X-Git-Url: https://osm.etsi.org/gitweb/?a=blobdiff_plain;f=installers%2Fcharm%2Fnbi%2Fsrc%2Fcharm.py;h=c6a7c1eab9e5eaf51418d9457a7d4c16f67e4c61;hb=f854a6172cfdd3d5cea50c4038604de1a5cc304c;hp=7efc5b0de549358414c9beaea524dd6251639b18;hpb=c753dc5f89180d11c1049f6398d74a4f99d7acd5;p=osm%2Fdevops.git diff --git a/installers/charm/nbi/src/charm.py b/installers/charm/nbi/src/charm.py index 7efc5b0d..c6a7c1ea 100755 --- a/installers/charm/nbi/src/charm.py +++ b/installers/charm/nbi/src/charm.py @@ -39,6 +39,7 @@ from opslib.osm.interfaces.prometheus import PrometheusClient from opslib.osm.pod import ( ContainerV3Builder, IngressResourceV3Builder, + PodRestartPolicy, PodSpecV3Builder, ) from opslib.osm.validator import ModelValidator, validator @@ -56,8 +57,14 @@ class ConfigModel(ModelValidator): log_level: str max_file_size: int site_url: Optional[str] + cluster_issuer: Optional[str] + ingress_class: Optional[str] ingress_whitelist_source_range: Optional[str] tls_secret_name: Optional[str] + mongodb_uri: Optional[str] + image_pull_policy: str + debug_mode: bool + security_context: bool @validator("auth_backend") def validate_auth_backend(cls, v): @@ -91,10 +98,34 @@ class ConfigModel(ModelValidator): ip_network(v) return v + @validator("mongodb_uri") + def validate_mongodb_uri(cls, v): + if v and not v.startswith("mongodb://"): + raise ValueError("mongodb_uri is not properly formed") + return v + + @validator("image_pull_policy") + def validate_image_pull_policy(cls, v): + values = { + "always": "Always", + "ifnotpresent": "IfNotPresent", + "never": "Never", + } + v = v.lower() + if v not in values.keys(): + raise ValueError("value must be always, ifnotpresent or never") + return values[v] + class NbiCharm(CharmedOsmBase): def __init__(self, *args) -> NoReturn: - super().__init__(*args, oci_image="image") + super().__init__( + *args, + oci_image="image", + debug_mode_config_key="debug_mode", + debug_pubkey_config_key="debug_pubkey", + vscode_workspace=VSCODE_WORKSPACE, + ) self.kafka_client = KafkaClient(self, "kafka") self.framework.observe(self.on["kafka"].relation_changed, self.configure_pod) @@ -131,9 +162,12 @@ class NbiCharm(CharmedOsmBase): def _check_missing_dependencies(self, config: ConfigModel): missing_relations = [] - if self.kafka_client.is_missing_data_in_unit(): + if ( + self.kafka_client.is_missing_data_in_unit() + and self.kafka_client.is_missing_data_in_app() + ): missing_relations.append("kafka") - if self.mongodb_client.is_missing_data_in_unit(): + if not config.mongodb_uri and self.mongodb_client.is_missing_data_in_unit(): missing_relations.append("mongodb") if self.prometheus_client.is_missing_data_in_app(): missing_relations.append("prometheus") @@ -147,10 +181,32 @@ class NbiCharm(CharmedOsmBase): def build_pod_spec(self, image_info): # Validate config config = ConfigModel(**dict(self.config)) + + if config.mongodb_uri and not self.mongodb_client.is_missing_data_in_unit(): + raise Exception("Mongodb data cannot be provided via config and relation") + # Check relations self._check_missing_dependencies(config) + + security_context_enabled = ( + config.security_context if not config.debug_mode else False + ) + # Create Builder for the PodSpec - pod_spec_builder = PodSpecV3Builder() + pod_spec_builder = PodSpecV3Builder( + enable_security_context=security_context_enabled + ) + + # Add secrets to the pod + mongodb_secret_name = f"{self.app.name}-mongodb-secret" + pod_spec_builder.add_secret( + mongodb_secret_name, + { + "uri": config.mongodb_uri or self.mongodb_client.connection_string, + "commonkey": config.database_commonkey, + }, + ) + # Build Init Container pod_spec_builder.add_init_container( { @@ -163,8 +219,14 @@ class NbiCharm(CharmedOsmBase): ], } ) + # Build Container - container_builder = ContainerV3Builder(self.app.name, image_info) + container_builder = ContainerV3Builder( + self.app.name, + image_info, + config.image_pull_policy, + run_as_non_root=security_context_enabled, + ) container_builder.add_port(name=self.app.name, port=PORT) container_builder.add_tcpsocket_readiness_probe( PORT, @@ -188,13 +250,10 @@ class NbiCharm(CharmedOsmBase): "OSMNBI_MESSAGE_PORT": self.kafka_client.port, # Database configuration "OSMNBI_DATABASE_DRIVER": "mongo", - "OSMNBI_DATABASE_URI": self.mongodb_client.connection_string, - "OSMNBI_DATABASE_COMMONKEY": config.database_commonkey, # Storage configuration "OSMNBI_STORAGE_DRIVER": "mongo", "OSMNBI_STORAGE_PATH": "/app/storage", "OSMNBI_STORAGE_COLLECTION": "files", - "OSMNBI_STORAGE_URI": self.mongodb_client.connection_string, # Prometheus configuration "OSMNBI_PROMETHEUS_HOST": self.prometheus_client.hostname, "OSMNBI_PROMETHEUS_PORT": self.prometheus_client.port, @@ -202,24 +261,48 @@ class NbiCharm(CharmedOsmBase): "OSMNBI_LOG_LEVEL": config.log_level, } ) + container_builder.add_secret_envs( + secret_name=mongodb_secret_name, + envs={ + "OSMNBI_DATABASE_URI": "uri", + "OSMNBI_DATABASE_COMMONKEY": "commonkey", + "OSMNBI_STORAGE_URI": "uri", + }, + ) if config.auth_backend == "internal": container_builder.add_env("OSMNBI_AUTHENTICATION_BACKEND", "internal") elif config.auth_backend == "keystone": - container_builder.add_envs( + keystone_secret_name = f"{self.app.name}-keystone-secret" + pod_spec_builder.add_secret( + keystone_secret_name, { - "OSMNBI_AUTHENTICATION_BACKEND": "keystone", - "OSMNBI_AUTHENTICATION_AUTH_URL": self.keystone_client.host, - "OSMNBI_AUTHENTICATION_AUTH_PORT": self.keystone_client.port, - "OSMNBI_AUTHENTICATION_USER_DOMAIN_NAME": self.keystone_client.user_domain_name, - "OSMNBI_AUTHENTICATION_PROJECT_DOMAIN_NAME": self.keystone_client.project_domain_name, - "OSMNBI_AUTHENTICATION_SERVICE_USERNAME": self.keystone_client.username, - "OSMNBI_AUTHENTICATION_SERVICE_PASSWORD": self.keystone_client.password, - "OSMNBI_AUTHENTICATION_SERVICE_PROJECT": self.keystone_client.service, - } + "url": self.keystone_client.host, + "port": self.keystone_client.port, + "user_domain": self.keystone_client.user_domain_name, + "project_domain": self.keystone_client.project_domain_name, + "service_username": self.keystone_client.username, + "service_password": self.keystone_client.password, + "service_project": self.keystone_client.service, + }, + ) + container_builder.add_env("OSMNBI_AUTHENTICATION_BACKEND", "keystone") + container_builder.add_secret_envs( + secret_name=keystone_secret_name, + envs={ + "OSMNBI_AUTHENTICATION_AUTH_URL": "url", + "OSMNBI_AUTHENTICATION_AUTH_PORT": "port", + "OSMNBI_AUTHENTICATION_USER_DOMAIN_NAME": "user_domain", + "OSMNBI_AUTHENTICATION_PROJECT_DOMAIN_NAME": "project_domain", + "OSMNBI_AUTHENTICATION_SERVICE_USERNAME": "service_username", + "OSMNBI_AUTHENTICATION_SERVICE_PASSWORD": "service_password", + "OSMNBI_AUTHENTICATION_SERVICE_PROJECT": "service_project", + }, ) container = container_builder.build() + # Add container to pod spec pod_spec_builder.add_container(container) + # Add ingress resources to pod spec if site url exists if config.site_url: parsed = urlparse(config.site_url) @@ -231,6 +314,8 @@ class NbiCharm(CharmedOsmBase): ), "nginx.ingress.kubernetes.io/backend-protocol": "HTTPS", } + if config.ingress_class: + annotations["kubernetes.io/ingress.class"] = config.ingress_class ingress_resource_builder = IngressResourceV3Builder( f"{self.app.name}-ingress", annotations ) @@ -240,6 +325,9 @@ class NbiCharm(CharmedOsmBase): "nginx.ingress.kubernetes.io/whitelist-source-range" ] = config.ingress_whitelist_source_range + if config.cluster_issuer: + annotations["cert-manager.io/cluster-issuer"] = config.cluster_issuer + if parsed.scheme == "https": ingress_resource_builder.add_tls( [parsed.hostname], config.tls_secret_name @@ -250,9 +338,36 @@ class NbiCharm(CharmedOsmBase): ingress_resource_builder.add_rule(parsed.hostname, self.app.name, PORT) ingress_resource = ingress_resource_builder.build() pod_spec_builder.add_ingress_resource(ingress_resource) - logger.debug(pod_spec_builder.build()) + + # Add restart policy + restart_policy = PodRestartPolicy() + restart_policy.add_secrets() + pod_spec_builder.set_restart_policy(restart_policy) + return pod_spec_builder.build() +VSCODE_WORKSPACE = { + "folders": [ + {"path": "/usr/lib/python3/dist-packages/osm_nbi"}, + {"path": "/usr/lib/python3/dist-packages/osm_common"}, + {"path": "/usr/lib/python3/dist-packages/osm_im"}, + ], + "settings": {}, + "launch": { + "version": "0.2.0", + "configurations": [ + { + "name": "NBI", + "type": "python", + "request": "launch", + "module": "osm_nbi.nbi", + "justMyCode": False, + } + ], + }, +} + + if __name__ == "__main__": main(NbiCharm)