X-Git-Url: https://osm.etsi.org/gitweb/?a=blobdiff_plain;ds=sidebyside;f=installers%2Fcharm%2Fmon%2Fsrc%2Fcharm.py;h=85d1fa4ecacaaa97ba40356dd0ad217bcd1b1f84;hb=refs%2Fchanges%2F53%2F11253%2F2;hp=f253c0930bccd46779b87da64b36cb211a4f737b;hpb=d680be4f261d4c580fcdf75abe11cfc29003915d;p=osm%2Fdevops.git diff --git a/installers/charm/mon/src/charm.py b/installers/charm/mon/src/charm.py index f253c093..85d1fa4e 100755 --- a/installers/charm/mon/src/charm.py +++ b/installers/charm/mon/src/charm.py @@ -34,7 +34,12 @@ from opslib.osm.interfaces.kafka import KafkaClient from opslib.osm.interfaces.keystone import KeystoneClient from opslib.osm.interfaces.mongo import MongoClient from opslib.osm.interfaces.prometheus import PrometheusClient -from opslib.osm.pod import ContainerV3Builder, FilesV3Builder, PodSpecV3Builder +from opslib.osm.pod import ( + ContainerV3Builder, + FilesV3Builder, + PodRestartPolicy, + PodSpecV3Builder, +) from opslib.osm.validator import ModelValidator, validator @@ -80,7 +85,9 @@ class ConfigModel(ModelValidator): grafana_user: str grafana_password: str certificates: Optional[str] - image_pull_policy: Optional[str] + image_pull_policy: str + debug_mode: bool + security_context: bool @validator("log_level") def validate_log_level(cls, v): @@ -150,7 +157,10 @@ class MonCharm(CharmedOsmBase): def _check_missing_dependencies(self, config: ConfigModel): missing_relations = [] - if self.kafka_client.is_missing_data_in_unit(): + if ( + self.kafka_client.is_missing_data_in_unit() + and self.kafka_client.is_missing_data_in_app() + ): missing_relations.append("kafka") if not config.mongodb_uri and self.mongodb_client.is_missing_data_in_unit(): missing_relations.append("mongodb") @@ -182,12 +192,51 @@ class MonCharm(CharmedOsmBase): # Check relations self._check_missing_dependencies(config) + security_context_enabled = ( + config.security_context if not config.debug_mode else False + ) + # Create Builder for the PodSpec - pod_spec_builder = PodSpecV3Builder() + pod_spec_builder = PodSpecV3Builder( + enable_security_context=security_context_enabled + ) + + # Add secrets to the pod + mongodb_secret_name = f"{self.app.name}-mongodb-secret" + pod_spec_builder.add_secret( + mongodb_secret_name, + { + "uri": config.mongodb_uri or self.mongodb_client.connection_string, + "commonkey": config.database_commonkey, + }, + ) + grafana_secret_name = f"{self.app.name}-grafana-secret" + pod_spec_builder.add_secret( + grafana_secret_name, + { + "url": config.grafana_url, + "user": config.grafana_user, + "password": config.grafana_password, + }, + ) + + vca_secret_name = f"{self.app.name}-vca-secret" + pod_spec_builder.add_secret( + vca_secret_name, + { + "host": config.vca_host, + "user": config.vca_user, + "secret": config.vca_secret, + "cacert": config.vca_cacert, + }, + ) # Build Container container_builder = ContainerV3Builder( - self.app.name, image_info, config.image_pull_policy + self.app.name, + image_info, + config.image_pull_policy, + run_as_non_root=security_context_enabled, ) certs_files = self._build_cert_files(config) @@ -210,35 +259,75 @@ class MonCharm(CharmedOsmBase): "OSMMON_MESSAGE_PORT": self.kafka_client.port, # Database