openshift-update-proxy 1.2.0__tar.gz → 1.4.5__tar.gz

{openshift_update_proxy-1.2.0 → openshift_update_proxy-1.4.5}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: openshift-update-proxy
-Version: 1.2.0
-Summary: Forwarding proxy for OpenShift update resources (Cincinnati API, mirror, release signatures)
+Version: 1.4.5
+Summary: Forwarding proxy for OpenShift update resources (update graph, mirror, release signatures, operator catalog, lifecycle API)
 Author-email: Simon Lauger <simon@lauger.de>
 License-Expression: Apache-2.0
 Project-URL: Repository, https://github.com/slauger/openshift-update-proxy
-Keywords: openshift,cincinnati,update-graph,proxy,disconnected,air-gapped
+Keywords: openshift,cincinnati,update-graph,proxy,disconnected,air-gapped,olm,renovate
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Web Environment
 Classifier: Framework :: Flask
@@ -47,8 +47,8 @@ central egress proxy (or a single host with internet access) exists.
   (`/api/upgrades_info/v1/graph`) to `api.openshift.com`
 - 📦 **Mirror Proxy** - forwards requests for clients and release artifacts to
   `mirror.openshift.com/pub`
-- 🔏 **Signature Store** - serves release image signatures for
-  `ClusterVersion.spec.signatureStores` (OpenShift 4.14+)
+- 🔏 **Signature Store** - forwards release image signature requests to the
+  public signature store on `mirror.openshift.com`
 - 🗺️ **ConfigMap Generator** - renders ready-to-apply signature ConfigMaps for the
   classic disconnected verification workflow
 - 🎛️ **Operator Catalog API** - serves operator channels and versions from the
@@ -61,6 +61,8 @@ central egress proxy (or a single host with internet access) exists.
   Cosign signed
 - ⛵ **Helm Chart** - deploy to Kubernetes/OpenShift with probes and sane security defaults
 - 🩺 **Health Endpoint** - `/healthz` for liveness and readiness probes
+- 🪵 **Request Logging** - logs source, method, path and status for every
+  request (health probes excluded)
 
 ## How it works
 
@@ -159,6 +161,9 @@ pip install openshift-update-proxy
 openshift-update-proxy
 ```
 
+For running as a service on a plain Linux host, see the systemd unit example in
+[examples/update-proxy.service](examples/update-proxy.service).
+
 ## Cluster integration
 
 ### Update graph
@@ -189,7 +194,11 @@ curl -s "http://update-proxy.example.com:5000/configmaps/4.16.8" | oc apply -f -
 
 The optional `arch` (default `amd64`) and `channel_prefix` (default `stable`) query
 parameters select the architecture and the update channel used for the lookup, e.g.
-`/configmaps/4.16.8?arch=arm64`.
+`/configmaps/4.16.8?arch=arm64`. Version lookups name the ConfigMap
+`release-signature-<version>-<arch>` - the signed digest differs per
+architecture, so the name has to carry it. Digest lookups use
+`signature-sha256-<digest prefix>` (first 16 characters) as neither version nor
+architecture are known there.
 
 Alternatively, a release digest can be passed directly:
 
@@ -289,9 +298,12 @@ The optional `channel_prefix` (default `stable`, e.g. `eus`, `fast`, `candidate`
 lifecycle API is available under `/lifecycle/`, e.g.
 `/lifecycle/products?name=OpenShift Container Platform`.
 
-[examples/create-configmaps.sh](examples/create-configmaps.sh) combines this with
-the `/configmaps/` endpoint: it fetches the release signatures for a set of update
-channels through the proxy and applies them as ConfigMaps.
+[examples/create-configmaps/](examples/create-configmaps/) combines this with the
+`/configmaps/` endpoint: it fetches the release signatures for a set of update
+channels through the proxy and writes one manifest per release
+(`manifests/release-signature-<version>-<arch>.yaml`), ready to be committed to a GitOps
+repository. The directory also contains a scheduled GitHub Actions workflow that
+keeps the manifests up to date.
 
 ## Local Development
 

{openshift_update_proxy-1.2.0 → openshift_update_proxy-1.4.5}/README.md

@@ -16,8 +16,8 @@ central egress proxy (or a single host with internet access) exists.
   (`/api/upgrades_info/v1/graph`) to `api.openshift.com`
 - 📦 **Mirror Proxy** - forwards requests for clients and release artifacts to
   `mirror.openshift.com/pub`
-- 🔏 **Signature Store** - serves release image signatures for
-  `ClusterVersion.spec.signatureStores` (OpenShift 4.14+)
+- 🔏 **Signature Store** - forwards release image signature requests to the
+  public signature store on `mirror.openshift.com`
 - 🗺️ **ConfigMap Generator** - renders ready-to-apply signature ConfigMaps for the
   classic disconnected verification workflow
 - 🎛️ **Operator Catalog API** - serves operator channels and versions from the
@@ -30,6 +30,8 @@ central egress proxy (or a single host with internet access) exists.
   Cosign signed
 - ⛵ **Helm Chart** - deploy to Kubernetes/OpenShift with probes and sane security defaults
 - 🩺 **Health Endpoint** - `/healthz` for liveness and readiness probes
+- 🪵 **Request Logging** - logs source, method, path and status for every
+  request (health probes excluded)
 
 ## How it works
 
@@ -128,6 +130,9 @@ pip install openshift-update-proxy
 openshift-update-proxy
 ```
 
