikolla has quit IRC | 08:24 | |
| *** awalende has quit IRC | 08:24 | |
| *** tinwood has quit IRC | 08:24 | |
| *** moguimar has quit IRC | 08:24 | |
| *** lxkong has quit IRC | 08:24 | |
| *** jamespage has quit IRC | 08:24 | |
| *** gmann has quit IRC | 08:24 | |
| *** Luzi has quit IRC | 08:24 | |
| *** tonyb has quit IRC | 08:24 | |
| *** timburke has quit IRC | 08:24 | |
| *** andreaf has quit IRC | 08:24 | |
| *** johnsom has quit IRC | 08:24 | |
| *** kklimonda has quit IRC | 08:24 | |
| *** redrobot has quit IRC | 08:24 | |
| *** mnaser has quit IRC | 08:24 | |
| *** rm_work has quit IRC | 08:24 | |
| *** awalende has joined #openstack-barbican | 08:24 | |
| *** Luzi has joined #openstack-barbican | 08:24 | |
| *** pcaruana has joined #openstack-barbican | 08:24 | |
| *** jmlowe has joined #openstack-barbican | 08:24 | |
| *** ade_lee has joined #openstack-barbican | 08:24 | |
| *** trident has joined #openstack-barbican | 08:24 | |
| *** njohnston has joined #openstack-barbican | 08:24 | |
| *** cmurphy has joined #openstack-barbican | 08:24 | |
| *** tinwood has joined #openstack-barbican | 08:24 | |
| *** kklimonda has joined #openstack-barbican | 08:24 | |
| *** gregwork has joined #openstack-barbican | 08:24 | |
| *** beisner has joined #openstack-barbican | 08:24 | |
| *** spotz has joined #openstack-barbican | 08:24 | |
| *** moguimar has joined #openstack-barbican | 08:24 | |
| *** openstackgerrit has joined #openstack-barbican | 08:24 | |
| *** tonyb has joined #openstack-barbican | 08:24 | |
| *** mmethot has joined #openstack-barbican | 08:24 | |
| *** redrobot has joined #openstack-barbican | 08:24 | |
| *** irclogbot_3 has joined #openstack-barbican | 08:24 | |
| *** efried has joined #openstack-barbican | 08:24 | |
| *** lxkong has joined #openstack-barbican | 08:24 | |
| *** jamespage has joined #openstack-barbican | 08:24 | |
| *** knikolla has joined #openstack-barbican | 08:24 | |
| *** coreycb has joined #openstack-barbican | 08:24 | |
| *** Anticimex has joined #openstack-barbican | 08:24 | |
| *** aspiers has joined #openstack-barbican | 08:24 | |
| *** jmccrory has joined #openstack-barbican | 08:24 | |
| *** gmann has joined #openstack-barbican | 08:24 | |
| *** andreaf has joined #openstack-barbican | 08:24 | |
| *** strigazi has joined #openstack-barbican | 08:24 | |
| *** timburke has joined #openstack-barbican | 08:24 | |
| *** mnaser has joined #openstack-barbican | 08:24 | |
| *** rm_work has joined #openstack-barbican | 08:24 | |
| *** johnsom has joined #openstack-barbican | 08:24 | |
| *** dpawlik has joined #openstack-barbican | 08:28 | |
| *** ivve has joined #openstack-barbican | 08:36 | |
| *** tosky has joined #openstack-barbican | 09:00 | |
| *** dpawlik has quit IRC | 09:49 | |
| *** dpawlik has joined #openstack-barbican | 10:02 | |
| *** tosky has quit IRC | 10:21 | |
| *** tosky has joined #openstack-barbican | 10:21 | |
| *** Luzi has quit IRC | 10:38 | |
| *** dpawlik has quit IRC | 11:19 | |
| *** dpawlik has joined #openstack-barbican | 11:51 | |
| *** raildo has joined #openstack-barbican | 12:35 | |
| *** dpawlik has quit IRC | 13:10 | |
| *** dpawlik has joined #openstack-barbican | 13:13 | |
| *** spotz has quit IRC | 14:04 | |
| *** spotz has joined #openstack-barbican | 14:09 | |
| efried | o/ barbican! | 14:11 |
| efried | redrobot, rm_work: qq: if $user creates a key, is it possible (to set policy) for admin to delete it? | 14:12 |
| efried | on the theory that, if $user vanishes from existence, admin needs to be able to clean up. | 14:13 |
| *** spotz has quit IRC | 14:13 | |
| redrobot | efried, secrets are owned by the project, not the user, so a project-scoped-admin _should_ be able to delete keys that any user made in that project. | 14:15 |
| efried | wait, secrets are owned by a project? That's... weird. | 14:16 |
| efried | and is that a barbican statement or a keymgr statement? | 14:16 |
| efried | I guess in that case a project-scoped admin would be able to *see* such keys as well, eh? | 14:16 |
| redrobot | efried, that's the general case for Barbican, as it uses Keystone for AuthZ/AuthN | 14:17 |
| redrobot | efried, as far as Castellan goes, it depends on the backend, and what context is being passed into it. | 14:18 |
| redrobot | and yeah, a project-scoped-admin would be able to see/retrieve all secrets in that project | 14:18 |
