Skip to content

Commit b3ee18d

Browse files
fmastefmaste
committed
workbench: reuse credentials fetching code (Vault)
1 parent 98ede00 commit b3ee18d

File tree

5 files changed

+322
-164
lines changed

5 files changed

+322
-164
lines changed

‎nix/workbench/backend/nomad.sh

+25-35
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
usage_nomad() {
1+
usage_nomadbackend() {
22
usage "nomad" "Backend: manages a Cardano cluster using Nomad" <<EOF
33
44
Please see documentation for 'wb backend' for the supported commands.
@@ -65,26 +65,7 @@ EOF
6565

6666
backend_nomad() {
6767

68-
op=${1:?$(usage_nomad)}; shift
69-
70-
# Stateful Nomad server and agent(s):
71-
# Calling `wb backend XXX` inside a Nix derivation will make everything fail:
72-
# "mkdir: cannot create directory '/homeless-shelter': Permission denied"
73-
# Better here rather than hidden in a function well below
74-
local nomad_agents_dir="$(envjqr 'cacheDir')"/nomad
75-
mkdir -p "${nomad_agents_dir}"
76-
local nomad_servers_dir="${nomad_agents_dir}"/server
77-
mkdir -p "${nomad_servers_dir}"
78-
local nomad_clients_dir="${nomad_agents_dir}"/client
79-
mkdir -p "${nomad_clients_dir}"
80-
local webfs_dir="$(envjqr 'cacheDir')"/webfs
81-
mkdir -p "${webfs_dir}"
82-
# TODO: Which directory ? State, cache, config ?
83-
# local nomad_state_dir=${XDG_STATE_HOME:-$HOME/.local/state}/cardano-workbench/nomad
84-
# $XDG_STATE_HOME defines the base directory relative to which user-specific
85-
# state files should be stored.
86-
# (analogous to /var/lib).
87-
# https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
68+
op=${1:?$(usage_nomadbackend)}; shift
8869

8970
case "$op" in
9071

@@ -125,7 +106,7 @@ backend_nomad() {
125106

126107
while test $# -gt 0
127108
do case "$1" in
128-
--* ) msg "FATAL: unknown flag '$1'"; usage_nomad;;
109+
--* ) msg "FATAL: unknown flag '$1'"; usage_nomadbackend;;
129110
* ) break;; esac; shift; done
130111

131112
# The "nomad" folder is created by the sub-backends ("podman", "exec",
@@ -899,7 +880,7 @@ backend_nomad() {
899880

900881
while test $# -gt 0
901882
do case "$1" in
902-
--* ) msg "FATAL: unknown flag '$1'"; usage_nomad;;
883+
--* ) msg "FATAL: unknown flag '$1'"; usage_nomadbackend;;
903884
* ) break;; esac; shift; done
904885

