Skip to content

Commit 5d5115a

Browse files
ehelmsehelms
committed
Add iop_vmaas and iop_vulnerability
Signed-off-by: Eric D. Helms <[email protected]>
1 parent ebfb0f7 commit 5d5115a

File tree

12 files changed

+824
-1
lines changed

12 files changed

+824
-1
lines changed

‎src/playbooks/deploy/deploy.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
- name: Add iop databases
1717
when:
1818
- "'iop' in enabled_features"
19+
- database_mode == 'internal'
1920
block:
2021
- name: Include iop databases
2122
ansible.builtin.include_vars:
@@ -47,6 +48,7 @@
4748
- role: iop_core
4849
when:
4950
- "'iop' in enabled_features"
51+
- database_mode == 'internal'
5052
- role: foreman_proxy
5153
when:
5254
- "'foreman-proxy' in enabled_features"

‎src/roles/iop_core/tasks/main.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,11 @@
3838
- name: Deploy IOP Remediation service
3939
ansible.builtin.include_role:
4040
name: iop_remediation
41+
42+
- name: Deploy IOP VMAAS service
43+
ansible.builtin.include_role:
44+
name: iop_vmaas
45+
46+
- name: Deploy IOP Vulnerability service
47+
ansible.builtin.include_role:
48+
name: iop_vulnerability

‎src/roles/iop_remediation/defaults/main.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,5 @@ iop_remediation_container_tag: "foreman-3.16"
55
iop_remediation_database_name: remediations_db
66
iop_remediation_database_user: remediations_user
77
iop_remediation_database_password: CHANGEME
8-
iop_remediation_database_host: "localhost"
8+
iop_remediation_database_host: "host.containers.internal"
99
iop_remediation_database_port: "5432"

‎src/roles/iop_vmaas/defaults/main.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
iop_vmaas_container_image: "quay.io/iop/vmaas"
3+
iop_vmaas_container_tag: "foreman-3.16"
4+
5+
iop_vmaas_database_name: vmaas_db
6+
iop_vmaas_database_user: vmaas_admin
7+
iop_vmaas_database_password: CHANGEME
8+
iop_vmaas_database_host: "host.containers.internal"
9+
iop_vmaas_database_port: "5432"

‎src/roles/iop_vmaas/handlers/main.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
- name: Check if vmaas reposcan service exists
3+
ansible.builtin.systemd:
4+
name: iop-service-vmaas-reposcan
5+
register: iop_vmaas_reposcan_service_status
6+
failed_when: false
7+
listen: restart vmaas
8+
9+
- name: Restart vmaas reposcan
10+
ansible.builtin.systemd:
11+
name: iop-service-vmaas-reposcan
12+
state: restarted
13+
when: iop_vmaas_reposcan_service_status.status is defined and iop_vmaas_reposcan_service_status.status.LoadState != "not-found"
14+
listen: restart vmaas
15+
16+
- name: Check if vmaas webapp-go service exists
17+
ansible.builtin.systemd:
18+
name: iop-service-vmaas-webapp-go
19+
register: iop_vmaas_webapp_service_status
20+
failed_when: false
21+
listen: restart vmaas
22+
23+
- name: Restart vmaas webapp-go
24+
ansible.builtin.systemd:
25+
name: iop-service-vmaas-webapp-go
26+
state: restarted
27+
when: iop_vmaas_webapp_service_status.status is defined and iop_vmaas_webapp_service_status.status.LoadState != "not-found"
28+
listen: restart vmaas

