| *** dave-mccowan has quit IRC | 04:19 | |
| *** dave-mccowan has joined #openstack-barbican | 04:20 | |
| *** tosky has joined #openstack-barbican | 07:32 | |
| *** tosky has quit IRC | 08:23 | |
| *** xek has joined #openstack-barbican | 08:23 | |
| *** xek_ has joined #openstack-barbican | 08:35 | |
| *** xek has quit IRC | 08:38 | |
| *** xek_ has quit IRC | 08:42 | |
| *** xek_ has joined #openstack-barbican | 08:43 | |
| *** xek__ has joined #openstack-barbican | 09:29 | |
| *** tosky has joined #openstack-barbican | 09:31 | |
| *** xek_ has quit IRC | 09:32 | |
| *** xek__ has quit IRC | 09:50 | |
| *** xek__ has joined #openstack-barbican | 09:52 | |
| *** xek_ has joined #openstack-barbican | 10:06 | |
| *** xek__ has quit IRC | 10:09 | |
| *** xek_ has quit IRC | 10:17 | |
| *** xek_ has joined #openstack-barbican | 10:19 | |
| *** xek__ has joined #openstack-barbican | 10:25 | |
| *** johnsom has quit IRC | 10:26 | |
| *** johnsom has joined #openstack-barbican | 10:28 | |
| *** xek_ has quit IRC | 10:28 | |
| *** Luzi has joined #openstack-barbican | 11:51 | |
| *** xek__ has quit IRC | 12:17 | |
| *** xek__ has joined #openstack-barbican | 12:18 | |
| noonedeadpunk | hey! having question about logic of the simple_crypto secretstore plugin... | 12:28 |
|---|---|---|
| *** xek_ has joined #openstack-barbican | 12:28 | |
| noonedeadpunk | so in case both simple_crypto_plugin and p11_crypto_plugin sections are present in config - what will be used? | 12:28 |
| noonedeadpunk | * store_crypto to be exact | 12:30 |
| noonedeadpunk | however, I think it's still more about crypto storage rather than secret storage in case of pkcs11? | 12:31 |
| *** xek__ has quit IRC | 12:32 | |
| redrobot | hi noonedeadpunk! | 13:00 |
| redrobot | I can answer your questions after the meeting (or during) | 13:00 |
| redrobot | #startmeeting barbican | 13:00 |
| openstack | Meeting started Tue Nov 10 13:00:48 2020 UTC and is due to finish in 60 minutes. The chair is redrobot. Information about MeetBot at http://wiki.debian.org/MeetBot. | 13:00 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 13:00 |
| *** openstack changes topic to " (Meeting topic: barbican)" | 13:00 | |
| openstack | The meeting name has been set to 'barbican' | 13:00 |
| redrobot | #topic Roll Call | 13:00 |
| *** openstack changes topic to "Roll Call (Meeting topic: barbican)" | 13:00 | |
| noonedeadpunk | o/ | 13:01 |
| tosky | hi | 13:01 |
| redrobot | Courtesy ping for ade_lee dave-mccowan hrybacki jamespage Luzi lxkong mhen moguimar raildo rm_work xek nearyo | 13:01 |
| redrobot | hi tosky! | 13:01 |
| redrobot | hi noonedeadpunk! | 13:01 |
| Luzi | o/ | 13:02 |
| redrobot | As usual our agenda can be found here: | 13:02 |
| moguimar | o/ | 13:02 |
| redrobot | #link https://etherpad.opendev.org/p/barbican-weekly-meeting | 13:02 |
| redrobot | hi Luzi! | 13:02 |
| redrobot | hi moguimar! | 13:02 |
| redrobot | let's get started | 13:02 |
| redrobot | #topic Review Past Meeting Action Items | 13:02 |
| *** openstack changes topic to "Review Past Meeting Action Items (Meeting topic: barbican)" | 13:03 | |
| redrobot | #link http://eavesdrop.openstack.org/meetings/barbican/2020/barbican.2020-11-03-13.00.html | 13:03 |
| redrobot | First, I did not get a chance to dig into noonedeadpunk's Cinder-> Barbican + Vault issue :( | 13:03 |
| redrobot | #action redrobot to work with noonedeadpunk to fix the Cinder+Vault issue | 13:03 |
| redrobot | Will shoot for this week | 13:03 |
| noonedeadpunk | no hurry for this:) | 13:04 |
| redrobot | Aaaaand I didn't update the Kanban board either :( | 13:04 |
| noonedeadpunk | I hope I won't do this scenario but anyway worth fixing I guess | 13:04 |
