krates 1.6.0

data/lib/kontena/callbacks/master/deploy/56_set_server_provider_after_deploy.rb

@@ -0,0 +1,24 @@
+module Kontena
+  module Callbacks
+    class SetServerProviderAfterDeploy < Kontena::Callback
+
+      matches_commands 'master create'
+
+      def after
+        extend Kontena::Cli::Common
+        return unless command.exit_code == 0
+        return unless config.current_master
+        return unless config.current_master.name == command.result[:name]
+        return unless command.result[:provider]
+
+        require 'shellwords'
+
+        cmd = ['master', 'config', 'set', "server.provider=#{command.result[:provider]}"]
+        spinner "Setting Master configuration server.provider to '#{command.result[:provider]}'" do |spin|
+          spin.fail! unless Kontena.run(cmd)
+        end
+      end
+    end
+  end
+end
+

data/lib/kontena/callbacks/master/deploy/60_configure_auth_provider_after_deploy.rb

@@ -0,0 +1,31 @@
+module Kontena
+  module Callbacks
+    class ConfigureAuthProviderAfterDeploy < Kontena::Callback
+
+      matches_commands 'master create'
+
+      def init_cloud_args
+        args = []
+        args << '--force'
+        args += ["--cloud-master-id", command.cloud_master_id] if command.cloud_master_id
+        args += ["--provider", command.result[:provider]] if command.result[:provider]
+        args += ["--version", command.result[:version]] if command.result[:version]
+        args
+      end
+
+      def after
+        extend Kontena::Cli::Common
+        return unless command.exit_code == 0
+        return unless command.result.kind_of?(Hash)
+        return unless command.result.has_key?(:name)
+        return unless config.current_master
+        return unless config.current_master.name == command.result[:name]
+
+        unless command.respond_to?(:skip_auth_provider?) && command.skip_auth_provider?
+          Kontena.run(['master', 'init-cloud'] + init_cloud_args)
+        end
+      end
+    end
+  end
+end
+

