Add smart proxy

.fixtures.yml

@@ -2,10 +2,12 @@
 fixtures:
   repositories:
     apache: 'https://github.com/puppetlabs/puppetlabs-apache'
-    certs: "https://github.com/theforeman/puppet-certs.git"
+    candlepin:     "https://github.com/theforeman/puppet-candlepin.git"
+    certs: 'https://github.com/theforeman/puppet-certs'
     concat: 'https://github.com/puppetlabs/puppetlabs-concat'
     extlib: 'https://github.com/voxpupuli/puppet-extlib'
-    foreman:       "https://github.com/theforeman/puppet-foreman.git"
+    foreman: 'https://github.com/theforeman/puppet-foreman'
+    katello:       "https://github.com/theforeman/puppet-katello.git"
     hashfile: "https://github.com/southalc/hashfile"
     redis:         "https://github.com/voxpupuli/puppet-redis"
     podman:

manifests/core_gateway.pp

@@ -17,7 +17,7 @@
 ) {
   include podman
   require iop::core_network
-  include certs::iop_advisor_engine
+  include certs::iop
 
   $service_name = 'iop-core-gateway'
   $relay_conf_secret_name = "${service_name}-relay-conf"
@@ -26,39 +26,38 @@
   $server_key_secret_name = "${service_name}-server-key"
   $server_ca_cert_secret_name = "${service_name}-server-ca-cert"
 
-  # Client certificates for Smart Proxy Relay
   $client_cert_secret_name = "${service_name}-client-cert"
   $client_key_secret_name = "${service_name}-client-key"
   $client_ca_cert_secret_name = "${service_name}-client-ca-cert"
 
   podman::secret { $server_cert_secret_name:
     ensure => $ensure,
-    path   => $certs::iop_advisor_engine::server_cert,
+    path   => $certs::iop::server_cert,
   }
 
   podman::secret { $server_key_secret_name:
     ensure => $ensure,
-    path   => $certs::iop_advisor_engine::server_key,
+    path   => $certs::iop::server_key,
   }
 
   podman::secret { $server_ca_cert_secret_name:
     ensure => $ensure,
-    path   => $certs::iop_advisor_engine::server_ca_cert,
+    path   => $certs::iop::server_ca_cert,
   }
 
   podman::secret { $client_cert_secret_name:
     ensure => $ensure,
-    path   => $certs::foreman_proxy::foreman_ssl_cert,
+    path   => $certs::iop::client_cert,
   }
 
   podman::secret { $client_key_secret_name:
     ensure => $ensure,
-    path   => $certs::foreman_proxy::foreman_ssl_key,
+    path   => $certs::iop::client_key,
   }
 
   podman::secret { $client_ca_cert_secret_name:
     ensure => $ensure,
-    path   => $certs::foreman_proxy::foreman_ssl_ca_cert,
+    path   => $certs::iop::client_ca_cert,
   }
 
   podman::secret { $relay_conf_secret_name:
@@ -106,7 +105,10 @@
         'Restart' => 'always',
       },
       'Install'   => {
-        'WantedBy' => ['multi-user.target', 'default.target'],
+        'WantedBy' => [
+          'multi-user.target',
+          'default.target',
+        ],
       },
     },
   }

manifests/init.pp

@@ -4,11 +4,14 @@
 #
 # === Parameters:
 #
+# $register_as_smartproxy:: Whether to register as a smart proxy
+#
 # $enable_vulnerability:: Enable vulnerability services
 #
 # $enable_advisor:: Enable advisor services
 #
 class iop (
+  Boolean $register_as_smartproxy = false,
   Boolean $enable_vulnerability = true,
   Boolean $enable_advisor = true,
 ) {
@@ -18,6 +21,7 @@
   include iop::core_engine
   include iop::core_gateway
   include iop::core_host_inventory
+
   if $enable_vulnerability {
     include iop::service_vmaas
     include iop::service_vulnerability_frontend
@@ -29,4 +33,22 @@
     include iop::service_advisor
     include iop::service_remediations
   }
+
+  if $register_as_smartproxy {
+    include katello
+
+    foreman_smartproxy { 'iop-gateway':
+      ensure          => present,
+      base_url        => "https://${facts['networking']['fqdn']}",
+      consumer_key    => $foreman::oauth_consumer_key,
+      consumer_secret => $foreman::oauth_consumer_secret,
+      effective_user  => $foreman::oauth_effective_user,
+      ssl_ca          => $certs::iop::client_ca_cert,
+      url             => 'https://localhost:24443',
+      require         => [
+        Class['katello'],
+        Class['iop::core_gateway'],
+      ],
+    }
+  }
 }

