foreman_rh_cloud 14.4.0 → 14.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '03458c064241e69e2f5384094f124fd0911a9bb2b08a0e299581c8d5c22ef5da'
-  data.tar.gz: 4a14089d8e6410a5389473824d6206637370a34c552dcd178fe843b2eea3307c
+  metadata.gz: 6c5686d5268a4028cc883b95daa1948748a56a41cb54495668a4170cd1fcaab9
+  data.tar.gz: 533e44e09c87944392c120d57cc34e9244fbe3cf176dddb6c8d7ab7334ce4f92
 SHA512:
-  metadata.gz: c5daadeadfe2543a242aea723e832b4fcc5f7ac31a598fc05f34792e1c58042ec993718e07b96bff3841b35f366438b8ed7e52166fe94ea118f635f9caadfa16
-  data.tar.gz: c6008984ca0d88a5bcc51a1d6fd288e031b51238a0c561fcdb414cc967b7814750a529c5f5c0916866401dd922b71efd9fc20ad0b927fb2faec36ee21d5ae859
+  metadata.gz: ca9d76abf073cb2f31f74822d45c40d18f6f735f2d6251d67c3ebae1bec9d26c33fe6c9098e8bb6f1b21f922003eaecbfe0da7249111e28ea4cd0f04e0d25138
+  data.tar.gz: cbe8078e2ef86cde32ad7feef2c0dd19850de71cefec7aa61939d71605d749e0ad18225492c160b5f5d57ba15bea691f0af0a5978e5300979e4858bc959b0e72

data/app/controllers/api/v2/rh_cloud/cloud_request_controller.rb

@@ -3,6 +3,7 @@ module Api::V2::RhCloud
     include ForemanRhCloud::IopSmartProxyAccess
     layout false
 
+    before_action :set_admin_user, only: [:update]
     before_action :require_non_iop_smart_proxy, only: [:update]
 
     KNOWN_DIRECTIVES = {

data/app/controllers/api/v2/rh_cloud/inventory_controller.rb

@@ -7,7 +7,7 @@ module Api
         include InventoryUpload::TaskActions
         include ForemanRhCloud::IopSmartProxyAccess
 
-        before_action :require_non_iop_smart_proxy, only: [:enable_cloud_connector]
+        before_action :require_non_iop_smart_proxy, only: [:announce_to_sources]
 
         api :GET, "/organizations/:organization_id/rh_cloud/report", N_("Download latest report")
         param :organization_id, Integer, required: true, desc: N_("Set the current organization context for the request")
@@ -70,10 +70,16 @@ module Api
           render json: { message: error.message }, status: :bad_request
         end
 
-        api :POST, "/rh_cloud/enable_connector", N_("Enable cloud connector")
-        def enable_cloud_connector
-          cloud_connector = ForemanRhCloud::CloudConnector.new
-          render json: cloud_connector.install.to_json
+        api :POST, "/rh_cloud/announce_to_sources", N_("Schedule a task to register in Red Hat Sources for cloud connector")
+        param :instance_id, String, required: true, desc: N_("RHC instance ID to register with Red Hat Sources")
+        def announce_to_sources
+          Setting[:rhc_instance_id] = params[:instance_id]
+
+          task = ForemanTasks.async_task(InsightsCloud::Async::CloudConnectorAnnounceTask, true)
+
+          render json: {
+            task: task,
+          }, status: :accepted
         end
       end
     end

data/app/controllers/foreman_inventory_upload/accounts_controller.rb

@@ -29,7 +29,6 @@ module ForemanInventoryUpload
 
       render json: {
         accounts: accounts,
-        CloudConnectorStatus: ForemanInventoryUpload::UploadsSettingsController.cloud_connector_status,
       }, status: :ok
     end
 

data/app/controllers/foreman_inventory_upload/uploads_controller.rb

@@ -1,22 +1,11 @@
 module ForemanInventoryUpload
   class UploadsController < ::ApplicationController
     include InventoryUpload::ReportActions
-    include ForemanRhCloud::IopSmartProxyAccess
-
-    before_action :require_non_iop_smart_proxy, only: [:enable_cloud_connector]
 
     def download_file
       filename, file = report_file(params[:organization_id])
 
       send_file file, disposition: 'attachment', filename: filename
     end
-
-    def enable_cloud_connector
-      # Set the autoupload to true, since it's required by the feature.
-      Setting[:allow_auto_inventory_upload] = true
-
-      cloud_connector = ForemanRhCloud::CloudConnector.new
-      render json: cloud_connector.install.to_json
-    end
   end
 end

