2022-09-05 03:06:08 -04:00
|
|
|
/*
|
|
|
|
Copyright (c) Edgeless Systems GmbH
|
|
|
|
|
|
|
|
SPDX-License-Identifier: AGPL-3.0-only
|
|
|
|
*/
|
|
|
|
|
2022-05-19 11:12:03 -04:00
|
|
|
package k8sapi
|
|
|
|
|
|
|
|
import (
|
|
|
|
"archive/tar"
|
|
|
|
"compress/gzip"
|
|
|
|
"context"
|
|
|
|
"errors"
|
|
|
|
"fmt"
|
|
|
|
"io"
|
|
|
|
"io/fs"
|
|
|
|
"net/http"
|
|
|
|
"os"
|
|
|
|
"path"
|
2022-07-21 09:20:12 -04:00
|
|
|
"time"
|
2022-05-19 11:12:03 -04:00
|
|
|
|
2022-09-21 07:47:57 -04:00
|
|
|
"github.com/edgelesssys/constellation/v2/internal/retry"
|
2022-05-19 11:12:03 -04:00
|
|
|
"github.com/spf13/afero"
|
|
|
|
"golang.org/x/text/transform"
|
2022-07-21 09:20:12 -04:00
|
|
|
"k8s.io/utils/clock"
|
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
|
|
|
// determines the period after which retryDownloadToTempDir will retry a download.
|
|
|
|
downloadInterval = 10 * time.Millisecond
|
2022-05-19 11:12:03 -04:00
|
|
|
)
|
|
|
|
|
|
|
|
// osInstaller installs binary components of supported kubernetes versions.
|
|
|
|
type osInstaller struct {
|
|
|
|
fs *afero.Afero
|
|
|
|
hClient httpClient
|
2022-07-21 09:20:12 -04:00
|
|
|
// clock is needed for testing purposes
|
|
|
|
clock clock.WithTicker
|
|
|
|
// retriable is the function used to check if an error is retriable. Needed for testing.
|
|
|
|
retriable func(error) bool
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
// newOSInstaller creates a new osInstaller.
|
|
|
|
func newOSInstaller() *osInstaller {
|
|
|
|
return &osInstaller{
|
2022-07-21 09:20:12 -04:00
|
|
|
fs: &afero.Afero{Fs: afero.NewOsFs()},
|
|
|
|
hClient: &http.Client{},
|
|
|
|
clock: clock.RealClock{},
|
2022-07-22 05:10:39 -04:00
|
|
|
retriable: isRetriable,
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Install downloads a resource from a URL, applies any given text transformations and extracts the resulting file if required.
|
|
|
|
// The resulting file(s) are copied to all destinations.
|
|
|
|
func (i *osInstaller) Install(
|
|
|
|
ctx context.Context, sourceURL string, destinations []string, perm fs.FileMode,
|
|
|
|
extract bool, transforms ...transform.Transformer,
|
|
|
|
) error {
|
2022-07-21 09:20:12 -04:00
|
|
|
tempPath, err := i.retryDownloadToTempDir(ctx, sourceURL, transforms...)
|
2022-05-19 11:12:03 -04:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
defer func() {
|
|
|
|
_ = i.fs.Remove(tempPath)
|
|
|
|
}()
|
|
|
|
for _, destination := range destinations {
|
|
|
|
var err error
|
|
|
|
if extract {
|
|
|
|
err = i.extractArchive(tempPath, destination, perm)
|
|
|
|
} else {
|
|
|
|
err = i.copy(tempPath, destination, perm)
|
|
|
|
}
|
|
|
|
if err != nil {
|
2022-06-09 10:04:30 -04:00
|
|
|
return fmt.Errorf("installing from %q: copying to destination %q: %w", sourceURL, destination, err)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// extractArchive extracts tar gz archives to a prefixed destination.
