debian-mirror-gitlab/app/models/clusters/platforms/kubernetes.rb

291 lines
9 KiB
Ruby
Raw Normal View History

2018-11-18 11:00:15 +05:30
# frozen_string_literal: true
2018-03-17 18:26:18 +05:30
module Clusters
module Platforms
2019-07-07 11:18:12 +05:30
class Kubernetes < ApplicationRecord
2018-03-17 18:26:18 +05:30
include Gitlab::Kubernetes
2018-11-20 20:47:30 +05:30
include EnumWithNil
2018-12-13 13:39:08 +05:30
include AfterCommitQueue
2019-12-21 20:55:43 +05:30
include ReactiveCaching
2021-03-11 19:13:27 +05:30
include NullifyIfBlank
2018-12-13 13:39:08 +05:30
RESERVED_NAMESPACES = %w(gitlab-managed-apps).freeze
2018-03-17 18:26:18 +05:30
self.table_name = 'cluster_platforms_kubernetes'
2021-01-03 14:25:43 +05:30
self.reactive_cache_work_type = :external_dependency
2018-03-17 18:26:18 +05:30
belongs_to :cluster, inverse_of: :platform_kubernetes, class_name: 'Clusters::Cluster'
attr_encrypted :password,
mode: :per_attribute_iv,
2018-11-08 19:23:39 +05:30
key: Settings.attr_encrypted_db_key_base_truncated,
2018-03-17 18:26:18 +05:30
algorithm: 'aes-256-cbc'
attr_encrypted :token,
mode: :per_attribute_iv,
2018-11-08 19:23:39 +05:30
key: Settings.attr_encrypted_db_key_base_truncated,
2018-03-17 18:26:18 +05:30
algorithm: 'aes-256-cbc'
before_validation :enforce_namespace_to_lower_case
2018-12-13 13:39:08 +05:30
before_validation :enforce_ca_whitespace_trimming
2018-03-17 18:26:18 +05:30
validates :namespace,
2019-12-21 20:55:43 +05:30
allow_nil: true,
2018-03-17 18:26:18 +05:30
length: 1..63,
format: {
with: Gitlab::Regex.kubernetes_namespace_regex,
message: Gitlab::Regex.kubernetes_namespace_regex_message
}
2018-12-13 13:39:08 +05:30
validates :namespace, exclusion: { in: RESERVED_NAMESPACES }
2019-02-15 15:39:39 +05:30
validate :no_namespace, unless: :allow_user_defined_namespace?
2018-03-17 18:26:18 +05:30
# We expect to be `active?` only when enabled and cluster is created (the api_url is assigned)
2019-03-13 22:55:13 +05:30
validates :api_url, public_url: true, presence: true
2018-03-17 18:26:18 +05:30
validates :token, presence: true
2019-07-07 11:18:12 +05:30
validates :ca_cert, certificate: true, allow_blank: true, if: :ca_cert_changed?
2018-03-17 18:26:18 +05:30
validate :prevent_modification, on: :update
alias_attribute :ca_pem, :ca_cert
delegate :enabled?, to: :cluster, allow_nil: true
2019-07-07 11:18:12 +05:30
delegate :provided_by_user?, to: :cluster, allow_nil: true
2019-02-15 15:39:39 +05:30
delegate :allow_user_defined_namespace?, to: :cluster, allow_nil: true
2019-09-04 21:01:54 +05:30
2018-03-17 18:26:18 +05:30
alias_method :active?, :enabled?
2018-11-20 20:47:30 +05:30
enum_with_nil authorization_type: {
unknown_authorization: nil,
rbac: 1,
abac: 2
}
2019-02-15 15:39:39 +05:30
default_value_for :authorization_type, :rbac
2021-03-11 19:13:27 +05:30
nullify_if_blank :namespace
2020-01-01 13:55:28 +05:30
def predefined_variables(project:, environment_name:, kubernetes_namespace: nil)
2018-05-09 12:01:36 +05:30
Gitlab::Ci::Variables::Collection.new.tap do |variables|
2018-12-13 13:39:08 +05:30
variables.append(key: 'KUBE_URL', value: api_url)
2018-05-09 12:01:36 +05:30
if ca_pem.present?
