smart_proxy_ansible_director 0.6.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8b4c354edd008b22c1a7c3bb81961c43c0159083c8605b06c04f7a1d85bd5c32
-  data.tar.gz: edf3d06edeef438c682173531b0ac2e29911803afc448c2bcca3f1f5b1517090
+  metadata.gz: ecd7bca9499c92013e47ab4de68b7172c2f1d0d37a89d4b6f5de7b5319bc0405
+  data.tar.gz: d389d6b6cad1752b5f80efe3cfd6ee6ac2c2a61a7f03231a0b86a44d015ae77d
 SHA512:
-  metadata.gz: 7522c49d2d8ff5aac7499681d8321d1fdbe6f879df564da7a1cf5a53d04a20dd8ceddb1a7817e4ff65fe5e704039c75f16072e1cf460bd7d30a2af28f370cbb4
-  data.tar.gz: e41d6d20ccf4729d5550b6909b7bf5f4151171f2999684712a87db978dd7c27a1f2f5621efbe14659a7d02647599a2e52a41c8c4798982ef98d25fcd283fcdd3
+  metadata.gz: 1497f6db7412a154f434f5be05be800e6fb1560b7be43df7013eb01b2682cfc244fc4889feaa0ee8b85cb78e0349da62321a70d5c80f553b1498d5883edfc747
+  data.tar.gz: 2176d249b9d1501b4618aef64d3a416b6a9fe21482122bafba8b5bd6a2406aff326ea45966d862560e5feb62ad5b2d6943a2fd035b50c9679e5c27d4517a9d66

data/lib/smart_proxy_ansible_director/actions/meta/build_push_ee.rb

@@ -3,58 +3,54 @@
 require_relative '../build_execution_environment'
 require_relative '../push_execution_environment'
 require_relative '../../helpers/execution_environment_helpers'
+require_relative '../../runners/ansible_builder_runner'
+require_relative '../../runners/podman_push_runner'
+require_relative '../../runners/meta_runner'
 
 module Proxy
   module AnsibleDirector
     module Actions
       module Meta
         class BuildPushEe < ::Proxy::Dynflow::Action::Runner
-          #           "action_input": {
-          #             "execution_environment": {
-          #               "id": 1,
-          #               "content": {
-          #                 "base_image": "registry.fedoraproject.org/fedora:42",
-          #                 "ansible_core_version": "",
-          #                 "content_units": [
-          #                   {
-          #                     "type": "collection",
-          #                     "identifier": "nextcloud.admin",
-          #                     "version": "2.0.0",
-          #                     "source": "https://galaxy.ansible.com"
-          #                   }
-          #                 ]
-          #               }
-          #             }
-          #           }
-          def plan(args)
-            execution_environment_definition = args['execution_environment']
+          RUNNER_PHASES = [
+            { id: :build_ee, title: 'Building Execution Environment',
+              runner_class: ::Proxy::AnsibleDirector::Runners::AnsibleBuilderRunner,
+              runner_input_key: :build_ee_input },
+            { id: :push_ee, title: 'Pushing Execution Environment',
+              runner_class: ::Proxy::AnsibleDirector::Runners::PodmanPushRunner,
+              runner_input_key: :push_ee_input }
+          ].freeze
+
+          def initiate_runner
+            execution_environment_definition = input['execution_environment']
+            push_url = input['push_url']
 
             ee_id = execution_environment_definition['id']
             execution_environment_content = execution_environment_definition['content']
 
             ee_base_image = execution_environment_content['base_image']
-            ee_base_image_tag = 'latest'
+            ee_base_image_tag = push_url
             ee_ansible_core_version = execution_environment_content['ansible_core_version']
             ee_formatted_content = ::Proxy::AnsibleDirector::Helpers::ExecutionEnvironmentHelpers.format_content(
               execution_environment_content['content_units']
             )
 
