cloud-mu 1.9.0.pre.beta

data/modules/mu/clouds/google/firewall_rule.rb

@@ -0,0 +1,267 @@
+# Copyright:: Copyright (c) 2017 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module MU
+
+  class Cloud
+    class Google
+      # A firewall ruleset as configured in {MU::Config::BasketofKittens::firewall_rules}
+      class FirewallRule < MU::Cloud::FirewallRule
+
+        @deploy = nil
+        @config = nil
+        @admin_sgs = Hash.new
+        @admin_sg_semaphore = Mutex.new
+
+        attr_reader :mu_name
+        attr_reader :config
+        attr_reader :cloud_id
+
+        # @param mommacat [MU::MommaCat]: A {MU::Mommacat} object containing the deploy of which this resource is/will be a member.
+        # @param kitten_cfg [Hash]: The fully parsed and resolved {MU::Config} resource descriptor as defined in {MU::Config::BasketofKittens::firewall_rules}
+        def initialize(mommacat: nil, kitten_cfg: nil, mu_name: nil, cloud_id: nil)
+          @deploy = mommacat
+          @config = MU::Config.manxify(kitten_cfg)
+          @cloud_id ||= cloud_id
+          if !mu_name.nil?
+            @mu_name = mu_name
+            # This is really a placeholder, since we "own" multiple rule sets
+            @cloud_id ||= MU::Cloud::Google.nameStr(@mu_name+"-ingress-allow")
+          else
+            if !@vpc.nil?
+              @mu_name = @deploy.getResourceName(@config['name'], need_unique_string: true)
+            else
+              @mu_name = @deploy.getResourceName(@config['name'])
+            end
+          end
+
+        end
+
+        attr_reader :rulesets
+
+        # Called by {MU::Deploy#createResources}
+        def create
+          vpc_id = @vpc.cloudobj.url if !@vpc.nil? and !@vpc.cloudobj.nil?
+          vpc_id ||= @config['vpc']['vpc_id'] if @config['vpc'] and @config['vpc']['vpc_id']
+
+          allrules = {}
+          # The set of rules might actually compose into multiple firewall
+          # objects, so figure that out.
+          @config['rules'].each { |rule|
+            srcs = []
+            ruleobj = nil
+            if ["tcp", "udp"].include?(rule['proto']) and (rule['port_range'] or rule['port'])
+              ruleobj = MU::Cloud::Google.compute(:Firewall)::Allowed.new(
+                ip_protocol: rule['proto'],
+                ports: [rule['port_range'] || rule['port']]
+              )
+            else
+              ruleobj = MU::Cloud::Google.compute(:Firewall)::Allowed.new(
+                ip_protocol: rule['proto']
+              )
+            end
+            if rule['hosts']
+              rule['hosts'].each { |cidr| srcs << cidr }
+            end
+
+            ["ingress", "egress"].each { |dir|
+              if rule[dir] or (dir == "ingress" and !rule.has_key?("egress"))
+                setname = MU::Cloud::Google.nameStr(@mu_name+"-"+dir+"-"+(rule['deny'] ? "deny" : "allow"))
+                @cloud_id ||= setname
+                allrules[setname] ||= {
+                  :name => setname,
+                  :direction => dir.upcase,
+                  :network => vpc_id
+                }
+                if @deploy
+                  allrules[setname][:description] = @deploy.deploy_id
+                end
+                ['source_service_accounts', 'source_tags', 'target_tags', 'target_service_accounts'].each { |filter|
+                  if config[filter] and config[filter].size > 0
+                    allrules[setname][filter.to_sym] = config[filter].dup
+                  end
+                }
+                action = rule['deny'] ? :denied : :allowed
+                allrules[setname][action] ||= []
+                allrules[setname][action] << ruleobj
+                ipparam = dir == "ingress" ? :source_ranges : :destination_ranges
+                allrules[setname][ipparam] ||= []