variables
.append(key: 'KUBE_CA_PEM', value: ca_pem)
.append(key: 'KUBE_CA_PEM_FILE', value: ca_pem, file: true)
end
2018-12-13 13:39:08 +05:30
2019-12-21 20:55:43 +05:30
if !cluster.managed? || cluster.management_project == project
2020-01-01 13:55:28 +05:30
namespace = kubernetes_namespace || default_namespace(project, environment_name: environment_name)
2019-09-04 21:01:54 +05:30
variables
.append(key: 'KUBE_TOKEN', value: token, public: false, masked: true)
2019-10-12 21:52:04 +05:30
.append(key: 'KUBE_NAMESPACE', value: namespace)
.append(key: 'KUBECONFIG', value: kubeconfig(namespace), public: false, file: true)
2019-09-04 21:01:54 +05:30
2020-01-01 13:55:28 +05:30
elsif persisted_namespace = find_persisted_namespace(project, environment_name: environment_name)
variables.concat(persisted_namespace.predefined_variables)
2018-12-13 13:39:08 +05:30
end
2019-03-02 22:35:43 +05:30
variables.concat(cluster.predefined_variables)
2018-03-17 18:26:18 +05:30
end
end
2019-09-30 21:07:59 +05:30
def calculate_reactive_cache_for(environment)
2019-09-04 21:01:54 +05:30
return unless enabled?
2018-03-17 18:26:18 +05:30
2020-03-13 15:44:24 +05:30
pods = read_pods(environment.deployment_namespace)
2021-02-22 17:27:13 +05:30
deployments = read_deployments(environment.deployment_namespace)
2020-03-13 15:44:24 +05:30
2021-09-04 01:27:46 +05:30
ingresses = read_ingresses(environment.deployment_namespace)
2021-02-22 17:27:13 +05:30
# extract only the data required for display to avoid unnecessary caching
{
pods: extract_relevant_pod_data(pods),
deployments: extract_relevant_deployment_data(deployments),
ingresses: extract_relevant_ingress_data(ingresses)
}
2019-09-30 21:07:59 +05:30
end
def terminals(environment, data)
pods = filter_by_project_environment(data[:pods], environment.project.full_path_slug, environment.slug)
terminals = pods.flat_map { |pod| terminals_for_pod(api_url, environment.deployment_namespace, pod) }.compact
2021-01-03 14:25:43 +05:30
terminals.each { |terminal| add_terminal_auth(terminal, **terminal_auth) }
2018-03-17 18:26:18 +05:30
end
def kubeclient
2018-12-13 13:39:08 +05:30
@kubeclient ||= build_kube_client!
2018-03-17 18:26:18 +05:30
end
2021-02-22 17:27:13 +05:30
def rollout_status(environment, data)
project = environment.project
deployments = filter_by_project_environment(data[:deployments], project.full_path_slug, environment.slug)
pods = filter_by_project_environment(data[:pods], project.full_path_slug, environment.slug)
ingresses = data[:ingresses].presence || []
::Gitlab::Kubernetes::RolloutStatus.from_deployments(*deployments, pods_attrs: pods, ingresses: ingresses)
end
def ingresses(namespace)
ingresses = read_ingresses(namespace)
ingresses.map { |ingress| ::Gitlab::Kubernetes::Ingress.new(ingress) }
end
def patch_ingress(namespace, ingress, data)
kubeclient.patch_ingress(ingress.name, data, namespace)
end
2018-03-17 18:26:18 +05:30
private
2020-01-01 13:55:28 +05:30
def default_namespace(project, environment_name:)
Gitlab::Kubernetes::DefaultNamespace.new(
cluster,
project: project
).from_environment_name(environment_name)
end
2019-10-12 21:52:04 +05:30
def find_persisted_namespace(project, environment_name:)
Clusters::KubernetesNamespaceFinder.new(
cluster,
project: project,
2019-12-21 20:55:43 +05:30
environment_name: environment_name
2019-10-12 21:52:04 +05:30
).execute
end
2019-09-04 21:01:54 +05:30
def kubeconfig(namespace)
2018-03-17 18:26:18 +05:30
to_kubeconfig(
url: api_url,
2019-09-04 21:01:54 +05:30
namespace: namespace,
2018-03-17 18:26:18 +05:30
token: token,
ca_pem: ca_pem)
end
2019-09-30 21:07:59 +05:30
def read_pods(namespace)
kubeclient.get_pods(namespace: namespace).as_json
rescue Kubeclient::ResourceNotFoundError
[]
end
2021-02-22 17:27:13 +05:30
def read_deployments(namespace)
kubeclient.get_deployments(namespace: namespace).as_json
rescue Kubeclient::ResourceNotFoundError
[]
end
def read_ingresses(namespace)
kubeclient.get_ingresses(namespace: namespace).as_json
rescue Kubeclient::ResourceNotFoundError
[]
end
2018-12-13 13:39:08 +05:30
def build_kube_client!
