/* Copyright (c) Edgeless Systems GmbH SPDX-License-Identifier: AGPL-3.0-only */ package openstack import ( "context" "errors" "fmt" "net/http" "net/netip" "strings" "github.com/edgelesssys/constellation/v2/internal/cloud/metadata" "github.com/edgelesssys/constellation/v2/internal/role" "github.com/gophercloud/gophercloud/openstack/compute/v2/servers" "github.com/gophercloud/gophercloud/openstack/networking/v2/subnets" "github.com/gophercloud/utils/openstack/clientconfig" ) const ( roleTagFormat = "constellation-role-%s" microversion = "2.42" ) // Cloud is the metadata client for OpenStack. type Cloud struct { api serversAPI imds imdsAPI } // New creates a new OpenStack metadata client. func New(ctx context.Context) (*Cloud, error) { imds := &imdsClient{client: &http.Client{}} authURL, err := imds.authURL(ctx) if err != nil { return nil, fmt.Errorf("getting auth URL: %w", err) } username, err := imds.username(ctx) if err != nil { return nil, fmt.Errorf("getting token name: %w", err) } password, err := imds.password(ctx) if err != nil { return nil, fmt.Errorf("getting token password: %w", err) } userDomainName, err := imds.userDomainName(ctx) if err != nil { return nil, fmt.Errorf("getting user domain name: %w", err) } clientOpts := &clientconfig.ClientOpts{ AuthType: clientconfig.AuthV3Password, AuthInfo: &clientconfig.AuthInfo{ AuthURL: authURL, UserDomainName: userDomainName, Username: username, Password: password, }, } serversClient, err := clientconfig.NewServiceClient("compute", clientOpts) if err != nil { return nil, fmt.Errorf("creating compute client: %w", err) } serversClient.Microversion = microversion subnetsClient, err := clientconfig.NewServiceClient("network", clientOpts) if err != nil { return nil, fmt.Errorf("creating network client: %w", err) } subnetsClient.Microversion = microversion return &Cloud{ imds: imds, api: &apiClient{ servers: serversClient, subnets: subnetsClient, }, }, nil } // Self returns the metadata of the current instance. func (c *Cloud) Self(ctx context.Context) (metadata.InstanceMetadata, error) { name, err := c.imds.name(ctx) if err != nil { return metadata.InstanceMetadata{}, fmt.Errorf("getting name: %w", err) } providerID, err := c.imds.providerID(ctx) if err != nil { return metadata.InstanceMetadata{}, fmt.Errorf("getting provider id: %w", err) } role, err := c.imds.role(ctx) if err != nil { return metadata.InstanceMetadata{}, fmt.Errorf("getting role: %w", err) } vpcIP, err := c.imds.vpcIP(ctx) if err != nil { return metadata.InstanceMetadata{}, fmt.Errorf("getting vpc ip: %w", err) } return metadata.InstanceMetadata{ Name: name, ProviderID: providerID, Role: role, VPCIP: vpcIP, }, nil } // List returns the metadata of all instances belonging to the same Constellation cluster. func (c *Cloud) List(ctx context.Context) ([]metadata.InstanceMetadata, error) { uid, err := c.imds.uid(ctx) if err != nil { return nil, fmt.Errorf("getting uid: %w", err) } uidTag := fmt.Sprintf("constellation-uid-%s", uid) subnet, err := c.getSubnetCIDR(uidTag) if err != nil { return nil, err } srvs, err := c.getServers(uidTag) if err != nil { return nil, err } var result []metadata.InstanceMetadata for _, s := range srvs { if s.Name == "" { continue } if s.ID == "" { continue } if s.Tags == nil { continue } var serverRole role.Role for _, t := range *s.Tags { if strings.HasPrefix(t, "constellation-role-") { serverRole = role.FromString(strings.TrimPrefix(t, "constellation-role-")) break } } if serverRole == role.Unknown { continue } subnetAddrs, err := parseSeverAddresses(s.Addresses) if err != nil { return nil, fmt.Errorf("parsing server %q addresses: %w", s.Name, err) } var vpcIP string // In a best effort approach, we