| opendevreview | Ade Lee proposed openstack/barbican master: Add SoftHSM PKCS#11 functional gate with dual secret stores https://review.opendev.org/c/openstack/barbican/+/1004026 | 03:03 |
|---|---|---|
| opendevreview | Ade Lee proposed openstack/barbican master: Add secret-store migrate API as microversion 1.3 https://review.opendev.org/c/openstack/barbican/+/1002398 | 04:39 |
| opendevreview | Ade Lee proposed openstack/barbican master: Add barbican-secret-migrate operator command https://review.opendev.org/c/openstack/barbican/+/1002399 | 04:39 |
| opendevreview | Dmitriy Chubinidze proposed openstack/barbican-ui master: wip: https://review.opendev.org/c/openstack/barbican-ui/+/1004802 | 11:17 |
| opendevreview | Dmitriy Chubinidze proposed openstack/barbican-ui master: Fix broken footer button on secret reveal modal https://review.opendev.org/c/openstack/barbican-ui/+/1004802 | 11:26 |
| dan_with | Hi, I am from Rackspace. Got a very pointed question about Gazpacho/Barbican and simple_crypto_plugin KEK. Is this the correct place to ask? | 16:08 |
| dan_with | Hi, are any of my messages visible to anyone else? | 16:27 |
| dmendiza[m] | Hi [@_oftc_dan_with:matrix.org](https://matrix.to/#/@_oftc_dan_with:matrix.org) | 16:27 |
| dan_with | thanks | 16:27 |
| dmendiza[m] | dan_with: you had a barbican question? | 16:49 |
| dan_with | Does Gazpacho Barbican provide any tool to re-wrap/migrate existing secrets from the simple_crypto KEK to the PKCS#11 (HSM) backend — because pkcs11_migrate_kek_signatures.py doesn't do that, it only fixes HMAC signature formats on rows already owned by the p11 plugin? Or is dual-plugin decrypt the only supported path for pre-HSM secrets? | 16:54 |
| dmendiza[m] | So, bad news is that it is not currenlty possible to migrate a secret from one backend to another. You can configure multiple backends with both SimpleCrypto and PKCS#11, set one as the default/preferred. | 16:57 |
| dmendiza[m] | New secrets will be encrypted with the default/preferred backend and existing secrets will be decrypted with the appropriate backend | 16:57 |
| dmendiza[m] | Good news is that we just merged a spec to implement a migration API: https://specs.openstack.org/openstack/barbican-specs/specs/2027.1/admin-migrate-secret-store.html | 16:58 |
| dmendiza[m] | Implementation is underway and release is targeted for Indri. | 16:59 |
| dan_with | Thank you so much. I wasn't sure if I was missing something. This all makes sense | 17:03 |
| opendevreview | Takashi Kajinami proposed openstack/castellan master: Do not run functional tests by default https://review.opendev.org/c/openstack/castellan/+/1004910 | 17:52 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!