correctly propagate password to requested instances

the recipe slapos.cookbook:generate.password will install the password only after the [request-xx] was called for the first time. Then the second run of buildout the password can change as it was not stored yet. We use publish-early to make it persistent on master and avoid inconsistency between published password and stored one.

/reviewed-on nexedi/slapos!370

software/kvm/instance-kvm-cluster.cfg.jinja2.in

@@ -91,7 +91,7 @@ config-httpd-port = {{ dumps(kvm_parameter_dict.get('httpd-port', 8081)) }}
 config-disable-ansible-promise = {{ dumps(kvm_parameter_dict.get('disable-ansible-promise', False)) }}
 config-monitor-cors-domains = {{ slapparameter_dict.get('monitor-cors-domains', 'monitor.app.officejs.com') }}
 config-monitor-username = ${monitor-instance-parameter:username}
-config-monitor-password = ${monitor-htpasswd:passwd}
+config-monitor-password = ${publish-early:monitor-password}
 # Enable disk wipe options
 {% if kvm_parameter_dict.get('wipe-disk-ondestroy', False) -%}
 config-wipe-disk-ondestroy = True
@@ -238,6 +238,11 @@ mode = {{ mode }}
 {{ writefile('cluster-data-content', '${directory:webroot}/${hash-code:passwd}/data', slapparameter_dict.get('cluster-data', ''), '700') }}
 {% endif -%}
 
+[publish-early]
+recipe = slapos.cookbook:publish-early
+-init =
+  monitor-password monitor-htpasswd:passwd
+
 [monitor-instance-parameter]
 monitor-httpd-port = 8060
 cors-domains = {{ slapparameter_dict.get('monitor-cors-domains', 'monitor.app.officejs.com') }}
@@ -260,6 +265,8 @@ recipe = slapos.cookbook:publish
 {% endfor %}
 {% set monitor_interface_url = slapparameter_dict.get('monitor-interface-url', 'https://monitor.app.officejs.com') -%}
 monitor-setup-url = {{ monitor_interface_url }}/#page=settings_configurator&url=${monitor-publish-parameters:monitor-url}&username=${monitor-publish-parameters:monitor-user}&password=${monitor-publish-parameters:monitor-password}
+monitor-password = ${publish-early:monitor-password}
+monitor-user = ${monitor-publish-parameters:monitor-user}
 {% do part_list.append('monitor-base') -%}
 
 [buildout]
@@ -273,7 +280,6 @@ parts =
   httpd-promise
   publish-connection-information
   directory-doc
-  monitor-htpasswd
 
 # Complete parts with sections
   {{ part_list | join('\n  ') }}

software/kvm/instance-kvm-resilient.cfg.jinja2

@@ -21,7 +21,7 @@ offline = true
 
 # += because we need to take up parts (like instance-custom, slapmonitor etc) from the profile we extended
 parts +=
-  monitor-htpasswd
+  publish-early
   {{ parts.replicate("kvm", backup_amount) }}
   publish-connection-information
   kvm-frontend-url-promise
@@ -37,13 +37,18 @@ storage-path = ${directory:etc}/.monitor_user
 bytes = 8
 username = admin
 
+[publish-early]
+recipe = slapos.cookbook:publish-early
+-init =
+  monitor-password monitor-htpasswd:passwd
+
 # XXX Monitoring Main Instane
 [monitor-instance-parameter]
 monitor-httpd-port = 8160
 cors-domains = {{ monitor_parameter.get('monitor-cors-domains', '') }}
 
 {%  do monitor_parameter.__setitem__('monitor-username', slapparameter_dict.get('monitor-username', 'admin'))%}
-{%  do monitor_parameter.__setitem__('monitor-password', slapparameter_dict.get('monitor-password', '${monitor-htpasswd:passwd}'))%}
+{%  do monitor_parameter.__setitem__('monitor-password', slapparameter_dict.get('monitor-password', '${publish-early:monitor-password}'))%}
 {% endif -%}
 
