Fine-Grained Role Configuration for Console Access (hawtio)

.github/workflows/ci.yml

@@ -23,6 +23,6 @@ jobs:
       molecule_tests: >-
         [ "static_cluster", "replication", "live_only", "mirroring" ]
       podman_tests_current: >-
-        [ "default", "amq_upgrade", "custom_xml", "federation", "mask_passwords", "uninstall" ]
+        [ "default", "amq_upgrade", "custom_xml", "federation", "mask_passwords", "uninstall", "console_access" ]
       podman_tests_next: >-
-        [ "default", "amq_upgrade", "custom_xml", "federation", "mask_passwords", "uninstall" ]
+        [ "default", "amq_upgrade", "custom_xml", "federation", "mask_passwords", "uninstall", "console_access" ]

molecule/console_access/converge.yml

@@ -0,0 +1,126 @@
+---
+- name: Converge
+  hosts: all
+  gather_facts: yes
+  environment:
+    http_proxy: "{{ lookup('env', 'PROXY') }}"
+    https_proxy: "{{ lookup('env', 'PROXY') }}"
+    no_proxy: "{{ lookup('env', 'NO_PROXY') }}"
+  module_defaults:
+    ansible.builtin.get_url:
+      validate_certs: "{{ not lookup('env', 'PROXY') != '' }}"
+  vars:
+    activemq_service_user_home: /home/activemq
+    activemq_network_check_enabled: true
+    activemq_message_counter_enabled: true
+    activemq_network_check_list: "127.0.0.1,8.8.8.8,{{ inventory_hostname }},{{ ansible_all_ipv4_addresses | join(',') }}"
+    activemq_hawtio_roles: [ 'admin', 'monitoring' ]
+    activemq_users:
+      - user: amq
+        password: amqbrokerpass
+        roles: [ admin ]
+      - user: operator
+        password: amqoperatorpass
+        roles: [ operate ]
+      - user: other
+        password: amqotherpass
+        roles: [ consumer, producer, monitoring ]
+      - user: business
+        password: amqbusinesspass
+        roles: [ specific ]
+    activemq_roles:
+      - name: admin
+        permissions: [ createNonDurableQueue, deleteNonDurableQueue, createDurableQueue, deleteDurableQueue, createAddress, deleteAddress, consume, browse, send, manage ]
+      - name: manager
+        permissions: [ browse, manage ]
+      - name: topicsmanager
+        match: topics.#
+        permissions: [ createNonDurableQueue, deleteNonDurableQueue, createDurableQueue, deleteDurableQueue, browse, manage ]
+      - name: consumer
+        match: topics.#
+        permissions: [ consume, browse ]
+      - name: producer
+        match: topics.#
+        permissions: [ send, browse ]
+    activemq_management_access_default:
+      - methods: [ 'list*', 'get*', 'is*', 'browse*', 'count*' ]
+        roles: [ 'operate' ]
+      - methods: [ 'set*', '*' ]
+        roles: [ ]
+    activemq_management_access_domains:
+      - accesses:
+          - methods: [ 'list*', 'get*', 'is*', 'set*', 'browse*', 'count*', '*' ]
+            roles: [ ]
+      - key: 'address=queue.*'
+        accesses:
+          - methods: [ 'list*', 'get*', 'is*', 'browse*', 'count*' ]
+            roles: [ 'specific' ]
+          - methods: [ 'set*', '*' ]
+            roles: [ ]
+    activemq_acceptors:
+      - name: artemis
+        bind_address: "{{ activemq_host }}"
+        bind_port: "{{ activemq_port }}"
+        parameters:
+          tcpSendBufferSize: 1048576
+          tcpReceiveBufferSize: 1048576
+          protocols: CORE,MQTT
+          useEpoll: true
+      - name: amqp
+        scheme: tcp
+        bind_address: "{{ activemq_host }}"
+        bind_port: "{{ activemq_port_amqp }}"
+        parameters:
+          tcpSendBufferSize: 1048576
+          tcpReceiveBufferSize: 1048576
+          protocols: AMQP
+          useEpoll: true
+          amqpMinLargeMessageSize: 102400
+          amqpCredits: 1000
+          amqpLowCredits: 300
+          amqpDuplicateDetection: true
+      - name: invm
+        scheme: vm
+    activemq_diverts:
+      - name: TESTDIVERT
+        address: queue.in
+        forwarding_address: queue.out
+        routing_type: ANYCAST
+        filter: "msgType LIKE '%ff%'"
+        exclusive: True
+    activemq_addresses:
+      - name: queue.in
+        anycast:
+          - name: queue.in
+      - name: queue.out
+        anycast:
+          - name: queue.out
+      - name: other.queue.out
+        anycast:
+          - name: other.queue.out
+      - name: DLQ
+        anycast:
+          - name: DLQ
+            parameters:
+              durable: True
+      - name: ExpiryQueue
+        anycast:
+          - name: ExpiryQueue
+      - name: importantTopic
+        multicast:
+      - name: client123.pubsub
+        multicast:
+          - name: client123.pubsub.foo
+            parameters:
+              max_consumers: 1
+              delay_before_dispatch: 3
+    activemq_broker_plugins:
+      - class_name: org.apache.activemq.artemis.core.server.plugin.impl.LoggingActiveMQServerPlugin
+        properties:
+          LOG_DELIVERING_EVENTS: true
+          LOG_SENDING_EVENTS: true
+      - class_name: org.apache.activemq.artemis.core.server.plugin.impl.NotificationActiveMQServerPlugin
+        properties:
+          SEND_SESSION_NOTIFICATIONS: true
+  roles:
+    - middleware_automation.amq.activemq

molecule/console_access/molecule.yml

@@ -0,0 +1,43 @@
+---
+driver:
+  name: podman
+platforms:
+  - name: instance
+    image: registry.access.redhat.com/ubi9/ubi-init:latest
+    pre_build_image: true
+    privileged: true
+    command: "/usr/sbin/init"
+    systemd: always
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      interpreter_python: auto_silent
+    ssh_connection:
+      pipelining: false
+  playbooks:
+    prepare: prepare.yml
+    converge: converge.yml
+    verify: verify.yml
+  inventory:
+    host_vars:
+      localhost:
+        ansible_python_interpreter: "{{ ansible_playbook_python }}"
+  env:
+    ANSIBLE_FORCE_COLOR: "true"
+    PROXY: "${PROXY}"
+    NO_PROXY: "${NO_PROXY}"
+verifier:
+  name: ansible
+scenario:
+  test_sequence:
+    - cleanup
+    - destroy
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - side_effect
+    - verify
+    - cleanup
+    - destroy

molecule/console_access/prepare.yml

@@ -0,0 +1,6 @@
+---
+- name: Prepare
+  hosts: all
+  tasks:
+    - name: "Run preparation common to all scenario"
+      ansible.builtin.include_tasks: ../prepare.yml

molecule/console_access/roles

@@ -0,0 +1 @@
+../../roles