X-Git-Url: https://osm.etsi.org/gitweb/?a=blobdiff_plain;f=installers%2Fcharm%2Fnbi%2Fsrc%2Fcharm.py;h=e12075680f230efa29bd510863f73d0db5effac1;hb=refs%2Fchanges%2F86%2F13086%2F9;hp=0e360738c5c269acd06044e88e46d28f90234c2c;hpb=d680be4f261d4c580fcdf75abe11cfc29003915d;p=osm%2Fdevops.git diff --git a/installers/charm/nbi/src/charm.py b/installers/charm/nbi/src/charm.py index 0e360738..e1207568 100755 --- a/installers/charm/nbi/src/charm.py +++ b/installers/charm/nbi/src/charm.py @@ -24,21 +24,23 @@ from ipaddress import ip_network +import json import logging from typing import NoReturn, Optional from urllib.parse import urlparse +from charms.kafka_k8s.v0.kafka import KafkaEvents, KafkaRequires from ops.main import main from opslib.osm.charm import CharmedOsmBase, RelationsMissing from opslib.osm.interfaces.http import HttpServer -from opslib.osm.interfaces.kafka import KafkaClient from opslib.osm.interfaces.keystone import KeystoneClient from opslib.osm.interfaces.mongo import MongoClient from opslib.osm.interfaces.prometheus import PrometheusClient from opslib.osm.pod import ( ContainerV3Builder, IngressResourceV3Builder, + PodRestartPolicy, PodSpecV3Builder, ) from opslib.osm.validator import ModelValidator, validator @@ -61,7 +63,11 @@ class ConfigModel(ModelValidator): ingress_whitelist_source_range: Optional[str] tls_secret_name: Optional[str] mongodb_uri: Optional[str] - image_pull_policy: Optional[str] + image_pull_policy: str + debug_mode: bool + security_context: bool + tcpsocket_liveness_probe: Optional[str] + tcpsocket_readiness_probe: Optional[str] @validator("auth_backend") def validate_auth_backend(cls, v): @@ -113,20 +119,66 @@ class ConfigModel(ModelValidator): raise ValueError("value must be always, ifnotpresent or never") return values[v] + @staticmethod + def _validate_tcpsocket_probe(probe_str) -> dict: + valid_attributes = ( + "initial_delay_seconds", + "timeout_seconds", + "period_seconds", + "success_threshold", + "failure_threshold", + ) + if probe_str: + probe_dict = json.loads(probe_str) + if all(attribute in valid_attributes for attribute in probe_dict): + return probe_dict + raise ValueError( + "One or more attributes are not accepted by the tcpsocket probe configuration" + ) + return {} + + @validator("tcpsocket_readiness_probe") + def validate_tcpsocket_readiness_probe(cls, v): + try: + return ConfigModel._validate_tcpsocket_probe(v) + except Exception as e: + raise ValueError(f"tcpsocket_readiness_probe configuration error: {e}") + + @validator("tcpsocket_liveness_probe") + def validate_tcpsocket_liveness_probe(cls, v): + try: + return ConfigModel._validate_tcpsocket_probe(v) + except Exception as e: + raise ValueError(f"tcpsocket_liveness_probe configuration error: {e}") + class NbiCharm(CharmedOsmBase): + on = KafkaEvents() + def __init__(self, *args) -> NoReturn: super().__init__( *args, oci_image="image", - debug_mode_config_key="debug_mode", - debug_pubkey_config_key="debug_pubkey", vscode_workspace=VSCODE_WORKSPACE, ) + if self.config.get("debug_mode"): + self.enable_debug_mode( + pubkey=self.config.get("debug_pubkey"), + hostpaths={ + "NBI": { + "hostpath": self.config.get("debug_nbi_local_path"), + "container-path": "/usr/lib/python3/dist-packages/osm_nbi", + }, + "osm_common": { + "hostpath": self.config.get("debug_common_local_path"), + "container-path": "/usr/lib/python3/dist-packages/osm_common", + }, + }, + ) - self.kafka_client = KafkaClient(self, "kafka") - self.framework.observe(self.on["kafka"].relation_changed, self.configure_pod) - self.framework.observe(self.on["kafka"].relation_broken, self.configure_pod) + self.kafka = KafkaRequires(self) + self.framework.observe(self.on.kafka_available, self.configure_pod) + self.framework.observe(self.on.kafka_broken, self.configure_pod) self.mongodb_client = MongoClient(self, "mongodb") self.framework.observe(self.on["mongodb"].relation_changed, self.configure_pod) @@ -159,7 +211,7 @@ class NbiCharm(CharmedOsmBase): def _check_missing_dependencies(self, config: ConfigModel): missing_relations = [] - if self.kafka_client.is_missing_data_in_unit(): + if not self.kafka.host or not self.kafka.port: missing_relations.append("kafka") if not config.mongodb_uri and self.mongodb_client.is_missing_data_in_unit(): missing_relations.append("mongodb") @@ -175,15 +227,30 @@ class NbiCharm(CharmedOsmBase): def build_pod_spec(self, image_info): # Validate config config = ConfigModel(**dict(self.config)) - if config.mongodb_uri and not self.mongodb_client.is_missing_data_in_unit(): raise Exception("Mongodb data cannot be provided via config and relation") # Check relations self._check_missing_dependencies(config) + security_context_enabled = ( + config.security_context if not config.debug_mode else False + ) + # Create Builder for the PodSpec - pod_spec_builder = PodSpecV3Builder() + pod_spec_builder = PodSpecV3Builder( + enable_security_context=security_context_enabled + ) + + # Add secrets to the pod + mongodb_secret_name = f"{self.app.name}-mongodb-secret" + pod_spec_builder.add_secret( + mongodb_secret_name, + { + "uri": config.mongodb_uri or self.mongodb_client.connection_string, + "commonkey": config.database_commonkey, + }, + ) # Build Init Container pod_spec_builder.add_init_container( @@ -193,25 +260,46 @@ class NbiCharm(CharmedOsmBase): "command": [ "sh", "-c", - f"until (nc -zvw1 {self.kafka_client.host} {self.kafka_client.port} ); do sleep 3; done; exit 0", + f"until (nc -zvw1 {self.kafka.host} {self.kafka.port} ); do sleep 3; done; exit 0", ], } ) # Build Container container_builder = ContainerV3Builder( - self.app.name, image_info, config.image_pull_policy + self.app.name, + image_info, + config.image_pull_policy, + run_as_non_root=security_context_enabled, ) container_builder.add_port(name=self.app.name, port=PORT) container_builder.add_tcpsocket_readiness_probe( PORT, - initial_delay_seconds=5, - timeout_seconds=5, + initial_delay_seconds=config.tcpsocket_readiness_probe.get( + "initial_delay_seconds", 5 + ), + timeout_seconds=config.tcpsocket_readiness_probe.get("timeout_seconds", 5), + period_seconds=config.tcpsocket_readiness_probe.get("period_seconds", 10), + success_threshold=config.tcpsocket_readiness_probe.get( + "success_threshold", 1 + ), + failure_threshold=config.tcpsocket_readiness_probe.get( + "failure_threshold", 3 + ), ) container_builder.add_tcpsocket_liveness_probe( PORT, - initial_delay_seconds=45, - timeout_seconds=10, + initial_delay_seconds=config.tcpsocket_liveness_probe.get( + "initial_delay_seconds", 45 + ), + timeout_seconds=config.tcpsocket_liveness_probe.get("timeout_seconds", 10), + period_seconds=config.tcpsocket_liveness_probe.get("period_seconds", 10), + success_threshold=config.tcpsocket_liveness_probe.get( + "success_threshold", 1 + ), + failure_threshold=config.tcpsocket_liveness_probe.get( + "failure_threshold", 3 + ), ) container_builder.add_envs( { @@ -220,20 +308,15 @@ class NbiCharm(CharmedOsmBase): "OSMNBI_SERVER_ENABLE_TEST": config.enable_test, "OSMNBI_STATIC_DIR": "/app/osm_nbi/html_public", # Kafka configuration - "OSMNBI_MESSAGE_HOST": self.kafka_client.host, + "OSMNBI_MESSAGE_HOST": self.kafka.host, "OSMNBI_MESSAGE_DRIVER": "kafka", - "OSMNBI_MESSAGE_PORT": self.kafka_client.port, + "OSMNBI_MESSAGE_PORT": self.kafka.port, # Database configuration "OSMNBI_DATABASE_DRIVER": "mongo", - "OSMNBI_DATABASE_URI": config.mongodb_uri - or self.mongodb_client.connection_string, - "OSMNBI_DATABASE_COMMONKEY": config.database_commonkey, # Storage configuration "OSMNBI_STORAGE_DRIVER": "mongo", "OSMNBI_STORAGE_PATH": "/app/storage", "OSMNBI_STORAGE_COLLECTION": "files", - "OSMNBI_STORAGE_URI": config.mongodb_uri - or self.mongodb_client.connection_string, # Prometheus configuration "OSMNBI_PROMETHEUS_HOST": self.prometheus_client.hostname, "OSMNBI_PROMETHEUS_PORT": self.prometheus_client.port, @@ -241,20 +324,42 @@ class NbiCharm(CharmedOsmBase): "OSMNBI_LOG_LEVEL": config.log_level, } ) + container_builder.add_secret_envs( + secret_name=mongodb_secret_name, + envs={ + "OSMNBI_DATABASE_URI": "uri", + "OSMNBI_DATABASE_COMMONKEY": "commonkey", + "OSMNBI_STORAGE_URI": "uri", + }, + ) if config.auth_backend == "internal": container_builder.add_env("OSMNBI_AUTHENTICATION_BACKEND", "internal") elif config.auth_backend == "keystone": - container_builder.add_envs( + keystone_secret_name = f"{self.app.name}-keystone-secret" + pod_spec_builder.add_secret( + keystone_secret_name, { - "OSMNBI_AUTHENTICATION_BACKEND": "keystone", - "OSMNBI_AUTHENTICATION_AUTH_URL": self.keystone_client.host, - "OSMNBI_AUTHENTICATION_AUTH_PORT": self.keystone_client.port, - "OSMNBI_AUTHENTICATION_USER_DOMAIN_NAME": self.keystone_client.user_domain_name, - "OSMNBI_AUTHENTICATION_PROJECT_DOMAIN_NAME": self.keystone_client.project_domain_name, - "OSMNBI_AUTHENTICATION_SERVICE_USERNAME": self.keystone_client.username, - "OSMNBI_AUTHENTICATION_SERVICE_PASSWORD": self.keystone_client.password, - "OSMNBI_AUTHENTICATION_SERVICE_PROJECT": self.keystone_client.service, - } + "url": self.keystone_client.host, + "port": self.keystone_client.port, + "user_domain": self.keystone_client.user_domain_name, + "project_domain": self.keystone_client.project_domain_name, + "service_username": self.keystone_client.username, + "service_password": self.keystone_client.password, + "service_project": self.keystone_client.service, + }, + ) + container_builder.add_env("OSMNBI_AUTHENTICATION_BACKEND", "keystone") + container_builder.add_secret_envs( + secret_name=keystone_secret_name, + envs={ + "OSMNBI_AUTHENTICATION_AUTH_URL": "url", + "OSMNBI_AUTHENTICATION_AUTH_PORT": "port", + "OSMNBI_AUTHENTICATION_USER_DOMAIN_NAME": "user_domain", + "OSMNBI_AUTHENTICATION_PROJECT_DOMAIN_NAME": "project_domain", + "OSMNBI_AUTHENTICATION_SERVICE_USERNAME": "service_username", + "OSMNBI_AUTHENTICATION_SERVICE_PASSWORD": "service_password", + "OSMNBI_AUTHENTICATION_SERVICE_PROJECT": "service_project", + }, ) container = container_builder.build() @@ -297,7 +402,10 @@ class NbiCharm(CharmedOsmBase): ingress_resource = ingress_resource_builder.build() pod_spec_builder.add_ingress_resource(ingress_resource) - logger.debug(pod_spec_builder.build()) + # Add restart policy + restart_policy = PodRestartPolicy() + restart_policy.add_secrets() + pod_spec_builder.set_restart_policy(restart_policy) return pod_spec_builder.build()