mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-07-19 21:38:44 -04:00
cli: Terraform migrations on upgrade (#1685)
* add terraform planning * overwrite terraform files in upgrade workspace * Revert "overwrite terraform files in upgrade workspace" This reverts commit 8bdacfb8bef23ef2cdbdb06bad0855b3bbc42df0. * prepare terraform workspace * test upgrade integration * print upgrade abort * rename plan file * write output to file * add show plan test * add upgrade tf workdir * fix workspace preparing * squash to 1 command * test * bazel build * plan test * register flag manually * bazel tidy * fix linter * remove MAA variable * fix workdir * accept tf variables * variable fetching * fix resource indices * accept Terraform targets * refactor upgrade command * Terraform migration apply unit test * pass down image fetcher to test * use new flags in e2e test * move file name to constant * update buildfiles * fix version constant * conditionally create MAA * move interface down * upgrade dir * update buildfiles * fix interface * fix createMAA check * fix imports * update buildfiles * wip: workspace backup * copy utils * backup upgrade workspace * remove debug print * replace old state after upgrade * check if flag exists * prepare test workspace * remove prefix Co-authored-by: Otto Bittner <cobittner@posteo.net> * respect file permissions * refactor tf upgrader * check workspace before upgrades * remove temp upgrade dir after completion * clean up workspace after abortion * fix upgrade apply test * fix linter --------- Co-authored-by: Otto Bittner <cobittner@posteo.net>
This commit is contained in:
Moritz Sanft
GitHub
parent
339e750c18
commit
c69e6777bd
21 changed files with 1391 additions and 44 deletions
34
cli/internal/upgrade/BUILD.bazel
Normal file
34
cli/internal/upgrade/BUILD.bazel
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
load("@io_bazel_rules_go//go:def.bzl", "go_library")
|
||||
load("//bazel/go:go_test.bzl", "go_test")
|
||||
|
||||
go_library(
|
||||
name = "upgrade",
|
||||
srcs = [
|
||||
"terraform.go",
|
||||
"upgrade.go",
|
||||
],
|
||||
importpath = "github.com/edgelesssys/constellation/v2/cli/internal/upgrade",
|
||||
visibility = ["//cli:__subpackages__"],
|
||||
deps = [
|
||||
"//cli/internal/clusterid",
|
||||
"//cli/internal/terraform",
|
||||
"//internal/cloud/cloudprovider",
|
||||
"//internal/constants",
|
||||
"//internal/file",
|
||||
],
|
||||
)
|
||||
|
||||
go_test(
|
||||
name = "upgrade_test",
|
||||
srcs = ["terraform_test.go"],
|
||||
embed = [":upgrade"],
|
||||
deps = [
|
||||
"//cli/internal/terraform",
|
||||
"//internal/cloud/cloudprovider",
|
||||
"//internal/constants",
|
||||
"//internal/file",
|
||||
"@com_github_spf13_afero//:afero",
|
||||
"@com_github_stretchr_testify//assert",
|
||||
"@com_github_stretchr_testify//require",
|
||||
],
|
||||
)
|
||||
175
cli/internal/upgrade/terraform.go
Normal file
175
cli/internal/upgrade/terraform.go
Normal file
|
|
@ -0,0 +1,175 @@
|
|||
/*
|
||||
Copyright (c) Edgeless Systems GmbH
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
package upgrade
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"github.com/edgelesssys/constellation/v2/cli/internal/clusterid"
|
||||
"github.com/edgelesssys/constellation/v2/cli/internal/terraform"
|
||||
"github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider"
|
||||
"github.com/edgelesssys/constellation/v2/internal/constants"
|
||||
"github.com/edgelesssys/constellation/v2/internal/file"
|
||||
)
|
||||
|
||||
// NewTerraformUpgrader returns a new TerraformUpgrader.
|
||||
func NewTerraformUpgrader(tfClient tfClient, outWriter io.Writer) (*TerraformUpgrader, error) {
|
||||
return &TerraformUpgrader{
|
||||
tf: tfClient,
|
||||
outWriter: outWriter,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// TerraformUpgrader is responsible for performing Terraform migrations on cluster upgrades.
|
||||
type TerraformUpgrader struct {
|
||||
tf tfClient
|
||||
outWriter io.Writer
|
||||
}
|
||||
|
||||
// TerraformUpgradeOptions are the options used for the Terraform upgrade.
|
||||
type TerraformUpgradeOptions struct {
|
||||
// LogLevel is the log level used for Terraform.
