Skip to content

Commit 3346b3e

Browse files
jovialjovial
authored
Merge branch 'stackhpc/2023.1' into feature/2023.1/cis
2 parents 425a0ac + 0d1dfe2 commit 3346b3e

File tree

18 files changed

+243
-10
lines changed

18 files changed

+243
-10
lines changed

‎.github/workflows/stackhpc-container-image-build.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -231,7 +231,7 @@ jobs:
231231
run: mv image-scan-output image-build-logs/image-scan-output
232232

233233
- name: Fail if no images have passed scanning
234-
run: if [ $(wc -l < image-build-logs/image-scan-output/clean-images.txt) -le 0 ]; then exit 1; fi
234+
run: if [ $(wc -l < image-build-logs/image-scan-output/critical-images.txt) -gt 0 ]; then exit 1; fi
235235
if: ${{ !inputs.push-dirty }}
236236

237237
- name: Copy clean images to push-attempt-images list

‎doc/source/contributor/environments/ci-builder.rst

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,13 @@ Pulp proxy that injects an HTTP basic auth header into requests that it
151151
proxies. Because this proxy bypasses Pulp's authentication, it must not be
152152
exposed to any untrusted environment.
153153

154+
Ensure that ``localhost`` is resolvable if Docker bridge networking is
155+
disabled. This may be achieved by adding the following to ``/etc/hosts``:
156+
157+
.. parsed-literal::
158+
159+
127.0.0.1 localhost
160+
154161
To deploy the proxy:
155162

156163
.. parsed-literal::

‎doc/source/operations/tempest.rst

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ Installing Docker on Rocky:
7070
.. code-block:: bash
7171
7272
sudo dnf install -y dnf-utils
73-
sudo dnf-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
73+
sudo dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
7474
sudo dnf install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
7575
7676
Ensure Docker is running & enabled:
@@ -101,7 +101,7 @@ Build a Kayobe automation image:
101101
git submodule update
102102
# If running on Ubuntu, the fact cache can confuse Kayobe in the Rocky-based container
103103
mv etc/kayobe/facts{,-old}
104-
sudo DOCKER_BUILDKIT=1 docker build --build-arg BASE_IMAGE=rockylinux:9 --file .automation/docker/kayobe/Dockerfile --tag kayobe:latest .
104+
sudo DOCKER_BUILDKIT=1 docker build --network host --build-arg BASE_IMAGE=rockylinux:9 --file .automation/docker/kayobe/Dockerfile --tag kayobe:latest .
105105
106106
Configuration
107107
=============

‎doc/source/operations/upgrading.rst

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -132,13 +132,13 @@ Some things to watch out for:
132132

133133
.. code-block:: sql
134134
135-
UPDATE trust_role
135+
UPDATE trust_role as tr
136136
SET role_id = '<MEMBER-ROLE-ID>'
137137
WHERE role_id = '<OLD-ROLE-ID>'
138138
AND NOT EXISTS (
139139
SELECT 1
140140
FROM trust_role
141-
WHERE trust_id = trust_role.trust_id
141+
WHERE trust_id = tr.trust_id
142142
AND role_id = '<MEMBER-ROLE-ID>'
143143
);
144144

‎etc/kayobe/ansible/pulp-auth-proxy.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
- import_role:
99
name: pulp_auth_proxy
1010
vars:
11-
pulp_auth_proxy_url: "{{ stackhpc_repo_mirror_url }}"
11+
pulp_auth_proxy_url: "{{ stackhpc_release_pulp_url }}"
1212
pulp_auth_proxy_username: "{{ stackhpc_repo_mirror_username }}"
1313
pulp_auth_proxy_password: "{{ stackhpc_repo_mirror_password }}"
1414
pulp_auth_proxy_conf_path: "{{ base_path }}/containers/pulp_proxy"

‎etc/kayobe/ansible/roles/pulp_auth_proxy/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ any untrusted environment.
1515

1616
## Role variables
1717

18-
* `pulp_auth_proxy_pulp_url`: URL of the Pulp server to proxy requests to.
18+
* `pulp_auth_proxy_url`: URL of the Pulp server to proxy requests to.
1919
* `pulp_auth_proxy_username`: Username of the Pulp server to proxy requests to.
2020
* `pulp_auth_proxy_password`: Password of the Pulp server to proxy requests to.
2121
* `pulp_auth_proxy_conf_path`: Path to a directory in which to write Nginx

