Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

openshift-node is logging private RSA keys to the systemd journal #3951

Closed
maxamillion opened this issue Jul 29, 2015 · 17 comments
Closed

openshift-node is logging private RSA keys to the systemd journal #3951

maxamillion opened this issue Jul 29, 2015 · 17 comments

Comments

@maxamillion
Copy link
Member

Jul 29 15:25:09 losbs.example.com openshift-node[18926]: ValueFrom:<nil>} {Name:OPENSHIFT_MASTER Value:https://losbs.example.com:8443 ValueFrom:<nil>} {Name:ROUTER_SERVICE_NAME Value:router ValueFrom:<nil>} {Name:ROUTER_SERVICE_NAMESPACE Value:default ValueFrom:<nil>} {Name:STATS_PASSWORD Value:BBVRF1e9gq ValueFrom:<nil>} {Name:STATS_PORT Value:1936 ValueFrom:<nil>} {Name:STATS_USERNAME Value:admin ValueFrom:<nil>}] Resources:{Limits:map[] Requests:map[]} VolumeMounts:[{Name:default-token-81jlw ReadOnly:true MountPath:/var/run/secrets/kubernetes.io/serviceaccount}] LivenessProbe:0xc2096e20c0 ReadinessProbe:<nil> Lifecycle:<nil> TerminationMessagePath:/dev/termination-log ImagePullPolicy:IfNotPresent SecurityContext:0xc208d49a20}] RestartPolicy:Always TerminationGracePeriodSeconds:<nil> ActiveDeadlineSeconds:<nil> DNSPolicy:ClusterFirst NodeSelector:map[] ServiceAccountName:default NodeName:losbs.example.com HostNetwork:false ImagePullSecrets:[{Name:default-dockercfg-94xqt}]} Status:{Phase:Pending Conditions:[] Message: Reason: HostIP: PodIP: StartTime:<nil> ContainerStatuses:[]}}, podFullName: "router-1-hjuyt_default", uid: "80388a0e-357a-11e5-b69b-525400b16e9e"
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.578517   18926 manager.go:1375] Found pod infra container for "router-1-hjuyt_default"
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.579156   18926 manager.go:1364] Syncing Pod &{TypeMeta:{Kind: APIVersion:} ObjectMeta:{Name:docker-registry-1-i2bz5 GenerateName:docker-registry-1- Namespace:default SelfLink:/api/v1/namespaces/default/pods/docker-registry-1-i2bz5 UID:33b0d96c-3607-11e5-b69b-525400b16e9e ResourceVersion:7602 Generation:0 CreationTimestamp:2015-07-29 10:33:46 -0500 CDT DeletionTimestamp:<nil> Labels:map[deployment:docker-registry-1 deploymentconfig:docker-registry docker-registry:default] Annotations:map[kubernetes.io/created-by:{"kind":"SerializedReference","apiVersion":"v1","reference":{"kind":"ReplicationController","namespace":"default","name":"docker-registry-1","uid":"3238c5c1-3607-11e5-b69b-525400b16e9e","apiVersion":"v1","resourceVersion":"7600"}} openshift.io/deployment-config.latest-version:1 openshift.io/deployment-config.name:docker-registry openshift.io/deployment.name:docker-registry-1 openshift.io/scc:privileged kubernetes.io/config.source:api kubernetes.io/config.seen:2015-07-29T10:33:46.52852118-05:00]} Spec:{Volumes:[{Name:registry-storage VolumeSource:{HostPath:0xc208f1b320 EmptyDir:<nil> GCEPersistentDisk:<nil> AWSElasticBlockStore:<nil> GitRepo:<nil> Secret:<nil> NFS:<nil> ISCSI:<nil> Glusterfs:<nil> PersistentVolumeClaim:<nil> RBD:<nil> CephFS:<nil> Metadata:<nil>}} {Name:registry-token-kl6za VolumeSource:{HostPath:<nil> EmptyDir:<nil> GCEPersistentDisk:<nil> AWSElasticBlockStore:<nil> GitRepo:<nil> Secret:0xc208f1b330 NFS:<nil> ISCSI:<nil> Glusterfs:<nil> PersistentVolumeClaim:<nil> RBD:<nil> CephFS:<nil> Metadata:<nil>}}] Containers:[{Name:registry Image:openshift/origin-docker-registry:v1.0.3 Command:[] Args:[] WorkingDir: Ports:[{Name: HostPort:0 ContainerPort:5000 Protocol:TCP HostIP:}] Env:[{Name:OPENSHIFT_CA_DATA Value:-----BEGIN CERTIFICATE-----
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: MIIC5jCCAdCgAwIBAgIBATALBgkqhkiG9w0BAQswJjEkMCIGA1UEAwwbb3BlbnNo
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: aWZ0LXNpZ25lckAxNDM4MTIzMzMwMB4XDTE1MDcyODIyNDIwOVoXDTE2MDcyNzIy
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: NDIxMFowJjEkMCIGA1UEAwwbb3BlbnNoaWZ0LXNpZ25lckAxNDM4MTIzMzMwMIIB
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAujUr3rtMzXHnhWYNc/2dnEVy
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: VLD4UoDg/r4T4MnSPXwybPR6jTxQXeQiXAoYLBkIDYIohSBsFgl1MsFCba8ffRdB
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: mGag5v+J1+8Crv1C9vVCin/MYKxoO5Vvp0QIDSUtQVgUEnqyeSL9JmswwYtN3bI/
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: 42/Ub+FoSFOZeF56azaYyUY5klo6e1zhPnhgfloTgiuwWCvAUmCF3pKOYblQIDOh
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: 0NUZrk1Z17kVPdZ0ms8I4V+SG+PH0xvKftqlI+tjj9RhK7Ccy4qWTKyfOKdaUcnH
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: VpKNLgX8acvSC44XAm/PoSwbOwSm33xQg8HgbG4ki7mDwyVNsKxthHVzNbcX+wID
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: AQABoyMwITAOBgNVHQ8BAf8EBAMCAKQwDwYDVR0TAQH/BAUwAwEB/zALBgkqhkiG
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: 9w0BAQsDggEBALbfYYZxnIy0cWkCRkODDLEfESvIhPlqPn+VmiEnJ53pk+ekHL1v
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: Zwn3k0u7I2TUmPdkATuEC0bdaCFsZAnDN7p0VaEVcgYfS92slCA3LEvThd9GzGay
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: z5L79APEpSz3u5Pa3fQfOOH+G+6SHlvjnzMysuZI4l6wne6AjhnjWpJv1vWLHdg2
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: ru3x+zoJlzCPlFyQvuT9zmNOOkjmOYW9xO8a/6fUT2c2+VtAA34eORNy9/1rQOi/
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: w1nCnY13w/5jZso1vNj7wnrxQddmTlZBQsv/OmXC0Is37Z9r/1OHSTZTOnirSSwv
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: 7NxmGiQwbkrrzy5rSmdgNT+tnIV3aK9poHM=
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: -----END CERTIFICATE-----
