/usr/lib/python2.7/dist-packages/maasserver/support/pertenant/migration.py is in python-django-maas 1.5+bzr2252-0ubuntu1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 | # Copyright 2012 Canonical Ltd. This software is licensed under the
# GNU Affero General Public License version 3 (see the file LICENSE).
"""Shared namespace --> per-tenant namespace migration.
Perform the following steps to migrate:
1. When no files exist (i.e. no Juju environments exist): do nothing
1a. When no *unowned* files exist: do nothing.
2. When there's only one user: assign ownership of all files to user.
3. When there are multiple users and a `provider-state` file: parse that file
to extract the instance id of the bootstrap node. From that instance id,
get the identity of the user who deployed this environment (that's the
owner of the bootstrap node). Then proceed as in 4, using that user as the
"legacy" user.
4. When there are multiple users: create a new "legacy" user, assign ownership
of all files and allocated/owned nodes to this user, copy all public SSH
keys to this user, and move all API credentials to this user.
There's not a lot we can do about SSH keys authorised to connect to the
already deployed nodes in #3, but this set will only ever decrease: nodes
allocated after this migration will permit access from any of the users with
SSH keys prior to the migration.
"""
from __future__ import (
absolute_import,
print_function,
unicode_literals,
)
str = None
__metaclass__ = type
__all__ = [
"migrate",
]
from django.contrib.auth.models import User
from maasserver.models import (
FileStorage,
Node,
SSHKey,
)
from maasserver.models.user import (
get_auth_tokens,
SYSTEM_USERS,
)
from maasserver.support.pertenant.utils import get_bootstrap_node_owner
from maasserver.utils.orm import get_one
legacy_user_name = "shared-environment"
def get_legacy_user():
"""Return the legacy namespace user, creating it if need be."""
try:
legacy_user = User.objects.get(username=legacy_user_name)
except User.DoesNotExist:
# Create the legacy user with a local, probably non-working, email
# address, and an unusable password.
legacy_user = User.objects.create_user(
email="%s@localhost" % legacy_user_name,
username=legacy_user_name)
legacy_user.first_name = "Shared"
legacy_user.last_name = "Environment"
legacy_user.is_active = True
return legacy_user
def get_unowned_files():
"""Returns a `QuerySet` of unowned files."""
return FileStorage.objects.filter(owner=None)
def get_real_users():
"""Returns a `QuerySet` of real. not system, users."""
users = User.objects.exclude(username__in=SYSTEM_USERS)
users = users.exclude(username=legacy_user_name)
return users
def get_owned_nodes():
"""Returns a `QuerySet` of nodes owned by real users."""
return Node.objects.filter(owner__in=get_real_users())
def get_owned_nodes_owners():
"""Returns a `QuerySet` of the owners of nodes owned by real users."""
owner_ids = get_owned_nodes().values_list("owner", flat=True)
return User.objects.filter(id__in=owner_ids.distinct())
def get_destination_user():
"""Return the user to which resources should be assigned."""
real_users = get_real_users()
if real_users.count() == 1:
return get_one(real_users)
else:
bootstrap_user = get_bootstrap_node_owner()
if bootstrap_user is None:
return get_legacy_user()
else:
return bootstrap_user
def get_ssh_keys(user):
"""Return the SSH key strings belonging to the specified user."""
return SSHKey.objects.filter(user=user).values_list("key", flat=True)
def copy_ssh_keys(user_from, user_dest):
"""Copies SSH keys from one user to another.
This is idempotent, and does not clobber the destination user's existing
keys.
"""
user_from_keys = get_ssh_keys(user_from)
user_dest_keys = get_ssh_keys(user_dest)
for key in set(user_from_keys).difference(user_dest_keys):
ssh_key = SSHKey(user=user_dest, key=key)
ssh_key.save()
def give_file_to_user(file, user):
"""Give a file to a user."""
file.owner = user
file.save()
def give_api_credentials_to_user(user_from, user_dest):
"""Gives one user's API credentials to another.
This ensures that users of the shared namespace environment continue to
operate within the legacy shared namespace environment by default via the
API (e.g. from the command-line client, or from Juju).
"""
for token in get_auth_tokens(user_from):
consumer = token.consumer
consumer.user = user_dest
consumer.save()
token.user = user_dest
token.save()
def give_node_to_user(node, user):
"""Changes a node's ownership for the legacy shared environment."""
node.owner = user
node.save()
def migrate_to_user(user):
"""Migrate files and nodes to the specified user.
This also copies, to the destination user, the public SSH keys of any
owned nodes' owners. This is so that those users who had allocated nodes
(i.e. active users of a shared-namespace environment) can access newly
created nodes in the legacy shared-namespace environment.
"""
for unowned_file in get_unowned_files():
give_file_to_user(unowned_file, user)
for node_owner in get_owned_nodes_owners():
copy_ssh_keys(node_owner, user)
give_api_credentials_to_user(node_owner, user)
for owned_node in get_owned_nodes():
give_node_to_user(owned_node, user)
def migrate():
"""Migrate files to a per-tenant namespace."""
if get_unowned_files().exists():
# 2, 3, and 4
user = get_destination_user()
migrate_to_user(user)
else:
# 1 and 1a
pass
|