Uploaded image for project: 'Red Hat Workload Availability'
  1. Red Hat Workload Availability
  2. RHWA-276

FAR: Support secret object to store credentials for fence agents

XMLWordPrintable

    • False
    • Hide

      None

      Show
      None
    • False
    • Hide
      Cause: In the Fence Agents Remediation (FAR) Operator template there was no way to provide fencing credentials other than in plain text.
      Consequence: However, plain text credentials are a security issue.
      Fix: To resolve the issue, it is now possible to provide shared and node parameters in Secrets.
      Result: It is a more secure way to provide fencing credentials in the FAR template.
      Show
      Cause: In the Fence Agents Remediation (FAR) Operator template there was no way to provide fencing credentials other than in plain text. Consequence: However, plain text credentials are a security issue. Fix: To resolve the issue, it is now possible to provide shared and node parameters in Secrets. Result: It is a more secure way to provide fencing credentials in the FAR template.
    • Feature
    • Proposed

      We would like to store credentials for fence agents in secret object from a security perspective.
      Now they are stored in FenceAgentsRemediationTemplate with plain text:

      apiVersion: fence-agents-remediation.medik8s.io/v1alpha1
kind: FenceAgentsRemediationTemplate
metadata:
  name: fence-agents-remediation-template-fence
  namespace: openshift-workload-availability
spec:
  template:
    spec:
      agent: fence_vmware_soap
      nodeparameters:
        '--plug':
          'worker0.autotest4.ocp.bld8.nec.test': 'worker0-autotest4'
          'worker1.autotest4.ocp.bld8.nec.test': 'worker1-autotest4'
          'worker2.autotest4.ocp.bld8.nec.test': 'worker2-autotest4'
      sharedparameters:
        '--action': reboot
        '--ip': vcenter7.bld8.nec.test
(*)     '--password': <password>
(*)     '--username': <id>
        '--ssl-insecure': "" 
      retryCount: 5
      retryInterval: 5
      timeout: '60s'

        1. share-secret-testing-for-far.txt
          13 kB
        2. nhc_far_12_sept_4_19_disconnected.text
          38 kB
        3. far_standalone_4_20_connected_node_secret.txt
          17 kB
        4. far_standalone_4_16_node_secret_name.connected.text
          42 kB
        5. far_nhc_with_node_pram_5_sept_connected.text
          21 kB
        6. far_4_16_connected_10_sept.text
          18 kB

              oraz@redhat.com Or Raz
              kkii@redhat.com Keiichi Kii
              Michael Shitrit
              Votes:
              10 Vote for this issue
              Watchers:
              24 Start watching this issue

                Created:
                Updated:
                Resolved: