ceph/src/pybind/mgr/dashboard/module.py

   1 # -*- coding: utf-8 -*-
   2 """
   3 ceph dashboard mgr plugin (based on CherryPy)
   4 """
   5 from __future__ import absolute_import
   6
   7 import collections
   8 import errno
   9 import logging
  10 import os
  11 import socket
  12 import ssl
  13 import sys
  14 import tempfile
  15 import threading
  16 import time
  17
  18 from mgr_module import MgrModule, MgrStandbyModule, Option, CLIWriteCommand
  19 from mgr_util import get_default_addr, ServerConfigException, verify_tls_files, \
  20     create_self_signed_cert
  21
  22 try:
  23     import cherrypy
  24     from cherrypy._cptools import HandlerWrapperTool
  25 except ImportError:
  26     # To be picked up and reported by .can_run()
  27     cherrypy = None
  28
  29 from .services.sso import load_sso_db
  30
  31 if cherrypy is not None:
  32     from .cherrypy_backports import patch_cherrypy
  33     patch_cherrypy(cherrypy.__version__)
  34
  35 # pylint: disable=wrong-import-position
  36 from . import mgr
  37 from .controllers import generate_routes, json_error_page
  38 from .grafana import push_local_dashboards
  39 from .tools import NotificationQueue, RequestLoggingTool, TaskManager, \
  40                    prepare_url_prefix, str_to_bool
  41 from .services.auth import AuthManager, AuthManagerTool, JwtManager
  42 from .services.sso import SSO_COMMANDS, \
  43                           handle_sso_command
  44 from .services.exception import dashboard_exception_handler
  45 from .settings import options_command_list, options_schema_list, \
  46                       handle_option_command
  47
  48 from .plugins import PLUGIN_MANAGER
  49 from .plugins import feature_toggles, debug  # noqa # pylint: disable=unused-import
  50
  51
  52 PLUGIN_MANAGER.hook.init()
  53
  54
  55 # cherrypy likes to sys.exit on error.  don't let it take us down too!
  56 # pylint: disable=W0613
  57 def os_exit_noop(*args):
  58     pass
  59
  60
  61 # pylint: disable=W0212
  62 os._exit = os_exit_noop
  63
  64
  65 logger = logging.getLogger(__name__)
  66
  67
  68 class CherryPyConfig(object):
  69     """
  70     Class for common server configuration done by both active and
  71     standby module, especially setting up SSL.
  72     """
  73
  74     def __init__(self):
  75         self._stopping = threading.Event()
  76         self._url_prefix = ""
  77
  78         self.cert_tmp = None
  79         self.pkey_tmp = None
  80
  81     def shutdown(self):
  82         self._stopping.set()
  83
  84     @property
  85     def url_prefix(self):
  86         return self._url_prefix
  87
  88     @staticmethod
  89     def update_cherrypy_config(config):
  90         PLUGIN_MANAGER.hook.configure_cherrypy(config=config)
  91         cherrypy.config.update(config)
  92
  93     # pylint: disable=too-many-branches
  94     def _configure(self):
  95         """
  96         Configure CherryPy and initialize self.url_prefix
  97
  98         :returns our URI
  99         """
 100         server_addr = self.get_localized_module_option(  # type: ignore
 101             'server_addr', get_default_addr())
 102         use_ssl = self.get_localized_module_option('ssl', True)  # type: ignore
 103         if not use_ssl:
 104             server_port = self.get_localized_module_option('server_port', 8080)  # type: ignore
 105         else:
 106             server_port = self.get_localized_module_option('ssl_server_port', 8443)  # type: ignore
 107
 108         if server_addr is None:
 109             raise ServerConfigException(
 110                 'no server_addr configured; '
 111                 'try "ceph config set mgr mgr/{}/{}/server_addr <ip>"'
 112                 .format(self.module_name, self.get_mgr_id()))  # type: ignore
 113         self.log.info('server: ssl=%s host=%s port=%d', 'yes' if use_ssl else 'no',  # type: ignore
 114                       server_addr, server_port)
 115
 116         # Initialize custom handlers.
