knife-ec-backup 2.4.6 → 2.5.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +56 -43
- data/Rakefile +1 -1
- data/lib/chef/automate.rb +18 -0
- data/lib/chef/knife/ec_backup.rb +8 -4
- data/lib/chef/knife/ec_base.rb +30 -7
- data/lib/chef/knife/ec_key_base.rb +47 -17
- data/lib/chef/knife/ec_key_import.rb +1 -1
- data/lib/chef/knife/ec_restore.rb +7 -3
- data/lib/chef/server.rb +2 -2
- data/lib/knife_ec_backup/version.rb +1 -1
- data/spec/chef/knife/ec_backup_spec.rb +2 -0
- data/spec/chef/knife/ec_base_spec.rb +1 -1
- data/spec/chef/knife/ec_key_base_spec.rb +5 -4
- data/spec/chef/knife/ec_key_export_spec.rb +2 -2
- data/spec/chef/knife/ec_restore_spec.rb +2 -1
- data/spec/chef/server_spec.rb +1 -1
- metadata +10 -9
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 04d60d691882443cee81667126f9f681d74a57bec9c1aa6891d0ea24d23c0825
|
|
4
|
+
data.tar.gz: 3839aaf3e1266642987da3a8047939bcbf249e4f35e8f637068ac9f228a9ad01
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 3d76b279ecd5178017431e5c0bfad401b40a080ace47b764d70697c426b04ce808b92380d26ab94f5473f743f71e3c16b080a920c2d6acdbffb10f0dcf555ecb
|
|
7
|
+
data.tar.gz: 85876db29caeb5531803fc902ff8ca185b52fb65ac5b3909e591fda18c0af43a483f7cc1d16919ff34978df372254900e78fce3f66e670f65a5125e2c7513cbc
|
data/README.md
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
# Knife EC Backup
|
|
2
|
-
[](https://buildkite.com/chef-oss/chef-knife-ec-backup-master-verify)
|
|
3
3
|
[](https://badge.fury.io/rb/knife-ec-backup)
|
|
4
4
|
|
|
5
5
|
**Umbrella Project**: [Knife](https://github.com/chef/chef-oss-practices/blob/master/projects/knife.md)
|
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
|
|
11
11
|
**Pull Request [Response Time Maximum](https://github.com/chef/chef-oss-practices/blob/master/repo-management/repo-states.md)**: 14 days
|
|
12
12
|
|
|
13
|
-
|
|
13
|
+
## Description
|
|
14
14
|
|
|
15
15
|
knife-ec-backup can backup and restore the data in an Enterprise Chef
|
|
16
16
|
Server installation, preserving the data in an intermediate, editable
|
|
@@ -18,29 +18,24 @@ text format. It is similar to the `knife download` and `knife upload`
|
|
|
18
18
|
commands and uses the same underlying libraries, but also includes
|
|
19
19
|
workarounds for objects not yet supported by those tools and various
|
|
20
20
|
Server API deficiencies. The long-run goal is to improve `knife
|
|
21
|
-
download`, `knife upload` and the Chef Server API and deprecate this
|
|
21
|
+
download`, `knife upload` and the Chef Infra Server API and deprecate this
|
|
22
22
|
tool.
|
|
23
23
|
|
|
24
|
-
|
|
24
|
+
## Requirements
|
|
25
25
|
|
|
26
|
-
This knife plugin requires Chef Client 11.8+.
|
|
26
|
+
This knife plugin requires Chef Infra Client 11.8+.
|
|
27
27
|
|
|
28
|
-
|
|
28
|
+
### Server Support
|
|
29
29
|
|
|
30
|
-
|
|
31
|
-
of this gem. Version 1.x additionally depends on knife-essentials.
|
|
32
|
-
|
|
33
|
-
## Server Support
|
|
34
|
-
|
|
35
|
-
This plugin currently supports Enterprise Chef 11 and Chef Server 12.
|
|
30
|
+
This plugin currently supports Enterprise Chef 11 and Chef Infra Server 12+.
|
|
36
31
|
Support for the beta key rotation features is provided via the
|
|
37
32
|
`--with-keys-sql` flag, but users of this feature should note that
|
|
38
|
-
this may change once the Chef Server supports an API-based export of
|
|
33
|
+
this may change once the Chef Infra Server supports an API-based export of
|
|
39
34
|
the key data.
|
|
40
35
|
|
|
41
|
-
|
|
36
|
+
## Installation
|
|
42
37
|
|
|
43
|
-
|
|
38
|
+
### Chef Infra Server Install (Recommended)
|
|
44
39
|
|
|
45
40
|
This gem is installed with chef-server-core 12.0.0 and newer.