data/lib/kontena/callbacks/master/deploy/70_invite_self_after_deploy.rb

@@ -0,0 +1,95 @@
+module Kontena
+  module Callbacks
+    class InviteSelfAfterDeploy < Kontena::Callback
+
+      matches_commands 'master create', 'master init_cloud'
+
+      def cloud_user_data
+        return @cloud_user_data if @cloud_user_data
+        return nil unless cloud_auth?
+        user_data = {}
+        response = nil
+        spinner "Retrieving user information from Kontena Cloud" do
+          response = cloud_client.get(kontena_account.userinfo_endpoint)
+        end
+        if response && response.kind_of?(Hash) && response.has_key?('data') && response['data'].has_key?('attributes')
+          user_data[:email] = response['data']['attributes']['email']
+          user_data[:username] = response['data']['attributes']['username']
+          user_data[:id] = response['data']['id']
+          user_data[:verified] = response['data']['attributes']['verified']
+          @cloud_user_data = user_data
+        end
+        @cloud_user_data
+      end
+
+      def after
+        extend Kontena::Cli::Common
+        return unless current_master
+        return unless command.exit_code == 0
+        return nil if command.respond_to?(:skip_auth_provider?) && command.skip_auth_provider?
+        return nil unless cloud_user_data
+
+        invite_response = nil
+        spinner "Creating user #{cloud_user_data[:email]} into Kontena Master" do |spin|
+          invite_response = Kontena.run(["master", "user", "invite", "--external-id", cloud_user_data[:id], "--return", cloud_user_data[:email]])
+          spin.fail! unless invite_response.kind_of?(Hash) && invite_response.has_key?('invite_code')
+        end
+
+        return nil unless invite_response
+        logger.debug { "Got invite code: #{invite_response['invite_code']}" }
+
+        success = spinner "Adding master_admin role for #{cloud_user_data[:email]}" do |spin|
+          spin.fail! unless Kontena.run(["master", "user", "role", "add", "--silent", "master_admin", cloud_user_data[:email]])
+          true
+        end
+
+        return nil unless success
+
+        if current_master.grid
+          spinner "Adding #{cloud_user_data[:email]} to grid '#{current_master.grid}'" do |spin|
+            spin.fail! unless Kontena.run(["grid", "user", "add", "--grid", current_master.grid, cloud_user_data[:email]])
+          end
+        end
+
+        return nil unless current_master.username.to_s == 'admin'
+
+        new_user_token = spinner "Creating an access token for #{cloud_user_data[:email]}" do |spin|
+          Kontena.run!(["master", "token", "create", "-e", "0", "-s", "user", "--return", "-u", cloud_user_data[:email]])
+        end
+
+        master_name = current_master.name.dup
+        master_url  = current_master.url
+        old_master  = current_master
+
+        spinner "Copying server '#{current_master.name}' to '#{current_master.name}-admin' in configuration" do
+          config.servers << Kontena::Cli::Config::Server.new(
+            name: "#{current_master.name}-admin",
+            url: current_master.url,
+            username: 'admin',
+            grid: current_master.grid,
+            token: Kontena::Cli::Config::Token.new(
+              access_token:  current_master.token.access_token,
+              refresh_token: current_master.token.refresh_token,
+              expires_at:    current_master.token.expires_at,
+              parent_type:   :master,
+              parent_name:   "#{current_master.name}-admin"
+            ),
+            account: 'master'
+          )
+        end
+
+        spinner "Authenticating as #{cloud_user_data[:email]} to Kontena Master '#{current_master.name}'" do
+          current_master.token = Kontena::Cli::Config::Token.new(
+            access_token:  new_user_token[:access_token],
+            refresh_token: new_user_token[:refresh_token],
+            expires_at:    new_user_token[:expires_in].to_i > 0 ? Time.now.utc.to_i + new_user_token[:expires_in].to_i : nil,
+            parent_type:   :master,
+            parent_name:   "#{current_master.name}"
+          )
+          current_master.username = new_user_token[:user_name].to_s == "" ? new_user_token[:user_email] : new_user_token[:user_name]
+          config.write
+        end
+      end
+    end
+  end
+end

data/lib/kontena/callbacks/master/deploy/90_proptip_after_deploy.rb

@@ -0,0 +1,33 @@
+module Kontena
+  module Callbacks
+    class SuggestInvitingYourself < Kontena::Callback
+
+      matches_commands 'master create'
+
+      def after
+        extend Kontena::Cli::Common
+
+        return unless current_master
+        return unless command.exit_code == 0
+        return if current_master.username.to_s == 'admin'
+
+        puts
+        puts Kontena.pastel.green("Protip:")
+
+        if config.find_server("#{current_master.name}-admin")
+          puts "  You are currently using the Kontena Master '#{Kontena.pastel.yellow(current_master.name)}' as"
+          puts "  #{Kontena.pastel.yellow(current_master.username)}. To switch to the Kontena Master internal"
+          puts "  administrator you can use:"
+          puts "  #{Kontena.pastel.green.on_black("  kontena master use #{current_master.name}-admin  ")}"
+          puts
+        end
+        puts "  To invite more users you can use:"
+        puts "  #{Kontena.pastel.green.on_black("  kontena master user invite email_address@example.com  ")}"
+        puts
+        puts "  The users can then join the master by using the invite code: "
+        puts "  #{Kontena.pastel.green.on_black("  kontena master join #{current_master.url} <invite_code>  ")}"
+        puts
+      end
+    end
+  end
+end

