| @harbott.osism.tech:regio.chat | mnasiadka: are you around to have a quick look at https://review.opendev.org/c/openstack/project-config/+/999022/2? otherwise I'd self-approve and trigger a test-run | 12:20 |
|---|---|---|
| -@gerrit:opendev.org- Zuul merged on behalf of Jeremy Stanley https://matrix.to/#/@fungicide:matrix.org: [openstack/project-config] 999022: Don't print GitHub auth responses as exceptions https://review.opendev.org/c/openstack/project-config/+/999022 | 12:45 | |
| @harbott.osism.tech:regio.chat | there is a deprecation warning with ^^, maybe dealing with that could help avoiding leaking tokens in the future: | 13:06 |
| ``` | ||
| /home/zuul/github_manager.py:195: DeprecationWarning: Argument login_or_token is deprecated, please use auth=github.Auth.Token(...) instead | ||
| ``` | ||
| anyway I think we can try with the new token now? https://zuul.opendev.org/t/openstack/build/80f6533cc5934bd69a3a845deeb9e7c3 | ||
| @fungicide:matrix.org | yeah, i also saw the deprecation warning but didn't want to change more than necessary in that patch | 13:14 |
| @fungicide:matrix.org | figured fixing it to use newer args could happen later in a separate change | 13:14 |
| @fungicide:matrix.org | and i agree we should be able to move forward if we get consensus on the replacement token, i know Clark had some concerns about which account we used so i'm happy to wait until he's got his jetlag under control | 13:15 |
| @mnasiadka:matrix.org | Jens Harbott: seems I was late ;) | 13:16 |
| @clarkb:matrix.org | fungi: yes I was hoping that we could use a more "normal" account intended for replication rather than an admin account for this purpose | 14:12 |
| @clarkb:matrix.org | particularly since there was already a previous leak. Limiting the blast radius seems useful there | 14:13 |
| @fungicide:matrix.org | i don't know what would make it more or less normal | 14:13 |
| @fungicide:matrix.org | it needs to be a member of the org with permission to create and alter all the org's repositories | 14:13 |
| @clarkb:matrix.org | fungi: re backup crons it does look like the borg-backup/tasks/main.yaml cron entry only sets entries based on group membership and doesn't know how to remove old entries | 14:14 |
| @fungicide:matrix.org | from what i could see, both the openstack-mirroring account that had been used previously and the openstackadmin one were on equal footing | 14:14 |
| @clarkb:matrix.org | yes I mentioned that during the incident debugging. I think things should be more limited (and discussed that as an option before revoking the token) | 14:15 |
| @clarkb:matrix.org | but also I'm not going to do that for openstack so if this is what openstack wants to do I guess I don't care enough to b lock it | 14:16 |
| @clarkb:matrix.org | but as the person who responded to this issue I think there are some clear improvements that could be made | 14:16 |
| @fungicide:matrix.org | well, the "classic" token i generated is scoped to only repository operations, in retrospect it may actually need additional permissions to close pull requests, i'm not sure | 14:16 |
| @clarkb:matrix.org | it also creates repositories | 14:17 |
| @fungicide:matrix.org | but since the only thing we host at that org is git repositories and the thing we need the token for is managing the git repositories, the blast radius looks like it has to be 100% of what that org is used for anyway | 14:17 |
| @fungicide:matrix.org | yes, the token creates and modifies git repositories as well as closing pull requests, then the ssh key does full mirroring into repositories (including pushing new branches and removing them, pushing tags) | 14:19 |
| @fungicide:matrix.org | i can't think of anything nefarious an actor might do with stolen credentials that isn't already covered by the permissions we need | 14:20 |
| @fungicide:matrix.org | with "classic" tokens you can do some coarse-grained access control, so i limited the one i generated to operations on public git repositories, which includes things like creating them and setting/altering their descriptions, and i **think** also is enough to be able to close pull requests | 14:22 |
| @fungicide:matrix.org | they also have a newer fine-grained token option, but that's for setting project-specific permissions mainly | 14:23 |
| @clarkb:matrix.org | ya I'm not sure what if anything could be done. But if people don't realize that org is used as a mirror and the account is simply there to facilitate that could it take actions in github that are problematic in other contexts? | 14:23 |
