This repository was archived by the owner on Sep 18, 2025. It is now read-only.
add turnpike content guard (HMS-4783) #2726
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,8 +4,10 @@ import ( | |
| "context" | ||
| "errors" | ||
| "fmt" | ||
| "slices" | ||
|
|
||
| "github.com/google/uuid" | ||
| "github.com/redhatinsights/edge-api/config" | ||
| "github.com/redhatinsights/edge-api/pkg/ptr" | ||
| "github.com/sirupsen/logrus" | ||
| ) | ||
|
|
@@ -65,12 +67,44 @@ func (ps *PulpService) CompositeGuardReadByOrgID(ctx context.Context, orgID stri | |
| return ps.CompositeGuardRead(ctx, id) | ||
| } | ||
|
|
||
| func contentGuardHrefsAreEqual(cghrefa, cghrefb []string) bool { | ||
| // compare how many hrefs are in the content guard versus expected | ||
| logrus.Debug("Comparing Content Guard hrefs") | ||
| if len(cghrefa) != len(cghrefb) { | ||
| logrus.WithFields(logrus.Fields{ | ||
| "href_count_1": len(cghrefa), | ||
| "href_count_2": len(cghrefb), | ||
| }).Warning("Content Guards do not have the same number of hrefs") | ||
|
|
||
| return false | ||
| } | ||
|
|
||
| logrus.WithFields(logrus.Fields{ | ||
| "href_count_1": len(cghrefa), | ||
| "href_count_2": len(cghrefb), | ||
| }).Debug("Content Guards have the same number of hrefs") | ||
|
|
||
| // compare content guard hrefs (actual vs. expected) | ||
| for i := range cghrefa { | ||
| if !slices.Contains(cghrefb, cghrefa[i]) { | ||
| logrus.WithField("href_mismatch", cghrefa[i]).Warning("Content Guard href mismatch") | ||
|
|
||
| return false | ||
| } | ||
| } | ||
|
|
||
| logrus.Debug("Content Guard has the expected hrefs") | ||
loadtheaccumulator marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| return true | ||
| } | ||
|
|
||
| // CompositeGuardEnsure ensures that the composite guard is created and returns it. The method is idempotent. | ||
| func (ps *PulpService) CompositeGuardEnsure(ctx context.Context, orgID string, pulpGuardHrefs []string) (*CompositeContentGuardResponse, error) { | ||
loadtheaccumulator marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| cg, err := ps.CompositeGuardReadByOrgID(ctx, compositeGuardName(orgID)) | ||
| // nolint: gocritic | ||
| if errors.Is(err, ErrRecordNotFound) { | ||
| logrus.Warning("No composite guard found. Creating one.") | ||
| cg, err = ps.CompositeGuardCreate(ctx, orgID, pulpGuardHrefs...) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
@@ -83,14 +117,15 @@ func (ps *PulpService) CompositeGuardEnsure(ctx context.Context, orgID, headerHr | |
| } | ||
|
|
||
| gs := ptr.FromOrEmpty(cg.Guards) | ||
| if !contentGuardHrefsAreEqual(gs, pulpGuardHrefs) { | ||
| logrus.WithContext(ctx).Warnf("unexpected Composite Content Guard: %v, deleting it", gs) | ||
| err = ps.CompositeGuardDelete(ctx, ScanUUID(cg.PulpHref)) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| logrus.Warning("Matching composite guard not found. Creating one.") | ||
| cg, err = ps.CompositeGuardCreate(ctx, orgID, pulpGuardHrefs...) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
@@ -102,17 +137,35 @@ func (ps *PulpService) CompositeGuardEnsure(ctx context.Context, orgID, headerHr | |
| // that the composite guard is not created or the guards are not the same as the ones provided, it will delete it | ||
| // and recreate it. This method is idempotent and will not create the guards if they already exist. | ||
| func (ps *PulpService) ContentGuardEnsure(ctx context.Context, orgID string) (*CompositeContentGuardResponse, error) { | ||
| var contentGuardHrefs []string | ||
|
Collaborator
There was a problem hiding this comment. This is fine, two appends will create a slice of capacity two, one extra copy operation is not big deal: https://go.dev/play/p/SAxjQTDwNCT Interesting fact: Go increases capacity in power of twos up until 256 and then it is just 1.25x: https://github.com/golang/go/blob/master/src/runtime/slice.go#L289 |
||
| cfg := config.Get() | ||
|
|
||
| logrus.WithContext(ctx).Debug("Creating header content guard") | ||
| hcg, err := ps.HeaderGuardEnsure(ctx, orgID) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| contentGuardHrefs = append(contentGuardHrefs, *hcg.PulpHref) | ||
|
|
||
| // Turnpike Content Guard is primarily for Image Builder to Pulp calls using the URL configured in PULP_CONTENT_URL | ||
| logrus.WithContext(ctx).Debug("Creating turnpike content guard") | ||
| tpcg, err := ps.TurnpikeGuardEnsure(ctx) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| contentGuardHrefs = append(contentGuardHrefs, *tpcg.PulpHref) | ||
|
|
||
