|
|
|
|
@ -10,12 +10,21 @@ from ....config import (
|
|
|
|
|
|
|
|
|
|
from ....docker_util import (
|
|
|
|
|
docker_cp_to,
|
|
|
|
|
docker_exec,
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
from ....containers import (
|
|
|
|
|
run_support_container,
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
from ....encoding import (
|
|
|
|
|
to_text,
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
from ....util import (
|
|
|
|
|
display,
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
from . import (
|
|
|
|
|
CloudEnvironment,
|
|
|
|
|
CloudEnvironmentConfig,
|
|
|
|
|
@ -23,53 +32,59 @@ from . import (
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# We add BasicAuthentication, to make the tasks that deal with
|
|
|
|
|
# direct API access easier to deal with across galaxy_ng and pulp
|
|
|
|
|
SETTINGS = '''
|
|
|
|
|
CONTENT_ORIGIN = 'http://{host}:80'
|
|
|
|
|
ANSIBLE_API_HOSTNAME = 'http://{host}:80'
|
|
|
|
|
ANSIBLE_CONTENT_HOSTNAME = 'http://{host}:80/pulp/content'
|
|
|
|
|
TOKEN_AUTH_DISABLED = True
|
|
|
|
|
GALAXY_REQUIRE_CONTENT_APPROVAL = False
|
|
|
|
|
GALAXY_AUTHENTICATION_CLASSES = [
|
|
|
|
|
"rest_framework.authentication.SessionAuthentication",
|
|
|
|
|
"rest_framework.authentication.TokenAuthentication",
|
|
|
|
|
"rest_framework.authentication.BasicAuthentication",
|
|
|
|
|
]
|
|
|
|
|
'''
|
|
|
|
|
|
|
|
|
|
SET_ADMIN_PASSWORD = b'''#!/usr/bin/execlineb -S0
|
|
|
|
|
foreground {
|
|
|
|
|
redirfd -w 1 /dev/null
|
|
|
|
|
redirfd -w 2 /dev/null
|
|
|
|
|
export DJANGO_SETTINGS_MODULE pulpcore.app.settings
|
|
|
|
|
export PULP_CONTENT_ORIGIN localhost
|
|
|
|
|
s6-setuidgid postgres
|
|
|
|
|
if { /usr/local/bin/django-admin reset-admin-password --password password }
|
|
|
|
|
if { /usr/local/bin/pulpcore-manager create-group system:partner-engineers --users admin }
|
|
|
|
|
}
|
|
|
|
|
'''
