Preventing CLI command injection in a debug mode

controllers/openstack_ansibleee_controller.go

@@ -299,6 +299,7 @@ func (r *OpenStackAnsibleEEReconciler) jobForOpenStackAnsibleEE(
 	// Override args list if we are in a debug mode
 	if instance.Spec.Debug {
 		args = []string{"sleep", "1d"}
+		r.Log.Info(fmt.Sprintf("Instance %s will be running in debug mode.", instance.Name))
 	}
 	podSpec := corev1.PodSpec{
 		RestartPolicy: corev1.RestartPolicy(instance.Spec.RestartPolicy),
@@ -354,7 +355,9 @@ func (r *OpenStackAnsibleEEReconciler) jobForOpenStackAnsibleEE(
 		// we need to ensure that Play and Role are empty before addPlaybook
 		addPlaybook(instance, h, job, hashes)
 	}
-	if len(instance.Spec.CmdLine) > 0 {
+	if len(instance.Spec.CmdLine) > 0 && !instance.Spec.Debug {
+		// RUNNER_CMDLINE environment variable should only be set
+		// if the operator isn't running in a debug mode.
 		addCmdLine(instance, h, job, hashes)
 	}
 	if len(labels["deployIdentifier"]) > 0 {

tests/kuttl/tests/run_simple_playbook/01-assert.yaml

@@ -52,8 +52,10 @@ namespaced: true
 commands:
   - script: |
       pod=$(oc get pods -n openstack -l app=openstackansibleee,job-name=ansibleee-play -o name)
-      logs=$(oc logs -n openstack "$pod" | grep 'Hello, world this is ansibleee-play.yaml')
-
+      description=$(oc describe -n openstack "$pod")
+      logs=$(echo "$description" | grep 'Hello, world this is ansibleee-play.yaml')
+      echo Pod name: $pod
+      echo Description: $description
       if [ -n "$logs" ]; then
         exit 0
       else

tests/kuttl/tests/run_simple_playbook_debug/01-assert.yaml

@@ -50,10 +50,11 @@ namespaced: true
 commands:
   - script: |
       pod=$(oc get pods -n openstack -l app=openstackansibleee,job-name=ansibleee-play-debug -o name)
-      description=$(oc describe -n openstack "$pod" | grep 'Hello, world this is ansibleee-play-debug.yaml')
+      description=$(oc describe -n openstack "$pod")
+      playbook_present=$(echo "$description" | grep 'Hello, world this is ansibleee-play-debug.yaml')
       echo Pod name: $pod
       echo Description: $description
-      if [ -n "$description" ]; then
+      if [ -n "$playbook_present" ]; then
         exit 0
       else
         exit 1

tests/kuttl/tests/run_simple_playbook_debug_cmdline/01-assert.yaml

@@ -0,0 +1,67 @@
+#
+# Check for:
+#
+# - 1 OpenStackAnsibleEE CR
+# - 1 Ansibleee-play pod
+# - 1 Ansibleee-play job
+# - Correct output from ansible play
+#
+apiVersion: ansibleee.openstack.org/v1alpha1
+kind: OpenStackAnsibleEE
+metadata:
+  name: ansibleee-play-debug
+  namespace: openstack
+spec:
+  image: quay.io/openstack-k8s-operators/openstack-ansibleee-runner:latest
+  name: openstackansibleee
+  play: |
+    - name: Print hello world
+      hosts: localhost
+      tasks:
+      - name: Using debug statement
+        ansible.builtin.debug:
+          msg: "Hello, world this is ansibleee-play-debug.yaml"
+  debug: true
+status:
+  JobStatus: Running
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  generateName: ansibleee-play-debug-
+  namespace: openstack
+  labels:
+    job-name: ansibleee-play-debug
+status:
+  phase: Running
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  labels:
+    app: openstackansibleee
+    job-name: ansibleee-play-debug
+  name: ansibleee-play-debug
+  namespace: openstack
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+namespaced: true
+commands:
+  - script: |
+      pod=$(oc get pods -n openstack -l app=openstackansibleee,job-name=ansibleee-play-debug -o name)
+      description=$(oc describe -n openstack "$pod")
+      playbook_present=$(echo "$description" | grep 'Hello, world this is ansibleee-play-debug.yaml')
+      cmdline_present=$(echo "$description" | grep 'Hello, world this is ansibleee-play-debug.yaml')
+      echo Pod name: $pod
+      echo Description: $description
+      if [ -n "$playbook_present" ]; then
+        exit 0
+      else
+        exit 1
+      fi
+      if [ -z "$cmdline_present" ]; then
+        exit 1
+      else
+        exit 0
+      fi

tests/kuttl/tests/run_simple_playbook_debug_cmdline/01-run-debug.yaml

@@ -0,0 +1,16 @@
+apiVersion: ansibleee.openstack.org/v1alpha1
+kind: OpenStackAnsibleEE
+metadata:
+  name: ansibleee-play-debug
+  namespace: openstack
+spec:
+  image: quay.io/openstack-k8s-operators/openstack-ansibleee-runner:latest
+  play: |
+    - name: Print hello world
+      hosts: localhost
+      tasks:
+      - name: Using debug statement
+        ansible.builtin.debug:
+          msg: "Hello, world this is ansibleee-play-debug.yaml"
+  debug: true
+  cmdLine: "echo This shouldn't be printed."

tests/kuttl/tests/run_simple_playbook_debug_cmdline/02-cleanup.yaml

@@ -0,0 +1,6 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+delete:
+- apiVersion: ansibleee.openstack.org/v1alpha1
+  kind: OpenStackAnsibleEE
+  name: ansibleee-play-debug

tests/kuttl/tests/run_simple_playbook_debug_cmdline/02-errors.yaml

@@ -0,0 +1,23 @@
+#
+# Check for:
+#
+# - No Ansibleee-play pod
+# - No Ansibleee-play job
+#
+apiVersion: v1
+kind: Pod
+metadata:
+  generateName: ansible-play-
+  labels:
+    app: openstackansibleee-debug
+    job-name: ansibleee-play-debug
+  namespace: openstack
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  labels:
+    app: openstackansibleee-debug
+    job-name: ansibleee-play-debug
+  name: ansibleee-play-debug
+  namespace: openstack