2018-10-08 14:50:39 +00:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2021-11-24 15:14:19 +00:00
|
|
|
require 'securerandom'
|
2018-03-16 16:50:48 +00:00
|
|
|
require 'google/apis/compute_v1'
|
2017-09-26 11:34:49 +00:00
|
|
|
require 'google/apis/container_v1'
|
2019-09-23 00:06:29 +00:00
|
|
|
require 'google/apis/container_v1beta1'
|
2017-12-15 22:54:50 +00:00
|
|
|
require 'google/apis/cloudbilling_v1'
|
2017-12-15 18:39:15 +00:00
|
|
|
require 'google/apis/cloudresourcemanager_v1'
|
2021-11-24 15:14:19 +00:00
|
|
|
require 'google/apis/iam_v1'
|
2022-02-11 18:18:58 +00:00
|
|
|
require 'google/apis/serviceusage_v1'
|
2017-09-26 11:34:49 +00:00
|
|
|
|
2017-09-25 07:10:25 +00:00
|
|
|
module GoogleApi
|
|
|
|
module CloudPlatform
|
2017-09-30 15:54:22 +00:00
|
|
|
class Client < GoogleApi::Auth
|
2022-02-11 18:18:58 +00:00
|
|
|
SCOPE = 'https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/service.management'
|
2017-10-06 09:23:53 +00:00
|
|
|
LEAST_TOKEN_LIFE_TIME = 10.minutes
|
2019-09-10 08:11:43 +00:00
|
|
|
CLUSTER_MASTER_AUTH_USERNAME = 'admin'
|
2019-10-29 18:06:15 +00:00
|
|
|
CLUSTER_IPV4_CIDR_BLOCK = '/16'
|
2019-12-15 21:07:47 +00:00
|
|
|
CLUSTER_OAUTH_SCOPES = [
|
|
|
|
"https://www.googleapis.com/auth/devstorage.read_only",
|
|
|
|
"https://www.googleapis.com/auth/logging.write",
|
|
|
|
"https://www.googleapis.com/auth/monitoring"
|
|
|
|
].freeze
|
2022-01-28 12:17:26 +00:00
|
|
|
ROLES_LIST = %w[roles/iam.serviceAccountUser roles/artifactregistry.admin roles/cloudbuild.builds.builder roles/run.admin roles/storage.admin roles/cloudsql.admin roles/browser].freeze
|
2017-10-01 08:48:21 +00:00
|
|
|
|
2017-09-25 17:11:26 +00:00
|
|
|
class << self
|
2017-09-30 15:54:22 +00:00
|
|
|
def session_key_for_token
|
2017-09-25 17:11:26 +00:00
|
|
|
:cloud_platform_access_token
|
|
|
|
end
|
2017-10-02 08:13:46 +00:00
|
|
|
|
|
|
|
def session_key_for_expires_at
|
|
|
|
:cloud_platform_expires_at
|
|
|
|
end
|
2017-10-06 12:28:40 +00:00
|
|
|
|
2017-10-06 14:14:14 +00:00
|
|
|
def new_session_key_for_redirect_uri
|
|
|
|
SecureRandom.hex.tap do |state|
|
|
|
|
yield session_key_for_redirect_uri(state)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def session_key_for_redirect_uri(state)
|
|
|
|
"cloud_platform_second_redirect_uri_#{state}"
|
2017-10-06 12:28:40 +00:00
|
|
|
end
|
2017-09-25 17:11:26 +00:00
|
|
|
end
|
|
|
|
|
2017-09-25 07:10:25 +00:00
|
|
|
def scope
|
2017-10-03 14:44:06 +00:00
|
|
|
SCOPE
|
2017-09-25 07:10:25 +00:00
|
|
|
end
|
|
|
|
|
2017-10-02 08:13:46 +00:00
|
|
|
def validate_token(expires_at)
