From 4917d947e0f1829eba7bc031289743e22bb583f0 Mon Sep 17 00:00:00 2001
From: Leonardo Rossetti <lrossett@redhat.com>
Date: Sep 14 2021 12:48:17 +0000
Subject: [PATCH 1/9] adding koji_ansible module


---

diff --git a/operator/Dockerfile b/operator/Dockerfile
index 5e95dd0..f21a0be 100644
--- a/operator/Dockerfile
+++ b/operator/Dockerfile
@@ -10,7 +10,8 @@ USER ${USER_ID}
 
 COPY requirements.yml ${HOME}/requirements.yml
 RUN ansible-galaxy collection install -r ${HOME}/requirements.yml \
- && chmod -R ug+rwx ${HOME}/.ansible
+ && chmod -R ug+rwx ${HOME}/.ansible \
+ && mkdir -p ${HOME}/.koji/config.d
 
 COPY watches.yaml ${HOME}/watches.yaml
 COPY roles/ ${HOME}/roles/
diff --git a/operator/requirements.yml b/operator/requirements.yml
index 3f626ed..de1ec48 100644
--- a/operator/requirements.yml
+++ b/operator/requirements.yml
@@ -4,3 +4,5 @@ collections:
     version: "1.2.1"
   - name: operator_sdk.util
     version: "0.2.0"
+  - name: ktdreyer.koji_ansible
+    version: "0.0.404"

From fc30efbf0e1b10b960768758787ba038f415c201 Mon Sep 17 00:00:00 2001
From: Leonardo Rossetti <lrossett@redhat.com>
Date: Sep 16 2021 04:40:51 +0000
Subject: [PATCH 2/9] adding koji ansible role from galaxy


---

diff --git a/operator/Dockerfile b/operator/Dockerfile
index f21a0be..9fa0408 100644
--- a/operator/Dockerfile
+++ b/operator/Dockerfile
@@ -11,7 +11,8 @@ USER ${USER_ID}
 COPY requirements.yml ${HOME}/requirements.yml
 RUN ansible-galaxy collection install -r ${HOME}/requirements.yml \
  && chmod -R ug+rwx ${HOME}/.ansible \
- && mkdir -p ${HOME}/.koji/config.d
+ && mkdir -p ${HOME}/.koji/config.d \
+ && chmod -R ug+rwx ${HOME}/.koji
 
 COPY watches.yaml ${HOME}/watches.yaml
 COPY roles/ ${HOME}/roles/

From 2f276fb1143ddea723a481551edf560522c4f234 Mon Sep 17 00:00:00 2001
From: Leonardo Rossetti <lrossett@redhat.com>
Date: Sep 16 2021 04:41:46 +0000
Subject: [PATCH 3/9] tiny kojiuser refactor


