This patch series moves us away from using admin/password for web requests, and instead we create/destroy a temporary aeolus user with administrative privileges for each puppet run.
We also make a separate, optional profile, admin_configure, which can be used to create an aeolus user with administrative privileges. Note that this makes the default profile now set up no 'admin' user by default, addressing the re-creation of un/pw admin/password which was the root of the bug in BZ806001. --- conf/admin_configure | 10 ++++ .../lib/puppet/parser/functions/secure_random.rb | 15 +++++ recipes/aeolus/manifests/conductor.pp | 55 +++++++++++++++----- recipes/aeolus/manifests/profiles/default.pp | 25 ++++++--- recipes/aeolus/manifests/profiles/ec2.pp | 47 +++++++++++------ recipes/aeolus/manifests/profiles/mock.pp | 36 +++++++++---- recipes/aeolus/manifests/profiles/rhevm.pp | 29 +++++++---- .../aeolus/manifests/profiles/rhevm/instance.pp | 3 +- recipes/aeolus/manifests/profiles/vsphere.pp | 28 ++++++---- .../aeolus/manifests/profiles/vsphere/instance.pp | 3 +- 10 files changed, 178 insertions(+), 73 deletions(-) create mode 100644 conf/admin_configure create mode 100644 recipes/aeolus/lib/puppet/parser/functions/secure_random.rb
diff --git a/conf/admin_configure b/conf/admin_configure new file mode 100644 index 0000000..00182c7 --- /dev/null +++ b/conf/admin_configure @@ -0,0 +1,10 @@ +parameters: + enable_https: true + admin_login: admin + admin_password: password + admin_email: root@localhost.localdomain + admin_first_name: Administrator + admin_last_name: "" +classes: +- aeolus::conductor +- aeolus::conductor::default_admin diff --git a/recipes/aeolus/lib/puppet/parser/functions/secure_random.rb b/recipes/aeolus/lib/puppet/parser/functions/secure_random.rb new file mode 100644 index 0000000..9ea7ce2 --- /dev/null +++ b/recipes/aeolus/lib/puppet/parser/functions/secure_random.rb @@ -0,0 +1,15 @@ +require 'securerandom' + +Puppet::Parser::Functions::newfunction(:secure_random, + :type => :rvalue, + :doc => <<ENDDOC +Return SecureRandom.hex using the first parameter as the +number of bytes desired, or 24 bytes by default. +ENDDOC +) do |args| + if !args[0].nil? && (args[0].responds_to to_i) + SecureRandom.hex(args[0]) + else + SecureRandom.hex(24) + end +end diff --git a/recipes/aeolus/manifests/conductor.pp b/recipes/aeolus/manifests/conductor.pp index 786c658..670eb58 100644 --- a/recipes/aeolus/manifests/conductor.pp +++ b/recipes/aeolus/manifests/conductor.pp @@ -180,23 +180,50 @@ class aeolus::conductor::disabled { }
# Create a new site admin conductor web user -define aeolus::conductor::site_admin($email="", $password="", $first_name="", $last_name=""){ +class aeolus::conductor::default_admin { exec{"create_site_admin_user": cwd => '/usr/share/aeolus-conductor', environment => "RAILS_ENV=production", - command => "/usr/bin/rake dc:create_user[${name},${password},${email},${first_name},${last_name}]", + command => "/usr/bin/rake dc:create_user[${admin_login},${admin_password},${admin_email},${admin_first_name},${admin_last_name}]", logoutput => true, - unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c "select count(*) from users where login = '${name}';"` = "1"", + unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c "select count(*) from roles, permissions, users where roles.id = permissions.role_id and users.id = permissions.user_id and roles.name = 'base.admin' and users.login = '${admin_login}'"` = "1"", require => Rails::Seed::Db["seed_aeolus_database"]} exec{"grant_site_admin_privs": cwd => '/usr/share/aeolus-conductor', environment => "RAILS_ENV=production", - command => "/usr/bin/rake dc:site_admin[${name}]", + command => "/usr/bin/rake dc:site_admin[${admin_login}]", logoutput => true, - unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c "select count(*) FROM roles INNER JOIN permissions ON (roles.id = permissions.role_id) INNER JOIN users ON (permissions.user_id = users.id) where roles.name = 'base.admin' AND users.login = '${name}';"` = "1"", + unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c "select count(*) FROM roles INNER JOIN permissions ON (roles.id = permissions.role_id) INNER JOIN users ON (permissions.user_id = users.id) where roles.name = 'base.admin' AND users.login = '${admin_login}';"` = "1"", require => Exec[create_site_admin_user]} }
+define aeolus::conductor::temp_admin($password=""){ + exec{"create_temp_admin": + cwd => '/usr/share/aeolus-conductor', + environment => "RAILS_ENV=production", + command => "/usr/bin/rake dc:create_user[${name},${password},'temp-admin@localhost.localdomain','temp','admin']", + logoutput => true, + require => Rails::Seed::Db["seed_aeolus_database"]} + exec{"grant_temp_admin_privs": + cwd => '/usr/share/aeolus-conductor', + environment => "RAILS_ENV=production", + command => "/usr/bin/rake dc:site_admin[${name}]", + logoutput => true, + require => Exec[create_temp_admin]} + } + + +define aeolus::conductor::destroy_temp_admin{ + exec{"destroy_temp_admin": + cwd => '/usr/share/aeolus-conductor', + environment => "RAILS_ENV=production", + command => "/usr/bin/rake dc:destroy_user[${name}]", + logoutput => true, + require => Rails::Seed::Db["seed_aeolus_database"] + } +} + + # login to the aeolus conductor define aeolus::conductor::login($password){ web_request{ "$name-conductor-login": @@ -231,7 +258,7 @@ define aeolus::conductor::logout(){ }
# Create a new provider via the conductor -define aeolus::conductor::provider($deltacloud_driver="",$url="", $deltacloud_provider=""){ +define aeolus::conductor::provider($deltacloud_driver="",$url="", $deltacloud_provider="", $admin_login=""){ web_request{ "provider-$name": post => "https://localhost/conductor/providers", parameters => { 'provider[name]' => $name, 'provider[url]' => $url, @@ -240,17 +267,17 @@ define aeolus::conductor::provider($deltacloud_driver="",$url="", $deltacloud_pr returns => '200', follow => true, contains => "//img[@alt='Notices']", # in the case of an error, @alt='Warnings' - use_cookies_at => '/tmp/aeolus-admin', + use_cookies_at => "/tmp/aeolus-${admin_login}", log_to => '/tmp/configure-provider-request.log', only_log_errors => true, unless => { 'get' => 'https://localhost/conductor/providers', 'contains' => "//html/body//a[text() = '$name']" }, - require => [Service['aeolus-conductor'], Exec['grant_site_admin_privs'], Exec['deltacloud-core-startup-wait']] + require => [Service['aeolus-conductor'], Exec['grant_temp_admin_privs'], Exec['deltacloud-core-startup-wait']] } }
# Create a new provider account via the conductor -define aeolus::conductor::provider::account($provider="", $type="", $username="",$password="", $account_id="",$x509private="", $x509public=""){ +define aeolus::conductor::provider::account($provider="", $type="", $username="",$password="", $account_id="",$x509private="", $x509public="", $admin_login=""){ if $type != "ec2" { web_request{ "provider-account-$name": post => "https://localhost/conductor/providers/0/provider_accounts", @@ -264,7 +291,7 @@ define aeolus::conductor::provider::account($provider="", $type="", $username="" returns => '200', #contains => "//table/thead/tr/th[text() = 'Properties for $name']", follow => true, - use_cookies_at => '/tmp/aeolus-admin', + use_cookies_at => "/tmp/aeolus-${admin_login}", unless => { 'get' => 'https://localhost/conductor/provider_accounts', 'contains' => "//html/body//a[text() = '$name']" }, require => Service['aeolus-conductor']} @@ -285,7 +312,7 @@ define aeolus::conductor::provider::account($provider="", $type="", $username="" returns => '200', #contains => "//table/thead/tr/th[text() = 'Properties for $name']", follow => true, - use_cookies_at => '/tmp/aeolus-admin', + use_cookies_at => "/tmp/aeolus-${admin_login}", unless => { 'get' => 'https://localhost/conductor/provider_accounts', 'contains' => "//html/body//a[text() = '$name']" }, require => Service['aeolus-conductor'] @@ -293,7 +320,7 @@ define aeolus::conductor::provider::account($provider="", $type="", $username="" } }
-define aeolus::conductor::hwp($memory='', $cpu='', $storage='', $architecture=''){ +define aeolus::conductor::hwp($memory='', $cpu='', $storage='', $architecture='', $admin_login=''){ web_request{ "hwp-$name": post => "https://localhost/conductor/hardware_profiles", parameters => {'hardware_profile[name]' => $name, @@ -313,7 +340,7 @@ define aeolus::conductor::hwp($memory='', $cpu='', $storage='', $architecture='' returns => '200', #verify => '.*Hardware profile added.*', follow => true, - use_cookies_at => '/tmp/aeolus-admin', - require => [Service['aeolus-conductor'], Exec['grant_site_admin_privs']] + use_cookies_at => "/tmp/aeolus-${admin_login}", + require => [Service['aeolus-conductor'], Exec['grant_temp_admin_privs']] } } diff --git a/recipes/aeolus/manifests/profiles/default.pp b/recipes/aeolus/manifests/profiles/default.pp index 5bb3119..47e640d 100644 --- a/recipes/aeolus/manifests/profiles/default.pp +++ b/recipes/aeolus/manifests/profiles/default.pp @@ -14,25 +14,32 @@
class aeolus::profiles::default {
+ #we will use one random hex string to name the temporary admin user + $random = secure_random() + $temp_admin_login = "temporary-administrative-user-${random}" + #and another random hex string for the temp user's password + $temp_admin_password = secure_random() + aeolus::create_bucket{"aeolus":}
- aeolus::conductor::site_admin{"admin": - email => 'root@localhost.localdomain', - password => "password", - first_name => 'Administrator', - last_name => ''} + aeolus::conductor::temp_admin{$temp_admin_login : + password => $temp_admin_password }
- aeolus::conductor::login{"admin": password => "password", - require => Aeolus::Conductor::Site_admin['admin']} + aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password, + require => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
aeolus::conductor::hwp{"small-x86_64": memory => "512", cpu => "1", storage => "", architecture => "x86_64", - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] }
- aeolus::conductor::logout{"admin": + aeolus::conductor::logout{$temp_admin_login: require => Aeolus::Conductor::Hwp['small-x86_64']}
+ aeolus::conductor::destroy_temp_admin{$temp_admin_login : + require => Aeolus::Conductor::Logout[$temp_admin_login]} + } diff --git a/recipes/aeolus/manifests/profiles/ec2.pp b/recipes/aeolus/manifests/profiles/ec2.pp index 3f63f70..165a32b 100644 --- a/recipes/aeolus/manifests/profiles/ec2.pp +++ b/recipes/aeolus/manifests/profiles/ec2.pp @@ -15,68 +15,83 @@ class aeolus::profiles::ec2 { include aeolus::deltacloud::ec2
+ #we will use one random hex string to name the temporary admin user + $random = secure_random() + $temp_admin_login = "temporary-administrative-user-${random}" + #and another random hex string for the temp user's password + $temp_admin_password = secure_random() + aeolus::create_bucket{"aeolus":}
- aeolus::conductor::site_admin{"admin": - email => 'root@localhost.localdomain', - password => "password", - first_name => 'Administrator', - last_name => ''} + aeolus::conductor::temp_admin{$temp_admin_login : + password => $temp_admin_password }
- aeolus::conductor::login{"admin": password => "password", - require => Aeolus::Conductor::Site_admin['admin']} + aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password, + require => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
aeolus::conductor::provider{"ec2-us-east-1": deltacloud_driver => 'ec2', deltacloud_provider => 'us-east-1', url => 'http://localhost:3002/api', - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] }
aeolus::conductor::provider{"ec2-us-west-1": deltacloud_driver => 'ec2', deltacloud_provider => 'us-west-1', url => 'http://localhost:3002/api', - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] }
aeolus::conductor::provider{"ec2-us-west-2": deltacloud_driver => 'ec2', deltacloud_provider => 'us-west-2', url => 'http://localhost:3002/api', - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] }
aeolus::conductor::provider{"ec2-eu-west-1": deltacloud_driver => 'ec2', deltacloud_provider => 'eu-west-1', url => 'http://localhost:3002/api', - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] }
aeolus::conductor::provider{"ec2-ap-southeast-1": deltacloud_driver => 'ec2', deltacloud_provider => 'ap-southeast-1', url => 'http://localhost:3002/api', - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] }
aeolus::conductor::provider{"ec2-ap-northeast-1": deltacloud_driver => 'ec2', deltacloud_provider => 'ap-northeast-1', url => 'http://localhost:3002/api', - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] }
aeolus::conductor::provider{"ec2-sa-east-1": deltacloud_driver => 'ec2', deltacloud_provider => 'sa-east-1', url => 'http://localhost:3002/api', - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] }
aeolus::conductor::hwp{"small-x86_64": memory => "512", cpu => "1", storage => "", architecture => "x86_64", - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] }
Aeolus::Conductor::Provider <| |> -> Aeolus::Conductor::Logout <| |>
- aeolus::conductor::logout{"admin": + aeolus::conductor::logout{$temp_admin_login: require => Aeolus::Conductor::Hwp['small-x86_64'] } + + aeolus::conductor::destroy_temp_admin{$temp_admin_login: + require => Aeolus::Conductor::Logout[$temp_admin_login]} + } diff --git a/recipes/aeolus/manifests/profiles/mock.pp b/recipes/aeolus/manifests/profiles/mock.pp index c68829c..b82a6d4 100644 --- a/recipes/aeolus/manifests/profiles/mock.pp +++ b/recipes/aeolus/manifests/profiles/mock.pp @@ -14,38 +14,50 @@
class aeolus::profiles::mock {
+ #we will use one random hex string to name the temporary admin user + $random = secure_random() + $temp_admin_login = "temporary-administrative-user-${random}" + #and another random hex string for the temp user's password + $temp_admin_password = secure_random() + aeolus::create_bucket{"aeolus":}
- aeolus::conductor::site_admin{"admin": - email => 'root@localhost.localdomain', - password => "password", - first_name => 'Administrator', - last_name => ''} + aeolus::conductor::temp_admin{$temp_admin_login : + password => $temp_admin_password }
- aeolus::conductor::login{"admin": password => "password", - require => Aeolus::Conductor::Site_admin['admin']} + aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password, + require => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
aeolus::conductor::provider{"mock": deltacloud_driver => 'mock', url => 'http://localhost:3002/api', - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] } +
aeolus::conductor::provider::account{"mock": provider => 'mock', type => 'mock', username => 'mockuser', password => 'mockpassword', - require => Aeolus::Conductor::Provider["mock"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Provider["mock"] }
aeolus::conductor::hwp{"small-x86_64": memory => "512", cpu => "1", storage => "", architecture => "x86_64", - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] }
- aeolus::conductor::logout{"admin": + aeolus::conductor::logout{$temp_admin_login : require => [Aeolus::Conductor::Provider['mock'], Aeolus::Conductor::Provider::Account['mock'], - Aeolus::Conductor::Hwp['small-x86_64']] } + Aeolus::Conductor::Hwp['small-x86_64']] + } + + aeolus::conductor::destroy_temp_admin{$temp_admin_login : + require => Aeolus::Conductor::Logout[$temp_admin_login]} + } diff --git a/recipes/aeolus/manifests/profiles/rhevm.pp b/recipes/aeolus/manifests/profiles/rhevm.pp index 547d7a9..8586944 100644 --- a/recipes/aeolus/manifests/profiles/rhevm.pp +++ b/recipes/aeolus/manifests/profiles/rhevm.pp @@ -13,6 +13,13 @@ # limitations under the License.
class aeolus::profiles::rhevm ($instances) { + + #we will use one random hex string to name the temporary admin user + $random = secure_random() + $temp_admin_login = "temporary-administrative-user-${random}" + #and another random hex string for the temp user's password + $temp_admin_password = secure_random() + create_resources2('aeolus::profiles::rhevm::instance', $instances)
file {"/etc/imagefactory/rhevm.json": @@ -24,26 +31,28 @@ class aeolus::profiles::rhevm ($instances) {
aeolus::create_bucket{"aeolus":}
- aeolus::conductor::site_admin{"admin": - email => 'root@localhost.localdomain', - password => "password", - first_name => 'Administrator', - last_name => ''} + aeolus::conductor::temp_admin{$temp_admin_login : + password => $temp_admin_password }
- aeolus::conductor::login{"admin": password => "password", - require => Aeolus::Conductor::Site_admin['admin']} + aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password, + require => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
aeolus::conductor::hwp{"small-x86_64": memory => "512", cpu => "1", storage => "", architecture => "x86_64", - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] }
- aeolus::conductor::logout{"admin": + aeolus::conductor::logout{$temp_admin_login: require => Aeolus::Conductor::Hwp['small-x86_64']}
- Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout["admin"] + Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout[$temp_admin_login] + + aeolus::conductor::destroy_temp_admin{$temp_admin_login : + require => Aeolus::Conductor::Logout[$temp_admin_login]} + # TODO: create a realm and mappings }
diff --git a/recipes/aeolus/manifests/profiles/rhevm/instance.pp b/recipes/aeolus/manifests/profiles/rhevm/instance.pp index 26ba3e9..195909d 100644 --- a/recipes/aeolus/manifests/profiles/rhevm/instance.pp +++ b/recipes/aeolus/manifests/profiles/rhevm/instance.pp @@ -43,5 +43,6 @@ define aeolus::profiles::rhevm::instance ( $nfs_server, deltacloud_driver => "rhevm", url => "http://localhost:3002/api", deltacloud_provider => "${deltacloud_api};${deltacloud_data_center}", - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] } } diff --git a/recipes/aeolus/manifests/profiles/vsphere.pp b/recipes/aeolus/manifests/profiles/vsphere.pp index dcca15b..db9955e 100644 --- a/recipes/aeolus/manifests/profiles/vsphere.pp +++ b/recipes/aeolus/manifests/profiles/vsphere.pp @@ -13,6 +13,13 @@ # limitations under the License.
class aeolus::profiles::vsphere ($instances) { + + #we will use one random hex string to name the temporary admin user + $random = secure_random() + $temp_admin_login = "temporary-administrative-user-${random}" + #and another random hex string for the temp user's password + $temp_admin_password = secure_random() + create_resources2('aeolus::profiles::vsphere::instance', $instances)
aeolus::create_bucket{"aeolus":} @@ -24,24 +31,25 @@ class aeolus::profiles::vsphere ($instances) { mode => 640, require => Package['aeolus-conductor-daemons'] }
- aeolus::conductor::site_admin{"admin": - email => 'root@localhost.localdomain', - password => "password", - first_name => 'Administrator', - last_name => ''} + aeolus::conductor::temp_admin{$temp_admin_login : + password => $temp_admin_password }
- aeolus::conductor::login{"admin": password => "password", - require => Aeolus::Conductor::Site_admin['admin']} + aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password, + require => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
aeolus::conductor::hwp{"small-x86_64": memory => "512", cpu => "1", storage => "", architecture => "x86_64", - require => Aeolus::Conductor::Login["admin"] } + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login] }
- aeolus::conductor::logout{"admin": + aeolus::conductor::logout{$temp_admin_login: require => Aeolus::Conductor::Hwp['small-x86_64'] }
- Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout["admin"] + Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout[$temp_admin_login] + + aeolus::conductor::destroy_temp_admin{$temp_admin_login : + require => Aeolus::Conductor::Logout[$temp_admin_login]} } diff --git a/recipes/aeolus/manifests/profiles/vsphere/instance.pp b/recipes/aeolus/manifests/profiles/vsphere/instance.pp index 55ac95f..39a3321 100644 --- a/recipes/aeolus/manifests/profiles/vsphere/instance.pp +++ b/recipes/aeolus/manifests/profiles/vsphere/instance.pp @@ -22,6 +22,7 @@ define aeolus::profiles::vsphere::instance ($deltacloud_provider, deltacloud_driver => "vsphere", url => "http://localhost:3002/api", deltacloud_provider => "$deltacloud_provider", - require => Aeolus::Conductor::Login["admin"], + admin_login => $temp_admin_login, + require => Aeolus::Conductor::Login[$temp_admin_login], } }
On Fri, Jun 01, 2012 at 03:28:45PM -0500, Steve Linabery wrote:
This patch series moves us away from using admin/password for web requests, and instead we create/destroy a temporary aeolus user with administrative privileges for each puppet run.
We also make a separate, optional profile, admin_configure, which can be used to create an aeolus user with administrative privileges. Note that this makes the default profile now set up no 'admin' user by default, addressing the re-creation of un/pw admin/password which was the root of the bug in BZ806001.
