Launchpad itself

Merge ~pelpsi/launchpad:pass-information-via-XML-RPC-API-to-the-builders into launchpad:master

  1. Git
  2. lp:~pelpsi/launchpad
  3. pass-information-via-XML-RPC-API-to-the-builders
  4. Merge into master
Proposed by Simone Pelosi
Status: Merged
Approved by: Simone Pelosi
Approved revision: c8a27b7b7e71b80d8454799f0f7f0d1a4d696154
Merge reported by: Otto Co-Pilot
Merged at revision: not available
Proposed branch: ~pelpsi/launchpad:pass-information-via-XML-RPC-API-to-the-builders
Merge into: launchpad:master
Diff against target: 138 lines (+56/-13)
5 files modified
charm/launchpad-buildd-manager/config.yaml (+4/-0)
lib/lp/buildmaster/builderproxy.py (+7/-0)
lib/lp/buildmaster/tests/fetchservice.py (+12/-13)
lib/lp/services/config/schema-lazr.conf (+6/-0)
lib/lp/snappy/tests/test_snapbuildbehaviour.py (+27/-0)
Reviewer Review Type Date Requested Status
Jürgen Gmach Approve
Review via email: mp+464337@code.launchpad.net

Commit message

Pass certificate to the builders

The certificate will be installed on the builders to the fetch service can man in the middle requests.

To post a comment you must log in.
Revision history for this message
Jürgen Gmach (jugmac00) wrote :

Awesome!

I only have a little suggestion for the commit message:

```
Pass certificate to the builders

The certificate will be installed on the builders to the fetch service can man in the middle requests.
```

