From da98f69a3a88115184b05478993907321bfe1215 Mon Sep 17 00:00:00 2001 From: "Eric D. Helms" Date: Thu, 3 Jul 2025 09:29:55 -0400 Subject: [PATCH] Add smartproxy registration of gateway Signed-off-by: Eric D. Helms --- .fixtures.yml | 6 +- manifests/core_gateway.pp | 20 +-- manifests/init.pp | 22 +++ manifests/service_vmaas.pp | 4 +- spec/acceptance/core_engine_spec.rb | 1 + spec/acceptance/core_gateway_spec.rb | 4 +- spec/acceptance/core_host_inventory_spec.rb | 1 + spec/acceptance/core_ingress_spec.rb | 1 + spec/acceptance/core_kafka_spec.rb | 1 + spec/acceptance/core_puptoo_spec.rb | 1 + spec/acceptance/core_yuptoo_spec.rb | 1 + spec/acceptance/hieradata/common.yaml | 12 ++ spec/acceptance/iop_spec.rb | 128 ++++++++++++------ .../service_advisor_frontend_spec.rb | 3 +- spec/acceptance/service_advisor_spec.rb | 1 + spec/acceptance/service_remediations_spec.rb | 1 + spec/acceptance/service_vmaas_spec.rb | 1 + .../service_vulnerability_frontend_spec.rb | 1 + spec/acceptance/service_vulnerability_spec.rb | 3 +- spec/setup_acceptance_node.pp | 6 + 20 files changed, 159 insertions(+), 59 deletions(-) create mode 100644 spec/acceptance/hieradata/common.yaml diff --git a/.fixtures.yml b/.fixtures.yml index 494b194..2e1a7fc 100644 --- a/.fixtures.yml +++ b/.fixtures.yml @@ -2,10 +2,12 @@ fixtures: repositories: apache: 'https://github.com/puppetlabs/puppetlabs-apache' - certs: "https://github.com/theforeman/puppet-certs.git" + candlepin: "https://github.com/theforeman/puppet-candlepin.git" + certs: 'https://github.com/theforeman/puppet-certs' concat: 'https://github.com/puppetlabs/puppetlabs-concat' extlib: 'https://github.com/voxpupuli/puppet-extlib' - foreman: "https://github.com/theforeman/puppet-foreman.git" + foreman: 'https://github.com/theforeman/puppet-foreman' + katello: "https://github.com/theforeman/puppet-katello.git" hashfile: "https://github.com/southalc/hashfile" redis: "https://github.com/voxpupuli/puppet-redis" podman: diff --git a/manifests/core_gateway.pp b/manifests/core_gateway.pp index 51cfe33..fc2a06e 100644 --- a/manifests/core_gateway.pp +++ b/manifests/core_gateway.pp @@ -17,7 +17,7 @@ ) { include podman require iop::core_network - include certs::iop_advisor_engine + include certs::iop $service_name = 'iop-core-gateway' $relay_conf_secret_name = "${service_name}-relay-conf" @@ -26,39 +26,38 @@ $server_key_secret_name = "${service_name}-server-key" $server_ca_cert_secret_name = "${service_name}-server-ca-cert" - # Client certificates for Smart Proxy Relay $client_cert_secret_name = "${service_name}-client-cert" $client_key_secret_name = "${service_name}-client-key" $client_ca_cert_secret_name = "${service_name}-client-ca-cert" podman::secret { $server_cert_secret_name: ensure => $ensure, - path => $certs::iop_advisor_engine::server_cert, + path => $certs::iop::server_cert, } podman::secret { $server_key_secret_name: ensure => $ensure, - path => $certs::iop_advisor_engine::server_key, + path => $certs::iop::server_key, } podman::secret { $server_ca_cert_secret_name: ensure => $ensure, - path => $certs::iop_advisor_engine::server_ca_cert, + path => $certs::iop::server_ca_cert, } podman::secret { $client_cert_secret_name: ensure => $ensure, - path => $certs::foreman_proxy::foreman_ssl_cert, + path => $certs::iop::client_cert, } podman::secret { $client_key_secret_name: ensure => $ensure, - path => $certs::foreman_proxy::foreman_ssl_key, + path => $certs::iop::client_key, } podman::secret { $client_ca_cert_secret_name: ensure => $ensure, - path => $certs::foreman_proxy::foreman_ssl_ca_cert, + path => $certs::iop::client_ca_cert, } podman::secret { $relay_conf_secret_name: @@ -106,7 +105,10 @@ 'Restart' => 'always', }, 'Install' => { - 'WantedBy' => ['multi-user.target', 'default.target'], + 'WantedBy' => [ + 'multi-user.target', + 'default.target', + ], }, }, } diff --git a/manifests/init.pp b/manifests/init.pp index d7eadb3..31bb93f 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -4,11 +4,14 @@ # # === Parameters: # +# $register_as_smartproxy:: Whether to register as a smart proxy +# # $enable_vulnerability:: Enable vulnerability services # # $enable_advisor:: Enable advisor services # class iop ( + Boolean $register_as_smartproxy = false, Boolean $enable_vulnerability = true, Boolean $enable_advisor = true, ) { @@ -18,6 +21,7 @@ include iop::core_engine include iop::core_gateway include iop::core_host_inventory + if $enable_vulnerability { include iop::service_vmaas include iop::service_vulnerability_frontend @@ -29,4 +33,22 @@ include iop::service_advisor include iop::service_remediations } + + if $register_as_smartproxy { + include katello + + foreman_smartproxy { 'iop-gateway': + ensure => present, + base_url => "https://${facts['networking']['fqdn']}", + consumer_key => $foreman::oauth_consumer_key, + consumer_secret => $foreman::oauth_consumer_secret, + effective_user => $foreman::oauth_effective_user, + ssl_ca => $certs::iop::client_ca_cert, + url => 'https://localhost:24443', + require => [ + Class['katello'], + Class['iop::core_gateway'], + ], + } + } } diff --git a/manifests/service_vmaas.pp b/manifests/service_vmaas.pp index 00821e8..f15b856 100644 --- a/manifests/service_vmaas.pp +++ b/manifests/service_vmaas.pp @@ -25,14 +25,14 @@ include iop::core_network include iop::core_kafka include iop::database - include certs::iop_advisor_engine + include certs::iop $service_name = 'iop-service-vmaas-reposcan' $server_ca_cert_secret_name = "${service_name}-server-ca-cert" podman::secret { $server_ca_cert_secret_name: ensure => $ensure, - path => $certs::iop_advisor_engine::server_ca_cert, + path => $certs::iop::server_ca_cert, } # Prevents errors if run from /root etc. diff --git a/spec/acceptance/core_engine_spec.rb b/spec/acceptance/core_engine_spec.rb index 4f09956..a41c1e2 100644 --- a/spec/acceptance/core_engine_spec.rb +++ b/spec/acceptance/core_engine_spec.rb @@ -9,6 +9,7 @@ on default, 'podman secret rm --all' on default, 'podman network rm iop-core-network --force' on default, 'dnf -y remove postgres*' + on default, 'dnf -y remove foreman*' end context 'with basic parameters' do diff --git a/spec/acceptance/core_gateway_spec.rb b/spec/acceptance/core_gateway_spec.rb index 3c976f0..a950711 100644 --- a/spec/acceptance/core_gateway_spec.rb +++ b/spec/acceptance/core_gateway_spec.rb @@ -9,6 +9,8 @@ on default, 'podman secret rm --all' on default, 'podman network rm iop-core-network --force' on default, 'dnf -y remove postgres*' + on default, 'dnf -y remove foreman*' + on default, 'rm -rf /root/ssl-build' end context 'with basic parameters' do @@ -25,7 +27,7 @@ class { 'iop::core_gateway': } it { is_expected.to be_enabled } end - describe command("curl -s -o /dev/null -w '%{http_code}' https://localhost:24443/ --cert /root/ssl-build/#{host_inventory['fqdn']}/#{host_inventory['fqdn']}-foreman-proxy-client.crt --key /root/ssl-build/#{host_inventory['fqdn']}/#{host_inventory['fqdn']}-foreman-proxy-client.key --cacert /root/ssl-build/katello-server-ca.crt") do + describe command("curl -s -o /dev/null -w '%{http_code}' https://localhost:24443/ --cert /root/ssl-build/localhost/localhost-iop-core-gateway-client.crt --key /root/ssl-build/localhost/localhost-iop-core-gateway-client.key --cacert /root/ssl-build/katello-server-ca.crt") do its(:stdout) { should match /200/ } end end diff --git a/spec/acceptance/core_host_inventory_spec.rb b/spec/acceptance/core_host_inventory_spec.rb index dabb404..d39d29f 100644 --- a/spec/acceptance/core_host_inventory_spec.rb +++ b/spec/acceptance/core_host_inventory_spec.rb @@ -9,6 +9,7 @@ on default, 'podman secret rm --all' on default, 'podman network rm iop-core-network --force' on default, 'dnf -y remove postgres*' + on default, 'dnf -y remove foreman*' end context 'with basic parameters' do diff --git a/spec/acceptance/core_ingress_spec.rb b/spec/acceptance/core_ingress_spec.rb index 80ae3f6..1d2c235 100644 --- a/spec/acceptance/core_ingress_spec.rb +++ b/spec/acceptance/core_ingress_spec.rb @@ -9,6 +9,7 @@ on default, 'podman secret rm --all' on default, 'podman network rm iop-core-network --force' on default, 'dnf -y remove postgres*' + on default, 'dnf -y remove foreman*' end context 'with basic parameters' do diff --git a/spec/acceptance/core_kafka_spec.rb b/spec/acceptance/core_kafka_spec.rb index 22b167c..60659c0 100644 --- a/spec/acceptance/core_kafka_spec.rb +++ b/spec/acceptance/core_kafka_spec.rb @@ -9,6 +9,7 @@ on default, 'podman secret rm --all' on default, 'podman network rm iop-core-network --force' on default, 'dnf -y remove postgres*' + on default, 'dnf -y remove foreman*' end context 'with basic parameters' do diff --git a/spec/acceptance/core_puptoo_spec.rb b/spec/acceptance/core_puptoo_spec.rb index 3028d0f..e68547f 100644 --- a/spec/acceptance/core_puptoo_spec.rb +++ b/spec/acceptance/core_puptoo_spec.rb @@ -9,6 +9,7 @@ on default, 'podman secret rm --all' on default, 'podman network rm iop-core-network --force' on default, 'dnf -y remove postgres*' + on default, 'dnf -y remove foreman*' end context 'with basic parameters' do diff --git a/spec/acceptance/core_yuptoo_spec.rb b/spec/acceptance/core_yuptoo_spec.rb index f6bc6df..d810c81 100644 --- a/spec/acceptance/core_yuptoo_spec.rb +++ b/spec/acceptance/core_yuptoo_spec.rb @@ -9,6 +9,7 @@ on default, 'podman secret rm --all' on default, 'podman network rm iop-core-network --force' on default, 'dnf -y remove postgres*' + on default, 'dnf -y remove foreman*' end context 'with basic parameters' do diff --git a/spec/acceptance/hieradata/common.yaml b/spec/acceptance/hieradata/common.yaml new file mode 100644 index 0000000..92bd28b --- /dev/null +++ b/spec/acceptance/hieradata/common.yaml @@ -0,0 +1,12 @@ +--- +apache::default_mods: false +foreman::client_ssl_ca: /etc/foreman/proxy_ca.pem +foreman::client_ssl_cert: /etc/foreman/client_cert.pem +foreman::client_ssl_key: /etc/foreman/client_key.pem +foreman::server_ssl_ca: /etc/pki/katello/certs/katello-default-ca.crt +foreman::server_ssl_cert: /etc/pki/katello/certs/katello-apache.crt +foreman::server_ssl_chain: /etc/pki/katello/certs/katello-server-ca.crt +foreman::server_ssl_crl: "" +foreman::server_ssl_key: /etc/pki/katello/private/katello-apache.key +postgresql::server::config_entries: + max_connections: 500 diff --git a/spec/acceptance/iop_spec.rb b/spec/acceptance/iop_spec.rb index 0baff52..9194a32 100644 --- a/spec/acceptance/iop_spec.rb +++ b/spec/acceptance/iop_spec.rb @@ -9,65 +9,109 @@ on default, 'podman secret rm --all' on default, 'podman network rm iop-core-network --force' on default, 'dnf -y remove postgres*' + on default, 'dnf -y remove foreman*' + on default, 'rm -rf /root/ssl-build' end - shared_examples 'foreman directory setup' do - let(:foreman_setup) do - <<-PUPPET - file { '/var/lib/foreman': - ensure => directory, - } - - file { '/var/lib/foreman/public': - ensure => directory, - require => File['/var/lib/foreman'], - } - - file { '/var/lib/foreman/public/assets': - ensure => directory, - require => File['/var/lib/foreman/public'], - } - - file { '/var/lib/foreman/public/assets/apps': - ensure => directory, - require => File['/var/lib/foreman/public/assets'], - } - - file { '/usr/share/foreman': - ensure => directory, - } - - file { '/usr/share/foreman/public': - ensure => link, - target => '/var/lib/foreman/public', - require => [File['/usr/share/foreman'], File['/var/lib/foreman/public']], - } - - include foreman::config::apache - PUPPET + context 'with basic parameters' do + it_behaves_like 'an idempotent resource' do + let(:manifest) do + <<-PUPPET + file { '/var/lib/foreman': + ensure => directory, + } + + file { '/var/lib/foreman/public': + ensure => directory, + require => File['/var/lib/foreman'], + } + + file { '/var/lib/foreman/public/assets': + ensure => directory, + require => File['/var/lib/foreman/public'], + } + + include foreman::config::apache + + class { 'iop': } + PUPPET + end + end + + describe command('curl http://localhost:24443/') do + its(:exit_status) { should eq 0 } + end + + describe command('podman run --network=iop-core-network quay.io/iop/puptoo curl http://iop-core-puptoo:8000/metrics') do + its(:exit_status) { should eq 0 } + end + + describe command('podman run --network=iop-core-network quay.io/iop/yuptoo curl http://iop-core-yuptoo:5005/') do + its(:exit_status) { should eq 0 } + end + + describe command('podman run --network=iop-core-network quay.io/iop/ingress curl http://iop-core-ingress:8080/') do + its(:exit_status) { should eq 0 } + end + + describe command('curl http://localhost:24443/api/ingress') do + its(:exit_status) { should eq 0 } + end + + describe command('podman run --network=iop-core-network quay.io/iop/host-inventory:latest curl http://iop-core-host-inventory:9126/') do + its(:exit_status) { should eq 0 } + end + + describe service('iop-core-host-inventory-api') do + it { is_expected.to be_running } + it { is_expected.to be_enabled } + end + + describe command("curl -s -o /dev/null -w '%{http_code}' https://localhost:24443/ --cert /root/ssl-build/localhost/localhost-iop-core-gateway-client.crt --key /root/ssl-build/localhost/localhost-iop-core-gateway-client.key --cacert /root/ssl-build/katello-server-ca.crt") do + its(:stdout) { should match /200/ } end end - context 'with default parameters (vulnerability and advisor enabled)' do - include_examples 'foreman directory setup' + context 'when registering as a smartproxy' do + before(:context) do + # Ensure foreman-installer-katello is installer prior + # katello would pull it in, but it purges the candlepin caches + # config/katello.migrations/231003142402-reset-store-credentials.rb + on hosts, <<~SKIP_INSTALLER_MIGRATION + applied=/etc/foreman-installer/scenarios.d/katello-migrations-applied + migration=231003142402-reset-store-credentials.rb + if ! grep -q $migration $applied 2> /dev/null ; then + mkdir -p $(dirname $applied) + echo "- $migration" >> $applied + fi + SKIP_INSTALLER_MIGRATION + end it_behaves_like 'an idempotent resource' do let(:manifest) do <<-PUPPET - #{foreman_setup} + include katello - class { 'iop': } + package { 'rubygem-foreman_rh_cloud': + ensure => present, + } + + Package['rubygem-foreman_rh_cloud'] -> Class['foreman::database'] + Package['rubygem-foreman_rh_cloud'] ~> Class['foreman::service'] + + class { 'iop': + register_as_smartproxy => true, + } PUPPET end end - # Core services should always be running - describe service('iop-core-host-inventory-api') do + describe service('iop-core-gateway') do it { is_expected.to be_running } it { is_expected.to be_enabled } end - describe command("curl -s -o /dev/null -w '%{http_code}' https://localhost:24443/ --cert /root/ssl-build/#{host_inventory['fqdn']}/#{host_inventory['fqdn']}-foreman-proxy-client.crt --key /root/ssl-build/#{host_inventory['fqdn']}/#{host_inventory['fqdn']}-foreman-proxy-client.key --cacert /root/ssl-build/katello-server-ca.crt") do + describe command("curl -s -o /dev/null -w '%{http_code}' https://localhost:24443/ --cert /root/ssl-build/localhost/localhost-iop-core-gateway-client.crt --key /root/ssl-build/localhost/localhost-iop-core-gateway-client.key --cacert /root/ssl-build/katello-server-ca.crt") do its(:stdout) { should match /200/ } end @@ -91,7 +135,6 @@ class { 'iop': } its(:stdout) { should match /200/ } end - # Vulnerability services should be running describe service('iop-service-vuln-manager') do it { is_expected.to be_running } it { is_expected.to be_enabled } @@ -102,7 +145,6 @@ class { 'iop': } it { is_expected.to be_enabled } end - # Advisor services should be running describe service('iop-service-advisor-backend-service') do it { is_expected.to be_running } it { is_expected.to be_enabled } diff --git a/spec/acceptance/service_advisor_frontend_spec.rb b/spec/acceptance/service_advisor_frontend_spec.rb index 6e56864..43d6edd 100644 --- a/spec/acceptance/service_advisor_frontend_spec.rb +++ b/spec/acceptance/service_advisor_frontend_spec.rb @@ -9,6 +9,7 @@ on default, 'podman secret rm --all' on default, 'podman network rm iop-core-network --force' on default, 'dnf -y remove postgres*' + on default, 'dnf -y remove foreman*' end context 'with basic parameters' do @@ -55,4 +56,4 @@ class { 'iop::service_advisor_frontend': } it { should be_mode 755 } end end -end \ No newline at end of file +end diff --git a/spec/acceptance/service_advisor_spec.rb b/spec/acceptance/service_advisor_spec.rb index ef06cf4..db1f11b 100644 --- a/spec/acceptance/service_advisor_spec.rb +++ b/spec/acceptance/service_advisor_spec.rb @@ -9,6 +9,7 @@ on default, 'podman secret rm --all' on default, 'podman network rm iop-core-network --force' on default, 'dnf -y remove postgres*' + on default, 'dnf -y remove foreman*' end context 'with basic parameters' do diff --git a/spec/acceptance/service_remediations_spec.rb b/spec/acceptance/service_remediations_spec.rb index 29d3730..a890c76 100644 --- a/spec/acceptance/service_remediations_spec.rb +++ b/spec/acceptance/service_remediations_spec.rb @@ -9,6 +9,7 @@ on default, 'podman secret rm --all' on default, 'podman network rm iop-core-network --force' on default, 'dnf -y remove postgres*' + on default, 'dnf -y remove foreman*' end context 'with basic parameters' do diff --git a/spec/acceptance/service_vmaas_spec.rb b/spec/acceptance/service_vmaas_spec.rb index 812281f..4403c50 100644 --- a/spec/acceptance/service_vmaas_spec.rb +++ b/spec/acceptance/service_vmaas_spec.rb @@ -9,6 +9,7 @@ on default, 'podman secret rm --all' on default, 'podman network rm iop-core-network --force' on default, 'dnf -y remove postgres*' + on default, 'dnf -y remove foreman*' end context 'with basic parameters' do diff --git a/spec/acceptance/service_vulnerability_frontend_spec.rb b/spec/acceptance/service_vulnerability_frontend_spec.rb index 7e2bfe2..4029433 100644 --- a/spec/acceptance/service_vulnerability_frontend_spec.rb +++ b/spec/acceptance/service_vulnerability_frontend_spec.rb @@ -9,6 +9,7 @@ on default, 'podman secret rm --all' on default, 'podman network rm iop-core-network --force' on default, 'dnf -y remove postgres*' + on default, 'dnf -y remove foreman*' end context 'with basic parameters' do diff --git a/spec/acceptance/service_vulnerability_spec.rb b/spec/acceptance/service_vulnerability_spec.rb index 74a9f0e..9146458 100644 --- a/spec/acceptance/service_vulnerability_spec.rb +++ b/spec/acceptance/service_vulnerability_spec.rb @@ -9,6 +9,7 @@ on default, 'podman secret rm --all' on default, 'podman network rm iop-core-network --force' on default, 'dnf -y remove postgres*' + on default, 'dnf -y remove foreman*' end context 'with basic parameters' do @@ -63,4 +64,4 @@ class { 'iop::service_vulnerability': } it { is_expected.to be_enabled } end end -end \ No newline at end of file +end diff --git a/spec/setup_acceptance_node.pp b/spec/setup_acceptance_node.pp index d5dbbea..0bbf3ac 100644 --- a/spec/setup_acceptance_node.pp +++ b/spec/setup_acceptance_node.pp @@ -5,6 +5,12 @@ class { 'foreman::repo': repo => 'nightly', } +class { 'katello::repo': + repo_version => 'nightly', +} +class { 'candlepin::repo': + version => 'nightly', +} file { '/etc/foreman-proxy': ensure => directory,