0ab1bf552d
By default, all sudo commands are logged to auth.log with their full command line. Previously, Shipyard scripts called 'sudo docker' with -e OS_PASSWORD=foo, resulting in the password value appearing in auth.log in plaintext. This change adds -E to the sudo command to pass the user's environment through, and removes the value from -e OS_PASSWORD which tells Docker to use the environment value directly. This prevents the password value from being logged. Change-Id: Ifcf7f6525876144a609ff42be42da57a3f7f6f60
38 lines
1.4 KiB
Bash
38 lines
1.4 KiB
Bash
#!/bin/bash
|
|
# Copyright 2018 AT&T Intellectual Property. All other rights reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
# Define Variables
|
|
#
|
|
# NOTE: User will need to set up the required environment variables
|
|
# before executing this script if they differ from the default values.
|
|
#
|
|
NAMESPACE="${NAMESPACE:-ucp}"
|
|
SHIPYARD_IMAGE="${SHIPYARD_IMAGE:-quay.io/airshipit/shipyard:master}"
|
|
|
|
# Define Base Docker Command
|
|
base_docker_command=$(cat << EndOfCommand
|
|
sudo -E docker run -t --rm --net=host
|
|
-e http_proxy=${HTTP_PROXY}
|
|
-e https_proxy=${HTTPS_PROXY}
|
|
-e no_proxy=${NO_PROXY}
|
|
-e OS_AUTH_URL=${OS_AUTH_URL:-http://keystone.${NAMESPACE}.svc.cluster.local:80/v3}
|
|
-e OS_USERNAME=${OS_USERNAME:-shipyard}
|
|
-e OS_USER_DOMAIN_NAME=${OS_USER_DOMAIN_NAME:-default}
|
|
-e OS_PASSWORD
|
|
-e OS_PROJECT_DOMAIN_NAME=${OS_PROJECT_DOMAIN_NAME:-default}
|
|
-e OS_PROJECT_NAME=${OS_PROJECT_NAME:-service}
|
|
EndOfCommand
|
|
)
|