Improvement: Add support for private GitHub repos

[Adrian Otto]

Currently solum only supports public git repos. Add support for private repos. Use a GitHub deploy key.

[Adrian Otto (aotto)]

https://help.github.com/articles/managing-deploy-keys

A deploy key is an SSH key that is stored on the server and grants access to a single repository on GitHub. This key is attached directly to the repository instead of to a user account.

This is what can allow Solum to access GitHub. We should store our private key in barbican, and use a "barbican secret" key in order to fetch the GitHub Deploy key on-demand. The advantage of this is that all accesses are logged, and Barbican can store the secret data in encrypted format.

[Adrian Otto (aotto)]

Ravi,

Any update on this?

Thanks,

Adrian

[Ravi Sankar Penta (ravips)]

Blueprint: https://blueprints.launchpad.net/solum/+spec/support-private-github-repos

Adrian,
  Oops, I subscribed to all changes (bugs/bps/...) and I missed your previous comment in the mix.

Last week, I tried to run barbican on devstack and ran into several issues. Got some help from barbican team, I had to make some changes to barbican source and had to apply a pending merge to make it work on devstack. I will be pushing my changes to barbican upstream.

Please look at the blueprint. I have done CLI and REST changes, need to make changes during build-app.

[Noorul Islam K M (noorul)]

Related discussion on irc

<noorul> ravips: hello [19:30]
<ravips> noorul: hi [19:31]
<ravips> noorul: I need to your input for the bug I'm trying to address, need
         to pass a field to plan_handler but that's not in the Plan object
                                                                        [19:32]
<noorul> which method? [19:34]
<ravips> noorul: init_plan_v1() in plan controller is pruning all fields that
         are not in the plan object, don't want to put the logic in controller
* noorul is looking [19:35]
<ravips> noorul: just some background, trying to support private github repos
         in solum (https://bugs.launchpad.net/solum/+bug/1319604), cli will
         pass 'artifact_deploy_keys' as optional param
<ravips> noorul: solum api, will parse that field and stores secrets in
         barbican and persists secret_ref in plan object [19:36]
<noorul> ravips: where is that method used? I don't see a use in the code base
                                                                        [19:37]
<ravips> noorul: are you referring to init_plan_v1() method? [19:38]
<noorul> Oh yeah, there is by_version variant
<ravips> noorul: init_plan_by_version() generates the method
<noorul> shouldn't those fields also be part of plan file? [19:40]
<ravips> noorul: we don't want to for security reasons, no one wants to put
         their private key/passphrase in yaml file [19:41]
<noorul> I thought it is going to be some barbican id [19:43]
<noorul> but still that makes it non portable [19:45]
<noorul> ravips: May be you need to change the way we do plan posting [19:46]
<noorul> ravips: How about using multipart ?
<ravips> may be I can add it the plan data model but will not persist similar
         to services? [19:47]
<noorul> ravips: One will have meta data and another will have plan yaml
* ravips looking up multipart
<noorul> ravips:
         http://pecan.readthedocs.org/en/latest/routing.html#handling-file-uploads
                                                                        [19:53]
<ravips> noorul: passing sshkey creds along with yaml file from cli to
         solum-api server is not an issue [19:54]
<noorul> ravi...

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/103972

[OpenStack Infra (hudson-openstack)]

Change abandoned by Ravi Sankar Penta (<email address hidden>) on branch: master
Review: https://review.openstack.org/103972
Reason: Better approach suggested by PaulCzar

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/105605

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/109467

[OpenStack Infra (hudson-openstack)]

Change abandoned by Ravi Sankar Penta (<email address hidden>) on branch: master
Review: https://review.openstack.org/109467
Reason: Incorrect Change-Id

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/105605
Committed: https://git.openstack.org/cgit/stackforge/solum/commit/?id=e640ec39431242668a86b8337b247e1465d15d5c
Submitter: Jenkins
Branch: master

commit e640ec39431242668a86b8337b247e1465d15d5c
Author: Ravi Sankar Penta <email address hidden>
Date: Mon Jun 9 16:05:59 2014 -0700

    Added support for private GitHub repos

    Implements: blueprint support-private-github-repos
    Closes-Bug: 1319604
    Change-Id: I6f0181a59165e5ab7e0b2d38aab07c8b06ec7462