-            sequence do
-              plan_action ::Proxy::AnsibleDirector::Actions::BuildExecutionEnvironment, {
-                ee_id: ee_id,
-                ee_base_image_url: ee_base_image,
-                ee_built_image_tag: ee_base_image_tag,
-                ee_ansible_core_version: ee_ansible_core_version,
-                ee_formatted_content: ee_formatted_content,
-                is_base_image: true
+            ::Proxy::AnsibleDirector::Runners::MetaRunner.new(
+              RUNNER_PHASES,
+              {
+                build_ee_input: {
+                  ee_id: ee_id,
+                  ee_base_image_url: ee_base_image,
+                  ee_built_image_tag: ee_base_image_tag,
+                  ee_ansible_core_version: ee_ansible_core_version,
+                  ee_formatted_content: ee_formatted_content,
+                  is_base_image: true
+                },
+                push_ee_input: {
+                  push_url: push_url
+                }
               }
-              # COMPAT 3.16 - 3
-              # Registry authorization has not been finalized.
-              # Further, granular capability usage is difficult with the current execution stack.
-              # plan_action ::Proxy::AnsibleDirector::Actions::PushExecutionEnvironment, {
-              #  ee_id: ee_id
-              # }
-            end
+            )
           end
         end
       end

data/lib/smart_proxy_ansible_director/actions/meta/run_ansible_script.rb

@@ -21,7 +21,7 @@ module Proxy
                 mode: 'literal',
                 inventory: inventory,
                 playbook: script,
-                execution_environment: "#{execution_environment.split('/')[-1]}:latest"
+                execution_environment: execution_environment
               }
               plan_action ::Proxy::Dynflow::Callback::Action,
                           args[:callback],

data/lib/smart_proxy_ansible_director/actions/meta/run_playbook.rb

@@ -3,35 +3,46 @@
 require_relative '../build_execution_environment'
 require_relative '../push_execution_environment'
 require_relative '../../helpers/execution_environment_helpers'
+require_relative '../../runners/ansible_builder_runner'
+require_relative '../../runners/ansible_navigator_runner'
 require_relative '../../runners/meta_runner'
-require 'smart_proxy_dynflow/callback'
 
 module Proxy
   module AnsibleDirector
     module Actions
       module Meta
         class RunPlaybook < ::Proxy::Dynflow::Action::Runner
+          RUNNER_PHASES = [
+            { id: :build_ee, title: 'Building Execution Environment',
+              runner_class: ::Proxy::AnsibleDirector::Runners::AnsibleBuilderRunner,
+              runner_input_key: :build_ee_input },
+            { id: :run_ansible, title: 'Running Ansible',
+              runner_class: ::Proxy::AnsibleDirector::Runners::AnsibleNavigatorRunner,
+              runner_input_key: :run_ansible_input }
+          ].freeze
+
           def initiate_runner
             execution_environment = input['execution_environment']
 
-            ee_id = execution_environment['id']
-            ee_registry_url = execution_environment['registry_url']
+            ee_pull_url = execution_environment['pull_url']
             ee_ansible_core_version = execution_environment['ansible_core_version']
 
+            ee_run_image_tag = ee_pull_url.sub("latest",
+                                               @caller_execution_plan_id)
 
             inventory = input['inventory']
             playbook = input['playbook']
-            variables = input['variables'].to_hash
+            variable_files = input['variable_files'].to_hash
             content = ::Proxy::AnsibleDirector::Helpers::ExecutionEnvironmentHelpers.format_content(
               input['content']
             )
 
             ::Proxy::AnsibleDirector::Runners::MetaRunner.new(
+              RUNNER_PHASES,
               {
                 build_ee_input: {
-                  ee_id: ee_id,
-                  ee_base_image_url: ee_registry_url,
-                  ee_built_image_tag: @caller_execution_plan_id,
+                  ee_base_image_url: ee_pull_url,
+                  ee_built_image_tag: ee_run_image_tag,
                   ee_ansible_core_version: ee_ansible_core_version,
                   ee_formatted_content: content,
                   is_base_image: false
@@ -39,9 +50,8 @@ module Proxy
                 run_ansible_input: {
                   inventory: inventory,
                   playbook: playbook,
-                  variables: variables,
-                  execution_environment: ee_registry_url.sub("latest",
-                                                             @caller_execution_plan_id)
+                  variable_files: variable_files,
+                  execution_environment: ee_run_image_tag
                 }
               }
             )

