Skip to content

Commit b86b5a6

Browse files
committed
Feature(deploy): support etcd authentication.
Signed-off-by: wanghai01 <[email protected]>
1 parent f9830eb commit b86b5a6

File tree

7 files changed

+193
-3
lines changed

7 files changed

+193
-3
lines changed

cli/command/deploy.go

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ const (
4444
CREATE_CONTAINER = playbook.CREATE_CONTAINER
4545
SYNC_CONFIG = playbook.SYNC_CONFIG
4646
START_ETCD = playbook.START_ETCD
47+
ENABLE_ETCD_AUTH = playbook.ENABLE_ETCD_AUTH
4748
START_MDS = playbook.START_MDS
4849
CREATE_PHYSICAL_POOL = playbook.CREATE_PHYSICAL_POOL
4950
START_CHUNKSERVER = playbook.START_CHUNKSERVER
@@ -66,6 +67,7 @@ var (
6667
CREATE_CONTAINER,
6768
SYNC_CONFIG,
6869
START_ETCD,
70+
ENABLE_ETCD_AUTH,
6971
START_MDS,
7072
CREATE_PHYSICAL_POOL,
7173
START_CHUNKSERVER,
@@ -80,13 +82,15 @@ var (
8082
CREATE_CONTAINER,
8183
SYNC_CONFIG,
8284
START_ETCD,
85+
ENABLE_ETCD_AUTH,
8386
START_MDS,
8487
CREATE_LOGICAL_POOL,
8588
START_METASERVER,
8689
}
8790

8891
DEPLOY_FILTER_ROLE = map[int]string{
8992
START_ETCD: ROLE_ETCD,
93+
ENABLE_ETCD_AUTH: ROLE_ETCD,
9094
START_MDS: ROLE_MDS,
9195
START_CHUNKSERVER: ROLE_CHUNKSERVER,
9296
START_SNAPSHOTCLONE: ROLE_SNAPSHOTCLONE,
@@ -100,6 +104,7 @@ var (
100104
CREATE_PHYSICAL_POOL: 1,
101105
CREATE_LOGICAL_POOL: 1,
102106
BALANCE_LEADER: 1,
107+
ENABLE_ETCD_AUTH: 1,
103108
}
104109

105110
CAN_SKIP_ROLES = []string{
@@ -162,11 +167,12 @@ func skipServiceRole(deployConfigs []*topology.DeployConfig, options deployOptio
162167
return dcs
163168
}
164169

165-
func skipDeploySteps(deploySteps []int, options deployOptions) []int {
170+
func skipDeploySteps(dcs []*topology.DeployConfig, deploySteps []int, options deployOptions) []int {
166171
steps := []int{}
167172
skipped := utils.Slice2Map(options.skip)
168173
for _, step := range deploySteps {
169-
if step == START_SNAPSHOTCLONE && skipped[ROLE_SNAPSHOTCLONE] {
174+
if (step == START_SNAPSHOTCLONE && skipped[ROLE_SNAPSHOTCLONE]) ||
175+
(step == ENABLE_ETCD_AUTH && len(dcs) > 0 && !dcs[0].GetEtcdAuthEnable()) {
170176
continue
171177
}
172178
steps = append(steps, step)
@@ -220,7 +226,7 @@ func genDeployPlaybook(curveadm *cli.CurveAdm,
220226
} else {
221227
steps = CURVEFS_DEPLOY_STEPS
222228
}
223-
steps = skipDeploySteps(steps, options)
229+
steps = skipDeploySteps(dcs, steps, options)
224230
poolset := configure.Poolset{
225231
Name: options.poolset,
226232
Type: options.poolsetDiskType,

