Differential D2669
Avoid to share credentials between dev and prod Docker engines Authored by DorianWinty on Apr 15 2022, 11:52. Tags None Referenced Files
Subscribers None
Details The same Vault policy was applied for all Docker engines. As plan is to repurpose Dwellers as a development Docker engine, As we don't currently have well defined environments, to assign This is a follow-up for af9db00760be. salt dwellers credentials.get_password nasqueron.etherpad.api should fail.
Diff Detail
Event TimelineComment Actions Complector $ cd /opt/salt/nasqueron-operations $ git fetch --all * [new branch] docker-vault-policies -> datacube/docker-vault-policies $ git checkout docker-vault-policies $ salt-call --local state.sls roles/vault/policies local: Data failed to compile: ---------- Rendering SLS 'base:roles/vault/policies' failed: Jinja variable 'salt.utils.templates.AliasedLoader object' has no attribute 'credentials.build_policies_by_node' $ salt-call --local saltutil.sync_all [...] modules: - modules.credentials [...] $ salt-call --local state.sls roles/vault/policies [...] ---------- ID: salt-node-docker-001 Function: vault.policy_present Result: True Comment: Policy exists, and has the correct content Started: 12:17:12.080163 Duration: 14.678 ms Changes: [...] Ok, we're no op for docker-001, so it picks the correct content. Note for a future change: We should remove the saltmaster role on Ysul and WindRiver, to avoid give Ysul a policy allowing Salt there to have full access to sys/policies/acl, etc. Comment Actions Manually deleted policies for dwellers, Ysul and windriver. Current code doesn't create empty policies so if we delete everything for one machine, it will keep former policy. Will fix that in _modules/credentials.py this week-end. Ysul and WindRiver should lose the saltmaster role, per T923. |