take the first fixed IPv4 address that is in the subnet // belonging to our cluster. for _, serverSubnet := range subnetAddrs { for _, addr := range serverSubnet.Addresses { if addr.Type != fixedIP { continue } if addr.IPVersion != ipV4 { continue } if addr.IP == "" { continue } parsedAddr, err := netip.ParseAddr(addr.IP) if err != nil { continue } if !subnet.Contains(parsedAddr) { continue } vpcIP = addr.IP break } } if vpcIP == "" { continue } im := metadata.InstanceMetadata{ Name: s.Name, ProviderID: s.ID, Role: serverRole, VPCIP: vpcIP, } result = append(result, im) } if len(result) == 0 { return nil, fmt.Errorf("no instances belonging to this cluster found") } return result, nil } // UID retrieves the UID of the constellation. func (c *Cloud) UID(ctx context.Context) (string, error) { uid, err := c.imds.uid(ctx) if err != nil { return "", fmt.Errorf("retrieving instance UID: %w", err) } return uid, nil } // InitSecretHash retrieves the InitSecretHash of the current instance. func (c *Cloud) InitSecretHash(ctx context.Context) ([]byte, error) { initSecretHash, err := c.imds.initSecretHash(ctx) if err != nil { return nil, fmt.Errorf("retrieving init secret hash: %w", err) } return []byte(initSecretHash), nil } // GetLoadBalancerEndpoint returns the endpoint of the load balancer. // For OpenStack, the load balancer is a floating ip attached to // a control plane node. // TODO(malt3): Rewrite to use real load balancer once it is available. func (c *Cloud) GetLoadBalancerEndpoint(ctx context.Context) (string, error) { uid, err := c.imds.uid(ctx) if err != nil { return "", fmt.Errorf("getting uid: %w", err) } uidTag := fmt.Sprintf("constellation-uid-%s", uid) subnet, err := c.getSubnetCIDR(uidTag) if err != nil { return "", err } srvs, err := c.getServers(uidTag) if err != nil { return "", err } for _, s := range srvs { if s.Name == "" { continue } if s.ID == "" { continue } if s.Tags == nil { continue } subnetAddrs, err := parseSeverAddresses(s.Addresses) if err != nil { return "", fmt.Errorf("parsing server %q addresses: %w", s.Name, err) } // In a best effort approach, we take the first fixed IPv4 address that is outside the subnet // belonging to our cluster and assume it is the "load balancer" floating ip. for _, serverSubnet := range subnetAddrs { for _, addr := range serverSubnet.Addresses { if addr.Type != floatingIP { continue } if addr.IPVersion != ipV4 { continue } if addr.IP == "" { continue } parsedAddr, err := netip.ParseAddr(addr.IP) if err != nil { continue } if subnet.Contains(parsedAddr) { continue } return addr.IP, nil } } } return "", errors.New("no load balancer endpoint found") } func (c *Cloud) getSubnetCIDR(uidTag string) (netip.Prefix, error) { listSubnetsOpts := subnets.ListOpts{Tags: uidTag} subnetsPage, err := c.api.ListSubnets(listSubnetsOpts).AllPages() if err != nil { return netip.Prefix{}, fmt.Errorf("listing subnets: %w", err) } nets, err := subnets.ExtractSubnets(subnetsPage) if err != nil { return netip.Prefix{}, fmt.Errorf("extracting subnets: %w", err) } if len(nets) != 1 { return netip.Prefix{}, fmt.Errorf("expected exactly one subnet, got %d", len(nets)) } cidr, err := netip.ParsePrefix(nets[0].CIDR) if err != nil { return netip.Prefix{}, fmt.Errorf("parsing subnet CIDR: %w", err) } return cidr, nil } func (c *Cloud) getServers(uidTag string) ([]servers.Server, error) { listServersOpts := servers.ListOpts{Tags: uidTag} serversPage, err := c.api.ListServers(listServersOpts).AllPages() if err != nil { return nil, fmt.Errorf("listing servers: %w", err) } servers, err := servers.ExtractServers(serversPage) if err != nil { return nil, fmt.Errorf("extracting servers: %w", err) } return servers, nil }