foreman_rh_cloud 2.0.15 → 3.0.17

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f471a3f5124bd751cc9059d2eb0a4b25df07fc234928f1ec2c3f30a980bd0709
-  data.tar.gz: 5080948b90534cc195661776fcfa71de4caa23e9589dfda3cbb9326927033766
+  metadata.gz: de4c573e51011ac6fd99707859fa86d659454b7f30183494ab5e240e773bec0a
+  data.tar.gz: f0510f09adf430834e01b9732a9cf6faedff0b18471e7b90fbca8a47fe867a13
 SHA512:
-  metadata.gz: 24dd90a5e2f290c6d898b75840ba923f26e7ff95f1c6e99ef4f836c68874fc567bb02457b05d94b6136ec0723f4b72804c975a9aa32f3b06c8a717d1cd0ba593
-  data.tar.gz: 8e74afc6e8d07b6505adbf268a0cc1705c3544ee87e369cd66806338671e585879500528485a3ed60f103c6d3394bdcaa99c65dae95add382b0d766d294438d7
+  metadata.gz: a5ef31993d25982136027082f9fb3d382133378627afd0f5da6eeb5eb24a971aa36cdb7f8995347b017ab438124219113e6b326a52f1821e0ccbdb0a6e402f52
+  data.tar.gz: e5da37635a059fadc6e6c62464aec98f75e803fddb1f8b1ca9b23ad27e42cffdb006bdd4ae5e59d10317d8599f6629ff8f4e08065a15947aff7f93133ec49e8a

data/app/controllers/concerns/insights_cloud/candlepin_cache.rb

@@ -0,0 +1,28 @@
+module InsightsCloud
+  module CandlepinCache
+    extend ActiveSupport::Concern
+
+    def upstream_owner(org)
+      # We use a cache because owner_details is a call to Candlepin
+      Rails.cache.fetch("rh_cloud_upstream_owner_#{org.id}", expires_in: 1.minute) do
+        org.owner_details['upstreamConsumer']
+      end
+    end
+
+    def cp_owner_id(org)
+      owner = upstream_owner(org)
+      owner['uuid'] if owner
+    end
+
+    def candlepin_id_cert(org)
+      owner = upstream_owner(org)
+      return unless owner
+      id_cert = {
+        cert: owner.dig('idCert', 'cert'),
+        key: owner.dig('idCert', 'key'),
+      }
+      return unless id_cert.values.all?
+      id_cert
+    end
+  end
+end

data/app/controllers/concerns/insights_cloud/client_authentication.rb

@@ -0,0 +1,23 @@
+module InsightsCloud
+  module ClientAuthentication
+    extend ActiveSupport::Concern
+
+    include ::Katello::Authentication::ClientAuthentication
+
+    def authorize
+      client_authorized? || super
+    end
+
+    def client_authorized?
+      authenticate_client && valid_machine_user?
+    end
+
+    def valid_machine_user?
+      subscribed_host_by_uuid(User.current.uuid).present?
+    end
+
+    def subscribed_host_by_uuid(uuid)
+      @host = Host.unscoped.joins(:subscription_facet).where(:katello_subscription_facets => {:uuid => uuid }).first
+    end
+  end
+end

data/app/controllers/foreman_inventory_upload/accounts_controller.rb

@@ -24,14 +24,22 @@ module ForemanInventoryUpload
         autoUploadEnabled: Setting[:allow_auto_inventory_upload],
         hostObfuscationEnabled: Setting[:obfuscate_inventory_hostnames],
         ipsObfuscationEnabled: Setting[:obfuscate_inventory_ips],
-        cloudToken: Setting[:rh_cloud_token],
+        cloudToken: !Setting[:rh_cloud_token].empty?,
         excludePackages: Setting[:exclude_installed_packages],
         accounts: accounts,
+        CloudConnectorStatus: cloud_connector_status,
       }, status: :ok
     end
 
     private
 
+    def cloud_connector_status
+      cloud_connector = ForemanRhCloud::CloudConnector.new
+      job = cloud_connector&.latest_job
+      return nil unless job
+      { id: job.id, task: ForemanTasks::Task.where(:id => job.task_id).first }
+    end
+
     def status_for(label, job_class)
       label = job_class.output_label(label)
       ForemanInventoryUpload::Async::ProgressOutput.get(label)&.status

data/app/controllers/foreman_inventory_upload/uploads_controller.rb

@@ -14,14 +14,12 @@ module ForemanInventoryUpload
       files = Dir["{#{ForemanInventoryUpload.uploads_file_path(filename)},#{ForemanInventoryUpload.done_file_path(filename)}}"]
 
       return send_file files.first, disposition: 'attachment', filename: filename unless files.empty?
-      throw_flash_error "File doesn't exist"
+      raise ::Foreman::Exception.new("The report file doesn't exist")
     end
 