configuration "OSMMON_DATABASE_DRIVER": "mongo", - "OSMMON_DATABASE_URI": config.mongodb_uri - or self.mongodb_client.connection_string, - "OSMMON_DATABASE_COMMONKEY": config.database_commonkey, # Prometheus configuration "OSMMON_PROMETHEUS_URL": f"http://{self.prometheus_client.hostname}:{self.prometheus_client.port}", - # VCA configuration - "OSMMON_VCA_HOST": config.vca_host, - "OSMMON_VCA_USER": config.vca_user, - "OSMMON_VCA_SECRET": config.vca_secret, - "OSMMON_VCA_CACERT": config.vca_cacert, - "OSMMON_GRAFANA_URL": config.grafana_url, - "OSMMON_GRAFANA_USER": config.grafana_user, - "OSMMON_GRAFANA_PASSWORD": config.grafana_password, } ) - if config.keystone_enabled: + prometheus_user = self.prometheus_client.user + prometheus_password = self.prometheus_client.password + if prometheus_user and prometheus_password: container_builder.add_envs( { - "OSMMON_KEYSTONE_ENABLED": True, - "OSMMON_KEYSTONE_URL": self.keystone_client.host, - "OSMMON_KEYSTONE_DOMAIN_NAME": self.keystone_client.user_domain_name, - "OSMMON_KEYSTONE_PROJECT_DOMAIN_NAME": self.keystone_client.project_domain_name, - "OSMMON_KEYSTONE_SERVICE_USER": self.keystone_client.username, - "OSMMON_KEYSTONE_SERVICE_PASSWORD": self.keystone_client.password, - "OSMMON_KEYSTONE_SERVICE_PROJECT": self.keystone_client.service, + "OSMMON_PROMETHEUS_USER": prometheus_user, + "OSMMON_PROMETHEUS_PASSWORD": prometheus_password, } ) + container_builder.add_secret_envs( + secret_name=mongodb_secret_name, + envs={ + "OSMMON_DATABASE_URI": "uri", + "OSMMON_DATABASE_COMMONKEY": "commonkey", + }, + ) + container_builder.add_secret_envs( + secret_name=vca_secret_name, + envs={ + "OSMMON_VCA_HOST": "host", + "OSMMON_VCA_USER": "user", + "OSMMON_VCA_SECRET": "secret", + "OSMMON_VCA_CACERT": "cacert", + }, + ) + container_builder.add_secret_envs( + secret_name=grafana_secret_name, + envs={ + "OSMMON_GRAFANA_URL": "url", + "OSMMON_GRAFANA_USER": "user", + "OSMMON_GRAFANA_PASSWORD": "password", + }, + ) + if config.keystone_enabled: + keystone_secret_name = f"{self.app.name}-keystone-secret" + pod_spec_builder.add_secret( + keystone_secret_name, + { + "url": self.keystone_client.host, + "user_domain": self.keystone_client.user_domain_name, + "project_domain": self.keystone_client.project_domain_name, + "service_username": self.keystone_client.username, + "service_password": self.keystone_client.password, + "service_project": self.keystone_client.service, + }, + ) + container_builder.add_env("OSMMON_KEYSTONE_ENABLED", True) + container_builder.add_secret_envs( + secret_name=keystone_secret_name, + envs={ + "OSMMON_KEYSTONE_URL": "url", + "OSMMON_KEYSTONE_DOMAIN_NAME": "user_domain", + "OSMMON_KEYSTONE_PROJECT_DOMAIN_NAME": "project_domain", + "OSMMON_KEYSTONE_SERVICE_USER": "service_username", + "OSMMON_KEYSTONE_SERVICE_PASSWORD": "service_password", + "OSMMON_KEYSTONE_SERVICE_PROJECT": "service_project", + }, + ) container = container_builder.build() + # Add restart policy + restart_policy = PodRestartPolicy() + restart_policy.add_secrets() + pod_spec_builder.set_restart_policy(restart_policy) + # Add container to pod spec pod_spec_builder.add_container(container)