‎etc/kayobe/ansible/roles/pulp_auth_proxy/defaults/main.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,4 @@ pulp_auth_proxy_password:
55
pulp_auth_proxy_conf_path:
66
pulp_auth_proxy_listen_ip: 127.0.0.1
77
pulp_auth_proxy_listen_port: 80
8+
pulp_auth_proxy_network_mode:

‎etc/kayobe/ansible/roles/pulp_auth_proxy/tasks/main.yml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,24 @@
11
---
2+
- when: pulp_auth_proxy_network_mode is none
3+
block:
4+
- name: Check if Docker bridge network exists
5+
community.docker.docker_host_info:
6+
networks: true
7+
register: docker_host_info
8+
9+
- name: Set a fact about the network mode
10+
ansible.builtin.set_fact:
11+
pulp_auth_proxy_network_mode: "{{ 'host' if docker_host_info.networks | selectattr('Driver', 'equalto', 'bridge') | list | length == 0 else 'bridge' }}"
12+
13+
- name: Assert that localhost is resolvable when using host networking
14+
assert:
15+
that:
16+
- "'localhost' is ansible.utils.resolvable"
17+
fail_msg: >-
18+
localhost must be resolvable when using Docker host networking with this container.
19+
Consider adding '127.0.0.1 localhost' to /etc/hosts.
20+
when: pulp_auth_proxy_network_mode == 'host'
21+
222
- name: "Ensure {{ pulp_auth_proxy_conf_path }} exists"
323
ansible.builtin.file:
424
path: "{{ pulp_auth_proxy_conf_path }}"
@@ -18,9 +38,18 @@
1838
community.docker.docker_container:
1939
name: pulp_proxy
2040
image: nginx:stable-alpine
41+
network_mode: "{{ pulp_auth_proxy_network_mode }}"
2142
ports:
2243
- "{{ pulp_auth_proxy_listen_ip }}:{{ pulp_auth_proxy_listen_port }}:80"
2344
restart_policy: "no"
2445
restart: "{{ pulp_proxy_conf is changed }}"
2546
volumes:
2647
- "{{ pulp_auth_proxy_conf_path }}/pulp_proxy.conf:/etc/nginx/conf.d/default.conf:ro"
48+
49+
- name: Wait for pulp_proxy container to become accessible
50+
ansible.builtin.uri:
51+
url: http://localhost/pulp/api/v3/status/
52+
register: uri_result
53+
until: uri_result is success
54+
retries: 30
55+
delay: 2

‎etc/kayobe/inventory/group_vars/overcloud/cis

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,9 +115,22 @@ ubtu22cis_sshd:
115115
deny_users: ""
116116
deny_groups: ""
117117

118-
# Do not change /var/lib/docker permissions
118+
# Stop the CIS benchmark scanning all files on every filesystem since this
119+
# takes a long time. Related to the changing permissions block below. This
120+
# would normally warn you about violations, but we can use Wazuh to continually
121+
# monitor this.
122+
ubtu22cis_rule_6_1_9: false
123+
ubtu22cis_rule_6_1_10: false
124+
ubtu22cis_rule_6_1_11: false
125+
ubtu22cis_rule_6_1_12: false
126+
ubtu22cis_rule_6_1_13: false
127+
128+
# The following rules change permissions on all files on every mounted
129+
# filesystem. We do not want to change /var/lib/docker permissions.
119130
ubtu22cis_no_group_adjust: false
120131
ubtu22cis_no_owner_adjust: false
132+
ubtu22cis_no_world_write_adjust: false
133+
ubtu22cis_suid_adjust: false
121134

122135
# Configure log rotation to prevent audit logs from filling the disk
123136
ubtu22cis_auditd:
@@ -133,4 +146,10 @@ ubtu22cis_max_log_file_size: 1024
133146
# ubtu22cis_bootloader_password_hash
134147
ubtu22cis_rule_1_4_1: false
135148
ubtu22cis_rule_1_4_3: false
149+
150+
# The way this is disabled currently breaks kolla's IPV6 check, see:
151+
# https://bugs.launchpad.net/kolla-ansible/+bug/2071443
152+
# Also matches RHEL hardening behavior.
153+
ubtu22cis_ipv6_required: true
154+
136155
##############################################################################

