8e635db8f1
Barbican API uses uWSGI, which by default writes out log files using 0640 permissions and default ownership for the user. This means that the log file in /var/log/kolla/barbican/barbican-api.log is not readable by fluentd. This was tested via the following command on a queens deployment: $ docker exec -it fluentd bash find /var/log/kolla/ -type f | while read f; do test -r $f || echo "Cannot read $f"; done Cannot read /var/log/kolla/barbican/barbican-api.log Generally there are a few ways in which access is provided to log file for fluentd: 1. Set log file ownership to $USER:kolla, permissions to 0640. 2. Set log file ownership to $USER:$USER, permissions to 0644. 3. MariaDB is a special case, and uses 0640 with the fluentd user added to the mysql group. Of these, 1. seems the most secure. This change uses the --logfile-chmod argument to set the log file permissions to 644, since it does not appear possible to specify a group to change ownership to using --logfile-chown. We use command line arguments since putting the option in the config file does not seem to work. Perhaps it is an ordering issue. Change-Id: If98ca7cd9630b5622132a00718cb09304b8285b3 Closes-Bug: #1794472
41 lines
1.3 KiB
Django/Jinja
41 lines
1.3 KiB
Django/Jinja
{
|
|
"command": "uwsgi --master --emperor /etc/barbican/vassals --logto /var/log/kolla/barbican/barbican-api.log --logfile-chmod 644",
|
|
"config_files": [
|
|
{
|
|
"source": "{{ container_config_directory }}/barbican.conf",
|
|
"dest": "/etc/barbican/barbican.conf",
|
|
"owner": "barbican",
|
|
"perm": "0600"
|
|
},
|
|
{
|
|
"source": "{{ container_config_directory }}/vassals/barbican-api.ini",
|
|
"dest": "/etc/barbican/vassals/barbican-api.ini",
|
|
"owner": "barbican",
|
|
"perm": "0600"
|
|
},
|
|
{
|
|
"source": "{{ container_config_directory }}/barbican-api-paste.ini",
|
|
"dest": "/etc/barbican/barbican-api-paste.ini",
|
|
"owner": "barbican",
|
|
"perm": "0600",
|
|
"optional": true
|
|
}{% if barbican_policy_file is defined %},
|
|
{
|
|
"source": "{{ container_config_directory }}/{{ barbican_policy_file }}",
|
|
"dest": "/etc/barbican/{{ barbican_policy_file }}",
|
|
"owner": "barbican",
|
|
"perm": "0600"
|
|
}{% endif %}
|
|
],
|
|
"permissions": [
|
|
{
|
|
"path": "/var/lib/barbican",
|
|
"owner": "barbican:barbican"
|
|
},
|
|
{
|
|
"path": "/var/log/kolla/barbican",
|
|
"owner": "barbican:barbican"
|
|
}
|
|
]
|
|
}
|