mirror of https://github.com/grafana/grafana
Cloud migrations: create endpoint to create an access token (#84690)
* fix merge conflicts * make token expiration configurablepull/85106/head
Bruno
1 year ago
committed by
GitHub
parent
e237b89fe7
commit
a2e21eac8c
@ -0,0 +1,330 @@ |
||||
package gcom |
||||
|
||||
import ( |
||||
"bytes" |
||||
"context" |
||||
"encoding/json" |
||||
"fmt" |
||||
"io" |
||||
"net/http" |
||||
"net/url" |
||||
"time" |
||||
|
||||
"github.com/grafana/grafana/pkg/infra/log" |
||||
) |
||||
|
||||
var LogPrefix = "gcom.service" |
||||
|
||||
type Service interface { |
||||
GetInstanceByID(ctx context.Context, requestID string, instanceID string) (Instance, error) |
||||
CreateAccessPolicy(ctx context.Context, params CreateAccessPolicyParams, payload CreateAccessPolicyPayload) (AccessPolicy, error) |
||||
ListAccessPolicies(ctx context.Context, params ListAccessPoliciesParams) ([]AccessPolicy, error) |
||||
DeleteAccessPolicy(ctx context.Context, params DeleteAccessPolicyParams) (bool, error) |
||||
CreateToken(ctx context.Context, params CreateTokenParams, payload CreateTokenPayload) (Token, error) |
||||
} |
||||
|
||||
type Instance struct { |
||||
ID int `json:"id"` |
||||
Slug string `json:"slug"` |
||||
RegionSlug string `json:"regionSlug"` |
||||
ClusterSlug string `json:"clusterSlug"` |
||||
} |
||||
|
||||
type CreateAccessPolicyParams struct { |
||||
RequestID string |
||||
Region string |
||||
} |
||||
|
||||
type CreateAccessPolicyPayload struct { |
||||
Name string `json:"name"` |
||||
DisplayName string `json:"displayName"` |
||||
Realms []Realm `json:"realms"` |
||||
Scopes []string `json:"scopes"` |
||||
} |
||||
|
||||
type Realm struct { |
||||
Identifier string `json:"identifier"` |
||||
LabelPolicies []LabelPolicy `json:"labelPolicies"` |
||||
Type string `json:"type"` |
||||
} |
||||
|
||||
type LabelPolicy struct { |
||||
Selector string `json:"selector"` |
||||
} |
||||
|
||||
type AccessPolicy struct { |
||||
ID string `json:"id"` |
||||
Name string `json:"name"` |
||||
} |
||||
|
||||
type ListAccessPoliciesParams struct { |
||||
RequestID string |
||||
Region string |
||||
Name string |
||||
} |
||||
|
||||
type listAccessPoliciesResponse struct { |
||||
Items []AccessPolicy `json:"items"` |
||||
} |
||||
|
||||
type DeleteAccessPolicyParams struct { |
||||
RequestID string |
||||
AccessPolicyID string |
||||
Region string |
||||
} |
||||
|
||||
type CreateTokenParams struct { |
||||
RequestID string |
||||
Region string |
||||
} |
||||
|
||||
type CreateTokenPayload struct { |
||||
AccessPolicyID string `json:"accessPolicyId"` |
||||
DisplayName string `json:"displayName"` |
||||
Name string `json:"name"` |
||||
ExpiresAt time.Time `json:"expiresAt"` |
||||
} |
||||
|
||||
type Token struct { |
||||
ID string `json:"id"` |
||||
AccessPolicyID string `json:"accessPolicyId"` |
||||
Name string `json:"name"` |
||||
Token string `json:"token"` |
||||
} |
||||
|
||||
type GcomClient struct { |
||||
log log.Logger |
||||
cfg Config |
||||
httpClient *http.Client |
||||
} |
||||
|
||||
type Config struct { |
||||
ApiURL string |
||||
Token string |
||||
} |
||||
|
||||
func New(cfg Config) Service { |
||||
return &GcomClient{ |
||||
log: log.New(LogPrefix), |
||||
cfg: cfg, |
||||
httpClient: &http.Client{}, |
||||
} |
||||
} |
||||
|
||||
func (client *GcomClient) GetInstanceByID(ctx context.Context, requestID string, instanceID string) (Instance, error) { |
||||
endpoint, err := url.JoinPath(client.cfg.ApiURL, "/instances/", instanceID) |
||||
if err != nil { |
||||
return Instance{}, fmt.Errorf("building gcom instance url: %w", err) |
||||
} |
||||
|
||||
request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil) |
||||
if err != nil { |
||||
return Instance{}, fmt.Errorf("creating http request: %w", err) |
||||
} |
||||
|
||||
request.Header.Set("x-request-id", requestID) |
||||
request.Header.Set("Content-Type", "application/json") |
||||
|
||||
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token)) |
||||
|
||||
response, err := client.httpClient.Do(request) |
||||
if err != nil { |
||||
return Instance{}, fmt.Errorf("sending http request to create fetch instance by id: %w", err) |
||||
} |
||||
defer func() { |
||||
if err := response.Body.Close(); err != nil { |
||||
client.log.Error("closing http response body", "err", err.Error()) |
||||
} |
||||
}() |
||||
|
||||
if response.StatusCode != http.StatusOK { |
||||
body, _ := io.ReadAll(response.Body) |
