Support alternate password for PTF container (#16457)

What is the motivation for this PR?
The PTF container is always using default password. If the PTF container is on same bridge with the host server's management IP, then it is easily accessible from other host servers. This is not secure enough. We need to support alternate password for the PTF container and password rotation.

How did you do it?
This change improved the ansible related code to support accessing the PTF containers using the multi_ssh_pass ansible plugin. Then we can specify alternate passwords for the PTF container. When alternate passwords are specified, the default password of PTF container is updated after PTF creation.

How did you verify/test it?
Tested remove-topo/add-topo/restart-ptf on KVM and physical testbed.

Author: wangxin

ansible/group_vars/ptf/secrets.yml

@@ -0,0 +1,7 @@
+ansible_connection: multi_passwd_ssh
+
+ansible_user: root
+ansible_ssh_pass: root
+# ansible_altpasswords:
+#   - fakepassword1
+#   - fakepassword2

ansible/group_vars/ptf_host/secrets.yml

@@ -79,6 +79,9 @@
             memory_swap: 8G
           become: yes
 
+        - name: Update ptf password
+          include_tasks: update_ptf_password.yml
+
         - name: Bind ptf_ip to keysight_api_server
           vm_topology:
             cmd: "bind_keysight_api_server_ip"
@@ -170,6 +173,9 @@
       memory_swap: 32G
     become: yes
 
+  - name: Update ptf password
+    include_tasks: update_ptf_password.yml
+
   - name: Enable ipv6 for docker container ptf_{{ vm_set_name }}
     command: docker exec -i ptf_{{ vm_set_name }} sysctl -w net.ipv6.conf.all.disable_ipv6=0
     become: yes

ansible/roles/vm_set/tasks/add_topo.yml

@@ -1,22 +1,14 @@
 ---
-- name: Include variables for PTF containers
-  include_vars:
-    dir: "{{ playbook_dir }}/group_vars/ptf_host/"
-
 - name: Set ptf host
   set_fact:
-    ptf_host: "ptf_{{ vm_set_name }}"
+    ptf_host: "{{ ptf_ip.split('/')[0] }}"
     ptf_host_ip: "{{ ptf_ip.split('/')[0] }}"
 
 - name: Add ptf host
   add_host:
-    hostname: "{{ ptf_host }}"
-    ansible_user: "{{ ptf_host_user }}"
-    ansible_ssh_host: "{{ ptf_host_ip }}"
-    ansible_ssh_pass: "{{ ptf_host_pass }}"
-    ansible_python_interpreter: "/usr/bin/python"
+    name: "{{ ptf_host }}"
     groups:
-      - ptf_host
+      - ptf
 
 - name: Set default exabgp_action
   set_fact:

ansible/roles/vm_set/tasks/announce_routes.yml

@@ -1,22 +1,14 @@
 ---
-- name: Include variables for PTF containers
-  include_vars:
-    dir: "{{ playbook_dir }}/group_vars/ptf_host/"
-
 - name: Set ptf host
   set_fact:
-    ptf_host: "ptf_{{ vm_set_name }}"
+    ptf_host: "{{ ptf_ip.split('/')[0] }}"
     ptf_host_ip: "{{ ptf_ip.split('/')[0] }}"
 
 - name: Add ptf host
   add_host:
-    hostname: "{{ ptf_host }}"
-    ansible_user: "{{ ptf_host_user }}"
-    ansible_ssh_host: "{{ ptf_host_ip }}"
-    ansible_ssh_pass: "{{ ptf_host_pass }}"
-    ansible_python_interpreter: "/usr/bin/python"
+    name: "{{ ptf_host }}"
     groups:
-      - ptf_host
+      - ptf
 
 - name: wait until ptf is reachable
   wait_for:

ansible/roles/vm_set/tasks/ptf_change_mac.yml

@@ -1,22 +1,14 @@
 ---
-- name: Include variables for PTF containers
-  include_vars:
-    dir: "{{ playbook_dir }}/group_vars/ptf_host/"
-
 - name: Set ptf host
   set_fact:
-    ptf_host: "ptf_{{ vm_set_name }}"
+    ptf_host: "{{ ptf_ip.split('/')[0] }}"
     ptf_host_ip: "{{ ptf_ip.split('/')[0] }}"
 
 - name: Add ptf host
   add_host:
-    hostname: "{{ ptf_host }}"
-    ansible_user: "{{ ptf_host_user }}"
-    ansible_ssh_host: "{{ ptf_host_ip }}"
-    ansible_ssh_pass: "{{ ptf_host_pass }}"
-    ansible_python_interpreter: "/usr/bin/python"
+    name: "{{ ptf_host }}"
     groups:
-      - ptf_host
+      - ptf
 
 - name: find downlink portchannel configuration
   set_fact:

ansible/roles/vm_set/tasks/ptf_portchannel.yml

@@ -122,6 +122,9 @@
       memory_swap: 32G
     become: yes
 
+  - name: Update ptf password
+    include_tasks: update_ptf_password.yml
+
   - name: Enable ipv6 for docker container ptf_{{ vm_set_name }}
     command: docker exec -i ptf_{{ vm_set_name }} sysctl -w net.ipv6.conf.all.disable_ipv6=0
     become: yes

ansible/roles/vm_set/tasks/renumber_topo.yml

@@ -1,55 +1,43 @@
 ---
-- name: Include variables for PTF containers
-  include_vars:
-    dir: "{{ playbook_dir }}/group_vars/ptf_host/"
+- name: Set ptf host
+  set_fact:
+    ptf_host: "{{ ptf_ip.split('/')[0] }}"
+
+- name: Add ptf host
+  add_host:
+    name: "{{ ptf_host }}"
+    groups:
+      - ptf
+
+- name: Check if ptf_tgen exists
+  supervisorctl:
+    name: ptf_tgen
+    state: present
+  become: True
+  delegate_to: "{{ ptf_host }}"
+  ignore_errors: True
+  register: ptf_tgen_state
 
