[openstack-dev] [all] [barbican] [security] Why are projects trying to avoid Barbican, still?

Flavio Percoco flavio at redhat.com
Tue Jan 17 10:44:45 UTC 2017


On 16/01/17 16:57 -0500, Jay Pipes wrote:
>On 01/16/2017 04:09 PM, Fox, Kevin M wrote:
>>If the developers that had issue with the lack of functionality,
>>contributed to Barbican rather then go off on their own, the problem
>> would have been solved much more quickly. The lack of sharing means
>> the problems don't get fixed as fast.
>
>Agreed completely.
>
>>As for operators, If the more common projects all started depending
>>on it, it would be commonly deployed.
>
>Also agreed.
>
>>Would the operators deploy Barbican just for Magnum? maybe not. maybe
>>so. For Magnum, Ironic, and Sahara, more likely . Would they deploy
>>it if Neutron and Keystone depended on it, yeah. they would. And then
>>all the other projects would benefit from it being there, such as
>>Magnum.
>
>Totally agreed.
>
>> The sooner OpenStack as a whole can decide on some new core
>>components so that projects can start hard depending on them, the
>>better I think. That process kind of stopped with the arrival of the
>>big tent.
>
>You are using a false equivalence again.
>
>As I've mentioned numerous times before on the mailing list, the Big 
>Tent was NOT either of these things:
>
>* Expanding what the "core components" of OpenStack
>* Expanding the mission or scope of OpenStack
>
>What the Big Tent -- technically "Project Structure Reform" -- was 
>about was actually the following:
>
>* No longer having a formal incubation and graduation period/review 
>for applying projects
>* Having a single, objective list of requirements and responsibilities 
>for inclusion into the OpenStack development community
>* Specifically allowing competition of different source projects in 
>the same "space" (e.g. deployment or metrics)
>
>What you are complaining about (rightly IMHO) regarding OpenStack 
>project contributors not contributing missing functionality to 
>Barbican has absolutely nothing to do with the Big Tent:
>
>There's no competing secret storage project in OpenStack other than 
>Barbican/Castellan.
>
>Furthermore, this behaviour of projects choosing to DIY/NIH something 
>that existed in other projects was around long before the advent of 
>the Big Tent. In fact, in this specific case, the Magnum team knew 
>about Barbican, previously depended on it, and chose to make Barbican 
>an option not because Barbican wasn't OpenStack -- it absolutely WAS 
>-- but because it wasn't commonly deployed, which limited their own 
>adoption.
>
>What you are asking for, Kevin, is a single opinionated and 
>consolidated OpenStack deployment; a single OpenStack "product" if you 
>will. This is a perfectly valid request. However it has nothing to do 
>with the Big Tent governance reform.

I guess this is also why castellan was created in the first place, which is to
try to avoid a single opinionated deployment, except that there's only one
secret storage service right now.

FWIW, The same thing happened with Zaqar, which was one of the first (if not the
first) project to join the Big Tent. To my knowledge, it's still neither widely
used nor deployed. Heat is using it, TripleO is using it (probably the biggest
consumer of Zaqar today). I can see Zaqar being adopted by several other services.

The point is, as Kevin mentioned, we would benefit more from consuming more of
our services rather than re-inventing some of this logics in every project.
We've faced this issue in different areas and the best solution has been to
consolidate on a fixed set of solutions that we can manage, support and
contribute. For example, Oslo.

So yeah, I'd love to see more projects consuming Barbican, even if it means that
a new service is required to have a working OpenStack.

Cheers,
Flavio

-- 
@flaper87
Flavio Percoco
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 862 bytes
Desc: not available
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20170117/255062c6/attachment.pgp>


More information about the OpenStack-dev mailing list