set a random password for keepalived #263
Conversation
| @@ -4,3 +4,4 @@ | |||
| rke2_method: tar | |||
| rke2_service_name: "rke2-{{ rke2_type }}.service" | |||
| rke2_restart_needed: false | |||
| keepalived_secret: "{{ lookup('community.general.random_string', length=80, base64=True) }}" | |||
There was a problem hiding this comment.
This will cause that all keepalived nodes will have different password
There was a problem hiding this comment.
Do you know if there is a way to cache the value or something so it's the same for all hosts? I guess it could be set as a fact first and then that fact could be used later?
There was a problem hiding this comment.
Technically you could use local facts for storing it. But then you would need solve also things like to have this secret idempotent but still have an option to change it, use it also for new node joining the keepalived cluster... etc. The solution would have to be too much programmatic i guess... And Ansible is not an programming language :-) I think the value should be left up to user.
| @@ -50,8 +50,8 @@ vrrp_instance VI_1 { | |||
| {% endfor %} | |||
| } | |||
| authentication { | |||
| auth_type PASS | |||
| auth_pass rke2servers | |||
| auth_type AH | |||
There was a problem hiding this comment.
This should be configurable with PASS as the default. Also in case of AH, it would be good to have an additional option for auth_algo.
There was a problem hiding this comment.
I'm no expert here, I just thought the AH algo was better than the PASS algo because the AH algo isn't as sniffable. Why would you want to use the PASS algo?
There was a problem hiding this comment.
Because there are users which are already using this Ansible Role and by changing keepalived configuration the role may cause service interruption.
Description
set a random password for keepalived instead of having the same pre-shared key.
also switched to authentication headers instead of the password, as it is more secure that way.
set the folder permissions so you can't just read the password with OS access.
Type of change
How Has This Been Tested?