installers/charm/nbi/src/pod_spec.py

   1 #!/usr/bin/env python3
   2 # Copyright 2020 Canonical Ltd.
   3 #
   4 # Licensed under the Apache License, Version 2.0 (the "License"); you may
   5 # not use this file except in compliance with the License. You may obtain
   6 # a copy of the License at
   7 #
   8 #         http://www.apache.org/licenses/LICENSE-2.0
   9 #
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  12 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
  13 # License for the specific language governing permissions and limitations
  14 # under the License.
  15 #
  16 # For those usages not covered by the Apache License, Version 2.0 please
  17 # contact: legal@canonical.com
  18 #
  19 # To get in touch with the maintainers, please contact:
  20 # osm-charmers@lists.launchpad.net
  21 ##
  22
  23 from ipaddress import ip_network
  24 from typing import Any, Callable, Dict, List, NoReturn
  25 from urllib.parse import urlparse
  26
  27
  28 def _validate_max_file_size(max_file_size: int, site_url: str) -> bool:
  29     """Validate max_file_size.
  30
  31     Args:
  32         max_file_size (int): maximum file size allowed.
  33         site_url (str): endpoint url.
  34
  35     Returns:
  36         bool: True if valid, false otherwise.
  37     """
  38     if not site_url:
  39         return True
  40
  41     parsed = urlparse(site_url)
  42
  43     if not parsed.scheme.startswith("http"):
  44         return True
  45
  46     if max_file_size is None:
  47         return False
  48
  49     return max_file_size >= 0
  50
  51
  52 def _validate_ip_network(network: str) -> bool:
  53     """Validate IP network.
  54
  55     Args:
  56         network (str): IP network range.
  57
  58     Returns:
  59         bool: True if valid, false otherwise.
  60     """
  61     if not network:
  62         return True
  63
  64     try:
  65         ip_network(network)
  66     except ValueError:
  67         return False
  68
  69     return True
  70
  71
  72 def _validate_keystone_config(keystone: bool, value: Any, validator: Callable) -> bool:
  73     """Validate keystone configurations.
  74
  75     Args:
  76         keystone (bool): is keystone enabled, true if so, false otherwise.
  77         value (Any): value to be validated.
  78         validator (Callable): function to validate configuration.
  79
  80     Returns:
  81         bool: true if valid, false otherwise.
  82     """
  83     if not keystone:
  84         return True
  85
  86     return validator(value)
  87
  88
  89 def _validate_data(
  90     config_data: Dict[str, Any], relation_data: Dict[str, Any], keystone: bool
  91 ) -> NoReturn:
  92     """Validate input data.
  93
  94     Args:
  95         config_data (Dict[str, Any]): configuration data.
  96         relation_data (Dict[str, Any]): relation data.
  97         keystone (bool): is keystone to be used.
  98     """
  99     config_validators = {
 100         "enable_test": lambda value, _: isinstance(value, bool),
 101         "database_commonkey": lambda value, _: (
 102             isinstance(value, str) and len(value) > 1
 103         ),
 104         "log_level": lambda value, _: (
 105             isinstance(value, str) and value in ("INFO", "DEBUG")
 106         ),
 107         "auth_backend": lambda value, _: (
 108             isinstance(value, str) and (value == "internal" or value == "keystone")
 109         ),
 110         "site_url": lambda value, _: isinstance(value, str)
 111         if value is not None
 112         else True,
 113         "max_file_size": lambda value, values: _validate_max_file_size(
 114             value, values.get("site_url")
 115         ),
 116         "ingress_whitelist_source_range": lambda value, _: _validate_ip_network(value),
 117         "tls_secret_name": lambda value, _: isinstance(value, str)
 118         if value is not None
 119         else True,
 120     }
 121     relation_validators = {
 122         "message_host": lambda value, _: isinstance(value, str),
 123         "message_port": lambda value, _: isinstance(value, int) and value > 0,
 124         "database_uri": lambda value, _: (
 125             isinstance(value, str) and value.startswith("mongodb://")
 126         ),
 127         "prometheus_host": lambda value, _: isinstance(value, str),
 128         "prometheus_port": lambda value, _: isinstance(value, int) and value > 0,
 129         "keystone_host": lambda value, _: _validate_keystone_config(
 130             keystone, value, lambda x: isinstance(x, str) and len(x) > 0
 131         ),
 132         "keystone_port": lambda value, _: _validate_keystone_config(
 133             keystone, value, lambda x: isinstance(x, int) and x > 0
 134         ),
 135         "keystone_user_domain_name": lambda value, _: _validate_keystone_config(
 136             keystone, value, lambda x: isinstance(x, str) and len(x) > 0
 137         ),
 138         "keystone_project_domain_name": lambda value, _: _validate_keystone_config(
 139             keystone, value, lambda x: isinstance(x, str) and len(x) > 0
 140         ),
 141         "keystone_username": lambda value, _: _validate_keystone_config(
 142             keystone, value, lambda x: isinstance(x, str) and len(x) > 0
 143         ),
 144         "keystone_password": lambda value, _: _validate_keystone_config(
 145             keystone, value, lambda x: isinstance(x, str) and len(x) > 0
 146         ),
 147         "keystone_service": lambda value, _: _validate_keystone_config(
 148             keystone, value, lambda x: isinstance(x, str) and len(x) > 0
 149         ),
 150     }
 151     problems = []
 152
 153     for key, validator in config_validators.items():
 154         valid = validator(config_data.get(key), config_data)
 155
 156         if not valid:
 157             problems.append(key)
 158
 159     for key, validator in relation_validators.items():
 160         valid = validator(relation_data.get(key), relation_data)
 161
 162         if not valid:
 163             problems.append(key)
 164
 165     if len(problems) > 0:
 166         raise ValueError("Errors found in: {}".format(", ".join(problems)))
 167
 168
 169 def _make_pod_ports(port: int) -> List[Dict[str, Any]]:
 170     """Generate pod ports details.
