chef-provisioning-aws 3.0.4 → 3.0.6
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/Gemfile +16 -5
- data/Rakefile +15 -6
- data/chef-provisioning-aws.gemspec +17 -17
- data/lib/chef/provider/aws_auto_scaling_group.rb +5 -6
- data/lib/chef/provider/aws_cache_cluster.rb +21 -15
- data/lib/chef/provider/aws_cache_replication_group.rb +12 -8
- data/lib/chef/provider/aws_cache_subnet_group.rb +3 -3
- data/lib/chef/provider/aws_cloudsearch_domain.rb +9 -13
- data/lib/chef/provider/aws_cloudwatch_alarm.rb +10 -12
- data/lib/chef/provider/aws_dhcp_options.rb +18 -21
- data/lib/chef/provider/aws_ebs_volume.rb +24 -26
- data/lib/chef/provider/aws_eip_address.rb +10 -13
- data/lib/chef/provider/aws_elasticsearch_domain.rb +19 -18
- data/lib/chef/provider/aws_iam_instance_profile.rb +5 -7
- data/lib/chef/provider/aws_iam_role.rb +14 -17
- data/lib/chef/provider/aws_image.rb +6 -6
- data/lib/chef/provider/aws_instance.rb +5 -5
- data/lib/chef/provider/aws_internet_gateway.rb +8 -11
- data/lib/chef/provider/aws_key_pair.rb +15 -17
- data/lib/chef/provider/aws_launch_configuration.rb +11 -14
- data/lib/chef/provider/aws_load_balancer.rb +1 -2
- data/lib/chef/provider/aws_nat_gateway.rb +6 -7
- data/lib/chef/provider/aws_network_acl.rb +28 -29
- data/lib/chef/provider/aws_network_interface.rb +25 -27
- data/lib/chef/provider/aws_rds_instance.rb +12 -13
- data/lib/chef/provider/aws_rds_parameter_group.rb +8 -8
- data/lib/chef/provider/aws_rds_subnet_group.rb +8 -9
- data/lib/chef/provider/aws_route_table.rb +19 -20
- data/lib/chef/provider/aws_s3_bucket.rb +22 -25
- data/lib/chef/provider/aws_security_group.rb +268 -285
- data/lib/chef/provider/aws_server_certificate.rb +6 -5
- data/lib/chef/provider/aws_sns_topic.rb +4 -6
- data/lib/chef/provider/aws_sqs_queue.rb +3 -4
- data/lib/chef/provider/aws_subnet.rb +29 -34
- data/lib/chef/provider/aws_vpc.rb +108 -116
- data/lib/chef/provider/aws_vpc_peering_connection.rb +11 -11
- data/lib/chef/provisioning/aws_driver.rb +4 -2
- data/lib/chef/provisioning/aws_driver/aws_provider.rb +234 -241
- data/lib/chef/provisioning/aws_driver/aws_rds_resource.rb +5 -7
- data/lib/chef/provisioning/aws_driver/aws_resource.rb +182 -185
- data/lib/chef/provisioning/aws_driver/aws_resource_with_entry.rb +17 -17
- data/lib/chef/provisioning/aws_driver/aws_taggable.rb +13 -15
- data/lib/chef/provisioning/aws_driver/aws_tagger.rb +47 -48
- data/lib/chef/provisioning/aws_driver/credentials.rb +96 -100
- data/lib/chef/provisioning/aws_driver/credentials2.rb +42 -45
- data/lib/chef/provisioning/aws_driver/driver.rb +1349 -1362
- data/lib/chef/provisioning/aws_driver/exceptions.rb +10 -12
- data/lib/chef/provisioning/aws_driver/super_lwrp.rb +60 -60
- data/lib/chef/provisioning/aws_driver/tagging_strategy/auto_scaling.rb +49 -50
- data/lib/chef/provisioning/aws_driver/tagging_strategy/ec2.rb +37 -38
- data/lib/chef/provisioning/aws_driver/tagging_strategy/elasticsearch.rb +14 -15
- data/lib/chef/provisioning/aws_driver/tagging_strategy/elb.rb +29 -31
- data/lib/chef/provisioning/aws_driver/tagging_strategy/rds.rb +39 -40
- data/lib/chef/provisioning/aws_driver/tagging_strategy/s3.rb +41 -43
- data/lib/chef/provisioning/aws_driver/version.rb +5 -5
- data/lib/chef/provisioning/driver_init/aws.rb +2 -2
- data/lib/chef/resource/aws_auto_scaling_group.rb +1 -1
- data/lib/chef/resource/aws_cache_cluster.rb +9 -12
- data/lib/chef/resource/aws_cache_replication_group.rb +9 -11
- data/lib/chef/resource/aws_cache_subnet_group.rb +8 -10
- data/lib/chef/resource/aws_cloudsearch_domain.rb +4 -5
- data/lib/chef/resource/aws_cloudwatch_alarm.rb +17 -18
- data/lib/chef/resource/aws_dhcp_options.rb +2 -2
- data/lib/chef/resource/aws_ebs_volume.rb +10 -10
- data/lib/chef/resource/aws_eip_address.rb +5 -5
- data/lib/chef/resource/aws_elasticsearch_domain.rb +4 -4
- data/lib/chef/resource/aws_iam_instance_profile.rb +4 -5
- data/lib/chef/resource/aws_iam_role.rb +2 -3
- data/lib/chef/resource/aws_image.rb +3 -3
- data/lib/chef/resource/aws_instance.rb +4 -4
- data/lib/chef/resource/aws_internet_gateway.rb +3 -3
- data/lib/chef/resource/aws_key_pair.rb +7 -7
- data/lib/chef/resource/aws_launch_configuration.rb +4 -4
- data/lib/chef/resource/aws_load_balancer.rb +7 -7
- data/lib/chef/resource/aws_nat_gateway.rb +11 -11
- data/lib/chef/resource/aws_network_acl.rb +7 -8
- data/lib/chef/resource/aws_network_interface.rb +9 -9
- data/lib/chef/resource/aws_rds_instance.rb +4 -4
- data/lib/chef/resource/aws_rds_parameter_group.rb +3 -3
- data/lib/chef/resource/aws_rds_subnet_group.rb +4 -4
- data/lib/chef/resource/aws_route53_hosted_zone.rb +37 -40
- data/lib/chef/resource/aws_route53_record_set.rb +22 -24
- data/lib/chef/resource/aws_route_table.rb +7 -7
- data/lib/chef/resource/aws_s3_bucket.rb +7 -7
- data/lib/chef/resource/aws_security_group.rb +10 -10
- data/lib/chef/resource/aws_server_certificate.rb +6 -8
- data/lib/chef/resource/aws_sns_topic.rb +2 -2
- data/lib/chef/resource/aws_sqs_queue.rb +5 -7
- data/lib/chef/resource/aws_subnet.rb +9 -9
- data/lib/chef/resource/aws_vpc.rb +11 -11
- data/lib/chef/resource/aws_vpc_peering_connection.rb +4 -4
- data/spec/aws_support.rb +44 -45
- data/spec/aws_support/aws_resource_run_wrapper.rb +2 -2
- data/spec/aws_support/deep_matcher.rb +2 -3
- data/spec/aws_support/deep_matcher/fuzzy_match_objects.rb +6 -9
- data/spec/aws_support/deep_matcher/match_values_failure_messages.rb +30 -37
- data/spec/aws_support/deep_matcher/matchable_array.rb +0 -1
- data/spec/aws_support/deep_matcher/matchable_object.rb +1 -2
- data/spec/aws_support/deep_matcher/rspec_monkeypatches.rb +4 -4
- data/spec/aws_support/delayed_stream.rb +2 -2
- data/spec/aws_support/matchers/create_an_aws_object.rb +6 -6
- data/spec/aws_support/matchers/destroy_an_aws_object.rb +6 -6
- data/spec/aws_support/matchers/have_aws_object_tags.rb +4 -5
- data/spec/aws_support/matchers/match_an_aws_object.rb +5 -6
- data/spec/aws_support/matchers/update_an_aws_object.rb +6 -7
- data/spec/integration/aws_auto_scaling_group_spec.rb +56 -64
- data/spec/integration/aws_cache_cluster_spec.rb +70 -71
- data/spec/integration/aws_cache_subnet_group_spec.rb +13 -14
- data/spec/integration/aws_cloudsearch_domain_spec.rb +6 -8
- data/spec/integration/aws_cloudwatch_alarm_spec.rb +200 -208
- data/spec/integration/aws_dhcp_options_spec.rb +32 -43
- data/spec/integration/aws_ebs_volume_spec.rb +52 -73
- data/spec/integration/aws_eip_address_spec.rb +24 -31
- data/spec/integration/aws_elasticsearch_domain_spec.rb +31 -33
- data/spec/integration/aws_iam_instance_profile_spec.rb +36 -45
- data/spec/integration/aws_iam_role_spec.rb +39 -46
- data/spec/integration/aws_internet_gateway_spec.rb +64 -75
- data/spec/integration/aws_key_pair_spec.rb +6 -6
- data/spec/integration/aws_launch_configuration_spec.rb +17 -18
- data/spec/integration/aws_nat_gateway_spec.rb +21 -24
- data/spec/integration/aws_network_acl_spec.rb +81 -95
- data/spec/integration/aws_network_interface_spec.rb +28 -43
- data/spec/integration/aws_rds_instance_spec.rb +29 -40
- data/spec/integration/aws_rds_parameter_group_spec.rb +32 -35
- data/spec/integration/aws_rds_subnet_group_spec.rb +30 -40
- data/spec/integration/aws_route53_hosted_zone_spec.rb +205 -205
- data/spec/integration/aws_route_table_spec.rb +118 -136
- data/spec/integration/aws_s3_bucket_spec.rb +19 -27
- data/spec/integration/aws_security_group_spec.rb +369 -388
- data/spec/integration/aws_server_certificate_spec.rb +16 -18
- data/spec/integration/aws_subnet_spec.rb +44 -58
- data/spec/integration/aws_vpc_peering_connection_spec.rb +43 -50
- data/spec/integration/aws_vpc_spec.rb +99 -115
- data/spec/integration/load_balancer_spec.rb +169 -183
- data/spec/integration/machine_batch_spec.rb +24 -31
- data/spec/integration/machine_image_spec.rb +54 -66
- data/spec/integration/machine_spec.rb +216 -237
- data/spec/persistence_file.txt +219 -0
- data/spec/spec_helper.rb +16 -17
- data/spec/unit/chef/provisioning/aws_driver/credentials_spec.rb +67 -74
- data/spec/unit/chef/provisioning/aws_driver/driver_spec.rb +29 -29
- data/spec/unit/chef/provisioning/aws_driver/route53_spec.rb +13 -15
- metadata +4 -3
@@ -1,5 +1,5 @@
|
|
1
|
-
require
|
2
|
-
require
|
1
|
+
require "chef/provisioning/aws_driver/aws_provider"
|
2
|
+
require "chef/provisioning/aws_driver/tagging_strategy/ec2"
|
3
3
|
|
4
4
|
class Chef::Provider::AwsInstance < Chef::Provisioning::AWSDriver::AWSProvider
|
5
5
|
include Chef::Provisioning::AWSDriver::TaggingStrategy::EC2ConvergeTags
|
@@ -21,11 +21,11 @@ class Chef::Provider::AwsInstance < Chef::Provisioning::AWSDriver::AWSProvider
|
|
21
21
|
# When purging, we must wait until the instance is fully terminated - thats the only way
|
22
22
|
# to delete the network interface that I can see
|
23
23
|
instance.wait_until_terminated do |w|
|
24
|
-
# TODO look at `wait_for_status` - delay and max_attempts should be configurable
|
24
|
+
# TODO: look at `wait_for_status` - delay and max_attempts should be configurable
|
25
25
|
w.delay = 5
|
26
26
|
w.max_attempts = 60
|
27
|
-
w.before_wait do |attempts,
|
28
|
-
action_handler.report_progress "waited #{(attempts-1)*5}/#{60*5}s for #{instance.id} status to terminate..."
|
27
|
+
w.before_wait do |attempts, _response|
|
28
|
+
action_handler.report_progress "waited #{(attempts - 1) * 5}/#{60 * 5}s for #{instance.id} status to terminate..."
|
29
29
|
end
|
30
30
|
end
|
31
31
|
end
|
@@ -1,5 +1,5 @@
|
|
1
|
-
require
|
2
|
-
require
|
1
|
+
require "chef/provisioning/aws_driver/aws_provider"
|
2
|
+
require "retryable"
|
3
3
|
|
4
4
|
class Chef::Provider::AwsInternetGateway < Chef::Provisioning::AWSDriver::AWSProvider
|
5
5
|
include Chef::Provisioning::AWSDriver::TaggingStrategy::EC2ConvergeTags
|
@@ -20,19 +20,17 @@ class Chef::Provider::AwsInternetGateway < Chef::Provisioning::AWSDriver::AWSPro
|
|
20
20
|
ec2_resource = ::Aws::EC2::Resource.new(new_resource.driver.ec2)
|
21
21
|
internet_gateway = ec2_resource.create_internet_gateway
|
22
22
|
retry_with_backoff(::Aws::EC2::Errors::InvalidInternetGatewayIDNotFound) do
|
23
|
-
internet_gateway.create_tags(
|
23
|
+
internet_gateway.create_tags(tags: [{ key: "Name", value: new_resource.name }])
|
24
24
|
end
|
25
25
|
|
26
|
-
if desired_vpc
|
27
|
-
attach_vpc(desired_vpc, internet_gateway)
|
28
|
-
end
|
26
|
+
attach_vpc(desired_vpc, internet_gateway) if desired_vpc
|
29
27
|
|
30
28
|
internet_gateway
|
31
29
|
end
|
32
30
|
end
|
33
31
|
|
34
32
|
def update_aws_object(internet_gateway)
|
35
|
-
ec2_resource = new_resource.driver.ec2.describe_internet_gateways(:
|
33
|
+
ec2_resource = new_resource.driver.ec2.describe_internet_gateways(internet_gateway_ids: [internet_gateway.id])
|
36
34
|
current_vpc = ec2_resource.internet_gateways.first.attachments.first
|
37
35
|
|
38
36
|
if new_resource.vpc
|
@@ -57,8 +55,8 @@ class Chef::Provider::AwsInternetGateway < Chef::Provisioning::AWSDriver::AWSPro
|
|
57
55
|
|
58
56
|
def attach_vpc(vpc, desired_gateway)
|
59
57
|
if vpc.internet_gateways.first && vpc.internet_gateways.first != desired_gateway
|
60
|
-
current_driver =
|
61
|
-
current_chef_server =
|
58
|
+
current_driver = new_resource.driver
|
59
|
+
current_chef_server = new_resource.chef_server
|
62
60
|
Cheffish.inline_resource(self, action) do
|
63
61
|
aws_vpc vpc.id do
|
64
62
|
cidr_block vpc.cidr_block
|
@@ -74,7 +72,7 @@ class Chef::Provider::AwsInternetGateway < Chef::Provisioning::AWSDriver::AWSPro
|
|
74
72
|
end
|
75
73
|
|
76
74
|
def detach_vpc(internet_gateway)
|
77
|
-
ec2_resource = new_resource.driver.ec2.describe_internet_gateways(:
|
75
|
+
ec2_resource = new_resource.driver.ec2.describe_internet_gateways(internet_gateway_ids: [internet_gateway.id])
|
78
76
|
vpcid = ec2_resource.internet_gateways.first.attachments.first
|
79
77
|
vpc_id = vpcid.vpc_id unless vpcid.nil?
