def update_cyberark_aim_name(apps, schema_editor): CredentialType.setup_tower_managed_defaults(apps) aim_types = apps.get_model('main', 'CredentialType').objects.filter(namespace='aim').order_by('id') if aim_types.count() == 2: original, renamed = aim_types.all() apps.get_model('main', 'Credential').objects.filter(credential_type_id=original.id).update(credential_type_id=renamed.id) original.delete()
def test_idempotent_credential_type_setup(): assert CredentialType.objects.count() == 0 CredentialType.setup_tower_managed_defaults() total = CredentialType.objects.count() assert total > 0 CredentialType.setup_tower_managed_defaults() assert CredentialType.objects.count() == total
def test_credential_defaults_idempotency(): CredentialType.setup_tower_managed_defaults() old_inputs = CredentialType.objects.get(name='Ansible Tower', kind='cloud').inputs prior_count = ActivityStream.objects.count() # this is commonly re-ran in migrations, and no changes should be shown # because inputs and injectors are not actually tracked in the database CredentialType.setup_tower_managed_defaults() assert CredentialType.objects.get(name='Ansible Tower', kind='cloud').inputs == old_inputs assert ActivityStream.objects.count() == prior_count
def setup_tower_managed_defaults(apps, schema_editor): set_current_apps(apps) CredentialType.setup_tower_managed_defaults()
def migrate_galaxy_settings(apps, schema_editor): Organization = apps.get_model('main', 'Organization') if Organization.objects.count() == 0: # nothing to migrate return set_current_apps(apps) ModernCredentialType.setup_tower_managed_defaults(apps) CredentialType = apps.get_model('main', 'CredentialType') Credential = apps.get_model('main', 'Credential') Setting = apps.get_model('conf', 'Setting') galaxy_type = CredentialType.objects.get(kind='galaxy') private_galaxy_url = Setting.objects.filter( key='PRIMARY_GALAXY_URL').first() # by default, prior versions of AWX automatically pulled content # from galaxy.ansible.com public_galaxy_enabled = True public_galaxy_setting = Setting.objects.filter( key='PUBLIC_GALAXY_ENABLED').first() if public_galaxy_setting and public_galaxy_setting.value is False: # ...UNLESS this behavior was explicitly disabled via this setting public_galaxy_enabled = False try: # Needed for old migrations public_galaxy_credential = Credential( created=now(), modified=now(), name='Ansible Galaxy', managed_by_tower=True, credential_type=galaxy_type, inputs={'url': 'https://galaxy.ansible.com/'}, ) except: # Needed for new migrations, tests public_galaxy_credential = Credential( created=now(), modified=now(), name='Ansible Galaxy', managed=True, credential_type=galaxy_type, inputs={'url': 'https://galaxy.ansible.com/'}) public_galaxy_credential.save() for org in Organization.objects.all(): if private_galaxy_url and private_galaxy_url.value: # If a setting exists for a private Galaxy URL, make a credential for it username = Setting.objects.filter( key='PRIMARY_GALAXY_USERNAME').first() password = Setting.objects.filter( key='PRIMARY_GALAXY_PASSWORD').first() if (username and username.value) or (password and password.value): logger.error( f'Specifying HTTP basic auth for the Ansible Galaxy API ' f'({private_galaxy_url.value}) is no longer supported. ' 'Please provide an API token instead after your upgrade ' 'has completed', ) inputs = {'url': private_galaxy_url.value} token = Setting.objects.filter(key='PRIMARY_GALAXY_TOKEN').first() if token and token.value: inputs['token'] = decrypt_field(token, 'value') auth_url = Setting.objects.filter( key='PRIMARY_GALAXY_AUTH_URL').first() if auth_url and auth_url.value: inputs['auth_url'] = auth_url.value name = f'Private Galaxy ({private_galaxy_url.value})' if 'cloud.redhat.com' in inputs['url']: name = f'Ansible Automation Hub ({private_galaxy_url.value})' cred = Credential(created=now(), modified=now(), name=name, organization=org, credential_type=galaxy_type, inputs=inputs) cred.save() if token and token.value: # encrypt based on the primary key from the prior save cred.inputs['token'] = encrypt_field(cred, 'token') cred.save() org.galaxy_credentials.add(cred) fallback_servers = getattr(settings, 'FALLBACK_GALAXY_SERVERS', []) for fallback in fallback_servers: url = fallback.get('url', None) auth_url = fallback.get('auth_url', None) username = fallback.get('username', None) password = fallback.get('password', None) token = fallback.get('token', None) if username or password: logger.error( f'Specifying HTTP basic auth for the Ansible Galaxy API ' f'({url}) is no longer supported. ' 'Please provide an API token instead after your upgrade ' 'has completed', ) inputs = {'url': url} if token: inputs['token'] = token if auth_url: inputs['auth_url'] = auth_url cred = Credential(created=now(), modified=now(), name=f'Ansible Galaxy ({url})', organization=org, credential_type=galaxy_type, inputs=inputs) cred.save() if token: # encrypt based on the primary key from the prior save cred.inputs['token'] = encrypt_field(cred, 'token') cred.save() org.galaxy_credentials.add(cred) if public_galaxy_enabled: # If public Galaxy was enabled, associate it to the org org.galaxy_credentials.add(public_galaxy_credential)
def migrate_to_static_inputs(apps, schema_editor): set_current_apps(apps) CredentialType.setup_tower_managed_defaults()
def migrate_to_v2_credentials(apps, schema_editor): CredentialType.setup_tower_managed_defaults() deprecated_cred = _generate_deprecated_cred_types() # this monkey-patch is necessary to make the implicit role generation save # signal use the correct Role model (the version active at this point in # migration, not the one at HEAD) orig_current_apps = utils.get_current_apps try: utils.get_current_apps = lambda: apps for cred in apps.get_model('main', 'Credential').objects.all(): job_templates = cred.jobtemplates.all() jobs = cred.jobs.all() data = {} if getattr(cred, 'vault_password', None): data['vault_password'] = cred.vault_password if _is_insights_scm(apps, cred): _disassociate_non_insights_projects(apps, cred) credential_type = _get_insights_credential_type() else: credential_type = _populate_deprecated_cred_types( deprecated_cred, cred.kind) or CredentialType.from_v1_kind( cred.kind, data) defined_fields = credential_type.defined_fields cred.credential_type = apps.get_model( 'main', 'CredentialType').objects.get(pk=credential_type.pk) for field in defined_fields: if getattr(cred, field, None): cred.inputs[field] = getattr(cred, field) if cred.vault_password: for jt in job_templates: jt.credential = None jt.vault_credential = cred jt.save() for job in jobs: job.credential = None job.vault_credential = cred job.save() if data.get('is_insights', False): cred.kind = 'insights' cred.save() # # If the credential contains a vault password, create a new # *additional* credential for the ssh details # if cred.vault_password: # We need to make an ssh credential, too ssh_type = CredentialType.from_v1_kind('ssh') new_cred = apps.get_model('main', 'Credential').objects.get(pk=cred.pk) new_cred.pk = None new_cred.vault_password = '' new_cred.credential_type = apps.get_model( 'main', 'CredentialType').objects.get(pk=ssh_type.pk) if 'vault_password' in new_cred.inputs: del new_cred.inputs['vault_password'] # unset these attributes so that new roles are properly created # at save time new_cred.read_role = None new_cred.admin_role = None new_cred.use_role = None if any([ getattr(cred, field) for field in ssh_type.defined_fields ]): new_cred.save(force_insert=True) # copy rbac roles for role_type in ('read_role', 'admin_role', 'use_role'): for member in getattr(cred, role_type).members.all(): getattr(new_cred, role_type).members.add(member) for role in getattr(cred, role_type).parents.all(): getattr(new_cred, role_type).parents.add(role) for jt in job_templates: jt.credential = new_cred jt.save() for job in jobs: job.credential = new_cred job.save() # passwords must be decrypted and re-encrypted, because # their encryption is based on the Credential's primary key # (which has changed) for field in ssh_type.defined_fields: if field in ssh_type.secret_fields: value = decrypt_field(cred, field) if value: setattr(new_cred, field, value) new_cred.inputs[field] = encrypt_field( new_cred, field) setattr(new_cred, field, '') elif getattr(cred, field): new_cred.inputs[field] = getattr(cred, field) new_cred.save() finally: utils.get_current_apps = orig_current_apps
def create_rhv_tower_credtype(apps, schema_editor): CredentialType.setup_tower_managed_defaults()
def create_new_credential_types(apps, schema_editor): set_current_apps(apps) CredentialType.setup_tower_managed_defaults()
def handle(self, *args, **options): CredentialType.setup_tower_managed_defaults()
def setup_tower_managed_defaults(apps, schema_editor): CredentialType.setup_tower_managed_defaults()