||||
return Instance{}, fmt.Errorf("unexpected response when fetching instance by id: code=%d body=%s", response.StatusCode, body) |
||||
} |
||||
|
||||
var instance Instance |
||||
if err := json.NewDecoder(response.Body).Decode(&instance); err != nil { |
||||
return instance, fmt.Errorf("unmarshaling response body: %w", err) |
||||
} |
||||
|
||||
return instance, nil |
||||
} |
||||
|
||||
func (client *GcomClient) CreateAccessPolicy(ctx context.Context, params CreateAccessPolicyParams, payload CreateAccessPolicyPayload) (AccessPolicy, error) { |
||||
endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/accesspolicies") |
||||
if err != nil { |
||||
return AccessPolicy{}, fmt.Errorf("building gcom access policy url: %w", err) |
||||
} |
||||
|
||||
body, err := json.Marshal(&payload) |
||||
if err != nil { |
||||
return AccessPolicy{}, fmt.Errorf("marshaling request body: %w", err) |
||||
} |
||||
|
||||
request, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body)) |
||||
if err != nil { |
||||
return AccessPolicy{}, fmt.Errorf("creating http request: %w", err) |
||||
} |
||||
|
||||
query := url.Values{} |
||||
query.Set("region", params.Region) |
||||
|
||||
request.URL.RawQuery = query.Encode() |
||||
request.Header.Set("x-request-id", params.RequestID) |
||||
request.Header.Set("Content-Type", "application/json") |
||||
|
||||
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token)) |
||||
|
||||
response, err := client.httpClient.Do(request) |
||||
if err != nil { |
||||
return AccessPolicy{}, fmt.Errorf("sending http request to create access policy: %w", err) |
||||
} |
||||
defer func() { |
||||
if err := response.Body.Close(); err != nil { |
||||
client.log.Error("closing http response body", "err", err.Error()) |
||||
} |
||||
}() |
||||
|
||||
if response.StatusCode != http.StatusOK { |
||||
body, _ := io.ReadAll(response.Body) |
||||
return AccessPolicy{}, fmt.Errorf("unexpected response when creating access policy: code=%d body=%s", response.StatusCode, body) |
||||
} |
||||
|
||||
var accessPolicy AccessPolicy |
||||
if err := json.NewDecoder(response.Body).Decode(&accessPolicy); err != nil { |
||||
return accessPolicy, fmt.Errorf("unmarshaling response body: %w", err) |
||||
} |
||||
|
||||
return accessPolicy, nil |
||||
} |
||||
|
||||
func (client *GcomClient) DeleteAccessPolicy(ctx context.Context, params DeleteAccessPolicyParams) (bool, error) { |
||||
endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/accesspolicies/", params.AccessPolicyID) |
||||
if err != nil { |
||||
return false, fmt.Errorf("building gcom access policy url: %w", err) |
||||
} |
||||
|
||||
request, err := http.NewRequestWithContext(ctx, http.MethodDelete, endpoint, nil) |
||||
if err != nil { |
||||
return false, fmt.Errorf("creating http request: %w", err) |
||||
} |
||||
|
||||
query := url.Values{} |
||||
query.Set("region", params.Region) |
||||
|
||||
request.URL.RawQuery = query.Encode() |
||||
request.Header.Set("x-request-id", params.RequestID) |
||||
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token)) |
||||
|
||||
response, err := client.httpClient.Do(request) |
||||
if err != nil { |
||||
return false, fmt.Errorf("sending http request to create access policy: %w", err) |
||||
} |
||||
defer func() { |
||||
if err := response.Body.Close(); err != nil { |
||||
client.log.Error("closing http response body", "err", err.Error()) |
||||
} |
||||
}() |
||||
|
||||
if response.StatusCode == http.StatusNotFound { |
||||
return false, nil |
||||
} |
||||
|
||||
if response.StatusCode == http.StatusOK || response.StatusCode == http.StatusNoContent { |
||||
return true, nil |
||||
} |
||||
|
||||
body, _ := io.ReadAll(response.Body) |
||||
return false, fmt.Errorf("unexpected response when deleting access policy: code=%d body=%s", response.StatusCode, body) |
||||
} |
||||
|
||||
func (client *GcomClient) ListAccessPolicies(ctx context.Context, params ListAccessPoliciesParams) ([]AccessPolicy, error) { |
||||
endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/accesspolicies") |
||||
if err != nil { |
||||
return nil, fmt.Errorf("building gcom access policy url: %w", err) |
||||
} |
||||
|
||||
request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil) |
||||
if err != nil { |
||||
return nil, fmt.Errorf("creating http request: %w", err) |
||||
} |
||||
|
||||
query := url.Values{} |
||||
query.Set("region", params.Region) |
||||
query.Set("name", params.Name) |
||||
