Skip to content

Commit de95fe7

Browse files
ehelmsehelms
committed
Add frontends for advisor and vulnerability
1 parent 5d5115a commit de95fe7

File tree

11 files changed

+275
-17
lines changed

11 files changed

+275
-17
lines changed

‎src/requirements.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
collections:
2+
- community.general
23
- community.postgresql
34
- community.crypto
45
- community.general

‎src/roles/iop_advisor_frontend/defaults/main.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
iop_advisor_frontend_container_image: "quay.io/iop/advisor-frontend"
3+
iop_advisor_frontend_container_tag: "foreman-3.16"
4+
iop_advisor_frontend_assets_path: "/var/lib/foreman/public/assets/apps/advisor"
5+
iop_advisor_frontend_source_path: "/srv/dist/."

‎src/roles/iop_advisor_frontend/tasks/main.yaml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
---
2+
- name: Pull Advisor Frontend container image
3+
containers.podman.podman_image:
4+
name: "{{ iop_advisor_frontend_container_image }}:{{ iop_advisor_frontend_container_tag }}"
5+
state: present
6+
7+
- name: Ensure parent assets directory exists
8+
ansible.builtin.file:
9+
path: /var/lib/foreman/public/assets/apps
10+
state: directory
11+
owner: root
12+
group: root
13+
mode: '0755'
14+
15+
- name: Ensure assets directory exists
16+
ansible.builtin.file:
17+
path: "{{ iop_advisor_frontend_assets_path }}"
18+
state: directory
19+
owner: root
20+
group: root
21+
mode: '0755'
22+
23+
- name: Create temporary container for asset extraction
24+
containers.podman.podman_container:
25+
name: iop-advisor-frontend-temp
26+
image: "{{ iop_advisor_frontend_container_image }}:{{ iop_advisor_frontend_container_tag }}"
27+
state: created
28+
29+
- name: Extract advisor frontend assets from container
30+
containers.podman.podman_container_copy:
31+
container: iop-advisor-frontend-temp
32+
src: "{{ iop_advisor_frontend_source_path }}"
33+
dest: "{{ iop_advisor_frontend_assets_path }}"
34+
from_container: true
35+
36+
- name: Restore SELinux context for advisor frontend assets
37+
ansible.builtin.command:
38+
cmd: restorecon -R "{{ iop_advisor_frontend_assets_path }}"
39+
when: ansible_facts['selinux']['status'] == "enabled"
40+
changed_when: false
41+
42+
- name: Remove temporary container
43+
containers.podman.podman_container:
44+
name: iop-advisor-frontend-temp
45+
state: absent
46+
47+
- name: Set ownership of advisor frontend assets
48+
ansible.builtin.file:
49+
path: "{{ iop_advisor_frontend_assets_path }}"
50+
owner: root
51+
group: root
52+
recurse: true
53+
54+
- name: Ensure Apache SSL config directory exists
55+
ansible.builtin.file:
56+
path: /etc/httpd/conf.d/05-foreman-ssl.d
57+
state: directory
58+
mode: '0755'
59+
60+
- name: Configure Apache for advisor frontend assets
61+
ansible.builtin.copy:
62+
dest: /etc/httpd/conf.d/05-foreman-ssl.d/advisor-frontend.conf
63+
content: |
64+
# IOP Advisor Frontend Assets Configuration
65+
Alias /assets/apps/advisor {{ iop_advisor_frontend_assets_path }}
66+
ProxyPass /assets/apps/advisor !
67+
68+
<LocationMatch "^/assets/apps/advisor">
69+
Options SymLinksIfOwnerMatch
70+
AllowOverride None
71+
Require all granted
72+
73+
# Use standard http expire header for assets instead of ETag
74+
<IfModule mod_expires.c>
75+
Header unset ETag
76+
FileETag None
77+
ExpiresActive On
78+
ExpiresDefault "access plus 1 year"
79+
</IfModule>
80+
81+
# Return compressed assets if they are precompiled
82+
RewriteEngine On
83+
# Make sure the browser supports gzip encoding and file with .gz added
84+
# does exist on disc before we rewrite with the extension
85+
RewriteCond %{HTTP:Accept-Encoding} \b(x-)?gzip\b
86+
RewriteCond %{REQUEST_FILENAME} \.(css|js|svg)$
87+
RewriteCond %{REQUEST_FILENAME}.gz -s
88+
RewriteRule ^(.+) $1.gz [L]
89+
</LocationMatch>
90+
mode: '0644'
91+
notify: "httpd : Restart httpd"

‎src/roles/iop_core/tasks/main.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,3 +46,16 @@
4646
- name: Deploy IOP Vulnerability service
4747
ansible.builtin.include_role:
4848
name: iop_vulnerability
49+
50+
- name: Install foreman-selinux package for frontend assets
51+
ansible.builtin.package:
52+
name: foreman-selinux
53+
state: present
54+
55+
- name: Deploy IOP Advisor Frontend
56+
ansible.builtin.include_role:
57+
name: iop_advisor_frontend
58+
59+
- name: Deploy IOP Vulnerability Frontend
60+
ansible.builtin.include_role:
61+
name: iop_vulnerability_frontend

‎src/roles/iop_vulnerability_frontend/defaults/main.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
iop_vulnerability_frontend_container_image: "quay.io/iop/vulnerability-frontend"
3+
iop_vulnerability_frontend_container_tag: "foreman-3.16"
4+
iop_vulnerability_frontend_assets_path: "/var/lib/foreman/public/assets/apps/vulnerability"
5+
iop_vulnerability_frontend_source_path: "/srv/dist/."

‎src/roles/iop_vulnerability_frontend/tasks/main.yaml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
---
2+
- name: Pull Vulnerability Frontend container image
3+
containers.podman.podman_image:
4+
name: "{{ iop_vulnerability_frontend_container_image }}:{{ iop_vulnerability_frontend_container_tag }}"
5+
state: present
6+
7+
- name: Ensure parent assets directory exists
8+
ansible.builtin.file:
9+
path: /var/lib/foreman/public/assets/apps
10+
state: directory
11+
owner: root
12+
group: root
13+
mode: '0755'
14+
15+
- name: Ensure assets directory exists
16+
ansible.builtin.file:
17+
path: "{{ iop_vulnerability_frontend_assets_path }}"
18+
state: directory
19+
owner: root
20+
group: root
21+
mode: '0755'
22+
23+
- name: Create temporary container for asset extraction
24+
containers.podman.podman_container:
25+
name: iop-vulnerability-frontend-temp
26+
image: "{{ iop_vulnerability_frontend_container_image }}:{{ iop_vulnerability_frontend_container_tag }}"
27+
state: created
28+
29+
- name: Extract vulnerability frontend assets from container
30+
containers.podman.podman_container_copy:
31+
container: iop-vulnerability-frontend-temp
32+
src: "{{ iop_vulnerability_frontend_source_path }}"
33+
dest: "{{ iop_vulnerability_frontend_assets_path }}"
34+
from_container: true
35+
36+
- name: Restore SELinux context for vulnerability frontend assets
37+
ansible.builtin.command:
38+
cmd: restorecon -R "{{ iop_vulnerability_frontend_assets_path }}"
39+
when: ansible_facts['selinux']['status'] == "enabled"
40+
changed_when: false
41+
42+
- name: Remove temporary container
43+
containers.podman.podman_container:
44+
name: iop-vulnerability-frontend-temp
45+
state: absent
46+
47+
- name: Set ownership of vulnerability frontend assets
48+
ansible.builtin.file:
49+
path: "{{ iop_vulnerability_frontend_assets_path }}"
50+
owner: root
51+
group: root
52+
recurse: true
53+
54+
- name: Ensure Apache SSL config directory exists
55+
ansible.builtin.file:
56+
path: /etc/httpd/conf.d/05-foreman-ssl.d
57+
state: directory
58+
mode: '0755'
59+
60+
- name: Configure Apache for vulnerability frontend assets
61+
ansible.builtin.copy:
62+
dest: /etc/httpd/conf.d/05-foreman-ssl.d/vulnerability-frontend.conf
63+
content: |
64+
# IOP Vulnerability Frontend Assets Configuration
65+
Alias /assets/apps/vulnerability {{ iop_vulnerability_frontend_assets_path }}
66+
ProxyPass /assets/apps/vulnerability !
67+
68+
<LocationMatch "^/assets/apps/vulnerability">
69+
Options SymLinksIfOwnerMatch
70+
AllowOverride None
71+
Require all granted
72+
73+
# Use standard http expire header for assets instead of ETag
74+
<IfModule mod_expires.c>
75+
Header unset ETag
76+
FileETag None
77+
ExpiresActive On
78+
ExpiresDefault "access plus 1 year"
79+
</IfModule>
80+
81+
# Return compressed assets if they are precompiled
82+
RewriteEngine On
83+
# Make sure the browser supports gzip encoding and file with .gz added
84+
# does exist on disc before we rewrite with the extension
85+
RewriteCond %{HTTP:Accept-Encoding} \b(x-)?gzip\b
86+
RewriteCond %{REQUEST_FILENAME} \.(css|js|svg)$
87+
RewriteCond %{REQUEST_FILENAME}.gz -s
88+
RewriteRule ^(.+) $1.gz [L]
89+
</LocationMatch>
90+
mode: '0644'
91+
notify: "httpd : Restart httpd"

