Skip to content

Commit ae5d9a5

Browse files
ehelmsehelms
committed
Add frontends for advisor and vulnerability
1 parent a597433 commit ae5d9a5

File tree

10 files changed

+297
-17
lines changed

10 files changed

+297
-17
lines changed

‎src/roles/iop_advisor_frontend/defaults/main.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
iop_advisor_frontend_container_image: "quay.io/iop/advisor-frontend"
3+
iop_advisor_frontend_container_tag: "foreman-3.16"
4+
iop_advisor_frontend_assets_path: "/var/lib/foreman/public/assets/apps/advisor"
5+
iop_advisor_frontend_source_path: "/srv/dist/."

‎src/roles/iop_advisor_frontend/tasks/main.yaml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
---
2+
- name: Pull Advisor Frontend container image
3+
containers.podman.podman_image:
4+
name: "{{ iop_advisor_frontend_container_image }}:{{ iop_advisor_frontend_container_tag }}"
5+
state: present
6+
7+
- name: Ensure parent assets directory exists
8+
ansible.builtin.file:
9+
path: /var/lib/foreman/public/assets/apps
10+
state: directory
11+
owner: foreman
12+
group: foreman
13+
mode: '0755'
14+
15+
- name: Ensure assets directory exists
16+
ansible.builtin.file:
17+
path: "{{ iop_advisor_frontend_assets_path }}"
18+
state: directory
19+
owner: foreman
20+
group: foreman
21+
mode: '0755'
22+
23+
- name: Create temporary container for asset extraction
24+
containers.podman.podman_container:
25+
name: iop-advisor-frontend-temp
26+
image: "{{ iop_advisor_frontend_container_image }}:{{ iop_advisor_frontend_container_tag }}"
27+
state: created
28+
29+
- name: Extract advisor frontend assets from container
30+
containers.podman.podman_container_copy:
31+
container: iop-advisor-frontend-temp
32+
src: "{{ iop_advisor_frontend_source_path }}"
33+
dest: "{{ iop_advisor_frontend_assets_path }}"
34+
from_container: true
35+
36+
- name: Remove temporary container
37+
containers.podman.podman_container:
38+
name: iop-advisor-frontend-temp
39+
state: absent
40+
41+
- name: Set ownership of advisor frontend assets
42+
ansible.builtin.file:
43+
path: "{{ iop_advisor_frontend_assets_path }}"
44+
owner: foreman
45+
group: foreman
46+
recurse: true
47+
48+
- name: Set SELinux context for advisor frontend assets
49+
ansible.builtin.command:
50+
cmd: "chcon -R -t httpd_exec_t {{ iop_advisor_frontend_assets_path }}"
51+
changed_when: true
52+
53+
- name: Ensure Apache SSL config directory exists
54+
ansible.builtin.file:
55+
path: /etc/httpd/conf.d/05-foreman-ssl.d
56+
state: directory
57+
mode: '0755'
58+
59+
- name: Configure Apache for advisor frontend assets
60+
ansible.builtin.copy:
61+
dest: /etc/httpd/conf.d/05-foreman-ssl.d/advisor-frontend.conf
62+
content: |
63+
# IOP Advisor Frontend Assets Configuration
64+
Alias /assets/apps/advisor {{ iop_advisor_frontend_assets_path }}
65+
ProxyPass /assets/apps/advisor !
66+
67+
<LocationMatch "^/assets/apps/advisor">
68+
Options SymLinksIfOwnerMatch
69+
AllowOverride None
70+
Require all granted
71+
72+
# Use standard http expire header for assets instead of ETag
73+
<IfModule mod_expires.c>
74+
Header unset ETag
75+
FileETag None
76+
ExpiresActive On
77+
ExpiresDefault "access plus 1 year"
78+
</IfModule>
79+
80+
# Return compressed assets if they are precompiled
81+
RewriteEngine On
82+
# Make sure the browser supports gzip encoding and file with .gz added
83+
# does exist on disc before we rewrite with the extension
84+
RewriteCond %{HTTP:Accept-Encoding} \b(x-)?gzip\b
85+
RewriteCond %{REQUEST_FILENAME} \.(css|js|svg)$
86+
RewriteCond %{REQUEST_FILENAME}.gz -s
87+
RewriteRule ^(.+) $1.gz [L]
88+
</LocationMatch>
89+
mode: '0644'
90+
notify: "httpd : Restart httpd"

