)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":8833,"name":"Rabi Mishra","email":"ramishra@redhat.com","username":"rabi"},"change_message_id":"2f919a78ae5a33c866863df691a514f3e5c76813","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"6d2b8730_882f1d2b","updated":"2022-09-28 04:30:48.000000000","message":"This seems orthogonal to all the changes around permissions. Are these playbooks/roles running with a different user?","commit_id":"5fb4636dccd18128d4470fb1da768645efdd3f65"},{"author":{"_account_id":25402,"name":"Francesco Pantano","email":"fpantano@redhat.com","username":"fmount"},"change_message_id":"2f7586d8a8b7156098b0faef3aa2e5b23d55a462","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"e85a6e18_77051cda","in_reply_to":"6d2b8730_882f1d2b","updated":"2022-09-28 06:06:47.000000000","message":"Everything owned by 42430 except ceph-ansible which is \"tripleo-admin:root\", and files set the ownership to {{ ansible_user }} (it would be the same w/o forcing the ownership given it creates them).\nThe symlink failure was also an issue with the tripleo-inventory in the {{ playbook_dir }}.\n\n\n[root@undercloud-0 config-download-latest]# ll\ntotal 1988\n-rw-r--r--. 1         42430 42430   2258 Sep 27 07:37 ansible.cfg\n-rw-r-----. 1         42430 42430   1124 Sep 27 07:42 ansible-errors.json\n-rw-r-----. 1         42430 42430 982847 Sep 27 07:42 ansible.log\n-rwxr-x---. 1         42430 42430    801 Sep 27 07:37 ansible-playbook-command.sh\ndrwx------. 2         42430 42430      6 Sep 27 08:12 ansible-ssh\ndrwxrwx---. 2         42430 42430   4096 Sep 27 07:37 BlockStorage\ndrwxr-xr-x. 5 tripleo-admin root      58 Sep 27 07:42 ceph-ansible\ndrwxrwx---. 5         42430 42430   4096 Sep 27 07:37 CephStorage\n-rw-rw----. 1         42430 42430    547 Sep 27 07:37 common_container_config_scripts.yaml\n-rw-rw----. 1         42430 42430   3198 Sep 27 07:37 common_deploy_steps_playbooks.yaml\n-rw-rw----. 1         42430 42430  11176 Sep 27 07:37 common_deploy_steps_tasks_step_1.yaml\n-rw-rw----. 1         42430 42430   9235 Sep 27 07:37 common_deploy_steps_tasks.yaml\n...\n...\n\n\n[root@undercloud-0 mistral]# ll\ntotal 8\nlrwxrwxrwx.  1 42430 42430   26 Sep 27 09:04 config-download-latest -\u003e /var/lib/mistral/overcloud\ndrwxrwx---. 14 42430 42430 4096 Sep 27 09:05 overcloud\n-r--r--r--.  1 42430 42430 1065 Sep 27 06:49 undercloud.conf\n\nThe symlink to the inventory is created via [1][2], and this is just a regular tripleo-ansible task\nexecuted (it\u0027s not yet the ceph-ansible nested execution).\n\n\nGiven this approach is orthogonal to the proposed approach in tripleo, do you have any suggestion on how this problem can be solved?\n\n[1] https://github.com/openstack/tripleo-ansible/blob/stable/train/tripleo_ansible/roles/tripleo-ceph-work-dir/tasks/prepare.yml#L29\n[2] https://github.com/openstack/tripleo-heat-templates/blob/stable/train/deployment/ceph-ansible/ceph-base.yaml#L703","commit_id":"5fb4636dccd18128d4470fb1da768645efdd3f65"},{"author":{"_account_id":8833,"name":"Rabi Mishra","email":"ramishra@redhat.com","username":"rabi"},"change_message_id":"cc8e7782034c78980c02e0f68d204bdd3c0e01d2","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"0953074e_2c21e91e","updated":"2022-09-28 07:02:35.000000000","message":"\u003e Given this approach is orthogonal to the proposed approach in tripleo, do you have any suggestion on how this problem can be solved?\n\n42430 is mistral user. The fact that we use tripleo-admin (ansible_ssh_user) in these external_deploy_tasks running on the undercloud to create the ceph-ansible execution environment in /var/lib/mistral, I don\u0027t know if there is a better approach for train other than escalating privileges. Though it\u0027s weird to have a nested directory owned by a different user. ","commit_id":"dbb4f10084fce99a8271dcb66fa9b8003be63764"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"07a6b1baebe83c344af9243402fe91ce821859ad","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"9810b1f2_876bf2e5","updated":"2022-09-28 07:21:24.000000000","message":"Sorry I was checking the original pach in a deployment without Ceph and I totally missed the change affects ceph deployment...\n\nThe overall change looks good but allow me to vote -1 because of the too-wide permission of the group var file which contains ceph key. I\u0027ve went through the other copy/file resources but seems there are no other sensitive files but we might want to ensure we drop permissions from the managed files.","commit_id":"dbb4f10084fce99a8271dcb66fa9b8003be63764"},{"author":{"_account_id":18002,"name":"John Fulton","email":"fulton@redhat.com","username":"fultonj"},"change_message_id":"e82442566524eb9fe5891363b82e2226854af59c","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"6c966cb3_ab6955a5","in_reply_to":"0953074e_2c21e91e","updated":"2022-09-28 12:47:34.000000000","message":"Yeah, it came from when Mistral used to run ansible in Pike+. In Wallaby that weirdness was removed when config-download was moved to /home/stack.","commit_id":"dbb4f10084fce99a8271dcb66fa9b8003be63764"}],"tripleo_ansible/roles/tripleo-ceph-run-ansible/tasks/create_ceph_ansible_remote_tmp.yml":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"07a6b1baebe83c344af9243402fe91ce821859ad","unresolved":true,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"- name: generate create_ceph_ansible_remote_tmp playbook"},{"line_number":18,"context_line":"  become: true"},{"line_number":19,"context_line":"  copy:"},{"line_number":20,"context_line":"    dest: \"{{ playbook_dir }}/ceph-ansible/create_ceph_ansible_remote_tmp.yml\""},{"line_number":21,"context_line":"    content: |"},{"line_number":22,"context_line":"      - hosts: all"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"7893403d_66fc7f50","line":19,"updated":"2022-09-28 07:21:24.000000000","message":"(nit. Maybe we can ignore this)\nCan we use 0640 instead ?","commit_id":"dbb4f10084fce99a8271dcb66fa9b8003be63764"},{"author":{"_account_id":25402,"name":"Francesco Pantano","email":"fpantano@redhat.com","username":"fmount"},"change_message_id":"5203b6dd695b15aae97ba330620fcab2fb407b8f","unresolved":false,"context_lines":[{"line_number":16,"context_line":""},{"line_number":17,"context_line":"- name: generate create_ceph_ansible_remote_tmp playbook"},{"line_number":18,"context_line":"  become: true"},{"line_number":19,"context_line":"  copy:"},{"line_number":20,"context_line":"    dest: \"{{ playbook_dir }}/ceph-ansible/create_ceph_ansible_remote_tmp.yml\""},{"line_number":21,"context_line":"    content: |"},{"line_number":22,"context_line":"      - hosts: all"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"5ccb2d04_587b1fda","line":19,"in_reply_to":"7893403d_66fc7f50","updated":"2022-09-28 08:30:45.000000000","message":"Done","commit_id":"dbb4f10084fce99a8271dcb66fa9b8003be63764"}],"tripleo_ansible/roles/tripleo-ceph-run-ansible/tasks/main.yml":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"07a6b1baebe83c344af9243402fe91ce821859ad","unresolved":true,"context_lines":[{"line_number":81,"context_line":"  become: true"},{"line_number":82,"context_line":"  copy:"},{"line_number":83,"context_line":"    dest: \"{{ playbook_dir }}/ceph-ansible/ceph_ansible_command.sh\""},{"line_number":84,"context_line":"    mode: \u00270755\u0027"},{"line_number":85,"context_line":"    content: |"},{"line_number":86,"context_line":"      #!/usr/bin/env bash"},{"line_number":87,"context_line":"      set -e"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"54428b6c_38f8ee26","line":84,"range":{"start_line":84,"start_character":11,"end_line":84,"end_character":15},"updated":"2022-09-28 07:21:24.000000000","message":"(nit. Maybe we can ignore this)\nCan we use 0750 instead ?","commit_id":"dbb4f10084fce99a8271dcb66fa9b8003be63764"},{"author":{"_account_id":25402,"name":"Francesco Pantano","email":"fpantano@redhat.com","username":"fmount"},"change_message_id":"5203b6dd695b15aae97ba330620fcab2fb407b8f","unresolved":false,"context_lines":[{"line_number":81,"context_line":"  become: true"},{"line_number":82,"context_line":"  copy:"},{"line_number":83,"context_line":"    dest: \"{{ playbook_dir }}/ceph-ansible/ceph_ansible_command.sh\""},{"line_number":84,"context_line":"    mode: \u00270755\u0027"},{"line_number":85,"context_line":"    content: |"},{"line_number":86,"context_line":"      #!/usr/bin/env bash"},{"line_number":87,"context_line":"      set -e"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"b4eaccd7_a6a29eed","line":84,"range":{"start_line":84,"start_character":11,"end_line":84,"end_character":15},"in_reply_to":"54428b6c_38f8ee26","updated":"2022-09-28 08:30:45.000000000","message":"Done","commit_id":"dbb4f10084fce99a8271dcb66fa9b8003be63764"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"07a6b1baebe83c344af9243402fe91ce821859ad","unresolved":true,"context_lines":[{"line_number":105,"context_line":"      become: true"},{"line_number":106,"context_line":"      copy:"},{"line_number":107,"context_line":"        dest: \"{{ ceph_prefix + item + ceph_suffix }}\""},{"line_number":108,"context_line":"        mode: \u00270755\u0027"},{"line_number":109,"context_line":"        content: |"},{"line_number":110,"context_line":"          #!/usr/bin/env bash"},{"line_number":111,"context_line":"          set -e"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"d5e8b68b_162b29e6","line":108,"range":{"start_line":108,"start_character":15,"end_line":108,"end_character":19},"updated":"2022-09-28 07:21:24.000000000","message":"(nit. Maybe we can ignore this)\nCan we use 0750 instead ?","commit_id":"dbb4f10084fce99a8271dcb66fa9b8003be63764"},{"author":{"_account_id":25402,"name":"Francesco Pantano","email":"fpantano@redhat.com","username":"fmount"},"change_message_id":"5203b6dd695b15aae97ba330620fcab2fb407b8f","unresolved":false,"context_lines":[{"line_number":105,"context_line":"      become: true"},{"line_number":106,"context_line":"      copy:"},{"line_number":107,"context_line":"        dest: \"{{ ceph_prefix + item + ceph_suffix }}\""},{"line_number":108,"context_line":"        mode: \u00270755\u0027"},{"line_number":109,"context_line":"        content: |"},{"line_number":110,"context_line":"          #!/usr/bin/env bash"},{"line_number":111,"context_line":"          set -e"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"b4c2332b_50558276","line":108,"range":{"start_line":108,"start_character":15,"end_line":108,"end_character":19},"in_reply_to":"d5e8b68b_162b29e6","updated":"2022-09-28 08:30:45.000000000","message":"Done","commit_id":"dbb4f10084fce99a8271dcb66fa9b8003be63764"}],"tripleo_ansible/roles/tripleo-ceph-uuid/tasks/prepare.yml":[{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"07a6b1baebe83c344af9243402fe91ce821859ad","unresolved":true,"context_lines":[{"line_number":46,"context_line":"                # the node specific data we\u0027ll fail then.  If we aren\u0027t then lets keep moving"},{"line_number":47,"context_line":"                failed_when: machine_uuid.rc not in [0, 1, 2]"},{"line_number":48,"context_line":"              - name: generate host vars from nodes data"},{"line_number":49,"context_line":"                copy:"},{"line_number":50,"context_line":"                  content: \"{% raw %}{{ nodes_data[machine_uuid.stdout|default(\u0027\u0027)]|default({})|to_nice_yaml }}{% endraw %}\""},{"line_number":51,"context_line":"                  dest: \"{{ playbook_dir }}/ceph-ansible/host_vars/{% raw %}{{ inventory_hostname }}{% endraw %}.yml\""},{"line_number":52,"context_line":"                delegate_to: localhost"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"249b3711_79d373da","line":49,"range":{"start_line":49,"start_character":16,"end_line":49,"end_character":20},"updated":"2022-09-28 07:21:24.000000000","message":"(nit) Ideally this file should have mode: 0640 but the node uuid would not be considered as a sensitive data.","commit_id":"dbb4f10084fce99a8271dcb66fa9b8003be63764"},{"author":{"_account_id":25402,"name":"Francesco Pantano","email":"fpantano@redhat.com","username":"fmount"},"change_message_id":"5203b6dd695b15aae97ba330620fcab2fb407b8f","unresolved":false,"context_lines":[{"line_number":46,"context_line":"                # the node specific data we\u0027ll fail then.  If we aren\u0027t then lets keep moving"},{"line_number":47,"context_line":"                failed_when: machine_uuid.rc not in [0, 1, 2]"},{"line_number":48,"context_line":"              - name: generate host vars from nodes data"},{"line_number":49,"context_line":"                copy:"},{"line_number":50,"context_line":"                  content: \"{% raw %}{{ nodes_data[machine_uuid.stdout|default(\u0027\u0027)]|default({})|to_nice_yaml }}{% endraw %}\""},{"line_number":51,"context_line":"                  dest: \"{{ playbook_dir }}/ceph-ansible/host_vars/{% raw %}{{ inventory_hostname }}{% endraw %}.yml\""},{"line_number":52,"context_line":"                delegate_to: localhost"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"e13752b1_8c4d3e92","line":49,"range":{"start_line":49,"start_character":16,"end_line":49,"end_character":20},"in_reply_to":"249b3711_79d373da","updated":"2022-09-28 08:30:45.000000000","message":"Done","commit_id":"dbb4f10084fce99a8271dcb66fa9b8003be63764"}],"tripleo_ansible/roles/tripleo-ceph-work-dir/tasks/prepare.yml":[{"author":{"_account_id":8833,"name":"Rabi Mishra","email":"ramishra@redhat.com","username":"rabi"},"change_message_id":"2f919a78ae5a33c866863df691a514f3e5c76813","unresolved":true,"context_lines":[{"line_number":18,"context_line":"  become: true"},{"line_number":19,"context_line":"  block:"},{"line_number":20,"context_line":"    - name: create ceph-ansible temp dirs"},{"line_number":21,"context_line":"      become: true"},{"line_number":22,"context_line":"      file:"},{"line_number":23,"context_line":"        path: \"{{ item }}\""},{"line_number":24,"context_line":"        state: directory"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"4a960d69_ac31e52d","line":21,"range":{"start_line":21,"start_character":6,"end_line":21,"end_character":18},"updated":"2022-09-28 04:30:48.000000000","message":"There is block level become:true. We don\u0027t need it in the task again.","commit_id":"5fb4636dccd18128d4470fb1da768645efdd3f65"},{"author":{"_account_id":25402,"name":"Francesco Pantano","email":"fpantano@redhat.com","username":"fmount"},"change_message_id":"2f7586d8a8b7156098b0faef3aa2e5b23d55a462","unresolved":false,"context_lines":[{"line_number":18,"context_line":"  become: true"},{"line_number":19,"context_line":"  block:"},{"line_number":20,"context_line":"    - name: create ceph-ansible temp dirs"},{"line_number":21,"context_line":"      become: true"},{"line_number":22,"context_line":"      file:"},{"line_number":23,"context_line":"        path: \"{{ item }}\""},{"line_number":24,"context_line":"        state: directory"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"4a096f20_724cabd0","line":21,"range":{"start_line":21,"start_character":6,"end_line":21,"end_character":18},"in_reply_to":"4a960d69_ac31e52d","updated":"2022-09-28 06:06:47.000000000","message":"Done","commit_id":"5fb4636dccd18128d4470fb1da768645efdd3f65"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"07a6b1baebe83c344af9243402fe91ce821859ad","unresolved":true,"context_lines":[{"line_number":18,"context_line":"  become: true"},{"line_number":19,"context_line":"  block:"},{"line_number":20,"context_line":"    - name: create ceph-ansible temp dirs"},{"line_number":21,"context_line":"      file:"},{"line_number":22,"context_line":"        path: \"{{ item }}\""},{"line_number":23,"context_line":"        state: directory"},{"line_number":24,"context_line":"        owner: \"{{ ansible_user }}\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"152dc254_7493476d","line":21,"range":{"start_line":21,"start_character":6,"end_line":21,"end_character":10},"updated":"2022-09-28 07:21:24.000000000","message":"(nit) can we set mode: 0750 so that non-root user can sneak the directory list ?","commit_id":"dbb4f10084fce99a8271dcb66fa9b8003be63764"},{"author":{"_account_id":25402,"name":"Francesco Pantano","email":"fpantano@redhat.com","username":"fmount"},"change_message_id":"5203b6dd695b15aae97ba330620fcab2fb407b8f","unresolved":false,"context_lines":[{"line_number":18,"context_line":"  become: true"},{"line_number":19,"context_line":"  block:"},{"line_number":20,"context_line":"    - name: create ceph-ansible temp dirs"},{"line_number":21,"context_line":"      file:"},{"line_number":22,"context_line":"        path: \"{{ item }}\""},{"line_number":23,"context_line":"        state: directory"},{"line_number":24,"context_line":"        owner: \"{{ ansible_user }}\""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"dec56203_c497e242","line":21,"range":{"start_line":21,"start_character":6,"end_line":21,"end_character":10},"in_reply_to":"152dc254_7493476d","updated":"2022-09-28 08:30:45.000000000","message":"Done","commit_id":"dbb4f10084fce99a8271dcb66fa9b8003be63764"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"07a6b1baebe83c344af9243402fe91ce821859ad","unresolved":true,"context_lines":[{"line_number":87,"context_line":"  become: true"},{"line_number":88,"context_line":"  block:"},{"line_number":89,"context_line":"    - name: generate ceph-ansible group vars all"},{"line_number":90,"context_line":"      copy:"},{"line_number":91,"context_line":"        dest: \"{{ playbook_dir }}/ceph-ansible/group_vars/all.yml\""},{"line_number":92,"context_line":"        content: \"{{ ceph_ansible_group_vars_all | combine(ceph_overrides|default({}))"},{"line_number":93,"context_line":"                 | combine(openstack_pools|default({\u0027openstack_pools\u0027: []})) | combine(openstack_keys|default({\u0027openstack_keys\u0027: []}))"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"b2a4432e_2c53e4ee","line":90,"range":{"start_line":90,"start_character":6,"end_line":90,"end_character":10},"updated":"2022-09-28 07:21:24.000000000","message":"this file likely needs mode: 0640 because it contains keys.","commit_id":"dbb4f10084fce99a8271dcb66fa9b8003be63764"},{"author":{"_account_id":25402,"name":"Francesco Pantano","email":"fpantano@redhat.com","username":"fmount"},"change_message_id":"5203b6dd695b15aae97ba330620fcab2fb407b8f","unresolved":false,"context_lines":[{"line_number":87,"context_line":"  become: true"},{"line_number":88,"context_line":"  block:"},{"line_number":89,"context_line":"    - name: generate ceph-ansible group vars all"},{"line_number":90,"context_line":"      copy:"},{"line_number":91,"context_line":"        dest: \"{{ playbook_dir }}/ceph-ansible/group_vars/all.yml\""},{"line_number":92,"context_line":"        content: \"{{ ceph_ansible_group_vars_all | combine(ceph_overrides|default({}))"},{"line_number":93,"context_line":"                 | combine(openstack_pools|default({\u0027openstack_pools\u0027: []})) | combine(openstack_keys|default({\u0027openstack_keys\u0027: []}))"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"157bedd0_c1d6cbf3","line":90,"range":{"start_line":90,"start_character":6,"end_line":90,"end_character":10},"in_reply_to":"b2a4432e_2c53e4ee","updated":"2022-09-28 08:30:45.000000000","message":"Done","commit_id":"dbb4f10084fce99a8271dcb66fa9b8003be63764"}]}