09:00:24 <yuval> #startmeeting karbor
09:00:24 <openstack> Meeting started Tue Aug  1 09:00:24 2017 UTC and is due to finish in 60 minutes.  The chair is yuval. Information about MeetBot at http://wiki.debian.org/MeetBot.
09:00:25 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
09:00:27 <openstack> The meeting name has been set to 'karbor'
09:00:34 <yuval> Hello everybody and welcome to Karbor's biweekly meeting
09:00:40 <chenying> hi
09:01:07 <liujiong> hi yuanying chenying
09:01:07 <yuval> hey chenying
09:01:22 <liujiong> hi yuval
09:01:31 <zhonghua2> hi
09:01:32 <yuval> hey liujiong
09:01:51 <liujiong> :)
09:01:54 <yushb> hey
09:02:00 <yuval> hey yushb
09:02:05 <jiaopengju> hi
09:02:10 <yuval> #info chenying liujiong yushb jiaopengju in meeting
09:02:29 <yuval> good to see all of you here
09:02:46 <edisonxiang> hello:)
09:02:52 <yuval> hey edisonxiang!
09:02:52 <chenying> #info zhonghua2
09:03:08 <edisonxiang> hello yuval
09:03:21 <yuval> #info zhonghua2 edisonxiang in meeting
09:03:50 <yuval> Let's start with the first topic on the agenda
09:04:03 <yuval> #topic Pike Status
09:04:44 <yuval> Next week is RC1 target week
09:05:04 <yuval> and on August 21th we enter final RC week
09:05:45 <chenying> yuval So the feature patches need be merged this week?
09:05:47 <yuval> we have made quite a progress in the last two weeks
09:05:55 <yuval> chenying: this week or the next
09:06:07 <chenying> ok.
09:06:07 <yuval> chenying: the RC will be created at the end of next week, afaik
09:07:07 <yuval> if there are any patches you think should be merged, please say so
09:07:39 <yuval> I'm currently aware about the operation log patches, the heat patches
09:08:19 <chenying> Operation Engine: Support Trigger Multi Node   what about this patch?
09:08:46 <yuval> chenying: as you pointed out to me, more work is required on that. I'll try to finish by the end of next week
09:08:51 <chenying> It  seems that it need be updated.
09:09:10 <chenying> yuval Sound good.
09:09:41 <yuval> anything else?
09:10:02 <jiaopengju> I will try to add retry for s3 bank plugin
09:10:17 <chenying> There is a topic submitted by
09:10:17 <chenying> yushb.
09:10:20 <yuval> jiaopengju: hope to see this one
09:10:27 <yuval> chenying: getting to it next
09:10:32 <jiaopengju> yuval: ok
09:10:41 <yuval> another thing
09:11:00 <yuval> The Sydney summit is on, and the voting for talks is open
09:11:02 <yuval> https://www.openstack.org/summit/sydney-2017/vote-for-speakers
09:11:37 <yuval> A few sessions about Karbor have been submitted. You can use search for "Karbor" to see them
09:11:49 <yuval> if there is any talk you'd like to hear, please vote for it
09:12:24 <yuval> #topic Barbican integration
09:13:05 <yushb> yes, I added this topic.
09:13:07 <yuval> that's by yushb?
09:13:14 <yuval> go ahead :)
09:13:54 <yushb> we want to integrate barbican to backup keys
09:14:47 <chenying> yushb Can you give some usecases about it?
09:14:57 <yuval> yushb: to be honest, I'm not very familiar with barbican. Does barbican have some sort of backup, or would you like to backup them to the bank?
09:15:47 <liujiong> barbican is key manager service in openstack, currently it doesn't have backup function implemented yet.
09:16:34 <liujiong> Does karbor require the backup function implemented in barbican side?
09:17:16 <yuval> liujiong: not really. But some services do have their own backup API (i.e Cinder), and that's something Karbor can support
09:18:47 <liujiong> ok, actually, backing up key materials is a normal usecase. That's why we're seeking the possibility to integrate with karbor.
09:19:11 <chenying> yushb The the backup function about barbican resource could be  implemented  in plugins. It can call backup api like cinder, or you can implement it in plugin it self.
09:20:00 <yushb> chenying yeah, I know about it.
09:20:26 <yuval> Placing the keys in the bank + metadata sounds quite easy. What about security? Is it used to backup private keys as well?
09:21:10 <chenying> https://ethercalc.openstack.org/karbor-queens  it seem that the task 'Support barbican protection plugin
09:21:11 <chenying> ' has been added to this link.
09:21:53 <yuval> looking at barbican's api, maybe I mean: we intend to backup the secret payload, right? Placing it in the bank as is, seem to induce a security issue
09:22:10 <chandankumar> Hello,
09:22:57 <liujiong> yuval: yep, indeed backing up private key is something need discussion
09:23:33 <chenying> hi chandankumar
09:23:53 <chandankumar> chenying: i was checking karbor project there is no tempest plugin there
09:24:22 <chandankumar> chenying: is there any plan to add create tempest plugin in a seperate repo for karbor in Queens cycle?
