Volans has submitted this change and it was merged. (
https://gerrit.wikimedia.org/r/379192 )
Change subject: WMCS: fix Cumin configuration
......................................................................
WMCS: fix Cumin configuration
* Move the SSH options to a dedicated ssh_config file. This allows also
to have the same options to silent the known hosts for the
ProxyCommand too.
* Remove the no-port-forwarding limitation in the userkey on the proxy
instances.
* Add an example alias
Bug: T175712
Change-Id: I4b866ea49e26b5aaeb550a8a123cec60a0861dca
---
A modules/profile/files/openstack/main/cumin/ssh_config
M modules/profile/manifests/openstack/main/cumin/master.pp
M modules/profile/templates/openstack/main/cumin/aliases.yaml.erb
M modules/profile/templates/openstack/main/cumin/config.yaml.erb
M modules/profile/templates/openstack/main/cumin/userkey.erb
5 files changed, 29 insertions(+), 9 deletions(-)
Approvals:
Muehlenhoff: Looks good to me, but someone else must approve
jenkins-bot: Verified
Volans: Looks good to me, approved
diff --git a/modules/profile/files/openstack/main/cumin/ssh_config
b/modules/profile/files/openstack/main/cumin/ssh_config
new file mode 100644
index 0000000..0ee3a89
--- /dev/null
+++ b/modules/profile/files/openstack/main/cumin/ssh_config
@@ -0,0 +1,13 @@
+# WMCS Bastions
+Host bastion-restricted.wmflabs.org bastion-restricted-??.bastion.eqiad.wmflabs
+ ProxyCommand none
+
+# WMCS Instances
+Host *
+ BatchMode yes
+ ConnectTimeout 2
+ StrictHostKeyChecking no
+ UserKnownHostsFile /dev/null
+ GlobalKnownHostsFile /dev/null
+ LogLevel QUIET
+ ProxyCommand ssh -a -W %h:%p bastion-restricted.wmflabs.org
diff --git a/modules/profile/manifests/openstack/main/cumin/master.pp
b/modules/profile/manifests/openstack/main/cumin/master.pp
index 78a6997..8bc8db0 100644
--- a/modules/profile/manifests/openstack/main/cumin/master.pp
+++ b/modules/profile/manifests/openstack/main/cumin/master.pp
@@ -12,7 +12,10 @@
require_package('cumin')
- $cumin_log_path = '/var/log/cumin' # Used also in config.yaml
+ # Variables used also in config.yaml
+ $cumin_log_path = '/var/log/cumin'
+ $ssh_config_path = '/etc/cumin/ssh_config'
+
file { $cumin_log_path:
ensure => directory,
owner => 'root',
@@ -44,4 +47,13 @@
content =>
template('profile/openstack/main/cumin/aliases.yaml.erb'),
require => File['/etc/cumin'],
}
+
+ file { $ssh_config_path:
+ ensure => present,
+ owner => 'root',
+ group => 'root',
+ mode => '0640',
+ source =>
'puppet:///modules/profile/openstack/main/cumin/ssh_config',
+ require => File['/etc/cumin'],
+ }
}
diff --git a/modules/profile/templates/openstack/main/cumin/aliases.yaml.erb
b/modules/profile/templates/openstack/main/cumin/aliases.yaml.erb
index 16dfd67..48626a7 100644
--- a/modules/profile/templates/openstack/main/cumin/aliases.yaml.erb
+++ b/modules/profile/templates/openstack/main/cumin/aliases.yaml.erb
@@ -1,2 +1,3 @@
# Cumin aliases, in the form:
# key: query_using_the_global_grammar
+all: O{*}
diff --git a/modules/profile/templates/openstack/main/cumin/config.yaml.erb
b/modules/profile/templates/openstack/main/cumin/config.yaml.erb
index 8f10aa2..34bce5f 100644
--- a/modules/profile/templates/openstack/main/cumin/config.yaml.erb
+++ b/modules/profile/templates/openstack/main/cumin/config.yaml.erb
@@ -7,13 +7,7 @@
clustershell:
ssh_options:
- - '-o BatchMode=yes'
- - '-o ConnectTimeout=2'
- - '-o StrictHostKeyChecking=no'
- - '-o UserKnownHostsFile=/dev/null'
- - '-o GlobalKnownHostsFile=/dev/null'
- - '-o LogLevel=QUIET'
- - '-o ProxyCommand="ssh -a -W %h:%p bastion-restricted.wmflabs.org"'
+ - '-F <%= @ssh_config_path %>'
openstack:
auth_url: <%= @keystone_protocol %>://<%= @keystone_host %>:<%=
@keystone_port %>
diff --git a/modules/profile/templates/openstack/main/cumin/userkey.erb
b/modules/profile/templates/openstack/main/cumin/userkey.erb
index 288a6d4..160a802 100644
--- a/modules/profile/templates/openstack/main/cumin/userkey.erb
+++ b/modules/profile/templates/openstack/main/cumin/userkey.erb
@@ -1,2 +1,2 @@
# Cumin Masters. TODO: use 'restrict' once available across the fleet (>
jessie)
-from="<%= @ssh_authorized_sources
%>",no-agent-forwarding,no-port-forwarding,no-x11-forwarding,no-user-rc <%=
@cumin_master_pub_key %>
+from="<%= @ssh_authorized_sources %>",no-agent-forwarding,<% if
@cumin_auth_group == 'cumin_masters' %>no-port-forwarding,<% end
%>no-x11-forwarding,no-user-rc <%= @cumin_master_pub_key %>
--
To view, visit https://gerrit.wikimedia.org/r/379192
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I4b866ea49e26b5aaeb550a8a123cec60a0861dca
Gerrit-PatchSet: 2
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Volans <[email protected]>
Gerrit-Reviewer: Andrew Bogott <[email protected]>
Gerrit-Reviewer: BryanDavis <[email protected]>
Gerrit-Reviewer: Chasemp <[email protected]>
Gerrit-Reviewer: Madhuvishy <[email protected]>
Gerrit-Reviewer: Muehlenhoff <[email protected]>
Gerrit-Reviewer: Volans <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
