| *** vkmc has joined #openstack-trove | 00:02 | |
| *** mattgriffin has joined #openstack-trove | 00:04 | |
| *** todd_dsm has quit IRC | 00:05 | |
| *** tkatarki has quit IRC | 00:05 | |
| *** IanGovett has quit IRC | 00:06 | |
| *** tkatarki has joined #openstack-trove | 00:07 | |
| *** eghobo has quit IRC | 00:07 | |
| *** mattgriffin has quit IRC | 00:10 | |
| *** ViswaV has quit IRC | 00:18 | |
| *** Longgeek has quit IRC | 00:26 | |
| *** Riddhi has quit IRC | 00:31 | |
| openstackgerrit | Auston McReynolds proposed a change to openstack/trove-integration: Make Rsync For Guest Optional https://review.openstack.org/119488 | 00:36 |
|---|---|---|
| *** russellb has quit IRC | 00:46 | |
| *** pdmars has quit IRC | 00:47 | |
| *** tkatarki has quit IRC | 00:47 | |
| *** pdmars has joined #openstack-trove | 00:47 | |
| *** russellb has joined #openstack-trove | 00:49 | |
| *** IanGovett has joined #openstack-trove | 00:55 | |
| *** tkatarki has joined #openstack-trove | 00:58 | |
| *** Riddhi has joined #openstack-trove | 01:05 | |
| *** IanGovett has quit IRC | 01:10 | |
| *** todd_dsm has joined #openstack-trove | 01:24 | |
| *** newb has joined #openstack-trove | 01:54 | |
| *** nosnos has joined #openstack-trove | 01:54 | |
| *** amcrn has quit IRC | 01:55 | |
| *** todd_dsm has quit IRC | 01:58 | |
| *** georgelorch has quit IRC | 02:02 | |
| *** rhodgin has joined #openstack-trove | 02:03 | |
| *** georgelorch has joined #openstack-trove | 02:03 | |
| *** fifieldt_ is now known as fifieldt | 02:03 | |
| *** ViswaV has joined #openstack-trove | 02:05 | |
| *** haomaiw__ has quit IRC | 02:14 | |
| *** haomaiwang has joined #openstack-trove | 02:15 | |
| *** ViswaV has quit IRC | 02:21 | |
| *** tkatarki has quit IRC | 02:21 | |
| *** harlowja is now known as harlowja_away | 02:25 | |
| *** haomaiwang has quit IRC | 02:30 | |
| *** haomaiw__ has joined #openstack-trove | 02:30 | |
| *** haomaiwa_ has joined #openstack-trove | 02:35 | |
| *** haomaiwa_ has quit IRC | 02:35 | |
| *** haomaiw__ has quit IRC | 02:36 | |
| *** haomaiwang has joined #openstack-trove | 02:36 | |
| *** haomai___ has joined #openstack-trove | 02:42 | |
| *** haomaiwang has quit IRC | 02:45 | |
| *** vkmc has quit IRC | 02:49 | |
| *** juantwo_ has joined #openstack-trove | 02:54 | |
| *** juantwo has quit IRC | 02:57 | |
| *** newb has quit IRC | 02:58 | |
| *** ramishra has joined #openstack-trove | 03:07 | |
| *** jasonb365 has joined #openstack-trove | 03:11 | |
| *** achampio1 has joined #openstack-trove | 03:32 | |
| *** haomai___ has quit IRC | 03:35 | |
| *** haomaiwang has joined #openstack-trove | 03:35 | |
| *** achampion has quit IRC | 03:35 | |
| *** haomaiw__ has joined #openstack-trove | 03:47 | |
| *** haomaiwang has quit IRC | 03:50 | |
| *** achampion has joined #openstack-trove | 04:10 | |
| *** achampio1 has quit IRC | 04:13 | |
| *** ramishra has quit IRC | 04:19 | |
| *** ramishra_ has joined #openstack-trove | 04:21 | |
| *** rushiagr_away is now known as rushiagr | 04:40 | |
| *** ajayaa has joined #openstack-trove | 04:51 | |
| *** jasonb365 has quit IRC | 05:04 | |
| *** sgotliv has joined #openstack-trove | 05:09 | |
| *** juantwo_ has quit IRC | 05:17 | |
| *** vigneshvar has joined #openstack-trove | 05:17 | |
| vigneshvar | https://review.openstack.org/#/c/117985/ | 05:35 |
| *** k4n0 has joined #openstack-trove | 05:45 | |
| *** ramishra_ has quit IRC | 05:49 | |
| *** achampion has quit IRC | 05:53 | |
| *** ramishra has joined #openstack-trove | 05:54 | |
| *** ajayaa has quit IRC | 06:30 | |
| *** flaper87|afk is now known as flaper87 | 06:34 | |
| *** ajayaa has joined #openstack-trove | 06:39 | |
| *** ramishra has quit IRC | 06:42 | |
| openstackgerrit | Nikhil Manchanda proposed a change to openstack/trove-integration: Fix dsvm-gate-tests command to run int-tests https://review.openstack.org/120322 | 06:48 |
| *** rushiagr is now known as rushiagr_away | 06:48 | |
| *** rushiagr_away is now known as rushiagr | 06:49 | |
| *** k4n0 has quit IRC | 07:07 | |
| *** k4n0 has joined #openstack-trove | 07:21 | |
| openstackgerrit | Nikhil Manchanda proposed a change to openstack/trove-integration: Fix dsvm-gate-tests command to run int-tests https://review.openstack.org/120322 | 07:36 |
| *** sgotliv has quit IRC | 07:37 | |
| *** achampion has joined #openstack-trove | 07:59 | |
| *** jdandrea has joined #openstack-trove | 08:00 | |
| *** julienvey has joined #openstack-trove | 08:02 | |
| *** achampion has quit IRC | 08:07 | |