|
|
|
|
return false unless access_token
|
|
|
|
return false unless expires_at
|
|
|
|
|
|
|
|
# Making sure that the token will have been still alive during the cluster creation.
|
2017-10-06 09:23:53 +00:00
|
|
|
return false if token_life_time(expires_at) < LEAST_TOKEN_LIFE_TIME
|
2017-10-02 08:13:46 +00:00
|
|
|
|
|
|
|
true
|
|
|
|
end
|
|
|
|
|
2017-09-26 14:05:12 +00:00
|
|
|
def projects_zones_clusters_get(project_id, zone, cluster_id)
|
2017-09-26 11:34:49 +00:00
|
|
|
service = Google::Apis::ContainerV1::ContainerService.new
|
|
|
|
service.authorization = access_token
|
|
|
|
|
2017-12-04 01:19:02 +00:00
|
|
|
service.get_zone_cluster(project_id, zone, cluster_id, options: user_agent_header)
|
2017-09-25 07:10:25 +00:00
|
|
|
end
|
|
|
|
|
2019-09-23 00:06:29 +00:00
|
|
|
def projects_zones_clusters_create(project_id, zone, cluster_name, cluster_size, machine_type:, legacy_abac:, enable_addons: [])
|
|
|
|
service = Google::Apis::ContainerV1beta1::ContainerService.new
|
2017-09-26 11:34:49 +00:00
|
|
|
service.authorization = access_token
|
|
|
|
|
2019-09-23 00:06:29 +00:00
|
|
|
cluster_options = make_cluster_options(cluster_name, cluster_size, machine_type, legacy_abac, enable_addons)
|
|
|
|
|
2020-10-07 12:09:12 +00:00
|
|
|
request_body = Google::Apis::ContainerV1beta1::CreateClusterRequest.new(**cluster_options)
|
2017-09-26 11:34:49 +00:00
|
|
|
|
2017-12-04 01:19:02 +00:00
|
|
|
service.create_cluster(project_id, zone, request_body, options: user_agent_header)
|
2017-09-26 11:34:49 +00:00
|
|
|
end
|
2017-09-25 17:11:26 +00:00
|
|
|
|
2017-09-26 14:05:12 +00:00
|
|
|
def projects_zones_operations(project_id, zone, operation_id)
|
|
|
|
service = Google::Apis::ContainerV1::ContainerService.new
|
|
|
|
service.authorization = access_token
|
|
|
|
|
2017-12-04 01:19:02 +00:00
|
|
|
service.get_zone_operation(project_id, zone, operation_id, options: user_agent_header)
|
2017-09-26 14:05:12 +00:00
|
|
|
end
|
|
|
|
|
2017-09-30 15:54:22 +00:00
|
|
|
def parse_operation_id(self_link)
|
2017-10-05 09:17:21 +00:00
|
|
|
m = self_link.match(%r{projects/.*/zones/.*/operations/(.*)})
|
|
|
|
m[1] if m
|
2017-09-25 07:10:25 +00:00
|
|
|
end
|
2017-10-06 09:23:53 +00:00
|
|
|
|
2021-11-24 15:14:19 +00:00
|
|
|
def list_projects
|
|
|
|
result = []
|
|
|
|
|
2022-01-28 12:17:26 +00:00
|
|
|
response = cloud_resource_manager_service.fetch_all(items: :projects) do |token|
|
|
|
|
cloud_resource_manager_service.list_projects
|
2021-11-24 15:14:19 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
# Google API results are paged by default, so we need to iterate through
|
|
|
|
response.each do |project|
|
|
|
|
result.append(project)
|
|
|
|
end
|
|
|
|
|
|
|
|
result
|
|
|
|
end
|
|
|
|
|
|
|
|
def create_service_account(gcp_project_id, display_name, description)
|
|
|
|
name = "projects/#{gcp_project_id}"
|
|
|
|
|
|
|
|
# initialize google iam service
|
|
|
|
service = Google::Apis::IamV1::IamService.new
|
|
|
|
service.authorization = access_token
|
|
|
|
|
|
|
|
# generate account id
|
|
|
|
random_account_id = "gitlab-" + SecureRandom.hex(11)
|
|
|
|
|
|
|
|
body_params = { account_id: random_account_id,
|
|
|
|
service_account: { display_name: display_name,
|
|
|
|
description: description } }
|
|
|
|
|
|
|
|
request_body = Google::Apis::IamV1::CreateServiceAccountRequest.new(**body_params)
|
|
|
|
service.create_service_account(name, request_body)
|
|
|
|
end
|
|
|
|
|
|
|
|
def create_service_account_key(gcp_project_id, service_account_id)
|
|
|
|
service = Google::Apis::IamV1::IamService.new
|
|
|
|
service.authorization = access_token
|
|
|
|
|
|
|
|
name = "projects/#{gcp_project_id}/serviceAccounts/#{service_account_id}"
|
|
|
|
