/// <inheritdoc/> public override void Run(CommandLine commandLine) { if (commandLine.Arguments.Length == 0) { Console.WriteLine(usage); Program.Exit(1); } hiveLogin = Program.ConnectHive(); hive = new HiveProxy(hiveLogin); var command = commandLine.Arguments.ElementAt(0); var yaml = commandLine.HasOption("--yaml"); if (command == "help") { Console.WriteLine(help); Program.Exit(0); } switch (command) { case "addr": case "addresses": ListAddresses(commandLine); break; case "get": GetEntry(commandLine); break; case "ls": case "list": ListEntries(commandLine); break; case "set": SetEntry(commandLine); break; case "rm": case "remove": RemoveEntry(commandLine); break; default: Console.Error.WriteLine($"*** ERROR: Unknown command: [{command}]"); Program.Exit(1); break; } }
/// <inheritdoc/> public override void Run(CommandLine commandLine) { hiveLogin = Program.ConnectHive(); hive = new HiveProxy(hiveLogin); reserved = new HashSet <string>(StringComparer.InvariantCultureIgnoreCase) { "get", "list", "ls", "rm", "remove", "set" }; if (commandLine.HasHelpOption) { Console.WriteLine(usage); Program.Exit(0); } var command = commandLine.Arguments.ElementAtOrDefault(0); switch (command) { case "get": Get(commandLine); break; case "ls": case "list": List(commandLine); break; case "rm": case "remove": Remove(commandLine); break; case "set": Set(commandLine); break; default: Show(commandLine); break; } }
public LoginInfo(HiveLogin hiveLogin, bool viaVpn) { Name = hiveLogin.LoginName; ViaVpn = viaVpn; var info = string.Empty; if (hiveLogin.IsRoot) { if (info.Length > 0) { info += ", "; } info += "root"; } if (hiveLogin.SetupPending) { if (info.Length > 0) { info += ", "; } info += "setup"; } if (ViaVpn) { if (info.Length > 0) { info += ", "; } info += "via VPN"; } if (info.Length > 0) { this.Info = $"[{info}]"; } else { this.Info = string.Empty; } }
/// <summary> /// Initializes the hive login and hive proxy and verifies that the /// current user has root privileges and the hive enables a VPN. /// </summary> private void RootLogin() { hiveLogin = Program.ConnectHive(); if (!hiveLogin.Definition.Vpn.Enabled) { Console.Error.WriteLine(VpnNotEnabled); Program.Exit(1); } if (string.IsNullOrEmpty(hiveLogin.VpnCredentials.CaZipKey)) { Console.Error.WriteLine(MustHaveRootPrivileges); Program.Exit(1); } hive = HiveHelper.OpenHive(hiveLogin); }
/// <inheritdoc/> public override void Run(CommandLine commandLine) { if (commandLine.HasHelpOption) { Console.WriteLine(usage); Program.Exit(0); } Console.WriteLine(); hiveLogin = Program.ConnectHive(); hive = new HiveProxy(hiveLogin); var command = commandLine.Arguments.ElementAtOrDefault(0); var force = commandLine.HasOption("--force"); var maxParallel = Program.MaxParallel; var version = (string)null; // $todo(jeff.lill): // // We're eventually going to need a command to update Ceph // service for major releases (revision updates are handled // by the Linux package manager). Console.WriteLine(); switch (command) { case null: UpdateHive(force, maxParallel, Program.DockerImageTag); break; case "check": CheckHive(maxParallel); break; case "consul": version = commandLine.Arguments.ElementAtOrDefault(1); if (string.IsNullOrEmpty(version)) { Console.Error.WriteLine("*** ERROR: VERSON argument is required."); Program.Exit(1); } UpdateConsul(force, version, maxParallel); break; case "docker": version = commandLine.Arguments.ElementAtOrDefault(1); if (string.IsNullOrEmpty(version)) { Console.Error.WriteLine("*** ERROR: VERSON argument is required."); Program.Exit(1); } UpdateDocker(force, version, maxParallel); break; case "services": UpdateServices(force, maxParallel, Program.DockerImageTag); break; case "linux": UpdateLinux(force, maxParallel); break; case "vault": version = commandLine.Arguments.ElementAtOrDefault(1); if (string.IsNullOrEmpty(version)) { Console.Error.WriteLine("*** ERROR: VERSON argument is required."); Program.Exit(1); } UpdateVault(force, version, maxParallel); break; default: Console.Error.WriteLine($"*** ERROR: Unknown command: [{command}]"); Program.Exit(1); break; } }
/// <inheritdoc/> public override void Run(CommandLine commandLine) { if (commandLine.HasHelpOption) { Help(); Program.Exit(0); } // Special-case handling of the [--remove-templates] option. if (commandLine.HasOption("--remove-templates")) { Console.WriteLine("Removing cached virtual machine templates."); foreach (var fileName in Directory.GetFiles(HiveHelper.GetVmTemplatesFolder(), "*.*", SearchOption.TopDirectoryOnly)) { File.Delete(fileName); } Program.Exit(0); } // Implement the command. packageCacheUri = commandLine.GetOption("--package-cache"); // This overrides the hive definition, if specified. if (Program.HiveLogin != null) { Console.Error.WriteLine("*** ERROR: You are logged into a hive. You need to logout before preparing another."); Program.Exit(1); } if (commandLine.Arguments.Length == 0) { Console.Error.WriteLine($"*** ERROR: HIVE-DEF expected."); Program.Exit(1); } hiveDefPath = commandLine.Arguments[0]; force = commandLine.GetFlag("--force"); HiveDefinition.ValidateFile(hiveDefPath, strict: true); var hiveDefinition = HiveDefinition.FromFile(hiveDefPath, strict: true); hiveDefinition.Provisioner = $"neon-cli:{Program.Version}"; // Identify this tool/version as the hive provisioner // NOTE: // // Azure has implemented a more restrictive password policy and our // default machine password does not meet the requirements: // // The supplied password must be between 6-72 characters long and must // satisfy at least 3 of password complexity requirements from the following: // // 1. Contains an uppercase character // 2. Contains a lowercase character // 3. Contains a numeric digit // 4. Contains a special character // 5. Control characters are not allowed // // It's also probably not a great idea to use a static password when // provisioning VMs in public clouds because it might be possible for // somebody to use this fact the SSH into nodes while the hive is being // setup and before we set the secure password at the end. // // This is less problematic for non-cloud environments because it's // likely that the hosts won't initially be able to receive inbound // Internet traffic and besides, we need to have a known password // embedded into the VM templates. // // We're going to handle this for cloud environments by looking // at [Program.MachinePassword]. If this is set to the default // machine password then we're going to replace it with a randomlly // generated password with a few extra characters to ensure that // it meets the target cloud's password requirements. We'll use // a non-default password if the operator specified one. if (hiveDefinition.Hosting.IsCloudProvider && Program.MachinePassword == HiveConst.DefaulVmTemplatePassword) { Program.MachinePassword = NeonHelper.GetRandomPassword(20); // Append a string that guarantees that the generated password meets // cloud minimum requirements. Program.MachinePassword += ".Aa0"; } // Note that hive prepare starts new log files. hive = new HiveProxy(hiveDefinition, Program.CreateNodeProxy <NodeDefinition>, appendLog: false, useBootstrap: true, defaultRunOptions: RunOptions.LogOutput | RunOptions.FaultOnError); if (File.Exists(Program.GetHiveLoginPath(HiveConst.RootUser, hive.Definition.Name))) { Console.Error.WriteLine($"*** ERROR: A hive login named [{HiveConst.RootUser}@{hive.Definition.Name}] already exists."); Program.Exit(1); } Program.OSProperties = OSProperties.For(hiveDefinition.HiveNode.OperatingSystem); // Configure global options. if (commandLine.HasOption("--unredacted")) { hive.SecureRunOptions = RunOptions.None; } //----------------------------------------------------------------- // $todo(jeff.lill): // // We're temporarily disabling redaction to make it easier to investigate // Vault setup issues. Remove this line before final launch. // // https://github.com/jefflill/NeonForge/issues/225 hive.SecureRunOptions = RunOptions.None; //----------------------------------------------------------------- // Assign the VPN client return subnets to the manager nodes if VPN is enabled. if (hive.Definition.Vpn.Enabled) { var vpnSubnet = NetworkCidr.Parse(hive.Definition.Network.VpnPoolSubnet); var prefixLength = 25; var nextVpnSubnetAddress = vpnSubnet.Address; // Note that we're not going to assign the first block of addresses in the // VPN subnet to any managers to prevent conflicts with addresses reserved // by some cloud platforms at the beginning of a subnet. Azure for example // reserves 4 IP addresses for DNS servers and platform provided VPNs. foreach (var manager in hive.Definition.SortedManagers) { var managerVpnSubnet = new NetworkCidr(NetHelper.AddressIncrement(nextVpnSubnetAddress, VpnOptions.ServerAddressCount), prefixLength); manager.VpnPoolSubnet = managerVpnSubnet.ToString(); nextVpnSubnetAddress = managerVpnSubnet.NextAddress; } } //----------------------------------------------------------------- // Try to ensure that no servers are already deployed on the IP addresses defined // for hive nodes because provisoning over an existing hive will likely // corrupt the existing hive and also probably prevent the new hive from // provisioning correctly. // // Note that we're not going to perform this check for the [Machine] hosting // environment because we're expecting the bare machines to be already running // with the assigned addresses and we're also not going to do this for cloud // environments because we're assuming that the hive will run in its own private // network so there'll ne no possibility of conflicts. if (hive.Definition.Hosting.Environment != HostingEnvironments.Machine && !hive.Definition.Hosting.IsCloudProvider) { Console.WriteLine(); Console.WriteLine("Scanning for IP address conflicts..."); Console.WriteLine(); var pingOptions = new PingOptions(ttl: 32, dontFragment: true); var pingTimeout = TimeSpan.FromSeconds(2); var pingConflicts = new List <NodeDefinition>(); var pingAttempts = 2; // I'm going to use up to 20 threads at a time here for simplicity // rather then doing this as async operations. var parallelOptions = new ParallelOptions() { MaxDegreeOfParallelism = 20 }; Parallel.ForEach(hive.Definition.NodeDefinitions.Values, parallelOptions, node => { using (var ping = new Ping()) { // We're going to try pinging up to [pingAttempts] times for each node // just in case the network it sketchy and we're losing reply packets. for (int i = 0; i < pingAttempts; i++) { var reply = ping.Send(node.PrivateAddress, (int)pingTimeout.TotalMilliseconds); if (reply.Status == IPStatus.Success) { lock (pingConflicts) { pingConflicts.Add(node); } break; } } } }); if (pingConflicts.Count > 0) { Console.Error.WriteLine($"*** ERROR: Cannot provision the hive because [{pingConflicts.Count}] other"); Console.Error.WriteLine($"*** machines conflict with the following hive nodes:"); Console.Error.WriteLine(); foreach (var node in pingConflicts.OrderBy(n => NetHelper.AddressToUint(IPAddress.Parse(n.PrivateAddress)))) { Console.Error.WriteLine($"{node.PrivateAddress, 16}: {node.Name}"); } Program.Exit(1); } } //----------------------------------------------------------------- // Perform basic environment provisioning. This creates basic hive components // such as virtual machines, networks, load balancers, public IP addresses, security // groups,... as required for the environment. hostingManager = new HostingManagerFactory(() => HostingLoader.Initialize()).GetManager(hive, Program.LogPath); if (hostingManager == null) { Console.Error.WriteLine($"*** ERROR: No hosting manager for the [{hive.Definition.Hosting.Environment}] hosting environment could be located."); Program.Exit(1); } hostingManager.HostUsername = Program.MachineUsername; hostingManager.HostPassword = Program.MachinePassword; hostingManager.ShowStatus = !Program.Quiet; hostingManager.MaxParallel = Program.MaxParallel; hostingManager.WaitSeconds = Program.WaitSeconds; if (hostingManager.RequiresAdminPrivileges) { Program.VerifyAdminPrivileges($"Provisioning to [{hive.Definition.Hosting.Environment}] requires elevated administrator privileges."); } if (!hostingManager.Provision(force)) { Program.Exit(1); } // Get the mounted drive prefix from the hosting manager. hive.Definition.DrivePrefix = hostingManager.DrivePrefix; // Ensure that the nodes have valid IP addresses. hive.Definition.ValidatePrivateNodeAddresses(); var ipAddressToServer = new Dictionary <IPAddress, SshProxy <NodeDefinition> >(); foreach (var node in hive.Nodes.OrderBy(n => n.Name)) { SshProxy <NodeDefinition> duplicateServer; if (node.PrivateAddress == IPAddress.Any) { throw new ArgumentException($"Node [{node.Name}] has not been assigned an IP address."); } if (ipAddressToServer.TryGetValue(node.PrivateAddress, out duplicateServer)) { throw new ArgumentException($"Nodes [{duplicateServer.Name}] and [{node.Name}] have the same IP address [{node.Metadata.PrivateAddress}]."); } ipAddressToServer.Add(node.PrivateAddress, node); } //----------------------------------------------------------------- // Perform basic node provisioning including operating system updates & configuration, // and configure OpenVPN on the manager nodes so that hive setup will be // able to reach the nodes on all ports. // Write the operation begin marker to all hive node logs. hive.LogLine(logBeginMarker); var operation = $"Preparing [{hive.Definition.Name}] nodes"; var controller = new SetupController <NodeDefinition>(operation, hive.Nodes) { ShowStatus = !Program.Quiet, MaxParallel = Program.MaxParallel }; if (!string.IsNullOrEmpty(packageCacheUri)) { hive.Definition.PackageProxy = packageCacheUri; } // Prepare the nodes. controller.AddWaitUntilOnlineStep(timeout: TimeSpan.FromMinutes(15)); hostingManager.AddPostProvisionSteps(controller); controller.AddStep("verify OS", (node, stepDelay) => { Thread.Sleep(stepDelay); CommonSteps.VerifyOS(node); }); controller.AddStep("prepare", (node, stepDelay) => { Thread.Sleep(stepDelay); CommonSteps.PrepareNode(node, hive.Definition, shutdown: false); }, stepStaggerSeconds: hive.Definition.Setup.StepStaggerSeconds); // Add any VPN configuration steps. if (hive.Definition.Vpn.Enabled) { controller.AddGlobalStep("vpn credentials", () => CreateVpnCredentials()); controller.AddStep("vpn server", (node, stepDelay) => { Thread.Sleep(stepDelay); ConfigManagerVpn(node); }, node => node.Metadata.IsManager); // Add a step to establish a VPN connection if we're provisioning to a cloud. // We specifically don't want to do this if we're provisioning to a on-premise // datacenter because we're assuming that we're already directly connected to // the LAN while preparing and setting up the hive. if (hive.Definition.Hosting.IsCloudProvider) { controller.AddStep("vpn connect", (manager, stepDelay) => { Thread.Sleep(stepDelay); // Create a hive login with just enough credentials to connect the VPN. // Note that this isn't really a node specific command but I wanted to // be able to display the connection status somewhere. var vpnLogin = new HiveLogin() { Definition = hive.Definition, VpnCredentials = vpnCredentials }; // Ensure that we don't have an old VPN client for the hive running. HiveHelper.VpnClose(vpnLogin.Definition.Name); // ...and then start a new one. HiveHelper.VpnOpen(vpnLogin, onStatus: message => manager.Status = $"{message}", onError: message => manager.Status = $"ERROR: {message}"); }, n => n == hive.FirstManager); } // Perform any post-VPN setup provisioning required by the hosting provider. hostingManager.AddPostVpnSteps(controller); } if (!controller.Run()) { // Write the operation end/failed marker to all hive node logs. hive.LogLine(logFailedMarker); Console.Error.WriteLine("*** ERROR: One or more configuration steps failed."); Program.Exit(1); } // Write the hive login file. var hiveLoginPath = Program.GetHiveLoginPath(HiveConst.RootUser, hive.Definition.Name); var hiveLogin = new HiveLogin() { Path = hiveLoginPath, Username = HiveConst.RootUser, Definition = hive.Definition, SshUsername = Program.MachineUsername, SshPassword = Program.MachinePassword, SshProvisionPassword = Program.MachinePassword, SetupPending = true }; if (hive.Definition.Vpn.Enabled) { hiveLogin.VpnCredentials = vpnCredentials; } // Generate the hive certificates. const int bitCount = 2048; const int validDays = 365000; // About 1,000 years. if (hiveLogin.HiveCertificate == null) { var hostnames = new string[] { $"{hive.Name}.nhive.io", $"*.