| *** boblebauce has joined #openstack-trove | 08:22 | |
| *** julienvey has quit IRC | 08:29 | |
| *** julienvey has joined #openstack-trove | 08:30 | |
| *** achampion has joined #openstack-trove | 08:32 | |
| *** ramishra has joined #openstack-trove | 08:43 | |
| *** ramishra has quit IRC | 08:47 | |
| *** sgotliv has joined #openstack-trove | 08:48 | |
| *** ramishra has joined #openstack-trove | 08:59 | |
| *** ramishra has quit IRC | 09:00 | |
| *** ramishra has joined #openstack-trove | 09:01 | |
| *** ramishra has quit IRC | 09:05 | |
| *** rushiagr is now known as rushiagr_away | 09:18 | |
| *** rushiagr_away is now known as rushiagr | 09:18 | |
| *** vigneshvar has quit IRC | 09:30 | |
| *** vigneshvar has joined #openstack-trove | 09:31 | |
| *** nosnos has quit IRC | 09:41 | |
| *** nosnos has joined #openstack-trove | 09:42 | |
| *** nosnos has quit IRC | 09:47 | |
| *** ramishra has joined #openstack-trove | 09:52 | |
| *** Longgeek has joined #openstack-trove | 09:59 | |
| *** Bharat_Kobagana has joined #openstack-trove | 10:02 | |
| *** sgotliv has quit IRC | 10:09 | |
| *** Bharat_Kobagana is now known as bharat_kobagana | 10:10 | |
| *** ramishra has quit IRC | 10:25 | |
| *** ramishra has joined #openstack-trove | 10:26 | |
| *** sgotliv has joined #openstack-trove | 10:26 | |
| *** haomaiw__ has quit IRC | 10:34 | |
| *** 18VAAWTEG has joined #openstack-trove | 10:34 | |
| *** Riddhi has quit IRC | 10:44 | |
| *** ramishra has quit IRC | 10:44 | |
| *** IanGovett has joined #openstack-trove | 10:47 | |
| *** 18VAAWTEG has quit IRC | 10:53 | |
| *** haomaiwang has joined #openstack-trove | 10:53 | |
| *** miqui has quit IRC | 11:00 | |
| *** bharat_kobagana has quit IRC | 11:03 | |
| *** Longgeek_ has joined #openstack-trove | 11:14 | |
| *** Longgeek has quit IRC | 11:18 | |
| *** tomblank has quit IRC | 11:20 | |
| *** isviridov_away is now known as isviridov | 11:42 | |
| *** juantwo has joined #openstack-trove | 11:52 | |
| *** juantwo has quit IRC | 11:53 | |
| *** juantwo has joined #openstack-trove | 11:53 | |
| *** vkmc has joined #openstack-trove | 12:00 | |
| *** vkmc has joined #openstack-trove | 12:00 | |
| *** ramishra has joined #openstack-trove | 12:15 | |
| *** ramishra has quit IRC | 12:19 | |
| *** jcru has joined #openstack-trove | 12:28 | |
| *** miqui has joined #openstack-trove | 12:29 | |
| *** radez_g0n3 is now known as radez | 12:43 | |
| *** achampion has quit IRC | 12:43 | |
| *** boblebauce has quit IRC | 12:49 | |
| *** achampion has joined #openstack-trove | 12:52 | |
| *** georgelorch has quit IRC | 13:00 | |
| *** georgelorch has joined #openstack-trove | 13:00 | |
| denis_makogon | Hey, guys, i've started to filing bugs for clustering, any help is welcome, see https://etherpad.openstack.org/p/trove-cluster-api-bugs | 13:04 |
| *** IanGovett1 has joined #openstack-trove | 13:08 | |
| *** IanGovett has quit IRC | 13:10 | |
| *** IanGovett has joined #openstack-trove | 13:15 | |
| *** ramishra has joined #openstack-trove | 13:16 | |
| *** tomblank has joined #openstack-trove | 13:16 | |
| *** IanGovett1 has quit IRC | 13:16 | |
| *** tkatarki has joined #openstack-trove | 13:16 | |
| *** boblebauce has joined #openstack-trove | 13:19 | |
| *** ramishra has quit IRC | 13:20 | |
| *** IanGovett has quit IRC | 13:26 | |
| *** rhodgin has quit IRC | 13:31 | |
| *** julienvey has quit IRC | 13:34 | |
| *** Barker has joined #openstack-trove | 13:39 | |
| *** julienvey has joined #openstack-trove | 13:52 | |
| *** sgotliv has quit IRC | 13:54 | |
| *** johnma has quit IRC | 13:55 | |
| *** Longgeek_ has quit IRC | 13:56 | |
| *** sgotliv has joined #openstack-trove | 14:10 | |
| *** Longgeek has joined #openstack-trove | 14:11 | |
| *** tomblank has quit IRC | 14:16 | |
| *** mattgriffin has joined #openstack-trove | 14:16 | |
| *** rhodgin has joined #openstack-trove | 14:17 | |
| *** ajayaa has quit IRC | 14:24 | |
| *** tomblank has joined #openstack-trove | 14:27 | |
| *** rwsu has joined #openstack-trove | 14:30 | |
| *** Longgeek has quit IRC | 14:34 | |
| *** iartarisi has joined #openstack-trove | 14:35 | |
| *** Longgeek has joined #openstack-trove | 14:42 | |
| *** IanGovett has joined #openstack-trove | 14:42 | |
| *** rwsu has quit IRC | 14:48 | |
| *** Longgeek has quit IRC | 14:49 | |
| *** ramishra has joined #openstack-trove | 14:50 | |
| *** ramishra has quit IRC | 14:54 | |
| *** kevinconway has joined #openstack-trove | 14:55 | |
| *** jasonb365 has joined #openstack-trove | 14:58 | |
