Change default Docker group for nasqueron-dev-docker
ClosedPublic
Actions

Authored by DorianWinty on Apr 14 2022, 22:34.

Details

Reviewers

dereckson

Maniphest Tasks

T1724: Split Docker engines between production (docker-001) and dev (dwellers)

Commits

rOPS271340880cd2: Change default Docker group for nasqueron-dev-docker

Summary

As we provision a group nasqueron-dev-docker for Docker devserver,
we can use it for Docker too instead of the default docker one.

Security implication: members of the nasqueron-dev-docker group
has now root access on the Docker engines hosts.

Ref T1724

Test Plan

salt dwellers state.sls roles/paas-docker/docker/config has correctly
provisioned /etc/docker/daemon.json with expected configuration.

Diff Detail

Repository

rOPS Nasqueron Operations

Lint

Lint Passed

Unit

No Test Coverage

Branch

cfg_docker

Build Status

Buildable 4185
Build 4437: arc lint + arc unit

Event Timeline

DorianWinty requested review of this revision.Apr 14 2022, 22:34

DorianWinty created this revision.

Harbormaster completed remote builds in B4185: Diff 6743.Apr 14 2022, 22:34

dereckson edited the summary of this revision. (Show Details)Apr 15 2022, 12:52

dereckson edited the summary of this revision. (Show Details)

dereckson added a task: T1724: Split Docker engines between production (docker-001) and dev (dwellers).

Looks good to me:

P304 Docker D2668 and D2669

2 [

3 ----------

12 ----------

22 $

24 ----------

33 ----------

# test run

$ salt dwellers state.sls roles/core/users test=True ...] ID: dorianwinty Function: user.present Result: None Comment: User dorianwinty set to be added Started: 13:10:22.882113 Duration: 4.353 ms Changes: [...] ID: group_nasqueron-dev-docker Function: group.present Name: nasqueron-dev-docker Result: None Comment: Group nasqueron-dev-docker set to be added Started: 13:10:22.899044 Duration: 3.884 ms Changes: salt dwellers state.sls roles/core/users ID: dorianwinty Function: user.present Result: True Comment: New user dorianwinty created Started: 13:11:50.644692 Duration: 1018.402 ms Changes: [...] ID: group_nasqueron-dev-docker Function: group.present Name: nasqueron-dev-docker Result: True Comment: New group nasqueron-dev-docker created Started: 13:11:51.679170 Duration: 640.928 ms Changes: ---------- gid: 842 members: - dereckson - dorianwinty - sandlayth name: nasqueron-dev-docker passwd: x Note: it also removed self local key for /home/sandlayth/.ssh/authorized_keys

dereckson mentioned this in D2670: Update Docker socket ownership.Apr 15 2022, 17:36

dereckson edited the summary of this revision. (Show Details)Apr 15 2022, 17:55

dereckson edited the test plan for this revision. (Show Details)

dereckson accepted this revision.Apr 15 2022, 17:59

This revision is now accepted and ready to land.Apr 15 2022, 17:59

Closed by commit rOPS271340880cd2: Change default Docker group for nasqueron-dev-docker (authored by DorianWinty, committed by dereckson). · Explain WhyApr 15 2022, 19:50

This revision was automatically updated to reflect the committed changes.

dereckson added a commit: rOPS271340880cd2: Change default Docker group for nasqueron-dev-docker.

DorianWinty mentioned this in rOPS1abc93e26ee5: Update Docker socket ownership.Apr 19 2022, 20:37