From 1462d9e247348ee6676efb0fcfe30a66720b6e77 Mon Sep 17 00:00:00 2001
From: Leonardo Rossetti <lrossett@redhat.com>
Date: Jan 27 2022 18:55:11 +0000
Subject: adding basic auth to resultsdb


---

diff --git a/operator/config/components/ingress/ingress.yaml b/operator/config/components/ingress/ingress.yaml
deleted file mode 100644
index 3df9f1f..0000000
--- a/operator/config/components/ingress/ingress.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: resultsdb-sample
-  annotations:
-    nginx.ingress.kubernetes.io/secure-backends: "true"
-    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
-spec:
-  tls:
-  rules:
-  - host: resultsdb.testing
-    http:
-      paths:
-        - path: /
-          pathType: Prefix
-          backend:
-            service:
-              name: resultsdb-sample-http
-              port:
-                number: 5001
diff --git a/operator/config/components/kubernetes/ingress.yaml b/operator/config/components/kubernetes/ingress.yaml
new file mode 100644
index 0000000..3df9f1f
--- /dev/null
+++ b/operator/config/components/kubernetes/ingress.yaml
@@ -0,0 +1,22 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: resultsdb-sample
+  annotations:
+    nginx.ingress.kubernetes.io/secure-backends: "true"
+    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+spec:
+  tls:
+  rules:
+  - host: resultsdb.testing
+    http:
+      paths:
+        - path: /
+          pathType: Prefix
+          backend:
+            service:
+              name: resultsdb-sample-http
+              port:
+                number: 5001
diff --git a/operator/config/components/kubernetes/resultsdb-htpasswd-secret.yaml b/operator/config/components/kubernetes/resultsdb-htpasswd-secret.yaml
new file mode 100644
index 0000000..4809417
--- /dev/null
+++ b/operator/config/components/kubernetes/resultsdb-htpasswd-secret.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: resultsdb-htpasswd
+stringData:
+  .htpasswd: |-
+    resultsdb:$2y$10$brWuGvjH7V6xDz0gwas.QuJst5hQAFz0KhQmvuZ5Q8rcOsRnJalxy
diff --git a/operator/config/manager/kustomization.yaml b/operator/config/manager/kustomization.yaml
index 2bcd3ee..fddb4e0 100644
--- a/operator/config/manager/kustomization.yaml
+++ b/operator/config/manager/kustomization.yaml
@@ -5,6 +5,12 @@ generatorOptions:
   disableNameSuffixHash: true
 
 configMapGenerator:
-- name: manager-config
-  files:
+- files:
   - controller_manager_config.yaml
+  name: manager-config
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+images:
+- name: controller
+  newName: quay.io/fedora-kube-sig/gating-services-operator
+  newTag: latest
diff --git a/operator/config/samples/gating_v1alpha1_resultsdb.yaml b/operator/config/samples/gating_v1alpha1_resultsdb.yaml
index 63e1593..a83f480 100644
--- a/operator/config/samples/gating_v1alpha1_resultsdb.yaml
+++ b/operator/config/samples/gating_v1alpha1_resultsdb.yaml
@@ -3,6 +3,7 @@ kind: ResultsDB
 metadata:
   name: sample
 spec:
+  replicas: 1
   image: quay.io/fedora-kube-sig/resultsdb:latest
   psql_secret_ref: postgres
-  replicas: 1
+  htpasswd_secret_ref: resultsdb-htpasswd
diff --git a/operator/molecule/default/converge.yml b/operator/molecule/default/converge.yml
index 7e91da8..40a9ab1 100644
--- a/operator/molecule/default/converge.yml
+++ b/operator/molecule/default/converge.yml
@@ -24,6 +24,13 @@
         - 1-deployment.yaml
         - 2-service.yaml
 