‎src/roles/iop_core/tasks/main.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,3 +46,11 @@
4646
- name: Deploy IOP Vulnerability service
4747
ansible.builtin.include_role:
4848
name: iop_vulnerability
49+
50+
- name: Deploy IOP Advisor Frontend
51+
ansible.builtin.include_role:
52+
name: iop_advisor_frontend
53+
54+
- name: Deploy IOP Vulnerability Frontend
55+
ansible.builtin.include_role:
56+
name: iop_vulnerability_frontend

‎src/roles/iop_vulnerability_frontend/defaults/main.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
iop_vulnerability_frontend_container_image: "quay.io/iop/vulnerability-frontend"
3+
iop_vulnerability_frontend_container_tag: "foreman-3.16"
4+
iop_vulnerability_frontend_assets_path: "/var/lib/foreman/public/assets/apps/vulnerability"
5+
iop_vulnerability_frontend_source_path: "/srv/dist/."

‎src/roles/iop_vulnerability_frontend/tasks/main.yaml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
---
2+
- name: Pull Vulnerability Frontend container image
3+
containers.podman.podman_image:
4+
name: "{{ iop_vulnerability_frontend_container_image }}:{{ iop_vulnerability_frontend_container_tag }}"
5+
state: present
6+
7+
- name: Ensure parent assets directory exists
8+
ansible.builtin.file:
9+
path: /var/lib/foreman/public/assets/apps
10+
state: directory
11+
owner: foreman
12+
group: foreman
13+
mode: '0755'
14+
15+
- name: Ensure assets directory exists
16+
ansible.builtin.file:
17+
path: "{{ iop_vulnerability_frontend_assets_path }}"
18+
state: directory
19+
owner: foreman
20+
group: foreman
21+
mode: '0755'
22+
23+
- name: Create temporary container for asset extraction
24+
containers.podman.podman_container:
25+
name: iop-vulnerability-frontend-temp
26+
image: "{{ iop_vulnerability_frontend_container_image }}:{{ iop_vulnerability_frontend_container_tag }}"
27+
state: created
28+
29+
- name: Extract vulnerability frontend assets from container
30+
containers.podman.podman_container_copy:
31+
container: iop-vulnerability-frontend-temp
32+
src: "{{ iop_vulnerability_frontend_source_path }}"
33+
dest: "{{ iop_vulnerability_frontend_assets_path }}"
34+
from_container: true
35+
36+
- name: Remove temporary container
37+
containers.podman.podman_container:
38+
name: iop-vulnerability-frontend-temp
39+
state: absent
40+
41+
- name: Set ownership of vulnerability frontend assets
42+
ansible.builtin.file:
43+
path: "{{ iop_vulnerability_frontend_assets_path }}"
44+
owner: foreman
45+
group: foreman
46+
recurse: true
47+
48+
- name: Set SELinux context for vulnerability frontend assets
49+
ansible.builtin.command:
50+
cmd: "chcon -R -t httpd_exec_t {{ iop_vulnerability_frontend_assets_path }}"
51+
changed_when: true
52+
53+
- name: Ensure Apache SSL config directory exists
54+
ansible.builtin.file:
55+
path: /etc/httpd/conf.d/05-foreman-ssl.d
56+
state: directory
57+
mode: '0755'
58+
59+
- name: Configure Apache for vulnerability frontend assets
60+
ansible.builtin.copy:
61+
dest: /etc/httpd/conf.d/05-foreman-ssl.d/vulnerability-frontend.conf
62+
content: |
63+
# IOP Vulnerability Frontend Assets Configuration
64+
Alias /assets/apps/vulnerability {{ iop_vulnerability_frontend_assets_path }}
65+
ProxyPass /assets/apps/vulnerability !
66+
67+
<LocationMatch "^/assets/apps/vulnerability">
68+
Options SymLinksIfOwnerMatch
69+
AllowOverride None
70+
Require all granted
71+
72+
# Use standard http expire header for assets instead of ETag
73+
<IfModule mod_expires.c>
74+
Header unset ETag
75+
FileETag None
76+
ExpiresActive On
77+
ExpiresDefault "access plus 1 year"
78+
</IfModule>
79+
80+
# Return compressed assets if they are precompiled
81+
RewriteEngine On
82+
# Make sure the browser supports gzip encoding and file with .gz added
83+
# does exist on disc before we rewrite with the extension
84+
RewriteCond %{HTTP:Accept-Encoding} \b(x-)?gzip\b
85+
RewriteCond %{REQUEST_FILENAME} \.(css|js|svg)$
86+
RewriteCond %{REQUEST_FILENAME}.gz -s
87+
RewriteRule ^(.+) $1.gz [L]
88+
</LocationMatch>
89+
mode: '0644'
90+
notify: "httpd : Restart httpd"

