Merge "Do not make password files world-readable"

playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml

@@ -148,6 +148,9 @@
     crypt_scheme: bcrypt
     name: "{{ admin_username }}"
     password: "{{ admin_password }}"
+    owner: ironic
+    group: ironic
+    mode: 0600
   when:
     - not enable_keystone | bool
 
@@ -157,6 +160,9 @@
     crypt_scheme: bcrypt
     name: "{{ default_username }}"
     password: "{{ default_password }}"
+    owner: ironic
+    group: ironic
+    mode: 0600
   when:
     - not noauth_mode | bool
     - not enable_keystone | bool

playbooks/roles/bifrost-ironic-install/tasks/inspector_bootstrap.yml

@@ -78,6 +78,9 @@
     crypt_scheme: bcrypt
     name: "{{ admin_username }}"
     password: "{{ admin_password }}"
+    owner: ironic
+    group: ironic
+    mode: 0600
   when:
     - not noauth_mode | bool
     - not enable_keystone | bool
@@ -88,6 +91,9 @@
     crypt_scheme: bcrypt
     name: "{{ default_username }}"
     password: "{{ default_password }}"
+    owner: ironic
+    group: ironic
+    mode: 0600
   when:
     - not noauth_mode | bool
     - not enable_keystone | bool

releasenotes/notes/htpasswd-perm-7754c0be7cc676e1.yaml

@@ -0,0 +1,4 @@
+---
+fixes:
+  - |
+    Password files (``htpasswd``) are no longer world-readable.