bosh-director 1.3202.0 → 1.3213.0

data/lib/bosh/director/models/compiled_package.rb

@@ -1,26 +1,31 @@
 module Bosh::Director::Models
   class CompiledPackage < Sequel::Model(Bosh::Director::Config.db)
     many_to_one :package
-    many_to_one :stemcell
-
-    # Creates a dependency_key from a list of dependencies
-    # Input MUST include immediate & transitive dependencies
-    def self.create_dependency_key(transitive_dependencies)
-      key = transitive_dependencies.to_a.sort_by(&:name).map { |p| [p.name, p.version]}
-      Yajl::Encoder.encode(key)
-    end
 
     # Creates a 'unique' key to use in the global package cache
-    def self.create_cache_key(package, transitive_dependencies, stemcell)
+    def self.create_cache_key(package, transitive_dependencies, stemcell_sha1)
       dependency_fingerprints = transitive_dependencies.to_a.sort_by(&:name).map {|p| p.fingerprint }
-      hash_input = ([package.fingerprint, stemcell.sha1]+dependency_fingerprints).join('')
+      hash_input = ([package.fingerprint, stemcell_sha1]+dependency_fingerprints).join('')
       Digest::SHA1.hexdigest(hash_input)
     end
 
+    # Marks job template model as being used by release version
+    # @param string stemcell os & version, e.g. 'ubuntu_trusty/3146.1'
+    # @return hash, e.g. { stemcell_os: 'ubuntu_trusty', stemcell_version: '3146.1' }
+    def self.split_stemcell_os_and_version(name)
+      values = name.split('/', 2)
+
+      unless 2 == values.length
+        raise "Expected value to be in the format of \"{os_name}/{stemcell_version}\", but given \"#{name}\""
+      end
+
+      return { os: values[0], version: values[1] }
+    end
+
     def validate
-      validates_presence [:package_id, :stemcell_id, :sha1, :blobstore_id, :dependency_key]
-      validates_unique [:package_id, :stemcell_id, :dependency_key]
-      validates_unique [:package_id, :stemcell_id, :build]
+      validates_presence [:package_id, :stemcell_os, :stemcell_version, :sha1, :blobstore_id, :dependency_key]
+      validates_unique [:package_id, :stemcell_os, :stemcell_version, :dependency_key]
+      validates_unique [:package_id, :stemcell_os, :stemcell_version, :build]
     end
 
     def before_save
@@ -37,10 +42,11 @@ module Bosh::Director::Models
       package.version
     end
 
-    def self.generate_build_number(package_model, stemcell_model)
+    def self.generate_build_number(package_model, stemcell_os, stemcell_version)
       attrs = {
         :package_id => package_model.id,
-        :stemcell_id => stemcell_model.id
+        :stemcell_os => stemcell_os,
+        :stemcell_version => stemcell_version,
       }
 
       filter(attrs).max(:build).to_i + 1

data/lib/bosh/director/models/deployment.rb

@@ -7,6 +7,7 @@ module Bosh::Director::Models
     one_to_many  :properties, :class => "Bosh::Director::Models::DeploymentProperty"
     one_to_many  :problems, :class => "Bosh::Director::Models::DeploymentProblem"
     many_to_one  :cloud_config
+    many_to_one  :runtime_config
 
     def validate
       validates_presence :name
@@ -22,6 +23,15 @@ module Bosh::Director::Models
     def link_spec=(data)
       self.link_spec_json = Yajl::Encoder.encode(data)
     end
+
+    def self.transform_admin_team_scope_to_teams(token_scopes)
+      return [] if token_scopes.nil?
+      team_scopes = token_scopes.map do |scope|
+        match = scope.match(/\Abosh\.teams\.([^\.]*)\.admin\z/)
+        match[1] unless match.nil?
+      end
+      team_scopes.compact
+    end
   end
 
   Deployment.plugin :association_dependencies

data/lib/bosh/director/models/instance.rb

@@ -41,7 +41,8 @@ module Bosh::Director::Models
 
     def cloud_properties_hash
       if cloud_properties.nil?
-        spec['vm_type']['cloud_properties']
+        return {} if spec.nil? || spec['vm_type'].nil?
+        spec['vm_type']['cloud_properties'] || {}
       else
         JSON.parse(cloud_properties)
       end

data/lib/bosh/director/models/release_version.rb

@@ -11,22 +11,6 @@ module Bosh::Director::Models
       validates_unique [:release_id, :version]
     end
 