|
|
|
|
|
|
|
|
|
|
# There are 2 overrides here:
|
|
|
|
|
# 1. Change the gunicorn bind address from 127.0.0.1 to 0.0.0.0 now that Galaxy NG does not allow us to access the
|
|
|
|
|
# Pulp API through it.
|
|
|
|
|
# 2. Grant access allowing us to DELETE a namespace in Galaxy NG. This is as CI deletes and recreates repos and
|
|
|
|
|
# distributions in Pulp which now breaks the namespace in Galaxy NG. Recreating it is the "simple" fix to get it
|
|
|
|
|
# working again.
|
|
|
|
|
# These may not be needed in the future, especially if 1 becomes configurable by an env var but for now they must be
|
|
|
|
|
# done.
|
|
|
|
|
OVERRIDES = b'''#!/usr/bin/execlineb -S0
|
|
|
|
|
foreground {
|
|
|
|
|
sed -i "0,/\\"127.0.0.1:24817\\"/s//\\"0.0.0.0:24817\\"/" /etc/services.d/pulpcore-api/run
|
|
|
|
|
GALAXY_HOST_NAME = 'galaxy-pulp'
|
|
|
|
|
SETTINGS = {
|
|
|
|
|
'PULP_CONTENT_ORIGIN': f'http://{GALAXY_HOST_NAME}',
|
|
|
|
|
'PULP_ANSIBLE_API_HOSTNAME': f'http://{GALAXY_HOST_NAME}',
|
|
|
|
|
'PULP_GALAXY_API_PATH_PREFIX': '/api/galaxy/',
|
|
|
|
|
# These paths are unique to the container image which has an nginx location for /pulp/content to route
|
|
|
|
|
# requests to the content backend
|
|
|
|
|
'PULP_ANSIBLE_CONTENT_HOSTNAME': f'http://{GALAXY_HOST_NAME}/pulp/content/api/galaxy/v3/artifacts/collections/',
|
|
|
|
|
'PULP_CONTENT_PATH_PREFIX': '/pulp/content/api/galaxy/v3/artifacts/collections/',
|
|
|
|
|
'PULP_GALAXY_AUTHENTICATION_CLASSES': [
|
|
|
|
|
'rest_framework.authentication.SessionAuthentication',
|
|
|
|
|
'rest_framework.authentication.TokenAuthentication',
|
|
|
|
|
'rest_framework.authentication.BasicAuthentication',
|
|
|
|
|
'django.contrib.auth.backends.ModelBackend',
|
|
|
|
|
],
|
|
|
|
|
# This should probably be false see https://issues.redhat.com/browse/AAH-2328
|
|
|
|
|
'PULP_GALAXY_REQUIRE_CONTENT_APPROVAL': 'true',
|
|
|
|
|
'PULP_GALAXY_DEPLOYMENT_MODE': 'standalone',
|
|
|
|
|
'PULP_GALAXY_AUTO_SIGN_COLLECTIONS': 'false',
|
|
|
|
|
'PULP_GALAXY_COLLECTION_SIGNING_SERVICE': 'ansible-default',
|
|
|
|
|
'PULP_RH_ENTITLEMENT_REQUIRED': 'insights',
|
|
|
|
|
'PULP_TOKEN_AUTH_DISABLED': 'false',
|
|
|
|
|
'PULP_TOKEN_SERVER': f'http://{GALAXY_HOST_NAME}/token/',
|
|
|
|
|
'PULP_TOKEN_SIGNATURE_ALGORITHM': 'ES256',
|
|
|
|
|
'PULP_PUBLIC_KEY_PATH': '/src/galaxy_ng/dev/common/container_auth_public_key.pem',
|
|
|
|
|
'PULP_PRIVATE_KEY_PATH': '/src/galaxy_ng/dev/common/container_auth_private_key.pem',
|
|
|
|
|
'PULP_ANALYTICS': 'false',
|
|
|
|
|
'PULP_GALAXY_ENABLE_UNAUTHENTICATED_COLLECTION_ACCESS': 'true',
|
|
|
|
|
'PULP_GALAXY_ENABLE_UNAUTHENTICATED_COLLECTION_DOWNLOAD': 'true',
|
|
|
|
|
'PULP_GALAXY_ENABLE_LEGACY_ROLES': 'true',
|
|
|
|
|
'PULP_GALAXY_FEATURE_FLAGS__execution_environments': 'false',
|
|
|
|
|
'PULP_SOCIAL_AUTH_LOGIN_REDIRECT_URL': '/',
|
|
|
|
|
'PULP_GALAXY_FEATURE_FLAGS__ai_deny_index': 'true',
|
|
|
|
|
'PULP_DEFAULT_ADMIN_PASSWORD': 'password'
