direktil/local-server
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat: boot.img.lz4

Browse Source
This commit is contained in:
Mikaël Cluseau
2018-11-13 14:44:15 +11:00
parent 7ef45a39f9
commit 12ade36fd1
104 changed files with 4963 additions and 127 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
cmd/dkl-local-server/a_main-packr.go Normal file
View File

@ -0,0 +1,12 @@
// Code generated by github.com/gobuffalo/packr. DO NOT EDIT.
package main
import "github.com/gobuffalo/packr"
// You can use the "packr clean" command to clean up this,
// and any other packr generated files.
func init() {
packr.PackJSONBytes("./assets", "grub.cfg", "\"c2VhcmNoIC0tbm8tZmxvcHB5IC0tc2V0PXJvb3QgLS1wYXJ0LWxhYmVsIGJvb3QKCmluc21vZCBhbGxfdmlkZW8Kc2V0IHRpbWVvdXQ9MwoKc2V0IGJvb3RkZXY9UEFSVE5BTUU9Ym9vdAoKbWVudWVudHJ5ICJEaXJla3RpbCIgewogICAgbGludXggIC9jdXJyZW50L3ZtbGludXogZGlyZWt0aWwuYm9vdD0kYm9vdGRldgogICAgaW5pdHJkIC9jdXJyZW50L2luaXRyZAp9Cg==\"")
packr.PackJSONBytes("./assets", "mbr.bin", "\"62OQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAEAQAAAAAAP/6kJD2woB0BfbCcHQCsoDqeXwAADHAjtiO0LwAIPugZHw8/3QCiMJSvoB96BcBvgV8tEG7qlXNE1pScj2B+1WqdTeD4QF0MjHAiUQEQIhE/4lEAscEEABmix5cfGaJXAhmix5gfGaJXAzHRAYAcLRCzRNyBbsAcOt2tAjNE3MNWoTSD4PYAL6LfemCAGYPtsaIZP9AZolEBA+20cHiAojoiPRAiUQID7bCwOgCZokEZqFgfGYJwHVOZqFcfGYx0mb3NIjRMdJm93QEO0QIfTf+wYjFMMDB6AIIwYjQWojGuwBwjsMx27gBAs0Tch6Mw2AeuQABjtsx9r8AgI7G/POlH2H/Jlp8voZ96wO+lX3oNAC+mn3oLgDNGOv+R1JVQiAAR2VvbQBIYXJkIERpc2sAUmVhZAAgRXJyb3INCgC7AQC0Ds0QrDwAdfTDAAAAAAAAAAAAAAAAAACAQQ==\"")
}

26
cmd/dkl-local-server/addons.go Normal file
View File

@ -0,0 +1,26 @@
package main
// Kubernetes' compatible ConfigMap
type configMap struct {
APIVersion string `yaml:"apiVersion"` // v1
Kind string
Metadata metadata
Data map[string]string
}
type metadata struct {
Namespace string
Name string
}
func newConfigMap(name string) *configMap {
return &configMap{
APIVersion: "v1",
Kind: "ConfigMap",
Metadata: metadata{
Namespace: "kube-system",
Name: name,
},
Data: make(map[string]string),
}
}

11
cmd/dkl-local-server/assets.go Normal file
View File

@ -0,0 +1,11 @@
package main
import "log"
func asset(name string) []byte {
ba, err := assets.Find(name)
if err != nil {
log.Fatalf("asset find error for %q: %v", name, err)
}
return ba
}

144
cmd/dkl-local-server/boot-img.go Normal file
View File

@ -0,0 +1,144 @@
package main
import (
"archive/tar"
"io"
"io/ioutil"
"log"
"os"
"os/exec"
"path/filepath"
"strings"
"syscall"
"github.com/pierrec/lz4"
)
func buildBootImg(out io.Writer, ctx *renderContext) (err error) {
bootImg, err := ioutil.TempFile(os.TempDir(), "boot.img-")
if err != nil {
return
}
defer rmTempFile(bootImg)
// 2MB + 2GB + 2MB + 34 sectors
bootImg.Truncate(2<<30 + 4<<20 + 34*512)
// partition
err = run("sgdisk",
"--new=0:4096:+2G", "--typecode=0:EF00", "-c", "0:boot",
"--new=0:0:+2M", "--typecode=0:EF02", "-c", "0:BIOS-BOOT",
"--hybrid=1:2", "--print", bootImg.Name())
if err != nil {
return
}
err = setupBootImage(bootImg, ctx)
if err != nil {
return
}
// send the result
bootImg.Seek(0, os.SEEK_SET)
lz4Out := lz4.NewWriter(out)
io.Copy(lz4Out, bootImg)
lz4Out.Close()
return
}
func setupBootImage(bootImg *os.File, ctx *renderContext) (err error) {
devb, err := exec.Command("losetup", "--find", "--show", "--partscan", bootImg.Name()).CombinedOutput()
if err != nil {
return
}
dev := strings.TrimSpace(string(devb))
defer run("losetup", "-d", dev)
log.Print("device: ", dev)
err = run("mkfs.vfat", "-n", "DKLBOOT", dev+"p1")
if err != nil {
return
}
tempDir := bootImg.Name() + ".p1.mount"
err = os.Mkdir(tempDir, 0755)
if err != nil {
return
}
defer func() {
log.Print("Removing ", tempDir)
os.RemoveAll(tempDir)
}()
err = syscall.Mount(dev+"p1", tempDir, "vfat", 0, "")
if err != nil {
return
}
defer func() {
log.Print("Unmounting ", tempDir)
syscall.Unmount(tempDir, 0)
}()
// setup grub
err = run("/scripts/grub_install.sh", bootImg.Name(), dev, tempDir)
if err != nil {
return
}
// add system elements
tarOut, tarIn := io.Pipe()
go func() {
err2 := buildBootTar(tarIn, ctx)
tarIn.Close()
if err2 != nil {
err = err2
}
}()
defer tarOut.Close()
tarRd := tar.NewReader(tarOut)
for {
hdr, err := tarRd.Next()
if err == io.EOF {
break
}
if err != nil {
return err
}
log.Print("tar: extracting ", hdr.Name)
outPath := filepath.Join(tempDir, hdr.Name)
os.MkdirAll(filepath.Dir(outPath), 0755)
f, err := os.Create(outPath)
if err != nil {
return err
}
_, err = io.Copy(f, tarRd)
f.Close()
if err != nil {
return err
}
}
return
}
func run(program string, args ...string) (err error) {
cmd := exec.Command(program, args...)
cmd.Stdout = os.Stdout
cmd.Stderr = os.Stderr
return cmd.Run()
}

