diff --git a/examples/basic_candlepin.pp b/examples/basic_candlepin.pp index ea7ebb3..50646ad 100644 --- a/examples/basic_candlepin.pp +++ b/examples/basic_candlepin.pp @@ -58,5 +58,4 @@ truststore_password => $truststore_password, java_package => 'java-17-openjdk', java_home => '/usr/lib/jvm/jre-17', - artemis_client_dn => Deferred('pick', ['', 'CN=ActiveMQ Artemis Deferred, OU=Artemis, O=ActiveMQ, L=AMQ, ST=AMQ, C=AMQ']), } diff --git a/files/tomcat/cert-roles.properties b/files/tomcat/cert-roles.properties deleted file mode 100644 index 06320b5..0000000 --- a/files/tomcat/cert-roles.properties +++ /dev/null @@ -1 +0,0 @@ -candlepinEventsConsumer=katelloUser diff --git a/files/tomcat/jaas.conf b/files/tomcat/jaas.conf deleted file mode 100644 index e8b00a1..0000000 --- a/files/tomcat/jaas.conf +++ /dev/null @@ -1 +0,0 @@ -CATALINA_OPTS="-Djava.security.auth.login.config=$CATALINA_HOME/conf/login.config" diff --git a/files/tomcat/login.config b/files/tomcat/login.config deleted file mode 100644 index 20e88a3..0000000 --- a/files/tomcat/login.config +++ /dev/null @@ -1,13 +0,0 @@ -CertificateLogin { - org.apache.activemq.artemis.spi.core.security.jaas.TextFileCertificateLoginModule required - debug=true - org.apache.activemq.jaas.textfiledn.user="cert-users.properties" - org.apache.activemq.jaas.textfiledn.role="cert-roles.properties"; -}; - -InVMLogin { - org.apache.activemq.artemis.spi.core.security.jaas.GuestLoginModule required - debug=true - org.apache.activemq.jaas.guest.user="invm-user" - org.apache.activemq.jaas.guest.role="invm-role"; -}; diff --git a/manifests/artemis.pp b/manifests/artemis.pp index 32452a1..8e63da7 100644 --- a/manifests/artemis.pp +++ b/manifests/artemis.pp @@ -4,60 +4,23 @@ class candlepin::artemis { assert_private() - $broker_context = { - 'module_name' => $module_name, - 'artemis_host' => $candlepin::artemis_host, - 'artemis_port' => $candlepin::artemis_port, - 'keystore_file' => $candlepin::keystore_file, - 'keystore_password' => $candlepin::_keystore_password, - 'truststore_file' => $candlepin::truststore_file, - 'truststore_password' => $candlepin::_truststore_password, - } - - file { $candlepin::broker_config_file: - ensure => file, - content => epp('candlepin/broker.xml.epp', $broker_context), - mode => '0640', - owner => $candlepin::user, - group => $candlepin::group, + file { '/etc/candlepin/broker.xml': + ensure => absent, } file { "${candlepin::tomcat_conf}/login.config": - ensure => file, - content => file('candlepin/tomcat/login.config'), - mode => '0640', - owner => $candlepin::user, - group => $candlepin::group, + ensure => absent, } file { "${candlepin::tomcat_conf}/cert-users.properties": - ensure => file, - content => Deferred('inline_epp', ["katelloUser=<%= \$artemis_client_dn %>\n", { 'artemis_client_dn' => $candlepin::artemis_client_dn }]), - mode => '0640', - owner => $candlepin::user, - group => $candlepin::group, + ensure => absent, } file { "${candlepin::tomcat_conf}/cert-roles.properties": - ensure => file, - content => file('candlepin/tomcat/cert-roles.properties'), - mode => '0640', - owner => $candlepin::user, - group => $candlepin::group, + ensure => absent, } file { "${candlepin::tomcat_conf}/conf.d/jaas.conf": - ensure => file, - content => file('candlepin/tomcat/jaas.conf'), - mode => '0640', - owner => $candlepin::user, - group => $candlepin::group, - } - - if $facts['os']['selinux']['enabled'] { - selboolean { 'candlepin_can_bind_activemq_port': - value => 'on', - persistent => true, - } + ensure => absent, } } diff --git a/manifests/config.pp b/manifests/config.pp index 8f9caa4..1ec5d84 100644 --- a/manifests/config.pp +++ b/manifests/config.pp @@ -17,7 +17,6 @@ $candlepin_context = { 'module_name' => $module_name, 'adapter_module' => $candlepin::adapter_module, - 'broker_config_file' => $candlepin::broker_config_file, 'ca_cert' => $candlepin::ca_cert, 