Project

General

Profile

Actions
Copy link

coordination #105624

open

[saga][epic] Reconsider how openQA handles secrets

Added by nicksinger over 2 years ago. Updated 7 days ago.

Status:
New
Priority:
High
Assignee:
-
Category:
Feature requests
Target version:
QA - future
Start date:
2022-01-25
Due date:
2024-04-20 (12 days late)
% Done:

67%

Estimated time:
(Total: 0.00 h)

Description

Motivation

In the ongoing effort to improve our security we introduced things like e.g. https://github.com/os-autoinst/os-autoinst/pull/1909 which is a necessary step to improve how we handle passwords/secrets.
I'd like to see that openQA also supports accessing passwords over different channels which are specifically designed to store secrets.
I know that our public cloud testers already had similar challenges. IIUC they currently use their own setup of "vault" (see 3. in Suggestions). Maybe we could unify this approach and apply it to our whole infrastructure.

Ideas

  • Support variables with arbitrary commands to access password managers like e.g. keepass (for small, local installations), pass or whatever the user decides to use.
  • Support GPG encrypted variables (and an according configuration for a private key for openQA)
  • Support common interfaces for software which is specifically designed for such use-cases. E.g. https://www.vaultproject.io/

Subtasks 16 (8 open — 8 closed)

openQA Infrastructure - action #106365: Improve security for OSD worker credentials broke Gitlab CI/CD deploy of salt in OSD size:MResolvednicksinger2022-01-25

Actions
openQA Infrastructure - action #106925: [timeboxed:10h][research] What are best practices and options in the salt and GitLab community to handle secretsResolvedjbaier_cz2022-02-16

Actions
action #110227: Stop showing ipmi passwords in autoinst.txt from a ipmi backend job in O3Resolved2022-04-24

Actions
coordination #157537: [epic] Secure setup of openQA test machines with secure network+secure authenticationBlockedokurz2024-03-182024-04-20

Actions
openQA Infrastructure - action #157468: Handle internal test machines with compromised root password size:MResolvedokurz2024-03-18

Actions
openQA Tests - action #157555: [spike][timeboxed:10h][qe-core] Use a different ssh root password for s390x kvm installation openQA jobs (or svirt) size:SWorkable

Actions
openQA Tests - action #157744: [spike][timeboxed:10h][qe-core] Use ssh key authentication in particular for s390x kvm installation openQA jobsWorkable2024-03-22

Actions
openQA Infrastructure - action #157750: Better secure the networks to have s390kvm… (and others) less accessibleBlockedokurz2024-03-22

Actions
openQA Infrastructure - action #158242: Prevent ssh access to test VMs on svirt hypervisor hosts with firewall size:MRejecteddheidler2024-03-282024-04-20

Actions
action #158455: [spike][timeboxed:10h] openQA worker native on s390xResolvedokurz2024-03-28

Actions
action #158628: Prevent passwords being logged in s390x kvm test casesResolvedokurz2024-04-08

Actions
action #158985: openQA worker native on s390xResolvedokurz

Actions
openQA Infrastructure - action #159063: s390x qemu backend host within SUSE networksBlockedokurz2024-04-16

Actions
openQA Infrastructure - action #159066: network-level firewall preventing direct ssh+vnc access to openQA test VMs size:MBlockednicksinger2024-03-28

Actions
openQA Infrastructure - action #159069: network-level firewall preventing direct ssh+vnc access to all machines within the oqa.prg2.suse.org network if neededBlockedokurz2024-03-28

Actions
action #159621: Make tests work with native openQA worker s390x qemu size:MWorkable

Actions

Related issues 1 (0 open — 1 closed)

Related to openQA Project - action #104751: Extend "_SECRET_" variable handling to os-autoinst backend password variablesResolvedokurz2022-01-102022-01-24

Actions
Actions
Copy link

Also available in: Atom PDF