request.URL.RawQuery = query.Encode() |
||||
request.Header.Set("x-request-id", params.RequestID) |
||||
request.Header.Set("Accept", "application/json") |
||||
|
||||
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token)) |
||||
|
||||
response, err := client.httpClient.Do(request) |
||||
if err != nil { |
||||
return nil, fmt.Errorf("sending http request to create access policy: %w", err) |
||||
} |
||||
defer func() { |
||||
if err := response.Body.Close(); err != nil { |
||||
client.log.Error("closing http response body", "err", err.Error()) |
||||
} |
||||
}() |
||||
|
||||
if response.StatusCode != http.StatusOK { |
||||
body, _ := io.ReadAll(response.Body) |
||||
return nil, fmt.Errorf("unexpected response when listing access policies: code=%d body=%s", response.StatusCode, body) |
||||
} |
||||
|
||||
var responseBody listAccessPoliciesResponse |
||||
if err := json.NewDecoder(response.Body).Decode(&responseBody); err != nil { |
||||
return responseBody.Items, fmt.Errorf("unmarshaling response body: %w", err) |
||||
} |
||||
|
||||
return responseBody.Items, nil |
||||
} |
||||
|
||||
func (client *GcomClient) CreateToken(ctx context.Context, params CreateTokenParams, payload CreateTokenPayload) (Token, error) { |
||||
endpoint, err := url.JoinPath(client.cfg.ApiURL, "/v1/tokens") |
||||
if err != nil { |
||||
return Token{}, fmt.Errorf("building gcom tokens url: %w", err) |
||||
} |
||||
|
||||
body, err := json.Marshal(&payload) |
||||
if err != nil { |
||||
return Token{}, fmt.Errorf("marshaling request body: %w", err) |
||||
} |
||||
|
||||
request, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body)) |
||||
if err != nil { |
||||
return Token{}, fmt.Errorf("creating http request: %w", err) |
||||
} |
||||
|
||||
query := url.Values{} |
||||
query.Set("region", params.Region) |
||||
|
||||
request.URL.RawQuery = query.Encode() |
||||
request.Header.Set("x-request-id", params.RequestID) |
||||
request.Header.Set("Content-Type", "application/json") |
||||
|
||||
request.Header.Set("Authorization", fmt.Sprintf("Bearer %s", client.cfg.Token)) |
||||
|
||||
response, err := client.httpClient.Do(request) |
||||
if err != nil { |
||||
return Token{}, fmt.Errorf("sending http request to create access token: %w", err) |
||||
} |
||||
defer func() { |
||||
if err := response.Body.Close(); err != nil { |
||||
client.log.Error("closing http response body", "err", err.Error()) |
||||
} |
||||
}() |
||||
|
||||
if response.StatusCode != http.StatusOK { |
||||
body, _ := io.ReadAll(response.Body) |
||||
return Token{}, fmt.Errorf("unexpected response when creating access token: code=%d body=%s", response.StatusCode, body) |
||||
} |
||||
|
||||
var token Token |
||||
if err := json.NewDecoder(response.Body).Decode(&token); err != nil { |
||||
return token, fmt.Errorf("unmarshaling response body: %w", err) |
||||
} |
||||
|
||||
return token, nil |
||||
} |
||||
@ -0,0 +1,28 @@ |
||||
package setting |
||||
|
||||
import ( |
||||
"time" |
||||
) |
||||
|
||||
type CloudMigrationSettings struct { |
||||
IsTarget bool |
||||
GcomAPIToken string |
||||
FetchInstanceTimeout time.Duration |
||||
CreateAccessPolicyTimeout time.Duration |
||||
FetchAccessPolicyTimeout time.Duration |
||||
DeleteAccessPolicyTimeout time.Duration |
||||
CreateTokenTimeout time.Duration |
||||
TokenExpiresAfter time.Duration |
||||
} |
||||
|
||||
func (cfg *Cfg) readCloudMigrationSettings() { |
||||
cloudMigration := cfg.Raw.Section("cloud_migration") |
||||
cfg.CloudMigration.IsTarget = cloudMigration.Key("is_target").MustBool(false) |
||||
cfg.CloudMigration.GcomAPIToken = cloudMigration.Key("gcom_api_token").MustString("") |
||||
cfg.CloudMigration.FetchInstanceTimeout = cloudMigration.Key("fetch_instance_timeout").MustDuration(5 * time.Second) |
||||
cfg.CloudMigration.CreateAccessPolicyTimeout = cloudMigration.Key("create_access_policy_timeout").MustDuration(5 * time.Second) |
||||
cfg.CloudMigration.FetchAccessPolicyTimeout = cloudMigration.Key("fetch_access_policy_timeout").MustDuration(5 * time.Second) |
||||
cfg.CloudMigration.DeleteAccessPolicyTimeout = cloudMigration.Key("delete_access_policy_timeout").MustDuration(5 * time.Second) |
||||
cfg.CloudMigration.CreateTokenTimeout = cloudMigration.Key("create_token_timeout").MustDuration(5 * time.Second) |
||||
cfg.CloudMigration.TokenExpiresAfter = cloudMigration.Key("token_expires_after").MustDuration(7 * 24 * time.Hour) |
||||
} |
||||
Loading…
Reference in new issue