510724255b8a011b133c4df3ddf67c4967bf5d64
1 # Copyright 2019 Canonical Ltd.
3 # Licensed under the Apache License, Version 2.0 (the "License");
4 # you may not use this file except in compliance with the License.
5 # You may obtain a copy of the License at
7 # http://www.apache.org/licenses/LICENSE-2.0
9 # Unless required by applicable law or agreed to in writing, software
10 # distributed under the License is distributed on an "AS IS" BASIS,
11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 # See the License for the specific language governing permissions and
13 # limitations under the License.
18 from subprocess
import CalledProcessError
23 from juju
.client
import client
24 import n2vc
.exceptions
29 [re
.compile(r
"amd64|x86_64"), "amd64"],
30 [re
.compile(r
"i?[3-9]86"), "i386"],
31 [re
.compile(r
"(arm$)|(armv.*)"), "armhf"],
32 [re
.compile(r
"aarch64"), "arm64"],
33 [re
.compile(r
"ppc64|ppc64el|ppc64le"), "ppc64el"],
34 [re
.compile(r
"s390x?"), "s390x"],
38 def normalize_arch(rawArch
):
39 """Normalize the architecture string."""
41 if arch
[0].match(rawArch
):
45 DETECTION_SCRIPT
= """#!/bin/bash
47 os_id=$(grep '^ID=' /etc/os-release | tr -d '"' | cut -d= -f2)
48 if [ "$os_id" = 'centos' ]; then
49 os_version=$(grep '^VERSION_ID=' /etc/os-release | tr -d '"' | cut -d= -f2)
50 echo "centos$os_version"
55 grep MemTotal /proc/meminfo
59 INITIALIZE_UBUNTU_SCRIPT
= """set -e
60 (id ubuntu &> /dev/null) || useradd -m ubuntu -s /bin/bash
63 echo 'ubuntu ALL=(ALL) NOPASSWD:ALL' > $temp
64 install -m 0440 $temp /etc/sudoers.d/90-juju-ubuntu
66 su ubuntu -c 'install -D -m 0600 /dev/null ~/.ssh/authorized_keys'
67 export authorized_keys="{}"
68 if [ ! -z "$authorized_keys" ]; then
69 su ubuntu -c 'echo $authorized_keys >> ~/.ssh/authorized_keys'
73 IPTABLES_SCRIPT
= """#!/bin/bash
76 DEBIAN_FRONTEND=noninteractive apt-get install -yqq iptables-persistent
77 iptables -t nat -A OUTPUT -p tcp -d {} -j DNAT --to-destination {}
78 netfilter-persistent save
83 """Provision a manually created machine via SSH."""
85 def __init__(self
, user
, host
, private_key_path
, log
=None):
89 self
.private_key_path
= private_key_path
94 self
.log
= logging
.getLogger(__name__
)
96 def _get_ssh_client(self
, host
=None, user
=None, private_key_path
=None):
97 """Return a connected Paramiko ssh object.
99 :param str host: The host to connect to.
100 :param str user: The user to connect as.
101 :param str key: The private key to authenticate with.
103 :return: object: A paramiko.SSHClient
104 :raises: :class:`paramiko.ssh_exception.SSHException` if the
114 if not private_key_path
:
115 private_key_path
= self
.private_key_path
117 ssh
= paramiko
.SSHClient()
118 ssh
.set_missing_host_key_policy(paramiko
.AutoAddPolicy())
122 # Read the private key into a paramiko.RSAKey
123 if os
.path
.exists(private_key_path
):
124 with
open(private_key_path
, "r") as f
:
125 pkey
= paramiko
.RSAKey
.from_private_key(f
)
127 #######################################################################
128 # There is a bug in some versions of OpenSSH 4.3 (CentOS/RHEL5) where #
129 # the server may not send the SSH_MSG_USERAUTH_BANNER message except #
130 # when responding to an auth_none request. For example, paramiko will #
131 # attempt to use password authentication when a password is set, but #
132 # the server could deny that, instead requesting keyboard-interactive.#
133 # The hack to workaround this is to attempt a reconnect, which will #
134 # receive the right banner, and authentication can proceed. See the #
135 # following for more info: #
136 # https://github.com/paramiko/paramiko/issues/432 #
137 # https://github.com/paramiko/paramiko/pull/438 #
138 #######################################################################
143 while attempts
<= retry
:
147 # Attempt to establish a SSH connection
154 # look_for_keys=False,
157 except paramiko
.ssh_exception
.SSHException
as e
:
158 if "Error reading SSH protocol banner" == str(e
):
159 # Once more, with feeling
160 ssh
.connect(host
, port
=22, username
=user
, pkey
=pkey
)
162 # Reraise the original exception
163 self
.log
.debug("Unhandled exception caught: {}".format(e
))
165 except Exception as e
:
166 if "Unable to connect to port" in str(e
):
168 "Waiting for VM to boot, sleeping {} seconds".format(delay
)
174 # Slowly back off the retry
181 def _run_command(self
, ssh
, cmd
, pty
=True):
182 """Run a command remotely via SSH.