data/app/controllers/foreman_inventory_upload/uploads_settings_controller.rb

@@ -9,7 +9,6 @@ module ForemanInventoryUpload
         ipsObfuscationEnabled: Setting[:obfuscate_inventory_ips],
         excludePackagesEnabled: Setting[:exclude_installed_packages],
         allowAutoInsightsMismatchDelete: Setting[:allow_auto_insights_mismatch_delete],
-        CloudConnectorStatus: ForemanInventoryUpload::UploadsSettingsController.cloud_connector_status,
         lastSyncTask: last_successful_inventory_sync_task,
       }, status: :ok
     end
@@ -19,13 +18,6 @@ module ForemanInventoryUpload
       index
     end
 
-    def self.cloud_connector_status
-      cloud_connector = ForemanRhCloud::CloudConnector.new
-      job = cloud_connector&.latest_job
-      return nil unless job
-      { id: job.id, task: ForemanTasks::Task.where(:id => job.task_id).first }
-    end
-
     def last_successful_inventory_sync_task
       task = ForemanTasks::Task.where(label: 'InventorySync::Async::InventoryFullSync', result: 'success')
                         .reorder('ended_at desc').first

data/app/services/foreman_rh_cloud/cert_auth.rb

@@ -11,8 +11,9 @@ module ForemanRhCloud
 
     def execute_cloud_request(params)
       organization = params.delete(:organization)
+      force_cloud = params[:force_cloud]
       # Cache the value of with_iop_smart_proxy? to avoid multiple calls to the database
-      with_iop_smart_proxy = ForemanRhCloud.with_iop_smart_proxy?
+      with_iop_smart_proxy = ForemanRhCloud.with_iop_smart_proxy? && !force_cloud
       certs = with_iop_smart_proxy ? foreman_certificate : candlepin_id_cert(organization)
       default_params = {
         ssl_client_cert: OpenSSL::X509::Certificate.new(certs[:cert]),

data/app/services/foreman_rh_cloud/cloud_presence.rb

@@ -74,6 +74,9 @@ module ForemanRhCloud
 
     def register_rhc_instance
       raise Foreman::Exception.new('rhc_instance_id is empty, cannot register RHC to the cloud') if Setting[:rhc_instance_id].empty?
+
+      return :already_registered if rhc_connection_exists?
+
       source_id = satellite_instance_source || create_satellite_instance_source
 
       create_response = JSON.parse(
@@ -95,6 +98,22 @@ module ForemanRhCloud
       @satellite_instance_source = create_response['id']
     end
 
+    def rhc_connection_exists?
+      response = JSON.parse(
+        execute_cloud_request(
+          method: :get,
+          url: rhc_connection_url,
+          headers: {
+            content_type: :json,
+          },
+          ssl_client_cert: OpenSSL::X509::Certificate.new(certs[:cert]),
+          ssl_client_key: OpenSSL::PKey.read(certs[:key])
+        )
+      )
+
+      response['data']&.any?
+    end
+
     private
 
     def sources_url(path)
@@ -113,6 +132,10 @@ module ForemanRhCloud
       sources_url('/sources')
     end
 
+    def rhc_connection_url
+      sources_url("/rhc_connections?filter[rhc_id]=#{Setting[:rhc_instance_id]}")
+    end
+
     def create_rhc_connections_url
       sources_url('/rhc_connections')
     end

data/app/services/foreman_rh_cloud/cloud_request.rb

@@ -3,12 +3,13 @@ module ForemanRhCloud
     extend ActiveSupport::Concern
 
     def execute_cloud_request(params)
+      force_cloud = params.delete(:force_cloud)
       final_params = {
         verify_ssl: ForemanRhCloud.verify_ssl_method,
         proxy: ForemanRhCloud.transformed_http_proxy_string,
       }.deep_merge(params)
 
-      if ForemanRhCloud.with_iop_smart_proxy?
+      if ForemanRhCloud.with_iop_smart_proxy? && !force_cloud
         final_params[:ssl_ca_file] ||= ForemanRhCloud.ca_cert
       end
 

data/app/services/foreman_rh_cloud/cloud_request_forwarder.rb

@@ -36,8 +36,9 @@ module ForemanRhCloud
       }
       requested_url = original_request.original_fullpath.end_with?('/') ? original_request.path + '/' : original_request.path
       params = path_params(requested_url)
+      force_cloud = params[:force_cloud]
 
