13:00:55 <redrobot> #startmeeting barbican
13:00:55 <openstack> Meeting started Tue Jan 12 13:00:55 2021 UTC and is due to finish in 60 minutes.  The chair is redrobot. Information about MeetBot at http://wiki.debian.org/MeetBot.
13:00:56 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
13:00:58 <openstack> The meeting name has been set to 'barbican'
13:01:17 <redrobot> #topic Roll Call
13:01:20 <redrobot> Courtesy ping for ade_lee dave-mccowan hrybacki jamespage Luzi lxkong mhen moguimar raildo rm_work xek nearyo
13:01:28 <Luzi> o/
13:01:38 <redrobot> As usual our agenda can be found here:
13:01:40 <redrobot> #link https://etherpad.opendev.org/p/barbican-weekly-meeting
13:01:41 <moguimar> o/
13:03:21 <rajivmucheli> redrobot i am currently testing barbican upgrade to victoria release, i see the below from the barbican-api pod when i execute barbican-api --version :
13:03:21 <rajivmucheli> root@barbican-api-59765f4fcb-z27rq:/# barbican-api --version
13:03:23 <rajivmucheli> from paste import httpserver
13:03:23 <rajivmucheli> 2021-01-12 13:03:08,716.716 243 INFO barbican.model.repositories [-] Setting up database engine and session factory
13:03:24 <rajivmucheli> 2021-01-12 13:03:08,745.745 243 INFO barbican.model.repositories [-] Not auto-creating barbican registry DB
13:03:24 <rajivmucheli> 2021-01-12 13:03:08,746.746 243 INFO barbican.api.app [-] Barbican app created and initialized
13:03:25 <rajivmucheli> 2021-01-12 13:03:08,760.760 243 WARNING datadog.dogstatsd [-] Error submitting packet: [Errno 111] Connection refused, dropping the packet and closing the socket: ConnectionRefusedError: [Errno 111] Connection refused
13:03:25 <rajivmucheli> 2021-01-12 13:03:08,768.768 243 CRITICAL barbican [-] Unhandled error: OSError: [Errno 98] Address already in use
13:03:25 <rajivmucheli> 2021-01-12 13:03:08,768.768 243 ERROR barbican Traceback (most recent call last):
13:03:26 <rajivmucheli> 2021-01-12 13:03:08,768.768 243 ERROR barbican   File "/var/lib/openstack/bin/barbican-api", line 17, in <module>
13:03:26 <rajivmucheli> 2021-01-12 13:03:08,768.768 243 ERROR barbican     run()
13:03:27 <rajivmucheli> 2021-01-12 13:03:08,768.768 243 ERROR barbican   File "/var/lib/openstack/bin/barbican-api", line 14, in run
13:03:27 <rajivmucheli> 2021-01-12 13:03:08,768.768 243 ERROR barbican     httpserver.serve(application, host='0.0.0.0', port='9311')
13:03:28 <rajivmucheli> 2021-01-12 13:03:08,768.768 243 ERROR barbican   File "/var/lib/openstack/lib/python3.8/site-packages/paste/httpserver.py", line 1338, in serve
13:03:28 <rajivmucheli> 2021-01-12 13:03:08,768.768 243 ERROR barbican     server = WSGIThreadPoolServer(application, server_address, handler,
13:03:29 <rajivmucheli> 2021-01-12 13:03:08,768.768 243 ERROR barbican   File "/var/lib/openstack/lib/python3.8/site-packages/paste/httpserver.py", line 1157, in __init__
13:03:29 <rajivmucheli> 2021-01-12 13:03:08,768.768 243 ERROR barbican     WSGIServerBase.__init__(self, wsgi_application, server_address,
13:03:30 <rajivmucheli> 2021-01-12 13:03:08,768.768 243 ERROR barbican   File "/var/lib/openstack/lib/python3.8/site-packages/paste/httpserver.py", line 1136, in __init__
13:04:04 <redrobot> rajivmucheli hey, thanks for joining.  We just started the weekly meeting, so maybe we can talk about it after the meeting is over?
13:04:07 <rajivmucheli> this is my 1st IRC meeting, apologise if i missed to update any pre-req, i can do it now, if guided.
13:04:14 <rajivmucheli> sure
13:04:30 <redrobot> no worries
13:04:35 <redrobot> just a suggestion for next time
13:04:49 <redrobot> try not to paste logs here as it floods the channel with messages
13:04:54 <redrobot> try using http://paste.openstack.org/ instead
13:05:13 <redrobot> OK, let's get started with the meeting
13:05:23 <redrobot> #topic Aciton Items From Last Meeting
13:05:33 <redrobot> #link http://eavesdrop.openstack.org/meetings/barbican/2021/barbican.2021-01-05-13.02.html
13:05:44 <redrobot> Looks like we didn't have any Action Items last week
13:05:52 <redrobot> (ps. thanks moguimar for running the meeting last week)
13:06:09 <redrobot> Moving on ...