| *** jmontemayor has joined #openstack-trove | 15:00 | |
| *** jmontemayor has quit IRC | 15:00 | |
| *** jmontemayor has joined #openstack-trove | 15:02 | |
| *** jmontemayor has quit IRC | 15:03 | |
| *** grapex has joined #openstack-trove | 15:04 | |
| *** jmontemayor has joined #openstack-trove | 15:06 | |
| *** grapex_ has joined #openstack-trove | 15:09 | |
| *** grapex has quit IRC | 15:12 | |
| *** jmontemayor has quit IRC | 15:15 | |
| *** jmontemayor has joined #openstack-trove | 15:18 | |
| *** sgotliv has quit IRC | 15:30 | |
| *** k4n0 has quit IRC | 15:34 | |
| *** iartarisi has quit IRC | 15:39 | |
| *** sgotliv has joined #openstack-trove | 15:43 | |
| *** johnma has joined #openstack-trove | 15:51 | |
| amrith | denis_makogon, yt? | 15:53 |
| *** juantwo has quit IRC | 15:56 | |
| *** juantwo has joined #openstack-trove | 15:57 | |
| *** kevinconway has quit IRC | 15:58 | |
| *** Barker has quit IRC | 15:59 | |
| *** grapex has joined #openstack-trove | 15:59 | |
| *** grapex_ has quit IRC | 16:01 | |
| *** kevinconway has joined #openstack-trove | 16:03 | |
| *** Barker has joined #openstack-trove | 16:04 | |
| *** rwsu has joined #openstack-trove | 16:12 | |
| *** boblebauce has quit IRC | 16:17 | |
| *** todd_dsm has joined #openstack-trove | 16:24 | |
| *** julienve_ has joined #openstack-trove | 16:30 | |
| *** ViswaV has joined #openstack-trove | 16:34 | |
| *** juantwo has quit IRC | 16:34 | |
| *** julienvey has quit IRC | 16:34 | |
| *** todd_dsm has quit IRC | 16:35 | |
| *** todd_dsm has joined #openstack-trove | 16:36 | |
| *** ViswaV_ has joined #openstack-trove | 16:37 | |
| denis_makogon | amrith, yes | 16:38 |
| denis_makogon | amrith, i'm going to leave, soon, hope it's not something urgent | 16:39 |
| amrith | denis_makogon, I'm not sure I understand the rationale for your comment in https://review.openstack.org/#/c/117174/ | 16:39 |
| amrith | it was your comment ;) | 16:39 |
| *** sgotliv has quit IRC | 16:39 | |
| *** jasonb365 has quit IRC | 16:40 | |
| *** ViswaV has quit IRC | 16:40 | |
| *** kevinconway has quit IRC | 16:40 | |
| *** Barker has quit IRC | 16:42 | |
| *** juantwo has joined #openstack-trove | 16:43 | |
| *** Barker has joined #openstack-trove | 16:43 | |
| denis_makogon | amrith, yes, i see, it's not quite good to catch to broad exception in general, we might avoid such things because of coding standards (see the same question here http://stackoverflow.com/questions/14797375/should-we-always-specify-an-exception-type-in-python) | 16:44 |
| amrith | yes, I've read that (after seeing your comment) | 16:44 |
| amrith | but if I were to handle stuff differently based on the exception, your comment makes sense | 16:45 |
| amrith | and that answer doesn't say "don't ever ever ever use 'except:'" | 16:45 |
| amrith | it is a warning, not an error. | 16:45 |
| amrith | No matter what the exception is, I will do the exact same thing. | 16:45 |
| amrith | so what's the objection? | 16:45 |
| *** todd_dsm has quit IRC | 16:45 | |
| amrith | But, reading your comment and Dan's (esp, yt?) made me realize that the code is bad for another reason | 16:47 |
| amrith | I'm just rethrowing whatever exception I got | 16:47 |
| amrith | and there's no telling whether the caller will be able to catch that | 16:47 |
| amrith | so maybe I shouldn't just raise, I should raise RunTimeError() or some such thing | 16:47 |
| amrith | which there is a better chance that the caller is catching. | 16:47 |
| amrith | which brings up the fact that this routine has no doc string telling what it may raise ;) | 16:47 |
| *** Barker has quit IRC | 16:48 | |
| denis_makogon | amrith, sounds good (about RunTime exception) | 16:48 |
| denis_makogon | amrith, in general code style looks not so good, and if we're able to avoid even warnings - worth trying it | 16:49 |
| amrith | but I don't get a warning for this code | 16:49 |
| amrith | not from pep | 16:49 |
| amrith | not from my IDE | 16:49 |
| amrith | not from emacs (which is all that really matters) | 16:49 |
| amrith | Yes, if I change it to 'except:' my IDE gives me a warning | 16:50 |
| denis_makogon | actually, don't know why, my PyCharm raised warning | 16:50 |
| amrith | and the warning is? | 16:50 |
| amrith | actually | 16:51 |
| denis_makogon | "too broad exception" | 16:51 |
| amrith | was it a warning or an info lightbulb | 16:51 |
| denis_makogon | actual warning | 16:51 |
| amrith | I use pycharm as well, no warning. | 16:51 |
| *** jmontemayor has quit IRC | 16:52 | |