+For running as a service on a plain Linux host, see the systemd unit example in
+[examples/update-proxy.service](examples/update-proxy.service).
+
 ## Cluster integration
 
 ### Update graph
@@ -158,7 +163,11 @@ curl -s "http://update-proxy.example.com:5000/configmaps/4.16.8" | oc apply -f -
 
 The optional `arch` (default `amd64`) and `channel_prefix` (default `stable`) query
 parameters select the architecture and the update channel used for the lookup, e.g.
-`/configmaps/4.16.8?arch=arm64`.
+`/configmaps/4.16.8?arch=arm64`. Version lookups name the ConfigMap
+`release-signature-<version>-<arch>` - the signed digest differs per
+architecture, so the name has to carry it. Digest lookups use
+`signature-sha256-<digest prefix>` (first 16 characters) as neither version nor
+architecture are known there.
 
 Alternatively, a release digest can be passed directly:
 
@@ -258,9 +267,12 @@ The optional `channel_prefix` (default `stable`, e.g. `eus`, `fast`, `candidate`
 lifecycle API is available under `/lifecycle/`, e.g.
 `/lifecycle/products?name=OpenShift Container Platform`.
 
-[examples/create-configmaps.sh](examples/create-configmaps.sh) combines this with
-the `/configmaps/` endpoint: it fetches the release signatures for a set of update
-channels through the proxy and applies them as ConfigMaps.
+[examples/create-configmaps/](examples/create-configmaps/) combines this with the
+`/configmaps/` endpoint: it fetches the release signatures for a set of update
+channels through the proxy and writes one manifest per release
+(`manifests/release-signature-<version>-<arch>.yaml`), ready to be committed to a GitOps
+repository. The directory also contains a scheduled GitHub Actions workflow that
+keeps the manifests up to date.
 
 ## Local Development
 

{openshift_update_proxy-1.2.0 → openshift_update_proxy-1.4.5}/pyproject.toml

@@ -4,15 +4,15 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "openshift-update-proxy"
-version = "1.2.0"
-description = "Forwarding proxy for OpenShift update resources (Cincinnati API, mirror, release signatures)"
+version = "1.4.5"
+description = "Forwarding proxy for OpenShift update resources (update graph, mirror, release signatures, operator catalog, lifecycle API)"
 readme = "README.md"
 license = "Apache-2.0"
 requires-python = ">=3.14"
 authors = [
     {name = "Simon Lauger", email = "simon@lauger.de"},
 ]
-keywords = ["openshift", "cincinnati", "update-graph", "proxy", "disconnected", "air-gapped"]
+keywords = ["openshift", "cincinnati", "update-graph", "proxy", "disconnected", "air-gapped", "olm", "renovate"]
 classifiers = [
     "Development Status :: 4 - Beta",
     "Environment :: Web Environment",

{openshift_update_proxy-1.2.0 → openshift_update_proxy-1.4.5}/src/openshift_update_proxy/__init__.py

@@ -1,3 +1,3 @@
 """OpenShift update proxy for disconnected environments."""
 
