ceph/src/pybind/mgr/cephadm/services/iscsi.py

   1 import errno
   2 import json
   3 import logging
   4 import subprocess
   5 from typing import List, cast, Optional
   6 from ipaddress import ip_address, IPv6Address
   7
   8 from mgr_module import HandleCommandResult
   9 from ceph.deployment.service_spec import IscsiServiceSpec
  10
  11 from orchestrator import DaemonDescription, DaemonDescriptionStatus
  12 from .cephadmservice import CephadmDaemonDeploySpec, CephService
  13 from .. import utils
  14
  15 logger = logging.getLogger(__name__)
  16
  17
  18 class IscsiService(CephService):
  19     TYPE = 'iscsi'
  20
  21     def config(self, spec: IscsiServiceSpec) -> None:  # type: ignore
  22         assert self.TYPE == spec.service_type
  23         assert spec.pool
  24         self.mgr._check_pool_exists(spec.pool, spec.service_name())
  25
  26     def prepare_create(self, daemon_spec: CephadmDaemonDeploySpec) -> CephadmDaemonDeploySpec:
  27         assert self.TYPE == daemon_spec.daemon_type
  28
  29         spec = cast(IscsiServiceSpec, self.mgr.spec_store[daemon_spec.service_name].spec)
  30         igw_id = daemon_spec.daemon_id
  31
  32         keyring = self.get_keyring_with_caps(self.get_auth_entity(igw_id),
  33                                              ['mon', 'profile rbd, '
  34                                               'allow command "osd blocklist", '
  35                                               'allow command "config-key get" with "key" prefix "iscsi/"',
  36                                               'mgr', 'allow command "service status"',
  37                                               'osd', 'allow rwx'])
  38
  39         if spec.ssl_cert:
  40             if isinstance(spec.ssl_cert, list):
  41                 cert_data = '\n'.join(spec.ssl_cert)
  42             else:
  43                 cert_data = spec.ssl_cert
  44             ret, out, err = self.mgr.check_mon_command({
  45                 'prefix': 'config-key set',
  46                 'key': f'iscsi/{utils.name_to_config_section("iscsi")}.{igw_id}/iscsi-gateway.crt',
  47                 'val': cert_data,
  48             })
  49
  50         if spec.ssl_key:
  51             if isinstance(spec.ssl_key, list):
  52                 key_data = '\n'.join(spec.ssl_key)
  53             else:
  54                 key_data = spec.ssl_key
  55             ret, out, err = self.mgr.check_mon_command({
  56                 'prefix': 'config-key set',
  57                 'key': f'iscsi/{utils.name_to_config_section("iscsi")}.{igw_id}/iscsi-gateway.key',
  58                 'val': key_data,
  59             })
  60
  61         # add active mgr ip address to trusted list so dashboard can access
  62         trusted_ip_list = spec.trusted_ip_list if spec.trusted_ip_list else ''
  63         if trusted_ip_list:
  64             trusted_ip_list += ','
  65         trusted_ip_list += self.mgr.get_mgr_ip()
  66
  67         context = {
  68             'client_name': '{}.{}'.format(utils.name_to_config_section('iscsi'), igw_id),
  69             'trusted_ip_list': trusted_ip_list,
  70             'spec': spec
  71         }
  72         igw_conf = self.mgr.template.render('services/iscsi/iscsi-gateway.cfg.j2', context)
  73
  74         daemon_spec.keyring = keyring
  75         daemon_spec.extra_files = {'iscsi-gateway.cfg': igw_conf}
  76         daemon_spec.final_config, daemon_spec.deps = self.generate_config(daemon_spec)
  77         daemon_spec.deps = [self.mgr.get_mgr_ip()]
  78         return daemon_spec
  79
  80     def config_dashboard(self, daemon_descrs: List[DaemonDescription]) -> None:
  81         def get_set_cmd_dicts(out: str) -> List[dict]:
  82             gateways = json.loads(out)['gateways']
  83             cmd_dicts = []
  84             # TODO: fail, if we don't have a spec
  85             spec = cast(IscsiServiceSpec,
  86                         self.mgr.spec_store.all_specs.get(daemon_descrs[0].service_name(), None))
  87             if spec.api_secure and spec.ssl_cert and spec.ssl_key:
  88                 cmd_dicts.append({
  89                     'prefix': 'dashboard set-iscsi-api-ssl-verification',
  90                     'value': "false"
  91                 })
  92             else:
  93                 cmd_dicts.append({
  94                     'prefix': 'dashboard set-iscsi-api-ssl-verification',
  95                     'value': "true"
  96                 })
  97             for dd in daemon_descrs:
  98                 assert dd.hostname is not None
  99                 # todo: this can fail:
 100                 spec = cast(IscsiServiceSpec,
 101                             self.mgr.spec_store.all_specs.get(dd.service_name(), None))
 102                 if not spec:
 103                     logger.warning('No ServiceSpec found for %s', dd)
 104                     continue
 105                 ip = utils.resolve_ip(self.mgr.inventory.get_addr(dd.hostname))
 106                 # IPv6 URL encoding requires square brackets enclosing the ip
 107                 if type(ip_address(ip)) is IPv6Address:
 108                     ip = f'[{ip}]'
 109                 protocol = "http"
 110                 if spec.api_secure and spec.ssl_cert and spec.ssl_key:
 111                     protocol = "https"
 112                 service_url = '{}://{}:{}@{}:{}'.format(
 113                     protocol, spec.api_user or 'admin', spec.api_password or 'admin', ip, spec.api_port or '5000')
 114                 gw = gateways.get(dd.hostname)
 115                 if not gw or gw['service_url'] != service_url:
 116                     safe_service_url = '{}://{}:{}@{}:{}'.format(
 117                         protocol, '<api-user>', '<api-password>', ip, spec.api_port or '5000')
 118                     logger.info('Adding iSCSI gateway %s to Dashboard', safe_service_url)
 119                     cmd_dicts.append({
 120                         'prefix': 'dashboard iscsi-gateway-add',
 121                         'inbuf': service_url,
 122                         'name': dd.hostname
 123                     })
 124             return cmd_dicts
 125
 126         self._check_and_set_dashboard(
 127             service_name='iSCSI',
 128             get_cmd='dashboard iscsi-gateway-list',
 129             get_set_cmd_dicts=get_set_cmd_dicts
 130         )
 131
 132     def ok_to_stop(self,
 133                    daemon_ids: List[str],
 134                    force: bool = False,
 135                    known: Optional[List[str]] = None) -> HandleCommandResult:
 136         # if only 1 iscsi, alert user (this is not passable with --force)
 137         warn, warn_message = self._enough_daemons_to_stop(self.TYPE, daemon_ids, 'Iscsi', 1, True)
 138         if warn:
 139             return HandleCommandResult(-errno.EBUSY, '', warn_message)
 140
 141         # if reached here, there is > 1 nfs daemon. make sure none are down
 142         warn_message = (
 143             'ALERT: 1 iscsi daemon is already down. Please bring it back up before stopping this one')
 144         iscsi_daemons = self.mgr.cache.get_daemons_by_type(self.TYPE)
 145         for i in iscsi_daemons:
 146             if i.status != DaemonDescriptionStatus.running:
 147                 return HandleCommandResult(-errno.EBUSY, '', warn_message)
 148
 149         names = [f'{self.TYPE}.{d_id}' for d_id in daemon_ids]
 150         warn_message = f'It is presumed safe to stop {names}'
 151         return HandleCommandResult(0, warn_message, '')
 152
 153     def post_remove(self, daemon: DaemonDescription, is_failed_deploy: bool) -> None:
 154         """
 155         Called after the daemon is removed.
 156         """
 157         logger.debug(f'Post remove daemon {self.TYPE}.{daemon.daemon_id}')
 158
 159         # remove config for dashboard iscsi gateways
 160         ret, out, err = self.mgr.mon_command({
 161             'prefix': 'dashboard iscsi-gateway-rm',
 162             'name': daemon.hostname,
 163         })
 164         if not ret:
 165             logger.info(f'{daemon.hostname} removed from iscsi gateways dashboard config')
 166
 167         # needed to know if we have ssl stuff for iscsi in ceph config
 168         iscsi_config_dict = {}
 169         ret, iscsi_config, err = self.mgr.mon_command({
 170             'prefix': 'config-key dump',
 171             'key': 'iscsi',
 172         })
 173         if iscsi_config:
 174             iscsi_config_dict = json.loads(iscsi_config)
 175
 176         # remove iscsi cert and key from ceph config
 177         for iscsi_key, value in iscsi_config_dict.items():
 178             if f'iscsi/client.{daemon.name()}/' in iscsi_key:
 179                 ret, out, err = self.mgr.mon_command({
 180                     'prefix': 'config-key rm',
 181                     'key': iscsi_key,
 182                 })
 183                 logger.info(f'{iscsi_key} removed from ceph config')
 184
 185     def purge(self, service_name: str) -> None:
 186         """Removes configuration
 187         """
 188         spec = cast(IscsiServiceSpec, self.mgr.spec_store[service_name].spec)
 189         try:
 190             # remove service configuration from the pool
 191             try:
 192                 subprocess.run(['rados',
 193                                 '-k', str(self.mgr.get_ceph_option('keyring')),
 194                                 '-n', f'mgr.{self.mgr.get_mgr_id()}',
 195                                 '-p', cast(str, spec.pool),
 196                                 'rm',
 197                                 'gateway.conf'],
 198                                timeout=5)
 199                 logger.info(f'<gateway.conf> removed from {spec.pool}')
 200             except subprocess.CalledProcessError as ex:
 201                 logger.error(f'Error executing <<{ex.cmd}>>: {ex.output}')
 202             except subprocess.TimeoutExpired:
 203                 logger.error(f'timeout (5s) trying to remove <gateway.conf> from {spec.pool}')
 204
 205         except Exception:
 206             logger.exception(f'failed to purge {service_name}')