| *** hongbin has joined #openstack-meeting-3 | 00:58 | |
| *** apetrich has quit IRC | 01:28 | |
| *** yamamoto has quit IRC | 01:50 | |
| *** yamamoto has joined #openstack-meeting-3 | 02:11 | |
| *** psachin has joined #openstack-meeting-3 | 02:42 | |
| *** psachin has quit IRC | 04:04 | |
| *** psachin has joined #openstack-meeting-3 | 04:06 | |
| *** hongbin has quit IRC | 04:58 | |
| *** e0ne has joined #openstack-meeting-3 | 05:13 | |
| *** mugsie has quit IRC | 05:49 | |
| *** zigo has quit IRC | 05:49 | |
| *** Luzi has joined #openstack-meeting-3 | 05:57 | |
| *** psachin has quit IRC | 06:25 | |
| *** psachin has joined #openstack-meeting-3 | 06:30 | |
| *** e0ne has quit IRC | 06:44 | |
| *** apetrich has joined #openstack-meeting-3 | 06:59 | |
| *** alexchadin has joined #openstack-meeting-3 | 07:33 | |
| *** apetrich has quit IRC | 07:41 | |
| *** tssurya has joined #openstack-meeting-3 | 07:45 | |
| *** apetrich has joined #openstack-meeting-3 | 08:13 | |
| *** alexchadin has quit IRC | 08:19 | |
| *** e0ne has joined #openstack-meeting-3 | 08:37 | |
| *** yamamoto has quit IRC | 08:43 | |
| *** d0ugal has quit IRC | 08:43 | |
| *** psachin has quit IRC | 08:50 | |
| *** tonyb has quit IRC | 08:50 | |
| *** d0ugal has joined #openstack-meeting-3 | 09:03 | |
| *** psachin has joined #openstack-meeting-3 | 09:03 | |
| *** yamamoto has joined #openstack-meeting-3 | 09:19 | |
| *** tonyb has joined #openstack-meeting-3 | 09:53 | |
| *** psachin has quit IRC | 10:06 | |
| *** yamamoto has quit IRC | 10:11 | |
| *** yamamoto has joined #openstack-meeting-3 | 10:11 | |
| *** yamamoto has quit IRC | 10:20 | |
| *** yamamoto has joined #openstack-meeting-3 | 10:44 | |
| *** mugsie has joined #openstack-meeting-3 | 10:46 | |
| *** pbourke has quit IRC | 10:55 | |
| *** pbourke has joined #openstack-meeting-3 | 10:57 | |
| *** andreaf has joined #openstack-meeting-3 | 11:06 | |
| *** alexchadin has joined #openstack-meeting-3 | 11:34 | |
| *** sambetts_ has quit IRC | 11:55 | |
| *** dims has joined #openstack-meeting-3 | 11:56 | |
| *** sambetts_ has joined #openstack-meeting-3 | 11:57 | |
| *** raildo has joined #openstack-meeting-3 | 12:16 | |
| *** jamesmcarthur has joined #openstack-meeting-3 | 12:46 | |
| *** bobh has joined #openstack-meeting-3 | 13:04 | |
| *** jamesmcarthur has quit IRC | 13:05 | |
| *** munimeha1 has joined #openstack-meeting-3 | 13:06 | |
| *** jamesmcarthur has joined #openstack-meeting-3 | 13:45 | |
| *** bobh_ has joined #openstack-meeting-3 | 13:54 | |
| *** bobh has quit IRC | 13:58 | |
| *** iyamahat has joined #openstack-meeting-3 | 14:04 | |
| *** mjturek has joined #openstack-meeting-3 | 14:19 | |
| *** alexchadin has quit IRC | 14:22 | |
| *** alexchadin has joined #openstack-meeting-3 | 14:26 | |
| *** aagate has joined #openstack-meeting-3 | 14:31 | |
| *** jamesmcarthur has quit IRC | 14:36 | |
| *** hongbin has joined #openstack-meeting-3 | 14:44 | |
| *** redrobot has joined #openstack-meeting-3 | 14:51 | |
| *** spilla has joined #openstack-meeting-3 | 14:56 | |
| *** dklyle has joined #openstack-meeting-3 | 14:58 | |
| *** jamesmcarthur has joined #openstack-meeting-3 | 14:59 | |
| raildo | #startmeeting oslo-config-plaintext-secrets | 14:59 |
|---|---|---|
| openstack | Meeting started Tue Sep 4 14:59:36 2018 UTC and is due to finish in 60 minutes. The chair is raildo. Information about MeetBot at http://wiki.debian.org/MeetBot. | 14:59 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 14:59 |