'ca_key' => $candlepin::ca_key, 'ca_key_password' => $candlepin::_ca_key_password, diff --git a/manifests/init.pp b/manifests/init.pp index d59efba..74348ee 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -67,10 +67,10 @@ # Keystore type # # @param truststore_file -# Truststore file to use for Tomcat and Artemis +# Truststore file to use for Tomcat # # @param truststore_password -# Password for truststore being used with Tomcat and Artemis +# Password for truststore being used with Tomcat # # @param ca_key # CA key file to use @@ -149,18 +149,6 @@ # @param expired_pools_schedule # Quartz schedule notation for how often to run the ExpiredPoolsJob # -# @param artemis_port -# Port to expose Artemis on -# -# @param artemis_host -# Host address to have Artemis listen on; defaults to localhost -# -# @param artemis_client_dn -# Full DN for the client certificate used to talk to Artemis -# -# @param broker_config_file -# Config file for Artemis -# # @param user # User under which Candlepin will run # @@ -230,10 +218,6 @@ Boolean $security_manager = false, Optional[Integer[0]] $shutdown_wait = undef, String $expired_pools_schedule = '0 0 0 * * ?', - Stdlib::Host $artemis_host = 'localhost', - Stdlib::Port $artemis_port = 61613, - Variant[Deferred, String] $artemis_client_dn = 'CN=ActiveMQ Artemis Client, OU=Artemis, O=ActiveMQ, L=AMQ, ST=AMQ, C=AMQ', - Stdlib::Absolutepath $broker_config_file = '/etc/candlepin/broker.xml', String $user = 'tomcat', String $group = 'tomcat', Boolean $disable_fips = true, diff --git a/spec/acceptance/basic_candlepin_spec.rb b/spec/acceptance/basic_candlepin_spec.rb index 329e3eb..9979fb4 100644 --- a/spec/acceptance/basic_candlepin_spec.rb +++ b/spec/acceptance/basic_candlepin_spec.rb @@ -1,7 +1,5 @@ require 'spec_helper_acceptance' -#TODO: Add Artemis listening test https://projects.theforeman.org/issues/29561 - describe 'candlepin works' do include_examples 'the example', 'basic_candlepin.pp' @@ -28,12 +26,4 @@ # Test that the least cipher strength is "strong" or "A" its(:stdout) { should match(/least strength: (A|strong)/) } end - - describe file("/etc/tomcat/cert-users.properties") do - it { should be_file } - it { should be_mode 640 } - it { should be_owned_by 'tomcat' } - it { should be_grouped_into 'tomcat' } - its(:content) { should eq("katelloUser=CN=ActiveMQ Artemis Deferred, OU=Artemis, O=ActiveMQ, L=AMQ, ST=AMQ, C=AMQ\n") } - end end diff --git a/spec/classes/candlepin_spec.rb b/spec/classes/candlepin_spec.rb index 52b45b0..c3967c2 100644 --- a/spec/classes/candlepin_spec.rb +++ b/spec/classes/candlepin_spec.rb @@ -34,7 +34,6 @@ 'candlepin.ca_key=/etc/candlepin/certs/candlepin-ca.key', 'candlepin.ca_cert=/etc/candlepin/certs/candlepin-ca.crt', 'candlepin.async.jobs.ExpiredPoolsCleanupJob.schedule=0 0 0 * * ?', - 'candlepin.audit.hornetq.config_path=/etc/candlepin/broker.xml', 'candlepin.db.database_manage_on_startup=Manage', ]) end @@ -52,19 +51,6 @@ ]) end - it { is_expected.to contain_file('/etc/tomcat/login.config') } - it { is_expected.to contain_file('/etc/tomcat/cert-roles.properties') } - it { is_expected.to contain_file('/etc/tomcat/conf.d/jaas.conf') } - it do - is_expected.to contain_file('/etc/tomcat/cert-users.properties'). - with_content("katelloUser=CN=ActiveMQ Artemis Client, OU=Artemis, O=ActiveMQ, L=AMQ, ST=AMQ, C=AMQ\n") - end - - it do - is_expected.to contain_file('/etc/candlepin/broker.xml'). - with_content(/^ tcp:\/\/localhost:61613\?protocols=STOMP;useEpoll=false;sslEnabled=true;trustStorePath=\/etc\/candlepin\/certs\/truststore;trustStorePassword=;keyStorePath=\/etc\/candlepin\/certs\/keystore;keyStorePassword=;needClientAuth=true<\/acceptor>/) - end - # database it { is_expected.not_to contain_class('candlepin::database::mysql') } it { is_expected.to contain_class('candlepin::database::postgresql') } @@ -122,11 +108,6 @@ is_expected.to contain_concat_fragment('General