[Starlingx-discuss] How is Barbican being used in StarlingX?
Hi folks, I am working on a LP and might like to use "barbican-keystone-listener" to monitor a keystone event. From "sm-dump", we are seeing "barbican-api", "barbican-keystone-listener" and "barbican-worker" are "enabled-active", but I have a few questions about how Barbican (on host) is being used in StarlingX: 1. what secrets are stored in Barbican currently? btw: I got nothing by running "openstack secret list" or "barbican secret list". As well, "admin" and its password are stored in Keyring, not in Barbican. 2. Does "barbican-keystone-listener" actually work with keystone in StarlingX? I enabled "debug" flag in /etc/barbican/barbican.conf, but when I was triggering events with keystone, it seemed there was no notifications captured by "barbican-keystone-listener". 3. there is a "barbican" user/identify (with initial password) managed by keystone, but I wonder what we used this "barbican" for StarlingX. thanks in advance! -Yong
Hi Yong, I am not sure what the entire list of secrets stored in barbican is, but I know if you specify credentials for external docker registry to bootstrap the system with, barbican secrets will be created for those. Thanks, Jerry -----Original Message----- From: Yong Hu <yong.hu@intel.com> Sent: Tuesday, December 3, 2019 10:34 PM To: starlingx-discuss@lists.starlingx.io Subject: [Starlingx-discuss] How is Barbican being used in StarlingX? Hi folks, I am working on a LP and might like to use "barbican-keystone-listener" to monitor a keystone event. From "sm-dump", we are seeing "barbican-api", "barbican-keystone-listener" and "barbican-worker" are "enabled-active", but I have a few questions about how Barbican (on host) is being used in StarlingX: 1. what secrets are stored in Barbican currently? btw: I got nothing by running "openstack secret list" or "barbican secret list". As well, "admin" and its password are stored in Keyring, not in Barbican. 2. Does "barbican-keystone-listener" actually work with keystone in StarlingX? I enabled "debug" flag in /etc/barbican/barbican.conf, but when I was triggering events with keystone, it seemed there was no notifications captured by "barbican-keystone-listener". 3. there is a "barbican" user/identify (with initial password) managed by keystone, but I wonder what we used this "barbican" for StarlingX. thanks in advance! -Yong _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
Hi Yong, 1. We store BMC passwords in Barbican as well as Docker Registry credentials currently. 2. Keystone listener processes only Keystone project delete events to purge all associated Barbican resources. 3. Barbican identity in Keystone is used for authentication and multi-tenant authorization of Barbican. Regards, Alex -----Original Message----- From: Sun, Yicheng (Jerry) [mailto:Jerry.Sun@windriver.com] Sent: December 4, 2019 12:07 To: Yong Hu <yong.hu@intel.com>; starlingx-discuss@lists.starlingx.io Subject: Re: [Starlingx-discuss] How is Barbican being used in StarlingX? Hi Yong, I am not sure what the entire list of secrets stored in barbican is, but I know if you specify credentials for external docker registry to bootstrap the system with, barbican secrets will be created for those. Thanks, Jerry -----Original Message----- From: Yong Hu <yong.hu@intel.com> Sent: Tuesday, December 3, 2019 10:34 PM To: starlingx-discuss@lists.starlingx.io Subject: [Starlingx-discuss] How is Barbican being used in StarlingX? Hi folks, I am working on a LP and might like to use "barbican-keystone-listener" to monitor a keystone event. From "sm-dump", we are seeing "barbican-api", "barbican-keystone-listener" and "barbican-worker" are "enabled-active", but I have a few questions about how Barbican (on host) is being used in StarlingX: 1. what secrets are stored in Barbican currently? btw: I got nothing by running "openstack secret list" or "barbican secret list". As well, "admin" and its password are stored in Keyring, not in Barbican. 2. Does "barbican-keystone-listener" actually work with keystone in StarlingX? I enabled "debug" flag in /etc/barbican/barbican.conf, but when I was triggering events with keystone, it seemed there was no notifications captured by "barbican-keystone-listener". 3. there is a "barbican" user/identify (with initial password) managed by keystone, but I wonder what we used this "barbican" for StarlingX. thanks in advance! -Yong _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
Hi Alex and Jerry, Thanks much! Your answers addressed my questions mostly. Though, I still wondered whether currently barbican-keystone-listener actually works in StarlingX, because even I turned on the debug flag, I didn't see log output from "class NotificationTask -> process_event" in "barbican/queue/keystone_listener.py", where there is supposedly some debug log about the incoming notification before handling "operation_type == 'deleted'". Have we ever tested this feature before? regards, Yong On 2019/12/5 5:30 AM, Kozyrev, Alexander (Alex) wrote:
Hi Yong,
1. We store BMC passwords in Barbican as well as Docker Registry credentials currently. 2. Keystone listener processes only Keystone project delete events to purge all associated Barbican resources. 3. Barbican identity in Keystone is used for authentication and multi-tenant authorization of Barbican.
