2.1 Enterprise proxy

On this page you prove that Maven can resolve a Lightwell Validated library from the enterprise proxy on this cluster.

Track 2 is the library input. This is the first of its two pages. You finish an incomplete settings.xml so the Validated and Remediated profiles point at in-cluster Nexus. 2.2 Remediated pin then pins an exact .rhlw-* version of one of those libraries. Track 3 is where that pin is committed to git.

Why this control exists

Field delivery puts an enterprise artifact manager between developers and packages.redhat.com. On the OpenShift cluster for this workshop, that stand-in is Nexus running in the cluster. You complete ConfigMap stub-03-enterprise-proxy in namespace lightwell-repo so Maven resolves a Validated GAV from Nexus. Copying the finished lightwell-maven-settings file into that ConfigMap fails the Check.

A trusted software supply chain takes its libraries from that repository. Lightwell Network publishes two channels on https://packages.redhat.com/lightwell/java/validated and https://packages.redhat.com/lightwell/java/remediated. Validated matches the upstream release and is signed, with an SBOM. Remediated is the security backport you pin on the next page. Customers consume both the way they consume every other library: a remote or a virtual in Nexus or Artifactory.

The figure has three columns. This page scores the right-hand column. Seeded Nexus uses the same repository names as the middle column, and Job lightwell-repo-seed has already uploaded the stubs. The left-hand column is a laptop pointed straight at packages.redhat.com. The middle column is the customer pattern this lab is standing in for.

Direct packages.redhat.com versus enterprise Nexus or Artifactory proxy versus RHDP seeded Nexus

Lightwell Clearinghouse Premier remediations land in this same proxy, including a member GAV that is still under embargo. There is no Premier-only Maven protocol. The profiles you write here are the profiles that GAV resolves from once the artifact manager has cached it. A profile that falls through to Maven Central fails that rule. The Artifactory note at the end of the page is the customer form of the same rule.

pip.conf points Python at a Lightwell index the way this settings.xml points Maven at Nexus. This Check scores the Java file.

In a customer engagement the customer already runs Nexus or Artifactory. You wire the remotes at Lightwell Validated and Remediated. Red Hat operates packages.redhat.com. Nexus on this cluster is the workshop stand-in. Seeded mode is the default so the Check can pass without a live Lightwell membership.

Learning objectives

By the end of this module, you will be able to:

  • Point Maven at the in-cluster Nexus proxy and resolve a Lightwell Network Validated GAV from it

  • Name the direct, proxied, and seeded ways of reaching the same channels, and say why a Clearinghouse Premier GAV uses the proxied pattern

  • Finish settings.xml on ConfigMap stub-03-enterprise-proxy so no REPLACE_ME_* remains

  • Describe how pip.conf and an Artifactory virtual repository do the same job

The Nexus host

ConfigMap demo-userinfo-lightwell-repo in namespace lightwell-repo holds the coordinates. Four fields matter. nexus_url is the base URL. channel_validated and channel_remediated are the repository names you append under /repository/. lightwell_repo_mode tells you whether this cluster is seeded or is proxying packages.redhat.com live.

Success is those four lines.

Read the Nexus URL and channel names
oc -n lightwell-repo get configmap demo-userinfo-lightwell-repo \
  -o jsonpath='nexus={.data.nexus_url}{"\n"}validated={.data.channel_validated}{"\n"}remediated={.data.channel_remediated}{"\n"}mode={.data.lightwell_repo_mode}{"\n"}'

ConfigMap lightwell-maven-settings in the same namespace is a reference for repository ids and URL shape. The scored object is ConfigMap stub-03-enterprise-proxy. A copy of the reference into the stub fails the Check.

Success of the peek is the first 60 lines of that reference, including the repository ids.

Peek at the reference
oc -n lightwell-repo get configmap lightwell-maven-settings \
  -o jsonpath='{.data.settings\.xml}' | head -60

The Showroom home directory may not be writable for Maven’s local repository. The commands below use /tmp/m2. Success is a directory at that path.

export MVN_LOCAL='-Dmaven.repo.local=/tmp/m2'
mkdir -p /tmp/m2

Seeded mode usually does not need LW_USERNAME or LW_PASSWORD against hosted Nexus. Leave those values out of Git. If this cluster is in live proxy mode, inject them from a Secret.

The block below is the same settings shape on a different host. A scored file that still contains nexus.example.invalid or the repository id workshop-example fails the Check.

<!-- Worked example ONLY — not in-cluster Nexus. -->
<settings>
  <profiles>
    <profile>
      <id>lightwell-validated</id>
      <repositories>
        <repository>
          <id>workshop-example</id>
          <url>https://nexus.example.invalid/repository/not-lightwell/</url>
        </repository>
      </repositories>
    </profile>
  </profiles>
  <activeProfiles>
    <activeProfile>lightwell-validated</activeProfile>
  </activeProfiles>
</settings>

Your change

The scored object is ConfigMap stub-03-enterprise-proxy in namespace lightwell-repo, key settings.xml. Extract it, replace every REPLACE_ME_* with the Nexus URL and the two channel names you just read, and write the ConfigMap back. A file that exists only in your home directory leaves the Check on the seed.

Each Lightwell profile lists one Nexus repository. The validated URL is nexus_url + /repository/ + channel_validated + /. The remediated URL uses channel_remediated the same way. A profile whose only remote is Maven Central fails the Check.

Success of the extract is a file at ~/track-2-1-settings.xml that still contains REPLACE_ME.

