Used RHOS-16.2-RHEL-8-20221005.n.1-ASYNC

[stack@undercloud-0 ~]$ yum list installed | grep tripleo-ansible
tripleo-ansible.noarch                        0.8.1-2.20220406160116.el8ost                @rhelosp-16.2

[stack@undercloud-0 ~]$ yum list installed | grep openstack-tripleo-common
openstack-tripleo-common.noarch               11.7.1-2.20220318011206.el8ost               @rhelosp-16.2                     
openstack-tripleo-common-containers.noarch    11.7.1-2.20220318011206.el8ost               @rhelosp-16.2 


Moving to ON_DEV. Can still recover password from /avr/lib/mistral:

[stack@undercloud-0 ~]$ grep OS_PASSWORD /var/lib/mistral/overcloud/Controller/post_upgrade_tasks.yaml
    OS_PASSWORD: 5eflajGWotKbhIPa6HiKLos7H

As a regular user /var/lib/mistral is not visible:

[stack@undercloud-0 ~]$ ls -l /var/lib/mistral
ls: cannot open directory '/var/lib/mistral': Permission denied
[stack@undercloud-0 ~]$ 
[stack@undercloud-0 ~]$ 


However, the overcloud directory still has open permission so that a regular user can still access files in overcloud directory:
[stack@undercloud-0 ~]$ sudo ls -l /var/lib/mistral
total 8
lrwxrwxrwx.  1 42430 42430   26 Oct  6 13:39 config-download-latest -> /var/lib/mistral/overcloud
drwxr-xr-x. 14 42430 42430 4096 Oct  6 14:08 overcloud
-r--r--r--.  1 42430 42430 1057 Oct  6 12:51 undercloud.conf

The mistral_executor container does not have the updated openstack-tripleo-common from the FIV:

[stack@undercloud-0 ~]$ sudo podman exec -it mistral_executor rpm -q openstack-tripleo-common
openstack-tripleo-common-11.7.1-2.20220318011205.b5ef9a5.el8ost.noarch

Mistral is running containerized and using code from tripleo-common, so we need to patch the container in addition to the host.

I updated the openstack-tripleo-common containers in the mistral_executor container, then restarted the container:

[stack@undercloud-0 ~]$ sudo podman exec -it mistral_executor rpm -qa | grep tripleo-common
openstack-tripleo-common-container-base-11.7.1-2.20220318011206.el8ost.noarch
openstack-tripleo-common-11.7.1-2.20220318011206.el8ost.noarch
python3-tripleo-common-11.7.1-2.20220318011206.el8ost.noarch
openstack-tripleo-common-containers-11.7.1-2.20220318011206.el8ost.noarch


Then I ran overcloud deploy with the --config-download-only arg (just to skip the stack update). Looks like it is fixed now:

[stack@undercloud-0 ~]$ grep OS_PASSWORD /var/lib/mistral/overcloud/Controller/post_upgrade_tasks.yaml
grep: /var/lib/mistral/overcloud/Controller/post_upgrade_tasks.yaml: Permission denied
[stack@undercloud-0 ~]$ sudo ls -l /var/lib/mistral
total 8
lrwxrwxrwx.  1 42430 42430   26 Oct  6 20:08 config-download-latest -> /var/lib/mistral/overcloud
drwxrwx---. 15 42430 42430 4096 Oct  6 20:12 overcloud
-r--r--r--.  1 42430 42430 1057 Oct  6 12:51 undercloud.conf

The tripleo-ansible patch, which fixes the permissions on overcloud.json also looks fixed:

(undercloud) [stack@undercloud-0 ~]$ sudo ls -l /var/lib/mistral/overcloud/group_vars/overcloud.json
-rw-r-----. 1 42430 42430 30896 Oct  6 20:08 /var/lib/mistral/overcloud/group_vars/overcloud.json

Testing as mentioned above requires the mistral-executor container image to be patched for this fix to be effective, and able to be tested

Stopped mistral-executor, downloaded rhosp16-openstack-mistral-executor:16.2.3-10.1665156347, and started it with new image:

(undercloud) [stack@undercloud-0 ~]$ sudo podman ps -a | grep mistral-executor
41ebabbec3eb  undercloud-0.ctlplane.redhat.local:8787/rh-osbs/rhosp16-openstack-mistral-executor:16.2.3-10.1665156347      kolla_start

Reran overcloud deploy and verified password was no longer recoverable:

(undercloud) [stack@undercloud-0 ~]$ grep OS_PASSWORD /var/lib/mistral/overcloud/Controller/post_upgrade_tasks.yaml
grep: /var/lib/mistral/overcloud/Controller/post_upgrade_tasks.yaml: Permission denied

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: Red Hat OpenStack Platform (tripleo-ansible) security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:6969