External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-09-15 00:10:09 -02:30
Code Issues Packages Projects Releases Wiki Activity
13,731 Commits 64 Branches 102 Tags
4eaa12dd48df99aeacbf700ffaea3f5cb619e4fa
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ryan Petrello f4d6c03325 properly copy user owner roles when migrating v1 SSH to SSH + Vault 
see: #7050
 2017-07-18 15:24:43 -04:00
Ryan Petrello 4b2be9850e copy adhoc events properly for stdout downloads 
see: #7100
 2017-07-18 12:12:02 -04:00
Ryan Petrello 53259e4d24 properly capture job events for adhoc commands run on isolated instances 
see: #7100
 2017-07-17 14:51:24 -04:00
Ryan Petrello 9784633728 pin websocket-client to a known working version 
websocket-client 0.43.0 has a bug in its https client that breaks
requests:
https://github.com/websocket-client/websocket-client/issues/326

slackclient is affected by this bug:
https://github.com/slackapi/python-slackclient/issues/189

this commits also upgrades slackclient to add proxy support

see: #7088
see: #7093
 2017-07-17 12:04:30 -04:00
Ryan Petrello 0b6c43dac0 allow access to insights credentials in /api/v1/ 
see: #6978
 2017-07-17 10:14:29 -04:00
Ryan Petrello 937e90d342 force PENDO_TRACKING_STATE to be readonly for the open source license 
see: #6890
 2017-07-14 16:39:13 -04:00
Ryan Petrello d8da1dddf5 wrap instance and queue registration in postgres advisory locks 
see: #7040
 2017-07-14 14:56:14 -04:00
Ryan Petrello 0239cd37fe pin celery to a known version that works 
newer celery 3.x seems to a bug which causes forked celery worker
interprocess communication to hang (see: #6534)
 2017-07-13 16:24:30 -04:00
Ryan Petrello 58abfc3fde properly copy parent roles when migrating v1 SSH creds to SSH + Vault 
see: #7050
 2017-07-13 15:02:55 -04:00
Ryan Petrello 2d5c021b72 log task failures when DEBUG = True 
this helps a lot for development - otherwise you have to go look an
explanaton in the database for these sorts of failures
 2017-07-13 08:24:42 -04:00
Ryan Petrello 80224b791d avoid a race condition in recording deletions in the activity stream 
1. You delete something.
2. A signal is generated to record an activity stream deletion.
3. The process of deleting that activity stream deletion attempts to
   look up a related field which has been deleted (in the meantime) via
   a cascade.

see: #6721
see: #7022
 2017-07-12 16:39:39 -04:00
Ryan Petrello 5f6ed1bd6c upgrade to the latest version of tacacs_plus 2017-07-12 13:52:37 -04:00
Ryan Petrello 28f44c3ab0 filter Insights credentials from /api/v1/credentials/ 
see: #6978
see: #6088
 2017-07-11 13:55:43 -04:00
Ryan Petrello 09055f9c2f fix a few issues in credential type kind validation 
- fix a typo from `network` to `net`
- properly update OPTIONS for CredentialTypes to reflect allowed `kind`
  values for POST/PUT/

see: #6959
 2017-07-11 09:43:55 -04:00
Ryan Petrello 6996b16d5a add additional field validation to AWX_TASK_ENV 
AWX_TASK_ENV should only allow simple key-value assignment (since we're
using it to set environment variables).

see: #3508
 2017-07-10 17:29:38 -04:00
Ryan Petrello 31829038bd prevent creation of custom credential types that != 'cloud || network` 
see: #6959
 2017-07-10 16:34:25 -04:00
Ryan Petrello 0e29f3617d periodically run orphaned task cleanup as part of the scheduler 
Running orphaned task cleanup within its own scheduled task via
celery-beat causes a race-y lock contention between the cleanup task and
the task scheduler.  Unfortunately, the scheduler and the cleanup task
both run at similar intervals, so this race condition is fairly easy to
hit.  At best, it results in situations where the scheduler is
regularly delayed 20s; depending on timing, this can cause situations
where task execution is needlessly delayed a minute+.  At worst, it can
result in situations where the scheduler is never able to schedule
tasks.

