feat(lightwell): add vulnerability ingestion job

This adds a new job that ingests and syncs vulnerability data from Jira
to our DB. It tries to map whatever is currently available to the
desired data format specified by the DB.

Author: dominikvagner

cmd/jobs/main.go

@@ -29,6 +29,7 @@ func loadJobs() map[string]jobFunc {
 		"remove-custom-epel-repos":        jobs.RemoveCustomEpelRepos,
 		"cancel-tasks":                    jobs.CancelTasks,
 		"send-template-update-events":     jobs.SendTemplateUpdateEvents,
+		"sync-lightwell-vulnerabilities":  jobs.SyncLightwellVulnerabilities,
 	}
 }
 

configs/config.yaml.example

@@ -175,7 +175,11 @@ clients:
       oidc_issuer:
       grpc_insecure:
     timeout: 30s
-
+  # Jira variables for syncing lightwell vulnerabilities.
+  jira:
+    url: ""
+    user: ""
+    token: ""
 
 # Configuration for the mocks
 mocks:

deployments/build/deployment.template.yaml

@@ -270,6 +270,21 @@ objects:
               - sync-lightwell-advisories
             env:{{ENV_VARS}}
 
+        - name: sync-lightwell-vulnerabilities
+          schedule: ${SYNC_LIGHTWELL_VULNERABILITIES_CRON_JOB}
+          suspend: ${{SUSPEND_SYNC_LIGHTWELL_VULNERABILITIES}}
+          concurrencyPolicy: "Forbid"
+          podSpec:
+            securityContext:
+              runAsNonRoot: true
+              runAsUser: 1001
+            image: ${IMAGE}:${IMAGE_TAG}
+            inheritEnv: true
+            command:
+              - /jobs
+              - sync-lightwell-vulnerabilities
+            env:{{ENV_VARS}}
+
         - name: transform-pulp-logs
           schedule: "0 1 * * *"
           suspend: ${{SUSPEND_TRANSFORM_PULP_LOGS}}

deployments/build/env-variables.yaml

@@ -227,6 +227,16 @@ env:
         name: lightwell-content-sources-password
         key: password
         optional: true
+  - name: CLIENTS_JIRA_URL
+    value: ${{CLIENTS_JIRA_URL}}
+  - name: CLIENTS_JIRA_USER
+    value: ${{CLIENTS_JIRA_USER}}
+  - name: CLIENTS_JIRA_TOKEN
+    valueFrom:
+      secretKeyRef:
+        name: jira-content-sources-token
+        key: token
+        optional: true
   - name: EPEL_ORG_ID_SKIP
     value: ${EPEL_ORG_ID_SKIP}
   - name: OPTIONS_INTERNAL_USER
@@ -285,6 +295,12 @@ parameters:
     description: whether to suspend the sync-lightwell-advisories cronjob
     required: false
     value: "false"
+  - name: SYNC_LIGHTWELL_VULNERABILITIES_CRON_JOB
+    value: "0 */2 * * *"
+  - name: SUSPEND_SYNC_LIGHTWELL_VULNERABILITIES
+    description: whether to suspend the sync-lightwell-vulnerabilities cronjob
+    required: false
+    value: "true"
   - name: SUSPEND_CRON_JOB
     value: "false"
   - name: IMAGE_TAG
@@ -482,6 +498,12 @@ parameters:
   - name: CLIENTS_LIGHTWELL_USERNAME
     description: Username for accessing lightwell content using basic auth
     value: ''
+  - name: CLIENTS_JIRA_URL
+    description: URL of the Jira instance used for Lightwell vulnerability ingestion
+    value: ''
+  - name: CLIENTS_JIRA_USER
+    description: Username for Jira API access
+    value: ''
   - name: EPEL_ORG_ID_SKIP
     description: comma separated list of org ids to skip when turning snapshotting off
   - name: OPTIONS_INTERNAL_USER