installers/charm/prometheus/src/charm.py

   1 #!/usr/bin/env python3
   2 # Copyright 2021 Canonical Ltd.
   3 #
   4 # Licensed under the Apache License, Version 2.0 (the "License"); you may
   5 # not use this file except in compliance with the License. You may obtain
   6 # a copy of the License at
   7 #
   8 #         http://www.apache.org/licenses/LICENSE-2.0
   9 #
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  12 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
  13 # License for the specific language governing permissions and limitations
  14 # under the License.
  15 #
  16 # For those usages not covered by the Apache License, Version 2.0 please
  17 # contact: legal@canonical.com
  18 #
  19 # To get in touch with the maintainers, please contact:
  20 # osm-charmers@lists.launchpad.net
  21 ##
  22
  23 # pylint: disable=E0213
  24
  25 import base64
  26 from ipaddress import ip_network
  27 import logging
  28 from typing import NoReturn, Optional
  29 from urllib.parse import urlparse
  30
  31 import bcrypt
  32 from oci_image import OCIImageResource
  33 from ops.framework import EventBase
  34 from ops.main import main
  35 from opslib.osm.charm import CharmedOsmBase
  36 from opslib.osm.interfaces.prometheus import PrometheusServer
  37 from opslib.osm.pod import (
  38     ContainerV3Builder,
  39     FilesV3Builder,
  40     IngressResourceV3Builder,
  41     PodSpecV3Builder,
  42 )
  43 from opslib.osm.validator import (
  44     ModelValidator,
  45     validator,
  46 )
  47 import requests
  48
  49
  50 logger = logging.getLogger(__name__)
  51
  52 PORT = 9090
  53
  54
  55 class ConfigModel(ModelValidator):
  56     web_subpath: str
  57     default_target: str
  58     max_file_size: int
  59     site_url: Optional[str]
  60     cluster_issuer: Optional[str]
  61     ingress_class: Optional[str]
  62     ingress_whitelist_source_range: Optional[str]
  63     tls_secret_name: Optional[str]
  64     enable_web_admin_api: bool
  65     image_pull_policy: str
  66     security_context: bool
  67     web_config_username: str
  68     web_config_password: str
  69
  70     @validator("web_subpath")
  71     def validate_web_subpath(cls, v):
  72         if len(v) < 1:
  73             raise ValueError("web-subpath must be a non-empty string")
  74         return v
  75
  76     @validator("max_file_size")
  77     def validate_max_file_size(cls, v):
  78         if v < 0:
  79             raise ValueError("value must be equal or greater than 0")
  80         return v
  81
  82     @validator("site_url")
  83     def validate_site_url(cls, v):
  84         if v:
  85             parsed = urlparse(v)
  86             if not parsed.scheme.startswith("http"):
  87                 raise ValueError("value must start with http")
  88         return v
  89
  90     @validator("ingress_whitelist_source_range")
  91     def validate_ingress_whitelist_source_range(cls, v):
  92         if v:
  93             ip_network(v)
  94         return v
  95
  96     @validator("image_pull_policy")
  97     def validate_image_pull_policy(cls, v):
  98         values = {
  99             "always": "Always",
 100             "ifnotpresent": "IfNotPresent",
 101             "never": "Never",
 102         }
 103         v = v.lower()
 104         if v not in values.keys():
 105             raise ValueError("value must be always, ifnotpresent or never")
 106         return values[v]
 107
 108
 109 class PrometheusCharm(CharmedOsmBase):
 110     """Prometheus Charm."""
 111
 112     def __init__(self, *args) -> NoReturn:
 113         """Prometheus Charm constructor."""
 114         super().__init__(*args, oci_image="image")
 115
 116         # Registering provided relation events
 117         self.prometheus = PrometheusServer(self, "prometheus")
 118         self.framework.observe(
 119             self.on.prometheus_relation_joined,  # pylint: disable=E1101
 120             self._publish_prometheus_info,
 121         )
 122
 123         # Registering actions
 124         self.framework.observe(
 125             self.on.backup_action,  # pylint: disable=E1101
 126             self._on_backup_action,
 127         )
 128
 129     def _publish_prometheus_info(self, event: EventBase) -> NoReturn:
 130         config = ConfigModel(**dict(self.config))
 131         self.prometheus.publish_info(
 132             self.app.name,
 133             PORT,
 134             user=config.web_config_username,
 135             password=config.web_config_password,
 136         )
 137
 138     def _on_backup_action(self, event: EventBase) -> NoReturn:
 139         url = f"http://{self.model.app.name}:{PORT}/api/v1/admin/tsdb/snapshot"
 140         result = requests.post(url)
 141
 142         if result.status_code == 200:
 143             event.set_results({"backup-name": result.json()["name"]})
 144         else:
 145             event.fail(f"status-code: {result.status_code}")
 146
 147     def _build_config_file(self, config: ConfigModel):
 148         files_builder = FilesV3Builder()
 149         files_builder.add_file(
 150             "prometheus.yml",
 151             (
 152                 "global:\n"
 153                 "  scrape_interval: 15s\n"
 154                 "  evaluation_interval: 15s\n"
 155                 "alerting:\n"
 156                 "  alertmanagers:\n"
 157                 "    - static_configs:\n"
 158                 "        - targets:\n"
 159                 "rule_files:\n"
 160                 "scrape_configs:\n"
 161                 "  - job_name: 'prometheus'\n"
 162                 "    static_configs:\n"
 163                 f"      - targets: [{config.default_target}]\n"
 164             ),
 165         )
 166         return files_builder.build()
 167
