Add ROXAGENT role execution, to provide Client side for RHACS VM Scanning

[sluetze]

Together with stormshift/clusters#37, this provides an automation to deploy roxagent on VMs that are labeled with stormshift.coe.muc.redhat.com/roxagent: 'true'

IMPORTANT

currently there are multiple defaults defined for the security-aap, an AAP instance that I used for development. I can modify them if wanted to default to the ISAR AAP, which should be the goal.

This Role also requires a credential to be defined with access to VMs to fill the inventory

# Cluster access for AAP: VM inventory enumeration and virtctl SSH port-forward.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: sluetzen-vm-vuln-demo-kubevirt-aap-vm-enum
rules:
  - apiGroups:
      - kubevirt.io
    resources:
      - virtualmachines
      - virtualmachineinstances
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - subresources.kubevirt.io
    resources:
      - virtualmachines/portforward
      - virtualmachineinstances/portforward
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - namespaces
      - services
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - project.openshift.io
    resources:
      - projects
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: sluetzen-vm-vuln-demo-kubevirt-aap-vm-enum
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: sluetzen-vm-vuln-demo-kubevirt-aap-vm-enum
subjects:
  - kind: ServiceAccount
    name: sluetzen-vm-vuln-demo-kubevirt-aap
    namespace: sluetzen-vm-vuln-demo

Summary

Adds automation to install RHACS roxagent on RHEL VMs running on OpenShift Virtualization (KubeVirt), using the external Galaxy role sluetze.roxagent (v0.1.0).

• Execution environment — installs virtctl for SSH port-forwarding to pod-network VMs, adds sluetze.roxagent and containers.podman
• configure-roxagent.yaml — playbook for batch and ad-hoc roxagent installs via virtctl SSH
• configure-roxagent-job-template.yaml — provisions AAP resources: organization, KubeVirt inventory source (label-filtered), batch + ad-hoc job templates, Podman Image Registry credential type
• cfg/secrets.yml.example — documents required AAP controller and credential settings for local runs
• ansible-navigator — passes PODMAN_IMAGE_REGISTRY_* env vars for registry auth during local testing

Job-Templates

Two AAP job templates cover the two deployment paths:

Job template	Inventory	Use case
Configure RHACS Roxagent	ISAR-vm-inventory (KubeVirt source, label stormshift.coe.muc.redhat.com/roxagent=true)	Batch install/update on all matching VMs
Configure RHACS Roxagent - New VM	Static Roxagent-adhoc placeholder	Single VM via survey extra_vars; triggered by roxagent-trigger watcher or manual launch

SSH to VMs on pod networking uses virtctl ssh port-forwarding (configured by the role's set-kubevirt-connection.yml pre-task). Registry credentials are injected via a custom AAP credential type Podman Image Registry that sets PODMAN_IMAGE_REGISTRY_* environment variables.

Testing / Implementation

• Rebuild execution environment from updated execution-environment.yml and verify virtctl and sluetze.roxagent role are present
• Copy cfg/secrets.yml.example → cfg/secrets.yml, fill in AAP credentials for ISAR AAP
• Run ansible-navigator run configure-roxagent-job-template.yaml -e @cfg/secrets.yml against SAR AAP
• Verify AAP resources created: organization, inventory, KubeVirt source, sync schedule, both job templates, Podman Image Registry credential type
• Update Inventory
• Deploy a test VM from a vuln-scan template (with rhsm-cloud-init secret and roxagent label)
• Launch Configure RHACS Roxagent - New VM ad-hoc job with survey vars (roxagent_kubevirt_namespace, roxagent_kubevirt_vm_name, roxagent_ansible_user)
• Confirm roxagent container is running on the VM and appears in RHACS Central
• Launch batch job Configure RHACS Roxagent with --limit on a subset of inventory hosts

[sluetze]

Everything was tested with my own AAP in development.

[rbo]

@sluetze What's the reason for the "Podman Image Registry" credentials?

[rbo]

@sluetze What's the reason for the "Podman Image Registry" credentials?

Ah this are the registry credentials. Placed into the RHEL VM's to access all the tools/images.

[rbo]

Overall looks fine for me.

If you like you can also store all the playbooks in your own repo and configure at aap.coe.muc.redhat.com in your organisation. Mean's you don't have to wait for pull request review and so on

[sluetze]

@sluetze What's the reason for the "Podman Image Registry" credentials?

the RHACS Roxagent image is: https://catalog.redhat.com/en/software/containers/advanced-cluster-security/rhacs-main-rhel9/69fe13d88a36e845594f1989

even though there is "unauthenticated pull" this results in:

Trying to pull registry.access.redhat.com/advanced-cluster-security/rhacs-main-rhel9:4.11.2-1...
WARN[0001] Failed, retrying in 1s ... (1/3). Error: initializing source docker://registry.access.redhat.com/advanced-cluster-security/rhacs-main-rhel9:4.11.2-1: reading manifest 4.11.2-1 in registry.access.redhat.com/advanced-cluster-security/rhacs-main-rhel9: unsupported: This repo requires terms acceptance and is only available on registry.redhat.io 
WARN[0002] Failed, retrying in 1s ... (2/3). Error: initializing source docker://registry.access.redhat.com/advanced-cluster-security/rhacs-main-rhel9:4.11.2-1: reading manifest 4.11.2-1 in registry.access.redhat.com/advanced-cluster-security/rhacs-main-rhel9: unsupported: This repo requires terms acceptance and is only available on registry.redhat.io 
WARN[0004] Failed, retrying in 1s ... (3/3). Error: initializing source docker://registry.access.redhat.com/advanced-cluster-security/rhacs-main-rhel9:4.11.2-1: reading manifest 4.11.2-1 in registry.access.redhat.com/advanced-cluster-security/rhacs-main-rhel9: unsupported: This repo requires terms acceptance and is only available on registry.redhat.io 

so we need to go through registry.redhat.io and this is only possible authenticated.

As we need to pull the image (and configure authentication) on every host, I decided to store the secret in Ansible centrally and then distribute it in the playbook to all the hosts.