From: David Garcia <david.garcia@canonical.com>
Date: Thu, 30 Sep 2021 08:36:33 +0000 (+0200)
Subject: Add web ui authentication
X-Git-Tag: release-v11.0-start~11
X-Git-Url: https://osm.etsi.org/gitweb/?p=osm%2Fdevops.git;a=commitdiff_plain;h=a2a2b1c98b2a6c4df80514c184db912afb17b808

Add web ui authentication

Change-Id: I29c61f84dd8443a650cf45a4a2dfcc99efed1106
Signed-off-by: David Garcia <david.garcia@canonical.com>
---

diff --git a/installers/charm/prometheus/config.yaml b/installers/charm/prometheus/config.yaml
index 6db6a60b..b25eabae 100644
--- a/installers/charm/prometheus/config.yaml
+++ b/installers/charm/prometheus/config.yaml
@@ -75,3 +75,11 @@ options:
     description: Enables the security context of the pods
     type: boolean
     default: false
+  web_config_username:
+    type: string
+    default: admin
+    description: Username to access the Prometheus Web Interface
+  web_config_password:
+    type: string
+    default: admin
+    description: Password to access the Prometheus Web Interface
diff --git a/installers/charm/prometheus/requirements.txt b/installers/charm/prometheus/requirements.txt
index e1150c5d..db13e518 100644
--- a/installers/charm/prometheus/requirements.txt
+++ b/installers/charm/prometheus/requirements.txt
@@ -20,7 +20,6 @@
 ##
 
 git+https://github.com/charmed-osm/ops-lib-charmed-osm/@master
-git+https://github.com/juju-solutions/resource-oci-image/@c5778285d332edf3d9a538f9d0c06154b7ec1b0b#egg=oci-image
-ops
 requests
 urllib3>1.25.9
+bcrypt
diff --git a/installers/charm/prometheus/src/charm.py b/installers/charm/prometheus/src/charm.py
index 61589e20..40c4f4eb 100755
--- a/installers/charm/prometheus/src/charm.py
+++ b/installers/charm/prometheus/src/charm.py
@@ -22,11 +22,13 @@
 
 # pylint: disable=E0213
 
+import base64
 from ipaddress import ip_network
 import logging
 from typing import NoReturn, Optional
 from urllib.parse import urlparse
 
+import bcrypt
 from oci_image import OCIImageResource
 from ops.framework import EventBase
 from ops.main import main
@@ -62,6 +64,8 @@ class ConfigModel(ModelValidator):
     enable_web_admin_api: bool
     image_pull_policy: str
     security_context: bool
+    web_config_username: str
+    web_config_password: str
 
     @validator("web_subpath")
     def validate_web_subpath(cls, v):
@@ -135,7 +139,7 @@ class PrometheusCharm(CharmedOsmBase):
         else:
             event.fail(f"status-code: {result.status_code}")
 
-    def _build_files(self, config: ConfigModel):
+    def _build_config_file(self, config: ConfigModel):
         files_builder = FilesV3Builder()
         files_builder.add_file(
             "prometheus.yml",
@@ -156,6 +160,11 @@ class PrometheusCharm(CharmedOsmBase):
         )
         return files_builder.build()
 
+    def _build_webconfig_file(self):
+        files_builder = FilesV3Builder()
+        files_builder.add_file("web.yml", "web-config-file", secret=True)
+        return files_builder.build()
+
     def build_pod_spec(self, image_info):
         # Validate config
         config = ConfigModel(**dict(self.config))
@@ -169,9 +178,22 @@ class PrometheusCharm(CharmedOsmBase):
         backup_image_info = backup_image.fetch()
         backup_container_builder = ContainerV3Builder("prom-backup", backup_image_info)
         backup_container = backup_container_builder.build()
+
         # Add backup container to pod spec
         pod_spec_builder.add_container(backup_container)
 
+        # Add pod secrets
+        prometheus_secret_name = f"{self.app.name}-secret"
+        pod_spec_builder.add_secret(
+            prometheus_secret_name,
+            {
+                "web-config-file": (
+                    "basic_auth_users:\n"
+                    f"  {config.web_config_username}: {self._hash_password(config.web_config_password)}\n"
+                )
+            },
+        )
+
         # Build Container
         container_builder = ContainerV3Builder(
             self.app.name,
@@ -180,21 +202,27 @@ class PrometheusCharm(CharmedOsmBase):
             run_as_non_root=config.security_context,
         )
         container_builder.add_port(name=self.app.name, port=PORT)
+        token = self._base64_encode(
+            f"{config.web_config_username}:{config.web_config_password}"
+        )
         container_builder.add_http_readiness_probe(
             "/-/ready",
             PORT,
             initial_delay_seconds=10,
             timeout_seconds=30,
+            http_headers=[("Authorization", f"Basic {token}")],
         )
         container_builder.add_http_liveness_probe(
             "/-/healthy",
             PORT,
             initial_delay_seconds=30,
             period_seconds=30,
+            http_headers=[("Authorization", f"Basic {token}")],
         )
         command = [
             "/bin/prometheus",
             "--config.file=/etc/prometheus/prometheus.yml",
+            "--web.config.file=/etc/prometheus/web-config/web.yml",
             "--storage.tsdb.path=/prometheus",
             "--web.console.libraries=/usr/share/prometheus/console_libraries",
             "--web.console.templates=/usr/share/prometheus/consoles",
@@ -205,7 +233,13 @@ class PrometheusCharm(CharmedOsmBase):
             command.append("--web.enable-admin-api")
         container_builder.add_command(command)
         container_builder.add_volume_config(
-            "config", "/etc/prometheus", self._build_files(config)
+            "config", "/etc/prometheus", self._build_config_file(config)
+        )
+        container_builder.add_volume_config(
+            "web-config",
+            "/etc/prometheus/web-config",
+            self._build_webconfig_file(),
+            secret_name=prometheus_secret_name,
         )
         container = container_builder.build()
         # Add container to pod spec
@@ -246,6 +280,13 @@ class PrometheusCharm(CharmedOsmBase):
             pod_spec_builder.add_ingress_resource(ingress_resource)
         return pod_spec_builder.build()
 
+    def _hash_password(self, password):
+        hashed_password = bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt())
+        return hashed_password.decode()
+
+    def _base64_encode(self, phrase: str) -> str:
+        return base64.b64encode(phrase.encode("utf-8")).decode("utf-8")
+
 
 if __name__ == "__main__":
     main(PrometheusCharm)