-    def throw_flash_error(message)
-      process_error(
-        :redirect => foreman_inventory_upload_index_path,
-        :error_msg => message
-      )
+    def enable_cloud_connector
+      cloud_connector = ForemanRhCloud::CloudConnector.new
+      render json: cloud_connector.install.to_json
     end
 
     def auto_upload

data/app/controllers/insights_cloud/api/machine_telemetries_controller.rb

@@ -0,0 +1,73 @@
+module InsightsCloud::Api
+  class MachineTelemetriesController < ::Api::V2::BaseController
+    layout false
+
+    include ::InsightsCloud::ClientAuthentication
+    include ::InsightsCloud::CandlepinCache
+
+    before_action :cert_uuid, :ensure_org, :ensure_branch_id, :only => [:forward_request, :branch_info]
+    before_action :ensure_telemetry_enabled_for_consumer, :only => [:forward_request]
+
+    skip_after_action :log_response_body, :only => [:forward_request]
+    skip_before_action :check_media_type, :only => [:forward_request]
+
+    # The method that "proxies" requests over to Cloud
+    def forward_request
+      certs = candlepin_id_cert @organization
+      cloud_response = ::ForemanRhCloud::CloudRequestForwarder.new.forward_request(request, controller_name, @branch_id, certs)
+
+      if cloud_response.code == 401
+        return render json: {
+          :message => 'Authentication to the Insights Service failed.',
+          :headers => {},
+        }, status: :bad_gateway
+      end
+
+      if cloud_response.headers[:content_disposition]
+        return send_data cloud_response, disposition: cloud_response.headers[:content_disposition], type: cloud_response.headers[:content_type]
+      end
+
+      assign_header(response, cloud_response, :x_resource_count, true)
+      assign_header(response, cloud_response, :x_rh_insights_request_id, false)
+
+      render json: cloud_response, status: cloud_response.code
+    end
+
+    def branch_info
+      render :json => ForemanRhCloud::BranchInfo.new.generate(@uuid, @host, @branch_id, request.host).to_json
+    end
+
+    def assign_header(res, cloud_res, header, transform)
+      header_content = cloud_res.headers[header]
+      return unless header_content
+      new_header = transform ? header.to_s.tr('_', '-') : header.to_s
+      res.headers[new_header] = header_content
+    end
+
+    private
+
+    def ensure_telemetry_enabled_for_consumer
+      render_message 'Telemetry is not enabled for your organization', :status => 403 unless telemetry_config
+    end
+
+    def telemetry_config
+      ::RedhatAccess::TelemetryConfiguration.find_or_create_by(:organization_id => @organization.id) do |conf|
+        conf.enable_telemetry = true
+      end
+    end
+
+    def cert_uuid
+      @uuid ||= User.current.login
+    end
+
+    def ensure_org
+      @organization = @host.organization
+      return render_message 'Organization not found or invalid', :status => 400 unless @organization
+    end
+
+    def ensure_branch_id
+      @branch_id = cp_owner_id(@organization)
+      return render_message "Branch ID not found for organization #{@organization.title}", :status => 400 unless @branch_id
+    end
+  end
+end

data/app/controllers/insights_cloud/hits_controller.rb

@@ -1,6 +1,18 @@
 module InsightsCloud
   class HitsController < ::ApplicationController
+    include Foreman::Controller::AutoCompleteSearch
+
     def index
+      hits = resource_base_search_and_page.preload(:host, :rule)
+
+      render json: {
+        hasToken: !Setting[:rh_cloud_token].empty?,
+        hits: hits.map { |hit| hit.attributes.merge(hostname: hit.host&.name, has_playbook: hit.has_playbook?) },
+        itemCount: hits.count,
+      }, status: :ok
+    end
+
+    def show
       host = Host.where(id: host_id_param).first
 
       render json: {
@@ -8,6 +20,18 @@ module InsightsCloud
       }, status: :ok
     end
 
+    def model_of_controller
+      ::InsightsHit
+    end
+
+    def resource_class
+      ::InsightsHit
+    end
+
+    def controller_permission
+      :insights_hits
+    end
+
     private
 
     def host_id_param

data/app/controllers/insights_cloud/settings_controller.rb

@@ -9,6 +9,14 @@ module InsightsCloud
       render_setting(:insightsSyncEnabled, :allow_auto_insights_sync)
     end
 
+    def save_token_and_sync
+      token = Setting::RhCloud.find_by_name("rh_cloud_token")
+      token.value = params.require(:value)
+      token.save!
+      InsightsCloud::Async::InsightsFullSync.perform_now
+      redirect_to(:controller => "hits", :action => 'index')
+    end
+
     private
 
     def render_setting(node_name, setting)

data/app/controllers/insights_cloud/tasks_controller.rb

@@ -1,7 +1,12 @@
 module InsightsCloud
   class TasksController < ::ApplicationController
     def create
-      InsightsCloud::Async::InsightsFullSync.perform_now
+      job = InsightsCloud::Async::InsightsFullSync.perform_later
+      task = ForemanTasks::Task.find_by(external_id: job.provider_job_id)
+
+      render json: {
+        task: task,
+      }, status: :ok
     end
   end
 end

data/app/helpers/foreman_inventory_upload_host_helper.rb

@@ -6,14 +6,7 @@ module ForemanInventoryUploadHostHelper
   def hits_counts_cell(host)
     host_hits = hits_counts[host.id]
     tag.td class: ['hidden-xs', 'ellipsis', 'text-center'] do
-      if host_hits
-        link_to(
-          host_hits,
-          InsightsCloud::WebUi.system_url(InsightsCloud::WebUi::ADVISOR, host.insights.uuid),
-          :rel => 'external noopener noreferrer',
-          :target => '_blank'
-        )
-      end
+      link_to(host_hits, "#{host_path(host)}#insights") if host_hits
     end
   end
 end

data/app/models/insights_hit.rb

@@ -1,6 +1,25 @@
 class InsightsHit < ApplicationRecord
-  has_one :host
+  include ::Authorizable
+  belongs_to :host
   # since the facet is one-to-one association with a host, we can connect
   # through host_id column on both this model and facet.
   belongs_to :insights_facet, foreign_key: 'host_id', primary_key: 'host_id', counter_cache: :hits_count
+
+  has_one :rule, class_name: 'InsightsRule', foreign_key: 'rule_id', primary_key: 'rule_id'
+
+  scope :with_playbook, -> { joins(:rule) }
+
+  scoped_search on: :title, complete_value: true
+  scoped_search on: :total_risk, complete_value: true
+  scoped_search on: :rule_id, complete_value: true, only_explicit: true
+  scoped_search relation: :host, on: :name, rename: :hostname, complete_value: true
+  scoped_search on: :rule_id, rename: :with_playbook, only_explicit: true, complete_value: false, ext_method: :find_with_playbook
+
+  def self.find_with_playbook(key, operator, value)
+    { joins: :rule }
+  end
+
+  def has_playbook?
+    !rule.nil?
+  end
 end

data/app/models/insights_resolution.rb

@@ -0,0 +1,3 @@
+class InsightsResolution < ApplicationRecord
+  belongs_to :rule, class_name: 'InsightsRule', foreign_key: 'rule_id', primary_key: 'rule_id', inverse_of: :resolutions
+end

data/app/models/insights_rule.rb

@@ -0,0 +1,3 @@
+class InsightsRule < ApplicationRecord
+  has_many :resolutions, class_name: 'InsightsResolution', dependent: :destroy, foreign_key: 'rule_id', primary_key: 'rule_id', inverse_of: :rule
+end

data/app/models/setting/rh_cloud.rb

@@ -1,14 +1,26 @@
 class Setting::RhCloud < Setting
+  ::Setting::BLANK_ATTRS.concat %w{rh_cloud_token}
+
+  def self.load_defaults
+    return false unless table_exists?
+    transaction do
+      # If the user had auto_upload default setting, we will not surprise him, and force the value to false
+      # for new users, the default will be set to true and the value will remain nil
+      Setting.where(name: 'allow_auto_inventory_upload', value: nil).where("settings.default LIKE '%false%'").update_all(value: "--- false\n...")
+      super
+    end
+  end
+
   def self.default_settings
     return unless ActiveRecord::Base.connection.table_exists?('settings')
-    return unless super
     [
-      set('allow_auto_inventory_upload', N_('Allow automatic upload of the host inventory to the Red Hat cloud'), false, N_('Allow automatic inventory uploads')),
+      set('allow_auto_inventory_upload', N_('Allow automatic upload of the host inventory to the Red Hat cloud'), true, N_('Allow automatic inventory uploads')),
       set('allow_auto_insights_sync', N_('Allow recommendations synchronization from Red Hat cloud'), false, N_('Allow recommendations synchronization')),
       set('obfuscate_inventory_hostnames', N_('Obfuscate host names sent to Red Hat cloud'), false, N_('Obfuscate host names')),
       set('obfuscate_inventory_ips', N_('Obfuscate ip addresses sent to Red Hat cloud'), false, N_('Obfuscate IPs')),
-      set('rh_cloud_token', N_('Authentication token to Red Hat cloud services. Used to authenticate requests to cloud APIs'), 'DEFAULT', N_('Red Hat Cloud token'), nil, encrypted: true),
+      set('rh_cloud_token', N_('Authentication token to Red Hat cloud services. Used to authenticate requests to cloud APIs'), nil, N_('Red Hat Cloud token'), nil, encrypted: true),
       set('exclude_installed_packages', N_('Exclude installed packages from Red Hat cloud inventory report'), false, N_("Don't upload installed packages")),
+      set('include_parameter_tags', N_('Should import include parameter tags from Foreman?'), false, N_('Include parameters in insights-client reports')),
     ]
   end
 

