Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixes #30384 - Fix ansible secrets to support effective_user_password #350

Merged
merged 3 commits into from Aug 10, 2020
Merged

Fixes #30384 - Fix ansible secrets to support effective_user_password #350

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6342fc1
Fixes #30384 - Fix ansible secrets to support single effective_user_p…
patilsuraj767 Jul 13, 2020
9c8eeb1
Refs #30384 - REX version bump to 4.0.0
patilsuraj767 Jul 24, 2020
496539e
Refs #30384 - Fix test case
patilsuraj767 Aug 6, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
6 changes: 3 additions & 3 deletions app/models/foreman_ansible/ansible_provider.rb
View file
Open in desktop
Expand Up @@ -36,7 +36,7 @@ def secrets(host)
'per-host' => {
host.name => {
'ansible_ssh_pass' => rex_ssh_password(host),
'ansible_sudo_pass' => rex_sudo_password(host)
'ansible_become_password' => rex_effective_user_password(host)
}
}
}
Expand All @@ -46,8 +46,8 @@ def rex_ssh_password(host)
host_setting(host, 'remote_execution_ssh_password')
end

def rex_sudo_password(host)
host_setting(host, 'remote_execution_sudo_password')
def rex_effective_user_password(host)
host_setting(host, 'remote_execution_effective_user_password')
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doesn't this imply a migration of old settings is necessary?
We need migration to rename setting like this:

Setting.where(name: 'remote_execution_sudo_password').update_all(name: 'remote_execution_effective_user_password')

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ezr-ondrej Migration is written in this PR - theforeman/foreman_remote_execution#508

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right 👍 Thanks for the pointer, missed that out. In that case no more picks.

end

def host_setting(host, setting)
Expand Down
2 changes: 1 addition & 1 deletion foreman_ansible.gemspec
View file
Open in desktop
Expand Up @@ -22,6 +22,6 @@ Gem::Specification.new do |s|
# Kept as a dev dependency so tests can run together
s.add_development_dependency 'foreman_ansible_core', '~> 3.0'
s.add_dependency 'deface', '< 2.0'
s.add_dependency 'foreman_remote_execution', '>= 3.3.0'
s.add_dependency 'foreman_remote_execution', '>= 4.0.0'
s.add_dependency 'ipaddress', '>= 0.8.0', '< 1.0'
end
2 changes: 1 addition & 1 deletion lib/foreman_ansible_core/runner/ansible_runner.rb
View file
Open in desktop
Expand Up @@ -158,7 +158,7 @@ def rebuild_secrets(inventory, input)

new_secrets = {
'ansible_ssh_pass' => inventory['ssh_password'] || per_host['ansible_ssh_pass'],
'ansible_sudo_pass' => inventory['sudo_password'] || per_host['ansible_sudo_pass']
'ansible_become_password' => inventory['effective_user_password'] || per_host['ansible_become_password']
}
inventory['_meta']['hostvars'][host].update(new_secrets)
end
Expand Down
2 changes: 1 addition & 1 deletion lib/foreman_ansible_core/runner/playbook.rb
View file
Open in desktop
Expand Up @@ -125,7 +125,7 @@ def rebuild_secrets(inventory, secrets)

new_secrets = {
'ansible_ssh_pass' => inventory['ssh_password'] || per_host['ansible_ssh_pass'],
'ansible_sudo_pass' => inventory['sudo_password'] || per_host['ansible_sudo_pass']
'ansible_become_password' => inventory['effective_user_password'] || per_host['ansible_become_password']
}
inventory['_meta']['hostvars'][name].update(new_secrets)
end
Expand Down
4 changes: 2 additions & 2 deletions test/unit/ansible_provider_test.rb
View file
Open in desktop
Expand Up @@ -35,13 +35,13 @@ class AnsibleProviderTest < ActiveSupport::TestCase
it 'generates secrets properly' do
params = {
'remote_execution_ssh_password' => 'password',
'remote_execution_sudo_password' => 'letmein'
'ansible_become_password' => 'letmein'
}
host.expects(:params).twice.returns(params)
secrets = ForemanAnsible::AnsibleProvider.secrets(host)
host_secrets = secrets['per-host'][host.name]
assert_equal host_secrets['ansible_ssh_pass'], 'password'
assert_equal host_secrets['ansible_sudo_pass'], 'letmein'
assert_equal host_secrets['ansible_become_password'], 'letmein'
end
end

