2023-05-22 07:31:20 -04:00
|
|
|
/*
|
|
|
|
Copyright (c) Edgeless Systems GmbH
|
|
|
|
|
|
|
|
SPDX-License-Identifier: AGPL-3.0-only
|
|
|
|
*/
|
|
|
|
|
|
|
|
package upgrade
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
|
|
|
"fmt"
|
|
|
|
"io"
|
|
|
|
"os"
|
|
|
|
"path/filepath"
|
|
|
|
"strings"
|
|
|
|
|
2023-06-02 04:47:44 -04:00
|
|
|
"github.com/edgelesssys/constellation/v2/cli/internal/cloudcmd"
|
2023-05-22 07:31:20 -04:00
|
|
|
"github.com/edgelesssys/constellation/v2/cli/internal/clusterid"
|
|
|
|
"github.com/edgelesssys/constellation/v2/cli/internal/terraform"
|
|
|
|
"github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider"
|
|
|
|
"github.com/edgelesssys/constellation/v2/internal/constants"
|
|
|
|
"github.com/edgelesssys/constellation/v2/internal/file"
|
|
|
|
)
|
|
|
|
|
|
|
|
// NewTerraformUpgrader returns a new TerraformUpgrader.
|
2023-07-24 04:30:53 -04:00
|
|
|
func NewTerraformUpgrader(tfClient tfResourceClient, outWriter io.Writer, fileHandler file.Handler) (*TerraformUpgrader, error) {
|
2023-05-22 07:31:20 -04:00
|
|
|
return &TerraformUpgrader{
|
2023-06-02 04:47:44 -04:00
|
|
|
tf: tfClient,
|
|
|
|
policyPatcher: cloudcmd.NewAzurePolicyPatcher(),
|
|
|
|
outWriter: outWriter,
|
2023-07-18 03:33:42 -04:00
|
|
|
fileHandler: fileHandler,
|
2023-05-22 07:31:20 -04:00
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// TerraformUpgrader is responsible for performing Terraform migrations on cluster upgrades.
|
|
|
|
type TerraformUpgrader struct {
|
2023-07-24 04:30:53 -04:00
|
|
|
tf tfResourceClient
|
2023-06-02 04:47:44 -04:00
|
|
|
policyPatcher policyPatcher
|
|
|
|
outWriter io.Writer
|
2023-07-18 03:33:42 -04:00
|
|
|
fileHandler file.Handler
|
2023-05-22 07:31:20 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
// TerraformUpgradeOptions are the options used for the Terraform upgrade.
|
|
|
|
type TerraformUpgradeOptions struct {
|
|
|
|
// LogLevel is the log level used for Terraform.
|
|
|
|
LogLevel terraform.LogLevel
|
|
|
|
// CSP is the cloud provider to perform the upgrade on.
|
|
|
|
CSP cloudprovider.Provider
|
|
|
|
// Vars are the Terraform variables used for the upgrade.
|
|
|
|
Vars terraform.Variables
|
|
|
|
}
|
|
|
|
|
|
|
|
// CheckTerraformMigrations checks whether Terraform migrations are possible in the current workspace.
|
2023-07-24 04:30:53 -04:00
|
|
|
func checkTerraformMigrations(file file.Handler, upgradeID, upgradeSubDir string) error {
|
2023-05-22 07:31:20 -04:00
|
|
|
var existingFiles []string
|
|
|
|
filesToCheck := []string{
|
2023-07-24 04:30:53 -04:00
|
|
|
filepath.Join(constants.UpgradeDir, upgradeID, upgradeSubDir),
|
2023-05-22 07:31:20 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
for _, f := range filesToCheck {
|
2023-07-24 04:30:53 -04:00
|
|
|
if err := checkFileExists(file, &existingFiles, f); err != nil {
|
2023-05-22 07:31:20 -04:00
|
|
|
return fmt.Errorf("checking terraform migrations: %w", err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(existingFiles) > 0 {
|
|
|
|
return fmt.Errorf("file(s) %s already exist", strings.Join(existingFiles, ", "))
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2023-07-24 04:30:53 -04:00
|
|
|
// CheckTerraformMigrations checks whether Terraform migrations are possible in the current workspace.
|
|
|
|
// If the files that will be written during the upgrade already exist, it returns an error.
|
|
|
|
func (u *TerraformUpgrader) CheckTerraformMigrations(upgradeID, upgradeSubDir string) error {
|
|
|
|
return checkTerraformMigrations(u.fileHandler, upgradeID, upgradeSubDir)
|
|
|
|
}
|
|
|
|
|
2023-05-22 07:31:20 -04:00
|
|
|
// checkFileExists checks whether a file exists and adds it to the existingFiles slice if it does.
|
|
|
|
func checkFileExists(fileHandler file.Handler, existingFiles *[]string, filename string) error {
|
|
|
|
_, err := fileHandler.Stat(filename)
|
|
|
|
if err != nil {
|
|
|
|
if !os.IsNotExist(err) {
|
|
|
|
return fmt.Errorf("checking %s: %w", filename, err)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
*existingFiles = append(*existingFiles, filename)
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// PlanTerraformMigrations prepares the upgrade workspace and plans the Terraform migrations for the Constellation upgrade.