manifests/service_vmaas.pp

@@ -25,14 +25,14 @@
   include iop::core_network
   include iop::core_kafka
   include iop::database
-  include certs::iop_advisor_engine
+  include certs::iop
 
   $service_name = 'iop-service-vmaas-reposcan'
   $server_ca_cert_secret_name = "${service_name}-server-ca-cert"
 
   podman::secret { $server_ca_cert_secret_name:
     ensure => $ensure,
-    path   => $certs::iop_advisor_engine::server_ca_cert,
+    path   => $certs::iop::server_ca_cert,
   }
 
   # Prevents errors if run from /root etc.

spec/acceptance/core_engine_spec.rb

@@ -9,6 +9,7 @@
     on default, 'podman secret rm --all'
     on default, 'podman network rm iop-core-network --force'
     on default, 'dnf -y remove postgres*'
+    on default, 'dnf -y remove foreman*'
   end
 
   context 'with basic parameters' do

spec/acceptance/core_gateway_spec.rb

@@ -9,6 +9,8 @@
     on default, 'podman secret rm --all'
     on default, 'podman network rm iop-core-network --force'
     on default, 'dnf -y remove postgres*'
+    on default, 'dnf -y remove foreman*'
+    on default, 'rm -rf /root/ssl-build'
   end
 
   context 'with basic parameters' do
@@ -25,7 +27,7 @@ class { 'iop::core_gateway': }
       it { is_expected.to be_enabled }
     end
 
-    describe command("curl -s -o /dev/null -w '%{http_code}' https://localhost:24443/ --cert /root/ssl-build/#{host_inventory['fqdn']}/#{host_inventory['fqdn']}-foreman-proxy-client.crt --key /root/ssl-build/#{host_inventory['fqdn']}/#{host_inventory['fqdn']}-foreman-proxy-client.key --cacert /root/ssl-build/katello-server-ca.crt") do
+    describe command("curl -s -o /dev/null -w '%{http_code}' https://localhost:24443/ --cert /root/ssl-build/localhost/localhost-iop-core-gateway-client.crt --key /root/ssl-build/localhost/localhost-iop-core-gateway-client.key --cacert /root/ssl-build/katello-server-ca.crt") do
       its(:stdout) { should match /200/ }
     end
   end

spec/acceptance/core_host_inventory_spec.rb

@@ -9,6 +9,7 @@
     on default, 'podman secret rm --all'
     on default, 'podman network rm iop-core-network --force'
     on default, 'dnf -y remove postgres*'
+    on default, 'dnf -y remove foreman*'
   end
 
   context 'with basic parameters' do

spec/acceptance/core_ingress_spec.rb

@@ -9,6 +9,7 @@
     on default, 'podman secret rm --all'
     on default, 'podman network rm iop-core-network --force'
     on default, 'dnf -y remove postgres*'
+    on default, 'dnf -y remove foreman*'
   end
 
   context 'with basic parameters' do

spec/acceptance/core_kafka_spec.rb

@@ -9,6 +9,7 @@
     on default, 'podman secret rm --all'
     on default, 'podman network rm iop-core-network --force'
     on default, 'dnf -y remove postgres*'
+    on default, 'dnf -y remove foreman*'
   end
 
