Candlepin configurability

Today we configure Candlepin in a rather low level way using an ansible role. It places entire configuration files in the container as secrets. This means it limits us in upgrading: if something in the config file changes, it either hard breaks or we need to manage it very carefully.

I'm proposing we define formal options in the container itself. Probably README though perhaps there are more container native ways.

A general technique I'd advocating is that we put as much as possible in the container itself. All config files must be written in the container building process. Things that need to be changeable for every host should be explicitly described. If we need to write this into a config file, we can write start up wrappers that modify config files (ini, xml, json, whatever) as needed before starting the real process.

main

This is an analysis of https://github.com/theforeman/foreman-quadlet/blob/master/roles/candlepin/tasks/main.yml.

candlepin.conf

https://github.com/theforeman/foreman-quadlet/blob/177348fc149e74a4adb6680cb239181f16cf8476/roles/candlepin/tasks/main.yml#L17-L24

This is the main candlepin file. It contains 3 configurable options: candlepin.auth.oauth.consumer.katello.secret and the PostgreSQL URL (via jpa.config.hibernate.connection.url and org.quartz.dataSource.myDS.URL). It also has the DB password (,jpa.config.hibernate.connection.passwordandorg.quartz.dataSource.myDS.password`) but I wonder if we can't put that in the DB URL itself to simplify matters. Notably, it doesn't allow changing the username which may be required in some managed environments. Again, perhaps that can be put in the DB URL.

Candlepin uses https://github.com/smallrye/smallrye-config/blob/main/documentation/src/main/docs/config/environment-variables.md so you can use CANDLEPIN_AUTH_OAUTH_CONSUMER_KATELLO_SECRET instead of candlepin.auth.oauth.consumer.katello.secret. This means we don't need to write it out in the file itself.

server.xml

This is the Tomcat server XML file. It's important to keep this limited because if we change the container from Tomcat X to X+1 it may be completely different. We may even change the application server completely.

https://github.com/theforeman/foreman-quadlet/blob/177348fc149e74a4adb6680cb239181f16cf8476/roles/candlepin/tasks/main.yml#L26-L33

This really only has the <Connector> as configurable:
https://github.com/theforeman/foreman-quadlet/blob/177348fc149e74a4adb6680cb239181f16cf8476/roles/candlepin/templates/server.xml.j2#L70-L82

• port: IMHO can be hardcoded and explicitly defined in Containerfile as a Port statement. We can remap this as needed from the host.
• address: This is a tricky one. I don't think it's technically needed since it's mostly used for multiple hosts on the same Tomcat, but it might provide additional protection against DNS rebind attacks. Given we only listen on the host itself and don't expose it, this brings little security.
• sslProtocol, sslEnabledProtocols and ciphers: I've been wondering if the crypto-policies already provides this functionality for us. In /etc/crypto-policies/back-ends/java.config it provides properties jdk.certpath.disabledAlgorithms, jdk.tls.disabledAlgorithms, jdk.disabled.namedCurves and jdk.tls.legacyAlgorithms. Looking at /etc/crypto-policies/state/CURRENT.pol I see cipher@java-tls and protocol@java-tls. It would be great if we can experiment with this to see if we can avoid listing them. Specifically for the protocols: I'd expect today it to enable only TLSv1.2 and possibly TLSv1.3 out of the box. Perhaps we can leave it out until we explicitly want more control again or even hardcode it.
• keystorePass: I find https://tomcat.apache.org/tomcat-9.0-doc/config/http.html hard to understand, but if it is indeed an alias to certificateKeyPassword then we can switch to certificateKeyPasswordFile and make the "API" to provide a password file in a fixed location, just like keystoreFile is already hardcoded.

tomcat.conf

https://github.com/theforeman/foreman-quadlet/blob/177348fc149e74a4adb6680cb239181f16cf8476/roles/candlepin/tasks/main.yml#L35-L42

This is a shell file. Doesn't contain any variables now. Probably better to not template it at all. Modern tomcat (at least on EL9) also loads /etc/tomcat/conf.d/*.conf so my suggestion is to only place specific overrides we have (JAVA_HOME and JAVA_OPTS) in /etc/tomcat/conf.d/java.conf using Containerfile. If we want something specific to be overrideable I'd propose environment variables clearly documented in the README.

Artemis

This is an analysis of https://github.com/theforeman/foreman-quadlet/blob/master/roles/candlepin/tasks/artemis.yml

broker.xml

https://github.com/theforeman/foreman-quadlet/blob/177348fc149e74a4adb6680cb239181f16cf8476/roles/candlepin/tasks/artemis.yml#L11-L18

Only contains the keystore password. Perhaps this understands a keyStorePasswordFile directive and similar to server.xml we can make the API to expose the password in a predetermined file.

We need to expose the mentioned port (61613) in Containerfile as something that external services (Katello) can connect to.

login.conf

https://github.com/theforeman/foreman-quadlet/blob/177348fc149e74a4adb6680cb239181f16cf8476/roles/candlepin/tasks/artemis.yml#L20-L27

This is a static file without variables. Trivial to move to Containerfile.

jaas.conf

For reference, documented in https://activemq.apache.org/components/artemis/documentation/latest/security.html#user-credentials.

https://github.com/theforeman/foreman-quadlet/blob/177348fc149e74a4adb6680cb239181f16cf8476/roles/candlepin/tasks/artemis.yml#L29-L36

This is a static file without variables. Trivial to move to Containerfile.

cert-roles.properties

https://github.com/theforeman/foreman-quadlet/blob/177348fc149e74a4adb6680cb239181f16cf8476/roles/candlepin/tasks/artemis.yml#L38-L45

This is a static file without variables. Trivial to move to Containerfile.

cert-users.properties

https://github.com/theforeman/foreman-quadlet/blob/177348fc149e74a4adb6680cb239181f16cf8476/roles/candlepin/tasks/artemis.yml#L47-L54

Containers a mapping of katelloUser to some candlepin_artemis_client_dn. That value (only the DN) is something we IMHO something we can provide via a secret or environment variable and configure on start up.

Certificates

We should document in README where we expect certain files to be and what content is expected in it. That way we can also investigate validators to detect misconfigurations.

Start with roles/candlepin/tasks/main.yml and the referenced server.xml.j2 template, then review the Candlepin and Artemis configuration files listed in the issue. Identify which values must remain host-configurable and which static files can move into the Containerfile. Done means the container exposes a documented, stable configuration interface and README explains required certificate files and settings.