diff options
| author |   Steven Hardy <shardy@redhat.com> | 2017-09-04 13:53:04 +0100 |
|---|---|---|
| committer |   Emilien Macchi <emilien@redhat.com> | 2017-09-05 15:23:48 +0000 |
| commit | 41d599cb37fbc082a4869e32b520d7017085c4f7 (patch) | |
| tree | 699ac5e76a621d93921c4cc10ff62977d8e03f74 /common/deploy-steps.j2 | |
| parent | 9f408dbe8bc8371424ecb816877b1cfe62498f8d (diff) | |
Set mode for ansible written files
Use a more restrictive mode for these files, as some may contain sensitive data
which shouldn't be world readable
Closes-Bug: #1714986
Change-Id: Ib1e79b1d4e25d6e329938402b1ca776bdab81bdd
(cherry picked from commit 94c7752cfae64d96124a32bc36ccd6ec7b4df4a7)
Diffstat (limited to 'common/deploy-steps.j2')
| -rw-r--r-- | common/deploy-steps.j2 | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/common/deploy-steps.j2 b/common/deploy-steps.j2 index 3af48464..1119fb60 100644 --- a/common/deploy-steps.j2 +++ b/common/deploy-steps.j2 @@ -190,29 +190,29 @@ resources: - name: Create /var/lib/tripleo-config directory file: path=/var/lib/tripleo-config state=directory - name: Write the puppet step_config manifest - copy: content="{{puppet_step_config}}" dest=/var/lib/tripleo-config/puppet_step_config.pp force=yes + copy: content="{{puppet_step_config}}" dest=/var/lib/tripleo-config/puppet_step_config.pp force=yes mode=0600 # this creates a JSON config file for our docker-puppet.py script - name: Create /var/lib/docker-puppet file: path=/var/lib/docker-puppet state=directory - name: Write docker-puppet-tasks json files - copy: content="{{puppet_config | to_json}}" dest=/var/lib/docker-puppet/docker-puppet.json force=yes + copy: content="{{puppet_config | to_json}}" dest=/var/lib/docker-puppet/docker-puppet.json force=yes mode=0600 # FIXME: can we move docker-puppet somewhere so it's installed via a package? - name: Write docker-puppet.py - copy: content="{{docker_puppet_script}}" dest=/var/lib/docker-puppet/docker-puppet.py force=yes + copy: content="{{docker_puppet_script}}" dest=/var/lib/docker-puppet/docker-puppet.py force=yes mode=0600 # Here we are dumping all the docker container startup configuration data # so that we can have access to how they are started outside of heat # and docker-cmd. This lets us create command line tools to test containers. # FIXME do we need the docker-container-startup-configs.json or is the new per-step # data consumed by paunch enough? - name: Write docker-container-startup-configs - copy: content="{{docker_startup_configs | to_json}}" dest=/var/lib/docker-container-startup-configs.json force=yes + copy: content="{{docker_startup_configs | to_json}}" dest=/var/lib/docker-container-startup-configs.json force=yes mode=0600 - name: Write per-step docker-container-startup-configs - copy: content="{{item.value|to_json}}" dest="/var/lib/tripleo-config/docker-container-startup-config-{{item.key}}.json" force=yes + copy: content="{{item.value|to_json}}" dest="/var/lib/tripleo-config/docker-container-startup-config-{{item.key}}.json" force=yes mode=0600 with_dict: "{{docker_startup_configs}}" - name: Create /var/lib/kolla/config_files directory file: path=/var/lib/kolla/config_files state=directory - name: Write kolla config json files - copy: content="{{item.value|to_json}}" dest="{{item.key}}" force=yes + copy: content="{{item.value|to_json}}" dest="{{item.key}}" force=yes mode=0600 with_dict: "{{kolla_config}}" ######################################################## # Bootstrap tasks, only performed on bootstrap_server_id @@ -225,7 +225,7 @@ resources: - /var/lib/docker-puppet/docker-puppet-tasks*.json when: deploy_server_id == bootstrap_server_id - name: Write docker-puppet-tasks json files - copy: content="{{item.value|to_json}}" dest=/var/lib/docker-puppet/docker-puppet-tasks{{item.key.replace("step_", "")}}.json force=yes + copy: content="{{item.value|to_json}}" dest=/var/lib/docker-puppet/docker-puppet-tasks{{item.key.replace("step_", "")}}.json force=yes mode=0600 with_dict: "{{docker_puppet_tasks}}" when: deploy_server_id == bootstrap_server_id {%- endraw %} |