---

diff --git a/operator/roles/kojiuser/defaults/main.yml b/operator/roles/kojiuser/defaults/main.yml
index e7bb418..48b6828 100644
--- a/operator/roles/kojiuser/defaults/main.yml
+++ b/operator/roles/kojiuser/defaults/main.yml
@@ -1,6 +1,5 @@
 ---
 # defaults file for KojiUser
-koji_user_hub_host: "{{ hub_host | default('koji-hub:8443') }}"
-koji_user_admin_secret: "{{ admin_secret | default('koji-user-admin') }}"
+koji_user_ssl: "{{ ssl | default(False)  }}"
 koji_user_permissions: "{{ permissions | default([]) }}"
-koji_user_authentication: "{{ authentication | default({'ssl': {'client_secret_name': 'koji-sample-user-client-cert', 'ca_secret_name': 'koji-hub-ca-cert'}}) }}"
\ No newline at end of file
+koji_user_authentication: "{{ authentication | default({'ssl': {'client_secret_name': 'koji-sample-user-client-cert', 'ca_secret_name': 'koji-hub-ca-cert'}}) }}"
diff --git a/operator/roles/kojiuser/meta/main.yml b/operator/roles/kojiuser/meta/main.yml
index a2634aa..032b390 100644
--- a/operator/roles/kojiuser/meta/main.yml
+++ b/operator/roles/kojiuser/meta/main.yml
@@ -1,2 +1,2 @@
-dependencies:
-  - role: koji-lib
+#dependencies:
+#  - role: ktdreyer.koji_ansible
diff --git a/operator/roles/kojiuser/tasks/create.yml b/operator/roles/kojiuser/tasks/create.yml
new file mode 100644
index 0000000..84064a4
--- /dev/null
+++ b/operator/roles/kojiuser/tasks/create.yml
@@ -0,0 +1,98 @@
+---
+- block:
+    - k8s_info:
+        api_version: buildsys.apps.fedoraproject.org/v1alpha1
+        kind: KojiUser
+        namespace: "{{ meta.namespace }}"
+        name: "{{ meta.name }}"
+      register: koji_user_k8s
+    - fail:
+        msg: "Failed to fetch kojiuser"
+      when: koji_user_k8s.resources | length == 0
+    - set_fact:
+        koji_user_obj: "{{ koji_user_k8s.resources[0] }}"
+    - set_fact:
+        koji_user_hub: "{{ koji_user_obj.metadata.annotations['buildsys.apps.fedoraproject.org/hub'].split('/')  }}"
+    - set_fact:  
+        koji_user_hub_name: "{{ koji_user_hub.0 }}"
+        koji_user_hub_namespace: "{{ koji_user_hub.1 }}"
+    - ktdreyer.koji_ansible.koji_user:
+        koji: "{{ koji_user_hub_name }}-{{ koji_user_hub_namespace }}"
+        name: "{{ meta.name }}"
+        permissions: "{{ koji_user_permissions }}"
+        state: enabled
+
+- block:
+    - name: create temporary cert directory
+      k8s_info:
+        api_version: buildsys.apps.fedoraproject.org/v1alpha1
+        kind: KojiHub
+        namespace: "{{ koji_user_hub_namespace }}"
+        name: "{{ koji_user_hub_name }}"
+      register: k8s_query
+    - fail:
+        msg: "Failed to retrieve koji-hub"
+      when: k8s_query.resources | length == 0
+    - k8s_info:
+        api_version: v1
+        kind: Secret
+        namespace: "{{ koji_user_hub_namespace }}"
+        name: "{{ k8s_query.resources[0]['spec']['ca_cert_secret'] }}"
+      register: k8s_secret
+    - fail:
+        msg: 'Could not fetch ca secret'
+      when: k8s_secret.resources | length == 0
+    - tempfile:
+        state: directory
+        prefix: kojiuser
+        suffix: cert
+      register: cert_dir
+    - copy:
+        content: "{{ k8s_secret.resources[0].data.cert | b64decode }}"
+        dest: "{{ cert_dir.path }}/ca_cert.pem"
+    - copy:
+        content: "{{ k8s_secret.resources[0].data.key | b64decode }}"
+        dest: "{{ cert_dir.path }}/ca_key.pem"
+    - k8s_info:
+        api_version: v1
+        kind: Secret
+        name: "{{ meta.name }}-koji-client-cert"
+        namespace: "{{ meta.namespace }}"
+      register: clientcert_query
+    - openssl_privatekey:
+        path: "{{ cert_dir.path }}/client_key.pem"
+        size: 4096
+      when: clientcert_query.resources|length == 0
+    - openssl_csr:
+        path: "{{ cert_dir.path }}/client_req.pem"
+        privatekey_path: "{{ cert_dir.path }}/client_key.pem"
+        common_name: "{{ meta.name }}"
+      when: clientcert_query.resources|length == 0
+    - openssl_certificate:
+        path: "{{ cert_dir.path }}/client_cert.pem"
+        csr_path: "{{ cert_dir.path }}/client_req.pem"
+        ownca_path: "{{ cert_dir.path }}/ca_cert.pem"
+        ownca_privatekey_path: "{{ cert_dir.path }}/ca_key.pem"
+        provider: ownca
+      when: clientcert_query.resources|length == 0
+    - k8s:
+        definition:
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: "{{ meta.name }}-koji-client-cert"
+            namespace: "{{ meta.namespace }}"
+            labels:
+              app: koji
+              koji-hub: "{{ koji_user_hub_name }}"
+            annotations:
+              buildsys.apps.fedoraproject.org/hub: "{{ koji_user_hub_name }}/{{ koji_user_hub_namespace }}"
+          data:
+            client.pem: "{{ (lookup('file', cert_dir.path + '/client_key.pem') + '\n' + lookup('file', cert_dir.path + '/client_cert.pem')) | b64encode }}"
+      when: clientcert_query.resources|length == 0
+    - name: cleanup
+      file:
+        path: "{{ cert_dir.path }}"
+        state: absent
+  when:
+    - koji_user_ssl 
diff --git a/operator/roles/kojiuser/tasks/destroy.yml b/operator/roles/kojiuser/tasks/destroy.yml
new file mode 100644
index 0000000..e45bae4
--- /dev/null
+++ b/operator/roles/kojiuser/tasks/destroy.yml
@@ -0,0 +1,34 @@
+---
+- k8s_info:
+    api_version: buildsys.apps.fedoraproject.org/v1alpha1
+    kind: KojiUser
+    namespace: "{{ meta.namespace }}"
+    name: "{{ meta.name }}"
+  register: koji_user_k8s
+
+- fail:
+    msg: "Failed to fetch kojiuser"
+  when: koji_user_k8s.resources | length == 0
+
+- set_fact:
+    koji_user_obj: "{{ koji_user_k8s.resources[0] }}"
+
+- set_fact:
+    koji_user_hub: "{{ koji_user_obj.metadata.annotations['buildsys.apps.fedoraproject.org/hub'].split('/')  }}"
+
+- set_fact:  
+    koji_user_hub_name: "{{ koji_user_hub.0 }}"
+    koji_user_hub_namespace: "{{ koji_user_hub.1 }}"
+
+- ktdreyer.koji_ansible.koji_user:
+    koji: "{{ koji_user_hub_name }}-{{ koji_user_hub_namespace }}"
+    name: "{{ meta.name }}"
+    permissions: "{{ koji_user_permissions }}"
+    state: disabled
+
+- k8s:
+    api_version: v1
+    kind: Secret
+    name: "{{ meta.name }}-koji-client-cert"
+    namespace: "{{ meta.namespace }}"
+    state: absent 
diff --git a/operator/roles/kojiuser/tasks/main.yml b/operator/roles/kojiuser/tasks/main.yml
index 0e98f22..3a87fec 100644
--- a/operator/roles/kojiuser/tasks/main.yml
+++ b/operator/roles/kojiuser/tasks/main.yml
@@ -1,109 +1,8 @@
 ---
-# tasks file for KojiUser
-- name: create temporary cert directory
-  tempfile:
-    state: directory
-    prefix: kojiuser
-    suffix: cert
-  register: cert_dir
+- include_tasks: create.yml
+  when: state is not defined
 