This change implements the cleanup as a periodic block of code in the
scheduler itself that tracks its "last run" time in memcached (by
default, it performs a cleanup every 60 seconds)

see: #6534
 2017-07-10 15:51:46 -04:00
Ryan Petrello 7d12427497 add a new configurable, PROXY_IP_WHITELIST 
implement a whitelist setting that - if populated - will only allow
specific IPs/hostnames to provide custom REMOTE_HOST_HEADERS header
values (i.e., `HTTP_X_FORWARDED_FOR`)

see: #6538
 2017-07-10 10:31:45 -04:00
Ryan Petrello 7f286b50b8 don't auto-coerce boolean-like extra_vars for credential injection 
ansible itself already does this for you (albeit, with its own set of
quirks): https://github.com/ansible/ansible/issues/11905

see: #6900
 2017-07-07 16:11:29 -04:00
Ryan Petrello 5fde6ead42 properly copy prompted vault passwords on job launch 
see: #6924
 2017-07-07 13:15:17 -04:00
Ryan Petrello 3c2fe5e6db fix a variety of bugs that break vault pass injection for playbook runs 
see: #6924
 2017-07-07 12:19:31 -04:00
Ryan Petrello 12d41e2deb Support AWX_TASK_ENV injection in task and notification invocations. 
This change _only_ injects `AWS_TASK_ENV` into `os.environ`; it's up to
underlying libraries to be good citizens and actually respect things
like `HTTPS_PROXY`.

see: #3508
 2017-07-06 13:51:37 -04:00
Ryan Petrello d9fcefa7ad update help text for changes to AWX_PROOT_BASE_PATH 
see: #3472
 2017-07-05 14:16:14 -04:00
Ryan Petrello 0a5b9c458b standardize tasks.py temporary file paths under a single parameter 
see: #3472
 2017-07-05 13:50:43 -04:00
Ryan Petrello 7673a6fe49 fix a bug that prevents boolean inputs from being used in injectors 
when used as environment variables, boolean credential values are
stringified; when used in extra_vars, they are treated as actual JSON
boolean values (where possible)

see: #6776
 2017-07-05 11:21:01 -04:00
Ryan Petrello cd7dc39703 rename "Insights Basic Auth" to "Insights" 
see: #6870
 2017-07-03 16:25:44 -04:00
Ryan Petrello 1c066d478b substitute "$encrypted$" for actual password on logging config test 
see: #6780
 2017-07-03 12:14:43 -04:00
Ryan Petrello 2f6d6bfd67 update help text for credential inputs and injectors 
see: #6078
 2017-07-03 11:42:04 -04:00
Ryan Petrello 0a4c5d9d30 translate labels and help_text for Credential Types (where possible) 
see: #6327
 2017-07-03 11:42:04 -04:00
Ryan Petrello aaa0ed4c72 add help text for built-in Tower credential types 
see: #6561
 2017-07-03 11:42:04 -04:00
Ryan Petrello dade5c12a7 fix a bug in the CredentialType field validator that breaks required 
see: #6769
 2017-06-30 12:27:43 -04:00
Ryan Petrello de84f3cf4a fix a bug in cluster node version comparison 2017-06-30 11:28:04 -04:00
Ryan Petrello 413e8c3bc9 isolated nodes should report their awx version in their heartbeat 
see: #6810
 2017-06-29 16:55:11 -04:00
Ryan Petrello 611c42f741 fix the make rdb debugging tool 2017-06-29 15:40:09 -04:00
Ryan Petrello ac9bc166a0 properly invoke the byte-compiled isolated job runner in production 
see: #5903
 2017-06-29 11:11:28 -04:00
Ryan Petrello 405c01a847 more isolated production tinkering 
see: #5903
see: #6507
 2017-06-29 09:35:26 -04:00
Ryan Petrello a4b00cf485 minor tinkering to isolated key generation 2017-06-28 15:32:31 -04:00
Ryan Petrello b0e51b42d8 fix a bug that prevents unpriveleged users from listing CredentialTypes 
see: #6737
 2017-06-27 16:47:02 -04:00
Ryan Petrello 65ace1f446 fix a bug in AES -> fernet encryption migration 
see: #6747
 2017-06-27 15:07:44 -04:00
Ryan Petrello 3000f52a92 install a randomized RSA key for controller -> isolated rampart auth 
see: #6507
 2017-06-27 10:53:44 -04:00
Ryan Petrello bfb7ad15ae make isolated rampart settings API-configurable 
see: #6659
 2017-06-26 15:47:14 -04:00
Ryan Petrello 5adc1c603a properly update the heartbeat timestamp for isolated nodes 2017-06-26 11:03:56 -04:00
Ryan Petrello 97562fc4df block job template launches when an inventory is being deleted 
see: #4382
 2017-06-22 15:33:55 -04:00
Ryan Petrello 14addae813 delete inventories in the background via a celery task 
see: #4382
see: #6279
 2017-06-22 14:32:33 -04:00
Ryan Petrello 5e908bfc50 more isolated acceptance doc updates 2017-06-22 12:32:20 -04:00
Ryan Petrello 0804b7336c make isolated sdist use the correct filename for unofficial builds 2017-06-22 10:51:29 -04:00
Ryan Petrello 45bdd9f747 improve readability of the honcho console logs in the dev environment 
* colorize uwsgi and celery logs; DEBUG lines are green, WARN lines
  are yellow, ERROR lines (and tracebacks) are red
* pretty-print fact callback receiver JSON
* simplify the uwsgi log format so it's more legible
 2017-06-22 09:19:32 -04:00
Ryan Petrello 39525316ac prefix all /api/v1/ view descriptions with a deprecation message 
additionally, fix a bug in /api/v1/credentials/ view descriptions that
causes v2 fields to display (see: #6116)
 2017-06-21 16:27:07 -04:00
Ryan Petrello e832a56506 fix a bug in team-based credential validation 
when a credential is created with `team` in the payload, set the
credential's `organization` *prior* to validation so that we don't miss
organization-oriented validators (like the org + name + kind unique
validation)