-    # immediate dependency models
-    def dependencies(package)
-      package.dependency_set.map { |package_name| package_by_name(package_name) }.to_set
-    end
-
-    # all dependency models, including transitives
-    # assumes there are no cycles (checked during upload)
-    def transitive_dependencies(package)
-      dependency_set = Set.new
-      dependencies(package).each do |dependency|
-        dependency_set << dependency
-        dependency_set.merge(transitive_dependencies(dependency))
-      end
-      dependency_set
-    end
-
     def package_by_name(package_name)
       packages_by_name.fetch(package_name)
     end

data/lib/bosh/director/models/runtime_config.rb

@@ -0,0 +1,19 @@
+module Bosh
+  module Director
+    module Models
+      class RuntimeConfig < Sequel::Model(Bosh::Director::Config.db)
+        def before_create
+          self.created_at ||= Time.now
+        end
+
+        def manifest=(runtime_config_hash)
+          self.properties = Psych.dump(runtime_config_hash)
+        end
+
+        def manifest
+          Psych.load properties
+        end
+      end
+    end
+  end
+end

data/lib/bosh/director/models/template.rb

@@ -36,12 +36,12 @@ module Bosh::Director::Models
       object_or_nil(self.properties_json)
     end
 
-    def requires=(requires_spec)
-      self.requires_json = json_encode(requires_spec)
+    def consumes=(consumes_spec)
+      self.consumes_json = json_encode(consumes_spec)
     end
 
-    def requires
-      object_or_nil(self.requires_json)
+    def consumes
+      object_or_nil(self.consumes_json)
     end
 
     def provides=(provides_spec)

data/lib/bosh/director/package_dependencies_manager.rb

@@ -0,0 +1,22 @@
+module Bosh
+  module Director
+    class PackageDependenciesManager
+      def initialize(release_version)
+        @release_version = release_version
+      end
+
+      def transitive_dependencies(package)
+        dependency_set = Set.new
+        dependencies(package).each do |dependency|
+          dependency_set << dependency
+          dependency_set.merge(transitive_dependencies(dependency))
+        end
+        dependency_set
+      end
+
+      def dependencies(package)
+        package.dependency_set.map { |package_name| @release_version.package_by_name(package_name) }.to_set
+      end
+    end
+  end
+end

data/lib/bosh/director/password_helper.rb

@@ -0,0 +1,18 @@
+require 'securerandom'
+require 'unix_crypt'
+
+module Bosh::Director
+  module PasswordHelper
+    # SHA512 tolerates salt lengths from 8 to 16 bytes
+    # we found this by using the mkpasswd (from the whois package) on ubuntu linux
+    SALT_MAX_LENGTH_IN_BYTES = 16
+
+    PASSWORD_LENGTH = 30
+
+    def sha512_hashed_password
+      salt = SecureRandom.hex(SALT_MAX_LENGTH_IN_BYTES / 2)
+      password = SecureRandom.hex(PASSWORD_LENGTH)
+      UnixCrypt::SHA512.build(password, salt)
+    end
+  end
+end

data/lib/bosh/director/permission_authorizer.rb

@@ -1,52 +1,72 @@
 module Bosh::Director
   class PermissionAuthorizer
-    def initialize
-      @director_uuid ||= Bosh::Director::Models::DirectorAttribute.uuid
+    def initialize(uuid_provider)
+      @uuid_provider = uuid_provider
     end
 
-    def has_admin_scope?(token_scopes)
-      !(intersect(permissions[:write], token_scopes).empty?)
+    def granted_or_raise(subject, permission, user_scopes)
+      if !is_granted?(subject, permission, user_scopes)
+        raise UnauthorizedToAccessDeployment, "Require one of the scopes: #{list_expected_scope(subject, permission, user_scopes).join(', ')}"
+      end
     end
 
-    def has_admin_or_director_read_scope?(token_scopes)
-      !(intersect(permissions[:read], token_scopes).empty?)
+    def is_granted?(subject, permission, user_scopes)
+      !intersect(user_scopes, list_expected_scope(subject, permission, user_scopes)).empty?
     end
 
