2023-03-07 05:37:08 -05:00
|
|
|
/*
|
|
|
|
Copyright (c) Edgeless Systems GmbH
|
|
|
|
|
|
|
|
SPDX-License-Identifier: AGPL-3.0-only
|
|
|
|
*/
|
|
|
|
|
|
|
|
package openstack
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
|
|
|
"fmt"
|
|
|
|
"net/http"
|
2023-03-07 05:37:25 -05:00
|
|
|
"net/netip"
|
2023-07-21 10:43:51 -04:00
|
|
|
"strconv"
|
2023-03-07 05:37:25 -05:00
|
|
|
"strings"
|
2023-03-07 05:37:08 -05:00
|
|
|
|
|
|
|
"github.com/edgelesssys/constellation/v2/internal/cloud/metadata"
|
2023-07-21 10:43:51 -04:00
|
|
|
"github.com/edgelesssys/constellation/v2/internal/constants"
|
2023-03-07 05:37:25 -05:00
|
|
|
"github.com/edgelesssys/constellation/v2/internal/role"
|
2024-08-08 04:37:09 -04:00
|
|
|
"github.com/gophercloud/gophercloud/v2/openstack/compute/v2/servers"
|
|
|
|
"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/networks"
|
|
|
|
"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/subnets"
|
|
|
|
"github.com/gophercloud/utils/v2/openstack/clientconfig"
|
2023-03-07 05:37:25 -05:00
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
|
|
|
roleTagFormat = "constellation-role-%s"
|
|
|
|
microversion = "2.42"
|
2023-03-07 05:37:08 -05:00
|
|
|
)
|
|
|
|
|
2024-03-11 05:15:20 -04:00
|
|
|
// MetadataClient is the metadata client for OpenStack.
|
|
|
|
type MetadataClient struct {
|
2023-03-07 05:37:25 -05:00
|
|
|
api serversAPI
|
2023-03-07 05:37:08 -05:00
|
|
|
imds imdsAPI
|
|
|
|
}
|
|
|
|
|
|
|
|
// New creates a new OpenStack metadata client.
|
2024-03-11 05:15:20 -04:00
|
|
|
func New(ctx context.Context) (*MetadataClient, error) {
|
2023-03-07 05:37:08 -05:00
|
|
|
imds := &imdsClient{client: &http.Client{}}
|
2023-03-07 05:37:25 -05:00
|
|
|
|
|
|
|
authURL, err := imds.authURL(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("getting auth URL: %w", err)
|
|
|
|
}
|
|
|
|
username, err := imds.username(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("getting token name: %w", err)
|
|
|
|
}
|
|
|
|
password, err := imds.password(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("getting token password: %w", err)
|
|
|
|
}
|
|
|
|
userDomainName, err := imds.userDomainName(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("getting user domain name: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
clientOpts := &clientconfig.ClientOpts{
|
|
|
|
AuthType: clientconfig.AuthV3Password,
|
|
|
|
AuthInfo: &clientconfig.AuthInfo{
|
|
|
|
AuthURL: authURL,
|
|
|
|
UserDomainName: userDomainName,
|
|
|
|
Username: username,
|
|
|
|
Password: password,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
2024-08-08 04:37:09 -04:00
|
|
|
serversClient, err := clientconfig.NewServiceClient(ctx, "compute", clientOpts)
|
2023-03-07 05:37:25 -05:00
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("creating compute client: %w", err)
|
|
|
|
}
|
|
|
|
serversClient.Microversion = microversion
|
|
|
|
|
2024-08-08 04:37:09 -04:00
|
|
|
networksClient, err := clientconfig.NewServiceClient(ctx, "network", clientOpts)
|
2023-03-07 05:37:25 -05:00
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("creating network client: %w", err)
|
|
|
|
}
|
2024-02-15 04:43:48 -05:00
|
|
|
networksClient.Microversion = microversion
|
2023-03-07 05:37:25 -05:00
|
|
|
|
2024-03-11 05:15:20 -04:00
|
|
|
return &MetadataClient{
|
2023-03-07 05:37:25 -05:00
|
|
|
imds: imds,
|
|
|
|
api: &apiClient{
|
2024-02-15 04:43:48 -05:00
|
|
|
servers: serversClient,
|
|
|
|
networks: networksClient,
|
2023-03-07 05:37:25 -05:00
|
|
|
},
|
|
|
|
}, nil
|
2023-03-07 05:37:08 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
// Self returns the metadata of the current instance.