|
||||
LogLevel terraform.LogLevel
|
||||
// CSP is the cloud provider to perform the upgrade on.
|
||||
CSP cloudprovider.Provider
|
||||
// Vars are the Terraform variables used for the upgrade.
|
||||
Vars terraform.Variables
|
||||
// Targets are the Terraform targets used for the upgrade.
|
||||
Targets []string
|
||||
// OutputFile is the file to write the Terraform output to.
|
||||
OutputFile string
|
||||
}
|
||||
|
||||
// CheckTerraformMigrations checks whether Terraform migrations are possible in the current workspace.
|
||||
// If the files that will be written during the upgrade already exist, it returns an error.
|
||||
func (u *TerraformUpgrader) CheckTerraformMigrations(fileHandler file.Handler) error {
|
||||
var existingFiles []string
|
||||
filesToCheck := []string{
|
||||
constants.TerraformMigrationOutputFile,
|
||||
filepath.Join(constants.UpgradeDir, constants.TerraformUpgradeBackupDir),
|
||||
}
|
||||
|
||||
for _, f := range filesToCheck {
|
||||
if err := checkFileExists(fileHandler, &existingFiles, f); err != nil {
|
||||
return fmt.Errorf("checking terraform migrations: %w", err)
|
||||
}
|
||||
}
|
||||
|
||||
if len(existingFiles) > 0 {
|
||||
return fmt.Errorf("file(s) %s already exist", strings.Join(existingFiles, ", "))
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// checkFileExists checks whether a file exists and adds it to the existingFiles slice if it does.
|
||||
func checkFileExists(fileHandler file.Handler, existingFiles *[]string, filename string) error {
|
||||
_, err := fileHandler.Stat(filename)
|
||||
if err != nil {
|
||||
if !os.IsNotExist(err) {
|
||||
return fmt.Errorf("checking %s: %w", filename, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
*existingFiles = append(*existingFiles, filename)
|
||||
return nil
|
||||
}
|
||||
|
||||
// PlanTerraformMigrations prepares the upgrade workspace and plans the Terraform migrations for the Constellation upgrade.
|
||||
// If a diff exists, it's being written to the upgrader's output writer. It also returns
|
||||
// a bool indicating whether a diff exists.
|
||||
func (u *TerraformUpgrader) PlanTerraformMigrations(ctx context.Context, opts TerraformUpgradeOptions) (bool, error) {
|
||||
err := u.tf.PrepareUpgradeWorkspace(
|
||||
filepath.Join("terraform", strings.ToLower(opts.CSP.String())),
|
||||
constants.TerraformWorkingDir,
|
||||
filepath.Join(constants.UpgradeDir, constants.TerraformUpgradeWorkingDir),
|
||||
opts.Vars,
|
||||
)
|
||||
if err != nil {
|
||||
return false, fmt.Errorf("preparing terraform workspace: %w", err)
|
||||
}
|
||||
|
||||
hasDiff, err := u.tf.Plan(ctx, opts.LogLevel, constants.TerraformUpgradePlanFile, opts.Targets...)
|
||||
if err != nil {
|
||||
return false, fmt.Errorf("terraform plan: %w", err)
|
||||
}
|
||||
|
||||
if hasDiff {
|
||||
if err := u.tf.ShowPlan(ctx, opts.LogLevel, constants.TerraformUpgradePlanFile, u.outWriter); err != nil {
|
||||
return false, fmt.Errorf("terraform show plan: %w", err)
|
||||
}
|
||||
}
|
||||
|
||||
return hasDiff, nil
|
||||
}
|
||||
|
||||
// CleanUpTerraformMigrations cleans up the Terraform migration workspace, for example when an upgrade is
|
||||
// aborted by the user.
|
||||
func (u *TerraformUpgrader) CleanUpTerraformMigrations(fileHandler file.Handler) error {
|
||||
cleanupFiles := []string{
|
||||
filepath.Join(constants.UpgradeDir, constants.TerraformUpgradeBackupDir),
|
||||
filepath.Join(constants.UpgradeDir, constants.TerraformUpgradeWorkingDir),
|
||||
}
|
||||
|
||||
for _, f := range cleanupFiles {
|
||||
if err := fileHandler.RemoveAll(f); err != nil {
|
||||
return fmt.Errorf("cleaning up file %s: %w", f, err)
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// ApplyTerraformMigrations applies the migerations planned by PlanTerraformMigrations.
