External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-09-16 08:50:10 -02:30
Code Issues Packages Projects Releases Wiki Activity
25,627 Commits 65 Branches 102 Tags
32831794eef40caeca9509c45f9f7a18dfeb09fa
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ryan Petrello 32831794ee Merge pull request #4477 from ryanpetrello/372-signal-deadlock 
force worker processes to have a different signal handler from the parent
 2020-07-23 12:21:44 -04:00
Ryan Petrello 26660fa82e Merge pull request #4464 from ryanpetrello/named-url-vuln-372 
update the named URL code to properly return 404 vs 403
 2020-07-23 12:07:33 -04:00
Ryan Petrello 860183f178 update the named URL code to properly return 404 vs 403 2020-07-22 12:15:34 -04:00
Ryan Petrello c410f1f344 Merge pull request #4458 from ryanpetrello/fifo-cred-plugin-hang-372 
[3.7.2] remove the usage of create_temporary_fifo from credential plugins
 2020-07-14 17:21:35 -04:00
Ryan Petrello 310a0f88e5 remove the usage of create_temporary_fifo from credential plugins 
this resolves an issue that causes an endless hang on with Cyberark AIM
lookups when a certificate *and* key are specified

the underlying issue here is that we can't rely on the underyling Python
ssl implementation to *only* read from the fifo that stores the pem data
*only once*; in reality, we need to just use *actual* tempfiles for
stability purposes

see: https://github.com/ansible/awx/issues/6986
see: https://github.com/urllib3/urllib3/issues/1880
 2020-07-14 16:24:03 -04:00
Ryan Petrello 3ef07ee5f7 Merge pull request #4447 from ryanpetrello/372-master-main-links 
fixed broken UI links
 2020-07-13 15:49:11 -04:00
Ryan Petrello 140d9ae3ee Merge pull request #4429 from wenottingham/label-maker 
Reintroduce label filtering
 2020-07-09 09:00:57 -04:00
Ryan Petrello 7322e13436 add tests for clarified label permissions 2020-07-08 16:53:05 -04:00
Ryan Petrello bc14e995fd Merge pull request #4434 from ryanpetrello/jinja-injector-sandbox-validation 
prevent unsafe jinja from being saved in the first place for cred types
 2020-07-07 12:47:15 -04:00
Ryan Petrello 61d3a765ee prevent unsafe jinja from being saved in the first place for cred types 
see: https://github.com/ansible/tower-security/issues/21
 2020-07-07 10:59:14 -04:00
Ryan Petrello f943277ef0 Merge pull request #4433 from ghjm/webhook_error_detail 
Error detail in webhook and credential tests
 2020-07-07 10:35:21 -04:00
Ryan Petrello 8aa11f4848 Merge pull request #4430 from ryanpetrello/jinja2-injector-sandbox 
use jinja2.sandbox for credential type injectors
 2020-07-06 15:21:21 -04:00
Ryan Petrello 2f1b4d81e1 use jinja2.sandbox for credential type injectors 2020-07-06 13:50:33 -04:00
Ryan Petrello 6376395c68 Merge pull request #4409 from ryanpetrello/371-host-summary-regression 
fix a regression in how job host summaries are generated
 2020-06-16 17:04:22 -04:00
Ryan Petrello eaadbe9730 fix a regression in how job host summaries are generated 
this change fixes a bug introduced in the optimization at https://github.com/ansible/awx/pull/7352