request_body = Google::Apis::IamV1::CreateServiceAccountKeyRequest.new
|
|
|
|
service.create_service_account_key(name, request_body)
|
|
|
|
end
|
|
|
|
|
2022-01-28 12:17:26 +00:00
|
|
|
def grant_service_account_roles(gcp_project_id, email)
|
|
|
|
body = policy_request_body(gcp_project_id, email)
|
|
|
|
cloud_resource_manager_service.set_project_iam_policy(gcp_project_id, body)
|
|
|
|
end
|
|
|
|
|
2022-02-11 18:18:58 +00:00
|
|
|
def enable_cloud_run(gcp_project_id)
|
|
|
|
enable_service(gcp_project_id, 'run.googleapis.com')
|
|
|
|
end
|
|
|
|
|
|
|
|
def enable_artifacts_registry(gcp_project_id)
|
|
|
|
enable_service(gcp_project_id, 'artifactregistry.googleapis.com')
|
|
|
|
end
|
|
|
|
|
|
|
|
def enable_cloud_build(gcp_project_id)
|
|
|
|
enable_service(gcp_project_id, 'cloudbuild.googleapis.com')
|
|
|
|
end
|
|
|
|
|
2017-10-06 09:23:53 +00:00
|
|
|
private
|
|
|
|
|
2022-02-11 18:18:58 +00:00
|
|
|
def enable_service(gcp_project_id, service_name)
|
|
|
|
name = "projects/#{gcp_project_id}/services/#{service_name}"
|
|
|
|
service = Google::Apis::ServiceusageV1::ServiceUsageService.new
|
|
|
|
service.authorization = access_token
|
|
|
|
service.enable_service(name)
|
|
|
|
end
|
|
|
|
|
2019-09-23 00:06:29 +00:00
|
|
|
def make_cluster_options(cluster_name, cluster_size, machine_type, legacy_abac, enable_addons)
|
|
|
|
{
|
|
|
|
cluster: {
|
|
|
|
name: cluster_name,
|
|
|
|
initial_node_count: cluster_size,
|
|
|
|
node_config: {
|
2019-12-15 21:07:47 +00:00
|
|
|
machine_type: machine_type,
|
|
|
|
oauth_scopes: CLUSTER_OAUTH_SCOPES
|
2019-09-23 00:06:29 +00:00
|
|
|
},
|
|
|
|
master_auth: {
|
|
|
|
client_certificate_config: {
|
|
|
|
issue_client_certificate: true
|
|
|
|
}
|
|
|
|
},
|
|
|
|
legacy_abac: {
|
|
|
|
enabled: legacy_abac
|
|
|
|
},
|
2019-10-10 12:06:19 +00:00
|
|
|
ip_allocation_policy: {
|
2019-10-29 18:06:15 +00:00
|
|
|
use_ip_aliases: true,
|
|
|
|
cluster_ipv4_cidr_block: CLUSTER_IPV4_CIDR_BLOCK
|
2019-10-10 12:06:19 +00:00
|
|
|
},
|
2019-12-15 21:07:47 +00:00
|
|
|
addons_config: make_addons_config(enable_addons)
|
2019-09-23 00:06:29 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
end
|
|
|
|
|
2019-12-15 21:07:47 +00:00
|
|
|
def make_addons_config(enable_addons)
|
|
|
|
enable_addons.each_with_object({}) do |addon, hash|
|
|
|
|
hash[addon] = { disabled: false }
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2017-10-06 09:23:53 +00:00
|
|
|
def token_life_time(expires_at)
|
|
|
|
DateTime.strptime(expires_at, '%s').to_time.utc - Time.now.utc
|
|
|
|
end
|
2017-12-03 23:53:04 +00:00
|
|
|
|
|
|
|
def user_agent_header
|
2017-12-04 12:43:45 +00:00
|
|
|
Google::Apis::RequestOptions.new.tap do |options|
|
|
|
|
options.header = { 'User-Agent': "GitLab/#{Gitlab::VERSION.match('(\d+\.\d+)').captures.first} (GPN:GitLab;)" }
|
|
|
|
end
|
2017-12-03 23:53:04 +00:00
|
|
|
end
|
2022-01-28 12:17:26 +00:00
|
|
|
|
|
|
|
def policy_request_body(gcp_project_id, email)
|
|
|
|
policy = cloud_resource_manager_service.get_project_iam_policy(gcp_project_id)
|
|
|
|
policy.bindings = policy.bindings + additional_policy_bindings("serviceAccount:#{email}")
|
|
|
|
|
|
|
|
Google::Apis::CloudresourcemanagerV1::SetIamPolicyRequest.new(policy: policy)
|
|
|
|
end
|
|
|
|
|
|
|
|
def additional_policy_bindings(member)
|
|
|
|
ROLES_LIST.map do |role|
|
|
|
|
Google::Apis::CloudresourcemanagerV1::Binding.new(role: role, members: [member])
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def cloud_resource_manager_service
|
|
|
|
@gpc_service ||= Google::Apis::CloudresourcemanagerV1::CloudResourceManagerService.new.tap { |s| s. authorization = access_token }
|
|
|
|
end
|
2017-09-25 07:10:25 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|