Expand Down
8 changes: 4 additions & 4 deletions test/unit/lib/foreman_ansible_core/ansible_runner_test.rb
View file
Open in desktop
Expand Up @@ -24,26 +24,26 @@ class AnsibleRunnerTest < ActiveSupport::TestCase
'_meta' => { 'hostvars' => { 'foreman.example.com' => {} } } }
end
let(:input) do
host_secrets = { 'ansible_ssh_pass' => 'letmein', 'ansible_sudo_pass' => 'iamroot' }
host_secrets = { 'ansible_ssh_pass' => 'letmein', 'ansible_become_password' => 'iamroot' }
secrets = { 'per-host' => { 'foreman.example.com' => host_secrets } }
host_input = { 'input' => { 'action_input' => { 'secrets' => secrets } } }
{ 'foreman.example.com' => host_input }
end
let(:runner) { ForemanAnsibleCore::Runner::AnsibleRunner.allocate }

test 'uses secrets from inventory' do
test_inventory = inventory.merge('ssh_password' => 'sshpass', 'sudo_password' => 'sudopass')
test_inventory = inventory.merge('ssh_password' => 'sshpass', 'effective_user_password' => 'mypass')
rebuilt = runner.send(:rebuild_secrets, test_inventory, input)
host_vars = rebuilt.dig('_meta', 'hostvars', 'foreman.example.com')
assert_equal 'sshpass', host_vars['ansible_ssh_pass']
assert_equal 'sudopass', host_vars['ansible_sudo_pass']
assert_equal 'mypass', host_vars['ansible_become_password']
end

test 'host secrets are used when not overriden by inventory secrest' do
rebuilt = runner.send(:rebuild_secrets, inventory, input)
host_vars = rebuilt.dig('_meta', 'hostvars', 'foreman.example.com')
assert_equal 'letmein', host_vars['ansible_ssh_pass']
assert_equal 'iamroot', host_vars['ansible_sudo_pass']
assert_equal 'iamroot', host_vars['ansible_become_password']
end
end
end
Expand Down
8 changes: 4 additions & 4 deletions test/unit/lib/foreman_ansible_core/playbook_runner_test.rb
View file
Open in desktop
Expand Up @@ -87,24 +87,24 @@ class PlaybookRunnerTest < ActiveSupport::TestCase
'_meta' => { 'hostvars' => { 'foreman.example.com' => {} } } }
end
let(:secrets) do
host_secrets = { 'ansible_ssh_pass' => 'letmein', 'ansible_sudo_pass' => 'iamroot' }
host_secrets = { 'ansible_ssh_pass' => 'letmein', 'ansible_become_password' => 'iamroot' }
{ 'per-host' => { 'foreman.example.com' => host_secrets } }
end
let(:runner) { ForemanAnsibleCore::Runner::Playbook.allocate }

test 'uses secrets from inventory' do
test_inventory = inventory.merge('ssh_password' => 'sshpass', 'sudo_password' => 'sudopass')
test_inventory = inventory.merge('ssh_password' => 'sshpass', 'effective_user_password' => 'mypass')
rebuilt = runner.send(:rebuild_secrets, test_inventory, secrets)
host_vars = rebuilt.dig('_meta', 'hostvars', 'foreman.example.com')
assert_equal 'sshpass', host_vars['ansible_ssh_pass']
assert_equal 'sudopass', host_vars['ansible_sudo_pass']
assert_equal 'mypass', host_vars['ansible_become_password']
end

test 'host secrets are used when not overriden by inventory secrest' do
rebuilt = runner.send(:rebuild_secrets, inventory, secrets)
host_vars = rebuilt.dig('_meta', 'hostvars', 'foreman.example.com')
assert_equal 'letmein', host_vars['ansible_ssh_pass']
assert_equal 'iamroot', host_vars['ansible_sudo_pass']
assert_equal 'iamroot', host_vars['ansible_become_password']
end
end
end
4 changes: 2 additions & 2 deletions test/unit/services/inventory_creator_test.rb
View file
Open in desktop
Expand Up @@ -10,7 +10,7 @@ class InventoryCreatorTest < ActiveSupport::TestCase
@host = FactoryBot.build(:host)
@template_invocation = OpenStruct.new(
:job_invocation => OpenStruct.new(:password => 'foobar',
:sudo_password => 'foobar'),
:effective_user_password => 'foobar'),
:effective_user => 'foobar'
)
end
Expand Down Expand Up @@ -70,7 +70,7 @@ class InventoryCreatorTest < ActiveSupport::TestCase
assert_equal Setting['remote_execution_effective_user_method'],
connection_params['ansible_become_method']
refute connection_params.key?('ansible_ssh_pass')
refute connection_params.key?('ansible_sudo_pass')
refute connection_params.key?('ansible_become_password')
end

test 'ssh private key is passed when available' do
Expand Down