data/lib/kontena/cli/browser_launcher.rb

@@ -0,0 +1,61 @@
+require 'kontena/util'
+
+module Kontena
+  module Cli
+    class BrowserLauncher
+      def self.open(url)
+        Kontena::Cli::BrowserLauncher.new(url).launch
+      end
+
+      attr_reader :url
+
+      def initialize(url)
+        @url = url
+      end
+
+      def launch
+        system(*command)
+      end
+
+      def command
+        cmd = if Kontena.on_windows?
+          ['cmd', '/c', 'start', '/b', url.gsub(/&/, '^&')]
+        elsif RUBY_PLATFORM =~ /darwin/
+          ["open", url]
+        elsif Kontena.browserless?
+          raise RuntimeError, "Environment variable DISPLAY not set, assuming non-desktop session, unable to open browser. Try using '--remote' option."
+        else
+          [detect_unixlike_command, url]
+        end
+
+        Kontena.logger.debug { "Using %p to launch browser" % cmd }
+
+        cmd
+      end
+
+      def detect_unixlike_command
+        Kontena.logger.debug { "Assuming unix-like environment, looking for browser" }
+
+        cmd = %w(
+          xdg-open
+          sensible-browser
+          x-www-browser
+        ).find { |c| !which(c).nil? }
+
+        if cmd.nil?
+          if ENV['BROWSER']
+            cmd = which(ENV['BROWSER'])
+            return cmd unless cmd.nil?
+          end
+          raise RuntimeError, "Unable to launch a local browser. Try installing xdg-utils or sensible-utils package, setting BROWSER environment variable or using the --remote option"
+        end
+
+        cmd
+      end
+
+      def which(cmd)
+        Kontena::Util.which(cmd)
+      end
+    end
+  end
+end

data/lib/kontena/cli/bytes_helper.rb

@@ -0,0 +1,40 @@
+module Kontena
+  module Cli
+    module BytesHelper
+
+      KILOBYTE = 1024
+      MEGABYTE = KILOBYTE * 1024
+      GIGABYTE = MEGABYTE * 1024
+      TERABYTE = GIGABYTE * 1024
+
+      def to_kilobytes(bytes, ndigits=nil)
+        return 0.0 if bytes.nil?
+        round(bytes.to_f / KILOBYTE, ndigits)
+      end
+
+      def to_megabytes(bytes, ndigits=nil)
+        return 0.0 if bytes.nil?
+        round(bytes.to_f / MEGABYTE, ndigits)
+      end
+
+      def to_gigabytes(bytes, ndigits=nil)
+        return 0.0 if bytes.nil?
+        round(bytes.to_f / GIGABYTE, ndigits)
+      end
+
+      def to_terabytes(bytes, ndigits)
+        return 0.0 if bytes.nil?
+        round(bytes.to_f / TERABYTE, ndigits)
+      end
+
+      private
+      def round(value, ndigits=nil)
+        if ndigits.nil?
+          return value
+        end
+        value.round(ndigits)
+      end
+
+    end
+  end
+end

