From 2d225c2250e0cd878fff69f7ddc7e4faf16d1787 Mon Sep 17 00:00:00 2001 From: OpenStack Release Bot Date: Wed, 16 Apr 2025 08:41:09 +0000 Subject: [PATCH 1/3] Update .gitreview for stable/2025.1 Change-Id: I6b764c5cdf055ca48f9c57c38da47e2075754696 --- .gitreview | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitreview b/.gitreview index 19b5cb4f..5f91bd6d 100644 --- a/.gitreview +++ b/.gitreview @@ -2,3 +2,4 @@ host=review.opendev.org port=29418 project=openstack/puppet-openstacklib.git +defaultbranch=stable/2025.1 From 9d1998a3d5043f90f1a28b86f8e05b2c21bfebdb Mon Sep 17 00:00:00 2001 From: OpenStack Release Bot Date: Wed, 16 Apr 2025 08:41:11 +0000 Subject: [PATCH 2/3] Update TOX_CONSTRAINTS_FILE for stable/2025.1 Update the URL to the upper-constraints file to point to the redirect rule on releases.openstack.org so that anyone working on this branch will switch to the correct upper-constraints list automatically when the requirements repository branches. Until the requirements repository has as stable/2025.1 branch, tests will continue to use the upper-constraints list on master. Change-Id: I3b02b29a6048d5cec64b284ed60b47e25b510665 --- tox.ini | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tox.ini b/tox.ini index 5bf76d23..7ce85edb 100644 --- a/tox.ini +++ b/tox.ini @@ -8,6 +8,6 @@ ignore_basepython_conflict = True basepython = python3 [testenv:releasenotes] -deps = -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master} +deps = -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/2025.1} -r{toxinidir}/doc/requirements.txt commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html From 12557ed183275edadd72c9942eef9f7fdc761f78 Mon Sep 17 00:00:00 2001 From: Tobias Urdin Date: Thu, 6 Nov 2025 16:53:24 +0100 Subject: [PATCH 3/3] Replace Puppet::Util::withenv with custom version ... that filters out OS_* environment variables from the existing copied ENV and then set the passed environment variables to ENV and yield to the openstack CLI call. This has been a problem for a very long this where if you source OS_* environment in your shell and try to run Puppet the openstack CLI calls executed by the Puppet modules will pick up these environment variables causing side effects such as `openstack token issue` commands failing to test password for keystone_user resources causing a `openstack uset set` command even though the password has not changed. Change-Id: Ic4f9d7f7e8faf5ba5caaade49f10789aa8dba864 Signed-off-by: Tobias Urdin (cherry picked from commit 864f02dda63a0bb566643302b561b2dc04eb8530) (cherry picked from commit 2e85937d7503ad44156c7fd9f209d25aa0a8c8cb) --- lib/puppet/provider/openstack.rb | 19 +++++++- .../notes/os-withenv-3ca466fde75f6441.yaml | 6 +++ spec/unit/provider/openstack_spec.rb | 43 ++++++++++++++++++- 3 files changed, 66 insertions(+), 2 deletions(-) create mode 100644 releasenotes/notes/os-withenv-3ca466fde75f6441.yaml diff --git a/lib/puppet/provider/openstack.rb b/lib/puppet/provider/openstack.rb index a11b8f4b..b67f54d3 100644 --- a/lib/puppet/provider/openstack.rb +++ b/lib/puppet/provider/openstack.rb @@ -76,6 +76,23 @@ def self.request_without_retry(&block) rc end + # Copy of Puppet::Util::withenv but that filters out + # env variables starting with OS_ from the existing + # environment. + # + # @param hash [Hash] Hash of environment variables + def self.os_withenv(hash) + saved = ENV.to_hash + begin + cleaned_env = ENV.to_hash.reject { |k, _| k.start_with?('OS_') } + ENV.replace(cleaned_env) + ENV.merge!(hash.transform_keys(&:to_s)) + yield + ensure + ENV.replace(saved) + end + end + # Returns an array of hashes, where the keys are the downcased CSV headers # with underscores instead of spaces # @@ -85,7 +102,7 @@ def self.request(service, action, properties, credentials=nil, options={}) env = credentials ? credentials.to_env : {} no_retry = options[:no_retry_exception_msgs] - Puppet::Util.withenv(env) do + os_withenv(env) do rv = nil start_time = current_time end_time = start_time + request_timeout diff --git a/releasenotes/notes/os-withenv-3ca466fde75f6441.yaml b/releasenotes/notes/os-withenv-3ca466fde75f6441.yaml new file mode 100644 index 00000000..e381ca63 --- /dev/null +++ b/releasenotes/notes/os-withenv-3ca466fde75f6441.yaml @@ -0,0 +1,6 @@ +--- +fixes: + - | + The ``Puppet::Provider::Openstack.request`` now filters out all external + ``OS_*`` environment variables to prevent collisions with environment + variables in the shell where Puppet is running. diff --git a/spec/unit/provider/openstack_spec.rb b/spec/unit/provider/openstack_spec.rb index c0cdf5ea..fa369444 100644 --- a/spec/unit/provider/openstack_spec.rb +++ b/spec/unit/provider/openstack_spec.rb @@ -80,7 +80,7 @@ end it 'uses provided credentials' do - expect(Puppet::Util).to receive(:withenv).with(credentials.to_env) + expect(provider.class).to receive(:os_withenv).with(credentials.to_env) Puppet::Provider::Openstack.request('project', 'list', ['--long'], credentials) end @@ -242,4 +242,45 @@ expect(Puppet::Provider::Openstack.parse_python_list(s)).to eq([1, 2, 3]) end end + + describe '#os_withenv' do + around do |example| + @original_env = ENV.to_hash + example.run + ENV.replace(@original_env) + end + + it 'removes environment variables starting with OS_' do + ENV['OS_FOO'] = 'should be removed' + ENV['OTHER'] = 'should stay' + + Puppet::Provider::Openstack.os_withenv({}) do + expect(ENV.key?('OS_FOO')).to be false + expect(ENV['OTHER']).to eq('should stay') + end + end + + it 'merges the given environment variables' do + Puppet::Provider::Openstack.os_withenv({'MY_VAR' => '123'}) do + expect(ENV['MY_VAR']).to eq('123') + end + end + + it 'restores the original environment after the block' do + original = ENV.to_hash + Puppet::Provider::Openstack.os_withenv({'TEMP_VAR' => 'test'}) do + ENV['INSIDE_BLOCK'] = 'yep' + end + + expect(ENV.key?('TEMP_VAR')).to be false + expect(ENV.key?('INSIDE_BLOCK')).to be false + expect(ENV.to_hash).to eq(original) + end + + it 'handles string and symbol keys in the input hash' do + Puppet::Provider::Openstack.os_withenv({:FOO => 'bar'}) do + expect(ENV['FOO']).to eq('bar') + end + end + end end