public_git/postgres-operator
1
0
Fork 0
mirror of https://github.com/zalando/postgres-operator.git synced 2026-09-30 13:16:25 +02:00
Code Issues Projects Releases Wiki Activity

Create human users from teams api

Browse Source
This commit is contained in:
Murat Kabilov
2017-05-12 11:37:09 +02:00
parent 58506634c4
commit 6e2d64bd50
11 changed files with 287 additions and 117 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/cluster/cluster.go
+80 -43
View File
@@ -21,10 +21,11 @@ import (
"github.bus.zalan.do/acid/postgres-operator/pkg/util"
"github.bus.zalan.do/acid/postgres-operator/pkg/util/constants"
"github.bus.zalan.do/acid/postgres-operator/pkg/util/retryutil"
"github.bus.zalan.do/acid/postgres-operator/pkg/util/teams"
)
var (
superUsername = "superuser"
superuserName = "postgres"
replicationUsername = "replication"
alphaNumericRegexp = regexp.MustCompile("^[a-zA-Z0-9]*$")
@@ -32,10 +33,11 @@ var (
//TODO: remove struct duplication
type Config struct {
Namespace string
KubeClient *kubernetes.Clientset //TODO: move clients to the better place?
RestClient *rest.RESTClient
EtcdClient etcdclient.KeysAPI
Namespace string
KubeClient *kubernetes.Clientset //TODO: move clients to the better place?
RestClient *rest.RESTClient
EtcdClient etcdclient.KeysAPI
TeamsAPIClient *teams.TeamsAPI
}
type pgUser struct {
@@ -45,15 +47,15 @@ type pgUser struct {
}
type Cluster struct {
logger *logrus.Entry
config Config
logger *logrus.Entry
etcdHost string
dockerImage string
cluster *spec.Postgresql
pgUsers map[string]pgUser
pgDb *sql.DB
mu sync.Mutex
pgDb *sql.DB
mu sync.Mutex
}
func New(cfg Config, spec *spec.Postgresql) *Cluster {
@@ -71,6 +73,37 @@ func New(cfg Config, spec *spec.Postgresql) *Cluster {
return cluster
}
func (c *Cluster) getReadonlyToken() (string, error) {
credentialsSecret, err := c.config.KubeClient.Secrets(c.config.Namespace).Get("postgresql-operator")
if err != nil {
return "", fmt.Errorf("Can't get credentials secret: %s", err)
}
data := credentialsSecret.Data
if string(data["read-only-token-type"]) != "Bearer" {
return "", fmt.Errorf("Wrong token type: %s", data["read-only-token-type"])
}
return string(data["read-only-token-secret"]), nil
}
func (c *Cluster) getTeamMembers() ([]string, error) {
token, err := c.getReadonlyToken()
if err != nil {
return nil, fmt.Errorf("Can't get oauth token: %s", err)
}
c.config.TeamsAPIClient.OauthToken = token
teamInfo, err := c.config.TeamsAPIClient.TeamInfo((*c.cluster.Spec).TeamId)
if err != nil {
return nil, fmt.Errorf("Can't get team info: %s", err)
}
return teamInfo.Members, nil
}
func (c *Cluster) labelsSet() labels.Set {
return labels.Set{
"application": "spilo",
@@ -78,10 +111,10 @@ func (c *Cluster) labelsSet() labels.Set {
}
}
func (c *Cluster) credentialSecretName(userName string) string {
func (c *Cluster) credentialSecretName(username string) string {
return fmt.Sprintf(
"%s.%s.credentials.%s.%s",
userName,
username,
(*c.cluster).Metadata.Name,
constants.TPRName,
constants.TPRVendor)
@@ -91,7 +124,7 @@ func isValidUsername(username string) bool {
return alphaNumericRegexp.MatchString(username)
}
func validateUserFlags(userFlags []string) (flags []string, err error) {
func normalizeUserFlags(userFlags []string) (flags []string, err error) {
uniqueFlags := make(map[string]bool)
for _, flag := range userFlags {
@@ -106,10 +139,6 @@ func validateUserFlags(userFlags []string) (flags []string, err error) {
}
}
if _, ok := uniqueFlags["NOLOGIN"]; !ok {
uniqueFlags["LOGIN"] = true
}
flags = []string{}
for k := range uniqueFlags {
flags = append(flags, k)
@@ -122,8 +151,8 @@ func (c *Cluster) init() {
users := (*c.cluster.Spec).Users
c.pgUsers = make(map[string]pgUser, len(users)+2) // + [superuser and replication]
c.pgUsers[superUsername] = pgUser{
name: superUsername,
c.pgUsers[superuserName] = pgUser{
name: superuserName,
password: util.RandomPassword(constants.PasswordLength),
}
@@ -132,27 +161,35 @@ func (c *Cluster) init() {
password: util.RandomPassword(constants.PasswordLength),
}
for userName, userFlags := range users {
if !isValidUsername(userName) {
c.logger.Warningf("Invalid '%s' username", userName)
for username, userFlags := range users {
if !isValidUsername(username) {
c.logger.Warningf("Invalid username: '%s'", username)
continue
}
flags, err := validateUserFlags(userFlags)
flags, err := normalizeUserFlags(userFlags)
if err != nil {
c.logger.Warningf("Invalid flags for user '%s': %s", userName, err)
c.logger.Warningf("Invalid flags for user '%s': %s", username, err)