 - block:
-    - name: Set ptf host
-      set_fact:
-        ptf_host: "ptf_{{ vm_set_name }}"
-        ptf_host_ip: "{{ ptf_ip.split('/')[0] }}"
+    - name: Copy scapy scripts to ptf host
+      copy:
+        src: "{{ item }}"
+        dest: "/ptf_tgen/"
+      with_fileglob:
+        - "{{ playbook_dir }}/../spytest/spytest/tgen/scapy/*"
+        - "{{ playbook_dir }}/../spytest/spytest/dicts.py"
 
-    - name: Add ptf host
-      add_host:
-        hostname: "{{ ptf_host }}"
-        ansible_user: "{{ ptf_host_user }}"
-        ansible_ssh_host: "{{ ptf_host_ip }}"
-        ansible_ssh_pass: "{{ ptf_host_pass }}"
-        groups:
-          - ptf_host
+    - name: Create ptf_tgen service
+      copy:
+        src: "/ptf_tgen/service.sh"
+        dest: "/ptf_tgen/ptf_tgen.sh"
+        mode: "0755"
+        remote_src: yes
 
-    - name: Check if ptf_tgen exists
+    - name: Start ptf_tgen
       supervisorctl:
         name: ptf_tgen
-        state: present
-      become: True
-      delegate_to: "{{ ptf_host }}"
-      ignore_errors: True
-      register: ptf_tgen_state
-
-    - block:
-        - name: Copy scapy scripts to ptf host
-          copy:
-            src: "{{ item }}"
-            dest: "/ptf_tgen/"
-          with_fileglob:
-            - "{{ playbook_dir }}/../spytest/spytest/tgen/scapy/*"
-            - "{{ playbook_dir }}/../spytest/spytest/dicts.py"
-
-        - name: Create ptf_tgen service
-          copy:
-            src: "/ptf_tgen/service.sh"
-            dest: "/ptf_tgen/ptf_tgen.sh"
-            mode: "0755"
-            remote_src: yes
-
-        - name: Start ptf_tgen
-          supervisorctl:
-            name: ptf_tgen
-            state: restarted
-      become: True
-      delegate_to: "{{ ptf_host }}"
-      when: ptf_tgen_state is not failed
-  when:
-    - ptf_host_user is defined
-    - ptf_host_pass is defined
+        state: restarted
+  become: True
+  delegate_to: "{{ ptf_host }}"
+  when: ptf_tgen_state is not failed

ansible/roles/vm_set/tasks/start_ptf_tgen.yml

@@ -43,7 +43,14 @@
 
 - name: Set ptf host
   set_fact:
-    ptf_host: "ptf_{{ vm_set_name }}"
+    ptf_host: "{{ ptf_ip.split('/')[0] }}"
+    ptf_host_ip: "{{ ptf_ip.split('/')[0] }}"
+
+- name: Add ptf host
+  add_host:
+    name: "{{ ptf_host }}"
+    groups:
+      - ptf
 
 - debug: msg="ptf_host {{ ptf_host }}"
 

ansible/roles/vm_set/tasks/start_tacacs_daily_daemon.yml

@@ -0,0 +1,63 @@
+- include_vars:
+    file: "{{ playbook_dir }}/group_vars/ptf/secrets.yml"
+    name: raw_ptf_secrets
+  no_log: true
+
+- name: Render ptf secrets
+  set_fact:
+    ptf_secrets: >-
+      {{
+        dict(
+          raw_ptf_secrets.keys() | zip(raw_ptf_secrets.values()
+          )
+        )
+      }}
+  no_log: true
+
+- block:
+
+  - name: Init default ptf_username
+    set_fact:
+      ptf_username: "root"
+    when: ptf_username is not defined
+
+  - name: Init default ptf_password
+    set_fact:
+      ptf_password: "root"
+    when: ptf_password is not defined
+    no_log: true
+
+  - name: Override default ptf_username
+    set_fact:
+      ptf_username: "{{ ptf_secrets['ansible_user'] }}"
+    when: "'ansible_user' in ptf_secrets"
+
+  - name: Override default ptf_password
+    set_fact:
+      ptf_password: "{{ ptf_secrets['ansible_ssh_pass'] }}"
+    when: "'ansible_ssh_pass' in ptf_secrets"
+
+  - name: Get ptf_alt_passwords from ptf_secrets
+    set_fact:
+      ptf_alt_passwords: "{{ ptf_secrets['ansible_altpasswords'] }}"
+    no_log: true
+
+  - name: If ptf_alt_passwords is a list, set ptf_password to its first value
+    set_fact:
+      ptf_password: "{{ ptf_alt_passwords[0] }}"
+    when: ptf_alt_passwords | type_debug == "list" and ptf_alt_passwords | length > 0
+    no_log: true
+
+  - name: If ptf_alt_passwords is not a list, log a debug message
+    debug:
+      msg: >-
+        The 'ansible_altpasswords' field in group_vars/ptf/secrets.yml is not a list.
+        Falling back to use the 'ansible_ssh_pass' field."
+    when: ptf_alt_passwords | type_debug != "list"
+
+  - name: Update ptf username and password
+    command: docker exec -t ptf_{{ vm_set_name }} sh -c 'echo "{{ ptf_username }}:{{ ptf_password }}" | chpasswd'
+    become: yes
+    no_log: true
+
+  when: ptf_secrets is defined and 'ansible_altpasswords' in ptf_secrets