see: #3303
 2017-06-21 14:25:51 -04:00
Ryan Petrello b8e0c91bd4 store stderr on successful inventory syncs 
see: #4823
 2017-06-21 10:20:50 -04:00
Ryan Petrello c35d83df13 fix a race condition in isolated stdout processing 2017-06-19 16:59:03 -04:00
Ryan Petrello 2e608f4eac remove ANSIBLE_USE_VENV and TOWER_USE_VENV 
modern Tower deployments (both production and dev container-based)
always build ansible and Tower in separate, distinct virtualenvs, not
the global site-packages
 2017-06-19 16:11:15 -04:00
Ryan Petrello 2ba9e56033 Include the Tower venv in the isolated bubblewrapped arguments. 
This moves the container-based code location and venvs.
The goal here is that the paths of Tower source for isolated
vs normal nodes matches (both in prod and local development) so that we
don't have to add a bunch of additional bwrap argument logic for
<location-of-isolated-tower-venv>.
 2017-06-19 15:52:54 -04:00
Ryan Petrello 1ea03aa4c9 more isolated task execution tweaking 
* set a more reasonable default `AWX_ISOLATED_CHECK_INTERVAL`
* make manual cancellation work for high values of
  `AWX_ISOLATED_CHECK_INTERVAL`
* remove the `/tmp/ansible_tower/jobs/` symlink directory

see: #6616
 2017-06-16 15:37:07 -04:00
Ryan Petrello 1b88349f1e fix a typo in the tower-manage instance_group_remove arg parsing 2017-06-16 11:21:35 -04:00
Ryan Petrello 44e0c8621a isolated ramparts: replace systemd unit with a tower-expect binary 
instead of launching isolated tasks via `systemctl`, treat
`awx.main.isolated.run` as an executable that knows how to daemonize