|
|
46
41
|
|
|
@@ -53,7 +48,7 @@ downloading the .zip file. Once unpacked, run:
|
|
|
53
48
|
/opt/opscode/embedded/bin/gem install knife-ec-backup*gem --no-ri --no-rdoc -V
|
|
54
49
|
```
|
|
55
50
|
|
|
56
|
-
|
|
51
|
+
#### Note on installing with existing development tools:
|
|
57
52
|
|
|
58
53
|
The latest versions of knife-ec-backup require gems with native
|
|
59
54
|
extensions, thus you must install a standard build toolchain. To
|
|
@@ -62,6 +57,24 @@ on your system, try the following:
|
|
|
62
57
|
|
|
63
58
|
/opt/opscode/embedded/bin/gem install knife-ec-backup -- --with-pg-config=/opt/opscode/embedded/postgresql/9.2/bin/pg_config
|
|
64
59
|
|
|
60
|
+
This uses the libpq headers that are included in the Chef Infra Server
|
|
61
|
+
package installed in `/opt/opscode`.
|
|
62
|
+
|
|
63
|
+
### Chef Workstation Install (Unsupported)
|
|
64
|
+
|
|
65
|
+
On systems other than the Chef Infra Server, installation of this gem is not
|
|
66
|
+
tested or supported. However, if you attempt to do so you will need the
|
|
67
|
+
postgresql libraries installed.
|
|
68
|
+
|
|
69
|
+
For example, on macOS:
|
|
70
|
+
|
|
71
|
+
```
|
|
72
|
+
brew install libpq
|
|
73
|
+
gem install knife-ec-backup -- --with-pg-config=/usr/local/Cellar/libpq/9.2/bin/pg_config
|
|
74
|
+
```
|
|
75
|
+
|
|
76
|
+
The current location of pg_config can be determined with `brew info libpq`.
|
|
77
|
+
|
|
65
78
|
## Running tests
|
|
66
79
|
|
|
67
80
|
```
|
|
@@ -84,29 +97,29 @@ Clone the git repository and run the following from inside:
|
|
|
84
97
|
gem build knife-ec-backup.gemspec
|
|
85
98
|
gem install knife-ec-backup*gem
|
|
86
99
|
|
|
87
|
-
|
|
100
|
+
## Configuration
|
|
88
101
|
|
|
89
|
-
|
|
102
|
+
### Permissions
|
|
90
103
|
|
|
91
104
|
Note that most users in an EC installation lack the permissions to pull all of the data from all organizations and other users.
|
|
92
|
-
This plugin **REQUIRES THE PIVOTAL KEY AND WEBUI KEY** from the Chef Server.
|
|
93
|
-
It is recommended that you run this from a frontend Enterprise Chef Server, you can use --user and --key to pass the pivotal information along.
|
|
105
|
+
This plugin **REQUIRES THE PIVOTAL KEY AND WEBUI KEY** from the Chef Infra Server.
|
|
106
|
+
It is recommended that you run this from a frontend Enterprise Chef Infra Server, you can use --user and --key to pass the pivotal information along.
|
|
94
107
|
|
|
95
|
-
|
|
108
|
+
## Subcommands
|
|
96
109
|
|
|
97
|
-
|
|
110
|
+
### Common Options
|
|
98
111
|
|
|
99
112
|
The following options are supported across all subcommands:
|
|
100
113
|
|
|
101
114
|
* `--sql-host`:
|
|
102
|
-
The hostname of the Chef Server's postgresql server. (default: localhost)
|
|
115
|
+
The hostname of the Chef Infra Server's postgresql server. (default: localhost)
|
|
103
116
|
|
|
104
117
|
* `--sql-port`:
|
|
105
|
-
The postgresql listening port on the Chef Server. (default: 5432)
|
|
118
|
+
The postgresql listening port on the Chef Infra Server. (default: 5432)
|
|
106
119
|
|
|
107
120
|
* `--sql-db`:
|
|
108
|
-
The postgresql Chef Server database name. (default: opscode_chef)
|
|
109
|
-
Specify 'automate-cs-oc-erchef' when using Automate Chef Server API
|
|
121
|
+
The postgresql Chef Infra Server database name. (default: opscode_chef)
|
|
122
|
+
Specify 'automate-cs-oc-erchef' when using Automate Chef Infra Server API
|
|
110
123
|
|
|
111
124
|
* `--sql-user`:
|
|
112
125
|
The username of postgresql user with access to the opscode_chef
|
|
@@ -122,7 +135,7 @@ The following options are supported across all subcommands:
|
|
|
122
135
|
* `--dry-run`:
|
|
123
136
|
Report what actions would be taken without performing any. (default: false)
|
|
124
137
|
|
|
125
|
-
|
|
138
|
+
### knife ec backup DEST_DIR (options)
|
|
126
139
|
|
|
127
140
|
*Path*: If you have chef-client installed as well, you may need to invoke this as `/opt/opscode/embedded/bin/knife ec backup backup`
|
|
128
141
|
|
|
@@ -144,8 +157,8 @@ The following options are supported across all subcommands:
|
|
|
144
157
|
|
|
145
158
|
* `--with-key-sql`: Whether to backup/restore key data directly
|
|
146
159
|
from the database. This requires access to the listening
|
|
147
|
-
postgresql port on the Chef Server. This is required to correctly
|
|
148
|
-
handle keys in Chef Servers with multikey support. This option
|
|
160
|
+
postgresql port on the Chef Infra Server. This is required to correctly
|
|
161
|
+
handle keys in Chef Infra Servers with multikey support. This option
|
|
149
162
|
will only work on `restore` if it was also used during the
|
|
150
163
|
`backup`.