-      if ForemanRhCloud.with_iop_smart_proxy?
+      if ForemanRhCloud.with_iop_smart_proxy? && !force_cloud
         params[:ssl_ca_file] = ForemanRhCloud.ca_cert
       end
 
@@ -70,10 +71,13 @@ module ForemanRhCloud
 
     def path_params(request_path)
       case request_path
-      when lightspeed?
+      when lightspeed_cla?
+        force_cloud = ForemanRhCloud.with_iop_smart_proxy? && Setting[:force_cla_connection]
         {
-          url: ForemanRhCloud.cert_base_url + request_path,
-        }
+          url: ForemanRhCloud.cloud_cert_base_url + request_path,
+          force_cloud: force_cloud,
+          proxy: (force_cloud ? ForemanRhCloud.transformed_cloud_http_proxy_string : nil),
+        }.compact
       when platform_request?
         {
           url: ForemanRhCloud.cert_base_url + request_path.sub('/redhat_access/r/insights/platform', '/api'),
@@ -104,7 +108,7 @@ module ForemanRhCloud
       "for=\"_#{host.subscription_facet.uuid}\""
     end
 
-    def lightspeed?
+    def lightspeed_cla?
       ->(request_path) { request_path.include? '/lightspeed' }
     end
 

data/config/routes.rb

@@ -7,8 +7,6 @@ Rails.application.routes.draw do
     get 'settings', to: 'uploads_settings#index'
     post 'setting', to: 'uploads_settings#set_advanced_setting'
 
-    post 'cloud_connector', to: 'uploads#enable_cloud_connector'
-
     resources :tasks, only: [:create, :show]
 
     get 'status', to: 'cloud_status#index'
@@ -72,7 +70,7 @@ Rails.application.routes.draw do
       end
 
       namespace 'rh_cloud' do
-        post 'enable_connector', to: 'inventory#enable_cloud_connector'
+        post 'announce_to_sources', to: 'inventory#announce_to_sources'
         post 'cloud_request', to: 'cloud_request#update'
         get 'advisor_engine_config', to: 'advisor_engine_config#show'
 

data/lib/foreman_rh_cloud/engine.rb

@@ -61,6 +61,7 @@ module ForemanRhCloud
           ForemanRhCloud::Engine.register_scheduled_task(InventorySync::Async::InventoryScheduledSync, '0 0 * * *')
           ForemanRhCloud::Engine.register_scheduled_task(InsightsCloud::Async::InsightsScheduledSync, '0 0 * * *')
           ForemanRhCloud::Engine.register_scheduled_task(InsightsCloud::Async::InsightsClientStatusAging, '0 0 * * *')
+          ForemanRhCloud::Engine.register_scheduled_task(InsightsCloud::Async::CloudConnectorAnnounceTask, '0 0 * * *')
         end
       end
     rescue ActiveRecord::NoDatabaseError
@@ -80,12 +81,6 @@ module ForemanRhCloud
         host_action_button: false,
         provided_inputs: ['playbook_url', 'report_url', 'correlation_id', 'report_interval']
       )
-      RemoteExecutionFeature.register(
-        :ansible_configure_cloud_connector,
-        N_('Configure Cloud Connector on given hosts'),
-        :description => N_('Configure Cloud Connector on given hosts'),
-        :proxy_selector_override => ::RemoteExecutionProxySelector::INTERNAL_PROXY
-      )
     end
 
     # Ideally this code belongs to an initializer. The problem is that Katello controllers are not initialized completely until after the end of the to_prepare blocks

data/lib/foreman_rh_cloud/plugin.rb

@@ -22,6 +22,7 @@ module ForemanRhCloud
             setting('include_parameter_tags', type: :boolean, description: N_('Should import include parameter tags from Foreman? Ignored when using local Insights.'), default: false, full_name: N_('Include parameters in insights-client reports'))
             setting('rhc_instance_id', type: :string, description: N_('RHC daemon id. Ignored when using local Insights.'), default: nil, full_name: N_('ID of the RHC(Yggdrasil) daemon'))
             setting('insights_minimal_data_collection', type: :boolean, default: false, full_name: N_('Minimal data collection'), description: N_('Only include the minimum required data in inventory reports for uploading to Red Hat cloud. When this is true, installed packages are excluded from the report regardless of the exclude_installed_packages setting, and host names and IPv4 addresses are excluded from the report regardless of obfuscation settings. Ignored when using local Insights.'))
+            setting('force_cla_connection', type: :boolean, default: false, full_name: N_('Force RHEL Lightspeed CLA connection'), description: N_('Forward requests to Lightspeed CLA even when in IoP mode. Ignored when IoP mode is off.'))
           end
         end
 
