Merge branch 'master' into adjust_kafka_sasl_settings

RedHatInsights · Oct 2, 2023 · 85728f9 · 85728f9
2 parents 09ac653 + 03271a5
commit 85728f9
Show file tree

Hide file tree

Showing 5 changed files with 27 additions and 20 deletions.
diff --git a/build_deploy.sh b/build_deploy.sh
@@ -4,6 +4,7 @@ set -exv
 
 IMAGE="quay.io/cloudservices/insights-ingress"
 IMAGE_TAG=$(git rev-parse --short=7 HEAD)
+SECURITY_COMPLIANCE_TAG="sc-$(date +%Y%m%d)-$(git rev-parse --short=7 HEAD)"
 
 if [[ -z "$QUAY_USER" || -z "$QUAY_TOKEN" ]]; then
     echo "QUAY_USER and QUAY_TOKEN must be set"
@@ -21,7 +22,13 @@ docker --config="$DOCKER_CONF" login -u="$QUAY_USER" -p="$QUAY_TOKEN" quay.io
 docker --config="$DOCKER_CONF" login -u="$RH_REGISTRY_USER" -p="$RH_REGISTRY_TOKEN" registry.redhat.io
 docker --config="$DOCKER_CONF" build -t "${IMAGE}:${IMAGE_TAG}" .
 docker --config="$DOCKER_CONF" push "${IMAGE}:${IMAGE_TAG}"
-docker --config="$DOCKER_CONF" tag "${IMAGE}:${IMAGE_TAG}" "${IMAGE}:qa"
-docker --config="$DOCKER_CONF" push "${IMAGE}:qa"
-docker --config="$DOCKER_CONF" tag "${IMAGE}:${IMAGE_TAG}" "${IMAGE}:latest"
-docker --config="$DOCKER_CONF" push "${IMAGE}:latest"
+
+if [[ $GIT_BRANCH == *"security-compliance"* ]]; then
+    docker --config="$DOCKER_CONF" tag "${IMAGE}:${IMAGE_TAG}" "${IMAGE}:${SECURITY_COMPLIANCE_TAG}"
+    docker --config="$DOCKER_CONF" push "${IMAGE}:${SECURITY_COMPLIANCE_TAG}"
+else
+    docker --config="$DOCKER_CONF" tag "${IMAGE}:${IMAGE_TAG}" "${IMAGE}:qa"
+    docker --config="$DOCKER_CONF" push "${IMAGE}:qa"
+    docker --config="$DOCKER_CONF" tag "${IMAGE}:${IMAGE_TAG}" "${IMAGE}:latest"
+    docker --config="$DOCKER_CONF" push "${IMAGE}:latest"
+fi
diff --git a/deploy/clowdapp.yaml b/deploy/clowdapp.yaml
@@ -62,8 +62,8 @@ objects:
           value: ${CLOWDER_ENABLED}
         - name: INGRESS_MINIOENDPOINT
           value: ${INGRESS_MINIOENDPOINT}
-        - name: INGRESS_BLACK_LISTED_ORGIDS
-          value: ${INGRESS_BLACK_LISTED_ORGIDS}
+        - name: INGRESS_DENY_LISTED_ORGIDS
+          value: ${INGRESS_DENY_LISTED_ORGIDS}
         - name: SSL_CERT_DIR
           value: ${SSL_CERT_DIR}
         resources:
@@ -131,7 +131,7 @@ parameters:
   name: ENV_NAME
   value: "insights-ingress"
   required: true
-- name: INGRESS_BLACK_LISTED_ORGIDS
+- name: INGRESS_DENY_LISTED_ORGIDS
   value: ""
 - name: SSL_CERT_DIR
   value: '/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts:/cdapp/certs'
diff --git a/internal/config/config.go b/internal/config/config.go
@@ -31,7 +31,7 @@ type IngressConfig struct {
 	TlsCAPath            string
 	StorageConfig        StorageCfg
 	LoggingConfig        LoggingCfg
-	BlackListedOrgIDs    []string
+	DenyListedOrgIDs    []string
 	Debug                bool
 	DebugUserAgent       *regexp.Regexp
 }
@@ -110,7 +110,7 @@ func Get() *IngressConfig {
 	options.SetDefault("OpenshiftBuildCommit", "notrunninginopenshift")
 	options.SetDefault("Valid_Upload_Types", "unit,announce")
 	options.SetDefault("Profile", false)
-	options.SetDefault("Black_Listed_OrgIDs", []string{})
+	options.SetDefault("Deny_Listed_OrgIDs", []string{})
 	options.SetDefault("Debug", false)
 	options.SetDefault("DebugUserAgent", `unspecified`)
 	options.SetEnvPrefix("INGRESS")
@@ -208,7 +208,7 @@ func Get() *IngressConfig {
 		PayloadTrackerURL:    options.GetString("PayloadTrackerURL"),
 		TlsCAPath:            options.GetString("TlsCAPath"),
 		Profile:              options.GetBool("Profile"),
-		BlackListedOrgIDs:    options.GetStringSlice("Black_Listed_OrgIDs"),
+		DenyListedOrgIDs:    options.GetStringSlice("Deny_Listed_OrgIDs"),
 		Debug:                options.GetBool("Debug"),
 		DebugUserAgent:       regexp.MustCompile(options.GetString("DebugUserAgent")),
 		KafkaConfig: KafkaCfg{