| *** ViswaV_ has quit IRC | 16:52 | |
| denis_makogon | no matter, i'd suggest to dig into exceptions that are might be raised by methods that were used and write exception handling according to them | 16:53 |
| denis_makogon | it's just IMHO, you can ignore it and move forward, as i said "i strongly recommend", i didn't say "Hey, that's bad, fix it" | 16:54 |
| denis_makogon | just friendly suggestion =) | 16:55 |
| *** ViswaV has joined #openstack-trove | 16:55 | |
| *** jmontemayor has joined #openstack-trove | 16:55 | |
| denis_makogon | amrith, once you're here, you might take a look at https://etherpad.openstack.org/p/trove-cluster-api-bugs | 16:55 |
| amrith | I understand, what I'm trying to understand is why you think that's the case. why is it important. After all, you took the time to make the suggestion so it must matter to you. | 16:57 |
| *** kevinconway has joined #openstack-trove | 16:57 | |
| *** kevinconway has quit IRC | 16:58 | |
| *** harlowja_away is now known as harlowja | 16:58 | |
| denis_makogon | just want to see nice stylish code | 16:58 |
| *** kevinconway has joined #openstack-trove | 16:58 | |
| denis_makogon | if we know what's going to be raised, why can't we expect it | 16:58 |
| denis_makogon | that's all | 16:59 |
| *** Barker has joined #openstack-trove | 17:01 | |
| *** Barker has quit IRC | 17:02 | |
| amrith | denis_makogon, one second, let me send you screen shot from my PyCharm | 17:03 |
| *** Barker has joined #openstack-trove | 17:03 | |
| amrith | how do I send you a picture? | 17:04 |
| amrith | screen shot of PyCharm | 17:04 |
| denis_makogon | amrith, let's do it later, i'm leaving now | 17:04 |
| amrith | ok | 17:05 |
| *** amcrn has joined #openstack-trove | 17:05 | |
| denis_makogon | amrith, just wanted to say what i want to say, in general, code looks good, i don't have objections about it, just wanted to recommend to rework exception handling =) | 17:06 |
| *** vigneshvar has quit IRC | 17:08 | |
| *** denis_makogon has quit IRC | 17:10 | |
| *** rushiagr is now known as rushiagr_away | 17:13 | |
| *** juantwo_ has joined #openstack-trove | 17:20 | |
| *** juantwo has quit IRC | 17:23 | |
| *** julienve_ has quit IRC | 17:35 | |
| *** julienvey has joined #openstack-trove | 17:35 | |
| *** rushiagr_away is now known as rushiagr | 17:36 | |
| *** julienvey has quit IRC | 17:40 | |
| *** eghobo has joined #openstack-trove | 17:45 | |
| *** saurabhs has joined #openstack-trove | 17:50 | |
| *** rushiagr is now known as rushiagr_away | 17:51 | |
| *** vigneshvar has joined #openstack-trove | 17:55 | |
| *** jasonb365 has joined #openstack-trove | 17:55 | |
| *** jmontemayor has quit IRC | 17:58 | |
| *** Barker has quit IRC | 17:59 | |
| *** Barker has joined #openstack-trove | 18:02 | |
| SlickNik | Reminder: Weekly trove meeting is happening now in #openstack-meeting-alt | 18:02 |
| *** jmontemayor has joined #openstack-trove | 18:03 | |
| *** ramashri has joined #openstack-trove | 18:05 | |
| *** ranjitha has joined #openstack-trove | 18:05 | |
| *** cweid_ has joined #openstack-trove | 18:12 | |
| *** ranjitha has quit IRC | 18:12 | |
| *** ranjitha has joined #openstack-trove | 18:14 | |
| *** cweid has quit IRC | 18:15 | |
| *** robertmyers has joined #openstack-trove | 18:21 | |
| *** todd_dsm has joined #openstack-trove | 18:30 | |
| *** rushiagr_away is now known as rushiagr | 18:33 | |
| *** todd_dsm has quit IRC | 18:34 | |
| *** todd_dsm has joined #openstack-trove | 18:35 | |
| *** julienvey has joined #openstack-trove | 18:36 | |
| *** Barker has quit IRC | 18:40 | |
| *** julienvey has quit IRC | 18:40 | |
| *** ranjitha has quit IRC | 18:42 | |
| *** sgotliv has joined #openstack-trove | 18:44 | |
| *** ViswaV has quit IRC | 18:44 | |
| *** todd_dsm has quit IRC | 18:51 | |
| openstackgerrit | amrith proposed a change to openstack/trove: Partially address concerns in Couchbase restore strategy https://review.openstack.org/117174 | 18:53 |
| *** Barker has joined #openstack-trove | 18:55 | |
| *** georgelorch has quit IRC | 18:57 | |
| *** georgelorch has joined #openstack-trove | 18:57 | |
| *** IanGovett has quit IRC | 18:58 | |
| *** IanGovett has joined #openstack-trove | 18:58 | |
| *** eghobo has quit IRC | 18:59 | |
| *** radez is now known as radez_g0n3 | 18:59 | |
| *** ranjitha has joined #openstack-trove | 19:00 | |
| *** Barker has quit IRC | 19:00 | |
| *** cweid_ has quit IRC | 19:01 | |
| *** Barker has joined #openstack-trove | 19:02 | |