+    - name: Create resultsdb htpasswd secret
+      k8s:
+        src: "{{ components_dir }}/kubernetes/resultsdb-htpasswd-secret.yaml"
+        namespace: "{{ namespace }}"
+        state: present
+        wait: true
+
     - import_tasks: kustomize.yml
       vars:
         state: present
diff --git a/operator/molecule/default/tasks/resultsdb_test.yml b/operator/molecule/default/tasks/resultsdb_test.yml
index 9e0a6da..c69280b 100644
--- a/operator/molecule/default/tasks/resultsdb_test.yml
+++ b/operator/molecule/default/tasks/resultsdb_test.yml
@@ -58,3 +58,64 @@
         that:
           - _k8s_info.resources | length == 1
         fail_msg: Failed to retrieve resultsdb service
+
+- block:
+    - name: Test resultsdb httpd auth
+      command: |-
+        kubectl \
+        get svc/resultsdb-sample-http \
+        -n osdk-test \
+        -o jsonpath='{.spec.clusterIP}' \
+        --kubeconfig {{ kubeconfig }}
+      register: resultsdb_svc_addr
+
+    - name: Do a GET resultsdb request
+      community.docker.docker_container_exec:
+        container: osdk-test-control-plane
+        argv:
+          - curl
+          - -o
+          - /dev/null
+          - -s
+          - -w
+          - "%{http_code}"
+          - http://{{ resultsdb_svc_addr.stdout }}:5001/api/v2.0/groups
+      register: out_get_200
+
+    - name: Do a POST resultsdb request
+      community.docker.docker_container_exec:
+        container: osdk-test-control-plane
+        argv:
+          - curl
+          - -X
+          - POST
+          - -o
+          - /dev/null
+          - -s
+          - -w
+          - "%{http_code}"
+          - http://{{ resultsdb_svc_addr.stdout }}:5001/api/v2.0/groups
+      register: out_post_401
+    - name: Do a POST resultsdb request
+      community.docker.docker_container_exec:
+        container: osdk-test-control-plane
+        argv:
+          - curl
+          - -X
+          - POST
+          - --user
+          - 'resultsdb:resultsdb'
+          - -o
+          - /dev/null
+          - -s
+          - -w
+          - "%{http_code}"
+          - http://{{ resultsdb_svc_addr.stdout }}:5001/api/v2.0/groups
+      register: out_post_201
+
+    - name: Assert resultsdb requests
+      assert:
+        that:
+          - "out_get_200.stdout == '200'"
+          - "out_post_401.stdout == '401'"
+          - "out_post_201.stdout == '201'"
diff --git a/operator/molecule/kind/molecule.yml b/operator/molecule/kind/molecule.yml
index 64357f9..4387f9f 100644
--- a/operator/molecule/kind/molecule.yml
+++ b/operator/molecule/kind/molecule.yml
@@ -1,6 +1,8 @@
 ---
 dependency:
   name: galaxy
+  options:
+    requirements-file: molecule/requirements.yml
 driver:
   name: delegated
 lint: |
diff --git a/operator/molecule/requirements.yml b/operator/molecule/requirements.yml
new file mode 100644
index 0000000..0c3270e
--- /dev/null
+++ b/operator/molecule/requirements.yml
@@ -0,0 +1,4 @@
+---
+collections:
+  - name: community.docker
+    version: "2.1.1"
diff --git a/operator/roles/resultsdb/defaults/main.yml b/operator/roles/resultsdb/defaults/main.yml
index 0141eac..59a8e97 100644
--- a/operator/roles/resultsdb/defaults/main.yml
+++ b/operator/roles/resultsdb/defaults/main.yml
@@ -4,3 +4,4 @@ resultsdb_image: "{{ image | default('quay.io/fedora-kube-sig/resultsdb:latest')
 resultsdb_psql_secret_ref: "{{ psql_secret_ref | default('resultsdb-psql') }}"
 resultsdb_replicas: "{{ replicas | default(1) | int }}"
 resultsdb_secret_key: "{{ secret_key | default('12345') }}"
+resultsdb_htpasswd_secret_ref: "{{  htpasswd_secret_ref | default('resultsdb-htpasswd') }}"
diff --git a/operator/roles/resultsdb/tasks/main.yml b/operator/roles/resultsdb/tasks/main.yml
index 465e411..9d45350 100644
--- a/operator/roles/resultsdb/tasks/main.yml
+++ b/operator/roles/resultsdb/tasks/main.yml
@@ -9,9 +9,20 @@
   register: _k8s_info_psql
   failed_when: "_k8s_info_psql.resources | length == 0"
 
-- name: Set psql secret variable
+- name: Check if htpasswd secret exists
+  community.kubernetes.k8s_info:
+    api_version: v1
+    kind: Secret
+    name: "{{ resultsdb_htpasswd_secret_ref }}"
+    namespace: "{{ ansible_operator_meta.namespace }}"
+  register: _k8s_info_htpasswd
+  failed_when: "_k8s_info_htpasswd.resources | length == 0"
+
+
+- name: Set k8s_info secret variables
   set_fact:
     resultsdb_psql_info: "{{ _k8s_info_psql.resources[0] }}"
+    resultsdb_htpasswd_info: "{{ _k8s_info_htpasswd.resources[0] }}"
 
 - name: Apply resultsdb app secret
   community.kubernetes.k8s:
@@ -25,6 +36,12 @@
     resultsdb_psql_port: "{{ resultsdb_psql_info.data['POSTGRES_PORT'] | b64decode }}"
     resultsdb_psql_db: "{{ resultsdb_psql_info.data['POSTGRES_DB'] | b64decode  }}"
 
+- name: Apply resultsdb httpd configmap
+  community.kubernetes.k8s:
+    state: present
+    wait: true
+    definition: "{{ lookup('template', 'configmap-httpd.yaml') }}"
+
 - name: Apply resultsdb deployment
   community.kubernetes.k8s:
     state: present
diff --git a/operator/roles/resultsdb/templates/configmap-httpd.yaml b/operator/roles/resultsdb/templates/configmap-httpd.yaml
index 522a28a..3347276 100644
--- a/operator/roles/resultsdb/templates/configmap-httpd.yaml
+++ b/operator/roles/resultsdb/templates/configmap-httpd.yaml
@@ -21,7 +21,7 @@ data:
       AuthType Basic
       AuthName "Authentication Required"
       AuthBasicProvider file
-      AuthUserFile "/etc/resultsdb/.htpasswd"
+      AuthUserFile "/etc/httpd/auth/.htpasswd"
       <LimitExcept GET>
         Require valid-user
       </LimitExcept>
diff --git a/operator/roles/resultsdb/templates/deployment.yaml b/operator/roles/resultsdb/templates/deployment.yaml
index dddaa92..cbbf784 100644
--- a/operator/roles/resultsdb/templates/deployment.yaml
+++ b/operator/roles/resultsdb/templates/deployment.yaml
@@ -58,7 +58,19 @@ spec:
             - name: config-volume
               mountPath: /etc/resultsdb
               readOnly: true
+            - name: htpasswd-volume
+              mountPath: /etc/httpd/auth
+              readOnly: true
+            - name: httpd-config
+              mountPath: /etc/httpd/conf.d
+              readOnly: true
       volumes:
         - name: config-volume
           secret:
             secretName: resultsdb-{{ ansible_operator_meta.name }}-config
+        - name: htpasswd-volume
+          secret:
+            secretName: {{ resultsdb_htpasswd_secret_ref }}
+        - name: httpd-config
+          configMap:
+            name: resultsdb-{{ ansible_operator_meta.name }}-httpd-config