data/app/overrides/layouts/base/styles.html.erb.deface

@@ -0,0 +1,2 @@
+<!-- insert_top 'head' -->
+<%= css_tags_for([:foreman_rh_cloud]).first %>

data/app/services/foreman_rh_cloud/branch_info.rb

@@ -0,0 +1,57 @@
+module ForemanRhCloud
+  class BranchInfo
+    def generate(uuid, host, branch_id, request_hostname)
+      {
+        :remote_leaf => uuid,
+        :remote_branch => branch_id,
+        :display_name => host.organization.name,
+        :hostname => request_hostname,
+        :product => {
+          :type => core_app_name,
+          :major_version => core_app_version.major,
+          :minor_version => core_app_version.minor,
+        },
+        :organization_id => host.organization.id,
+        :satellite_instance_id => Foreman.instance_id,
+        :labels => host_labels(host),
+      }
+    end
+
+    def core_app_name
+      'Foreman'
+    end
+
+    def core_app_version
+      Foreman::Version.new
+    end
+
+    def new_label(key, value, namespace)
+      {
+        :namespace => namespace,
+        :key => key,
+        :value => value,
+      }
+    end
+
+    def labels_from_items(items, label_namespace, label_lamb, label_value_method = :to_s)
+      items.map { |item| new_label(label_lamb.call(item), item.public_send(label_value_method), label_namespace) }
+    end
+
+    def host_labels(host)
+      labels = [new_label('Organization', host.organization.name, 'Satellite')]
+      labels += labels_from_items(host.location.title.split('/'), 'Satellite', ->(item) { 'Location' }) if host.location
+      labels += labels_from_items(host.hostgroup.title.split('/'), 'Satellite', ->(item) { 'Host Group' }) if host.hostgroup
+      labels += labels_from_items(host.host_collections, 'Satellite', ->(item) { 'Host Collection' }, :name)
+
+      if Setting[:include_parameter_tags]
+        labels += labels_from_items(
+          host.host_inherited_params_objects,
+          'SatelliteParameter',
+          ->(item) { item.name },
+          :value)
+      end
+
+      labels
+    end
+  end
+end

data/app/services/foreman_rh_cloud/cloud_connector.rb

@@ -0,0 +1,60 @@
+require 'securerandom'
+
+module ForemanRhCloud
+  class CloudConnector
+    CLOUD_CONNECTOR_USER = 'cloud_connector_user'.freeze
+    CLOUD_CONNECTOR_TOKEN_NAME = 'Cloud connector access token'.freeze
+    CLOUD_CONNECTOR_FEATURE = 'ansible_configure_cloud_connector'.freeze
+
+    def install
+      user = service_user
+      token_value = personal_access_token(user)
+
+      composer = ::JobInvocationComposer.for_feature(
+        CLOUD_CONNECTOR_FEATURE,
+        [foreman_host.id],
+        {:satellite_user => service_user.login, :satellite_password => token_value}
+      )
+      composer.trigger!
+      composer.job_invocation
+    end
+
+    def latest_job
+      feature_id = RemoteExecutionFeature.find_by_label(CLOUD_CONNECTOR_FEATURE)&.id
+      return nil unless feature_id
+      JobInvocation.where(:remote_execution_feature_id => feature_id).includes(:task).reorder('foreman_tasks_tasks.started_at DESC').first
+    end
+
+    def personal_access_token(user)
+      access_token = PersonalAccessToken.find_by_name(CLOUD_CONNECTOR_TOKEN_NAME)
+
+      access_token&.destroy! # destroy the old token if exists
+
+      personal_access_token = PersonalAccessToken.new(:name => CLOUD_CONNECTOR_TOKEN_NAME, :user => user)
+      token_value = personal_access_token.generate_token
+      personal_access_token.save!
+
+      token_value
+    end
+
+    def service_user
+      user = User.find_by_login(CLOUD_CONNECTOR_USER)
+
+      if user.nil?
+        user = User.create!(
+          :login => CLOUD_CONNECTOR_USER,
+          :password => SecureRandom.base64(255),
+          :description => "This is a service user used by cloud connector to talk to the Satellite API",
+          :auth_source => AuthSourceInternal.first,
+          :admin => true
+        )
+      end
+
+      user
+    end
+
+    def foreman_host
+      ::Host.friendly.find(::SmartProxy.default_capsule.name)
+    end
+  end
+end