Config'). with_content(sensitive(/^candlepin.ca_key_password=MY_CA_KEY_PASSWORD$/)) end - it do - is_expected.to contain_file('/etc/candlepin/broker.xml'). - with_content(sensitive(/;keyStorePassword=MY_KEYSTORE_PASSWORD;/)). - with_content(sensitive(/;trustStorePassword=MY_TRUSTSTORE_PASSWORD;/)) - end it do is_expected.to contain_file('/etc/tomcat/server.xml'). with_content(sensitive(/^ *keystorePass="MY_KEYSTORE_PASSWORD"$/)) @@ -230,7 +211,6 @@ let(:facts) { override_facts(super(), os: {selinux: {enabled: true}}) } it { is_expected.to compile.with_all_deps } - it { is_expected.to contain_selboolean('candlepin_can_bind_activemq_port').that_requires('Package[candlepin-selinux]') } if facts[:os]['release']['major'] == '8' it { is_expected.to contain_package('candlepin-selinux').that_requires('Package[pki-core]') } @@ -241,7 +221,6 @@ let(:facts) { override_facts(super(), os: {selinux: {enabled: false}}) } it { is_expected.to compile.with_all_deps } - it { is_expected.not_to contain_selboolean('candlepin_can_bind_activemq_port') } it { is_expected.not_to contain_package('candlepin-selinux') } end end diff --git a/spec/setup_acceptance_node.pp b/spec/setup_acceptance_node.pp index 3bf413d..a691c0e 100644 --- a/spec/setup_acceptance_node.pp +++ b/spec/setup_acceptance_node.pp @@ -22,18 +22,6 @@ ensure => installed, require => Yumrepo['candlepin'], } - - # Workaround for https://github.com/theforeman/puppet-candlepin/issues/185#issuecomment-822284497 - $tomcat_conf_files = [ - '/etc/tomcat/login.config', - '/etc/tomcat/cert-users.properties', - '/etc/tomcat/cert-roles.properties', - '/etc/tomcat/conf.d/jaas.conf' - ] - file { $tomcat_conf_files: - ensure => file, - require => Package['candlepin-selinux'], - } } # Used to test which TLS versions are enabled diff --git a/templates/broker.xml.epp b/templates/broker.xml.epp deleted file mode 100644 index dbf9996..0000000 --- a/templates/broker.xml.epp +++ /dev/null @@ -1,152 +0,0 @@ -<%- | - String[1] $module_name, - Stdlib::Host $artemis_host, - Stdlib::Port $artemis_port, - Stdlib::Absolutepath $keystore_file, - Optional[Sensitive[String]] $keystore_password, - Stdlib::Absolutepath $truststore_file, - Optional[Sensitive[String]] $truststore_password, -| -%> - - - - - - - - -1 - - - vm://0 - tcp://<%= $artemis_host %>:<%= $artemis_port %>?protocols=STOMP;useEpoll=false;sslEnabled=true;trustStorePath=<%= $truststore_file %>;trustStorePassword=<%= $truststore_password %>;keyStorePath=<%= $keystore_file %>;keyStorePassword=<%= $keystore_password %>;needClientAuth=true - - - true - - - - - - - - - - - - - - - - - - - - - - - - true - NIO - 1 - true - true - /var/lib/candlepin/activemq-artemis/bindings - /var/lib/candlepin/activemq-artemis/journal - /var/lib/candlepin/activemq-artemis/largemsgs - /var/lib/candlepin/activemq-artemis/paging - - - 99 - - -
- - - - -
- -
- - - -
- -
- - - -
-
- - - - FORCE - true - 10485760 - - - 1048576 - - - 30000 - 3600000 - 2 - 0 - - - - false - 10485760 - - - 1048576 - - 0 - 1 - - - - 10485760 - - - 1048576 - - - 0 - - - 30000 - 3600000 - 2 - 0 - - - - - - false -
event.default
- - katello.candlepin -
-
-
-
diff --git a/templates/candlepin.conf.epp b/templates/candlepin.conf.epp index 97d48bb..cdf09ce 100644 --- a/templates/candlepin.conf.epp +++ b/templates/candlepin.conf.epp @@ -1,7 +1,6 @@ <%- | String[1] $module_name, Optional[String] $adapter_module, - Stdlib::Absolutepath $broker_config_file, Stdlib::Absolutepath $ca_cert, Stdlib::Absolutepath $ca_key, Optional[Sensitive[String]] $ca_key_password, @@ -26,7 +25,6 @@ candlepin.environment_content_filtering=<%= $env_filtering_enabled %> candlepin.auth.basic.enable=<%= $enable_basic_auth %> candlepin.auth.trusted.enable=<%= $enable_trusted_auth %> -candlepin.audit.hornetq.config_path=<%= $broker_config_file %> <% if $oauth_key != "" { %> candlepin.db.database_manage_on_startup=<%= $db_manage_on_startup %>