Tuesday, 2020-03-10

*** enriquetaso has quit IRC01:51
*** enriquetaso has joined #openstack-barbican02:29
*** enriquetaso has quit IRC03:05
*** dave-mccowan has quit IRC04:40
*** xek_ has joined #openstack-barbican07:57
*** tosky has joined #openstack-barbican08:18
*** Luzi has joined #openstack-barbican11:37
*** raildo has joined #openstack-barbican12:07
*** raildo has quit IRC12:19
*** raildo has joined #openstack-barbican12:20
*** enriquetaso has joined #openstack-barbican12:24
redrobot#startmeeting barbican13:00
openstackMeeting started Tue Mar 10 13:00:12 2020 UTC and is due to finish in 60 minutes.  The chair is redrobot. Information about MeetBot at http://wiki.debian.org/MeetBot.13:00
openstackUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.13:00
*** openstack changes topic to " (Meeting topic: barbican)"13:00
openstackThe meeting name has been set to 'barbican'13:00
redrobot#topic Roll Call13:00
*** openstack changes topic to "Roll Call (Meeting topic: barbican)"13:00
redrobotCourtesy ping for ade_lee dave-mccowan hrybacki jamespage Luzi lxkong mhen moguimar raildo rm_work xek13:00
Luzio/13:00
redrobotAs usual our agenda can be found here:13:00
redrobot#link https://etherpad.openstack.org/p/barbican-weekly-meeting13:00
redrobotHi Luzi!13:00
*** xek_ is now known as xek13:01
Luzihi redrobot13:02
*** nearyo has joined #openstack-barbican13:02
redrobot#topic Review Past Action Items13:03
*** openstack changes topic to "Review Past Action Items (Meeting topic: barbican)"13:03
redrobot#link http://eavesdrop.openstack.org/meetings/barbican/2020/barbican.2020-03-03-13.00.html13:03
nearyoo/13:03
redrobotI still need to do my action item13:03
redrobot#action redrobot to send ML message to get added to barbican-stable13:03
redrobotok, moving on13:03
redrobothi nearyo!13:03
nearyohey13:03
redrobot#topic Liaison Updates13:04
*** openstack changes topic to "Liaison Updates (Meeting topic: barbican)"13:04
redrobotmoguimar, o/13:04
moguimaro/13:06
redrobothi moguimar!13:06
moguimarhey13:06
redrobotAny updates from oslo?13:06
moguimarnot really13:06
moguimarI've been doing some castellan code latelly13:06
redrobot:-O13:06
redrobotI saw your patches, but haven't had a chance to review them yet13:06
redrobot#topic Castellan Updates13:06
*** openstack changes topic to "Castellan Updates (Meeting topic: barbican)"13:06
moguimarthe hvac backend is still waiting on some decisions13:07
redrobot#link https://review.opendev.org/#/q/project:openstack/castellan+status:open13:07
moguimarso the traditional vault backend turns the objects into dicts13:07
redrobotOk, I'll try to take a look soon.  For sure I'll look at it Friday at the latest.13:07
moguimarbefore storing them13:07
moguimarI wanna centralize that code somewhere13:07
moguimarand was thinking if we don't aready have a solution or pattern for that13:08
moguimarI looked into oslo.serialization and yesterday oslo folks recommended me to look into oslo.versionedobjects13:08
redrobotπŸ€”πŸ€”πŸ€”13:08
moguimarso I have that on my list for when I get back from BRA13:09
moguimarHervΓ© is helping a lot in the reviews =D13:10
moguimarI gotta back to him as well in the oslo.cache code13:10
moguimarback him up*13:10
moguimarwhich will also help me in other security stuff13:11
redrobotawesome, thanks for leading the charge on the HVAC work, moguimar13:11
moguimarI wanna have it with at least the same features as the current one has13:11
moguimarhttps://review.opendev.org/#/c/706468/13:12
moguimarthis one could use some input too13:12
moguimarjust to raise a discussion13:12
moguimarand I think at some point that could be automated13:12
moguimarsome dependabot13:12
* redrobot looks13:13
redrobotah yes... I thought we had updated the Vault version alredy?13:13
redrobotI'm not sure we want to always be bumping the minimum version of Vault we support, but we definitely need to do a better job of evaluating new releases13:14
moguimaryep13:14
redrobotCool, anything else on Castellan?13:16
moguimarnope13:16
redrobotalright, moving on13:16
redrobot#topic Barbican UI13:16
*** openstack changes topic to "Barbican UI (Meeting topic: barbican)"13:16
redrobotnearyo, I'm sorry I have not had a chance to look at your patch. :(13:16
redrobotade_lee, was supposed to do the initial review, but I'm not sure if he's had a chance to do that13:16
redrobotunfortunately he's out on PTO right now.13:17
redrobotBut I'll ask him about it when he gets back.13:17
redrobotI think rm_work was also interested in Barbican UI13:17
