direktil/local-server
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat(dir2config)

Browse Source
This commit is contained in:
Mikaël Cluseau
2018-12-11 00:44:05 +11:00
parent 26b6efd54c
commit 7435995592
106 changed files with 5352 additions and 4052 deletions
Download Patch File Download Diff File Expand all files Collapse all files

293
cmd/dkl-dir2config/http.go
View File

@ -1,293 +0,0 @@
package main
import (
"bytes"
"encoding/json"
"flag"
"log"
"net"
"net/http"
"regexp"
"strings"
yaml "gopkg.in/yaml.v2"
"novit.nc/direktil/pkg/localconfig"
)
var (
hostsToken = flag.String("hosts-token", "", "Token to give to access /hosts (open is none)")
reHost = regexp.MustCompile("^/hosts/([^/]+)/([^/]+)$")
trustXFF = flag.Bool("trust-xff", true, "Trust the X-Forwarded-For header")
)
func authorizeHosts(r *http.Request) bool {
if *hostsToken == "" {
// access is open
return true
}
reqToken := r.Header.Get("Authorization")
return reqToken == "Bearer "+*hostsToken
}
func forbidden(w http.ResponseWriter, r *http.Request) {
log.Printf("denied access to %s from %s", r.RequestURI, r.RemoteAddr)
http.Error(w, "Forbidden", http.StatusForbidden)
}
func serveHostByIP(w http.ResponseWriter, r *http.Request) {
host, cfg := hostByIP(w, r)
if host == nil {
return
}
what := strings.TrimLeft(r.URL.Path, "/")
renderHost(w, r, what, host, cfg)
}
func hostByIP(w http.ResponseWriter, r *http.Request) (*localconfig.Host, *localconfig.Config) {
remoteAddr := r.RemoteAddr
if *trustXFF {
if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
remoteAddr = strings.Split(xff, ",")[0]
}
}
hostIP, _, err := net.SplitHostPort(remoteAddr)
if err != nil {
hostIP = remoteAddr
}
cfg, err := readConfig()
if err != nil {
http.Error(w, "", http.StatusServiceUnavailable)
return nil, nil
}
host := cfg.HostByIP(hostIP)
if host == nil {
log.Print("no host found for IP ", hostIP)
http.NotFound(w, r)
return nil, nil
}
return host, cfg
}
func serveHosts(w http.ResponseWriter, r *http.Request) {
if !authorizeHosts(r) {
forbidden(w, r)
return
}
cfg, err := readConfig()
if err != nil {
http.Error(w, "", http.StatusServiceUnavailable)
return
}
renderJSON(w, cfg.Hosts)
}
func serveHost(w http.ResponseWriter, r *http.Request) {
if !authorizeHosts(r) {
forbidden(w, r)
return
}
match := reHost.FindStringSubmatch(r.URL.Path)
if match == nil {
http.NotFound(w, r)
return
}
hostName, what := match[1], match[2]
cfg, err := readConfig()
if err != nil {
http.Error(w, "", http.StatusServiceUnavailable)
return
}
host := cfg.Host(hostName)
if host == nil {
host = cfg.HostByMAC(hostName)
}
if host == nil {
log.Printf("no host with name or MAC %q", hostName)
http.NotFound(w, r)
return
}
renderHost(w, r, what, host, cfg)
}
func renderHost(w http.ResponseWriter, r *http.Request, what string, host *localconfig.Host, cfg *localconfig.Config) {
ctx, err := newRenderContext(host, cfg)
if err != nil {
log.Printf("host %s: %s: failed to render: %v", what, host.Name, err)
http.Error(w, "", http.StatusServiceUnavailable)