|
||||
// If PlanTerraformMigrations has not been executed before, it will return an error.
|
||||
// In case of a successful upgrade, the output will be written to the specified file and the old Terraform directory is replaced
|
||||
// By the new one.
|
||||
func (u *TerraformUpgrader) ApplyTerraformMigrations(ctx context.Context, fileHandler file.Handler, opts TerraformUpgradeOptions) error {
|
||||
tfOutput, err := u.tf.CreateCluster(ctx, opts.LogLevel, opts.Targets...)
|
||||
if err != nil {
|
||||
return fmt.Errorf("terraform apply: %w", err)
|
||||
}
|
||||
|
||||
outputFileContents := clusterid.File{
|
||||
CloudProvider: opts.CSP,
|
||||
InitSecret: []byte(tfOutput.Secret),
|
||||
IP: tfOutput.IP,
|
||||
UID: tfOutput.UID,
|
||||
AttestationURL: tfOutput.AttestationURL,
|
||||
}
|
||||
|
||||
if err := fileHandler.RemoveAll(constants.TerraformWorkingDir); err != nil {
|
||||
return fmt.Errorf("removing old terraform directory: %w", err)
|
||||
}
|
||||
|
||||
if err := fileHandler.CopyDir(filepath.Join(constants.UpgradeDir, constants.TerraformUpgradeWorkingDir), constants.TerraformWorkingDir); err != nil {
|
||||
return fmt.Errorf("replacing old terraform directory with new one: %w", err)
|
||||
}
|
||||
|
||||
if err := fileHandler.RemoveAll(filepath.Join(constants.UpgradeDir, constants.TerraformUpgradeWorkingDir)); err != nil {
|
||||
return fmt.Errorf("removing terraform upgrade directory: %w", err)
|
||||
}
|
||||
|
||||
if err := fileHandler.WriteJSON(opts.OutputFile, outputFileContents); err != nil {
|
||||
return fmt.Errorf("writing terraform output to file: %w", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// a tfClient performs the Terraform interactions in an upgrade.
|
||||
type tfClient interface {
|
||||
PrepareUpgradeWorkspace(path, oldWorkingDir, newWorkingDir string, vars terraform.Variables) error
|
||||
ShowPlan(ctx context.Context, logLevel terraform.LogLevel, planFilePath string, output io.Writer) error
|
||||
Plan(ctx context.Context, logLevel terraform.LogLevel, planFile string, targets ...string) (bool, error)
|
||||
CreateCluster(ctx context.Context, logLevel terraform.LogLevel, targets ...string) (terraform.CreateOutput, error)
|
||||
}
|
||||
313
cli/internal/upgrade/terraform_test.go
Normal file
313
cli/internal/upgrade/terraform_test.go
Normal file
|
|
@ -0,0 +1,313 @@
|
|||
/*
|
||||
Copyright (c) Edgeless Systems GmbH
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
package upgrade
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"io"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"github.com/edgelesssys/constellation/v2/cli/internal/terraform"
|
||||
"github.com/edgelesssys/constellation/v2/internal/cloud/cloudprovider"
|
||||
"github.com/edgelesssys/constellation/v2/internal/constants"
|
||||
"github.com/edgelesssys/constellation/v2/internal/file"
|
||||
"github.com/spf13/afero"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
func TestCheckTerraformMigrations(t *testing.T) {
|
||||
upgrader := func() *TerraformUpgrader {
|
||||
u, err := NewTerraformUpgrader(&stubTerraformClient{}, bytes.NewBuffer(nil))
|
||||
require.NoError(t, err)
|
||||
|
||||
return u
|
||||
}
|
||||
|
||||
workspace := func(existingFiles []string) file.Handler {
|
||||
fs := afero.NewMemMapFs()
|
||||
for _, f := range existingFiles {
|
||||
require.NoError(t, afero.WriteFile(fs, f, []byte{}, 0o644))
|
||||
}
|
||||
|
||||
return file.NewHandler(fs)
|
||||
}
|
||||
|
||||
testCases := map[string]struct {
|
||||
workspace file.Handler
|
||||
wantErr bool
|
||||
}{
|
||||
"success": {
|
||||
workspace: workspace(nil),
|
||||
},
|
||||
"migration output file already exists": {
|
||||
workspace: workspace([]string{constants.TerraformMigrationOutputFile}),
|
||||
wantErr: true,
|
||||
},
|
||||