| *** rushiagr is now known as rushiagr_away | 19:02 | |
| *** Barker has quit IRC | 19:02 | |
| *** grapex_ has joined #openstack-trove | 19:03 | |
| *** Barker has joined #openstack-trove | 19:03 | |
| *** ranjitha has quit IRC | 19:03 | |
| *** grapex has quit IRC | 19:06 | |
| *** cweid has joined #openstack-trove | 19:07 | |
| kevinconway | amrith: SlickNik: grapex_: i updated the BP from monday to include examples of the scenarios we outlined: https://wiki.openstack.org/wiki/Trove/TroveSSL | 19:11 |
| kevinconway | with regards to ssl, thatis | 19:12 |
| amrith | kevinconway, will read it now. | 19:12 |
| *** ramashri has quit IRC | 19:14 | |
| *** ViswaV has joined #openstack-trove | 19:17 | |
| openstackgerrit | Sergey Gotliv proposed a change to openstack/trove: [WIP] Updates RPC API to use oslo.messaging https://review.openstack.org/94484 | 19:21 |
| *** tkatarki has quit IRC | 19:27 | |
| *** tkatarki has joined #openstack-trove | 19:27 | |
| *** Barker has quit IRC | 19:33 | |
| *** newb has joined #openstack-trove | 19:34 | |
| *** Barker has joined #openstack-trove | 19:36 | |
| *** julienvey has joined #openstack-trove | 19:36 | |
| *** Barker has quit IRC | 19:40 | |
| *** julienvey has quit IRC | 19:41 | |
| vgnbkr | kevinconway: re SSL: Could you give us an idea of how you see this being used? Is the intention that the cloud provider would provide a common cert across all dbs, all dbs for a given tenant would share a cert, or that the user will define a cert (similar to how keypairs are done)? | 19:48 |
| kevinconway | vgnbkr: ideally that's at the whim of a provider | 19:53 |
| kevinconway | i'm trying to set this up so providers have as much flex as needed to implement their own key/cert management | 19:53 |
| kevinconway | without requiring that trove do all those things | 19:53 |
| *** ViswaV has quit IRC | 19:56 | |
| *** ViswaV has joined #openstack-trove | 20:02 | |
| *** julienvey has joined #openstack-trove | 20:02 | |
| *** jmontemayor_ has joined #openstack-trove | 20:04 | |
| *** jmontema_ has joined #openstack-trove | 20:05 | |
| *** jmontemayor has quit IRC | 20:06 | |
| *** tkatarki has quit IRC | 20:07 | |
| *** julienvey has quit IRC | 20:07 | |
| *** tkatarki has joined #openstack-trove | 20:08 | |
| *** jmontemayor_ has quit IRC | 20:09 | |
| *** dkehn has quit IRC | 20:10 | |
| *** dkehn has joined #openstack-trove | 20:12 | |
| dougshelley66 | kevinconway, a clarification - so out of the box will SSL work or will the "user" have to implement something | 20:14 |
| *** ViswaV has quit IRC | 20:17 | |
| *** jmontema_ has quit IRC | 20:31 | |
| amrith | kevinconway, read the spec. I think it reflects what I'd proposed (3 options) on Monday although in my understanding, the ssl_payload for the NoOp use case was that the guest agent knew what to do and it would just do it. | 20:32 |
| amrith | I'm assuming that the default config will be ssl_disabled | 20:32 |
| amrith | some other questions | 20:32 |
| amrith | how do we know whether a data store supports ssl? | 20:32 |
| amrith | not whether it is enabled or not, but whether it is supported or not? | 20:33 |
| amrith | how do we know what kind(s) of payloads a guest agent may understand | 20:33 |
| amrith | kevinconway ^^ (thanks) | 20:34 |
| *** amcrn has quit IRC | 20:35 | |
| kevinconway | amrith: my intention was for each datastore which support ssl to implement both the provider and installer. this way it is one config option for the driver | 20:39 |
| kevinconway | amrith: the guest would simply load the given driver and be able to consume the payload since the driver also produces the payload | 20:39 |
| *** zacksh has quit IRC | 20:40 | |
| kevinconway | amrith: clarification: when you ask whether a datastore supports ssl, do you mean the datastore itself or the trove datastore (as in the PAI construct) | 20:40 |
| *** freyes has quit IRC | 20:41 | |
| *** zacksh has joined #openstack-trove | 20:41 | |
| *** freyes has joined #openstack-trove | 20:42 | |
| amrith | trove datastore (aka, is it valid to execute the ssl_enable command) | 20:42 |
| *** juantwo_ has quit IRC | 20:42 | |
| kevinconway | i see. for the initial impl i imagined this would be a feature that would either be enabled/disabled at instance create with an optional mgmt command to enable it | 20:43 |
| kevinconway | i haven't spec'ed out a trove consumer api yet | 20:43 |
| *** tomblank has quit IRC | 20:43 | |
| amrith | if it is at instance create time, then why the restart_required state? | 20:44 |
