
This commit implements access control for DC API. The reference doc can be found at "https://docs.starlingx.io/api-ref/distcloud/api-ref-dcmanager-v1.html". Unit tests and YAML file support will be done in other tasks. The access control implementation for GET requests requires the user to have "reader" role and to be present in either "admin" or "services" project. For other requests, it requires the user to have "admin" role and to be present in either "admin" or "services" project. Requests using public API URLs require no credentials. As all default system users of StarlingX have "admin" role and are present in either project "admin" or "services", there should be no regression with the change introduced here. The implementation done here is a little bit different from the one done for sysinv and FM APIs, because the routing of requests is not done when "before()" method of Pecan hooks are called, so the controller is not defined at this point. To test the access control of DC API, the following commands are used (long list of parameters is replaced by "<params>"): dcmanager subcloud add <params> dcmanager subcloud manage subcloud2 dcmanager subcloud list dcmanager subcloud delete subcloud2 dcmanager subcloud-deploy upload <params> dcmanager subcloud-deploy show dcmanager alarm summary dcmanager patch-strategy create dcmanager patch-strategy show dcmanager patch-strategy apply dcmanager patch-strategy abort dcmanager patch-strategy delete dcmanager strategy-config update <params> subcloud1 dcmanager strategy-config list dcmanager strategy-config delete subcloud1 dcmanager subcloud-group add --name group01 dcmanager subcloud-group update --description test group01 dcmanager subcloud-group list dcmanager subcloud-group delete group01 dcmanager subcloud-backup create --subcloud subcloud1 On test plan, these commands are reffered as "test commands". The access control is not implemented for "dcdbsync" and "dcorch" servers. Also, it is also not implemented for action POST "/v1.0/notifications" in dcmanager API server, as it it is only called indirectly by sysinv controllers. Test Plan: PASS: Successfully deploy a Distributed Cloud (with 1 subcloud) using a CentOS image with this commit present. Successfully create, through openstack CLI, the users: 'testreader' with role 'reader' in project 'admin', 'adminsvc' with role 'admin' in project 'services' and 'otheradmin' with role 'admin' in project 'notadminproject'. Create openrc files for all new users. Note: the other user used is the already existing 'admin' with role 'admin' in project 'admin'. PASS: In the deployed DC, check the behavior of test commands through different users: for "admin" and "adminsvc" users, all commands are successful; for "testreader" user, only the test commands ending with "list" or "summary" (GET requests) are successful; for "otheradmin" user, all commands fail. PASS: In the deployed DC, to assert that public API works without authentication, execute the command "curl -v http://<MGMT_IP>:8119/" and verify that it is accepted and that the HTTP response is 200, and execute the command "curl -v http://<MGMT_IP>:8119/v1.0/subclouds" and verify that it is rejected and that the HTTP response is 401. PASS: In the deployed DC, check through Horizon interface that DC management works correctly with default admin user. Story: 2010149 Task: 46287 Signed-off-by: Joao Victor Portal <Joao.VictorPortal@windriver.com> Change-Id: Icfe24fd62096c7bf0bbb1f97e819dee5aac675e4
277 lines
12 KiB
Python
Executable File
277 lines
12 KiB
Python
Executable File
# Copyright (c) 2017 Ericsson AB.
|
|
# Copyright (c) 2017-2022 Wind River Systems, Inc.
|
|
# All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
#
|
|
|
|
from oslo_config import cfg
|
|
from oslo_log import log as logging
|
|
from oslo_messaging import RemoteError
|
|
|
|
import pecan
|
|
from pecan import expose
|
|
from pecan import request
|
|
|
|
from dccommon import consts as dccommon_consts
|
|
from dcmanager.api.controllers import restcomm
|
|
from dcmanager.api.policies import sw_update_strategy as sw_update_strat_policy
|
|
from dcmanager.api import policy
|
|
from dcmanager.common import consts
|
|
from dcmanager.common import exceptions
|
|
from dcmanager.common.i18n import _
|
|
from dcmanager.common import utils
|
|
from dcmanager.db import api as db_api
|
|
from dcmanager.orchestrator import rpcapi as orch_rpc_client
|
|
|
|
CONF = cfg.CONF
|
|
LOG = logging.getLogger(__name__)
|
|
|
|
SUPPORTED_STRATEGY_TYPES = [
|
|
consts.SW_UPDATE_TYPE_FIRMWARE,
|
|
consts.SW_UPDATE_TYPE_KUBE_ROOTCA_UPDATE,
|
|
consts.SW_UPDATE_TYPE_KUBERNETES,
|
|
consts.SW_UPDATE_TYPE_PATCH,
|
|
consts.SW_UPDATE_TYPE_PRESTAGE,
|
|
consts.SW_UPDATE_TYPE_UPGRADE
|
|
]
|
|
|
|
# some strategies allow force for all subclouds
|
|
FORCE_ALL_TYPES = [
|
|
consts.SW_UPDATE_TYPE_KUBE_ROOTCA_UPDATE,
|
|
consts.SW_UPDATE_TYPE_KUBERNETES,
|
|
consts.SW_UPDATE_TYPE_PRESTAGE,
|
|
consts.SW_UPDATE_TYPE_UPGRADE
|
|
]
|
|
|
|
|
|
class SwUpdateStrategyController(object):
|
|
|
|
def __init__(self):
|
|
super(SwUpdateStrategyController, self).__init__()
|
|
self.orch_rpc_client = orch_rpc_client.ManagerOrchestratorClient()
|
|
|
|
@expose(generic=True, template='json')
|
|
def index(self):
|
|
# Route the request to specific methods with parameters
|
|
pass
|
|
|
|
@index.when(method='GET', template='json')
|
|
def get(self, steps=None, cloud_name=None):
|
|
"""Get details about software update strategy.