"terraform backup dir already exists": {
|
||||
workspace: workspace([]string{filepath.Join(constants.UpgradeDir, constants.TerraformUpgradeBackupDir)}),
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
for name, tc := range testCases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
u := upgrader()
|
||||
err := u.CheckTerraformMigrations(tc.workspace)
|
||||
if tc.wantErr {
|
||||
require.Error(t, err)
|
||||
return
|
||||
}
|
||||
|
||||
require.NoError(t, err)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestPlanTerraformMigrations(t *testing.T) {
|
||||
upgrader := func(tf tfClient) *TerraformUpgrader {
|
||||
u, err := NewTerraformUpgrader(tf, bytes.NewBuffer(nil))
|
||||
require.NoError(t, err)
|
||||
|
||||
return u
|
||||
}
|
||||
|
||||
testCases := map[string]struct {
|
||||
tf tfClient
|
||||
want bool
|
||||
wantErr bool
|
||||
}{
|
||||
"success no diff": {
|
||||
tf: &stubTerraformClient{},
|
||||
},
|
||||
"success diff": {
|
||||
tf: &stubTerraformClient{
|
||||
hasDiff: true,
|
||||
},
|
||||
want: true,
|
||||
},
|
||||
"prepare workspace error": {
|
||||
tf: &stubTerraformClient{
|
||||
prepareWorkspaceErr: assert.AnError,
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
"plan error": {
|
||||
tf: &stubTerraformClient{
|
||||
planErr: assert.AnError,
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
"show plan error no diff": {
|
||||
tf: &stubTerraformClient{
|
||||
showErr: assert.AnError,
|
||||
},
|
||||
},
|
||||
"show plan error diff": {
|
||||
tf: &stubTerraformClient{
|
||||
showErr: assert.AnError,
|
||||
hasDiff: true,
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
for name, tc := range testCases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
require := require.New(t)
|
||||
|
||||
u := upgrader(tc.tf)
|
||||
|
||||
opts := TerraformUpgradeOptions{
|
||||
LogLevel: terraform.LogLevelDebug,
|
||||
CSP: cloudprovider.Unknown,
|
||||
Vars: &terraform.QEMUVariables{},
|
||||
}
|
||||
|
||||
diff, err := u.PlanTerraformMigrations(context.Background(), opts)
|
||||
if tc.wantErr {
|
||||
require.Error(err)
|
||||
} else {
|
||||
require.NoError(err)
|
||||
require.Equal(tc.want, diff)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestApplyTerraformMigrations(t *testing.T) {
|
||||
upgrader := func(tf tfClient) *TerraformUpgrader {
|
||||
u, err := NewTerraformUpgrader(tf, bytes.NewBuffer(nil))
|
||||
require.NoError(t, err)
|
||||
|
||||
return u
|
||||
}
|
||||
|
||||
fileHandler := func(existingFiles ...string) file.Handler {
|
||||
fh := file.NewHandler(afero.NewMemMapFs())
|
||||
require.NoError(t,
|
||||
fh.Write(
|
||||
filepath.Join(constants.UpgradeDir, constants.TerraformUpgradeWorkingDir, "someFile"),
|
||||
[]byte("some content"),
|
||||
))
|
||||
for _, f := range existingFiles {
|
||||
require.NoError(t, fh.Write(f, []byte("some content")))
|
||||
}
|
||||
return fh
|
||||
}
|
||||
|
||||
testCases := map[string]struct {
|
||||
tf tfClient
|
||||
fs file.Handler
|
||||
outputFileName string
|
||||
wantErr bool
|
||||
}{
|
||||
"success": {
|
||||
tf: &stubTerraformClient{},
|
||||
fs: fileHandler(),
|
||||
outputFileName: "test.json",
|
||||
},
|
||||
"create cluster error": {
|
||||
tf: &stubTerraformClient{
|
||||
CreateClusterErr: assert.AnError,
|
||||
},
|
||||
fs: fileHandler(),
|
||||
outputFileName: "test.json",
|
||||
wantErr: true,
|
||||
},
|
||||
"empty file name": {
|
||||
tf: &stubTerraformClient{},
|
||||
fs: fileHandler(),
|
||||
outputFileName: "",
|
||||
wantErr: true,
|
||||
},
|
||||
"file already exists": {
|
||||
tf: &stubTerraformClient{},
|
||||
fs: fileHandler("test.json"),
|
||||
outputFileName: "test.json",
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
for name, tc := range testCases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