nearyoHey ... okay no problem ... that was my the question13:17
rm_workYeah he was13:18
rm_workBut he knows literally nothing about UI code13:18
redrobotsame13:18
* redrobot hangs head in shame13:18
* rm_work holds head high13:19
nearyoNo problem ... maybe you can have a look at the python/server side? :)13:20
Luzihttps://review.opendev.org/#/c/702399/13:21
redrobotFor sure. :)  ... also maybe we should ping the UI folks to take a looky loo13:22
Luzithat's the link in case someone wants to know ;)13:22
redrobotthanks, Luzi13:22
nearyoSo maybe you can check in the first place if I used the barbican-python-client correctly? This would be great.13:22
redrobot#help we need more reviewers for the initial Barbican UI patch13:22
nearyo(y)13:22
*** nearyo has quit IRC13:25
redrobotoh no! nearyo ragequit13:25
redrobotj/k13:25
redrobotI hope he comes back.13:25
redrobotOk, moving on13:25
redrobot#topic PTG13:26
*** openstack changes topic to "PTG (Meeting topic: barbican)"13:26
redrobotI did not request space for Barbican at the upcoming PTG due to lack of attendees interested in Barbican.13:26
*** nearyo has joined #openstack-barbican13:26
rm_workRIP13:26
nearyoo/13:26
rm_workWell hopefully it even happens :)13:27
redrobotsorry rm_work... you would have been sitting at the PTG table by yourself.13:27
rm_workI requested space for 10 for octavia lol13:27
rm_workHow are we supposed to tear up the town if you aren't there πŸ˜”13:27
redrobot:(13:28
redrobotWe'll have to plan to tear up Berlin instead. lol13:28
rm_workWorks for me13:28
LuziI will be in Berlin too :D13:28
rm_workNoice13:29
redrobotrm_work, I do recommend going to the Devil's Elbo for a Beer Burbon and Bacon.13:29
redrobot*Devil's Elbow13:29
rm_workSold me with the bacon13:29
redrobotLuzi, awesome!  I'm going to try to get to Berlin too. 🀞🀞13:29
redrobotok, moving on13:31
redrobot#topic Open Discussion13:31
*** openstack changes topic to "Open Discussion (Meeting topic: barbican)"13:31
redrobotAnything else y'all want to talk about?13:31
toskysoooo, a review in barbican-tempest-plugin13:31
toskythis one, part of the "drop py2" goal: https://review.opendev.org/#/c/704083/13:31
toskyalso, I noticed there is a bunch of barbican-tempest-plugin reviews which could be easily reviewed or even approved (like opendev links migration, stestr migration, etC)13:32
redrobottosky, looking13:33
* redrobot adds barbican-tempest-plugin to his review queue13:33
toskythanks!13:36
redrobotAnything else we should talk about?13:37
nearyoSorry guys ... BEST-WIFI (TM)For those who are interested in the barbican-ui or if someone has any questions, it's probably the easiest to write me an email to dag.dammann@cloudandheat.com13:37
redrobotAck, thanks again for the UI work, nearyo13:38
nearyomy pleasure ^^13:38
redrobotAlrighty, y'all.  I don't have anything else on the agenda.13:39
redrobotThanks everyone for joining!13:39
redrobotSee y'all online!13:39
redrobot#endmeeting13:39
*** openstack changes topic to "OpenStack Barbican Development - Weekly Meeting Agenda: https://etherpad.openstack.org/p/barbican-weekly-meeting"13:39
openstackMeeting ended Tue Mar 10 13:39:37 2020 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)13:39
openstackMinutes:        http://eavesdrop.openstack.org/meetings/barbican/2020/barbican.2020-03-10-13.00.html13:39
openstackMinutes (text): http://eavesdrop.openstack.org/meetings/barbican/2020/barbican.2020-03-10-13.00.txt13:39
openstackLog:            http://eavesdrop.openstack.org/meetings/barbican/2020/barbican.2020-03-10-13.00.log.html13:39
*** nearyo has quit IRC13:40
rm_workhmmm either need to write a barbican driver or a castellan driver for our internal secret-store system >_>13:56
rm_workdeciding which... technically our secret-store has its own API with user auth, so i guess I can just skip directly to castellan and we don't actually need to run Barbican :/13:56
*** dave-mccowan has joined #openstack-barbican14:03
openstackgerritMerged openstack/castellan master: Moving common objects under KeyManager.  https://review.opendev.org/71044014:16
redrobotrm_work, I think the deciding factor should be:  Do end users of your cloud need to access secrets with those same credentials?14:17
redrobotrm_work, because Castellan->YourSecretStore driver means all secrets will be owned by the user you configure in that Castellan plugin14:18
rm_workyeah it's all universally the same auth14:18
rm_workopenstack auth + secret auth is all with Athenz14:18