| *** openstack changes topic to " (Meeting topic: oslo-config-plaintext-secrets)" | 14:59 | |
| openstack | The meeting name has been set to 'oslo_config_plaintext_secrets' | 14:59 |
| moguimar | o/ | 14:59 |
| raildo | #link https://etherpad.openstack.org/p/oslo-config-plaintext-secrets | 14:59 |
| spilla | o/ | 15:00 |
| raildo | courtesy ping dhellmann redrobot | 15:01 |
| redrobot | o/ | 15:01 |
| raildo | I think that we can start it | 15:03 |
| dhellmann | o/ | 15:03 |
| raildo | #topic Denver PTG | 15:03 |
| *** openstack changes topic to "Denver PTG (Meeting topic: oslo-config-plaintext-secrets)" | 15:03 | |
| * dhellmann is currently debugging a release job failure so may only be paying partial attention | 15:03 | |
| raildo | dhellmann, no worries :) | 15:03 |
| raildo | #link oslo session: https://etherpad.openstack.org/p/oslo-stein-ptg-planning | 15:03 |
| raildo | #link Tripleo session: Wednesday 14:00 - 15:00: https://etherpad.openstack.org/p/tripleo-ptg-stein | 15:03 |
| raildo | so, we have these two session related to this topic, for the olso side, we're looking for review the next steps related to the oslo.config changes also the castellan driver | 15:04 |
| *** yamamoto has quit IRC | 15:05 | |
| raildo | for the TripleO side, we will be explaining what we are doing, why we are doing, and basically understand what will be necessary to do on TripleO do have that automated over there | 15:05 |
| *** yamamoto has joined #openstack-meeting-3 | 15:05 | |
| beekneemech | o/ | 15:06 |
| *** beekneemech is now known as bnemec | 15:06 | |
| raildo | hey bnemec :) | 15:06 |
| bnemec | Hi | 15:07 |
| *** lamt has joined #openstack-meeting-3 | 15:07 | |
| raildo | so, hope to have a great feedback from those sessions about this feature :) | 15:07 |
| raildo | #topic Castellan driver | 15:08 |
| *** openstack changes topic to "Castellan driver (Meeting topic: oslo-config-plaintext-secrets)" | 15:08 | |
| raildo | #link https://review.openstack.org/#/c/599589/ | 15:08 |
| raildo | moguimar, ^ | 15:08 |
| moguimar | o/ | 15:09 |
| moguimar | first lines of code on the castellan drive are out | 15:09 |
| moguimar | I'm finishing to answer Doug's review | 15:09 |
| moguimar | and fix the zuul crashes | 15:09 |
| moguimar | unit tests are still to be implemented | 15:10 |
| moguimar | and docs as well | 15:10 |
| moguimar | o\ | 15:10 |
| raildo | also, we're preparing a demo/slides for PTG, if needed to explain that for ppl outside this meeting, or if someone wants more details about the current progress, next steps and so on... | 15:11 |
| raildo | and we want to include a demo of this castellan driver code running, as well | 15:12 |
| raildo | hope to have that done by the end of the week | 15:12 |
| *** dklyle has quit IRC | 15:13 | |
| *** dklyle has joined #openstack-meeting-3 | 15:14 | |
| raildo | #topic Castellan don't have update operation for secrets | 15:14 |
| *** openstack changes topic to "Castellan don't have update operation for secrets (Meeting topic: oslo-config-plaintext-secrets)" | 15:14 | |
| raildo | so, during the castellan investigation that we made, we noticed that castellan doesn't support update operation | 15:15 |
| raildo | dhellmann, bnemec I'm not sure how that it will affect mutable values on oslo.config without that operation | 15:15 |