‎tests/fixtures/help/checks.txt‎

Whitespace-only changes.

‎tests/iop/test_advisor_frontend.py‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
import pytest
2+
3+
4+
def test_advisor_frontend_assets_directory(server):
5+
assets_dir = server.file("/var/lib/foreman/public/assets/apps/advisor")
6+
assert assets_dir.exists
7+
assert assets_dir.is_directory
8+
assert assets_dir.mode == 0o755
9+
10+
11+
def test_advisor_frontend_assets_ownership(server):
12+
assets_dir = server.file("/var/lib/foreman/public/assets/apps/advisor")
13+
assert assets_dir.user == "foreman"
14+
assert assets_dir.group == "foreman"
15+
16+
17+
def test_advisor_frontend_app_info_file(server):
18+
app_info_file = server.file("/var/lib/foreman/public/assets/apps/advisor/app.info.json")
19+
20+
assert app_info_file.exists
21+
assert app_info_file.is_file
22+
assert app_info_file.user == "foreman"
23+
assert app_info_file.group == "foreman"
24+
25+
26+
def test_advisor_frontend_asset_accessible_via_https(server):
27+
result = server.run("curl -s -o /dev/null -w '%{http_code}' -k https://localhost/assets/apps/advisor/ 2>/dev/null || echo '000'")
28+
assert result.succeeded
29+
http_code = result.stdout.strip()
30+
assert http_code != "000"
31+
assert http_code in ["200", "301", "302", "403"]
32+
33+
34+
def test_advisor_frontend_static_file_content_type(server):
35+
result = server.run("curl -s -I http://localhost/assets/apps/advisor/ 2>/dev/null | grep -i 'content-type' || echo 'no-content-type'")
36+
assert result.succeeded
37+
assert "no-content-type" not in result.stdout
38+
assert "content-type" in result.stdout.lower()
39+
40+
41+
def test_advisor_frontend_javascript_assets_accessible(server):
42+
result = server.run("find /var/lib/foreman/public/assets/apps/advisor -name '*.js' | head -1")
43+
assert result.succeeded
44+
assert result.stdout.strip()
45+
js_file = result.stdout.strip().replace("/var/lib/foreman/public", "")
46+
curl_result = server.run(f"curl -s -o /dev/null -w '%{{http_code}}' -k https://localhost{js_file} 2>/dev/null || echo '000'")
47+
assert curl_result.succeeded
48+
http_code = curl_result.stdout.strip()
49+
assert http_code in ["200", "403", "404"]

‎tests/iop/test_kafka.py‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -43,23 +43,23 @@ def test_kafka_config_content(server):
4343