|
80
78
|
if vpc_id
|
@@ -83,5 +81,4 @@ class Chef::Provider::AwsInternetGateway < Chef::Provisioning::AWSDriver::AWSPro
|
|
83
81
|
end
|
84
82
|
end
|
85
83
|
end
|
86
|
-
|
87
84
|
end
|
@@ -1,7 +1,6 @@
|
|
1
|
-
require
|
2
|
-
require
|
3
|
-
require
|
4
|
-
|
1
|
+
require "chef/provider/lwrp_base"
|
2
|
+
require "chef/provisioning/aws_driver/aws_provider"
|
3
|
+
require "aws-sdk"
|
5
4
|
|
6
5
|
class Chef::Provider::AwsKeyPair < Chef::Provisioning::AWSDriver::AWSProvider
|
7
6
|
provides :aws_key_pair
|
@@ -13,7 +12,7 @@ class Chef::Provider::AwsKeyPair < Chef::Provisioning::AWSDriver::AWSProvider
|
|
13
12
|
action :destroy do
|
14
13
|
if current_resource_exists?
|
15
14
|
converge_by "delete AWS key pair #{new_resource.name} on region #{region}" do
|
16
|
-
driver.ec2.delete_key_pair(
|
15
|
+
driver.ec2.delete_key_pair(key_name: new_resource.name)
|
17
16
|
end
|
18
17
|
end
|
19
18
|
end
|
@@ -43,7 +42,6 @@ class Chef::Provider::AwsKeyPair < Chef::Provisioning::AWSDriver::AWSProvider
|
|
43
42
|
ensure_keys(action)
|
44
43
|
end
|
45
44
|
|
46
|
-
|
47
45
|
# “The nice thing about standards is that you have so many to
|
48
46
|
# choose from.” - Andrew S. Tanenbaum
|
49
47
|
#
|
@@ -55,11 +53,11 @@ class Chef::Provider::AwsKeyPair < Chef::Provisioning::AWSDriver::AWSProvider
|
|
55
53
|
#
|
56
54
|
# So compute both possible AWS fingerprints and check if either of
|
57
55
|
# them matches.
|
58
|
-
new_fingerprints = [Cheffish::KeyFormatter.encode(desired_key, :
|
56
|
+
new_fingerprints = [Cheffish::KeyFormatter.encode(desired_key, format: :fingerprint)]
|
59
57
|
if RUBY_VERSION.to_f < 2.0
|
60
58
|
if @@use_pkcs8.nil?
|
61
59
|
begin
|
62
|
-
require
|
60
|
+
require "openssl_pkcs8"
|
63
61
|
@@use_pkcs8 = true
|
64
62
|
rescue LoadError
|
65
63
|
Chef::Log.warn("The openssl_pkcs8 gem is not loaded: you may not be able to read key fingerprints created by some cloud providers. gem install openssl_pkcs8 to fix!")
|
@@ -68,15 +66,15 @@ class Chef::Provider::AwsKeyPair < Chef::Provisioning::AWSDriver::AWSProvider
|
|
68
66
|
end
|
69
67
|
if @@use_pkcs8
|
70
68
|
new_fingerprints << Cheffish::KeyFormatter.encode(desired_private_key,
|
71
|
-
|
69
|
+
format: :pkcs8sha1fingerprint)
|
72
70
|
end
|
73
71
|
end
|
74
72
|
|
75
|
-
if
|
73
|
+
if new_fingerprints.none? { |f| compare_public_key f }
|
76
74
|
if new_resource.allow_overwrite
|
77
75
|
converge_by "update #{key_description} to match local key at #{new_resource.private_key_path}" do
|
78
|
-
driver.ec2.delete_key_pair(
|
79
|
-
driver.ec2.import_key_pair(
|
76
|
+
driver.ec2.delete_key_pair(key_name: new_resource.name)
|
77
|
+
driver.ec2.import_key_pair(key_name: new_resource.name, public_key_material: Cheffish::KeyFormatter.encode(desired_key, format: :openssh))
|
80
78
|
end
|
81
79
|
else
|
82
80
|
raise "#{key_description} with fingerprint #{@current_fingerprint} does not match local key fingerprint(s) #{new_fingerprints}, and allow_overwrite is false!"
|
@@ -88,7 +86,7 @@ class Chef::Provider::AwsKeyPair < Chef::Provisioning::AWSDriver::AWSProvider
|
|
88
86
|
|
89
87
|
# Create key
|
90
88
|
converge_by "create #{key_description} from local key at #{new_resource.private_key_path}" do
|
91
|
-
driver.ec2.import_key_pair(
|
89
|
+
driver.ec2.import_key_pair(key_name: new_resource.name, public_key_material: Cheffish::KeyFormatter.encode(desired_key, format: :openssh))
|
92
90
|
end
|
93
91
|
end
|
94
92
|
end
|
@@ -104,7 +102,7 @@ class Chef::Provider::AwsKeyPair < Chef::Provisioning::AWSDriver::AWSProvider
|
|
104
102
|
private_key private_key_path do
|
105
103
|
public_key_path resource.public_key_path
|
106
104
|
if resource.private_key_options
|
107
|
-
resource.private_key_options.each_pair do |key,value|
|
105
|
+
resource.private_key_options.each_pair do |key, value|
|
108
106
|
send(key, value)
|
109
107
|
end
|
110
108
|
end
|
@@ -135,12 +133,12 @@ class Chef::Provider::AwsKeyPair < Chef::Provisioning::AWSDriver::AWSProvider
|
|
135
133
|
end
|
136
134
|
|
137
135
|
def current_resource_exists?
|
138
|
-
@current_resource.action != [
|
136
|
+
@current_resource.action != [:destroy]
|
139
137
|
end
|
140
138
|
|
141
139
|
def compare_public_key(new)
|
142
|
-
c = @current_fingerprint.split[0,2].join(
|
143
|
-
n = new.split[0,2].join(
|
140
|
+
c = @current_fingerprint.split[0, 2].join(" ")
|
141
|
+
n = new.split[0, 2].join(" ")
|
144
142
|
c == n
|
145
143
|
end
|
146
144
|
|
@@ -1,6 +1,6 @@
|
|
1
|
-
require
|
2
|
-
require
|
3
|
-
require
|
1
|
+
require "chef/provisioning/aws_driver/aws_provider"
|
2
|
+
require "chef/resource/aws_image"
|
3
|
+
require "base64"
|
4
4
|
|
5
5
|
class Chef::Provider::AwsLaunchConfiguration < Chef::Provisioning::AWSDriver::AWSProvider
|
6
6
|
provides :aws_launch_configuration
|
@@ -27,20 +27,20 @@ class Chef::Provider::AwsLaunchConfiguration < Chef::Provisioning::AWSDriver::AW
|
|
27
27
|
if new_resource.image
|
28
28
|
image_id = Chef::Resource::AwsImage.get_aws_object_id(new_resource.image, resource: new_resource)
|
29
29
|
if image_id != launch_configuration.image_id
|
30
|
-
raise "#{new_resource
|
30
|
+
raise "#{new_resource}.image = #{new_resource.image}, but actual launch configuration has image set to #{launch_configuration.image_id}. Cannot be modified!"
|
31
31
|
end
|
32
32
|
end
|
33
33
|
if new_resource.instance_type
|
34
34
|
if new_resource.instance_type != launch_configuration.instance_type
|
35
|
-
raise "#{new_resource
|
35
|
+
raise "#{new_resource}.instance_type = #{new_resource.instance_type}, but actual launch configuration has instance_type set to #{launch_configuration.instance_type}. Cannot be modified!"
|
36
36
|
end
|
37
37
|
end
|
38
|
-
# TODO compare options
|
38
|
+
# TODO: compare options
|
39
39
|
end
|
40
40
|
|
41
41
|
def destroy_aws_object(launch_configuration)
|
42
42
|
converge_by "delete launch configuration #{new_resource.name} in #{region}" do
|
43
|
-
# TODO add a timeout here.
|
43
|
+
# TODO: add a timeout here.
|
44
44
|
# TODO is InUse really a status guaranteed to go away??
|
45
45
|
begin
|
46
46
|
new_resource.driver.auto_scaling_client.delete_launch_configuration(launch_configuration_name: launch_configuration.launch_configuration_name)
|
@@ -54,12 +54,9 @@ class Chef::Provider::AwsLaunchConfiguration < Chef::Provisioning::AWSDriver::AW
|
|
54
54
|
private
|
55
55
|
|
56
56
|
def ensure_base64_encoded(data)
|
57
|
-
|
58
|
-
|
59
|
-
|
60
|
-
|
61
|
-
return Base64.encode64(data)
|
62
|
-
end
|
57
|
+
Base64.strict_decode64(data)
|
58
|
+
data
|
59
|
+
rescue ArgumentError
|
60
|
+
Base64.encode64(data)
|
63
61
|
end
|
64
|
-
|
65
62
|
end
|
@@ -1,7 +1,6 @@
|
|
1
|
-
require
|
1
|
+
require "chef/provisioning/aws_driver/aws_provider"
|
2
2
|
|
3
3
|
class Chef::Provider::AwsLoadBalancer < Chef::Provisioning::AWSDriver::AWSProvider
|
4
|
-
|
5
4
|
def aws_tagger
|
6
5
|
@aws_tagger ||= begin
|
7
6
|
elb_strategy = Chef::Provisioning::AWSDriver::TaggingStrategy::ELB.new(
|
@@ -1,8 +1,7 @@
|
|
1
|
-
#require 'chef/provisioning/aws_driver/aws_provider'
|
2
|
-
require
|
1
|
+
# require 'chef/provisioning/aws_driver/aws_provider'
|
2
|
+
require "retryable"
|
3
3
|
|
4
4
|
class Chef::Provider::AwsNatGateway < Chef::Provisioning::AWSDriver::AWSProvider
|
5
|
-
|
6
5
|
provides :aws_nat_gateway
|
7
6
|
|
8
7
|
protected
|
@@ -14,7 +13,7 @@ class Chef::Provider::AwsNatGateway < Chef::Provisioning::AWSDriver::AWSProvider
|
|
14
13
|
subnet = Chef::Resource::AwsSubnet.get_aws_object(new_resource.subnet, resource: new_resource)
|
15
14
|
|
16
15
|
if new_resource.eip_address.nil?
|
17
|
-
# TODO Ideally it would be nice to automatically manage an eip address but
|
16
|
+
# TODO: Ideally it would be nice to automatically manage an eip address but
|
18
17
|
# the lack of tagging support and the limited SDK interaction with these two
|
19
18
|
# resources makes that too hard right now. So we force the user to manage their
|
20
19
|
# eip address as a seperate resource.
|
@@ -24,8 +23,8 @@ class Chef::Provider::AwsNatGateway < Chef::Provisioning::AWSDriver::AWSProvider
|
|
24
23
|
|
25
24
|
converge_by "create nat gateway #{new_resource.name} in region #{region} for subnet #{subnet}" do
|
26
25
|
options = {
|
27
|
-
|
28
|
-
|
26
|
+
subnet_id: subnet.id,
|
27
|
+
allocation_id: eip_address.allocation_id
|
29
28
|
}
|
30
29
|
|
31
30
|
nat_gateway = new_resource.driver.ec2_resource.create_nat_gateway(options)
|
@@ -42,7 +41,7 @@ class Chef::Provider::AwsNatGateway < Chef::Provisioning::AWSDriver::AWSProvider
|
|
42
41
|
|
43
42
|
if new_resource.eip_address
|
44
43
|
eip_address = Chef::Resource::AwsEipAddress.get_aws_object(new_resource.eip_address, resource: new_resource)
|
45
|
-
if eip_address.nil?
|
44
|
+
if eip_address.nil? || (eip_address.allocation_id != nat_gateway.nat_gateway_addresses.first.allocation_id)
|
46
45
|
raise "Nat gateway elastic ip address cannot be changed after being created! Desired elastic ip address for #{new_resource.name} (#{nat_gateway.id}) was \"#{nat_gateway.nat_gateway_addresses.first.allocation_id}\" and actual description is \"#{eip_address.allocation_id}\""
|
47
46
|
end
|
48
47
|
end
|
@@ -1,6 +1,6 @@
|
|
1
|
-
require
|
2
|
-
require
|
3
|
-
require
|
1
|
+
require "chef/provisioning/aws_driver/aws_provider"
|
2
|
+
require "chef/resource/aws_vpc"
|
3
|
+
require "retryable"
|
4
4
|
|
5
5
|
class Chef::Provider::AwsNetworkAcl < Chef::Provisioning::AWSDriver::AWSProvider
|
6
6
|
include Chef::Provisioning::AWSDriver::TaggingStrategy::EC2ConvergeTags
|
@@ -25,24 +25,24 @@ class Chef::Provider::AwsNetworkAcl < Chef::Provisioning::AWSDriver::AWSProvider
|
|
25
25
|
|
26
26
|
network_acl = new_resource.driver.ec2_resource.create_network_acl(options)
|
27
27
|
retry_with_backoff(::Aws::EC2::Errors::InvalidNetworkAclIDNotFound) do
|
28
|
-
network_acl.create_tags(
|
28
|
+
network_acl.create_tags(tags: [{ key: "Name", value: new_resource.name }])
|
29
29
|
end
|
30
30
|
network_acl
|
31
31
|
end
|
32
32
|
end
|
33
33
|
|
34
34
|
def update_aws_object(network_acl)
|
35
|
-
|
35
|
+
unless new_resource.vpc.nil?
|
36
36
|
desired_vpc = Chef::Resource::AwsVpc.get_aws_object_id(new_resource.vpc, resource: new_resource)
|
37
37
|
if desired_vpc != network_acl.vpc_id
|
38
|
-
raise "Network ACL VPC cannot be changed after being created! Desired VPC for #{new_resource
|
38
|
+
raise "Network ACL VPC cannot be changed after being created! Desired VPC for #{new_resource} was #{new_resource.vpc} (#{desired_vpc}) and actual VPC is #{network_acl.vpc_id}"
|
39
39
|
end
|
40
40
|
end
|
41
41
|
end
|
42
42
|
|
43
43
|
def destroy_aws_object(network_acl)
|
44
|
-
# TODO if purging, do we need to destory the linked subnets?
|
45
|
-
converge_by "delete #{new_resource
|
44
|
+
# TODO: if purging, do we need to destory the linked subnets?
|
45
|
+
converge_by "delete #{new_resource} in #{region}" do
|
46
46
|
network_acl.delete
|
47
47
|
end
|
48
48
|
end
|
@@ -55,7 +55,7 @@ class Chef::Provider::AwsNetworkAcl < Chef::Provisioning::AWSDriver::AWSProvider
