Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1683353

Summary:	Sensitive variables are in plaintext on bastion
Product:	[oVirt] ovirt-engine-metrics	Reporter:	Jan Zmeskal <jzmeskal>
Component:	Generic	Assignee:	Shirly Radco <sradco>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Ivana Saranova <isaranov>
Severity:	high	Docs Contact:
Priority:	high
Version:	1.2.0.2	CC:	aoconnor, bugs, dfediuck, lleistne
Target Milestone:	ovirt-4.2.8-4	Flags:	sradco: ovirt-4.2? sradco: ovirt-4.3? lleistne: testing_ack+
Target Release:	1.2.2.2
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-03 07:56:01 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	Metrics	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1683287
Bug Blocks:

Description Jan Zmeskal 2019-02-26 16:17:31 UTC

Description of problem:
According to the latest (patchset 56) version of README for oVirt.metrics-store-installation role, user is prompted to store sensitive variables in ansible-vault protected file called secure_vars.yaml. However, if they do it and then run playbook for deploying bastion (ovirt-metrics-store-installation.yml), security of those variables is compromised. They are *all* visible in plaintext in vars.yaml file on bastion. It happens because the jinja2 template for vars file is rendered with them. See here: https://gerrit.ovirt.org/#/c/97643/56/roles/oVirt.metrics-store-installation/templates/vars.yaml.template

Version-Release number of selected component (if applicable):
ovirt-engine-metrics-1.2.1-0.0.master.20190225200554.el7.noarch (patchset 56)

How reproducible:
100 %

Steps to Reproduce:
1. Prepare your config.yml according to README. Make sure that you don't specify *any* of the sensitive variables (engine_password, rhsub_pass, oreg_auth_password, root_password and ovirt_metrics_admin_password) there.
2. Specify all the sensitive variables in ansible-vault protected file
3. Run ovirt-metrics-store-installation.yml (don't forget to include the file with sensitive variables!)
4. SSH to newly-created bastion
5. Inspect content of vars.yaml

Actual results:
vars.yaml contains sensitive variables in plaintext

Expected results:
If your protects them with ansible-vault on the starting machine (probable engine) they should stay encrypted during the whole process.

Comment 1 Ivana Saranova 2019-04-04 14:45:05 UTC

Steps to Reproduce:
1. Prepare your configs according to official documentation
2. Specify all the sensitive variables in ansible-vault protected file
3. Run ANSIBLE_JINJA2_EXTENSIONS="jinja2.ext.do" ./configure_ovirt_machines_for_metrics.sh \
  --playbook=ovirt-metrics-store-installation.yml --ask-vault-pass
4. SSH to newly-created bastion
5. Inspect content of vars.yaml

Result:
Root_password is still in the vars.yaml in plaintext.

Verified in: 
ovirt-engine-4.2.8.5-0.1.el7ev.noarch
ovirt-engine-metrics-1.2.1.3-1.el7ev.noarch

Also verified in:
ovirt-engine-4.3.3.1-0.1.el7.noarch
ovirt-engine-metrics-1.2.1.3-1.el7ev.noarch

Comment 2 Ivana Saranova 2019-04-04 15:04:04 UTC

> Verified in: 
> ovirt-engine-4.2.8.5-0.1.el7ev.noarch
> ovirt-engine-metrics-1.2.1.3-1.el7ev.noarch
> 
> Also verified in:
> ovirt-engine-4.3.3.1-0.1.el7.noarch
> ovirt-engine-metrics-1.2.1.3-1.el7ev.noarch

Sorry for mistake, should be just 

Tested in: 
ovirt-engine-4.2.8.5-0.1.el7ev.noarch
ovirt-engine-metrics-1.2.1.3-1.el7ev.noarch

Also tested in:
ovirt-engine-4.3.3.1-0.1.el7.noarch
ovirt-engine-metrics-1.2.1.3-1.el7ev.noarch

Comment 3 Ivana Saranova 2019-04-08 15:02:49 UTC

Steps to Reproduce:
1. Prepare your configs according to official documentation
2. Specify all the sensitive variables in ansible-vault protected file
3. Run ANSIBLE_JINJA2_EXTENSIONS="jinja2.ext.do" ./configure_ovirt_machines_for_metrics.sh \
  --playbook=ovirt-metrics-store-installation.yml --ask-vault-pass
4. SSH to newly-created bastion
5. Inspect content of vars.yaml

Result:
Playbook fails on this: https://bugzilla.redhat.com/show_bug.cgi?id=1697521

Tested in: 
ovirt-engine-metrics-1.3.0.1-1.el7ev.noarch
ovirt-engine-4.3.3.1-0.1.el7.noarch

Comment 4 Ivana Saranova 2019-04-10 12:54:49 UTC

Steps to Reproduce:
1. Prepare your configs according to official documentation
2. Specify all the sensitive variables in ansible-vault protected file
3. Run ANSIBLE_JINJA2_EXTENSIONS="jinja2.ext.do" ./configure_ovirt_machines_for_metrics.sh \
  --playbook=ovirt-metrics-store-installation.yml --ask-vault-pass
4. SSH to newly-created bastion
5. Inspect content of vars.yaml

Result:
Playbook finishes successfully. There are no passwords in plaintext on the bastion machine.

Verified in:
ovirt-engine-4.2.8.5-0.1.el7ev.noarch
ovirt-engine-metrics-1.2.2.2-1.el7ev.noarch

Also verified in:
ovirt-engine-4.3.3.1-0.1.el7.noarch
ovirt-engine-metrics-1.3.0.1-1.el7ev.noarch