1. Create inventory with multiple hosts
2. Run a playbook with a limit to match only one host
3. Run job, verify that it only acts on the one host
4. Go to inventory host list and see that all the hosts have last_job updated to point to the job that only acted on one host.
 2020-06-16 13:18:14 -04:00
Ryan Petrello fe221c2473 Merge pull request #4399 from shanemcd/kube-queues 
Add queue / instance group registration to heartbeat for k8s installs
 2020-06-11 09:00:16 -04:00
Ryan Petrello 7c1959010a Merge pull request #4396 from jladdjr/foreman_script_should_not_use_reports_3.7.1 
disable reports option for foreman (release_3.7.1)
 2020-06-10 08:30:14 -04:00
Ryan Petrello 1d7e2a82c6 Merge pull request #4393 from kdelee/backport_dont_block_log_send 
[3.7.1] don't block on log aggregator socket.send() calls
 2020-06-09 14:49:43 -04:00
Ryan Petrello b7ac5f0ffb Merge pull request #4395 from fosterseth/fix-parents_converge_settable_api_backport 
[backport] Make all_parents_must_converge settable when creating node
 2020-06-09 11:29:34 -04:00
Ryan Petrello a057a2e056 Merge pull request #4394 from ryanpetrello/mattermost-371 
Send content-type with mattermost notifications, fixes #7264
 2020-06-09 10:35:55 -04:00
Ryan Petrello 71cc359ccf don't block on log aggregator socket.send() calls 
see: https://github.com/ansible/tower/issues/4391
 2020-06-09 10:10:32 -04:00
Ryan Petrello 99c0a954e4 Merge pull request #4384 from ryanpetrello/rsyslog-chmod 
properly write rsyslog configuration as 0640
 2020-06-08 14:05:18 -04:00
Ryan Petrello c53e5bdbcf properly write rsyslog configuration as 0640 
see: https://github.com/ansible/tower/issues/4383
 2020-06-04 15:12:09 -04:00
Ryan Petrello bd23c41d25 Merge pull request #4361 from ryanpetrello/venv-try-except 
[3.7.1] backport a change to address venv permission issues
 2020-05-26 11:31:16 -04:00
Ryan Petrello 3d02bd7a90 Merge pull request #4350 from ryanpetrello/371-os-walkdir-recursive 
Revert "follow symlinks while discovering valid playbooks"
 2020-05-20 16:50:28 -04:00
Ryan Petrello 71257c18c2 Revert "follow symlinks while discovering valid playbooks" 
This reverts commit 3dd21d720e.
 2020-05-20 16:47:38 -04:00
Ryan Petrello d85df2e4a1 further optimize job host summary queries 2020-05-19 13:00:12 -04:00
Ryan Petrello 59d457207c properly update .failed, .last_job_id, and last_job_host_summary 2020-05-19 13:00:05 -04:00
Ryan Petrello 3ea642f212 properly handle host summary bulk updates if hosts go missing 2020-05-19 13:00:00 -04:00
Ryan Petrello b6d3c3c1a3 drastically optimize job host summary creation 
see: https://github.com/ansible/awx/issues/6991
 2020-05-19 12:59:54 -04:00
Ryan Petrello 9668d18203 Merge pull request #4313 from ryanpetrello/more-fips-monkey-business 
monkey-patch another Django names_digest for FIPS support
 2020-05-08 15:14:25 -04:00
Ryan Petrello 814f033d46 monkey-patch another Django names_digest for FIPS support 2020-05-08 14:12:50 -04:00
Ryan Petrello a7ca6e2eea Merge pull request #4293 from chrismeyersfsu/fix-ws_disconnect_log 
missing f"" on log statement
 2020-05-05 11:16:13 -04:00
Ryan Petrello 9c5f04b1e0 Merge pull request #4287 from ryanpetrello/flake8-whoops 
fix busted flake8
 2020-05-01 13:52:52 -04:00
Ryan Petrello b4b261b918 fix busted flake8 2020-05-01 13:51:37 -04:00
Ryan Petrello cd21dd69f5 Merge pull request #4284 from ryanpetrello/more-event-sanitization-tweaks 
only sanitize project update events for the scm modules
 2020-05-01 11:48:24 -04:00
Ryan Petrello bf65b40241 only sanitize project update events for the scm modules 
these are the only modules in the project update playbook that actually
utilize the SCM URL (which is what potentially contains sensitive data)
 2020-05-01 11:39:46 -04:00
Ryan Petrello 99c7f2f70d Merge pull request #4278 from elyezer/drop-awxkit-requirements-txt 
[3.7.0] Keep awxkit's requirements on the setup.py
 2020-04-29 14:46:58 -04:00
Ryan Petrello 6b976c4239 Merge pull request #4276 from rebeccahhh/release_3.7.0 
put remaining correct links for 'Source Variables' in Source Page
 2020-04-28 15:31:37 -04:00
Ryan Petrello 0d30a67756 Merge pull request #4273 from wenottingham/certscertscerts 
Allow unsigned certs in logging if cert verification is disabled.
 2020-04-28 11:17:19 -04:00
Ryan Petrello 94692c2364 Merge pull request #4272 from chrismeyersfsu/sos_report_redis_logs 
sos report redis logs
 2020-04-28 11:00:41 -04:00
Ryan Petrello 29abe35799 Merge pull request #4268 from fosterseth/fix-ip_conflict_cluster 
Unset IP address of old instance if conflicting with new instance IP
 2020-04-28 10:59:27 -04:00
Ryan Petrello e1cedcfb04 Merge pull request #4266 from rooftopcellist/rsyslog_followup 
Increase stopwait time for rsyslogd service
 2020-04-27 15:26:49 -04:00
Ryan Petrello efe9d85685 Merge pull request #4260 from jlmitch5/fixNotificationPagination 
make sure right endpoint is getting called for notification pagination
 2020-04-27 09:18:34 -04:00
Ryan Petrello 1f1069e9f3 Merge pull request #4261 from jlmitch5/fixLicenseTranslation 
Remove unnecessary nesting license translate directive
 2020-04-24 16:03:10 -04:00
Ryan Petrello 04e6482f36 Merge pull request #6832 from ghjm/service_command 
Improve the ansible-tower-service script
 2020-04-24 15:24:40 -04:00
Ryan Petrello e51d0b6fde add a setting for enabling high rsyslogd verbosity 2020-04-24 14:01:17 -04:00
Ryan Petrello 31c6b3337c allow users to test log aggregration if awx isn't in the loggers list 2020-04-23 15:15:37 -04:00
Ryan PetrelloandFrancois Herbert 3dd21d720e follow symlinks while discovering valid playbooks 
related: https://github.com/ansible/awx/pull/6769