data/lib/kontena/cli/certificate/authorize_command.rb

@@ -0,0 +1,107 @@
+require_relative '../services/services_helper'
+
+module Kontena::Cli::Certificate
+  class AuthorizeCommand < Kontena::Command
+    include Kontena::Cli::Common
+    include Kontena::Cli::GridOptions
+    include Kontena::Cli::Services::ServicesHelper
+
+    class DeployFailedError < StandardError; end
+
+    parameter "DOMAIN", "Domain to authorize"
+
+    option '--type', 'AUTHORIZATION_TYPE', 'Authorization type, either http-01, dns-01 or tls-sni-01 (renewals only)', default: 'http-01'
+    option '--linked-service', "LINKED_SERVICE", 'A service (usually LB) where the http-01/tls-sni-01 challenge is deployed to'
+
+    requires_current_master
+    requires_current_master_token
+    requires_current_grid
+
+    def requires_linked_service?
+      case type
+      when 'dns-01'
+        false
+      when 'http-01'
+        true
+      when 'tls-sni-01'
+        true
+      else
+        fail "Invalid authorization --type=#{type}"
+      end
+    end
+
+    def execute
+      exit_with_error "--linked-service is required with --type=#{type}" if requires_linked_service? && !self.linked_service
+
+      data = {
+        domain: domain,
+        authorization_type: self.type
+      }
+      data[:linked_service] = service_path(self.linked_service) if self.linked_service
+      retried = false
+
+      response = nil
+      retry_on_le_registration do
+        response = client.post("grids/#{current_grid}/domain_authorizations", data)
+      end
+
+      case self.type
+      when 'dns-01'
+        puts "Authorization successfully created. Use the following details to create necessary validations:"
+        puts "Record name: #{response.dig('challenge_opts', 'record_name')}.#{domain}"
+        puts "Record type: #{response.dig('challenge_opts', 'record_type')}"
+        puts "Record content: #{response.dig('challenge_opts', 'record_content')}"
+      when 'http-01'
+        domain_auth = spinner "Waiting for http-01 challenge to be deployed into #{response.dig('linked_service', 'id').colorize(:cyan)} " do
+          wait_for_domain_auth_deployed(response)
+        end
+        if domain_auth['state'] == 'deploy_error'
+          exit_with_error "Linked services deploy failed. Check service events for details"
+        else
+          puts "HTTP challenge is deployed, you can now request the actual certificate"
+        end
+      when 'tls-sni-01'
+        domain_auth = spinner "Waiting for tls-sni-01 challenge to be deployed into #{response.dig('linked_service', 'id').colorize(:cyan)} " do
+          wait_for_domain_auth_deployed(response)
+        end
+        if domain_auth['state'] == 'deploy_error'
+          exit_with_error "Linked services deploy failed. Check service events for details"
+        else
+          puts "TLS-SNI challenge certificate is deployed, you can now request the actual certificate"
+        end
+      else
+        exit_with_error "Unknown authorization type: #{self.type}"
+      end
+    end
+
+    def wait_for_domain_auth_deployed(domain_auth)
+      Timeout.timeout(300) {
+        while domain_auth['status'] == 'deploying' do
+          sleep 1
+
+          domain_auth = client.get("domain_authorizations/#{domain_auth['id']}")
+        end
+        return domain_auth
+      }
+    end
+
+    def service_path(linked_service)
+      unless linked_service.include?('/')
+        "null/#{linked_service}"
+      else
+        linked_service
+      end
+    end
+
+    def retry_on_le_registration
+      yield
+    rescue Kontena::Errors::StandardErrorHash => exc
+      raise unless exc.errors.has_key?('le_registration')
+      # Run through registration
+      puts "Let's Encrypt registration missing, creating one."
+      email = prompt.ask("Email for Let's Encrypt:")
+      Kontena.run!(['certificate', 'register', email])
+      yield
+    end
+  end
+end

data/lib/kontena/cli/certificate/common.rb

@@ -0,0 +1,16 @@
+module Kontena::Cli::Certificate
+  module Common
+    def show_certificate(cert)
+      puts "#{cert['id']}:"
+      puts "  subject: #{cert['subject']}"
+      puts "  valid until: #{Time.parse(cert['valid_until']).utc.strftime("%FT%TZ")}"
+      if cert['alt_names'] && !cert['alt_names'].empty?
+        puts "  alt names:"
+        cert['alt_names'].each do |alt_name|
+          puts "    - #{alt_name}"
+        end
+      end
+      puts "  auto renewable: #{cert['auto_renewable']}"
+    end
+  end
+end

data/lib/kontena/cli/certificate/domain_authorization/list_command.rb

@@ -0,0 +1,24 @@
+
+module Kontena::Cli::Certificate::DomainAuthorization
+  class ListCommand < Kontena::Command
+    include Kontena::Cli::Common
+    include Kontena::Cli::GridOptions
+    include Kontena::Cli::TableGenerator::Helper
+    include Kontena::Util
+
+    requires_current_master
+    requires_current_master_token
+    requires_current_grid
+
+    def fields
+      quiet? ? ['domain'] : {domain: 'domain', authorization_type: 'authorization_type', status: 'status'}
+    end
+
+    def execute
+      authorizations = client.get("grids/#{current_grid}/domain_authorizations")['domain_authorizations']
+
+      print_table(authorizations)
+    end
+
+  end
+end

data/lib/kontena/cli/certificate/domain_authorization/remove_authorization_command.rb

