Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix some issues around secrets handling (PROJQUAY-6787) #142

Merged
merged 2 commits into from
Mar 5, 2024
Merged

fix some issues around secrets handling (PROJQUAY-6787) #142

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5b09bd1
fix some issues around secrets handling
BadgerOps Feb 21, 2024
c546d73
set skip_existing to true for secrets for install so we don't clobber
BadgerOps Feb 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions ...ble-runner/context/app/project/roles/mirror_appliance/tasks/install-postgres-service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,13 @@
state: present
name: pg-storage

- name: Create Postgres Password Secret
containers.podman.podman_secret:
state: present
name: pgdb_pass
data: "{{ pgdb_password }}"
skip_existing: true

- name: Start Postgres service
systemd:
name: quay-postgres.service
Expand Down
7 changes: 7 additions & 0 deletions ansible-runner/context/app/project/roles/mirror_appliance/tasks/install-redis-service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,13 @@
retries: 5
delay: 5

- name: Create Redis Password Secret
containers.podman.podman_secret:
state: present
name: redis_pass
data: "{{ redis_password }}"
skip_existing: true

- name: Start Redis service
systemd:
name: quay-redis.service
Expand Down
3 changes: 3 additions & 0 deletions ansible-runner/context/app/project/roles/mirror_appliance/tasks/main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
- name: Expand variables
include_tasks: expand-vars.yaml

- name: Create secret vars
include_tasks: secret-vars.yaml

- name: Install Dependencies
include_tasks: install-deps.yaml

Expand Down
6 changes: 6 additions & 0 deletions ansible-runner/context/app/project/roles/mirror_appliance/tasks/secret-vars.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
- name: Generate secrets for Quay config.yaml
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not very familiar with the community.general.random_string. A quick google search yields its powered by the https://docs.python.org/3/library/random.html#random.SystemRandom lib. It looks like it will use a unique seed on each invocation unless specified specific seed (for testing purposes).

However, it does mention limitations of not being available on some OS, though it doesn't call out any. Do we know what the limitations of this role and underlying libraries are?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I'm not sure exactly why that doc mentions it not being available - my guess is maybe a *BSD? Looks like even windows can deal with os.urandom properly.

Given that it is highly unlikely this tool will be installed on a non RHEL OS, I don't think we'll see an issue. The primary reason I went this path was that community.general was already installed, and I didn't want to add any more imports/complexity than necessary to accomplish the goal.

set_fact:
secret_key: "{{ lookup('community.general.random_string', length=48, base64=True) }}"
database_secret_key: "{{ lookup('community.general.random_string', length=48, base64=True) }}"
pgdb_password: "{{ lookup('community.general.random_string', length=24, base64=True) }}"
redis_password: "{{ lookup('community.general.random_string', length=24, base64=True) }}"
10 changes: 5 additions & 5 deletions ansible-runner/context/app/project/roles/mirror_appliance/templates/config.yaml.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
AUTHENTICATION_TYPE: Database
BUILDLOGS_REDIS:
host: localhost
password: password
password: {{ redis_password }}
port: 6379
DATABASE_SECRET_KEY: "81541057085600720484162638317561463611194901378275494293746615390984668417511"
DB_URI: postgresql://user:password@localhost/quay
DATABASE_SECRET_KEY: {{ database_secret_key }}
DB_URI: postgresql://user:{{ pgdb_password }}@localhost/quay
DEFAULT_TAG_EXPIRATION: 2w
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
DISTRIBUTED_STORAGE_PREFERENCE:
Expand Down Expand Up @@ -42,7 +42,7 @@ REGISTRY_TITLE: Red Hat Quay
REGISTRY_TITLE_SHORT: Red Hat Quay
REPO_MIRROR_SERVER_HOSTNAME: null
REPO_MIRROR_TLS_VERIFY: false
SECRET_KEY: "30824339799025335633887256663000123118247018465144108496567331049820667127217"
SECRET_KEY: {{ secret_key }}
SECURITY_SCANNER_ISSUER_NAME: security_scanner
SERVER_HOSTNAME: {{ quay_hostname }}
SETUP_COMPLETE: true
Expand All @@ -60,7 +60,7 @@ USERFILES_LOCATION: default
USERFILES_PATH: userfiles/
USER_EVENTS_REDIS:
host: localhost
password: password
password: {{ redis_password }}
port: 6379
USE_CDN: false
FEATURE_USER_INITIALIZE: true
Expand Down
2 changes: 1 addition & 1 deletion ansible-runner/context/app/project/roles/mirror_appliance/templates/postgres.service.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,12 +13,12 @@ ExecStart=/usr/bin/podman run \
-v {{ expanded_pg_storage }}:/var/lib/pgsql/data:Z \
--image-volume=ignore \
-e POSTGRESQL_USER=user \
-e POSTGRESQL_PASSWORD=password \
-e POSTGRESQL_DATABASE=quay \
--pod=quay-pod \
--conmon-pidfile %t/%n-pid \
--cidfile %t/%n-cid \
--cgroups=no-conmon \
--secret=pgdb_pass,type=env,target=POSTGRESQL_PASSWORD \
--replace \
{{ postgres_image }}

Expand Down
2 changes: 1 addition & 1 deletion ansible-runner/context/app/project/roles/mirror_appliance/templates/redis.service.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,12 @@ TimeoutStartSec=5m
ExecStartPre=-/bin/rm -f %t/%n-pid %t/%n-cid
ExecStart=/usr/bin/podman run \
--name quay-redis \
-e REDIS_PASSWORD=password \
--pod=quay-pod \
--conmon-pidfile %t/%n-pid \
--cidfile %t/%n-cid \
--cgroups=no-conmon \
--image-volume=ignore \
--secret=redis_pass,type=env,target=REDIS_PASSWORD \
--replace \
{{ redis_image }}

Expand Down
Loading