(multiple) Randomize osp-secrets.env default passwords - #4114
openshift-merge-bot[bot] merged 1 commit into
Conversation
|
This complements #4110. They both attack the same problem for different secret keys in different ways, so perhaps we could converge on a preferred approach. |
72803ce to
b947518
Compare
abays
changed the title
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 39m 16s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 6h 23m 08s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 44m 07s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 30m 27s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 4h 05m 54s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 42m 38s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 48m 27s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 14m 56s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 44m 29s |
|
recheck |
| backup: true | ||
| content: "{{ _osp_secrets_randomized }}\n" | ||
| dest: "{{ _osp_secrets_path }}" | ||
| mode: "0644" |
There was a problem hiding this comment.
(non-blockign) question: As this is required I think I prefer the other approach, but if we tweak permissions to 0600 and we removed (if possible) backup: true, I think we should also go with this!
There was a problem hiding this comment.
Alright, then let's get #4110 as we want it and merged first. Then I will rework this PR to build on top of that.
There was a problem hiding this comment.
So that's now merged.
Adding here WIP label, does this makes sense @abays ?
There was a problem hiding this comment.
Yes, makes total sense. I will look into reworking this.
b947518 to
fed937a
Compare
/test images |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 50m 02s |
Extend the post-kustomize osp-secret manifest injection (introduced for BarbicanSimpleCryptoKEK) to randomize all remaining password keys before `oc apply`. After `kustomize build` renders the manifest, the Python helper `osp_secret_manifest.py` replaces every osp-secret data value with a cryptographically random one, unless the key already exists in the live cluster secret or is in the skip list. This replaces the earlier pre-kustomize `.env` rewriting approach with a single post-kustomize pass that operates on the rendered YAML, aligning with the pattern established for BarbicanSimpleCryptoKEK. Key handling: - Plain passwords: 20-char alphanumeric via `secrets` module - HeatAuthEncryptionKey: random hex (configurable via `special_keys`) - BarbicanSimpleCryptoKEK: skipped (handled by its dedicated Fernet block) - Cluster values: preserved when the live osp-secret already exists Also hardens the `has` check that gates this logic: previously, any error while loading/parsing the kustomize manifest (missing file, malformed YAML, etc.) exited with the same code used for "no osp-secret present", so `inject_osp_secret_keys.yml` would silently skip randomization instead of failing. `osp_secret_manifest.py has` now exits 2 on such errors (0 = found, 1 = not found), and the task fails loudly when that happens. Both the BarbicanSimpleCryptoKEK injection and the general randomizer write plaintext secrets to a temporary JSON file that is then passed to `osp_secret_manifest.py`. Both temp-file lifecycles now run inside a block/always so the file is removed even if the intervening command fails, instead of leaving plaintext secrets on disk. Signed-off-by: Andrew Bays <abays@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>
be13d40 to
85764db
Compare
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 11m 48s |
|
/test images |
|
recheck |
|
PR-Agent: could not find a component named |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 23m 29s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 50m 35s |
|
recheck |
|
/test images |
|
PR-Agent: could not find a component named |
|
Build failed (check pipeline). Post ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 14m 26s |
|
recheck |
|
This has been successfully tested with multiple architectures. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: nemarjan The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/lgtm |
8ae87ba
into
openstack-k8s-operators:main
Replace hardcoded passwords and keys with CHANGEME_REQUIRED sentinels The osp-secrets.env file in lib/control-plane/base/ contained the literal password 12345678 for 38 service and database accounts, a static Barbican KEK, and a hardcoded Heat encryption key. Since lib/ is the shared base consumed by every VA and DT, any operator running kustomize build would produce a cluster-wide secret with universally known credentials. Replace all password values with the CHANGEME_REQUIRED sentinel so that deployers are forced to generate proper secrets before applying. Move the libvirt password into lib/dataplane/nodeset/libvirt-secret.env, matching the control-plane env-file pattern. Remove BarbicanSimpleCryptoKEK from osp-secrets.env entirely -- it must be unique per cluster and is injected at deploy time by ci-framework or generated separately for install_yamls flows. Additionally: Add .ci/validate-secret-passwords.py that fails the build if any .env file under lib/ or examples/ contains 8-digit numeric passwords, preventing regression. The validator distinguishes hex-encoded keys (e.g. HeatAuthEncryptionKey) from plain passwords and silently skips externally managed keys (e.g. BarbicanSimpleCryptoKEK). It also warns when CHANGEME_REQUIRED sentinels remain in examples/ directories. Document the secret generation workflow in examples/common/README.md with per-key-type openssl rand examples (hex 32 for encryption keys, hex 16 for passwords). Add __pycache__/ to .gitignore. Depends-On: openstack-k8s-operators/ci-framework#4114 Reviewed-by: John Fulton <johfulto@redhat.com>
5 participants
The architecture repo ships
osp-secrets.envwith hardcoded default passwords that end up in theosp-secretK8s Secret via kustomizesecretGenerator. This is a security risk for any environment that deploys using these defaults.Add a new
randomize_secrets.ymltask file to thekustomize_deployrole that rewrites values inosp-secrets.envwith randomly generated replacements after the architecture repo is cloned but beforeoc kustomizeruns. The task uses a three-tier resolution per key: live cluster secret, local cache, then fresh generation.Value format handling:
HeatAuthEncryptionKey): random hex of the same lengthBarbicanSimpleCryptoKEK): preserved as-isThe task is wired into both
cifmw_setup/deploy_architecture.ymland the deprecated06-deploy-architecture.ymlplaybook, running right aftercheck_requirementsand beforereduce_ocp_cluster.