@@ -31,8 +32,7 @@ module ForemanRhCloud
             :generate_foreman_rh_cloud,
             'foreman_inventory_upload/reports': [:generate],
             'foreman_inventory_upload/tasks': [:create],
-            'api/v2/rh_cloud/inventory': [:get_hosts, :remove_hosts, :sync_inventory_status, :download_file, :generate_report, :enable_cloud_connector],
-            'foreman_inventory_upload/uploads': [:enable_cloud_connector],
+            'api/v2/rh_cloud/inventory': [:get_hosts, :remove_hosts, :sync_inventory_status, :download_file, :generate_report, :announce_to_sources],
             'foreman_inventory_upload/uploads_settings': [:set_advanced_setting],
             'foreman_inventory_upload/missing_hosts': [:remove_hosts],
             'insights_cloud/settings': [:update],
@@ -123,6 +123,8 @@ module ForemanRhCloud
         role 'ForemanRhCloud Read Only', read_only_permissions, 'Role granting read-only permissions to view
                                                                  Insights Compliance, Vulnerability, Advisor, and host inventory'
 
+        role 'Cloud Connector', [:dispatch_cloud_requests], 'Role granting permission to dispatch cloud connector requests'
+
         add_permissions_to_default_roles Role::ORG_ADMIN => plugin_permissions,
           Role::MANAGER => plugin_permissions,
           Role::SYSTEM_ADMIN => plugin_permissions

data/lib/foreman_rh_cloud/version.rb

@@ -1,3 +1,3 @@
 module ForemanRhCloud
-  VERSION = '14.4.0'.freeze
+  VERSION = '14.6.0'.freeze
 end

data/lib/foreman_rh_cloud.rb

@@ -21,6 +21,14 @@ module ForemanRhCloud
     env_or_on_premise_url('SATELLITE_CERT_RH_CLOUD_URL') || 'https://cert.cloud.redhat.com'
   end
 
+  # Lightspeed/CLA is cloud-only. Use the cloud URL only when the admin
+  # enables force_cla_connection; otherwise follow cert_base_url (IoP when IoP is on).
+  def self.cloud_cert_base_url
+    return cert_base_url unless Setting[:force_cla_connection]
+
+    ENV['SATELLITE_CERT_RH_CLOUD_URL'] || 'https://cert.cloud.redhat.com'
+  end
+
   def self.legacy_insights_url
     env_or_on_premise_url('SATELLITE_LEGACY_INSIGHTS_URL') || 'https://cert-api.access.redhat.com'
   end
@@ -48,11 +56,19 @@ module ForemanRhCloud
   def self.proxy_string
     return '' if ForemanRhCloud.with_iop_smart_proxy?
 
+    cloud_proxy_string
+  end
+
+  def self.cloud_proxy_string
     HttpProxy.default_global_content_proxy&.full_url ||
     ForemanRhCloud.global_foreman_proxy ||
     ''
   end
 
+  def self.transformed_cloud_http_proxy_string
+    transform_scheme(fix_port(cloud_proxy_string))
+  end
+
   def self.fix_port(uri_string)
     return '' if uri_string.empty?
 

data/lib/insights_cloud/async/cloud_connector_announce_task.rb

@@ -1,39 +1,96 @@
 module InsightsCloud
   module Async
     class CloudConnectorAnnounceTask < ::Actions::EntryAction
-      def self.subscribe
-        Actions::RemoteExecution::RunHostsJob
-      end
+      include ::Actions::RecurringAction
+      include ::ForemanRhCloud::CertAuth
+      include ForemanInventoryUpload::Async::DelayedStart
 
-      def self.connector_feature_id
-        @connector_feature_id ||= RemoteExecutionFeature.feature!(ForemanRhCloud::CloudConnector::CLOUD_CONNECTOR_FEATURE).id
-      end
+      def plan(immediate = false)
+        if ForemanRhCloud.with_iop_smart_proxy?
+          logger.debug('Sources announcement skipped: running in IoP mode')
+          return
+        end
 
-      def plan(job_invocation)
-        return unless connector_playbook_job?(job_invocation)
+        if Setting[:rhc_instance_id].blank?
+          logger.debug('Sources announcement skipped: rhc_instance_id is not set')
+          return
+        end
 