|
|
|
|
func (i *osInstaller) extractArchive(archivePath, prefix string, perm fs.FileMode) error {
|
|
|
|
archiveFile, err := i.fs.Open(archivePath)
|
|
|
|
if err != nil {
|
2022-06-09 10:04:30 -04:00
|
|
|
return fmt.Errorf("opening archive file: %w", err)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
defer archiveFile.Close()
|
|
|
|
gzReader, err := gzip.NewReader(archiveFile)
|
|
|
|
if err != nil {
|
2022-06-09 10:04:30 -04:00
|
|
|
return fmt.Errorf("reading archive file as gzip: %w", err)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
defer gzReader.Close()
|
|
|
|
if err := i.fs.MkdirAll(prefix, fs.ModePerm); err != nil {
|
2022-06-09 10:04:30 -04:00
|
|
|
return fmt.Errorf("creating prefix folder: %w", err)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
tarReader := tar.NewReader(gzReader)
|
|
|
|
|
|
|
|
for {
|
|
|
|
header, err := tarReader.Next()
|
|
|
|
if err == io.EOF {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
if err != nil {
|
2022-06-09 10:04:30 -04:00
|
|
|
return fmt.Errorf("parsing tar header: %w", err)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
if err := verifyTarPath(header.Name); err != nil {
|
2022-06-09 10:04:30 -04:00
|
|
|
return fmt.Errorf("verifying tar path %q: %w", header.Name, err)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
switch header.Typeflag {
|
|
|
|
case tar.TypeDir:
|
|
|
|
if len(header.Name) == 0 {
|
|
|
|
return errors.New("cannot create dir for empty path")
|
|
|
|
}
|
2022-06-09 10:10:42 -04:00
|
|
|
prefixedPath := path.Join(prefix, header.Name)
|
|
|
|
if err := i.fs.Mkdir(prefixedPath, fs.FileMode(header.Mode)&perm); err != nil && !errors.Is(err, os.ErrExist) {
|
|
|
|
return fmt.Errorf("creating folder %q: %w", prefixedPath, err)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
case tar.TypeReg:
|
|
|
|
if len(header.Name) == 0 {
|
|
|
|
return errors.New("cannot create file for empty path")
|
|
|
|
}
|
2022-06-09 10:10:42 -04:00
|
|
|
prefixedPath := path.Join(prefix, header.Name)
|
|
|
|
out, err := i.fs.OpenFile(prefixedPath, os.O_WRONLY|os.O_CREATE, fs.FileMode(header.Mode))
|
2022-05-19 11:12:03 -04:00
|
|
|
if err != nil {
|
2022-06-09 10:10:42 -04:00
|
|
|
return fmt.Errorf("creating file %q for writing: %w", prefixedPath, err)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
defer out.Close()
|
|
|
|
if _, err := io.Copy(out, tarReader); err != nil {
|
2022-06-09 10:04:30 -04:00
|
|
|
return fmt.Errorf("writing extracted file contents: %w", err)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
case tar.TypeSymlink:
|
|
|
|
if err := verifyTarPath(header.Linkname); err != nil {
|
|
|
|
return fmt.Errorf("invalid tar path %q: %w", header.Linkname, err)
|
|
|
|
}
|
|
|
|
if len(header.Name) == 0 {
|
|
|
|
return errors.New("cannot symlink file for empty oldname")
|
|
|
|
}
|
|
|
|
if len(header.Linkname) == 0 {
|
|
|
|
return errors.New("cannot symlink file for empty newname")
|
|
|
|
}
|
|
|
|
if symlinker, ok := i.fs.Fs.(afero.Symlinker); ok {
|
|
|
|
if err := symlinker.SymlinkIfPossible(path.Join(prefix, header.Name), path.Join(prefix, header.Linkname)); err != nil {
|
2022-06-09 10:04:30 -04:00
|
|
|
return fmt.Errorf("creating symlink: %w", err)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
} else {
|
|
|
|
return errors.New("fs does not support symlinks")
|
|
|
|
}
|
|
|
|
default:
|
|
|
|
return fmt.Errorf("unsupported tar record: %v", header.Typeflag)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-07-21 09:20:12 -04:00
|
|
|
func (i *osInstaller) retryDownloadToTempDir(ctx context.Context, url string, transforms ...transform.Transformer) (fileName string, someError error) {
|
|
|
|
doer := downloadDoer{
|
|
|
|
url: url,
|
|
|
|
transforms: transforms,
|
|
|
|
downloader: i,
|
|
|
|
}
|
|
|
|
|
2022-07-22 05:10:39 -04:00
|
|
|
// Retries are canceled as soon as the context is canceled.
