openstack/puppet-trove
Code Issues Proposed changes

Remove nova_* options from guestagent

Browse Source 
These options are unncessary according to Tesora, and they are a
security risk. The nova user has admin privelges. If your use spins up a
trove instance then snapshots it, they'd be able to get admin
credentials in your cloud.

Change-Id: Ie1f46fde9369033315e299e01d5c7f848bdd2696
This commit is contained in:
Matt Fischer 2016-04-14 08:29:04 -06:00
parent 18a06bf2a3
commit d0da01d63f
2 changed files with 0 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
manifests/guestagent.pp
View File

@ -78,9 +78,6 @@ class trove::guestagent(
'DEFAULT/debug': value => $debug;
'DEFAULT/trove_auth_url': value => $auth_url;
'DEFAULT/swift_url': value => $swift_url;
'DEFAULT/nova_proxy_admin_user': value => $::trove::nova_proxy_admin_user;
'DEFAULT/nova_proxy_admin_tenant_name': value => $::trove::nova_proxy_admin_tenant_name;
'DEFAULT/nova_proxy_admin_pass': value => $::trove::nova_proxy_admin_pass;
'DEFAULT/control_exchange': value => $control_exchange;
'DEFAULT/rpc_backend': value => $::trove::rpc_backend;
}

3
spec/classes/trove_guestagent_spec.rb
View File

@ -29,9 +29,6 @@ describe 'trove::guestagent' do
it 'configures trove-guestagent with default parameters' do
is_expected.to contain_trove_guestagent_config('DEFAULT/verbose').with_value(false)
is_expected.to contain_trove_guestagent_config('DEFAULT/debug').with_value(false)
is_expected.to contain_trove_guestagent_config('DEFAULT/nova_proxy_admin_user').with_value('admin')
is_expected.to contain_trove_guestagent_config('DEFAULT/nova_proxy_admin_pass').with_value('verysecrete')
is_expected.to contain_trove_guestagent_config('DEFAULT/nova_proxy_admin_tenant_name').with_value('admin')
is_expected.to contain_trove_guestagent_config('DEFAULT/os_region_name').with_value('RegionOne')
is_expected.to contain_trove_guestagent_config('DEFAULT/notification_driver').with_value('noop,')
is_expected.to contain_trove_guestagent_config('DEFAULT/notification_topics').with_value('notifications')