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: ValueFrom:<nil>} {Name:OPENSHIFT_CERT_DATA Value:-----BEGIN CERTIFICATE-----
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: MIIDEjCCAfygAwIBAgIBBTALBgkqhkiG9w0BAQswJjEkMCIGA1UEAwwbb3BlbnNo
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: aWZ0LXNpZ25lckAxNDM4MTIzMzMwMB4XDTE1MDcyODIyNDIxNVoXDTE2MDcyNzIy
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: NDIxNlowQDEaMBgGA1UEChMRc3lzdGVtOnJlZ2lzdHJpZXMxIjAgBgNVBAMTGXN5
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: c3RlbTpvcGVuc2hpZnQtcmVnaXN0cnkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: ggEKAoIBAQDLe7cpv3pBCd5sG/tJgyigHmIF+HpQpTVy2Ccs82xZM49Vii2Clwg4
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: DC0vvsBcaLSW8ngmF5JdjEDF2fVz46+cf1UKd2IENlIOqgcuc36gO1YHkAhYX6kY
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: NTA8Iztv4CbqzxRM86USwUGQSg/xvw8WEgBPEjg+K9S8BGB/xcihpLF2MbLbJxbj
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: 7QMTTRKYZEd2ccd7CrXVOTwyWGa5nn4N/xfxneKPAEi6QI/vQRXP+SeDSSl0qEJ1
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: Fk08db9H0rMsxjtPccz1KggEMxgVGBC/zxc1kxkJCjzFuBwmvIcfQOxEjQDFnTTu
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: 2VoaQ6Jd5GfVSGhS75UAgSfegAn1vmeVAgMBAAGjNTAzMA4GA1UdDwEB/wQEAwIA
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: oDATBgNVHSUEDDAKBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMAsGCSqGSIb3DQEB
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: CwOCAQEAlw2dminQINeWQx96OCa7cpTfoX0RXWDkDFcYFc7xQvbGlkafodDocuB3
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: dp37IXRDRTboHA4vjP/6he/eiy5C+9pcQbnHnUSuUiwqs3xvbfZdjhFYEjqdPvP1
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: xhEjZZ4aYb7pUc3Dk88EZ/8IFIubh9g9grZHcHv94nfr21pL71X9EFBPatElTa2j
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: oOyraAyGRb1RN2RTvaABdWYtdtQRNRRsK0+mllMNeJptlMR/tKgON0YqwJndW4P4
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: Ijx2o2WR3Dkr0KoljW1YirVhEeqemVcehy96vYfphEWXV/Ezzo0TwbltoW014U6N
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: OrvyOr9Tyvu6gIWSG0SA6HoaS05Lxg==
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: -----END CERTIFICATE-----
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: ValueFrom:<nil>} {Name:OPENSHIFT_INSECURE Value:false ValueFrom:<nil>} {Name:OPENSHIFT_KEY_DATA Value:-----BEGIN RSA PRIVATE KEY-----
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: MIIEpgIBAAKCAQEAy3u3Kb96QQnebBv7SYMooB5iBfh6UKU1ctgnLPNsWTOPVYot
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: gpcIOAwtL77AXGi0lvJ4JheSXYxAxdn1c+OvnH9VCndiBDZSDqoHLnN+oDtWB5AI
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: WF+pGDUwPCM7b+Am6s8UTPOlEsFBkEoP8b8PFhIATxI4PivUvARgf8XIoaSxdjGy
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: 2ycW4+0DE00SmGRHdnHHewq11Tk8MlhmuZ5+Df8X8Z3ijwBIukCP70EVz/kng0kp
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: dKhCdRZNPHW/R9KzLMY7T3HM9SoIBDMYFRgQv88XNZMZCQo8xbgcJryHH0DsRI0A
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: xZ007tlaGkOiXeRn1UhoUu+VAIEn3oAJ9b5nlQIDAQABAoIBAQCvreJXcu+UE3cr
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: E4WC1HBQvaqXyQ2hbuGUg7ZfAtM6uF851RCxvL/l0+13WVMu9V9lK3Y8PQGrLpoF
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: t8ZJBfzqOq0rWiMPy+5Qps+IdUKQCGqgIORzmDOfqNw6L5jzYC15cMvwHDMa3CtE
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: 7gySBQh7X5NQsURJuQH0SjseVZ6AnuulWDMrlJ5HzIWZs2O4m2X7TEKc20M46Lm8
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: xci457HnqW8IaOLBgdJxGn1obWKvZ2wHVCm4RGqNL2uh3lSCrimez0xe/LZDxGqC
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: mo7n1H0osSp72dBN9RFg/VTX8pwJPS8GWQ1dA7RA1QSyAgETczCSFThM7Iqz1kYr
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: 6N0HWxOJAoGBAPIdxpmLKKL9UzNcdf6U1OLsNKXsgOPCf5nyeSJ/57gYwbwQuYIk
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: 5J3ImVvWiB6gnVNG3Po9q87D5hLo3j07jAzcEmQULmBEyzy7N24O6WA7oy1ymGky
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: qcjRevrp3wU8QsdO4QCk7iQfC2aCOJYhvOn8Kgoil2eZFsCV5YsedPh7AoGBANcm
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: 0D6DXXKkH+ZA+ZDZ8th4YmdPHaREa+R65AKnlTCAadb4X8dxR/ri07QIml3Sdo2B
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: 0SxqsMFAVzvLsBeHoFllW1aHZ3zLLcjRtwEEh3jVZrmgW21SE6+RQCckDk7FR6yB
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: A6O63JyWGn9iaF0B1V1NhgU2EYtD/oFe2Y+77osvAoGBAKsl3zi0xSIKPuEksAgp
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: Px+15zWPLEFUQQ0a+QQpNCzP20tM60WTPMRIhBgGW6yCzxOKGTUPmT6M/jtJv6e7
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: SzHf82QpW+sTVjN1CCbVhaVQIvZCdniOprRdWDi8T7mMsovfN3BUJj8EbvOkg8mk
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: yb0BUtpdP3etIQc8Lsob2oW3AoGBAMJfxnMzqxEPReJ3gQBkZwk6eWxsBZOKXQ8m
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: FyhuzlHrMbOM4LsGlMkMc8aKnyt0ILbnOVqvaNCumCDlfElFtpANCd+6pLwRs2Ni
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: U7sPpHR+FzhMr0ysgixzRUoXQPXZNU+bnvYks3qkAXxkI3UjWufYSeQbXO48l4m5
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: b0RzvKbxAoGBAJ4zomgk25vzSvJ56pfQPwjJKC82QRcw9XTdnJB838Y8rCx9Yn+2
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: SXn1J/Nci8lT0fAs+aBj3M8F4hvQz/NB/MybBSuvqXskD3cDGAFH+2XQYsdrmbS8
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: NG6rK1GAKiLW9B8ntZ5Ouf+gDA9fhlLIYpXQb7Tz2vyZPjiOHHqlaOga
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: -----END RSA PRIVATE KEY-----