|
2022-07-21 09:20:12 -04:00
|
|
|
// We need to call NewIntervalRetrier with a clock argument so that the tests can fake the clock by changing the osInstaller clock.
|
|
|
|
retrier := retry.NewIntervalRetrier(&doer, downloadInterval, i.retriable, i.clock)
|
|
|
|
if err := retrier.Do(ctx); err != nil {
|
|
|
|
return "", fmt.Errorf("retrying downloadToTempDir: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return doer.path, nil
|
|
|
|
}
|
|
|
|
|
2022-05-19 11:12:03 -04:00
|
|
|
// downloadToTempDir downloads a file to a temporary location, applying transform on-the-fly.
|
2022-07-21 09:20:12 -04:00
|
|
|
func (i *osInstaller) downloadToTempDir(ctx context.Context, url string, transforms ...transform.Transformer) (fileName string, retErr error) {
|
2022-05-19 11:12:03 -04:00
|
|
|
out, err := afero.TempFile(i.fs, "", "")
|
|
|
|
if err != nil {
|
2022-06-09 10:04:30 -04:00
|
|
|
return "", fmt.Errorf("creating destination temp file: %w", err)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
2022-07-21 09:20:12 -04:00
|
|
|
// Remove the created file if an error occurs.
|
|
|
|
defer func() {
|
|
|
|
if retErr != nil {
|
|
|
|
_ = i.fs.Remove(fileName)
|
2022-07-22 05:10:39 -04:00
|
|
|
retErr = &retriableError{err: retErr} // mark any error after this point as retriable
|
2022-07-21 09:20:12 -04:00
|
|
|
}
|
|
|
|
}()
|
2022-05-19 11:12:03 -04:00
|
|
|
defer out.Close()
|
2022-07-21 09:20:12 -04:00
|
|
|
|
2022-05-19 11:12:03 -04:00
|
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
|
|
|
|
if err != nil {
|
2022-06-09 10:04:30 -04:00
|
|
|
return "", fmt.Errorf("request to download %q: %w", url, err)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
resp, err := i.hClient.Do(req)
|
|
|
|
if err != nil {
|
2022-06-09 10:04:30 -04:00
|
|
|
return "", fmt.Errorf("request to download %q: %w", url, err)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
if resp.StatusCode != http.StatusOK {
|
|
|
|
return "", fmt.Errorf("request to download %q failed with status code: %v", url, resp.Status)
|
|
|
|
}
|
|
|
|
defer resp.Body.Close()
|
|
|
|
|
|
|
|
transformReader := transform.NewReader(resp.Body, transform.Chain(transforms...))
|
|
|
|
|
|
|
|
if _, err = io.Copy(out, transformReader); err != nil {
|
2022-06-09 10:04:30 -04:00
|
|
|
return "", fmt.Errorf("downloading %q: %w", url, err)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
return out.Name(), nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// copy copies a file from oldname to newname.