-- name: create temporary koji directory
-  tempfile:
-    state: directory
-    prefix: kojiuser
-    suffix: koji
-  register: koji_dir
-
-- name: Check for koji-user client secret existence 
-  k8s_info:
-    api_version: v1
-    kind: Secret
-    name: "{{ koji_user_authentication.ssl.client_secret_name }}"
-    namespace: "{{ meta.namespace }}"
-  register: clientcert_query
-
-- name: Retrieve ca secret
-  block:
-    - k8s_info:
-        api_version: v1
-        kind: Secret
-        name: "{{ koji_user_authentication.ssl.ca_secret_name }}"
-        namespace: "{{ meta.namespace }}"
-      register: k8s_secrets
-    - fail:
-        msg: "Secret {{ koji_user_authentication.ssl.client_secret_name }} not found."
-      when: k8s_secrets.resources|length == 0
-    - set_fact:
-        ca: "{{ k8s_secrets.resources[0] }}"
-    - copy:
-        content: "{{ ca.data.cert | b64decode }}"
-        dest: "{{ cert_dir.path }}/ca_cert.pem"
-    - copy:
-        content: "{{ ca.data.key | b64decode }}"
-        dest: "{{ cert_dir.path }}/ca_key.pem"
-      when: clientcert_query.resources|length == 0
-    - copy:
-        content: "{{ ca.data.cert | b64decode }}"
-        dest: "{{ koji_dir.path }}/ca.pem"
-
-- name: Client certificate creation
-  block:
-    - openssl_privatekey:
-        path: "{{ cert_dir.path }}/client_key.pem"
-        size: 4096
-    - openssl_csr:
-        path: "{{ cert_dir.path }}/client_req.pem"
-        privatekey_path: "{{ cert_dir.path }}/client_key.pem"
-        common_name: "{{ meta.name }}"
-    - openssl_certificate:
-        path: "{{ cert_dir.path }}/client_cert.pem"
-        csr_path: "{{ cert_dir.path }}/client_req.pem"
-        ownca_path: "{{ cert_dir.path }}/ca_cert.pem"
-        ownca_privatekey_path: "{{ cert_dir.path }}/ca_key.pem"
-        provider: ownca
-  when: clientcert_query.resources|length == 0
-
-- name: Kubernetes client certificate secret creation
-  block:
-    - k8s:
-        definition:
-          apiVersion: v1
-          kind: Secret
-          metadata:
-            name: "{{ koji_user_authentication.ssl.client_secret_name }}"
-            namespace: "{{ meta.namespace }}"
-            labels:
-              app: koji-user
-          data:
-            client.pem: "{{ (lookup('file', cert_dir.path + '/client_key.pem') + '\n' + lookup('file', cert_dir.path + '/client_cert.pem')) | b64encode }}"
-  when: clientcert_query.resources|length == 0
-
-- block:
-    - name: setup koji user
-      k8s_info:
-        api_version: v1
-        kind: Secret
-        namespace: "{{ meta.namespace }}"
-        name: "{{ koji_user_admin_secret }}"
-      register: k8s_res
-    - fail:
-        msg: "Secret not found: {{ koji_user_admin_secret }}"
-      when: k8s_res.resources|length == 0
-    - set_fact:
-        koji_admin_secret: "{{ k8s_res.resources[0] | from_yaml }}"
-    - copy:
-        content: "{{ koji_admin_secret.data['client.pem'] | b64decode }}"
-        dest: "{{ koji_dir.path }}/admin.pem"
-    - koji_user:
-        server: "https://{{ koji_user_hub_host }}/kojihub"
-        username: "{{ meta.name }}"
-        permissions: "{{ koji_user_permissions }}"
-        ssl_auth:
-          cert: "{{ koji_dir.path }}/admin.pem"
-          serverca: "{{ koji_dir.path }}/ca.pem"
-          verify: false
-
-- name: cleanup
-  file:
-    path: "{{ cert_dir.path }}"
-    state: absent
\ No newline at end of file
+- include_tasks: destroy.yml
+  when:
+    - state is defined
+    - state == 'absent'
diff --git a/operator/watches.yaml b/operator/watches.yaml
index fa9d975..78306d2 100644
--- a/operator/watches.yaml
+++ b/operator/watches.yaml
@@ -27,4 +27,8 @@
   role: kojiuser
   vars:
     meta: '{{ ansible_operator_meta }}'
+  finalizer:
+    name: buildsys.apps.fedoraproject.org/finalizer
+    vars:
+      state: absent
 #+kubebuilder:scaffold:watch