{hive.Name}.nhive.io", $"*.neon-vault.{hive.Name}.nhive.io", $"*.neon-registry-cache.{hive.Name}.nhive.io", $"*.neon-hivemq.{hive.Name}.nhive.io" }; hiveLogin.HiveCertificate = TlsCertificate.CreateSelfSigned(hostnames, bitCount, validDays, issuedBy: "neonHIVE", issuedTo: $"neonHIVE: {hiveDefinition.Name}"); hiveLogin.HiveCertificate.FriendlyName = $"neonHIVE: {hiveLogin.Definition.Name}"; } // Persist the certificates into the hive login. hiveLogin.Save(); // Write the operation end marker to all hive node logs. hive.LogLine(logEndMarker); }
/// <summary> /// Executes a built-in neonHIVE Ansible module. /// </summary> /// <param name="login">The hive login.</param> /// <param name="commandLine">The module command line: MODULE ARGS...</param> private void ExecuteModule(HiveLogin login, CommandLine commandLine) { var module = commandLine.Arguments.ElementAtOrDefault(0); if (commandLine.HasHelpOption || module == null) { Console.WriteLine(moduleHelp); Program.Exit(0); } var context = new ModuleContext() { Module = module }; try { // Verify that we're running in the context of another Ansible // command (probably [exec] or [play]). if (Environment.GetEnvironmentVariable("IN_NEON_ANSIBLE_COMMAND") == null) { throw new NotSupportedException("Built-in neonHIVE Ansible modules can run only within [neon ansible exec] or [play]."); } // Read the Ansible module arguments. var argsPath = commandLine.Arguments.ElementAtOrDefault(1); if (string.IsNullOrEmpty(argsPath)) { throw new ArgumentException("Expected a path to the module arguments file."); } context.Login = login; context.SetArguments(argsPath); // Connect to the hive so the [HiverHelper] methods will work. HiveHelper.OpenHive(login); // Run the module. switch (module.ToLowerInvariant()) { case "neon_certificate": new CertificateModule().Run(context); break; case "neon_couchbase_import": new CouchbaseImportModule().Run(context); break; case "neon_couchbase_index": new CouchbaseIndexModule().Run(context); break; case "neon_couchbase_query": new CouchbaseQueryModule().Run(context); break; case "neon_dashboard": new DashboardModule().Run(context); break; case "neon_docker_config": new DockerConfigModule().Run(context); break; case "neon_docker_login": new DockerLoginModule().Run(context); break; case "neon_docker_registry": new DockerRegistryModule().Run(context); break; case "neon_docker_secret": new DockerSecretModule().Run(context); break; case "neon_docker_service": new DockerServiceModule().Run(context); break; case "neon_docker_stack": new DockerStackModule().Run(context); break; case "neon_globals": new GlobalsModule().Run(context); break; case "neon_hive_dns": new HiveDnsModule().Run(context); break; case "neon_hivemq": new HiveMQModule().Run(context); break; case "neon_traffic_manager": new TrafficManagerModule().Run(context); break; default: throw new ArgumentException($"[{module}] is not a recognized neonHIVE Ansible module."); } } catch (Exception e) { context.Failed = true; context.Message = NeonHelper.ExceptionError(e); context.WriteErrorLine(context.Message); context.WriteErrorLine(e.StackTrace.ToString()); } // Handle non-exception based errors. if (context.HasErrors && !context.Failed) { context.Failed = true; context.Message = context.GetFirstError(); } Console.WriteLine(context.ToString()); // Exit right now to be sure that nothing else is written to STDOUT. Program.Exit(0); }