iTop学习笔记--安装和初始化配置

An initialization template makes an iTop automation client reproducible, but the template must not contain an administrative username or password. Keep those values in a protected environment file or secret manager and inject them only when the client runs.

Create a configuration template

Save this as itop-client.ini.template:

[itop]
endpoint=https://cmdb.example.test/webservices/rest.php
auth_user=${ITOP_USER}
auth_pwd=${ITOP_PASSWORD}

${ITOP_USER} and ${ITOP_PASSWORD} are unresolved placeholders, not example credentials. The deployment process must receive their values from a protected environment file or a secret manager.

Load protected values

A local environment file may be appropriate for a developer workstation if access is restricted and the file is excluded from version control. In shared automation, prefer the platform’s secret manager.

set -a
. /run/secrets/itop-client.env
set +a

: "${ITOP_USER:?ITOP_USER is required}"
: "${ITOP_PASSWORD:?ITOP_PASSWORD is required}"

The protected file should be readable only by the service account:

chmod 600 /run/secrets/itop-client.env

Do not print the variables while testing the setup.

Render a short-lived client configuration

Render the template into a private runtime directory:

install -d -m 700 /run/itop-client
envsubst '${ITOP_USER} ${ITOP_PASSWORD}' \
  <itop-client.ini.template \
  >/run/itop-client/itop-client.ini
chmod 600 /run/itop-client/itop-client.ini

Point the client at the generated file, perform the initialization, and remove the file when the process no longer needs it:

itop-client init --config /run/itop-client/itop-client.ini
itop-client status --config /run/itop-client/itop-client.ini
rm /run/itop-client/itop-client.ini
unset ITOP_USER ITOP_PASSWORD

If the client can read credentials directly from environment variables or a secret provider, skip the rendered file entirely.

Repository safeguards

Add runtime configuration and local environment files to the repository ignore rules:

.env
.env.*
itop-client.ini

Commit only the template. During review, confirm that the committed file still contains ${ITOP_USER} and ${ITOP_PASSWORD} and that generated configuration is absent from the working tree.

Administrative access should be temporary and narrowly scoped. Prefer a dedicated automation account with only the permissions required for the initialization task, then rotate or revoke it after bootstrap.