| @fungicide:matrix.org | you're not supposed to be able to take control of an account with that token or the ssh key, and the token doesn't have access to e.g. set up wikis and discussions and whatever other github features exist (it can but those have to be enabled at token creation and they're disallowed by default) | 14:25 |
| @clarkb:matrix.org | got it | 14:25 |
| @harbott.osism.tech:regio.chat | ok, are we ready to proceed with https://review.opendev.org/c/openstack/project-config/+/999019 then? I triggered a test run earlier and it seems fine to me | 15:11 |
| @harbott.osism.tech:regio.chat | also please check https://review.opendev.org/c/openstack/project-config/+/995781 for yet another zuul config error removed | 15:12 |
| @clarkb:matrix.org | Jens Harbott: yes that is why I +1'd and didn't -1 or -2 | 15:13 |
| @clarkb:matrix.org | I think its ok. I just wanted to call out the concerns and now that we've discussed them if we want to proceed I think that is fine | 15:13 |
| @fungicide:matrix.org | arnaudm: in case you missed my comment earlier, yesterday ovh sent us a notice that we have an invoice pending payment for `PublicCloudProject: 8bbdc6f25ee94568baea4e872f032f14 (openstackci)` with invoice id `FR79702243` (i haven't received warnings about our other project yet, and can't recall whether both vouchers typically expire at the same time) | 15:14 |
| @harbott.osism.tech:regio.chat | arnaudm: ^^ (just in case the formatted highlight works better) | 15:16 |
| @fungicide:matrix.org | thanks, i didn't realize my matrix client's tab-completion wasn't formatting | 15:16 |
| @clarkb:matrix.org | fungi: I left a comment on https://review.opendev.org/c/opendev/system-config/+/999465 about borg compaction | 15:16 |
| @harbott.osism.tech:regio.chat | also as a curiosity note: nova has managed to have unit tests that fail only on nested-virt nodes, which is why this wasn't detected in the usual CI, cf. https://review.opendev.org/c/openstack/nova/+/999729 | 15:18 |
| @clarkb:matrix.org | neat I wonder what that will find | 15:18 |
| @clarkb:matrix.org | as a general heads up I've got a morning full of meetings and am also working through local system updates today. Ping me if there are things I should be looking at, but for the most part I'm trying to catch up so I've more useful later this week | 15:19 |
| -@gerrit:opendev.org- Zuul merged on behalf of Jeremy Stanley https://matrix.to/#/@fungicide:matrix.org: [openstack/project-config] 999019: Update GitHub mirroring credentials for OpenStack https://review.opendev.org/c/openstack/project-config/+/999019 | 15:21 | |
| @mnasiadka:matrix.org | Jens Harbott, fungi: Trying to automate some of the Kolla images bumps - does any of you have the will to review https://review.opendev.org/c/openstack/project-config/+/998419 ? | 17:37 |
| @fungicide:matrix.org | okay, i need to disappear for a bit, but may merge the anubis upgrade when i get back in an hour or two | 19:52 |
| @fungicide:matrix.org | i'm back, but thinking i don't want to approve the anubis upgrade this late in my day since i don't want to stick around long enough for the gitea job to run in the gate | 21:42 |
| @clarkb:matrix.org | ack wfm | 21:47 |
| @clarkb:matrix.org | I'm still elbow deep in local network updates. I upgraded the system and have converted firewall rules to the new rule management system. Converted NAT rules and am finishing up a conversion to Kea dhcpd | 21:48 |
| @clarkb:matrix.org | so far things have mostly worked which is nice. The only hiccup was when my desktop decided it needed a new lease in the period of time between disabling isc dhcp and enabling kea dhcp. But statically configuring an IP solved that | 21:48 |
| @clarkb:matrix.org | hoping that if I rip the bandaid off on a bunch of this right now I can avoid issues in the future requiring a bunch of work | 21:49 |
| @clarkb:matrix.org | I should be converting from apparmor to selinux on the desktop shortly | 21:49 |
| @fungicide:matrix.org | good luck! if we don't hear from you again before next week, we'll send help | 21:50 |
| @clarkb:matrix.org | I think its working. sestatus says it is enforcing and I've been able to run firefox and chrome | 22:10 |
| @fungicide:matrix.org | congrats! you have successfully selinuxed your apparmor | 22:14 |
| @clarkb:matrix.org | I just responded to starlingx about the Zuul tenant work: https://lists.starlingx.io/archives/list/starlingx-discuss@lists.starlingx.io/thread/YQVACUR4OCX74ZULHAJ4AD44MHGY37YI/ | 22:20 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!