Tighten tcib sudoers rules - #415
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: rabi The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Build failed (check pipeline). Post ✔️ tcib-openstack-meta-content-provider-master SUCCESS in 2h 08m 02s |
|
Build failed (check pipeline). Post ✔️ tcib-openstack-meta-content-provider-master SUCCESS in 2h 14m 51s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ tcib-openstack-meta-content-provider-master SUCCESS in 3h 05m 14s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ tcib-openstack-meta-content-provider-master SUCCESS in 2h 43m 50s |
4e0ee47 to
c844cac
Compare
|
Build failed (check pipeline). Post ✔️ tcib-openstack-meta-content-provider-master SUCCESS in 2h 44m 34s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ tcib-openstack-meta-content-provider-master SUCCESS in 2h 51m 21s |
|
recheck hold node |
|
Build failed (check pipeline). Post ✔️ tcib-openstack-meta-content-provider-master SUCCESS in 2h 47m 38s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ tcib-openstack-meta-content-provider-master SUCCESS in 2h 46m 28s |
|
recheck |
|
This change depends on a change that failed to merge. Change openstack-k8s-operators/ci-framework#4100 is needed. |
|
recheck |
|
Build failed (check pipeline). Post ✔️ tcib-openstack-meta-content-provider-master SUCCESS in 1h 56m 45s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ tcib-openstack-meta-content-provider-master SUCCESS in 3h 35m 31s |
|
Build failed (check pipeline). Post ✔️ tcib-openstack-meta-content-provider-master SUCCESS in 2h 42m 04s |
|
recheck |
|
Build failed (check pipeline). Post ❌ tcib-openstack-meta-content-provider-master FAILURE in 5m 46s |
|
recheck |
|
This change depends on a change that failed to merge. Change openstack-k8s-operators/ci-framework#4100 is needed. |
|
recheck |
|
Build failed (check pipeline). Post ✔️ tcib-openstack-meta-content-provider-master SUCCESS in 1h 23m 33s |
|
recheck |
|
This change depends on a change that failed to merge. Change openstack-k8s-operators/ci-framework#4100 is needed. |
|
recheck |
|
Build failed (check pipeline). Post ❌ tcib-openstack-meta-content-provider-master FAILURE in 5m 57s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ tcib-openstack-meta-content-provider-master SUCCESS in 5h 19m 13s |
|
recheck |
|
Build failed (check pipeline). Post ✔️ tcib-openstack-meta-content-provider-master SUCCESS in 2h 45m 33s |
Restrict sudo access to the commands the images still need, preserve the Kolla environment required for non-interactive startup and restore the Tobiko host inspection commands needed in CI. Signed-off-by: rabi <ramishra@redhat.com>
|
This change depends on a change that failed to merge. Change openstack-k8s-operators/ci-framework#4100 is needed. |
|
recheck |
1 participant
Drop the unneeded broad sudoers entries from the ansible-tests, horizontest, rally, and tobiko images, restrict Tempest to package installation, and replace the kolla wildcard rule with explicit helper commands.
Keep the MariaDB bootstrap environment needed by kolla_security_reset so the tighter kolla allowlist does not break bootstrap.
Depends-On: openstack-k8s-operators/mariadb-operator#537
Depends-On: openstack-k8s-operators/ci-framework#4100
jira: OSPRH-34490