2.1 Enterprise proxy

Overview

You complete ConfigMap stub-03-enterprise-proxy so Maven resolves a Validated GAV from in-cluster Nexus, not Maven Central. Copying finished lightwell-maven-settings as the scored file fails. You do not pin .rhlw-* yet (2.2), and you do not seed Gitea yet (Track 3).

Why it matters

Trusted libraries must come from an enterprise artifact manager. A mis-pointed remote silently falls through to Maven Central. Hermetic Track 4 will deny that fallback. This module is where you wire the proxy before egress is closed.

What does it solve

  • Builds that pull from Maven Central

  • No proxy between developers and packages.redhat.com

  • Mixing direct, proxied, and seeded consumption

  • Thinking Premier needs a different Maven protocol

Direct vs proxied vs seeded

Direct remotes exist. Seeded Nexus is the workshop default so the Check does not require live Lightwell membership.

Pattern Where Maven points When you use it

Direct

https://packages.redhat.com/lightwell/java/validated / https://packages.redhat.com/lightwell/java/remediated

Laptop or CI with Lightwell membership

Proxied (enterprise)

Nexus or Artifactory remotes/virtuals that fetch Lightwell

Typical enterprise. The pattern this lab scores

Seeded (RHDP)

Same Nexus repository names; Job lightwell-repo-seed uploaded stubs

This workshop when live membership is unavailable
Direct packages.redhat.com versus enterprise Nexus or Artifactory proxy versus RHDP seeded Nexus

Do not copy v1 module-02-direct-vs-proxy.png (different framing). The diagram above is the Track 2 visual.

Discover Nexus (do not invent the host)

Userinfo: Nexus URL and channel names
oc -n lightwell-repo get configmap demo-userinfo-lightwell-repo \
  -o jsonpath='nexus={.data.nexus_url}{"\n"}validated={.data.channel_validated}{"\n"}remediated={.data.channel_remediated}{"\n"}mode={.data.lightwell_repo_mode}{"\n"}'

ConfigMap lightwell-maven-settings is a reference (repo ids and URLs). Copying it into stub-03-enterprise-proxy is not the Your change — complete the incomplete stub.

Peek at the reference (ids and URLs only)
oc -n lightwell-repo get configmap lightwell-maven-settings \
  -o jsonpath='{.data.settings\.xml}' | head -60

Showroom home may not be writable for the Maven local repo. Use /tmp:

export MVN_LOCAL='-Dmaven.repo.local=/tmp/m2'
mkdir -p /tmp/m2

Seeded mode usually does not need LW_USERNAME / LW_PASSWORD against hosted Nexus. Never commit those values. If the claim is in live proxy mode, inject them from a Secret — not from Git.

Worked example (not the Check)

Fake host and repo id. If your scored settings.xml still uses this URL, the Check fails.

<!-- Worked example ONLY — not in-cluster Nexus. -->
<settings>
  <profiles>
    <profile>
      <id>lightwell-validated</id>
      <repositories>
        <repository>
          <id>workshop-example</id>
          <url>https://nexus.example.invalid/repository/not-lightwell/</url>
        </repository>
      </repositories>
    </profile>
  </profiles>
  <activeProfiles>
    <activeProfile>lightwell-validated</activeProfile>
  </activeProfiles>
</settings>

Your change: complete the settings ConfigMap

The scored object is ConfigMap stub-03-enterprise-proxy in lightwell-repo. Extract it, replace every REPLACE_ME_* with values from userinfo (nexus_url plus channel_validated / channel_remediated), then write it back. Do not leave Maven Central as the only remote for the Lightwell profiles. Do not paste the nexus.example.invalid worked example.

Extract the incomplete seed
oc -n lightwell-repo get configmap stub-03-enterprise-proxy \
  -o jsonpath='{.data.settings\.xml}' > ~/track-2-1-settings.xml

The seed looks like this (placeholders fail):