|
|
55
55
|
outbound_rules = new_resource.outbound_rules
|
56
56
|
# AWS requires a deny all rule at the end. Delete here so we don't
|
57
57
|
# try to compare.
|
58
|
-
current_rules.delete_if { |rule| rule[:rule_number] ==
|
58
|
+
current_rules.delete_if { |rule| rule[:rule_number] == 32_767 }
|
59
59
|
|
60
60
|
current_inbound_rules = current_rules.select { |rule| rule[:egress] == false }
|
61
61
|
# If inbound_rules is nil, leave rules alone. If empty array, delete all.
|
@@ -76,25 +76,24 @@ class Chef::Provider::AwsNetworkAcl < Chef::Provisioning::AWSDriver::AWSProvider
|
|
76
76
|
|
77
77
|
# Get the desired rules in a comparable state
|
78
78
|
desired_rules.clone.each do |desired_rule|
|
79
|
-
matching_rule = current_rules.select { |r| r[:rule_number] == desired_rule[:rule_number]}.first
|
80
|
-
|
81
|
-
|
82
|
-
|
83
|
-
|
84
|
-
|
85
|
-
|
86
|
-
|
87
|
-
|
88
|
-
|
89
|
-
|
90
|
-
|
91
|
-
|
92
|
-
end
|
79
|
+
matching_rule = current_rules.select { |r| r[:rule_number] == desired_rule[:rule_number] }.first
|
80
|
+
next unless matching_rule
|
81
|
+
# Anything unhandled will be removed
|
82
|
+
current_rules.delete(matching_rule)
|
83
|
+
# Anything unhandled will be added
|
84
|
+
desired_rules.delete(desired_rule)
|
85
|
+
|
86
|
+
# Converting matching_rule [:rule_action] and [:port_range] to symbol & hash to match correctly with desired_rule
|
87
|
+
matching_rule[:rule_action] = matching_rule[:rule_action].to_sym unless matching_rule[:rule_action].nil?
|
88
|
+
matching_rule[:port_range] = matching_rule[:port_range].to_hash unless matching_rule[:port_range].nil?
|
89
|
+
if matching_rule.merge(desired_rule) != matching_rule
|
90
|
+
# Replace anything with a matching rule number but different attributes
|
91
|
+
replace_rules << desired_rule
|
93
92
|
end
|
94
93
|
end
|
95
94
|
|
96
95
|
unless replace_rules.empty? && desired_rules.empty? && current_rules.empty?
|
97
|
-
action_handler.report_progress "update network ACL #{new_resource.name} #{direction
|
96
|
+
action_handler.report_progress "update network ACL #{new_resource.name} #{direction} rules"
|
98
97
|
replace_rules(network_acl, replace_rules)
|
99
98
|
add_rules(network_acl, desired_rules)
|
100
99
|
remove_rules(network_acl, current_rules)
|
@@ -123,14 +122,14 @@ class Chef::Provider::AwsNetworkAcl < Chef::Provisioning::AWSDriver::AWSProvider
|
|
123
122
|
end
|
124
123
|
|
125
124
|
def rule_direction(rule)
|
126
|
-
rule[:egress] == true ?
|
125
|
+
rule[:egress] == true ? "egress" : "ingress"
|
127
126
|
end
|
128
127
|
|
129
128
|
def entry_to_hash(entry)
|
130
|
-
options =
|
131
|
-
|
132
|
-
|
133
|
-
|
129
|
+
options = %i{
|
130
|
+
rule_number rule_action protocol cidr_block egress
|
131
|
+
port_range icmp_type_code
|
132
|
+
}
|
134
133
|
entry_hash = {}
|
135
134
|
options.each { |option| entry_hash.merge!(option => entry.send(option.to_sym)) }
|
136
135
|
entry_hash
|
@@ -1,7 +1,7 @@
|
|
1
|
-
require
|
2
|
-
require
|
3
|
-
require
|
4
|
-
require
|
1
|
+
require "chef/provisioning/aws_driver/aws_provider"
|
2
|
+
require "cheffish"
|
3
|
+
require "date"
|
4
|
+
require "retryable"
|
5
5
|
|
6
6
|
class Chef::Provider::AwsNetworkInterface < Chef::Provisioning::AWSDriver::AWSProvider
|
7
7
|
include Chef::Provisioning::AWSDriver::TaggingStrategy::EC2ConvergeTags
|
@@ -23,9 +23,7 @@ class Chef::Provider::AwsNetworkInterface < Chef::Provisioning::AWSDriver::AWSPr
|
|
23
23
|
def action_create
|
24
24
|
eni = super
|
25
25
|
|
26
|
-
|
27
|
-
update_eni(eni)
|
28
|
-
end
|
26
|
+
update_eni(eni) unless new_resource.machine.nil?
|
29
27
|
end
|
30
28
|
|
31
29
|
protected
|
@@ -50,30 +48,31 @@ class Chef::Provider::AwsNetworkInterface < Chef::Provisioning::AWSDriver::AWSPr
|
|
50
48
|
end
|
51
49
|
|
52
50
|
def update_aws_object(eni)
|
53
|
-
if options.
|
51
|
+
if options.key?(:subnet_id)
|
54
52
|
if Chef::Resource::AwsSubnet.get_aws_object(options[:subnet_id], resource: new_resource).id != eni.subnet.id
|
55
53
|
raise "#{new_resource} subnet is #{new_resource.subnet}, but actual network interface has subnet set to #{eni.subnet_id}. Cannot be modified!"
