openstack/tripleo-heat-templates
Code Issues Proposed changes

Set mode for ansible written files

Browse Source 
Use a more restrictive mode for these files, as some may contain sensitive data
which shouldn't be world readable

Closes-Bug: #1714986
Change-Id: Ib1e79b1d4e25d6e329938402b1ca776bdab81bdd
This commit is contained in:
Steven Hardy 2017-09-04 13:53:04 +01:00
parent 67f0f94dc7
commit 94c7752cfa
3 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
common/deploy-steps-tasks.yaml
View File

@ -5,7 +5,7 @@
# Per step puppet configuration of the baremetal host # Per step puppet configuration of the baremetal host
##################################################### #####################################################
- name: Write the config_step hieradata - name: Write the config_step hieradata
copy: content="{{dict(step=step|int)|to_json}}" dest=/etc/puppet/hieradata/config_step.json force=true copy: content="{{dict(step=step|int)|to_json}}" dest=/etc/puppet/hieradata/config_step.json force=true mode=0600
- name: Run puppet host configuration for step {{step}} - name: Run puppet host configuration for step {{step}}
command: >- command: >-
puppet apply puppet apply

14
common/deploy-steps.j2
View File

@ -190,29 +190,29 @@ resources:
- name: Create /var/lib/tripleo-config directory - name: Create /var/lib/tripleo-config directory
file: path=/var/lib/tripleo-config state=directory file: path=/var/lib/tripleo-config state=directory
- name: Write the puppet step_config manifest - name: Write the puppet step_config manifest
copy: content="{{puppet_step_config}}" dest=/var/lib/tripleo-config/puppet_step_config.pp force=yes copy: content="{{puppet_step_config}}" dest=/var/lib/tripleo-config/puppet_step_config.pp force=yes mode=0600
# this creates a JSON config file for our docker-puppet.py script # this creates a JSON config file for our docker-puppet.py script
- name: Create /var/lib/docker-puppet - name: Create /var/lib/docker-puppet
file: path=/var/lib/docker-puppet state=directory file: path=/var/lib/docker-puppet state=directory
- name: Write docker-puppet-tasks json files - name: Write docker-puppet-tasks json files
copy: content="{{puppet_config | to_json}}" dest=/var/lib/docker-puppet/docker-puppet.json force=yes copy: content="{{puppet_config | to_json}}" dest=/var/lib/docker-puppet/docker-puppet.json force=yes mode=0600
# FIXME: can we move docker-puppet somewhere so it's installed via a package? # FIXME: can we move docker-puppet somewhere so it's installed via a package?
- name: Write docker-puppet.py - name: Write docker-puppet.py
copy: content="{{docker_puppet_script}}" dest=/var/lib/docker-puppet/docker-puppet.py force=yes copy: content="{{docker_puppet_script}}" dest=/var/lib/docker-puppet/docker-puppet.py force=yes mode=0600
# Here we are dumping all the docker container startup configuration data # Here we are dumping all the docker container startup configuration data
# so that we can have access to how they are started outside of heat # so that we can have access to how they are started outside of heat
# and docker-cmd. This lets us create command line tools to test containers. # and docker-cmd. This lets us create command line tools to test containers.
# FIXME do we need the docker-container-startup-configs.json or is the new per-step # FIXME do we need the docker-container-startup-configs.json or is the new per-step
# data consumed by paunch enough? # data consumed by paunch enough?
- name: Write docker-container-startup-configs - name: Write docker-container-startup-configs
copy: content="{{docker_startup_configs | to_json}}" dest=/var/lib/docker-container-startup-configs.json force=yes copy: content="{{docker_startup_configs | to_json}}" dest=/var/lib/docker-container-startup-configs.json force=yes mode=0600
- name: Write per-step docker-container-startup-configs - name: Write per-step docker-container-startup-configs
copy: content="{{item.value|to_json}}" dest="/var/lib/tripleo-config/docker-container-startup-config-{{item.key}}.json" force=yes copy: content="{{item.value|to_json}}" dest="/var/lib/tripleo-config/docker-container-startup-config-{{item.key}}.json" force=yes mode=0600
with_dict: "{{docker_startup_configs}}" with_dict: "{{docker_startup_configs}}"
- name: Create /var/lib/kolla/config_files directory - name: Create /var/lib/kolla/config_files directory
file: path=/var/lib/kolla/config_files state=directory file: path=/var/lib/kolla/config_files state=directory
- name: Write kolla config json files - name: Write kolla config json files
copy: content="{{item.value|to_json}}" dest="{{item.key}}" force=yes copy: content="{{item.value|to_json}}" dest="{{item.key}}" force=yes mode=0600
with_dict: "{{kolla_config}}" with_dict: "{{kolla_config}}"
######################################################## ########################################################
# Bootstrap tasks, only performed on bootstrap_server_id # Bootstrap tasks, only performed on bootstrap_server_id
@ -225,7 +225,7 @@ resources:
- /var/lib/docker-puppet/docker-puppet-tasks*.json - /var/lib/docker-puppet/docker-puppet-tasks*.json
when: deploy_server_id == bootstrap_server_id when: deploy_server_id == bootstrap_server_id
- name: Write docker-puppet-tasks json files - name: Write docker-puppet-tasks json files
copy: content="{{item.value|to_json}}" dest=/var/lib/docker-puppet/docker-puppet-tasks{{item.key.replace("step_", "")}}.json force=yes copy: content="{{item.value|to_json}}" dest=/var/lib/docker-puppet/docker-puppet-tasks{{item.key.replace("step_", "")}}.json force=yes mode=0600
with_dict: "{{docker_puppet_tasks}}" with_dict: "{{docker_puppet_tasks}}"
when: deploy_server_id == bootstrap_server_id when: deploy_server_id == bootstrap_server_id
{%- endraw %} {%- endraw %}

1
docker/docker-puppet.py
View File

@ -366,6 +366,7 @@ for infile in infiles:
outfile = os.path.join(os.path.dirname(infile), "hashed-" + os.path.basename(infile)) outfile = os.path.join(os.path.dirname(infile), "hashed-" + os.path.basename(infile))
with open(outfile, 'w') as out_f: with open(outfile, 'w') as out_f:
os.chmod(out_f.name, 0600)
json.dump(infile_data, out_f) json.dump(infile_data, out_f)
if not success: if not success: