[PATCH aeolus-configure] BZ 806001 aeolus-configure will always create an admin user, need to key of a uuid not name

Steve Linabery slinaber at redhat.com
Fri Jun 1 20:36:32 UTC 2012


On Fri, Jun 01, 2012 at 03:28:45PM -0500, Steve Linabery wrote:
> This patch series moves us away from using admin/password for web
> requests, and instead we create/destroy a temporary aeolus user with
> administrative privileges for each puppet run.
> 
> We also make a separate, optional profile, admin_configure, which
> can be used to create an aeolus user with administrative privileges.
> Note that this makes the default profile now set up no 'admin' user
> by default, addressing the re-creation of un/pw admin/password which
> was the root of the bug in BZ806001.
> ---
>  conf/admin_configure                               |   10 ++++
>  .../lib/puppet/parser/functions/secure_random.rb   |   15 +++++
>  recipes/aeolus/manifests/conductor.pp              |   55 +++++++++++++++-----
>  recipes/aeolus/manifests/profiles/default.pp       |   25 ++++++---
>  recipes/aeolus/manifests/profiles/ec2.pp           |   47 +++++++++++------
>  recipes/aeolus/manifests/profiles/mock.pp          |   36 +++++++++----
>  recipes/aeolus/manifests/profiles/rhevm.pp         |   29 +++++++----
>  .../aeolus/manifests/profiles/rhevm/instance.pp    |    3 +-
>  recipes/aeolus/manifests/profiles/vsphere.pp       |   28 ++++++----
>  .../aeolus/manifests/profiles/vsphere/instance.pp  |    3 +-
>  10 files changed, 178 insertions(+), 73 deletions(-)
>  create mode 100644 conf/admin_configure
>  create mode 100644 recipes/aeolus/lib/puppet/parser/functions/secure_random.rb
> 
> diff --git a/conf/admin_configure b/conf/admin_configure
> new file mode 100644
> index 0000000..00182c7
> --- /dev/null
> +++ b/conf/admin_configure
> @@ -0,0 +1,10 @@
> +parameters:
> +  enable_https: true
> +  admin_login: admin
> +  admin_password: password
> +  admin_email: root at localhost.localdomain
> +  admin_first_name: Administrator
> +  admin_last_name: ""
> +classes:
> +- aeolus::conductor
> +- aeolus::conductor::default_admin
> diff --git a/recipes/aeolus/lib/puppet/parser/functions/secure_random.rb b/recipes/aeolus/lib/puppet/parser/functions/secure_random.rb
> new file mode 100644
> index 0000000..9ea7ce2
> --- /dev/null
> +++ b/recipes/aeolus/lib/puppet/parser/functions/secure_random.rb
> @@ -0,0 +1,15 @@
> +require 'securerandom'
> +
> +Puppet::Parser::Functions::newfunction(:secure_random,
> +                                       :type => :rvalue,
> +                                       :doc => <<ENDDOC
> +Return SecureRandom.hex using the first parameter as the
> +number of bytes desired, or 24 bytes by default.
