alchemite-setup 0.1.0__py3-none-any.whl

alchemite_setup/__main__.py

@@ -0,0 +1,3 @@
+from alchemite_setup.cli import main
+
+main()

alchemite_setup/cli.py

@@ -0,0 +1,151 @@
+import asyncio
+import logging
+import sys
+from argparse import ArgumentParser
+
+from alchemite_setup.exception import Abort
+from alchemite_setup.install import deploy, prepare
+from alchemite_setup.versions import VERSION_SANITIZERS
+
+
+def generate_cli() -> ArgumentParser:
+    parser = ArgumentParser(
+        prog="uvx alchemite_setup",
+        description="An installation script for self-hosted alchemite installations",
+    )
+    parser.add_argument(
+        "--config-path",
+        action="store",
+        default="./intellegens_config",
+        help="The directory used to store or load the deployment configuration",
+    )
+    parser.add_argument(
+        "--log-level",
+        action="store",
+        default="INFO",
+        help="The log level to use for this script",
+        choices=["DEBUG", "INFO", "WARNING", "ERROR"],
+    )
+
+    subparsers = parser.add_subparsers(dest="command")
+    # prepare arguments
+    prep_parser = subparsers.add_parser(
+        "prepare",
+        help="Prepare for deployment",
+        description="Prepare for new deployment, or update existing configuration for application update",
+    )
+    prep_parser.add_argument(
+        "--rehost-images",
+        action="store",
+        help="Instructs the script to rehost the images to an alternative repository",
+        metavar="repository_name",
+    )
+    prep_parser.add_argument(
+        "--rotate",
+        action="store_true",
+        help="Rotate the config secret values. This may require additional steps to deploy successfully",
+    )
+
+    prep_parser.add_argument(
+        "--oligo",
+        action="store_true",
+        help="Enable oligonucleotide features in the cluster",
+    )
+
+    for i in VERSION_SANITIZERS.keys():
+        prep_parser.add_argument(
+            f"--{i}-version",
+            action="store",
+            default="latest",
+            help=f"Specify the version of {i} to install",
+        )
+
+    prep_parser.add_argument(
+        "--pull-secret",
+        action="store",
+        help="The image pull secret to use when the cluster is starting pods",
+    )
+
+    prep_parser.add_argument(
+        "--domain",
+        action="store",
+        help="The domain that the application will be hosted on",
+    )
+
+    # deploy arguments
+    dep_parser = subparsers.add_parser(
+        "deploy",
+        help="Deploy alchemite",
+        description="Use a prepared configuration to deploy a new version of alchemite",
+    )
+
+    dep_parser.add_argument("--dry-run", action="store_true")
+
+    dep_parser.add_argument(
+        "--namespace",
+        action="store",
+        help="The namespace to deploy Alchemite application charts into",
+    )
+
+    dep_parser.add_argument("--atomic", action="store_true")
+
+    return parser
+
+
+def clean_domain(domain: str | None) -> str | None:
+    if domain is None:
+        return None
+    domain = domain.strip().strip("/")
+    if "://" in domain:
+        _, domain = domain.rsplit("/", 1)
+    return domain
+
+
+async def amain() -> None:
+    parser = generate_cli()
+    args = parser.parse_args()
+    logging.basicConfig(
+        level=args.log_level, stream=sys.stderr, format="%(message)s"
+    )
+
+    # Suppress helm command errors
+    logging.getLogger("pyhelm3.command").setLevel(logging.ERROR)
+    if args.log_level == "INFO":
+        # A few httpx logs are at info that I'd prefer be at DEBUG, so suppress
+        logging.getLogger("httpx").setLevel(logging.WARNING)
+
+    command = args.command
+    if command == "prepare":
+        versions = {
+            i: getattr(args, f"{i.replace('-', '_')}_version")
+            for i in VERSION_SANITIZERS.keys()
+        }
+        await prepare(
+            raw_config_path=args.config_path,
+            rotate_secrets=args.rotate,
+            enable_oligo=args.oligo,
+            rehost_images=args.rehost_images,
+            desired_versions=versions,
+            pull_secret=args.pull_secret,
+            domain=clean_domain(args.domain),
+        )
+    if command == "deploy":
+        await deploy(
+            raw_config_path=args.config_path,
+            dry_run=args.dry_run,
+            namespace=args.namespace,
+            atomic=args.atomic,
+        )
+
+
+def main() -> None:
+    try:
+        asyncio.run(amain())
+    except Abort as e:
+        logging.error(e)
+        logging.shutdown()
+        exit(1)
+
+
+if __name__ == "__main__":
+    main()