‎etc/kayobe/kolla/config/fluentd/output/00-local.conf

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
{% raw %}
2+
{% for item in syslog_facilities | selectattr('enabled') %}
3+
<match syslog.{{ item.facility }}.**>
4+
@type copy
5+
<store>
6+
@type file
7+
path /var/log/kolla/{{ item.logdir }}/{{ item.logfile }}
8+
append true
9+
# Disable timestamp in filename for logs
10+
<buffer []>
11+
path /var/log/kolla/{{ item.logdir }}/{{ item.logfile }}.*.buffer
12+
</buffer>
13+
<format>
14+
output_tag {{ item.output_tag | default(false) | lower }}
15+
output_time {{ item.output_time | default(false) | lower }}
16+
</format>
17+
</store>
18+
{% if log_direct_to_elasticsearch %}
19+
<store>
20+
@type elasticsearch
21+
host {{ elasticsearch_address }}
22+
port {{ elasticsearch_port | default('9200') }}
23+
scheme {{ fluentd_elasticsearch_scheme }}
24+
{% if fluentd_elasticsearch_path != '' %}
25+
path {{ fluentd_elasticsearch_path }}
26+
{% endif %}
27+
{% if fluentd_elasticsearch_scheme == 'https' %}
28+
ssl_version {{ fluentd_elasticsearch_ssl_version }}
29+
ssl_verify {{ fluentd_elasticsearch_ssl_verify }}
30+
{% if fluentd_elasticsearch_cacert | length > 0 %}
31+
ca_file {{ fluentd_elasticsearch_cacert }}
32+
{% endif %}
33+
{% endif %}
34+
{% if fluentd_elasticsearch_user != '' and fluentd_elasticsearch_password != ''%}
35+
user {{ fluentd_elasticsearch_user }}
36+
password {{ fluentd_elasticsearch_password }}
37+
{% endif %}
38+
logstash_format true
39+
logstash_prefix {{ opensearch_log_index_prefix }}
40+
reconnect_on_error true
41+
request_timeout {{ fluentd_elasticsearch_request_timeout }}
42+
suppress_type_name true
43+
<buffer>
44+
@type file
45+
path /var/lib/fluentd/data/elasticsearch.buffer/{{ item.facility }}.*
46+
flush_interval 15s
47+
</buffer>
48+
</store>
49+
{% elif log_direct_to_opensearch %}
50+
<store>
51+
@type opensearch
52+
host {{ opensearch_address }}
53+
port {{ opensearch_port }}
54+
scheme {{ fluentd_opensearch_scheme }}
55+
{% if fluentd_opensearch_path != '' %}
56+
path {{ fluentd_opensearch_path }}
57+
{% endif %}
58+
{% if fluentd_opensearch_scheme == 'https' %}
59+
ssl_version {{ fluentd_opensearch_ssl_version }}
60+
ssl_verify {{ fluentd_opensearch_ssl_verify }}
61+
{% if fluentd_opensearch_cacert | length > 0 %}
62+
ca_file {{ fluentd_opensearch_cacert }}
63+
{% endif %}
64+
{% endif %}
65+
{% if fluentd_opensearch_user != '' and fluentd_opensearch_password != ''%}
66+
user {{ fluentd_opensearch_user }}
67+
password {{ fluentd_opensearch_password }}
68+
{% endif %}
69+
logstash_format true
70+
logstash_prefix {{ opensearch_log_index_prefix }}
71+
reconnect_on_error true
72+
request_timeout {{ fluentd_opensearch_request_timeout }}
73+
suppress_type_name true
74+
bulk_message_request_threshold 20M
75+
<buffer>
76+
@type file
77+
path /var/lib/fluentd/data/opensearch.buffer/{{ item.facility }}.*
78+
flush_interval 15s
79+
chunk_limit_size 8M
80+
</buffer>
81+
</store>
82+
{% endif %}
83+
</match>
84+
{% endfor %}
85+
{% endraw %}

