Skip to content

[aap_containerized] Add missing components, fix secret masking gaps#4274

Merged
TurboTurtle merged 1 commit intososreport:mainfrom
lucas-benedito:fix/aap-containerized-plugin-updates
Apr 4, 2026
Merged

[aap_containerized] Add missing components, fix secret masking gaps#4274
TurboTurtle merged 1 commit intososreport:mainfrom
lucas-benedito:fix/aap-containerized-plugin-updates

Conversation

@lucas-benedito
Copy link
Copy Markdown
Contributor

@lucas-benedito lucas-benedito commented Mar 17, 2026

Summary

The aap_containerized plugin was missing coverage for several AAP components, had a typo in a command, and lacked secret masking for some configuration files.

Bug fix:

  • Fix typo: receptorcltreceptorctl (and replace with receptor --version since receptorctl is not available inside the receptor container)

New component coverage (pod_cmds):

  • automation-hub-api: pulpcore-manager --version, pulpcore-manager showmigrations
  • automation-gateway-proxy: envoy --version
  • postgresql: psql --version, pg_isready

Forbidden paths (cert/key/secret exclusion):

  • Added SECRET_KEY files for controller, eda, gateway, lightspeed
  • Added cert/key exclusions for gatewayproxy, lightspeed, ansiblemcp, pcp
  • Added hub/etc/keys/*.key for symmetric encryption keys

Secret masking (postproc):

  • Controller: database password in conf.d/postgres.py (triple-quoted format)
  • Hub: database password, AZURE_ACCOUNT_KEY, AWS_SECRET_ACCESS_KEY
  • Redis: ACL password hashes in redis-users.acl

Process detection (check_enabled):

  • Added gunicorn pulpcore.app.wsgi (hub)
  • Added receptor --config
  • Added metrics-service run

  • Is the commit message split over multiple lines and hard-wrapped at 72 characters?
  • Is the subject and message clear and concise?
  • Does the subject start with [plugin_name] if submitting a plugin patch or a [section_name] if part of the core sosreport code?
  • Does the commit contain a Signed-off-by: First Lastname email@example.com?
  • Are any related Issues or existing PRs properly referenced via a Closes (Issue) or Resolved (PR) line?
  • Are all passwords or private data gathered by this PR obfuscated?

@packit-as-a-service
Copy link
Copy Markdown

Congratulations! One of the builds has completed. 🍾

You can install the built RPMs by following these steps:

  • sudo dnf install -y 'dnf*-command(copr)'
  • dnf copr enable packit/sosreport-sos-4274
  • And now you can install the packages.

Please note that the RPMs should be used only in a testing environment.

@pmoravec
Copy link
Copy Markdown
Contributor

Thanks!

Just a nitpick to

Ran sos report -o aap_containerized -k aap_containerized.username=devops

You can (try to) skip the plugopt username setting, since 2b3841c ;-)

Copy link
Copy Markdown
Member

@TurboTurtle TurboTurtle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When submitting AI-assisted changes, please make sure to follow our Contribution Guidelines, including with commit message formatting and not nuking the PR template provided.

Comment thread sos/report/plugins/aap_containerized.py Outdated
Comment thread sos/report/plugins/aap_containerized.py Outdated
Comment thread sos/report/plugins/aap_containerized.py Outdated
@TurboTurtle TurboTurtle added Status/Need More Info Feedback is required to reproduce issue or to continue work Reviewed/Needs 2nd Ack Require a 2nd ack from a maintainer Status/Needs Review This issue still needs a review from project members Kind/Collection New or updated command or file collection labels Mar 17, 2026
- Fix typo: receptorclt -> receptorctl (replaced with
  receptor --version since receptorctl is not in the container)
- Add pod_cmds for automation-hub-api (pulpcore-manager),
  automation-gateway-proxy (envoy), and postgresql (psql, pg_isready)
- Add forbidden paths for newer components: lightspeed, ansiblemcp,
  gatewayproxy, pcp, and hub symmetric keys
- Add SECRET_KEY file exclusions for controller, eda, gateway,
  lightspeed
- Add secret masking for controller DB password (conf.d/postgres.py),
  hub DB password and cloud storage keys (AZURE_ACCOUNT_KEY,
  AWS_SECRET_ACCESS_KEY), and redis ACL password hashes
- Add process signatures for hub (gunicorn pulpcore), receptor,
  and metrics-service to check_enabled

Assisted-by: Claude
Signed-off-by: Lucas Benedito <lbenedit@redhat.com>
@lucas-benedito lucas-benedito force-pushed the fix/aap-containerized-plugin-updates branch from f38c830 to 12972d1 Compare March 17, 2026 19:28
@lucas-benedito lucas-benedito changed the title aap_containerized: add missing components, fix secret masking gaps [aap_containerized] Add missing components, fix secret masking gaps Mar 17, 2026
@lucas-benedito
Copy link
Copy Markdown
Contributor Author

My apologies for missing the community guidelines format for the PR summary. I've updated it accordingly.

@TurboTurtle TurboTurtle added Reviewed/Ready for Merge Has been reviewed, ready for merge and removed Status/Need More Info Feedback is required to reproduce issue or to continue work Reviewed/Needs 2nd Ack Require a 2nd ack from a maintainer Status/Needs Review This issue still needs a review from project members labels Apr 4, 2026
@TurboTurtle TurboTurtle merged commit 8ed8739 into sosreport:main Apr 4, 2026
44 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Kind/Collection New or updated command or file collection Reviewed/Ready for Merge Has been reviewed, ready for merge

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants