*** tosky has quit IRC | 00:15 | |
*** dwilde has quit IRC | 02:04 | |
*** dwilde has joined #openstack-barbican | 02:07 | |
*** dwilde has quit IRC | 02:07 | |
*** dwilde has joined #openstack-barbican | 02:08 | |
*** dwilde has quit IRC | 02:44 | |
*** d34dh0r53 has quit IRC | 03:32 | |
*** d34dh0r53 has joined #openstack-barbican | 03:33 | |
*** d34dh0r53 has quit IRC | 03:35 | |
*** d34dh0r53 has joined #openstack-barbican | 03:35 | |
*** d34dh0r53 has quit IRC | 04:19 | |
*** d34dh0r53 has joined #openstack-barbican | 04:20 | |
*** d34dh0r53 has quit IRC | 04:22 | |
*** d34dh0r53 has joined #openstack-barbican | 04:22 | |
*** d34dh0r53 has quit IRC | 04:59 | |
*** d34dh0r53 has joined #openstack-barbican | 04:59 | |
*** d34dh0r53 has quit IRC | 05:01 | |
*** d34dh0r53 has joined #openstack-barbican | 05:01 | |
*** d34dh0r53 has quit IRC | 05:03 | |
*** d34dh0r53 has joined #openstack-barbican | 05:03 | |
*** d34dh0r53 has quit IRC | 05:03 | |
*** d34dh0r53 has joined #openstack-barbican | 05:04 | |
*** nikparasyr has joined #openstack-barbican | 07:27 | |
*** dave-mccowan has quit IRC | 07:30 | |
*** tosky has joined #openstack-barbican | 08:22 | |
*** xek has joined #openstack-barbican | 08:53 | |
*** Luzi has joined #openstack-barbican | 11:47 | |
*** jaosorior has quit IRC | 11:53 | |
*** raildo has joined #openstack-barbican | 12:14 | |
*** rajivmucheli has joined #openstack-barbican | 12:45 | |
rajivmucheli | Hi | 12:58 |
---|---|---|
redrobot | Hi rajivmucheli! | 12:59 |
redrobot | #startmeeting barbican | 13:00 |
openstack | Meeting started Tue Jan 12 13:00:55 2021 UTC and is due to finish in 60 minutes. The chair is redrobot. Information about MeetBot at http://wiki.debian.org/MeetBot. | 13:00 |
openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 13:00 |
*** openstack changes topic to " (Meeting topic: barbican)" | 13:00 | |
openstack | The meeting name has been set to 'barbican' | 13:00 |
redrobot | #topic Roll Call | 13:01 |
*** openstack changes topic to "Roll Call (Meeting topic: barbican)" | 13:01 | |
redrobot | Courtesy ping for ade_lee dave-mccowan hrybacki jamespage Luzi lxkong mhen moguimar raildo rm_work xek nearyo | 13:01 |
Luzi | o/ | 13:01 |
redrobot | As usual our agenda can be found here: | 13:01 |
redrobot | #link https://etherpad.opendev.org/p/barbican-weekly-meeting | 13:01 |
moguimar | o/ | 13:01 |
rajivmucheli | redrobot i am currently testing barbican upgrade to victoria release, i see the below from the barbican-api pod when i execute barbican-api --version : | 13:03 |
rajivmucheli | root@barbican-api-59765f4fcb-z27rq:/# barbican-api --version | 13:03 |
rajivmucheli | from paste import httpserver | 13:03 |
rajivmucheli | 2021-01-12 13:03:08,716.716 243 INFO barbican.model.repositories [-] Setting up database engine and session factory | 13:03 |
rajivmucheli | 2021-01-12 13:03:08,745.745 243 INFO barbican.model.repositories [-] Not auto-creating barbican registry DB | 13:03 |
rajivmucheli | 2021-01-12 13:03:08,746.746 243 INFO barbican.api.app [-] Barbican app created and initialized | 13:03 |
rajivmucheli | 2021-01-12 13:03:08,760.760 243 WARNING datadog.dogstatsd [-] Error submitting packet: [Errno 111] Connection refused, dropping the packet and closing the socket: ConnectionRefusedError: [Errno 111] Connection refused | 13:03 |
rajivmucheli | 2021-01-12 13:03:08,768.768 243 CRITICAL barbican [-] Unhandled error: OSError: [Errno 98] Address already in use | 13:03 |
rajivmucheli | 2021-01-12 13:03:08,768.768 243 ERROR barbican Traceback (most recent call last): | 13:03 |
rajivmucheli | 2021-01-12 13:03:08,768.768 243 ERROR barbican File "/var/lib/openstack/bin/barbican-api", line 17, in <module> | 13:03 |
rajivmucheli | 2021-01-12 13:03:08,768.768 243 ERROR barbican run() | 13:03 |
rajivmucheli | 2021-01-12 13:03:08,768.768 243 ERROR barbican File "/var/lib/openstack/bin/barbican-api", line 14, in run | 13:03 |
rajivmucheli | 2021-01-12 13:03:08,768.768 243 ERROR barbican httpserver.serve(application, host='0.0.0.0', port='9311') | 13:03 |
rajivmucheli | 2021-01-12 13:03:08,768.768 243 ERROR barbican File "/var/lib/openstack/lib/python3.8/site-packages/paste/httpserver.py", line 1338, in serve | 13:03 |
rajivmucheli | 2021-01-12 13:03:08,768.768 243 ERROR barbican server = WSGIThreadPoolServer(application, server_address, handler, | 13:03 |
rajivmucheli | 2021-01-12 13:03:08,768.768 243 ERROR barbican File "/var/lib/openstack/lib/python3.8/site-packages/paste/httpserver.py", line 1157, in __init__ | 13:03 |
rajivmucheli | 2021-01-12 13:03:08,768.768 243 ERROR barbican WSGIServerBase.__init__(self, wsgi_application, server_address, | 13:03 |
rajivmucheli | 2021-01-12 13:03:08,768.768 243 ERROR barbican File "/var/lib/openstack/lib/python3.8/site-packages/paste/httpserver.py", line 1136, in __init__ | 13:03 |
redrobot | rajivmucheli hey, thanks for joining. We just started the weekly meeting, so maybe we can talk about it after the meeting is over? | 13:04 |
rajivmucheli | this is my 1st IRC meeting, apologise if i missed to update any pre-req, i can do it now, if guided. | 13:04 |
rajivmucheli | sure | 13:04 |
redrobot | no worries | 13:04 |
redrobot | just a suggestion for next time | 13:04 |
redrobot | try not to paste logs here as it floods the channel with messages | 13:04 |
redrobot | try using http://paste.openstack.org/ instead | 13:04 |
redrobot | OK, let's get started with the meeting | 13:05 |
redrobot | #topic Aciton Items From Last Meeting | 13:05 |
*** openstack changes topic to "Aciton Items From Last Meeting (Meeting topic: barbican)" | 13:05 | |
redrobot | #link http://eavesdrop.openstack.org/meetings/barbican/2021/barbican.2021-01-05-13.02.html | 13:05 |
redrobot | Looks like we didn't have any Action Items last week | 13:05 |
redrobot | (ps. thanks moguimar for running the meeting last week) | 13:05 |
redrobot | Moving on ... | 13:06 |
redrobot | #topic Liaison Updates | 13:06 |
moguimar | maybe check on the AI from your last meeting | 13:06 |
*** openstack changes topic to "Liaison Updates (Meeting topic: barbican)" | 13:06 | |
redrobot | moguimar? tosky? | 13:06 |
moguimar | Oslo is droping lower constraints | 13:06 |
moguimar | and taking cursive under its umbrella | 13:06 |
moguimar | open to barbican contributions | 13:06 |
redrobot | I had a topic for Cursive in the agenda, but we can talk about it now | 13:07 |
redrobot | #topic Cursive | 13:07 |
*** openstack changes topic to "Cursive (Meeting topic: barbican)" | 13:07 | |
redrobot | #link https://opendev.org/x/cursive | 13:07 |
moguimar | do you want to add anything else to that statement? | 13:08 |
redrobot | A little background for folks: Cursive is a digital signing library | 13:08 |
redrobot | it's used by a few projects and the original maintainers have moved on to other things | 13:09 |
redrobot | There was an ML discussion to get new maintainers since it's still used by OpenStack | 13:09 |
redrobot | Let me fish that ML link | 13:09 |
tosky | (sorry , nothing from me, and I haven't even updated the cursive patch) | 13:10 |
redrobot | #link http://lists.openstack.org/pipermail/openstack-discuss/2020-December/019430.html | 13:10 |
redrobot | TL;DR Oslo owns Cursive now | 13:10 |
redrobot | but our team will also have core reviewer votes as we are somewhat SMEs for crypto stuff | 13:10 |
tosky | and guess why :) | 13:10 |
redrobot | tosky ? | 13:11 |
redrobot | why is that? 🤔 | 13:12 |
tosky | guess why you are considered SMEs for crypto stuff :D | 13:13 |
redrobot | 🤔🤔🤔 | 13:13 |
tosky | maybe the fact that barbican is "crypto stuff" :) | 13:14 |
redrobot | lol | 13:15 |
tosky | ok, ok, it was a cheap attempt of joking | 13:15 |
redrobot | I lol'ed for real though 😝 | 13:15 |
redrobot | moguimar can we get an updated dashboard link that pulls in Cursive reviews? | 13:16 |
moguimar | will do | 13:16 |
redrobot | Thanks! | 13:16 |
redrobot | #action moguimar to use his gerrit-foo to make us a new dashboard link that includes Cursive reviews | 13:16 |
redrobot | OK, moving on | 13:16 |
redrobot | #topic Kanban Review | 13:17 |
*** openstack changes topic to "Kanban Review (Meeting topic: barbican)" | 13:17 | |
redrobot | #link https://tree.taiga.io/project/dmend-openstack-barbican/kanban | 13:17 |
redrobot | No updates from me here | 13:17 |
redrobot | Just got back into the office yesterday after a few weeks off, so I'm just starting to get back into the swing of things | 13:17 |
redrobot | #topic Cycle checkin | 13:20 |
*** openstack changes topic to "Cycle checkin (Meeting topic: barbican)" | 13:20 | |
redrobot | #link https://releases.openstack.org/wallaby/schedule.html | 13:20 |
redrobot | Wallaby-2 milestone is coming up next week | 13:20 |
redrobot | I will try to get the Microversions patch and Secret Consumers patches up before then | 13:20 |
redrobot | 🤞🤞 | 13:21 |
redrobot | Also, it does not look like we have any specs for review this cycle: | 13:21 |
redrobot | #link https://review.opendev.org/q/project:openstack/barbican-specs+status:open | 13:21 |
redrobot | So if you're thinking of a spec for Wallaby now is the time to get it up for review. | 13:22 |
redrobot | Any questions/comments about Wallaby-2? | 13:23 |
redrobot | OK, moving on | 13:25 |
redrobot | #topic Bug Review | 13:25 |
*** openstack changes topic to "Bug Review (Meeting topic: barbican)" | 13:25 | |
redrobot | #link https://storyboard.openstack.org/#!/project_group/barbican | 13:25 |
redrobot | Looks like no new bugs in the Barbican Storyboards | 13:26 |
redrobot | #link https://bugs.launchpad.net/castellan/+bugs?orderby=-id&start=0 | 13:26 |
redrobot | and also no new bugs in Castellan | 13:26 |
redrobot | #topic Wayward Reviews | 13:26 |
*** openstack changes topic to "Wayward Reviews (Meeting topic: barbican)" | 13:26 | |
redrobot | #link https://tinyurl.com/y3ydwmkl | 13:27 |
moguimar | https://review.opendev.org/c/openstack/barbican/+/768512 | 13:28 |
redrobot | moguimar I think I will -1 that one | 13:30 |
redrobot | the MKEK and HMAC labels don't have defaults in the config | 13:31 |
redrobot | #link https://opendev.org/openstack/barbican/src/branch/master/barbican/plugin/crypto/p11_crypto.py#L50-L51 | 13:31 |
redrobot | and the rest of the instructions in that doc all use the convention of $HSM_NAME_mkek_0 and $HSM_NAME_hmac_0 | 13:31 |
moguimar | I see | 13:31 |
moguimar | I just think the new name is more generic | 13:32 |
redrobot | I think the new name looks ugly :-P | 13:32 |
moguimar | yeah, but when you see something like that, you know you can name it whatever | 13:32 |
moguimar | not a fixed value | 13:32 |
redrobot | at least make both barbican_hmac_0 or my_hmac and my_mkek | 13:32 |
moguimar | sure | 13:32 |
moguimar | my_... works | 13:33 |
moguimar | make that suggestion then | 13:33 |
redrobot | will do | 13:34 |
moguimar | https://review.opendev.org/c/openstack/barbican/+/767275 | 13:34 |
moguimar | it took me a while on this one to actually look at the classifiers | 13:34 |
