[RFC] Making things easier when working with custom products & Simple Content Access (SCA)

jeremylenz · June 1, 2023, 5:15pm

Decided to post this in Community instead of replying here: Katello 4.9 Custom products changes with SCA

admin_hw · June 17, 2024, 2:28pm

Hello, we are testing Foreman 3.10 with Katello 4.12. The SCA enablement/disablement works fine. What we are facing is that all the repositories from Content View is visible in hosts. It’s undesirable for us. For exemple if we have two types of servers (DNS/DHCP server and application server with databases,java and tomcat) we don’t need that the repo of mariadb, java and tomcat is visible on the DNS/DHCP server. It could be the security issue because if we have defined repo for mariadb which is visible on DNS/DHCP server attacker could just enable it and use some vulnerabilities which could be there. Moreover it’s very confusing to have many many repositories in repolist.
Is possible to have 3 states of content repositories (enabled, disabled and absent)? It’s very important for us and with new SCA model it’s not possible.
Thank you very much.
Ondrej

jeremylenz · June 17, 2024, 2:32pm

No, not within the same content view. If you want a repository to be completely absent from your redhat.repo file, it would have to be not included in the content view. You can do this with content view filters, or by simply excluding the repository from the content view before publishing.

admin_hw · June 17, 2024, 2:55pm

I’ve made two separate content views. The multiple content view per host is enabled, but it seems not working. Host only still use one content view. What is the usage of multiple content views? Am I using it right?

jeremylenz · June 17, 2024, 3:01pm

Here’s a link to my demo of the feature as it is now: https://www.youtube.com/live/XKuMf9Li734?t=445s

You have to turn on that setting and then reregister your host via subscription-manager register --environments.

admin_hw · June 17, 2024, 3:18pm

Oh, thank you so much. There is very important information in the video. The multiple content view register works only with username and password. I’ve used antivation keys and link generator from gui. When it will be ready to use it with activation keys? We are using ansible pleybook to registration of hosts.

jeremylenz · June 17, 2024, 3:36pm

We plan to advance the feature for hosts first, then AKs. For hosts there are a couple PRs out currently:

github.com/Katello/katello

Fixes #37509 - Display multi-CV in web UI

Katello:master ← jeremylenz:multi-cv-host-details-display

opened 10:16PM - 22 May 24 UTC

jeremylenz

+237 -73

#### What are the changes introduced in this pull request? 1. Add multi-CV di…splay to host details ![image](https://github.com/Katello/katello/assets/22042343/c024f099-0877-453d-9df6-903c988d33d7) 2. Add a column for multi-CV display to new All Hosts ![image](https://github.com/Katello/katello/assets/22042343/6434ae11-6b8e-4685-9334-ed010fbbec37) We haven't yet built the web UI for changing or rearranging a host's multiple environments. Until then, using the web UI to change CV/LCE will transform a multi-environment host back into a single-environment one. So, 3. Add an alert banner (for now) on the change CV modal: ![image](https://github.com/Katello/katello/assets/22042343/a5d0b3e3-8a29-46f3-8d89-4c82af0f3fef) #### Considerations taken when implementing this change? I had added a badge on the card as well, but it took up too much space and caused the kebab to wrap to the next line. I decided the badge wasn't useful enough to include. #### What are the testing steps for this pull request? Register a host to multiple environments: ``` subscription-manager register --environments dev/cv1,prod/cv2 ``` Check and verify correct display on * All Hosts experimental page (turn on the 'Content view environments' column) * Host details - Content view card * Host details - Edit content view environments modal

github.com/Katello/katello

Multi-CV: Add ordering to content view environments

Katello:master ← jeremylenz:37508-multi-cv-rank

opened 07:42PM - 28 May 24 UTC

jeremylenz

+46 -7

#### What are the changes introduced in this pull request? Since Katello 4.8,… you've been able to register hosts to multiple content view environments: ``` subscription-manager register --environments dev/cv1, prod/cv2 ``` For the situation where the same repository is contained in multiple content view versions, we may end up with "repo conflicts" where Candlepin must make a decision about which content view environment to serve the repo from. The way that Candlepin handles it is via the _order_ of the content view environments, with first being highest priority. Therefore, in the example above, if the same repo were in both of the host's content views, `dev/cv1` would win, since it was specified first. Until now, it was not possible to change this order without reregistering a host. This PR adds a (backend) way to change the order: - Add a zero-indexed `priority` field to `ContentViewEnvironmentContentFacet` - When changing a host's content view environments, update this `priority` to reflect the order that the user specified - Always sort by priority when sending params to Candlepin. Thus, assuming a host called `rhel8b` it's now possible to change the order of a host's content view environments like this: ``` [13] pry(main)> rhel8b.content_view_environments.map(&:candlepin_name) => ["dev/cv1", "prod/cv2"] [14] pry(main)> rhel8b.content_facet.content_view_environments = [prodCv2, devCv1] [16] pry(main)> rhel8b.content_view_environments.reload.map(&:candlepin_name) => ["prod/cv2", "dev/cv1"] ``` (Note that you must use `rhel8b.content_facet.content_view_environments =`, instead of just simply `rhel8b.content_view_environments =`, or Rails will emphatically protest.) #### Considerations taken when implementing this change? Web UI will come in a future PR. For now, you will have to use Rails console. #### What are the testing steps for this pull request? 1. Have at least 2 published content views 2. Register a host to multiple environments (remember, no activation keys or global registration allowed) ``` subscription-manager register --environments dev/cv1, prod/cv2 ``` 3. Verify that the host's environments are listed in the same order, by running on the host ``` subscription-manager environments --list-enabled ``` 4. Change the order of environments like the example above 5. Run `subscription-manager environments --list-enabled` again. You should see the environments in the new order. You can also use these methods on `host.subscription_facet` to verify: ```rb subscription_facet.candlepin_environments_cp_ids # returns ordered array of environment ids, as stored in Katello subscription_facet.consumer_cve_order_from_candlepin # makes Candlepin API call and returns ordered array of environment ids subscription_facet.cves_ordered_correctly? # compares the 2 things above and returns true if they're the same ```

and there will be a few more in Katello 4.14, hopefully. Once hosts are working (via hammer at least), we will move on to making it work with AKs and global registration. I’m hoping within the next few releases (?) but these things are always a process…

jeremylenz · June 17, 2024, 3:37pm

For now, if you use ansible you could have your playbook run (on the host) subscription-manager register with --environments and --force, and I think it would work.

admin_hw · June 18, 2024, 10:50am

Yes it is working but there is no possibility to define, which repo is enable/disable. The Activation Key gives me the choice.

This add the environment, but all the repos are disabled. I can’t see any possiblity in Content view, to say which repos has enabled overwrite.
Specify the enabled repos in ansible playbook is little a bit annoying and the beauty of automation is fading.

jeremylenz · June 18, 2024, 1:47pm

Please keep in mind this is not a complete feature yet. The automation will be more beautiful when the feature is completed. Thank you for testing this feature; your feedback will help make it better!

In the meantime, another option I can think of (if you have the host already registered) is

subscription-manager identity # get the consumer id
subscription-manager clean # clean all local data
subscription-manager register --consumerid xxxx # use the id you got above

This should in theory preserve any content overrides (enabled repos) that were there before.
You can run man subscription-manager on the host for more info about all the options.