data/lib/smart_proxy_ansible_director/plugin.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative 'version'
+require 'fileutils'
 
 module Proxy
   module AnsibleDirector
@@ -9,8 +10,9 @@ module Proxy
       rackup_path File.expand_path('http_config.ru', __dir__)
 
       default_settings(
-        ansible_navigator_run_dir: "/usr/share/foreman-proxy/.ansible_director/run",
-        execution_env_build_dir: "/usr/share/foreman-proxy/.ansible_director/execution_env",
+        workdir_root: "/usr/share/foreman-proxy/.ansible_director",
+        ansible_navigator_run_dir: "run",
+        execution_env_build_dir: "execution_env",
         remove_workdirs: true
       )
 
@@ -21,7 +23,43 @@ module Proxy
         require 'smart_proxy_ansible_director/runners'
       end
 
-      load_dependency_injection_wirings do |_container_instance, _settings|
+      after_activation do
+        FileUtils.mkdir_p(
+          Proxy::AnsibleDirector::Plugin.settings[:workdir_root]
+        )
+
+        [
+          Proxy::AnsibleDirector::Plugin.settings[:ansible_navigator_run_dir],
+          Proxy::AnsibleDirector::Plugin.settings[:execution_env_build_dir],
+          "certs"
+        ].each do |dir|
+          FileUtils.mkdir_p(
+            File.join(
+              Proxy::AnsibleDirector::Plugin.settings[:workdir_root],
+              dir
+            )
+          )
+        end
+
+        # This symlinks the foreman client certs to the new directory, as the certificates have to adhere to a specific
+        # naming scheme.
+        # See: https://man.archlinux.org/man/containers-certs.d.5.en#Directory_Structure
+        FileUtils.ln_sf(Proxy::SETTINGS.foreman_ssl_cert, File.join(
+                                                            Proxy::AnsibleDirector::Plugin.settings[:workdir_root],
+                                                            "certs",
+                                                            "client.cert"
+                                                          ))
+        FileUtils.ln_sf(Proxy::SETTINGS.foreman_ssl_ca, File.join(
+                                                          Proxy::AnsibleDirector::Plugin.settings[:workdir_root],
+                                                          "certs",
+                                                          "ca.crt"
+                                                        ))
+        FileUtils.ln_sf(Proxy::SETTINGS.foreman_ssl_key, File.join(
+                                                           Proxy::AnsibleDirector::Plugin.settings[:workdir_root],
+                                                           "certs",
+                                                           "client.key"
+                                                         ))
+
         Proxy::Dynflow::TaskLauncherRegistry.register('ansible-builder',
                                                       ::Proxy::AnsibleDirector::Launchers::AnsibleBuilderLauncher)
         Proxy::Dynflow::TaskLauncherRegistry.register('ansible-navigator',

data/lib/smart_proxy_ansible_director/runners/ansible_builder_runner.rb

@@ -18,8 +18,6 @@ module Proxy
         #   ee_formatted_content: ee_formatted_content
         # }
         def initialize(ansible_builder_input, suspended_action: nil)
-          # ID of the execution environment definition; supplied by Foreman
-          @ee_id = ansible_builder_input[:ee_id]
           # TAGGED registry URL of the base image; supplied by Foreman
           @ee_base_image_url = ansible_builder_input[:ee_base_image_url]
           # Tag used at the end of building for this image
@@ -28,12 +26,19 @@ module Proxy
           @ee_formatted_content = ansible_builder_input[:ee_formatted_content]
           @is_base_image = ansible_builder_input[:is_base_image]
 