Co-authored-by: Francois Herbert <francois@herbert.org.nz>
 2020-04-22 13:38:29 -04:00
Ryan Petrello 2742612be9 bump version to 11.1.0 2020-04-22 13:00:41 -04:00
Ryan Petrello edd9972435 include the AWX version as a header in all responses 2020-04-22 12:07:31 -04:00
Ryan Petrello af11055e5c update (dead) links to example inv source vars 
see: https://github.com/ansible/awx/issues/6538

some of these are subject to change (in particular, the azure one), but
this at least fixes the dead links for now in ansible devel
 2020-04-21 14:00:54 -04:00
Ryan Petrello 41586ea3a6 update postgres minimum version 2020-04-21 12:49:33 -04:00
Ryan Petrello 9e30f004d3 let users configure the destination and max disk size of rsyslogd spool 2020-04-20 19:12:28 -04:00
Ryan Petrello f62dfe85cc escape certain log aggregator settings when generating rsyslog config 
see: https://github.com/ansible/awx/issues/6760
 2020-04-20 18:05:01 -04:00
Ryan Petrello cec7cb393d record redis config in the sosreport 2020-04-20 17:03:50 -04:00
Ryan Petrello 7bfc99a615 don't expose redis port 2020-04-17 15:34:11 -04:00
Ryan Petrello f159a6508e rsyslogd: set some higher limits for disk-assisted queues 2020-04-17 14:34:07 -04:00
Ryan Petrello 8ed5964871 bump version for 11.0.0 2020-04-15 22:10:12 -04:00
Ryan Petrello 8464ec5c49 update custom credential plugin docs to point at an example project 2020-04-15 09:59:09 -04:00
Ryan Petrello 262d99fde6 properly implement TCP timeouts for external log aggregation 
see: https://github.com/ansible/awx/issues/6683
 2020-04-14 17:06:30 -04:00
Ryan Petrello e95938715a make rsyslog service restarts a bit less noisy 2020-04-14 14:18:30 -04:00
Ryan Petrello 75bb7cce22 don't wait on memcached TCP 2020-04-14 11:45:27 -04:00
Ryan Petrello 52a253ad18 add a few minor logging changes to accomodate Splunk's API 
see: https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/UsetheHTTPEventCollector
 2020-04-14 11:45:04 -04:00
Ryan Petrello 0f74a05fea rsyslogd: ignore /dev/log when we load imuxsock 2020-04-14 11:34:58 -04:00
Ryan Petrello dbe949a2c2 Merge pull request #6697 from chrismeyersfsu/fix-collection_tests 
ensure last comma removed in select
 2020-04-14 11:05:29 -04:00
Ryan Petrello f7f1bdf9c9 properly configure supervisorctl to point at the web volume mount 2020-04-13 21:56:52 -04:00
Ryan Petrello 69cf915a20 add rsyslogd block to the k8s supervisord config file 2020-04-13 20:25:53 -04:00
Ryan Petrello 9440785bdd properly set the group on the rsyslog config 2020-04-13 19:46:34 -04:00
Ryan Petrello e52cebc28e rsyslogd: use %rawmsg-after-pri% instead of %msg% 
after some prolonged RFC reading and tinkering w/ rsyslogd...