13:06:20 <redrobot> #topic Liaison Updates
13:06:21 <moguimar> maybe check on the AI from your last meeting
13:06:25 <redrobot> moguimar?  tosky?
13:06:37 <moguimar> Oslo is droping lower constraints
13:06:47 <moguimar> and taking cursive under its umbrella
13:06:56 <moguimar> open to barbican contributions
13:07:04 <redrobot> I had a topic for Cursive in the agenda, but we can talk about it now
13:07:22 <redrobot> #topic Cursive
13:07:49 <redrobot> #link https://opendev.org/x/cursive
13:08:04 <moguimar> do you want to add anything else to that statement?
13:08:30 <redrobot> A little background for folks:  Cursive is a digital signing library
13:09:07 <redrobot> it's used by a few projects and the original maintainers have moved on to other things
13:09:25 <redrobot> There was an ML discussion to get new maintainers since it's still used by OpenStack
13:09:39 <redrobot> Let me fish that ML link
13:10:03 <tosky> (sorry , nothing from me, and I haven't even updated the cursive patch)
13:10:08 <redrobot> #link http://lists.openstack.org/pipermail/openstack-discuss/2020-December/019430.html
13:10:19 <redrobot> TL;DR Oslo owns Cursive now
13:10:46 <redrobot> but our team will also have core reviewer votes as we are somewhat SMEs for crypto stuff
13:10:56 <tosky> and guess why :)
13:11:07 <redrobot> tosky ?
13:12:19 <redrobot> why is that? 🤔
13:13:21 <tosky> guess why you are considered SMEs for crypto stuff :D
13:13:44 <redrobot> 🤔🤔🤔
13:14:50 <tosky> maybe the fact that barbican is "crypto stuff" :)
13:15:02 <redrobot> lol
13:15:06 <tosky> ok, ok, it was a cheap attempt of joking
13:15:33 <redrobot> I lol'ed for real though 😝
13:16:02 <redrobot> moguimar can we get an updated dashboard link that pulls in Cursive reviews?
13:16:11 <moguimar> will do
13:16:17 <redrobot> Thanks!
13:16:39 <redrobot> #action moguimar to use his gerrit-foo to make us a new dashboard link that includes Cursive reviews
13:16:54 <redrobot> OK, moving on
13:17:00 <redrobot> #topic Kanban Review
13:17:17 <redrobot> #link https://tree.taiga.io/project/dmend-openstack-barbican/kanban
13:17:33 <redrobot> No updates from me here
13:17:57 <redrobot> Just got back into the office yesterday after a few weeks off, so I'm just starting to get back into the swing of things
13:20:10 <redrobot> #topic Cycle checkin
13:20:14 <redrobot> #link https://releases.openstack.org/wallaby/schedule.html
13:20:28 <redrobot> Wallaby-2 milestone is coming up next week
13:20:51 <redrobot> I will try to get the Microversions patch and Secret Consumers patches up before then
13:21:00 <redrobot> 🤞🤞
13:21:43 <redrobot> Also, it does not look like we have any specs for review this cycle:
13:21:45 <redrobot> #link https://review.opendev.org/q/project:openstack/barbican-specs+status:open
13:22:04 <redrobot> So if you're thinking of a spec for Wallaby now is the time to get it up for review.
13:23:43 <redrobot> Any questions/comments about Wallaby-2?
13:25:46 <redrobot> OK, moving on
13:25:49 <redrobot> #topic Bug Review
13:25:53 <redrobot> #link https://storyboard.openstack.org/#!/project_group/barbican
13:26:07 <redrobot> Looks like no new bugs in the Barbican Storyboards
13:26:30 <redrobot> #link https://bugs.launchpad.net/castellan/+bugs?orderby=-id&start=0
13:26:35 <redrobot> and also no new bugs in Castellan
13:26:49 <redrobot> #topic Wayward Reviews
13:27:00 <redrobot> #link https://tinyurl.com/y3ydwmkl
13:28:42 <moguimar> https://review.opendev.org/c/openstack/barbican/+/768512
13:30:50 <redrobot> moguimar I think I will -1 that one
13:31:20 <redrobot> the MKEK and HMAC labels don't have defaults in the config
13:31:22 <redrobot> #link https://opendev.org/openstack/barbican/src/branch/master/barbican/plugin/crypto/p11_crypto.py#L50-L51
13:31:53 <redrobot> and the rest of the instructions in that doc all use the convention of $HSM_NAME_mkek_0 and $HSM_NAME_hmac_0
13:31:54 <moguimar> I see
13:32:00 <moguimar> I just think the new name is more generic
13:32:15 <redrobot> I think the new name looks ugly :-P
13:32:41 <moguimar> yeah, but when you see something like that, you know you can name it whatever
13:32:47 <moguimar> not a fixed value
13:32:49 <redrobot> at least make both barbican_hmac_0 or my_hmac and my_mkek
13:32:58 <moguimar> sure
13:33:06 <moguimar> my_... works
13:33:24 <moguimar> make that suggestion then
13:34:03 <redrobot> will do
13:34:32 <moguimar> https://review.opendev.org/c/openstack/barbican/+/767275
13:34:49 <moguimar> it took me a while on this one to actually look at the classifiers
13:34:54 <moguimar> in pypi
13:35:19 <redrobot> LGTM
13:35:50 <redrobot> https://review.opendev.org/c/openstack/barbican/+/768000
13:35:58 <moguimar> and translations
13:36:00 <moguimar> https://review.opendev.org/c/openstack/barbican/+/768000
13:36:02 <moguimar> yeah, same
13:36:34 <moguimar> needs approval
13:36:36 <moguimar> https://review.opendev.org/c/openstack/barbican/+/769090
13:37:26 <moguimar> ah, I see you have already reviewed those
13:37:44 <moguimar> https://review.opendev.org/c/openstack/castellan/+/767726
13:37:50 <moguimar> wanna ship this one?