|
|
|
|
:param steps: get the steps for this strategy (optional)
|
|
:param cloud_name: name of cloud (optional)
|
|
"""
|
|
policy.authorize(sw_update_strat_policy.POLICY_ROOT % "get", {},
|
|
restcomm.extract_credentials_for_policy())
|
|
context = restcomm.extract_context_from_environ()
|
|
|
|
# If 'type' is in the request params, filter the update_type
|
|
update_type_filter = request.params.get('type', None)
|
|
|
|
if steps is None:
|
|
# Strategy requested
|
|
strategy = None
|
|
try:
|
|
strategy = db_api.sw_update_strategy_get(
|
|
context,
|
|
update_type=update_type_filter)
|
|
except exceptions.NotFound:
|
|
if update_type_filter is None:
|
|
pecan.abort(404, _('Strategy not found'))
|
|
else:
|
|
pecan.abort(404,
|
|
_("Strategy of type '%s' not found"
|
|
% update_type_filter))
|
|
|
|
strategy_dict = db_api.sw_update_strategy_db_model_to_dict(
|
|
strategy)
|
|
return strategy_dict
|
|
|
|
elif steps == "steps":
|
|
# Steps for the strategy requested
|
|
if cloud_name is None:
|
|
# List of steps requested
|
|
result = dict()
|
|
result['strategy-steps'] = list()
|
|
strategy_steps = db_api.strategy_step_get_all(context)
|
|
for strategy_step in strategy_steps:
|
|
result['strategy-steps'].append(
|
|
db_api.strategy_step_db_model_to_dict(strategy_step))
|
|
|
|
return result
|
|
else:
|
|
# Single step requested
|
|
strategy_step = None
|
|
if cloud_name == dccommon_consts.SYSTEM_CONTROLLER_NAME:
|
|
# The system controller step does not map to a subcloud,
|
|
# so has no name.
|
|
try:
|
|
strategy_step = db_api.strategy_step_get(context, None)
|
|
except exceptions.StrategyStepNotFound:
|
|
pecan.abort(404, _('Strategy step not found'))
|
|
else:
|
|
try:
|
|
strategy_step = db_api.strategy_step_get_by_name(
|
|
context, cloud_name)
|
|
except exceptions.StrategyStepNameNotFound:
|
|
pecan.abort(404, _('Strategy step not found'))
|
|
|
|
strategy_step_dict = db_api.strategy_step_db_model_to_dict(
|
|
strategy_step)
|
|
return strategy_step_dict
|
|
|
|
@index.when(method='POST', template='json')
|
|
def post(self, actions=None):
|
|
"""Create a new software update strategy."""
|
|
context = restcomm.extract_context_from_environ()
|
|
|
|
payload = eval(request.body)
|
|
if not payload:
|
|
pecan.abort(400, _('Body required'))
|
|
|
|
if actions is None:
|
|
policy.authorize(sw_update_strat_policy.POLICY_ROOT % "create", {},
|
|
restcomm.extract_credentials_for_policy())
|
|
|
|
# Validate any options that were supplied
|
|
strategy_type = payload.get('type')
|
|
if not strategy_type:
|
|
pecan.abort(400, _('type required'))
|
|
if strategy_type not in SUPPORTED_STRATEGY_TYPES:
|
|
pecan.abort(400, _('type invalid'))
|
|
|
|
subcloud_apply_type = payload.get('subcloud-apply-type')
|
|
if subcloud_apply_type is not None:
|
|
if subcloud_apply_type not in [
|
|
consts.SUBCLOUD_APPLY_TYPE_PARALLEL,
|
|
consts.SUBCLOUD_APPLY_TYPE_SERIAL]:
|
|
pecan.abort(400, _('subcloud-apply-type invalid'))
|
|
|
|
max_parallel_subclouds_str = payload.get('max-parallel-subclouds')
|
|
if max_parallel_subclouds_str is not None:
|
|
max_parallel_subclouds = None
|
|
try:
|
|
max_parallel_subclouds = int(max_parallel_subclouds_str)
|
|
except ValueError:
|
|
pecan.abort(400, _('max-parallel-subclouds invalid'))
|
|
if max_parallel_subclouds < 1 or max_parallel_subclouds > 500:
|
|
pecan.abort(400, _('max-parallel-subclouds invalid'))
|
|
|
|
stop_on_failure = payload.get('stop-on-failure')
|
|
if stop_on_failure is not None:
|
|
if stop_on_failure not in ["true", "false"]:
|
|
pecan.abort(400, _('stop-on-failure invalid'))
|
|
|
|
force_flag = payload.get('force')
|
|
if force_flag is not None:
|
|
if force_flag not in ["true", "false"]:
|
|
pecan.abort(400, _('force invalid'))
|
|
elif strategy_type not in FORCE_ALL_TYPES:
|
|
if payload.get('cloud_name') is None:
|
|
pecan.abort(400,
|
|
_('The --force option can only be applied '
|
|
'for a single subcloud. Please specify '
|
|
'the subcloud name.'))