alchemite_setup/exception.py

@@ -0,0 +1,2 @@
+class Abort(BaseException):
+    pass

alchemite_setup/gensecrets.py

@@ -0,0 +1,140 @@
+import base64
+import json
+import secrets
+import string
+from json import JSONDecodeError
+from pathlib import Path
+
+import bcrypt
+import yaml
+
+from alchemite_setup.exception import Abort
+from alchemite_setup.helm import API_SECRET_PATH, AUM_SECRET_PATH, LICENCE_PATH
+
+DEFAULT_PASSWORD_CHARSET = (
+    string.ascii_letters + string.digits + "!#%&'()*+,-./:;<=>?[]^_`{|}~"
+)
+
+
+def generate_password(
+    length: int = 30, charset: str = DEFAULT_PASSWORD_CHARSET
+) -> str:
+    return "".join(secrets.choice(charset) for i in range(length))
+
+
+def secrets_exist(values_dir: Path) -> bool:
+    return all(
+        (values_dir / file).exists()
+        for file in [LICENCE_PATH, API_SECRET_PATH, AUM_SECRET_PATH]
+    )
+
+
+def validate_licence(licence: str) -> bool:
+    # Check that the licence is likely to work once deployed.
+    # This does NOT validate the signature, that is left to the application itself
+    try:
+        data = json.loads(licence)
+    except JSONDecodeError:
+        data_segments = licence.split(".")
+        if len(data_segments) != 3:
+            return False
+        try:
+            data = json.loads(
+                base64.urlsafe_b64decode(f"{data_segments[1]}====")
+            )
+        except JSONDecodeError:
+            return False
+
+    if not isinstance(data, dict):
+        return False
+
+    for k in ["e", "p", "t", "u", "v", "w"]:
+        if k not in data:
+            return False
+
+    if data["v"] not in [1, 2]:
+        return False
+
+    if "__all__" not in data["p"]:
+        if "apiserver" not in data["p"]:
+            return False
+
+        # Installs now also require ichnite for the smiles extension
+        if "ichnite_beta" not in data["p"]:
+            return False
+
+    return True
+
+
+def create_licence_secret(values_dir: Path) -> None:
+    licence = input("Enter Intellegens licence: ")
+
+    if not validate_licence(licence):
+        cont = input(
+            "Licence looks to be invalid. Are you sure you wish to continue? (y/n)"
+        )
+        if len(cont) == 0 or cont[0] != "y":
+            raise Abort("Abort due to user request")
+
+    with (values_dir / LICENCE_PATH).open("w") as f:
+        yaml.dump({"licence": licence}, f, sort_keys=False)
+
+
+def create_api_secrets(values_dir: Path, postgres_pw: str) -> None:
+    keycloak_pw = generate_password()
+    opensearch_service_pw = generate_password()
+    opensearch_admin_pw = generate_password()
+    hashed_opensearch_service_pw = bcrypt.hashpw(
+        opensearch_service_pw.encode("ascii"), bcrypt.gensalt(prefix=b"2a")
+    ).decode()
+    hashed_opensearch_admin_pw = bcrypt.hashpw(
+        opensearch_admin_pw.encode("ascii"), bcrypt.gensalt(prefix=b"2a")
+    ).decode()
+    data = {
+        "postgresql": {"postgresqlPassword": postgres_pw},
+        "keycloak": {"username": "intellegensadmin", "password": keycloak_pw},
+        "opensearch": {
+            "alchemiteSecrets": {
+                "adminPasswordHashed": hashed_opensearch_admin_pw,
+                "serviceAccountPasswordHashed": hashed_opensearch_service_pw,
+                "serviceAccountPassword": opensearch_service_pw,
+            }
+        },
+    }
+
+    with (values_dir / API_SECRET_PATH).open("w") as f:
+        yaml.dump(data, f, sort_keys=False)
+
+
+def create_aum_secrets(values_dir: Path, postgres_pw: str) -> None:
+    keycloak_pw = generate_password()
+
+    data = {
+        "keycloak": {
+            "username": "aum-service-account",
+            "password": keycloak_pw,
+        },
+        "sql": {
+            "aum": {
+                "password": postgres_pw,
+            }
+        },
+    }
+
+    with (values_dir / AUM_SECRET_PATH).open("w") as f:
+        yaml.dump(data, f, sort_keys=False)
+
+
+def create_secrets(config_path: Path) -> None:
+    create_licence_secret(config_path)
+
+    postgres_pw = generate_password()
+    create_api_secrets(config_path, postgres_pw)
+    create_aum_secrets(config_path, postgres_pw)
+
+
+if __name__ == "__main__":
+    output_path = Path("../local/intellegensconfig")
+    output_path.mkdir(parents=True, exist_ok=True)
+
+    create_secrets(output_path)