From ddd18caadb0c8e32b0ec36a4116e441622e0b5e6 Mon Sep 17 00:00:00 2001
From: Leonardo Rossetti <lrossett@redhat.com>
Date: Sep 10 2021 11:41:48 +0000
Subject: [PATCH 1/5] removing mbbox references


---

diff --git a/operator/roles/koji-builder/defaults/main.yml b/operator/roles/koji-builder/defaults/main.yml
index 2044e89..87bf115 100644
--- a/operator/roles/koji-builder/defaults/main.yml
+++ b/operator/roles/koji-builder/defaults/main.yml
@@ -21,4 +21,4 @@ koji_builder_host_name: "{{ host_name | default('koji-hub:8443') }}"
 koji_builder_ssl_verify: "{{ ssl_verify | default(true) }}"
 
 koji_builder_shared_pvc: "{{ shared_pvc | default('koji-hub-mnt-pvc') }}"
-koji_builder_mbox: "{{ mbox | default('') }}"
+
diff --git a/operator/roles/koji-builder/tasks/cert.yml b/operator/roles/koji-builder/tasks/cert.yml
index e8cdc2e..7154560 100644
--- a/operator/roles/koji-builder/tasks/cert.yml
+++ b/operator/roles/koji-builder/tasks/cert.yml
@@ -12,11 +12,6 @@
     suffix: koji
   register: koji_dir
 
-- block:
-    - set_fact:
-        koji_builder_cacert_secret: "{{ k8s_mboxes.resources[0].spec.root_ca_secret_name }}"
-  when: koji_builder_mbox|length > 0
-
 - name: Check for koji-builder client secret existence 
   k8s_info:
     api_version: v1
diff --git a/operator/roles/koji-builder/tasks/main.yml b/operator/roles/koji-builder/tasks/main.yml
index 9961e7c..7e29bac 100644
--- a/operator/roles/koji-builder/tasks/main.yml
+++ b/operator/roles/koji-builder/tasks/main.yml
@@ -1,18 +1,7 @@
 ---
+- include_tasks: builders/repo.yml
 - set_fact:
     koji_builder_koji_hub_url: "https://{{ koji_builder_koji_hub_host }}.{{ meta.namespace }}.svc:{{ koji_builder_koji_hub_port }}"
-- block:
-    - name: retrieve mbox resource
-      k8s_info:
-        api_version: apps.fedoraproject.org/v1alpha1
-        kind: Mbox
-        namespace: "{{ meta.namespace }}"
-        name: "{{ koji_builder_mbox }}"
-      register: k8s_mboxes
-    - fail:
-        msg: "Failed to find mbox {{ koji_builder_mbox }} in namespace {{ meta.namespace }}"
-      when: k8s_mboxes.resources|length == 0
-  when: koji_builder_mbox|length > 0
 
 - block:
     - name: Ensure koji-builder configmap is updated

From 15fb8beca2df3d22a5fff2f27121811796723e3a Mon Sep 17 00:00:00 2001
From: Leonardo Rossetti <lrossett@redhat.com>
Date: Sep 11 2021 06:21:51 +0000
Subject: [PATCH 2/5] fix watch code format


---

diff --git a/operator/watches.yaml b/operator/watches.yaml
index 820c4c8..fa9d975 100644
--- a/operator/watches.yaml
+++ b/operator/watches.yaml
@@ -20,6 +20,7 @@
   role: kojira
   vars:
     meta: '{{ ansible_operator_meta }}'
+
 - version: v1alpha1
   group: buildsys.apps.fedoraproject.org
   kind: KojiUser

From 1ef928a0716b0f79c379e67570544ff8e69b4da5 Mon Sep 17 00:00:00 2001
From: Leonardo Rossetti <lrossett@redhat.com>
Date: Sep 11 2021 06:22:42 +0000
Subject: [PATCH 3/5] use prper secret format and cert filename


---

diff --git a/operator/molecule/default/tasks/kojibuilder_test.yml b/operator/molecule/default/tasks/kojibuilder_test.yml
index cb158a8..6f2566e 100644
--- a/operator/molecule/default/tasks/kojibuilder_test.yml
+++ b/operator/molecule/default/tasks/kojibuilder_test.yml
@@ -39,8 +39,7 @@
         that:
           - kojibuilder_client_secrets.resources|length == 1
           - kojibuilder_client_secrets.resources[0].metadata.labels['app'] == 'koji-builder'
-          - "'tls.crt' in kojibuilder_client_secrets.resources[0].data"
-          - "'tls.key' in kojibuilder_client_secrets.resources[0].data"
+          - "'client.pem' in kojibuilder_client_secrets.resources[0].data"
 