|
|
|
|
subcloud_group = payload.get('subcloud_group')
|
|
# prevents passing both cloud_name and subcloud_group options
|
|
# from REST APIs and checks if the group exists
|
|
if subcloud_group is not None:
|
|
if payload.get('cloud_name') is not None:
|
|
pecan.abort(400, _('cloud_name and subcloud_group are '
|
|
'mutually exclusive'))
|
|
|
|
if (subcloud_apply_type is not None or
|
|
max_parallel_subclouds_str is not None):
|
|
pecan.abort(400, _('subcloud-apply-type and '
|
|
'max-parallel-subclouds are not '
|
|
'supported when subcloud_group is '
|
|
'applied'))
|
|
|
|
group = utils.subcloud_group_get_by_ref(context,
|
|
subcloud_group)
|
|
if group is None:
|
|
pecan.abort(400, _('Invalid group_id'))
|
|
|
|
# Not adding validation for extra args. Passing them through.
|
|
try:
|
|
# Ask dcmanager-manager to create the strategy.
|
|
# It will do all the real work...
|
|
return self.orch_rpc_client.create_sw_update_strategy(context,
|
|
payload)
|
|
except RemoteError as e:
|
|
pecan.abort(422, e.value)
|
|
except Exception as e:
|
|
LOG.exception(e)
|
|
pecan.abort(500, _('Unable to create strategy'))
|
|
elif actions == 'actions':
|
|
# If 'type' is in the request params, filter the update_type
|
|
update_type_filter = request.params.get('type', None)
|
|
|
|
# Apply or abort a strategy
|
|
action = payload.get('action')
|
|
if not action:
|
|
pecan.abort(400, _('action required'))
|
|
if action == consts.SW_UPDATE_ACTION_APPLY:
|
|
policy.authorize(sw_update_strat_policy.POLICY_ROOT % "apply",
|
|
{}, restcomm.extract_credentials_for_policy())
|
|
try:
|
|
# Ask dcmanager-manager to apply the strategy.
|
|
# It will do all the real work...
|
|
return self.orch_rpc_client.apply_sw_update_strategy(
|
|
context,
|
|
update_type=update_type_filter)
|
|
except RemoteError as e:
|
|
pecan.abort(422, e.value)
|
|
except Exception as e:
|
|
LOG.exception(e)
|
|
pecan.abort(500, _('Unable to apply strategy'))
|
|
elif action == consts.SW_UPDATE_ACTION_ABORT:
|
|
policy.authorize(sw_update_strat_policy.POLICY_ROOT % "abort",
|
|
{}, restcomm.extract_credentials_for_policy())
|
|
try:
|
|
# Ask dcmanager-manager to abort the strategy.
|
|
# It will do all the real work...
|
|
return self.orch_rpc_client.abort_sw_update_strategy(
|
|
context,
|
|
update_type=update_type_filter)
|
|
except RemoteError as e:
|
|
pecan.abort(422, e.value)
|
|
except Exception as e:
|
|
LOG.exception(e)
|
|
pecan.abort(500, _('Unable to abort strategy'))
|
|
|
|
@index.when(method='delete', template='json')
|
|
def delete(self):
|
|
"""Delete the software update strategy."""
|
|
policy.authorize(sw_update_strat_policy.POLICY_ROOT % "delete", {},
|
|
restcomm.extract_credentials_for_policy())
|
|
context = restcomm.extract_context_from_environ()
|
|
|
|
# If 'type' is in the request params, filter the update_type
|
|
update_type_filter = request.params.get('type', None)
|
|
|
|
try:
|
|
# Ask dcmanager-manager to delete the strategy.
|
|
# It will do all the real work...
|
|
return self.orch_rpc_client.delete_sw_update_strategy(
|
|
context,
|
|
update_type=update_type_filter)
|
|
except RemoteError as e:
|
|
pecan.abort(422, e.value)
|
|
except Exception as e:
|
|
LOG.exception(e)
|
|
pecan.abort(500, _('Unable to delete strategy'))
|