Using the new options for image-scanning options

app/models/manageiq/providers/kubernetes/container_manager.rb

@@ -14,6 +14,7 @@ class ManageIQ::Providers::Kubernetes::ContainerManager < ManageIQ::Providers::C
  require_nested :Scanning
 
  include ManageIQ::Providers::Kubernetes::ContainerManagerMixin
+ include ManageIQ::Providers::Kubernetes::ContainerManager::Options
 
  # See HasMonitoringManagerMixin
  has_one :monitoring_manager,

app/models/manageiq/providers/kubernetes/container_manager/options.rb

@@ -0,0 +1,75 @@
+module ManageIQ::Providers::Kubernetes::ContainerManager::Options
+ extend ActiveSupport::Concern
+
+ module ClassMethods
+ def proxy_settings
+ {
+ :http_proxy => {
+ :label => N_('HTTP Proxy'),
+ :help_text => N_('HTTP Proxy to connect ManageIQ to the provider. example: http://user:password@my_https_proxy'),
+ :global_default => VMDB::Util.http_proxy_uri,
+ },
+ }
+ end
+
+ def advanced_settings
+ {
+ :image_inspector_options => {
+ :label => N_('Image Inspector Options'),
+ :help_text => N_('Settings for Image Inspector tool'),
+ :settings => {
+ :http_proxy => {
+ :label => N_('HTTP Proxy'),
+ :help_text => N_('HTTP Proxy to connect image inspector pods to the internet. example: http://user:password@my_https_proxy'),
+ },
+ :https_proxy => {
+ :label => N_('HTTPS Proxy'),
+ :help_text => N_('HTTPS Proxy to connect image inspector pods to the internet. example: https://user:password@my_https_proxy'),
+ },
+ :no_proxy => {
+ :label => N_('NO Proxy'),
+ :help_text => N_('NO Proxy lists urls that should\'nt be sent to any proxy. example: my_file_server.org'),
+ },
+ :repository => {
+ :label => N_('Image-Inspector Repository'),
+ :help_text => N_('Image-Inspector Repository. example: openshift/image-inspector'),
+ :global_default => Settings.ems.ems_kubernetes.image_inspector_repository,
+ },
+ :registry => {
+ :label => N_('Image-Inspector Registry'),
+ :help_text => N_('Registry to provide the image inspector repository. example: docker.io'),
+ :global_default => Settings.ems.ems_kubernetes.image_inspector_registry,
+ },
+ :image_tag => {
+ :label => N_('Image-Inspector Tag'),
+ :help_text => N_('Image-Inspector image tag. example: 2.1'),
+ :global_default => ManageIQ::Providers::Kubernetes::ContainerManager::Scanning::Job::INSPECTOR_IMAGE_TAG,
+ },
+ :cve_url => {
+ :label => N_('CVE location'),
+ :help_text => N_('Enables defining a URL path prefix for XCCDF file instead of accessing the default location.
+ example: http://my_file_server.org:3333/xccdf_files/
+ Expecting to find com.redhat.rhsa-RHEL7.ds.xml.bz2 file there.'),
+ # Future versions of image inspector will extend this.
+ },
+ }
+ }
+ }
+ end
+
+ def provider_settings
+ {
+ :proxy_settings => {
+ :label => N_('Proxy Settings'),
+ :help_text => N_('Proxy Settings for connection to the provider'),
+ :settings => proxy_settings,
+ },
+ :advanced_settings => {
+ :label => N_('Advanced Settings'),
+ :help_text => N_('Advanced Settings for provider configuration'),
+ :settings => advanced_settings,
+ }
+ }
+ end
+ end
+end

app/models/manageiq/providers/kubernetes/container_manager/scanning/job.rb

@@ -13,7 +13,6 @@ class ManageIQ::Providers::Kubernetes::ContainerManager::Scanning::Job < Job
  ERRCODE_NOTFOUND = 404
  IMAGE_INSPECTOR_SA = 'inspector-admin'
  INSPECTOR_ADMIN_SECRET_PATH = '/var/run/secrets/kubernetes.io/inspector-admin-secret-'
- ATTRIBUTE_SECTION = 'cluster_settings'
  PROXY_ENV_VARIABLES = %w(no_proxy http_proxy https_proxy)
 
  def load_transitions
@@ -347,6 +346,10 @@ def inspector_admin_secret
  return nil
  end
 
+ def ems_image_inspector_options
+ @provider_options ||= ext_management_system.options.try(:fetch_path, :image_inspector_options) || {}
+ end
+
  def pod_definition(inspector_admin_secret_name)
  pod_def = {
  :apiVersion => "v1",
@@ -409,6 +412,7 @@ def pod_definition(inspector_admin_secret_name)
  }
 
  add_secret_to_pod_def(pod_def, inspector_admin_secret_name) unless inspector_admin_secret_name.blank?
+ add_cve_url(pod_def)
  Kubeclient::Resource.new(pod_def)
  end
 
@@ -425,17 +429,24 @@ def add_secret_to_pod_def(pod_def, inspector_admin_secret_name)
  end
 
  def inspector_image
- registry = ::Settings.ems.ems_kubernetes.image_inspector_registry
- repo = ::Settings.ems.ems_kubernetes.image_inspector_repository
- "#{registry}/#{repo}:#{INSPECTOR_IMAGE_TAG}"
+ registry = ems_image_inspector_options.fetch_path(:registry) || ::Settings.ems.ems_kubernetes.image_inspector_registry
+ repo = ems_image_inspector_options.fetch_path(:repository) || ::Settings.ems.ems_kubernetes.image_inspector_repository
+ tag = ems_image_inspector_options.fetch_path(:image_tag) || INSPECTOR_IMAGE_TAG
+ "#{registry}/#{repo}:#{tag}"
  end
 
  def inspector_proxy_env_variables
- settings = ext_management_system.custom_attributes
- settings.where(:section => ATTRIBUTE_SECTION,
- :name => PROXY_ENV_VARIABLES).each_with_object([]) do |att, env|
- env << {:name => att.name.upcase,
- :value => att.value} unless att.value.blank?
+ PROXY_ENV_VARIABLES.each_with_object([]) do |var_name, env|
+ next unless ems_image_inspector_options.key?(var_name.to_sym)
+ var_value = ems_image_inspector_options[var_name.to_sym]
+ env << {:name => var_name.upcase,
+ :value => var_value}
+ end
+ end
+
+ def add_cve_url(pod_def)
+ if ems_image_inspector_options.key?(:cve_url)
+ pod_def[:spec][:containers][0][:command].append("--cve-url=#{ems_image_inspector_options[:cve_url]}")
  end
  end
 end

app/models/manageiq/providers/kubernetes/container_manager_mixin.rb

@@ -42,7 +42,7 @@ def kubernetes_connect(hostname, port, options)
  options[:version] || kubernetes_version,
  :ssl_options => Kubeclient::Client::DEFAULT_SSL_OPTIONS.merge(options[:ssl_options] || {}),
  :auth_options => kubernetes_auth_options(options),
- :http_proxy_uri => VMDB::Util.http_proxy_uri,
+ :http_proxy_uri => options[:http_proxy] || VMDB::Util.http_proxy_uri,
  :timeouts => {
  :open => Settings.ems.ems_kubernetes.open_timeout.to_f_with_method,
  :read => Settings.ems.ems_kubernetes.read_timeout.to_f_with_method
@@ -108,11 +108,12 @@ def ssl_cert_store(endpoint = default_endpoint)
 