return
}
switch what {
case "ipxe":
w.Header().Set("Content-Type", "text/x-ipxe")
case "config":
w.Header().Set("Content-Type", "text/vnd.yaml")
default:
w.Header().Set("Content-Type", "application/octet-stream")
}
switch what {
case "ipxe":
err = renderIPXE(w, ctx)
case "kernel":
err = renderKernel(w, r, ctx)
case "initrd":
err = renderCtx(w, r, ctx, what, buildInitrd)
case "boot.iso":
err = renderCtx(w, r, ctx, what, buildBootISO)
case "boot.tar":
err = renderCtx(w, r, ctx, what, buildBootTar)
case "boot.img":
err = renderCtx(w, r, ctx, what, buildBootImg)
case "boot.img.gz":
err = renderCtx(w, r, ctx, what, buildBootImgGZ)
case "boot.img.lz4":
err = renderCtx(w, r, ctx, what, buildBootImgLZ4)
case "config":
err = renderConfig(w, r, ctx)
default:
http.NotFound(w, r)
}
if err != nil {
if isNotFound(err) {
log.Printf("host %s: %s: %v", what, host.Name, err)
http.NotFound(w, r)
} else {
log.Printf("host %s: %s: failed to render: %v", what, host.Name, err)
http.Error(w, "", http.StatusServiceUnavailable)
}
}
}
func renderJSON(w http.ResponseWriter, v interface{}) {
w.Header().Add("Content-Type", "application/json")
json.NewEncoder(w).Encode(v)
}
func serveClusters(w http.ResponseWriter, r *http.Request) {
cfg, err := readConfig()
if err != nil {
http.Error(w, "", http.StatusServiceUnavailable)
return
}
clusterNames := make([]string, len(cfg.Clusters))
for i, cluster := range cfg.Clusters {
clusterNames[i] = cluster.Name
}
renderJSON(w, clusterNames)
}
func serveCluster(w http.ResponseWriter, r *http.Request) {
// "/clusters/<name>/<what>" split => "", "clusters", "<name>", "<what>"
p := strings.Split(r.URL.Path, "/")
if len(p) != 4 {
http.NotFound(w, r)
return
}
clusterName := p[2]
p = strings.SplitN(p[3], ".", 2)
what := p[0]
format := ""
if len(p) > 1 {
format = p[1]
}
cfg, err := readConfig()
if err != nil {
http.Error(w, "", http.StatusServiceUnavailable)
return
}
cluster := cfg.Cluster(clusterName)
if cluster == nil {
http.NotFound(w, r)
return
}
switch what {
case "addons":
if len(cluster.Addons) == 0 {
log.Printf("cluster %q has no addons defined", clusterName)
http.NotFound(w, r)
return
}
addons := cluster.Addons
if addons == nil {
log.Printf("cluster %q: no addons with name %q", clusterName, cluster.Addons)
http.NotFound(w, r)
return
}
clusterAsMap := asMap(cluster)
clusterAsMap["kubernetes_svc_ip"] = cluster.KubernetesSvcIP().String()
clusterAsMap["dns_svc_ip"] = cluster.DNSSvcIP().String()
cm := newConfigMap("cluster-addons")
for _, addon := range addons {
buf := &bytes.Buffer{}
err := addon.Execute(buf, clusterAsMap, nil)
if err != nil {
log.Printf("cluster %q: addons %q: failed to render %q: %v",
clusterName, cluster.Addons, addon.Name, err)
http.Error(w, "", http.StatusServiceUnavailable)
return
}
cm.Data[addon.Name] = buf.String()
}
switch format {
case "yaml":
for name, data := range cm.Data {
w.Write([]byte("\n# addon: " + name + "\n---\n\n"))
w.Write([]byte(data))
}
default:
yaml.NewEncoder(w).Encode(cm)
}
default:
http.NotFound(w, r)
}
}

