installers/charm/nbi/src/pod_spec.py

   1 #!/usr/bin/env python3
   2 # Copyright 2020 Canonical Ltd.
   3 #
   4 # Licensed under the Apache License, Version 2.0 (the "License"); you may
   5 # not use this file except in compliance with the License. You may obtain
   6 # a copy of the License at
   7 #
   8 #         http://www.apache.org/licenses/LICENSE-2.0
   9 #
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  12 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
  13 # License for the specific language governing permissions and limitations
  14 # under the License.
  15 #
  16 # For those usages not covered by the Apache License, Version 2.0 please
  17 # contact: legal@canonical.com
  18 #
  19 # To get in touch with the maintainers, please contact:
  20 # osm-charmers@lists.launchpad.net
  21 ##
  22
  23 import logging
  24 from pydantic import (
  25     BaseModel,
  26     conint,
  27     constr,
  28     IPvAnyNetwork,
  29     PositiveInt,
  30     validator,
  31     ValidationError,
  32 )
  33 from typing import Any, Dict, List, Optional
  34 from urllib.parse import urlparse
  35
  36 logger = logging.getLogger(__name__)
  37
  38
  39 class ConfigData(BaseModel):
  40     """Configuration data model."""
  41
  42     enable_test: bool
  43     database_commonkey: constr(min_length=1)
  44     log_level: constr(regex=r"^(INFO|DEBUG)$")
  45     auth_backend: constr(regex=r"^(internal|keystone)$")
  46     site_url: Optional[str]
  47     max_file_size: Optional[conint(ge=0)]
  48     ingress_whitelist_source_range: Optional[IPvAnyNetwork]
  49     tls_secret_name: Optional[str]
  50
  51     @validator("max_file_size", pre=True, always=True)
  52     def validate_max_file_size(cls, value, values, **kwargs):
  53         site_url = values.get("site_url")
  54
  55         if not site_url:
  56             return value
  57
  58         parsed = urlparse(site_url)
  59
  60         if not parsed.scheme.startswith("http"):
  61             return value
  62
  63         if value is None:
  64             raise ValueError("max_file_size needs to be defined if site_url is defined")
  65
  66         return value
  67
  68     @validator("ingress_whitelist_source_range", pre=True, always=True)
  69     def validate_ingress_whitelist_source_range(cls, value, values, **kwargs):
  70         if not value:
  71             return None
  72
  73         return value
  74
  75
  76 class RelationData(BaseModel):
  77     """Relation data model."""
  78
  79     message_host: str
  80     message_port: PositiveInt
  81     database_uri: constr(regex=r"^(mongo://)")
  82     prometheus_host: str
  83     prometheus_port: PositiveInt
  84     keystone: bool
  85     keystone_host: Optional[constr(min_length=1)]
  86     keystone_port: Optional[PositiveInt]
  87     keystone_user_domain_name: Optional[constr(min_length=1)]
  88     keystone_project_domain_name: Optional[constr(min_length=1)]
  89     keystone_username: Optional[constr(min_length=1)]
  90     keystone_password: Optional[constr(min_length=1)]
  91     keystone_service: Optional[constr(min_length=1)]
  92
  93     @validator("keystone_host", pre=True, always=True)
  94     def validate_keystone_host(cls, value, values, **kwargs):
  95         keystone = values.get("keystone")
  96
  97         if not keystone:
  98             return value
  99
 100         if value is None:
 101             raise ValueError(
 102                 "keystone_host needs to be defined if keystone is configured"
 103             )
 104
 105         return value
 106
 107     @validator("keystone_port", pre=True, always=True)
 108     def validate_keystone_port(cls, value, values, **kwargs):
 109         keystone = values.get("keystone")
 110
 111         if not keystone:
 112             return value
 113
 114         if value is None:
 115             raise ValueError(
 116                 "keystone_port needs to be defined if keystone is configured"
 117             )
 118
 119         return value
 120
 121     @validator("keystone_user_domain_name", pre=True, always=True)
 122     def validate_keystone_user_domain_name(cls, value, values, **kwargs):
 123         keystone = values.get("keystone")
 124
 125         if not keystone:
 126             return value
 127
 128         if value is None:
 129             raise ValueError(
 130                 "keystone_user_domain_name needs to be defined if keystone is configured"
 131             )
 132
 133         return value
 134
 135     @validator("keystone_project_domain_name", pre=True, always=True)
 136     def validate_keystone_project_domain_name(cls, value, values, **kwargs):
 137         keystone = values.get("keystone")
 138
 139         if not keystone:
 140             return value
 141
 142         if value is None:
 143             raise ValueError(
 144                 "keystone_project_domain_name needs to be defined if keystone is configured"
 145             )
 146
 147         return value
 148
 149     @validator("keystone_username", pre=True, always=True)
 150     def validate_keystone_username(cls, value, values, **kwargs):
 151         keystone = values.get("keystone")
 152
 153         if not keystone:
 154             return value
 155
 156         if value is None:
 157             raise ValueError(
 158                 "keystone_username needs to be defined if keystone is configured"
 159             )
 160
 161         return value
 162
 163     @validator("keystone_password", pre=True, always=True)
 164     def validate_keystone_password(cls, value, values, **kwargs):
 165         keystone = values.get("keystone")
 166
 167         if not keystone:
 168             return value
 169
 170         if value is None:
 171             raise ValueError(
 172                 "keystone_password needs to be defined if keystone is configured"
 173             )
 174
 175         return value
 176
 177     @validator("keystone_service", pre=True, always=True)
 178     def validate_keystone_service(cls, value, values, **kwargs):
 179         keystone = values.get("keystone")
 180
 181         if not keystone:
 182             return value
 183
 184         if value is None:
 185             raise ValueError(
 186                 "keystone_service needs to be defined if keystone is configured"
 187             )
 188
 189         return value
 190
 191
 192 def _make_pod_ports(port: int) -> List[Dict[str, Any]]:
 193     """Generate pod ports details.
 194
 195     Args:
 196         port (int): port to expose.
 197
 198     Returns:
 199         List[Dict[str, Any]]: pod port details.
 200     """
 201     return [{"name": "nbi", "containerPort": port, "protocol": "TCP"}]
 202
 203
 204 def _make_pod_envconfig(
 205     config: Dict[str, Any], relation_state: Dict[str, Any]
 206 ) -> Dict[str, Any]:
 207     """Generate pod environment configuration.
 208
 209     Args:
 210         config (Dict[str, Any]): configuration information.
 211         relation_state (Dict[str, Any]): relation state information.
 212
 213     Returns:
 214         Dict[str, Any]: pod environment configuration.
 215     """
 216     envconfig = {
 217         # General configuration
 218         "ALLOW_ANONYMOUS_LOGIN": "yes",
 219         "OSMNBI_SERVER_ENABLE_TEST": config["enable_test"],
 220         "OSMNBI_STATIC_DIR": "/app/osm_nbi/html_public",
 221         # Kafka configuration
 222         "OSMNBI_MESSAGE_HOST": relation_state["message_host"],
 223         "OSMNBI_MESSAGE_DRIVER": "kafka",
 224         "OSMNBI_MESSAGE_PORT": relation_state["message_port"],
 225         # Database configuration
 226         "OSMNBI_DATABASE_DRIVER": "mongo",
 227         "OSMNBI_DATABASE_URI": relation_state["database_uri"],
 228         "OSMNBI_DATABASE_COMMONKEY": config["database_commonkey"],
 229         # Storage configuration
 230         "OSMNBI_STORAGE_DRIVER": "mongo",
 231         "OSMNBI_STORAGE_PATH": "/app/storage",
 232         "OSMNBI_STORAGE_COLLECTION": "files",
 233         "OSMNBI_STORAGE_URI": relation_state["database_uri"],
 234         # Prometheus configuration
 235         "OSMNBI_PROMETHEUS_HOST": relation_state["prometheus_host"],
 236         "OSMNBI_PROMETHEUS_PORT": relation_state["prometheus_port"],
 237         # Log configuration
 238         "OSMNBI_LOG_LEVEL": config["log_level"],
 239     }
 240
 241     if config["auth_backend"] == "internal":
 242         envconfig["OSMNBI_AUTHENTICATION_BACKEND"] = "internal"
 243     elif config["auth_backend"] == "keystone":
 244         envconfig.update(
 245             {
 246                 "OSMNBI_AUTHENTICATION_BACKEND": "keystone",
 247                 "OSMNBI_AUTHENTICATION_AUTH_URL": relation_state["keystone_host"],
 248                 "OSMNBI_AUTHENTICATION_AUTH_PORT": relation_state["keystone_port"],
 249                 "OSMNBI_AUTHENTICATION_USER_DOMAIN_NAME": relation_state[
 250                     "keystone_user_domain_name"
 251                 ],
 252                 "OSMNBI_AUTHENTICATION_PROJECT_DOMAIN_NAME": relation_state[
 253                     "keystone_project_domain_name"
 254                 ],
 255                 "OSMNBI_AUTHENTICATION_SERVICE_USERNAME": relation_state[
 256                     "keystone_username"
 257                 ],
 258                 "OSMNBI_AUTHENTICATION_SERVICE_PASSWORD": relation_state[
 259                     "keystone_password"
 260                 ],
 261                 "OSMNBI_AUTHENTICATION_SERVICE_PROJECT": relation_state[
 262                     "keystone_service"
 263                 ],
 264             }
 265         )
 266     else:
 267         raise ValueError("auth_backend needs to be either internal or keystone")
 268
 269     return envconfig
 270
 271
 272 def _make_pod_ingress_resources(
 273     config: Dict[str, Any], app_name: str, port: int
 274 ) -> List[Dict[str, Any]]:
 275     """Generate pod ingress resources.
 276
 277     Args:
 278         config (Dict[str, Any]): configuration information.
 279         app_name (str): application name.
 280         port (int): port to expose.