conf/admin_configure | 10 ++++ .../lib/puppet/parser/functions/secure_random.rb | 15 +++++ recipes/aeolus/manifests/conductor.pp | 55 +++++++++++++++----- recipes/aeolus/manifests/profiles/default.pp | 25 ++++++--- recipes/aeolus/manifests/profiles/ec2.pp | 47 +++++++++++------ recipes/aeolus/manifests/profiles/mock.pp | 36 +++++++++---- recipes/aeolus/manifests/profiles/rhevm.pp | 29 +++++++---- .../aeolus/manifests/profiles/rhevm/instance.pp | 3 +- recipes/aeolus/manifests/profiles/vsphere.pp | 28 ++++++---- .../aeolus/manifests/profiles/vsphere/instance.pp | 3 +- 10 files changed, 178 insertions(+), 73 deletions(-) create mode 100644 conf/admin_configure create mode 100644 recipes/aeolus/lib/puppet/parser/functions/secure_random.rb
diff --git a/conf/admin_configure b/conf/admin_configure new file mode 100644 index 0000000..00182c7 --- /dev/null +++ b/conf/admin_configure @@ -0,0 +1,10 @@ +parameters:
- enable_https: true
- admin_login: admin
- admin_password: password
- admin_email: root@localhost.localdomain
- admin_first_name: Administrator
- admin_last_name: ""
+classes: +- aeolus::conductor +- aeolus::conductor::default_admin diff --git a/recipes/aeolus/lib/puppet/parser/functions/secure_random.rb b/recipes/aeolus/lib/puppet/parser/functions/secure_random.rb new file mode 100644 index 0000000..9ea7ce2 --- /dev/null +++ b/recipes/aeolus/lib/puppet/parser/functions/secure_random.rb @@ -0,0 +1,15 @@ +require 'securerandom'
+Puppet::Parser::Functions::newfunction(:secure_random,
:type => :rvalue,
:doc => <<ENDDOC
+Return SecureRandom.hex using the first parameter as the +number of bytes desired, or 24 bytes by default. +ENDDOC +) do |args|
- if !args[0].nil? && (args[0].responds_to to_i)
- SecureRandom.hex(args[0])
- else
- SecureRandom.hex(24)
- end
+end diff --git a/recipes/aeolus/manifests/conductor.pp b/recipes/aeolus/manifests/conductor.pp index 786c658..670eb58 100644 --- a/recipes/aeolus/manifests/conductor.pp +++ b/recipes/aeolus/manifests/conductor.pp @@ -180,23 +180,50 @@ class aeolus::conductor::disabled { }
# Create a new site admin conductor web user -define aeolus::conductor::site_admin($email="", $password="", $first_name="", $last_name=""){ +class aeolus::conductor::default_admin { exec{"create_site_admin_user": cwd => '/usr/share/aeolus-conductor', environment => "RAILS_ENV=production",
command => "/usr/bin/rake dc:create_user[${name},${password},${email},${first_name},${last_name}]",
command => "/usr/bin/rake dc:create_user[${admin_login},${admin_password},${admin_email},${admin_first_name},${admin_last_name}]", logoutput => true,
unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) from users where login = '${name}';\"` = \"1\"",
exec{"grant_site_admin_privs": cwd => '/usr/share/aeolus-conductor', environment => "RAILS_ENV=production",unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) from roles, permissions, users where roles.id = permissions.role_id and users.id = permissions.user_id and roles.name = 'base.admin' and users.login = '${admin_login}'\"` = \"1\"", require => Rails::Seed::Db["seed_aeolus_database"]}
command => "/usr/bin/rake dc:site_admin[${name}]",
command => "/usr/bin/rake dc:site_admin[${admin_login}]", logoutput => true,
unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) FROM roles INNER JOIN permissions ON (roles.id = permissions.role_id) INNER JOIN users ON (permissions.user_id = users.id) where roles.name = 'base.admin' AND users.login = '${name}';\"` = \"1\"",
unless => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) FROM roles INNER JOIN permissions ON (roles.id = permissions.role_id) INNER JOIN users ON (permissions.user_id = users.id) where roles.name = 'base.admin' AND users.login = '${admin_login}';\"` = \"1\"", require => Exec[create_site_admin_user]}
}
+define aeolus::conductor::temp_admin($password=""){
- exec{"create_temp_admin":
cwd => '/usr/share/aeolus-conductor',
environment => "RAILS_ENV=production",
command => "/usr/bin/rake dc:create_user[${name},${password},'temp-admin@localhost.localdomain','temp','admin']",
logoutput => true,
require => Rails::Seed::Db["seed_aeolus_database"]}
- exec{"grant_temp_admin_privs":
cwd => '/usr/share/aeolus-conductor',
environment => "RAILS_ENV=production",
command => "/usr/bin/rake dc:site_admin[${name}]",
logoutput => true,
require => Exec[create_temp_admin]}
- }
+define aeolus::conductor::destroy_temp_admin{
- exec{"destroy_temp_admin":
- cwd => '/usr/share/aeolus-conductor',
- environment => "RAILS_ENV=production",
- command => "/usr/bin/rake dc:destroy_user[${name}]",
- logoutput => true,
- require => Rails::Seed::Db["seed_aeolus_database"]
- }
+}
# login to the aeolus conductor define aeolus::conductor::login($password){ web_request{ "$name-conductor-login": @@ -231,7 +258,7 @@ define aeolus::conductor::logout(){ }
# Create a new provider via the conductor -define aeolus::conductor::provider($deltacloud_driver="",$url="", $deltacloud_provider=""){ +define aeolus::conductor::provider($deltacloud_driver="",$url="", $deltacloud_provider="", $admin_login=""){ web_request{ "provider-$name": post => "https://localhost/conductor/providers", parameters => { 'provider[name]' => $name, 'provider[url]' => $url, @@ -240,17 +267,17 @@ define aeolus::conductor::provider($deltacloud_driver="",$url="", $deltacloud_pr returns => '200', follow => true, contains => "//img[@alt='Notices']", # in the case of an error, @alt='Warnings'
- use_cookies_at => '/tmp/aeolus-admin',
