)]}'
{"reference/base-services.rst":[{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"df63fac99e1b452ab68a6e9888e2962e06daa876","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"**A Castellan-compatible key store**"},{"line_number":41,"context_line":"  OpenStack components may keep secrets in a key store, using Oslo\u0027s"},{"line_number":42,"context_line":"  Castellan library as an indirection layer. While OpenStack provides a key"},{"line_number":43,"context_line":"  store service, Barbican, other key store backends are supported."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"**An oslo.db-compatible database**"},{"line_number":46,"context_line":"  OpenStack components store data in a database, using oslo.db as an"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_7f337a63","line":43,"range":{"start_line":42,"start_character":45,"end_line":43,"end_character":66},"updated":"2018-06-06 16:33:14.000000000","message":"Can we rephrase this last sentence to emphasize that we do not want services to build secret management APIs? Maybe something like:\n\n  If services need to have user-managed secrets, preference should be given\n  to relying on Barbican as the OpenStack API for managing secrets rather than \n  building those features into another service\u0027s API.","commit_id":"f99d555a7ae0ff5c4f31e8a5825b74c3eef287c7"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"1a35819c986be5613975ec1d77453596ce9a20aa","unresolved":false,"context_lines":[{"line_number":40,"context_line":"**A Castellan-compatible key store**"},{"line_number":41,"context_line":"  OpenStack components may keep secrets in a key store, using Oslo\u0027s"},{"line_number":42,"context_line":"  Castellan library as an indirection layer. While OpenStack provides a key"},{"line_number":43,"context_line":"  store service, Barbican, other key store backends are supported."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"**An oslo.db-compatible database**"},{"line_number":46,"context_line":"  OpenStack components store data in a database, using oslo.db as an"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_230a7225","line":43,"updated":"2018-06-11 14:24:00.000000000","message":"I think the context of Doug\u0027s initial comment here was that _if_ your service\u0027s security feature needs to give end users/application developers some means of uploading or accessing secrets, then we should expect them to communicate with the Barbican API directly rather than reimplement similar functionality less safely because we\u0027re worried deployers/operators won\u0027t want to manage yet one more service and also not set up some sort of proxy API in the calling service just because we\u0027re worried they won\u0027t want to expose yet another API.","commit_id":"f99d555a7ae0ff5c4f31e8a5825b74c3eef287c7"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"3b72f8bac987f1a8c29d8333b2b054822ec02f3c","unresolved":false,"context_lines":[{"line_number":40,"context_line":"**A Castellan-compatible key store**"},{"line_number":41,"context_line":"  OpenStack components may keep secrets in a key store, using Oslo\u0027s"},{"line_number":42,"context_line":"  Castellan library as an indirection layer. While OpenStack provides a key"},{"line_number":43,"context_line":"  store service, Barbican, other key store backends are supported."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"**An oslo.db-compatible database**"},{"line_number":46,"context_line":"  OpenStack components store data in a database, using oslo.db as an"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_7e300108","line":43,"updated":"2018-06-11 14:53:46.000000000","message":"Maybe s/Barbican/Glance/ in your head and see if that assertion still makes sense? Services interact with Glance now, but so do users. The proxy API concept would be analogous to Nova\u0027s \"images\" methods (deprecated back in Newton). Did having Nova proxy users\u0027 requests to Glance so that operators could avoid exposing the Glance API have a positive or negative impact on the ecosystem?","commit_id":"f99d555a7ae0ff5c4f31e8a5825b74c3eef287c7"},{"author":{"_account_id":5263,"name":"Jeremy Stanley","display_name":"fungi","email":"fungi@yuggoth.org","username":"fungi","status":"missing, presumed fed"},"change_message_id":"84bbcf71411d827d611d71a77b597a810d53d186","unresolved":false,"context_lines":[{"line_number":40,"context_line":"**A Castellan-compatible key store**"},{"line_number":41,"context_line":"  OpenStack components may keep secrets in a key store, using Oslo\u0027s"},{"line_number":42,"context_line":"  Castellan library as an indirection layer. While OpenStack provides a key"},{"line_number":43,"context_line":"  store service, Barbican, other key store backends are supported."