require := require.New(t)
|
||||
|
||||
u := upgrader(tc.tf)
|
||||
|
||||
opts := TerraformUpgradeOptions{
|
||||
LogLevel: terraform.LogLevelDebug,
|
||||
CSP: cloudprovider.Unknown,
|
||||
Vars: &terraform.QEMUVariables{},
|
||||
OutputFile: tc.outputFileName,
|
||||
}
|
||||
|
||||
err := u.ApplyTerraformMigrations(context.Background(), tc.fs, opts)
|
||||
if tc.wantErr {
|
||||
require.Error(err)
|
||||
} else {
|
||||
require.NoError(err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestCleanUpTerraformMigrations(t *testing.T) {
|
||||
upgrader := func() *TerraformUpgrader {
|
||||
u, err := NewTerraformUpgrader(&stubTerraformClient{}, bytes.NewBuffer(nil))
|
||||
require.NoError(t, err)
|
||||
|
||||
return u
|
||||
}
|
||||
|
||||
workspace := func(existingFiles []string) file.Handler {
|
||||
fs := afero.NewMemMapFs()
|
||||
for _, f := range existingFiles {
|
||||
require.NoError(t, afero.WriteFile(fs, f, []byte{}, 0o644))
|
||||
}
|
||||
|
||||
return file.NewHandler(fs)
|
||||
}
|
||||
|
||||
testCases := map[string]struct {
|
||||
workspace file.Handler
|
||||
wantFiles []string
|
||||
wantErr bool
|
||||
}{
|
||||
"no files": {
|
||||
workspace: workspace(nil),
|
||||
wantFiles: []string{},
|
||||
},
|
||||
"clean backup dir": {
|
||||
workspace: workspace([]string{
|
||||
filepath.Join(constants.UpgradeDir, constants.TerraformUpgradeBackupDir),
|
||||
}),
|
||||
wantFiles: []string{},
|
||||
},
|
||||
"clean working dir": {
|
||||
workspace: workspace([]string{
|
||||
filepath.Join(constants.UpgradeDir, constants.TerraformUpgradeWorkingDir),
|
||||
}),
|
||||
wantFiles: []string{},
|
||||
},
|
||||
"clean backup dir leave other files": {
|
||||
workspace: workspace([]string{
|
||||
filepath.Join(constants.UpgradeDir, constants.TerraformUpgradeBackupDir),
|
||||
filepath.Join(constants.UpgradeDir, "someFile"),
|
||||
}),
|
||||
wantFiles: []string{
|
||||
filepath.Join(constants.UpgradeDir, "someFile"),
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for name, tc := range testCases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
require := require.New(t)
|
||||
|
||||
u := upgrader()
|
||||
err := u.CleanUpTerraformMigrations(tc.workspace)
|
||||
if tc.wantErr {
|
||||
require.Error(err)
|
||||
return
|
||||
}
|
||||
|
||||
require.NoError(err)
|
||||
|
||||
for _, f := range tc.wantFiles {
|
||||
_, err := tc.workspace.Stat(f)
|
||||
require.NoError(err, "file %s should exist", f)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
type stubTerraformClient struct {
|
||||
hasDiff bool
|
||||
prepareWorkspaceErr error
|
||||
showErr error
|
||||
planErr error
|
||||
CreateClusterErr error
|
||||
}
|
||||
|
||||
func (u *stubTerraformClient) PrepareUpgradeWorkspace(string, string, string, terraform.Variables) error {
|
||||
return u.prepareWorkspaceErr
|
||||
}
|
||||
|
||||
func (u *stubTerraformClient) ShowPlan(context.Context, terraform.LogLevel, string, io.Writer) error {
|
||||
return u.showErr
|
||||
}
|
||||
|
||||
func (u *stubTerraformClient) Plan(context.Context, terraform.LogLevel, string, ...string) (bool, error) {
|
||||
return u.hasDiff, u.planErr
|
||||
}
|
||||
|
||||
func (u *stubTerraformClient) CreateCluster(context.Context, terraform.LogLevel, ...string) (terraform.CreateOutput, error) {
|
||||
return terraform.CreateOutput{}, u.CreateClusterErr
|
||||
}
|
||||
10
cli/internal/upgrade/upgrade.go
Normal file
10
cli/internal/upgrade/upgrade.go
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
/*
|
||||
Copyright (c) Edgeless Systems GmbH
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
/*
|
||||
Package upgrade provides functionality to upgrade the cluster and it's resources
|
||||
*/
|
||||
package upgrade
|
||||
Loading…
Add table
Add a link
Reference in a new issue