@@ -0,0 +1,25 @@
+
+module Kontena::Cli::Certificate::DomainAuthorization
+  class RemoveAuthorizationCommand < Kontena::Command
+    include Kontena::Cli::Common
+    include Kontena::Cli::GridOptions
+
+    parameter "DOMAIN", "Domain authorization to remove"
+    option "--force", :flag, "Force remove", default: false, attribute_name: :forced
+
+
+    def execute
+      confirm_command(self.domain) unless forced?
+
+      require_api_url
+      token = require_token
+
+
+      spinner "Deleting domain authorization for #{self.domain.colorize(:cyan)}" do
+        client.delete("domain_authorizations/#{current_grid}/#{self.domain}")
+      end
+
+    end
+
+  end
+end

data/lib/kontena/cli/certificate/domain_authorize_command.rb

@@ -0,0 +1,7 @@
+
+module Kontena::Cli::Certificate
+  class DomainAuthorizeCommand < Kontena::Command
+    subcommand ["rm", "remove"], "Remove domain authorization", load_subcommand('certificate/domain_authorization/remove_authorization_command')
+    subcommand ["ls", "list"], "List domain authorizations", load_subcommand('certificate/domain_authorization/list_command')
+  end
+end

data/lib/kontena/cli/certificate/export_command.rb

@@ -0,0 +1,28 @@
+module Kontena::Cli::Certificate
+  class ExportCommand < Kontena::Command
+    include Kontena::Cli::Common
+    include Kontena::Cli::GridOptions
+
+    parameter "SUBJECT", "Certificate subject"
+
+    requires_current_master
+    requires_current_master_token
+    requires_current_grid
+
+    option ['--certificate', '--cert'], :flag, "Output certificate"
+    option ['--chain'], :flag, "Output chain"
+    option ['--private-key', '--key'], :flag, "Output private key"
+
+    def bundle?
+      ![certificate?, chain?, private_key?].any?
+    end
+
+    def execute
+      certificate = client.get("certificates/#{current_grid}/#{self.subject}/export")
+
+      puts certificate['certificate'] if certificate? || bundle?
+      puts certificate['chain'] if chain? || bundle?
+      puts certificate['private_key'] if private_key? || bundle?
+    end
+  end
+end

data/lib/kontena/cli/certificate/get_command.rb

@@ -0,0 +1,33 @@
+
+module Kontena::Cli::Certificate
+  class GetCommand < Kontena::Command
+    include Kontena::Cli::Common
+    include Kontena::Cli::GridOptions
+
+    BANNER = Kontena.pastel.yellow("[DEPRECATED] This command is now deprecated in favor of 'kontena certificate request' command")
+
+    banner BANNER
+
+    option '--secret-name', 'SECRET_NAME', 'The name for the secret to store the certificate in'
+    option '--cert-type', 'CERT_TYPE', 'The type of certificate to get: fullchain, chain or cert', default: 'fullchain'
+    parameter "DOMAIN ...", "Domain(s) to get certificate for"
+
+
+    def execute
+      warn BANNER
+
+      require_api_url
+      token = require_token
+      secret = secret_name || "LE_CERTIFICATE_#{domain_list[0].gsub('.', '_')}"
+      data = {domains: domain_list, secret_name: secret}
+
+      response = client(token).post("certificates/#{current_grid}/certificate", data)
+      puts "Certificate successfully received and stored into vault with keys:"
+      response.each do |secret|
+        puts pastel.green(secret)
+      end
+      puts "Use the #{secret}_BUNDLE with Kontena loadbalancer!"
+
+    end
+  end
+end

