* [#1548] Add support for dynamic rollouts
-- Current status --
Initial draft only !!!, to be improved
TODO:
* evaluate the target count - if update group/rollout total count fails dynamic updates could (?), actually, contain more targets
* is it needed to break handler on group creating?
* if dynamic group schedulers occur to be heavy - maybe a handler per tenant will ensure that one tenant won't break all
*Concept for dynamic groups*:
Rollouts are static and dynamic.
Static rollouts consist of static groups only while dynamic rollouts have a number of static groups (first groups) and then an unlimited number of dynamic groups.
Group targets assignments:
* static groups include ALL matching targets created at the time the rollout was created, nevertheless they have active actions with bigger weight or not. Actions for the rollout and included targeets however are created at the start time.
* dynamic groups however are filled in when started and consider the action weight. The targets included in a dynamic group are:
* matching (filter and distribution set compatible)
* not included in this or following rollout static groups (if already included in any of the following rollouts - it's intended to be overridden)
* not in active actions of any rollouts with equal or bigger weight
In general, when you create a rollout it contains all matching targets available at create time overriding any previous rollouts, actions, and so on. If the rollout is dynamic when its dynamic group becomes running it gets only matching targets that doesn't belong to static groups or have actions with great or equal weight
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* [#1548] Add 1000 weight for actions, rollouts and auto assignments without weight
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
---------
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Introduce the AccessControlManager and use if for the TargetManagement and TargetTypeManagement.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Extend the access control manager by an API to serialize the current active context and persist it for scheduled background operations like auto-assignment.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Verify modification is permitted before performing automatic assignment
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Start with controlling distribution set type access. Perform some refactoring.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Support distribution set access control. Increase character limit to 512 chars for access control context. Refactor default implementations.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Introduce ContextRunner and define admin execution to check for duplicates before creating/updating entities.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Introduce Software Module, Module Type and Artifact control management. Fix tests.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Introduce access controlling test base. Add first test verifying the read operations for target types.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Finalize target type access controlling test.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Introduce ContextRunnerTest and TargetAccessControllingTest.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Introduce DistributionSetAccessControllingTest and fix missing access control specifications.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Extend test cases. Include only updatable targets into rollout.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Fix action visibility.
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
* Modifiable->Updatable & UPDATE check where needed
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* ContextRunner superseded by ContextAware
+ ContextRunner remaned to ContextAware (move as a cenral entry/concept).
It now extends (and replace) TenantAware
+ SecurityContextTenantAware becomes ContextAware
+ Pluggable serialization mechanism
(default Java serialization of contexts) for SecurityContextTenantAware
(using SecurityContextSerializer)
+ AccessControl methods are added to ensure no entities fill be retrieved
just to call access control - so, if all permitted - no additional db
queries will be made
+ <repo type>AccessControl classes removed and replaced with
AccessControl <repo type> generics
+ AccessControlService removed - every AccessControl is registered and
overiden independently
+ access_control_context in DB increased to 4k (in order to support java
security context serialization)
+ needed adaptaion of implemtation and tests done
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Refactor SoftModules & DistSets
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Refactoring of the Repositories
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Repostiotory level permissions
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Improvements
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Simplification of AccessControl interface
* Simplifications & management package
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Implementation improvements
+ Artifact management & repo reviewed and tuned
+ Action(Status) management & repo reviewed and tuned
+ SoftwareModule(Type/Meta) management & repo reviewed and tuned
+ DistributionSet(Type/Tag/Meta) management(+Invalidation) & repo reviewed and tuned
+ Target(Tag/Type/Meta) management & repo reviewed and tuned
+ TargetQueryFilter management & repo reviewed and tuned
* Apply suggestions from code review
Suggestions accepted. Thanks @herdt-michael
Co-authored-by: Michael Herdt <michael.herdt@bosch.com>
* Apply suggestions from code review 2
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
---------
Signed-off-by: Michael Herdt <Michael.Herdt@bosch.io>
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
Co-authored-by: Michael Herdt <Michael.Herdt@bosch.com>
* REST API extend System Configuration to support Default DistributionSet Type
* Remove leftover comment
* After review - changing the Default DistributionSetType type to long
* After review - Remove CustomMatcher for Numbers equals, rename test methods to more descriptive naming
* Simplify
Since now hawkBit support Swagger and OpenAPI the documentation is built
using redoc based on OpenAPI definitions. Spring REST documentation is
not needed anymore.
Since this Spring REST doc is not needed and it duplicates API
documentation (no single source of truth and hard to maintain) with this
commit it is removed.
Some tests from the Spring REST doc that seems are not covered by the
JUnit of the resource modules are moved in the resource JUnit tests.
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Add DDI Authentication (using apikey)
* Gateway token by passing as apikey "GatewayToken: <token>"
* Target token by passing as apikey "TargetToken: <token>"
* Removed Bearer auth as not supported
* Authentication schemes are set to the correspondent groups in order to be visible only where needed
* Optional OpenAPI (with property _hawkbit.server.swagger.enabled_, by default _true_)
Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
* Introduce request parameter to request download URLs when retrieving list of artifacts for a specific software module.
* Fix DDI integration test by aligning download path to new config
* Make use of mgmt representation mode in sw-module mgmt api
* Changed path
* refactor test names
* Add validation for deployment groups and rollouts
* NOT_FOUND status code instead of BAD_REQUEST
* NOT_FOUND status code instead of BAD_REQUEST
* Change the returned message
Signed-off-by: Stanislav Trailov <stanislav.trailov@bosch.io>
* Do some refactoring to fix dependencies between rollout management, executor and evaluator beans.
* Move rollout retrieving in same transaction as execution.
* Do some refactoring. Extend logging and exception handling.
* Remove unnecessary transactional and validation annotations.
* remove catching never thrown bean
* Fix new rollout handling API
* Expose forceTime and startAt fields in rollout representation in Mgmt API
* Change "forceTime" to "forcetime"
* Add checks when making a POST request in the tests
* Change forced to timeforced in tests and extend validity check
* Pass aforcetime and startat arguments as test checks
* remove unused import
Signed-off-by: Stanislav Trailov <stanislav.trailov@bosch.io>
* Fix formatting of the sub entity attribute by verifying the formatting against the sub entity attributes list of the related parent property enum.
* Verify action API by target property filter