| // to create an RBAC Content Guard, add PULP_CONTENT_USERNAME and PULP_CONTENT_PASSWORD to environment | ||
| if cfg.Pulp.ContentUsername != "" { | ||
| logrus.WithContext(ctx).Debug("Creating RBAC content guard") | ||
| rcg, err := ps.RbacGuardEnsure(ctx) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| contentGuardHrefs = append(contentGuardHrefs, *rcg.PulpHref) | ||
| } | ||
|
|
||
| ccg, err := ps.CompositeGuardEnsure(ctx, orgID, contentGuardHrefs) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
loadtheaccumulator marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| package pulp | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "testing" | ||
|
|
||
| "github.com/bxcodec/faker/v3" | ||
| "github.com/magiconair/properties/assert" | ||
| ) | ||
|
|
||
| func TestContentGuardHrefsAreEqual(t *testing.T) { | ||
| var hrefTemplate = "/api/pulp/em%sd/api/v3/contentguards/core/%s/%s/" | ||
| var orgID = faker.UUIDDigit() | ||
|
|
||
| var href1 = fmt.Sprintf(hrefTemplate, orgID, "header", faker.UUIDHyphenated()) // id | ||
| var href2 = fmt.Sprintf(hrefTemplate, orgID, "rbac", faker.UUIDHyphenated()) // rbac | ||
| var href3 = fmt.Sprintf(hrefTemplate, orgID, "header", faker.UUIDHyphenated()) // turnpike | ||
| var href4 = fmt.Sprintf(hrefTemplate, orgID, "header", faker.UUIDHyphenated()) // different | ||
|
|
||
| var baseSlice = []string{href1, href2, href3} | ||
| var sameSizeDiffOrder = []string{href3, href2, href1} | ||
| var sameSizeSameOrder = []string{href1, href2, href3} | ||
| var sameSizeDiffContent = []string{href1, href2, href4} | ||
| var diffSmaller = []string{href1, href2} | ||
| var diffLarger = []string{href1, href2, href3, href4} | ||
| var sameSizeEmptyString = []string{href1, href2, ""} | ||
| var sameSizeEmptyStringDiffOrder = []string{"", href2, href1} | ||
| var sameSizeAllEmptyStrings = []string{"", "", ""} | ||
| var diffSizeSmallerAllEmptyStrings = []string{"", ""} | ||
| var diffSizeLargerAllEmptyStrings = []string{"", "", "", ""} | ||
|
|
||
| t.Run("sameslice", func(t *testing.T) { | ||
| assert.Equal(t, contentGuardHrefsAreEqual(baseSlice, baseSlice), true) | ||
| }) | ||
|
|
||
| t.Run("samesize_differentorder", func(t *testing.T) { | ||
| assert.Equal(t, contentGuardHrefsAreEqual(baseSlice, sameSizeDiffOrder), true) | ||
| }) | ||
|
|
||
| t.Run("samesize_sameorder", func(t *testing.T) { | ||
| assert.Equal(t, contentGuardHrefsAreEqual(baseSlice, sameSizeSameOrder), true) | ||
| }) | ||
|
|
||
| t.Run("negative_samesize_differentcontent", func(t *testing.T) { | ||
| assert.Equal(t, contentGuardHrefsAreEqual(baseSlice, sameSizeDiffContent), false) | ||
| }) | ||
|
|
||
| t.Run("negative_differentsizesmaller", func(t *testing.T) { | ||
| assert.Equal(t, contentGuardHrefsAreEqual(baseSlice, diffSmaller), false) | ||
| }) | ||
|
|
||
| t.Run("negative_differentsizelarger", func(t *testing.T) { | ||
| assert.Equal(t, contentGuardHrefsAreEqual(baseSlice, diffLarger), false) | ||
| }) | ||
|
|
||
| t.Run("empty_both", func(t *testing.T) { | ||
| assert.Equal(t, contentGuardHrefsAreEqual([]string{}, []string{}), true) | ||
| }) | ||
|
|
||
| t.Run("negative_empty_a", func(t *testing.T) { | ||
| assert.Equal(t, contentGuardHrefsAreEqual([]string{}, baseSlice), false) | ||
| }) | ||
|
|
||
| t.Run("negative_empty_b", func(t *testing.T) { | ||
| assert.Equal(t, contentGuardHrefsAreEqual(baseSlice, []string{}), false) | ||
| }) | ||
|
|
||
| t.Run("negative_samesize_emptystring", func(t *testing.T) { | ||
| assert.Equal(t, contentGuardHrefsAreEqual(baseSlice, sameSizeEmptyString), false) | ||
| }) | ||
|
|
||
| t.Run("samesize_oneemptystring_difforder", func(t *testing.T) { | ||
| assert.Equal(t, contentGuardHrefsAreEqual(sameSizeEmptyString, sameSizeEmptyStringDiffOrder), true) | ||
| }) | ||
|
|
||
| t.Run("negative_samesize_allemptystrings", func(t *testing.T) { | ||
| assert.Equal(t, contentGuardHrefsAreEqual(baseSlice, sameSizeAllEmptyStrings), false) | ||
| }) | ||
|
|
||
| t.Run("negative_differentsizesmaller_allemptystrings", func(t *testing.T) { | ||
| assert.Equal(t, contentGuardHrefsAreEqual(sameSizeAllEmptyStrings, diffSizeSmallerAllEmptyStrings), false) | ||
| }) | ||
|
|
||
| t.Run("negative_differentsizelarger_allemptystrings", func(t *testing.T) { | ||
| assert.Equal(t, contentGuardHrefsAreEqual(sameSizeAllEmptyStrings, diffSizeLargerAllEmptyStrings), false) | ||
| }) | ||
|
|
||
| t.Run("sameslice_allemptystrings", func(t *testing.T) { | ||
| assert.Equal(t, contentGuardHrefsAreEqual(sameSizeAllEmptyStrings, sameSizeAllEmptyStrings), true) | ||
| }) | ||
| } |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.