installers/charm/grafana/src/charm.py

   1 #!/usr/bin/env python3
   2 # Copyright 2021 Canonical Ltd.
   3 #
   4 # Licensed under the Apache License, Version 2.0 (the "License"); you may
   5 # not use this file except in compliance with the License. You may obtain
   6 # a copy of the License at
   7 #
   8 #         http://www.apache.org/licenses/LICENSE-2.0
   9 #
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  12 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
  13 # License for the specific language governing permissions and limitations
  14 # under the License.
  15 #
  16 # For those usages not covered by the Apache License, Version 2.0 please
  17 # contact: legal@canonical.com
  18 #
  19 # To get in touch with the maintainers, please contact:
  20 # osm-charmers@lists.launchpad.net
  21 ##
  22
  23 # pylint: disable=E0213
  24
  25 from ipaddress import ip_network
  26 import logging
  27 from pathlib import Path
  28 import secrets
  29 from string import Template
  30 from typing import NoReturn, Optional
  31 from urllib.parse import urlparse
  32
  33 from ops.main import main
  34 from opslib.osm.charm import CharmedOsmBase, RelationsMissing
  35 from opslib.osm.interfaces.grafana import GrafanaCluster
  36 from opslib.osm.interfaces.mysql import MysqlClient
  37 from opslib.osm.interfaces.prometheus import PrometheusClient
  38 from opslib.osm.pod import (
  39     ContainerV3Builder,
  40     FilesV3Builder,
  41     IngressResourceV3Builder,
  42     PodRestartPolicy,
  43     PodSpecV3Builder,
  44 )
  45 from opslib.osm.validator import ModelValidator, validator
  46
  47
  48 logger = logging.getLogger(__name__)
  49
  50
  51 class ConfigModel(ModelValidator):
  52     log_level: str
  53     port: int
  54     admin_user: str
  55     max_file_size: int
  56     osm_dashboards: bool
  57     site_url: Optional[str]
  58     cluster_issuer: Optional[str]
  59     ingress_class: Optional[str]
  60     ingress_whitelist_source_range: Optional[str]
  61     tls_secret_name: Optional[str]
  62     image_pull_policy: str
  63     security_context: bool
  64
  65     @validator("log_level")
  66     def validate_log_level(cls, v):
  67         allowed_values = ("debug", "info", "warn", "error", "critical")
  68         if v not in allowed_values:
  69             separator = '", "'
  70             raise ValueError(
  71                 f'incorrect value. Allowed values are "{separator.join(allowed_values)}"'
  72             )
  73         return v
  74
  75     @validator("max_file_size")
  76     def validate_max_file_size(cls, v):
  77         if v < 0:
  78             raise ValueError("value must be equal or greater than 0")
  79         return v
  80
  81     @validator("site_url")
  82     def validate_site_url(cls, v):
  83         if v:
  84             parsed = urlparse(v)
  85             if not parsed.scheme.startswith("http"):
  86                 raise ValueError("value must start with http")
  87         return v
  88
  89     @validator("ingress_whitelist_source_range")
  90     def validate_ingress_whitelist_source_range(cls, v):
  91         if v:
  92             ip_network(v)
  93         return v
  94
  95     @validator("image_pull_policy")
  96     def validate_image_pull_policy(cls, v):
  97         values = {
  98             "always": "Always",
  99             "ifnotpresent": "IfNotPresent",
 100             "never": "Never",
 101         }
 102         v = v.lower()
 103         if v not in values.keys():
 104             raise ValueError("value must be always, ifnotpresent or never")
 105         return values[v]
 106
 107
 108 class GrafanaCharm(CharmedOsmBase):
 109     """GrafanaCharm Charm."""
 110
 111     def __init__(self, *args) -> NoReturn:
 112         """Prometheus Charm constructor."""
