This reverts commit 658dc9d30c.
The L3 agent metadata driver was added but then reverted
because it broke the functional job. The fix to the functional
job was merged, and this patch reverts the revert, thereby
adding the metadata driver back.
Change-Id: Ice7ae845d1d5063b116824f49961ff060a0b2baa
changes/01/143301/5
Assaf Muller
8 years ago
committed by
Cedric Brandily
parent
75832ea45a
commit
3d682d2fb7
@ -0,0 +1,110 @@
|
||||
# Copyright 2014 OpenStack Foundation.
|
||||
# All Rights Reserved.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
import os
|
||||
|
||||
from neutron.agent.common import config
|
||||
from neutron.agent.linux import external_process
|
||||
from neutron.openstack.common import log as logging
|
||||
from neutron.services import advanced_service
|
||||
|
||||
LOG = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class MetadataDriver(advanced_service.AdvancedService):
|
||||
def __init__(self, l3_agent):
|
||||
super(MetadataDriver, self).__init__(l3_agent)
|
||||
self.metadata_port = l3_agent.conf.metadata_port
|
||||
|
||||
def after_router_added(self, router):
|
||||
for c, r in self.metadata_filter_rules(self.metadata_port):
|
||||
router.iptables_manager.ipv4['filter'].add_rule(c, r)
|
||||
for c, r in self.metadata_nat_rules(self.metadata_port):
|
||||
router.iptables_manager.ipv4['nat'].add_rule(c, r)
|
||||
router.iptables_manager.apply()
|
||||
|
||||
if not router.is_ha:
|
||||
self._spawn_metadata_proxy(router.router_id,
|
||||
router.ns_name,
|
||||
self.l3_agent.conf)
|
||||
|
||||
def before_router_removed(self, router):
|
||||
for c, r in self.metadata_filter_rules(self.metadata_port):
|
||||
router.iptables_manager.ipv4['filter'].remove_rule(c, r)
|
||||
for c, r in self.metadata_nat_rules(self.metadata_port):
|
||||
router.iptables_manager.ipv4['nat'].remove_rule(c, r)
|
||||
router.iptables_manager.apply()
|
||||
|
||||
self._destroy_metadata_proxy(router.router['id'],
|
||||
router.ns_name,
|
||||
self.l3_agent.conf)
|
||||
|
||||
@classmethod
|
||||
def metadata_filter_rules(cls, port):
|
||||
return [('INPUT', '-s 0.0.0.0/0 -d 127.0.0.1 '
|
||||
'-p tcp -m tcp --dport %s '
|
||||
'-j ACCEPT' % port)]
|
||||
|
||||
@classmethod
|
||||
def metadata_nat_rules(cls, port):
|
||||
return [('PREROUTING', '-s 0.0.0.0/0 -d 169.254.169.254/32 '
|
||||
'-p tcp -m tcp --dport 80 -j REDIRECT '
|
||||
'--to-port %s' % port)]
|
||||
|
||||
@classmethod
|
||||
def _get_metadata_proxy_user_group(cls, conf):
|
||||
user = conf.metadata_proxy_user or os.geteuid()
|
||||
group = conf.metadata_proxy_group or os.getegid()
|
||||
return user, group
|
||||
|
||||
@classmethod
|
||||
def _get_metadata_proxy_callback(cls, router_id, conf):
|
||||
|
||||
def callback(pid_file):
|
||||
metadata_proxy_socket = conf.metadata_proxy_socket
|
||||
user, group = cls._get_metadata_proxy_user_group(conf)
|
||||
proxy_cmd = ['neutron-ns-metadata-proxy',
|
||||
'--pid_file=%s' % pid_file,
|
||||
'--metadata_proxy_socket=%s' % metadata_proxy_socket,
|
||||
'--router_id=%s' % router_id,
|
||||
'--state_path=%s' % conf.state_path,
|
||||
'--metadata_port=%s' % conf.metadata_port,
|
||||
'--metadata_proxy_user=%s' % user,
|
||||
'--metadata_proxy_group=%s' % group]
|
||||
proxy_cmd.extend(config.get_log_args(
|
||||
conf, 'neutron-ns-metadata-proxy-%s.log' %
|
||||
router_id))
|
||||
return proxy_cmd
|
||||
|
||||
return callback
|
||||
|
||||
@classmethod
|
||||
def _get_metadata_proxy_process_manager(cls, router_id, ns_name, conf):
|
||||
return external_process.ProcessManager(
|
||||
conf,
|
||||
router_id,
|
||||
config.get_root_helper(conf),
|
||||
ns_name)
|
||||
|
||||
@classmethod
|
||||
def _spawn_metadata_proxy(cls, router_id, ns_name, conf):
|
||||
callback = cls._get_metadata_proxy_callback(router_id, conf)
|
||||
pm = cls._get_metadata_proxy_process_manager(router_id, ns_name, conf)
|
||||
pm.enable(callback)
|
||||
|
||||
@classmethod
|
||||
def _destroy_metadata_proxy(cls, router_id, ns_name, conf):
|
||||
pm = cls._get_metadata_proxy_process_manager(router_id, ns_name, conf)
|
||||
pm.disable()