| dhellmann | if a secret is marked mutable, then the mapping value associated with it would have to be updated in order for a new value to be read out of the backend | 15:16 |
| raildo | maybe we gonna need to implement secrets updates to enable mutable values? | 15:16 |
| raildo | in the castellan side | 15:17 |
| dhellmann | the process would be (1) create a new secret (2) update the mapping file with its ID (3) poke the service to have it reload its config | 15:17 |
| raildo | dhellmann, the other solution would be generate a new secret and update the mapping file id | 15:17 |
| dhellmann | right | 15:17 |
| raildo | exactly | 15:17 |
| bnemec | Yeah, we'll need to make sure the mapping opts inherit the mutability flag of their parent opt. | 15:17 |
| raildo | #topic open discussion | 15:19 |
| *** openstack changes topic to "open discussion (Meeting topic: oslo-config-plaintext-secrets)" | 15:19 | |
| raildo | that's all that I had for today | 15:19 |
| dhellmann | bnemec : I wasn't expecting us to define separate options for the mapping values | 15:19 |
| bnemec | dhellmann: Sure, but we have to have them defined somehow, right? | 15:20 |
| dhellmann | they're identical to the group and opt names given to the driver for lookup | 15:20 |
| bnemec | Yeah, but we can't reuse them because they won't necessarily be the same type. | 15:20 |
| dhellmann | they don't need to be | 15:21 |
| moguimar | we can poke the option itself | 15:21 |
| bnemec | We can't read a string id into an int opt, can we? | 15:21 |
| moguimar | the get() recieves group_name, option_name and the opt | 15:21 |
| *** Luzi has quit IRC | 15:21 | |
| dhellmann | accessing conf.foo.bar causes the driver to load the secret id from the bar value in the foo section and then use that value to talk to the backend and return whatever the backend gives back | 15:21 |
| dhellmann | the mapping values are never returned out of the driver | 15:21 |
| dhellmann | the driver doesn't need to worry about type conversion, either, the caller does all of the coercion | 15:22 |
| bnemec | So we're just going to use a standard ConfigParser to read the mapping file instead of an oslo.config object? | 15:23 |
| * bnemec should probably go look at the review | 15:23 | |
| moguimar | I was just looking at that | 15:23 |
| dhellmann | that's not how it was written when I looked at it, but that was my suggestion, yes | 15:23 |
| moguimar | in the ConfigParser docs | 15:23 |
| moguimar | the DEFAULT section behaves in a different way than oslo.conifg | 15:24 |
| dhellmann | that supporting mapping file could be YAML or sqlite or anything, we just said we'd use ini for consistency from the deployer's perspective | 15:24 |
| dhellmann | oh? | 15:24 |
| moguimar | in configparser.ConfirParser, the DEFAULT section provides default values for the other sections when the option is not present | 15:25 |
| bnemec | I ran into that once before. DEFAULT in ConfigParser applies to all groups. | 15:25 |
| moguimar | yep | 15:25 |
| dhellmann | moguimar : ok, I don't think that's going to apply here, is it? | 15:25 |
| bnemec | So if you have an opt DEFAULT/foo and you look up bar/foo, if bar/foo isn't defined you get the value in DEFAULT/foo. | 15:25 |
| moguimar | exactly bnemec | 15:25 |
| dhellmann | do we want that behavior in this case? | 15:26 |
| moguimar | nope | 15:26 |
| bnemec | It's kind of obnoxious and I don't think there was a good way to turn it off. :-/ | 15:26 |
