-
Bug
-
Resolution: Unresolved
-
Undefined
-
None
-
rhos-18.0.16
-
None
-
0
-
False
-
-
False
-
?
-
rhos-ops-platform-services-security
-
None
-
-
-
-
Low
To Reproduce Steps to reproduce the behavior:
- Configure the .spec.defaultConfigOverwrite or .spec.barbicanAPI.defaultConfigOverwrite (I assume barbicanKeystoneListener and barbicanWorker behave the same, but I haven't tried those two) with some custom contents
- Look where those contents appear inside the pod (they'll appear inside /etc/barbican/barbican.cond.d/<filename based on defaultConfigOverwrite contents>)
Expected behavior
- The contents should appear inside /etc/barbican/<filename based on defaultConfigOverwrite contents> as per the field description.
Bug impact
- This prevents some config customization. It also introduces inconsistencies between operators (e.g. the same field in nova-operator works as described in the CRD description and puts the modified config inside /etc/nova/)
Known workaround
- no workaround that I'm aware of
Additional context
- The barbican CRD description says the following for the .spec.barbicanAPI.defaultConfigOverwrite field (notice the path):
$ oc explain barbican.spec.barbicanAPI.defaultConfigOverwrite GROUP: barbican.openstack.org KIND: Barbican VERSION: v1beta1FIELD: defaultConfigOverwrite <map[string]string> DESCRIPTION: ConfigOverwrite - interface to overwrite default config files like e.g. policy.json. But can also be used to add additional files. Those get added to the service config dir in /etc/<service> .
- I have this barbican CR (I redacted the uninteresting parts):
$ oc get barbican barbican -oyaml apiVersion: barbican.openstack.org/v1beta1 kind: Barbican metadata: ... spec: apiTimeout: 90 barbicanAPI: ... defaultConfigOverwrite: policy.yaml: | my policy contents ...
- Now I'd expect to have a file in /etc/barbican/policy.yaml with my contents but it's not there
$ oc rsh -c barbican-api barbican-api-85d59845b-4572k ls /etc/barbican api_audit_map.conf barbican-api-paste.ini barbican.conf barbican.conf.d barbican-functional.conf gunicorn-config.py vassals
- Instead it's in /etc/barbican/barbican.conf.d/policy.yaml
$ oc rsh -c barbican-api barbican-api-85d59845b-4572k cat /etc/barbican/barbican.conf.d/policy.yaml my policy contents