184 :param object ssh: The SSHClient
185 :param str cmd: The command to execute
186 :param list cmd: The `shlex.split` command to execute
187 :param bool pty: Whether to allocate a pty
189 :return: tuple: The stdout and stderr of the command execution
190 :raises: :class:`CalledProcessError` if the command fails
193 if isinstance(cmd
, str):
194 cmd
= shlex
.split(cmd
)
196 if type(cmd
) is not list:
200 _
, stdout
, stderr
= ssh
.exec_command(cmds
, get_pty
=pty
)
201 retcode
= stdout
.channel
.recv_exit_status()
204 output
= stderr
.read().strip()
205 raise CalledProcessError(returncode
=retcode
, cmd
=cmd
, output
=output
)
207 stdout
.read().decode("utf-8").strip(),
208 stderr
.read().decode("utf-8").strip(),
211 def _init_ubuntu_user(self
):
212 """Initialize the ubuntu user.
214 :return: bool: If the initialization was successful
215 :raises: :class:`paramiko.ssh_exception.AuthenticationException`
216 if the authentication fails
220 # Run w/o allocating a pty, so we fail if sudo prompts for a passwd
221 ssh
= self
._get
_ssh
_client
()
222 self
._run
_command
(ssh
, "sudo -n true", pty
=False)
223 except paramiko
.ssh_exception
.AuthenticationException
:
224 raise n2vc
.exceptions
.AuthenticationFailed(self
.user
)
225 except paramiko
.ssh_exception
.NoValidConnectionsError
:
226 raise n2vc
.exceptions
.NoRouteToHost(self
.host
)
231 # Infer the public key
232 public_key_path
= "{}.pub".format(self
.private_key_path
)
234 if not os
.path
.exists(public_key_path
):
235 raise FileNotFoundError(
236 "Public key '{}' doesn't exist.".format(public_key_path
)
239 with
open(public_key_path
, "r") as f
:
240 public_key
= f
.readline()
242 script
= INITIALIZE_UBUNTU_SCRIPT
.format(public_key
)
245 ssh
= self
._get
_ssh
_client
()
248 ssh
, ["sudo", "/bin/bash -c " + shlex
.quote(script
)], pty
=True
250 except paramiko
.ssh_exception
.AuthenticationException
as e
:
257 def _detect_hardware_and_os(self
, ssh
):
258 """Detect the target hardware capabilities and OS series.
260 :param object ssh: The SSHClient
261 :return: str: A raw string containing OS and hardware information.