905886
if ! backend_nomad task-program-start "$dir" node-0 generator
@@ -2273,7 +2254,7 @@ backend_nomad() {
22732254
nomad job stop -global -no-shutdown-delay -purge -yes -verbose "${job_name}"
22742255
;;
22752256
* )
2276-
usage_nomad
2257+
usage_nomadbackend
22772258
;;
22782259
esac # nomad -> job
22792260
;;
@@ -2349,7 +2330,7 @@ backend_nomad() {
23492330
backend_nomad nomad server stop "${server_name}" || true
23502331
;;
23512332
* )
2352-
usage_nomad
2333+
usage_nomadbackend
23532334
;;
23542335
esac # nomad -> agents
23552336
;;
@@ -2363,6 +2344,7 @@ backend_nomad() {
23632344
state-dir-path )
23642345
local usage="USAGE: wb backend pass $op $agent $subop SERVER-NAME"
23652346
local name=${1:?$usage}; shift
2347+
local nomad_servers_dir="$(wb_nomad dir-path server)"
23662348
echo "${nomad_servers_dir}"/"${name}"
23672349
;;
23682350
config-file-path )
@@ -2530,7 +2512,7 @@ backend_nomad() {
25302512
fi
25312513
;;
25322514
* )
2533-
usage_nomad
2515+
usage_nomadbackend
25342516
;;
25352517
esac # nomad -> server
25362518
;;
@@ -2544,6 +2526,7 @@ backend_nomad() {
25442526
state-dir-path )
25452527
local usage="USAGE: wb backend pass $op $agent $subop CLIENT-NAME"
25462528
local name=${1:?$usage}; shift
2529+
local nomad_clients_dir="$(wb_nomad dir-path client)"
25472530
echo "${nomad_clients_dir}"/"${name}"
25482531
;;
25492532
config-file-path )
@@ -2838,7 +2821,7 @@ backend_nomad() {
28382821
;;
28392822
# Client specific subcommands here (not available for servers):
28402823
* )
2841-
usage_nomad
2824+
usage_nomadbackend
28422825
;;
28432826
esac # nomad -> client
28442827
;;
@@ -2880,7 +2863,8 @@ backend_nomad() {
28802863
echo "${XDG_RUNTIME_DIR:-/run/user/$UID}/workbench-podman.sock"
28812864
;;
28822865
pid-filepath )
2883-
echo "${nomad_agents_dir}"/nomad-driver-podman.pid
2866+
local plugin_dir="$(wb_nomad dir-path plugin)"
2867+
echo "${plugin_dir}"/nomad-driver-podman.pid
28842868
;;
28852869
pid )
28862870
local pid_file=$(backend_nomad nomad plugin nomad-driver-podman pid-filepath)
@@ -2961,12 +2945,12 @@ backend_nomad() {
29612945
fi
29622946
;;
29632947
* )
2964-
usage_nomad
2948+
usage_nomadbackend
29652949
;;
29662950
esac # nomad -> plugin -> nomad-driver-podman
29672951
;;
29682952
* )
2969-
usage_nomad
2953+
usage_nomadbackend
29702954
;;
29712955
esac # nomad -> plugin
29722956
;;
@@ -2978,6 +2962,8 @@ backend_nomad() {
29782962
local subop=${1:?$usage}; shift
29792963
case "$subop" in
29802964
nuke )
2965+
local nomad_servers_dir="$(wb_nomad dir-path server)"
2966+
local nomad_clients_dir="$(wb_nomad dir-path client)"
29812967
# Nuke all Nomad clients
29822968
for client_name in $(ls "${nomad_clients_dir}"); do
29832969
if backend_nomad nomad client is-running "${client_name}"
@@ -3004,8 +2990,10 @@ backend_nomad() {
30042990
backend_nomad nomad server cleanup "${server_name}"
30052991
fi
30062992
done
3007-
# Nuke the Nomad .cache dir
3008-
rm -rf "${nomad_agents_dir}" >/dev/null 2>&1
2993+
# Nuke the Nomad Agents' .cache dir
2994+
# Keep top level Nomad cache dir because it includes Vault's dirs.
2995+
rm -rf "${nomad_servers_dir}" >/dev/null 2>&1
2996+
rm -rf "${nomad_clients_dir}" >/dev/null 2>&1
30092997
# Bye HTTP server
30102998
if backend_nomad webfs is-running
30112999
then
@@ -3018,15 +3006,15 @@ backend_nomad() {
30183006
# rm -rf ~/.config/containers/podman/
30193007
;;
30203008
* )
3021-
usage_nomad
3009+
usage_nomadbackend
30223010
;;
30233011
esac # nomad -> all
30243012
;;
30253013
################################################################################
30263014
################################################################################
30273015
################################################################################
30283016
* )
3029-
usage_nomad
3017+
usage_nomadbackend
30303018
;;
30313019
esac # nomad
30323020
;;
@@ -3082,6 +3070,7 @@ EOF
30823070
# Nomad actions
30833071
case "$subop" in
30843072
state-dir-path)
3073+
local webfs_dir="$(wb_nomad dir-path webfs)"
30853074
echo "${webfs_dir}"
30863075
;;
30873076
document-root-path )
@@ -3161,7 +3150,7 @@ EOF
31613150
################################################################################
31623151

31633152
* )
3164-
usage_nomad
3153+
usage_nomadbackend
31653154
;;
31663155

31673156
esac
@@ -3445,6 +3434,7 @@ nomad_create_client_config() {
34453434
local config_file=$(backend_nomad nomad client config-file-path "${name}")
34463435
# Look for the running servers to connect to ("wired" in the config file).
34473436
local servers_addresses=""
3437+
local nomad_servers_dir="$(wb_nomad dir-path server)"
34483438
for server_name in $(ls "${nomad_servers_dir}"); do
34493439
if backend_nomad nomad server is-running "${server_name}"
34503440
then

‎nix/workbench/backend/nomad/cloud.sh

+19-15
Original file line numberDiff line numberDiff line change
@@ -108,15 +108,23 @@ backend_nomadcloud() {
108108
# test, I repeat, this is not a drill =)
109109
if test -z "${NOMAD_ADDR:-}"
110110
then
111-
msg $(yellow "WARNING: Nomad namespace \"NOMAD_NAMESPACE\" envar is not set")
112-
msg $(blue "INFO: The SRE provided address for \"Performance and Tracing\" is \"https://nomad.world.dev.cardano.org\"")
111+
msg $(yellow "WARNING: Nomad address \"NOMAD_ADDR\" envar is not set")
112+
NOMAD_ADDR="https://nomad.world.dev.cardano.org"
113+
msg $(blue "INFO: Setting \"NOMAD_ADDR\" to the SRE provided address for \"Performance and Tracing\" (\"${NOMAD_ADDR}\")")
113114
read -p "Hit enter to continue ..."
115+
else
116+
if test "${NOMAD_ADDR}" != "https://nomad.world.dev.cardano.org"
117+
then
118+
msg $(yellow "WARNING: Nomad address \"NOMAD_ADDR\" envar is not \"https://nomad.world.dev.cardano.org\"")
119+
read -p "Hit enter to continue ..."
120+
fi
114121
fi
115122
# The abscence of `NOMAD_NAMESPACE` or `NOMAD_TOKEN` needs confirmation
116123
if test -z "${NOMAD_NAMESPACE:-}"
117124
then
118125
msg $(yellow "WARNING: Nomad namespace \"NOMAD_NAMESPACE\" envar is not set")
119-
msg $(blue "INFO: The SRE provided namespace for \"Performance and Tracing\" is \"perf\"")
126+
NOMAD_NAMESPACE="perf"
127+
msg $(blue "INFO: Setting \"NOMAD_NAMESPACE\" to the SRE provided namespace for \"Performance and Tracing\" (\"${NOMAD_NAMESPACE}\")")
120128
read -p "Hit enter to continue ..."
121129
else
122130
if test "${NOMAD_NAMESPACE}" != "perf"
@@ -128,23 +136,19 @@ backend_nomadcloud() {
128136
if test -z "${NOMAD_TOKEN:-}"
129137
then
130138
msg $(yellow "WARNING: Nomad token \"NOMAD_TOKEN\" envar is not set")
131-
msg $(blue "INFO: Run "\`$(green "vault login -address=\"https://vault.world.dev.cardano.org\" -method=github -path=github-employees; vault read -address=\"https://vault.world.dev.cardano.org\" -field secret_id nomad/creds/perf")$(blue "\` to obtain one"))
132-
read -p "Hit enter to continue ..."
139+
msg $(blue "INFO: Fetching a \"NOMAD_TOKEN\" from SRE provided Vault for \"Performance and Tracing\"")
140+
NOMAD_TOKEN="$(wb_nomad vault world nomad-token)"
133141
fi
134142
# Check all the AWS S3 envars needed for the HTTP PUT request
135143
# Using same names as the AWS CLI
136144
# https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html
137-
if test -z "${AWS_ACCESS_KEY_ID:-}"
138-
then
139-
msg $(red "ERROR: Amazon S3 \"AWS_ACCESS_KEY_ID\" envar is not set")
140-
msg $(blue "INFO: Run "\`$(green "vault read -address=\"https://vault.world.dev.cardano.org\" -field access_key aws/creds/perf")$(blue "\` to obtain one"))
141-
fatal "Can't run a cluster in the Nomad cloud without \"AWS_ACCESS_KEY_ID\" envar"
142-
fi
143-
if test -z "${AWS_SECRET_ACCESS_KEY:-}"
145+
if test -z "${AWS_ACCESS_KEY_ID:-}" || test -z "${AWS_SECRET_ACCESS_KEY:-}"
144146
then
145-
msg $(red "ERROR: Amazon S3 \"AWS_SECRET_ACCESS_KEY\" envar is not set")
146-
msg $(blue "INFO: Run "\`$(green "vault read -address=\"https://vault.world.dev.cardano.org\" -field secret_key aws/creds/perf")$(blue "\` to obtain one"))
147-
fatal "Can't run a cluster in the Nomad cloud without \"AWS_SECRET_ACCESS_KEY\" envar"
147+
msg $(yellow "WARNING: Amazon S3 \"AWS_ACCESS_KEY_ID\" or \"AWS_SECRET_ACCESS_KEY\" envar is not set")
148+
msg $(blue "INFO: Fetching \"AWS_ACCESS_KEY_ID\" and \"AWS_SECRET_ACCESS_KEY\" from SRE provided Vault for \"Performance and Tracing\"")
149+
local aws_credentials="$(wb_nomad vault world aws-s3-credentials)"
150+
AWS_ACCESS_KEY_ID=$(echo "${aws_credentials}" | jq -r .data.access_key)
151+
AWS_SECRET_ACCESS_KEY=$(echo "${aws_credentials}" | jq -r .data.secret_key)
148152
fi
149153
# The Nomad job spec will contain links ("nix_installables" stanza) to
150154
# the Nix Flake outputs it needs inside the container, these are

0 commit comments

Comments
 (0)