- use_cookies_at => "/tmp/aeolus-${admin_login}", log_to => '/tmp/configure-provider-request.log', only_log_errors => true, unless => { 'get' => 'https://localhost/conductor/providers', 'contains' => "//html/body//a[text() = '$name']" },
- require => [Service['aeolus-conductor'], Exec['grant_site_admin_privs'], Exec['deltacloud-core-startup-wait']]
- require => [Service['aeolus-conductor'], Exec['grant_temp_admin_privs'], Exec['deltacloud-core-startup-wait']] }
}
# Create a new provider account via the conductor -define aeolus::conductor::provider::account($provider="", $type="", $username="",$password="", $account_id="",$x509private="", $x509public=""){ +define aeolus::conductor::provider::account($provider="", $type="", $username="",$password="", $account_id="",$x509private="", $x509public="", $admin_login=""){ if $type != "ec2" { web_request{ "provider-account-$name": post => "https://localhost/conductor/providers/0/provider_accounts", @@ -264,7 +291,7 @@ define aeolus::conductor::provider::account($provider="", $type="", $username="" returns => '200', #contains => "//table/thead/tr/th[text() = 'Properties for $name']", follow => true,
use_cookies_at => '/tmp/aeolus-admin',
use_cookies_at => "/tmp/aeolus-${admin_login}", unless => { 'get' => 'https://localhost/conductor/provider_accounts', 'contains' => "//html/body//a[text() = '$name']" }, require => Service['aeolus-conductor']}
@@ -285,7 +312,7 @@ define aeolus::conductor::provider::account($provider="", $type="", $username="" returns => '200', #contains => "//table/thead/tr/th[text() = 'Properties for $name']", follow => true,
use_cookies_at => '/tmp/aeolus-admin',
use_cookies_at => "/tmp/aeolus-${admin_login}", unless => { 'get' => 'https://localhost/conductor/provider_accounts', 'contains' => "//html/body//a[text() = '$name']" }, require => Service['aeolus-conductor']
@@ -293,7 +320,7 @@ define aeolus::conductor::provider::account($provider="", $type="", $username="" } }
-define aeolus::conductor::hwp($memory='', $cpu='', $storage='', $architecture=''){ +define aeolus::conductor::hwp($memory='', $cpu='', $storage='', $architecture='', $admin_login=''){ web_request{ "hwp-$name": post => "https://localhost/conductor/hardware_profiles", parameters => {'hardware_profile[name]' => $name, @@ -313,7 +340,7 @@ define aeolus::conductor::hwp($memory='', $cpu='', $storage='', $architecture='' returns => '200', #verify => '.*Hardware profile added.*', follow => true,
- use_cookies_at => '/tmp/aeolus-admin',
- require => [Service['aeolus-conductor'], Exec['grant_site_admin_privs']]
- use_cookies_at => "/tmp/aeolus-${admin_login}",
- require => [Service['aeolus-conductor'], Exec['grant_temp_admin_privs']] }
} diff --git a/recipes/aeolus/manifests/profiles/default.pp b/recipes/aeolus/manifests/profiles/default.pp index 5bb3119..47e640d 100644 --- a/recipes/aeolus/manifests/profiles/default.pp +++ b/recipes/aeolus/manifests/profiles/default.pp @@ -14,25 +14,32 @@
class aeolus::profiles::default {
- #we will use one random hex string to name the temporary admin user
- $random = secure_random()
- $temp_admin_login = "temporary-administrative-user-${random}"
- #and another random hex string for the temp user's password
- $temp_admin_password = secure_random()
- aeolus::create_bucket{"aeolus":}
- aeolus::conductor::site_admin{"admin":
email => 'root@localhost.localdomain',
password => "password",
first_name => 'Administrator',
last_name => ''}
- aeolus::conductor::temp_admin{$temp_admin_login :
password => $temp_admin_password }
- aeolus::conductor::login{"admin": password => "password",
require => Aeolus::Conductor::Site_admin['admin']}
aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password,
require => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
aeolus::conductor::hwp{"small-x86_64": memory => "512", cpu => "1", storage => "", architecture => "x86_64",
require => Aeolus::Conductor::Login["admin"] }
admin_login => $temp_admin_login,
require => Aeolus::Conductor::Login[$temp_admin_login] }
- aeolus::conductor::logout{"admin":
aeolus::conductor::logout{$temp_admin_login: require => Aeolus::Conductor::Hwp['small-x86_64']}
aeolus::conductor::destroy_temp_admin{$temp_admin_login :
require => Aeolus::Conductor::Logout[$temp_admin_login]}
} diff --git a/recipes/aeolus/manifests/profiles/ec2.pp b/recipes/aeolus/manifests/profiles/ec2.pp index 3f63f70..165a32b 100644 --- a/recipes/aeolus/manifests/profiles/ec2.pp +++ b/recipes/aeolus/manifests/profiles/ec2.pp @@ -15,68 +15,83 @@ class aeolus::profiles::ec2 { include aeolus::deltacloud::ec2
- #we will use one random hex string to name the temporary admin user
- $random = secure_random()
- $temp_admin_login = "temporary-administrative-user-${random}"
- #and another random hex string for the temp user's password
- $temp_admin_password = secure_random()
- aeolus::create_bucket{"aeolus":}
- aeolus::conductor::site_admin{"admin":
email => 'root@localhost.localdomain',
password => "password",
first_name => 'Administrator',
last_name => ''}
- aeolus::conductor::temp_admin{$temp_admin_login :
password => $temp_admin_password }