 - block:
     - name: 'TEST: kojibuilder.pod deployment'
diff --git a/operator/roles/koji-builder/tasks/cert.yml b/operator/roles/koji-builder/tasks/cert.yml
index 7154560..5da5e05 100644
--- a/operator/roles/koji-builder/tasks/cert.yml
+++ b/operator/roles/koji-builder/tasks/cert.yml
@@ -1,17 +1,3 @@
-- name: create temporary cert directory
-  tempfile:
-    state: directory
-    prefix: kojibuilder
-    suffix: cert
-  register: cert_dir
-
-- name: create temporary koji directory
-  tempfile:
-    state: directory
-    prefix: kojibuilder
-    suffix: koji
-  register: koji_dir
-
 - name: Check for koji-builder client secret existence 
   k8s_info:
     api_version: v1
@@ -35,29 +21,29 @@
         ca: "{{ k8s_secrets.resources[0] }}"
     - copy:
         content: "{{ ca.data.cert | b64decode }}"
-        dest: "{{ cert_dir.path }}/ca_cert.pem"
+        dest: "{{ koji_dir_path }}/ca_cert.pem"
     - copy:
         content: "{{ ca.data.key | b64decode }}"
-        dest: "{{ cert_dir.path }}/ca_key.pem"
+        dest: "{{ koji_dir_path }}/ca_key.pem"
       when: clientcert_query.resources|length == 0
     - copy:
         content: "{{ ca.data.cert | b64decode }}"
-        dest: "{{ koji_dir.path }}/ca.pem"
+        dest: "{{ koji_dir_path }}/ca.pem"
 
 - name: Client certificate creation
   block:
     - openssl_privatekey:
-        path: "{{ cert_dir.path }}/client_key.pem"
+        path: "{{ koji_dir_path }}/client_key.pem"
         size: 4096
     - openssl_csr:
-        path: "{{ cert_dir.path }}/client_req.pem"
-        privatekey_path: "{{ cert_dir.path }}/client_key.pem"
+        path: "{{ koji_dir_path }}/client_req.pem"
+        privatekey_path: "{{ koji_dir_path }}/client_key.pem"
         common_name: "{{ koji_builder_host_name }}"
     - openssl_certificate:
-        path: "{{ cert_dir.path }}/client_cert.pem"
-        csr_path: "{{ cert_dir.path }}/client_req.pem"
-        ownca_path: "{{ cert_dir.path }}/ca_cert.pem"
-        ownca_privatekey_path: "{{ cert_dir.path }}/ca_key.pem"
+        path: "{{ koji_dir_path }}/client_cert.pem"
+        csr_path: "{{ koji_dir_path }}/client_req.pem"
+        ownca_path: "{{ koji_dir_path }}/ca_cert.pem"
+        ownca_privatekey_path: "{{ koji_dir_path }}/ca_key.pem"
         provider: ownca
   when: clientcert_query.resources|length == 0
 
@@ -73,13 +59,8 @@
             labels:
               app: koji-builder
           data:
-            tls.crt: "{{ lookup('file', cert_dir.path + '/client_cert.pem') | b64encode }}"
-            tls.key: "{{ lookup('file', cert_dir.path + '/client_key.pem') | b64encode }}"
-            tls.pem: "{{ (lookup('file', cert_dir.path + '/client_key.pem') + '\n' + lookup('file', cert_dir.path + '/client_cert.pem')) | b64encode }}"
-          type: kubernetes.io/tls
+            # tls.crt: "{{ lookup('file', koji_dir_path + '/client_cert.pem') | b64encode }}"
+            # tls.key: "{{ lookup('file', koji_dir_path + '/client_key.pem') | b64encode }}"
+            client.pem: "{{ (lookup('file', koji_dir_path + '/client_key.pem') + '\n' + lookup('file', koji_dir_path + '/client_cert.pem')) | b64encode }}"
   when: clientcert_query.resources|length == 0
 
-- name: cleanup
-  file:
-    path: "{{ cert_dir.path }}"
-    state: absent

From 399ded4d878ecaa1cc07945c8e70345b37045599 Mon Sep 17 00:00:00 2001
From: Leonardo Rossetti <lrossett@redhat.com>
Date: Sep 11 2021 06:23:12 +0000
Subject: [PATCH 4/5] implement koji builder 'repo' type


