1009348 - Remove secrets for ceph from puppet

Status: RESOLVED FIXED

(Infrastructure & Operations :: RelOps: Puppet, task)

Description

[Justin Wood (:Callek)]

After Bug 1007976 is resolved we should remove the ceph secrets from eyaml since they will no longer be used.

that is: ceph_access_key_id and ceph_secret_access_key.

As is prudent we should wait a few days min before doing the removal incase there is a need for a backout.

Comment 1

[Justin Wood (:Callek)]

[22:26:51]	glandium	Callek: fwiw, the ceph secrets are still needed for windows, although i have no clue if the gpo uses the same secrets base
[22:28:25]	Callek	glandium: not yet, but probably should rope markco in on that then
[22:28:29]	Callek	will cc him on the other bug
[22:28:39]	Callek	since mark is working to get puppet working on windows for us

So, cc'ing him and adding a bug dep incase the puppet work is gaining traction faster than that GPO work.

Comment 2

[Amy Rich [:arr] [:arich]]

The blocker was resolved about a month ago. Is this something that's going to be cleaned up soon?

Comment 3

[Justin Wood (:Callek)]

Is c#1 still accurate, and a remaining action item?

Comment 4

[Justin Wood (:Callek)]

I did:

$ grep ceph /etc/hiera/secrets.eyaml > /etc/hiera/secrets.eyaml.ceph-backup


And then removed the secrets from the actual eyaml and saved. (the backup is incase there is fallout), I'll remove the backup after I get the n-i's back and there is proven no fallout

Comment 5

[Justin Wood (:Callek)]

I'd have seen fallout from puppet here, so did not save the secrets for that.

rm -f /etc/hiera/secrets.eyaml.ceph-backup - done

Comment 6

[Mike Hommey [:glandium]]

(In reply to Justin Wood (:Callek) from comment #3)
> Is c#1 still accurate

No, ceph secrets are not useful anymore, if they are really ceph secrets (that is, if they are not aws secrets with a name saying they're ceph secrets)