‎tests/fixtures/help/checks.txt‎

Whitespace-only changes.

‎tests/iop/test_advisor_frontend.py‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
import pytest
2+
3+
4+
def test_advisor_frontend_assets_directory(server):
5+
assets_dir = server.file("/var/lib/foreman/public/assets/apps/advisor")
6+
assert assets_dir.exists
7+
assert assets_dir.is_directory
8+
assert assets_dir.mode == 0o755
9+
10+
11+
def test_advisor_frontend_app_info_file(server):
12+
app_info_file = server.file("/var/lib/foreman/public/assets/apps/advisor/app.info.json")
13+
14+
assert app_info_file.exists
15+
assert app_info_file.is_file
16+
17+
18+
def test_advisor_frontend_javascript_assets_accessible(server):
19+
result = server.run("find /var/lib/foreman/public/assets/apps/advisor -name '*.js' | head -1")
20+
assert result.succeeded
21+
assert result.stdout.strip()
22+
js_file = result.stdout.strip().replace("/var/lib/foreman/public", "")
23+
curl_result = server.run(f"curl -s -o /dev/null -w '%{{http_code}}' -k https://localhost{js_file}")
24+
assert curl_result.succeeded
25+
http_code = curl_result.stdout.strip()
26+
assert http_code in ["200"]

‎tests/iop/test_kafka.py‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -43,23 +43,23 @@ def test_kafka_config_content(server):
4343

4444
def test_kafka_topic_creation(server):
4545
topics = [
46-
"platform.upload.available",
46+
"platform.engine.results",
47+
"platform.insights.rule-hits",
48+
"platform.insights.rule-deactivation",
4749
"platform.inventory.events",
48-
"platform.system-profile",
49-
"advisor.recommendations",
50-
"advisor.payload-tracker",
51-
"advisor.rules-results",
52-
"remediations.updates",
53-
"remediations.status",
54-
"vulnerability.uploads",
55-
"vulnerability.evaluator",
56-
"vulnerability.manager",
57-
"vmaas.vulnerability.updates",
58-
"vmaas.package.updates",
59-
"puptoo.opening",
60-
"puptoo.validation",
61-
"yuptoo.opening",
62-
"yuptoo.validation"
50+
"platform.inventory.host-ingress",
51+
"platform.sources.event-stream",
52+
"platform.playbook-dispatcher.runs",
53+
"platform.upload.announce",
54+
"platform.upload.validation",
55+
"platform.logging.logs",
56+
"platform.payload-status",
57+
"platform.remediation-updates.vulnerability",
58+
"vulnerability.evaluator.results",
59+
"vulnerability.evaluator.recalc",
60+
"vulnerability.evaluator.upload",
61+
"vulnerability.grouper.inventory.upload",
62+
"vulnerability.grouper.advisor.upload"
6363
]
6464

6565
result = server.run("podman exec iop-core-kafka /opt/kafka/bin/kafka-topics.sh --bootstrap-server iop-core-kafka:9092 --list")

‎tests/iop/test_vulnerability.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ def test_vulnerability_fdw_user_mapping_exists(server):
172172

173173

174174
def test_vulnerability_fdw_foreign_table_exists(server):
175-
result = server.run("podman exec postgresql psql vulnerability_db -c \"SELECT * FROM information_schema.foreign_tables WHERE foreign_table_schema = 'inventory_remote' AND foreign_table_name = 'hosts';\"")
175+
result = server.run("podman exec postgresql psql vulnerability_db -c \"SELECT * FROM information_schema.foreign_tables WHERE foreign_table_schema = 'inventory_source' AND foreign_table_name = 'hosts';\"")
176176
assert result.succeeded
177177
assert "hosts" in result.stdout
178178

0 commit comments

Comments
 (0)