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: ValueFrom:<nil>} {Name:OPENSHIFT_MASTER Value:https://losbs.example.com:8443 ValueFrom:<nil>}] Resources:{Limits:map[] Requests:map[]} VolumeMounts:[{Name:registry-storage ReadOnly:false MountPath:/registry} {Name:registry-token-kl6za ReadOnly:true MountPath:/var/run/secrets/kubernetes.io/serviceaccount}] LivenessProbe:<nil> ReadinessProbe:<nil> Lifecycle:<nil> TerminationMessagePath:/dev/termination-log ImagePullPolicy:IfNotPresent SecurityContext:0xc208d49aa0}] RestartPolicy:Always TerminationGracePeriodSeconds:<nil> ActiveDeadlineSeconds:<nil> DNSPolicy:ClusterFirst NodeSelector:map[] ServiceAccountName:registry NodeName:losbs.example.com HostNetwork:false ImagePullSecrets:[{Name:registry-dockercfg-ic68z}]} Status:{Phase:Pending Conditions:[] Message: Reason: HostIP: PodIP: StartTime:<nil> ContainerStatuses:[]}}, podFullName: "docker-registry-1-i2bz5_default", uid: "33b0d96c-3607-11e5-b69b-525400b16e9e"
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.579252   18926 manager.go:1375] Found pod infra container for "docker-registry-1-i2bz5_default"
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.581288   18926 manager.go:1388] Pod infra container looks good, keep it "docker-registry-1-i2bz5_default"
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.581362   18926 manager.go:1411] pod "docker-registry-1-i2bz5_default" container "registry" exists as 1ae3f672c584c4706d6786b2aeb8fe3fc6cdbc2ff9b21b566b23e028b40e1dce
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.581388   18926 prober.go:180] Readiness probe for "docker-registry-1-i2bz5_default:registry" succeeded
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.581395   18926 manager.go:1442] probe success: "registry"
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.581408   18926 manager.go:1515] Got container changes for pod "docker-registry-1-i2bz5_default": {StartInfraContainer:false InfraContainerId:5a9a80933128aac8f54c5b9d9f1f18507eec67779155dbba14bcc0e104ef8619 ContainersToStart:map[] ContainersToKeep:map[5a9a80933128aac8f54c5b9d9f1f18507eec67779155dbba14bcc0e104ef8619:-1 1ae3f672c584c4706d6786b2aeb8fe3fc6cdbc2ff9b21b566b23e028b40e1dce:0]}
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.581448   18926 kubelet.go:2245] Generating status for "docker-registry-1-i2bz5_default"
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.581958   18926 manager.go:1388] Pod infra container looks good, keep it "router-1-hjuyt_default"
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.582063   18926 manager.go:1411] pod "router-1-hjuyt_default" container "router" exists as e7f81682f97116e4ecfda09d031102dc77c82427a9759460ed94320707572291
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.582073   18926 prober.go:180] Readiness probe for "router-1-hjuyt_default:router" succeeded
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.582080   18926 prober.go:225] TCP-Probe PodIP: 10.1.0.3, Port: 80, Timeout: 1s
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.582662   18926 prober.go:136] Liveness probe for "router-1-hjuyt_default:router" succeeded
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.582676   18926 manager.go:1442] probe success: "router"
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.582687   18926 manager.go:1515] Got container changes for pod "router-1-hjuyt_default": {StartInfraContainer:false InfraContainerId:c3c50b6ad474a5c19abd304a254e334a31daa4661c892046e06eaf56b5148955 ContainersToStart:map[] ContainersToKeep:map[c3c50b6ad474a5c19abd304a254e334a31daa4661c892046e06eaf56b5148955:-1 e7f81682f97116e4ecfda09d031102dc77c82427a9759460ed94320707572291:0]}
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.582715   18926 kubelet.go:2245] Generating status for "router-1-hjuyt_default"
Jul 29 15:25:09 losbs.example.com openshift-node[18926]: I0729 15:25:09.612163   18926 manager.go:279] Container inspect result: {ID:e7f81682f97116e4ecfda09d031102dc77c82427a9759460ed94320707572291 Created:2015-07-29 16:45:33.605714603 +0000 UTC Path:/usr/bin/openshift-router Args:[--template=/var/lib/haproxy/conf/haproxy-config.template --reload=/var/lib/haproxy/reload-haproxy] Config:0xc208496480 State:{Running:true Paused:false Restarting:false OOMKilled:false Pid:37041 ExitCode:0 Error: StartedAt:2015-07-29 16:45:34.34976607 +0000 UTC FinishedAt:0001-01-01 00:00:00 +0000 UTC} Image:6476e03a99d277b80c0ca36f813a5273a9658a078e7f92e32a7648c9847b44f8 Node:<nil> NetworkSettings:0xc209e0a230 SysInitPath: ResolvConfPath:/var/lib/docker/containers/c3c50b6ad474a5c19abd304a254e334a31daa4661c892046e06eaf56b5148955/resolv.conf HostnamePath:/var/lib/docker/containers/c3c50b6ad474a5c19abd304a254e334a31daa4661c892046e06eaf56b5148955/hostname HostsPath:/var/lib/docker/containers/c3c50b6ad474a5c19abd304a254e334a31daa4661c892046e06eaf56b5148955/hosts Name:/k8s_router.e0da39d5_router-1-hjuyt_default_80388a0e-357a-11e5-b69b-525400b16e9e_5aeca6e0 Driver:devicemapper Volumes:map[/dev/termination-log:/var/lib/openshift/openshift.local.volumes/pods/80388a0e-357a-11e5-b69b-525400b16e9e/containers/router/e7f81682f97116e4ecfda09d031102dc77c82427a9759460ed94320707572291 /var/run/secrets/kubernetes.io/serviceaccount:/var/lib/openshift/openshift.local.volumes/pods/80388a0e-357a-11e5-b69b-525400b16e9e/volumes/kubernetes.io~secret/default-token-81jlw] VolumesRW:map[/dev/termination-log:true /var/run/secrets/kubernetes.io/serviceaccount:false] HostConfig:0xc2085b41e0 ExecIDs:[] AppArmorProfile:}
@liggitt
Copy link
Contributor