From 4d9a99bae44d515544d13f3ea6a787668105796f Mon Sep 17 00:00:00 2001
From: Leonardo Rossetti <lrossett@redhat.com>
Date: Sep 16 2021 04:42:14 +0000
Subject: [PATCH 4/9] switch to upstream koji role + profile file


---

diff --git a/operator/roles/koji-hub/tasks/cert.yml b/operator/roles/koji-hub/tasks/cert.yml
index 62f086d..8e0ac06 100644
--- a/operator/roles/koji-hub/tasks/cert.yml
+++ b/operator/roles/koji-hub/tasks/cert.yml
@@ -1,3 +1,8 @@
+- name: Ensure profile certs dir exists
+  file:
+    path: "{{ lookup('env', 'HOME') }}/.koji/certs/{{ meta.name }}"
+    state: directory
+
 - name: create temporary cert directory
   tempfile:
     state: directory
@@ -5,10 +10,10 @@
     suffix: cert
   register: cert_dir
 
-- block:
-    - set_fact:
-        koji_hub_ca_cert_secret: "{{ k8s_mboxes.resources[0].spec.root_ca_secret_name }}"
-  when: koji_mbox|length > 0
+    # - block:
+    #- set_fact:
+    #   koji_hub_ca_cert_secret: "{{ k8s_mboxes.resources[0].spec.root_ca_secret_name }}"
+    #when: koji_mbox|length > 0
 
 # koji-hub ca cert
 - name: Root CA creation
@@ -55,10 +60,7 @@
             cert: "{{ lookup('file', cert_dir.path + '/ca_cert.pem') | b64encode }}"
             key: "{{ lookup('file', cert_dir.path + '/ca_key.pem') | b64encode }}"
       when: k8s_cacert_query.resources|length == 0
-    - copy:
-        src: "{{  cert_dir.path }}/ca_cert.pem"
-        dest: "{{ lookup('env', 'HOME') }}/.koji/certs/ca.pem"
-  when: koji_mbox|length == 0
+        # when: koji_mbox|length == 0
 
 # koji-hub httpd cert
 - name: check if server cert exists
@@ -82,6 +84,7 @@
           - "DNS:{{ koji_hub_svc_name }}"
           - "DNS:{{ koji_hub_svc_name }}.{{ meta.namespace }}.svc"
           - "DNS:{{ koji_hub_svc_name }}.{{ meta.namespace }}.svc.cluster"
+          - "DNS:{{ koji_hub_svc_name }}.{{ meta.namespace }}.svc.cluster.local"
     - openssl_certificate:
         path: "{{ cert_dir.path }}/server_cert.pem"
         csr_path: "{{ cert_dir.path }}/server_req.pem"
@@ -139,7 +142,7 @@
             client.pem: "{{ (lookup('file', cert_dir.path + '/admin_key.pem') + '\n' + lookup('file', cert_dir.path + '/admin_cert.pem')) | b64encode }}"
     - copy:
         content: "{{ lookup('file', cert_dir.path + '/admin_key.pem') + '\n' + lookup('file', cert_dir.path + '/admin_cert.pem') }}"
-        dest: "{{ lookup('env', 'HOME') }}/.koji/certs/kojiadmin.pem"
+        dest: "{{ lookup('env', 'HOME') }}/.koji/certs/{{ meta.name  }}/client.pem"
   when: k8s_admin_cert_query.resources|length == 0
 
 # koji-web client cert
diff --git a/operator/roles/koji-hub/tasks/main.yml b/operator/roles/koji-hub/tasks/main.yml
index 1a83872..66492d6 100644
--- a/operator/roles/koji-hub/tasks/main.yml
+++ b/operator/roles/koji-hub/tasks/main.yml
@@ -1,37 +1,5 @@
 ---
 - block:
-    - name: set koji-hub config file
-      file:
-        path: "{{ lookup('env', 'HOME') }}/.koji/{{ item }}"
-        state: directory
-      with_items:
-        - config.d
-        - certs
-    - template:
-        src: kojiadmin.conf.j2
-        dest: "{{ lookup('env', 'HOME') }}/.koji/config.d/kojiadmin.conf"
-      vars:
-        kojiadmin_cert_path: "{{ lookup('env', 'HOME') }}/.koji/certs/kojiadmin.pem"
-        kojiadmin_ca_cert_path: "{{ lookup('env', 'HOME') }}/.koji/certs/ca.pem"
-
-- block:
-    - name: retrieve mbox resource
-      k8s_info:
-        api_version: apps.fedoraproject.org/v1alpha1
-        kind: Mbox
-        namespace: "{{ meta.namespace }}"
-        name: "{{ koji_mbox }}"
-      register: k8s_mboxes
-    - fail:
-        msg: "Failed to find mbox {{ koji_mbox }} in namespace {{ meta.namespace }}"
-      when: k8s_mboxes.resources|length == 0
-  when: koji_mbox|length > 0
-
-- set_fact:
-    koji_hub_postgres_secret: "{{ k8s_mboxes.resources[0].spec.psql_secret_name }}"
-  when: koji_mbox|length > 0
-
-- block:
     - name: Retrieve postgresql secret
       k8s_info:
         api_version: v1
@@ -213,3 +181,8 @@
         login_user: "{{ psql_secret.data.POSTGRES_USER | b64decode }}"
         login_password: "{{ psql_secret.data.POSTGRES_PASSWORD | b64decode }}"
         query: "INSERT INTO user_perms (user_id, perm_id, creator_id) VALUES ({{ psql_user_query.query_result[0].id }}, 1, 1) ON CONFLICT DO NOTHING"
+
+- name: Profile setup
+  template:
+    src: koji-profile.conf.j2             
+    dest: "{{ lookup('env', 'HOME') }}/.koji/config.d/{{ meta.name }}-{{ meta.namespace }}.conf"
diff --git a/operator/roles/koji-hub/templates/koji-profile.conf.j2 b/operator/roles/koji-hub/templates/koji-profile.conf.j2
new file mode 100644
index 0000000..f204075
--- /dev/null
+++ b/operator/roles/koji-hub/templates/koji-profile.conf.j2
@@ -0,0 +1,9 @@
+[{{ meta.name }}-{{ meta.namespace }}]
+weburl = https://{{ koji_hub_svc_name }}.{{ meta.namespace }}.svc.cluster.local:{{ koji_hub_https_port }}/koji
+topurl = https://{{ koji_hub_svc_name }}.{{ meta.namespace }}.svc.cluster.local:{{ koji_hub_https_port }}
+server = https://{{ koji_hub_svc_name }}.{{ meta.namespace }}.svc.cluster.local:{{ koji_hub_https_port }}/kojihub
+
+;auth
+authtype = ssl
+cert = {{ lookup('env', 'HOME')}}/.koji/certs/{{ meta.name }}/client.pem
+no_ssl_verify = True