+                allrules[setname][ipparam].concat(srcs)
+                allrules[setname][:priority] = rule['weight'] if rule['weight']
+              end
+            }
+          }
+
+          parent_thread_id = Thread.current.object_id
+          threads = []
+
+          allrules.each_value { |fwdesc|
+            threads << Thread.new { 
+              fwobj = MU::Cloud::Google.compute(:Firewall).new(fwdesc)
+              MU.log "Creating firewall #{fwdesc[:name]} in project #{@config['project']}", details: fwobj
+              resp = MU::Cloud::Google.compute.insert_firewall(@config['project'], fwobj)
+# XXX Check for empty (no hosts) sets
+#  MU.log "Can't create empty firewalls in Google Cloud, skipping #{@mu_name}", MU::WARN
+            }
+          }
+
+          threads.each do |t|
+            t.join
+          end
+        end
+
+        # Called by {MU::Deploy#createResources}
+        def groom
+        end
+
+        # Log metadata about this ruleset to the currently running deployment
+        def notify
+          sg_data = MU.structToHash(
+            MU::Cloud::Google::FirewallRule.find(cloud_id: @cloud_id, region: @config['region'])
+          )
+          sg_data ||= {}
+          sg_data["group_id"] = @cloud_id
+          sg_data["cloud_id"] = @cloud_id
+
+          return sg_data
+        end
+
+        # Insert a rule into an existing security group.
+        #
+        # @param hosts [Array<String>]: An array of CIDR network addresses to which this rule will apply.
+        # @param proto [String]: One of "tcp," "udp," or "icmp"
+        # @param port [Integer]: A port number. Only valid with udp or tcp.
+        # @param egress [Boolean]: Whether this is an egress ruleset, instead of ingress.
+        # @param port_range [String]: A port range descriptor (e.g. 0-65535). Only valid with udp or tcp.
+        # @return [void]
+        def addRule(hosts, proto: "tcp", port: nil, egress: false, port_range: "0-65535")
+        end
+
+        # Locate an existing security group or groups and return an array containing matching AWS resource descriptors for those that match.
+        # @param cloud_id [String]: The cloud provider's identifier for this resource.
+        # @param region [String]: The cloud provider region
+        # @param tag_key [String]: A tag key to search.
+        # @param tag_value [String]: The value of the tag specified by tag_key to match when searching by tag.
+        # @param flags [Hash]: Optional flags
+        # @return [Array<Hash<String,OpenStruct>>]: The cloud provider's complete descriptions of matching FirewallRules
+        def self.find(cloud_id: nil, region: MU.curRegion, tag_key: "Name", tag_value: nil, flags: {})
+          flags["project"] ||= MU::Cloud::Google.defaultProject
+
+          found = {}
+          resp = MU::Cloud::Google.compute.list_firewalls(flags["project"])
+          if resp and resp.items
+            resp.items.each { |fw|
+              next if !cloud_id.nil? and fw.name != cloud_id
+              found[fw.name] = fw
+            }
+          end
+          found
+        end
+
+        # Remove all security groups (firewall rulesets) associated with the currently loaded deployment.
+        # @param noop [Boolean]: If true, will only print what would be done
+        # @param ignoremaster [Boolean]: If true, will remove resources not flagged as originating from this Mu server
+        # @param region [String]: The cloud provider region
+        # @return [void]
+        def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, flags: {})
+          flags["project"] ||= MU::Cloud::Google.defaultProject
+
+          MU::Cloud::Google.compute.delete(
+            "firewall",
+            flags["project"],
+            nil,
+            noop
+          )
+        end
+
+        # Cloud-specific configuration properties.