---

diff --git a/operator/roles/koji-builder/defaults/main.yml b/operator/roles/koji-builder/defaults/main.yml
index 87bf115..2c75626 100644
--- a/operator/roles/koji-builder/defaults/main.yml
+++ b/operator/roles/koji-builder/defaults/main.yml
@@ -21,4 +21,4 @@ koji_builder_host_name: "{{ host_name | default('koji-hub:8443') }}"
 koji_builder_ssl_verify: "{{ ssl_verify | default(true) }}"
 
 koji_builder_shared_pvc: "{{ shared_pvc | default('koji-hub-mnt-pvc') }}"
-
+koji_builder_type: "{{ type | default('repo')  }}"
diff --git a/operator/roles/koji-builder/tasks/builders/repo.yml b/operator/roles/koji-builder/tasks/builders/repo.yml
new file mode 100644
index 0000000..c93aa24
--- /dev/null
+++ b/operator/roles/koji-builder/tasks/builders/repo.yml
@@ -0,0 +1,38 @@
+---
+- block:
+    - name: Download admin client certificate
+      k8s_info:
+        api_version: v1
+        kind: Secret
+        namespace: "{{ meta.namespace }}"
+        name: "{{ koji_builder_admin_secret }}"
+      register: k8s_res
+    - fail:
+        msg: "Secret not found: {{ koji_builder_admin_secret }}"
+      when: k8s_res.resources|length == 0
+    - set_fact:
+        koji_admin_secret: "{{ k8s_res.resources[0] | from_yaml }}"
+    - copy:
+        content: "{{ koji_admin_secret.data['client.pem'] | b64decode }}"
+        dest: "{{ koji_dir_path }}/admin.pem"
+
+- koji_host:
+    server: "{{ koji_builder_koji_hub_url }}/kojihub"
+    host: "{{ koji_builder_host_name }}"
+    archs: "{{ koji_builder_host_archs }}"
+    channels: [ "createrepo" ]
+    ssl_auth:
+      cert: "{{ koji_dir_path }}/admin.pem"
+      serverca: "{{ koji_dir_path }}/ca.pem"
+      verify: "{{ koji_builder_ssl_verify }}"
+ 
+- block:
+    - name: Apply koji-builder deployment
+      template:
+        src: deployment.yml.j2
+        dest: "{{ koji_dir_path}}/deployment.yml"
+    - k8s:
+        state: present
+        src: "{{ koji_dir_path}}/deployment.yml"
+        wait: true
+        namespace: "{{ meta.namespace }}" 
diff --git a/operator/roles/koji-builder/tasks/main.yml b/operator/roles/koji-builder/tasks/main.yml
index 7e29bac..87e91a8 100644
--- a/operator/roles/koji-builder/tasks/main.yml
+++ b/operator/roles/koji-builder/tasks/main.yml
@@ -1,78 +1,33 @@
 ---
-- include_tasks: builders/repo.yml
+- name: Create temporary koji directory
+  tempfile:
+    state: directory
+    prefix: kojibuilder
+    suffix: koji
+  register: koji_dir
+
 - set_fact:
     koji_builder_koji_hub_url: "https://{{ koji_builder_koji_hub_host }}.{{ meta.namespace }}.svc:{{ koji_builder_koji_hub_port }}"
+    koji_dir_path: "{{ koji_dir.path }}"
+
+- include_tasks: cert.yml
 
 - block:
     - name: Ensure koji-builder configmap is updated
       template:
         src: configmap.yml.j2
-        dest: /tmp/configmap.yml
+        dest: "{{ koji_dir_path }}/configmap.yml"
     - k8s:
         state: present
-        src: /tmp/configmap.yml
+        src: "{{ koji_dir_path }}/configmap.yml"
         wait: true
         namespace: "{{ meta.namespace }}"
-    - file:
-        path: /tmp/configmap.yml
-        state: absent
-
-- include_tasks: cert.yml
-
-- block:
-    - name: retrieve and set shared pvc name var
-      k8s_info:
-        api_version: apps.fedoraproject.org/v1alpha1
-        kind: Mbox
-        namespace: "{{ meta.namespace }}"
-        name: "{{ koji_builder_mbox }}"
-      register: k8s_mboxes
-    - fail:
-        msg: "Failed to find mbox {{ koji_builder_mbox }} in namespace {{ meta.namespace }}"
-      when: k8s_mboxes.resources|length == 0
-    - set_fact:
-        koji_builder_pvc_name: "{{ k8s_mboxes.resources[0].spec.koji_pvc_name }}"
-  when: koji_builder_mbox|length > 0
+ 
 