| moguimar | we want to return NoValue | 15:26 |
| moguimar | I think there is | 15:26 |
| moguimar | default_section=configparser.DEFAULTSECT | 15:27 |
| moguimar | in the __init__ | 15:27 |
| moguimar | maybe setting it to '' | 15:27 |
| moguimar | would 'release' the DEFAULT section for what we want it to be | 15:27 |
| bnemec | Ah, yeah that seems like it could work. | 15:27 |
| *** mjturek has quit IRC | 15:28 | |
| moguimar | so I'm also digging in the configparser.ConfigParser alternative | 15:28 |
| moguimar | another thing, I got an Oslo Config talk approved for Python Brasil in October =D | 15:30 |
| bnemec | Oh, that's right. I ran into this in https://review.openstack.org/#/c/567950/3/oslo_config/validator.py | 15:30 |
| raildo | dhellmann, do you agree with the moguimar's suggestion as well? | 15:30 |
| bnemec | I just used the oslo.config ConfigParser class instead. | 15:30 |
| bnemec | That might work here too. | 15:31 |
| moguimar | that's how I implemented it ben | 15:31 |
| bnemec | Ah, okay. I really need to just go look at the review. :-) | 15:31 |
| dhellmann | I'm a bit concerned that reusing our custom parsing library for this non-custom file is going to mean that somewhere down the road a change to that parser breaks things. The standard library parser is pretty stable at this point and doesn't have as much fancy baggage on top, so it feels like it's good enough for this case. I can go along with using our custom driver if everyone else feels that it's necessary, though. | 15:33 |
| moguimar | dhellmann I think the standard library parser is a viable option | 15:33 |
| moguimar | just need to test it | 15:34 |
| moguimar | also the erro handling will be easier | 15:34 |
| dhellmann | cool | 15:34 |
| dhellmann | yeah | 15:34 |
| moguimar | just need to disable that DEFAULT magic | 15:34 |
| moguimar | as we don't have it in oslo.config | 15:34 |
| raildo | cool, looks like we have some next steps for the next weeks :) | 15:35 |
| raildo | we're running our of time | 15:35 |
| *** alexchadin has quit IRC | 15:35 | |
| moguimar | 🙄 we ran already | 15:35 |
| bnemec | I guess the one argument _for_ using the oslo.config parser is if we do any magic in there with opt names or anything it would automatically apply to the mapping file too. | 15:35 |
| *** alexchadin has joined #openstack-meeting-3 | 15:36 | |
| bnemec | I don't know if that happens at all though, or if it ever should. | 15:36 |
| moguimar | bnemec: but we don't register the options to the mapping file | 15:36 |
| *** alexchadin has quit IRC | 15:36 | |
| moguimar | that falls back to the caller | 15:36 |
| *** alexchadin has joined #openstack-meeting-3 | 15:36 | |
| moguimar | so I think option deprecation will try to fetch again from the source with the deprecated name | 15:36 |
| *** alexchadin has quit IRC | 15:37 | |
| * moguimar have not looked in the deprecation code yet | 15:37 | |
| moguimar | has* | 15:37 |
| *** alexchadin has joined #openstack-meeting-3 | 15:37 | |
| dhellmann | yeah, the driver API is designed to make the driver implementations as simple as possible | 15:37 |
| *** alexchadin has quit IRC | 15:37 | |
| bnemec | Yeah, I'm kind of thinking out loud here. I don't know whether that's a relevant issue. | 15:37 |
| dhellmann | they are specifically *not* supposed to do any guessing about alternative locations for values | 15:37 |
