Tuesday, 2021-10-12

mvpniteshhi all, i'm trying to execute Barbican-tempest-plugin .  I don't have an L3 agent in my setup and when i try to run Barbican-tempest-plugin all the testcases are failing. When i see the tempest code at https://github.com/openstack/tempest/blob/25.0.0/tempest/lib/common/dynamic_creds.py#L343 , i see the router creation is happening. Is it Mandatory to have L3 agent? My tempest.conf is https://paste.openstack.org/show/809908/  let me know if i09:18
opendevreviewPavlo Shchelokovskyy proposed openstack/barbican master: Add support for Vault Namespaces  https://review.opendev.org/c/openstack/barbican/+/81360610:27
toskymvpnitesh: does any other tempest test which requires networking up work? This may not be a barbican-tempest-plugin issue12:16
toskytempest expects to be able to connect to the nodes12:17
toskyat least for some checks12:17
toskyit may be better to ask on the -qa channel, and provide also the exact error message12:17
toskytraceback even12:17
mvpniteshHi Tosky, i know that. This is not a barbican-tempest-issue. I might be missing some config12:18
mvpniteshAlreay i've asked in -qa no response from them12:18
toskythere is going to be more activity on the channel later12:36
toskywith the logs too?12:37
kim_swill there be the possibility to ask questions later?12:39
toskykim_s: sorry, that one was an answer to mvpnitesh about an earlier question, and I was talking about the -qa channel12:43
thelounge94#startmeeting barbican13:01
opendevmeetMeeting started Tue Oct 12 13:01:48 2021 UTC and is due to finish in 60 minutes.  The chair is thelounge94. Information about MeetBot at http://wiki.debian.org/MeetBot.13:01
opendevmeetUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.13:01
opendevmeetThe meeting name has been set to 'barbican'13:01
thelounge94#topic Roll Call13:02
*** thelounge94 is now known as redrobot13:02
redrobotCourtesy ping for ade_lee dave-mccowan d34dh0r53 hrybacki jamespage Luzi lxkong mhen moguimar raildo rm_work tosky xek nearyo oleksandry13:03
redrobot#chair redrobot13:03
d34dh0r53o/13:04
*** redrobot is now known as thelounge9413:04
thelounge94#chair redrobot13:04
opendevmeetWarning: Nick not in channel: redrobot13:04
opendevmeetCurrent chairs: redrobot thelounge9413:04
*** thelounge94 is now known as redrobot13:04
rajivHi, i have question on Barbican-HSM integration, mailed openstack-discussion but had no response. Could ask now or wait till the end for Q&A ?13:06
redrobotrajiv hi I'll add your topic to the agenda13:08
toskyo/13:08
redrobothi tosky!13:08
redrobotOK, let's get started13:08
redrobot#topic Review Past Meeting Action Items13:08
redrobot#link https://meetings.opendev.org/meetings/barbican/2021/barbican.2021-10-05-13.01.html13:09
redrobotWe didn't have any13:09
redrobotmoving on ...13:09
redrobot#topic Liaison Updates13:09
redrobottosky do you have anything for us?13:09
toskynothing from my side13:13
redrobotack, thanks!13:13
redrobotmoving on13:13
redrobotTopic Barbican+HSM integration13:13
redrobot#topic Barbican+HSM integration13:13
redrobotrajiv ^^^13:13
rajivHi, i am switching from soft crypto plugin to HSM backend 13:14
rajivThales A79013:14
rajivi am told Barbican uses self- generated IV instead of module generated IV which FIPS do not support and shows incorrect parameter error in FIPS mode.13:14
rajivis this fixed in Barbican ? or Barbican doesnt run if FIPS Operation mode is enabled ? 13:15
redrobotI had to google "Thales A790"  Looks like it's the same as the Thales Luna Network HSM?13:16
rajivFIPS 140-2 L3 to be precise13:16
rajivyes, this is the latest device offered by Thales Luna Network HSM13:16
kim_syes, Luna A790 is the Thales Luna Network HSM, the Password based13:16
rajivhttps://cpl.thalesgroup.com/resources/encryption/openstack-barbican-integration-guide13:18
redrobotYeah, that seems right that FIPS mode does not work.  I think we've documented that limitation.  Let me look for a link13:18
redrobotrajiv Oh yeah, I've seen that guide before13:19