diff --git a/internal/upload/upload.go b/internal/upload/upload.go
@@ -144,7 +144,7 @@ func NewHandler(
 	tracker announcers.Announcer,
 	cfg config.IngressConfig) http.HandlerFunc {
 
-	isCustomerBlackListed := isRequestFromBlackListedOrgID(cfg)
+	isCustomerDenyListed := isRequestFromDenyListedOrgID(cfg)
 
 	return func(w http.ResponseWriter, r *http.Request) {
 		var id identity.XRHID
@@ -178,10 +178,10 @@ func NewHandler(
 			id.Identity.OrgID = id.Identity.Internal.OrgID
 		}
 
-		if isCustomerBlackListed(id) {
+		if isCustomerDenyListed(id) {
 			w.WriteHeader(http.StatusForbidden)
 			w.Write([]byte("Upload denied. Please contact Red Hat Support."))
-			requestLogger.WithFields(logrus.Fields{"account": id.Identity.AccountNumber, "org_id": id.Identity.OrgID}).Info("Upload rejected due to customer being blacklisted")
+			requestLogger.WithFields(logrus.Fields{"account": id.Identity.AccountNumber, "org_id": id.Identity.OrgID}).Info("Upload rejected due to customer being denylisted")
 			return
 		}
 
@@ -330,15 +330,15 @@ func NewHandler(
 	}
 }
 
-func isRequestFromBlackListedOrgID(cfg config.IngressConfig) func(identity.XRHID) bool {
+func isRequestFromDenyListedOrgID(cfg config.IngressConfig) func(identity.XRHID) bool {
 
-	blackListedOrgIDs := make(map[string]bool)
-	for _, orgID := range cfg.BlackListedOrgIDs {
-		blackListedOrgIDs[orgID] = true
+	denyListedOrgIDs := make(map[string]bool)
+	for _, orgID := range cfg.DenyListedOrgIDs {
+		denyListedOrgIDs[orgID] = true
 	}
 
 	return func(id identity.XRHID) bool {
-		_, blackListed := blackListedOrgIDs[id.Identity.OrgID]
-		return blackListed
+		_, denyListed := denyListedOrgIDs[id.Identity.OrgID]
+		return denyListed
 	}
 }
diff --git a/internal/upload/upload_test.go b/internal/upload/upload_test.go
@@ -439,7 +439,7 @@ var _ = Describe("Upload", func() {
 		Context("with a denied orgID", func() {
 			It("should return 403", func() {
 				cfg := config.Get()
-				cfg.BlackListedOrgIDs = []string{"12345"}
+				cfg.DenyListedOrgIDs = []string{"12345"}
 				handler = NewHandler(stager, validator, tracker, *cfg)
 				boiler(http.StatusForbidden, &FilePart{
 					Name:        "file",