|
|
151
164
|
|
|
@@ -156,7 +169,7 @@ The following options are supported across all subcommands:
|
|
|
156
169
|
Chef objects.
|
|
157
170
|
|
|
158
171
|
* `--skip-version-check`:
|
|
159
|
-
Skip Chef Server version check. This will also skip any auto-configured options (default: false)
|
|
172
|
+
Skip Chef Infra Server version check. This will also skip any auto-configured options (default: false)
|
|
160
173
|
|
|
161
174
|
* `--only-org ORG`:
|
|
162
175
|
Only donwload/restore objects in the named organization. Global
|
|
@@ -214,7 +227,7 @@ This compares very closely with the "knife download /" from an OSC server:
|
|
|
214
227
|
users
|
|
215
228
|
<name>.json>
|
|
216
229
|
|
|
217
|
-
|
|
230
|
+
### knife ec restore DEST_DIR (options)
|
|
218
231
|
|
|
219
232
|
Restores all data from the specified DEST_DIR to an Enterprise Chef /
|
|
220
233
|
Private Chef server. DEST_DIR should be a backup directory created by
|
|
@@ -239,11 +252,11 @@ Private Chef server. DEST_DIR should be a backup directory created by
|
|
|
239
252
|
Server. (default: 10)
|
|
240
253
|
|
|
241
254
|
* `--skip-version-check`:
|
|
242
|
-
Skip Chef Server version check. This will
|
|
255
|
+
Skip Chef Infra Server version check. This will
|
|
243
256
|
also skip any auto-configured options (default: false)
|
|
244
257
|
|
|
245
258
|
* `--[no-]skip-user-ids`:
|
|
246
|
-
Reuses user ids from the restore destination when updating existing
|
|
259
|
+
Reuses user ids from the restore destination when updating existing
|
|
247
260
|
users to avoid database conflicts (default: true)
|
|
248
261
|
|
|
249
262
|
* `--with-user-sql`:
|
|
@@ -256,8 +269,8 @@ Private Chef server. DEST_DIR should be a backup directory created by
|
|
|
256
269
|
|
|
257
270
|
* `--with-key-sql`: Whether to backup/restore key data directly
|
|
258
271
|
from the database. This requires access to the listening
|
|
259
|
-
postgresql port on the Chef Server. This is required to correctly
|
|
260
|
-
handle keys in Chef Servers with multikey support. This option
|
|
272
|
+
postgresql port on the Chef Infra Server. This is required to correctly
|
|
273
|
+
handle keys in Chef Infra Servers with multikey support. This option
|
|
261
274
|
will only work on `restore` if it was also used during the
|
|
262
275
|
`backup`.
|
|
263
276
|
|
|
@@ -268,35 +281,35 @@ Private Chef server. DEST_DIR should be a backup directory created by
|
|
|
268
281
|
Chef objects.
|
|
269
282
|
|
|
270
283
|
* `--only-org ORG`:
|
|
271
|
-
Only
|
|
284
|
+
Only download/restore objects in the named organization. Global
|
|
272
285
|
objects such as users will still be downloaded/restored.
|
|
273
286
|
|
|
274
|
-
|
|
287
|
+
### knife ec key export [FILENAME]
|
|
275
288
|
|
|
276
|
-
Create a json representation of the users table from the Chef Server
|
|
289
|
+
Create a json representation of the users table from the Chef Infra Server
|
|
277
290
|
database. If no argument is given, the name of the backup is
|
|
278
291
|
`key_dump.json`.
|
|
279
292
|
|
|
280
293
|
Please note, most users should use `knife ec backup` with the
|
|
281
294
|
`--with-user-sql` option rather than this command.
|
|
282
295
|
|
|
283
|
-
|
|
296
|
+
### knife ec key import [FILENAME]
|
|
284
297
|
|
|
285
298
|
Import a json representation of the users table from FILENAME to the
|
|
286
|
-
the Chef Server database. If no argument is given, the filename is
|
|
299
|
+
the Chef Infra Server database. If no argument is given, the filename is
|
|
287
300
|
assumed to be `key_dump.json`.
|
|
288
301
|
|
|
289
302
|
Please note, most user should use `knife ec restore` with the
|
|
290
303
|
`--with-user-sql` option rather than this command.
|
|
291
304
|
|
|
292
|
-
|
|
305
|
+
## Known Bugs
|
|
293
306
|
|
|
294
307
|
- knife-ec-backup cannot be installed in the embedded gemset of Chef
|
|
295
|
-
Server 12. This will be resolved in a future Chef Server release.