2019-02-15 15:39:39 +05:30
raise "Incomplete settings" unless api_url
2018-03-17 18:26:18 +05:30
unless (username && password) || token
raise "Either username/password or token is required to access API"
end
2018-11-20 20:47:30 +05:30
Gitlab::Kubernetes::KubeClient.new(
api_url,
2018-03-17 18:26:18 +05:30
auth_options: kubeclient_auth_options,
ssl_options: kubeclient_ssl_options,
http_proxy_uri: ENV['http_proxy']
)
end
def kubeclient_ssl_options
opts = { verify_ssl: OpenSSL::SSL::VERIFY_PEER }
if ca_pem.present?
opts[:cert_store] = OpenSSL::X509::Store.new
2020-07-28 23:09:34 +05:30
file = Tempfile.new('cluster_ca_pem_temp')
begin
file.write(ca_pem)
file.rewind
opts[:cert_store].add_file(file.path)
ensure
file.close
file.unlink # deletes the temp file
end
2018-03-17 18:26:18 +05:30
end
opts
end
def kubeclient_auth_options
{ bearer_token: token }
end
def terminal_auth
{
token: token,
ca_pem: ca_pem,
max_session_time: Gitlab::CurrentSettings.terminal_max_session_time
}
end
def enforce_namespace_to_lower_case
self.namespace = self.namespace&.downcase
end
2018-12-13 13:39:08 +05:30
def enforce_ca_whitespace_trimming
self.ca_pem = self.ca_pem&.strip
self.token = self.token&.strip
end
2019-02-15 15:39:39 +05:30
def no_namespace
if namespace
errors.add(:namespace, 'only allowed for project cluster')
end
end
2018-03-17 18:26:18 +05:30
def prevent_modification
2019-07-07 11:18:12 +05:30
return if provided_by_user?
2018-03-17 18:26:18 +05:30
2021-03-08 18:12:59 +05:30
if api_url_changed? || attribute_changed?(:token) || ca_pem_changed?
2018-03-17 18:26:18 +05:30
errors.add(:base, _('Cannot modify managed Kubernetes cluster'))
return false
end
true
end
2019-12-21 20:55:43 +05:30
2020-03-13 15:44:24 +05:30
def extract_relevant_pod_data(pods)
pods.map do |pod|
{
'metadata' => pod.fetch('metadata', {})
.slice('name', 'generateName', 'labels', 'annotations', 'creationTimestamp'),
'status' => pod.fetch('status', {}).slice('phase'),
'spec' => {
'containers' => pod.fetch('spec', {})
.fetch('containers', [])
.map { |c| c.slice('name') }
}
}
end
end
2021-02-22 17:27:13 +05:30
def extract_relevant_deployment_data(deployments)
deployments.map do |deployment|
{
'metadata' => deployment.fetch('metadata', {}).slice('name', 'generation', 'labels', 'annotations'),
'spec' => deployment.fetch('spec', {}).slice('replicas'),
'status' => deployment.fetch('status', {}).slice('observedGeneration')
}
end
end
def extract_relevant_ingress_data(ingresses)
ingresses.map do |ingress|
{
'metadata' => ingress.fetch('metadata', {}).slice('name', 'labels', 'annotations')
}
end
end
2018-03-17 18:26:18 +05:30
end
end
end