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
# This sed calls changes the first occurrence to "allow" which is conveniently the delete operation for a namespace.
|
|
|
|
|
# https://github.com/ansible/galaxy_ng/blob/master/galaxy_ng/app/access_control/statements/standalone.py#L9-L11.
|
|
|
|
|
backtick NG_PREFIX { python -c "import galaxy_ng; print(galaxy_ng.__path__[0], end='')" }
|
|
|
|
|
importas ng_prefix NG_PREFIX
|
|
|
|
|
foreground {
|
|
|
|
|
sed -i "0,/\\"effect\\": \\"deny\\"/s//\\"effect\\": \\"allow\\"/" ${ng_prefix}/app/access_control/statements/standalone.py
|
|
|
|
|
}'''
|
|
|
|
|
|
|
|
|
|
GALAXY_IMPORTER = b'''
|
|
|
|
|
[galaxy-importer]
|
|
|
|
|
ansible_local_tmp=~/.ansible/tmp
|
|
|
|
|
ansible_test_local_image=false
|
|
|
|
|
check_required_tags=false
|
|
|
|
|
check_runtime_yaml=false
|
|
|
|
|
check_changelog=false
|
|
|
|
|
infra_osd=false
|
|
|
|
|
local_image_docker=false
|
|
|
|
|
log_level_main=INFO
|
|
|
|
|
require_v1_or_greater=false
|
|
|
|
|
run_ansible_doc=false
|
|
|
|
|
run_ansible_lint=false
|
|
|
|
|
run_ansible_test=false
|
|
|
|
|
run_flake8=false
|
|
|
|
|
'''.strip()
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class GalaxyProvider(CloudProvider):
|
|
|
|
|
@ -81,13 +96,9 @@ class GalaxyProvider(CloudProvider):
|
|
|
|
|
def __init__(self, args: IntegrationConfig) -> None:
|
|
|
|
|
super().__init__(args)
|
|
|
|
|
|
|
|
|
|
# Cannot use the latest container image as either galaxy_ng 4.2.0rc2 or pulp 0.5.0 has sporatic issues with
|
|
|
|
|
# dropping published collections in CI. Try running the tests multiple times when updating. Will also need to
|
|
|
|
|
# comment out the cache tests in 'test/integration/targets/ansible-galaxy-collection/tasks/install.yml' when
|
|
|
|
|
# the newer update is available.
|
|
|
|
|
self.pulp = os.environ.get(
|
|
|
|
|
self.image = os.environ.get(
|
|
|
|
|
'ANSIBLE_PULP_CONTAINER',
|
|
|
|
|
'quay.io/ansible/pulp-galaxy-ng:b79a7be64eff'
|
|
|
|
|
'quay.io/pulp/galaxy:4.7.1'
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
self.uses_docker = True
|
|
|
|
|
@ -96,46 +107,45 @@ class GalaxyProvider(CloudProvider):
|
|
|
|
|
"""Setup cloud resource before delegation and reg cleanup callback."""
|
|
|
|
|
super().setup()
|
|
|
|
|
|
|
|
|
|
galaxy_port = 80
|
|
|
|
|
pulp_port = 24817
|
|
|
|
|
|
|
|
|
|
ports = [
|
|
|
|
|
galaxy_port,
|
|
|
|
|
pulp_port,
|
|
|
|
|
]
|
|
|
|
|
|
|
|
|
|
# Create the container, don't run it, we need to inject configs before it starts
|
|
|
|
|
descriptor = run_support_container(
|
|
|
|
|
self.args,
|
|
|
|
|
self.platform,
|
|
|
|
|
self.pulp,
|
|
|
|
|
'galaxy-pulp',
|
|
|
|
|
ports,
|
|
|
|
|
start=False,
|
|
|
|
|
)
|
|
|
|
|
with tempfile.NamedTemporaryFile(mode='w+') as env_fd:
|
|
|
|
|
settings = '\n'.join(
|
|
|
|
|
f'{key}={value}' for key, value in SETTINGS.items()
|
|
|
|
|
)
|
|
|
|
|
env_fd.write(settings)
|
|
|
|
|
env_fd.flush()
|
|
|
|
|
display.info(f'>>> galaxy_ng Configuration\n{settings}', verbosity=3)
|
|
|
|
|
descriptor = run_support_container(
|
|
|
|
|
self.args,
|
|
|
|
|
self.platform,
|
|
|
|
|
self.image,
|
|
|
|
|
GALAXY_HOST_NAME,
|
|
|
|
|
[
|
|
|
|
