From e566fbf6de9b306be8b5c895f2ed091c0bca8bc5 Mon Sep 17 00:00:00 2001 From: Michal Nasiadka Date: Tue, 2 Sep 2025 19:00:30 +0200 Subject: docs: Add information about possible password leaking Closes-Bug: #2120302 Change-Id: Ideb7974796ba503a2ac979a321b9c6f27c7c22a1 Signed-off-by: Michal Nasiadka --- doc/source/admin/production-architecture-guide.rst | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'doc/source/admin') diff --git a/doc/source/admin/production-architecture-guide.rst b/doc/source/admin/production-architecture-guide.rst index d1da7eaad..ced3571fa 100644 --- a/doc/source/admin/production-architecture-guide.rst +++ b/doc/source/admin/production-architecture-guide.rst @@ -14,6 +14,8 @@ Node types and services running on them A basic Kolla inventory consists of several types of nodes, known in Ansible as ``groups``. +* Deployment - Host from which you're running kolla-ansible CLI + * Control - Cloud controller nodes which host control services like APIs and databases. This group should have odd number of nodes for quorum. @@ -29,6 +31,14 @@ A basic Kolla inventory consists of several types of nodes, known in Ansible as * Monitoring - Monitor nodes which host monitoring services. +.. warning:: + + All hosts should be hardened and access to them should be limited, + because Ansible can leak administrative passwords and other secrets to + system log. The same leaked passwords can be observed in OpenSearch if + you're pushing your system logs there. + + Network configuration ~~~~~~~~~~~~~~~~~~~~~ -- cgit v1.2.3