Adding security_context flag to charms
[osm/devops.git] / installers / charm / pol / src / charm.py
1 #!/usr/bin/env python3
2 # Copyright 2021 Canonical Ltd.
3 #
4 # Licensed under the Apache License, Version 2.0 (the "License"); you may
5 # not use this file except in compliance with the License. You may obtain
6 # a copy of the License at
7 #
8 # http://www.apache.org/licenses/LICENSE-2.0
9 #
10 # Unless required by applicable law or agreed to in writing, software
11 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 # License for the specific language governing permissions and limitations
14 # under the License.
15 #
16 # For those usages not covered by the Apache License, Version 2.0 please
17 # contact: legal@canonical.com
18 #
19 # To get in touch with the maintainers, please contact:
20 # osm-charmers@lists.launchpad.net
21 ##
22
23 # pylint: disable=E0213
24
25
26 import logging
27 import re
28 from typing import NoReturn, Optional
29
30 from ops.main import main
31 from opslib.osm.charm import CharmedOsmBase, RelationsMissing
32 from opslib.osm.interfaces.kafka import KafkaClient
33 from opslib.osm.interfaces.mongo import MongoClient
34 from opslib.osm.interfaces.mysql import MysqlClient
35 from opslib.osm.pod import (
36 ContainerV3Builder,
37 PodRestartPolicy,
38 PodSpecV3Builder,
39 )
40 from opslib.osm.validator import ModelValidator, validator
41
42
43 logger = logging.getLogger(__name__)
44
45 PORT = 9999
46 DEFAULT_MYSQL_DATABASE = "pol"
47
48
49 class ConfigModel(ModelValidator):
50 log_level: str
51 mongodb_uri: Optional[str]
52 mysql_uri: Optional[str]
53 image_pull_policy: str
54 debug_mode: bool
55 security_context: bool
56
57 @validator("log_level")
58 def validate_log_level(cls, v):
59 if v not in {"INFO", "DEBUG"}:
60 raise ValueError("value must be INFO or DEBUG")
61 return v
62
63 @validator("mongoddb_uri")
64 def validate_mongodb_uri(cls, v):
65 if v and not v.startswith("mongodb://"):
66 raise ValueError("mongodb_uri is not properly formed")
67 return v
68
69 @validator("mysql_uri")
70 def validate_mysql_uri(cls, v):
71 pattern = re.compile("^mysql:\/\/.*:.*@.*:\d+\/.*$") # noqa: W605
72 if v and not pattern.search(v):
73 raise ValueError("mysql_uri is not properly formed")
74 return v
75
76 @validator("image_pull_policy")
77 def validate_image_pull_policy(cls, v):
78 values = {
79 "always": "Always",
80 "ifnotpresent": "IfNotPresent",
81 "never": "Never",
82 }
83 v = v.lower()
84 if v not in values.keys():
85 raise ValueError("value must be always, ifnotpresent or never")
86 return values[v]
87
88
89 class PolCharm(CharmedOsmBase):
90 def __init__(self, *args) -> NoReturn:
91 super().__init__(
92 *args,
93 oci_image="image",
94 debug_mode_config_key="debug_mode",
95 debug_pubkey_config_key="debug_pubkey",
96 vscode_workspace=VSCODE_WORKSPACE,
97 )
98
99 self.kafka_client = KafkaClient(self, "kafka")
100 self.framework.observe(self.on["kafka"].relation_changed, self.configure_pod)
101 self.framework.observe(self.on["kafka"].relation_broken, self.configure_pod)
102
103 self.mongodb_client = MongoClient(self, "mongodb")
104 self.framework.observe(self.on["mongodb"].relation_changed, self.configure_pod)
105 self.framework.observe(self.on["mongodb"].relation_broken, self.configure_pod)
106
107 self.mysql_client = MysqlClient(self, "mysql")
108 self.framework.observe(self.on["mysql"].relation_changed, self.configure_pod)
109 self.framework.observe(self.on["mysql"].relation_broken, self.configure_pod)
