Detect RHEL more comprehensively #93

Closed ghost closed 3 years ago

In GitLab by @infinitewarp on Jul 20, 2018, 19:00

Summary

As a customer, I want houndigrade to more accurately and comprehensively detect RHEL and for cloudigrade to record and return houndigrade's detailed reasons so I can trust its results.

Note: Resolving this issue should include changes for both houndigrade and cloudigrade.

When we first built houndigrade, we simply looked at /etc/release files to determine if the image contains RHEL. Since then, we've learned that there are better ways to make this determination. We need to find those ways and try to implement them.

See also OnDemand Pilot Reqs: Public Cloud which references Formalize Fingerprints. As of the time of this writing, that definition includes:

1 or more Red Hat signed packages from a RHEL repository

Product Certificate exists as /etc/pki/product/*.pem . In (decrypted) cert contents, find ...

Product:

Name: foo

Foo matches “Red Hat Enterprise Linux”

Release file indicates RHEL

Follow up on consistency of naming in release file (or lack thereof)

Active RHEL repositories

Repository configuration files indicate that a stanza is active (active = 1)

Active repository stanza matches “Red Hat Enterprise Linux”

Implementation details of the API response payload to be determined during development. Be sure to discuss this with @cdcabrera along the way so we don't make bad decisions for frontigrade.

Acceptance Criteria

Verify RHEL is identified by houndigrade for each of the criteria:
- [ ] an image with 1 or more Red Hat signed packages from a RHEL repository
- [ ] an image with 1 or more product certificates in /etc/pki/product/*.pem that has a product name matching "Red Hat Enterprise Linux"
- [ ] an image with a release file that indicates RHEL
- [ ] an image with a repository with active=1 whose stanza matches "Red Hat Enterprise Linux"
- [ ] an image that meets two or more of the above criteria
[ ] Verify that the result data structure sent from houndigrade's inspection includes something to indicate presence of successful match on each of the criteria.
[ ] Verify that the presence of each of these criteria is individually recorded in cloudigrade's model.
[ ] Verify that if any criteria are met, we indicate that the image "is RHEL".
[ ] Verify that if no criteria are met, we indicate that the image "is not RHEL".
[x] Verify that an issue exists for tracking integration tests! (see https://gitlab.com/cloudigrade/integrade/issues/85)

Assumptions and Questions

How many (and which) of these criteria are critical for the pilot launch? Can or should any of these be deferred?
- Answer: All of them unless something is impossible. The most critical is the "is a Red Hat signed package installed".
We are not yet concerned with the "challenging" issue in this issue's implementation. Further, issuing a "challenge" affects the whole image for this user, not specific criteria.
Do we need to enumerate all of the specific things we find? For example, if there are multiple certificates, do we need to track all of them?
- Answer: No, we just track "yes" or "no" to each of the four general criteria:
  - Y/N? found a red hat signed package installed
  - Y/N? found a red hat product certificate
  - Y/N? found a red hat release file
  - Y/N? found an active red hat repository
The list of things we ultimately give the user will be ways we positively identified RHEL, not including all the ways to did not find RHEL.

In GitLab by @infinitewarp on Jul 20, 2018, 19:04

changed title from Detect RHEL more {-accurat-}ely to Detect RHEL more {+comprehensiv+}ely

In GitLab by @infinitewarp on Jul 20, 2018, 19:04

changed the description

In GitLab by @infinitewarp on Jul 23, 2018, 14:32

changed the description

In GitLab by @infinitewarp on Jul 23, 2018, 14:34

changed the description

In GitLab by @infinitewarp on Jul 23, 2018, 14:35

changed the description

In GitLab by @infinitewarp on Jul 23, 2018, 14:38

changed the description

In GitLab by @infinitewarp on Jul 24, 2018, 13:12

changed the description

In GitLab by @infinitewarp on Jul 24, 2018, 13:13

changed the description

In GitLab by @infinitewarp on Jul 24, 2018, 16:24

changed the description

In GitLab by @infinitewarp on Jul 24, 2018, 16:24

changed the description

In GitLab by @infinitewarp on Jul 24, 2018, 16:27

changed weight to 8

In GitLab by @kholdaway on Aug 2, 2018, 10:24

assigned to @kholdaway

In GitLab by @kholdaway on Aug 2, 2018, 10:24

assigned to @abaiken

In GitLab by @erezende on Aug 3, 2018, 09:03

changed the description

In GitLab by @erezende on Aug 3, 2018, 09:03

marked the task Verify that an issue exists for tracking integration tests! (see https://gitlab.com/cloudigrade/integrade/issues/85) as completed

In GitLab by @erezende on Aug 3, 2018, 09:03

marked this issue as related to integrade#85

In GitLab by @infinitewarp on Aug 6, 2018, 09:30

marked this issue as related to cloudigrade#446

In GitLab by @abaiken on Aug 13, 2018, 23:14

mentioned in merge request !64

In GitLab by @kholdaway on Aug 15, 2018, 10:17

changed the description

In GitLab by @kholdaway on Aug 17, 2018, 14:24

Demo with enabled repos and certs --> https://drive.google.com/open?id=1zTXuKganLkY0NU0dGkAONoAamr1KFh0e

In GitLab by @elijahd on Aug 23, 2018, 11:21

I can't currently verify this in a end-to-end test because of https://gitlab.com/cloudigrade/cloudigrade/issues/464 preventing the results being processed and showing up in the API

In GitLab by @elijahd on Aug 24, 2018, 15:59

I have seen it in action!

Verified

In GitLab by @elijahd on Aug 24, 2018, 15:59

closed

In GitLab by @elijahd on Aug 24, 2018, 16:00

{'created_at': '2018-08-24T19:47:26.710727Z',
              'ec2_ami_id': 'ami-0a0c971e6f4a04a60',
              'id': 1,
              'is_encrypted': False,
              'openshift': True,
              'openshift_challenged': False,
              'openshift_detected': True,
              'owner_aws_account_id': '439727791560',
              'resourcetype': 'AwsMachineImage',
              'rhel': True,
              'rhel_challenged': False,
              'rhel_detected': True,
              'rhel_enabled_repos_found': True,
              'rhel_product_certs_found': True,
              'rhel_release_files_found': True,
              'rhel_signed_packages_found': True,
              'status': 'inspected',
              'updated_at': '2018-08-24T19:55:34.301734Z'},

cloudigrade / houndigrade