| redrobot | #action redrobot to update the kanban board | 13:04 |
| redrobot | noonedeadpunk, we had someone else ask about it yesterday | 13:04 |
| redrobot | they filed a story to track it which we'll get to at the bug review | 13:05 |
| redrobot | And lastly I did get myself added to the stable team! :D | 13:06 |
| redrobot | I was able to get a lot of stable branches back to healthy | 13:06 |
| noonedeadpunk | ah, I should fill a story as well I guess :( | 13:06 |
| noonedeadpunk | that's super cool | 13:06 |
| redrobot | some of the older ones (pike, queen, stein) still need a bit more work | 13:07 |
| redrobot | noonedeadpunk, :D | 13:07 |
| redrobot | OK, moving on | 13:07 |
| redrobot | #topic Liaison updates | 13:07 |
| *** openstack changes topic to "Liaison updates (Meeting topic: barbican)" | 13:07 | |
| redrobot | tosky, any news from testing? | 13:07 |
| moguimar | nothing from oslo | 13:07 |
| tosky | nothing from me | 13:08 |
| redrobot | Cool, moving on then | 13:08 |
| redrobot | #topic Kanban Review | 13:08 |
| *** openstack changes topic to "Kanban Review (Meeting topic: barbican)" | 13:08 | |
| redrobot | #link https://tree.taiga.io/project/dmend-openstack-barbican/kanban | 13:08 |
| redrobot | moguimar, any updates on HVAC? | 13:08 |
| moguimar | not yet | 13:09 |
| redrobot | I don't have any updates either. | 13:10 |
| redrobot | #topic Bug Review | 13:10 |
| *** openstack changes topic to "Bug Review (Meeting topic: barbican)" | 13:10 | |
| redrobot | #link https://storyboard.openstack.org/#!/project_group/barbican | 13:10 |
| redrobot | We did get a new bug in Storyboard: | 13:10 |
| redrobot | #link https://storyboard.openstack.org/#!/story/2008335 | 13:10 |
| redrobot | it looks to be the same issue that noonedeadpunk found last week with Cinder -> Barbican + Vault | 13:11 |
| noonedeadpunk | yeah, it's exactly the same | 13:11 |
| noonedeadpunk | except I think I find it out 3 weeks ago or so, but yeah:) | 13:11 |
| redrobot | hehe | 13:12 |
| redrobot | cool, I'll hopefully get some time to look into it sooner rather than later | 13:12 |
| redrobot | #link https://bugs.launchpad.net/castellan/+bugs?orderby=-id&start=0 | 13:14 |
| redrobot | looks like no new bugs in Castellan | 13:14 |
| redrobot | #topic Wayward Reviews | 13:14 |
| *** openstack changes topic to "Wayward Reviews (Meeting topic: barbican)" | 13:14 | |
| redrobot | #link https://tinyurl.com/y3ydwmkl | 13:14 |
| moguimar | we have two patches on castellan | 13:15 |
| moguimar | stable branches | 13:15 |
| moguimar | https://review.opendev.org/#/c/759447/ | 13:15 |
| moguimar | https://review.opendev.org/#/c/759448/ | 13:16 |
| moguimar | but I guess we're missing Victoria there | 13:17 |
| noonedeadpunk | 759447 looks valid | 13:17 |
| redrobot | moguimar, yeah, I was trying to check right now if we had a victoria backport | 13:17 |
| noonedeadpunk | it's not needed for victoria | 13:18 |
| noonedeadpunk | as you've branched with it | 13:18 |
| moguimar | I'm not sure if victoria was forked before Oct 23 | 13:18 |
| moguimar | or after | 13:19 |
| noonedeadpunk | it's easy to check with Included In dropdown in gerrit | 13:19 |
| noonedeadpunk | which claims that stable/victoria already has this patch | 13:19 |
| noonedeadpunk | reno is here https://opendev.org/openstack/castellan/src/branch/stable/victoria/releasenotes/notes/use-barbican-endpoint-type-config-option-e583d30930cc22ba.yaml | 13:20 |
| moguimar | ok, we have it in vic | 13:21 |
| redrobot | yeah, just checked in my local repo with `git branch --contains e63d813a70eb4b841937a4e8a06a55e85d3ea97d` | 13:22 |
| moguimar | did the same here redrobot | 13:22 |
| redrobot | looks like the rest of our old patches are all -1'd | 13:23 |
