From 9f7217c838008e5dba4d0c7cf0d083d36e128c36 Mon Sep 17 00:00:00 2001 From: Eric Ames Date: Thu, 21 May 2026 10:02:39 -0700 Subject: [PATCH] feat: probe http on every URL in addition to https (#10) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per Red Hat KB 6972355, the Azure firewall must allow both http (tcp/80) and https (tcp/443) to every listed host. The KB states port 80 is "often a redirect to 443" but "Red Hat cannot guarantee dependent services do not need it" — open both. The KB's only HTTPS-only exception (*.blob.core.windows.net) is not present in this list. Add `http` to the schemes list of all 16 entries, taking probe coverage from 16 to 32. The play's existing `follow_redirects: all` means an http probe that 301s to https resolves to the final https status, so the same expected `status` works for both schemes on every entry. Top-of-file comment documents the KB-derived rationale (one informative comment beats 16 uninformative ones). Tested locally: 32 of 32 probes pass from a host with open egress (exit 0). Closes #10. Co-Authored-By: Claude Opus 4.7 --- CHANGELOG.md | 6 ++++++ playbooks/files/websites.yml | 42 ++++++++++++++++++++++-------------- 2 files changed, 32 insertions(+), 16 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index de28e94..bc24eba 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,12 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] ### Added +- Every entry in `playbooks/files/websites.yml` now probes both `http` and + `https`, doubling probe coverage from 16 to 32. Per Red Hat KB 6972355, + the Azure firewall must allow http (tcp/80) and https (tcp/443) to every + listed host — port 80 is mostly used for redirect-to-443 or by dependent + services that may need it. The KB's only HTTPS-only exception + (`*.blob.core.windows.net`) is not in this list. - `aap_config/` configuration-as-code so customers can load `url_checker` into their AAP as a Project + Job Template. Uses `infra.aap_configuration` 4.5.0; authenticates via `AAP_HOSTNAME` + `AAP_TOKEN` env vars (BYO token model — no diff --git a/playbooks/files/websites.yml b/playbooks/files/websites.yml index 81feae4..b4998a5 100644 --- a/playbooks/files/websites.yml +++ b/playbooks/files/websites.yml @@ -5,84 +5,94 @@ # method: HTTP method to use (HEAD, GET, OPTIONS, POST) # status: expected HTTP status code (integer) # schemes: list of schemes to probe (required) +# +# Per Red Hat KB 6972355 (https://access.redhat.com/articles/6972355), the +# Azure firewall must allow both http (tcp/80) and https (tcp/443) to every +# hostname listed below — "port 80 is often a redirect to 443, but Red Hat +# cannot guarantee dependent services do not need it." The playbook's +# `follow_redirects: all` means an http probe that 301s to https resolves to +# the final https status, so the same expected `status` works for both +# schemes on every entry. +# (The only HTTPS-only exception called out in the KB is +# *.blob.core.windows.net, which is not present in this list.) websites: - url: redhat.com method: HEAD status: 200 - schemes: [https] + schemes: [http, https] - url: access.redhat.com method: HEAD status: 200 - schemes: [https] + schemes: [http, https] - url: registry.redhat.io method: HEAD status: 404 - schemes: [https] + schemes: [http, https] - url: quay.io method: HEAD status: 200 - schemes: [https] + schemes: [http, https] - url: letsencrypt.org method: HEAD status: 200 - schemes: [https] + schemes: [http, https] - url: community.letsencrypt.org method: HEAD status: 200 - schemes: [https] + schemes: [http, https] - url: gcr.io method: GET status: 200 - schemes: [https] + schemes: [http, https] - url: googleapis.com method: OPTIONS status: 404 - schemes: [https] + schemes: [http, https] - url: mcr.microsoft.com method: GET status: 200 - schemes: [https] + schemes: [http, https] - url: login.microsoftonline.com method: HEAD status: 200 - schemes: [https] + schemes: [http, https] - url: acs-mirror.azureedge.net method: HEAD status: 400 # CDN root rejects HEAD with 400; reaching the host is the signal we want. - schemes: [https] + schemes: [http, https] - url: azure.com method: HEAD status: 200 - schemes: [https] + schemes: [http, https] - url: dynatrace.com method: HEAD status: 200 - schemes: [https] + schemes: [http, https] - url: segment.io method: HEAD status: 200 - schemes: [https] + schemes: [http, https] - url: consul.segment.io method: HEAD status: 200 - schemes: [https] + schemes: [http, https] - url: github.com method: HEAD status: 200 - schemes: [https] + schemes: [http, https]