|
|
308
|
+
Server 12. This will be resolved in a future Chef Infra Server release.
|
|
296
309
|
|
|
297
310
|
- `knife ec restore` can fail to restore cookbooks, failing with an
|
|
298
311
|
internal server error. A common cause of this problem is a
|
|
299
|
-
concurrency bug in Chef Server. Setting `--concurrency 1` can often
|
|
312
|
+
concurrency bug in Chef Infra Server. Setting `--concurrency 1` can often
|
|
300
313
|
work around the issue.
|
|
301
314
|
|
|
302
315
|
- `knife ec restore` can fail if the pool of pre-created organizations
|
data/Rakefile
CHANGED
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
class Chef
|
|
2
|
+
class Automate
|
|
3
|
+
def self.is_installed?
|
|
4
|
+
File.exists?('/hab/svc/automate-cs-oc-erchef/')
|
|
5
|
+
end
|
|
6
|
+
|
|
7
|
+
def self.config
|
|
8
|
+
{
|
|
9
|
+
sql_user: 'automate-cs-oc-erchef',
|
|
10
|
+
sql_cert: '/hab/svc/automate-cs-oc-erchef/config/service.crt',
|
|
11
|
+
sql_key: '/hab/svc/automate-cs-oc-erchef/config/service.key',
|
|
12
|
+
sql_rootcert: '/hab/svc/automate-cs-oc-erchef/config/root_ca.crt',
|
|
13
|
+
sql_db: 'automate-cs-oc-erchef',
|
|
14
|
+
webui_key: '/hab/svc/automate-cs-oc-erchef/data/webui_priv.pem'
|
|
15
|
+
}
|
|
16
|
+
end
|
|
17
|
+
end
|
|
18
|
+
end
|
data/lib/chef/knife/ec_backup.rb
CHANGED
|
@@ -13,9 +13,13 @@ class Chef
|
|
|
13
13
|
require 'chef/chef_fs/config'
|
|
14
14
|
require 'chef/chef_fs/file_system'
|
|
15
15
|
require 'chef/chef_fs/file_pattern'
|
|
16
|
-
|
|
16
|
+
begin
|
|
17
|
+
require 'chef/chef_fs/parallelizer'
|
|
18
|
+
rescue LoadError
|
|
19
|
+
require 'chef-utils/parallel_map' unless defined?(ChefUtils::ParallelMap)
|
|
20
|
+
end
|
|
17
21
|
require_relative '../server'
|
|
18
|
-
require 'fileutils'
|
|
22
|
+
require 'fileutils' unless defined?(FileUtils)
|
|
19
23
|
end
|
|
20
24
|
|
|
21
25
|
def run
|
|
@@ -96,10 +100,10 @@ class Chef
|
|
|
96
100
|
knife_ec_error_handler.add(ex)
