feat(iop): enable exploits and rules sync (flavor) - #927

Pre-merge checks · 4 · 1

Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files. (2 skipped: 2 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks (4 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the main change: enabling exploit and rules synchronization for the Satellite flavor.
Description check		The description directly explains the Satellite flavor change, its purpose, implementation, and test procedure.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

@ehelms @jeremylenz please review

Why are these special to the flavor?

@ehelms the data are only provided to the satellite flavor only.

In the steps to reproduce, you mentioned "Deploy with satellite flavor." However, in the current upstream src/vars/flavors/satellite.yml, the Satellite flavor does not include iop by default. Therefore, this change only affects deployments where IoP is explicitly enabled.

The PR test plan currently says:

Deploy with satellite flavor

I would suggest making it more precise:

Deploy with Satellite flavor and IoP enabled:

foremanctl deploy --flavor satellite --add-feature iop

This makes it clear that IoP must be explicitly enabled to reproduce the issue.

This test needs to be updated to reflect the changes.

def test_vulnerability_taskomatic_environment_variables(server, obsah_params):
    result = server.run("podman inspect iop-service-vuln-taskomatic --format '{{.Config.Env}}'")
    assert result.succeeded
    assert "IS_FEDRAMP=true" in result.stdout
    if obsah_params.get("flavor") == "satellite":
        assert "JOBS=stale_systems:5,delete_systems:30,cacheman:5,exploit_sync:1440,rules_git_sync:1440" in result.stdout
        assert "JOBS_STARTUP=cacheman,exploit_sync,rules_git_sync" in result.stdout
    else:
        assert "JOBS=stale_systems:5,delete_systems:30,cacheman:5" in result.stdout
        assert "JOBS_STARTUP=cacheman" in result.stdout

The docs currently mention taskomatic as running only:

  stale_systems, delete_systems, cacheman

File:

  docs/architecture/iop.md

Current line found:

  | `iop-service-vuln-taskomatic` | service | Periodic job scheduler (stale_systems, delete_systems, cacheman) |

Suggested update:

  | `iop-service-vuln-taskomatic` | service | Periodic job scheduler. Default jobs are `stale_systems`, `delete_systems`, and `cacheman`; Satellite flavor also enables `exploit_sync` and `rules_git_sync`. |

@ehelms the data are only provided to the satellite flavor only.

Not the flavor since it lives here. I assume you mean only present in the RH images?

@amolpati30 Updated. Thanks for the review.

Not the flavor since it lives here. I assume you mean only present in the RH images?

@ehelms yes, downstream images.

Latest errors from the pipelines (those need retry):

srpm:

2026-10-13 10:07:07.152 logging.py        INFO   [ERROR]: Error when getting collection version metadata for community.postgresql:5.0.0 from default (https://galaxy.ansible.com/api/) (HTTP Code: 504, Message: Gateway Timeout Code: Unknown)

and regular test on setup Vagrant

TimeoutError: [Errno 110] Connection timed out