}
c.pgUsers[userName] = pgUser{
name: userName,
c.pgUsers[username] = pgUser{
name: username,
password: util.RandomPassword(constants.PasswordLength),
flags: flags,
}
}
teamMembers, err := c.getTeamMembers()
if err != nil {
c.logger.Errorf("Can't get list of team members: %s", err)
} else {
for _, username := range teamMembers {
c.pgUsers[username] = pgUser{name: username}
}
}
}
func (c *Cluster) waitPodsDestroy() error {
func (c *Cluster) waitPodDelete() error {
ls := c.labelsSet()
listOptions := v1.ListOptions{
@@ -227,7 +264,7 @@ func (c *Cluster) waitPodLabelsReady() error {
}
func (c *Cluster) Create() error {
c.createEndPoint()
c.createEndpoint()
c.createService()
c.applySecrets()
c.createStatefulSet()
@@ -268,7 +305,7 @@ func (c *Cluster) waitClusterReady() error {
func (c *Cluster) Delete() error {
clusterName := (*c.cluster).Metadata.Name
nameSpace := c.config.Namespace
namespace := c.config.Namespace
orphanDependents := false
deleteOptions := &v1.DeleteOptions{
OrphanDependents: &orphanDependents,
@@ -280,54 +317,54 @@ func (c *Cluster) Delete() error {
kubeClient := c.config.KubeClient
podList, err := kubeClient.Pods(nameSpace).List(listOptions)
podList, err := kubeClient.Pods(namespace).List(listOptions)
if err != nil {
return fmt.Errorf("Can't get list of pods: %s", err)
}
err = kubeClient.StatefulSets(nameSpace).Delete(clusterName, deleteOptions)
err = kubeClient.StatefulSets(namespace).Delete(clusterName, deleteOptions)
if err != nil {
return fmt.Errorf("Can't delete statefulset: %s", err)
}
c.logger.Infof("StatefulSet %s.%s has been deleted", nameSpace, clusterName)
c.logger.Infof("Statefulset '%s' has been deleted", util.FullObjectName(namespace, clusterName))
for _, pod := range podList.Items {
err = kubeClient.Pods(nameSpace).Delete(pod.Name, deleteOptions)
err = kubeClient.Pods(namespace).Delete(pod.Name, deleteOptions)
if err != nil {
return fmt.Errorf("Error while deleting pod %s.%s: %s", pod.Name, pod.Namespace, err)
return fmt.Errorf("Error while deleting pod '%s': %s", util.FullObjectName(pod.Namespace, pod.Name), err)
}
c.logger.Infof("Pod %s.%s has been deleted", pod.Name, pod.Namespace)
c.logger.Infof("Pod '%s' has been deleted", util.FullObjectName(pod.Namespace, pod.Name))
}
serviceList, err := kubeClient.Services(nameSpace).List(listOptions)
serviceList, err := kubeClient.Services(namespace).List(listOptions)
if err != nil {
return fmt.Errorf("Can't get list of the services: %s", err)
}
for _, service := range serviceList.Items {
err = kubeClient.Services(nameSpace).Delete(service.Name, deleteOptions)
err = kubeClient.Services(namespace).Delete(service.Name, deleteOptions)
if err != nil {
return fmt.Errorf("Can't delete service %s.%s: %s", service.Name, service.Namespace, err)
return fmt.Errorf("Can't delete service '%s': %s", util.FullObjectName(service.Namespace, service.Name), err)
}
c.logger.Infof("Service %s.%s has been deleted", service.Name, service.Namespace)
c.logger.Infof("Service '%s' has been deleted", util.FullObjectName(service.Namespace, service.Name))
}
secretsList, err := kubeClient.Secrets(nameSpace).List(listOptions)
secretsList, err := kubeClient.Secrets(namespace).List(listOptions)
if err != nil {
return err
}
for _, secret := range secretsList.Items {
err = kubeClient.Secrets(nameSpace).Delete(secret.Name, deleteOptions)
err = kubeClient.Secrets(namespace).Delete(secret.Name, deleteOptions)
if err != nil {
return fmt.Errorf("Can't delete secret %s.%s: %s", secret.Name, secret.Namespace, err)
return fmt.Errorf("Can't delete secret '%s': %s", util.FullObjectName(secret.Namespace, secret.Name), err)
}
c.logger.Infof("Secret %s.%s has been deleted", secret.Name, secret.Namespace)
c.logger.Infof("Secret '%s' has been deleted", util.FullObjectName(secret.Namespace, secret.Name))
}
c.waitPodsDestroy()
c.waitPodDelete()
etcdKey := fmt.Sprintf("/service/%s", clusterName)
pkg/cluster/pg.go
+4 -2
View File
@@ -10,14 +10,16 @@ import (
func (c *Cluster) pgConnectionString() string {
hostname := fmt.Sprintf("%s.%s.svc.cluster.local", (*c.cluster).Metadata.Name, (*c.cluster).Metadata.Namespace)
password := c.pgUsers[superUsername].password
password := c.pgUsers[superuserName].password
return fmt.Sprintf("host='%s' dbname=postgres sslmode=require user=postgres password='%s'",
return fmt.Sprintf("host='%s' dbname=postgres sslmode=require user='%s' password='%s'",
hostname,
superuserName,
strings.Replace(password, "$", "\\$", -1))
}
func (c *Cluster) initDbConn() error {
//TODO: concurrent safe?