| amrith | oh, ok | 20:44 |
| amrith | optional command to enable later? | 20:44 |
| *** IanGovett has quit IRC | 20:44 | |
| kevinconway | yes, setting up ssl on an existing instance would require restart for most datastores | 20:44 |
| kevinconway | that's what the state is for | 20:44 |
| *** jcru has quit IRC | 20:45 | |
| amrith | kevinconway, one thing | 20:46 |
| amrith | vgnbkr and I have been chatting about this on the sidelines | 20:46 |
| amrith | one thing which we came away with was this | 20:46 |
| amrith | we can't think of any good reason why one would send the keypair over the wire | 20:46 |
| amrith | I had initially thought it would be a keypair expiry thing | 20:47 |
| amrith | but after reading more about it overnight, vgnbkr's point of view is correct. | 20:47 |
| amrith | sending the keypair over the wire seems to be unnecessary (in any case that we can conceive of at least) | 20:47 |
| amrith | so, I'd like to know specifically the answer to vgnbkr's qustion about where he asks for a use-case/situation where the user would like to provide the keypair to the guest machine | 20:48 |
| amrith | I get the idea of why one would give it the cert | 20:48 |
| amrith | no argument there | 20:48 |
| amrith | but I submit to you that in 100% of the cases that I can think of (i'm not a security expert, I don't play one on tv or IRC), there is no need to send the keypair over to the guest. | 20:49 |
| *** tmcpeak has joined #openstack-trove | 20:49 | |
| amrith | vgnbkr, did I correctly represent the things we chatted about? | 20:49 |
| kevinconway | clarification - who is user the is providing the keypair? trove consumer or trove deployer? | 20:49 |
| *** ViswaV has joined #openstack-trove | 20:50 | |
| kevinconway | in the scenarios you discussed, that is | 20:50 |
| amrith | no one provides the keypair as far as I can tell | 20:50 |
| amrith | the machine creates it | 20:50 |
| amrith | the ssl_enable command has a payload that only needs one thing | 20:51 |
| amrith | certificate | 20:51 |
| tmcpeak | hey guys, trying to get up to speed | 20:51 |
| amrith | (ca certificate) | 20:51 |
| tmcpeak | amrith asked me to come by | 20:51 |
| amrith | ah, tmcpeak ... hello | 20:51 |
| tmcpeak | I'm from OSSG | 20:51 |
| tmcpeak | hi all | 20:51 |
| amrith | thx tmcpeak ... | 20:51 |
| amrith | we're talking about ssl on trove instances | 20:51 |
| kevinconway | well it depends. if you want to use signed keys the ssl keypair needs to be generated and signed using the ca-cert and ca-key | 20:51 |
| SlickNik | amrith: You can't generate a random key — you'll need the same one that the CA has signed. | 20:52 |
| tmcpeak | can we generate one and go about whatever procedure to get it signed? | 20:53 |
| tmcpeak | what's the CA in this case? | 20:53 |
| amrith | SlickNik, I'm not grokking something here. | 20:53 |
| amrith | SlickNik, kevinconway ... let me send around what I understand to be the process and why I'm confused about this. | 20:53 |
| amrith | sorry, fell off the network | 20:55 |
| kevinconway | tmcpeak: using mysql as an example, the typical mysql ssl setup is to sign a key pair, install that in the db, and provide the public ca-cert to end users | 20:55 |
| kevinconway | but generically for the feature it is simply the ca pair used to sign ssl keys | 20:56 |
| tmcpeak | ok, how is it protected during transfer | 20:57 |
| tmcpeak | ? | 20:57 |
| vgnbkr | amrith: Yes, you have reflected what we discussed. | 20:57 |
| vgnbkr | I think we need to clarify use cases. | 20:57 |
| kevinconway | tmcpeak: so under the current BP the ca-key would never be transported | 20:57 |
| *** tkatarki has quit IRC | 20:58 | |
| vgnbkr | From a cloud provider's point of view, they would want to inject the keys and certs into the instances so that all databases can be accessed by the same cert. | 20:58 |
| tmcpeak | ok, yeah, definitely can't transfer the CA key | 20:58 |
| *** jmontemayor has joined #openstack-trove | 20:58 | |
| tmcpeak | only the CA should ever have the CA private key | 20:59 |
| vgnbkr | Enterprises may wish to do the same, or they might prefer to avoid the key mgmt overhead, have each instance generate it's own keys/cert, then require the user to download the cert for that instance. | 20:59 |
| kevinconway | i think most of the contention comes from the notion that a deployer might distribute ssl key pairs (private included) over the AMQ | 20:59 |
| amrith | kevinconway, that's correct. that is my concern. | 20:59 |