data/lib/kontena/cli/certificate/import_command.rb

@@ -0,0 +1,61 @@
+require 'openssl'
+require_relative './common'
+
+module Kontena::Cli::Certificate
+  class ImportCommand < Kontena::Command
+    include Kontena::Cli::Common
+    include Kontena::Cli::GridOptions
+    include Common
+
+    # @raise [ArgumentError]
+    def open_file(path)
+      File.open(path)
+    rescue Errno::ENOENT
+      raise ArgumentError, "File not found: #{path}"
+    end
+
+    parameter 'CERT_FILE', "Path to PEM-encoded X.509 certificate file" do |path|
+      open_file(path)
+    end
+    option '--subject', 'SUBJECT', "Import cert specific subject"
+    option ['--private-key', '--key'], 'KEY_FILE', "Path to private key file", :required => true, :attribute_name => :key_file do |path|
+      open_file(path)
+    end
+    option ['--chain'], 'CHAIN_FILE', "Path to CA cert chain file", :multivalued => true, :attribute_name => :chain_file_list do |path|
+      open_file(path)
+    end
+
+    requires_current_master
+    requires_current_master_token
+    requires_current_grid
+
+    def load_certificate
+      OpenSSL::X509::Certificate.new(self.cert_file)
+    rescue OpenSSL::OpenSSLError => exc
+      exit_with_error "Invalid certificate at #{self.cert_file.path}: #{exc.class}: #{exc.message}"
+    end
+
+    def certificate_subject(cert)
+      cert.subject.to_a.each do |name, data|
+        return data if name == 'CN'
+      end
+
+      exit_with_error "No CN in certificate subject: #{cert.subject}"
+    end
+
+    def execute
+      cert = load_certificate
+      subject = self.subject || self.certificate_subject(cert)
+
+      certificate = spinner "Importing certificate from #{cert_file.path}..." do
+        client.put("certificates/#{current_grid}/#{subject}",
+          certificate: cert.to_pem,
+          private_key: self.key_file.read(),
+          chain: chain_file_list.map{|chain_file| chain_file.read() },
+        )
+      end
+
+      show_certificate(certificate)
+    end
+  end
+end

data/lib/kontena/cli/certificate/list_command.rb

@@ -0,0 +1,75 @@
+require_relative '../services/services_helper'
+
+module Kontena::Cli::Certificate
+  class ListCommand < Kontena::Command
+    include Kontena::Cli::Common
+    include Kontena::Cli::GridOptions
+    include Kontena::Cli::TableGenerator::Helper
+    include Kontena::Util
+
+    requires_current_master
+    requires_current_master_token
+    requires_current_grid
+
+    SEVEN_DAYS = 7 * 24 * 60 * 60
+    THREE_DAYS = 3 * 24 * 60 * 60
+
+    def fields
+      quiet? ? ['subject'] : {subject: 'subject', "expiration" => 'expires_in', auto_renewable?: 'auto_renewable'}
+    end
+
+    def certificates
+      client.get("grids/#{current_grid}/certificates")['certificates']
+    end
+
+    def status_icon(expires_in)
+      icon = '⊛'.freeze
+
+      if expires_in < 0
+        icon.colorize(:red)
+      else
+        icon.colorize(:green)
+      end
+
+    end
+
+    def status_color(expires_in)
+
+      if expires_in < 0
+        :red
+      elsif expires_in < THREE_DAYS
+        :bright_yellow
+      elsif expires_in < SEVEN_DAYS
+        :yellow
+      else
+        :green
+      end
+
+    end
+
+    def expires_in(certificate)
+      valid_until = Time.parse(certificate['valid_until'])
+      (valid_until - Time.now).to_i
+    end
+
+    def expires_in_human(expires_in)
+      if expires_in > 0
+        text = seconds_to_human(expires_in)
+      else
+        text = seconds_to_human(-1 * expires_in) + ' ago'
+      end
+
+      text.colorize(status_color(expires_in))
+    end
+
+    def execute
+      print_table(certificates) do |certificate|
+        expires_in = expires_in(certificate)
+        certificate['subject'] = status_icon(expires_in) + " " + certificate['subject'] unless quiet?
+        next if quiet? # No need to fiddle with colors when they will not get printed
+        certificate['expires_in'] = expires_in_human(expires_in)
+      end
+    end
+
+  end
+end