  def connect(options = {})
  effective_options = options.merge(
- :hostname => options[:hostname] || address,
- :port => options[:port] || port,
- :user => options[:user] || authentication_userid(options[:auth_type]),
- :pass => options[:pass] || authentication_password(options[:auth_type]),
- :bearer => options[:bearer] || authentication_token(options[:auth_type] || 'bearer'),
+ :hostname => options[:hostname] || address,
+ :port => options[:port] || port,
+ :user => options[:user] || authentication_userid(options[:auth_type]),
+ :pass => options[:pass] || authentication_password(options[:auth_type]),
+ :bearer => options[:bearer] || authentication_token(options[:auth_type] || 'bearer'),
+ :http_proxy => self.options ? self.options.fetch_path(:proxy_settings, :http_proxy) : nil,
  :ssl_options => options[:ssl_options] || {
  :verify_ssl => verify_ssl_mode,
  :cert_store => ssl_cert_store

spec/models/manageiq/providers/kubernetes/container_manager/scanning/job_spec.rb

@@ -190,18 +190,30 @@ def fetch_oscap_arf
  end
  end
 
- it 'should add correct environment variables' do
- att_name = 'http_proxy'
- my_value = "MY_TEST_VALUE"
- @ems.custom_attributes.create(:section => described_class::ATTRIBUTE_SECTION,
- :name => att_name,
- :value => my_value)
- allow_any_instance_of(described_class).to receive_messages(:kubernetes_client => MockKubeClient.new)
- kc = @job.kubernetes_client
- secret_name = kc.get_service_account[:imagePullSecrets][0][:name]
- pod = @job.send(:pod_definition, secret_name)
- expect(pod[:spec][:containers][0][:env][0][:name]).to eq(att_name.upcase)
- expect(pod[:spec][:containers][0][:env][0][:value]).to eq(my_value)
+ context "using provider options" do
+ def create_pod_definition
+ allow_any_instance_of(described_class).to receive_messages(:kubernetes_client => MockKubeClient.new)
+ kc = @job.kubernetes_client
+ secret_name = kc.get_service_account[:imagePullSecrets][0][:name]
+ @job.send(:pod_definition, secret_name)
+ end
+
+ it 'should add correct environment variables from options' do
+ att_name = 'http_proxy'
+ my_value = "MY_TEST_VALUE"
+ @ems.update(:options => { :image_inspector_options => {att_name.to_sym => my_value} })
+ pod = create_pod_definition
+ expect(pod[:spec][:containers][0][:env][0][:name]).to eq(att_name.upcase)
+ expect(pod[:spec][:containers][0][:env][0][:value]).to eq(my_value)
+ end
+
+ it 'should send cve_url from options' do
+ cve_url_value = "get_cve_from_here.com"
+ @ems.update(:options => { :image_inspector_options => {:cve_url => cve_url_value} })
+ pod = create_pod_definition
+ expect(pod[:spec][:containers][0][:command]
+ .select { |cmd| cmd.starts_with?("--cve-url=") }.first.split('=').last).to eq(cve_url_value)
+ end
  end
 
  it 'should send correct dockercfg secrets' do

spec/models/manageiq/providers/kubernetes/container_manager_spec.rb

@@ -172,6 +172,25 @@
  )
  described_class.raw_connect(hostname, port, options)
  end
+
+ it "connect uses provider options for http_proxy" do
+ allow(VMDB::Util).to receive(:http_proxy_uri).and_return(URI::HTTP.build(:host => "some"))
+ require 'kubeclient'
+ my_proxy_value = "internal_proxy.org"
+ expect(Kubeclient::Client).to receive(:new).with(
+ instance_of(URI::HTTPS), 'v1',
+ hash_including(:http_proxy_uri => my_proxy_value)
+ )
+ ems = FactoryGirl.create(
+ :ems_kubernetes,
+ :endpoints => [
+ FactoryGirl.create(:endpoint, :role => 'default', :hostname => 'host'),
+ FactoryGirl.create(:endpoint, :role => 'prometheus_alerts', :hostname => 'host2'),
+ ]
+ )
+ ems.update(:options => {:proxy_settings => {:http_proxy => my_proxy_value}})
+ ems.connect
+ end
  end
 
  # Test MonitoringManager functionality related to ContainerManager