moguimar | in pypi | 13:34 |
redrobot | LGTM | 13:35 |
redrobot | https://review.opendev.org/c/openstack/barbican/+/768000 | 13:35 |
moguimar | and translations | 13:35 |
moguimar | https://review.opendev.org/c/openstack/barbican/+/768000 | 13:36 |
moguimar | yeah, same | 13:36 |
moguimar | needs approval | 13:36 |
moguimar | https://review.opendev.org/c/openstack/barbican/+/769090 | 13:36 |
moguimar | ah, I see you have already reviewed those | 13:37 |
moguimar | https://review.opendev.org/c/openstack/castellan/+/767726 | 13:37 |
moguimar | wanna ship this one? | 13:37 |
moguimar | we decided on single approval, but you can put your finger on it =P | 13:38 |
redrobot | done | 13:39 |
redrobot | Easy one https://review.opendev.org/c/openstack/barbican-specs/+/769264 | 13:40 |
moguimar | I was like "again? didn't I just +w this one?" | 13:41 |
redrobot | hehe | 13:41 |
moguimar | and it is finally snowing | 13:42 |
redrobot | I think that's it for easy reviews | 13:42 |
moguimar | yeah | 13:42 |
redrobot | Yeah, it's really freakin' cold over here too | 13:42 |
moguimar | open discussion? so rajivmucheli can have his questions? | 13:42 |
redrobot | woke up to 32 F ( 0 C) | 13:42 |
redrobot | #topic Open Discussion | 13:43 |
*** openstack changes topic to "Open Discussion (Meeting topic: barbican)" | 13:43 | |
rajivmucheli | if this is better http://paste.openstack.org/show/801555/ ? | 13:43 |
redrobot | rajivmucheli yes, much better, thank you | 13:46 |
redrobot | > [Errno 98] Address already in use | 13:46 |
redrobot | my guess is there may be some other service running on that port? | 13:47 |
rajivmucheli | yes, the ps -ef shares the o/p | 13:47 |
rajivmucheli | ideally, barbican-api --version should ideally share an o/p, right ? i have the same setup to create openstack containers, i dont get this error for other services. | 13:48 |
openstackgerrit | Merged openstack/barbican-specs master: remove unicode from code https://review.opendev.org/c/openstack/barbican-specs/+/769264 | 13:48 |
redrobot | not sure what you mean by o/p ? | 13:49 |
rajivmucheli | output ** | 13:49 |
redrobot | well, output should go to stdout, but I think that error means that the process can't bind to the 0.0.0.0:9311 address | 13:51 |
redrobot | maybe there is another process using that port? | 13:51 |
redrobot | are you running only this barbican container? | 13:52 |
rajivmucheli | yes, only barbican-api container is running in the barbican pod | 13:53 |
redrobot | Is this an exec command after you started the container? | 13:53 |
rajivmucheli | yes, its an exec into the container. | 13:53 |
redrobot | OH! | 13:53 |
redrobot | yeah, that won't work | 13:53 |
redrobot | when you start the container a barbican-api process binds to that port | 13:53 |
redrobot | that command is trying to exec a new process, so it won't work | 13:54 |
redrobot | what you can do instead is something like "curl http://0.0.0.0:9311" outside the container | 13:54 |
redrobot | and if things are working you should get a response | 13:54 |
rajivmucheli | okay, i wanted this confirmation! prior to upgrading to victoria release | 13:54 |
rajivmucheli | thanks, so barbican is designed to work this way on port 9311 ? | 13:55 |
rajivmucheli | is it possible to get a secret by its name ? i see its restricted to URI only https://docs.openstack.org/python-openstackclient/latest/cli/plugin-commands/barbican.html#secret-get. | 13:57 |
redrobot | currently we do not support getting secret by name | 13:58 |
redrobot | but you can use only the UUID, not the full URI | 13:58 |
redrobot | And yes, barbican runs on port 9311 by default | 13:58 |