 281
 282     Returns:
 283         List[Dict[str, Any]]: pod ingress resources.
 284     """
 285     site_url = config.get("site_url")
 286
 287     if not site_url:
 288         return
 289
 290     parsed = urlparse(site_url)
 291
 292     if not parsed.scheme.startswith("http"):
 293         return
 294
 295     max_file_size = config["max_file_size"]
 296     ingress_whitelist_source_range = config["ingress_whitelist_source_range"]
 297
 298     annotations = {
 299         "nginx.ingress.kubernetes.io/proxy-body-size": "{}".format(
 300             max_file_size + "m" if max_file_size > 0 else max_file_size
 301         ),
 302         "nginx.ingress.kubernetes.io/backend-protocol": "HTTPS",
 303     }
 304
 305     if ingress_whitelist_source_range:
 306         annotations[
 307             "nginx.ingress.kubernetes.io/whitelist-source-range"
 308         ] = ingress_whitelist_source_range
 309
 310     ingress_spec_tls = None
 311
 312     if parsed.scheme == "https":
 313         ingress_spec_tls = [{"hosts": [parsed.hostname]}]
 314         tls_secret_name = config["tls_secret_name"]
 315         if tls_secret_name:
 316             ingress_spec_tls[0]["secretName"] = tls_secret_name
 317     else:
 318         annotations["nginx.ingress.kubernetes.io/ssl-redirect"] = "false"
 319
 320     ingress = {
 321         "name": "{}-ingress".format(app_name),
 322         "annotations": annotations,
 323         "spec": {
 324             "rules": [
 325                 {
 326                     "host": parsed.hostname,
 327                     "http": {
 328                         "paths": [
 329                             {
 330                                 "path": "/",
 331                                 "backend": {
 332                                     "serviceName": app_name,
 333                                     "servicePort": port,
 334                                 },
 335                             }
 336                         ]
 337                     },
 338                 }
 339             ]
 340         },
 341     }
 342     if ingress_spec_tls:
 343         ingress["spec"]["tls"] = ingress_spec_tls
 344
 345     return [ingress]
 346
 347
 348 def _make_startup_probe() -> Dict[str, Any]:
 349     """Generate startup probe.
 350
 351     Returns:
 352         Dict[str, Any]: startup probe.
 353     """
 354     return {
 355         "exec": {"command": ["/usr/bin/pgrep python3"]},
 356         "initialDelaySeconds": 60,
 357         "timeoutSeconds": 5,
 358     }
 359
 360
 361 def _make_readiness_probe(port: int) -> Dict[str, Any]:
 362     """Generate readiness probe.
 363
 364     Args:
 365         port (int): [description]
 366
 367     Returns:
 368         Dict[str, Any]: readiness probe.
 369     """
 370     return {
 371         "httpGet": {
 372             "path": "/osm/",
 373             "port": port,
 374         },
 375         "initialDelaySeconds": 45,
 376         "timeoutSeconds": 5,
 377     }
 378
 379
 380 def _make_liveness_probe(port: int) -> Dict[str, Any]:
 381     """Generate liveness probe.
 382
 383     Args:
 384         port (int): [description]
 385
 386     Returns:
 387         Dict[str, Any]: liveness probe.
 388     """
 389     return {
 390         "httpGet": {
 391             "path": "/osm/",
 392             "port": port,
 393         },
 394         "initialDelaySeconds": 45,
 395         "timeoutSeconds": 5,
 396     }
 397
 398
 399 def make_pod_spec(
 400     image_info: Dict[str, str],
 401     config: Dict[str, Any],
 402     relation_state: Dict[str, Any],
 403     app_name: str = "nbi",
 404     port: int = 9999,
 405 ) -> Dict[str, Any]:
 406     """Generate the pod spec information.
 407
 408     Args:
 409         image_info (Dict[str, str]): Object provided by
 410                                      OCIImageResource("image").fetch().
 411         config (Dict[str, Any]): Configuration information.
 412         relation_state (Dict[str, Any]): Relation state information.
 413         app_name (str, optional): Application name. Defaults to "nbi".
 414         port (int, optional): Port for the container. Defaults to 9999.
 415
 416     Returns:
 417         Dict[str, Any]: Pod spec dictionary for the charm.
 418     """
 419     if not image_info:
 420         return None
 421
 422     ConfigData(**(config))
 423     RelationData(
 424         **(relation_state),
 425         keystone=True if config.get("auth_backend") == "keystone" else False,
 426     )
 427
 428     ports = _make_pod_ports(port)
 429     env_config = _make_pod_envconfig(config, relation_state)
 430     ingress_resources = _make_pod_ingress_resources(config, app_name, port)
 431
 432     return {
 433         "version": 3,
 434         "containers": [
 435             {
 436                 "name": app_name,
 437                 "imageDetails": image_info,
 438                 "imagePullPolicy": "Always",
 439                 "ports": ports,
 440                 "envConfig": env_config,
 441             }
 442         ],
 443         "kubernetesResources": {
 444             "ingressResources": ingress_resources or [],
 445         },
 446     }