Uploaded image for project: 'Red Hat OpenStack Services on OpenShift'
  1. Red Hat OpenStack Services on OpenShift
  2. OSPRH-7321

edpm_neutron_metadata and edpm_neutron_dhcp are usign the wrong user to own files on the edpm nodes.

XMLWordPrintable

    • 1
    • False
    • Hide

      None

      Show
      None
    • False
    • Committed
    • No Docs Impact
    • Committed
    • No impact
    • Hide

      RHOSO18Beta waived:Neutron: EDPM security

      Show
      RHOSO18Beta waived: Neutron : EDPM security
    • Neutron Sprint 98
    • Critical

      currently edpm_neutron_metadata and edpm_neutron_dhcp 

      are using the following logic to determin the default ownership of files created on the edpm node.

          owner: "{{ item.owner | default(lookup('pipe', 'whoami')) }}"
          group: "{{ item.group | default(lookup('pipe', 'whoami')) }}"

       

      https://github.com/openstack-k8s-operators/edpm-ansible/blob/3fa954c66dc7c607b7907de7fe3d3b69fedb1b45/roles/edpm_neutron_metadata/tasks/install.yml#L22-L23

      https://github.com/openstack-k8s-operators/edpm-ansible/blob/3fa954c66dc7c607b7907de7fe3d3b69fedb1b45/roles/edpm_neutron_dhcp/tasks/install.yml#L22-L23

       

      this is incorect as lookup plugins execution on the ansibale contoler not the target host

      https://docs.ansible.com/ansible/latest/collections/ansible/builtin/pipe_lookup.html#notes

      so this is lookup the user the ansible execution envionment container is runing as not the user it is connected to the host host with.

       

      this should either be using the ansible_user connection variable 

       

          owner: "{{ item.owner | default(ansible_user) }}"
          group: "{{ item.group | default(ansible_user) }}"

       

      https://docs.ansible.com/ansible/latest/reference_appendices/special_variables.html#connection-variables

       

      or for a more portable version that works with molecule podman/delegated driver

      you can use ansible_user_id __ which is available after you have gathered facts

       owner: "{{ item.owner | default(ansible_user_id) }}"
        group: "{{ item.group | default(ansible_user_id) }}"

       

      you can even cascade the defaulting to have ansible_user take precendece if we want but they should be the same if both are present.

       owner: "{{ item.owner | default(ansible_user) | default(ansible_user_id) }}"
        group: "{{ item.group | default(ansible_user) | default(ansible_user_id) }}"

       

      using a lookup plugin is always wrong in this context.

            mtomaska@redhat.com Miro Tomaska
            smooney@redhat.com Sean Mooney
            rhos-dfg-networking-squad-neutron
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated: