From 0cc2daa57d58f376cdbf7b6d87e83d2e23dc9366 Mon Sep 17 00:00:00 2001 From: Mark Goddard Date: Tue, 10 Jul 2018 12:45:19 +0100 Subject: [PATCH] Fix sudoers in bootstrap-servers when user != group In some cases we may want a configuration in which the kolla user's primary group name is not the same as their username. Doing this currently breaks the sudoers configuration, since user entries should reference a user, or a group prefixed with a '%'. There does not seem to be a good reason to give root privileges to the entire group (which sometimes may be a shared group), so let's revert to giving only the user root privileges. See kayobe CI test [1] in which a different user and group were configured, leading to permission denied when using kolla ansible. [1] http://logs.openstack.org/53/581053/2/check/kayobe-overcloud-centos/a70168e TrivialFix Change-Id: I677778ebd0de58df0adfa2a8705f161ec5552283 --- ansible/roles/baremetal/tasks/post-install.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ansible/roles/baremetal/tasks/post-install.yml b/ansible/roles/baremetal/tasks/post-install.yml index 498453a368..5c0f082e42 100644 --- a/ansible/roles/baremetal/tasks/post-install.yml +++ b/ansible/roles/baremetal/tasks/post-install.yml @@ -27,8 +27,8 @@ lineinfile: dest: /etc/sudoers.d/kolla-ansible-users state: present - regexp: '^{{ kolla_group }}' - line: '{{ kolla_group }} ALL=(ALL) NOPASSWD: ALL' + regexp: '^{{ kolla_user }}' + line: '{{ kolla_user }} ALL=(ALL) NOPASSWD: ALL' become: True when: create_kolla_user_sudoers | bool