<?xml version="1.0" encoding="UTF-8"?>
<settings xmlns="http://maven.apache.org/SETTINGS/1.2.0"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.2.0 https://maven.apache.org/xsd/settings-1.2.0.xsd">
  <profiles>
    <profile>
      <id>lightwell-validated</id>
      <repositories>
        <repository>
          <id>lightwell-java-validated</id>
          <url>REPLACE_ME_NEXUS_URL/repository/REPLACE_ME_CHANNEL_VALIDATED/</url>
          <releases><enabled>true</enabled></releases>
          <snapshots><enabled>false</enabled></snapshots>
        </repository>
      </repositories>
    </profile>
    <profile>
      <id>lightwell-remediated</id>
      <repositories>
        <repository>
          <id>lightwell-java-remediated</id>
          <url>REPLACE_ME_NEXUS_URL/repository/REPLACE_ME_CHANNEL_REMEDIATED/</url>
          <releases><enabled>true</enabled></releases>
          <snapshots><enabled>false</enabled></snapshots>
        </repository>
      </repositories>
    </profile>
  </profiles>
  <activeProfiles>
    <activeProfile>lightwell-validated</activeProfile>
  </activeProfiles>
</settings>
Write settings back to the ConfigMap
oc -n lightwell-repo create configmap stub-03-enterprise-proxy \
  --from-file=settings.xml=$HOME/track-2-1-settings.xml \
  --dry-run=client -o yaml | oc apply -f -
grep -E 'REPLACE_ME' ~/track-2-1-settings.xml && echo 'STILL HAS PLACEHOLDERS' || echo 'placeholders gone'

Check: Maven resolve from Nexus

Resolve Validated commons-lang3:3.14.0 (upstream line — not the .rhlw-* pin). The log must show your Nexus host, not repo.maven.apache.org as the source of that GAV.

mvn -s ~/track-2-1-settings.xml ${MVN_LOCAL} -Plightwell-validated \
  org.apache.maven.plugins:maven-dependency-plugin:3.7.0:get \
  -Dartifact=org.apache.commons:commons-lang3:3.14.0
Fill the report

The Job also grades ConfigMap report-03-enterprise-proxy key proxy_standin. Set it to nexus-stand-in. Empty or REPLACE_ME fails even if cluster state is correct. Do not copy validate-docs.

oc -n lw-poc-validate edit configmap report-03-enterprise-proxy

The scored Check is Job validate-03-enterprise-proxy in lw-poc-validate. Direct nav URLs still work (honor system). Unlimited retries. There is no Solve.

Run the Validate Job
oc -n lw-poc-validate delete job validate-03-enterprise-proxy --ignore-not-found
TPL='job-03.yaml'
oc -n lw-poc-validate get configmap validate-job-templates \
  -o go-template="{{ index .data \"${TPL}\" }}" | oc create -f -
oc -n lw-poc-validate logs -f job/validate-03-enterprise-proxy

Expect CHECK PASSED: before you continue. CHECK FAILED: names the object to fix. Delete the Job and create it again as often as you need.

Honor system: later modules still open if you skip this. The Validate Job grades the ConfigMap (Nexus host, no REPLACE_ME, not the worked-example URL). The ~/track-2-1-settings.xml copy is for mvn -s.

Callout: pip.conf

pip.conf is the analogue of settings.xml: index-url to Lightwell PyPI Validated (and a remediated file). ConfigMap lightwell-pip-settings shows the pattern. PEP 740 wheel attestations are the analogue of Maven GPG when the artifacts carry them — not this Check.

oc -n lightwell-repo get configmap lightwell-pip-settings \
  -o jsonpath='{.data.pip\.conf}'

Callout: Artifactory (not installed)

On your cluster you would configure Artifactory remotes and virtuals the same way. The Check is still Nexus settings.xml. Do not paste an Artifactory client file as the scored settings.

This workshop (Nexus) Your Artifactory

Proxy or hosted Maven repo whose URL is Lightwell Validated / Remediated

Remote Maven repository. URL is https://packages.redhat.com/lightwell/java/validated/ or https://packages.redhat.com/lightwell/java/remediated/. Product docs often use a repository key such as lightwell-remote.

Group that developers point Maven at

Virtual Maven repository that selects those Lightwell remotes (and usually nothing else for those GAVs).

Repository routing so Lightwell GAVs do not fall through to Maven Central

Include / exclude patterns on the virtual (and often on the remote): include Lightwell paths; exclude internal groupIds from the remote so they never leak to a public index.

Artifactory naming must allow the .rhlw-* version suffix (3.14.0.rhlw-00001). Procedure: Configure Artifactory to use the Lightwell Network Java repository. This cluster does not install Artifactory.

Official documentation

Key takeaways

  • TSSC library input is the enterprise proxy. You wire your artifact manager. Nexus is the workshop stand-in.

  • Clearinghouse Premier member versions (including during embargo) use the same remotes. They do not invent a second settings.xml.

  • pip.conf index-url is the PyPI analogue of these Nexus remotes.

  • Artifactory is remote plus virtual plus include/exclude against the same Lightwell URLs. That is not a second Check.

  • 2.2 is the exact .rhlw-* pin, not this Validated resolve.

cd ~/ocp5-rhacs-showroom
bash setup/lab-cleanup.sh --module tssc-03