[kustomize_deploy] Randomize libvirt-secret password at deploy time

[abays]

The architecture repo's lib/dataplane/nodeset component generates a libvirt-secret Secret from a hardcoded libvirt-secret.env file (LibvirtPassword=12345678). Extend the post-kustomize manifest injection pattern introduced for osp-secret so this well-known default password is also randomized before oc apply.

After each kustomize build, if the rendered dataplane manifest contains a libvirt-secret Secret, its data keys are replaced with a cryptographically random value via the shared osp_secret_manifest.py helper, unless a live cluster secret already exists (in which case its value is preserved across redeploys).

To support this, generalize osp_secret_manifest.py so its helpers and CLI commands (has, get, get-namespace, set, randomize) accept an optional secret name, defaulting to osp-secret for backward compatibility. Add a new inject_libvirt_secret_key.yml task file mirroring the osp-secret randomization block, wired into execute_step.yml so it runs for every stage but is a no-op except for the dataplane stage.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign eshulman2 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[qodo-code-review]

PR Summary by Qodo

Randomize libvirt-secret passwords during Kustomize deployment

🐞 Bug fix ✨ Enhancement 🧪 Tests 📝 Documentation 🕐 20-40 Minutes

AI Description

• Randomizes rendered libvirt-secret credentials before applying dataplane manifests.
• Preserves cluster values across redeployments and generates secure passwords for new deployments.
• Generalizes and tests secret tooling while retaining osp-secret defaults.

Diagram

graph TD
  A["Kustomize Build"] --> B["Rendered Manifest"] --> C{"libvirt-secret?"}
  C -- "No" --> G["oc apply"]
  C -- "Yes" --> D["Cluster Lookup"] --> E{"Existing value?"}
  E -- "Yes: preserve" --> F["Secret Randomizer"] --> G
  E -- "No: generate" --> F

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Parameterized secret injection task

• ➕ Eliminates duplication between osp-secret and libvirt-secret orchestration
• ➕ Provides a reusable path for additional generated secrets
• ➖ Requires accommodating osp-secret-specific KEK and skip-key behavior
• ➖ Broadens the refactor and regression surface of this security fix

2. Generate credentials in the architecture source

• ➕ Addresses the insecure default closer to its origin
• ➕ Keeps deployment-role logic simpler
• ➖ Kustomize cannot natively provide cryptographically random, persistent values
• ➖ Cross-repository changes complicate rollout and backward compatibility
• ➖ Preserving live values across redeployments still requires cluster-aware logic

Recommendation: The PR's approach is appropriate for the immediate security issue: it reuses the established post-build injection point, preserves deployed credentials, and keeps existing osp-secret callers compatible. A follow-up could extract the shared cluster-lookup and randomization sequence into a parameterized task if more secrets adopt this pattern.

Files changed (5) +316 / -36

Enhancement (2) +61 / -36

osp_secret_manifest.pyGeneralize manifest helpers for named Secrets +56/-36

Generalize manifest helpers for named Secrets

• Adds an optional secret name to lookup, namespace, key mutation, and randomization helpers and CLI commands. Existing callers continue targeting osp-secret by default.

roles/kustomize_deploy/files/osp_secret_manifest.py

execute_step.ymlAdd libvirt-secret processing to the deployment pipeline +5/-0

Add libvirt-secret processing to the deployment pipeline

• Invokes the new libvirt-secret injection tasks after each Kustomize build and before artifact storage and cluster application.

roles/kustomize_deploy/tasks/execute_step.yml

Bug fix (1) +137 / -0

inject_libvirt_secret_key.ymlPreserve or randomize rendered libvirt credentials +137/-0

Preserve or randomize rendered libvirt credentials

• Detects libvirt-secret resources, resolves their namespace, and retrieves existing cluster values when available. It securely passes preserved values to the shared randomizer or generates new credentials, then always removes the temporary plaintext configuration.

roles/kustomize_deploy/tasks/inject_libvirt_secret_key.yml

Tests (1) +106 / -0

test_osp_secret_manifest.pyTest named-secret helper and CLI behavior +106/-0

Test named-secret helper and CLI behavior

• Adds coverage for selecting libvirt-secret, reading and randomizing its password, isolating unrelated Secrets, and invoking named-secret CLI commands. The tests also verify backward-compatible osp-secret defaults.

tests/unit/roles/test_osp_secret_manifest.py

Documentation (1) +12 / -0

README.mdDocument libvirt-secret credential randomization +12/-0

Document libvirt-secret credential randomization

• Explains why the hardcoded libvirt password is replaced after Kustomize rendering. Documents cluster-value precedence, generated password format, and no-op behavior for unrelated stages.

roles/kustomize_deploy/README.md

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can turn these tips off under Display preferences

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/5ea67dd5cde049ca9ba89ff7bec8f10f

✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 16m 45s
✔️ podified-multinode-edpm-deployment-crc SUCCESS in 1h 22m 44s
✔️ cifmw-crc-podified-edpm-baremetal SUCCESS in 1h 34m 00s
❌ cifmw-crc-podified-edpm-baremetal-minor-update NODE_FAILURE Node(set) request 099-0000199248 failed in 0s
✔️ cifmw-pod-zuul-files SUCCESS in 4m 37s
✔️ openstack-k8s-operators-content-provider-bootc SUCCESS in 1h 03m 11s
❌ cifmw-crc-podified-edpm-baremetal-bootc NODE_FAILURE Node(set) request 099-0000199016 failed in 0s
✔️ noop SUCCESS in 0s
✔️ cifmw-pod-ansible-test SUCCESS in 8m 21s
✔️ cifmw-pod-pre-commit SUCCESS in 8m 47s
✔️ cifmw-architecture-validate-hci SUCCESS in 5m 57s
✔️ cifmw-molecule-kustomize_deploy SUCCESS in 6m 14s

[abays]

recheck

[centosinfra-prod-github-app]

Build succeeded (check pipeline).
https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/36d6b12c0f1d4bb796e890fd88d73912

✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 09m 33s
✔️ podified-multinode-edpm-deployment-crc SUCCESS in 1h 22m 01s
✔️ cifmw-crc-podified-edpm-baremetal SUCCESS in 1h 39m 06s
✔️ cifmw-crc-podified-edpm-baremetal-minor-update SUCCESS in 1h 56m 34s
✔️ cifmw-pod-zuul-files SUCCESS in 4m 40s
✔️ openstack-k8s-operators-content-provider-bootc SUCCESS in 2h 55m 38s
✔️ cifmw-crc-podified-edpm-baremetal-bootc SUCCESS in 1h 30m 41s
✔️ noop SUCCESS in 0s
✔️ cifmw-pod-ansible-test SUCCESS in 8m 27s
✔️ cifmw-pod-pre-commit SUCCESS in 9m 01s
✔️ cifmw-architecture-validate-hci SUCCESS in 6m 15s
✔️ cifmw-molecule-kustomize_deploy SUCCESS in 6m 46s