Re: FAI + SaltStack anybody?
Andrew Ruthven <[email protected]>
| Newsgroups | gmane.linux.debian.fai |
|---|---|
| Message-ID | <[email protected]> |
On Fri, 2023-10-06 at 11:18 +0200, Thomas Lange wrote: > > > > > > On Fri, 06 Oct 2023 21:57:28 +1300, Andrew Ruthven > > > > > > <[email protected]> said: > > > This isn't ideal as the secrets are still present in the NFSROOT for > a short > > period of time, but does solve the chicken and egg issue others > mentioned > This reminds me of a solution I once saw. > Put some info into a fifo (named pipe), so only one receiver can read > it. After that the fifo is empty. > > What about having a daemon on the FAI server which serves some secrect > using: > echo secrect | nc -p 12345 -l > > So only one FAI client can read the secrect from port 12345 once. > This may help a little bit. This could help. It could also do some level of validation of the IP/MAC that the request is coming from, especially if you've used fai-chboot. Again not ideal, but better. The thing I like about my solution is that fcopy just works. :) Cheers, Andrew -- Andrew Ruthven, Wellington, New Zealand [email protected] | Catalyst Cloud: | This space intentionally left blank https://catalystcloud.nz |