name : DataSourceExoscale.py # Author: Mathieu Corbin <mathieu.corbin@exoscale.com> # Author: Christopher Glass <christopher.glass@exoscale.com> # # This file is part of cloud-init. See LICENSE file for license information. import logging from cloudinit import atomic_helper, dmi, helpers, sources, url_helper, util from cloudinit.sources.helpers import ec2 LOG = logging.getLogger(__name__) METADATA_URL = "http://169.254.169.254" API_VERSION = "1.0" PASSWORD_SERVER_PORT = 8080 URL_TIMEOUT = 10 URL_RETRIES = 6 EXOSCALE_DMI_NAME = "Exoscale" class DataSourceExoscale(sources.DataSource): dsname = "Exoscale" url_max_wait = 120 def __init__(self, sys_cfg, distro, paths): super(DataSourceExoscale, self).__init__(sys_cfg, distro, paths) LOG.debug("Initializing the Exoscale datasource") self.metadata_url = self.ds_cfg.get("metadata_url", METADATA_URL) self.api_version = self.ds_cfg.get("api_version", API_VERSION) self.password_server_port = int( self.ds_cfg.get("password_server_port", PASSWORD_SERVER_PORT) ) self.url_timeout = self.ds_cfg.get("timeout", URL_TIMEOUT) self.url_retries = self.ds_cfg.get("retries", URL_RETRIES) self.extra_config = {} def activate(self, cfg, is_new_instance): """Adjust set_passwords module to run 'always' during each boot""" # We run the set password config module on every boot in order to # enable resetting the instance's password via the exoscale console # (and a subsequent instance reboot). # Exoscale password server only provides set_passwords user-data if # a user has triggered a password reset. So calling that password # service generally results in no additional cloud-config. # TODO(Create util functions for overriding merged sys_cfg module freq) mod = "set_passwords" sem_path = self.paths.get_ipath_cur("sem") sem_helper = helpers.FileSemaphores(sem_path) if sem_helper.clear("config_" + mod, None): LOG.debug("Overriding module set_passwords with frequency always") def wait_for_metadata_service(self): """Wait for the metadata service to be reachable.""" metadata_url = "{}/{}/meta-data/instance-id".format( self.metadata_url, self.api_version ) url, _response = url_helper.wait_for_url( urls=[metadata_url], max_wait=self.url_max_wait, timeout=self.url_timeout, status_cb=LOG.critical, ) return bool(url) def crawl_metadata(self): """ Crawl the metadata service when available. @returns: Dictionary of crawled metadata content. """ metadata_ready = util.log_time( logfunc=LOG.info, msg="waiting for the metadata service", func=self.wait_for_metadata_service, ) if not metadata_ready: return {} return read_metadata( self.metadata_url, self.api_version, self.password_server_port, self.url_timeout, self.url_retries, ) def _get_data(self): """Fetch the user data, the metadata and the VM password from the metadata service. Please refer to the datasource documentation for details on how the metadata server and password server are crawled. """ data = util.log_time( logfunc=LOG.debug, msg="Crawl of metadata service", func=self.crawl_metadata, ) if not data: return False self.userdata_raw = data["user-data"] self.metadata = data["meta-data"] password = data.get("password") password_config = {} if password: # Since we have a password, let's make sure we are allowed to use # it by allowing ssh_pwauth. # The password module's default behavior is to leave the # configuration as-is in this regard, so that means it will either # leave the password always disabled if no password is ever set, or # leave the password login enabled if we set it once. password_config = { "ssh_pwauth": True, "password": password, "chpasswd": { "expire": False, }, } # builtin extra_config overrides password_config self.extra_config = util.mergemanydict( [self.extra_config, password_config] ) return True def get_config_obj(self): return self.extra_config @staticmethod def ds_detect(): return dmi.read_dmi_data("system-product-name").startswith( EXOSCALE_DMI_NAME ) # Used to match classes to dependencies datasources = [ (DataSourceExoscale, (sources.DEP_FILESYSTEM, sources.DEP_NETWORK)), ] # Return a list of data sources that match this set of dependencies def get_datasource_list(depends): return sources.list_from_depends(depends, datasources) def get_password( metadata_url=METADATA_URL, api_version=API_VERSION, password_server_port=PASSWORD_SERVER_PORT, url_timeout=URL_TIMEOUT, url_retries=URL_RETRIES, ): """Obtain the VM's password if set. Once fetched the password is marked saved. Future calls to this method may return empty string or 'saved_password'.""" password_url = "{}:{}/{}/".format( metadata_url, password_server_port, api_version ) response = url_helper.read_file_or_url( password_url, ssl_details=None, headers={"DomU_Request": "send_my_password"}, timeout=url_timeout, retries=url_retries, ) password = response.contents.decode("utf-8") # the password is empty or already saved # Note: the original metadata server would answer an additional # 'bad_request' status, but the Exoscale implementation does not. if password in ["", "saved_password"]: return None # save the password url_helper.read_file_or_url( password_url, ssl_details=None, headers={"DomU_Request": "saved_password"}, timeout=url_timeout, retries=url_retries, ) return password def read_metadata( metadata_url=METADATA_URL, api_version=API_VERSION, password_server_port=PASSWORD_SERVER_PORT, url_timeout=URL_TIMEOUT, url_retries=URL_RETRIES, ): """Query the metadata server and return the retrieved data.""" crawled_metadata = {} crawled_metadata["_metadata_api_version"] = api_version try: crawled_metadata["user-data"] = ec2.get_instance_userdata( api_version, metadata_url, timeout=url_timeout, retries=url_retries ) crawled_metadata["meta-data"] = ec2.get_instance_metadata( api_version, metadata_url, timeout=url_timeout, retries=url_retries ) except Exception as e: util.logexc( LOG, "failed reading from metadata url %s (%s)", metadata_url, e ) return {} try: crawled_metadata["password"] = get_password( api_version=api_version, metadata_url=metadata_url, password_server_port=password_server_port, url_retries=url_retries, url_timeout=url_timeout, ) except Exception as e: util.logexc( LOG, "failed to read from password server url %s:%s (%s)", metadata_url, password_server_port, e, ) return crawled_metadata if __name__ == "__main__": import argparse parser = argparse.ArgumentParser(description="Query Exoscale Metadata") parser.add_argument( "--endpoint", metavar="URL", help="The url of the metadata service.", default=METADATA_URL, ) parser.add_argument( "--version", metavar="VERSION", help="The version of the metadata endpoint to query.", default=API_VERSION, ) parser.add_argument( "--retries", metavar="NUM", type=int, help="The number of retries querying the endpoint.", default=URL_RETRIES, ) parser.add_argument( "--timeout", metavar="NUM", type=int, help="The time in seconds to wait before timing out.", default=URL_TIMEOUT, ) parser.add_argument( "--password-port", metavar="PORT", type=int, help="The port on which the password endpoint listens", default=PASSWORD_SERVER_PORT, ) args = parser.parse_args() data = read_metadata( metadata_url=args.endpoint, api_version=args.version, password_server_port=args.password_port, url_timeout=args.timeout, url_retries=args.retries, ) print(atomic_helper.json_dumps(data))