 117         cherrypy.tools.authenticate = AuthManagerTool()
 118         cherrypy.tools.plugin_hooks_filter_request = cherrypy.Tool(
 119             'before_handler',
 120             lambda: PLUGIN_MANAGER.hook.filter_request_before_handler(request=cherrypy.request),
 121             priority=1)
 122         cherrypy.tools.request_logging = RequestLoggingTool()
 123         cherrypy.tools.dashboard_exception_handler = HandlerWrapperTool(dashboard_exception_handler,
 124                                                                         priority=31)
 125
 126         cherrypy.log.access_log.propagate = False
 127         cherrypy.log.error_log.propagate = False
 128
 129         # Apply the 'global' CherryPy configuration.
 130         config = {
 131             'engine.autoreload.on': False,
 132             'server.socket_host': server_addr,
 133             'server.socket_port': int(server_port),
 134             'error_page.default': json_error_page,
 135             'tools.request_logging.on': True,
 136             'tools.gzip.on': True,
 137             'tools.gzip.mime_types': [
 138                 # text/html and text/plain are the default types to compress
 139                 'text/html', 'text/plain',
 140                 # We also want JSON and JavaScript to be compressed
 141                 'application/json',
 142                 'application/javascript',
 143             ],
 144             'tools.json_in.on': True,
 145             'tools.json_in.force': True,
 146             'tools.plugin_hooks_filter_request.on': True,
 147         }
 148
 149         if use_ssl:
 150             # SSL initialization
 151             cert = self.get_localized_store("crt")  # type: ignore
 152             if cert is not None:
 153                 self.cert_tmp = tempfile.NamedTemporaryFile()
 154                 self.cert_tmp.write(cert.encode('utf-8'))
 155                 self.cert_tmp.flush()  # cert_tmp must not be gc'ed
 156                 cert_fname = self.cert_tmp.name
 157             else:
 158                 cert_fname = self.get_localized_module_option('crt_file')  # type: ignore
 159
 160             pkey = self.get_localized_store("key")  # type: ignore
 161             if pkey is not None:
 162                 self.pkey_tmp = tempfile.NamedTemporaryFile()
 163                 self.pkey_tmp.write(pkey.encode('utf-8'))
 164                 self.pkey_tmp.flush()  # pkey_tmp must not be gc'ed
 165                 pkey_fname = self.pkey_tmp.name
 166             else:
 167                 pkey_fname = self.get_localized_module_option('key_file')  # type: ignore
 168
 169             verify_tls_files(cert_fname, pkey_fname)
 170
 171             # Create custom SSL context to disable TLS 1.0 and 1.1.
 172             context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
 173             context.load_cert_chain(cert_fname, pkey_fname)
 174             if sys.version_info >= (3, 7):
 175                 context.minimum_version = ssl.TLSVersion.TLSv1_2
 176             else:
 177                 context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
 178
 179             config['server.ssl_module'] = 'builtin'
 180             config['server.ssl_certificate'] = cert_fname
 181             config['server.ssl_private_key'] = pkey_fname
 182             config['server.ssl_context'] = context
 183
 184         self.update_cherrypy_config(config)
 185
 186         self._url_prefix = prepare_url_prefix(self.get_module_option(  # type: ignore
 187             'url_prefix', default=''))
 188
 189         uri = "{0}://{1}:{2}{3}/".format(
 190             'https' if use_ssl else 'http',
 191             socket.getfqdn(server_addr if server_addr != '::' else ''),
 192             server_port,
 193             self.url_prefix
 194         )
 195
 196         return uri
 197
 198     def await_configuration(self):
 199         """
 200         Block until configuration is ready (i.e. all needed keys are set)
 201         or self._stopping is set.
 202
 203         :returns URI of configured webserver
 204         """
 205         while not self._stopping.is_set():
 206             try:
 207                 uri = self._configure()
 208             except ServerConfigException as e:
 209                 self.log.info(  # type: ignore
 210                     "Config not ready to serve, waiting: {0}".format(e)
 211                 )
 212                 # Poll until a non-errored config is present
 213                 self._stopping.wait(5)
 214             else:
 215                 self.log.info("Configured CherryPy, starting engine...")  # type: ignore
 216                 return uri
 217
 218
 219 class Module(MgrModule, CherryPyConfig):
 220     """
 221     dashboard module entrypoint
 222     """
 223
 224     COMMANDS = [
 225         {
 226             'cmd': 'dashboard set-jwt-token-ttl '
 227                    'name=seconds,type=CephInt',
 228             'desc': 'Set the JWT token TTL in seconds',
 229             'perm': 'w'
 230         },
 231         {
 232             'cmd': 'dashboard get-jwt-token-ttl',
 233             'desc': 'Get the JWT token TTL in seconds',
 234             'perm': 'r'
 235         },
 236         {
 237             "cmd": "dashboard create-self-signed-cert",
 238             "desc": "Create self signed certificate",
 239             "perm": "w"
 240         },
 241         {
 242             "cmd": "dashboard grafana dashboards update",
 243             "desc": "Push dashboards to Grafana",
 244             "perm": "w",
 245         },
 246     ]
 247     COMMANDS.extend(options_command_list())
 248     COMMANDS.extend(SSO_COMMANDS)
 249     PLUGIN_MANAGER.hook.register_commands()
 250
 251     MODULE_OPTIONS = [
 252         Option(name='server_addr', type='str', default=get_default_addr()),
 253         Option(name='server_port', type='int', default=8080),
 254         Option(name='ssl_server_port', type='int', default=8443),
 255         Option(name='jwt_token_ttl', type='int', default=28800),
 256         Option(name='url_prefix', type='str', default=''),
 257         Option(name='key_file', type='str', default=''),
 258         Option(name='crt_file', type='str', default=''),
 259         Option(name='ssl', type='bool', default=True),
 260         Option(name='standby_behaviour', type='str', default='redirect',
 261                enum_allowed=['redirect', 'error']),
 262         Option(name='standby_error_status_code', type='int', default=500,
 263                min=400, max=599)
 264     ]
 265     MODULE_OPTIONS.extend(options_schema_list())
 266     for options in PLUGIN_MANAGER.hook.get_options() or []:
 267         MODULE_OPTIONS.extend(options)
 268
 269     __pool_stats = collections.defaultdict(lambda: collections.defaultdict(
 270         lambda: collections.deque(maxlen=10)))  # type: dict
 271
 272     def __init__(self, *args, **kwargs):
 273         super(Module, self).__init__(*args, **kwargs)
 274         CherryPyConfig.__init__(self)
 275
 276         mgr.init(self)
 277
 278         self._stopping = threading.Event()
 279         self.shutdown_event = threading.Event()
 280         self.ACCESS_CTRL_DB = None
 281         self.SSO_DB = None
 282         self.health_checks = {}
 283
 284     @classmethod
 285     def can_run(cls):
 286         if cherrypy is None:
 287             return False, "Missing dependency: cherrypy"
 288
 289         if not os.path.exists(cls.get_frontend_path()):
 290             return False, "Frontend assets not found: incomplete build?"