271 stdout
, _
= self
._run
_command
(
272 ssh
, ["sudo", "/bin/bash -c " + shlex
.quote(DETECTION_SCRIPT
)], pty
=True,
275 lines
= stdout
.split("\n")
277 # Remove extraneous line if DNS resolution of hostname famils
278 # i.e. sudo: unable to resolve host test-1-mgmtvm-1: Connection timed out
279 if "unable to resolve host" in lines
[0]:
282 info
["series"] = lines
[0].strip()
283 info
["arch"] = normalize_arch(lines
[1].strip())
285 memKb
= re
.split(r
"\s+", lines
[2])[1]
287 # Convert megabytes -> kilobytes
288 info
["mem"] = round(int(memKb
) / 1024)
290 # Detect available CPUs
292 for line
in lines
[3:]:
295 if line
.find("physical id") == 0:
296 physical_id
= line
.split(":")[1].strip()
297 elif line
.find("cpu cores") == 0:
298 cores
= line
.split(":")[1].strip()
300 if physical_id
not in recorded
.keys():
301 info
["cpu-cores"] += cores
302 recorded
[physical_id
] = True
306 def provision_machine(self
):
307 """Perform the initial provisioning of the target machine.
309 :return: bool: The client.AddMachineParams
310 :raises: :class:`paramiko.ssh_exception.AuthenticationException`
313 params
= client
.AddMachineParams()
315 if self
._init
_ubuntu
_user
():
317 ssh
= self
._get
_ssh
_client
()
319 hw
= self
._detect
_hardware
_and
_os
(ssh
)
320 params
.series
= hw
["series"]
321 params
.instance_id
= "manual:{}".format(self
.host
)
322 params
.nonce
= "manual:{}:{}".format(
323 self
.host
, str(uuid
.uuid4()), # a nop for Juju w/manual machines
325 params
.hardware_characteristics
= {
327 "mem": int(hw
["mem"]),
328 "cpu-cores": int(hw
["cpu-cores"]),
331 {"value": self
.host
, "type": "ipv4", "scope": "public"}
334 except paramiko
.ssh_exception
.AuthenticationException
as e
:
341 async def install_agent(self
, connection
, nonce
, machine_id
, api
):
343 :param object connection: Connection to Juju API
344 :param str nonce: The nonce machine specification
345 :param str machine_id: The id assigned to the machine
347 :return: bool: If the initialization was successful
349 # The path where the Juju agent should be installed.
350 data_dir
= "/var/lib/juju"
352 # Disabling this prevents `apt-get update` from running initially, so
353 # charms will fail to deploy
354 disable_package_commands
= False
356 client_facade
= client
.ClientFacade
.from_connection(connection
)
357 results
= await client_facade
.ProvisioningScript(
359 disable_package_commands
=disable_package_commands
,
360 machine_id
=machine_id
,
364 """Get the IP of the controller
366 Parse the provisioning script, looking for the first apiaddress.
374 m
= re
.search(r
"apiaddresses:\n- (\d+\.\d+\.\d+\.\d+):17070", results
.script
)
375 apiaddress
= m
.group(1)
379 In order to route the traffic to the private ip of the Juju controller
380 we use a DNAT rule to tell the machine that the destination for the
381 private address is the public address of the machine where the Juju
382 controller is running in LXD. That machine will have a complimentary
383 iptables rule, routing traffic to the appropriate LXD container.
386 script
= IPTABLES_SCRIPT
.format(apiaddress
, api
)
388 # Run this in a retry loop, because dpkg may be running and cause the
394 while attempts
<= retry
:
398 self
._run
_configure
_script
(script
)
400 except Exception as e
:
401 self
.log
.debug("Waiting for dpkg, sleeping {} seconds".format(delay
))
406 # Slowly back off the retry
409 # self.log.debug("Running configure script")
410 self
._run
_configure
_script
(results
.script
)
411 # self.log.debug("Configure script finished")
413 def _run_configure_script(self
, script
: str):
414 """Run the script to install the Juju agent on the target machine.
416 :param str script: The script returned by the ProvisioningScript API
417 :raises: :class:`paramiko.ssh_exception.AuthenticationException`
420 _
, tmpFile
= tempfile
.mkstemp()
421 with
open(tmpFile
, "w") as f
:
425 ssh
= self
._get
_ssh
_client
(user
="ubuntu",)
427 # copy the local copy of the script to the remote machine
428 sftp
= paramiko
.SFTPClient
.from_transport(ssh
.get_transport())
433 # run the provisioning script
435 ssh
, "sudo /bin/bash {}".format(tmpFile
),
438 except paramiko
.ssh_exception
.AuthenticationException
as e
: