kubernetes_service.rb 4.94 KB
Newer Older
1
class KubernetesService < DeploymentService
2
  include Gitlab::CurrentSettings
3 4 5
  include Gitlab::Kubernetes
  include ReactiveCaching

6
  self.reactive_cache_key = ->(service) { [service.class.model_name.singular, service.project_id] }
7

8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26
  # Namespace defaults to the project path, but can be overridden in case that
  # is an invalid or inappropriate name
  prop_accessor :namespace

  #  Access to kubernetes is directly through the API
  prop_accessor :api_url

  # Bearer authentication
  # TODO:  user/password auth, client certificates
  prop_accessor :token

  # Provide a custom CA bundle for self-signed deployments
  prop_accessor :ca_pem

  with_options presence: true, if: :activated? do
    validates :api_url, url: true
    validates :token
  end

27 28 29 30 31 32 33 34 35
  validates :namespace,
    allow_blank: true,
    length: 1..63,
    if: :activated?,
    format: {
      with: Gitlab::Regex.kubernetes_namespace_regex,
      message: Gitlab::Regex.kubernetes_namespace_regex_message
    }

36 37
  after_save :clear_reactive_cache!

38
  def initialize_properties
39
    self.properties = {} if properties.nil?
40 41 42 43 44 45 46 47 48 49 50
  end

  def title
    'Kubernetes'
  end

  def description
    'Kubernetes / Openshift integration'
  end

  def help
51 52
    'To enable terminal access to Kubernetes environments, label your ' \
    'deployments with `app=$CI_ENVIRONMENT_SLUG`'
53 54
  end

55
  def self.to_param
56 57 58 59 60 61 62 63
    'kubernetes'
  end

  def fields
    [
        { type: 'text',
          name: 'namespace',
          title: 'Kubernetes namespace',
64
          placeholder: namespace_placeholder },
65 66 67
        { type: 'text',
          name: 'api_url',
          title: 'API URL',
68
          placeholder: 'Kubernetes API URL, like https://kube.example.com/' },
69 70 71
        { type: 'text',
          name: 'token',
          title: 'Service token',
72
          placeholder: 'Service token' },
73 74 75
        { type: 'textarea',
          name: 'ca_pem',
          title: 'Custom CA bundle',
76
          placeholder: 'Certificate Authority bundle (PEM format)' },
77 78 79 80 81
    ]
  end

  # Check we can connect to the Kubernetes API
  def test(*args)
82
    kubeclient = build_kubeclient!
83

84
    kubeclient.discover
85 86 87 88 89
    { success: kubeclient.discovered, result: "Checked API discovery endpoint" }
  rescue => err
    { success: false, result: err }
  end

90 91 92 93
  def predefined_variables
    variables = [
      { key: 'KUBE_URL', value: api_url, public: true },
      { key: 'KUBE_TOKEN', value: token, public: false },
94
      { key: 'KUBE_NAMESPACE', value: namespace_variable, public: true }
95
    ]
96 97 98 99 100 101

    if ca_pem.present?
      variables << { key: 'KUBE_CA_PEM', value: ca_pem, public: true }
      variables << { key: 'KUBE_CA_PEM_FILE', value: ca_pem, public: true, file: true }
    end

102 103 104
    variables
  end

105 106 107 108 109 110 111
  # Constructs a list of terminals from the reactive cache
  #
  # Returns nil if the cache is empty, in which case you should try again a
  # short time later
  def terminals(environment)
    with_reactive_cache do |data|
      pods = data.fetch(:pods, nil)
112 113 114
      filter_pods(pods, app: environment.slug).
        flat_map { |pod| terminals_for_pod(api_url, namespace, pod) }.
        each { |terminal| add_terminal_auth(terminal, terminal_auth) }
115 116
    end
  end
117

118 119 120 121
  # Caches all pods in the namespace so other calls don't need to block on
  # network access.
  def calculate_reactive_cache
    return unless active? && project && !project.pending_delete?
122

123 124 125 126 127 128 129 130 131 132 133 134 135 136
    kubeclient = build_kubeclient!

    # Store as hashes, rather than as third-party types
    pods = begin
      kubeclient.get_pods(namespace: namespace).as_json
    rescue KubeException => err
      raise err unless err.error_code == 404
      []
    end

    # We may want to cache extra things in the future
    { pods: pods }
  end

137 138
  TEMPLATE_PLACEHOLDER = 'Kubernetes namespace'.freeze

139 140
  private

141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156
  def namespace_placeholder
    default_namespace || TEMPLATE_PLACEHOLDER
  end

  def namespace_variable
    if namespace.present?
      namespace
    else
      default_namespace
    end
  end

  def default_namespace
    "#{project.path}-#{project.id}" if project.present?
  end

157 158
  def build_kubeclient!(api_path: 'api', api_version: 'v1')
    raise "Incomplete settings" unless api_url && namespace && token
159 160

    ::Kubeclient::Client.new(
161
      join_api_url(api_path),
162 163
      api_version,
      auth_options: kubeclient_auth_options,
164
      ssl_options: kubeclient_ssl_options,
165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182
      http_proxy_uri: ENV['http_proxy']
    )
  end

  def kubeclient_ssl_options
    opts = { verify_ssl: OpenSSL::SSL::VERIFY_PEER }

    if ca_pem.present?
      opts[:cert_store] = OpenSSL::X509::Store.new
      opts[:cert_store].add_cert(OpenSSL::X509::Certificate.new(ca_pem))
    end

    opts
  end

  def kubeclient_auth_options
    { bearer_token: token }
  end
183 184 185 186 187

  def join_api_url(*parts)
    url = URI.parse(api_url)
    prefix = url.path.sub(%r{/+\z}, '')

188
    url.path = [prefix, *parts].join("/")
189 190 191

    url.to_s
  end
192 193 194 195 196 197 198 199

  def terminal_auth
    {
      token: token,
      ca_pem: ca_pem,
      max_session_time: current_application_settings.terminal_max_session_time
    }
  end
200
end