|
|
|
|
// If a diff exists, it's being written to the upgrader's output writer. It also returns
|
|
|
|
// a bool indicating whether a diff exists.
|
2023-06-21 03:22:32 -04:00
|
|
|
func (u *TerraformUpgrader) PlanTerraformMigrations(ctx context.Context, opts TerraformUpgradeOptions, upgradeID string) (bool, error) {
|
2023-07-18 03:33:42 -04:00
|
|
|
// Prepare the new Terraform workspace and backup the old one
|
2023-05-22 07:31:20 -04:00
|
|
|
err := u.tf.PrepareUpgradeWorkspace(
|
|
|
|
filepath.Join("terraform", strings.ToLower(opts.CSP.String())),
|
|
|
|
constants.TerraformWorkingDir,
|
2023-06-21 03:22:32 -04:00
|
|
|
filepath.Join(constants.UpgradeDir, upgradeID, constants.TerraformUpgradeWorkingDir),
|
|
|
|
filepath.Join(constants.UpgradeDir, upgradeID, constants.TerraformUpgradeBackupDir),
|
2023-05-22 07:31:20 -04:00
|
|
|
opts.Vars,
|
|
|
|
)
|
|
|
|
if err != nil {
|
|
|
|
return false, fmt.Errorf("preparing terraform workspace: %w", err)
|
|
|
|
}
|
|
|
|
|
2023-07-18 03:33:42 -04:00
|
|
|
// Backup the old constellation-id.json file
|
|
|
|
if err := u.fileHandler.CopyFile(
|
|
|
|
constants.ClusterIDsFileName,
|
|
|
|
filepath.Join(constants.UpgradeDir, upgradeID, constants.ClusterIDsFileName+".old"),
|
|
|
|
); err != nil {
|
|
|
|
return false, fmt.Errorf("backing up %s: %w", constants.ClusterIDsFileName, err)
|
|
|
|
}
|
|
|
|
|
2023-06-27 05:27:50 -04:00
|
|
|
hasDiff, err := u.tf.Plan(ctx, opts.LogLevel, constants.TerraformUpgradePlanFile)
|
2023-05-22 07:31:20 -04:00
|
|
|
if err != nil {
|
|
|
|
return false, fmt.Errorf("terraform plan: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
if hasDiff {
|
|
|
|
if err := u.tf.ShowPlan(ctx, opts.LogLevel, constants.TerraformUpgradePlanFile, u.outWriter); err != nil {
|
|
|
|
return false, fmt.Errorf("terraform show plan: %w", err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return hasDiff, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// CleanUpTerraformMigrations cleans up the Terraform migration workspace, for example when an upgrade is
|
|
|
|
// aborted by the user.
|
2023-07-18 03:33:42 -04:00
|
|
|
func (u *TerraformUpgrader) CleanUpTerraformMigrations(upgradeID string) error {
|
2023-07-24 04:30:53 -04:00
|
|
|
return CleanUpTerraformMigrations(upgradeID, u.fileHandler)
|
|
|
|
}
|
|
|
|
|
|
|
|
// CleanUpTerraformMigrations cleans up the Terraform upgrade directory.
|
|
|
|
func CleanUpTerraformMigrations(upgradeID string, fileHandler file.Handler) error {
|
2023-05-22 07:31:20 -04:00
|
|
|
cleanupFiles := []string{
|
2023-06-21 03:22:32 -04:00
|
|
|
filepath.Join(constants.UpgradeDir, upgradeID),
|
2023-05-22 07:31:20 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
for _, f := range cleanupFiles {
|
2023-07-24 04:30:53 -04:00
|
|
|
if err := fileHandler.RemoveAll(f); err != nil {
|
2023-05-22 07:31:20 -04:00
|
|
|
return fmt.Errorf("cleaning up file %s: %w", f, err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2023-07-24 04:30:53 -04:00
|
|
|
// ApplyTerraformMigrations applies the migrations planned by PlanTerraformMigrations.
|
2023-05-22 07:31:20 -04:00
|
|
|
// If PlanTerraformMigrations has not been executed before, it will return an error.
|
|
|
|
// In case of a successful upgrade, the output will be written to the specified file and the old Terraform directory is replaced
|
|
|
|
// By the new one.
|
2023-07-18 03:33:42 -04:00
|
|
|
func (u *TerraformUpgrader) ApplyTerraformMigrations(ctx context.Context, opts TerraformUpgradeOptions, upgradeID string) error {
|
2023-06-27 05:27:50 -04:00
|
|
|
tfOutput, err := u.tf.CreateCluster(ctx, opts.LogLevel)
|
2023-05-22 07:31:20 -04:00
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("terraform apply: %w", err)
|
|
|
|
}
|
|
|
|
|
2023-06-02 04:47:44 -04:00
|
|
|
// AttestationURL is only set for Azure.
|
|
|
|
if tfOutput.AttestationURL != "" {
|
|
|
|
if err := u.policyPatcher.Patch(ctx, tfOutput.AttestationURL); err != nil {
|
|
|
|
return fmt.Errorf("patching policies: %w", err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-05-22 07:31:20 -04:00
|
|
|
outputFileContents := clusterid.File{
|
2023-07-21 10:43:51 -04:00
|
|
|
CloudProvider: opts.CSP,
|
|
|
|
InitSecret: []byte(tfOutput.Secret),
|
|
|
|
IP: tfOutput.IP,
|
|
|
|
APIServerCertSANs: tfOutput.APIServerCertSANs,
|
|
|
|
UID: tfOutput.UID,
|
|
|
|
AttestationURL: tfOutput.AttestationURL,
|
2023-05-22 07:31:20 -04:00
|
|
|
}
|
|
|
|
|
2023-07-18 03:33:42 -04:00
|
|
|
if err := u.fileHandler.RemoveAll(constants.TerraformWorkingDir); err != nil {
|
2023-05-22 07:31:20 -04:00
|
|
|
return fmt.Errorf("removing old terraform directory: %w", err)
|
|
|
|
}
|
|
|
|
|
2023-07-18 03:33:42 -04:00
|
|
|
if err := u.fileHandler.CopyDir(filepath.Join(constants.UpgradeDir, upgradeID, constants.TerraformUpgradeWorkingDir), constants.TerraformWorkingDir); err != nil {
|
2023-05-22 07:31:20 -04:00
|
|
|
return fmt.Errorf("replacing old terraform directory with new one: %w", err)
|
|
|
|
}
|
|
|
|
|
2023-07-18 03:33:42 -04:00
|
|
|
if err := u.fileHandler.RemoveAll(filepath.Join(constants.UpgradeDir, upgradeID, constants.TerraformUpgradeWorkingDir)); err != nil {
|
2023-05-22 07:31:20 -04:00
|
|
|
return fmt.Errorf("removing terraform upgrade directory: %w", err)
|
|
|
|
}
|
|
|
|
|
2023-07-18 03:33:42 -04:00
|
|
|
if err := u.mergeClusterIDFile(outputFileContents); err != nil {
|
|
|
|
return fmt.Errorf("merging migration output into %s: %w", constants.ClusterIDsFileName, err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// mergeClusterIDFile merges the output of the migration into the constellation-id.json file.
|
|
|
|
func (u *TerraformUpgrader) mergeClusterIDFile(migrationOutput clusterid.File) error {
|
|
|
|
idFile := &clusterid.File{}
|
|
|
|
if err := u.fileHandler.ReadJSON(constants.ClusterIDsFileName, idFile); err != nil {
|
|
|
|
return fmt.Errorf("reading %s: %w", constants.ClusterIDsFileName, err)
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := u.fileHandler.WriteJSON(constants.ClusterIDsFileName, idFile.Merge(migrationOutput), file.OptOverwrite); err != nil {
|
|
|
|
return fmt.Errorf("writing %s: %w", constants.ClusterIDsFileName, err)
|
2023-05-22 07:31:20 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2023-07-24 04:30:53 -04:00
|
|
|
type tfClientCommon interface {
|
2023-05-22 07:31:20 -04:00
|
|
|
ShowPlan(ctx context.Context, logLevel terraform.LogLevel, planFilePath string, output io.Writer) error
|
2023-06-27 05:27:50 -04:00
|
|
|
Plan(ctx context.Context, logLevel terraform.LogLevel, planFile string) (bool, error)
|
2023-07-24 04:30:53 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
// tfResourceClient is a Terraform client for managing cluster resources.
|
|
|
|
type tfResourceClient interface {
|
|
|
|
PrepareUpgradeWorkspace(path, oldWorkingDir, newWorkingDir, backupDir string, vars terraform.Variables) error
|
2023-07-21 10:43:51 -04:00
|
|
|
CreateCluster(ctx context.Context, logLevel terraform.LogLevel) (terraform.ApplyOutput, error)
|
2023-07-24 04:30:53 -04:00
|
|
|
tfClientCommon
|
|
|
|
}
|
|
|
|
|
|
|
|
// tfIAMClient is a Terraform client for managing IAM resources.
|
|
|
|
type tfIAMClient interface {
|
|
|
|
ApplyIAMConfig(ctx context.Context, csp cloudprovider.Provider, logLevel terraform.LogLevel) (terraform.IAMOutput, error)
|
|
|
|
tfClientCommon
|
2023-05-22 07:31:20 -04:00
|
|
|
}
|
2023-06-02 04:47:44 -04:00
|
|
|
|
|
|
|
// policyPatcher interacts with the CSP (currently only applies for Azure) to update the attestation policy.
|
|
|
|
type policyPatcher interface {
|
|
|
|
Patch(ctx context.Context, attestationURL string) error
|
|
|
|
}
|