> +ENDDOC
> +) do |args|
> +  if !args[0].nil? && (args[0].responds_to to_i)
> +    SecureRandom.hex(args[0])
> +  else
> +    SecureRandom.hex(24)
> +  end
> +end
> diff --git a/recipes/aeolus/manifests/conductor.pp b/recipes/aeolus/manifests/conductor.pp
> index 786c658..670eb58 100644
> --- a/recipes/aeolus/manifests/conductor.pp
> +++ b/recipes/aeolus/manifests/conductor.pp
> @@ -180,23 +180,50 @@ class aeolus::conductor::disabled {
>  }
>  
>  # Create a new site admin conductor web user
> -define aeolus::conductor::site_admin($email="", $password="", $first_name="", $last_name=""){
> +class aeolus::conductor::default_admin {
>    exec{"create_site_admin_user":
>           cwd         => '/usr/share/aeolus-conductor',
>           environment => "RAILS_ENV=production",
> -         command     => "/usr/bin/rake dc:create_user[${name},${password},${email},${first_name},${last_name}]",
> +         command     => "/usr/bin/rake dc:create_user[${admin_login},${admin_password},${admin_email},${admin_first_name},${admin_last_name}]",
>           logoutput   => true,
> -         unless      => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) from users where login = '${name}';\"` = \"1\"",
> +         unless      => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) from roles, permissions, users where roles.id = permissions.role_id and users.id = permissions.user_id and roles.name = 'base.admin' and users.login = '${admin_login}'\"` = \"1\"",
>           require     => Rails::Seed::Db["seed_aeolus_database"]}
>    exec{"grant_site_admin_privs":
>           cwd         => '/usr/share/aeolus-conductor',
>           environment => "RAILS_ENV=production",
> -         command     => "/usr/bin/rake dc:site_admin[${name}]",
> +         command     => "/usr/bin/rake dc:site_admin[${admin_login}]",
>           logoutput   => true,
> -         unless      => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) FROM roles INNER JOIN permissions ON (roles.id = permissions.role_id) INNER JOIN users ON (permissions.user_id = users.id) where roles.name = 'base.admin' AND users.login = '${name}';\"` = \"1\"",
> +         unless      => "/usr/bin/test `psql conductor aeolus -P tuples_only -c \"select count(*) FROM roles INNER JOIN permissions ON (roles.id = permissions.role_id) INNER JOIN users ON (permissions.user_id = users.id) where roles.name = 'base.admin' AND users.login = '${admin_login}';\"` = \"1\"",
>           require     => Exec[create_site_admin_user]}
>  }
>  
> +define aeolus::conductor::temp_admin($password=""){
> +    exec{"create_temp_admin":
> +      cwd         => '/usr/share/aeolus-conductor',
> +      environment => "RAILS_ENV=production",
> +      command     => "/usr/bin/rake dc:create_user[${name},${password},'temp-admin at localhost.localdomain','temp','admin']",
> +      logoutput   => true,
> +      require     => Rails::Seed::Db["seed_aeolus_database"]}
> +    exec{"grant_temp_admin_privs":
> +      cwd         => '/usr/share/aeolus-conductor',
> +      environment => "RAILS_ENV=production",
> +      command     => "/usr/bin/rake dc:site_admin[${name}]",
> +      logoutput   => true,
> +      require     => Exec[create_temp_admin]}
> +  }
> +
> +
> +define aeolus::conductor::destroy_temp_admin{
> +  exec{"destroy_temp_admin":
> +    cwd         => '/usr/share/aeolus-conductor',
> +    environment => "RAILS_ENV=production",
> +    command     => "/usr/bin/rake dc:destroy_user[${name}]",
> +    logoutput   => true,
> +    require     => Rails::Seed::Db["seed_aeolus_database"]
> +  }
> +}
> +
> +
>  # login to the aeolus conductor
>  define aeolus::conductor::login($password){
>    web_request{ "$name-conductor-login":
> @@ -231,7 +258,7 @@ define aeolus::conductor::logout(){
>  }
>  
>  # Create a new provider via the conductor
> -define aeolus::conductor::provider($deltacloud_driver="",$url="", $deltacloud_provider=""){
> +define aeolus::conductor::provider($deltacloud_driver="",$url="", $deltacloud_provider="", $admin_login=""){
>    web_request{ "provider-$name":
>      post         => "https://localhost/conductor/providers",
>      parameters  => { 'provider[name]'  => $name, 'provider[url]'   => $url,
> @@ -240,17 +267,17 @@ define aeolus::conductor::provider($deltacloud_driver="",$url="", $deltacloud_pr
>      returns     => '200',
>      follow      => true,
>      contains    => "//img[@alt='Notices']", # in the case of an error, @alt='Warnings'
> -    use_cookies_at => '/tmp/aeolus-admin',
> +    use_cookies_at => "/tmp/aeolus-${admin_login}",
>      log_to      => '/tmp/configure-provider-request.log',
>      only_log_errors => true,
>      unless      => { 'get'             => 'https://localhost/conductor/providers',
>                       'contains'        => "//html/body//a[text() = '$name']" },
> -    require    => [Service['aeolus-conductor'], Exec['grant_site_admin_privs'], Exec['deltacloud-core-startup-wait']]
> +    require    => [Service['aeolus-conductor'], Exec['grant_temp_admin_privs'], Exec['deltacloud-core-startup-wait']]
>    }
>  }
>  
>  # Create a new provider account via the conductor
> -define aeolus::conductor::provider::account($provider="", $type="", $username="",$password="", $account_id="",$x509private="", $x509public=""){
> +define aeolus::conductor::provider::account($provider="", $type="", $username="",$password="", $account_id="",$x509private="", $x509public="", $admin_login=""){
>    if $type != "ec2" {
>      web_request{ "provider-account-$name":
>        post         => "https://localhost/conductor/providers/0/provider_accounts",
> @@ -264,7 +291,7 @@ define aeolus::conductor::provider::account($provider="", $type="", $username=""
>        returns     => '200',
>        #contains    => "//table/thead/tr/th[text() = 'Properties for $name']",
>        follow      => true,
> -      use_cookies_at => '/tmp/aeolus-admin',
> +      use_cookies_at => "/tmp/aeolus-${admin_login}",
>        unless      => { 'get'             => 'https://localhost/conductor/provider_accounts',
>                         'contains'        => "//html/body//a[text() = '$name']" },
>        require    => Service['aeolus-conductor']}
> @@ -285,7 +312,7 @@ define aeolus::conductor::provider::account($provider="", $type="", $username=""
>        returns     => '200',
>        #contains    => "//table/thead/tr/th[text() = 'Properties for $name']",
>        follow      => true,
> -      use_cookies_at => '/tmp/aeolus-admin',
> +      use_cookies_at => "/tmp/aeolus-${admin_login}",
>        unless      => { 'get'             => 'https://localhost/conductor/provider_accounts',
>                         'contains'        => "//html/body//a[text() = '$name']" },
>        require    => Service['aeolus-conductor']
> @@ -293,7 +320,7 @@ define aeolus::conductor::provider::account($provider="", $type="", $username=""
>    }
>  }
>  
> -define aeolus::conductor::hwp($memory='', $cpu='', $storage='', $architecture=''){
> +define aeolus::conductor::hwp($memory='', $cpu='', $storage='', $architecture='', $admin_login=''){
>    web_request{ "hwp-$name":
>      post         => "https://localhost/conductor/hardware_profiles",
>      parameters  => {'hardware_profile[name]'  => $name,
> @@ -313,7 +340,7 @@ define aeolus::conductor::hwp($memory='', $cpu='', $storage='', $architecture=''
>      returns     => '200',
>      #verify      => '.*Hardware profile added.*',
>      follow      => true,
> -    use_cookies_at => '/tmp/aeolus-admin',
> -    require    => [Service['aeolus-conductor'], Exec['grant_site_admin_privs']]
> +    use_cookies_at => "/tmp/aeolus-${admin_login}",
> +    require    => [Service['aeolus-conductor'], Exec['grant_temp_admin_privs']]
>    }
>  }
> diff --git a/recipes/aeolus/manifests/profiles/default.pp b/recipes/aeolus/manifests/profiles/default.pp
> index 5bb3119..47e640d 100644
> --- a/recipes/aeolus/manifests/profiles/default.pp
> +++ b/recipes/aeolus/manifests/profiles/default.pp
> @@ -14,25 +14,32 @@
>  
>  class aeolus::profiles::default {
>  
> +  #we will use one random hex string to name the temporary admin user
> +  $random = secure_random()
> +  $temp_admin_login = "temporary-administrative-user-${random}"
> +  #and another random hex string for the temp user's password