additionally, add `setup.py isolated_build` for isolated Tower source
distribution
 2017-06-16 09:59:21 -04:00
Ryan Petrello e95b254a3f provide a more helpful error message for secret decryption failures. 
see: #6230
see: #6395
 2017-06-13 14:35:15 -04:00
Ryan Petrello d4afa41acb key prompting of all credentials off of ask_credential_on_launch 
see: #6371
 2017-06-12 12:26:58 -04:00
Ryan Petrello 240d629128 fix a bug in ssh key unlock validation 
see: #6553
 2017-06-12 10:28:38 -04:00
Ryan Petrello 28ad576c90 properly validate ssh_key_unlock for Net and SCM credentials 
see: #6460
 2017-06-09 10:43:04 -04:00
Ryan Petrello ea0f4ce59d properly validate SSH key data for SCM, Net, GCE, and Azure Classic 
see: #6384
 2017-06-09 10:39:07 -04:00
Ryan Petrello 9bba3d9749 resolve a few CredentialType.inputs validation issues 
see: #6363
 2017-06-06 15:48:23 -04:00
Ryan Petrello 9445fed340 use str() - not repr() - for invalid SSH cert error messages 
see: #6417
 2017-06-06 13:53:13 -04:00
Ryan Petrello ad9fda9a06 add a boolean authorize field for the Network Credential Type 
see: #6464
 2017-06-06 11:13:10 -04:00
Ryan Petrello af457ad8eb clarify valid CredentialType field types 
almost all of our current credential values are strings, but under the
v1 Credential model, `authorize` is boolean

additionally, if a field is specified with no type, fall back to
`string` as a default (this is almost always what people creating custom
types will want)

see: #6406
 2017-06-01 13:23:51 -04:00
Ryan Petrello fd4b86349c fix a 500 error in /api/v1/credentials/ backwards compat 
see: #6414
 2017-06-01 11:26:18 -04:00
Ryan Petrello 71dda544ab fix a bug in /api/v1/credential detection of Vault payloads 
see: #6390
 2017-06-01 10:18:43 -04:00
Ryan Petrello e0a629db58 improve error formatting for jsonschema failures on Credential.inputs 
this provides error messages keyed by input fields, so that instead of
e.g.,

{
    'inputs': ['Invalid certificate or key: u'XYZ']
}

...you get:

{
    'inputs': {
        'ssh_key_data': ['Invalid certificate or key: u'XYZ']
    }
}

Includes /api/v1/ compatability for error message format.  Requests to
/api/v1/ will get:

{'ssh_key_data': ['Invalid certificate or key: u'XYZ']}
 2017-06-01 09:48:42 -04:00
Ryan Petrello 98fa654be2 enforce dict for credential API input payloads 
see: #6363
 2017-06-01 09:19:21 -04:00
Ryan Petrello 462b2c6696 improve a few permission-related errors for CredentialType update/delete 
see: #6385
 2017-05-31 15:48:34 -04:00
Ryan Petrello 23a1c94d38 OpenStack CredentialType needs a domain input field 
see: #6380
 2017-05-31 13:44:38 -04:00
Ryan Petrello 2d0ae56d94 fix incorrect AWS Credential Type labels 
see: #6372
 2017-05-31 13:29:22 -04:00
Ryan Petrello 34b4270b1c add more context for default extra_credentials to the JT launch endpoint 
see: #6394
 2017-05-31 13:22:46 -04:00
Ryan Petrello 5a34f3a1a4 remove a hook QE no longer uses for testing task execution 2017-05-18 15:59:36 -04:00
Ryan Petrello 1ba71acf07 fix a typo causing tests to fail 2017-05-12 15:34:23 -04:00
Ryan Petrello b9007997eb squash together a few credential-related migrations 2017-05-12 14:42:12 -04:00
Ryan Petrello 0ac4f71e5b refactor and fix ssh_private_key and ssh_key_unlock validation 
`clean_ssh_key_data` and `clean_ssh_key_unlock` no longer work because
they're not actual fields on `model.Credential` anymore.  This change
refactors/moves their validation to a place that works (and makes more
sense).
 2017-05-12 09:42:29 -04:00
Ryan Petrello 53c3ece32b add prompting for JT.extra_credentials 
see: #2913
 2017-05-11 07:29:53 -04:00
Ryan Petrello 3126bfa1a2 add tooling to aid in remote debugging sessions 2017-05-09 15:36:13 -04:00
Ryan Petrello 9a6dc4d0ef add a view for /api/v2/credential_types/N/activity_stream/ 2017-05-09 15:01:04 -04:00
Ryan Petrello f7660e1778 properly filter User.password from ActivityStream entries 
see: #6160
 2017-05-09 14:56:27 -04:00
Ryan Petrello 2feb7d5a69 add a new read-only view for /api/v2/credential_types/N/credentials/ 2017-05-08 17:11:09 -04:00
Ryan Petrello 1568fddde1 Make CredentialType conditionally editable/readonly. 
* CredentialTypes should not be editable *or* deletable if they're
  "managed_by_tower".
* CredentialTypes should not be deletable if they're in use by one or
  more Credentials.
* CredentialType.inputs should not be editable if they're in use by one
  or more Credentials.