| amrith | almost in its entirety. | 21:00 |
| tmcpeak | kevinconway: yeah, how is that AMQ connection secured? | 21:00 |
| kevinconway | it's the trove infra message bus. all trove to guest communication occurs over that AMQ | 21:00 |
| tmcpeak | hmm | 21:00 |
| kevinconway | i suppose there is nothing to prevent a deployer from unsecuring it | 21:01 |
| amrith | kevinconway, tmcpeak have to step out for a bit. will read scrollback later. also will send what I tested when I get back to a PC. | 21:01 |
| amrith | sorry, unexpected callout. | 21:01 |
| SlickNik | it's a deployment option though, correct? I can chose in my deployment to do it over AMQP if I have a secure AMQP connection in my deployment (i.e. using TLS). If not, I can choose to bake the keys into the image, and use the same cert for all instances? | 21:01 |
| tmcpeak | amrith: cool | 21:01 |
| kevinconway | SlickNik: correct, pushing keys over the AMQ would be a possible option for deployers, likely not the trove default | 21:01 |
| tmcpeak | so what is the solution actually implementing? are you just saying "public/private keys and the cert need to end up on the machine, make that happen somehow" or are you actually transferring them yourself? | 21:02 |
| *** julienvey has joined #openstack-trove | 21:03 | |
| kevinconway | the solution is simply an interface that allows trove to pass _some_ identifier to the guest that represents a public key, private key, and ca cert | 21:03 |
| kevinconway | we have discussed multiple options including those references being HREF's or being nothing at all | 21:03 |
| tmcpeak | so it could be an encrypted blob as well | 21:03 |
| kevinconway | possibly being the keys themselves | 21:03 |
| tmcpeak | ? | 21:03 |
| kevinconway | yes, there is nothing that would prevent that as an implementation | 21:04 |
| tmcpeak | in that case, I think it's fine | 21:04 |
| kevinconway | ultimately it would be at the deployers discretion | 21:04 |
| tmcpeak | ok, yeah, as long as you aren't implementing sending a private key yourself, it's fine | 21:05 |
| vgnbkr | I don't know that just saying "encrypted blob" achieves anything. You would have to push the keys for the blob to be unencrypted. | 21:05 |
| tmcpeak | it could be out of band though | 21:05 |
| *** tkatarki has joined #openstack-trove | 21:05 | |
| kevinconway | you can put a shared key in the guest image, for example, which allows it to decrypt the payload | 21:05 |
| tmcpeak | right | 21:05 |
| vgnbkr | So if you have an "out of band" channel, why wouldn't you just send the SSL keys/cert over it? | 21:05 |
| kevinconway | we already do this for backups | 21:05 |
| SlickNik | vgnbkr: Because you might want to have a shared secret, but uniques SSL keys/certs. | 21:06 |
| vgnbkr | So shouldn't the keys/certs be managed similar to how nova deals with keypairs? | 21:06 |
| SlickNik | nova keypairs don't ever need the private-key for anything though. It only ever deals with the public key. | 21:07 |
| *** julienvey has quit IRC | 21:07 | |
| openstackgerrit | Peter Stachowski proposed a change to openstack/trove: Document Trove configuration options https://review.openstack.org/118759 | 21:07 |
| vgnbkr | SlickNik: I meant an option in horizon to generate the keys/cert so that the enterprise user can manage them. | 21:08 |
| vgnbkr | Trove would then pass them down to the instances. | 21:08 |
| kevinconway | wouldn't that be a feature and use case of barbican once it supports those kinds of operations? | 21:09 |
| tmcpeak | kevinconway: yeah, I think that's in barbican territory | 21:10 |
| SlickNik | vgnbkr: That would work for self-signed certs, but if you want to have a CA signed cert, then you'd have to ship the key to the user so that they can pass it to the CA, and then also ship the cert back to the trove instance once the CA has signed it. | 21:10 |
| SlickNik | yup, getting close to barbican territory. | 21:11 |
| *** miqui has quit IRC | 21:12 | |
| tmcpeak | I would call out in some way in the BP how the bottom example is secured | 21:13 |
| tmcpeak | where it just says: ssl_payload => {"public_key": "BEGIN RSA...", "private_key": "...", "ca_cert": "..."} guest behaviour => Use the keys given in the payload and setup ssl. | 21:14 |
| tmcpeak | looks terrifying | 21:14 |
| *** ramashri has joined #openstack-trove | 21:14 | |
| *** ranjitha has joined #openstack-trove | 21:14 | |
| tmcpeak | but if you're relying on a secure message channel you can mention that | 21:14 |