> +  $temp_admin_password = secure_random()
> +
>    aeolus::create_bucket{"aeolus":}
>  
> -  aeolus::conductor::site_admin{"admin":
> -     email           => 'root at localhost.localdomain',
> -     password        => "password",
> -     first_name      => 'Administrator',
> -     last_name       => ''}
> +  aeolus::conductor::temp_admin{$temp_admin_login :
> +     password        => $temp_admin_password }
>  
> -  aeolus::conductor::login{"admin": password => "password",
> -     require  => Aeolus::Conductor::Site_admin['admin']}
> +  aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password,
> +     require  => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
>  
>    aeolus::conductor::hwp{"small-x86_64":
>        memory         => "512",
>        cpu            => "1",
>        storage        => "",
>        architecture   => "x86_64",
> -      require        => Aeolus::Conductor::Login["admin"] }
> +      admin_login    => $temp_admin_login,
> +      require        => Aeolus::Conductor::Login[$temp_admin_login] }
>  
> -  aeolus::conductor::logout{"admin":
> +  aeolus::conductor::logout{$temp_admin_login:
>      require    => Aeolus::Conductor::Hwp['small-x86_64']}
>  
> +  aeolus::conductor::destroy_temp_admin{$temp_admin_login :
> +    require => Aeolus::Conductor::Logout[$temp_admin_login]}
> +
>  }
> diff --git a/recipes/aeolus/manifests/profiles/ec2.pp b/recipes/aeolus/manifests/profiles/ec2.pp
> index 3f63f70..165a32b 100644
> --- a/recipes/aeolus/manifests/profiles/ec2.pp
> +++ b/recipes/aeolus/manifests/profiles/ec2.pp
> @@ -15,68 +15,83 @@
>  class aeolus::profiles::ec2 {
>    include aeolus::deltacloud::ec2
>  
> +  #we will use one random hex string to name the temporary admin user
> +  $random = secure_random()
> +  $temp_admin_login = "temporary-administrative-user-${random}"
> +  #and another random hex string for the temp user's password
> +  $temp_admin_password = secure_random()
> +
>    aeolus::create_bucket{"aeolus":}
>  
> -  aeolus::conductor::site_admin{"admin":
> -     email           => 'root at localhost.localdomain',
> -     password        => "password",
> -     first_name      => 'Administrator',
> -     last_name       => ''}
> +  aeolus::conductor::temp_admin{$temp_admin_login :
> +     password        => $temp_admin_password }
>  
> -  aeolus::conductor::login{"admin": password => "password",
> -     require  => Aeolus::Conductor::Site_admin['admin']}
> +  aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password,
> +     require  => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
>  
>    aeolus::conductor::provider{"ec2-us-east-1":
>        deltacloud_driver         => 'ec2',
>        deltacloud_provider       => 'us-east-1',
>        url                       => 'http://localhost:3002/api',
> -      require        => Aeolus::Conductor::Login["admin"] }
> +      admin_login               => $temp_admin_login,
> +      require        => Aeolus::Conductor::Login[$temp_admin_login] }
>  
>    aeolus::conductor::provider{"ec2-us-west-1":
>        deltacloud_driver         => 'ec2',
>        deltacloud_provider       => 'us-west-1',
>        url                       => 'http://localhost:3002/api',
> -      require        => Aeolus::Conductor::Login["admin"] }
> +      admin_login               => $temp_admin_login,
> +      require        => Aeolus::Conductor::Login[$temp_admin_login] }
>  
>    aeolus::conductor::provider{"ec2-us-west-2":
>        deltacloud_driver         => 'ec2',
>        deltacloud_provider       => 'us-west-2',
>        url                       => 'http://localhost:3002/api',
> -      require        => Aeolus::Conductor::Login["admin"] }
> +      admin_login               => $temp_admin_login,
> +      require        => Aeolus::Conductor::Login[$temp_admin_login] }
>  
>    aeolus::conductor::provider{"ec2-eu-west-1":
>        deltacloud_driver         => 'ec2',
>        deltacloud_provider       => 'eu-west-1',
>        url                       => 'http://localhost:3002/api',
> -      require        => Aeolus::Conductor::Login["admin"] }