cpython's SysLogHandler doesn't emit RFC3164 formatted messages
in the format you'd expect; it's missing the ISO date, hostname, etc...
along with other header values; the handler implementation relies on you
to specify a syslog-like formatter (we've replaced all of this with our
own *custom* logstash-esque formatter that effectively outputs valid JSON
- without dates and other syslog header values prepended)

because of this unanticipated format, rsyslogd chokes when trying to
parse the message's parts;  AWX is emitting:

<priority>RAWJSON

...so the usage of `%msg%` isn't going to work for us, because rsyslog
tries to parse *all* of the possible headers (and yells, because it
can't find a date to parse):

see: https://www.rsyslog.com/files/temp/doc-indent/configuration/properties.html#message-properties

this is fine, because we don't *need* any of that message parsing
anyways; in the end, we're *just* interested in forwarding the raw
JSON/text content to the third party log handler
 2020-04-13 11:44:00 -04:00
Ryan Petrello bb5136cdae properly escape URL paths and querystrings for paths in logging settings 2020-04-13 11:44:00 -04:00
Ryan Petrello b0db2b7bec add some exception handling for dealing with logging connection resets 
when rsyslogd restarts due to config changes, there's a brief moment
where the socket will refuse connections on teardown; exception handling
is needed here to deal with that
 2020-04-13 11:44:00 -04:00
Ryan Petrello 1000dc10fb an an rsyslogd config check to the logging test endpoint 2020-04-13 11:44:00 -04:00
Ryan Petrello 2a4b009f04 rsyslogd: use %rawmsg-after-pri% instead of %msg% 
after some prolonged RFC reading and tinkering w/ rsyslogd...

cpython's SysLogHandler doesn't emit RFC3164 formatted messages
in the format you'd expect; it's missing the ISO date, hostname, etc...
along with other header values; the handler implementation relies on you
to specify a syslog-like formatter (we've replaced all of this with our
own *custom* logstash-esque formatter that effectively outputs valid JSON
- without dates and other syslog header values prepended)

because of this unanticipated format, rsyslogd chokes when trying to
parse the message's parts;  AWX is emitting:

<priority>RAWJSON

...so the usage of `%msg%` isn't going to work for us, because rsyslog
tries to parse *all* of the possible headers (and yells, because it
can't find a date to parse):

see: https://www.rsyslog.com/files/temp/doc-indent/configuration/properties.html#message-properties