if c.pgDb == nil {
c.mu.Lock()
defer c.mu.Unlock()
pkg/cluster/resources.go
+59 -45
View File
@@ -1,26 +1,23 @@
package cluster
import (
"fmt"
"strings"
"k8s.io/client-go/pkg/api/resource"
"k8s.io/client-go/pkg/api/v1"
"k8s.io/client-go/pkg/apis/apps/v1beta1"
"k8s.io/client-go/pkg/util/intstr"
"fmt"
"github.bus.zalan.do/acid/postgres-operator/pkg/util"
"github.bus.zalan.do/acid/postgres-operator/pkg/util/constants"
"github.bus.zalan.do/acid/postgres-operator/pkg/util/k8sutil"
"strings"
)
var createUserSQL = `DO $$
BEGIN
SET local synchronous_commit = 'local';
PERFORM * FROM pg_authid WHERE rolname = '%s';
IF FOUND THEN
ALTER ROLE "%s" WITH %s PASSWORD '%s';
ELSE
CREATE ROLE "%s" WITH %s PASSWORD '%s';
END IF;
SET LOCAL synchronous_commit = 'local';
CREATE ROLE "%s" %s PASSWORD %s;
END;
$$`
@@ -63,7 +60,7 @@ func (c *Cluster) createStatefulSet() {
ValueFrom: &v1.EnvVarSource{
SecretKeyRef: &v1.SecretKeySelector{
LocalObjectReference: v1.LocalObjectReference{
Name: c.credentialSecretName("superuser"),
Name: c.credentialSecretName(superuserName),
},
Key: "password",
},
@@ -74,15 +71,15 @@ func (c *Cluster) createStatefulSet() {
ValueFrom: &v1.EnvVarSource{
SecretKeyRef: &v1.SecretKeySelector{
LocalObjectReference: v1.LocalObjectReference{
Name: c.credentialSecretName("replication"),
Name: c.credentialSecretName(replicationUsername),
},
Key: "password",
},
},
},
{
Name: "PAM_OAUTH2", //TODO: get from the operator tpr spec
Value: "https://info.example.com/oauth2/tokeninfo?access_token= uid realm=/employees", //space before uid is obligatory
Name: "PAM_OAUTH2", //TODO: get from the operator tpr spec
Value: constants.PamConfiguration, //space before uid is obligatory
},
{
Name: "SPILO_CONFIGURATION", //TODO: get from the operator tpr spec
@@ -93,10 +90,16 @@ bootstrap:
initdb:
- auth-host: md5
- auth-local: trust
users:
%s:
password: NULL
options:
- createdb
- nologin
pg_hba:
- hostnossl all all all reject
- hostssl all +%s all pam
- hostssl all all all md5`, (*c.cluster.Spec).Version, constants.PamRoleName),
- hostssl all all all md5`, (*c.cluster.Spec).Version, constants.PamRoleName, constants.PamRoleName),
},
}
@@ -169,17 +172,24 @@ bootstrap:
},
}
c.config.KubeClient.StatefulSets(c.config.Namespace).Create(statefulSet)
_, err := c.config.KubeClient.StatefulSets(c.config.Namespace).Create(statefulSet)
if err != nil {
c.logger.Errorf("Can't create statefulset: %s", err)
} else {
c.logger.Infof("Statefulset has been created: '%s'", util.FullObjectNameFromMeta(statefulSet.ObjectMeta))
}
}
func (c *Cluster) applySecrets() {
//TODO: do not override current secrets
var err error
for userName, pgUser := range c.pgUsers {
for username, pgUser := range c.pgUsers {
//Skip users with no password i.e. human users (they'll be authenticated using pam)
if pgUser.password == "" {
continue
}
secret := v1.Secret{
ObjectMeta: v1.ObjectMeta{
Name: c.credentialSecretName(userName),
Name: c.credentialSecretName(username),
Labels: c.labelsSet(),
},
Type: v1.SecretTypeOpaque,
@@ -192,32 +202,24 @@ func (c *Cluster) applySecrets() {
if k8sutil.IsKubernetesResourceAlreadyExistError(err) {
c.logger.Infof("Skipping update of '%s'", secret.Name)
curSecrets, err := c.config.KubeClient.Secrets(c.config.Namespace).Get(c.credentialSecretName(userName))
curSecrets, err := c.config.KubeClient.Secrets(c.config.Namespace).Get(c.credentialSecretName(username))