| redrobot | #topic Open Discussion | 13:23 |
| *** openstack changes topic to "Open Discussion (Meeting topic: barbican)" | 13:23 | |
| redrobot | Anything else y'all want to talk about? | 13:23 |
| redrobot | Thanks for joining everyone! | 13:30 |
| redrobot | #endmeeting | 13:30 |
| *** openstack changes topic to "OpenStack Barbican Development - Weekly Meeting Agenda: https://etherpad.openstack.org/p/barbican-weekly-meeting" | 13:30 | |
| openstack | Meeting ended Tue Nov 10 13:30:50 2020 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 13:30 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/barbican/2020/barbican.2020-11-10-13.00.html | 13:30 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/barbican/2020/barbican.2020-11-10-13.00.txt | 13:30 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/barbican/2020/barbican.2020-11-10-13.00.log.html | 13:30 |
| *** xek__ has joined #openstack-barbican | 14:08 | |
| *** xek_ has quit IRC | 14:10 | |
| *** xek has joined #openstack-barbican | 14:11 | |
| *** xek__ has quit IRC | 14:13 | |
| openstackgerrit | Merged openstack/castellan stable/ussuri: Use 'barbican_endpoint_type'config option to get endpoint from catalog https://review.opendev.org/759447 | 14:13 |
| redrobot | noonedeadpunk, just realized I didn't answer your config questions | 14:14 |
| redrobot | noonedeadpunk, Barbican does support enabling more than one backend. | 14:15 |
| noonedeadpunk | I wouldn't hesitate to ping you again later :P | 14:15 |
| redrobot | :D | 14:16 |
| redrobot | noonedeadpunk, https://docs.openstack.org/barbican/latest/configuration/plugin_backends.html#enabling-multiple-barbican-backends | 14:16 |
| redrobot | So, a SecretStore backend covers both storage and encryption. Eg. SimpleCrypto does DB storage and software-only crypto. | 14:17 |
| noonedeadpunk | yes, I know that. but what I was wondering is that what will happen in case of having this config: http://paste.openstack.org/show/799877/ | 14:17 |
| redrobot | noonedeadpunk, store_crypto != simple crypto. store_crypto only covers DB Storage, and uses PKCS#11 for the crypto | 14:18 |
| noonedeadpunk | I think that simple_crypto_plugin and p11_crypto_plugin shouldn't be defined at the same time? | 14:18 |
| noonedeadpunk | ah | 14:18 |
| redrobot | IIRC it's fine if it's defined, as the logic will only load whatever you defined in enabled_secretstore_plugins | 14:18 |
| noonedeadpunk | well why I'm asking is that I decided to review what we have in barbican role and https://opendev.org/openstack/openstack-ansible-os_barbican/src/branch/master/templates/barbican.conf.j2#L268-L295 looks weird to me | 14:19 |
| noonedeadpunk | well it's just defaults file with all options... | 14:19 |
| noonedeadpunk | (I've already placed patch to move kek to be randomly generated per deployment) | 14:20 |
| noonedeadpunk | but I don't really understand what is going to happen... Since tempest works I think it uses defined kek | 14:21 |
| noonedeadpunk | but I guess to use p11_crypto_plugin section, simple_crypto_plugin section should be dropped? | 14:21 |
| noonedeadpunk | so I feel totally wrong about what we're doing here | 14:22 |
| *** d34dh0r53 has quit IRC | 14:40 | |
| *** d34dh0r53 has joined #openstack-barbican | 14:47 | |
| redrobot | noonedeadpunk, sorry, had to refresh my mind on the config stuff again | 15:01 |
| *** xek has quit IRC | 15:02 | |
| *** xek has joined #openstack-barbican | 15:03 | |
| redrobot | Soooo... store_crypto + simple_crypto gets you db storage with software-only cryptography | 15:03 |
| redrobot | store_crypto + pkcs11 gets you db storage with pkcs#11 crypto | 15:03 |
| redrobot | [secretstore]enabled_secretstore_pugin = store_crypto ... for both | 15:04 |
| redrobot | [crypto]enabled_crypto_plguins <--- is where you choose whether it'll be simple_crypto or pkcs11 | 15:05 |
| redrobot | So, [crypto]enabled_crypto_plugins = simple_crypto <--- gets you Software only crypto | 15:07 |
| *** Luzi has quit IRC | 15:07 | |
| redrobot | and [crypto]enabled_crypto_plugins = p11_crypto <--- gets you PKCS#11 | 15:07 |
| noonedeadpunk | ah! | 15:07 |
| noonedeadpunk | ok, makes sense now | 15:07 |
| noonedeadpunk | so for p11 I should enabled_secretstore_plugins = store_crypto and enabled_crypto_plugins = p11_crypto | 15:08 |
| redrobot | yup! | 15:08 |
| noonedeadpunk | (unless it's multibackend) | 15:08 |
| * noonedeadpunk tries to use thales dpod | 15:09 | |
| redrobot | and then the details of the PKCS#11 library and credentials go into [p11_crypto_plugin] | 15:09 |
| noonedeadpunk | yeah. sure | 15:09 |
| noonedeadpunk | at the moment ended up with http://paste.openstack.org/show/799878/ | 15:10 |
| noonedeadpunk | I think I need to place certificates somewhere as well | 15:10 |
| noonedeadpunk | wait, so, I can use enabled_secretstore_plugins = vault and enabled_crypto_plugins = p11_crypto ? | 15:14 |
| redrobot | sorry this stuff is so confusing :( | 15:15 |
| redrobot | I am not 100% sure on how the vault backend for barbican works | 15:15 |
| redrobot | noonedeadpunk, I want to say that the Vault backend covers both sotrage and encryption ... that is to say that secrets get stored directly to Vault instead of the DB | 15:16 |
| redrobot | so when enabled_secretstore_plugins = vault, then barbican does not look at enabled_crypto_plugin | 15:16 |
| noonedeadpunk | yeah, makes sense to me | 15:17 |
| redrobot | in other words, enabled_crypto_plugin only gets checked when enabled_secretstore_plugins = store_crypto | 15:17 |
| noonedeadpunk | was worth asking;) | 15:17 |
| noonedeadpunk | as it would be too good to be true:) | 15:17 |
| noonedeadpunk | btw need to check stevedore how p11_crypto is really called as `barbican.plugin.crypto.base.CryptoPluginNotFound: Crypto plugin not found.` | 15:19 |
| noonedeadpunk | well, worst part here is that you can't use multi-user vault, as you provide to castellan just single token (and I _really_ doubt it will create users if it's root one). | 15:22 |
| noonedeadpunk | in the meanwhile for p11 there are limitations on amount of keys that could be stored in the slot... at least for thales dpod | 15:23 |
| redrobot | noonedeadpunk, crypto plugin not found is usually a secondary failure | 15:23 |
| redrobot | sooo.... PKCS#11 plugin only stores 2 keys in the device | 15:23 |
| noonedeadpunk | ah, your;e right - `Problem seen creating plugin: 'p11_crypto': barbican.common.exception.P11CryptoTokenException: No token was found in slot 3` | 15:23 |
| noonedeadpunk | redrobot: um, wait, I thought it creates kek per tenant? | 15:24 |
| redrobot | There's 2 root keys we use to secure a PKCS#11 deployment: The MKEK and HMAC keys. They're generated out of band using the barbican-manage CLI | 15:24 |
| noonedeadpunk | `Secrets are encrypted (and decrypted on retrieval) by a project specific Key Encryption Key (KEK), which resides in the HSM.`? | 15:25 |
| redrobot | So, each project (aka tenant) does get a PKEK | 15:25 |
| redrobot | but they're stored in the DB | 15:25 |
| noonedeadpunk | aha | 15:25 |
| redrobot | actually the encrypted blob gets stored in the DB | 15:26 |
| redrobot | encrypted by the MKEK that resides in the hsm | 15:26 |
| redrobot | and then each secret is encrypted by the PKEK and stored in the DB as well | 15:26 |
| redrobot | and all encryption/decryption happens inside the HSM | 15:27 |
| redrobot | so PKEKs never leave the HSM unencrypted | 15:27 |