   context 'with basic parameters' do

spec/acceptance/core_puptoo_spec.rb

@@ -9,6 +9,7 @@
     on default, 'podman secret rm --all'
     on default, 'podman network rm iop-core-network --force'
     on default, 'dnf -y remove postgres*'
+    on default, 'dnf -y remove foreman*'
   end
 
   context 'with basic parameters' do

spec/acceptance/core_yuptoo_spec.rb

@@ -9,6 +9,7 @@
     on default, 'podman secret rm --all'
     on default, 'podman network rm iop-core-network --force'
     on default, 'dnf -y remove postgres*'
+    on default, 'dnf -y remove foreman*'
   end
 
   context 'with basic parameters' do

spec/acceptance/hieradata/common.yaml

@@ -0,0 +1,12 @@
+---
+apache::default_mods: false
+foreman::client_ssl_ca: /etc/foreman/proxy_ca.pem
+foreman::client_ssl_cert: /etc/foreman/client_cert.pem
+foreman::client_ssl_key: /etc/foreman/client_key.pem
+foreman::server_ssl_ca: /etc/pki/katello/certs/katello-default-ca.crt
+foreman::server_ssl_cert: /etc/pki/katello/certs/katello-apache.crt
+foreman::server_ssl_chain: /etc/pki/katello/certs/katello-server-ca.crt
+foreman::server_ssl_crl: ""
+foreman::server_ssl_key: /etc/pki/katello/private/katello-apache.key
+postgresql::server::config_entries:
+  max_connections: 500

spec/acceptance/iop_spec.rb

@@ -9,65 +9,109 @@
     on default, 'podman secret rm --all'
     on default, 'podman network rm iop-core-network --force'
     on default, 'dnf -y remove postgres*'
+    on default, 'dnf -y remove foreman*'
+    on default, 'rm -rf /root/ssl-build'
   end
 
-  shared_examples 'foreman directory setup' do
-    let(:foreman_setup) do
-      <<-PUPPET
-      file { '/var/lib/foreman':
-        ensure => directory,
-      }
-
-      file { '/var/lib/foreman/public':
-        ensure => directory,
-        require => File['/var/lib/foreman'],
-      }
-
-      file { '/var/lib/foreman/public/assets':
-        ensure => directory,
-        require => File['/var/lib/foreman/public'],
-      }
-
-      file { '/var/lib/foreman/public/assets/apps':
-        ensure => directory,
-        require => File['/var/lib/foreman/public/assets'],
-      }
-
-      file { '/usr/share/foreman':
-        ensure => directory,
-      }
-
-      file { '/usr/share/foreman/public':
-        ensure => link,
-        target => '/var/lib/foreman/public',
-        require => [File['/usr/share/foreman'], File['/var/lib/foreman/public']],
-      }
-
-      include foreman::config::apache
-      PUPPET
+  context 'with basic parameters' do
+    it_behaves_like 'an idempotent resource' do
+      let(:manifest) do
+        <<-PUPPET
+        file { '/var/lib/foreman':
+          ensure => directory,
+        }
+
+        file { '/var/lib/foreman/public':
+          ensure => directory,
+          require => File['/var/lib/foreman'],
+        }
+
+        file { '/var/lib/foreman/public/assets':
+          ensure => directory,
+          require => File['/var/lib/foreman/public'],
+        }
+
+        include foreman::config::apache
+
+        class { 'iop': }
+        PUPPET
+      end
+    end
+
+    describe command('curl http://localhost:24443/') do
+      its(:exit_status) { should eq 0 }
+    end
+
+    describe command('podman run --network=iop-core-network quay.io/iop/puptoo curl http://iop-core-puptoo:8000/metrics') do
+      its(:exit_status) { should eq 0 }
+    end
+
+    describe command('podman run --network=iop-core-network quay.io/iop/yuptoo curl http://iop-core-yuptoo:5005/') do
+      its(:exit_status) { should eq 0 }
+    end
+
+    describe command('podman run --network=iop-core-network quay.io/iop/ingress curl http://iop-core-ingress:8080/') do
+      its(:exit_status) { should eq 0 }
+    end
+
+    describe command('curl http://localhost:24443/api/ingress') do
+      its(:exit_status) { should eq 0 }
+    end
+
+    describe command('podman run --network=iop-core-network quay.io/iop/host-inventory:latest curl http://iop-core-host-inventory:9126/') do
+      its(:exit_status) { should eq 0 }
+    end
+
+    describe service('iop-core-host-inventory-api') do
+      it { is_expected.to be_running }
+      it { is_expected.to be_enabled }
+    end
+
+    describe command("curl -s -o /dev/null -w '%{http_code}' https://localhost:24443/ --cert /root/ssl-build/localhost/localhost-iop-core-gateway-client.crt --key /root/ssl-build/localhost/localhost-iop-core-gateway-client.key --cacert /root/ssl-build/katello-server-ca.crt") do
+      its(:stdout) { should match /200/ }
     end
   end
 