redrobotSo, for example, let's say you use Castellan for Octavia14:19
rm_workall uses the same x509 certs14:19
redrobotWhich credentials will the Octavia service use to talk to the backend?14:19
rm_workand octavia will have full admin access to the system (don't think about it)14:19
redrobotIf you want to write a driver that proxies those credentials, then you may not need Barbican.14:19
redrobotor maybe your driver will impersonate credentials14:20
rm_worknah we're just god-min14:20
redrobotHmm ... If the user story is -> 1. User uploads secret to YourSecretStore, 2. Octavia uses godmin privs to get that secret, then you should be good with just Castellan14:22
rm_workyep thats it14:22
rm_workexactly14:22
redrobotThe only issue with Catellan-only would be if any service is generating Secrets14:23
redrobotthen you have to impersonate14:23
rm_workjust octavia uses secrets and we don't generate14:23
redrobotIF you want the users to later retrieve those using their credentials14:23
redrobotYeah, sounds like least resistance may be writing a Castellan driver14:23
rm_workwe run barbican now but literally no one uses it T_T14:24
redrobot😭😭😭14:24
johnsomrm_work: Did you find out about that barbican client exception issue?14:25
rm_worknot yet, i should probably be asking about that XD14:25
johnsomi.e. secrets api with container ref not raising an exception14:25
rm_workalso still never heard a confirmation from alee about that tomcat thing, ah well14:26
rm_workyeah i seriously don't know what's going on there, i think someone f'd something up14:26
rm_workif you use the client to pass a ref to secret-get, if that ref isn't valid, it will 40414:26
rm_workend of story14:26
rm_workwhether it's a valid container-ref or not is irrelevant14:27
rm_workas far as the client is concerned, it's NOT a valid secret ref14:27
rm_workit's not going around comparing to other object types just in case you tried the wrong type, lol14:27
johnsomI just don’t want to revert that patch for better error handling on our side14:27
redrobotrm_work, ade_lee is out on PTO14:29
rm_workahh ok14:29
rm_workjohnsom: yeah we shouldn't14:29
rm_worki honestly am not sure i believe it's a real error14:29
rm_workhave you replicated it yourself?14:29
rm_worki've been having issues getting my devstack working recently for a number of issues so it's hard for me to test this kind of thing14:30
rm_workoh, though ... i bet this is testable directly in my real cloud actually <_<14:31
rm_worksec, i'll give it a whirl in a minute14:31
*** Luzi has quit IRC14:32
johnsomI have not tested it. Focused on unit tests currently.14:39
rm_workk i'm stuck on remembering how to generate a valid cert+key :D14:40
rm_workah octavia has a thing14:40
rm_worklol apparently our barbican deployment is broken enough that i can't store a cert T_T14:42
redrobotrm_work, oof, that sucks.  Let me know if you need help debugging14:46
rm_workah nah it seems like the issue isn't in barbican14:47
rm_workit's something with our LB shutting off connections too early14:47
rm_worknot sure what's up14:47
rm_workit just means it's gonna take me a sec14:48
rm_worklol apparently default users don't even have permissions in our cloud to use barbican, awesome14:48
rm_workah and as admin, it fails somehow to create14:49
rm_work(i'm bypassing the LB now)14:50
rm_worklol so i just ran it a couple more times and randomly eventually got a different error14:51
rm_workthis is super weird14:52
rm_workhttp://paste.openstack.org/show/790513/14:53
rm_workit's just alternating between 400 and 50014:53
rm_worksuper odd14:53
rm_workahhhh14:54
rm_workon the barbican side:14:54
rm_workrequests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https://localhost:8373/kra/rest/agent/keyrequests14:54
rm_workso obviously we messed up the auth for dogtag14:55
rm_workyeah ok due to general incompetence, I will not be able to test this easily :D15:11
redrobotrm_work, oof15:12
rm_workah and apparently our security policy won't let us do TLS Termination on a LB anyway15:12
* rm_work flips table15:12
* rm_work burns it all down15:12
*** trident has quit IRC16:34
*** trident has joined #openstack-barbican16:36
*** trident has quit IRC18:08
*** trident has joined #openstack-barbican18:17
*** openstackgerrit has quit IRC19:32
*** openstackstatus has joined #openstack-barbican20:18
*** ChanServ sets mode: +v openstackstatus20:18
*** dave-mccowan has quit IRC20:27
*** xek has quit IRC21:07

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!