191
cmd/dkl-local-server/boot-iso.go Normal file
View File

@ -0,0 +1,191 @@
package main
import (
"fmt"
"io"
"io/ioutil"
"log"
"os"
"os/exec"
"path/filepath"
)
func buildBootISO(out io.Writer, ctx *renderContext) error {
tempDir, err := ioutil.TempDir("/tmp", "iso-")
if err != nil {
return err
}
defer os.RemoveAll(tempDir)
cp := func(src, dst string) error {
log.Printf("iso: adding %s as %s", src, dst)
in, err := os.Open(src)
if err != nil {
return err
}
defer in.Close()
outPath := filepath.Join(tempDir, dst)
if err := os.MkdirAll(filepath.Dir(outPath), 0755); err != nil {
return err
}
out, err := os.Create(outPath)
if err != nil {
return err
}
defer out.Close()
_, err = io.Copy(out, in)
return err
}
err = func() error {
// grub
if err := os.MkdirAll(filepath.Join(tempDir, "grub"), 0755); err != nil {
return err
}
err = ioutil.WriteFile(filepath.Join(tempDir, "grub", "grub.cfg"), []byte(`
search --set=root --file /config.yaml
insmod all_video
set timeout=3
menuentry "Direktil" {
linux /vmlinuz direktil.boot=DEVNAME=sr0 direktil.boot.fs=iso9660
initrd /initrd
}
`), 0644)
if err != nil {
return err
}
coreImgPath := filepath.Join(tempDir, "grub", "core.img")
grubCfgPath := filepath.Join(tempDir, "grub", "grub.cfg")
cmd := exec.Command("grub-mkstandalone",
"--format=i386-pc",
"--output="+coreImgPath,
"--install-modules=linux normal iso9660 biosdisk memdisk search tar ls",
"--modules=linux normal iso9660 biosdisk search",
"--locales=",
"--fonts=",
"boot/grub/grub.cfg="+grubCfgPath,
)
cmd.Stdout = os.Stdout
cmd.Stderr = os.Stderr
if err := cmd.Run(); err != nil {
return err
}
defer os.Remove(coreImgPath)
defer os.Remove(grubCfgPath)
out, err := os.Create(filepath.Join(tempDir, "grub", "bios.img"))
if err != nil {
return err
}
defer out.Close()
b, err := ioutil.ReadFile("/usr/lib/grub/i386-pc/cdboot.img")
if err != nil {
return err
}
if _, err := out.Write(b); err != nil {
return err
}
b, err = ioutil.ReadFile(coreImgPath)
if err != nil {
return err
}
if _, err := out.Write(b); err != nil {
return err
}
return nil
}()
if err != nil {
return err
}
// config
cfgBytes, cfg, err := ctx.Config()
if err != nil {
return err
}
ioutil.WriteFile(filepath.Join(tempDir, "config.yaml"), cfgBytes, 0600)
// kernel and initrd
type distCopy struct {
Src []string
Dst string
}
copies := []distCopy{
{Src: []string{"kernels", ctx.Group.Kernel}, Dst: "vmlinuz"},
{Src: []string{"initrd", ctx.Group.Initrd}, Dst: "initrd"},
}
// layers
for _, layer := range cfg.Layers {
layerVersion := ctx.Group.Versions[layer]
if layerVersion == "" {
return fmt.Errorf("layer %q not mapped to a version", layer)
}
copies = append(copies,
distCopy{
Src: []string{"layers", layer, layerVersion},
Dst: filepath.Join("current", "layers", layer+".fs"),
})
}
for _, copy := range copies {
outPath, err := ctx.distFetch(copy.Src...)
if err != nil {
return err
}
err = cp(outPath, copy.Dst)
if err != nil {
return err
}
}
// build the ISO
mkisofs, err := exec.LookPath("genisoimage")
if err != nil {
mkisofs, err = exec.LookPath("mkisofs")
}
if err != nil {
return err
}
cmd := exec.Command(mkisofs,
"-quiet",
"-joliet",
"-joliet-long",
"-rock",
"-translation-table",
"-no-emul-boot",
"-boot-load-size", "4",
"-boot-info-table",
"-eltorito-boot", "grub/bios.img",
"-eltorito-catalog", "grub/boot.cat",
tempDir,
)
cmd.Stdout = out
cmd.Stderr = os.Stderr
return cmd.Run()
}