if err != nil {
c.logger.Errorf("Can't get current secret: %s", err)
}
user := pgUser
user.password = string(curSecrets.Data["password"])
c.pgUsers[userName] = user
c.logger.Infof("Password fetched for user '%s' from the secrets", userName)
c.pgUsers[username] = user
c.logger.Infof("Password fetched for user '%s' from the secrets", username)
continue
//_, err = c.config.KubeClient.Secrets(c.config.Namespace).Update(&secret)
//if err != nil {
// c.logger.Errorf("Error while updating secret: %+v", err)
//} else {
// c.logger.Infof("Secret updated: %+v", secret)
//}
} else {
if err != nil {
c.logger.Errorf("Error while creating secret: %+v", err)
c.logger.Errorf("Error while creating secret: %s", err)
} else {
c.logger.Infof("Secret created: %s", secret.Name)
c.logger.Infof("Secret created: '%s'", util.FullObjectNameFromMeta(secret.ObjectMeta))
}
}
}
//TODO: remove secrets of the deleted users
}
func (c *Cluster) createService() {
@@ -245,11 +247,11 @@ func (c *Cluster) createService() {
if err != nil {
c.logger.Errorf("Error while creating service: %+v", err)
} else {
c.logger.Infof("Service created: %s", service.Name)
c.logger.Infof("Service created: '%s'", util.FullObjectNameFromMeta(service.ObjectMeta))
}
}
func (c *Cluster) createEndPoint() {
func (c *Cluster) createEndpoint() {
clusterName := (*c.cluster).Metadata.Name
_, err := c.config.KubeClient.Endpoints(c.config.Namespace).Get(clusterName)
@@ -258,18 +260,18 @@ func (c *Cluster) createEndPoint() {
return
}
endPoint := v1.Endpoints{
endpoint := v1.Endpoints{
ObjectMeta: v1.ObjectMeta{
Name: clusterName,
Labels: c.labelsSet(),
},
}
_, err = c.config.KubeClient.Endpoints(c.config.Namespace).Create(&endPoint)
_, err = c.config.KubeClient.Endpoints(c.config.Namespace).Create(&endpoint)
if err != nil {
c.logger.Errorf("Error while creating endpoint: %+v", err)
} else {
c.logger.Infof("Endpoint created: %s", endPoint.Name)
c.logger.Infof("Endpoint created: %s", endpoint.Name)
}
}
@@ -279,28 +281,40 @@ func (c *Cluster) createUser(user pgUser) {
if user.password == "" {
userType = "human"
flags = append(flags, fmt.Sprintf("IN ROLE '%s'", constants.PamRoleName))
flags = append(flags, fmt.Sprintf("IN ROLE \"%s\"", constants.PamRoleName))
} else {
userType = "app"
}
addLoginFlag := true
for _, v := range flags {
if v == "NOLOGIN" {
addLoginFlag = false
break
}
}
if addLoginFlag {
flags = append(flags, "LOGIN")
}
userFlags := strings.Join(flags, " ")
query := fmt.Sprintf(createUserSQL,
user.name,
user.name, userFlags, user.password,
user.name, userFlags, user.password)
userPassword := fmt.Sprintf("'%s'", user.password)
if user.password == "" {
userPassword = "NULL"
}
query := fmt.Sprintf(createUserSQL, user.name, userFlags, userPassword)
_, err := c.pgDb.Query(query)
if err != nil {
c.logger.Errorf("Can't create %s user '%s': %s", user.name, err)
} else {
c.logger.Infof("%s user '%s' with flags %s has been created", userType, user.name, flags)
c.logger.Infof("Created %s user '%s' with %s flags", userType, user.name, flags)
}
}
func (c *Cluster) createUsers() error {
for userName, user := range c.pgUsers {
if userName == superUsername || userName == replicationUsername {
for username, user := range c.pgUsers {
if username == superuserName || username == replicationUsername {
continue
}