diff options
| -rw-r--r-- | .ansible-lint | 2 | ||||
| -rw-r--r-- | ansible/roles/certificates/tasks/generate-backend.yml | 6 | ||||
| -rw-r--r-- | ansible/roles/hacluster/tasks/bootstrap.yml | 1 | ||||
| -rw-r--r-- | ansible/roles/mariadb/tasks/recover_cluster.yml | 1 | ||||
| -rw-r--r-- | ansible/roles/octavia-certificates/tasks/main.yml | 2 | ||||
| -rw-r--r-- | ansible/roles/octavia/tasks/hm-interface.yml | 1 | ||||
| -rw-r--r-- | tools/setup-compute-libvirt.yml | 1 |
7 files changed, 10 insertions, 4 deletions
diff --git a/.ansible-lint b/.ansible-lint index 5c0c0640a..3efb5cc57 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -35,6 +35,4 @@ skip_list: # TODO(frickler): Discuss these in detail, skipping for now to unblock things - name[play] - var-naming[no-role-prefix] - - risky-file-permissions - - risky-shell-pipe - yaml[line-length] diff --git a/ansible/roles/certificates/tasks/generate-backend.yml b/ansible/roles/certificates/tasks/generate-backend.yml index 8b9b0600c..4c33f6eb8 100644 --- a/ansible/roles/certificates/tasks/generate-backend.yml +++ b/ansible/roles/certificates/tasks/generate-backend.yml @@ -69,8 +69,9 @@ copy: src: "{{ item.src }}" dest: "{{ item.dest }}" + mode: "0600" remote_src: true - with_items: + loop: - src: "{{ kolla_tls_backend_cert }}" dest: "{{ kolla_certificates_dir }}/rabbitmq-cert.pem" - src: "{{ kolla_tls_backend_key }}" @@ -82,11 +83,12 @@ copy: src: "{{ item.src }}" dest: "{{ item.dest }}" - mode: "0660" + mode: "{{ item.mode | default('0600') }}" remote_src: true with_items: - src: "{{ kolla_tls_backend_cert }}" dest: "{{ kolla_certificates_dir }}/mariadb-cert.pem" + mode: "0644" - src: "{{ kolla_tls_backend_key }}" dest: "{{ kolla_certificates_dir }}/mariadb-key.pem" when: diff --git a/ansible/roles/hacluster/tasks/bootstrap.yml b/ansible/roles/hacluster/tasks/bootstrap.yml index d1fb59fed..9d788e3ec 100644 --- a/ansible/roles/hacluster/tasks/bootstrap.yml +++ b/ansible/roles/hacluster/tasks/bootstrap.yml @@ -2,6 +2,7 @@ - name: Ensure config directories exist file: path: "{{ node_custom_config }}/{{ item }}" + mode: "0755" state: directory delegate_to: localhost changed_when: false diff --git a/ansible/roles/mariadb/tasks/recover_cluster.yml b/ansible/roles/mariadb/tasks/recover_cluster.yml index 0f1f0f9de..4bbaf5c25 100644 --- a/ansible/roles/mariadb/tasks/recover_cluster.yml +++ b/ansible/roles/mariadb/tasks/recover_cluster.yml @@ -104,6 +104,7 @@ lineinfile: create: true dest: "{{ container_engine_volumes_path }}/mariadb/_data/grastate.dat" + mode: "0660" regexp: "safe_to_bootstrap:(.*)$" line: "safe_to_bootstrap: 1" state: present diff --git a/ansible/roles/octavia-certificates/tasks/main.yml b/ansible/roles/octavia-certificates/tasks/main.yml index ee2fb5466..be0288787 100644 --- a/ansible/roles/octavia-certificates/tasks/main.yml +++ b/ansible/roles/octavia-certificates/tasks/main.yml @@ -26,6 +26,7 @@ copy: src: "{{ octavia_certs_openssl_cnf_path }}" dest: "{{ octavia_certs_work_dir }}/openssl.cnf" + mode: "0600" - import_tasks: server_ca.yml @@ -43,6 +44,7 @@ copy: src: "{{ octavia_certs_work_dir }}/{{ item.src }}" dest: "{{ node_custom_config }}/octavia/{{ item.dest }}" + mode: "0600" with_items: - { src: "server_ca/server_ca.cert.pem", dest: "server_ca.cert.pem" } - { src: "server_ca/server_ca.key.pem", dest: "server_ca.key.pem" } diff --git a/ansible/roles/octavia/tasks/hm-interface.yml b/ansible/roles/octavia/tasks/hm-interface.yml index 279261957..7b9bff9cc 100644 --- a/ansible/roles/octavia/tasks/hm-interface.yml +++ b/ansible/roles/octavia/tasks/hm-interface.yml @@ -66,6 +66,7 @@ template: src: octavia-interface.service.j2 dest: /etc/systemd/system/octavia-interface.service + mode: "0644" register: octavia_interface - name: Restart octavia-interface.service if required diff --git a/tools/setup-compute-libvirt.yml b/tools/setup-compute-libvirt.yml index d544d2626..ea3f677d9 100644 --- a/tools/setup-compute-libvirt.yml +++ b/tools/setup-compute-libvirt.yml @@ -14,6 +14,7 @@ copy: src: "{{ item }}" dest: "/usr/lib/systemd/system/{{ item }}" + mode: "0644" with_items: "{{ systemd_artifacts }}" - name: Enable/start systemd artifacts |