- aeolus::conductor::login{"admin": password => "password",
require => Aeolus::Conductor::Site_admin['admin']}
aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password,
require => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
aeolus::conductor::provider{"ec2-us-east-1": deltacloud_driver => 'ec2', deltacloud_provider => 'us-east-1', url => 'http://localhost:3002/api',
require => Aeolus::Conductor::Login["admin"] }
admin_login => $temp_admin_login,
require => Aeolus::Conductor::Login[$temp_admin_login] }
aeolus::conductor::provider{"ec2-us-west-1": deltacloud_driver => 'ec2', deltacloud_provider => 'us-west-1', url => 'http://localhost:3002/api',
require => Aeolus::Conductor::Login["admin"] }
admin_login => $temp_admin_login,
require => Aeolus::Conductor::Login[$temp_admin_login] }
aeolus::conductor::provider{"ec2-us-west-2": deltacloud_driver => 'ec2', deltacloud_provider => 'us-west-2', url => 'http://localhost:3002/api',
require => Aeolus::Conductor::Login["admin"] }
admin_login => $temp_admin_login,
require => Aeolus::Conductor::Login[$temp_admin_login] }
aeolus::conductor::provider{"ec2-eu-west-1": deltacloud_driver => 'ec2', deltacloud_provider => 'eu-west-1', url => 'http://localhost:3002/api',
require => Aeolus::Conductor::Login["admin"] }
admin_login => $temp_admin_login,
require => Aeolus::Conductor::Login[$temp_admin_login] }
aeolus::conductor::provider{"ec2-ap-southeast-1": deltacloud_driver => 'ec2', deltacloud_provider => 'ap-southeast-1', url => 'http://localhost:3002/api',
require => Aeolus::Conductor::Login["admin"] }
admin_login => $temp_admin_login,
require => Aeolus::Conductor::Login[$temp_admin_login] }
aeolus::conductor::provider{"ec2-ap-northeast-1": deltacloud_driver => 'ec2', deltacloud_provider => 'ap-northeast-1', url => 'http://localhost:3002/api',
require => Aeolus::Conductor::Login["admin"] }
admin_login => $temp_admin_login,
require => Aeolus::Conductor::Login[$temp_admin_login] }
aeolus::conductor::provider{"ec2-sa-east-1": deltacloud_driver => 'ec2', deltacloud_provider => 'sa-east-1', url => 'http://localhost:3002/api',
require => Aeolus::Conductor::Login["admin"] }
admin_login => $temp_admin_login,
require => Aeolus::Conductor::Login[$temp_admin_login] }
aeolus::conductor::hwp{"small-x86_64": memory => "512", cpu => "1", storage => "", architecture => "x86_64",
require => Aeolus::Conductor::Login["admin"] }
admin_login => $temp_admin_login,
require => Aeolus::Conductor::Login[$temp_admin_login] }
Aeolus::Conductor::Provider <| |> -> Aeolus::Conductor::Logout <| |>
- aeolus::conductor::logout{"admin":
- aeolus::conductor::logout{$temp_admin_login: require => Aeolus::Conductor::Hwp['small-x86_64'] }
- aeolus::conductor::destroy_temp_admin{$temp_admin_login:
- require => Aeolus::Conductor::Logout[$temp_admin_login]}
} diff --git a/recipes/aeolus/manifests/profiles/mock.pp b/recipes/aeolus/manifests/profiles/mock.pp index c68829c..b82a6d4 100644 --- a/recipes/aeolus/manifests/profiles/mock.pp +++ b/recipes/aeolus/manifests/profiles/mock.pp @@ -14,38 +14,50 @@
class aeolus::profiles::mock {
- #we will use one random hex string to name the temporary admin user
- $random = secure_random()
- $temp_admin_login = "temporary-administrative-user-${random}"
- #and another random hex string for the temp user's password
- $temp_admin_password = secure_random()
- aeolus::create_bucket{"aeolus":}
- aeolus::conductor::site_admin{"admin":
email => 'root@localhost.localdomain',
password => "password",
first_name => 'Administrator',
last_name => ''}
- aeolus::conductor::temp_admin{$temp_admin_login :
password => $temp_admin_password }
- aeolus::conductor::login{"admin": password => "password",
require => Aeolus::Conductor::Site_admin['admin']}
aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password,
require => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
aeolus::conductor::provider{"mock": deltacloud_driver => 'mock', url => 'http://localhost:3002/api',
require => Aeolus::Conductor::Login["admin"] }
admin_login => $temp_admin_login,
require => Aeolus::Conductor::Login[$temp_admin_login] }
aeolus::conductor::provider::account{"mock": provider => 'mock', type => 'mock', username => 'mockuser', password => 'mockpassword',
require => Aeolus::Conductor::Provider["mock"] }
admin_login => $temp_admin_login,
require => Aeolus::Conductor::Provider["mock"] }
aeolus::conductor::hwp{"small-x86_64": memory => "512", cpu => "1", storage => "", architecture => "x86_64",
require => Aeolus::Conductor::Login["admin"] }
admin_login => $temp_admin_login,
require => Aeolus::Conductor::Login[$temp_admin_login] }
- aeolus::conductor::logout{"admin":
- aeolus::conductor::logout{$temp_admin_login : require => [Aeolus::Conductor::Provider['mock'], Aeolus::Conductor::Provider::Account['mock'],
Aeolus::Conductor::Hwp['small-x86_64']] }
Aeolus::Conductor::Hwp['small-x86_64']]
- }
- aeolus::conductor::destroy_temp_admin{$temp_admin_login :
- require => Aeolus::Conductor::Logout[$temp_admin_login]}
} diff --git a/recipes/aeolus/manifests/profiles/rhevm.pp b/recipes/aeolus/manifests/profiles/rhevm.pp index 547d7a9..8586944 100644 --- a/recipes/aeolus/manifests/profiles/rhevm.pp +++ b/recipes/aeolus/manifests/profiles/rhevm.pp @@ -13,6 +13,13 @@ # limitations under the License.