Regards, Alex
-----Original Message----- From: Sun, Yicheng (Jerry) [mailto:Jerry.Sun@windriver.com] Sent: December 4, 2019 12:07 To: Yong Hu <yong.hu@intel.com>; starlingx-discuss@lists.starlingx.io Subject: Re: [Starlingx-discuss] How is Barbican being used in StarlingX?
Hi Yong,
I am not sure what the entire list of secrets stored in barbican is, but I know if you specify credentials for external docker registry to bootstrap the system with, barbican secrets will be created for those.
Thanks, Jerry
-----Original Message----- From: Yong Hu <yong.hu@intel.com> Sent: Tuesday, December 3, 2019 10:34 PM To: starlingx-discuss@lists.starlingx.io Subject: [Starlingx-discuss] How is Barbican being used in StarlingX?
Hi folks, I am working on a LP and might like to use "barbican-keystone-listener" to monitor a keystone event.
From "sm-dump", we are seeing "barbican-api", "barbican-keystone-listener" and "barbican-worker" are "enabled-active", but I have a few questions about how Barbican (on host) is being used in StarlingX: 1. what secrets are stored in Barbican currently? btw: I got nothing by running "openstack secret list" or "barbican secret list". As well, "admin" and its password are stored in Keyring, not in Barbican. 2. Does "barbican-keystone-listener" actually work with keystone in StarlingX? I enabled "debug" flag in /etc/barbican/barbican.conf, but when I was triggering events with keystone, it seemed there was no notifications captured by "barbican-keystone-listener". 3. there is a "barbican" user/identify (with initial password) managed by keystone, but I wonder what we used this "barbican" for StarlingX.
thanks in advance!
-Yong
_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
Yong, I don't think we have any tests covering this functionality as of today. keystone-listener is enabled and up and running on StarlingX, that's for sure. Regards, Alex -----Original Message----- From: Yong Hu [mailto:yong.hu@intel.com] Sent: December 4, 2019 19:53 To: Kozyrev, Alexander (Alex) <Alex.Kozyrev@windriver.com>; Sun, Yicheng (Jerry) <Jerry.Sun@windriver.com>; starlingx-discuss@lists.starlingx.io Subject: Re: [Starlingx-discuss] How is Barbican being used in StarlingX? Hi Alex and Jerry, Thanks much! Your answers addressed my questions mostly. Though, I still wondered whether currently barbican-keystone-listener actually works in StarlingX, because even I turned on the debug flag, I didn't see log output from "class NotificationTask -> process_event" in "barbican/queue/keystone_listener.py", where there is supposedly some debug log about the incoming notification before handling "operation_type == 'deleted'". Have we ever tested this feature before? regards, Yong On 2019/12/5 5:30 AM, Kozyrev, Alexander (Alex) wrote:
Hi Yong,
1. We store BMC passwords in Barbican as well as Docker Registry credentials currently. 2. Keystone listener processes only Keystone project delete events to purge all associated Barbican resources. 3. Barbican identity in Keystone is used for authentication and multi-tenant authorization of Barbican.
Regards, Alex
-----Original Message----- From: Sun, Yicheng (Jerry) [mailto:Jerry.Sun@windriver.com] Sent: December 4, 2019 12:07 To: Yong Hu <yong.hu@intel.com>; starlingx-discuss@lists.starlingx.io Subject: Re: [Starlingx-discuss] How is Barbican being used in StarlingX?
Hi Yong,
I am not sure what the entire list of secrets stored in barbican is, but I know if you specify credentials for external docker registry to bootstrap the system with, barbican secrets will be created for those.
Thanks, Jerry
-----Original Message----- From: Yong Hu <yong.hu@intel.com> Sent: Tuesday, December 3, 2019 10:34 PM To: starlingx-discuss@lists.starlingx.io Subject: [Starlingx-discuss] How is Barbican being used in StarlingX?
Hi folks, I am working on a LP and might like to use "barbican-keystone-listener" to monitor a keystone event.
From "sm-dump", we are seeing "barbican-api", "barbican-keystone-listener" and "barbican-worker" are "enabled-active", but I have a few questions about how Barbican (on host) is being used in StarlingX: 1. what secrets are stored in Barbican currently? btw: I got nothing by running "openstack secret list" or "barbican secret list". As well, "admin" and its password are stored in Keyring, not in Barbican. 2. Does "barbican-keystone-listener" actually work with keystone in StarlingX? I enabled "debug" flag in /etc/barbican/barbican.conf, but when I was triggering events with keystone, it seemed there was no notifications captured by "barbican-keystone-listener". 3. there is a "barbican" user/identify (with initial password) managed by keystone, but I wonder what we used this "barbican" for StarlingX.
thanks in advance!
-Yong
_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
participants (3)
-
Kozyrev, Alexander (Alex)
-
Sun, Yicheng (Jerry)
-
Yong Hu