-    def has_team_admin_scope?(token_scopes)
-      token_scopes.any? do |e|
-        /bosh.teams.[^\.]+.admin/ =~ e
+    def list_expected_scope(subject, permission, user_scopes)
+      expected_scope = director_permissions[:admin]
+
+      if subject.instance_of? Models::Deployment
+        expected_scope << deployment_team_scopes(subject, 'admin')
+
+        if :admin == permission
+          # already allowed with initial expected_scope
+        elsif :read == permission
+          expected_scope << director_permissions[:read]
+        else
+          raise ArgumentError, "Unexpected permission for deployment: #{permission}"
+        end
+      elsif :director == subject
+        if :admin == permission
+          # already allowed with initial expected_scope
+        elsif :create_deployment == permission
+          expected_scope << add_bosh_admin_scopes(user_scopes)
+        elsif [:read_releases, :list_deployments, :read_stemcells, :list_tasks].include?(permission)
+          expected_scope << director_permissions[:read]
+          expected_scope << add_bosh_admin_scopes(user_scopes)
+        elsif :read == permission
+          expected_scope << director_permissions[:read]
+        else
+          raise ArgumentError, "Unexpected permission for director: #{permission}"
+        end
+      else
+        raise ArgumentError, "Unexpected subject: #{subject}"
       end
+
+      expected_scope.flatten.uniq
     end
 
-    def contains_requested_scope?(valid_scopes, token_scopes)
-      return false unless valid_scopes
-      !(intersect(valid_scopes, token_scopes).empty?)
+    private
+
+    def add_bosh_admin_scopes(user_scopes)
+      user_scopes.select do |scope|
+        scope.match(/\Abosh\.teams\.([^\.]*)\.admin\z/)
+      end
     end
 
-    def permissions
+    def director_permissions
       {
-        :read  => ['bosh.admin', "bosh.#{@director_uuid}.admin", 'bosh.read', "bosh.#{@director_uuid}.read"],
-        :write => ['bosh.admin', "bosh.#{@director_uuid}.admin"]
+        read: ['bosh.read', "bosh.#{@uuid_provider.uuid}.read"],
+        admin: ['bosh.admin', "bosh.#{@uuid_provider.uuid}.admin"],
       }
     end
 
-    def is_authorized?(provided_scopes, token_scopes)
-      return true if has_admin_or_director_read_scope?(token_scopes)
-
-      return contains_requested_scope?(provided_scopes, token_scopes)
+    def deployment_team_scopes(deployment, permission)
+      permissions = deployment.teams.nil? ? [] : deployment.teams.split(',')
+      permissions.map{ |team_name| "bosh.teams.#{team_name}.#{permission}" }
     end
 
-    def raise_error_if_unauthorized(provided_scopes, deployment_scopes)
-      return if has_admin_scope?(provided_scopes)
-
-      if (deployment_scopes & provided_scopes).empty?
-        raise Bosh::Director::UnauthorizedToAccessDeployment,
-          'You are unauthorized to view this deployment. Please contact the BOSH admin.'
-      end
-    end
-
-    private
-
     def intersect(valid_scopes, token_scopes)
       valid_scopes & token_scopes
     end

data/lib/bosh/director/post_deployment_script_runner.rb

@@ -0,0 +1,40 @@
+module Bosh::Director
+  class PostDeploymentScriptRunner
+
+    def self.run_post_deploys_after_resurrection(deployment)
+      return unless Config.enable_post_deploy
+      instances = Models::Instance.filter(deployment: deployment).exclude(vm_cid: nil).all
+      agent_options = {
+          timeout: 10,
+          retry_methods: {get_state: 0}
+      }
+
+      ThreadPool.new(:max_threads => Config.max_threads).wrap do |pool|
+        instances.each do |instance|
+          pool.process do
+            agent = AgentClient.with_vm_credentials_and_agent_id(instance.credentials, instance.agent_id, agent_options)
+            begin
+              agent.run_script('post-deploy', {})
+            rescue Bosh::Director::RpcTimeout
+              # Ignoring timeout errors
+            end
+          end
+        end
+      end
+    end
+
+    def self.run_post_deploys_after_deployment(deployment_plan)
+      return unless Config.enable_post_deploy
+      ThreadPool.new(:max_threads => Config.max_threads).wrap do |pool|
+        deployment_plan.jobs.each do |job|
+          job.instances.select{|instance| instance.model[:vm_cid] != nil && instance.model.state != "stopped"}.each do |instance|
+            pool.process do
+              instance.agent_client.run_script('post-deploy', {})
+            end
+          end
+        end
+      end
+    end
+
+  end
+end

data/lib/bosh/director/problem_handlers/missing_disk.rb

@@ -23,8 +23,8 @@ module Bosh::Director
 
       def description
         job = @instance.job || "unknown job"
-        index = @instance.index || "unknown index"
-        disk_label = "`#{@disk.disk_cid}' (#{job}/#{index}, #{@disk.size.to_i}M)"
+        uuid = @instance.uuid || "unknown id"
+        disk_label = "`#{@disk.disk_cid}' (#{job}/#{uuid}, #{@disk.size.to_i}M)"
         "Disk #{disk_label} is missing"
       end
 

data/lib/bosh/director/problem_resolver.rb

@@ -6,6 +6,7 @@ module Bosh::Director
     def initialize(deployment)
       @deployment = deployment
       @resolved_count = 0
+      @resolution_error_logs = StringIO.new
 
       #temp
       @event_log = Config.event_log
@@ -42,7 +43,10 @@ module Bosh::Director
           apply_resolution(problem)
         end
       end
-      @resolved_count
+
+      error_message = @resolution_error_logs.string.empty? ? nil : @resolution_error_logs.string.chomp
+
+      [@resolved_count, error_message]
     end
 
     private
@@ -75,8 +79,10 @@ module Bosh::Director
     private
 
     def log_resolution_error(problem, error)
-      logger.error("Error resolving problem `#{problem.id}': #{error}")
+      error_message = "Error resolving problem `#{problem.id}': #{error}"
+      logger.error(error_message)
       logger.error(error.backtrace.join("\n"))
+      @resolution_error_logs.puts(error_message)
     end
   end
 end

data/lib/bosh/director/problem_scanner/scanner.rb

@@ -20,7 +20,7 @@ module Bosh::Director
       def reset(vms=nil)
         if vms
           vms.each do |job, index|
-            instance = @instance_manager.find_by_name(@deployment.name, job, index)
+            instance = @instance_manager.find_by_name(@deployment, job, index)
 
             Models::DeploymentProblem.where(
               deployment: @deployment,

data/lib/bosh/director/problem_scanner/vm_scan_stage.rb

@@ -18,7 +18,7 @@ module Bosh::Director
     def scan(vms=nil)
       if vms
         instances = vms.map do |job, index|
-          @instance_manager.find_by_name(@deployment.name, job, index)
+          @instance_manager.find_by_name(@deployment, job, index)
         end
       else
         instances = Models::Instance.filter(deployment: @deployment).exclude(vm_cid: nil).all

data/lib/bosh/director/validation_helper.rb

@@ -5,7 +5,7 @@ module Bosh::Director
 
       if hash && !hash.kind_of?(Hash)
         raise Bosh::Director::ValidationInvalidType,
-              "Object (#{hash.inspect}) did not match the required type `Hash'"
+              "Object (#{hash.inspect}) did not match the required type 'Hash'"
 
       elsif hash && hash.has_key?(property)
         result = hash[property]
@@ -27,12 +27,12 @@ module Bosh::Director
 
         if options[:min] && result < options[:min]
           raise ValidationViolatedMin,
-                "`#{property}' value (#{result.inspect}) should be greater than #{options[:min].inspect}"
+                "'#{property}' value (#{result.inspect}) should be greater than #{options[:min].inspect}"
         end
 
         if options[:max] && result > options[:max]
           raise ValidationViolatedMax,
-                "`#{property}' value (#{result.inspect}) should be less than #{options[:max].inspect}"
+                "'#{property}' value (#{result.inspect}) should be less than #{options[:max].inspect}"
         end
 
       elsif options[:default]
@@ -40,7 +40,7 @@ module Bosh::Director
 
       elsif !options[:optional]
         raise ValidationMissingField,
-              "Required property `#{property}' was not specified in object (#{hash.inspect})"
+              "Required property '#{property}' was not specified in object (#{hash.inspect})"
       end
 
       result
@@ -48,7 +48,7 @@ module Bosh::Director
 
     def invalid_type(property, klass, value)
       raise ValidationInvalidType,
-            "Property `#{property}' (value #{value.inspect}) did not match the required type `#{klass}'"
+            "Property '#{property}' (value #{value.inspect}) did not match the required type '#{klass}'"
     end
   end
 end