Skip to content

Commit 836da98

Browse files
committed
Adding migration command with sa2hs migration
* Migrates secret-agent to helm-secrets ref: FORGEOPS-6796
1 parent 3c86d2a commit 836da98

10 files changed

Lines changed: 482 additions & 16 deletions

File tree

CHANGELOG.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,13 @@ to do it.
2222
Helm cannot generate ssh keys, so a job was created to generate an ssh key and
2323
store it in a secret. This is used by amster to connect to am.
2424

25+
### New migration command
26+
27+
A new subcommand has been added called `forgeops migrate`. This subcommand
28+
currently can be used to migrate secrets from secret-agent to Helm-generated
29+
secrets. Run `forgeops migrate -h` and `forgeops migrate sa2hs -h` for more
30+
information.
31+
2532
### Helm chart for RCS
2633

2734
A new Helm chart has been created for RCS Server. This allows users to sync

bin/commands/migrate

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
#!/usr/bin/env python3
2+
""" Run a migration on a running deployment """
3+
4+
import argparse
5+
import site
6+
import os
7+
from pathlib import Path
8+
import sys
9+
file_name = Path(__file__)
10+
current_file_path = file_name.parent.resolve()
11+
root_path = [parent_path for parent_path in current_file_path.parents if (parent_path / 'README.md').exists()][0]
12+
dependencies_dir = os.path.join(root_path, 'lib', 'dependencies')
13+
# Insert lib folders to python path
14+
sys.path.insert(0, str(root_path))
15+
sys.path.insert(1, str(dependencies_dir) + site.USER_SITE.replace(site.USER_BASE, ''))
16+
17+
from lib.python.ensure_configuration_is_valid_or_exit import ensure_configuration_is_valid_or_exit, \
18+
print_how_to_install_dependencies
19+
from lib.python.defaults import SNAPSHOT_ROLE_NAME
20+
21+
# First ensure configure has been executed
22+
try:
23+
ensure_configuration_is_valid_or_exit()
24+
except Exception as e:
25+
try:
26+
print(f'[error] {str(e)}')
27+
except:
28+
raise e
29+
sys.exit(1)
30+
31+
try:
32+
import yaml
33+
from mergedeep import merge
34+
except:
35+
print_how_to_install_dependencies()
36+
import lib.python.common as common
37+
import lib.python.utils as utils
38+
import lib.python.migrations.sa2hs as sa2hs
39+
40+
41+
class MigrateFormatter(argparse.ArgumentDefaultsHelpFormatter, argparse.RawDescriptionHelpFormatter):
42+
pass
43+
44+
45+
if __name__ == '__main__':
46+
PROG = 'forgeops migrate'
47+
DESC = "Run a migration on a running deployment."
48+
49+
migrations = ['sa2hs']
50+
common_args = common.setup_args()
51+
52+
parser = argparse.ArgumentParser(description=DESC,
53+
prog=PROG,
54+
formatter_class=MigrateFormatter)
55+
56+
subparsers = parser.add_subparsers(
57+
title="Migrations",
58+
required=True,
59+
dest="migration")
60+
sa2hs.setup_args(subparsers, common_args)
61+
62+
args = parser.parse_args()
63+
64+
# Setup defaults for values that can be set in forgeops.conf
65+
overrides = utils.process_overrides(root_path,
66+
getattr(args, 'helm_path', None),
67+
getattr(args, 'kustomize_path', None),
68+
getattr(args, 'build_path', None),
69+
getattr(args, 'no_helm', False),
70+
getattr(args, 'no_kustomize', False),
71+
getattr(args, 'releases_src', None),
72+
getattr(args, 'pull_policy', None),
73+
getattr(args, 'source', None),
74+
getattr(args, 'ssl_secretname', None),
75+
args.debug)
76+
77+
config = {}
78+
config['root_path'] = root_path
79+
if args.debug:
80+
print(f"root_path = {config['root_path']}")
81+
82+
config = merge(config, overrides)
83+
84+
if getattr(args, 'namespace', None):
85+
config['namespace_opt'] = f'-n {args.namespace}'
86+
else:
87+
ns = utils.get_namespace()
88+
print(f"No namespace given, getting it from your context. ns = {ns}")
89+
config['namespace_opt'] = f'-n {ns}'
90+
91+
if args.migration == 'sa2hs':
92+
sa2hs.run(args, config)