 113         super().__init__(*args, oci_image="image", mysql_uri=True)
 114         # Initialize relation objects
 115         self.prometheus_client = PrometheusClient(self, "prometheus")
 116         self.grafana_cluster = GrafanaCluster(self, "cluster")
 117         self.mysql_client = MysqlClient(self, "db")
 118         # Observe events
 119         event_observer_mapping = {
 120             self.on["prometheus"].relation_changed: self.configure_pod,
 121             self.on["prometheus"].relation_broken: self.configure_pod,
 122             self.on["db"].relation_changed: self.configure_pod,
 123             self.on["db"].relation_broken: self.configure_pod,
 124         }
 125         for event, observer in event_observer_mapping.items():
 126             self.framework.observe(event, observer)
 127
 128     def _build_dashboard_files(self, config: ConfigModel):
 129         files_builder = FilesV3Builder()
 130         files_builder.add_file(
 131             "dashboard_osm.yaml",
 132             Path("templates/default_dashboards.yaml").read_text(),
 133         )
 134         if config.osm_dashboards:
 135             osm_dashboards_mapping = {
 136                 "kafka_exporter_dashboard.json": "templates/kafka_exporter_dashboard.json",
 137                 "mongodb_exporter_dashboard.json": "templates/mongodb_exporter_dashboard.json",
 138                 "mysql_exporter_dashboard.json": "templates/mysql_exporter_dashboard.json",
 139                 "nodes_exporter_dashboard.json": "templates/nodes_exporter_dashboard.json",
 140                 "summary_dashboard.json": "templates/summary_dashboard.json",
 141             }
 142             for file_name, path in osm_dashboards_mapping.items():
 143                 files_builder.add_file(file_name, Path(path).read_text())
 144         return files_builder.build()
 145
 146     def _build_datasources_files(self):
 147         files_builder = FilesV3Builder()
 148         prometheus_user = self.prometheus_client.user
 149         prometheus_password = self.prometheus_client.password
 150         enable_basic_auth = all([prometheus_user, prometheus_password])
 151         kwargs = {
 152             "prometheus_host": self.prometheus_client.hostname,
 153             "prometheus_port": self.prometheus_client.port,
 154             "enable_basic_auth": enable_basic_auth,
 155             "user": "",
 156             "password": "",
 157         }
 158         if enable_basic_auth:
 159             kwargs["user"] = f"basic_auth_user: {prometheus_user}"
 160             kwargs[
 161                 "password"
 162             ] = f"secure_json_data:\n      basicAuthPassword: {prometheus_password}"
 163         files_builder.add_file(
 164             "datasource_prometheus.yaml",
 165             Template(Path("templates/default_datasources.yaml").read_text()).substitute(
 166                 **kwargs
 167             ),
 168         )
 169         return files_builder.build()
 170
 171     def _check_missing_dependencies(self, config: ConfigModel, external_db: bool):
 172         missing_relations = []
 173
 174         if self.prometheus_client.is_missing_data_in_app():
 175             missing_relations.append("prometheus")
 176
 177         if not external_db and self.mysql_client.is_missing_data_in_unit():
 178             missing_relations.append("db")
 179
 180         if missing_relations:
 181             raise RelationsMissing(missing_relations)
 182
 183     def build_pod_spec(self, image_info, **kwargs):
 184         # Validate config
 185         config = ConfigModel(**dict(self.config))
 186         mysql_config = kwargs["mysql_config"]
 187         if mysql_config.mysql_uri and not self.mysql_client.is_missing_data_in_unit():
 188             raise Exception("Mysql data cannot be provided via config and relation")
 189
 190         # Check relations
 191         external_db = True if mysql_config.mysql_uri else False
 192         self._check_missing_dependencies(config, external_db)
 193
 194         # Get initial password
 195         admin_initial_password = self.grafana_cluster.admin_initial_password
 196         if not admin_initial_password:
 197             admin_initial_password = _generate_random_password()
 198             self.grafana_cluster.set_initial_password(admin_initial_password)
 199
 200         # Create Builder for the PodSpec
 201         pod_spec_builder = PodSpecV3Builder(
 202             enable_security_context=config.security_context
 203         )
 204
 205         # Add secrets to the pod
 206         grafana_secret_name = f"{self.app.name}-admin-secret"
 207         pod_spec_builder.add_secret(
 208             grafana_secret_name,
 209             {
 210                 "admin-password": admin_initial_password,
 211                 "mysql-url": mysql_config.mysql_uri or self.mysql_client.get_uri(),
 212                 "prometheus-user": self.prometheus_client.user,
 213                 "prometheus-password": self.prometheus_client.password,
 214             },
 215         )
 216
 217         # Build Container
 218         container_builder = ContainerV3Builder(
 219             self.app.name,
 220             image_info,
 221             config.image_pull_policy,
 222             run_as_non_root=config.security_context,
 223         )
 224         container_builder.add_port(name=self.app.name, port=config.port)
 225         container_builder.add_http_readiness_probe(
 226             "/api/health",
 227             config.port,
 228             initial_delay_seconds=10,
 229             period_seconds=10,
 230             timeout_seconds=5,
 231             failure_threshold=3,
 232         )
 233         container_builder.add_http_liveness_probe(
 234             "/api/health",
 235             config.port,
 236             initial_delay_seconds=60,
 237             timeout_seconds=30,
 238             failure_threshold=10,
 239         )
 240         container_builder.add_volume_config(
 241             "dashboards",
 242             "/etc/grafana/provisioning/dashboards/",
 243             self._build_dashboard_files(config),
 244         )
 245         container_builder.add_volume_config(
 246             "datasources",
 247             "/etc/grafana/provisioning/datasources/",
 248             self._build_datasources_files(),
 249         )
 250         container_builder.add_envs(
 251             {
 252                 "GF_SERVER_HTTP_PORT": config.port,
 253                 "GF_LOG_LEVEL": config.log_level,
 254                 "GF_SECURITY_ADMIN_USER": config.admin_user,
 255             }
 256         )
 257         container_builder.add_secret_envs(
 258             secret_name=grafana_secret_name,
 259             envs={
 260                 "GF_SECURITY_ADMIN_PASSWORD": "admin-password",
 261                 "GF_DATABASE_URL": "mysql-url",
 262                 "PROMETHEUS_USER": "prometheus-user",
 263                 "PROMETHEUS_PASSWORD": "prometheus-password",
 264             },
 265         )
 266         container = container_builder.build()
 267         pod_spec_builder.add_container(container)
 268
 269         # Add Pod restart policy
 270         restart_policy = PodRestartPolicy()
 271         restart_policy.add_secrets(secret_names=(grafana_secret_name,))
 272         pod_spec_builder.set_restart_policy(restart_policy)
 273
 274         # Add ingress resources to pod spec if site url exists
 275         if config.site_url:
 276             parsed = urlparse(config.site_url)
 277             annotations = {
 278                 "nginx.ingress.kubernetes.io/proxy-body-size": "{}".format(
 279                     str(config.max_file_size) + "m"
 280                     if config.max_file_size > 0
 281                     else config.max_file_size
 282                 )
 283             }
 284             if config.ingress_class:
 285                 annotations["kubernetes.io/ingress.class"] = config.ingress_class
 286             ingress_resource_builder = IngressResourceV3Builder(
 287                 f"{self.app.name}-ingress", annotations
 288             )
 289
 290             if config.ingress_whitelist_source_range:
 291                 annotations[
 292                     "nginx.ingress.kubernetes.io/whitelist-source-range"
 293                 ] = config.ingress_whitelist_source_range
 294
 295             if config.cluster_issuer:
 296                 annotations["cert-manager.io/cluster-issuer"] = config.cluster_issuer
 297
 298             if parsed.scheme == "https":
 299                 ingress_resource_builder.add_tls(
 300                     [parsed.hostname], config.tls_secret_name
 301                 )
 302             else:
 303                 annotations["nginx.ingress.kubernetes.io/ssl-redirect"] = "false"
 304
 305             ingress_resource_builder.add_rule(
 306                 parsed.hostname, self.app.name, config.port
 307             )
 308             ingress_resource = ingress_resource_builder.build()
 309             pod_spec_builder.add_ingress_resource(ingress_resource)
 310         return pod_spec_builder.build()
 311
 312
 313 def _generate_random_password():
 314     return secrets.token_hex(16)
 315
 316
 317 if __name__ == "__main__":
 318     main(GrafanaCharm)