From a96a26cbb2b3516c69898eccbb7ee0ccfababae1 Mon Sep 17 00:00:00 2001
From: Hunor Csomortáni <csomh@redhat.com>
Date: Apr 12 2021 10:56:50 +0000
Subject: Require basic authentication for POST requests


This updates the OpenShift test template to require basic
authentication for POST requests.

Signed-off-by: Hunor Csomortáni <csomh@redhat.com>

---

diff --git a/openshift/README.md b/openshift/README.md
index cfc0516..00159d1 100644
--- a/openshift/README.md
+++ b/openshift/README.md
@@ -21,10 +21,11 @@ configuration option.
 There are two volumes expected to be mounted, holding configuration for
 ResultsDB and httpd:
 
-1. The volume mounted at `/etc/resultsdb` should have `settings.py`, holding
-   ResultsDB configuration. For an example, see `settings.py` in
+1. The volume mounted at `/etc/resultsdb` should have `settings.py` and `.htpasswd`.  
+   The former holds ResultsDB configuration. For an example, see `settings.py` in
    `resultsdb-test-template.yaml`, or `conf/settings.py.example`
-   for a full list of configuration options.
+   for a full list of configuration options.  
+   `.htpasswd` holds user data for basic auth, and it's generated using `htpasswd`.
 
 2. The volume mounted at `/etc/httpd/conf.d` should have `resultsdb.conf`,
    holding httpd configuration to be used by `mod_wsgi-express`. For an
diff --git a/openshift/resultsdb-test-template.yaml b/openshift/resultsdb-test-template.yaml
index 2b5767d..52d2b17 100644
--- a/openshift/resultsdb-test-template.yaml
+++ b/openshift/resultsdb-test-template.yaml
@@ -65,32 +65,36 @@ objects:
       MESSAGE_BUS_PLUGIN = 'fedmsg'
       MESSAGE_BUS_KWARGS = {'modname': 'resultsdb'}
       ADDITIONAL_RESULT_OUTCOMES = ${RESULTSDB_ADDITIONAL_RESULT_OUTCOMES}
+    # Credentials are resultsdb-updater:password
+    .htpasswd: |-
+      resultsdb-updater:$2y$05$yAlqAYWqfMoxAMrFgFMfpuQsDw.v5b4tuS8x43h6tcPP1gIXBRutq
 - apiVersion: v1
   kind: ConfigMap
   metadata:
-    name: "resultsdb-test-${TEST_ID}-public-httpd-config"
-    labels:
-      environment: "test-${TEST_ID}"
-      app: resultsdb
-  data:
-    resultsdb.conf: |-
-      <Location "/">
-        # <RequireAny>
-        #   # allow only GET
-        #   Require method GET
-        # </RequireAny>
-      </Location>
-- apiVersion: v1
-  kind: ConfigMap
-  metadata:
-    name: "resultsdb-test-${TEST_ID}-internal-httpd-config"
+    name: "resultsdb-test-${TEST_ID}-httpd-config"
     labels:
       environment: "test-${TEST_ID}"
       app: resultsdb
   data:
     resultsdb.conf: |-
+      <IfModule !auth_basic_module>
+        LoadModule auth_basic_module '${MOD_WSGI_MODULES_DIRECTORY}/mod_auth_basic.so'
+      </IfModule>
+      <IfModule !authn_file_module>
+        LoadModule authn_file_module '${MOD_WSGI_MODULES_DIRECTORY}/mod_authn_file.so'
+      </IfModule>
+      <IfModule !authz_user_module>
+        LoadModule authz_user_module '${MOD_WSGI_MODULES_DIRECTORY}/mod_authz_user.so'
+      </IfModule>
+
       <Location "/">
-      # allow all methods
+        AuthType Basic
+        AuthName "Authentication Required"
+        AuthBasicProvider file
+        AuthUserFile "/etc/resultsdb/.htpasswd"
+        <LimitExcept GET>
+          Require valid-user
+        </LimitExcept>
       </Location>
 - apiVersion: v1
   kind: Service
@@ -197,22 +201,6 @@ objects:
       termination: edge
       insecureEdgeTerminationPolicy: Redirect
 - apiVersion: v1
-  kind: Service
-  metadata:
-    name: "resultsdb-test-${TEST_ID}-internal-api"
-    labels:
-      environment: "test-${TEST_ID}"
-      app: resultsdb
-  spec:
-    selector:
-      app: resultsdb
-      environment: "test-${TEST_ID}"
-      service: internal-api
-    ports:
-    - name: api
-      port: 5001
-      targetPort: 5001
-- apiVersion: v1
   kind: DeploymentConfig
   metadata:
     name: "resultsdb-test-${TEST_ID}-api"
@@ -221,73 +209,11 @@ objects:
       service: api
       app: resultsdb
   spec:
-    replicas: 1
+    replicas: 2
     selector:
       app: resultsdb
       environment: "test-${TEST_ID}"
       service: api
-    template:
-      metadata:
-        labels:
-          environment: "test-${TEST_ID}"
-          service: api
-          app: resultsdb
-      spec:
-        containers:
-        - name: api
-          image: "${RESULTSDB_IMAGE}"
-          imagePullPolicy: Always
-          ports:
-          - containerPort: 5001
-          volumeMounts:
-          - name: config-volume
-            mountPath: /etc/resultsdb
-            readOnly: true
-          - name: httpd-config-volume
-            mountPath: /etc/httpd/conf.d
-            readOnly: true
-          readinessProbe:
-            timeoutSeconds: 1
-            initialDelaySeconds: 5
-            httpGet:
-              path: /api/v2.0/
-              port: 5001
-          livenessProbe:
-            timeoutSeconds: 1
-            initialDelaySeconds: 30
-            httpGet:
-              path: /api/v2.0/
-              port: 5001
-          # Limit to 384MB memory. This is probably *not* enough but it is
-          # necessary in the current environment to allow for 2 replicas and
-          # rolling updates, without hitting the (very aggressive) memory quota.
-          resources:
-            limits:
-              memory: 384Mi
-              cpu: 0.3
-        volumes:
-        - name: config-volume
-          secret:
-            secretName: "resultsdb-test-${TEST_ID}-config"
-        - name: httpd-config-volume
-          configMap:
-            name: "resultsdb-test-${TEST_ID}-public-httpd-config"
-    triggers:
-    - type: ConfigChange
-- apiVersion: v1
-  kind: DeploymentConfig
-  metadata:
-    name: "resultsdb-test-${TEST_ID}-internal-api"
-    labels:
-      environment: "test-${TEST_ID}"
-      service: internal-api
-      app: resultsdb
-  spec:
-    replicas: 1
-    selector:
-      app: resultsdb
-      environment: "test-${TEST_ID}"
-      service: internal-api
     strategy:
       type: Rolling
       rollingParams:
@@ -317,7 +243,7 @@ objects:
       metadata:
         labels:
           environment: "test-${TEST_ID}"
-          service: internal-api
+          service: api
           app: resultsdb
       spec:
         containers:
@@ -356,8 +282,9 @@ objects:
         - name: config-volume
           secret:
             secretName: "resultsdb-test-${TEST_ID}-config"
+            defaultMode: 0600
         - name: httpd-config-volume
           configMap:
-            name: "resultsdb-test-${TEST_ID}-internal-httpd-config"
+            name: "resultsdb-test-${TEST_ID}-httpd-config"
     triggers:
     - type: ConfigChange