> +      admin_login               => $temp_admin_login,
> +      require        => Aeolus::Conductor::Login[$temp_admin_login] }
>  
>    aeolus::conductor::provider{"ec2-ap-southeast-1":
>        deltacloud_driver		=> 'ec2',
>        deltacloud_provider	=> 'ap-southeast-1',
>        url			=> 'http://localhost:3002/api',
> -      require        => Aeolus::Conductor::Login["admin"] }
> +      admin_login               => $temp_admin_login,
> +      require        => Aeolus::Conductor::Login[$temp_admin_login] }
>  
>    aeolus::conductor::provider{"ec2-ap-northeast-1":
>        deltacloud_driver         => 'ec2',
>        deltacloud_provider       => 'ap-northeast-1',
>        url                       => 'http://localhost:3002/api',
> -      require        => Aeolus::Conductor::Login["admin"] }
> +      admin_login               => $temp_admin_login,
> +      require        => Aeolus::Conductor::Login[$temp_admin_login] }
>  
>    aeolus::conductor::provider{"ec2-sa-east-1":
>        deltacloud_driver         => 'ec2',
>        deltacloud_provider       => 'sa-east-1',
>        url                       => 'http://localhost:3002/api',
> -      require        => Aeolus::Conductor::Login["admin"] }
> +      admin_login               => $temp_admin_login,
> +      require        => Aeolus::Conductor::Login[$temp_admin_login] }
>  
>    aeolus::conductor::hwp{"small-x86_64":
>        memory         => "512",
>        cpu            => "1",
>        storage        => "",
>        architecture   => "x86_64",
> -      require        => Aeolus::Conductor::Login["admin"] }
> +      admin_login    => $temp_admin_login,
> +      require        => Aeolus::Conductor::Login[$temp_admin_login] }
>  
>    Aeolus::Conductor::Provider <| |> -> Aeolus::Conductor::Logout <| |>
>  
> -  aeolus::conductor::logout{"admin":
> +  aeolus::conductor::logout{$temp_admin_login:
>      require    => Aeolus::Conductor::Hwp['small-x86_64'] }
> +
> +  aeolus::conductor::destroy_temp_admin{$temp_admin_login:
> +    require => Aeolus::Conductor::Logout[$temp_admin_login]}
> +
>  }
> diff --git a/recipes/aeolus/manifests/profiles/mock.pp b/recipes/aeolus/manifests/profiles/mock.pp
> index c68829c..b82a6d4 100644
> --- a/recipes/aeolus/manifests/profiles/mock.pp
> +++ b/recipes/aeolus/manifests/profiles/mock.pp
> @@ -14,38 +14,50 @@
>  
>  class aeolus::profiles::mock {
>  
> +  #we will use one random hex string to name the temporary admin user
> +  $random = secure_random()
> +  $temp_admin_login = "temporary-administrative-user-${random}"
> +  #and another random hex string for the temp user's password
> +  $temp_admin_password = secure_random()
> +
>    aeolus::create_bucket{"aeolus":}
>  
> -  aeolus::conductor::site_admin{"admin":
> -     email           => 'root at localhost.localdomain',
> -     password        => "password",
> -     first_name      => 'Administrator',
> -     last_name       => ''}
> +  aeolus::conductor::temp_admin{$temp_admin_login :
> +     password        => $temp_admin_password }
>  
> -  aeolus::conductor::login{"admin": password => "password",
> -     require  => Aeolus::Conductor::Site_admin['admin']}
> +  aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password,
> +     require  => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
>  
>    aeolus::conductor::provider{"mock":
>        deltacloud_driver  => 'mock',
>        url                => 'http://localhost:3002/api',
> -      require            => Aeolus::Conductor::Login["admin"] }
> +      admin_login        => $temp_admin_login,
> +      require            => Aeolus::Conductor::Login[$temp_admin_login] }
> +
>  
>    aeolus::conductor::provider::account{"mock":
>        provider           => 'mock',
>        type               => 'mock',
>        username           => 'mockuser',
>        password           => 'mockpassword',
> -      require        => Aeolus::Conductor::Provider["mock"] }
> +      admin_login        => $temp_admin_login,
> +      require            => Aeolus::Conductor::Provider["mock"] }
>  
>    aeolus::conductor::hwp{"small-x86_64":
>        memory         => "512",