 171
 172     Args:
 173         port (int): port to expose.
 174
 175     Returns:
 176         List[Dict[str, Any]]: pod port details.
 177     """
 178     return [{"name": "nbi", "containerPort": port, "protocol": "TCP"}]
 179
 180
 181 def _make_pod_envconfig(
 182     config: Dict[str, Any], relation_state: Dict[str, Any]
 183 ) -> Dict[str, Any]:
 184     """Generate pod environment configuration.
 185
 186     Args:
 187         config (Dict[str, Any]): configuration information.
 188         relation_state (Dict[str, Any]): relation state information.
 189
 190     Returns:
 191         Dict[str, Any]: pod environment configuration.
 192     """
 193     envconfig = {
 194         # General configuration
 195         "ALLOW_ANONYMOUS_LOGIN": "yes",
 196         "OSMNBI_SERVER_ENABLE_TEST": config["enable_test"],
 197         "OSMNBI_STATIC_DIR": "/app/osm_nbi/html_public",
 198         # Kafka configuration
 199         "OSMNBI_MESSAGE_HOST": relation_state["message_host"],
 200         "OSMNBI_MESSAGE_DRIVER": "kafka",
 201         "OSMNBI_MESSAGE_PORT": relation_state["message_port"],
 202         # Database configuration
 203         "OSMNBI_DATABASE_DRIVER": "mongo",
 204         "OSMNBI_DATABASE_URI": relation_state["database_uri"],
 205         "OSMNBI_DATABASE_COMMONKEY": config["database_commonkey"],
 206         # Storage configuration
 207         "OSMNBI_STORAGE_DRIVER": "mongo",
 208         "OSMNBI_STORAGE_PATH": "/app/storage",
 209         "OSMNBI_STORAGE_COLLECTION": "files",
 210         "OSMNBI_STORAGE_URI": relation_state["database_uri"],
 211         # Prometheus configuration
 212         "OSMNBI_PROMETHEUS_HOST": relation_state["prometheus_host"],
 213         "OSMNBI_PROMETHEUS_PORT": relation_state["prometheus_port"],
 214         # Log configuration
 215         "OSMNBI_LOG_LEVEL": config["log_level"],
 216     }
 217
 218     if config["auth_backend"] == "internal":
 219         envconfig["OSMNBI_AUTHENTICATION_BACKEND"] = "internal"
 220     elif config["auth_backend"] == "keystone":
 221         envconfig.update(
 222             {
 223                 "OSMNBI_AUTHENTICATION_BACKEND": "keystone",
 224                 "OSMNBI_AUTHENTICATION_AUTH_URL": relation_state["keystone_host"],
 225                 "OSMNBI_AUTHENTICATION_AUTH_PORT": relation_state["keystone_port"],
 226                 "OSMNBI_AUTHENTICATION_USER_DOMAIN_NAME": relation_state[
 227                     "keystone_user_domain_name"
 228                 ],
 229                 "OSMNBI_AUTHENTICATION_PROJECT_DOMAIN_NAME": relation_state[
 230                     "keystone_project_domain_name"
 231                 ],
 232                 "OSMNBI_AUTHENTICATION_SERVICE_USERNAME": relation_state[
 233                     "keystone_username"
 234                 ],
 235                 "OSMNBI_AUTHENTICATION_SERVICE_PASSWORD": relation_state[
 236                     "keystone_password"
 237                 ],
 238                 "OSMNBI_AUTHENTICATION_SERVICE_PROJECT": relation_state[
 239                     "keystone_service"
 240                 ],
 241             }
 242         )
 243     else:
 244         raise ValueError("auth_backend needs to be either internal or keystone")
 245
 246     return envconfig
 247
 248
 249 def _make_pod_ingress_resources(
 250     config: Dict[str, Any], app_name: str, port: int
 251 ) -> List[Dict[str, Any]]:
 252     """Generate pod ingress resources.
 253
 254     Args:
 255         config (Dict[str, Any]): configuration information.
 256         app_name (str): application name.
 257         port (int): port to expose.