bin/forgeops

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@ COMMANDS=(
8080
'env'
8181
'info'
8282
'image'
83+
'migrate'
8384
'prereqs'
8485
'rotate'
8586
'version'

charts/identity-platform/templates/secret-agent-config.yaml

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ spec:
5555
# ds-passwords secret
5656

5757
{{- if and .Values.platform.secrets_enabled .Values.platform.secrets.ds_passwords }}
58-
# Skipping because secret-generator enabled and platform.secrets.ds_passwords exists
58+
# Skipping because platform.secrets enabled and platform.secrets.ds_passwords exists
5959
{{- else }}
6060
- name: ds-passwords
6161
keys:
@@ -77,7 +77,7 @@ spec:
7777
# am-passwords secret
7878

7979
{{- if and .Values.platform.secrets_enabled .Values.platform.secrets.keystore_create .Values.keystore_create.enabled }}
80-
# Skipping because secret-generator enabled and platform.secrets.am_passwords exists
80+
# Skipping because will use keystore-create job
8181
{{- else }}
8282
- name: am-passwords
8383
keys:
@@ -96,7 +96,7 @@ spec:
9696
# am-env-secrets secret
9797

9898
{{- if and .Values.platform.secrets_enabled .Values.platform.secrets.am_env_secrets }}
99-
# Skipping because secret-generator enabled and platform.secrets.am_env_secrets exists
99+
# Skipping because platform.secrets enabled and platform.secrets.am_env_secrets exists
100100
{{- else }}
101101
- name: am-env-secrets
102102
keys:
@@ -202,7 +202,7 @@ spec:
202202
# amster-env-secrets secret
203203

204204
{{- if and .Values.platform.secrets_enabled .Values.platform.secrets.amster_env_secrets }}
205-
# Skipping because secret-generator enabled and platform.secrets.amster_env_secrets exists
205+
# Skipping because platform.secrets enabled and platform.secrets.amster_env_secrets exists
206206
{{- else }}
207207
- name: amster-env-secrets
208208
keys:
@@ -218,8 +218,8 @@ spec:
218218

219219
# amster secret
220220

221-
{{- if and .Values.platform.secrets_enabled .Values.platform.secrets.amster }}
222-
# Skipping because secret-generator enabled and platform.secrets.amster exists
221+
{{- if and .Values.platform.secrets_enabled (or .Values.platform.secrets.amster .Values.ssh_keygen.enabled) }}
222+
# Skipping because platform.secrets enabled and (platform.secrets.amster exists, or ssh_keygen job enabled)
223223
{{- else }}
224224
- name: amster
225225
keys:
@@ -232,7 +232,7 @@ spec:
232232
# ds-env-secrets secret
233233

234234
{{- if and .Values.platform.secrets_enabled .Values.platform.secrets.ds_env_secrets }}
235-
# Skipping because secret-generator enabled and platform.secrets.ds_env_secrets exists
235+
# Skipping because platform.secrets enabled and platform.secrets.ds_env_secrets exists
236236
{{- else }}
237237
- name: ds-env-secrets
238238
keys:
@@ -255,7 +255,7 @@ spec:
255255
# idm-env-secrets secret
256256