-        plan_self
+        unless Setting[:allow_auto_inventory_upload]
+          logger.debug(
+            'Cloud connector is configured (rhc_instance_id is set) but automatic inventory upload is disabled. ' \
+            'Enable the "Automatic inventory upload" setting for full cloud connector functionality.'
+          )
+        end
+
+        if immediate
+          plan_self
+        else
+          after_delay do
+            plan_self
+          end
+        end
       end
 
-      def finalize
+      def run
+        registered = []
+        confirmed_by_remediation = []
+        already_registered = []
+        skipped = []
+        failed = {}
+
         Organization.unscoped.each do |org|
+          unless cert_auth_available?(org)
+            skipped << org.name
+            next
+          end
+
+          if recent_cloud_remediation?(org)
+            confirmed_by_remediation << org.name
+            next
+          end
+
           presence = ForemanRhCloud::CloudPresence.new(org, logger)
-          presence.announce_to_sources
+          result = presence.announce_to_sources
+          if result == :already_registered
+            already_registered << org.name
+          else
+            registered << org.name
+          end
         rescue StandardError => ex
-          logger.warn(ex)
+          logger.warn("Failed to announce to Sources for organization #{org.name}: #{ex}")
+          logger.debug { ex.backtrace.join("\n") }
+          failed[org.name] = ex.message
         end
-      end
 
-      def rescue_strategy_for_self
-        Dynflow::Action::Rescue::Skip
+        parts = []
+        parts << "Registered: #{registered.join(', ')}" if registered.any?
+        parts << "Already registered: #{already_registered.join(', ')}" if already_registered.any?
+        parts << "Already registered (recent cloud remediation): #{confirmed_by_remediation.join(', ')}" if confirmed_by_remediation.any?
+        parts << "Skipped (no manifest): #{skipped.join(', ')}" if skipped.any?
+        if failed.any?
+          failed_details = failed.map { |name, msg| "#{name}: #{msg}" }.join('; ')
+          parts << "Failed: #{failed_details}"
+        end
+        output[:status] = parts.join('. ')
+
+        error!("Sources announcement failed for: #{failed.keys.join(', ')}") if failed.any?
       end
 
-      def connector_playbook_job?(job_invocation)
-        job_invocation&.remote_execution_feature_id == connector_feature_id
+      def recent_cloud_remediation?(org)
+        feature = RemoteExecutionFeature.find_by(label: 'rh_cloud_connector_run_playbook')
+        return false unless feature
+
+        JobInvocation.where(remote_execution_feature_id: feature.id)
+                     .joins(:task)
+                     .joins(targeting: :hosts)
+                     .where(hosts: { organization_id: org.id })
+                     .where('foreman_tasks_tasks.started_at > ?', 24.hours.ago)
+                     .exists?
       end
 
-      def connector_feature_id
-        self.class.connector_feature_id
+      def rescue_strategy_for_self
+        Dynflow::Action::Rescue::Skip
       end
 
       def logger

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "foreman_rh_cloud",
-  "version": "14.4.0",
+  "version": "14.6.0",
   "description": "Inventory Upload =============",
   "main": "index.js",
   "scripts": {

data/test/controllers/inventory_upload/api/inventory_controller_test.rb

@@ -35,20 +35,22 @@ module InventoryUpload::Api
       assert_equal test_task.id.to_s, actual_task['id']
     end
 
-    test 'Starts cloud connector configuration job' do
-      test_job = FactoryBot.create(:job_invocation)
+    test 'Triggers Sources announcement task' do
+      test_task = FactoryBot.create(:some_task)
 
-      ForemanRhCloud::CloudConnector.any_instance
-        .expects(:install)
-        .returns(test_job)
+      ForemanTasks.expects(:async_task)
+        .with(InsightsCloud::Async::CloudConnectorAnnounceTask, true)
+        .returns(test_task)
 
-      post :enable_cloud_connector
+      post :announce_to_sources, params: { instance_id: 'test-instance-id' }
 
       assert_response :success
 
-      actual_job = @response.parsed_body
+      assert_equal 'test-instance-id', Setting[:rhc_instance_id]
 
-      assert_equal test_job.id, actual_job['id']
+      actual_task = @response.parsed_body['task']
+      assert_not_nil actual_task
+      assert_equal test_task.id.to_s, actual_task['id']
     end
   end
 end