From ac6b5267270be183a38d1aa301f705edc571ef9f Mon Sep 17 00:00:00 2001
From: Leonardo Rossetti <lrossett@redhat.com>
Date: Sep 16 2021 04:42:33 +0000
Subject: [PATCH 5/9] kojiuser tests


---

diff --git a/operator/molecule/default/tasks/kojiuser_test.yml b/operator/molecule/default/tasks/kojiuser_test.yml
index b88c91d..370a0a9 100644
--- a/operator/molecule/default/tasks/kojiuser_test.yml
+++ b/operator/molecule/default/tasks/kojiuser_test.yml
@@ -3,7 +3,16 @@
   k8s:
     state: present
     namespace: '{{ namespace }}'
-    definition: "{{ lookup('template', '/'.join([samples_dir, cr_file])) | from_yaml }}"
+    definition:      
+      apiVersion: buildsys.apps.fedoraproject.org/v1alpha1
+      kind: KojiUser
+      metadata:
+        name: sample
+        annotations:
+          buildsys.apps.fedoraproject.org/hub: sample/osdk-test
+      spec:
+        permissions: []
+        ssl: true
     wait: yes
     wait_timeout: 300
     wait_condition:
@@ -19,16 +28,18 @@
         api_version: v1
         kind: Secret
         namespace: "{{ namespace }}"
-        name: koji-sample-user-client-cert
+        name: sample-koji-client-cert
       register: kojiuser_client_secrets
     - assert:
         that:
-          - kojiuser_client_secrets.resources|length == 1
-          - kojiuser_client_secrets.resources[0].metadata.labels['app'] == 'koji-user'
+          - kojiuser_client_secrets.resources | length == 1
+          - kojiuser_client_secrets.resources[0].metadata.labels['app'] == 'koji'
+          - kojiuser_client_secrets.resources[0].metadata.labels['koji-hub'] == 'sample'
+          - kojiuser_client_secrets.resources[0].metadata.annotations['buildsys.apps.fedoraproject.org/hub'] == 'sample/osdk-test'
           - "'client.pem' in kojiuser_client_secrets.resources[0].data"
 
 - block:
-    - name: 'TEST: kojiuser.database'
+    - name: 'TEST: kojiuser.created.database'
       command: "kubectl get po --selector='app=postgres' -o jsonpath='{.items[0].metadata.name}'  -n {{ namespace }}"
       register: k8s_pod
     - command: "kubectl exec -it {{ k8s_pod.stdout  }} -n {{ namespace }} -- psql --username koji koji -c 'SELECT name FROM users;'"
@@ -37,3 +48,23 @@
         that:
           - "'sample' in psql_users.stdout"
 
+
+- name: Delete KojiUser resource
+  k8s:
+    api_version: buildsys.apps.fedoraproject.org/v1alpha1
+    kind: KojiUser
+    name: sample
+    namespace: "{{ namespace }}"
+    state: absent
+    wait: true
+
+- block:
+    - name: 'TEST: kojiuser.deleted.database'
+      command: "kubectl get po --selector='app=postgres' -o jsonpath='{.items[0].metadata.name}'  -n {{ namespace }}"
+      register: k8s_pod
+    - command: "kubectl exec -it {{ k8s_pod.stdout  }} -n {{ namespace }} -- psql --username koji koji -c 'SELECT name,status FROM users;'"
+      register: psql_users
+    - assert:
+        that:
+          - "'sample' in psql_users.stdout"
+          - "'1' in psql_users.stdout"
diff --git a/operator/molecule/default/verify.yml b/operator/molecule/default/verify.yml
index 6decf47..93c0470 100644
--- a/operator/molecule/default/verify.yml
+++ b/operator/molecule/default/verify.yml
@@ -15,9 +15,9 @@
           include_tasks: 'tasks/{{ item }}_test.yml'
           with_items:
             - kojihub
-            - kojibuilder
-            - kojira
-            - kojiuser
+              # - kojibuilder
+              # - kojira
+            -  kojiuser
       rescue:
         - name: Retrieve relevant resources
           k8s_info:

