Don't send galera root credentials file to compute hosts

[Logan V]

When galera_client runs against compute nodes, a ~/.my.cnf file is copied to the compute node with root credentials to the galera cluster. Is there a reason this needs to occur? On my compute nodes I have nova, cinder, and neutron-dhcp-agent running. Of these only cinder utilizes a database connection and it has its own 'cinder' user so it makes no use of the root login.

It seems prudent to filter this file from being sent anywhere it may not be needed. Compute hosts are an obvious candidate for this filtering.

[Jesse Pretorius (jesse-pretorius)]

This has already been identified and although we had hoped to do the work to reduce the .my.cnf configuration distribution for Liberty, it has slipped into the Mitaka development cycle. More details here: http://specs.openstack.org/openstack/openstack-ansible-specs/specs/mitaka/limit-mysql-config-distribution.html

We welcome more hands on deck for getting this done if you're able to do so!

[Major Hayden (rackerhacker)]

I'm going on the assumption that only the galera server containers need these .my.cnf files. I don't really see a need to add it to every container that has the galera_client role applied.

Am I right on this assumption?

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/241382

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/241382
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible/commit/?id=e0d58a99debd017ec063b71f290c373892f8b0a3
Submitter: Jenkins
Branch: master

commit e0d58a99debd017ec063b71f290c373892f8b0a3
Author: Major Hayden <email address hidden>
Date: Tue Nov 3 19:44:56 2015 -0600

    Only deploy .my.cnf file on galera/utility containers

    The original bug was opened because .my.cnf (with sensitive root credentials)
    was being deployed on compute hosts without needing to be there. This patch
    restricts the deployment of .my.cnf files to the galera/utility containers
    only. This improves security while still allowing deployers to diagnose galera
    server issues on the galera server containers themselves, and to access the
    database from the utility containers for diagnostic purposes.

    Closes-bug: 1510596
    Implements: blueprint limit-mysql-config-distribution
    Change-Id: I42f39cbfcb02b97846894592d642ac0c58a82b02

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/253122
Committed: https://git.openstack.org/cgit/openstack/openstack-ansible/commit/?id=f530301fbfe76bf12679f80f7db9377a25dc3f2c
Submitter: Jenkins
Branch: liberty

commit f530301fbfe76bf12679f80f7db9377a25dc3f2c
Author: Major Hayden <email address hidden>
Date: Tue Nov 3 19:44:56 2015 -0600

    Only deploy .my.cnf file on galera/utility containers

    The original bug was opened because .my.cnf (with sensitive root credentials)
    was being deployed on compute hosts without needing to be there. This patch
    restricts the deployment of .my.cnf files to the galera/utility containers
    only. This improves security while still allowing deployers to diagnose galera
    server issues on the galera server containers themselves, and to access the
    database from the utility containers for diagnostic purposes.

    Closes-bug: 1510596
    Implements: blueprint limit-mysql-config-distribution
    Change-Id: I42f39cbfcb02b97846894592d642ac0c58a82b02
    (cherry picked from commit e0d58a99debd017ec063b71f290c373892f8b0a3)

[Davanum Srinivas (DIMS) (dims-v)]

This issue was fixed in the openstack/openstack-ansible 13.0.0 release.

[Davanum Srinivas (DIMS) (dims-v)]

This issue was fixed in the openstack/openstack-ansible 12.0.11 release.