4444
def test_kafka_topic_creation(server):
4545
topics = [
46-
"platform.upload.available",
46+
"platform.engine.results",
47+
"platform.insights.rule-hits",
48+
"platform.insights.rule-deactivation",
4749
"platform.inventory.events",
48-
"platform.system-profile",
49-
"advisor.recommendations",
50-
"advisor.payload-tracker",
51-
"advisor.rules-results",
52-
"remediations.updates",
53-
"remediations.status",
54-
"vulnerability.uploads",
55-
"vulnerability.evaluator",
56-
"vulnerability.manager",
57-
"vmaas.vulnerability.updates",
58-
"vmaas.package.updates",
59-
"puptoo.opening",
60-
"puptoo.validation",
61-
"yuptoo.opening",
62-
"yuptoo.validation"
50+
"platform.inventory.host-ingress",
51+
"platform.sources.event-stream",
52+
"platform.playbook-dispatcher.runs",
53+
"platform.upload.announce",
54+
"platform.upload.validation",
55+
"platform.logging.logs",
56+
"platform.payload-status",
57+
"platform.remediation-updates.vulnerability",
58+
"vulnerability.evaluator.results",
59+
"vulnerability.evaluator.recalc",
60+
"vulnerability.evaluator.upload",
61+
"vulnerability.grouper.inventory.upload",
62+
"vulnerability.grouper.advisor.upload"
6363
]
6464

6565
result = server.run("podman exec iop-core-kafka /opt/kafka/bin/kafka-topics.sh --bootstrap-server iop-core-kafka:9092 --list")

‎tests/iop/test_vulnerability.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ def test_vulnerability_fdw_user_mapping_exists(server):
172172

173173

174174
def test_vulnerability_fdw_foreign_table_exists(server):
175-
result = server.run("podman exec postgresql psql vulnerability_db -c \"SELECT * FROM information_schema.foreign_tables WHERE foreign_table_schema = 'inventory_remote' AND foreign_table_name = 'hosts';\"")
175+
result = server.run("podman exec postgresql psql vulnerability_db -c \"SELECT * FROM information_schema.foreign_tables WHERE foreign_table_schema = 'inventory_source' AND foreign_table_name = 'hosts';\"")
176176
assert result.succeeded
177177
assert "hosts" in result.stdout
178178

‎tests/iop/test_vulnerability_frontend.py‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
import pytest
2+
3+
4+
def test_vulnerability_frontend_assets_directory(server):
5+
assets_dir = server.file("/var/lib/foreman/public/assets/apps/vulnerability")
6+
assert assets_dir.exists
7+
assert assets_dir.is_directory
8+
assert assets_dir.mode == 0o755
9+
10+
11+
def test_vulnerability_frontend_assets_ownership(server):
12+
assets_dir = server.file("/var/lib/foreman/public/assets/apps/vulnerability")
13+
assert assets_dir.user == "foreman"
14+
assert assets_dir.group == "foreman"
15+
16+
17+
def test_vulnerability_frontend_app_info_file(server):
18+
app_info_file = server.file("/var/lib/foreman/public/assets/apps/vulnerability/app.info.json")
19+
assert app_info_file.exists
20+
assert app_info_file.is_file
21+
assert app_info_file.user == "foreman"
22+
assert app_info_file.group == "foreman"
23+
24+
25+
def test_vulnerability_frontend_javascript_assets_accessible(server):
26+
result = server.run("find /var/lib/foreman/public/assets/apps/vulnerability -name '*.js' | head -1")
27+
assert result.succeeded
28+
assert result.stdout.strip()
29+
js_file = result.stdout.strip().replace("/var/lib/foreman/public", "")
30+
curl_result = server.run(f"curl -s -o /dev/null -w '%{{http_code}}' -k https://localhost{js_file}")
31+
assert curl_result.succeeded
32+
http_code = curl_result.stdout.strip()
33+
assert http_code in ["200"]

0 commit comments

Comments
 (0)