| *** alexchadin has joined #openstack-meeting-3 | 15:38 | |
| bnemec | I'm also curious how this would interact with the env var stuff Chris is working on. Seems like a container might want to store secrets in Castellan too. | 15:38 |
| dhellmann | they basically implement a key-value lookup for a 2 part key (group and option name) and both parts of the key are always provided | 15:38 |
| *** alexchadin has quit IRC | 15:38 | |
| dhellmann | hmm | 15:38 |
| dhellmann | that's interesting, bnemec | 15:38 |
| moguimar | I've been reviewing that one | 15:39 |
| dhellmann | I thought the idea was that the secret would be passed through the env var? | 15:39 |
| moguimar | it is comming good | 15:39 |
| bnemec | That's probably not something we can get for free unless we create an entire ConfigOpts structure for the mapping, which it doesn't seem like we want to do. | 15:39 |
| bnemec | And I don't think it should block this work, just something we might want to consider in the future. | 15:40 |
| raildo | dhellmann, bnemec would be nice to take some time during PTG to see if we can join both efforts for the next release? or see if make sense integrate somehow those efforts? | 15:40 |
| dhellmann | it would be good to talk about how they might interact, for sure | 15:40 |
| bnemec | raildo: It's already leveraging the driver infrastructure, but it can't be a normal driver because of precedence requirements. | 15:40 |
| bnemec | But yeah, we can certainly talk about it at the PTG. | 15:41 |
| * raildo is really sad because will be not attending PTG this time | 15:41 | |
| raildo | bnemec, yeah, got it | 15:41 |
| bnemec | Maybe we can grab Juan for that session? He's on your team, right? | 15:42 |
| moguimar | yep | 15:42 |
| bnemec | Although I imagine he's going to be a bit busy PTLing TripleO this cycle. :-) | 15:42 |
| raildo | bnemec, yeah, he is, just ping me, when you have some day-time slot for this session, and I'll spoke with him to attend it | 15:42 |
| *** jamesmcarthur has quit IRC | 15:43 | |
| bnemec | Okay, sounds good. I need to sit down and come up with a rough schedule for the Oslo day. | 15:43 |
| bnemec | I'll send an email to the list once that's done. | 15:43 |
| *** jamesmcarthur has joined #openstack-meeting-3 | 15:43 | |
| raildo | that would be great :) | 15:43 |
| raildo | so, thank you guys for attending today, have a great PTG for those who will be attending it! | 15:44 |
| moguimar | o/ | 15:44 |
| bnemec | Thanks | 15:44 |
| raildo | #endmeeting | 15:44 |
| *** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings/" | 15:44 | |
| openstack | Meeting ended Tue Sep 4 15:44:14 2018 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 15:44 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/oslo_config_plaintext_secrets/2018/oslo_config_plaintext_secrets.2018-09-04-14.59.html | 15:44 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/oslo_config_plaintext_secrets/2018/oslo_config_plaintext_secrets.2018-09-04-14.59.txt | 15:44 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/oslo_config_plaintext_secrets/2018/oslo_config_plaintext_secrets.2018-09-04-14.59.log.html | 15:44 |
| *** redrobot has quit IRC | 15:46 | |
| *** mjturek has joined #openstack-meeting-3 | 15:48 | |
| *** jlvilla-viva is now known as jlvillal | 15:58 | |
| *** yamamoto has quit IRC | 15:58 | |
| *** yamamoto has joined #openstack-meeting-3 | 15:58 | |