-__version__ = "1.2.0"
+__version__ = "1.4.5"

{openshift_update_proxy-1.2.0 → openshift_update_proxy-1.4.5}/src/openshift_update_proxy/app.py

@@ -5,6 +5,7 @@ import logging
 import re
 
 import requests
+import urllib3
 from flask import Flask, Response, jsonify, request
 
 from openshift_update_proxy import __version__, catalog, graph, lifecycle
@@ -34,7 +35,7 @@ VERSION_PATTERN = re.compile(r"^(?P<major>\d+)\.(?P<minor>\d+)\.\d+[A-Za-z0-9.+-
 CONFIGMAP_TEMPLATE = """apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: signature-sha256-{short_digest}
+  name: {name}
   namespace: openshift-config-managed
   labels:
     release.openshift.io/verification-signatures: ""
@@ -46,6 +47,23 @@ def create_app(config: Config | None = None) -> Flask:
     app = Flask(__name__)
     app.config["proxy"] = config or Config()
 
+    # the insecure request warning would be emitted on every upstream call;
+    # skipping verification is an explicit opt-in, so silence it
+    if not app.config["proxy"].ssl_verify:
+        urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+
+    @app.after_request
+    def log_request(response: Response) -> Response:
+        if request.path != "/healthz":
+            logger.info(
+                '%s "%s %s" %s',
+                request.remote_addr,
+                request.method,
+                request.full_path if request.query_string else request.path,
+                response.status_code,
+            )
+        return response
+
     @app.route("/")
     def index() -> Response:
         return jsonify(
@@ -190,6 +208,7 @@ def create_app(config: Config | None = None) -> Flask:
         digest_match = DIGEST_PATTERN.match(ref)
         version_match = VERSION_PATTERN.match(ref)
 
+        name = None
         if digest_match:
             digest = digest_match.group("digest")
         elif version_match:
@@ -200,6 +219,10 @@ def create_app(config: Config | None = None) -> Flask:
             if error:
                 return error
 
+            # the signed digest differs per architecture, so the name has to
+            # carry it - the version alone would collide across architectures
+            name = f"release-signature-{ref}-{arch}"
+
             channel = (
                 f"{channel_prefix}-{version_match.group('major')}.{version_match.group('minor')}"
             )
@@ -228,7 +251,9 @@ def create_app(config: Config | None = None) -> Flask:
         if not signatures:
             return Response("no signatures found for digest\n", status=404, mimetype="text/plain")
 
-        return Response(_render_configmap(digest, signatures), mimetype="application/yaml")
+        return Response(
+            _render_configmap(digest, signatures, name=name), mimetype="application/yaml"
+        )
 
     return app
 
@@ -290,10 +315,13 @@ def _fetch_signatures(cfg: Config, digest: str, limit: int = 10) -> list[bytes]:
     return signatures
 
 
-def _render_configmap(digest: str, signatures: list[bytes]) -> str:
+def _render_configmap(digest: str, signatures: list[bytes], name: str | None = None) -> str:
     binary_data = "\n".join(
         f"  sha256-{digest}-{index}: {base64.b64encode(signature).decode('ascii')}"
         for index, signature in enumerate(signatures, start=1)
     )
 
-    return CONFIGMAP_TEMPLATE.format(short_digest=digest[:16], binary_data=binary_data)
+    return CONFIGMAP_TEMPLATE.format(
+        name=name or f"signature-sha256-{digest[:16]}",
+        binary_data=binary_data,
+    )

{openshift_update_proxy-1.2.0 → openshift_update_proxy-1.4.5}/src/openshift_update_proxy.egg-info/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: openshift-update-proxy
-Version: 1.2.0
-Summary: Forwarding proxy for OpenShift update resources (Cincinnati API, mirror, release signatures)
+Version: 1.4.5
+Summary: Forwarding proxy for OpenShift update resources (update graph, mirror, release signatures, operator catalog, lifecycle API)
 Author-email: Simon Lauger <simon@lauger.de>
 License-Expression: Apache-2.0
 Project-URL: Repository, https://github.com/slauger/openshift-update-proxy
-Keywords: openshift,cincinnati,update-graph,proxy,disconnected,air-gapped
+Keywords: openshift,cincinnati,update-graph,proxy,disconnected,air-gapped,olm,renovate
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Web Environment
 Classifier: Framework :: Flask
@@ -47,8 +47,8 @@ central egress proxy (or a single host with internet access) exists.
   (`/api/upgrades_info/v1/graph`) to `api.openshift.com`
 - 📦 **Mirror Proxy** - forwards requests for clients and release artifacts to
   `mirror.openshift.com/pub`
-- 🔏 **Signature Store** - serves release image signatures for
-  `ClusterVersion.spec.signatureStores` (OpenShift 4.14+)
+- 🔏 **Signature Store** - forwards release image signature requests to the
+  public signature store on `mirror.openshift.com`
 - 🗺️ **ConfigMap Generator** - renders ready-to-apply signature ConfigMaps for the
   classic disconnected verification workflow
 - 🎛️ **Operator Catalog API** - serves operator channels and versions from the
@@ -61,6 +61,8 @@ central egress proxy (or a single host with internet access) exists.
   Cosign signed
 - ⛵ **Helm Chart** - deploy to Kubernetes/OpenShift with probes and sane security defaults
 - 🩺 **Health Endpoint** - `/healthz` for liveness and readiness probes
+- 🪵 **Request Logging** - logs source, method, path and status for every
+  request (health probes excluded)
 
