Age | Commit message (Collapse) | Author | Files | Lines |
|
The core dump of a setuid program is more likely
to contain sensitive data, as the program itself
runs with greater privileges than the user who
initiated execution of the program. Disabling the
ability for any setuid program to write a core
file decreases the risk of unauthorized access of
such data.
This change sets core dump for setuid programs
to '0'.
Change-Id: Ib05d993c1bb59b59c784e438f805733f636c743d
Signed-off-by: zshi <zshi@redhat.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The str_replace conversion used previously is no longer needed and
breaks the hieradata value.
Closes-Bug: 1675426
Change-Id: I7a052d1757efe36daf6ed47e55598ca3c2ee9055
Signed-off-by: Tim Rozet <trozet@redhat.com>
|
|
This is needed for the TLS everywhere work. This will break on
TLS-everywhere setups where neutron would be deployed in its own role.
So we need to add the metadata_settings.
bp tls-via-certmonger
Change-Id: I7934a258e032d8eaa6f07c0e48b3fbdb1f8c6a06
|
|
This feature stopped working somewhere along the lines. In the past it
was working with parameter_defaults like this:
CinderNfsServers: '10.0.0.254:/srv/nfs/cinder'
or
CinderNfsServers: "[fd00:fd00:fd00:3000::1]:/srv/nfs/cinder"
The problem was that the templating escaped these strings, and
puppet-tripleo didn't receive a proper array, but a string.
This patch fixes this. It accepts strings as above as well as
comma-delimited lists of Nfs Servers.
Closes-Bug: 1671153
Change-Id: I89439c1d969e92cb8e0503de561e22409deafdfc
|
|
Firewall config was being inherited by the dpdk service, however
since the firewall service name was the parent (neutron_ovs_agent)
and technically that service was not enabled - the rules were never
applied. This modifies the service name as it is inherited using
map_replace.
Closes-Bug: 1674689
Change-Id: I6676205b8fc1fd578cb2435ad97fe577a9e81d95
Signed-off-by: Tim Rozet <trozet@redhat.com>
|
|
This is used in gnocchi-api.yaml and is not needed on the base template.
Change-Id: I5ebd27dff3dca7053647a57eb4cdef56d38526c6
|
|
|
|
Unprivileged access to the kernel syslog can expose sensitive
kernel address information.
Change-Id: If40f1b883dfde6c7870bf9c463753d037867c9e2
Signed-off-by: zshi <zshi@redhat.com>
|
|
|
|
Change-Id: I4958b886cbd6c2b34da0c265e8774105474ace13
|
|
Port 2550 is required for inter-ODL communication when clustering.
odl-jolokia feature is required to expose REST APIs from ODL for
monitoring the cluster.
Implements: blueprint opendaylight-ha
Depends-On: Ic9a955a1c2afc040b2f9c6fb86573c04a60f9f31
Change-Id: Ie108ab75cce0cb7d89e72637c600e30fc241d186
Signed-off-by: Tim Rozet <trozet@redhat.com>
|
|
|
|
|
|
We currently do not bind redis-sentinel to any IP:
redis 21144 0.0 0.0 142908 5908 ? Ssl 07:43 0:11 /usr/bin/redis-sentinel *:26379 [sentinel]
Let's bind it to the same network as redis.
Change-Id: I8a782ae1db84eb614aa3995a1638a2f370e70d06
Partial-Bug: #1673715
|
|
Using keystone_authtoken credentials for this purpose is deprecated, and also
prevents ironic-conductor from being used as a separate role.
Also remove neutron_url, it can be fetched from the catalog instead.
Change-Id: I12822568cb4db31808aec5fd407d71fe4b7b09e0
Depends-On: I21180678bec911f1be36e3b174bae81af042938c
Partial-Bug: #1661250
|
|
Secure EtcdInitialClusterToken parameter by:
* removing the default value.
* make it hidden.
Change-Id: I938af697f9faaadb9c9aeb950e9410db24b1b961
Depends-On: I6e30cce469736e84a3c483fafa29d542b8347ba9
Closes-Bug: #1673266
|
|
UUID is to be deprecated, and we should be using fernet.
Change-Id: I61b999e65ba5eb771776344d38eb90fc52d49d56
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
This profile will request the certificates for the services on the node.
So with this, we will remove the requesting of these certs on the
services' profiles themselves.
The reasoning for this is that for a containerized environment, the
containers won't have credentials to the CA while the baremetal node
does. So, with this, we will have this profile that still gets executed
in the baremetal nodes, and we can subsequently pass the requested
certificates by bind-mounting them on the containers. On the other hand,
this approach still works well for the TLS-everywhere case when the
services are running on baremetal.
Change-Id: Ibf58dfd7d783090e927de6629e487f968f7e05b6
Depends-On: I4d2e62b5c1b893551f9478cf5f69173c334ac81f
|
|
Switch Congress and Tacker to use auth_uri with keystone versionless
endpoint.
Change-Id: I7e17d061344849b0421f3a6c9571f1609e8861fb
Partial-Implement: blueprint keystone-v3
|
|
* Move swift_authurl to gnocchi-base hieradata, where other swift auth
credentials live and switch it to versionless keystone endpoint.
* Force swift_auth_version to 3 for Keystone v3.
* Switch auth_uri to use versionless Keystone endpoint.
* Switch auth_url to use Keystone admin endpoint (instead of internal).
* Remove old parameters from gnocchi::api, not used anymore.
Partial-blueprint: keystone-v3
Change-Id: I2feed8b1219069128faa1a1e8dcd2ddfbae7e40a
|
|
Switch Aodh, Ceilometer and Panko to use auth_uri parameter with
keystone versionless endpoint.
Change-Id: I5800f4161d0406d3717e1f539d23411b11378fbc
Partial-implement: blueprint keystone-v3
|
|
Switch Cinder to use auth_uri with keystone versionless endpoint.
Change-Id: Iccc6e3df6a8bb1aca3667b1783bc7f6eebf262e5
Partial-implement: blueprint keystone-v3
|
|
Switch Heat to use auth_uri with keystone versionless endpoint.
Change-Id: Iddd091a659d37d965b216db9f536d30245cd3c3a
Partial-implement: blueprint keystone-v3
|
|
Switch Ironic to use auth_uri with keystone versionless endpoint.
Change-Id: Ia8061a1e08bd31425f8d4192cd45b64b9f8e1f74
Partial-implement: blueprint keystone-v3
|
|
Switch Manila to use auth_uri with keystone versionless endpoint.
Change-Id: If05032a5c7d93b5787d3f18c0aa374bac3cbd478
Partial-implement: blueprint keystone-v3
|
|
Switch Neutron to use auth_uri with keystone versionless endpoint, also
for notifications with Nova.
Change-Id: I530e3dcdfe6961e14755a63767c1fb5c0e1cfa22
Partial-implement: blueprint keystone-v3
|
|
Switch nova authtoken auth_uri to use keystone endpoint without version.
Also switch ironic config in nova.conf to use it.
Change-Id: I8046f2eed0b9a7da76d6d7c3507a92bf5054b000
Partial-Implement: blueprint keystone-v3
|
|
We also need to wait for the galera resource to settle down
before we proceed starting up with the other services.
Note that before merging this, we need to land the following
change in ansible-pacemaker:
https://review.gerrithub.io/#/c/351387/
Change-Id: Id71c9cb41cfd4c17685c922db2683e28ab7588fd
Closes-Bug: #1668372
|
|
|
|
Change-Id: I677075012a948c7c32959680608255eff919b8d4
|