[Starlingx-discuss] How is Barbican being used in StarlingX?

[Kozyrev, Alexander (Alex)]

Yong, I don't think we have any tests covering this functionality as of today.
keystone-listener is enabled and up and running on StarlingX, that's for sure.

Regards,
Alex

-----Original Message-----
From: Yong Hu [mailto:yong.hu at intel.com] 
Sent: December 4, 2019 19:53
To: Kozyrev, Alexander (Alex) <Alex.Kozyrev at windriver.com>; Sun, Yicheng (Jerry) <Jerry.Sun at windriver.com>; starlingx-discuss at lists.starlingx.io
Subject: Re: [Starlingx-discuss] How is Barbican being used in StarlingX?

Hi Alex and Jerry,
Thanks much! Your answers addressed my questions mostly.

Though, I still wondered whether currently barbican-keystone-listener actually works in StarlingX, because even I turned on the debug flag, I didn't see log output from "class NotificationTask -> process_event" in "barbican/queue/keystone_listener.py", where there is supposedly some debug log about the incoming notification before handling "operation_type == 'deleted'".

Have we ever tested this feature before?

regards,
Yong


On 2019/12/5 5:30 AM, Kozyrev, Alexander (Alex) wrote:
> Hi Yong,
> 
> 1. We store BMC passwords in Barbican as well as Docker Registry credentials currently.
> 2. Keystone listener processes only Keystone project delete events to purge all associated Barbican resources.
> 3. Barbican identity in Keystone is used for authentication and multi-tenant authorization of Barbican.
> 
> Regards,
> Alex
> 
> -----Original Message-----
> From: Sun, Yicheng (Jerry) [mailto:Jerry.Sun at windriver.com]
> Sent: December 4, 2019 12:07
> To: Yong Hu <yong.hu at intel.com>; starlingx-discuss at lists.starlingx.io
> Subject: Re: [Starlingx-discuss] How is Barbican being used in StarlingX?
> 
> Hi Yong,
> 
> I am not sure what the entire list of secrets stored in barbican is, but I know if you specify credentials for external docker registry to bootstrap the system with, barbican secrets will be created for those.
> 
> Thanks,
> Jerry
> 
> -----Original Message-----
> From: Yong Hu <yong.hu at intel.com>
> Sent: Tuesday, December 3, 2019 10:34 PM
> To: starlingx-discuss at lists.starlingx.io
> Subject: [Starlingx-discuss] How is Barbican being used in StarlingX?
> 
> Hi folks,
> I am working on a LP and might like to use "barbican-keystone-listener"
> to monitor a keystone event.
> 
>   From "sm-dump", we are seeing "barbican-api", 
> "barbican-keystone-listener" and "barbican-worker" are 
> "enabled-active", but I have a few questions about how Barbican (on 
> host) is being used in
> StarlingX:
> 1. what secrets are stored in Barbican currently? btw: I got nothing by running "openstack secret list" or "barbican secret list". As well, "admin" and its password are stored in Keyring, not in Barbican.
> 2. Does "barbican-keystone-listener" actually work with keystone in StarlingX? I enabled "debug" flag in /etc/barbican/barbican.conf, but when I was triggering events with keystone, it seemed there was no notifications captured by "barbican-keystone-listener".
> 3. there is a "barbican" user/identify (with initial password) managed by keystone, but I wonder what we used this "barbican" for StarlingX.
> 
> 
> thanks in advance!
> 
> -Yong
> 
> 
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io
> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io
> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
>