‎etc/kayobe/kolla/config/fluentd/output/03-opensearch.conf

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{% raw %}
2+
{% if enable_caso | bool and inventory_hostname in groups['caso'] %}
3+
<match apel.events>
4+
@type copy
5+
<store>
6+
@type opensearch
7+
host { opensearch_address }}
8+
port {{ opensearch_port }}
9+
logstash_format true
10+
logstash_prefix apel
11+
flush_interval 15s
12+
</store>
13+
</match>
14+
{% endif %}
15+
16+
<match **>
17+
@type copy
18+
<store>
19+
@type opensearch
20+
host {{ opensearch_address }}
21+
port {{ opensearch_port }}
22+
scheme {{ fluentd_opensearch_scheme }}
23+
{% if fluentd_opensearch_path != '' %}
24+
path {{ fluentd_opensearch_path }}
25+
{% endif %}
26+
{% if fluentd_opensearch_scheme == 'https' %}
27+
ssl_version {{ fluentd_opensearch_ssl_version }}
28+
ssl_verify {{ fluentd_opensearch_ssl_verify }}
29+
{% if fluentd_opensearch_cacert | length > 0 %}
30+
ca_file {{ fluentd_opensearch_cacert }}
31+
{% endif %}
32+
{% endif %}
33+
{% if fluentd_opensearch_user != '' and fluentd_opensearch_password != ''%}
34+
user {{ fluentd_opensearch_user }}
35+
password {{ fluentd_opensearch_password }}
36+
{% endif %}
37+
logstash_format true
38+
logstash_prefix {{ opensearch_log_index_prefix }}
39+
reconnect_on_error true
40+
request_timeout {{ fluentd_opensearch_request_timeout }}
41+
suppress_type_name true
42+
bulk_message_request_threshold 20M
43+
<buffer>
44+
@type file
45+
path /var/lib/fluentd/data/opensearch.buffer/openstack.*
46+
flush_interval 15s
47+
chunk_limit_size 8M
48+
</buffer>
49+
</store>
50+
</match>
51+
{% endraw %}

‎etc/kayobe/kolla/config/prometheus/fluentd.rules

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{% raw %}
2+
groups:
3+
- name: Fluentd
4+
rules:
5+
- alert: FluentdBufferTooLarge
6+
expr: (fluentd_output_status_buffer_total_bytes / 1024^2) > 128
7+
for: 15m
8+
labels:
9+
severity: warning
10+
annotations:
11+
summary: "Fluentd at {{ $labels.instance }} reports large queue buffers"
12+
description: "Fluentd queue buffers on {{ $labels.instance }} are using {{ $value }} MiB."
13+
{% endraw %}

‎etc/kayobe/kolla/config/prometheus/prometheus-blackbox-exporter.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ modules:
2727
- expect: "^SSH-2.0-"
2828
icmp:
2929
prober: icmp
30-
http_2xx_os_dashboards:
30+
http_2xx_opensearch_dashboards:
3131
prober: http
3232
timeout: 5s
3333
http:

‎etc/kayobe/pulp-repo-versions.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ stackhpc_pulp_repo_rocky_9_3_baseos_version: 20240413T014042
3131
stackhpc_pulp_repo_rocky_9_3_crb_version: 20240413T014042
3232
stackhpc_pulp_repo_rocky_9_3_extras_version: 20240413T014042
3333
stackhpc_pulp_repo_rocky_9_3_highavailability_version: 20240404T012937
34-
stackhpc_pulp_repo_rocky_9_sig_security_common_version: 20240705T092559
34+
stackhpc_pulp_repo_rocky_9_sig_security_common_version: 20240708T235303
3535
stackhpc_pulp_repo_ubuntu_cloud_archive_version: 20240418T070026
3636
stackhpc_pulp_repo_ubuntu_jammy_security_version: 20240418T043733
3737
stackhpc_pulp_repo_ubuntu_jammy_version: 20240418T043733

‎releasenotes/notes/cis-do-not-disable-ipv6-98bd79ad86555f51.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
fixes:
3+
- |
4+
IPV6 is no longer disabled by default in the Ubuntu CIS hardening. If
5+
using the old behaviour you may hit `2071443
6+
<https://bugs.launchpad.net/kolla-ansible/+bug/2071443>`.
7+
upgrade:
8+
- |
9+
To match the new CIS benchmark defaults on Ubuntu, you should remove
10+
the ``ipv6.disable=1`` kernel command line option. If you wish to carry
11+
on with the current settings, change ``ubtu22cis_ipv6_required`` to
12+
``false``.

‎releasenotes/notes/fix-blackbox-opensearch-dashboard-d973b43c557c8103.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
fixes:
3+
- |
4+
Fixed incorrect Opensearch Dashboards Prometheus Blackbox Exporter
5+
configuration.

‎releasenotes/notes/fluentd-buffer-too-large-alert-682893410855387f.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
features:
3+
- |
4+
Adds a new Prometheus alert ``FluentdBufferTooLarge`` which is raised when
5+
the total size of queue buffers grows above 128 MiB.

‎releasenotes/notes/rl9-security-common-cve-2024-6409-d36de799a29c3f74.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
security:
3+
- |
4+
Updates the Rocky Linux 9 SIG Security Common repository to address
5+
`CVE-2024-6409 <https://sig-security.rocky.page/issues/CVE-2024-6409/>`__
6+
in OpenSSH.

0 commit comments

Comments
 (0)