111
cmd/dkl-local-server/boot-tar.go Normal file
View File

@ -0,0 +1,111 @@
package main
import (
"archive/tar"
"fmt"
"io"
"io/ioutil"
"log"
"os"
"path/filepath"
)
func rmTempFile(f *os.File) {
f.Close()
if err := os.Remove(f.Name()); err != nil {
log.Print("failed to remove ", f.Name(), ": ", err)
}
}
func buildBootTar(out io.Writer, ctx *renderContext) (err error) {
grubCfg, err := ioutil.TempFile(os.TempDir(), "grub.cfg-")
if err != nil {
return
}
defer rmTempFile(grubCfg)
_, err = grubCfg.Write(asset("grub.cfg"))
if err != nil {
return
}
grubCfg.Close()
arch := tar.NewWriter(out)
defer arch.Close()
archAdd := func(path string, ba []byte) (err error) {
err = arch.WriteHeader(&tar.Header{Name: path, Size: int64(len(ba))})
if err != nil {
return
}
_, err = arch.Write(ba)
return
}
// config
cfgBytes, cfg, err := ctx.Config()
if err != nil {
return err
}
archAdd("config.yaml", cfgBytes)
// add "current" elements
type distCopy struct {
Src []string
Dst string
}
// kernel and initrd
copies := []distCopy{
{Src: []string{"kernels", ctx.Group.Kernel}, Dst: "current/vmlinuz"},
{Src: []string{"initrd", ctx.Group.Initrd}, Dst: "current/initrd"},
}
// layers
for _, layer := range cfg.Layers {
layerVersion := ctx.Group.Versions[layer]
if layerVersion == "" {
return fmt.Errorf("layer %q not mapped to a version", layer)
}
copies = append(copies,
distCopy{
Src: []string{"layers", layer, layerVersion},
Dst: filepath.Join("current", "layers", layer+".fs"),
})
}
for _, copy := range copies {
outPath, err := ctx.distFetch(copy.Src...)
if err != nil {
return err
}
f, err := os.Open(outPath)
if err != nil {
return err
}
defer f.Close()
stat, err := f.Stat()
if err != nil {
return err
}
if err = arch.WriteHeader(&tar.Header{
Name: copy.Dst,
Size: stat.Size(),
}); err != nil {
return err
}
_, err = io.Copy(arch, f)
if err != nil {
return err
}
}
return nil
}

69
cmd/dkl-local-server/cas-cleaner.go Normal file
View File

@ -0,0 +1,69 @@
package main
import (
"flag"
"log"
"sort"
"time"
)
var (
cacheCleanDelay = flag.Duration("cache-clean-delay", 10*time.Minute, "Time between cache cleanups")
)
func casCleaner() {
for {
err := cleanCAS()
if err != nil {
log.Print("warn: couldn't clean cache: ", err)
}
time.Sleep(*cacheCleanDelay)
}
}
func cleanCAS() error {
cfg, err := readConfig()
if err != nil {
return err
}
activeTags := make([]string, len(cfg.Hosts))
for i, host := range cfg.Hosts {
ctx, err := newRenderContext(host, cfg)
if err != nil {
return err
}
tag, err := ctx.Tag()
if err != nil {
return err
}
activeTags[i] = tag
}
tags, err := casStore.Tags()
if err != nil {
return err
}
sort.Strings(activeTags)
for _, tag := range tags {
idx := sort.SearchStrings(activeTags, tag)
if idx < len(activeTags) && activeTags[idx] == tag {
continue
}
// tag is not present in active tags
log.Print("cache cleaner: removing tag ", tag)
if err := casStore.Remove(tag); err != nil {
log.Printf("cache cleaner: failed to remove tag %s: %v", tag, err)
}
}
return nil
}

34
cmd/dkl-local-server/data.go Normal file
View File

@ -0,0 +1,34 @@
package main
import (
"flag"
"log"
"path/filepath"
"novit.nc/direktil/pkg/clustersconfig"
)
var (
dataDir = flag.String("data", "/var/lib/direktil", "Data dir")
configFromDir = flag.String("config-from-dir", "", "Build configuration from this directory")
)
func readConfig() (config *clustersconfig.Config, err error) {
configFile := filepath.Join(*dataDir, "current-config.yaml")
if *configFromDir != "" {
config, err = clustersconfig.FromDir(*configFromDir)
if err != nil {
log.Print("failed to load config: ", err)
return nil, err
}
if err = config.SaveTo(configFile); err != nil {
return nil, err
}
return
}
return clustersconfig.FromFile(configFile)
}

29
cmd/dkl-local-server/errors.go Normal file
View File

@ -0,0 +1,29 @@
package main
import (
"fmt"
"os"
)
type notFoundError struct {
ref string
}
func (e notFoundError) Error() string {
return fmt.Sprintf("not found: %s", e.ref)
}
var _ error = notFoundError{}
func isNotFound(err error) bool {
if err == nil {
return false
}
if os.IsNotExist(err) {
return true
}
_, ok := err.(notFoundError)
return ok
}

19
cmd/dkl-local-server/hash.go Normal file
View File

@ -0,0 +1,19 @@
package main
import (
"crypto/sha1"
"encoding/base64"
"encoding/json"
)
func hash(values ...interface{}) string {
ba, err := json.Marshal(values)
if err != nil {
panic(err) // should not happen
}
h := sha1.Sum(ba)
enc := base64.StdEncoding.WithPadding(base64.NoPadding)
return enc.EncodeToString(h[:])
}