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"**An oslo.db-compatible database**"},{"line_number":46,"context_line":"  OpenStack components store data in a database, using oslo.db as an"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_488eb9d1","line":43,"updated":"2018-06-10 21:45:48.000000000","message":"Sean: I\u0027m not entirely clear on what \"expose the needed Barbican APIs through adding to Castellan\" means... can you clarify? Are you saying that rather than exposing Barbican to end users, calls into Castellan should be used to proxy user requests from the calling service\u0027s API into Barbican?","commit_id":"f99d555a7ae0ff5c4f31e8a5825b74c3eef287c7"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"a42fe1feee8c633488cd590c082214bdff72405b","unresolved":false,"context_lines":[{"line_number":40,"context_line":"**A Castellan-compatible key store**"},{"line_number":41,"context_line":"  OpenStack components may keep secrets in a key store, using Oslo\u0027s"},{"line_number":42,"context_line":"  Castellan library as an indirection layer. While OpenStack provides a key"},{"line_number":43,"context_line":"  store service, Barbican, other key store backends are supported."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"**An oslo.db-compatible database**"},{"line_number":46,"context_line":"  OpenStack components store data in a database, using oslo.db as an"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_5e0f45df","line":43,"in_reply_to":"5f7c97a3_230a7225","updated":"2018-06-11 14:31:16.000000000","message":"Right, but do we want them then going directly to barbican (and breaking that flexible abstraction that castellan provides) or working to add the necessary functionality to castellan in a way that can then be used for other non-barbican backends.","commit_id":"f99d555a7ae0ff5c4f31e8a5825b74c3eef287c7"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"44f9e89176db5652f9858c419053b0640c101a61","unresolved":false,"context_lines":[{"line_number":40,"context_line":"**A Castellan-compatible key store**"},{"line_number":41,"context_line":"  OpenStack components may keep secrets in a key store, using Oslo\u0027s"},{"line_number":42,"context_line":"  Castellan library as an indirection layer. While OpenStack provides a key"},{"line_number":43,"context_line":"  store service, Barbican, other key store backends are supported."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"**An oslo.db-compatible database**"},{"line_number":46,"context_line":"  OpenStack components store data in a database, using oslo.db as an"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_83dca618","line":43,"in_reply_to":"5f7c97a3_488eb9d1","updated":"2018-06-11 14:11:25.000000000","message":"Maybe this is just my lack of knowledge around this area, but I thought castellan was our abstraction interface to be able to access different secret stores to avoid having a hard dependency on one specific implementation. So I thought we should use the castellan interface, not the barbican interface, if possible. So if that is right, my point was that castellan would need to be expanded to support other barbican functionality so we don\u0027t need to go to barbican directly.\n\nBut if I do not have the right, please ignore. ;)","commit_id":"f99d555a7ae0ff5c4f31e8a5825b74c3eef287c7"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"492fa1c8e9f8f2d01deb40eca3f39c945d7cf0e4","unresolved":false,"context_lines":[{"line_number":40,"context_line":"**A Castellan-compatible key store**"},{"line_number":41,"context_line":"  OpenStack components may keep secrets in a key store, using Oslo\u0027s"},{"line_number":42,"context_line":"  Castellan library as an indirection layer. While OpenStack provides a key"},{"line_number":43,"context_line":"  store service, Barbican, other key store backends are supported."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"**An oslo.db-compatible database**"},{"line_number":46,"context_line":"  OpenStack components store data in a database, using oslo.db as an"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_a13f3e23","line":43,"in_reply_to":"5f7c97a3_4df0e191","updated":"2018-06-12 14:43:50.000000000","message":"I like dims\u0027 intent, but think it needs to be a bit more strongly worded so as to avoid ambiguity. We can\u0027t be mealy-mouthed about this stuff or no solution will gain traction. Are the following assertions true:\n\n* A component should keep secrets in a key store\n* If they choose to do so, they must[1] use castellan as the interface to the store.\n* If a component requires features that are provided by Barbican, they should rely on Barbican and express it as a dependency and can expect deployers to deploy it.\n\n[1] must is probably the wrong word here but I\u0027m trying to get at the notion that \"yes, really, doing it this one way is better\"","commit_id":"f99d555a7ae0ff5c4f31e8a5825b74c3eef287c7"},{"author":{"_account_id":5638,"name":"Davanum Srinivas","email":"davanum@gmail.com","username":"dims-v"},"change_message_id":"75f0ddd83c0e718752e7484dbe3a733a13e4444f","unresolved":false,"context_lines":[{"line_number":40,"context_line":"**A Castellan-compatible key store**"},{"line_number":41,"context_line":"  OpenStack components may keep secrets in a key store, using Oslo\u0027s"},{"line_number":42,"context_line":"  Castellan library as an indirection layer. While OpenStack provides a key"},{"line_number":43,"context_line":"  store service, Barbican, other key store backends are supported."