internal/configure/topology/dc_get.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,9 @@ func (dc *DeployConfig) GetS3Address() string { return dc.getString(CONFI
143143
func (dc *DeployConfig) GetS3BucketName() string { return dc.getString(CONFIG_S3_BUCKET_NAME) }
144144
func (dc *DeployConfig) GetEnableRDMA() bool { return dc.getBool(CONFIG_ENABLE_RDMA) }
145145
func (dc *DeployConfig) GetEnableRenameAt2() bool { return dc.getBool(CONFIG_ENABLE_RENAMEAT2) }
146+
func (dc *DeployConfig) GetEtcdAuthEnable() bool { return dc.getBool(CONFIG_ETCD_AUTH_ENABLE) }
147+
func (dc *DeployConfig) GetEtcdAuthUsername() string { return dc.getString(CONFIG_ETCD_AUTH_USERNAME) }
148+
func (dc *DeployConfig) GetEtcdAuthPassword() string { return dc.getString(CONFIG_ETCD_AUTH_PASSWORD) }
146149
func (dc *DeployConfig) GetEnableChunkfilePool() bool {
147150
return dc.getBool(CONFIG_ENABLE_CHUNKFILE_POOL)
148151
}

internal/configure/topology/dc_item.go

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -283,6 +283,27 @@ var (
283283
true,
284284
nil,
285285
)
286+
287+
CONFIG_ETCD_AUTH_ENABLE = itemset.insert(
288+
"etcd.auth.enable",
289+
REQUIRE_BOOL,
290+
false,
291+
false,
292+
)
293+
294+
CONFIG_ETCD_AUTH_USERNAME = itemset.insert(
295+
"etcd.auth.username",
296+
REQUIRE_STRING,
297+
false,
298+
nil,
299+
)
300+
301+
CONFIG_ETCD_AUTH_PASSWORD = itemset.insert(
302+
"etcd.auth.password",
303+
REQUIRE_STRING,
304+
false,
305+
nil,
306+
)
286307
)
287308

288309
func (i *item) Key() string {

internal/errno/errno.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -377,6 +377,7 @@ var (
377377
ERR_INVALID_DEVICE_USAGE = EC(410020, "invalid device usage")
378378
ERR_ENCRYPT_FILE_FAILED = EC(410021, "encrypt file failed")
379379
ERR_CLIENT_ID_NOT_FOUND = EC(410022, "client id not found")
380+
ERR_ENABLE_ETCD_AUTH_FAILED = EC(410023, "enable etcd auth failed")
380381

381382
// 420: common (curvebs client)
382383
ERR_VOLUME_ALREADY_MAPPED = EC(420000, "volume already mapped")