-          workdir_base = Proxy::AnsibleDirector::Plugin.settings[:execution_env_build_dir]
+          workdir_base = File.join(
+            Proxy::AnsibleDirector::Plugin.settings[:workdir_root],
+            Proxy::AnsibleDirector::Plugin.settings[:execution_env_build_dir]
+          )
           @runner_workdir = Dir.mktmpdir('execution_env', workdir_base)
           super suspended_action: suspended_action
         end
 
         def start
+          cert_dir = File.join(
+            Proxy::AnsibleDirector::Plugin.settings[:workdir_root],
+            'certs'
+          )
           ee_content = @ee_formatted_content.to_hash
           ee_content.transform_values! do |value|
               value.map do |cuv|
@@ -82,12 +87,7 @@ module Proxy
                   {
                     'prepend_base' => [
                       'ENV ANSIBLE_CALLBACK_WHITELIST=theforeman.foreman.foreman',
-                      'ENV ANSIBLE_CALLBACKS_ENABLED=theforeman.foreman.foreman',
-                      "ENV FOREMAN_URL=#{Proxy::SETTINGS.foreman_url}",
-                      'ENV FOREMAN_SSL_CERT=/run/secrets/foreman_ssl_cert',
-                      'ENV FOREMAN_SSL_KEY=/run/secrets/foreman_ssl_key',
-                      'ENV FOREMAN_SSL_VERIFY=/run/secrets/foreman_ssl_verify'
-
+                      'ENV ANSIBLE_CALLBACKS_ENABLED=theforeman.foreman.foreman'
                     ]
                   }
                 end
@@ -107,14 +107,14 @@ module Proxy
           # COMPAT 3.16 - 2
           # --extra-build-cli-args is not supported in ansible-builder 3.0.0
           # Verbosity is chosen by passing -v {0, 1, 2, 3}
-
           cmd = <<~CMD
             echo "Running in #{@runner_workdir}"
 
             cat <<EOF > "#{@runner_workdir}/execution-environment.yml"
             #{YAML.dump(ee_definition, indentation: 2)}
             EOF
-            ansible-builder build --tag ansible_director/#{@ee_id}:#{@ee_built_image_tag} -v 3 --file #{@runner_workdir}/execution-environment.yml #{build_args_str} --context #{@runner_workdir}
+            ansible-builder create --verbosity 3 --file #{@runner_workdir}/execution-environment.yml --context #{@runner_workdir}
+            podman build --cert-dir #{cert_dir} --tag #{@ee_built_image_tag} --log-level=info --tag #{@ee_built_image_tag} #{build_args_str} #{@runner_workdir}
           CMD
 
           initialize_command('bash', '-c', cmd)

data/lib/smart_proxy_ansible_director/runners/ansible_navigator_runner.rb

@@ -17,14 +17,17 @@ module Proxy
           @inventory = ::Proxy::AnsibleDirector::Helpers::AnsibleNavigatorHelpers.reserialize_inventory(ansible_input[:inventory])
           if ansible_input[:mode] == 'literal'
             @playbook = ansible_input[:playbook]
-            @variables = {}
+            @variable_files = {}
           else
             @playbook = ::Proxy::AnsibleDirector::Helpers::AnsibleNavigatorHelpers.reserialize_playbook(ansible_input[:playbook])
-            @variables = ansible_input[:variables]
+            @variable_files = ansible_input[:variable_files]
           end
           @execution_environment = ansible_input[:execution_environment]
 
-          workdir_base = Proxy::AnsibleDirector::Plugin.settings[:ansible_navigator_run_dir]
+          workdir_base = File.join(
+            Proxy::AnsibleDirector::Plugin.settings[:workdir_root],
+            Proxy::AnsibleDirector::Plugin.settings[:ansible_navigator_run_dir]
+          )
           @runner_workdir = Dir.mktmpdir('navigator', workdir_base)
         end
 