|
|
|
|
func (i *osInstaller) copy(oldname, newname string, perm fs.FileMode) (err error) {
|
|
|
|
old, openOldErr := i.fs.OpenFile(oldname, os.O_RDONLY, fs.ModePerm)
|
|
|
|
if openOldErr != nil {
|
2022-06-09 10:04:30 -04:00
|
|
|
return fmt.Errorf("copying %q to %q: cannot open source file for reading: %w", oldname, newname, openOldErr)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
defer func() { _ = old.Close() }()
|
|
|
|
// create destination path if not exists
|
|
|
|
if err := i.fs.MkdirAll(path.Dir(newname), fs.ModePerm); err != nil {
|
2022-06-09 10:04:30 -04:00
|
|
|
return fmt.Errorf("copying %q to %q: unable to create destination folder: %w", oldname, newname, err)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
new, openNewErr := i.fs.OpenFile(newname, os.O_WRONLY|os.O_TRUNC|os.O_CREATE, perm)
|
|
|
|
if openNewErr != nil {
|
2022-06-09 10:04:30 -04:00
|
|
|
return fmt.Errorf("copying %q to %q: cannot open destination file for writing: %w", oldname, newname, openNewErr)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
defer func() {
|
|
|
|
_ = new.Close()
|
|
|
|
if err != nil {
|
|
|
|
_ = i.fs.Remove(newname)
|
|
|
|
}
|
|
|
|
}()
|
|
|
|
if _, err := io.Copy(new, old); err != nil {
|
2022-06-09 10:04:30 -04:00
|
|
|
return fmt.Errorf("copying %q to %q: copying file contents: %w", oldname, newname, err)
|
2022-05-19 11:12:03 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-07-21 09:20:12 -04:00
|
|
|
type downloadDoer struct {
|
|
|
|
url string
|
|
|
|
transforms []transform.Transformer
|
|
|
|
downloader downloader
|
|
|
|
path string
|
|
|
|
}
|
|
|
|
|
|
|
|
type downloader interface {
|
|
|
|
downloadToTempDir(ctx context.Context, url string, transforms ...transform.Transformer) (string, error)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (d *downloadDoer) Do(ctx context.Context) error {
|
|
|
|
path, err := d.downloader.downloadToTempDir(ctx, d.url, d.transforms...)
|
|
|
|
d.path = path
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2022-07-22 05:10:39 -04:00
|
|
|
// retriableError is an error that can be retried.
|
|
|
|
type retriableError struct{ err error }
|
|
|
|
|
|
|
|
func (e *retriableError) Error() string {
|
|
|
|
return fmt.Sprintf("retriable error: %s", e.err.Error())
|
|
|
|
}
|
|
|
|
|
|
|
|
func (e *retriableError) Unwrap() error { return e.err }
|
|
|
|
|
|
|
|
// isRetriable returns true if the action resulting in this error can be retried.
|
|
|
|
func isRetriable(err error) bool {
|
|
|
|
retriableError := &retriableError{}
|
|
|
|
return errors.As(err, &retriableError)
|
2022-07-21 09:20:12 -04:00
|
|
|
}
|
|
|
|
|
2022-05-19 11:12:03 -04:00
|
|
|
// verifyTarPath checks if a tar path is valid (must not contain ".." as path element).
|
|
|
|
func verifyTarPath(pat string) error {
|
|
|
|
n := len(pat)
|
|
|
|
r := 0
|
|
|
|
for r < n {
|
|
|
|
switch {
|
|
|
|
case os.IsPathSeparator(pat[r]):
|
|
|
|
// empty path element
|
|
|
|
r++
|
|
|
|
case pat[r] == '.' && (r+1 == n || os.IsPathSeparator(pat[r+1])):
|
|
|
|
// . element
|
|
|
|
r++
|
|
|
|
case pat[r] == '.' && pat[r+1] == '.' && (r+2 == n || os.IsPathSeparator(pat[r+2])):
|
|
|
|
// .. element
|
|
|
|
return errors.New("path contains \"..\"")
|
|
|
|
default:
|
|
|
|
// skip to next path element
|
|
|
|
for r < n && !os.IsPathSeparator(pat[r]) {
|
|
|
|
r++
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
type httpClient interface {
|
|
|
|
Do(req *http.Request) (*http.Response, error)
|
|
|
|
}
|