internal/playbook/factory.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ const (
5858
SYNC_CONFIG
5959
START_SERVICE
6060
START_ETCD
61+
ENABLE_ETCD_AUTH
6162
START_MDS
6263
START_CHUNKSERVER
6364
START_SNAPSHOTCLONE
@@ -196,6 +197,8 @@ func (p *Playbook) createTasks(step *PlaybookStep) (*tasks.Tasks, error) {
196197
START_SNAPSHOTCLONE,
197198
START_METASERVER:
198199
t, err = comm.NewStartServiceTask(curveadm, config.GetDC(i))
200+
case ENABLE_ETCD_AUTH:
201+
t, err = comm.NewEnableEtcdAuthTask(curveadm, config.GetDC(i))
199202
case STOP_SERVICE:
200203
t, err = comm.NewStopServiceTask(curveadm, config.GetDC(i))
201204
case RESTART_SERVICE:
Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
/*
2+
* Copyright (c) 2023 NetEase Inc.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
/*
18+
* Project: Curveadm
19+
* Created Date: 2023-08-02
20+
* Author: wanghai (SeanHai)
21+
*/
22+
23+
package scripts
24+
25+
var ENABLE_ETCD_AUTH = `
26+
#!/usr/bin/env bash
27+
28+
if [ $# -ne 3 ]; then
29+
echo "Usage: $0 endpoints username password"
30+
exit 1
31+
fi
32+
33+
endpoints=$1
34+
username=$2
35+
password=$3
36+
root_user=root
37+
38+
# create root user
39+
etcdctl --endpoints=${endpoints} user add ${root_user}:${password} && \
40+
etcdctl --endpoints=${endpoints} user grant-role ${root_user} root || exit 1
41+
42+
# create user if not root
43+
if [ "${username}" != "${root_user}" ]; then
44+
etcdctl --endpoints=${endpoints} user add ${username}:${password} && \
45+
etcdctl --endpoints=${endpoints} user grant-role ${username} root || exit 1
46+
fi
47+
48+
# enable auth
49+
etcdctl --endpoints=${endpoints} auth enable --user=${root_user}:${password} || exit 1
50+
`
Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
/*
2+
* Copyright (c) 2023 NetEase Inc.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
/*
18+
* Project: Curveadm
19+
* Created Date: 2023-08-02
20+
* Author: wanghai (SeanHai)
21+
*/
22+
23+
package common
24+
25+
import (
26+
"fmt"
27+
28+
"github.com/opencurve/curveadm/cli/cli"
29+
"github.com/opencurve/curveadm/internal/configure/topology"
30+
"github.com/opencurve/curveadm/internal/errno"
31+
"github.com/opencurve/curveadm/internal/task/context"
32+
"github.com/opencurve/curveadm/internal/task/scripts"
33+
"github.com/opencurve/curveadm/internal/task/step"
34+
"github.com/opencurve/curveadm/internal/task/task"
35+
tui "github.com/opencurve/curveadm/internal/tui/common"
36+
)
37+
38+
func checkEnableEtcdAuthStatus(success *bool, out *string) step.LambdaType {
39+
return func(ctx *context.Context) error {
40+
if !*success {
41+
return errno.ERR_ENABLE_ETCD_AUTH_FAILED.S(*out)
42+
}
43+
return nil
44+
}
45+
}
46+
47+
func NewEnableEtcdAuthTask(curveadm *cli.CurveAdm, dc *topology.DeployConfig) (*task.Task, error) {
48+
serviceId := curveadm.GetServiceId(dc.GetId())
49+
containerId, err := curveadm.GetContainerId(serviceId)
50+
if curveadm.IsSkip(dc) {
51+
return nil, nil
52+
} else if err != nil {
53+
return nil, err
54+
}
55+
hc, err := curveadm.GetHost(dc.GetHost())
56+
if err != nil {
57+
return nil, err
58+
}
59+
60+
var success bool
61+
var out string
62+
host, role := dc.GetHost(), dc.GetRole()
63+
// new task
64+
subname := fmt.Sprintf("host=%s role=%s containerId=%s",
65+
dc.GetHost(), dc.GetRole(), tui.TrimContainerId(containerId))
66+
t := task.NewTask("Enable Etcd Auth", subname, hc.GetSSHConfig())
67+
68+
script := scripts.ENABLE_ETCD_AUTH
69+
layout := dc.GetProjectLayout()
70+
scriptPath := fmt.Sprintf("%s/enable_auth.sh", layout.ServiceBinDir)
71+
72+
etcdEndPoints, err := dc.GetVariables().Get("cluster_etcd_addr")
73+
if err != nil {
74+
return nil, err
75+
}
76+
77+
t.AddStep(&step.ListContainers{
78+
ShowAll: true,
79+
Format: `"{{.ID}}"`,
80+
Filter: fmt.Sprintf("id=%s", containerId),
81+
Out: &out,
82+
ExecOptions: curveadm.ExecOptions(),
83+
})
84+
t.AddStep(&step.Lambda{
85+
Lambda: checkContainerExist(host, role, containerId, &out),
86+
})
87+
t.AddStep(&step.InstallFile{ // install /curvebs(fs)/etcd/sbin/enable_auth.sh
88+
ContainerId: &containerId,
89+
ContainerDestPath: scriptPath,
90+
Content: &script,
91+
ExecOptions: curveadm.ExecOptions(),
92+
})
93+
command := fmt.Sprintf("/bin/bash %s %s %s %s", scriptPath, etcdEndPoints, dc.GetEtcdAuthUsername(),
94+
dc.GetEtcdAuthPassword())
95+
t.AddStep(&step.ContainerExec{
96+
ContainerId: &containerId,
97+
Success: &success,
98+
Out: &out,
99+
Command: command,
100+
ExecOptions: curveadm.ExecOptions(),
101+
})
102+
t.AddStep(&step.Lambda{
103+
Lambda: checkEnableEtcdAuthStatus(&success, &out),
104+
})
105+
return t, nil
106+
}

0 commit comments

Comments
 (0)