|
||||
@ -0,0 +1,106 @@
|
||||
# Copyright 2014 OpenStack Foundation.
|
||||
# All Rights Reserved.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
# not use this file except in compliance with the License. You may obtain
|
||||
# a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations
|
||||
# under the License.
|
||||
|
||||
import contextlib
|
||||
|
||||
import mock
|
||||
|
||||
from oslo.config import cfg
|
||||
|
||||
from neutron.agent.common import config as agent_config
|
||||
from neutron.agent.l3 import agent as l3_agent
|
||||
from neutron.agent.metadata import driver as metadata_driver
|
||||
from neutron.openstack.common import uuidutils
|
||||
from neutron.tests import base
|
||||
|
||||
|
||||
_uuid = uuidutils.generate_uuid
|
||||
|
||||
|
||||
class TestMetadataDriver(base.BaseTestCase):
|
||||
|
||||
EUID = 123
|
||||
EGID = 456
|
||||
|
||||
def setUp(self):
|
||||
super(TestMetadataDriver, self).setUp()
|
||||
cfg.CONF.register_opts(l3_agent.L3NATAgent.OPTS)
|
||||
agent_config.register_root_helper(cfg.CONF)
|
||||
|
||||
def test_metadata_nat_rules(self):
|
||||
rules = ('PREROUTING', '-s 0.0.0.0/0 -d 169.254.169.254/32 '
|
||||
'-p tcp -m tcp --dport 80 -j REDIRECT --to-port 8775')
|
||||
self.assertEqual(
|
||||
[rules],
|
||||
metadata_driver.MetadataDriver.metadata_nat_rules(8775))
|
||||
|
||||
def test_metadata_filter_rules(self):
|
||||
rules = ('INPUT', '-s 0.0.0.0/0 -d 127.0.0.1 '
|
||||
'-p tcp -m tcp --dport 8775 -j ACCEPT')
|
||||
self.assertEqual(
|
||||
[rules],
|
||||
metadata_driver.MetadataDriver.metadata_filter_rules(8775))
|
||||
|
||||
def _test_spawn_metadata_proxy(self, expected_user, expected_group,
|
||||
user='', group=''):
|
||||
router_id = _uuid()
|
||||
router_ns = 'qrouter-%s' % router_id
|
||||
metadata_port = 8080
|
||||
ip_class_path = 'neutron.agent.linux.ip_lib.IPWrapper'
|
||||
|
||||
cfg.CONF.set_override('metadata_port', metadata_port)
|
||||
cfg.CONF.set_override('metadata_proxy_user', user)
|
||||
cfg.CONF.set_override('metadata_proxy_group', group)
|
||||
cfg.CONF.set_override('log_file', 'test.log')
|
||||
cfg.CONF.set_override('debug', True)
|
||||
|
||||
driver = metadata_driver.MetadataDriver
|
||||
with contextlib.nested(
|
||||
mock.patch('os.geteuid', return_value=self.EUID),
|
||||
mock.patch('os.getegid', return_value=self.EGID),
|
||||
mock.patch(ip_class_path)) as (geteuid, getegid, ip_mock):
|
||||
driver._spawn_metadata_proxy(router_id, router_ns, cfg.CONF)
|
||||
ip_mock.assert_has_calls([
|
||||
mock.call('sudo', router_ns),
|
||||
mock.call().netns.execute([
|
||||
'neutron-ns-metadata-proxy',
|
||||
mock.ANY,
|
||||
mock.ANY,
|
||||
'--router_id=%s' % router_id,
|
||||
mock.ANY,
|
||||
'--metadata_port=%s' % metadata_port,
|
||||
'--metadata_proxy_user=%s' % expected_user,
|
||||
'--metadata_proxy_group=%s' % expected_group,
|
||||
'--debug',
|
||||
'--verbose',
|
||||
'--log-file=neutron-ns-metadata-proxy-%s.log' %
|
||||
router_id
|
||||
], addl_env=None)
|
||||
])
|
||||
|
||||
def test_spawn_metadata_proxy_with_user(self):
|
||||
self._test_spawn_metadata_proxy('user', self.EGID, user='user')
|
||||
|
||||
def test_spawn_metadata_proxy_with_uid(self):
|
||||
self._test_spawn_metadata_proxy('321', self.EGID, user='321')
|
||||
|
||||
def test_spawn_metadata_proxy_with_group(self):
|
||||
self._test_spawn_metadata_proxy(self.EUID, 'group', group='group')
|
||||
|
||||
def test_spawn_metadata_proxy_with_gid(self):
|
||||
self._test_spawn_metadata_proxy(self.EUID, '654', group='654')
|
||||
|
||||
def test_spawn_metadata_proxy(self):
|
||||
self._test_spawn_metadata_proxy(self.EUID, self.EGID)
|
||||
Loading…
Reference in new issue