Use PULP3_* env vars for Hosted Pulp credentials [RHELDST-45461]

src/pushsource/_impl/backend/konflux_source/konflux_source.py

@@ -59,34 +59,29 @@ def __init__(
             pulp_url (str):
                 URL of hosted Pulp server
                 (e.g., https://packages.redhat.com/).
-                If omitted, uses ``PUSHSOURCE_KONFLUX_PULP_URL``
-                environment variable.
+                If omitted, uses ``PULP3_URL`` environment variable.
 
             pulp_cert (str):
                 Path to TLS client certificate for Pulp authentication.
-                If omitted, uses ``PUSHSOURCE_KONFLUX_PULP_CERT``
-                environment variable.
+                If omitted, uses ``PULP3_CERT`` environment variable.
 
             pulp_key (str):
                 Path to TLS client key for Pulp authentication.
-                If omitted, uses ``PUSHSOURCE_KONFLUX_PULP_KEY``
-                environment variable.
+                If omitted, uses ``PULP3_CERT_KEY`` environment variable.
 
             pulp_user (str):
                 Username for Pulp basic authentication.
-                If omitted, uses ``PUSHSOURCE_KONFLUX_PULP_USER``
-                environment variable. Use with ``pulp_password``
-                as an alternative to certificate authentication.
+                If omitted, uses ``PULP3_USER`` environment variable.
+                Use with ``pulp_password`` as an alternative to
+                certificate authentication.
 
             pulp_password (str):
                 Password for Pulp basic authentication.
-                If omitted, uses ``PUSHSOURCE_KONFLUX_PULP_PASSWORD``
-                environment variable.
+                If omitted, uses ``PULP3_PASSWORD`` environment variable.
 
             pulp_domain (str):
                 Pulp domain name (e.g., "konflux-myteam-tenant").
-                If omitted, uses ``PUSHSOURCE_KONFLUX_PULP_DOMAIN``
-                environment variable.
+                If omitted, uses ``PULP3_DOMAIN`` environment variable.
 
             threads (int):
                 Number of threads for concurrent processing.
@@ -102,15 +97,14 @@ def __init__(
 
         self._advisories = list_argument(advisories)
 
-        # Resolve Pulp params from env vars if not provided
-        pulp_url = pulp_url or os.environ.get("PUSHSOURCE_KONFLUX_PULP_URL")
-        pulp_cert = pulp_cert or os.environ.get("PUSHSOURCE_KONFLUX_PULP_CERT")
-        pulp_key = pulp_key or os.environ.get("PUSHSOURCE_KONFLUX_PULP_KEY")
-        pulp_user = pulp_user or os.environ.get("PUSHSOURCE_KONFLUX_PULP_USER")
-        pulp_password = pulp_password or os.environ.get(
-            "PUSHSOURCE_KONFLUX_PULP_PASSWORD"
-        )
-        pulp_domain = pulp_domain or os.environ.get("PUSHSOURCE_KONFLUX_PULP_DOMAIN")
+        # Resolve Pulp params from env vars if not provided.
+        # PULP3_* env vars are shared with pubtools-pulp's Pulp3ClientService.
+        pulp_url = pulp_url or os.environ.get("PULP3_URL")
+        pulp_cert = pulp_cert or os.environ.get("PULP3_CERT")
+        pulp_key = pulp_key or os.environ.get("PULP3_CERT_KEY")
+        pulp_user = pulp_user or os.environ.get("PULP3_USER")
+        pulp_password = pulp_password or os.environ.get("PULP3_PASSWORD")
+        pulp_domain = pulp_domain or os.environ.get("PULP3_DOMAIN")
 
         # Validate required params
         if not pulp_url:

tests/konflux/test_konflux_source.py

@@ -554,6 +554,67 @@ def test_basic_auth():
     assert "cert" not in source._pulp_client_kwargs
 
 
+def test_env_var_resolution(monkeypatch):
+    """Test that PULP3_* env vars are used when params are omitted."""
+    monkeypatch.setenv("PULP3_URL", "https://pulp.env.example.com")
+    monkeypatch.setenv("PULP3_DOMAIN", "env-tenant")
+    monkeypatch.setenv("PULP3_USER", "env-user")
+    monkeypatch.setenv("PULP3_PASSWORD", "env-password")
+
+    source = KonfluxSource(
+        url=DATADIR,
+        advisories="RHSA-2020:0509",
+    )
+
+    assert source._pulp_client_kwargs == {
+        "url": "https://pulp.env.example.com",
+        "domain": "env-tenant",
+        "auth": ("env-user", "env-password"),
+    }
+
+
+def test_env_var_cert_auth(monkeypatch):
+    """Test that PULP3_CERT and PULP3_CERT_KEY env vars work for cert auth."""
+    monkeypatch.setenv("PULP3_URL", "https://pulp.env.example.com")
+    monkeypatch.setenv("PULP3_DOMAIN", "env-tenant")
+    monkeypatch.setenv("PULP3_CERT", "/env/path/to/cert")
+    monkeypatch.setenv("PULP3_CERT_KEY", "/env/path/to/key")
+
+    source = KonfluxSource(
+        url=DATADIR,
+        advisories="RHSA-2020:0509",
+    )
+
+    assert source._pulp_client_kwargs == {
+        "url": "https://pulp.env.example.com",
+        "domain": "env-tenant",
+        "cert": ("/env/path/to/cert", "/env/path/to/key"),
+    }
+
+
+def test_params_override_env_vars(monkeypatch):
+    """Test that explicit params take precedence over env vars."""
+    monkeypatch.setenv("PULP3_URL", "https://pulp.env.example.com")
+    monkeypatch.setenv("PULP3_DOMAIN", "env-tenant")
+    monkeypatch.setenv("PULP3_USER", "env-user")
+    monkeypatch.setenv("PULP3_PASSWORD", "env-password")
+
+    source = KonfluxSource(
+        url=DATADIR,
+        advisories="RHSA-2020:0509",
+        pulp_url="https://pulp.param.example.com",
+        pulp_domain="param-tenant",
+        pulp_user="param-user",
+        pulp_password="param-password",
+    )
+
+    assert source._pulp_client_kwargs == {
+        "url": "https://pulp.param.example.com",
+        "domain": "param-tenant",
+        "auth": ("param-user", "param-password"),
+    }
+
+
 def test_build_without_rpms():
     """Test that builds without 'rpms' key are skipped."""
     source = KonfluxSource(url=DATADIR, advisories="RHBA-2020:1234", **PULP_PARAMS)