110
111 def _check_missing_dependencies(self, config: ConfigModel):
112 missing_relations = []
113
114 if self.kafka_client.is_missing_data_in_unit():
115 missing_relations.append("kafka")
116 if not config.mongodb_uri and self.mongodb_client.is_missing_data_in_unit():
117 missing_relations.append("mongodb")
118 if not config.mysql_uri and self.mysql_client.is_missing_data_in_unit():
119 missing_relations.append("mysql")
120 if missing_relations:
121 raise RelationsMissing(missing_relations)
122
123 def build_pod_spec(self, image_info):
124 # Validate config
125 config = ConfigModel(**dict(self.config))
126
127 if config.mongodb_uri and not self.mongodb_client.is_missing_data_in_unit():
128 raise Exception("Mongodb data cannot be provided via config and relation")
129 if config.mysql_uri and not self.mysql_client.is_missing_data_in_unit():
130 raise Exception("Mysql data cannot be provided via config and relation")
131
132 # Check relations
133 self._check_missing_dependencies(config)
134
135 security_context_enabled = (
136 config.security_context if not config.debug_mode else False
137 )
138
139 # Create Builder for the PodSpec
140 pod_spec_builder = PodSpecV3Builder(
141 enable_security_context=security_context_enabled
142 )
143
144 # Add secrets to the pod
145 mongodb_secret_name = f"{self.app.name}-mongodb-secret"
146 pod_spec_builder.add_secret(
147 mongodb_secret_name,
148 {"uri": config.mongodb_uri or self.mongodb_client.connection_string},
149 )
150 mysql_secret_name = f"{self.app.name}-mysql-secret"
151 pod_spec_builder.add_secret(
152 mysql_secret_name,
153 {
154 "uri": config.mysql_uri
155 or self.mysql_client.get_root_uri(DEFAULT_MYSQL_DATABASE)
156 },
157 )
158
159 # Build Container
160 container_builder = ContainerV3Builder(
161 self.app.name,
162 image_info,
163 config.image_pull_policy,
164 run_as_non_root=security_context_enabled,
165 )
166 container_builder.add_port(name=self.app.name, port=PORT)
167 container_builder.add_envs(
168 {
169 # General configuration
170 "ALLOW_ANONYMOUS_LOGIN": "yes",
171 "OSMPOL_GLOBAL_LOGLEVEL": config.log_level,
172 # Kafka configuration
173 "OSMPOL_MESSAGE_DRIVER": "kafka",
174 "OSMPOL_MESSAGE_HOST": self.kafka_client.host,
175 "OSMPOL_MESSAGE_PORT": self.kafka_client.port,
176 # Database configuration
177 "OSMPOL_DATABASE_DRIVER": "mongo",
178 }
179 )
180 container_builder.add_secret_envs(
181 mongodb_secret_name, {"OSMPOL_DATABASE_URI": "uri"}
182 )
183 container_builder.add_secret_envs(
184 mysql_secret_name, {"OSMPOL_SQL_DATABASE_URI": "uri"}
185 )
186 container = container_builder.build()
187
188 # Add Pod restart policy
189 restart_policy = PodRestartPolicy()
190 restart_policy.add_secrets(
191 secret_names=(mongodb_secret_name, mysql_secret_name)
192 )
193 pod_spec_builder.set_restart_policy(restart_policy)
194
195 # Add container to pod spec
196 pod_spec_builder.add_container(container)
197
198 return pod_spec_builder.build()
199
200
201 VSCODE_WORKSPACE = {
202 "folders": [
203 {"path": "/usr/lib/python3/dist-packages/osm_policy_module"},
204 {"path": "/usr/lib/python3/dist-packages/osm_common"},
205 ],
206 "settings": {},
207 "launch": {
208 "version": "0.2.0",
209 "configurations": [
210 {
211 "name": "POL",
212 "type": "python",
213 "request": "launch",
214 "module": "osm_policy_module.cmd.policy_module_agent",
215 "justMyCode": False,
216 }
217 ],
218 },
219 }
220
221
222 if __name__ == "__main__":
223 main(PolCharm)