diff --git a/development/roles/foreman_development/templates/katello.yaml.j2 b/development/roles/foreman_development/templates/katello.yaml.j2 index 5d9d585a..eb4ef7d3 100644 --- a/development/roles/foreman_development/templates/katello.yaml.j2 +++ b/development/roles/foreman_development/templates/katello.yaml.j2 @@ -11,9 +11,4 @@ :oauth_secret: {{ candlepin_oauth_secret }} :ca_cert_file: {{ foreman_development_cert_dir }}/proxy_ca.pem - :candlepin_events: - :ssl_cert_file: {{ foreman_development_cert_dir }}/client_cert.pem - :ssl_key_file: {{ foreman_development_cert_dir }}/client_key.pem - :ssl_ca_file: {{ foreman_development_cert_dir }}/proxy_ca.pem - :katello_applicability: true diff --git a/src/roles/candlepin/tasks/artemis.yml b/src/roles/candlepin/tasks/artemis.yml deleted file mode 100644 index 75cb91e4..00000000 --- a/src/roles/candlepin/tasks/artemis.yml +++ /dev/null @@ -1,64 +0,0 @@ ---- -- name: Extract the DN from the client certificate - ansible.builtin.command: "openssl x509 -in {{ candlepin_client_certificate }} -noout -subject -nameopt rfc2253,sep_comma_plus_space" - changed_when: false - register: candlepin_openssl_response - -- name: Set candlepin_artemis_client_dn - ansible.builtin.set_fact: - candlepin_artemis_client_dn: "{{ candlepin_openssl_response.stdout | replace('subject=', '') }}" - -- name: Create Candlepin broker.xml - containers.podman.podman_secret: - state: present - name: candlepin-artemis-broker-xml - data: "{{ lookup('ansible.builtin.template', 'broker.xml.j2') }}" - labels: - filename: broker.xml - app: artemis - notify: - - Restart candlepin - -- name: Create Tomcat login config - containers.podman.podman_secret: - state: present - name: candlepin-artemis-login-config - data: "{{ lookup('ansible.builtin.template', 'login.config') }}" - labels: - filename: login.config - app: artemis - notify: - - Restart candlepin - -- name: Create Tomcat jaas.conf - containers.podman.podman_secret: - state: present - name: candlepin-artemis-jaas-conf - data: "{{ lookup('ansible.builtin.template', 'jaas.conf') }}" - labels: - filename: jaas.conf - app: artemis - notify: - - Restart candlepin - -- name: Create Tomcat cert-roles.properties - containers.podman.podman_secret: - state: present - name: candlepin-artemis-cert-roles-properties - data: "{{ lookup('ansible.builtin.template', 'cert-roles.properties') }}" - labels: - filename: cert-roles.properties - app: artemis - notify: - - Restart candlepin - -- name: Create Tomcat cert-users.properties - containers.podman.podman_secret: - state: present - name: candlepin-artemis-cert-users-properties - data: "{{ lookup('ansible.builtin.template', 'cert-users.properties.j2') }}" - labels: - filename: cert-users.properties - app: artemis - notify: - - Restart candlepin diff --git a/src/roles/candlepin/tasks/certs.yml b/src/roles/candlepin/tasks/certs.yml index c90468c4..6c0187f9 100644 --- a/src/roles/candlepin/tasks/certs.yml +++ b/src/roles/candlepin/tasks/certs.yml @@ -10,17 +10,6 @@ other_certificates: "{{ candlepin_ca_certificate }}" state: present -- name: Generate truststore - community.crypto.openssl_pkcs12: - action: export - passphrase: "{{ candlepin_keystore_password }}" - path: "/root/candlepin.truststore" - friendly_name: 'artemis-client' - privatekey_path: "{{ candlepin_client_key }}" - certificate_path: "{{ candlepin_client_certificate }}" - other_certificates: "{{ candlepin_ca_certificate }}" - state: present - - name: Create the podman secret for Candlepin CA certificate containers.podman.podman_secret: state: present @@ -57,17 +46,6 @@ notify: - Restart candlepin -- name: Create the podman secret for Tomcat truststore - containers.podman.podman_secret: - state: present - name: candlepin-tomcat-truststore - path: "/root/candlepin.truststore" - labels: - filename: candlepin.truststore - app: tomcat - notify: - - Restart candlepin - - name: Create the podman