>        cpu            => "1",
>        storage        => "",
>        architecture   => "x86_64",
> -      require        => Aeolus::Conductor::Login["admin"] }
> +      admin_login    => $temp_admin_login,
> +      require        => Aeolus::Conductor::Login[$temp_admin_login] }
>  
> -  aeolus::conductor::logout{"admin":
> +  aeolus::conductor::logout{$temp_admin_login :
>      require    => [Aeolus::Conductor::Provider['mock'],
>                     Aeolus::Conductor::Provider::Account['mock'],
> -                   Aeolus::Conductor::Hwp['small-x86_64']] }
> +                   Aeolus::Conductor::Hwp['small-x86_64']]
> +  }
> +
> +  aeolus::conductor::destroy_temp_admin{$temp_admin_login :
> +    require => Aeolus::Conductor::Logout[$temp_admin_login]}
> +
>  }
> diff --git a/recipes/aeolus/manifests/profiles/rhevm.pp b/recipes/aeolus/manifests/profiles/rhevm.pp
> index 547d7a9..8586944 100644
> --- a/recipes/aeolus/manifests/profiles/rhevm.pp
> +++ b/recipes/aeolus/manifests/profiles/rhevm.pp
> @@ -13,6 +13,13 @@
>  #   limitations under the License.
>  
>  class aeolus::profiles::rhevm ($instances) {
> +
> +  #we will use one random hex string to name the temporary admin user
> +  $random = secure_random()
> +  $temp_admin_login = "temporary-administrative-user-${random}"
> +  #and another random hex string for the temp user's password
> +  $temp_admin_password = secure_random()
> +
>    create_resources2('aeolus::profiles::rhevm::instance', $instances)
>  
>    file {"/etc/imagefactory/rhevm.json":
> @@ -24,26 +31,28 @@ class aeolus::profiles::rhevm ($instances) {
>  
>    aeolus::create_bucket{"aeolus":}
>  
> -  aeolus::conductor::site_admin{"admin":
> -     email           => 'root at localhost.localdomain',
> -     password        => "password",
> -     first_name      => 'Administrator',
> -     last_name       => ''}
> +  aeolus::conductor::temp_admin{$temp_admin_login :
> +     password        => $temp_admin_password }
>  
> -  aeolus::conductor::login{"admin": password => "password",
> -     require  => Aeolus::Conductor::Site_admin['admin']}
> +  aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password,
> +     require  => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
>  
>    aeolus::conductor::hwp{"small-x86_64":
>        memory         => "512",
>        cpu            => "1",
>        storage        => "",
>        architecture   => "x86_64",
> -      require        => Aeolus::Conductor::Login["admin"] }
> +      admin_login    => $temp_admin_login,
> +      require        => Aeolus::Conductor::Login[$temp_admin_login] }
>  
> -  aeolus::conductor::logout{"admin":
> +  aeolus::conductor::logout{$temp_admin_login:
>      require    => Aeolus::Conductor::Hwp['small-x86_64']}
>  
> -  Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout["admin"]
> +  Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout[$temp_admin_login]
> +
> +  aeolus::conductor::destroy_temp_admin{$temp_admin_login :
> +    require => Aeolus::Conductor::Logout[$temp_admin_login]}
> +
>    # TODO: create a realm and mappings
>  }
>  
> diff --git a/recipes/aeolus/manifests/profiles/rhevm/instance.pp b/recipes/aeolus/manifests/profiles/rhevm/instance.pp
> index 26ba3e9..195909d 100644
> --- a/recipes/aeolus/manifests/profiles/rhevm/instance.pp
> +++ b/recipes/aeolus/manifests/profiles/rhevm/instance.pp
> @@ -43,5 +43,6 @@ define aeolus::profiles::rhevm::instance ( $nfs_server,
>      deltacloud_driver   => "rhevm",
>      url                 => "http://localhost:3002/api",
>      deltacloud_provider => "${deltacloud_api};${deltacloud_data_center}",
> -    require             => Aeolus::Conductor::Login["admin"] }
> +    admin_login         => $temp_admin_login,
> +    require             => Aeolus::Conductor::Login[$temp_admin_login] }
>  }
> diff --git a/recipes/aeolus/manifests/profiles/vsphere.pp b/recipes/aeolus/manifests/profiles/vsphere.pp
> index dcca15b..db9955e 100644
> --- a/recipes/aeolus/manifests/profiles/vsphere.pp
> +++ b/recipes/aeolus/manifests/profiles/vsphere.pp
> @@ -13,6 +13,13 @@
>  #   limitations under the License.