09:24:24 <chenying> Yes karbor only have fullstack tests.
09:24:59 <chandankumar> chenying: sorry what is fullstack tests?
09:25:01 <yuval> chandankumar: we are now discussing barbican integration. Mind discussing tempest after that?
09:25:08 <chandankumar> yuval: sure
09:25:16 <yuval> chandankumar: thanks
09:25:43 <yuval> yushb: liujiong: any idea about storing secret payload on the bank?
09:27:19 <liujiong> yuval: you mean karbor as a storage backend for barbican?
09:28:28 <liujiong> yuval: what's bank plugin used for?
09:28:30 <yuval> liujiong: Karbor is using the bank (i.e swift, s3, etc.) for storing backup metadata and sometimes data itself (depending on the protection plugin). One possible implementation for Barbican secrets would be, store the secret payload and metadata on the bank.
09:28:54 <yuval> liujiong: = store the data on swift or s3 (for example)
09:29:45 <yuval> liujiong: this induces a security issue: anyone with access to the bank could get the secret payload
09:32:43 <liujiong> yuval: ok, so people can access bank means they can access all the data stored in bank?
09:32:44 <yuval> liujiong: I guess there are other solutions. Maybe ask the Barbican backend store for an encrypted dump
09:33:11 <jiaopengju> yuval liujiong: maybe we can store it as binary file?
09:34:53 <yuval> jiaopengju: sounds good, but that binary file must be encrypted, right?
09:34:56 <yushb> yuval : Now in barbican service, keys are stored after encrypted.
09:36:04 <jiaopengju> yuval: it seems yes
09:36:10 <yuval> yushb: afaik, they are stored in a backend secret store https://docs.openstack.org/barbican/latest/install/barbican-backend.html
09:36:27 <yuval> yushb: a few problems with that:
09:36:29 <liujiong> yuval jiaopengju: then another problem, how to protect the encryption keys of karbor.
09:36:31 <chenying> liujiong:  can the encrypted data can be restore by  barbican service directly?
09:36:43 <yuval> yushb: 1. we don't want to speak to the backend store, behind barbican's back
09:37:04 <yuval> yushb: 2. we would be able to restore only into the same backend store
09:37:21 <yuval> liujiong: good point
09:38:50 <yuval> I'll have to stop here and move to the next subject, but there is plenty to continue to speak about. I suggest we meet in Karbor channel, tomorrow at 07:00 UTC (15:00 China time) to discuss it in depth
09:39:10 <yuval> liujiong: jiaopengju: jiaopengju: chenying: are you ok with that?
09:39:17 <liujiong> yuval: fine with me
09:39:20 <yuval> yushb:
09:39:28 <yushb> fine
09:39:34 <chenying> sure
09:39:52 <jiaopengju> ok
09:39:53 <yuval> great
09:40:01 <yuval> will move to tempest chandankumar
09:40:04 <yuval> #topic Tempest
09:40:54 <yuval> chandankumar: Currently Karbor uses a DSVM gate and tests Karbor's APIs without tempest
09:41:31 <chandankumar> yuval: is there any plan to use tempest plugin in future?
09:42:16 <chenying> IMO they are repetitive about integration tests.
09:43:35 <yuval> chandankumar: tbh, a bit embarassing, but I'm not very familiar with tempest
09:44:14 <chandankumar> yuval: no problem i was asking because in queens there is a tempest split goal to a seperate repo, i am volunteering for the same
09:44:26 <liujiong> looks like fullstack is integration test
09:44:49 <chandankumar> yuval: tempest provides a set of stable api through which you can create tempest plugin
09:45:23 <chandankumar> through plugin tempest discovers the tests and all the api/scenario tests related to karbor will resides with the plugin
09:45:43 <yuval> #link https://governance.openstack.org/tc/goals/queens/split-tempest-plugins.html
09:45:47 <chandankumar> yuval: since there is currently on tempest plugin in karbor so there is no issue
09:45:53 <yuval> chandankumar: thanks for pointing that out
09:46:23 <yuval> chandankumar: adding a tempest plugin for karbor means that we have to be aware of the split and do it correctly, I guess
09:46:25 <chandankumar> yuval: but if you need any help, please let me know i will be hanging around on #openstack-qa channel
09:46:54 <chandankumar> yuval: yes
09:47:01 <yuval> chandankumar: that's great, thank you :D
09:47:20 <chandankumar> yuval: since there is no tempest plugin for karbor so creating it from scratch is not hard
09:47:42 <yuval> #topic Open Discussion
09:47:54 <yuval> Anything else you would like to speak about?
09:49:14 <yuval> thanks for attending :)
09:49:15 <yuval> #endmeeting