secret for the keystore password containers.podman.podman_secret: state: present diff --git a/src/roles/candlepin/tasks/main.yml b/src/roles/candlepin/tasks/main.yml index a3c1f88f..471748ce 100644 --- a/src/roles/candlepin/tasks/main.yml +++ b/src/roles/candlepin/tasks/main.yml @@ -47,10 +47,6 @@ notify: - Restart candlepin -- name: Setup artemis - ansible.builtin.include_tasks: - file: artemis.yml - - name: Pull the Candlepin container image containers.podman.podman_image: name: "{{ candlepin_container_image }}:{{ candlepin_container_tag }}" @@ -67,15 +63,9 @@ - 'candlepin-ca-cert,target=/etc/candlepin/certs/candlepin-ca.crt,mode=0440,type=mount' - 'candlepin-ca-key,target=/etc/candlepin/certs/candlepin-ca.key,mode=0440,type=mount' - 'candlepin-tomcat-keystore,target=/etc/candlepin/certs/keystore,mode=0440,type=mount' - - 'candlepin-tomcat-truststore,target=/etc/candlepin/certs/truststore,mode=0440,type=mount' - 'candlepin-candlepin-conf,target=/etc/candlepin/candlepin.conf,mode=0440,type=mount' - - 'candlepin-artemis-broker-xml,target=/etc/candlepin/broker.xml,mode=440,type=mount' - 'candlepin-tomcat-server-xml,target=/etc/tomcat/server.xml,mode=440,type=mount' - 'candlepin-tomcat-conf,target=/etc/tomcat/tomcat.conf,mode=440,type=mount' - - 'candlepin-artemis-login-config,target=/etc/tomcat/login.config,mode=440,type=mount' - - 'candlepin-artemis-cert-roles-properties,target=/etc/tomcat/cert-roles.properties,mode=440,type=mount' - - 'candlepin-artemis-cert-users-properties,target=/etc/tomcat/cert-users.properties,mode=440,type=mount' - - 'candlepin-artemis-jaas-conf,target=/etc/tomcat/conf.d/jaas.conf,mode=440,type=mount' volumes: - /var/log/candlepin:/var/log/candlepin:Z - /var/log/tomcat:/var/log/tomcat:Z diff --git a/src/roles/candlepin/templates/broker.xml.j2 b/src/roles/candlepin/templates/broker.xml.j2 deleted file mode 100644 index 3a247b9c..00000000 --- a/src/roles/candlepin/templates/broker.xml.j2 +++ /dev/null @@ -1,138 +0,0 @@ - - - - - - -1 - - - vm://0 - tcp://localhost:61613?protocols=STOMP;useEpoll=false;sslEnabled=true;trustStorePath=/etc/candlepin/certs/truststore;trustStorePassword={{ candlepin_keystore_password }};keyStorePath=/etc/candlepin/certs/keystore;keyStorePassword={{ candlepin_keystore_password }};needClientAuth=true - - - true - - - - - - - - - - - - - - - - - - - - - - - - true - NIO - 1 - true - true - /var/lib/candlepin/activemq-artemis/bindings - /var/lib/candlepin/activemq-artemis/journal - /var/lib/candlepin/activemq-artemis/largemsgs - /var/lib/candlepin/activemq-artemis/paging - - - 99 - - -
- - - - -
- -
- - - -
- -
- - - -
-
- - - - FORCE - true - 10485760 - - - 1048576 - - - 30000 - 3600000 - 2 - 0 - - - - false - 10485760 - - - 1048576 - - 0 - 1 - - - - 10485760 - - - 1048576 - - - 0 - - - 30000 - 3600000 - 2 - 0 - - - - - - false -
event.default
- - katello.candlepin -
-
-
-
diff --git a/src/roles/candlepin/templates/candlepin.conf.j2 b/src/roles/candlepin/templates/candlepin.conf.j2 index 0a46138e..d725c68c 100644 --- a/src/roles/candlepin/templates/candlepin.conf.j2 +++ b/src/roles/candlepin/templates/candlepin.conf.j2 @@ -4,8 +4,6 @@ candlepin.environment_content_filtering=true candlepin.auth.basic.enable=false candlepin.auth.trusted.enable=false -candlepin.audit.hornetq.config_path=/etc/candlepin/broker.xml - candlepin.db.database_manage_on_startup=Manage candlepin.auth.oauth.enable=true diff --git a/src/roles/candlepin/templates/cert-roles.properties b/src/roles/candlepin/templates/cert-roles.properties deleted file mode 100644 index 06320b5a..00000000 --- a/src/roles/candlepin/templates/cert-roles.properties +++ /dev/null @@ -1 +0,0 @@ -candlepinEventsConsumer=katelloUser diff --git a/src/roles/candlepin/templates/cert-users.properties.j2 b/src/roles/candlepin/templates/cert-users.properties.j2 deleted file mode 100644 index 193a825d..00000000 --- a/src/roles/candlepin/templates/cert-users.properties.j2 +++ /dev/null @@ -1 +0,0 @@ -katelloUser={{ candlepin_artemis_client_dn }} diff --git a/src/roles/candlepin/templates/jaas.conf b/src/roles/candlepin/templates/jaas.conf deleted file mode 100644 index e8b00a14..00000000 --- a/src/roles/candlepin/templates/jaas.conf +++ /dev/null @@ -1 +0,0 @@ -CATALINA_OPTS="-Djava.security.auth.login.config=$CATALINA_HOME/conf/login.config" diff --git a/src/roles/candlepin/templates/login.config b/src/roles/candlepin/templates/login.config deleted file mode 100644 index 20e88a3f..00000000 --- a/src/roles/candlepin/templates/login.config +++ /dev/null @@ -1,13 +0,0 @@ -CertificateLogin { - org.apache.activemq.artemis.spi.core.security.jaas.TextFileCertificateLoginModule required - debug=true - org.apache.activemq.jaas.textfiledn.user="cert-users.properties" - org.apache.activemq.jaas.textfiledn.role="cert-roles.properties"; -}; - -InVMLogin { - org.apache.activemq.artemis.spi.core.security.jaas.GuestLoginModule required - debug=true - org.apache.activemq.jaas.guest.user="invm-user" - org.apache.activemq.jaas.guest.role="invm-role"; -}; diff --git a/src/roles/foreman/templates/katello.yaml.j2 b/src/roles/foreman/templates/katello.yaml.j2 index 668d2cf7..14450c50 100644 --- a/src/roles/foreman/templates/katello.yaml.j2 +++ b/src/roles/foreman/templates/katello.yaml.j2 @@ -8,11 +8,5 @@ :oauth_secret: "{{ candlepin_oauth_secret }}" :ca_cert_file: /etc/foreman/katello-default-ca.crt - :candlepin_events: - :broker_host: localhost - :ssl_cert_file: /etc/foreman/client_cert.pem - :ssl_key_file: /etc/foreman/client_key.pem - :ssl_ca_file: /etc/foreman/katello-default-ca.crt - :pulp: :ca_cert_file: /etc/foreman/katello-default-ca.crt diff --git a/tests/candlepin_test.py b/tests/candlepin_test.py index dc78faa8..d775d4d6 100644 --- a/tests/candlepin_test.py +++ b/tests/candlepin_test.py @@ -23,22 +23,6 @@ def test_candlepin_status(server, certificates): assert status.stdout == '200' -def test_artemis_port(server): - candlepin = server.addr("localhost") - assert candlepin.port("61613").is_reachable - - -def test_artemis_auth(server, certificates): - cmd = server.run(f'echo "" | openssl s_client -CAfile {certificates["ca_certificate"]} -cert {certificates["client_certificate"]} -key {certificates["client_key"]} -connect localhost:61613') - assert cmd.succeeded, f"exit: {cmd.rc}\n\nstdout:\n{cmd.stdout}\n\nstderr:\n{cmd.stderr}" - - -def test_certs_users_file(server, certificates): - cmd = server.run(f'openssl x509 -noout -subject -in {certificates["client_certificate"]} -nameopt rfc2253,sep_comma_plus_space') - subject = cmd.stdout.replace("subject=", "").rstrip() - assert_secret_content(server, 'candlepin-artemis-cert-users-properties', f'katelloUser={subject}') - - def test_tls(server): result = server.run('nmap --script +ssl-enum-ciphers localhost -p 23443') result = result.stdout @@ -55,7 +39,3 @@ def test_tls(server): # Test that the least cipher strength is "strong" or "A" assert "least strength: A" in result - - -def test_cert_roles(server): - assert_secret_content(server, 'candlepin-artemis-cert-roles-properties', 'candlepinEventsConsumer=katelloUser') diff --git a/tests/foreman_test.py b/tests/foreman_test.py index 5a9095f8..781839c4 100644 --- a/tests/foreman_test.py +++ b/tests/foreman_test.py @@ -46,7 +46,7 @@ def test_foreman_status_cache(foreman_status): assert foreman_status['results']['foreman']['cache']['servers'][0]['status'] == 'ok' -@pytest.mark.parametrize("katello_service", ['candlepin', 'candlepin_auth', 'candlepin_events', 'foreman_tasks', 'katello_events', 'pulp3', 'pulp3_content']) +@pytest.mark.parametrize("katello_service", ['candlepin', 'candlepin_auth', 'foreman_tasks', 'katello_events', 'pulp3', 'pulp3_content']) def test_katello_services_status(foreman_status, katello_service): assert foreman_status['results']['katello']['services'][katello_service]['status'] == 'ok'