class aeolus::profiles::rhevm ($instances) {
#we will use one random hex string to name the temporary admin user
$random = secure_random()
$temp_admin_login = "temporary-administrative-user-${random}"
#and another random hex string for the temp user's password
$temp_admin_password = secure_random()
create_resources2('aeolus::profiles::rhevm::instance', $instances)
file {"/etc/imagefactory/rhevm.json":
@@ -24,26 +31,28 @@ class aeolus::profiles::rhevm ($instances) {
aeolus::create_bucket{"aeolus":}
- aeolus::conductor::site_admin{"admin":
email => 'root@localhost.localdomain',
password => "password",
first_name => 'Administrator',
last_name => ''}
- aeolus::conductor::temp_admin{$temp_admin_login :
password => $temp_admin_password }
- aeolus::conductor::login{"admin": password => "password",
require => Aeolus::Conductor::Site_admin['admin']}
aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password,
require => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
aeolus::conductor::hwp{"small-x86_64": memory => "512", cpu => "1", storage => "", architecture => "x86_64",
require => Aeolus::Conductor::Login["admin"] }
admin_login => $temp_admin_login,
require => Aeolus::Conductor::Login[$temp_admin_login] }
- aeolus::conductor::logout{"admin":
- aeolus::conductor::logout{$temp_admin_login: require => Aeolus::Conductor::Hwp['small-x86_64']}
- Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout["admin"]
- Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout[$temp_admin_login]
- aeolus::conductor::destroy_temp_admin{$temp_admin_login :
- require => Aeolus::Conductor::Logout[$temp_admin_login]}
- # TODO: create a realm and mappings
}
diff --git a/recipes/aeolus/manifests/profiles/rhevm/instance.pp b/recipes/aeolus/manifests/profiles/rhevm/instance.pp index 26ba3e9..195909d 100644 --- a/recipes/aeolus/manifests/profiles/rhevm/instance.pp +++ b/recipes/aeolus/manifests/profiles/rhevm/instance.pp @@ -43,5 +43,6 @@ define aeolus::profiles::rhevm::instance ( $nfs_server, deltacloud_driver => "rhevm", url => "http://localhost:3002/api", deltacloud_provider => "${deltacloud_api};${deltacloud_data_center}",
- require => Aeolus::Conductor::Login["admin"] }
- admin_login => $temp_admin_login,
- require => Aeolus::Conductor::Login[$temp_admin_login] }
} diff --git a/recipes/aeolus/manifests/profiles/vsphere.pp b/recipes/aeolus/manifests/profiles/vsphere.pp index dcca15b..db9955e 100644 --- a/recipes/aeolus/manifests/profiles/vsphere.pp +++ b/recipes/aeolus/manifests/profiles/vsphere.pp @@ -13,6 +13,13 @@ # limitations under the License.
class aeolus::profiles::vsphere ($instances) {
#we will use one random hex string to name the temporary admin user
$random = secure_random()
$temp_admin_login = "temporary-administrative-user-${random}"
#and another random hex string for the temp user's password
$temp_admin_password = secure_random()
create_resources2('aeolus::profiles::vsphere::instance', $instances)
aeolus::create_bucket{"aeolus":}
@@ -24,24 +31,25 @@ class aeolus::profiles::vsphere ($instances) { mode => 640, require => Package['aeolus-conductor-daemons'] }
- aeolus::conductor::site_admin{"admin":
email => 'root@localhost.localdomain',
password => "password",
first_name => 'Administrator',
last_name => ''}
- aeolus::conductor::temp_admin{$temp_admin_login :
password => $temp_admin_password }
- aeolus::conductor::login{"admin": password => "password",
require => Aeolus::Conductor::Site_admin['admin']}
aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password,
require => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
aeolus::conductor::hwp{"small-x86_64": memory => "512", cpu => "1", storage => "", architecture => "x86_64",
require => Aeolus::Conductor::Login["admin"] }
admin_login => $temp_admin_login,
require => Aeolus::Conductor::Login[$temp_admin_login] }
- aeolus::conductor::logout{"admin":
- aeolus::conductor::logout{$temp_admin_login: require => Aeolus::Conductor::Hwp['small-x86_64'] }
- Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout["admin"]
- Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout[$temp_admin_login]
- aeolus::conductor::destroy_temp_admin{$temp_admin_login :
- require => Aeolus::Conductor::Logout[$temp_admin_login]}
} diff --git a/recipes/aeolus/manifests/profiles/vsphere/instance.pp b/recipes/aeolus/manifests/profiles/vsphere/instance.pp index 55ac95f..39a3321 100644 --- a/recipes/aeolus/manifests/profiles/vsphere/instance.pp +++ b/recipes/aeolus/manifests/profiles/vsphere/instance.pp @@ -22,6 +22,7 @@ define aeolus::profiles::vsphere::instance ($deltacloud_provider, deltacloud_driver => "vsphere", url => "http://localhost:3002/api", deltacloud_provider => "$deltacloud_provider",
require => Aeolus::Conductor::Login["admin"],
admin_login => $temp_admin_login,
}require => Aeolus::Conductor::Login[$temp_admin_login],
}
1.7.6.5
brilliant, sent wrong patch. please disregard.
s|e
aeolus-devel@lists.fedorahosted.org