Add IOP by ehelms · Pull Request #280 · theforeman/foremanctl

ehelms · 2025-11-02T15:25:41Z

No description provided.

ehelms · 2025-12-12T12:57:45Z

@evgeni Could you check just the github action part of the commit (eb1df00) to make sure it matches with how you think we should use matrix?

.github/workflows/test.yml

evgeni · 2025-12-12T13:14:25Z

.github/workflows/test.yml

+      - name: Enable iop
+        if: matrix.iop == 'enabled'
+        run: |
+          ./foremanctl deploy --add-feature iop


calls to foremanctl deploy are expensive (adds ca 2 minutes to the execution), so I wonder if it'd be smarter to have fewer of those "add optional feature" steps and use something like {{ matrix.iop == 'enabled' && '--add-feature iop' || '' }} inside an existing step

evgeni · 2025-12-12T13:15:08Z

@evgeni Could you check just the github action part of the commit (eb1df00) to make sure it matches with how you think we should use matrix?

I think it can be optimized, posted comments how :)

ehelms · 2025-12-15T17:00:42Z

@evgeni For now, I want to keep the same behavior of not supporting remote database yet. Looking at Obsah, I don't think that's possible but I wanted you to check me on that. I need to forbid:

database_mode == external and 'iop' in enabled_features

forbidden_if looks like it only allows the first parameter to have a value. Do I read that correctly?

evgeni · 2025-12-18T10:02:49Z

@evgeni For now, I want to keep the same behavior of not supporting remote database yet. Looking at Obsah, I don't think that's possible but I wanted you to check me on that. I need to forbid:
* database_mode == external and 'iop' in enabled_features
forbidden_if looks like it only allows the first parameter to have a value. Do I read that correctly?

That's correct, today we can only forbid "if param P has value Y you can't set params A and B at all"

You could add a check, that's more flexible than what you get at the obsah level?

ehelms · 2025-12-18T13:44:08Z

You could add a check, that's more flexible than what you get at the obsah level?

I could... just less clear then when do we do parameter validation at the CLI level and when do we do it at the checks level.

ehelms · 2025-12-18T16:37:30Z

Here is my attempt to implement that structure: theforeman/obsah#104

pablomh

Builds and creates running services :)

src/roles/iop_advisor/defaults/main.yaml

src/roles/iop_inventory/defaults/main.yaml

src/roles/iop_remediation/defaults/main.yaml

src/roles/iop_vmaas/defaults/main.yaml

src/roles/iop_vulnerability/defaults/main.yaml

Signed-off-by: Eric D. Helms <ericdhelms@gmail.com>

ehelms · 2026-02-03T13:13:33Z

I'll need theforeman/puppet-certs#505 to get in so that installer certificate testing can pass.

Signed-off-by: Eric D. Helms <ericdhelms@gmail.com>

vkrizan · 2026-02-19T14:24:45Z

src/roles/iop_engine/defaults/main.yaml

@@ -0,0 +1,8 @@
+---
+iop_engine_container_image: "quay.io/iop/insights-engine"
+iop_engine_container_tag: "foreman-3.16"


Is there any reason to split image and its tag? Doing so this split would prevent anyone using digest only? Although with a combination with a tag the digest can still be used.

Why does it prevent using digest only?

IIRC the reasoning was to make it easier to do what we do in the vars file: https://github.com/theforeman/foremanctl/blob/master/src/vars/images.yml#L1C1-L1C21

We can set the current tag for all images without having to touch the registry information and vice versa.

In that case feel free to keep it as is.

The digest only could look like

quay.io/iop/insights-engine@sha256:7a777a4ff121d259c9e592ce2425006631ecdaa7f3b001b184ede049b2a7a7a9

with the split and format it would end up as invalid reference format because of that colon

quay.io/iop/insights-engine:@sha256:7a777a4ff121d259c9e592ce2425006631ecdaa7f3b001b184ede049b2a7a7a9 ^

Oh I see. That's a fair call out, will you make a Github issue with that? I don't want to change the paradigm already present in the repository with this PR but I agree we should explore that.

vkrizan · 2026-02-19T14:51:45Z

tests/conftest.py

+
+
+def pytest_runtest_setup(item):
+    if "iop" in item.nodeid.lower():


Pytest has markers that could be utilized instead of a substring match of a test name which is rigid.