112
cmd/dkl-dir2config/main.go
View File

@ -1,7 +1,115 @@
package main
import "fmt"
import (
"bytes"
"flag"
"fmt"
"log"
"os"
yaml "gopkg.in/yaml.v2"
"novit.nc/direktil/pkg/clustersconfig"
"novit.nc/direktil/pkg/localconfig"
)
var (
src *clustersconfig.Config
dst *localconfig.Config
)
func main() {
fmt.Println("vim-go")
dir := flag.String("in", ".", "Source directory")
outPath := flag.String("out", "config.yaml", "Output file")
flag.Parse()
var err error
src, err = clustersconfig.FromDir(*dir)
if err != nil {
log.Fatal("failed to load config from dir: ", err)
}
dst = &localconfig.Config{
SSLConfig: src.SSLConfig,
}
// ----------------------------------------------------------------------
for _, cluster := range src.Clusters {
dst.Clusters = append(dst.Clusters, &localconfig.Cluster{
Name: cluster.Name,
Addons: renderAddons(cluster),
})
}
// ----------------------------------------------------------------------
for _, host := range src.Hosts {
ctx, err := newRenderContext(host, src)
if err != nil {
log.Fatal("failed to create render context for host ", host.Name, ": ", err)
}
macs := make([]string, 0)
if host.MAC != "" {
macs = append(macs, host.MAC)
}
ips := make([]string, 0)
if len(host.IP) != 0 {
ips = append(ips, host.IP)
}
ips = append(ips, host.IPs...)
dst.Hosts = append(dst.Hosts, &localconfig.Host{
Name: host.Name,
MACs: macs,
IPs: ips,
IPXE: ctx.Group.IPXE, // TODO render
Kernel: ctx.Group.Kernel,
Initrd: ctx.Group.Initrd,
Versions: ctx.Group.Versions,
Config: ctx.Config(),
})
}
// ----------------------------------------------------------------------
out, err := os.Create(*outPath)
if err != nil {
log.Fatal("failed to create output: ", err)
}
defer out.Close()
if err = yaml.NewEncoder(out).Encode(dst); err != nil {
log.Fatal("failed to render output: ", err)
}
}
func renderAddons(cluster *clustersconfig.Cluster) string {
addons := src.Addons[cluster.Addons]
if addons == nil {
log.Fatal("cluster %q: no addons with name %q", cluster.Name, cluster.Addons)
}
clusterAsMap := asMap(cluster)
clusterAsMap["kubernetes_svc_ip"] = cluster.KubernetesSvcIP().String()
clusterAsMap["dns_svc_ip"] = cluster.DNSSvcIP().String()
buf := &bytes.Buffer{}
for _, addon := range addons {
fmt.Fprintf(buf, "# addon: %s\n", addon.Name)
err := addon.Execute(buf, clusterAsMap, nil)
if err != nil {
log.Fatalf("cluster %q: addons %q: failed to render %q: %v",
cluster.Name, cluster.Addons, addon.Name, err)
}
}
return buf.String()
}

238
cmd/dkl-dir2config/render-context.go
View File

@ -2,21 +2,12 @@ package main
import (
"bytes"
"crypto/sha256"
"encoding/hex"
"encoding/json"
"errors"
"fmt"
"log"
"path"
"path/filepath"
cfsslconfig "github.com/cloudflare/cfssl/config"
"github.com/cloudflare/cfssl/csr"
yaml "gopkg.in/yaml.v2"
"novit.nc/direktil/pkg/clustersconfig"
"novit.nc/direktil/pkg/config"
)
type renderContext struct {
@ -67,20 +58,14 @@ func newRenderContext(host *clustersconfig.Host, cfg *clustersconfig.Config) (ct
}, nil
}
func (ctx *renderContext) Config() (ba []byte, cfg *config.Config, err error) {
func (ctx *renderContext) Config() string {
if ctx.ConfigTemplate == nil {
err = notFoundError{fmt.Sprintf("config %q", ctx.Group.Config)}
return
log.Fatalf("no such config: %q", ctx.Group.Config)
}
ctxMap := ctx.asMap()
secretData, err := ctx.secretData()
if err != nil {
return
}
templateFuncs := ctx.templateFuncs(secretData, ctxMap)
templateFuncs := ctx.templateFuncs(ctxMap)
render := func(what string, t *clustersconfig.Template) (s string, err error) {
buf := &bytes.Buffer{}
@ -94,7 +79,7 @@ func (ctx *renderContext) Config() (ba []byte, cfg *config.Config, err error) {
return
}
extraFuncs := ctx.templateFuncs(secretData, ctxMap)
extraFuncs := ctx.templateFuncs(ctxMap)
extraFuncs["static_pods"] = func(name string) (string, error) {
t := ctx.clusterConfig.StaticPodsTemplate(name)
@ -106,85 +91,41 @@ func (ctx *renderContext) Config() (ba []byte, cfg *config.Config, err error) {
}
buf := bytes.NewBuffer(make([]byte, 0, 4096))
if err = ctx.ConfigTemplate.Execute(buf, ctxMap, extraFuncs); err != nil {
return
if err := ctx.ConfigTemplate.Execute(buf, ctxMap, extraFuncs); err != nil {
log.Fatalf("failed to render config %q for host %q: %v", ctx.Group.Config, ctx.Host.Name, err)
}
if secretData.Changed() {
err = secretData.Save()
if err != nil {
return
}
}
ba = buf.Bytes()
cfg = &config.Config{}
if err = yaml.Unmarshal(buf.Bytes(), cfg); err != nil {
return
}
return
}
func (ctx *renderContext) secretData() (data *SecretData, err error) {
var sslCfg *cfsslconfig.Config
if ctx.clusterConfig.SSLConfig == "" {
sslCfg = &cfsslconfig.Config{}
} else {
sslCfg, err = cfsslconfig.LoadConfig([]byte(ctx.clusterConfig.SSLConfig))
if err != nil {
return
}
}
data, err = loadSecretData(sslCfg)
return
return buf.String()
}
func (ctx *renderContext) StaticPods() (ba []byte, err error) {
secretData, err := ctx.secretData()
if err != nil {
return
}
if ctx.StaticPodsTemplate == nil {
err = notFoundError{fmt.Sprintf("static-pods %q", ctx.Group.StaticPods)}
return
log.Fatalf("no such static-pods: %q", ctx.Group.StaticPods)
}
ctxMap := ctx.asMap()
buf := bytes.NewBuffer(make([]byte, 0, 4096))
if err = ctx.StaticPodsTemplate.Execute(buf, ctxMap, ctx.templateFuncs(secretData, ctxMap)); err != nil {
if err = ctx.StaticPodsTemplate.Execute(buf, ctxMap, ctx.templateFuncs(ctxMap)); err != nil {
return
}
if secretData.Changed() {
err = secretData.Save()
if err != nil {
return
}
}
ba = buf.Bytes()
return
}
func (ctx *renderContext) templateFuncs(secretData *SecretData, ctxMap map[string]interface{}) map[string]interface{} {
func (ctx *renderContext) templateFuncs(ctxMap map[string]interface{}) map[string]interface{} {
cluster := ctx.Cluster.Name
getKeyCert := func(name string) (kc *KeyCert, err error) {
getKeyCert := func(name, funcName string) (s string, err error) {
req := ctx.clusterConfig.CSR(name)
if req == nil {
err = errors.New("no such certificate request")
err = fmt.Errorf("no certificate request named %q", name)
return
}
if req.CA == "" {
err = errors.New("CA not defined")
err = fmt.Errorf("CA not defined in req %q", name)
return
}
@ -194,135 +135,41 @@ func (ctx *renderContext) templateFuncs(secretData *SecretData, ctxMap map[strin
return
}
certReq := &csr.CertificateRequest{
KeyRequest: csr.NewBasicKeyRequest(),