|
2024-03-11 05:15:20 -04:00
|
|
|
func (c *MetadataClient) Self(ctx context.Context) (metadata.InstanceMetadata, error) {
|
2023-03-07 05:37:08 -05:00
|
|
|
name, err := c.imds.name(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return metadata.InstanceMetadata{}, fmt.Errorf("getting name: %w", err)
|
|
|
|
}
|
|
|
|
providerID, err := c.imds.providerID(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return metadata.InstanceMetadata{}, fmt.Errorf("getting provider id: %w", err)
|
|
|
|
}
|
|
|
|
role, err := c.imds.role(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return metadata.InstanceMetadata{}, fmt.Errorf("getting role: %w", err)
|
|
|
|
}
|
|
|
|
vpcIP, err := c.imds.vpcIP(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return metadata.InstanceMetadata{}, fmt.Errorf("getting vpc ip: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return metadata.InstanceMetadata{
|
|
|
|
Name: name,
|
|
|
|
ProviderID: providerID,
|
|
|
|
Role: role,
|
|
|
|
VPCIP: vpcIP,
|
|
|
|
}, nil
|
|
|
|
}
|
2023-03-07 05:37:25 -05:00
|
|
|
|
|
|
|
// List returns the metadata of all instances belonging to the same Constellation cluster.
|
2024-03-11 05:15:20 -04:00
|
|
|
func (c *MetadataClient) List(ctx context.Context) ([]metadata.InstanceMetadata, error) {
|
2023-03-07 05:37:25 -05:00
|
|
|
uid, err := c.imds.uid(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("getting uid: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
uidTag := fmt.Sprintf("constellation-uid-%s", uid)
|
|
|
|
|
2024-08-08 04:37:09 -04:00
|
|
|
subnet, err := c.getSubnetCIDR(ctx, uidTag)
|
2023-03-07 05:37:25 -05:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2024-08-08 04:37:09 -04:00
|
|
|
srvs, err := c.getServers(ctx, uidTag)
|
2023-03-07 05:37:25 -05:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
var result []metadata.InstanceMetadata
|
|
|
|
for _, s := range srvs {
|
|
|
|
if s.Name == "" {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
if s.ID == "" {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
if s.Tags == nil {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
var serverRole role.Role
|
|
|
|
for _, t := range *s.Tags {
|
|
|
|
if strings.HasPrefix(t, "constellation-role-") {
|
|
|
|
serverRole = role.FromString(strings.TrimPrefix(t, "constellation-role-"))
|
|
|
|
break
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if serverRole == role.Unknown {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
subnetAddrs, err := parseSeverAddresses(s.Addresses)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("parsing server %q addresses: %w", s.Name, err)
|
|
|
|
}
|
|
|
|
|
|
|
|
var vpcIP string
|
|
|
|
// In a best effort approach, we take the first fixed IPv4 address that is in the subnet
|
|
|
|
// belonging to our cluster.
|
|
|
|
for _, serverSubnet := range subnetAddrs {
|
|
|
|
for _, addr := range serverSubnet.Addresses {
|
|
|
|
if addr.Type != fixedIP {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
if addr.IPVersion != ipV4 {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
if addr.IP == "" {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
parsedAddr, err := netip.ParseAddr(addr.IP)
|
|
|
|
if err != nil {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
if !subnet.Contains(parsedAddr) {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
vpcIP = addr.IP
|
|
|
|
break
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if vpcIP == "" {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
im := metadata.InstanceMetadata{
|
|
|
|
Name: s.Name,
|
|
|
|
ProviderID: s.ID,
|
|
|
|
Role: serverRole,
|
|
|
|
VPCIP: vpcIP,
|
|
|
|
}
|
|
|
|
result = append(result, im)
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(result) == 0 {
|
|
|
|
return nil, fmt.Errorf("no instances belonging to this cluster found")
|
|
|
|
}
|
|
|
|
|
|
|
|
return result, nil
|
|
|
|
}
|
|
|
|
|
2023-03-17 04:24:39 -04:00
|
|
|
// UID retrieves the UID of the constellation.
|
2024-03-11 05:15:20 -04:00
|
|
|
func (c *MetadataClient) UID(ctx context.Context) (string, error) {
|
2023-03-17 04:24:39 -04:00
|
|
|
uid, err := c.imds.uid(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return "", fmt.Errorf("retrieving instance UID: %w", err)
|
|
|
|
}
|
|
|
|
return uid, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// InitSecretHash retrieves the InitSecretHash of the current instance.
|
2024-03-11 05:15:20 -04:00
|
|
|
func (c *MetadataClient) InitSecretHash(ctx context.Context) ([]byte, error) {
|
2023-03-17 04:24:39 -04:00
|
|
|
initSecretHash, err := c.imds.initSecretHash(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("retrieving init secret hash: %w", err)
|
|
|
|
}
|
|
|
|
return []byte(initSecretHash), nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetLoadBalancerEndpoint returns the endpoint of the load balancer.