|
|
97
101
|
next
|
|
98
102
|
end
|
|
99
|
-
# Enterprise Chef 11 and below uses a pool of
|
|
103
|
+
# Enterprise Chef 11 and below uses a pool of pre-created
|
|
100
104
|
# organizations to account for slow organization creation
|
|
101
105
|
# using CouchDB. Thus, on server versions < 12 we want to
|
|
102
|
-
# skip any of these
|
|
106
|
+
# skip any of these pre-created organizations by checking if
|
|
103
107
|
# they have been assigned or not. The Chef 12 API does not
|
|
104
108
|
# return an assigned_at field.
|
|
105
109
|
if org['assigned_at'] || server.version >= Gem::Version.new("12")
|
data/lib/chef/knife/ec_base.rb
CHANGED
|
@@ -18,9 +18,10 @@
|
|
|
18
18
|
|
|
19
19
|
require 'chef/knife'
|
|
20
20
|
require 'chef/server_api'
|
|
21
|
-
require 'veil'
|
|
21
|
+
require 'veil' unless defined?(Veil)
|
|
22
22
|
require_relative 'ec_error_handler'
|
|
23
|
-
require 'ffi_yajl'
|
|
23
|
+
require 'ffi_yajl' unless defined?(FFI_Yajl)
|
|
24
|
+
require_relative '../automate'
|
|
24
25
|
|
|
25
26
|
class Chef
|
|
26
27
|
class Knife
|
|
@@ -31,13 +32,17 @@ class Chef
|
|
|
31
32
|
def self.included(includer)
|
|
32
33
|
includer.class_eval do
|
|
33
34
|
|
|
35
|
+
option :error_log_dir,
|
|
36
|
+
:long => '--error-log-dir PATH',
|
|
37
|
+
:description => 'Path to a directory where any errors will be logged'
|
|
38
|
+
|
|
34
39
|
option :concurrency,
|
|
35
40
|
:long => '--concurrency THREADS',
|
|
36
41
|
:description => 'Maximum number of simultaneous requests to send (default: 10)'
|
|
37
42
|
|
|
38
43
|
option :webui_key,
|
|
39
44
|
:long => '--webui-key KEYPATH',
|
|
40
|
-
:description => 'Path to the WebUI Key (default: Read from secrets store or /etc/opscode/webui_priv.pem)'
|
|
45
|
+
:description => 'Path to the WebUI Key (default: Read from secrets store or /etc/opscode/webui_priv.pem or /hab/svc/automate-cs-oc-erchef/data/webui_priv.pem)'
|
|
41
46
|
|
|
42
47
|
option :secrets_file_path,
|
|
43
48
|
:long => '--secrets-file PATH',
|
|
@@ -72,8 +77,7 @@ class Chef
|
|
|
72
77
|
|
|
73
78
|
option :sql_db,
|
|
74
79
|
:long => '--sql-db DBNAME',
|
|
75
|
-
:description => 'Postgresql Chef Server database name (default: opscode_chef)'
|
|
76
|
-
:default => "opscode_chef"
|
|
80
|
+
:description => 'Postgresql Chef Server database name (default: opscode_chef or automate-cs-oc-erchef)'
|
|
77
81
|
|
|
78
82
|
option :sql_user,
|
|
79
83
|
:long => "--sql-user USERNAME",
|
|
@@ -83,6 +87,18 @@ class Chef
|
|
|
83
87
|
:long => "--sql-password PASSWORD",
|
|
84
88
|
:description => 'Password used to connect to the postgresql database'
|
|
85
89
|
|
|
90
|
+
option :sql_cert,
|
|
91
|
+
:long => "--sql-cert ",
|
|
92
|
+
:description => 'Path to client ssl cert'
|
|
93
|
+
|
|
94
|
+
option :sql_key,
|
|
95
|
+
:long => "--sql-key PATH",
|
|
96
|
+
:description => 'Path to client ssl key'
|
|
97
|
+
|
|
98
|
+
option :sql_rootcert,
|
|
99
|
+
:long => "--sql-rootcert ",
|
|
100
|
+
:description => 'Path to root ssl cert'
|
|
101
|
+
|
|
86
102
|
option :with_user_sql,
|
|
87
103
|
:long => '--with-user-sql',
|
|
88
104
|
:description => 'Try direct data base access for user export/import. Required to properly handle passwords, keys, and USAGs'
|
|
@@ -109,7 +125,11 @@ class Chef
|
|
|
109
125
|
def configure_chef
|
|
110
126
|
super
|
|
111
127
|
Chef::Config[:concurrency] = config[:concurrency].to_i if config[:concurrency]
|
|
112
|
-
Chef::ChefFS::Parallelizer
|
|
128
|
+
if defined?(Chef::ChefFS::Parallelizer)
|
|
129
|
+
Chef::ChefFS::Parallelizer.threads = (Chef::Config[:concurrency] || 10) - 1
|
|
130
|
+
elsif defined?(ChefUtils::DefaultThreadPool)
|
|
131
|
+
ChefUtils::DefaultThreadPool.instance.threads = (Chef::Config[:concurrency] || 10) - 1
|
|
132
|
+
end
|
|
113
133
|
end
|
|
114
134
|
|
|
115
135
|
def org_admin
|
|
@@ -160,7 +180,8 @@ class Chef
|
|
|
160
180
|
end
|
|
161
181
|
|
|
162
182
|
def knife_ec_error_handler
|
|
163
|
-
|
|
183
|
+
error_dir = config[:error_log_dir] || dest_dir
|
|
184
|
+
@knife_ec_error_handler ||= Chef::Knife::EcErrorHandler.new(error_dir, self.class)
|
|
164
185
|
end
|
|
165
186
|
|
|
166
187
|
def user_acl_rest
|
|
@@ -195,6 +216,8 @@ class Chef
|
|
|
195
216
|
def webui_key
|
|
196
217
|
if config[:webui_key]
|
|
197
218
|
config[:webui_key]
|
|
219
|
+
elsif Chef::Automate.is_installed?
