Skip to content

Commit a6c61dd

Browse files
ehelmsehelms
committed
Add frontends for advisor and vulnerability
1 parent 5d5115a commit a6c61dd

File tree

11 files changed

+263
-17
lines changed

11 files changed

+263
-17
lines changed

‎src/requirements.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
collections:
2+
- community.general
23
- community.postgresql
34
- community.crypto
45
- community.general

‎src/roles/iop_advisor_frontend/defaults/main.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
iop_advisor_frontend_container_image: "quay.io/iop/advisor-frontend"
3+
iop_advisor_frontend_container_tag: "foreman-3.16"
4+
iop_advisor_frontend_assets_path: "/var/lib/foreman/public/assets/apps/advisor"
5+
iop_advisor_frontend_source_path: "/srv/dist/."

‎src/roles/iop_advisor_frontend/tasks/main.yaml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
---
2+
- name: Pull Advisor Frontend container image
3+
containers.podman.podman_image:
4+
name: "{{ iop_advisor_frontend_container_image }}:{{ iop_advisor_frontend_container_tag }}"
5+
state: present
6+
7+
- name: Ensure parent assets directory exists
8+
ansible.builtin.file:
9+
path: /var/lib/foreman/public/assets/apps
10+
state: directory
11+
owner: root
12+
group: root
13+
mode: '0755'
14+
15+
- name: Ensure assets directory exists
16+
ansible.builtin.file:
17+
path: "{{ iop_advisor_frontend_assets_path }}"
18+
state: directory
19+
owner: root
20+
group: root
21+
mode: '0755'
22+
23+
- name: Create temporary container for asset extraction
24+
containers.podman.podman_container:
25+
name: iop-advisor-frontend-temp
26+
image: "{{ iop_advisor_frontend_container_image }}:{{ iop_advisor_frontend_container_tag }}"
27+
state: created
28+
29+
- name: Extract advisor frontend assets from container
30+
containers.podman.podman_container_copy:
31+
container: iop-advisor-frontend-temp
32+
src: "{{ iop_advisor_frontend_source_path }}"
33+
dest: "{{ iop_advisor_frontend_assets_path }}"
34+
from_container: true
35+
36+
- name: Remove temporary container
37+
containers.podman.podman_container:
38+
name: iop-advisor-frontend-temp
39+
state: absent
40+
41+
- name: Set ownership of advisor frontend assets
42+
ansible.builtin.file:
43+
path: "{{ iop_advisor_frontend_assets_path }}"
44+
owner: root
45+
group: root
46+
recurse: true
47+
48+
- name: Ensure Apache SSL config directory exists
49+
ansible.builtin.file:
50+
path: /etc/httpd/conf.d/05-foreman-ssl.d
51+
state: directory
52+
mode: '0755'
53+
54+
- name: Configure Apache for advisor frontend assets
55+
ansible.builtin.copy:
56+
dest: /etc/httpd/conf.d/05-foreman-ssl.d/advisor-frontend.conf
57+
content: |
58+
# IOP Advisor Frontend Assets Configuration
59+
Alias /assets/apps/advisor {{ iop_advisor_frontend_assets_path }}
60+
ProxyPass /assets/apps/advisor !
61+
62+
<LocationMatch "^/assets/apps/advisor">
63+
Options SymLinksIfOwnerMatch
64+
AllowOverride None
65+
Require all granted
66+
67+
# Use standard http expire header for assets instead of ETag
68+
<IfModule mod_expires.c>
69+
Header unset ETag
70+
FileETag None
71+
ExpiresActive On
72+
ExpiresDefault "access plus 1 year"
73+
</IfModule>
74+
75+
# Return compressed assets if they are precompiled
76+
RewriteEngine On
77+
# Make sure the browser supports gzip encoding and file with .gz added
78+
# does exist on disc before we rewrite with the extension
79+
RewriteCond %{HTTP:Accept-Encoding} \b(x-)?gzip\b
80+
RewriteCond %{REQUEST_FILENAME} \.(css|js|svg)$
81+
RewriteCond %{REQUEST_FILENAME}.gz -s
82+
RewriteRule ^(.+) $1.gz [L]
83+
</LocationMatch>
84+
mode: '0644'
85+
notify: "httpd : Restart httpd"