From 1c75e27ed4520fe1968f9ae26b2f8b762cf6f06c Mon Sep 17 00:00:00 2001
From: Leonardo Rossetti <lrossett@redhat.com>
Date: Sep 16 2021 04:43:05 +0000
Subject: [PATCH 6/9] update sample KojiUser file


---

diff --git a/operator/config/samples/buildsys_v1alpha1_kojiuser.yaml b/operator/config/samples/buildsys_v1alpha1_kojiuser.yaml
index 4f07063..fa7670d 100644
--- a/operator/config/samples/buildsys_v1alpha1_kojiuser.yaml
+++ b/operator/config/samples/buildsys_v1alpha1_kojiuser.yaml
@@ -1,13 +1,9 @@
 apiVersion: buildsys.apps.fedoraproject.org/v1alpha1
 kind: KojiUser
 metadata:
-  name: sample
+  name: sample # metadata.name will be used as koji username
+  annotations:
+    buildsys.apps.fedoraproject.org/hub: sample/default # $NAME/$NAMESPACE
 spec:
-  permissions:
-    - repo
-  admin_secret: koji-hub-admin-cert
-  hub_host: koji-hub:8443
-  authentication:
-    ssl:
-      client_secret_name: koji-sample-user-client-cert
-      ca_secret_name: koji-hub-ca-cert
+  permissions: [] # array of koji permissions
+  ssl: true # will generate user auth ssl certificates if set to true

From 706e1def1294f13cfd6756fe26fd7173e12a5b17 Mon Sep 17 00:00:00 2001
From: Leonardo Rossetti <lrossett@redhat.com>
Date: Sep 16 2021 12:22:24 +0000
Subject: [PATCH 7/9] uncomment tests


---

diff --git a/operator/molecule/default/verify.yml b/operator/molecule/default/verify.yml
index 93c0470..6decf47 100644
--- a/operator/molecule/default/verify.yml
+++ b/operator/molecule/default/verify.yml
@@ -15,9 +15,9 @@
           include_tasks: 'tasks/{{ item }}_test.yml'
           with_items:
             - kojihub
-              # - kojibuilder
-              # - kojira
-            -  kojiuser
+            - kojibuilder
+            - kojira
+            - kojiuser
       rescue:
         - name: Retrieve relevant resources
           k8s_info:

From dbdcfd463aeaf65d6739c097a6b32905c7bf9177 Mon Sep 17 00:00:00 2001
From: Leonardo Rossetti <lrossett@redhat.com>
Date: Sep 16 2021 12:22:43 +0000
Subject: [PATCH 8/9] remove koji-user module