-- block:
-    - name: add default koji host
-      k8s_info:
-        api_version: v1
-        kind: Secret
-        namespace: "{{ meta.namespace }}"
-        name: "{{ koji_builder_admin_secret }}"
-      register: k8s_res
-    - fail:
-        msg: "Secret not found: {{ koji_builder_admin_secret }}"
-      when: k8s_res.resources|length == 0
-    - set_fact:
-        koji_admin_secret: "{{ k8s_res.resources[0] | from_yaml }}"
-    - copy:
-        content: "{{ koji_admin_secret.data['client.pem'] | b64decode }}"
-        dest: "{{ koji_dir.path }}/admin.pem"
-    - koji_host:
-        server: "{{ koji_builder_koji_hub_url }}/kojihub"
-        host: "{{ koji_builder_host_name }}"
-        archs: "{{ koji_builder_host_archs }}"
-        channels: "{{ koji_builder_host_channels }}"
-        ssl_auth:
-          cert: "{{ koji_dir.path }}/admin.pem"
-          serverca: "{{ koji_dir.path }}/ca.pem"
-          verify: "{{ koji_builder_ssl_verify }}"
-    - file:
-        state: absent
-        path: "{{ koji_dir.path }}"
+- include_tasks: builders/repo.yml
+  when: "koji_builder_type == 'repo'"
 
-- block:
-    - name: Apply koji-builder deployment
-      template:
-        src: deployment.yml.j2
-        dest: /tmp/deployment.yml
-    - k8s:
-        state: present
-        src: /tmp/deployment.yml
-        wait: true
-        namespace: "{{ meta.namespace }}"
-    - file:
-        path: /tmp/deployment.yml
-        state: absent
+- name: Remove temporary koji directory
+  file:
+    path: "{{ koji_dir_path  }}"
+    state: absent
diff --git a/operator/roles/koji-builder/templates/configmap.yml.j2 b/operator/roles/koji-builder/templates/configmap.yml.j2
index 8cc4696..5972866 100644
--- a/operator/roles/koji-builder/templates/configmap.yml.j2
+++ b/operator/roles/koji-builder/templates/configmap.yml.j2
@@ -19,6 +19,6 @@ data:
     plugins=
 
     ; Configuration authentication
-    serverca = /etc/cacert/cert
-    cert=/etc/clientcert/tls.pem
+    serverca = /etc/certs/ca/cert
+    cert=/etc/certs/client/client.pem
 
diff --git a/operator/roles/koji-builder/templates/deployment.yml.j2 b/operator/roles/koji-builder/templates/deployment.yml.j2
index f0c44c7..7290867 100644
--- a/operator/roles/koji-builder/templates/deployment.yml.j2
+++ b/operator/roles/koji-builder/templates/deployment.yml.j2
@@ -1,7 +1,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: koji-builder
+  name: "{{ meta.name }}"
   labels:
     app: koji-builder
 spec:
@@ -15,7 +15,7 @@ spec:
         app: koji-builder
     spec:
       containers:
-      - name: koji-builder
+      - name: builder
         image: {{ koji_builder_image }}
         resources: {}
         livenessProbe:
@@ -30,10 +30,10 @@ spec:
           mountPath: /etc/kojid
           readOnly: true
         - name: cacert-volume
-          mountPath: /etc/cacert
+          mountPath: /etc/certs/ca
           readOnly: true
         - name: client-cert-volume
-          mountPath: /etc/clientcert
+          mountPath: /etc/certs/client
           readOnly: true
         - name: koji-builder-mnt
           mountPath: /mnt/koji

From 2fae73a8175dbff7adc93607be6baebae104bf96 Mon Sep 17 00:00:00 2001
From: Leonardo Rossetti <lrossett@redhat.com>
Date: Sep 11 2021 06:24:21 +0000
Subject: [PATCH 5/5] add type in sample file


---

diff --git a/operator/config/samples/buildsys_v1alpha1_kojibuilder.yaml b/operator/config/samples/buildsys_v1alpha1_kojibuilder.yaml
index e0b8a37..4e22508 100644
--- a/operator/config/samples/buildsys_v1alpha1_kojibuilder.yaml
+++ b/operator/config/samples/buildsys_v1alpha1_kojibuilder.yaml
@@ -4,6 +4,7 @@ metadata:
   name: sample
 spec:
   image: quay.io/fedora/koji-builder:f34
+  type: repo
   replicas: 1
   configmap: koji-builder-configmap
   cacert_secret: koji-hub-ca-cert
@@ -12,12 +13,8 @@ spec:
   koji_hub_host: 'koji-hub'
   koji_hub_port: 8443
   max_jobs: 5
-  vendor: MBox
   host_archs:
     - x86_64
-  host_channels:
-    - default
-    - createrepo
   host_name: mbbox.default
   ssl_verify: false
   shared_pvc: koji-hub-mnt-pvc

