Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow datastore key to be populated from a variable. #280

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Allow datastore key to be populated from a variable. #280

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
850e7ba
Allow datastore key to be populated from a variable.
nmaludy Dec 22, 2020
e6f67a1
Restart stackstorm services after changing encryption key
nmaludy Dec 23, 2020
4b658a7
Merge branch 'master' into feature/datastore-keys
nmaludy Dec 23, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ Below is the list of variables you can redefine in your playbook to customize st
| `st2_auth_username` | `testu` | Username used by StackStorm standalone authentication.
| `st2_auth_password` | `testp` | Password used by StackStorm standalone authentication.
| `st2_save_credentials` | `yes` | Save credentials for local CLI in `/root/.st2/config` file.
| `st2_datastore_key` | `null` | String for the datastore key file contents. This is useful if you're deploying StackStorm to multiple nodes and they need to share the same datastore key. By default, this variable is undefined and a new random key will be generated for each node.
| `st2_packs` | `[ st2 ]` | List of packs to install. This flag does not work with a `--python3` only pack.
| **st2web**
| `st2web_ssl_certificate` | `null` | String with custom SSL certificate (`.crt`). If not provided, self-signed certificate will be generated.
Expand Down
5 changes: 5 additions & 0 deletions roles/StackStorm.st2/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,11 @@ st2_auth_username: testu
st2_auth_password: testp
# Save credentials in ~/.st2/config file
st2_save_credentials: yes
# The string contents of the datastore key file. If you need to distribute the same key
# to multiple StackStorm nodes, generate a datastore key and populate this variable
# when installing on each of the ndoes.
# Example: '{"hmacKey": {"hmacKeyString": "xxx", "size": 256}, "aesKeyString": "yyy", "mode": "CBC", "size": 256}'
st2_datastore_key: null
# ST2 packs to be installed (list)
st2_packs:
- st2
8 changes: 8 additions & 0 deletions roles/StackStorm.st2/tasks/datastore.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,14 @@
command: st2-generate-symmetric-crypto-key --key-path {{ st2_datastore_key_file }}
args:
creates: "{{ st2_datastore_key_file }}"
when: not st2_datastore_key

- name: Copy st2 encryption key
become: yes
copy:
content: "{{ st2_datastore_key }}"
dest: "{{ st2_datastore_key_file }}"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When the content of the file changes we'll need to notify st2 to restart the services.
According to code below it's st2api, but I guess that's incomplete as more StackStorm services might be using the crypto key.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@armab added a restart to all of the st2 services

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Restarting all the st2 services is impractical here. We need only specific services that are using st2 datastore key.
Can you please figure out which may use it?

when: st2_datastore_key

- name: Fix permissions on datastore encryption key
become: yes
Expand Down