>  
>  class aeolus::profiles::vsphere ($instances) {
> +
> +  #we will use one random hex string to name the temporary admin user
> +  $random = secure_random()
> +  $temp_admin_login = "temporary-administrative-user-${random}"
> +  #and another random hex string for the temp user's password
> +  $temp_admin_password = secure_random()
> +
>    create_resources2('aeolus::profiles::vsphere::instance', $instances)
>  
>    aeolus::create_bucket{"aeolus":}
> @@ -24,24 +31,25 @@ class aeolus::profiles::vsphere ($instances) {
>      mode => 640,
>      require => Package['aeolus-conductor-daemons'] }
>  
> -  aeolus::conductor::site_admin{"admin":
> -     email           => 'root at localhost.localdomain',
> -     password        => "password",
> -     first_name      => 'Administrator',
> -     last_name       => ''}
> +  aeolus::conductor::temp_admin{$temp_admin_login :
> +     password        => $temp_admin_password }
>  
> -  aeolus::conductor::login{"admin": password => "password",
> -     require  => Aeolus::Conductor::Site_admin['admin']}
> +  aeolus::conductor::login{$temp_admin_login : password => $temp_admin_password,
> +     require  => Aeolus::Conductor::Temp_admin[$temp_admin_login]}
>  
>    aeolus::conductor::hwp{"small-x86_64":
>        memory         => "512",
>        cpu            => "1",
>        storage        => "",
>        architecture   => "x86_64",
> -      require        => Aeolus::Conductor::Login["admin"] }
> +      admin_login    => $temp_admin_login,
> +      require        => Aeolus::Conductor::Login[$temp_admin_login] }
>  
> -  aeolus::conductor::logout{"admin":
> +  aeolus::conductor::logout{$temp_admin_login:
>      require    => Aeolus::Conductor::Hwp['small-x86_64'] }
>  
> -  Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout["admin"]
> +  Aeolus::Conductor::Provider<| |> -> Aeolus::Conductor::Logout[$temp_admin_login]
> +
> +  aeolus::conductor::destroy_temp_admin{$temp_admin_login :
> +    require => Aeolus::Conductor::Logout[$temp_admin_login]}
>  }
> diff --git a/recipes/aeolus/manifests/profiles/vsphere/instance.pp b/recipes/aeolus/manifests/profiles/vsphere/instance.pp
> index 55ac95f..39a3321 100644
> --- a/recipes/aeolus/manifests/profiles/vsphere/instance.pp
> +++ b/recipes/aeolus/manifests/profiles/vsphere/instance.pp
> @@ -22,6 +22,7 @@ define aeolus::profiles::vsphere::instance ($deltacloud_provider,
>        deltacloud_driver   => "vsphere",
>        url                 => "http://localhost:3002/api",
>        deltacloud_provider => "$deltacloud_provider",
> -      require             => Aeolus::Conductor::Login["admin"],
> +      admin_login         => $temp_admin_login,
> +      require             => Aeolus::Conductor::Login[$temp_admin_login],
>      }
>  }
> -- 
> 1.7.6.5
> 

brilliant, sent wrong patch. please disregard.

s|e



More information about the aeolus-devel mailing list