|
80,
|
|
|
|
|
],
|
|
|
|
|
aliases=[
|
|
|
|
|
GALAXY_HOST_NAME,
|
|
|
|
|
],
|
|
|
|
|
start=True,
|
|
|
|
|
options=[
|
|
|
|
|
'--env-file', env_fd.name,
|
|
|
|
|
],
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
if not descriptor:
|
|
|
|
|
return
|
|
|
|
|
|
|
|
|
|
pulp_id = descriptor.container_id
|
|
|
|
|
|
|
|
|
|
injected_files = {
|
|
|
|
|
'/etc/pulp/settings.py': SETTINGS.format(host=descriptor.name).encode(),
|
|
|
|
|
'/etc/cont-init.d/111-postgres': SET_ADMIN_PASSWORD,
|
|
|
|
|
'/etc/cont-init.d/000-ansible-test-overrides': OVERRIDES,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
for path, content in injected_files.items():
|
|
|
|
|
injected_files = [
|
|
|
|
|
('/etc/galaxy-importer/galaxy-importer.cfg', GALAXY_IMPORTER, 'galaxy-importer'),
|
|
|
|
|
]
|
|
|
|
|
for path, content, friendly_name in injected_files:
|
|
|
|
|
with tempfile.NamedTemporaryFile() as temp_fd:
|
|
|
|
|
temp_fd.write(content)
|
|
|
|
|
temp_fd.flush()
|
|
|
|
|
docker_cp_to(self.args, pulp_id, temp_fd.name, path)
|
|
|
|
|
|
|
|
|
|
descriptor.start(self.args)
|
|
|
|
|
display.info(f'>>> {friendly_name} Configuration\n{to_text(content)}', verbosity=3)
|
|
|
|
|
docker_exec(self.args, descriptor.container_id, ['mkdir', '-p', os.path.dirname(path)], True)
|
|
|
|
|
docker_cp_to(self.args, descriptor.container_id, temp_fd.name, path)
|
|
|
|
|
|
|
|
|
|
self._set_cloud_config('PULP_HOST', descriptor.name)
|
|
|
|
|
self._set_cloud_config('PULP_PORT', str(pulp_port))
|
|
|
|
|
self._set_cloud_config('GALAXY_PORT', str(galaxy_port))
|
|
|
|
|
self._set_cloud_config('PULP_HOST', GALAXY_HOST_NAME)
|
|
|
|
|
self._set_cloud_config('PULP_USER', 'admin')
|
|
|
|
|
self._set_cloud_config('PULP_PASSWORD', 'password')
|
|
|
|
|
|
|
|
|
|
@ -148,21 +158,19 @@ class GalaxyEnvironment(CloudEnvironment):
|
|
|
|
|
pulp_user = str(self._get_cloud_config('PULP_USER'))
|
|
|
|
|
pulp_password = str(self._get_cloud_config('PULP_PASSWORD'))
|
|
|
|
|
pulp_host = self._get_cloud_config('PULP_HOST')
|
|
|
|
|
galaxy_port = self._get_cloud_config('GALAXY_PORT')
|
|
|
|
|
pulp_port = self._get_cloud_config('PULP_PORT')
|
|
|
|
|
|
|
|
|
|
return CloudEnvironmentConfig(
|
|
|
|
|
ansible_vars=dict(
|
|
|
|
|
pulp_user=pulp_user,
|
|
|
|
|
pulp_password=pulp_password,
|
|
|
|
|
pulp_api='http://%s:%s' % (pulp_host, pulp_port),
|
|
|
|
|
pulp_server='http://%s:%s/pulp_ansible/galaxy/' % (pulp_host, pulp_port),
|
|
|
|
|
galaxy_ng_server='http://%s:%s/api/galaxy/' % (pulp_host, galaxy_port),
|
|
|
|
|
pulp_api=f'http://{pulp_host}',
|
|
|
|
|
pulp_server=f'http://{pulp_host}/pulp_ansible/galaxy/',
|
|
|
|
|
galaxy_ng_server=f'http://{pulp_host}/api/galaxy/',
|
|
|
|
|
),
|
|
|
|
|
env_vars=dict(
|
|
|
|
|
PULP_USER=pulp_user,
|
|
|
|
|
PULP_PASSWORD=pulp_password,
|
|
|
|
|
PULP_SERVER='http://%s:%s/pulp_ansible/galaxy/api/' % (pulp_host, pulp_port),
|
|
|
|
|
GALAXY_NG_SERVER='http://%s:%s/api/galaxy/' % (pulp_host, galaxy_port),
|
|
|
|
|
PULP_SERVER=f'http://{pulp_host}/pulp_ansible/galaxy/api/',
|
|
|
|
|
GALAXY_NG_SERVER=f'http://{pulp_host}/api/galaxy/',
|
|
|
|
|
),
|
|
|
|
|
)
|
|
|
|
|
|
Matt Martz
1 year ago
committed by