redrobot | but you can configure that any way you want | 13:58 |
redrobot | also bin/barbican-api is not necessarily a production-ready script | 13:59 |
redrobot | I think Kolla uses uwsgi in front of barbican | 13:59 |
redrobot | but you can also use apache+mod_wsgi | 13:59 |
redrobot | Aaaand we're out of time for the meeting | 14:00 |
redrobot | (but I'll stick around if you still have questions rajivmucheli) | 14:00 |
redrobot | Thanks for joining everyone | 14:00 |
redrobot | #endmeeting | 14:00 |
*** openstack changes topic to "OpenStack Barbican Development - Weekly Meeting Agenda: https://etherpad.openstack.org/p/barbican-weekly-meeting" | 14:00 | |
openstack | Meeting ended Tue Jan 12 14:00:35 2021 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 14:00 |
openstack | Minutes: http://eavesdrop.openstack.org/meetings/barbican/2021/barbican.2021-01-12-13.00.html | 14:00 |
openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/barbican/2021/barbican.2021-01-12-13.00.txt | 14:00 |
openstack | Log: http://eavesdrop.openstack.org/meetings/barbican/2021/barbican.2021-01-12-13.00.log.html | 14:00 |
rajivmucheli | oh ok, thanks for all your confirmation. Whats the other way to validate barbican is on victoria release ? | 14:01 |
rajivmucheli | do we need to upgrade the OpenSSL version prior upgrading to victoria release ? will this be fixed in Wallaby release : | 14:02 |
rajivmucheli | from paste import httpserver | 14:02 |
redrobot | if you have the openstack cli you can just "openstack secret list" if it doesn't give you any errors then things should be fine | 14:02 |
redrobot | rajivmucheli are you using your own containers? Kolla? or? | 14:02 |
rajivmucheli | the cli works fine | 14:02 |
rajivmucheli | we switched from kolla to loci https://github.com/sapcc/loci/tree/master | 14:03 |
redrobot | Interesting, I was not familiar with LOCI | 14:06 |
redrobot | I would have to dig into it to be sure | 14:06 |
redrobot | but it looks like they are using https://opendev.org/openstack/barbican/src/branch/master/bin/barbican-api#L14 | 14:06 |
redrobot | but, like I mentioned, that script is not good enough for production | 14:07 |
redrobot | httpserver is not a production-ready server | 14:07 |
redrobot | you need to run barbican behind either nginx+gunicorn or apache+mod_wsgi or uwsgi, but definitely not that script | 14:07 |
redrobot | and when you do that, then nginx or apache or uwsgi needs to have TLS enabled | 14:08 |
rajivmucheli | okay, i will work on this! Thats it from me, thanks for extending. | 14:09 |
redrobot | You're welcome! :) | 14:11 |
*** rajivmucheli has quit IRC | 14:13 | |
*** Luzi has quit IRC | 14:31 | |
*** jaosorior has joined #openstack-barbican | 14:41 | |
*** dave-mccowan has joined #openstack-barbican | 15:00 | |
openstackgerrit | Merged openstack/barbican master: Update doc8 version https://review.opendev.org/c/openstack/barbican/+/767275 | 15:14 |
openstackgerrit | Merged openstack/barbican master: Imported Translations from Zanata https://review.opendev.org/c/openstack/barbican/+/768000 | 15:14 |
openstackgerrit | Merged openstack/barbican master: remove unicode from code https://review.opendev.org/c/openstack/barbican/+/769090 | 15:15 |
openstackgerrit | Merged openstack/castellan master: Dropping lower constraints testing https://review.opendev.org/c/openstack/castellan/+/767726 | 15:15 |
*** d34dh0r53 has quit IRC | 15:51 | |
*** d34dh0r53 has joined #openstack-barbican | 15:53 | |
openstackgerrit | Douglas Mendizábal proposed openstack/ansible-role-atos-hsm master: Ignore lint error 106 https://review.opendev.org/c/openstack/ansible-role-atos-hsm/+/770440 | 16:04 |
