openQA Project (public)

Motivation¶

In the ongoing effort to improve our security we introduced things like e.g. https://github.com/os-autoinst/os-autoinst/pull/1909 which is a necessary step to improve how we handle passwords/secrets.
I'd like to see that openQA also supports accessing passwords over different channels which are specifically designed to store secrets.
I know that our public cloud testers already had similar challenges. IIUC they currently use their own setup of "vault" (see 3. in Suggestions). Maybe we could unify this approach and apply it to our whole infrastructure.

Ideas¶

• Support variables with arbitrary commands to access password managers like e.g. keepass (for small, local installations), pass or whatever the user decides to use.
• Support GPG encrypted variables (and an according configuration for a private key for openQA)
• Support common interfaces for software which is specifically designed for such use-cases. E.g. https://www.vaultproject.io/