|
|
|
|
// For OpenStack, the load balancer is a floating ip attached to
|
|
|
|
// a control plane node.
|
|
|
|
// TODO(malt3): Rewrite to use real load balancer once it is available.
|
2024-03-11 05:15:20 -04:00
|
|
|
func (c *MetadataClient) GetLoadBalancerEndpoint(ctx context.Context) (host, port string, err error) {
|
2024-02-22 11:39:34 -05:00
|
|
|
host, err = c.imds.loadBalancerEndpoint(ctx)
|
2023-07-21 10:43:51 -04:00
|
|
|
if err != nil {
|
2024-02-22 11:39:34 -05:00
|
|
|
return "", "", fmt.Errorf("getting load balancer endpoint: %w", err)
|
2023-07-21 10:43:51 -04:00
|
|
|
}
|
|
|
|
return host, strconv.FormatInt(constants.KubernetesPort, 10), nil
|
|
|
|
}
|
|
|
|
|
2024-08-08 04:37:09 -04:00
|
|
|
func (c *MetadataClient) getSubnetCIDR(ctx context.Context, uidTag string) (netip.Prefix, error) {
|
2024-02-15 04:43:48 -05:00
|
|
|
listNetworksOpts := networks.ListOpts{Tags: uidTag}
|
2024-08-08 04:37:09 -04:00
|
|
|
networksPage, err := c.api.ListNetworks(listNetworksOpts).AllPages(ctx)
|
2024-02-15 04:43:48 -05:00
|
|
|
if err != nil {
|
|
|
|
return netip.Prefix{}, fmt.Errorf("listing networks: %w", err)
|
|
|
|
}
|
|
|
|
nets, err := networks.ExtractNetworks(networksPage)
|
|
|
|
if err != nil {
|
|
|
|
return netip.Prefix{}, fmt.Errorf("extracting networks: %w", err)
|
|
|
|
}
|
|
|
|
if len(nets) != 1 {
|
|
|
|
return netip.Prefix{}, fmt.Errorf("expected exactly one network, got %d", len(nets))
|
|
|
|
}
|
|
|
|
|
2023-03-07 05:37:25 -05:00
|
|
|
listSubnetsOpts := subnets.ListOpts{Tags: uidTag}
|
2024-08-08 04:37:09 -04:00
|
|
|
subnetsPage, err := c.api.ListSubnets(listSubnetsOpts).AllPages(ctx)
|
2023-03-07 05:37:25 -05:00
|
|
|
if err != nil {
|
|
|
|
return netip.Prefix{}, fmt.Errorf("listing subnets: %w", err)
|
|
|
|
}
|
|
|
|
|
2024-02-15 04:43:48 -05:00
|
|
|
snets, err := subnets.ExtractSubnets(subnetsPage)
|
2023-03-07 05:37:25 -05:00
|
|
|
if err != nil {
|
|
|
|
return netip.Prefix{}, fmt.Errorf("extracting subnets: %w", err)
|
|
|
|
}
|
|
|
|
|
2024-02-15 04:43:48 -05:00
|
|
|
if len(snets) < 1 {
|
|
|
|
return netip.Prefix{}, fmt.Errorf("expected at least one subnet, got %d", len(snets))
|
|
|
|
}
|
|
|
|
|
|
|
|
var rawCIDR string
|
|
|
|
for _, n := range snets {
|
|
|
|
if n.Name == nets[0].Name {
|
|
|
|
rawCIDR = n.CIDR
|
|
|
|
break
|
|
|
|
}
|
2023-03-07 05:37:25 -05:00
|
|
|
}
|
|
|
|
|
2024-02-15 04:43:48 -05:00
|
|
|
cidr, err := netip.ParsePrefix(rawCIDR)
|
2023-03-07 05:37:25 -05:00
|
|
|
if err != nil {
|
|
|
|
return netip.Prefix{}, fmt.Errorf("parsing subnet CIDR: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return cidr, nil
|
|
|
|
}
|
|
|
|
|
2024-08-08 04:37:09 -04:00
|
|
|
func (c *MetadataClient) getServers(ctx context.Context, uidTag string) ([]servers.Server, error) {
|
2023-03-07 05:37:25 -05:00
|
|
|
listServersOpts := servers.ListOpts{Tags: uidTag}
|
2024-08-08 04:37:09 -04:00
|
|
|
serversPage, err := c.api.ListServers(listServersOpts).AllPages(ctx)
|
2023-03-07 05:37:25 -05:00
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("listing servers: %w", err)
|
|
|
|
}
|
|
|
|
servers, err := servers.ExtractServers(serversPage)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("extracting servers: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return servers, nil
|
|
|
|
}
|