 {{ replicated.replicate("kvm", backup_amount, "kvm-export", "kvm-import", slapparameter_dict=slapparameter_dict, monitor_parameter_dict=monitor_dict) }}
@@ -68,9 +73,11 @@ recipe = slapos.cookbook:publish
 backend-url = ${request-kvm:connection-backend-url}
 url = ${request-kvm:connection-url}
 ipv6 = ${request-kvm:connection-ip}
+monitor-password = ${publish-early:monitor-password}
+monitor-user = ${monitor-publish-parameters:monitor-user}
 {% if monitor_dict -%}
 monitor-base-url = ${monitor-publish-parameters:monitor-base-url}
-monitor-setup-url = {{ monitor_interface_url }}/#page=settings_configurator&url=${monitor-publish-parameters:monitor-url}&username=${monitor-publish-parameters:monitor-user}&password=${monitor-publish-parameters:monitor-password}
+monitor-setup-url = {{ monitor_interface_url }}/#page=settings_configurator&url=${monitor-publish-parameters:monitor-url}&username=${monitor-publish-parameters:monitor-user}&password=${publish-early:monitor-password}
 {% endif -%}
 
 [kvm-frontend-url-promise]

software/kvm/software.cfg

@@ -108,7 +108,7 @@ recipe = hexagonit.recipe.download
 ignore-existing = true
 url = ${:_profile_base_location_}/instance-kvm-cluster.cfg.jinja2.in
 mode = 644
-md5sum = d9fe920d31f1ef0e377aa768ccd24f4c
+md5sum = 6d165aec7d236ea3944765236d11940f
 download-only = true
 on-update = true
 
@@ -117,7 +117,7 @@ recipe = hexagonit.recipe.download
 ignore-existing = true
 url = ${:_profile_base_location_}/instance-kvm-resilient.cfg.jinja2
 mode = 644
-md5sum = 1095968487282784a735735aa1b37d35
+md5sum = a5fd0cbe6be757d57c8b6903bb7a1d8b
 download-only = true
 on-update = true
 

software/slaprunner/buildout.hash.cfg

@@ -38,7 +38,7 @@ md5sum = 1a812a06cc02bb11636009f4ec043d54
 
 [template-resilient]
 filename = instance-resilient.cfg.jinja2
-md5sum = 8ed180de711d207a540d0acb539b2536
+md5sum = bed1c457aa9e54a59b64d167bdafe970
 
 [template_nginx_conf]
 filename = nginx_conf.in

software/slaprunner/instance-resilient.cfg.jinja2

@@ -28,7 +28,7 @@ offline = true
 
 # += because we need to take up parts (like instance-custom, slapmonitor etc) from the profile we extended
 parts +=
-  monitor-htpasswd
+  publish-early
   {{ parts.replicate("runner", number_of_instances + 1) }}
   publish-connection-information
 
@@ -38,8 +38,13 @@ storage-path = ${directory:etc}/.monitor_user
 bytes = 8
 username = admin
 
+[publish-early]
+recipe = slapos.cookbook:publish-early
+-init =
+  init-password monitor-htpasswd:passwd
+
 {%  do monitor_parameter.__setitem__('monitor-username', slapparameter_dict.get('monitor-username', 'admin'))%}
-{%  do monitor_parameter.__setitem__('monitor-password', slapparameter_dict.get('monitor-password', '${monitor-htpasswd:passwd}'))%}
+{%  do monitor_parameter.__setitem__('monitor-password', slapparameter_dict.get('monitor-password', '${publish-early:init-password}'))%}
 
 {{ replicated.replicate("runner", number_of_instances + 1, "runner-export", "runner-import", slapparameter_dict=slapparameter_dict, monitor_parameter_dict=monitor_dict) }}
 
@@ -60,7 +65,7 @@ recipe = slapos.cookbook:publish
 backend-url = ${request-runner:connection-backend-url}
 url = ${request-runner:connection-url}
 init-user = ${request-runner:connection-init-user}
-init-password = ${request-runner:connection-init-password}
+init-password = ${publish-early:init-password}
 ssh-command = ${request-runner:connection-ssh-command}
 webdav-url = ${request-runner:connection-webdav-url}
 public-url = ${request-runner:connection-public-url}