295
cmd/dkl-local-server/http.go Normal file
View File

@ -0,0 +1,295 @@
package main
import (
"bytes"
"encoding/json"
"flag"
"log"
"net"
"net/http"
"path"
"regexp"
"strings"
yaml "gopkg.in/yaml.v2"
"novit.nc/direktil/pkg/clustersconfig"
)
var (
hostsToken = flag.String("hosts-token", "", "Token to give to access /hosts (open is none)")
reHost = regexp.MustCompile("^/hosts/([^/]+)/([^/]+)$")
trustXFF = flag.Bool("trust-xff", true, "Trust the X-Forwarded-For header")
)
func authorizeHosts(r *http.Request) bool {
if *hostsToken == "" {
// access is open
return true
}
reqToken := r.Header.Get("Authorization")
return reqToken == "Bearer "+*hostsToken
}
func forbidden(w http.ResponseWriter, r *http.Request) {
log.Printf("denied access to %s from %s", r.RequestURI, r.RemoteAddr)
http.Error(w, "Forbidden", http.StatusForbidden)
}
func serveHostByIP(w http.ResponseWriter, r *http.Request) {
host, cfg := hostByIP(w, r)
if host == nil {
return
}
what := path.Base(r.URL.Path)
renderHost(w, r, what, host, cfg)
}
func hostByIP(w http.ResponseWriter, r *http.Request) (*clustersconfig.Host, *clustersconfig.Config) {
remoteAddr := r.RemoteAddr
if *trustXFF {
if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
remoteAddr = strings.Split(xff, ",")[0]
}
}
hostIP, _, err := net.SplitHostPort(remoteAddr)
if err != nil {
hostIP = remoteAddr
}
cfg, err := readConfig()
if err != nil {
http.Error(w, "", http.StatusServiceUnavailable)
return nil, nil
}
host := cfg.HostByIP(hostIP)
if host == nil {
log.Print("no host found for IP ", hostIP)
http.NotFound(w, r)
return nil, nil
}
return host, cfg
}
func serveHosts(w http.ResponseWriter, r *http.Request) {
if !authorizeHosts(r) {
forbidden(w, r)
return
}
cfg, err := readConfig()
if err != nil {
http.Error(w, "", http.StatusServiceUnavailable)
return
}
renderJSON(w, cfg.Hosts)
}
func serveHost(w http.ResponseWriter, r *http.Request) {
if !authorizeHosts(r) {
forbidden(w, r)
return
}
match := reHost.FindStringSubmatch(r.URL.Path)
if match == nil {
http.NotFound(w, r)
return
}
hostName, what := match[1], match[2]
cfg, err := readConfig()
if err != nil {
http.Error(w, "", http.StatusServiceUnavailable)
return
}
host := cfg.Host(hostName)
if host == nil {
host = cfg.HostByMAC(hostName)
}
if host == nil {
log.Printf("no host with name or MAC %q", hostName)
http.NotFound(w, r)
return
}
renderHost(w, r, what, host, cfg)
}
func renderHost(w http.ResponseWriter, r *http.Request, what string, host *clustersconfig.Host, cfg *clustersconfig.Config) {
ctx, err := newRenderContext(host, cfg)
if err != nil {
log.Printf("host %s: %s: failed to render: %v", what, host.Name, err)
http.Error(w, "", http.StatusServiceUnavailable)
return
}
switch what {
case "ipxe":
w.Header().Set("Content-Type", "text/x-ipxe")
case "config":
w.Header().Set("Content-Type", "text/vnd.yaml")
default:
w.Header().Set("Content-Type", "application/octet-stream")
}
switch what {
case "ipxe":
err = renderIPXE(w, ctx)
case "kernel":
err = renderKernel(w, r, ctx)
case "initrd":
err = renderCtx(w, r, ctx, "initrd", buildInitrd)
case "boot.iso":
err = renderCtx(w, r, ctx, "boot.iso", buildBootISO)
case "boot.tar":
err = renderCtx(w, r, ctx, "boot.tar", buildBootTar)
case "boot.img.lz4":
err = renderCtx(w, r, ctx, what, buildBootImg)
case "config":
err = renderConfig(w, r, ctx)
case "static-pods":
if ctx.Group.StaticPods == "" {
w.WriteHeader(http.StatusNoContent)
return
}
err = renderStaticPods(w, r, ctx)
default:
http.NotFound(w, r)
}
if err != nil {
if isNotFound(err) {
log.Printf("host %s: %s: %v", what, host.Name, err)
http.NotFound(w, r)
} else {
log.Printf("host %s: %s: failed to render: %v", what, host.Name, err)
http.Error(w, "", http.StatusServiceUnavailable)
}
}
}
func renderJSON(w http.ResponseWriter, v interface{}) {
w.Header().Add("Content-Type", "application/json")
json.NewEncoder(w).Encode(v)
}
func serveClusters(w http.ResponseWriter, r *http.Request) {
cfg, err := readConfig()
if err != nil {
http.Error(w, "", http.StatusServiceUnavailable)
return
}
clusterNames := make([]string, len(cfg.Clusters))
for i, cluster := range cfg.Clusters {
clusterNames[i] = cluster.Name
}
renderJSON(w, clusterNames)
}
func serveCluster(w http.ResponseWriter, r *http.Request) {
// "/clusters/<name>/<what>" split => "", "clusters", "<name>", "<what>"
p := strings.Split(r.URL.Path, "/")
if len(p) != 4 {
http.NotFound(w, r)
return
}
clusterName := p[2]
p = strings.SplitN(p[3], ".", 2)
what := p[0]
format := ""
if len(p) > 1 {
format = p[1]
}
cfg, err := readConfig()
if err != nil {
http.Error(w, "", http.StatusServiceUnavailable)
return
}
cluster := cfg.Cluster(clusterName)
if cluster == nil {
http.NotFound(w, r)
return
}
switch what {
case "addons":
if cluster.Addons == "" {
log.Printf("cluster %q has no addons defined", clusterName)
http.NotFound(w, r)
return
}
addons := cfg.Addons[cluster.Addons]
if addons == nil {
log.Printf("cluster %q: no addons with name %q", clusterName, cluster.Addons)
http.NotFound(w, r)
return
}
clusterAsMap := asMap(cluster)
clusterAsMap["kubernetes_svc_ip"] = cluster.KubernetesSvcIP().String()
clusterAsMap["dns_svc_ip"] = cluster.DNSSvcIP().String()
cm := newConfigMap("cluster-addons")
for _, addon := range addons {
buf := &bytes.Buffer{}
err := addon.Execute(buf, clusterAsMap, nil)
if err != nil {
log.Printf("cluster %q: addons %q: failed to render %q: %v",
clusterName, cluster.Addons, addon.Name, err)
http.Error(w, "", http.StatusServiceUnavailable)
return
}
cm.Data[addon.Name] = buf.String()
}
switch format {
case "yaml":
for name, data := range cm.Data {
w.Write([]byte("\n# addon: " + name + "\n---\n\n"))
w.Write([]byte(data))
}
default:
yaml.NewEncoder(w).Encode(cm)
}
default:
http.NotFound(w, r)
}
}

