openstack
/
kolla-ansible
Code Issues Proposed changes

Allow fluentd to read barbican-api.log 

Barbican API uses uWSGI, which by default writes out log files using
0640 permissions and default ownership for the user. This means that the
log file in /var/log/kolla/barbican/barbican-api.log is not readable by
fluentd.

This was tested via the following command on a queens deployment:

$ docker exec -it fluentd bash
find /var/log/kolla/ -type f | while read f; do test -r $f || echo
"Cannot read $f"; done
Cannot read /var/log/kolla/barbican/barbican-api.log

Generally there are a few ways in which access is provided to log file
for fluentd:

1. Set log file ownership to $USER:kolla, permissions to 0640.
2. Set log file ownership to $USER:$USER, permissions to 0644.
3. MariaDB is a special case, and uses 0640 with the fluentd user added
to the mysql group.

Of these, 1. seems the most secure.

This change uses the --logfile-chmod argument to set the log file
permissions to 644, since it does not appear possible to specify a group
to change ownership to using --logfile-chown. We use command line
arguments since putting the option in the config file does not seem to
work. Perhaps it is an ordering issue.

Change-Id: If98ca7cd9630b5622132a00718cb09304b8285b3
Closes-Bug: #1794472
(cherry picked from commit 8e635db8f1)
This commit is contained in:
Mark Goddard 2018-09-26 10:08:18 +01:00
parent dca1b68231
commit 70c1a23e76
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ansible/roles/barbican/templates/barbican-api.json.j2
View File

@ -1,5 +1,5 @@
{
"command": "uwsgi --master --emperor /etc/barbican/vassals --logto /var/log/kolla/barbican/barbican-api.log",
"command": "uwsgi --master --emperor /etc/barbican/vassals --logto /var/log/kolla/barbican/barbican-api.log --logfile-chmod 644",
"config_files": [
{
"source": "{{ container_config_directory }}/barbican.conf",