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"**An oslo.db-compatible database**"},{"line_number":46,"context_line":"  OpenStack components store data in a database, using oslo.db as an"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_4df0e191","line":43,"in_reply_to":"5f7c97a3_72c03551","updated":"2018-06-12 12:23:08.000000000","message":"What do you all think of this variation?\n\n  OpenStack components may keep secrets in a key store, using Oslo\u0027s\n  Castellan library as an indirection layer. Depending on usage patterns\n  of how these secrets are created/used by users and deployers, services\n  may depend require Barbican to be available in OpenStack deployments.","commit_id":"f99d555a7ae0ff5c4f31e8a5825b74c3eef287c7"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"60e50c4ea36e650883a43366a03bb49e43ae9837","unresolved":false,"context_lines":[{"line_number":40,"context_line":"**A Castellan-compatible key store**"},{"line_number":41,"context_line":"  OpenStack components may keep secrets in a key store, using Oslo\u0027s"},{"line_number":42,"context_line":"  Castellan library as an indirection layer. While OpenStack provides a key"},{"line_number":43,"context_line":"  store service, Barbican, other key store backends are supported."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"**An oslo.db-compatible database**"},{"line_number":46,"context_line":"  OpenStack components store data in a database, using oslo.db as an"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_72c03551","line":43,"in_reply_to":"5f7c97a3_7e300108","updated":"2018-06-11 15:10:46.000000000","message":"\u003e Services interact with Glance now, but so do\n \u003e users. The proxy API concept would be analogous to Nova\u0027s \"images\"\n \u003e methods (deprecated back in Newton). Did having Nova proxy users\u0027\n \u003e requests to Glance so that operators could avoid exposing the\n \u003e Glance API have a positive or negative impact on the ecosystem?\n\n*Thank you* for that analogy. I\u0027ve been struggling to explain why I\u0027m concerned with us limiting this change to castellan-compatible services and the tendency to add new proxy APIs is exactly the problem. We in fact addressed proxy APIs as they relate to the interop testing back in 2016 by saying that we don\u0027t want them (https://governance.openstack.org/tc/resolutions/20160504-defcore-proxy-tests.html).","commit_id":"f99d555a7ae0ff5c4f31e8a5825b74c3eef287c7"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"ab36bb21a28093d8948020e3091431820416f7a2","unresolved":false,"context_lines":[{"line_number":40,"context_line":"**A Castellan-compatible key store**"},{"line_number":41,"context_line":"  OpenStack components may keep secrets in a key store, using Oslo\u0027s"},{"line_number":42,"context_line":"  Castellan library as an indirection layer. While OpenStack provides a key"},{"line_number":43,"context_line":"  store service, Barbican, other key store backends are supported."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"**An oslo.db-compatible database**"},{"line_number":46,"context_line":"  OpenStack components store data in a database, using oslo.db as an"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_3e0fe939","line":43,"in_reply_to":"5f7c97a3_7e300108","updated":"2018-06-11 14:55:09.000000000","message":"OK, I apparently don\u0027t have the right model for castellan/barbican. Thanks for bearing with me.","commit_id":"f99d555a7ae0ff5c4f31e8a5825b74c3eef287c7"},{"author":{"_account_id":11904,"name":"Sean McGinnis","email":"sean.mcginnis@gmail.com","username":"SeanM"},"change_message_id":"51186ca87fb95a45067700f14bd2e4536f4bb37e","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"**A Castellan-compatible key store**"},{"line_number":41,"context_line":"  OpenStack components may keep secrets in a key store, using Oslo\u0027s"},{"line_number":42,"context_line":"  Castellan library as an indirection layer. While OpenStack provides a key"},{"line_number":43,"context_line":"  store service, Barbican, other key store backends are supported."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"**An oslo.db-compatible database**"},{"line_number":46,"context_line":"  OpenStack components store data in a database, using oslo.db as an"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_6730ba9f","line":43,"range":{"start_line":42,"start_character":45,"end_line":43,"end_character":66},"in_reply_to":"5f7c97a3_7f337a63","updated":"2018-06-07 12:12:25.000000000","message":"Should we further add some comment around that the effort should be made to expose the needed Barbican APIs through adding to Castellan.","commit_id":"f99d555a7ae0ff5c4f31e8a5825b74c3eef287c7"}]}