Bug 1683306 - Command for creating bastion with --vault-password-file does not work
Summary: Command for creating bastion with --vault-password-file does not work
Keywords:
Status: CLOSED DUPLICATE of bug 1683287
Alias: None
Product: ovirt-engine-metrics
Classification: oVirt
Component: Generic
Version: 1.2.0.2
Hardware: Unspecified
OS: Unspecified
unspecified
low
Target Milestone: ---
: ---
Assignee: Shirly Radco
QA Contact: Lukas Svaty
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-02-26 15:02 UTC by Jan Zmeskal
Modified: 2019-03-13 21:21 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2019-03-13 21:21:44 UTC
oVirt Team: Metrics
Embargoed:


Attachments (Terms of Use)

Description Jan Zmeskal 2019-02-26 15:02:18 UTC
Description of problem:
The latest version (patchset 56) of README for oVirt.metrics-store-installation role says that bastion should be created by this command: 
./configure_ovirt_machines_for_metrics.sh --playbook=ovirt-metrics-store-installation.yml --vault-password-file ./config.yml.d/secure_vars.yml

This command does not work for several reasons. 
1) If you want to refer secure_vars.yml, the path is wrong. When we are running this command, we are in /usr/share/ovirt-engine-metrics. The previous instructions tells us to go there. Let's try going to /usr/share/ovirt-engine-metrics and running this: 
# ls -l /config.yml.d/secure_vars.yml
ls: cannot access /config.yml.d/secure_vars.yml: No such file or directory

2) Even when you provide the correct path (/etc/ovirt-engine-metrics/config.yml.d/secure_vars.yml), it still does not work with --vault-password-file parameter. That is because --vault-password-file does not accept file with the ACTUAL sensitive data. It expects file with a password that UNLOCKS sensitive file (in our case secure_vars.yml).

3) We need to include our sensitive variables from secure_vars.yaml as extra vars. This is done with -e parameter. 

So if we want this command to execute successfully, we have to go one of two possible ways: 
1.1 Create a password file like this:
echo "<my_pass>" > password_file.txt
1.2 Then run:
./configure_ovirt_machines_for_metrics.sh --playbook=ovirt-metrics-store-installation.yml --vault-password-file=password_file.txt
Or 
2. You can make Ansible to ask user for password interactively like this: 
./configure_ovirt_machines_for_metrics.sh --playbook=ovirt-metrics-store-installation.yml --ask-vault-pass

Version-Release number of selected component (if applicable):
ovirt-engine-metrics-1.2.1-0.0.master.20190225200554.el7.noarch (patchset 56)

How reproducible:
100 %

Steps to Reproduce:
1. Try running command that is supposed to deploy a bastino machine based on README for oVirt.metrics-store-installation role.

Comment 1 Shirly Radco 2019-03-13 21:21:44 UTC
Closing. This will be fixed as part of adding documentation and support for ansible vault, for sensitive variables, in bug #1683287

*** This bug has been marked as a duplicate of bug 1683287 ***


Note You need to log in before you can comment on or make changes to this bug.