257257
{{- if and .Values.platform.secrets_enabled .Values.platform.secrets.idm_env_secrets .Values.platform.secrets.keystore_create .Values.keystore_create.enabled }}
258-
# Skipping because secret-generator enabled and platform.secrets.idm_env_secrets exists
258+
# Skipping because platform.secrets enabled and platform.secrets.idm_env_secrets exists
259259
{{- else if and .Values.platform.secrets_enabled .Values.platform.secrets.keystore_create .Values.keystore_create.enabled }}
260260
- name: idm-env-secrets
261261
keys:

charts/identity-platform/templates/ssh-keygen-job.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
apiVersion: batch/v1
33
kind: Job
44
metadata:
5-
name: ssh-keygen
5+
name: ssh-keygen-{{ .Release.Revision }}
66
labels:
77
{{- include "identity-platform.labels" . | nindent 4 }}
88
{{- with .Values.ssh_keygen.podLabels }}

charts/identity-platform/values-secret-agent.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,5 @@ platform:
33
disable_secret_agent_config: false
44
secrets_enabled: false
55
secrets: {}
6+
ssh_keygen:
7+
enabled: false

charts/identity-platform/values.yaml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1110,7 +1110,6 @@ ssh_keygen:
11101110
bits: 4096
11111111
backoffLimit: 6
11121112
restartPolicy: OnFailure
1113-
deleteOnSuccess: false
11141113
ttlSecondsAfterFinished: 7200
11151114
clusterRoleName: identity-platform-ssh-keygen
11161115
appendNSToRole: true

lib/python/common.py

Lines changed: 29 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,10 +43,13 @@ class NoAliasDumper(yaml.SafeDumper):
4343
def ignore_aliases(self, data):
4444
return True
4545

46-
def write_yaml_file(data, file):
46+
def write_yaml_file(data, file, dryrun=False):
4747
"""Write an object to a yaml file"""
48-
with open(file, 'w+', encoding='utf-8') as f:
49-
yaml.dump(data, f, sort_keys=False, Dumper=NoAliasDumper)
48+
if dryrun:
49+
print(f"DRYRUN: Save YAML to {file}")
50+
else:
51+
with open(file, 'w+', encoding='utf-8') as f:
52+
yaml.dump(data, f, sort_keys=False, Dumper=NoAliasDumper)
5053

5154

5255
def log(msg, path, verbose=True, log_file='upgrade.log', end="\n"):
@@ -76,7 +79,13 @@ def setup_args():
7679
'--debug',
7780
'-d',
7881
action='store_true',
79-
help='Target namespace (default: current ctx namespace)')
82+
help='Turn on debugging')
83+
common_dr = argparse.ArgumentParser(add_help=False)
84+
common_dr.add_argument(
85+
'--dryrun',
86+
'-r',
87+
action='store_true',
88+
help='Do a dryrun')
8089
common_pf = argparse.ArgumentParser(add_help=False)
8190
common_pf.add_argument(
8291
'--config-profile',
@@ -103,6 +112,18 @@ def setup_args():
103112
'--kustomize-path',
104113
'-k',
105114
help='Kustomize dir to use (absolute or relative to forgeops data dir)')
115+
common_nh = argparse.ArgumentParser(add_help=False)
116+
common_nh.add_argument(
117+
'--no-helm',
118+
dest='no_helm',
119+
action='store_true',
120+
help="Skip Helm")
121+
common_nk = argparse.ArgumentParser(add_help=False)
122+
common_nk.add_argument(
123+
'--no-kustomize',
124+
dest='no_kustomize',
125+
action='store_true',
126+
help="Skip Kustomize")
106127
common_src = argparse.ArgumentParser(add_help=False)
107128
common_src.add_argument(
108129
'--source',
@@ -111,11 +132,14 @@ def setup_args():
111132

112133
return {
113134
'debug': common_dg,
135+
'dryrun': common_dr,
114136
'namespace': common_ns,
115-
'config_profile': common_ns,
137+
'config_profile': common_pf,
116138
'env_name': common_env,
117139
'env_name_req': common_env_r,
118140
'helm_path': common_hp,
119141
'kustomize_path': common_kp,
142+
'no_helm': common_nh,
143+
'no_kustomize': common_nk,
120144
'source': common_src,
121145
}

0 commit comments

Comments
 (0)