152
cmd/dkl-local-server/initrd.go Normal file
View File

@ -0,0 +1,152 @@
package main
import (
"bytes"
"fmt"
"io"
"log"
"net/http"
"os"
"time"
cpio "github.com/cavaliercoder/go-cpio"
yaml "gopkg.in/yaml.v2"
)
func renderConfig(w http.ResponseWriter, r *http.Request, ctx *renderContext) error {
log.Printf("sending config for %q", ctx.Host.Name)
_, cfg, err := ctx.Config()
if err != nil {
return err
}
ba, err := yaml.Marshal(cfg)
if err != nil {
return err
}
w.Header().Set("Content-Type", "application/yaml")
http.ServeContent(w, r, "config.yaml", time.Unix(0, 0), bytes.NewReader(ba))
return nil
}
func renderStaticPods(w http.ResponseWriter, r *http.Request, ctx *renderContext) error {
log.Printf("sending static-pods for %q", ctx.Host.Name)
ba, err := ctx.StaticPods()
if err != nil {
return err
}
w.Header().Set("Content-Type", "application/yaml") // XXX can also be JSON
http.ServeContent(w, r, "static-pods", time.Unix(0, 0), bytes.NewReader(ba))
return nil
}
func renderCtx(w http.ResponseWriter, r *http.Request, ctx *renderContext, what string,
create func(out io.Writer, ctx *renderContext) error) error {
log.Printf("sending %s for %q", what, ctx.Host.Name)
tag, err := ctx.Tag()
if err != nil {
return err
}
// get it or create it
content, meta, err := casStore.GetOrCreate(tag, what, func(out io.Writer) error {
log.Printf("building %s for %q", what, ctx.Host.Name)
return create(out, ctx)
})
if err != nil {
return err
}
// serve it
http.ServeContent(w, r, what, meta.ModTime(), content)
return nil
}
func buildInitrd(out io.Writer, ctx *renderContext) error {
_, cfg, err := ctx.Config()
if err != nil {
return err
}
// send initrd basis
initrdPath, err := ctx.distFetch("initrd", ctx.Group.Initrd)
if err != nil {
return err
}
err = writeFile(out, initrdPath)
if err != nil {
return err
}
// and our extra archive
archive := cpio.NewWriter(out)
// - required dirs
for _, dir := range []string{
"boot",
"boot/current",
"boot/current/layers",
} {
archive.WriteHeader(&cpio.Header{
Name: dir,
Mode: 0600 | cpio.ModeDir,
})
}
// - the layers
for _, layer := range cfg.Layers {
layerVersion := ctx.Group.Versions[layer]
if layerVersion == "" {
return fmt.Errorf("layer %q not mapped to a version", layer)
}
path, err := ctx.distFetch("layers", layer, layerVersion)
if err != nil {
return err
}
stat, err := os.Stat(path)
if err != nil {
return err
}
archive.WriteHeader(&cpio.Header{
Name: "boot/current/layers/" + layer + ".fs",
Mode: 0600,
Size: stat.Size(),
})
if err = writeFile(archive, path); err != nil {
return err
}
}
// - the configuration
ba, err := yaml.Marshal(cfg)
if err != nil {
return err
}
archive.WriteHeader(&cpio.Header{
Name: "boot/config.yaml",
Mode: 0600,
Size: int64(len(ba)),
})
archive.Write(ba)
// finalize the archive
archive.Flush()
archive.Close()
return nil
}

25
cmd/dkl-local-server/ipxe.go Normal file
View File

@ -0,0 +1,25 @@
package main
import (
"bytes"
"io"
"log"
"text/template"
)
func renderIPXE(out io.Writer, ctx *renderContext) error {
log.Printf("sending IPXE code for %q", ctx.Host.Name)
tmpl, err := template.New("ipxe").Parse(ctx.Group.IPXE)
if err != nil {
return err
}
buf := bytes.NewBuffer(make([]byte, 0, 4096))
if err := tmpl.Execute(buf, ctx.asMap()); err != nil {
return err
}
_, err = buf.WriteTo(out)
return err
}

17
cmd/dkl-local-server/kernel.go Normal file
View File

@ -0,0 +1,17 @@
package main
import (
"log"
"net/http"
)
func renderKernel(w http.ResponseWriter, r *http.Request, ctx *renderContext) error {
path, err := ctx.distFetch("kernels", ctx.Group.Kernel)
if err != nil {
return err
}
log.Printf("sending kernel %s for %q", ctx.Group.Kernel, ctx.Host.Name)
http.ServeFile(w, r, path)
return nil
}