I don't know what that means or would entail, but I'll look it up.

https://docs.pytest.org/en/stable/example/markers.html

vkrizan · 2026-02-19T14:56:10Z

tests/iop/test_kafka.py

-    assert "running" in result.stdout
-
-
-def test_kafka_quadlet_file(server):


Why are these two tests being removed in this commit (and overall)?

Which commit? The interface doesn't actually show me.

cf46b19
Add iop_ingress

ehelms force-pushed the add-iop branch 5 times, most recently from bfdcd43 to 2fd7276 Compare November 4, 2025 01:51

ehelms marked this pull request as ready for review November 4, 2025 16:45

ehelms mentioned this pull request Nov 6, 2025

make features and flavors configurable #188

Merged

ehelms force-pushed the add-iop branch from 2fd7276 to 3dff1ce Compare November 6, 2025 15:50

ehelms force-pushed the add-iop branch 2 times, most recently from 71ce03e to 4cf96ac Compare November 25, 2025 20:35

ehelms force-pushed the add-iop branch 6 times, most recently from ddfec69 to eb1df00 Compare December 11, 2025 20:38

evgeni reviewed Dec 12, 2025

View reviewed changes

.github/workflows/test.yml Outdated Show resolved Hide resolved

evgeni reviewed Dec 12, 2025

View reviewed changes

ehelms force-pushed the add-iop branch 5 times, most recently from a200e68 to ffcfc02 Compare December 15, 2025 16:58

ehelms force-pushed the add-iop branch 2 times, most recently from d5bfe6f to 1b2bf3f Compare December 17, 2025 21:29

ehelms force-pushed the add-iop branch 3 times, most recently from 95c8203 to acbe14a Compare December 18, 2025 19:44

pablomh reviewed Dec 19, 2025

View reviewed changes

ehelms force-pushed the add-iop branch from acbe14a to ce53edd Compare January 6, 2026 15:31

ehelms changed the title ~~Add core services for iop~~ Add IOP Jan 20, 2026

ehelms added 5 commits January 31, 2026 15:17

Add iop_kafka

54c7066

Signed-off-by: Eric D. Helms <ericdhelms@gmail.com>

Add iop_ingress

cf46b19

Add iop_puptoo

369e525

Add iop_yuptoo

ffd623f

Add iop_engine

8284d34

ehelms force-pushed the add-iop branch 2 times, most recently from e96e49f to c333fd0 Compare February 2, 2026 13:58

ehelms force-pushed the add-iop branch 3 times, most recently from 85f7f48 to 2e42420 Compare February 4, 2026 13:24

ehelms added 7 commits February 4, 2026 10:03

Add iop_gateway

d860044

Add iop_inventory

f031baf

Signed-off-by: Eric D. Helms <ericdhelms@gmail.com>

Add iop_advisor

f497f71

Signed-off-by: Eric D. Helms <ericdhelms@gmail.com>

Add iop_remediation

5d45dbf

Add iop_vmaas and iop_vulnerability

f5bf658

Signed-off-by: Eric D. Helms <ericdhelms@gmail.com>

Add frontends for advisor and vulnerability

41ae84b

Add iop test github actions

15296d6

Signed-off-by: Eric D. Helms <ericdhelms@gmail.com>

ehelms force-pushed the add-iop branch from 2e42420 to 15296d6 Compare February 4, 2026 15:03

Specify explicit volume mount permissions

9ad0e2e

evgeni mentioned this pull request Feb 16, 2026

add first feature metadata draft #372

Open

vkrizan reviewed Feb 19, 2026

View reviewed changes



		def pytest_runtest_setup(item):
		if "iop" in item.nodeid.lower():

		assert "running" in result.stdout


		def test_kafka_quadlet_file(server):

Comments

Conversation

ehelms commented Nov 2, 2025

Uh oh!

ehelms commented Dec 12, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

evgeni commented Dec 12, 2025

Uh oh!

ehelms commented Dec 15, 2025

Uh oh!

evgeni commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ehelms commented Dec 18, 2025

Uh oh!

ehelms commented Dec 18, 2025

Uh oh!

pablomh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ehelms commented Feb 3, 2026

Uh oh!

vkrizan Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

evgeni commented Dec 18, 2025 •

edited

Loading

vkrizan Feb 19, 2026 •

edited

Loading