|
|
220
|
+
config[:webui_key] = Chef::Automate.config[:webui_key]
|
|
198
221
|
elsif veil.exist?("chef-server", "webui_key")
|
|
199
222
|
temporary_webui_key
|
|
200
223
|
else
|
|
@@ -17,6 +17,7 @@
|
|
|
17
17
|
#
|
|
18
18
|
|
|
19
19
|
require 'chef/knife'
|
|
20
|
+
require 'veil'
|
|
20
21
|
|
|
21
22
|
class Chef
|
|
22
23
|
class Knife
|
|
@@ -27,7 +28,8 @@ class Chef
|
|
|
27
28
|
|
|
28
29
|
deps do
|
|
29
30
|
require 'sequel'
|
|
30
|
-
require 'json'
|
|
31
|
+
require 'json' unless defined?(JSON)
|
|
32
|
+
require_relative '../automate'
|
|
31
33
|
end
|
|
32
34
|
|
|
33
35
|
option :sql_host,
|
|
@@ -42,8 +44,7 @@ class Chef
|
|
|
42
44
|
|
|
43
45
|
option :sql_db,
|
|
44
46
|
:long => '--sql-db DBNAME',
|
|
45
|
-
:description => 'Postgresql Chef Server database name (default: opscode_chef)'
|
|
46
|
-
:default => "opscode_chef"
|
|
47
|
+
:description => 'Postgresql Chef Server database name (default: opscode_chef or automate-cs-oc-erchef)'
|
|
47
48
|
|
|
48
49
|
option :sql_user,
|
|
49
50
|
:long => "--sql-user USERNAME",
|
|
@@ -53,6 +54,18 @@ class Chef
|
|
|
53
54
|
:long => "--sql-password PASSWORD",
|
|
54
55
|
:description => 'Password used to connect to the postgresql database'
|
|
55
56
|
|
|
57
|
+
option :sql_cert,
|
|
58
|
+
:long => "--sql-cert ",
|
|
59
|
+
:description => 'Path to client ssl cert'
|
|
60
|
+
|
|
61
|
+
option :sql_key,
|
|
62
|
+
:long => "--sql-key PATH",
|
|
63
|
+
:description => 'Path to client ssl key'
|
|
64
|
+
|
|
65
|
+
option :sql_rootcert,
|
|
66
|
+
:long => "--sql-rootcert ",
|
|
67
|
+
:description => 'Path to root ssl cert'
|
|
68
|
+
|
|
56
69
|
option :secrets_file_path,
|
|
57
70
|
:long => '--secrets-file PATH',
|
|
58
71
|
:description => 'Path to a valid private-chef-secrets.json file (default: /etc/opscode/private-chef-secrets.json)',
|
|
@@ -73,27 +86,44 @@ class Chef
|
|
|
73
86
|
def db
|
|
74
87
|
@db ||= begin
|
|
75
88
|
require 'sequel'
|
|
76
|
-
|
|
77
|
-
|
|
89
|
+
require 'uri'
|
|
90
|
+
server_uri = URI('postgres://')
|
|
91
|
+
server_uri.host = config[:sql_host]
|
|
92
|
+
server_uri.port = config[:sql_port]
|
|
93
|
+
server_uri.user = URI.encode_www_form_component(config[:sql_user]) if config[:sql_user]
|
|
94
|
+
server_uri.password = URI.encode_www_form_component(config[:sql_password]) if config[:sql_password]
|
|
95
|
+
query_params = []
|
|
96
|
+
query_params.push("sslcert=#{config[:sql_cert]}") if config[:sql_cert]
|
|
97
|
+
query_params.push("sslkey=#{config[:sql_key]}") if config[:sql_key]
|
|
98
|
+
query_params.push("sslrootcert=#{config[:sql_rootcert]}") if config[:sql_rootcert]
|
|
99
|
+
server_uri.query = query_params.join("&") if query_params.length > 0
|
|
100
|
+
|
|
101
|
+
::Sequel.connect(server_uri.to_s, :convert_infinite_timestamps => :string)
|
|
78
102
|
end
|
|
79
103
|
end
|
|
80
104
|
|
|
81
105
|
# Loads SQL user and password from running config if not passed
|
|
82
106
|
# as a command line option
|
|
83
107
|
def load_config_from_file!
|
|
84
|
-
if
|
|
85
|
-
ui.
|
|
86
|
-
|
|
108
|
+
if Chef::Automate.is_installed?
|
|
109
|
+
ui.msg "Automate detected"
|
|
110
|
+
config.merge! Chef::Automate.config {|key, v1, v2| v1}
|
|
87
111
|
else
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
112
|
+
if ! File.exists?("/etc/opscode/chef-server-running.json")
|
|
113
|
+
ui.fatal "SQL User or Password not provided as option and running config cannot be found!"
|
|
114
|
+
exit 1
|
|
115
|
+
else
|
|
116
|
+
running_config ||= JSON.parse(File.read("/etc/opscode/chef-server-running.json"))
|
|
117
|
+
# Latest versions of chef server put the database info under opscode-erchef.sql_user
|
|
118
|
+
hash_key = if running_config['private_chef']['opscode-erchef'].has_key? 'sql_user'
|
|
119
|
+
'opscode-erchef'
|
|
120
|
+
else
|
|
121
|
+
'postgresql'
|
|
122
|
+
end
|
|
123
|
+
config[:sql_user] ||= running_config['private_chef'][hash_key]['sql_user']
|
|
124
|
+
config[:sql_password] ||= (running_config['private_chef'][hash_key]['sql_password'] || sql_password)
|
|
125
|
+
config[:sql_db] ||= 'opscode_chef'
|
|
126
|
+
end
|
|
97
127
|
end
|
|
98
128
|
end
|
|
99
129
|
|
|
@@ -184,7 +184,7 @@ class Chef
|
|
|
184
184
|
d.delete('id') if config[:skip_ids]