kim_syes, you documented it, the question is: is it still the case? And why exactly, because it seems, that this restriction is only for Luna HSM.13:19
redrobotrajiv open that PDF and scroll down to pre-requisites13:19
redrobot> The OpenStack Barbican integration does not work with a SafeNet Luna HSM or 13:19
redrobotData Protection on Demand HSM on Demand services operating in FIPS mode.13:19
kim_sthis Thales Integration Guide is quite old from 2019, we've some more actual13:19
redrobotAFAIK there has bee no work done to add support to FIPS mode13:19
kim_syes, DPoD seems to work in FIPS Mode, and DPoD is Luna HSM13:20
rajivkim_s: thanks for reiterating the question13:20
rajivredrobot: yes, thats the page i am referring to, i would like to know why this restriction is in place13:21
rajivis there a workaround ? 13:21
redrobotrajiv probably because of the reasons you outlined with the IV being generated as you explained13:21
kim_sthe irritation is: Barbican with Luna HSM is per doku not FIPS Mode compatible, but Barbican with DPoD (which are Luna HSMs) are FIPS MOde compatible. Could we clearify this? 13:22
redrobotI do not know if there is a workaround.  You might try setting aes_gcm_generate_iv=False, but I don't know if that would work or not13:22
redrobothttps://opendev.org/openstack/barbican/src/branch/master/barbican/plugin/crypto/p11_crypto.py#L98-L10013:22
redrobotkim_s I am not familiar with DPoD13:22
kim_sI'm from Thales, so I'm a little bit familiar with DPoD and Luna HSMs, but unfortunatle I'm not familiar with Barbican13:23
rajivokay, i will try.13:23
redrobotkim_s gotcha.  IIRC, the doc linked by rajiv was produced by Gemalto prior to being acquired by Thales13:24
redrobotWe (the barbican open source community) don't have access to HSM hardware for development, so that FIPS testing was done by Gemalto13:24
redrobotin our documentation we do not mention DPoD13:25
kim_sah, ok, thx @redrobot13:25
redrobot#link https://docs.openstack.org/barbican/latest/install/barbican-backend.html#thales-luna-network-hsm-safenet13:25
redrobotOur note just says:13:25
redrobot> Barbican does not support FIPS mode enabled for SafeNet Luna HSM or Data Protection on Demand HSM. Make sure that it’s operating in non-FIPS mode while integrating with Barbican.13:25
redrobotoh, I guess we do mention DPoD13:26
redrobotbut our docs say we don't support that either13:26
redrobotIn any case, you mibhg be able to set that option to False and be OK.  I think that's the flag that Barbican checks to decide whether to generate an IV or not.13:26
redrobotYou might also need to tune the Mechanism13:26
redrobotI am not sure GCM is supported in FIPS?13:27
kim_sthe actual DPoD Integration Guide doesn't speak about FIPS Mode incompatibility: https://thalesdocs.com/dpod/services/integrations/other/openstack/index.html13:27
redrobotagain, that's your doc, not one produced by the community. 😅13:28
kim_sbut as I understood Barbican Community did not do the Tests with Thales HSM, so I try to get any response from our Proctuct Management - again :)13:28
redrobotFor historical context:  Barbican was initally devleoped by Rackspace.  We had Safenet Lunas to develop the system, but we were not able to make them available to our community for testing, so all testing was done downstream.13:29
redrobotRackspace did not use FIPS mode, so we did not test that13:29
redrobotI believe only Safenet/Gemalto tested FIPS mode13:30
redrobotCurrently most of the core team works at Red Hat13:30
rajivokay, so other vendor HSM devices work well on FIPS mode ?13:30
redrobotwe also have downstream Lunas for testing, but we are also unable to make them available to the community for testing.13:30
redrobotrajiv I don't know.  I have not personally tested any HSM with FIPS mode enabled13:31
redrobotrajiv kim_s, that said we'd be more than happy to review any patches to add FIPS mode support13:31
redrobotI suggest start by tweaking the config options13:32
rajivredrobot: i will test this in my qa setup, would there be any config options to lookout for ? any downsides by setting it to true ?13:32