openstackgerrit | Alex Schultz proposed openstack/ansible-role-atos-hsm master: Fix linter https://review.opendev.org/c/openstack/ansible-role-atos-hsm/+/770441 | 16:07 |
openstackgerrit | Alex Schultz proposed openstack/ansible-role-thales-hsm master: Fix linters https://review.opendev.org/c/openstack/ansible-role-thales-hsm/+/770443 | 16:16 |
openstackgerrit | Alex Schultz proposed openstack/ansible-role-thales-hsm master: Update README to clarify Thales name https://review.opendev.org/c/openstack/ansible-role-thales-hsm/+/770168 | 16:16 |
*** d34dh0r53 has quit IRC | 16:19 | |
*** d34dh0r53 has joined #openstack-barbican | 16:19 | |
openstackgerrit | Douglas Mendizábal proposed openstack/ansible-role-thales-hsm stable/victoria: Update .gitreview for stable/victoria https://review.opendev.org/c/openstack/ansible-role-thales-hsm/+/767801 | 16:28 |
openstackgerrit | Douglas Mendizábal proposed openstack/ansible-role-atos-hsm stable/victoria: Update .gitreview for stable/victoria https://review.opendev.org/c/openstack/ansible-role-atos-hsm/+/767768 | 16:31 |
*** jaosorior has quit IRC | 16:32 | |
*** jaosorior has joined #openstack-barbican | 16:45 | |
dave-mccowan | ade_lee redrobot: do you guys have any experience using barbican with multiple HSMs for HA/redundancy? | 16:50 |
*** jaosorior has quit IRC | 16:51 | |
*** jaosorior has joined #openstack-barbican | 16:51 | |
*** openstackgerrit has quit IRC | 16:55 | |
*** jaosorior has quit IRC | 16:57 | |
*** jaosorior has joined #openstack-barbican | 16:57 | |
redrobot | hi dave-mccowan! | 16:59 |
redrobot | Yes, I've run Barbican with HA HSMs before, but the caveat is that HA is usually done by your HSM client (e.g. the pkcs11.so file provided by the vendor) | 17:00 |
redrobot | Using Luna SA HSMs, for example, the lunacm tool provided by Thales is used to configure 2 or more HSMs into an HA group, and that results in a new HSM slot. Barbican is then configured to talk to that HA slot. | 17:01 |
redrobot | So from the Barbican point of view, it's just talking to a single slot. The HA magic happens in the pkcs11 client provided by Thales | 17:02 |
dave-mccowan | talking with ATOS, they say we need a multi-threaded process to do it, but barbican use a single threaded for HSM backend. | 17:03 |
redrobot | dave-mccowan we've implemented ATOS HA support in TripleO | 17:05 |
redrobot | trying to remember how we did it | 17:05 |
redrobot | Luna is freshes in my mind because we implemented it recently | 17:05 |
redrobot | *freshest | 17:05 |
redrobot | dave-mccowan https://opendev.org/openstack/ansible-role-atos-hsm/commit/5069751256fb218d56ce1f30552de678bd56b48a | 17:08 |
*** d34dh0r53 has quit IRC | 17:10 | |
redrobot | dave-mccowan We were using ATOS Trustway Proteccio HSMs. IIRC the magic is in cloning/duplicating the SHAMIR/CIK cards, and booting 2 (or more) HSMs with the duplicate cards. | 17:11 |
redrobot | then the proteccio.rc file just needs to have all HSMs listed and Mode=2 set | 17:11 |
dave-mccowan | redrobot thanks for the help! I'll check on those things. | 17:20 |
*** d34dh0r53 has joined #openstack-barbican | 17:27 | |
*** nikparasyr has left #openstack-barbican | 18:13 | |
*** d34dh0r53 has quit IRC | 18:13 | |
*** d34dh0r53 has joined #openstack-barbican | 18:31 | |
*** openstackgerrit has joined #openstack-barbican | 19:58 | |
openstackgerrit | Douglas Mendizábal proposed openstack/barbican master: [doc] Fix hmac/mkek generation commands https://review.opendev.org/c/openstack/barbican/+/768512 | 19:58 |
*** raildo has quit IRC | 22:05 |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!