Skip to content

Avoid writing secrets as persistent node attributes

Matt Smiley requested to merge avoid_tainting_node_attrs_with_secrets into master

Running deep_merge! to merge the hash of secrets from GKMS Vault into the hash of non-secret node attributes was actually adding the merge results to Chef Server's persistent cache of node attributes. This has a few undesirable side-effects:

  • It leaks the gitlab-patroni cookbook's secrets (i.e. postgres superuser credentials and SSH private key material), making them available in plaintext to anyone with read-access to query Chef Server via knife node show or knife node attribute get.
  • It prevents deleting a secret, since removing a secret from GKMS does not remove it from the saved result of the previously merged node attributes. Attribute values from the secrets list override the node attribute values, but if an temporary or obsolete secret is deleted from GKMS, the fact that it was previously merged into the node attributes means it remains present after deleting the key from GKMS. (For example, switching which postgres user to use for patroni roles unexpectedly preserved both the old and new users' credentials in the chef-managed config files.)

After this cookbook fix gets published, the inappropriately persisted node attributes must be deleted from Chef Server as a follow-up task. For more details, see notes in the description of the linked issue.

Issue: https://gitlab.com/gitlab-com/gl-infra/infrastructure/-/issues/9801

Merge request reports