---

diff --git a/operator/roles/koji-lib/library/koji_user.py b/operator/roles/koji-lib/library/koji_user.py
deleted file mode 100644
index aff46e5..0000000
--- a/operator/roles/koji-lib/library/koji_user.py
+++ /dev/null
@@ -1,177 +0,0 @@
-# This file is part of the mbbox project.
-# Copyright (C) 2020  Red Hat, Inc.
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to deal
-# in the Software without restriction, including without limitation the rights
-# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-# copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-
-# The above copyright notice and this permission notice shall be included in all
-# copies or substantial portions of the Software.
-
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-# SOFTWARE.
-
-
-DOCUMENTATION = '''
----
-module: koji_user
-
-short_description: Ansible module that ensures a koji user creation in a remote koji-hub instance.
-
-description:
-  - It requires a running koji-hub instance
-  - It requires koji-hub admin accesss
-
-options:
-    username:
-      description:
-        - a qualified and unique koji username
-      required: true
-    permissions:
-      description:
-        - A list of valid koji user permissions
-      required: true
-    host:
-      description:
-        - a qualified and unique koji hostname
-      required: true
-    server:
-      description:
-        - the full koji-hub server url
-      required: true
-    ssl_auth:
-      description:
-        - a dictonary which contains the require ssl authentication info
-    ssl_auth.cert:
-      description:
-        - the client pem file path to use, this file must contain both key and certificate in PEM format  
-    ssl_auth.serverca:
-      description:
-        - the certificate authority PEM file path used by both koji-hub server and koji-builder client pem file
-    ssl_auth.verify:
-      description:
-        - A boolean flag to tell koji-builder to validate the client pem file, should be set to false if using self-signed certificates.
-      default: true
-
-author:
-    - Red Hat, Inc. and others
-'''
-
-EXAMPLES = '''
-- koji_user:
-    server: https://koji-hub:8443/kojihub
-    username: kojira
-    permissions:
-      - repo
-    ssl_auth:
-      cert: /tmp/admin.pem
-      serverca: /tmp/ca.pem
-      verify: false
-'''
-
-
-from optparse import Values
-
-from ansible.module_utils.basic import AnsibleModule
-import koji
-from koji_cli.lib import activate_session
-
-
-def build():
-  """
-  Builds an AnsibleModule object instance
-  """
-  spec = dict(
-    username=dict(type='str', required=True),
-    permissions=dict(type='list', required=True),
-    server=dict(type='str', required=True),
-    ssl_auth=dict(type='dict')
-  )
-  return AnsibleModule(
-    argument_spec=spec,
-    supports_check_mode=True
-  )
-
-
-def ssl_config(module):
-  """
-  Creates a ssl config dictionary to be used for ssl auth.
-  """
-  ctx = module.params['ssl_auth']
-  try:
-    return {
-      'cert': ctx['cert'],
-      'serverca': ctx['serverca'],
-      'no_ssl_verify': ctx.get('verify', True),
-      'authtype': 'ssl'
-    }
-  except KeyError as e:
-   module.fail_json(changed=False,
-      skipped=False, 
-      failed=True, 
-      msg='Missing ssl_auth "%s" key.' % e.args[0])
-
-
-def main():
-  module = build()
-
-  config = {'server': module.params['server']}
-  if 'ssl_auth' in module.params:
-    config.update(**ssl_config(module))
-  else:
-    module.fail_json(changed=False,
-      skipped=False, 
-      failed=True, 
-      msg='Missing authentication config')
-  
-  options = Values(config)
-  session_opts = koji.grab_session_options(options)
-  session = koji.ClientSession(options.server, session_opts)
-
-  try:
-    session.ssl_login(options.cert, None, options.serverca)
-  except Exception as e:
-    module.fail_json(changed=False,
-      skipped=False,
-      failed=True,
-      msg=str(e))
-
-  username = module.params['username']
-  perms = module.params['permissions']
-
-  user = session.getUser(username)
-  if not user:  
-    try:
-      user = session.createUser(username)
-    except Exception as e:
-      module.fail_json(changed=False,
-        skipped=False,
-        failed=True,
-        msg=str(e))
-
-  for perm in perms:
-    try:
-      session.grantPermission(user, perm, True)
-    except Exception as e:
-      if not 'already has permission' in str(e):
-        module.fail_json(changed=False,
-          skipped=False,
-          failed=True,
-          msg=str(e))
-
-  module.exit_json(changed=True,
-    skipped=False,
-    failed=False, 
-    result={'username': username, 'perms': session.getUserPerms(user['id'])})
-
-
-if __name__ == '__main__':
-  main()

From 96dc2bd803840b60078c17182a45a4545f28f16e Mon Sep 17 00:00:00 2001
From: Leonardo Rossetti <lrossett@redhat.com>
Date: Sep 16 2021 12:23:06 +0000
Subject: [PATCH 9/9] switch to upstream koji_user module


---

diff --git a/operator/roles/kojira/tasks/main.yml b/operator/roles/kojira/tasks/main.yml
index 48ed6bb..a64b67d 100644
--- a/operator/roles/kojira/tasks/main.yml
+++ b/operator/roles/kojira/tasks/main.yml
@@ -74,7 +74,6 @@
     - copy:
         content: "{{ koji_admin_secret.data['client.pem'] | b64decode }}"
         dest: "{{ kojira_dir.path }}/admin.pem"
-    #
     - k8s_info:
         api_version: v1
         kind: Secret
@@ -89,16 +88,12 @@
     - copy:
         content: "{{ koji_ca_secret.data['cert'] | b64decode }}"
         dest: "{{ kojira_dir.path }}/ca.pem"
-    #
-    - koji_user:
-        server: "https://{{ kojira_hub_host }}/kojihub"
-        username: "{{ kojira_hub_username }}"
+    - ktdreyer.koji_ansible.koji_user:
+        koji: "{{ meta.name  }}-{{ meta.namespace }}"
+        name: "{{ kojira_hub_username }}"
         permissions:
           - repo
-        ssl_auth:
-          cert: "{{ kojira_dir.path }}/admin.pem"
-          serverca: "{{ kojira_dir.path }}/ca.pem"
-          verify: false
+        state: enabled
     - file:
         state: absent
         path: "{{ koji_dir.path }}"