liggitt commented Jul 29, 2015

These are the router credentials currently stored in envvars. Same exists for the registry pod

@sdodson
Copy link
Member

sdodson commented Jul 29, 2015

What log level should we be defaulting users to at this point?

@smarterclayton
Copy link
Contributor

4 is "debug", 2 is "normal verbosity", 3 is "more than normal".

@wshearn
Copy link

wshearn commented Jul 29, 2015

@liggitt that is fine, but should it be logging them to the nodes?

@sdodson I don't think log level matters, it should not be logging private keys.

@sdodson
Copy link
Member

sdodson commented Jul 29, 2015

@wshearn agreed. My question was somewhat tangential, sorry.

@liggitt
Copy link
Contributor

liggitt commented Jul 29, 2015

Should we expect envvars to contain secret values?

@wshearn
Copy link

wshearn commented Jul 29, 2015

@liggitt What about generating a secret store and mounting that into the container? That could allow people to still easily overwrite the secrets if they want while still providing some security around them.

@liggitt
Copy link
Contributor

liggitt commented Jul 29, 2015

Converting registry/router to use service account credentials (as secrets) is already planned, just not done yet

@maxamillion
Copy link
Member Author

Found another place this is being spit out (probably stored in the same place on the backend)

[root@losbs ~]# oc get pods -o=yaml
apiVersion: v1
items:
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      kubernetes.io/created-by: '{"kind":"SerializedReference","apiVersion":"v1","reference":{"kind":"ReplicationController","namespace":"default","name":"docker-registry-1","uid":"3238c5c1-3607-11e5-b69b-525400b16e9e","apiVersion":"v1","resourceVersion":"7600"}}'
      openshift.io/deployment-config.latest-version: "1"
      openshift.io/deployment-config.name: docker-registry
      openshift.io/deployment.name: docker-registry-1
      openshift.io/scc: privileged
    creationTimestamp: 2015-07-29T15:33:46Z
    generateName: docker-registry-1-
    labels:
      deployment: docker-registry-1
      deploymentconfig: docker-registry
      docker-registry: default
    name: docker-registry-1-i2bz5
    namespace: default
    resourceVersion: "8162"
    selfLink: /api/v1/namespaces/default/pods/docker-registry-1-i2bz5
    uid: 33b0d96c-3607-11e5-b69b-525400b16e9e
  spec:
    containers:
    - env:
      - name: OPENSHIFT_CA_DATA
        value: |
          -----BEGIN CERTIFICATE-----
          MIIC5jCCAdCgAwIBAgIBATALBgkqhkiG9w0BAQswJjEkMCIGA1UEAwwbb3BlbnNo
          aWZ0LXNpZ25lckAxNDM4MTIzMzMwMB4XDTE1MDcyODIyNDIwOVoXDTE2MDcyNzIy
          NDIxMFowJjEkMCIGA1UEAwwbb3BlbnNoaWZ0LXNpZ25lckAxNDM4MTIzMzMwMIIB
          IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAujUr3rtMzXHnhWYNc/2dnEVy
          VLD4UoDg/r4T4MnSPXwybPR6jTxQXeQiXAoYLBkIDYIohSBsFgl1MsFCba8ffRdB
          mGag5v+J1+8Crv1C9vVCin/MYKxoO5Vvp0QIDSUtQVgUEnqyeSL9JmswwYtN3bI/
          42/Ub+FoSFOZeF56azaYyUY5klo6e1zhPnhgfloTgiuwWCvAUmCF3pKOYblQIDOh
          0NUZrk1Z17kVPdZ0ms8I4V+SG+PH0xvKftqlI+tjj9RhK7Ccy4qWTKyfOKdaUcnH
          VpKNLgX8acvSC44XAm/PoSwbOwSm33xQg8HgbG4ki7mDwyVNsKxthHVzNbcX+wID
          AQABoyMwITAOBgNVHQ8BAf8EBAMCAKQwDwYDVR0TAQH/BAUwAwEB/zALBgkqhkiG
          9w0BAQsDggEBALbfYYZxnIy0cWkCRkODDLEfESvIhPlqPn+VmiEnJ53pk+ekHL1v
          Zwn3k0u7I2TUmPdkATuEC0bdaCFsZAnDN7p0VaEVcgYfS92slCA3LEvThd9GzGay
          z5L79APEpSz3u5Pa3fQfOOH+G+6SHlvjnzMysuZI4l6wne6AjhnjWpJv1vWLHdg2
          ru3x+zoJlzCPlFyQvuT9zmNOOkjmOYW9xO8a/6fUT2c2+VtAA34eORNy9/1rQOi/
          w1nCnY13w/5jZso1vNj7wnrxQddmTlZBQsv/OmXC0Is37Z9r/1OHSTZTOnirSSwv
          7NxmGiQwbkrrzy5rSmdgNT+tnIV3aK9poHM=
          -----END CERTIFICATE-----
      - name: OPENSHIFT_CERT_DATA
        value: |
          -----BEGIN CERTIFICATE-----
          MIIDEjCCAfygAwIBAgIBBTALBgkqhkiG9w0BAQswJjEkMCIGA1UEAwwbb3BlbnNo
          aWZ0LXNpZ25lckAxNDM4MTIzMzMwMB4XDTE1MDcyODIyNDIxNVoXDTE2MDcyNzIy
          NDIxNlowQDEaMBgGA1UEChMRc3lzdGVtOnJlZ2lzdHJpZXMxIjAgBgNVBAMTGXN5
          c3RlbTpvcGVuc2hpZnQtcmVnaXN0cnkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
          ggEKAoIBAQDLe7cpv3pBCd5sG/tJgyigHmIF+HpQpTVy2Ccs82xZM49Vii2Clwg4
          DC0vvsBcaLSW8ngmF5JdjEDF2fVz46+cf1UKd2IENlIOqgcuc36gO1YHkAhYX6kY