13:38:03 <moguimar> we decided on single approval, but you can put your finger on it =P
13:39:14 <redrobot> done
13:40:10 <redrobot> Easy one https://review.opendev.org/c/openstack/barbican-specs/+/769264
13:41:09 <moguimar> I was like "again? didn't I just +w this one?"
13:41:58 <redrobot> hehe
13:42:29 <moguimar> and it is finally snowing
13:42:32 <redrobot> I think that's it for easy reviews
13:42:38 <moguimar> yeah
13:42:48 <redrobot> Yeah, it's really freakin' cold over here too
13:42:53 <moguimar> open discussion? so rajivmucheli can have his questions?
13:42:59 <redrobot> woke up to 32 F ( 0 C)
13:43:05 <redrobot> #topic Open Discussion
13:43:38 <rajivmucheli> if this is better http://paste.openstack.org/show/801555/ ?
13:46:43 <redrobot> rajivmucheli yes, much better, thank you
13:46:49 <redrobot> > [Errno 98] Address already in use
13:47:05 <redrobot> my guess is there may be some other service running on that port?
13:47:09 <rajivmucheli> yes, the ps -ef shares the o/p
13:48:26 <rajivmucheli> ideally, barbican-api --version should ideally share an o/p, right ? i have the same setup to create openstack containers, i dont get this error for other services.
13:48:38 <openstackgerrit> Merged openstack/barbican-specs master: remove unicode from code  https://review.opendev.org/c/openstack/barbican-specs/+/769264
13:49:28 <redrobot> not sure what you mean by o/p ?
13:49:46 <rajivmucheli> output **
13:51:48 <redrobot> well, output should go to stdout, but I think that error means that the process can't bind to the 0.0.0.0:9311 address
13:51:57 <redrobot> maybe there is another process using that port?
13:52:10 <redrobot> are you running only this barbican container?
13:53:14 <rajivmucheli> yes, only barbican-api container is running in the barbican pod
13:53:14 <redrobot> Is this an exec command after you started the container?
13:53:29 <rajivmucheli> yes, its an exec into the container.
13:53:33 <redrobot> OH!
13:53:37 <redrobot> yeah, that won't work
13:53:49 <redrobot> when you start the container a barbican-api process binds to that port
13:54:02 <redrobot> that command is trying to exec a new process, so it won't work
13:54:26 <redrobot> what you can do instead is something like "curl http://0.0.0.0:9311" outside the container
13:54:33 <redrobot> and if things are working you should get a response
13:54:49 <rajivmucheli> okay, i wanted this confirmation! prior to upgrading to victoria release
13:55:08 <rajivmucheli> thanks, so barbican is designed to work this way on port 9311 ?
13:57:41 <rajivmucheli> is it possible to get a secret by its name ? i see its restricted to URI only https://docs.openstack.org/python-openstackclient/latest/cli/plugin-commands/barbican.html#secret-get.
13:58:22 <redrobot> currently we do not support getting secret by name
13:58:33 <redrobot> but you can use only the UUID, not the full URI
13:58:46 <redrobot> And yes, barbican runs on port 9311 by default
13:58:53 <redrobot> but you can configure that any way you want
13:59:04 <redrobot> also bin/barbican-api is not necessarily a production-ready script
13:59:16 <redrobot> I think Kolla uses uwsgi in front of barbican
13:59:36 <redrobot> but you can also use apache+mod_wsgi
14:00:18 <redrobot> Aaaand we're out of time for the meeting
14:00:27 <redrobot> (but I'll stick around if you still have questions rajivmucheli)
14:00:33 <redrobot> Thanks for joining everyone
14:00:35 <redrobot> #endmeeting