this is fine, because we don't *need* any of that message parsing
anyways; in the end, we're *just* interested in forwarding the raw
JSON/text content to the third party log handler
 2020-04-13 11:44:00 -04:00
Ryan Petrello 8cdd42307c clarify that logging username/password is only valid for HTTP/s 2020-04-13 11:44:00 -04:00
Ryan Petrello 269558876e only use a basic auth password for external logging if username is set 2020-04-13 11:44:00 -04:00
Ryan Petrello bba680671b when writing the rsyslog config, do it post-commit 
there's a race condition if we do this pre-commit where the correct
value isn't actually *persisted* to the database yet, and we end up
saving the *prior* setting values
 2020-04-13 11:44:00 -04:00
Ryan Petrello f70a76109c make rsyslog fall back to no-op if logging is disabled 2020-04-13 11:44:00 -04:00
Ryan Petrello f7dac8e68d more external logging unit test fixups 2020-04-13 11:44:00 -04:00
Ryan Petrello 39648b4f0b fix up a few test and lint errors related to external logging 2020-04-13 11:44:00 -04:00
Ryan Petrello ce82b87d9f rsyslog hardening (fixing a few weird things we noticed) 2020-04-13 11:44:00 -04:00
Ryan Petrello 589d27c88c POC: replace our external log aggregation feature with rsyslog 
- this change adds rsyslog (https://github.com/rsyslog/rsyslog) as
  a new service that runs on every AWX node (managed by supervisord)
  in particular, this feature requires a recent version (v8.38+) of
  rsyslog that supports the omhttp module
  (https://github.com/rsyslog/rsyslog-doc/pull/750)
- the "external_logger" handler in AWX is now a SysLogHandler that ships
  logs to the local UDP port where rsyslog is configured to listen (by
  default, 51414)
- every time a LOG_AGGREGATOR_* setting is changed, every AWX node
  reconfigures and restarts its local instance of rsyslog so that its
  fowarding settings match what has been configured in AWX
- unlike the prior implementation, if the external logging aggregator
  (splunk/logstash) goes temporarily offline, rsyslog will retain the
  messages and ship them when the log aggregator is back online
- 4xx or 5xx level errors are recorded at /var/log/tower/external.err
 2020-04-13 11:43:59 -04:00
Ryan Petrello 9843e21632 skip non-files when consuming events synced from isolated hosts 
see: https://github.com/ansible/awx/issues/6675
 2020-04-13 10:14:10 -04:00
Ryan Petrello 80147acc1c work around redis connection failures in the callback receiver 
if redis stops/starts, sometimes the callback receiver doesn't recover
without a restart; this fixes that
 2020-04-09 15:38:03 -04:00
Ryan Petrello 6b4219badb more ansible runner isolated cleanup 
follow-up to https://github.com/ansible/awx/pull/6296
 2020-04-08 01:18:05 -04:00
Ryan Petrello 0bf1116ef8 properly respect REFRESH_TOKEN_EXPIRE_SECONDS when generating new tokens 
see: https://github.com/ansible/awx/issues/6630
see: https://github.com/jazzband/django-oauth-toolkit/issues/746
 2020-04-07 11:34:01 -04:00
Ryan Petrello 771ca2400a don't send tags to the Grafana annotations API if none are specified 
see: https://github.com/ansible/awx/issues/6580
 2020-04-06 15:47:48 -04:00
Ryan Petrello 2cefba6f96 properly serialize external logs that contain decimal.Decimal objects 2020-04-06 14:24:24 -04:00
Ryan Petrello 014c995a8f fix a typo in the credentials UI 
this is causing 400 level errors for some users
 2020-04-06 10:45:33 -04:00
Ryan Petrello 6bd5053ae8 remove the limitation on (very) old DTSTART values for schedules 2020-04-03 10:59:35 -04:00
Ryan Petrello 8b00b8c9c2 remove deprecated legacy manual inventory source support 
see: https://github.com/ansible/awx/issues/6309
 2020-04-03 10:54:43 -04:00
Ryan Petrello 9fe2211f82 get rid of the activity stream middleware 
it has bugs and is very confusing

see: https://github.com/ansible/tower/issues/4037
 2020-04-01 16:02:42 -04:00
Ryan Petrello f9b8a69f7b remove some unused code from the redis rewrite 2020-04-01 08:03:59 -04:00
Ryan Petrello 4423e6edae update to the latest twisted to address two open CVEs 2020-03-31 13:47:56 -04:00
Ryan Petrello 42336355bb bump django-extensions version to address a bug in shell_plus 
see: https://github.com/ansible/awx/pull/6441
see: https://github.com/django-extensions/django-extensions/commit/e8d5daa06e5b6419e54d6c925f86a0adbe58ce8b
 2020-03-31 13:39:13 -04:00
Ryan Petrello d19a9db523 detect event migration tables in a less noisy way 
see: https://github.com/ansible/awx/issues/6493
 2020-03-31 00:05:30 -04:00
Ryan Petrello 140dbbaa7d disable host key checking when installing galaxy roles/collections 
see: https://github.com/ansible/awx/issues/5947
 2020-03-30 17:03:14 -04:00
Ryan Petrello 831bf9124f prevent manual updates at POST /api/v2/inventory_sources/N/update/ 
see: https://github.com/ansible/awx/issues/6309
 2020-03-30 15:35:04 -04:00
Ryan Petrello 32627ce51a promote AWX CLI installation instructions to the global INSTALL.md 
a few users have had trouble finding these instructions, so let's move
them into the top level installation docs
 2020-03-30 11:46:10 -04:00
Ryan Petrello 04dd1352c9 prevent ws group subscription if not specified in the valid format 2020-03-27 17:13:21 -04:00