          NTA8Iztv4CbqzxRM86USwUGQSg/xvw8WEgBPEjg+K9S8BGB/xcihpLF2MbLbJxbj
          7QMTTRKYZEd2ccd7CrXVOTwyWGa5nn4N/xfxneKPAEi6QI/vQRXP+SeDSSl0qEJ1
          Fk08db9H0rMsxjtPccz1KggEMxgVGBC/zxc1kxkJCjzFuBwmvIcfQOxEjQDFnTTu
          2VoaQ6Jd5GfVSGhS75UAgSfegAn1vmeVAgMBAAGjNTAzMA4GA1UdDwEB/wQEAwIA
          oDATBgNVHSUEDDAKBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMAsGCSqGSIb3DQEB
          CwOCAQEAlw2dminQINeWQx96OCa7cpTfoX0RXWDkDFcYFc7xQvbGlkafodDocuB3
          dp37IXRDRTboHA4vjP/6he/eiy5C+9pcQbnHnUSuUiwqs3xvbfZdjhFYEjqdPvP1
          xhEjZZ4aYb7pUc3Dk88EZ/8IFIubh9g9grZHcHv94nfr21pL71X9EFBPatElTa2j
          oOyraAyGRb1RN2RTvaABdWYtdtQRNRRsK0+mllMNeJptlMR/tKgON0YqwJndW4P4
          Ijx2o2WR3Dkr0KoljW1YirVhEeqemVcehy96vYfphEWXV/Ezzo0TwbltoW014U6N
          OrvyOr9Tyvu6gIWSG0SA6HoaS05Lxg==
          -----END CERTIFICATE-----
      - name: OPENSHIFT_INSECURE
        value: "false"
      - name: OPENSHIFT_KEY_DATA
        value: |
          -----BEGIN RSA PRIVATE KEY-----
          MIIEpgIBAAKCAQEAy3u3Kb96QQnebBv7SYMooB5iBfh6UKU1ctgnLPNsWTOPVYot
          gpcIOAwtL77AXGi0lvJ4JheSXYxAxdn1c+OvnH9VCndiBDZSDqoHLnN+oDtWB5AI
          WF+pGDUwPCM7b+Am6s8UTPOlEsFBkEoP8b8PFhIATxI4PivUvARgf8XIoaSxdjGy
          2ycW4+0DE00SmGRHdnHHewq11Tk8MlhmuZ5+Df8X8Z3ijwBIukCP70EVz/kng0kp
          dKhCdRZNPHW/R9KzLMY7T3HM9SoIBDMYFRgQv88XNZMZCQo8xbgcJryHH0DsRI0A
          xZ007tlaGkOiXeRn1UhoUu+VAIEn3oAJ9b5nlQIDAQABAoIBAQCvreJXcu+UE3cr
          E4WC1HBQvaqXyQ2hbuGUg7ZfAtM6uF851RCxvL/l0+13WVMu9V9lK3Y8PQGrLpoF
          t8ZJBfzqOq0rWiMPy+5Qps+IdUKQCGqgIORzmDOfqNw6L5jzYC15cMvwHDMa3CtE
          7gySBQh7X5NQsURJuQH0SjseVZ6AnuulWDMrlJ5HzIWZs2O4m2X7TEKc20M46Lm8
          xci457HnqW8IaOLBgdJxGn1obWKvZ2wHVCm4RGqNL2uh3lSCrimez0xe/LZDxGqC
          mo7n1H0osSp72dBN9RFg/VTX8pwJPS8GWQ1dA7RA1QSyAgETczCSFThM7Iqz1kYr
          6N0HWxOJAoGBAPIdxpmLKKL9UzNcdf6U1OLsNKXsgOPCf5nyeSJ/57gYwbwQuYIk
          5J3ImVvWiB6gnVNG3Po9q87D5hLo3j07jAzcEmQULmBEyzy7N24O6WA7oy1ymGky
          qcjRevrp3wU8QsdO4QCk7iQfC2aCOJYhvOn8Kgoil2eZFsCV5YsedPh7AoGBANcm
          0D6DXXKkH+ZA+ZDZ8th4YmdPHaREa+R65AKnlTCAadb4X8dxR/ri07QIml3Sdo2B
          0SxqsMFAVzvLsBeHoFllW1aHZ3zLLcjRtwEEh3jVZrmgW21SE6+RQCckDk7FR6yB
          A6O63JyWGn9iaF0B1V1NhgU2EYtD/oFe2Y+77osvAoGBAKsl3zi0xSIKPuEksAgp
          Px+15zWPLEFUQQ0a+QQpNCzP20tM60WTPMRIhBgGW6yCzxOKGTUPmT6M/jtJv6e7
          SzHf82QpW+sTVjN1CCbVhaVQIvZCdniOprRdWDi8T7mMsovfN3BUJj8EbvOkg8mk
          yb0BUtpdP3etIQc8Lsob2oW3AoGBAMJfxnMzqxEPReJ3gQBkZwk6eWxsBZOKXQ8m
          FyhuzlHrMbOM4LsGlMkMc8aKnyt0ILbnOVqvaNCumCDlfElFtpANCd+6pLwRs2Ni
          U7sPpHR+FzhMr0ysgixzRUoXQPXZNU+bnvYks3qkAXxkI3UjWufYSeQbXO48l4m5
          b0RzvKbxAoGBAJ4zomgk25vzSvJ56pfQPwjJKC82QRcw9XTdnJB838Y8rCx9Yn+2
          SXn1J/Nci8lT0fAs+aBj3M8F4hvQz/NB/MybBSuvqXskD3cDGAFH+2XQYsdrmbS8
          NG6rK1GAKiLW9B8ntZ5Ouf+gDA9fhlLIYpXQb7Tz2vyZPjiOHHqlaOga
          -----END RSA PRIVATE KEY-----
      - name: OPENSHIFT_MASTER
        value: https://losbs.example.com:8443
      image: openshift/origin-docker-registry:v1.0.3
      imagePullPolicy: IfNotPresent
      name: registry
      ports:
      - containerPort: 5000
        protocol: TCP
      resources: {}
      securityContext:
        capabilities: {}
        privileged: true
      terminationMessagePath: /dev/termination-log
      volumeMounts:
      - mountPath: /registry
        name: registry-storage
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: registry-token-kl6za
        readOnly: true
    dnsPolicy: ClusterFirst
    host: losbs.example.com
    imagePullSecrets:
    - name: registry-dockercfg-ic68z
    nodeName: losbs.example.com
    restartPolicy: Always
    serviceAccount: registry
    serviceAccountName: registry
    volumes:
    - hostPath:
        path: /var/lib/openshift/docker-registry
      name: registry-storage
    - name: registry-token-kl6za
      secret:
        secretName: registry-token-kl6za
  status:
    conditions:
    - status: "True"
      type: Ready
    containerStatuses:
    - containerID: docker://1ae3f672c584c4706d6786b2aeb8fe3fc6cdbc2ff9b21b566b23e028b40e1dce
      image: openshift/origin-docker-registry:v1.0.3
      imageID: docker://80f9e08cd8d221bf9024af25db13e4b85c3cb56679af8c0b6a5dae463d9347ea
