Class: OpenC3::MicroserviceOperator

Inherits:
Operator show all
Defined in:
lib/openc3/operators/microservice_operator.rb

Overview

Creates new OperatorProcess objects based on querying the Redis key value store. Any keys under 'openc3_microservices' will be created into microservices.

Constant Summary

Constants inherited from Operator

Operator::CYCLE_TIME, Operator::PROCESS_SHUTDOWN_SECONDS

Instance Attribute Summary

Attributes inherited from Operator

#cycle_time, #processes

Instance Method Summary collapse

Methods inherited from Operator

instance, processes, #remove_old, #respawn_changed, #respawn_dead, run, #run, #shutdown, #shutdown_processes, #start_new, #stop

Constructor Details

#initialize ⇒ MicroserviceOperator

Returns a new instance of MicroserviceOperator.



31
32
33
34
35
36
37
38
39
40
41
42
43
 
# File 'lib/openc3/operators/microservice_operator.rb', line 31

def initialize
  Logger.microservice_name = "MicroserviceOperator"
  super

  @secrets = Secrets.getClient
  @microservices = {}
  @previous_microservices = {}
  @new_microservices = {}
  @changed_microservices = {}
  @removed_microservices = {}
  @shard = ENV['OPENC3_SHARD'] || 0
  @shard = @shard.to_i
end

Instance Method Details

#convert_microservice_to_process_definition(microservice_name, microservice_config) ⇒ Object 



45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
 
# File 'lib/openc3/operators/microservice_operator.rb', line 45

def convert_microservice_to_process_definition(microservice_name, microservice_config)
  process_definition = ["ruby", "plugin_microservice.rb"]
  work_dir = "/openc3/lib/openc3/microservices"
  env = microservice_config["env"].dup
  if microservice_config["needs_dependencies"]
    env['GEM_HOME'] = '/gems'

    # Resolve the Python virtual environment for this microservice.
    # If the microservice belongs to a plugin that has a per-plugin UV venv
    # (created by uvinstall during plugin install), use that isolated venv.
    # Otherwise fall back to the shared PYTHONUSERBASE for legacy plugins.
    plugin_name = microservice_config["plugin"]
    plugin_venv_dir = nil
    if plugin_name
      scope = microservice_name.split("__")[0]
      plugin_venv_dir = PythonVenv.plugin_venv_path(scope: scope, plugin_name: plugin_name)
    end

    if plugin_venv_dir
      PythonVenv.configure_environment(env, plugin_venv_dir)
    else
      env['PYTHONUSERBASE'] = PythonVenv::DEFAULT_PYTHONUSERBASE
      env['PYTHONPATH'] = ENV.fetch('PYTHONPATH', nil)
    end
  else
    env['GEM_HOME'] = nil
    env['PYTHONUSERBASE'] = nil
    env['PYTHONPATH'] = nil
  end
  env['OPENC3_MICROSERVICE_NAME'] = microservice_name
  container = microservice_config["container"]
  scope = microservice_name.split("__")[0]

  # Setup secrets for microservice
  secrets = microservice_config["secrets"]
  if secrets
    secrets.each do |type, secret_name, env_name_or_path, secret_store|
      secret_value = @secrets.get(secret_name, secret_store: secret_store, scope: scope)
      if secret_value
        if type == 'ENV'
          env[env_name_or_path] = secret_value
        elsif type == 'FILE'
          write_secret_file(microservice_name, secret_name, env_name_or_path, secret_value)
        end
      else
        Logger.error("Microservice #{microservice_name} references unknown secret: #{secret_name}")
      end
    end
  end

  return process_definition, work_dir, env, scope, container
end

#handle_changed_microservice(microservice_name, microservice_config) ⇒ Object

Handle a change detected in a microservice model



179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
 
# File 'lib/openc3/operators/microservice_operator.rb', line 179

def handle_changed_microservice(microservice_name, microservice_config)
  parent = microservice_config['parent']
  enabled = microservice_config['enabled']
  enabled = true if enabled.nil?
  scope = microservice_name.split("__")[0]
  previous_parent = @previous_microservices[microservice_name]['parent']
  previous_enabled = @previous_microservices[microservice_name]["enabled"]
  previous_enabled = true if previous_enabled.nil?

  Logger.info("Changed microservice detected: #{microservice_name}\nWas: #{@previous_microservices[microservice_name]}\nIs: #{microservice_config}", scope: scope)

  if parent or previous_parent
    if parent == previous_parent
      # Same Parent - Respawn parent
      @changed_microservices[parent] = @microservices[parent] if @microservices[parent] and @previous_microservices[parent]
    elsif parent and previous_parent
      # Parent changed - Respawn both parents
      @changed_microservices[parent] = @microservices[parent] if @microservices[parent] and @previous_microservices[parent]
      @changed_microservices[previous_parent] = @microservices[previous_parent] if @microservices[previous_parent] and @previous_microservices[previous_parent]
    elsif parent
      # Moved under a parent - Respawn parent and kill standalone (if previously enabled)
      @changed_microservices[parent] = @microservices[parent] if @microservices[parent] and @previous_microservices[parent]
      if previous_enabled
        @removed_microservices[microservice_name] = microservice_config
      end
    else # previous_parent
      # Moved to standalone - Respawn previous parent and make new (if enabled)
      @changed_microservices[previous_parent] = @microservices[previous_parent] if @microservices[previous_parent] and @previous_microservices[previous_parent]
      if enabled
        @new_microservices[microservice_name] = microservice_config
      end
    end
  else
    if previous_enabled
      if enabled
        # Respawn regular microservice
        @changed_microservices[microservice_name] = microservice_config
      else
        # Remove regular microservice
        @removed_microservices[microservice_name] = microservice_config
      end
    else
      # Newly enabled microservice
      @new_microservices[microservice_name] = microservice_config
    end
  end
end

#handle_new_microservice(microservice_name, microservice_config) ⇒ Object

Handle the detection of a new microservice model



158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
 
# File 'lib/openc3/operators/microservice_operator.rb', line 158

def handle_new_microservice(microservice_name, microservice_config)
  parent = microservice_config['parent']
  enabled = microservice_config['enabled']
  enabled = true if enabled.nil?
  scope = microservice_name.split("__")[0]

  if enabled
    Logger.info("New microservice detected: #{microservice_name}", scope: scope)
    if parent
      # Respawn parent if it exists and isn't new
      if @microservices[parent] and @previous_microservices[parent]
        @changed_microservices[parent] = @microservices[parent]
      end
    else
      # New process be spawned
      @new_microservices[microservice_name] = microservice_config
    end
  end
end

#handle_removed_microservice(microservice_name, microservice_config) ⇒ Object

Handle the detection of a removed microservice model



228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
 
# File 'lib/openc3/operators/microservice_operator.rb', line 228

def handle_removed_microservice(microservice_name, microservice_config)
  previous_parent = @previous_microservices[microservice_name]['parent']
  scope = microservice_name.split("__")[0]

  Logger.info("Removed microservice detected: #{microservice_name}", scope: scope)

  if previous_parent
    # Respawn previous parent
    @changed_microservices[previous_parent] = @microservices[previous_parent] if @microservices[previous_parent] and @previous_microservices[previous_parent]
  else
    previous_enabled = @previous_microservices[microservice_name]["enabled"]
    previous_enabled = true if previous_enabled.nil?
    if previous_enabled
      # Regular process to be removed
      @removed_microservices[microservice_name] = microservice_config
    end
  end
end

#update ⇒ Object 



247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
 
# File 'lib/openc3/operators/microservice_operator.rb', line 247

def update
  @previous_microservices = @microservices.dup
  # Get all the microservice configuration
  @microservices = MicroserviceModel.all

  # Filter to just this shard
  @microservices = @microservices.select do |microservice_name, microservice_config|
    microservice_shard = microservice_config['shard'] || 0
    microservice_shard == @shard
  end

  # Detect new and changed microservices
  @new_microservices = {}
  @changed_microservices = {}
  @removed_microservices = {}
  @microservices.each do |microservice_name, microservice_config|
    if @previous_microservices[microservice_name]
      if @previous_microservices[microservice_name] != microservice_config
        if not microservice_config['ignore_changes']
          handle_changed_microservice(microservice_name, microservice_config)
        end
      end
    else
      handle_new_microservice(microservice_name, microservice_config)
    end
  end

  # Detect removed microservices
  @previous_microservices.each do |microservice_name, microservice_config|
    unless @microservices[microservice_name]
      handle_removed_microservice(microservice_name, microservice_config)
    end
  end

  # Convert to processes
  @mutex.synchronize do
    @new_microservices.each do |microservice_name, microservice_config|
      cmd_array, work_dir, env, scope, container = convert_microservice_to_process_definition(microservice_name, microservice_config)
      if cmd_array
        process = OperatorProcess.new(cmd_array, work_dir: work_dir, env: env, scope: scope, container: container, config: microservice_config)
        @new_processes[microservice_name] = process
        @processes[microservice_name] = process
      end
    end

    @changed_microservices.each do |microservice_name, microservice_config|
      cmd_array, work_dir, env, scope, container = convert_microservice_to_process_definition(microservice_name, microservice_config)
      if cmd_array
        process = @processes[microservice_name]
        if process
          process.process_definition = cmd_array
          process.work_dir = work_dir
          process.new_temp_dir = nil
          process.env = env
          @changed_processes[microservice_name] = process
        else
          # This shouldn't be possible, but still needs to be handled
          Logger.error("Changed microservice #{microservice_name} does not exist. Creating new...", scope: scope)
          process = OperatorProcess.new(cmd_array, work_dir: work_dir, env: env, scope: scope, container: container, config: microservice_config)
          @new_processes[microservice_name] = process
          @processes[microservice_name] = process
        end
      end
    end

    @removed_microservices.each do |microservice_name, _microservice_config|
      process = @processes[microservice_name]
      @processes.delete(microservice_name)
      @removed_processes[microservice_name] = process
    end
  end
end

#write_secret_file(microservice_name, secret_name, env_name_or_path, secret_value) ⇒ Object

Writes a FILE type secret to disk. The path is first validated lexically (see Secrets.validate_file_path) and then checked against the filesystem to make sure no symlink redirects the write outside of Secrets.secret_file_dir. Both checks happen before any directory is created so that mkdir_p can never create directories outside of the base.



103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
 
# File 'lib/openc3/operators/microservice_operator.rb', line 103

def write_secret_file(microservice_name, secret_name, env_name_or_path, secret_value)
  begin
    path = Secrets.validate_file_path(env_name_or_path)
  rescue ArgumentError => error
    Logger.error("Microservice #{microservice_name} secret #{secret_name} has an invalid file path: #{error.message}")
    return
  end

  # validate_file_path is purely lexical, so a symlink under the secret file
  # directory could still redirect the write outside of it. Resolve symlinks
  # here, where the filesystem being written to is the one being checked.
  begin
    real_base = File.realpath(Secrets.secret_file_dir)
  rescue SystemCallError => error
    Logger.error("Microservice #{microservice_name} secret #{secret_name} secret file directory is unusable: #{error.message}")
    return
  end

  # Check the deepest directory that already exists before creating anything.
  # If an existing component is a symlink out of the base, mkdir_p would
  # otherwise create the remaining directories outside of it.
  dir = File.dirname(path)
  existing = dir
  existing = File.dirname(existing) until File.directory?(existing) or existing == File.dirname(existing)
  begin
    real_existing = File.realpath(existing)
  rescue SystemCallError => error
    Logger.error("Microservice #{microservice_name} secret #{secret_name} file path is unusable: #{error.message}")
    return
  end
  unless Secrets.path_contained?(real_base, real_existing)
    Logger.error("Microservice #{microservice_name} secret #{secret_name} file path contains a symlinked directory which resolves outside of #{real_base}: #{path}")
    return
  end

  FileUtils.mkdir_p(dir)
  # Re-check after creating the directories in case one was created through a
  # symlink or the tree changed underneath us.
  real_dir = File.realpath(dir)
  unless Secrets.path_contained?(real_base, real_dir)
    Logger.error("Microservice #{microservice_name} secret #{secret_name} file path resolves outside of #{real_base}: #{path}")
    return
  end
  # File.symlink? uses lstat and so does not follow the link, unlike the
  # File.open below which would write through it.
  if File.symlink?(path)
    Logger.error("Microservice #{microservice_name} secret #{secret_name} file path is a symlink which is not allowed: #{path}")
    return
  end
  File.open(path, 'wb') do |file|
    file.write(secret_value)
  end
end