-  context 'with default parameters (vulnerability and advisor enabled)' do
-    include_examples 'foreman directory setup'
+  context 'when registering as a smartproxy' do
+    before(:context) do
+      # Ensure foreman-installer-katello is installer prior
+      # katello would pull it in, but it purges the candlepin caches
+      # config/katello.migrations/231003142402-reset-store-credentials.rb
+      on hosts, <<~SKIP_INSTALLER_MIGRATION
+      applied=/etc/foreman-installer/scenarios.d/katello-migrations-applied
+      migration=231003142402-reset-store-credentials.rb
+      if ! grep -q $migration $applied 2> /dev/null ; then
+        mkdir -p $(dirname $applied)
+        echo "- $migration" >> $applied
+      fi
+      SKIP_INSTALLER_MIGRATION
+    end
 
     it_behaves_like 'an idempotent resource' do
       let(:manifest) do
         <<-PUPPET
-        #{foreman_setup}
+        include katello
 
-        class { 'iop': }
+        package { 'rubygem-foreman_rh_cloud':
+          ensure => present,
+        }
+
+        Package['rubygem-foreman_rh_cloud'] -> Class['foreman::database']
+        Package['rubygem-foreman_rh_cloud'] ~> Class['foreman::service']
+
+        class { 'iop':
+          register_as_smartproxy => true,
+        }
         PUPPET
       end
     end
 
-    # Core services should always be running
-    describe service('iop-core-host-inventory-api') do
+    describe service('iop-core-gateway') do
       it { is_expected.to be_running }
       it { is_expected.to be_enabled }
     end
 
-    describe command("curl -s -o /dev/null -w '%{http_code}' https://localhost:24443/ --cert /root/ssl-build/#{host_inventory['fqdn']}/#{host_inventory['fqdn']}-foreman-proxy-client.crt --key /root/ssl-build/#{host_inventory['fqdn']}/#{host_inventory['fqdn']}-foreman-proxy-client.key --cacert /root/ssl-build/katello-server-ca.crt") do
+    describe command("curl -s -o /dev/null -w '%{http_code}' https://localhost:24443/ --cert /root/ssl-build/localhost/localhost-iop-core-gateway-client.crt --key /root/ssl-build/localhost/localhost-iop-core-gateway-client.key --cacert /root/ssl-build/katello-server-ca.crt") do
       its(:stdout) { should match /200/ }
     end
 
@@ -91,7 +135,6 @@ class { 'iop': }
       its(:stdout) { should match /200/ }
     end
 
-    # Vulnerability services should be running
     describe service('iop-service-vuln-manager') do
       it { is_expected.to be_running }
       it { is_expected.to be_enabled }
@@ -102,7 +145,6 @@ class { 'iop': }
       it { is_expected.to be_enabled }
     end
 
-    # Advisor services should be running
     describe service('iop-service-advisor-backend-service') do
       it { is_expected.to be_running }
       it { is_expected.to be_enabled }