      lastState:
        terminated:
          containerID: docker://64176093d803fce56ecc2b9bb266ce2c820e7e8e8dd6e35c2ddacbf1bee98925
          exitCode: 2
          finishedAt: 2015-07-29T16:45:26Z
          startedAt: 2015-07-29T16:44:25Z
      name: registry
      ready: true
      restartCount: 2
      state:
        running:
          startedAt: 2015-07-29T16:45:34Z
    hostIP: 192.168.122.28
    phase: Running
    podIP: 10.1.0.2
    startTime: 2015-07-29T15:33:46Z
- apiVersion: v1
  kind: Pod
  metadata:
    annotations:
      kubernetes.io/created-by: '{"kind":"SerializedReference","apiVersion":"v1","reference":{"kind":"ReplicationController","namespace":"default","name":"router-1","uid":"59c101db-357a-11e5-b69b-525400b16e9e","apiVersion":"v1","resourceVersion":"313"}}'
      openshift.io/deployment-config.latest-version: "1"
      openshift.io/deployment-config.name: router
      openshift.io/deployment.name: router-1
      openshift.io/scc: restricted
    creationTimestamp: 2015-07-28T22:46:35Z
    generateName: router-1-
    labels:
      deployment: router-1
      deploymentconfig: router
      router: router
    name: router-1-hjuyt
    namespace: default
    resourceVersion: "8161"
    selfLink: /api/v1/namespaces/default/pods/router-1-hjuyt
    uid: 80388a0e-357a-11e5-b69b-525400b16e9e
  spec:
    containers:
    - env:
      - name: DEFAULT_CERTIFICATE
      - name: OPENSHIFT_CA_DATA
        value: |
          -----BEGIN CERTIFICATE-----
          MIIC5jCCAdCgAwIBAgIBATALBgkqhkiG9w0BAQswJjEkMCIGA1UEAwwbb3BlbnNo
          aWZ0LXNpZ25lckAxNDM4MTIzMzMwMB4XDTE1MDcyODIyNDIwOVoXDTE2MDcyNzIy
          NDIxMFowJjEkMCIGA1UEAwwbb3BlbnNoaWZ0LXNpZ25lckAxNDM4MTIzMzMwMIIB
          IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAujUr3rtMzXHnhWYNc/2dnEVy
          VLD4UoDg/r4T4MnSPXwybPR6jTxQXeQiXAoYLBkIDYIohSBsFgl1MsFCba8ffRdB
          mGag5v+J1+8Crv1C9vVCin/MYKxoO5Vvp0QIDSUtQVgUEnqyeSL9JmswwYtN3bI/
          42/Ub+FoSFOZeF56azaYyUY5klo6e1zhPnhgfloTgiuwWCvAUmCF3pKOYblQIDOh
          0NUZrk1Z17kVPdZ0ms8I4V+SG+PH0xvKftqlI+tjj9RhK7Ccy4qWTKyfOKdaUcnH
          VpKNLgX8acvSC44XAm/PoSwbOwSm33xQg8HgbG4ki7mDwyVNsKxthHVzNbcX+wID
          AQABoyMwITAOBgNVHQ8BAf8EBAMCAKQwDwYDVR0TAQH/BAUwAwEB/zALBgkqhkiG
          9w0BAQsDggEBALbfYYZxnIy0cWkCRkODDLEfESvIhPlqPn+VmiEnJ53pk+ekHL1v
          Zwn3k0u7I2TUmPdkATuEC0bdaCFsZAnDN7p0VaEVcgYfS92slCA3LEvThd9GzGay
          z5L79APEpSz3u5Pa3fQfOOH+G+6SHlvjnzMysuZI4l6wne6AjhnjWpJv1vWLHdg2
          ru3x+zoJlzCPlFyQvuT9zmNOOkjmOYW9xO8a/6fUT2c2+VtAA34eORNy9/1rQOi/
          w1nCnY13w/5jZso1vNj7wnrxQddmTlZBQsv/OmXC0Is37Z9r/1OHSTZTOnirSSwv
          7NxmGiQwbkrrzy5rSmdgNT+tnIV3aK9poHM=
          -----END CERTIFICATE-----
      - name: OPENSHIFT_CERT_DATA
        value: |
          -----BEGIN CERTIFICATE-----
          MIIDDTCCAfegAwIBAgIBBDALBgkqhkiG9w0BAQswJjEkMCIGA1UEAwwbb3BlbnNo
          aWZ0LXNpZ25lckAxNDM4MTIzMzMwMB4XDTE1MDcyODIyNDIxNFoXDTE2MDcyNzIy
          NDIxNVowOzEXMBUGA1UEChMOc3lzdGVtOnJvdXRlcnMxIDAeBgNVBAMTF3N5c3Rl
          bTpvcGVuc2hpZnQtcm91dGVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
          AQEA4xZdrMqdBj+0QPcRpQRAXP2Nhr2bcc5J5UfBWXbWxfdCFDPDcwDMAl4/2Vvp
          FFYFVSoYnVGp3rK0BCc1jC8mHq4cd/OjrHeuw7IXoBjUbPEL0U2nQMl8Mfjlvy6H
          qIx7lg9mtZRRDQXJiyBV4JRhFXYGmzxkdnUYOyyyksGijw5zFGuFhCoLmjjCcrDh
          fH3wDbiG4Zp9eK4EL7lW/ozJloUyaQMTQypfU4wYq7hNsaKRAtLXCUcpd+06AnZ4
          oonWHGrkuNu2eR9hIaYXUTuL1jsodBzVAuQ4Jehu54mik3ewZl0f/MU/vhsPTg4Z
          kUHkluh3NbAbvMPE6notRxlz7QIDAQABozUwMzAOBgNVHQ8BAf8EBAMCAKAwEwYD
          VR0lBAwwCgYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADALBgkqhkiG9w0BAQsDggEB
          AALlFimAJtfFY0ZLozm6566/Xmc700Tvyhj7TrTJuqWP0h5mQZqpSyBMCAI3RfN/
          cEYDnkK1ulK8PSgH4L2bwl+iV3pslZV5poroYJeKVOzfgxh8yT0GjUSIjjyh4oRR
          hL8vGfFFxVYtqdxeYSRfi7JIsrl708OPdYMmkCsftFkAThTFrC403n2QMRkn/+TG
          GmTl3O/u/4Aba1aLbJ9hpFrjn8gani4Do4lCP096nDaKzsEO5fB4+qZvBMgS6B/+
          LfL7nEVU2SHpvw6vwD4Qs0c5fIZdiUhezE3p6yImObuXwXFOYTvbC+Kfs0HiONpr
          O4aFW9kT+IafKj9N57/OilQ=
          -----END CERTIFICATE-----
      - name: OPENSHIFT_INSECURE
        value: "false"
      - name: OPENSHIFT_KEY_DATA
        value: |