@@ -32,6 +35,12 @@ module Proxy
           # TODO: Find a way to request the auth token programmatically
           proxy_ssh_key_path = ::Proxy::RemoteExecution::Ssh::Plugin.settings[:ssh_identity_key_file]
           proxy_ssh_key_mount_path = "/runner/.ssh/#{File.basename(proxy_ssh_key_path)}"
+
+          foreman_certs_path = '/secrets/foreman/certs'
+          foreman_ssl_cert_mount_path = "#{foreman_certs_path}/#{File.basename(Proxy::SETTINGS.foreman_ssl_cert)}"
+          foreman_ssl_key_mount_path = "#{foreman_certs_path}/#{File.basename(Proxy::SETTINGS.foreman_ssl_key)}"
+          foreman_ssl_ca_mount_path = "#{foreman_certs_path}/#{File.basename(Proxy::SETTINGS.foreman_ssl_ca)}"
+
           cmd = <<~CMD
             echo "Running in #{@runner_workdir}"
 
@@ -46,8 +55,8 @@ module Proxy
             mkdir #{@runner_workdir}/vars
 
             #{
-              @variables.map do |role_name, variables|
-                %(cat > "#{@runner_workdir}/vars/#{role_name}_vars.yaml" <<'EOF'\n#{format_variables role_name, variables}EOF)
+              @variable_files.map do |file_name, file_content64|
+                %(cat > "#{@runner_workdir}/vars/#{file_name}" <<'EOF'\n#{Base64.decode64(file_content64)}EOF)
               end.join("\n\n")
             }
 
@@ -70,14 +79,20 @@ module Proxy
                     - "--authfile=$AUTHFILE"
                   policy: missing
                 volume-mounts:
-                  - src: #{File.join(Dir.pwd, Proxy::SETTINGS.foreman_ssl_cert)}
-                    dest: /run/secrets/foreman_ssl_cert
-                  - src: #{File.join(Dir.pwd, Proxy::SETTINGS.foreman_ssl_key)}
-                    dest: /run/secrets/foreman_ssl_key
-                  - src: #{File.join(Dir.pwd, Proxy::SETTINGS.foreman_ssl_ca)}
-                    dest: /run/secrets/foreman_ssl_verify
+                  - src: #{Proxy::SETTINGS.foreman_ssl_cert}
+                    dest: #{foreman_ssl_cert_mount_path}
+                  - src: #{Proxy::SETTINGS.foreman_ssl_key}
+                    dest: #{foreman_ssl_key_mount_path}
+                  - src: #{Proxy::SETTINGS.foreman_ssl_ca}
+                    dest: #{foreman_ssl_ca_mount_path}
                   - src: #{proxy_ssh_key_path}
                     dest: #{proxy_ssh_key_mount_path}
+                environment-variables:
+                  set:
+                    FOREMAN_URL: #{Proxy::SETTINGS.foreman_url}
+                    FOREMAN_SSL_CERT: #{foreman_ssl_cert_mount_path}
+                    FOREMAN_SSL_KEY: #{foreman_ssl_key_mount_path}
+                    FOREMAN_SSL_VERIFY: #{foreman_ssl_ca_mount_path}
               logging:
                 level: debug
                 file: #{@runner_workdir}/ansible-navigator.log
@@ -104,22 +119,6 @@ module Proxy
           remove_workdirs = Proxy::AnsibleDirector::Plugin.settings[:remove_workdirs]
           FileUtils.rm_rf @runner_workdir if remove_workdirs
         end
-
-        private
-
-        def format_variables(_role_name, variables)
-          formatted = {}
-          variables.each do |k, v|
-            formatted_v = begin
-              YAML.safe_load v
-            rescue Exception
-              v
-            end
-            formatted[k] = formatted_v
-          end
-
-          formatted.to_h.to_yaml
-        end
       end
     end
   end

data/lib/smart_proxy_ansible_director/runners/meta_runner.rb

@@ -6,15 +6,12 @@ module Proxy
   module AnsibleDirector
     module Runners
       class MetaRunner < ::Proxy::Dynflow::Runner::Base
-        PHASES = [
-          { id: :build_ee, title: 'Building execution environment', runner_class: AnsibleBuilderRunner,
-            runner_input_key: :build_ee_input },
-          { id: :run_ansible, title: 'Running Ansible', runner_class: AnsibleNavigatorRunner,
-            runner_input_key: :run_ansible_input }
-        ].freeze
-
-        def initialize(input, suspended_action: nil)
+        CYAN = "\e[36m"
+        RESET = "\e[0m"
+
+        def initialize(phases, input, suspended_action: nil)
           super(suspended_action: suspended_action)
+          @phases = phases
           @input = input
           @phase_index = 0
           @current_runner = nil
@@ -52,14 +49,14 @@ module Proxy
         private
 
         def transition_to_phase(index)
-          phase_info = PHASES[index]
+          phase_info = @phases[index]
 
           @phase_index = index
           runner_class = phase_info[:runner_class]
           runner_input = @input[phase_info[:runner_input_key]]
 
           @continuous_output.add_output(
-            "START: Phase #{phase_info[:id]} (#{index + 1} / #{PHASES.length}): #{phase_info[:title]}\n"
+            "#{CYAN}START: Phase #{phase_info[:id]} (#{index + 1} / #{@phases.length}): #{phase_info[:title]}#{RESET}\n"
           )
 
           @current_runner = runner_class.new(runner_input, suspended_action: @suspended_action)
@@ -67,12 +64,12 @@ module Proxy
         end
 
         def transition_to_next_phase
-          phase_info = PHASES[@phase_index]
+          phase_info = @phases[@phase_index]
           @continuous_output.add_output(
-            "END: Phase #{phase_info[:id]}: #{phase_info[:title]}\n"
+            "#{CYAN}END: Phase #{phase_info[:id]}: #{phase_info[:title]}#{RESET}\n"
           )
 
-          if @phase_index + 1 < PHASES.length
+          if @phase_index + 1 < @phases.length
             @phase_index += 1
             transition_to_phase(@phase_index)
           else

data/lib/smart_proxy_ansible_director/runners/podman_pull_runner.rb

@@ -15,8 +15,12 @@ module Proxy
         end
 
         def start
+          cert_dir = File.join(
+            Proxy::AnsibleDirector::Plugin.settings[:workdir_root],
+            'certs'
+          )
           cmd = <<~CMD
-            podman pull --tls-verify=false #{@ee_registry_url}
+            podman pull --cert-dir #{cert_dir} #{@ee_registry_url}
           CMD
           initialize_command('bash', '-c', cmd)
         end

data/lib/smart_proxy_ansible_director/runners/podman_push_runner.rb

@@ -9,20 +9,20 @@ module Proxy
       class PodmanPushRunner < ::Proxy::Dynflow::Runner::Base
         include ::Proxy::Dynflow::Runner::ProcessManagerCommand
 
+        attr_reader :continuous_output, :exit_status
+
         def initialize(podman_push_input, suspended_action: nil)
           super suspended_action: suspended_action
-          puts podman_push_input
-          @ee_id = podman_push_input[:ee_id]
+          @push_url = podman_push_input[:push_url]
         end
 
         def start
-          # TODO: Parametrize
-
-          image_name = "ansible_director/#{@ee_id}:latest"
-          registry = 'centos9-katello-devel-stable.example.com:4321'
-
+          cert_dir = File.join(
+            Proxy::AnsibleDirector::Plugin.settings[:workdir_root],
+            'certs'
+          )
           cmd = <<~CMD
-            podman push --tls-verify=false #{image_name} #{registry}/#{image_name}
+            podman push --cert-dir #{cert_dir} #{@push_url}
           CMD
           initialize_command('bash', '-c', cmd)
         end

data/lib/smart_proxy_ansible_director/version.rb

@@ -2,6 +2,6 @@
 
 module Proxy
   module AnsibleDirector
-    VERSION = '0.6.0'
+    VERSION = '0.7.0'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: smart_proxy_ansible_director
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.7.0
 platform: ruby
 authors:
 - ATIX AG
@@ -149,7 +149,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Smart Proxy plugin to integrate Ansible Director with Foreman
 test_files: []