 168     def _build_webconfig_file(self):
 169         files_builder = FilesV3Builder()
 170         files_builder.add_file("web.yml", "web-config-file", secret=True)
 171         return files_builder.build()
 172
 173     def build_pod_spec(self, image_info):
 174         # Validate config
 175         config = ConfigModel(**dict(self.config))
 176         # Create Builder for the PodSpec
 177         pod_spec_builder = PodSpecV3Builder(
 178             enable_security_context=config.security_context
 179         )
 180
 181         # Build Backup Container
 182         backup_image = OCIImageResource(self, "backup-image")
 183         backup_image_info = backup_image.fetch()
 184         backup_container_builder = ContainerV3Builder("prom-backup", backup_image_info)
 185         backup_container = backup_container_builder.build()
 186
 187         # Add backup container to pod spec
 188         pod_spec_builder.add_container(backup_container)
 189
 190         # Add pod secrets
 191         prometheus_secret_name = f"{self.app.name}-secret"
 192         pod_spec_builder.add_secret(
 193             prometheus_secret_name,
 194             {
 195                 "web-config-file": (
 196                     "basic_auth_users:\n"
 197                     f"  {config.web_config_username}: {self._hash_password(config.web_config_password)}\n"
 198                 )
 199             },
 200         )
 201
 202         # Build Container
 203         container_builder = ContainerV3Builder(
 204             self.app.name,
 205             image_info,
 206             config.image_pull_policy,
 207             run_as_non_root=config.security_context,
 208         )
 209         container_builder.add_port(name=self.app.name, port=PORT)
 210         token = self._base64_encode(
 211             f"{config.web_config_username}:{config.web_config_password}"
 212         )
 213         container_builder.add_http_readiness_probe(
 214             "/-/ready",
 215             PORT,
 216             initial_delay_seconds=10,
 217             timeout_seconds=30,
 218             http_headers=[("Authorization", f"Basic {token}")],
 219         )
 220         container_builder.add_http_liveness_probe(
 221             "/-/healthy",
 222             PORT,
 223             initial_delay_seconds=30,
 224             period_seconds=30,
 225             http_headers=[("Authorization", f"Basic {token}")],
 226         )
 227         command = [
 228             "/bin/prometheus",
 229             "--config.file=/etc/prometheus/prometheus.yml",
 230             "--web.config.file=/etc/prometheus/web-config/web.yml",
 231             "--storage.tsdb.path=/prometheus",
 232             "--web.console.libraries=/usr/share/prometheus/console_libraries",
 233             "--web.console.templates=/usr/share/prometheus/consoles",
 234             f"--web.route-prefix={config.web_subpath}",
 235             f"--web.external-url=http://localhost:{PORT}{config.web_subpath}",
 236         ]
 237         if config.enable_web_admin_api:
 238             command.append("--web.enable-admin-api")
 239         container_builder.add_command(command)
 240         container_builder.add_volume_config(
 241             "config", "/etc/prometheus", self._build_config_file(config)
 242         )
 243         container_builder.add_volume_config(
 244             "web-config",
 245             "/etc/prometheus/web-config",
 246             self._build_webconfig_file(),
 247             secret_name=prometheus_secret_name,
 248         )
 249         container = container_builder.build()
 250         # Add container to pod spec
 251         pod_spec_builder.add_container(container)
 252         # Add ingress resources to pod spec if site url exists
 253         if config.site_url:
 254             parsed = urlparse(config.site_url)
 255             annotations = {
 256                 "nginx.ingress.kubernetes.io/proxy-body-size": "{}".format(
 257                     str(config.max_file_size) + "m"
 258                     if config.max_file_size > 0
 259                     else config.max_file_size
 260                 )
 261             }
 262             if config.ingress_class:
 263                 annotations["kubernetes.io/ingress.class"] = config.ingress_class
 264             ingress_resource_builder = IngressResourceV3Builder(
 265                 f"{self.app.name}-ingress", annotations
 266             )
 267
 268             if config.ingress_whitelist_source_range:
 269                 annotations[
 270                     "nginx.ingress.kubernetes.io/whitelist-source-range"
 271                 ] = config.ingress_whitelist_source_range
 272
 273             if config.cluster_issuer:
 274                 annotations["cert-manager.io/cluster-issuer"] = config.cluster_issuer
 275
 276             if parsed.scheme == "https":
 277                 ingress_resource_builder.add_tls(
 278                     [parsed.hostname], config.tls_secret_name
 279                 )
 280             else:
 281                 annotations["nginx.ingress.kubernetes.io/ssl-redirect"] = "false"
 282
 283             ingress_resource_builder.add_rule(parsed.hostname, self.app.name, PORT)
 284             ingress_resource = ingress_resource_builder.build()
 285             pod_spec_builder.add_ingress_resource(ingress_resource)
 286         return pod_spec_builder.build()
 287
 288     def _hash_password(self, password):
 289         hashed_password = bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt())
 290         return hashed_password.decode()
 291
 292     def _base64_encode(self, phrase: str) -> str:
 293         return base64.b64encode(phrase.encode("utf-8")).decode("utf-8")
 294
 295
 296 if __name__ == "__main__":
 297     main(PrometheusCharm)