| efried | Okay, so there's nothing in castellan that's doing auth/policy enforcement inherently, a random backend would be able to make its own rules | 14:19 |
| efried | for example: only $user can retrieve, but $user or admin can delete. | 14:19 |
| *** spotz has joined #openstack-barbican | 14:19 | |
| redrobot | efried, right... the barbicanclient backend uses whatever context was passed in, but the Vault backend uses only the auth info in the conf file, so everything is owned by that | 14:20 |
| efried | redrobot: in the barbican case, are the operations (get vs delete) individually controlled by policy? | 14:21 |
| efried | though I guess given what you've said, even in that case there's no way to scope to the user | 14:22 |
| efried | so it wouldn't help to (ugh) create a project with one user and an admin. | 14:23 |
| tosky | (in a unrelated news, https://review.opendev.org/#/c/690123/ merged \o/ and I started with the backports: https://review.opendev.org/#/c/697212/ ) | 15:14 |
| *** jaosorior has joined #openstack-barbican | 15:14 | |
| *** dave-mccowan has joined #openstack-barbican | 15:21 | |
| *** dave-mccowan has quit IRC | 15:26 | |
| *** ivve has quit IRC | 15:33 | |
| *** awalende_ has joined #openstack-barbican | 15:43 | |
| *** awalende has quit IRC | 15:46 | |
| *** awalende_ has quit IRC | 15:48 | |
| *** awalende has joined #openstack-barbican | 16:12 | |
| *** awalende has quit IRC | 16:16 | |
| *** jaosorior has quit IRC | 17:23 | |
| rm_work | efried: right, yes it's all normal Oslo policy scoped if you're using keystone contexts and there are the full set of roles to control create/delete/read and also I believe the ability to actually decrypt the payload is separate from reading the secret metadata, but as with all keystone authed stuff, it is project based | 18:48 |
| rm_work | Unless I'm missing something, I didnt think Openstack really allowed for user-specific scoped stuff, excepting nova "keypair" objects, which seemed like an anomaly/hack | 18:49 |
| efried | rm_work: oh, so you *could* technically restrict the admin from decrypting? | 18:49 |
| rm_work | Uhh, maybe? | 18:49 |
| rm_work | Depends on how you configure the policies | 18:49 |
| rm_work | By default I believe "admin" includes the decrypt role | 18:49 |
| rm_work | See the default policy definitions | 18:50 |
| efried | Less concerned about the defaults than about the level of granularity in the implementation. | 18:50 |
| rm_work | Yeah, it is fully granular AFAIU | 18:50 |
| efried | point being, my deployment needs the ability to restrict decrypt to owner-only. | 18:50 |
| rm_work | But looking at the defaults will show you what's available | 18:51 |
| efried | cool | 18:51 |
| rm_work | I am not an Oslo policy expert ;) | 18:51 |
| rm_work | But I believe... maybe? | 18:51 |
| efried | rm_work: barbican/common/policies/secrets.py <== this? | 18:52 |
| *** tosky has quit IRC | 18:54 | |
| rm_work | https://github.com/openstack/barbican/blob/master/barbican/common/policies/secrets.py#L18 | 18:55 |
| rm_work | Yes | 18:55 |
| efried | thanks rm_work | 18:55 |
| rm_work | Yeah by default project admin can do it all | 18:55 |
| rm_work | But you could change that in your deployment | 18:55 |
| *** awalende has joined #openstack-barbican | 19:44 | |
| *** awalende has quit IRC | 19:49 | |
| *** redrobot has quit IRC | 19:52 | |
| *** awalende has joined #openstack-barbican | 20:05 | |
| *** redrobot has joined #openstack-barbican | 20:15 | |
| *** awalende has quit IRC | 20:37 | |
| *** awalende has joined #openstack-barbican | 20:38 | |
| *** awalende has quit IRC | 20:42 | |
| *** pcaruana has quit IRC | 21:32 | |
| *** raildo has quit IRC | 21:45 | |
| *** tosky has joined #openstack-barbican | 22:10 | |
| *** goldyfruit_ has joined #openstack-barbican | 22:24 | |
| goldyfruit_ | Hi guys | 22:24 |
| goldyfruit_ | Quick question, what is the RabbitMQ usage within Barbican project ? | 22:25 |
| goldyfruit_ | Is it a requirement? | 22:25 |
| goldyfruit_ | I understand that it is used between API and worker services but is there a way to bypass it as by using JSONRPC / | 22:26 |
| goldyfruit_ | ? | 22:26 |
| rm_work | barbican, like almost every project in openstack, uses oslo.messaging to do interprocess communication | 23:16 |
| rm_work | oslo.messaging might theoretically allow other backend options besides rabbit? but I don't know | 23:17 |
| *** goldyfruit_ has quit IRC | 23:52 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!