redrobote.g. turn of IV generation, and possibly change the mechanism to CKM_AES_CBC or something more compatible than GCM13:32
redrobothttps://opendev.org/openstack/barbican/src/branch/master/barbican/plugin/crypto/p11_crypto.py#L77-L7913:32
redrobotrajiv yes, I linked the two options that are most relevant13:33
rajivsure, how about other plugins ?13:34
redrobotrajiv all HSMs use the same plugin13:34
rajivKMIP ?13:34
redrobotKMIP backend is not very well tested.  I doubt FIPS is supported  as we had the same situation where we had no HSMs for testing and were only using pykmip for testing.13:35
redrobotUnfortunately the folks behind the KMIP backend (who had the downstream HSMs for development) are no longer contributing to the project13:36
redrobotWe can certainly review patches to add FIPS support to KMIP if needed.13:36
rajivah i see, pkcs11 is the best best to start with i guess.13:37
kim_syes, pkcs#11 is the best option13:37
rajivmaybe after testing the config options, etc i could raise a question/bug request for further assistance ?13:38
redrobotYeah, here or the mailing list are good places to ask kquestions13:40
redrobot(although I haven't checked the ML in a few days an dmissed your email 😅)13:41
rajivthanks13:41
redrobotrajiv you're welcome13:41
redrobotOK, moving on 13:41
redrobot#topic PTG13:41
redrobot#link https://etherpad.opendev.org/p/yoga-ptg-barbican13:42
redrobotPTG is coming up next week13:42
redrobotWe have two sessions scheduled on Tuesday October 19 and Thursday October 2113:42
redrobotboth sessions start at 1300 UTC13:42
redrobot#info weekly meeting next week is canceled13:43
redrobotsince we'll all be at the PTG13:43
redrobotplease sign up if you haven't yet.13:43
redrobotAlso feel free to add any topics you want to talk about to the etherpad I linked above13:44
redrobot#topic Kanban Review13:47
redrobot#link https://tree.taiga.io/project/dmend-openstack-barbican/kanban13:48
redrobotnot a whole lot of progress on my end13:49
redrobot#topic New Bug Review13:49
redrobot#link https://storyboard.openstack.org/#!/project_group/barbican13:49
redrobotLooks like no new bugs13:52
redrobot#link https://bugs.launchpad.net/castellan/+bugs?orderby=-id&start=013:53
redrobotand no new Castellan bugs13:53
redrobot#link https://bugs.launchpad.net/cursive/+bugs?orderby=-id&start=013:53
redrobotand no new Cursvie bugs13:53
redrobot#topic Open Discussion13:54
redrobotWe have a few minutes if anyone else has something quick to talk about?13:54
redrobotrajiv please open a Storyboard bug about FIPS mode not working13:55
redrobotThat's all the time we have for today13:59
redrobotthanks for joining, everyone!13:59
redrobot#endmeeting13:59
opendevmeetMeeting ended Tue Oct 12 13:59:12 2021 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)13:59
opendevmeetMinutes:        https://meetings.opendev.org/meetings/barbican/2021/barbican.2021-10-12-13.01.html13:59
opendevmeetMinutes (text): https://meetings.opendev.org/meetings/barbican/2021/barbican.2021-10-12-13.01.txt13:59
opendevmeetLog:            https://meetings.opendev.org/meetings/barbican/2021/barbican.2021-10-12-13.01.log.html13:59
opendevreviewMerged openstack/barbican master: Fix secret metadata access rules  https://review.opendev.org/c/openstack/barbican/+/81123618:51
opendevreviewMerged openstack/barbican master: Fix secret metadata access rules (pt 2)  https://review.opendev.org/c/openstack/barbican/+/81123718:57
opendevreviewMerged openstack/barbican-tempest-plugin master: Add secure-rbac tests for Secret Metadata  https://review.opendev.org/c/openstack/barbican-tempest-plugin/+/81094219:32
opendevreviewDouglas Mendizábal proposed openstack/barbican stable/train: DNM - Check stable/train gate health  https://review.opendev.org/c/openstack/barbican/+/81370621:15
opendevreviewLingxian Kong proposed openstack/castellan master: Support setting Vault kv version config  https://review.opendev.org/c/openstack/castellan/+/80766421:20

Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!