| redrobot | we implemented this multi-layer encryption when we realized we had very little storage room in Luna Network HSMs back in the day. | 15:28 |
| noonedeadpunk | well yes, I faced that I think) | 15:28 |
| noonedeadpunk | as I think that's exactly I'm trying to do right now | 15:29 |
| redrobot | So yeah, the HSMs only permanently store the MKEK and HMAC. Everything else is done in the HSM memory and encrypted blobs are persisted in the DB | 15:29 |
| noonedeadpunk | ok, thank you so much for so detailed explanation | 15:30 |
| noonedeadpunk | it really explains a lot | 15:30 |
| redrobot | 😁👍 Any time! | 15:32 |
| noonedeadpunk | I will probably try to adjust docs https://docs.openstack.org/barbican/latest/install/barbican-backend.html | 15:32 |
| redrobot | noonedeadpunk, would definitely appreciate any changes you think would make things clearer | 15:34 |
| redrobot | noonedeadpunk, RE: http://paste.openstack.org/show/799878/ how are you generating the new random keys? | 15:34 |
| noonedeadpunk | disregard it it was issue in conf. | 15:35 |
| redrobot | cool | 15:35 |
| noonedeadpunk | redrobot: since you said you had some hands on with luna network hsm, probably you know what level of access I should give to barbican? as there are po, co, cu? | 15:44 |
| *** xek_ has joined #openstack-barbican | 15:52 | |
| *** xek has quit IRC | 15:53 | |
| *** xek_ has quit IRC | 15:53 | |
| redrobot | noonedeadpunk, I want to say we were using Crypto Officer for barbican connections | 15:53 |
| noonedeadpunk | yeah, ok, doing the same | 15:54 |
| *** xek_ has joined #openstack-barbican | 15:54 | |
| noonedeadpunk | just having `No token was found in slot` so decided to double check | 15:55 |
| noonedeadpunk | well, I need to get used to look thorugh full stack trace | 15:58 |
| noonedeadpunk | HSM returned response code: 0x191 CKR_CRYPTOKI_ALREADY_INITIALIZED | 15:58 |
| noonedeadpunk | thanks a lot for the help, will try to handle this now) | 15:58 |
| *** xek__ has joined #openstack-barbican | 16:11 | |
| *** jmlowe has quit IRC | 16:13 | |
| *** xek_ has quit IRC | 16:14 | |
| *** jmlowe has joined #openstack-barbican | 16:14 | |
| *** xek__ has quit IRC | 16:30 | |
| *** xek__ has joined #openstack-barbican | 16:31 | |
| *** xek_ has joined #openstack-barbican | 16:33 | |
| *** xek__ has quit IRC | 16:36 | |
| *** iurygregory has quit IRC | 16:42 | |
| *** dave-mccowan has quit IRC | 16:56 | |
| *** xek_ has quit IRC | 17:32 | |
| *** xek_ has joined #openstack-barbican | 17:33 | |
| *** iurygregory has joined #openstack-barbican | 17:33 | |
| *** xek__ has joined #openstack-barbican | 17:46 | |
| *** xek_ has quit IRC | 17:49 | |
| openstackgerrit | Ade Lee proposed openstack/barbican master: DNM: testing FIPS gate job https://review.opendev.org/760665 | 18:41 |
| *** xek__ has quit IRC | 19:09 | |
| *** xek__ has joined #openstack-barbican | 19:10 | |
| *** xek__ has quit IRC | 19:17 | |
| *** xek__ has joined #openstack-barbican | 19:18 | |
| *** gmann is now known as gmann_lunch | 19:29 | |
| *** iurygregory has quit IRC | 20:25 | |
| *** xek__ has quit IRC | 20:32 | |
| *** xek__ has joined #openstack-barbican | 20:33 | |
| *** xek_ has joined #openstack-barbican | 20:40 | |
| *** tosky has quit IRC | 20:42 | |
| *** xek__ has quit IRC | 20:42 | |
| *** tosky has joined #openstack-barbican | 20:42 | |
| *** xek_ has quit IRC | 20:43 | |
| *** iurygregory has joined #openstack-barbican | 21:51 | |
| *** raildo has quit IRC | 22:01 | |
| *** gmann_lunch is now known as gmann | 22:27 | |
| *** iurygregory has quit IRC | 22:47 | |
| *** iurygregory has joined #openstack-barbican | 22:49 | |
| *** tosky has quit IRC | 22:55 | |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!