| *** yamahata has quit IRC | 16:07 | |
| *** macza has joined #openstack-meeting-3 | 16:08 | |
| *** alexchadin has joined #openstack-meeting-3 | 16:10 | |
| *** alexchadin has quit IRC | 16:14 | |
| *** spilla has quit IRC | 16:36 | |
| *** mjturek has quit IRC | 16:41 | |
| *** mjturek has joined #openstack-meeting-3 | 16:42 | |
| *** tssurya has quit IRC | 16:54 | |
| *** njohnston has quit IRC | 17:12 | |
| *** Adri2000 has quit IRC | 17:16 | |
| *** Adri2000 has joined #openstack-meeting-3 | 17:19 | |
| *** njohnston has joined #openstack-meeting-3 | 17:34 | |
| *** yamahata has joined #openstack-meeting-3 | 17:37 | |
| *** iyamahat has quit IRC | 17:41 | |
| *** yamahata has quit IRC | 17:41 | |
| *** e0ne has quit IRC | 17:44 | |
| *** diablo_rojo has joined #openstack-meeting-3 | 17:47 | |
| *** mjturek has quit IRC | 17:53 | |
| *** iyamahat has joined #openstack-meeting-3 | 17:54 | |
| *** alexchadin has joined #openstack-meeting-3 | 17:56 | |
| *** iyamahat_ has joined #openstack-meeting-3 | 17:57 | |
| *** alexchadin has quit IRC | 18:00 | |
| *** iyamahat has quit IRC | 18:01 | |
| *** njohnston has quit IRC | 18:10 | |
| *** jamesmcarthur has quit IRC | 18:12 | |
| *** yamahata has joined #openstack-meeting-3 | 18:12 | |
| *** alexchadin has joined #openstack-meeting-3 | 18:23 | |
| *** alexchadin has quit IRC | 18:27 | |
| *** jamesmcarthur has joined #openstack-meeting-3 | 18:32 | |
| *** jamesmcarthur has quit IRC | 18:36 | |
| *** mjturek has joined #openstack-meeting-3 | 18:49 | |
| *** jamesmcarthur has joined #openstack-meeting-3 | 19:11 | |
| *** mjturek has quit IRC | 19:11 | |
| *** jamesmcarthur has quit IRC | 19:15 | |
| *** jamesmcarthur_ has joined #openstack-meeting-3 | 19:15 | |
| *** e0ne has joined #openstack-meeting-3 | 19:27 | |
| *** mjturek has joined #openstack-meeting-3 | 19:30 | |
| *** jamesmcarthur_ has quit IRC | 19:33 | |
| *** e0ne has quit IRC | 19:33 | |
| *** e0ne has joined #openstack-meeting-3 | 19:52 | |
| *** alexchadin has joined #openstack-meeting-3 | 20:16 | |
| *** jamesmcarthur has joined #openstack-meeting-3 | 20:21 | |
| *** alexchadin has quit IRC | 20:51 | |
| *** raildo has quit IRC | 20:51 | |
| *** bobh_ has quit IRC | 21:00 | |
| *** iyamahat__ has joined #openstack-meeting-3 | 21:01 | |
| *** bobh has joined #openstack-meeting-3 | 21:02 | |
| *** iyamahat_ has quit IRC | 21:04 | |
| *** bobh has quit IRC | 21:07 | |
| *** e0ne has quit IRC | 21:13 | |
| *** iyamahat__ has quit IRC | 21:31 | |
| *** iyamahat has joined #openstack-meeting-3 | 21:32 | |
| *** yamahata has quit IRC | 21:36 | |
| *** bobh has joined #openstack-meeting-3 | 21:36 | |
| *** yamahata has joined #openstack-meeting-3 | 21:36 | |
| *** munimeha1 has quit IRC | 21:47 | |
| *** bobh has quit IRC | 22:10 | |
| *** ianychoi has quit IRC | 22:22 | |
| *** aagate has quit IRC | 22:27 | |
| *** jamesmcarthur has quit IRC | 22:50 | |
| *** jamesmcarthur has joined #openstack-meeting-3 | 22:51 | |
| *** jamesmcarthur has quit IRC | 22:52 | |
| *** ianychoi has joined #openstack-meeting-3 | 23:16 | |
| *** aagate has joined #openstack-meeting-3 | 23:31 | |
| *** jamesmcarthur has joined #openstack-meeting-3 | 23:44 | |
| *** bobh has joined #openstack-meeting-3 | 23:44 | |
| *** jamesmcarthur has quit IRC | 23:48 | |
| *** bobh has quit IRC | 23:49 | |
| *** mjturek has quit IRC | 23:58 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!