Hi all,
I’m trying to setup pulp_ansible on pulp3 to host my ansible collections, but I’m running into a couple of problems.
To start, I followed the instructions in Pulp in One Container | software repository management.
In Settings — Pulp Project 3.50.2 documentation I see that setting SECRET_KEY is required. This is not mentioned in the pulp-in-one-container documentation and setting it seems not to make any difference. Is that correct?
Despite of having lots of “error: Failed to initialize NSS library” messages in the logs I ended up with a running container which I can query with “pulp status” and with curl by calling /pulp/api/v3/status/. Accessing this url using firefox or chrome results in an error 500 and pulp complaining about “django.template.exceptions.TemplateSyntaxError: ‘optional_logout’ did not receive value(s) for the argument(s): ‘csrf_token’”.
Other urls like /pulp/api/v3/docs/ and /pulp/content/ can be queried by firefox and chrome, though. Is this expected?
Anyway, the api works fine using pulp-cli.
Next, I skipped to Welcome to Pulp Ansible’s documentation! — Pulp ansible Support 0.21.3 documentation and tried to setup everything for hosting an ansible collection.
As it seems to be possible to add users and assign roles, I imagined this scenario:
- add two repositories ‘foorepo’ and ‘barrepo’
- add two distributions ‘foodist’ and ‘bardist’ which are bound to ‘foo’ or ‘bar’, respectively
- add two users ‘foouser’ and ‘barrepo’ with publishing rights on ‘foorepo’, ‘foodist’ or ‘barrepo’, ‘bardist’, respectively
for x in foo bar; do
pulp ansible repository create --name "${x}repo"
pulp ansible distribution create --name "${x}dist" --base-path "${x}" --repository "${x}repo"
pulp user create --username "${x}user" --password "${x}pass1234"
href_repo=$(pulp ansible repository list | jq -r ".[]|select(.name==\"${x}repo\")|.pulp_href")
href_dist=$(pulp ansible distribution list | jq -r ".[]|select(.name==\"${x}dist\")|.pulp_href")
pulp user role-assignment add --username "${x}user" --role ansible.ansiblerepository_owner --object "${href_repo}"
pulp user role-assignment add --username "${x}user" --role ansible.ansiblerepository_creator --object "${href_repo}"
pulp user role-assignment add --username "${x}user" --role ansible.ansibledistribution_owner --object "${href_dist}"
pulp user role-assignment add --username "${x}user" --role ansible.ansibledistribution_creator --object "${href_dist}"
done
Now, I expected to be able to publish a collection using:
ansible-galaxy collection publish -s "http://foouser:foopass1234@$(hostname -f):8080/pulp_ansible/galaxy/foo/ test-package-1.2.3.tar.gz
Alas, I’m getting “You do not have permission to perform this action. Code: permission_denied” here.
So I tried without ‘href_{repo,dist}’, even though that’s probably not what I want, as, in my understanding, both users would have publishing rights to all repos and dists. Let’s use “foo” for now.
x=foo
href_repo=$(pulp ansible repository list | jq -r ".[]|select(.name==\"${x}repo\")|.pulp_href")
href_dist=$(pulp ansible distribution list | jq -r ".[]|select(.name==\"${x}dist\")|.pulp_href")
pulp user role-assignment remove --username "${x}user" --role ansible.ansiblerepository_owner --object "${href_repo}"
pulp user role-assignment remove --username "${x}user" --role ansible.ansiblerepository_creator --object "${href_repo}"
pulp user role-assignment remove --username "${x}user" --role ansible.ansibledistribution_owner --object "${href_dist}"
pulp user role-assignment remove --username "${x}user" --role ansible.ansibledistribution_creator --object "${href_dist}"
pulp user role-assignment add --username "${x}user" --role ansible.ansiblerepository_owner --object ""
pulp user role-assignment add --username "${x}user" --role ansible.ansiblerepository_creator --object ""
pulp user role-assignment add --username "${x}user" --role ansible.ansibledistribution_owner --object ""
pulp user role-assignment add --username "${x}user" --role ansible.ansibledistribution_creator --object ""
But I still get the “permission_denied” here.
My next two attempts were to grant all ansible related roles and to grant all roles I could find:
x=foo
pulp role list --limit 1000 | jq -r '.[]|select(.name|startswith("ansible."))|.name' | \
while read r; do
pulp user role-assignment add --username "${x}user" --role "${r}" --object ""
done
x=foo
pulp role list --limit 1000 | jq -r '.[]|.name' | \
while read r; do
pulp user role-assignment add --username "${x}user" --role "${r}" --object ""
done
Still no luck. How is this rbac suppsed to work, what am I missing?