‎src/roles/iop_vmaas/tasks/main.yaml‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
---
2+
- name: Create VMAAS database secrets
3+
containers.podman.podman_secret:
4+
name: "{{ item.name }}"
5+
data: "{{ item.data }}"
6+
state: present
7+
loop:
8+
- name: "iop-service-vmaas-reposcan-database-username"
9+
data: "{{ iop_vmaas_database_user }}"
10+
- name: "iop-service-vmaas-reposcan-database-password"
11+
data: "{{ iop_vmaas_database_password }}"
12+
- name: "iop-service-vmaas-reposcan-database-name"
13+
data: "{{ iop_vmaas_database_name }}"
14+
- name: "iop-service-vmaas-reposcan-database-host"
15+
data: "{{ iop_vmaas_database_host }}"
16+
- name: "iop-service-vmaas-reposcan-database-port"
17+
data: "{{ iop_vmaas_database_port }}"
18+
no_log: true
19+
20+
- name: Create VMAAS data volume
21+
containers.podman.podman_volume:
22+
name: iop-service-vmaas-data
23+
state: present
24+
25+
- name: Deploy VMAAS Reposcan container
26+
containers.podman.podman_container:
27+
name: iop-service-vmaas-reposcan
28+
image: "{{ iop_vmaas_container_image }}:{{ iop_vmaas_container_tag }}"
29+
state: quadlet
30+
quadlet_dir: /etc/containers/systemd
31+
network: iop-core-network
32+
volumes:
33+
- iop-service-vmaas-data:/data
34+
command: "/vmaas/entrypoint.sh database-upgrade reposcan"
35+
env:
36+
PROMETHEUS_PORT: "8085"
37+
PROMETHEUS_MULTIPROC_DIR: "/tmp/prometheus_multiproc_dir"
38+
SYNC_REPO_LIST_SOURCE: "katello"
39+
SYNC_REPOS: "yes"
40+
SYNC_CVE_MAP: "yes"
41+
SYNC_CPE: "no"
42+
SYNC_CSAF: "no"
43+
SYNC_RELEASES: "no"
44+
SYNC_RELEASE_GRAPH: "no"
45+
KATELLO_URL: "http://iop-core-gateway:9090"
46+
REDHAT_CVEMAP_URL: "http://iop-core-gateway:9090/pub/iop/data/meta/v1/cvemap.xml"
47+
POSTGRESQL_SSL_MODE: "disable"
48+
secrets:
49+
- "iop-service-vmaas-reposcan-database-username,type=env,target=POSTGRESQL_USER"
50+
- "iop-service-vmaas-reposcan-database-password,type=env,target=POSTGRESQL_PASSWORD"
51+
- "iop-service-vmaas-reposcan-database-name,type=env,target=POSTGRESQL_DATABASE"
52+
- "iop-service-vmaas-reposcan-database-host,type=env,target=POSTGRESQL_HOST"
53+
- "iop-service-vmaas-reposcan-database-port,type=env,target=POSTGRESQL_PORT"
54+
quadlet_options:
55+
- |
56+
[Unit]
57+
Description=VMAAS Reposcan Service
58+
[Service]
59+
Restart=on-failure
60+
Environment=REGISTRY_AUTH_FILE=/etc/foreman/registry-auth.json
61+
[Install]
62+
WantedBy=default.target
63+
64+
- name: Deploy VMAAS Webapp-Go container
65+
containers.podman.podman_container:
66+
name: iop-service-vmaas-webapp-go
67+
image: "{{ iop_vmaas_container_image }}:{{ iop_vmaas_container_tag }}"
68+
state: quadlet
69+
quadlet_dir: /etc/containers/systemd
70+
network: iop-core-network
71+
command: "/vmaas/entrypoint.sh webapp-go"
72+
env:
73+
REPOSCAN_PUBLIC_URL: "http://iop-service-vmaas-reposcan:8000"
74+
REPOSCAN_PRIVATE_URL: "http://iop-service-vmaas-reposcan:10000"
75+
CSAF_UNFIXED_EVAL_ENABLED: "FALSE"
76+
GIN_MODE: "release"
77+
POSTGRESQL_SSL_MODE: "disable"
78+
secrets:
79+
- "iop-service-vmaas-reposcan-database-username,type=env,target=POSTGRESQL_USER"
80+
- "iop-service-vmaas-reposcan-database-password,type=env,target=POSTGRESQL_PASSWORD"
81+
- "iop-service-vmaas-reposcan-database-name,type=env,target=POSTGRESQL_DATABASE"
82+
- "iop-service-vmaas-reposcan-database-host,type=env,target=POSTGRESQL_HOST"
83+
- "iop-service-vmaas-reposcan-database-port,type=env,target=POSTGRESQL_PORT"
84+
quadlet_options:
85+
- |
86+
[Unit]
87+
Description=VMAAS Webapp-Go Service
88+
Wants=iop-service-vmaas-reposcan.service
89+
After=iop-service-vmaas-reposcan.service
90+
[Service]
91+
Restart=on-failure
92+
Environment=REGISTRY_AUTH_FILE=/etc/foreman/registry-auth.json
93+
[Install]
94+
WantedBy=default.target
95+
96+
- name: Run daemon reload to make Quadlet create the service files
97+
ansible.builtin.systemd:
98+
daemon_reload: true
99+
100+
- name: Start VMAAS Reposcan service
101+
ansible.builtin.systemd:
102+
name: iop-service-vmaas-reposcan
103+
enabled: true
104+
state: started
105+
106+
- name: Start VMAAS Webapp-Go service
107+
ansible.builtin.systemd:
108+
name: iop-service-vmaas-webapp-go
109+
enabled: true
110+
state: started

‎src/roles/iop_vulnerability/defaults/main.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
iop_vulnerability_container_image: "quay.io/iop/vulnerability-engine"
3+
iop_vulnerability_container_tag: "foreman-3.16"
4+
5+
iop_vulnerability_database_name: vulnerability_db
6+
iop_vulnerability_database_user: vulnerability_admin
7+
iop_vulnerability_database_password: CHANGEME
8+
iop_vulnerability_database_host: "host.containers.internal"
9+
iop_vulnerability_database_port: "5432"
10+
11+
# Taskomatic configuration
12+
iop_vulnerability_taskomatic_jobs: "stale_systems:5,delete_systems:30,cacheman:5"
13+
iop_vulnerability_taskomatic_startup: "cacheman"

‎src/roles/iop_vulnerability/handlers/main.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
- name: Check if vulnerability services exist
3+
ansible.builtin.systemd:
4+
name: "{{ item }}"
5+
register: iop_vulnerability_services_status
6+
failed_when: false
7+
loop:
8+
- iop-service-vuln-dbupgrade
9+
- iop-service-vuln-manager
10+
- iop-service-vuln-taskomatic
11+
- iop-service-vuln-grouper
12+
- iop-service-vuln-listener
13+
- iop-service-vuln-evaluator-recalc
14+
- iop-service-vuln-evaluator-upload
15+
- iop-service-vuln-vmaas-sync
16+
listen: restart vulnerability
17+
18+
- name: Restart vulnerability services
19+
ansible.builtin.systemd:
20+
name: "{{ item.item }}"
21+
state: restarted
22+
when: item.status is defined and item.status.LoadState != "not-found"
23+
loop: "{{ iop_vulnerability_services_status.results }}"
24+
listen: restart vulnerability

0 commit comments

Comments
 (0)