| kevinconway | yes, i think most everyone has agreed that a large disclaimer should accompany any tx of secure information over the bus | 21:15 |
| tmcpeak | ok cool | 21:15 |
| *** todd_dsm has joined #openstack-trove | 21:20 | |
| *** Toodles has joined #openstack-trove | 21:21 | |
| *** ViswaV has quit IRC | 21:23 | |
| Toodles | Kevinconway.. Does this mean that sending pk on the message bus is optional? | 21:25 |
| *** juantwo has joined #openstack-trove | 21:28 | |
| kevinconway | Toodles: we discussed alternate implementation of the driver that would not require it, yes | 21:28 |
| *** Toodles has quit IRC | 21:29 | |
| *** robertmyers has quit IRC | 21:30 | |
| *** ranjitha has quit IRC | 21:31 | |
| *** ramashri has quit IRC | 21:32 | |
| *** mattgriffin has quit IRC | 21:38 | |
| *** tomblank has joined #openstack-trove | 21:38 | |
| *** mattgriffin has joined #openstack-trove | 21:41 | |
| *** jasonb365 has quit IRC | 21:42 | |
| *** julienve_ has joined #openstack-trove | 21:43 | |
| *** ViswaV has joined #openstack-trove | 21:43 | |
| *** ramashri has joined #openstack-trove | 21:43 | |
| *** julienve_ has quit IRC | 21:44 | |
| *** newb_ has joined #openstack-trove | 21:53 | |
| *** amcrn has joined #openstack-trove | 21:53 | |
| *** newb has quit IRC | 21:56 | |
| *** jmontemayor has quit IRC | 22:03 | |
| *** ranjitha has joined #openstack-trove | 22:04 | |
| amrith | kevinconway, that was me. I couldn't get onto freenode with my (registered) nick from my phone. | 22:08 |
| amrith | back for a short while at a PC. | 22:08 |
| amrith | so, my concern (after speaking with vgnbkr) was this and I didn't do a good job conveying it earlier. | 22:09 |
| amrith | is it necessary to provide the keys to the guest | 22:10 |
| amrith | can the guest obtain it instead. | 22:10 |
| amrith | SlickNik, I read your comment re: the keypair having to be provided to the guest, I understand that part. | 22:10 |
| amrith | I'm thinking about my own experience with ssl'ing a site. | 22:10 |
| amrith | where once the certs and keys are ready | 22:10 |
| amrith | I have to get them over some secure channel (typically https) | 22:11 |
| amrith | and that https is based on the sender having a cert installed that is trusted by some entity that we mutually trust. | 22:11 |
| amrith | so, seeing the scrollback now, I see that there is a mechanism where the guest can GET the keypair and the cert | 22:11 |
| amrith | so I think I'm good with it. | 22:11 |
| *** tmcpeak has left #openstack-trove | 22:11 | |
| amrith | kevinconway, SlickNik, vgnbkr, tmcpeak ^^ please let me know if this makes sense. | 22:12 |
| *** ranjitha has quit IRC | 22:12 | |
| *** tmcpeak has joined #openstack-trove | 22:14 | |
| *** todd_dsm has quit IRC | 22:20 | |
| *** flaper87 is now known as flaper87|afk | 22:22 | |
| stevelle | Having trouble getting a redstack up here. Trove won't let me create an instance larger than 5GB, but at that size the nova instance wont launch. I gave swift 80GB on this devstack but still being gated at 5GB. | 22:24 |
| *** tmcpeak has left #openstack-trove | 22:26 | |
| stevelle | Any clues about where to go next? | 22:26 |
| *** todd_dsm has joined #openstack-trove | 22:26 | |
| openstackgerrit | Sergey Gotliv proposed a change to openstack/trove: [WIP] Updates RPC API to use oslo.messaging https://review.openstack.org/94484 | 22:29 |
| *** juantwo has quit IRC | 22:49 | |
| *** juantwo has joined #openstack-trove | 22:51 | |
| *** rhodgin has quit IRC | 22:58 | |
| *** mattgriffin has quit IRC | 22:59 | |
| *** todd_dsm has quit IRC | 23:04 | |
| *** todd_dsm has joined #openstack-trove | 23:05 | |
| *** kevinconway has quit IRC | 23:05 | |
| *** todd_dsm has quit IRC | 23:06 | |
| *** vigneshvar has quit IRC | 23:09 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/python-troveclient: Updated from global requirements https://review.openstack.org/120610 | 23:09 |
| *** todd_dsm has joined #openstack-trove | 23:14 | |
| *** mattgriffin has joined #openstack-trove | 23:14 | |
| *** todd_dsm has quit IRC | 23:20 | |
| *** sgotliv has quit IRC | 23:22 | |
| *** IanGovett has joined #openstack-trove | 23:38 | |
| *** todd_dsm has joined #openstack-trove | 23:40 | |
| *** harlowja has quit IRC | 23:48 | |
| *** harlowja_ has joined #openstack-trove | 23:48 | |
| *** todd_dsm has quit IRC | 23:58 | |
| amcrn | stevelle: the default configure of cinder on devstack won't permit a volume size > 5GB | 23:58 |
| amcrn | configuration* rather | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!