 ## How it works
 
@@ -159,6 +161,9 @@ pip install openshift-update-proxy
 openshift-update-proxy
 ```
 
+For running as a service on a plain Linux host, see the systemd unit example in
+[examples/update-proxy.service](examples/update-proxy.service).
+
 ## Cluster integration
 
 ### Update graph
@@ -189,7 +194,11 @@ curl -s "http://update-proxy.example.com:5000/configmaps/4.16.8" | oc apply -f -
 
 The optional `arch` (default `amd64`) and `channel_prefix` (default `stable`) query
 parameters select the architecture and the update channel used for the lookup, e.g.
-`/configmaps/4.16.8?arch=arm64`.
+`/configmaps/4.16.8?arch=arm64`. Version lookups name the ConfigMap
+`release-signature-<version>-<arch>` - the signed digest differs per
+architecture, so the name has to carry it. Digest lookups use
+`signature-sha256-<digest prefix>` (first 16 characters) as neither version nor
+architecture are known there.
 
 Alternatively, a release digest can be passed directly:
 
@@ -289,9 +298,12 @@ The optional `channel_prefix` (default `stable`, e.g. `eus`, `fast`, `candidate`
 lifecycle API is available under `/lifecycle/`, e.g.
 `/lifecycle/products?name=OpenShift Container Platform`.
 
-[examples/create-configmaps.sh](examples/create-configmaps.sh) combines this with
-the `/configmaps/` endpoint: it fetches the release signatures for a set of update
-channels through the proxy and applies them as ConfigMaps.
+[examples/create-configmaps/](examples/create-configmaps/) combines this with the
+`/configmaps/` endpoint: it fetches the release signatures for a set of update
+channels through the proxy and writes one manifest per release
+(`manifests/release-signature-<version>-<arch>.yaml`), ready to be committed to a GitOps
+repository. The directory also contains a scheduled GitHub Actions workflow that
+keeps the manifests up to date.
 
 ## Local Development
 

{openshift_update_proxy-1.2.0 → openshift_update_proxy-1.4.5}/tests/test_app.py

@@ -168,7 +168,9 @@ def test_configmap_by_version_resolves_digest(client, monkeypatch):
     assert response.status_code == 200
     assert graph_calls["params"]["channel"] == "stable-4.16"
     assert graph_calls["params"]["arch"] == "arm64"
-    assert f"sha256-{DIGEST}-1:" in response.data.decode()
+    body = response.data.decode()
+    assert "name: release-signature-4.16.8-arm64" in body
+    assert f"sha256-{DIGEST}-1:" in body
 
 
 def test_configmap_by_version_returns_404_for_unknown_version(client, monkeypatch):
@@ -203,6 +205,44 @@ def test_configmap_by_version_rejects_invalid_arch(client):
     assert response.status_code == 400
 
 
+def test_requests_are_logged(client, caplog, monkeypatch):
+    monkeypatch.setattr(app_module.requests, "get", lambda *a, **kw: FakeResponse(b"{}"))
+
+    with caplog.at_level("INFO", logger="openshift-update-proxy"):
+        client.get("/api/upgrades_info/v1/graph?channel=stable-4.16")
+
+    assert any(
+        '"GET /api/upgrades_info/v1/graph?channel=stable-4.16" 200' in record.message
+        for record in caplog.records
+    )
+
+
+def test_healthz_is_not_logged(client, caplog):
+    with caplog.at_level("INFO", logger="openshift-update-proxy"):
+        client.get("/healthz")
+
+    assert not caplog.records
+
+
+def test_insecure_warnings_disabled_when_verify_off(monkeypatch):
+    from openshift_update_proxy.app import create_app
+    from openshift_update_proxy.config import Config
+
+    calls = []
+    monkeypatch.setattr(
+        app_module.urllib3, "disable_warnings", lambda category: calls.append(category)
+    )
+
+    monkeypatch.setenv("INSECURE_SKIP_TLS_VERIFY", "true")
+    create_app(Config())
+    assert calls == [app_module.urllib3.exceptions.InsecureRequestWarning]
+
+    calls.clear()
+    monkeypatch.delenv("INSECURE_SKIP_TLS_VERIFY")
+    create_app(Config())
+    assert calls == []
+
+
 def test_ssl_verify_enabled_by_default(config):
     assert config.ssl_verify is True