security: hide service account content from the logs for gce driver #302
Conversation
|
I'm looking at the CI failure. Why not using |
|
I can replace it with no log, but it will make things harder to debug, because driver errors (e.g. bad credentials, etc) are reported in wait job. Async job is always success. The problem here is that this leak is done by the driver, not by user-supplied playbooks. |
|
I'm not sure what's the issue with debug and no_log. The usual trick is to use "{{ molecule_no_log }}". I'll look at this PR again probably next week. btw, did you also reported that to the driver authors ? the answer won't have any influence on this PR. I'm only concerned by the fact of having a known possible security issue unfixed. |
|
My miss, I fixed tests, instead of the driver. Redoing it now. Thanks for "{{ molecule_no_log }}" advise. |
…for GCE When instance is waited for SSH, loop label contains all server data, returned by the driver. One of them is service_account_contents which contains a private key to a GCE service account, used to create VMs in GCE, if GCP_SERVICE_ACCOUNT_CONTENTS environment variable was used.
amarao
force-pushed
the
fix_key_leak_gce
branch
from
03d74c7 to
29b8908
Compare
for more information, see https://pre-commit.ci
|
I redone it, using molecule_no_log, and I still keep 'loop_control/label', because gce module output here is overwhelming and is almost impossible to read. Simple 'name' should be enough for loop label. |
|
I also reported it to the goolge.cloud: ansible-collections/google.cloud#670 They have autogenerated code, so I have no idea how to send patches there. |
In GCE driver, when instance is created using environment variable
GCP_SERVICE_ACCOUNT_CONTENTS(which is json with account metadata AND private key for the service account), GCE module returns it back into 'register' (may be, it's a security bug from them too).GCE driver prints those return data on log in plain text, including private key.
Below there is a screenshot of actual leak (leaked key is shown in red, key is rotated before filing this bug report).