|
56
54
|
end
|
57
55
|
end
|
58
56
|
|
59
|
-
# TODO implement private ip reassignment
|
60
|
-
if options.
|
57
|
+
# TODO: implement private ip reassignment
|
58
|
+
if options.key?(:private_ip_address)
|
61
59
|
if options[:private_ip_address] != eni.private_ip_address
|
62
60
|
raise "#{new_resource} private IP is #{new_resource.private_ip_address}, but actual network interface has private IP set to #{eni.private_ip_address}. Private IP reassignment not implemented. Cannot be modified!"
|
63
61
|
end
|
64
62
|
end
|
65
63
|
|
66
|
-
if options.
|
64
|
+
if options.key?(:description)
|
67
65
|
if options[:description] != eni.description
|
68
66
|
converge_by "set #{new_resource} description to #{new_resource.description}" do
|
69
|
-
eni.client.modify_network_interface_attribute(:
|
70
|
-
:
|
71
|
-
|
67
|
+
eni.client.modify_network_interface_attribute(network_interface_id: eni.network_interface_id,
|
68
|
+
description: {
|
69
|
+
value: new_resource.description
|
70
|
+
})
|
72
71
|
end
|
73
72
|
end
|
74
73
|
end
|
75
74
|
|
76
|
-
if options.
|
75
|
+
if options.key?(:groups)
|
77
76
|
groups = new_resource.security_groups
|
78
77
|
eni_security_groups = []
|
79
78
|
eni.groups.each do |group|
|
@@ -82,7 +81,7 @@ class Chef::Provider::AwsNetworkInterface < Chef::Provisioning::AWSDriver::AWSPr
|
|
82
81
|
|
83
82
|
if groups.sort != eni_security_groups.sort
|
84
83
|
converge_by "set #{new_resource} security groups to #{groups}" do
|
85
|
-
eni.client.modify_network_interface_attribute(:
|
84
|
+
eni.client.modify_network_interface_attribute(network_interface_id: eni.network_interface_id, groups: groups)
|
86
85
|
end
|
87
86
|
end
|
88
87
|
end
|
@@ -100,20 +99,20 @@ class Chef::Provider::AwsNetworkInterface < Chef::Provisioning::AWSDriver::AWSPr
|
|
100
99
|
def expected_instance
|
101
100
|
# use instance if already set
|
102
101
|
@expected_instance ||= new_resource.machine ?
|
103
|
-
|
102
|
+
# if not, and machine is set, find and return the instance
|
104
103
|
Chef::Resource::AwsInstance.get_aws_object(new_resource.machine, resource: new_resource) :
|
105
|
-
|
104
|
+
# otherwise return nil
|
106
105
|
nil
|
107
106
|
end
|
108
107
|
|
109
108
|
def options
|
110
109
|
@options ||= begin
|
111
110
|
options = {}
|
112
|
-
options[:subnet_id] = new_resource.subnet
|
113
|
-
options[:private_ip_address] = new_resource.private_ip_address
|
114
|
-
options[:description] = new_resource.description
|
115
|
-
options[:groups] = new_resource.security_groups
|
116
|
-
options[:device_index] = new_resource.device_index
|
111
|
+
options[:subnet_id] = new_resource.subnet unless new_resource.subnet.nil?
|
112
|
+
options[:private_ip_address] = new_resource.private_ip_address unless new_resource.private_ip_address.nil?
|
113
|
+
options[:description] = new_resource.description unless new_resource.description.nil?
|
114
|
+
options[:groups] = new_resource.security_groups unless new_resource.security_groups.nil?
|
115
|
+
options[:device_index] = new_resource.device_index unless new_resource.device_index.nil?
|
117
116
|
|
118
117
|
AWSResource.lookup_options(options, resource: new_resource)
|
119
118
|
end
|
@@ -136,7 +135,7 @@ class Chef::Provider::AwsNetworkInterface < Chef::Provisioning::AWSDriver::AWSPr
|
|
136
135
|
attach(eni)
|
137
136
|
end
|
138
137
|
when nil
|
139
|
-
raise NetworkInterfaceNotFoundError
|
138
|
+
raise NetworkInterfaceNotFoundError, new_resource
|
140
139
|
else
|
141
140
|
raise NetworkInterfaceInvalidStatusError.new(new_resource, status)
|
142
141
|
end
|
@@ -193,12 +192,11 @@ class Chef::Provider::AwsNetworkInterface < Chef::Provisioning::AWSDriver::AWSPr
|
|
193
192
|
Chef::Log.info("waiting for network interface to delete...")
|
194
193
|
}
|
195
194
|
|
196
|
-
Retryable.retryable(:
|
195
|
+
Retryable.retryable(tries: 30, sleep: 2, on: NetworkInterfaceStatusTimeoutError, ensure: log_callback) do
|
197
196
|
result = new_resource.driver.ec2_resource.network_interface(eni.id) if eni.id
|
198
|
-
|
197
|
+
raise NetworkInterfaceStatusTimeoutError.new(new_resource, "exists", "deleted") if new_resource.exists?(result)
|
199
198
|
end
|
200
199
|
eni
|
201
200
|
end
|
202
201
|
end
|
203
|
-
|
204
202
|
end
|