(multiple) Randomize osp-secrets.env default passwords - #4114
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
This complements #4110. They both attack the same problem for different secret keys in different ways, so perhaps we could converge on a preferred approach. |
72803ce to
b947518
Compare
abays
changed the title
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 39m 16s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 6h 23m 08s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 44m 07s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 30m 27s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 4h 05m 54s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 42m 38s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 48m 27s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 14m 56s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 44m 29s |
|
recheck |
| backup: true | ||
| content: "{{ _osp_secrets_randomized }}\n" | ||
| dest: "{{ _osp_secrets_path }}" | ||
| mode: "0644" |
There was a problem hiding this comment.
(non-blockign) question: As this is required I think I prefer the other approach, but if we tweak permissions to 0600 and we removed (if possible) backup: true, I think we should also go with this!
There was a problem hiding this comment.
Alright, then let's get #4110 as we want it and merged first. Then I will rework this PR to build on top of that.
There was a problem hiding this comment.
So that's now merged.
Adding here WIP label, does this makes sense @abays ?
There was a problem hiding this comment.
Yes, makes total sense. I will look into reworking this.
b947518 to
fed937a
Compare
/test images |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 50m 02s |
fed937a to
bdd4e9d
Compare
Extend the post-kustomize osp-secret manifest injection (introduced for BarbicanSimpleCryptoKEK) to randomize all remaining password keys before `oc apply`. After `kustomize build` renders the manifest, the Python helper `osp_secret_manifest.py` replaces every osp-secret data value with a cryptographically random one, unless the key already exists in the live cluster secret or is in the skip list. This replaces the earlier pre-kustomize `.env` rewriting approach with a single post-kustomize pass that operates on the rendered YAML, aligning with the pattern established for BarbicanSimpleCryptoKEK. Key handling: - Plain passwords: 20-char alphanumeric via `secrets` module - HeatAuthEncryptionKey: random hex (configurable via `special_keys`) - BarbicanSimpleCryptoKEK: skipped (handled by its dedicated Fernet block) - Cluster values: preserved when the live osp-secret already exists Also hardens the `has` check that gates this logic: previously, any error while loading/parsing the kustomize manifest (missing file, malformed YAML, etc.) exited with the same code used for "no osp-secret present", so `inject_osp_secret_keys.yml` would silently skip randomization instead of failing. `osp_secret_manifest.py has` now exits 2 on such errors (0 = found, 1 = not found), and the task fails loudly when that happens. Signed-off-by: Andrew Bays <abays@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>
bdd4e9d to
15720f6
Compare
2 participants
The architecture repo ships
osp-secrets.envwith hardcoded default passwords that end up in theosp-secretK8s Secret via kustomizesecretGenerator. This is a security risk for any environment that deploys using these defaults.Add a new
randomize_secrets.ymltask file to thekustomize_deployrole that rewrites values inosp-secrets.envwith randomly generated replacements after the architecture repo is cloned but beforeoc kustomizeruns. The task uses a three-tier resolution per key: live cluster secret, local cache, then fresh generation.Value format handling:
HeatAuthEncryptionKey): random hex of the same lengthBarbicanSimpleCryptoKEK): preserved as-isThe task is wired into both
cifmw_setup/deploy_architecture.ymland the deprecated06-deploy-architecture.ymlplaybook, running right aftercheck_requirementsand beforereduce_ocp_cluster.