 291
 292         return True, ""
 293
 294     @classmethod
 295     def get_frontend_path(cls):
 296         current_dir = os.path.dirname(os.path.abspath(__file__))
 297         return os.path.join(current_dir, 'frontend/dist')
 298
 299     def serve(self):
 300
 301         if 'COVERAGE_ENABLED' in os.environ:
 302             import coverage
 303             __cov = coverage.Coverage(config_file="{}/.coveragerc"
 304                                       .format(os.path.dirname(__file__)),
 305                                       data_suffix=True)
 306             __cov.start()
 307             cherrypy.engine.subscribe('after_request', __cov.save)
 308             cherrypy.engine.subscribe('stop', __cov.stop)
 309
 310         AuthManager.initialize()
 311         load_sso_db()
 312
 313         uri = self.await_configuration()
 314         if uri is None:
 315             # We were shut down while waiting
 316             return
 317
 318         # Publish the URI that others may use to access the service we're
 319         # about to start serving
 320         self.set_uri(uri)
 321
 322         mapper, parent_urls = generate_routes(self.url_prefix)
 323
 324         config = {}
 325         for purl in parent_urls:
 326             config[purl] = {
 327                 'request.dispatch': mapper
 328             }
 329
 330         cherrypy.tree.mount(None, config=config)
 331
 332         PLUGIN_MANAGER.hook.setup()
 333
 334         cherrypy.engine.start()
 335         NotificationQueue.start_queue()
 336         TaskManager.init()
 337         logger.info('Engine started.')
 338         update_dashboards = str_to_bool(
 339             self.get_module_option('GRAFANA_UPDATE_DASHBOARDS', 'False'))
 340         if update_dashboards:
 341             logger.info('Starting Grafana dashboard task')
 342             TaskManager.run(
 343                 'grafana/dashboards/update',
 344                 {},
 345                 push_local_dashboards,
 346                 kwargs=dict(tries=10, sleep=60),
 347             )
 348         # wait for the shutdown event
 349         self.shutdown_event.wait()
 350         self.shutdown_event.clear()
 351         NotificationQueue.stop()
 352         cherrypy.engine.stop()
 353         logger.info('Engine stopped')
 354
 355     def shutdown(self):
 356         super(Module, self).shutdown()
 357         CherryPyConfig.shutdown(self)
 358         logger.info('Stopping engine...')
 359         self.shutdown_event.set()
 360
 361     @CLIWriteCommand("dashboard set-ssl-certificate",
 362                      "name=mgr_id,type=CephString,req=false")
 363     def set_ssl_certificate(self, mgr_id=None, inbuf=None):
 364         if inbuf is None:
 365             return -errno.EINVAL, '',\
 366                    'Please specify the certificate file with "-i" option'
 367         if mgr_id is not None:
 368             self.set_store('{}/crt'.format(mgr_id), inbuf)
 369         else:
 370             self.set_store('crt', inbuf)
 371         return 0, 'SSL certificate updated', ''
 372
 373     @CLIWriteCommand("dashboard set-ssl-certificate-key",
 374                      "name=mgr_id,type=CephString,req=false")
 375     def set_ssl_certificate_key(self, mgr_id=None, inbuf=None):
 376         if inbuf is None:
 377             return -errno.EINVAL, '',\
 378                    'Please specify the certificate key file with "-i" option'
 379         if mgr_id is not None:
 380             self.set_store('{}/key'.format(mgr_id), inbuf)
 381         else:
 382             self.set_store('key', inbuf)
 383         return 0, 'SSL certificate key updated', ''
 384
 385     def handle_command(self, inbuf, cmd):
 386         # pylint: disable=too-many-return-statements
 387         res = handle_option_command(cmd, inbuf)
 388         if res[0] != -errno.ENOSYS:
 389             return res
 390         res = handle_sso_command(cmd)
 391         if res[0] != -errno.ENOSYS:
 392             return res
 393         if cmd['prefix'] == 'dashboard set-jwt-token-ttl':
 394             self.set_module_option('jwt_token_ttl', str(cmd['seconds']))
 395             return 0, 'JWT token TTL updated', ''
 396         if cmd['prefix'] == 'dashboard get-jwt-token-ttl':
 397             ttl = self.get_module_option('jwt_token_ttl', JwtManager.JWT_TOKEN_TTL)
 398             return 0, str(ttl), ''
 399         if cmd['prefix'] == 'dashboard create-self-signed-cert':
 400             self.create_self_signed_cert()
 401             return 0, 'Self-signed certificate created', ''
 402         if cmd['prefix'] == 'dashboard grafana dashboards update':
 403             push_local_dashboards()
 404             return 0, 'Grafana dashboards updated', ''
 405
 406         return (-errno.EINVAL, '', 'Command not found \'{0}\''
 407                 .format(cmd['prefix']))
 408
 409     def create_self_signed_cert(self):
 410         cert, pkey = create_self_signed_cert('IT', 'ceph-dashboard')
 411         self.set_store('crt', cert)
 412         self.set_store('key', pkey)
 413
 414     def notify(self, notify_type, notify_id):
 415         NotificationQueue.new_notification(notify_type, notify_id)
 416
 417     def get_updated_pool_stats(self):
 418         df = self.get('df')
 419         pool_stats = {p['id']: p['stats'] for p in df['pools']}
 420         now = time.time()
 421         for pool_id, stats in pool_stats.items():
 422             for stat_name, stat_val in stats.items():
 423                 self.__pool_stats[pool_id][stat_name].append((now, stat_val))
 424
 425         return self.__pool_stats
 426
 427     def config_notify(self):
 428         """
 429         This method is called whenever one of our config options is changed.
 430         """
 431         PLUGIN_MANAGER.hook.config_notify()
 432
 433     def refresh_health_checks(self):
 434         self.set_health_checks(self.health_checks)
 435
 436
 437 class StandbyModule(MgrStandbyModule, CherryPyConfig):
 438     def __init__(self, *args, **kwargs):
 439         super(StandbyModule, self).__init__(*args, **kwargs)
 440         CherryPyConfig.__init__(self)
 441         self.shutdown_event = threading.Event()
 442
 443         # We can set the global mgr instance to ourselves even though
 444         # we're just a standby, because it's enough for logging.
 445         mgr.init(self)
 446
 447     def serve(self):
 448         uri = self.await_configuration()
 449         if uri is None:
 450             # We were shut down while waiting
 451             return
 452
 453         module = self
 454
 455         class Root(object):
 456             @cherrypy.expose
 457             def default(self, *args, **kwargs):
 458                 if module.get_module_option('standby_behaviour', 'redirect') == 'redirect':
 459                     active_uri = module.get_active_uri()
 460                     if active_uri:
 461                         module.log.info("Redirecting to active '%s'", active_uri)
 462                         raise cherrypy.HTTPRedirect(active_uri)
 463                     else:
 464                         template = """
 465                     <html>
 466                         <!-- Note: this is only displayed when the standby
 467                              does not know an active URI to redirect to, otherwise
 468                              a simple redirect is returned instead -->
 469                         <head>
 470                             <title>Ceph</title>
 471                             <meta http-equiv="refresh" content="{delay}">
 472                         </head>
 473                         <body>
 474                             No active ceph-mgr instance is currently running
 475                             the dashboard. A failover may be in progress.
 476                             Retrying in {delay} seconds...
 477                         </body>
 478                     </html>
 479                         """
 480                         return template.format(delay=5)
 481                 else:
 482                     status = module.get_module_option('standby_error_status_code', 500)
 483                     raise cherrypy.HTTPError(status, message="Keep on looking")
 484
 485         cherrypy.tree.mount(Root(), "{}/".format(self.url_prefix), {})
 486         self.log.info("Starting engine...")
 487         cherrypy.engine.start()
 488         self.log.info("Engine started...")
 489         # Wait for shutdown event
 490         self.shutdown_event.wait()
 491         self.shutdown_event.clear()
 492         cherrypy.engine.stop()
 493         self.log.info("Engine stopped.")
 494
 495     def shutdown(self):
 496         CherryPyConfig.shutdown(self)
 497
 498         self.log.info("Stopping engine...")
 499         self.shutdown_event.set()
 500         self.log.info("Stopped engine...")