          -----BEGIN RSA PRIVATE KEY-----
          MIIEpQIBAAKCAQEA4xZdrMqdBj+0QPcRpQRAXP2Nhr2bcc5J5UfBWXbWxfdCFDPD
          cwDMAl4/2VvpFFYFVSoYnVGp3rK0BCc1jC8mHq4cd/OjrHeuw7IXoBjUbPEL0U2n
          QMl8Mfjlvy6HqIx7lg9mtZRRDQXJiyBV4JRhFXYGmzxkdnUYOyyyksGijw5zFGuF
          hCoLmjjCcrDhfH3wDbiG4Zp9eK4EL7lW/ozJloUyaQMTQypfU4wYq7hNsaKRAtLX
          CUcpd+06AnZ4oonWHGrkuNu2eR9hIaYXUTuL1jsodBzVAuQ4Jehu54mik3ewZl0f
          /MU/vhsPTg4ZkUHkluh3NbAbvMPE6notRxlz7QIDAQABAoIBAQC7Jye0zJd1GvN3
          xyfnlAVnniARuBpwRM9qAyU6klKXfRwcgjzGfxWjrgF5JeKGPA7RDYyTu0YAn870
          zUu4aPNFvcEAqu9tqIWECzalX1FTJ6XRren13xhYJwVR9wsewgjot3CynbXewbJE
          0zVzjVYl1cvEDJXPetmpi0Dw6l0LABQtV2mTa9BiWW/833gcuCYnO5SFx2tDEwVH
          C/SZ4EV0ERwLniJJmODZBhx3U+nqtwBssdTrhoUkrflFqWGOQSAdSS7oJ0Bh1ixF
          a12u4lDmPNLVm+ppBfS4EfWhV/CAG/G9LlkQSbP3JA443gcTP3DWf6IxrvrYq2FC
          uy6f56UBAoGBAO6ho1fUdkvoP+mFM3DBRedtZO4oGDWQGJFHl7aZIz39fBeIYC0W
          krgfmnl59hFySTuQIX8hUpRO2Wpn9YxUd66EI7CCNPpBk0q88ZHNnDvb4ccPZ1KG
          p6qNDyMSLFNNOpHBs+nDOG81Mz1iqXChwIyW+/T4pt/9RcNLNtRlA+9dAoGBAPOd
          oXNsEdeN0/sBK/hN8H0cnKVTZbldZZOLPyDGr3zAYbySvlLKRrnBJ05UF1quyL1O
          NJZP1UJ3V+HwOPWYsuUJxyyzET4xaVN6+8D6Iiqu9gM2uJS4G0WyJWN6cykNpQ/P
          582PXPr/llQuQnCL08HMnoczCgvNkWkz5ceDA53RAoGAXyPgrPbPR0pMmPz7Wlwk
          U7WgxPcFV+2gbeO+UBXUIDX9EKDVv4Q9cN1gyEfg3GnVWsMHJ9mQRAL/2dWi55UR
          tmmGlSwElTYp1GVqZrg0LwVmiefRSOzY0j21KEVpmLi0vkIdSfkEegoa6MF6Tqae
          zy6vO6cbWThwZQGK1bmEjR0CgYEA3GbUVrSDP90U15Yrza3V0Zs9LWXSNm4FJANq
          zaBzzA3RXuX0Qrq2WgAiK39w0Z4oBvzmHseDTWrjm4nWPnwz/XtnM02eYAIcJGaz
          tdeXab543Fd5jzMxmVCe+u0hmxa5KyERuqvllz/9JZPkkCYxIriZBABtKliFIgTN
          8j7Z2sECgYEAjJMtsIb6RP6M+HicRANr+sUag1ZJmKc3xym+wjtOE991MIcBmC42
          McBt/ZNS+yn0+Jgcfux4+q5Vw+OiW8lwuVgwrxSTN4kNXwsqL+EBdZmXxiS9lumU
          4V1nJZUCgDwLU8YAostrqzC5PcmH6LWIFJ+bbWJjLLoIWRheI4JyPck=
          -----END RSA PRIVATE KEY-----
      - name: OPENSHIFT_MASTER
        value: https://losbs.example.com:8443
      - name: ROUTER_SERVICE_NAME
        value: router
      - name: ROUTER_SERVICE_NAMESPACE
        value: default
      - name: STATS_PASSWORD
        value: BBVRF1e9gq
      - name: STATS_PORT
        value: "1936"
      - name: STATS_USERNAME
        value: admin
      image: openshift/origin-haproxy-router:v1.0.3
      imagePullPolicy: IfNotPresent
      livenessProbe:
        initialDelaySeconds: 10
        tcpSocket:
          port: 80
        timeoutSeconds: 1
      name: router
      ports:
      - containerPort: 80
        hostPort: 80
        protocol: TCP
      - containerPort: 443
        hostPort: 443
        protocol: TCP
      - containerPort: 1936
        hostPort: 1936
        name: stats
        protocol: TCP
      resources: {}
      securityContext:
        privileged: false
        runAsUser: 1000000000
        seLinuxOptions:
          level: s0:c1,c0
      terminationMessagePath: /dev/termination-log
      volumeMounts:
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: default-token-81jlw
        readOnly: true
    dnsPolicy: ClusterFirst
    host: losbs.example.com
    imagePullSecrets:
    - name: default-dockercfg-94xqt
    nodeName: losbs.example.com
    restartPolicy: Always
    serviceAccount: default
    serviceAccountName: default
    volumes:
    - name: default-token-81jlw
      secret:
        secretName: default-token-81jlw
  status:
    conditions:
    - status: "True"
      type: Ready
    containerStatuses:
    - containerID: docker://e7f81682f97116e4ecfda09d031102dc77c82427a9759460ed94320707572291
      image: openshift/origin-haproxy-router:v1.0.3
      imageID: docker://6476e03a99d277b80c0ca36f813a5273a9658a078e7f92e32a7648c9847b44f8
      lastState:
        terminated:
          containerID: docker://0f7517cf370182e867c919382f9d7f58a21208ab61b3d6461f7b06c5727430db
          exitCode: 2
          finishedAt: 2015-07-29T16:45:26Z
          startedAt: 2015-07-29T16:44:25Z
      name: router
      ready: true
      restartCount: 2
      state:
        running:
          startedAt: 2015-07-29T16:45:34Z
    hostIP: 192.168.122.28
    phase: Running
    podIP: 10.1.0.3
    startTime: 2015-07-28T22:46:35Z
kind: List
metadata: {}

@liggitt
Copy link
Contributor

liggitt commented Jul 31, 2015

Right, the root cause is storing the cert/key as envvars in the pod, which is what needs to stop.

@liggitt
Copy link
Contributor

liggitt commented Apr 12, 2016

--credentials has been deprecated for both router and registry commands. I'd like to stop generating the cert-based credentials for the register and router post-1.2, and remove the --credentials option entirely by 1.3

@sdodson
Copy link
Member

sdodson commented Apr 12, 2016

Deprecated in 1.2? it's littered all over our docs currently.

@liggitt
Copy link
Contributor

liggitt commented Apr 12, 2016

It's still present, functional, and supported, but isn't necessary and is discouraged. Docs still need updating, on my list.

@maxamillion
Copy link
Member Author

Wait, what is 1.2 and 1.3? The git tags show the latest stable release as v1.1.6

@liggitt
Copy link
Contributor

liggitt commented Apr 13, 2016

what is 1.2 and 1.3

the future :)

@maxamillion
Copy link
Member Author

Ah, ok. The way @sdodson said "depricated in 1.2?" sounded past tense and I was confused. Thanks :)

@mscherer
Copy link
Contributor

So FYI, I stumbled on that while looking for bug, and asked for a CVE to be assigned:
http://www.openwall.com/lists/oss-security/2016/07/13/9

Answer:
http://www.openwall.com/lists/oss-security/2016/07/13/10

So that's CVE-2015-8945.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

6 participants