Extract the incomplete seed
oc -n lightwell-repo get configmap stub-03-enterprise-proxy \
  -o jsonpath='{.data.settings\.xml}' > ~/track-2-1-settings.xml

The seed looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<settings xmlns="http://maven.apache.org/SETTINGS/1.2.0"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.2.0 https://maven.apache.org/xsd/settings-1.2.0.xsd">
  <profiles>
    <profile>
      <id>lightwell-validated</id>
      <repositories>
        <repository>
          <id>lightwell-java-validated</id>
          <url>REPLACE_ME_NEXUS_URL/repository/REPLACE_ME_CHANNEL_VALIDATED/</url>
          <releases><enabled>true</enabled></releases>
          <snapshots><enabled>false</enabled></snapshots>
        </repository>
      </repositories>
    </profile>
    <profile>
      <id>lightwell-remediated</id>
      <repositories>
        <repository>
          <id>lightwell-java-remediated</id>
          <url>REPLACE_ME_NEXUS_URL/repository/REPLACE_ME_CHANNEL_REMEDIATED/</url>
          <releases><enabled>true</enabled></releases>
          <snapshots><enabled>false</enabled></snapshots>
        </repository>
      </repositories>
    </profile>
  </profiles>
  <activeProfiles>
    <activeProfile>lightwell-validated</activeProfile>
  </activeProfiles>
</settings>

Writing the ConfigMap back succeeds when the last line prints placeholders gone.

Write settings back to the ConfigMap
oc -n lightwell-repo create configmap stub-03-enterprise-proxy \
  --from-file=settings.xml=$HOME/track-2-1-settings.xml \
  --dry-run=client -o yaml | oc apply -f -
grep -E 'REPLACE_ME' ~/track-2-1-settings.xml && echo 'STILL HAS PLACEHOLDERS' || echo 'placeholders gone'

Check

Resolve Validated org.apache.commons:commons-lang3:3.14.0. That coordinate is the upstream line. The .rhlw-* pin is the next page. Success is a Maven log that names your Nexus host as the source of that GAV.

mvn -s ~/track-2-1-settings.xml ${MVN_LOCAL} -Plightwell-validated \
  org.apache.maven.plugins:maven-dependency-plugin:3.7.0:get \
  -Dartifact=org.apache.commons:commons-lang3:3.14.0

The home-directory file is what mvn -s reads. The Validate Job grades ConfigMap stub-03-enterprise-proxy: the Nexus host is present, REPLACE_ME is gone, and the worked-example URL is absent. Later modules still open if you skip this page. The next Check expects this settings file.

Fill the report

The Job also grades ConfigMap report-03-enterprise-proxy key proxy_standin. Set it to nexus-stand-in. Empty or REPLACE_ME fails even if cluster state is correct. Do not copy validate-docs.

oc -n lw-poc-validate edit configmap report-03-enterprise-proxy

The scored Check is Job validate-03-enterprise-proxy in lw-poc-validate. Direct nav URLs still work (honor system). Unlimited retries. There is no Solve.

Run the Validate Job
oc -n lw-poc-validate delete job validate-03-enterprise-proxy --ignore-not-found
TPL='job-03.yaml'
oc -n lw-poc-validate get configmap validate-job-templates \
  -o go-template="{{ index .data \"${TPL}\" }}" | oc create -f -
oc -n lw-poc-validate logs -f job/validate-03-enterprise-proxy

Expect CHECK PASSED: before you continue. CHECK FAILED: names the object to fix. Delete the Job and create it again as often as you need.

The same proxy in other tools

pip.conf is the Python form of this file: index-url points at Lightwell PyPI Validated, and a second index points at the remediated files. ConfigMap lightwell-pip-settings shows the pattern. PEP 740 wheel attestations are the analogue of Maven signatures when the artifacts carry them. This Check stays on settings.xml.

 
oc -n lightwell-repo get configmap lightwell-pip-settings \
  -o jsonpath='{.data.pip\.conf}'

JFrog Artifactory is the name a statement of work uses for this same proxy. This cluster does not install it. The Check remains the Nexus settings.xml. An Artifactory client file pasted into the scored ConfigMap fails the Check.

This cluster (Nexus) Customer Artifactory

Proxy or hosted Maven repo whose URL is Lightwell Validated / Remediated

A remote Maven repository. The URL is https://packages.redhat.com/lightwell/java/validated/ or https://packages.redhat.com/lightwell/java/remediated/. Product docs often use a repository key such as lightwell-remote.

Group that developers point Maven at

A virtual Maven repository that selects those Lightwell remotes.

Repository routing so Lightwell GAVs stay on the enterprise manager

Include and exclude patterns on the virtual, and often on the remote: include the Lightwell paths, and exclude internal groupIds from the remote so they stay off a public index.

The Artifactory repository key has to allow the .rhlw-* version suffix, for example 3.14.0.rhlw-00001. The procedure is Configure Artifactory to use the Lightwell Network Java repository.

Official documentation

Key takeaways

  • The library input is the enterprise proxy. Nexus is the stand-in on this OpenShift cluster.

  • A Clearinghouse Premier GAV, including one that is still under embargo, uses these same profiles.

  • pip.conf index-url is the Python form of these Nexus remotes.

  • Artifactory is a remote, a virtual, and include/exclude rules against the same Lightwell URLs.

  • The next page pins the exact .rhlw-* version. This page only proves the Validated resolve.