+        # @param config [MU::Config]: The calling MU::Config object
+        # @return [Array<Array,Hash>]: List of required fields, and json-schema Hash of cloud-specific configuration parameters for this resource
+        def self.schema(config)
+          toplevel_required = []
+#                ['source_ranges', 'source_service_accounts', 'source_tags', 'target_ranges', 'target_service_accounts'].each { |filter|
+          schema = {
+            "rules" => {
+              "items" => {
+                "properties" => {
+                  "proto" => {
+                    "enum" => ["udp", "tcp", "icmp", "all"]
+                  },
+                  "source_tags" => {
+                    "type" => "array",
+                    "description" => "VMs with these tags, from which traffic will be allowed",
+                    "items" => {
+                      "type" => "string"
+                    }
+                  },
+                  "source_service_accounts" => {
+                    "type" => "array",
+                    "description" => "Resources using these service accounts, from which traffic will be allowed",
+                    "items" => {
+                      "type" => "string"
+                    }
+                  },
+                  "target_tags" => {
+                    "type" => "array",
+                    "description" => "VMs with these tags, to which traffic will be allowed",
+                    "items" => {
+                      "type" => "string"
+                    }
+                  },
+                  "target_service_accounts" => {
+                    "type" => "array",
+                    "description" => "Resources using these service accounts, to which traffic will be allowed",
+                    "items" => {
+                      "type" => "string"
+                    }
+                  }
+                }
+              }
+            },
+            "project" => {
+              "type" => "string",
+              "description" => "The project into which to deploy resources"
+            }
+          }
+          [toplevel_required, schema]
+        end
+
+        # Cloud-specific pre-processing of {MU::Config::BasketofKittens::firewall_rules}, bare and unvalidated.
+        # @param acl [Hash]: The resource to process and validate
+        # @param config [MU::Config]: The overall deployment config of which this resource is a member
+        # @return [Boolean]: True if validation succeeded, False otherwise
+        def self.validateConfig(acl, config)
+          ok = true
+        end
+
+        private
+
+        ########################################################################
+        # Manufacture an EC2 security group. The second parameter, rules, is an
+        # "ingress_rules" structure parsed and validated by MU::Config.
+        ########################################################################
+        def setRules(rules, add_to_self: false, ingress: true, egress: false)
+        end
+
+        ########################################################################
+        # Convert our config languages description of firewall rules into
+        # Amazon's.  This rule structure is as defined in MU::Config.
+        ########################################################################
+        def convertToEc2(rules)
+        end
+
+      end #class
+    end #class
+  end
+end #module

data/modules/mu/clouds/google/group.rb

@@ -0,0 +1,164 @@
+# Copyright:: Copyright (c) 2018 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module MU
+  class Cloud
+    class Google
+      # A group as configured in {MU::Config::BasketofKittens::groups}
+      class Group < MU::Cloud::Group
+        @deploy = nil
+        @config = nil
+        attr_reader :mu_name
+        attr_reader :config
+        attr_reader :cloud_id
+
+        # @param mommacat [MU::MommaCat]: A {MU::Mommacat} object containing the deploy of which this resource is/will be a member.
+        # @param kitten_cfg [Hash]: The fully parsed and resolved {MU::Config} resource descriptor as defined in {MU::Config::BasketofKittens::groups}
+        def initialize(mommacat: nil, kitten_cfg: nil, mu_name: nil, cloud_id: nil)
+          @deploy = mommacat
+          @config = MU::Config.manxify(kitten_cfg)
+          @cloud_id ||= cloud_id
+          @mu_name ||= @deploy.getResourceName(@config["name"])
+        end
+
+        # Called automatically by {MU::Deploy#createResources}
+        def create
+          bind_group
+        end
+
+        # Called automatically by {MU::Deploy#createResources}
+        def groom
+          bind_group
+        end
+
+        # Return the metadata for this group configuration
+        # @return [Hash]
+        def notify
+          {
+          }
+        end
+
+        # Remove all groups associated with the currently loaded deployment.
+        # @param noop [Boolean]: If true, will only print what would be done
+        # @param ignoremaster [Boolean]: If true, will remove resources not flagged as originating from this Mu server
+        # @param region [String]: The cloud provider region
+        # @return [void]
+        def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, flags: {})
+        end
+
+        # Locate an existing group group.
+        # @param cloud_id [String]: The cloud provider's identifier for this resource.
+        # @param region [String]: The cloud provider region.
+        # @param flags [Hash]: Optional flags
+        # @return [OpenStruct]: The cloud provider's complete descriptions of matching group group.
+        def self.find(cloud_id: nil, region: MU.curRegion, flags: {})
+          found = nil
+          found
+        end
+
+        # Cloud-specific configuration properties.
+        # @param config [MU::Config]: The calling MU::Config object
+        # @return [Array<Array,Hash>]: List of required fields, and json-schema Hash of cloud-specific configuration parameters for this resource
+        def self.schema(config)
+          toplevel_required = []
+          schema = {
+            "name" => {
+              "type" => "string",
+              "description" => "This must be the email address of an existing Google Group (+foo@googlegroups.com+), or of a federated GSuite or Cloud Identity domain group from your organization."
+            },
+            "roles" => {
+              "type" => "array",
+              "description" => "One or more Google IAM roles to associate with this group.",
+              "default" => ["roles/viewer"],
+              "items" => {
+                "type" => "string",
+                "description" => "One or more Google IAM roles to associate with this group. Google Cloud groups are not created directly; pre-existing Google Groups are associated with a project by being bound to one or more roles in that project. If no roles are specified, we default to +roles/viewer+, which permits read-only access project-wide."
+              }
+            },
+            "project" => {
+              "type" => "string",
+              "description" => "The project into which to deploy resources"
+            }
+          }
+          [toplevel_required, schema]
+        end
+
+        # Cloud-specific pre-processing of {MU::Config::BasketofKittens::groups}, bare and unvalidated.
+        # @param group [Hash]: The resource to process and validate
+        # @param configurator [MU::Config]: The overall deployment configurator of which this resource is a member
+        # @return [Boolean]: True if validation succeeded, False otherwise
+        def self.validateConfig(group, configurator)
+          ok = true
+          if group['members'] and group['members'].size > 0 and
+             !$MU_CFG['google']['masquerade_as']
+            MU.log "Cannot change Google group memberships in non-GSuite environments.\nVisit https://groups.google.com to manage groups.", MU::ERR
+            ok = false
+          end
+
+          ok
+        end
+
+        private
+
+        def bind_group
+          bindings = []
+          ext_policy = MU::Cloud::Google.resource_manager.get_project_iam_policy(
+            @config['project']
+          )
+
+          change_needed = false
+          @config['roles'].each { |role|
+            seen = false
+            ext_policy.bindings.each { |b|
+              if b.role == role
+                seen = true
+                if !b.members.include?("user:"+@config['name'])
+                  change_needed = true
+                  b.members << "group:"+@config['name']
+                end
+              end
+            }
+            if !seen
+              ext_policy.bindings << MU::Cloud::Google.resource_manager(:Binding).new(
+                role: role,
+                members: ["group:"+@config['name']]
+              )
+              change_needed = true
+            end
+          }
+
+          if change_needed
+            req_obj = MU::Cloud::Google.resource_manager(:SetIamPolicyRequest).new(
+              policy: ext_policy
+            )
+            MU.log "Adding group #{@config['name']} to Google Cloud project #{@config['project']}", details: @config['roles']
+
+            begin
+              MU::Cloud::Google.resource_manager.set_project_iam_policy(
+                @config['project'],
+                req_obj
+              )
+            rescue ::Google::Apis::ClientError => e
+              if e.message.match(/does not exist/i) and !$MU_CFG['google']['masquerade_as']
+                raise MuError, "Group #{@config['name']} does not exist, and we cannot create Google groups in non-GSuite environments.\nVisit https://groups.google.com to manage groups."
+              end
+              raise e
+            end
+          end
+        end
+
+      end
+    end
+  end
+end