61
cmd/dkl-local-server/main.go Normal file
View File

@ -0,0 +1,61 @@
package main
import (
"flag"
"log"
"net/http"
"path/filepath"
"github.com/gobuffalo/packr"
"novit.nc/direktil/pkg/cas"
)
const (
etcDir = "/etc/direktil"
)
var (
address = flag.String("address", ":7606", "HTTP listen address")
tlsAddress = flag.String("tls-address", "", "HTTPS listen address")
certFile = flag.String("tls-cert", etcDir+"/server.crt", "Server TLS certificate")
keyFile = flag.String("tls-key", etcDir+"/server.key", "Server TLS key")
casStore cas.Store
assets packr.Box
)
func main() {
flag.Parse()
assets = packr.NewBox("./assets")
if *address == "" && *tlsAddress == "" {
log.Fatal("no listen address given")
}
casStore = cas.NewDir(filepath.Join(*dataDir, "cache"))
go casCleaner()
// by default, serve a host resource by its IP
http.HandleFunc("/", serveHostByIP)
http.HandleFunc("/hosts", serveHosts)
http.HandleFunc("/hosts/", serveHost)
http.HandleFunc("/clusters", serveClusters)
http.HandleFunc("/clusters/", serveCluster)
if *address != "" {
log.Print("HTTP listening on ", *address)
go log.Fatal(http.ListenAndServe(*address, nil))
}
if *tlsAddress != "" {
log.Print("HTTPS listening on ", *tlsAddress)
go log.Fatal(http.ListenAndServeTLS(*tlsAddress, *certFile, *keyFile, nil))
}
select {}
}

402
cmd/dkl-local-server/render-context.go Normal file
View File

@ -0,0 +1,402 @@
package main
import (
"bytes"
"crypto/sha256"
"encoding/hex"
"encoding/json"
"errors"
"fmt"
"log"
"path"
"path/filepath"
cfsslconfig "github.com/cloudflare/cfssl/config"
"github.com/cloudflare/cfssl/csr"
yaml "gopkg.in/yaml.v2"
"novit.nc/direktil/pkg/clustersconfig"
"novit.nc/direktil/pkg/config"
)
type renderContext struct {
Host *clustersconfig.Host
Group *clustersconfig.Group
Cluster *clustersconfig.Cluster
Vars map[string]interface{}
ConfigTemplate *clustersconfig.Template
StaticPodsTemplate *clustersconfig.Template
clusterConfig *clustersconfig.Config
}
func newRenderContext(host *clustersconfig.Host, cfg *clustersconfig.Config) (ctx *renderContext, err error) {
cluster := cfg.Cluster(host.Cluster)
if cluster == nil {
err = fmt.Errorf("no cluster named %q", host.Cluster)
return
}
group := cfg.Group(host.Group)
if group == nil {
err = fmt.Errorf("no group named %q", host.Group)
return
}
vars := make(map[string]interface{})
for _, oVars := range []map[string]interface{}{
cluster.Vars,
group.Vars,
host.Vars,
} {
for k, v := range oVars {
vars[k] = v
}
}
return &renderContext{
Host: host,
Group: group,
Cluster: cluster,
Vars: vars,
ConfigTemplate: cfg.ConfigTemplate(group.Config),
StaticPodsTemplate: cfg.StaticPodsTemplate(group.StaticPods),
clusterConfig: cfg,
}, nil
}
func (ctx *renderContext) Config() (ba []byte, cfg *config.Config, err error) {
if ctx.ConfigTemplate == nil {
err = notFoundError{fmt.Sprintf("config %q", ctx.Group.Config)}
return
}
ctxMap := ctx.asMap()
secretData, err := ctx.secretData()
if err != nil {
return
}
templateFuncs := ctx.templateFuncs(secretData, ctxMap)
render := func(what string, t *clustersconfig.Template) (s string, err error) {
buf := &bytes.Buffer{}
err = t.Execute(buf, ctxMap, templateFuncs)
if err != nil {
log.Printf("host %s: failed to render %s [%q]: %v", ctx.Host.Name, what, t.Name, err)
return
}
s = buf.String()
return
}
extraFuncs := ctx.templateFuncs(secretData, ctxMap)
extraFuncs["static_pods"] = func(name string) (string, error) {
t := ctx.clusterConfig.StaticPodsTemplate(name)
if t == nil {
return "", fmt.Errorf("no static pods template named %q", name)
}
return render("static pods", t)
}
buf := bytes.NewBuffer(make([]byte, 0, 4096))
if err = ctx.ConfigTemplate.Execute(buf, ctxMap, extraFuncs); err != nil {
return
}
if secretData.Changed() {
err = secretData.Save()
if err != nil {
return
}
}
ba = buf.Bytes()
cfg = &config.Config{}
if err = yaml.Unmarshal(buf.Bytes(), cfg); err != nil {
return
}
return
}
func (ctx *renderContext) secretData() (data *SecretData, err error) {
var sslCfg *cfsslconfig.Config
if ctx.clusterConfig.SSLConfig == "" {
sslCfg = &cfsslconfig.Config{}
} else {
sslCfg, err = cfsslconfig.LoadConfig([]byte(ctx.clusterConfig.SSLConfig))
if err != nil {
return
}
}
data, err = loadSecretData(sslCfg)
return
}
func (ctx *renderContext) StaticPods() (ba []byte, err error) {
secretData, err := ctx.secretData()
if err != nil {
return
}
if ctx.StaticPodsTemplate == nil {
err = notFoundError{fmt.Sprintf("static-pods %q", ctx.Group.StaticPods)}
return
}
ctxMap := ctx.asMap()
buf := bytes.NewBuffer(make([]byte, 0, 4096))
if err = ctx.StaticPodsTemplate.Execute(buf, ctxMap, ctx.templateFuncs(secretData, ctxMap)); err != nil {
return
}
if secretData.Changed() {
err = secretData.Save()
if err != nil {
return
}
}
ba = buf.Bytes()
return
}
func (ctx *renderContext) templateFuncs(secretData *SecretData, ctxMap map[string]interface{}) map[string]interface{} {
cluster := ctx.Cluster.Name
getKeyCert := func(name string) (kc *KeyCert, err error) {
req := ctx.clusterConfig.CSR(name)
if req == nil {
err = errors.New("no such certificate request")
return
}
if req.CA == "" {
err = errors.New("CA not defined")
return
}
buf := &bytes.Buffer{}
err = req.Execute(buf, ctxMap, nil)
if err != nil {
return
}
certReq := &csr.CertificateRequest{
KeyRequest: csr.NewBasicKeyRequest(),
}
err = json.Unmarshal(buf.Bytes(), certReq)
if err != nil {
log.Print("unmarshal failed on: ", buf)
return
}
if req.PerHost {
name = name + "/" + ctx.Host.Name
}
return secretData.KeyCert(cluster, req.CA, name, req.Profile, req.Label, certReq)
}
asYaml := func(v interface{}) (string, error) {
ba, err := yaml.Marshal(v)
if err != nil {
return "", err
}
return string(ba), nil
}
return map[string]interface{}{
"token": func(name string) (s string, err error) {
return secretData.Token(cluster, name)
},
"ca_key": func(name string) (s string, err error) {
ca, err := secretData.CA(cluster, name)
if err != nil {
return
}
s = string(ca.Key)
return
},
"ca_crt": func(name string) (s string, err error) {
ca, err := secretData.CA(cluster, name)
if err != nil {
return
}
s = string(ca.Cert)
return
},
"ca_dir": func(name string) (s string, err error) {
ca, err := secretData.CA(cluster, name)
if err != nil {
return
}
dir := "/" + path.Join("etc", "tls-ca", name)
return asYaml([]config.FileDef{
{
Path: path.Join(dir, "ca.crt"),
Mode: 0644,
Content: string(ca.Cert),
},
{
Path: path.Join(dir, "ca.key"),
Mode: 0600,
Content: string(ca.Key),
},
})
},
"tls_key": func(name string) (s string, err error) {
kc, err := getKeyCert(name)
if err != nil {
return
}
s = string(kc.Key)
return
},
"tls_crt": func(name string) (s string, err error) {
kc, err := getKeyCert(name)
if err != nil {
return
}
s = string(kc.Cert)
return
},
"tls_dir": func(name string) (s string, err error) {
csr := ctx.clusterConfig.CSR(name)
if csr == nil {
err = fmt.Errorf("no CSR named %q", name)
return
}
ca, err := secretData.CA(cluster, csr.CA)
if err != nil {
return
}
kc, err := getKeyCert(name)
if err != nil {
return
}
dir := "/" + path.Join("etc", "tls", name)
return asYaml([]config.FileDef{
{
Path: path.Join(dir, "ca.crt"),
Mode: 0644,
Content: string(ca.Cert),
},
{
Path: path.Join(dir, "tls.crt"),
Mode: 0644,
Content: string(kc.Cert),
},
{
Path: path.Join(dir, "tls.key"),
Mode: 0600,
Content: string(kc.Key),
},
})
},
"hosts_of_group": func() (hosts []interface{}) {
hosts = make([]interface{}, 0)
for _, host := range ctx.clusterConfig.Hosts {
if host.Group != ctx.Host.Group {
continue
}
hosts = append(hosts, asMap(host))
}
return hosts
},
"hosts_of_group_count": func() (count int) {
for _, host := range ctx.clusterConfig.Hosts {
if host.Group != ctx.Host.Group {
continue
}
count++
}
return
},
}
}
func (ctx *renderContext) distFilePath(path ...string) string {
return filepath.Join(append([]string{*dataDir, "dist"}, path...)...)
}
func (ctx *renderContext) Tag() (string, error) {
h := sha256.New()
_, cfg, err := ctx.Config()
if err != nil {
return "", err
}
enc := yaml.NewEncoder(h)
for _, o := range []interface{}{cfg, ctx} {
if err := enc.Encode(o); err != nil {
return "", err
}
}
return hex.EncodeToString(h.Sum(nil)), nil
}
func (ctx *renderContext) asMap() map[string]interface{} {
result := asMap(ctx)
// also expand cluster:
cluster := result["cluster"].(map[interface{}]interface{})
cluster["kubernetes_svc_ip"] = ctx.Cluster.KubernetesSvcIP().String()
cluster["dns_svc_ip"] = ctx.Cluster.DNSSvcIP().String()
return result
}
func asMap(v interface{}) map[string]interface{} {
ba, err := yaml.Marshal(v)
if err != nil {
panic(err) // shouldn't happen
}
result := make(map[string]interface{})
if err := yaml.Unmarshal(ba, result); err != nil {
panic(err) // shouldn't happen
}
return result
}

243
cmd/dkl-local-server/secrets.go Normal file
View File

@ -0,0 +1,243 @@
package main
import (
"crypto/rand"
"encoding/base32"
"encoding/json"
"errors"
"fmt"
"io/ioutil"
"net"
"os"
"path/filepath"
"github.com/cloudflare/cfssl/config"
"github.com/cloudflare/cfssl/csr"
"github.com/cloudflare/cfssl/helpers"
"github.com/cloudflare/cfssl/initca"
"github.com/cloudflare/cfssl/signer"
"github.com/cloudflare/cfssl/signer/local"
"k8s.io/apimachinery/pkg/util/validation"
"k8s.io/apimachinery/pkg/util/validation/field"
)
type SecretData struct {
clusters map[string]*ClusterSecrets
changed bool
config *config.Config
}
type ClusterSecrets struct {
CAs map[string]*CA
Tokens map[string]string
}
type CA struct {
Key []byte
Cert []byte
Signed map[string]*KeyCert
}
type KeyCert struct {
Key []byte
Cert []byte
ReqHash string
}
func loadSecretData(config *config.Config) (*SecretData, error) {
sd := &SecretData{
clusters: make(map[string]*ClusterSecrets),
changed: false,
config: config,
}
ba, err := ioutil.ReadFile(filepath.Join(*dataDir, "secret-data.json"))
if err != nil {
if os.IsNotExist(err) {
sd.changed = true
return sd, nil
}
return nil, err
}
if err := json.Unmarshal(ba, &sd.clusters); err != nil {
return nil, err
}
return sd, nil
}
func (sd *SecretData) Changed() bool {
return sd.changed
}
func (sd *SecretData) Save() error {
ba, err := json.Marshal(sd.clusters)
if err != nil {
return err
}
return ioutil.WriteFile(filepath.Join(*dataDir, "secret-data.json"), ba, 0600)
}
func (sd *SecretData) cluster(name string) (cs *ClusterSecrets) {
cs, ok := sd.clusters[name]
if ok {
return
}
cs = &ClusterSecrets{
CAs: make(map[string]*CA),
Tokens: make(map[string]string),
}
sd.clusters[name] = cs
sd.changed = true
return
}
func (sd *SecretData) Token(cluster, name string) (token string, err error) {
cs := sd.cluster(cluster)
token = cs.Tokens[name]
if token != "" {
return
}
b := make([]byte, 16)
_, err = rand.Read(b)
if err != nil {
return
}
token = base32.StdEncoding.WithPadding(base32.NoPadding).EncodeToString(b)
cs.Tokens[name] = token
sd.changed = true
return
}
func (sd *SecretData) CA(cluster, name string) (ca *CA, err error) {
cs := sd.cluster(cluster)
ca, ok := cs.CAs[name]
if ok {
return
}
req := &csr.CertificateRequest{
CN: "Direktil Local Server",
KeyRequest: &csr.BasicKeyRequest{
A: "ecdsa",
S: 521, // 256, 384, 521
},
Names: []csr.Name{
{
C: "NC",
O: "novit.nc",
},
},
}
cert, _, key, err := initca.New(req)
if err != nil {
return
}
ca = &CA{
Key: key,
Cert: cert,
Signed: make(map[string]*KeyCert),
}
cs.CAs[name] = ca
sd.changed = true
return
}
func (sd *SecretData) KeyCert(cluster, caName, name, profile, label string, req *csr.CertificateRequest) (kc *KeyCert, err error) {
for idx, host := range req.Hosts {
if ip := net.ParseIP(host); ip != nil {
// valid IP (v4 or v6)
continue
}
if host == "*" {
continue
}
if errs := validation.IsDNS1123Subdomain(host); len(errs) == 0 {
continue
}
if errs := validation.IsWildcardDNS1123Subdomain(host); len(errs) == 0 {
continue
}
path := field.NewPath(cluster, name, "hosts").Index(idx)
return nil, fmt.Errorf("%v: %q is not an IP or FQDN", path, host)
}
if req.CA != nil {
err = errors.New("no CA section allowed here")
return
}
ca, err := sd.CA(cluster, caName)
if err != nil {
return
}
rh := hash(req)
kc, ok := ca.Signed[name]
if ok && rh == kc.ReqHash {
return
}
sgr, err := ca.Signer(sd.config.Signing)
if err != nil {
return
}
generator := &csr.Generator{Validator: func(_ *csr.CertificateRequest) error { return nil }}
csr, key, err := generator.ProcessRequest(req)
if err != nil {
return
}
signReq := signer.SignRequest{
Request: string(csr),
Profile: profile,
Label: label,
}
cert, err := sgr.Sign(signReq)
if err != nil {
return
}
kc = &KeyCert{
Key: key,
Cert: cert,
ReqHash: rh,
}
ca.Signed[name] = kc
sd.changed = true
return
}
func (ca *CA) Signer(policy *config.Signing) (result *local.Signer, err error) {
caCert, err := helpers.ParseCertificatePEM(ca.Cert)
if err != nil {
return
}
caKey, err := helpers.ParsePrivateKeyPEM(ca.Key)
if err != nil {
return
}
return local.NewSigner(caKey, caCert, signer.DefaultSigAlgo(caKey), policy)
}

80
cmd/dkl-local-server/upstream.go Normal file
View File

@ -0,0 +1,80 @@
package main
import (
"flag"
"io"
"log"
"net/http"
"os"
gopath "path"
"path/filepath"
"time"
)
var (
upstreamURL = flag.String("upstream", "https://direktil.novit.nc/dist", "Upstream server for dist elements")
)
func (ctx *renderContext) distFetch(path ...string) (outPath string, err error) {
outPath = ctx.distFilePath(path...)
if _, err = os.Stat(outPath); err == nil {
return
} else if !os.IsNotExist(err) {
return
}
subPath := gopath.Join(path...)
log.Print("need to fetch ", subPath)
if err = os.MkdirAll(filepath.Dir(outPath), 0755); err != nil {
return
}
fullURL := *upstreamURL + "/" + subPath
resp, err := http.Get(fullURL)
if err != nil {
return
}
tempOutPath := filepath.Join(filepath.Dir(outPath), "._part_"+filepath.Base(outPath))
done := make(chan error, 1)
go func() {
defer resp.Body.Close()
defer close(done)
out, err := os.Create(tempOutPath)
if err != nil {
done <- err
return
}
defer out.Close()
_, err = io.Copy(out, resp.Body)
done <- err
}()
wait:
select {
case <-time.After(10 * time.Second):
log.Print("still fetching ", subPath, "...")
goto wait
case err = <-done:
if err != nil {
log.Print("fetch of ", subPath, " failed: ", err)
os.Remove(tempOutPath)
return
}
log.Print("fetch of ", subPath, " finished")
}
err = os.Rename(tempOutPath, outPath)
return
}

18
cmd/dkl-local-server/utils.go Normal file
View File

@ -0,0 +1,18 @@
package main
import (
"io"
"os"
)
func writeFile(out io.Writer, path string) error {
f, err := os.Open(path)
if err != nil {
return err
}
defer f.Close()
_, err = io.Copy(out, f)
return err
}