review: Approve

Preview Diff

[H/L] Next/Prev Comment, [J/K] Next/Prev File, [N/P] Next/Prev Hunk
1diff --git a/charm/launchpad-buildd-manager/config.yaml b/charm/launchpad-buildd-manager/config.yaml
2index caac316..630ce00 100644
3--- a/charm/launchpad-buildd-manager/config.yaml
4+++ b/charm/launchpad-buildd-manager/config.yaml
5@@ -71,6 +71,10 @@ options:
6 Fetch service host, it could be either a single instance
7 or a load balancer in front.
8 default: ""
9+ fetch_service_mitm_certificate:
10+ type: string
11+ description: Fetch service certificate.
12+ default: ""
13 fetch_service_port:
14 type: int
15 description: Fetch service port.
16diff --git a/lib/lp/buildmaster/builderproxy.py b/lib/lp/buildmaster/builderproxy.py
17index 3375042..5f3cf5b 100644
18--- a/lib/lp/buildmaster/builderproxy.py
19+++ b/lib/lp/buildmaster/builderproxy.py
20@@ -82,6 +82,13 @@ class BuilderProxyMixin:
21 session_id=session["id"],
22 )
23
24+ # Append the fetch-service certificate to BuildArgs secrets.
25+ if "secrets" not in args:
26+ args["secrets"] = {}
27+ args["secrets"]["fetch_service_mitm_certificate"] = (
28+ _get_value_from_config("fetch_service_mitm_certificate")
29+ )
30+
31 @defer.inlineCallbacks
32 def _requestProxyToken(self):
33 admin_username = _get_value_from_config(
34diff --git a/lib/lp/buildmaster/tests/fetchservice.py b/lib/lp/buildmaster/tests/fetchservice.py
35index 3fd879c..51f73e3 100644
36--- a/lib/lp/buildmaster/tests/fetchservice.py
37+++ b/lib/lp/buildmaster/tests/fetchservice.py
38@@ -75,19 +75,18 @@ class InProcessFetchServiceAuthAPIFixture(fixtures.Fixture):
39 self.addCleanup(site.stopFactory)
40 port = yield endpoint.listen(site)
41 self.addCleanup(port.stopListening)
42- config.push(
43- "in-process-fetch-service-api-fixture",
44- dedent(
45- """
46- [builddmaster]
47- fetch_service_control_admin_secret: admin-secret
48- fetch_service_control_admin_username: admin-launchpad.test
49- fetch_service_control_endpoint: http://{host}:{port}/session
50- fetch_service_host: {host}
51- fetch_service_port: {port}
52- """
53- ).format(host=port.getHost().host, port=port.getHost().port),
54- )
55+ configs = dedent(
56+ """
57+ [builddmaster]
58+ fetch_service_control_admin_secret: admin-secret
59+ fetch_service_control_admin_username: admin-launchpad.test
60+ fetch_service_control_endpoint: http://{host}:{port}/session
61+ fetch_service_host: {host}
62+ fetch_service_port: {port}
63+ fetch_service_mitm_certificate: fake-cert
64+ """
65+ ).format(host=port.getHost().host, port=port.getHost().port)
66+ config.push("in-process-fetch-service-api-fixture", configs)
67 self.addCleanup(config.pop, "in-process-fetch-service-api-fixture")
68
69
70diff --git a/lib/lp/services/config/schema-lazr.conf b/lib/lp/services/config/schema-lazr.conf
71index 94ca842..07f04c6 100644
72--- a/lib/lp/services/config/schema-lazr.conf
73+++ b/lib/lp/services/config/schema-lazr.conf
74@@ -178,6 +178,9 @@ fetch_service_control_admin_username: none
75 # Endpoint for fetch service authentication service
76 fetch_service_control_endpoint: none
77
78+# Fetch service certificate
79+fetch_service_mitm_certificate: none
80+
81 # Fetch service host, it could be either a single instance
82 # or a load balancer in front
83 fetch_service_host: none
84@@ -1883,6 +1886,9 @@ fetch_service_control_admin_username: none
85 # Endpoint for fetch service control service.
86 fetch_service_control_endpoint: none
87
88+# Fetch service certificate
89+fetch_service_mitm_certificate: none
90+
91 # Fetch service host, it could be either a single instance
92 # or a load balancer in front.
93 fetch_service_host: none
94diff --git a/lib/lp/snappy/tests/test_snapbuildbehaviour.py b/lib/lp/snappy/tests/test_snapbuildbehaviour.py
95index 2ccc18d..d20bf33 100644
96--- a/lib/lp/snappy/tests/test_snapbuildbehaviour.py
97+++ b/lib/lp/snappy/tests/test_snapbuildbehaviour.py
98@@ -303,6 +303,28 @@ class TestAsyncSnapBuildBehaviourFetchService(
99 self.assertNotIn("revocation_endpoint", args)
100
101 @defer.inlineCallbacks
102+ def test_requestFetchServiceSession_no_certificate(self):
103+ """Create a snap build request with an incomplete fetch service
104+ configuration.
105+
106+ If `fetch_service_mitm_certificate` is not provided
107+ the function raises a `CannotBuild` error.
108+ """
109+ self.pushConfig("builddmaster", fetch_service_mitm_certificate=None)
110+ self.useFixture(
111+ FeatureFixture({SNAP_USE_FETCH_SERVICE_FEATURE_FLAG: "on"})
112+ )
113+
114+ snap = self.factory.makeSnap(use_fetch_service=True)
115+ request = self.factory.makeSnapBuildRequest(snap=snap)
116+ job = self.makeJob(snap=snap, build_request=request)
117+ expected_exception_msg = (
118+ "fetch_service_mitm_certificate is not configured."
119+ )
120+ with ExpectedException(CannotBuild, expected_exception_msg):
121+ yield job.extraBuildArgs()
122+
123+ @defer.inlineCallbacks
124 def test_requestFetchServiceSession_no_secret(self):
125 """Create a snap build request with an incomplete fetch service
126 configuration.
127@@ -379,6 +401,11 @@ class TestAsyncSnapBuildBehaviourFetchService(
128 )
129 self.assertIn("proxy_url", args)
130 self.assertIn("revocation_endpoint", args)
131+ self.assertIn("secrets", args)
132+ self.assertIn("fetch_service_mitm_certificate", args["secrets"])
133+ self.assertIn(
134+ "fake-cert", args["secrets"]["fetch_service_mitm_certificate"]
135+ )
136
137 @defer.inlineCallbacks
138 def test_requestFetchServiceSession_flag_off(self):

Subscribers

People subscribed via source and target branches

to status/vote changes: