Bläddra i källkod

fix certificate auth on containerized etcd

addresses an issue where quotation marks in files passed to docker's --env-file are escaped in a way that makes them unreadable by etcd

CVE-2018-1085 | https://bugzilla.redhat.com/show_bug.cgi?id=1557822
David Hocky 7 år sedan
förälder
incheckning
6fb52aea9a

+ 2 - 2
roles/etcd/tasks/upgrade/validate_etcd_conf.yml

@@ -24,13 +24,13 @@
   lineinfile:
     destfile: "{{ etcd_conf_file }}"
     regexp: '^ETCD_CLIENT_CERT_AUTH='
-    line: 'ETCD_CLIENT_CERT_AUTH="true"'
+    line: 'ETCD_CLIENT_CERT_AUTH=true'
 
 - name: Ensure ETCD_PEER_CLIENT_CERT_AUTH exists
   lineinfile:
     destfile: "{{ etcd_conf_file }}"
     regexp: '^ETCD_PEER_CLIENT_CERT_AUTH='
-    line: 'ETCD_PEER_CLIENT_CERT_AUTH="true"'
+    line: 'ETCD_PEER_CLIENT_CERT_AUTH=true'
 
 - name: Ensure ETCD_TRUSTED_CA_FILE exists
   lineinfile:

+ 3 - 3
roles/etcd/templates/etcd.conf.j2

@@ -44,7 +44,7 @@ ETCD_INITIAL_CLUSTER_TOKEN={{ etcd_initial_cluster_token }}
 ETCD_ADVERTISE_CLIENT_URLS={{ etcd_advertise_client_urls }}
 #ETCD_STRICT_RECONFIG_CHECK="false"
 #ETCD_AUTO_COMPACTION_RETENTION="0"
-#ETCD_ENABLE_V2="true"
+#ETCD_ENABLE_V2=true
 ETCD_QUOTA_BACKEND_BYTES={{ etcd_quota_backend_bytes }}
 
 #[proxy]
@@ -58,14 +58,14 @@ ETCD_QUOTA_BACKEND_BYTES={{ etcd_quota_backend_bytes }}
 #[security]
 {% if etcd_url_scheme == 'https' -%}
 ETCD_TRUSTED_CA_FILE={{ etcd_ca_file }}
-ETCD_CLIENT_CERT_AUTH="true"
+ETCD_CLIENT_CERT_AUTH=true
 ETCD_CERT_FILE={{ etcd_cert_file }}
 ETCD_KEY_FILE={{ etcd_key_file }}
 {% endif -%}
 #ETCD_AUTO_TLS="false"
 {% if etcd_peer_url_scheme == 'https' -%}
 ETCD_PEER_TRUSTED_CA_FILE={{ etcd_peer_ca_file }}
-ETCD_PEER_CLIENT_CERT_AUTH="true"
+ETCD_PEER_CLIENT_CERT_AUTH=true
 ETCD_PEER_CERT_FILE={{ etcd_peer_cert_file }}
 ETCD_PEER_KEY_FILE={{ etcd_peer_key_file }}
 {% endif -%}