‎src/roles/iop_core/tasks/main.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,3 +46,16 @@
4646
- name: Deploy IOP Vulnerability service
4747
ansible.builtin.include_role:
4848
name: iop_vulnerability
49+
50+
- name: Install foreman-selinux package for frontend assets
51+
ansible.builtin.package:
52+
name: foreman-selinux
53+
state: present
54+
55+
- name: Deploy IOP Advisor Frontend
56+
ansible.builtin.include_role:
57+
name: iop_advisor_frontend
58+
59+
- name: Deploy IOP Vulnerability Frontend
60+
ansible.builtin.include_role:
61+
name: iop_vulnerability_frontend

‎src/roles/iop_vulnerability_frontend/defaults/main.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
iop_vulnerability_frontend_container_image: "quay.io/iop/vulnerability-frontend"
3+
iop_vulnerability_frontend_container_tag: "foreman-3.16"
4+
iop_vulnerability_frontend_assets_path: "/var/lib/foreman/public/assets/apps/vulnerability"
5+
iop_vulnerability_frontend_source_path: "/srv/dist/."

‎src/roles/iop_vulnerability_frontend/tasks/main.yaml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
---
2+
- name: Pull Vulnerability Frontend container image
3+
containers.podman.podman_image:
4+
name: "{{ iop_vulnerability_frontend_container_image }}:{{ iop_vulnerability_frontend_container_tag }}"
5+
state: present
6+
7+
- name: Ensure parent assets directory exists
8+
ansible.builtin.file:
9+
path: /var/lib/foreman/public/assets/apps
10+
state: directory
11+
owner: root
12+
group: root
13+
mode: '0755'
14+
15+
- name: Ensure assets directory exists
16+
ansible.builtin.file:
17+
path: "{{ iop_vulnerability_frontend_assets_path }}"
18+
state: directory
19+
owner: root
20+
group: root
21+
mode: '0755'
22+
23+
- name: Create temporary container for asset extraction
24+
containers.podman.podman_container:
25+
name: iop-vulnerability-frontend-temp
26+
image: "{{ iop_vulnerability_frontend_container_image }}:{{ iop_vulnerability_frontend_container_tag }}"
27+
state: created
28+
29+
- name: Extract vulnerability frontend assets from container
30+
containers.podman.podman_container_copy:
31+
container: iop-vulnerability-frontend-temp
32+
src: "{{ iop_vulnerability_frontend_source_path }}"
33+
dest: "{{ iop_vulnerability_frontend_assets_path }}"
34+
from_container: true
35+
36+
- name: Remove temporary container
37+
containers.podman.podman_container:
38+
name: iop-vulnerability-frontend-temp
39+
state: absent
40+
41+
- name: Set ownership of vulnerability frontend assets
42+
ansible.builtin.file:
43+
path: "{{ iop_vulnerability_frontend_assets_path }}"
44+
owner: root
45+
group: root
46+
recurse: true
47+
48+
- name: Ensure Apache SSL config directory exists
49+
ansible.builtin.file:
50+
path: /etc/httpd/conf.d/05-foreman-ssl.d
51+
state: directory
52+
mode: '0755'
53+
54+
- name: Configure Apache for vulnerability frontend assets
55+
ansible.builtin.copy:
56+
dest: /etc/httpd/conf.d/05-foreman-ssl.d/vulnerability-frontend.conf
57+
content: |
58+
# IOP Vulnerability Frontend Assets Configuration
59+
Alias /assets/apps/vulnerability {{ iop_vulnerability_frontend_assets_path }}
60+
ProxyPass /assets/apps/vulnerability !
61+
62+
<LocationMatch "^/assets/apps/vulnerability">
63+
Options SymLinksIfOwnerMatch
64+
AllowOverride None
65+
Require all granted
66+
67+
# Use standard http expire header for assets instead of ETag
68+
<IfModule mod_expires.c>
69+
Header unset ETag
70+
FileETag None
71+
ExpiresActive On
72+
ExpiresDefault "access plus 1 year"
73+
</IfModule>
74+
75+
# Return compressed assets if they are precompiled
76+
RewriteEngine On
77+
# Make sure the browser supports gzip encoding and file with .gz added
78+
# does exist on disc before we rewrite with the extension
79+
RewriteCond %{HTTP:Accept-Encoding} \b(x-)?gzip\b
80+
RewriteCond %{REQUEST_FILENAME} \.(css|js|svg)$
81+
RewriteCond %{REQUEST_FILENAME}.gz -s
82+
RewriteRule ^(.+) $1.gz [L]
83+
</LocationMatch>
84+
mode: '0644'
85+
notify: "httpd : Restart httpd"

‎tests/fixtures/help/checks.txt‎

Whitespace-only changes.

‎tests/iop/test_advisor_frontend.py‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
import pytest
2+
3+
4+
def test_advisor_frontend_assets_directory(server):
5+
assets_dir = server.file("/var/lib/foreman/public/assets/apps/advisor")
6+
assert assets_dir.exists
7+
assert assets_dir.is_directory
8+
assert assets_dir.mode == 0o755
9+
10+
11+
def test_advisor_frontend_app_info_file(server):
12+
app_info_file = server.file("/var/lib/foreman/public/assets/apps/advisor/app.info.json")
13+
14+
assert app_info_file.exists
15+
assert app_info_file.is_file
16+
17+
18+
def test_advisor_frontend_javascript_assets_accessible(server):
19+
result = server.run("find /var/lib/foreman/public/assets/apps/advisor -name '*.js' | head -1")
20+
assert result.succeeded
21+
assert result.stdout.strip()
22+
js_file = result.stdout.strip().replace("/var/lib/foreman/public", "")
23+
curl_result = server.run(f"curl -s -o /dev/null -w '%{{http_code}}' -k https://localhost{js_file}")
24+
assert curl_result.succeeded
25+
http_code = curl_result.stdout.strip()
26+
assert http_code in ["200"]

‎tests/iop/test_kafka.py‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -43,23 +43,23 @@ def test_kafka_config_content(server):
4343

4444
def test_kafka_topic_creation(server):
4545
topics = [
46-
"platform.upload.available",
46+
"platform.engine.results",
47+
"platform.insights.rule-hits",
48+
"platform.insights.rule-deactivation",
4749
"platform.inventory.events",
48-
"platform.system-profile",
49-
"advisor.recommendations",
50-
"advisor.payload-tracker",
51-
"advisor.rules-results",
52-
"remediations.updates",
53-
"remediations.status",
54-
"vulnerability.uploads",
55-
"vulnerability.evaluator",
56-
"vulnerability.manager",
57-
"vmaas.vulnerability.updates",
58-
"vmaas.package.updates",
59-
"puptoo.opening",
60-
"puptoo.validation",
61-
"yuptoo.opening",
62-
"yuptoo.validation"
50+
"platform.inventory.host-ingress",
51+
"platform.sources.event-stream",
52+
"platform.playbook-dispatcher.runs",
53+
"platform.upload.announce",
54+
"platform.upload.validation",
55+
"platform.logging.logs",
56+
"platform.payload-status",
57+
"platform.remediation-updates.vulnerability",
58+
"vulnerability.evaluator.results",
59+
"vulnerability.evaluator.recalc",
60+
"vulnerability.evaluator.upload",
61+
"vulnerability.grouper.inventory.upload",
62+
"vulnerability.grouper.advisor.upload"
6363
]
6464

6565
result = server.run("podman exec iop-core-kafka /opt/kafka/bin/kafka-topics.sh --bootstrap-server iop-core-kafka:9092 --list")

‎tests/iop/test_vulnerability.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ def test_vulnerability_fdw_user_mapping_exists(server):
172172

173173

174174
def test_vulnerability_fdw_foreign_table_exists(server):
175-
result = server.run("podman exec postgresql psql vulnerability_db -c \"SELECT * FROM information_schema.foreign_tables WHERE foreign_table_schema = 'inventory_remote' AND foreign_table_name = 'hosts';\"")
175+
result = server.run("podman exec postgresql psql vulnerability_db -c \"SELECT * FROM information_schema.foreign_tables WHERE foreign_table_schema = 'inventory_source' AND foreign_table_name = 'hosts';\"")
176176
assert result.succeeded
177177
assert "hosts" in result.stdout
178178

0 commit comments

Comments
 (0)