|
|
185
185
|
# If the hash_type in the export,
|
|
186
186
|
# we are dealing with a record where the password is still in the
|
|
187
|
-
#
|
|
187
|
+
# serialized_object. Explicitly setting these to nil ensures that the
|
|
188
188
|
# password set in the restore is wiped out.
|
|
189
189
|
unless d.has_key?('hash_type')
|
|
190
190
|
d['hash_type'] = nil
|
|
@@ -33,8 +33,12 @@ class Chef
|
|
|
33
33
|
# Work around bug in chef_fs
|
|
34
34
|
require 'chef/chef_fs/command_line'
|
|
35
35
|
require 'chef/chef_fs/data_handler/acl_data_handler'
|
|
36
|
-
require 'securerandom'
|
|
37
|
-
|
|
36
|
+
require 'securerandom' unless defined?(SecureRandom)
|
|
37
|
+
begin
|
|
38
|
+
require 'chef/chef_fs/parallelizer'
|
|
39
|
+
rescue LoadError
|
|
40
|
+
require 'chef-utils/parallel_map' unless defined?(ChefUtils::ParallelMap)
|
|
41
|
+
end
|
|
38
42
|
require_relative '../tsorter'
|
|
39
43
|
require_relative '../server'
|
|
40
44
|
end
|
|
@@ -229,7 +233,7 @@ class Chef
|
|
|
229
233
|
ui.msg "Restoring org admin data"
|
|
230
234
|
chef_fs_config = Chef::ChefFS::Config.new
|
|
231
235
|
|
|
232
|
-
# Handle Admins, Billing Admins and Public Key Read Access
|
|
236
|
+
# Handle Admins, Billing Admins and Public Key Read Access separately
|
|
233
237
|
#
|
|
234
238
|
# admins: We need to upload admins first so that we
|
|
235
239
|
# can upload all of the other objects as a user in the org
|
data/lib/chef/server.rb
CHANGED
|
@@ -38,6 +38,8 @@ describe Chef::Knife::EcBackup do
|
|
|
38
38
|
allow(@knife).to receive(:rest).and_return(@rest)
|
|
39
39
|
allow(@knife).to receive(:user_acl_rest).and_return(@rest)
|
|
40
40
|
allow_any_instance_of(Chef::Knife::EcBase).to receive(:dest_dir).and_return(dest_dir)
|
|
41
|
+
allow(@knife.ui).to receive(:msg)
|
|
42
|
+
allow(@knife.ui).to receive(:error)
|
|
41
43
|
end
|
|
42
44
|
|
|
43
45
|
describe "#for_each_user" do
|
|
@@ -2,7 +2,7 @@ require File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "spec_hel
|
|
|
2
2
|
require 'chef/knife/ec_base'
|
|
3
3
|
require 'chef/knife'
|
|
4
4
|
require 'chef/config'
|
|
5
|
-
require 'stringio'
|
|
5
|
+
require 'stringio' unless defined?(StringIO)
|
|
6
6
|
|
|
7
7
|
class Tester < Chef::Knife
|
|
8
8
|
include Chef::Knife::EcBase
|
|
@@ -1,23 +1,25 @@
|
|
|
1
1
|
require File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "spec_helper"))
|
|
2
2
|
require 'chef/knife/ec_key_base'
|
|
3
|
+
require 'chef/automate'
|
|
3
4
|
|
|
4
5
|
class KeyBaseTester < Chef::Knife
|
|
5
6
|
include Chef::Knife::EcKeyBase
|
|
6
7
|
end
|
|
7
8
|
|
|
8
9
|
describe Chef::Knife::EcKeyBase do
|
|
9
|
-
let (:knife) {
|
|
10
|
+
let (:knife) { KeyBaseTester.new }
|
|
10
11
|
|
|
11
12
|
let(:running_server_postgresql_sql_config_json) {
|
|
12
|
-
'{"private_chef": { "opscode-erchef":{}, "postgresql": { "sql_user": "jiminy", "sql_password": "secret"} }
|
|
13
|
+
'{"private_chef": { "opscode-erchef":{}, "postgresql": { "sql_user": "jiminy", "sql_password": "secret"} } }'
|
|
13
14
|
}
|
|
14
15
|
|
|
15
16
|
|
|
16
17
|
let(:running_server_erchef_config_json) {
|
|
17
|
-
'{"private_chef": { "opscode-erchef": { "sql_user": "cricket", "sql_password": "secrete"}}
|
|
18
|
+
'{"private_chef": { "opscode-erchef": { "sql_user": "cricket", "sql_password": "secrete"} } }'
|
|
18
19
|
}
|
|
19
20
|
describe "#load_config_from_file!" do
|
|
20
21
|
before(:each) do
|
|
22
|
+
allow(Chef::Automate).to receive(:is_installed?).and_return(false)
|
|
21
23
|
allow(File).to receive(:exists?).and_return(true)
|
|
22
24
|
allow(File).to receive(:size).and_return(1)
|
|
23
25
|
end
|
|
@@ -35,4 +37,3 @@ describe Chef::Knife::EcKeyBase do
|
|
|
35
37
|
end
|
|
36
38
|
end
|
|
37
39
|
end
|
|
38
|
-
|
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
require File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "spec_helper"))
|
|
2
2
|
require 'chef/knife/ec_key_export'
|
|
3
3
|
require 'sequel'
|
|
4
|
-
require 'json'
|
|
5
|
-
require 'securerandom'
|
|
4
|
+
require 'json' unless defined?(JSON)
|
|
5
|
+
require 'securerandom' unless defined?(SecureRandom)
|
|
6
6
|
require 'fakefs/spec_helpers'
|
|
7
7
|
|
|
8
8
|
def user_record(name)
|
|
@@ -3,6 +3,7 @@ require 'chef/knife/ec_restore'
|
|
|
3
3
|
require 'fakefs/spec_helpers'
|
|
4
4
|
require_relative './ec_error_handler_spec'
|
|
5
5
|
require "chef/chef_fs/file_system/repository/chef_repository_file_system_root_dir"
|
|
6
|
+
require 'net/http'
|
|
6
7
|
|
|
7
8
|
def make_user(username)
|
|
8
9
|
FileUtils.mkdir_p("/users")
|
|
@@ -58,7 +59,7 @@ describe Chef::Knife::EcRestore do
|
|
|
58
59
|
@knife.restore_open_invitations("foo")
|
|
59
60
|
end
|
|
60
61
|
|
|
61
|
-
it "does NOT fail if an
|
|
62
|
+
it "does NOT fail if an invitation already exists" do
|
|
62
63
|
make_org "foo"
|
|
63
64
|
allow(@rest).to receive(:post).with("organizations/foo/association_requests", {"user" => "bob"}).and_return(net_exception(409))
|
|
64
65
|
allow(@rest).to receive(:post).with("organizations/foo/association_requests", {"user" => "jane"}).and_return(net_exception(409))
|
data/spec/chef/server_spec.rb
CHANGED
metadata
CHANGED
|
@@ -1,29 +1,29 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: knife-ec-backup
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 2.
|
|
4
|
+
version: 2.5.3
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- John Keiser
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date:
|
|
11
|
+
date: 2021-10-12 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: sequel
|
|
15
15
|
requirement: !ruby/object:Gem::Requirement
|
|
16
16
|
requirements:
|
|
17
|
-
- - "
|
|
17
|
+
- - "~>"
|
|
18
18
|
- !ruby/object:Gem::Version
|
|
19
|
-
version: '
|
|
19
|
+
version: '5.9'
|
|
20
20
|
type: :runtime
|
|
21
21
|
prerelease: false
|
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
|
23
23
|
requirements:
|
|
24
|
-
- - "
|
|
24
|
+
- - "~>"
|
|
25
25
|
- !ruby/object:Gem::Version
|
|
26
|
-
version: '
|
|
26
|
+
version: '5.9'
|
|
27
27
|
- !ruby/object:Gem::Dependency
|
|
28
28
|
name: pg
|
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -91,6 +91,7 @@ files:
|
|
|
91
91
|
- LICENSE
|
|
92
92
|
- README.md
|
|
93
93
|
- Rakefile
|
|
94
|
+
- lib/chef/automate.rb
|
|
94
95
|
- lib/chef/knife/ec_backup.rb
|
|
95
96
|
- lib/chef/knife/ec_base.rb
|
|
96
97
|
- lib/chef/knife/ec_error_handler.rb
|
|
@@ -114,7 +115,7 @@ files:
|
|
|
114
115
|
- spec/spec_helper.rb
|
|
115
116
|
homepage: https://www.chef.io
|
|
116
117
|
licenses:
|
|
117
|
-
- Apache
|
|
118
|
+
- Apache-2.0
|
|
118
119
|
metadata: {}
|
|
119
120
|
post_install_message:
|
|
120
121
|
rdoc_options: []
|
|
@@ -124,14 +125,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
|
124
125
|
requirements:
|
|
125
126
|
- - ">="
|
|
126
127
|
- !ruby/object:Gem::Version
|
|
127
|
-
version: '
|
|
128
|
+
version: '2.6'
|
|
128
129
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
129
130
|
requirements:
|
|
130
131
|
- - ">="
|
|
131
132
|
- !ruby/object:Gem::Version
|
|
132
133
|
version: '0'
|
|
133
134
|
requirements: []
|
|
134
|
-
rubygems_version: 3.
|
|
135
|
+
rubygems_version: 3.1.4
|
|
135
136
|
signing_key:
|
|
136
137
|
specification_version: 4
|
|
137
138
|
summary: Backup and Restore of Enterprise Chef
|