 258
 259     Returns:
 260         List[Dict[str, Any]]: pod ingress resources.
 261     """
 262     site_url = config.get("site_url")
 263
 264     if not site_url:
 265         return
 266
 267     parsed = urlparse(site_url)
 268
 269     if not parsed.scheme.startswith("http"):
 270         return
 271
 272     max_file_size = config["max_file_size"]
 273     ingress_whitelist_source_range = config["ingress_whitelist_source_range"]
 274
 275     annotations = {
 276         "nginx.ingress.kubernetes.io/proxy-body-size": "{}".format(
 277             str(max_file_size) + "m" if max_file_size > 0 else max_file_size
 278         ),
 279         "nginx.ingress.kubernetes.io/backend-protocol": "HTTPS",
 280     }
 281
 282     if ingress_whitelist_source_range:
 283         annotations[
 284             "nginx.ingress.kubernetes.io/whitelist-source-range"
 285         ] = ingress_whitelist_source_range
 286
 287     ingress_spec_tls = None
 288
 289     if parsed.scheme == "https":
 290         ingress_spec_tls = [{"hosts": [parsed.hostname]}]
 291         tls_secret_name = config["tls_secret_name"]
 292         if tls_secret_name:
 293             ingress_spec_tls[0]["secretName"] = tls_secret_name
 294     else:
 295         annotations["nginx.ingress.kubernetes.io/ssl-redirect"] = "false"
 296
 297     ingress = {
 298         "name": "{}-ingress".format(app_name),
 299         "annotations": annotations,
 300         "spec": {
 301             "rules": [
 302                 {
 303                     "host": parsed.hostname,
 304                     "http": {
 305                         "paths": [
 306                             {
 307                                 "path": "/",
 308                                 "backend": {
 309                                     "serviceName": app_name,
 310                                     "servicePort": port,
 311                                 },
 312                             }
 313                         ]
 314                     },
 315                 }
 316             ]
 317         },
 318     }
 319     if ingress_spec_tls:
 320         ingress["spec"]["tls"] = ingress_spec_tls
 321
 322     return [ingress]
 323
 324
 325 def _make_startup_probe() -> Dict[str, Any]:
 326     """Generate startup probe.
 327
 328     Returns:
 329         Dict[str, Any]: startup probe.
 330     """
 331     return {
 332         "exec": {"command": ["/usr/bin/pgrep python3"]},
 333         "initialDelaySeconds": 60,
 334         "timeoutSeconds": 5,
 335     }
 336
 337
 338 def _make_readiness_probe(port: int) -> Dict[str, Any]:
 339     """Generate readiness probe.
 340
 341     Args:
 342         port (int): [description]
 343
 344     Returns:
 345         Dict[str, Any]: readiness probe.
 346     """
 347     return {
 348         "httpGet": {
 349             "path": "/osm/",
 350             "port": port,
 351         },
 352         "initialDelaySeconds": 45,
 353         "timeoutSeconds": 5,
 354     }
 355
 356
 357 def _make_liveness_probe(port: int) -> Dict[str, Any]:
 358     """Generate liveness probe.
 359
 360     Args:
 361         port (int): [description]
 362
 363     Returns:
 364         Dict[str, Any]: liveness probe.
 365     """
 366     return {
 367         "httpGet": {
 368             "path": "/osm/",
 369             "port": port,
 370         },
 371         "initialDelaySeconds": 45,
 372         "timeoutSeconds": 5,
 373     }
 374
 375
 376 def make_pod_spec(
 377     image_info: Dict[str, str],
 378     config: Dict[str, Any],
 379     relation_state: Dict[str, Any],
 380     app_name: str = "nbi",
 381     port: int = 9999,
 382 ) -> Dict[str, Any]:
 383     """Generate the pod spec information.
 384
 385     Args:
 386         image_info (Dict[str, str]): Object provided by
 387                                      OCIImageResource("image").fetch().
 388         config (Dict[str, Any]): Configuration information.
 389         relation_state (Dict[str, Any]): Relation state information.
 390         app_name (str, optional): Application name. Defaults to "nbi".
 391         port (int, optional): Port for the container. Defaults to 9999.
 392
 393     Returns:
 394         Dict[str, Any]: Pod spec dictionary for the charm.
 395     """
 396     if not image_info:
 397         return None
 398
 399     _validate_data(config, relation_state, config.get("auth_backend") == "keystone")
 400
 401     ports = _make_pod_ports(port)
 402     env_config = _make_pod_envconfig(config, relation_state)
 403     ingress_resources = _make_pod_ingress_resources(config, app_name, port)
 404
 405     return {
 406         "version": 3,
 407         "containers": [
 408             {
 409                 "name": app_name,
 410                 "imageDetails": image_info,
 411                 "imagePullPolicy": "Always",
 412                 "ports": ports,
 413                 "envConfig": env_config,
 414             }
 415         ],
 416         "kubernetesResources": {
 417             "ingressResources": ingress_resources or [],
 418         },
 419     }