}
err = json.Unmarshal(buf.Bytes(), certReq)
if err != nil {
log.Print("unmarshal failed on: ", buf)
return
}
if req.PerHost {
name = name + "/" + ctx.Host.Name
}
return secretData.KeyCert(cluster, req.CA, name, req.Profile, req.Label, certReq)
}
asYaml := func(v interface{}) (string, error) {
ba, err := yaml.Marshal(v)
if err != nil {
return "", err
}
return string(ba), nil
s = fmt.Sprintf("{{ %s %q %q %q %q %q %q }}", funcName,
cluster, req.CA, name, req.Profile, req.Label, buf.String())
return
}
return map[string]interface{}{
"token": func(name string) (s string, err error) {
return secretData.Token(cluster, name)
"token": func(name string) (s string) {
return fmt.Sprintf("{{ token %q %q }}", cluster, name)
},
"ca_key": func(name string) (s string, err error) {
ca, err := secretData.CA(cluster, name)
if err != nil {
return
}
s = string(ca.Key)
return
// TODO check CA exists
// ?ctx.clusterConfig.CA(name)
return fmt.Sprintf("{{ ca_key %q %q }}", cluster, name), nil
},
"ca_crt": func(name string) (s string, err error) {
ca, err := secretData.CA(cluster, name)
if err != nil {
return
}
s = string(ca.Cert)
return
// TODO check CA exists
return fmt.Sprintf("{{ ca_crt %q %q }}", cluster, name), nil
},
"ca_dir": func(name string) (s string, err error) {
ca, err := secretData.CA(cluster, name)
if err != nil {
return
}
dir := "/" + path.Join("etc", "tls-ca", name)
return asYaml([]config.FileDef{
{
Path: path.Join(dir, "ca.crt"),
Mode: 0644,
Content: string(ca.Cert),
},
{
Path: path.Join(dir, "ca.key"),
Mode: 0600,
Content: string(ca.Key),
},
})
return fmt.Sprintf("{{ ca_dir %q %q }}", cluster, name), nil
},
"tls_key": func(name string) (s string, err error) {
kc, err := getKeyCert(name)
if err != nil {
return
}
s = string(kc.Key)
return
"tls_key": func(name string) (string, error) {
return getKeyCert(name, "tls_key")
},
"tls_crt": func(name string) (s string, err error) {
kc, err := getKeyCert(name)
if err != nil {
return
}
s = string(kc.Cert)
return
return getKeyCert(name, "tls_crt")
},
"tls_dir": func(name string) (s string, err error) {
csr := ctx.clusterConfig.CSR(name)
if csr == nil {
err = fmt.Errorf("no CSR named %q", name)
return
}
ca, err := secretData.CA(cluster, csr.CA)
if err != nil {
return
}
kc, err := getKeyCert(name)
if err != nil {
return
}
dir := "/" + path.Join("etc", "tls", name)
return asYaml([]config.FileDef{
{
Path: path.Join(dir, "ca.crt"),
Mode: 0644,
Content: string(ca.Cert),
},
{
Path: path.Join(dir, "tls.crt"),
Mode: 0644,
Content: string(kc.Cert),
},
{
Path: path.Join(dir, "tls.key"),
Mode: 0600,
Content: string(kc.Key),
},
})
return getKeyCert(name, "tls_dir")
},
"hosts_of_group": func() (hosts []interface{}) {
@ -341,40 +188,15 @@ func (ctx *renderContext) templateFuncs(secretData *SecretData, ctxMap map[strin
"hosts_of_group_count": func() (count int) {
for _, host := range ctx.clusterConfig.Hosts {
if host.Group != ctx.Host.Group {
continue
if host.Group == ctx.Host.Group {
count++
}
count++
}
return
},
}
}
func (ctx *renderContext) distFilePath(path ...string) string {
return filepath.Join(append([]string{*dataDir, "dist"}, path...)...)
}
func (ctx *renderContext) Tag() (string, error) {
h := sha256.New()
_, cfg, err := ctx.Config()
if err != nil {
return "", err
}
enc := yaml.NewEncoder(h)
for _, o := range []interface{}{cfg, ctx} {
if err := enc.Encode(o); err != nil {
return "", err
}
}
return hex.EncodeToString(h.Sum(nil)), nil
}
func (ctx *renderContext) asMap() map[string]interface{} {
result := asMap(ctx)

2
cmd/dkl-local-server/render-context.go
View File

@ -10,10 +10,10 @@ import (
"net/http"
"path"
"path/filepath"
"text/template"
cfsslconfig "github.com/cloudflare/cfssl/config"
"github.com/cloudflare/cfssl/csr"
"github.com/golang/go/src/pkg/html/template"
yaml "gopkg.in/yaml.v2"
"novit.nc/direktil/pkg/config"