see: #6077
 2017-05-08 16:13:26 -04:00
Ryan Petrello b7b9fb531e properly support (cloud|network)_credential for JT update *and* create 
fix a bug which caused `POST /api/v1/job_templates/` to not properly set
`JobTemplate.extra_credentials`.

see: #5807
 2017-05-08 13:50:28 -04:00
Ryan Petrello 422a62fb34 fix broken credential type migration upgrade 2017-05-05 13:19:59 -04:00
Ryan Petrello ef09744b75 enforce variable name syntax and uniqueness for Credential Types 
see: #6158
 2017-05-04 16:18:56 -04:00
Ryan Petrello f3591b81a7 more multicredential JobTemplate changes 
* allow for filtering Jobs and JobTemplates by v1 `cloud_credential` and
 `network_credential` fields
* properly validate uniqueness of `extra_credentials` types

see: #5807
 2017-05-04 16:18:48 -04:00
Ryan Petrello 4a438e044e acceptance docs for [AUDIC] Arbitrary User-Defined Inventory & Credential 2017-05-03 14:09:46 -04:00
Ryan Petrello d0a848d49a Add a new extra_credentials endpoint for Jobs and JobTemplates 
additionally, add backwards compatible support for `cloud_credential`
and `network_credential` in /api/v1/job_templates/ and /api/v1/jobs/.

see: #5807
 2017-05-03 13:38:10 -04:00
Ryan Petrello accf7cdea2 Replace Job/JT cloud/network credentials with a single M2M relation. 
The following fields:

    * (Job | JobTemplate).cloud_credential
    * (Job | JobTemplate).network_credential

...are replaced by M2M relationships:

    * Job.extra_credentials
    * JobTemplate.extra_credentials

Includes support for task execution with multiple cloud credentials.

see: #5807
 2017-05-03 13:36:59 -04:00
Ryan Petrello 61b3f7afb7 disallow ask_at_runtime fields for custom credential types 2017-05-02 10:45:43 -04:00
Ryan Petrello a1fa9243bc split machine CredentialType into two distinct (ssh and vault) kinds 2017-05-02 10:26:37 -04:00
Ryan Petrello f6046d47c9 work around a change in ansible 2.3 to Task.get_name() 
Properly detect setup tasks so that we can filter out sensitive
variables from the `ansible_facts` portion of the event payload.
 2017-05-01 10:38:05 -04:00
Ryan Petrello def2034883 add a new vault_credential relationship to Job/JobTemplate 
additionally, properly assign vault credentials to Jobs and JobTemplates
as they're migrated to the new split model

see: #5807
see: #5878
 2017-04-28 15:00:01 -04:00
Ryan Petrello 03460b311e treat tower as a reserved field name for custom CredentialTypes 2017-04-28 11:26:18 -04:00
Ryan Petrello 66e004a9db fix a few more migration-related issues for credentials 2017-04-26 09:24:33 -04:00
Ryan Petrello c0add33212 properly migrate vault credentials to the new credentialtype model 2017-04-25 15:03:16 -04:00
Ryan Petrello 80df1523b0 refactor API v2 version detection and feature inclusion 2017-04-25 09:35:03 -04:00
Ryan Petrello 83dc4f6757 for /api/v1/ requests, filter out v2 (custom) credentials 
see: #5877
 2017-04-24 15:21:30 -04:00
Ryan Petrello aff25c914e blacklist special env vars from being used in CredentialType injectors 
see: #5877
 2017-04-24 15:03:50 -04:00