Actions
Issue #8290
closedPulp_ansible unable to sync from galaxy endpoint with token whereas ansible-galaxy client can
Start date:
Due date:
Estimated time:
Severity:
2. Medium
Platform Release:
OS:
Triaged:
No
Groomed:
No
Sprint Candidate:
No
Tags:
Sprint:
Quarter:
Description
Steps to reproduce: Set up a remote with a token and point to a galaxy instance.
{
"auth_url": null,
"ca_cert": null,
"client_cert": null,
"client_key": null,
"download_concurrency": 10,
"name": "hub_1-128797",
"password": null,
"policy": "immediate",
"proxy_url": null,
"pulp_created": "2021-02-19T19:05:47.231796Z",
"pulp_href": "/pulp/api/v3/remotes/ansible/collection/91c20a7d-8477-48d8-86df-46755cdffcae/",
"pulp_last_updated": "2021-02-22T16:53:00.377091Z",
"requirements_file": "---\ncollections:\n- ibm.cloudcollection",
"tls_validation": false,
"token": "xxx-valid-token-xxx",
"url": "https://hostname/api/galaxy/content/community/",
"username": null
},
When syncing this, I get a 403 from the endpoint with the following logs:
Feb 22 17:13:53 hub-sat1-v4-2-1-jhardy gunicorn[74032]: pulp: django.request:WARNING: Forbidden: /api/galaxy/content/community/
Feb 22 17:13:53 hub-sat1-v4-2-1-jhardy gunicorn[74032]: pulp [-]: - - [22/Feb/2021:17:13:53 +0000] "GET /api/galaxy/content/community/ HTTP/1.0" 403 112 "-" "pulpcore/3.7.3 (cpython 3.6.8-final0, Linux x86_64) (aiohttp 3.7.2)"
Feb 22 17:13:54 hub-sat1-v4-2-1-jhardy gunicorn[74032]: pulp: django.request:WARNING: Forbidden: /api/galaxy/content/community/api/
Feb 22 17:13:54 hub-sat1-v4-2-1-jhardy gunicorn[74032]: pulp [-]: - - [22/Feb/2021:17:13:54 +0000] "GET /api/galaxy/content/community/api/ HTTP/1.0" 403 112 "-" "pulpcore/3.7.3 (cpython 3.6.8-final0, Linux x86_64) (aiohttp 3.7.2)"
PS: "tls_validation": false is set on the remote.
A ansible-galaxy client with the below cfg file:
[galaxy] server_list = community_repo
[galaxy_server.community_repo] url=https://hostname/api/galaxy/content/community/ token=xxx-valid-token-xxx
gives the following results:
Secure:
# ansible-galaxy collection install -p ./ ibm.cloudcollection
Process install dependency map
ERROR! Unknown error when attempting to call Galaxy at 'https://hub-sat1-v4-2-1-jhardy.c.ansible-tower-engineering.internal/api/galaxy/content/community/api': <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618)>
Ignore SSL certificate validation errors with -c :
# ansible-galaxy collection install -c -p ./ ibm.cloudcollection
Process install dependency map
Starting collection install process
Installing 'ibm.cloudcollection:1.21.0' to '/root/ansible_collections/ibm/cloudcollection'
Expected result: Pulp_Ansible should be able to ignore cert validations and sync successfully when tls_validation is off.
Actions
Use DRF token when no auth_url is provided
https://pulp.plan.io/issues/8290 closes #8290