Synnefo » snf-ganeti

  "NEW_CLUSTER_CERT_OPT",

  "NEW_HMAC_KEY_OPT",

  "NEW_RAPI_CERT_OPT",

  "RAPI_CERT_OPT",

NEW_CLUSTER_CERT_OPT = cli_option("--new-cluster-certificate",

                                  dest="new_cluster_cert",

                                  default=False, action="store_true",

                                  help="Generate a new cluster certificate")

RAPI_CERT_OPT = cli_option("--rapi-certificate", dest="rapi_cert",

                           default=None,

                           help="File containing new RAPI certificate")

NEW_RAPI_CERT_OPT = cli_option("--new-rapi-certificate", dest="new_rapi_cert",

                               default=None, action="store_true",

                               help=("Generate a new self-signed RAPI"

                                     " certificate"))

NEW_HMAC_KEY_OPT = cli_option("--new-hmac-key", dest="new_hmac_key",

                              default=False, action="store_true",

                              help="Create a new HMAC key")

        <arg choice="opt">-C <replaceable>candidate_pool_size</replaceable></arg>

        The <option>-C</option> option specifies the

      <title>RENEW-CRYPTO</title>

      <cmdsynopsis>

        <command>renew-crypto</command>

        <arg>-f</arg>

        <sbr>

        <arg choice="opt">--new-cluster-certificate</arg>

        <arg choice="opt">--new-hmac-key</arg>

        <sbr>

        <arg choice="opt">--new-rapi-certificate</arg>

        <arg choice="opt">--rapi-certificate <replaceable>rapi-cert</replaceable></arg>

      </cmdsynopsis>

      <para>

        This command will stop all

        Ganeti daemons in the cluster and start them again once the new

        certificates and keys are replicated. The options

        <option>--new-cluster-certificate</option> and

        <option>--new-hmac-key</option> can be used to regenerate the

        cluster-internal SSL certificate respective the HMAC key used by

        <citerefentry>

        <refentrytitle>ganeti-confd</refentrytitle><manvolnum>8</manvolnum>

        </citerefentry>. To generate a new self-signed RAPI certificate (used

        by <citerefentry>

        <refentrytitle>ganeti-rapi</refentrytitle><manvolnum>8</manvolnum>

        </citerefentry>) specify <option>--new-rapi-certificate</option>. If

        you want to use your own certificate, e.g. one signed by a certificate

        authority (CA), pass its filename to

        <option>--rapi-certificate</option>.

      </para>

    </refsect2>

    <refsect2>

  if qa_config.TestEnabled("cluster-renew-crypto"):

    RunTest(qa_cluster.TestClusterRenewCrypto)

    "cluster-renew-crypto": true,

from ganeti import constants

from ganeti import bootstrap

from qa_utils import AssertEqual, AssertNotEqual, StartSSH

def TestClusterRenewCrypto():

  """gnt-cluster renew-crypto"""

  master = qa_config.GetMasterNode()

  # Conflicting options

  cmd = ["gnt-cluster", "renew-crypto", "--force",

         "--new-cluster-certificate", "--new-hmac-key",

         "--new-rapi-certificate", "--rapi-certificate=/dev/null"]

  AssertNotEqual(StartSSH(master["primary"],

                          utils.ShellQuoteArgs(cmd)).wait(), 0)

  # Invalid RAPI certificate

  cmd = ["gnt-cluster", "renew-crypto", "--force",

         "--rapi-certificate=/dev/null"]

  AssertNotEqual(StartSSH(master["primary"],

                          utils.ShellQuoteArgs(cmd)).wait(), 0)

  # Custom RAPI certificate

  fh = tempfile.NamedTemporaryFile()

  # Ensure certificate doesn't cause "gnt-cluster verify" to complain

  validity = constants.SSL_CERT_EXPIRATION_WARN * 3

  bootstrap.GenerateSelfSignedSslCert(fh.name, validity=validity)

  tmpcert = qa_utils.UploadFile(master["primary"], fh.name)

  try:

    cmd = ["gnt-cluster", "renew-crypto", "--force",

           "--rapi-certificate=%s" % tmpcert]

    AssertEqual(StartSSH(master["primary"],

                         utils.ShellQuoteArgs(cmd)).wait(), 0)

  finally:

    cmd = ["rm", "-f", tmpcert]

    AssertEqual(StartSSH(master["primary"],

                         utils.ShellQuoteArgs(cmd)).wait(), 0)

  # Normal case

  cmd = ["gnt-cluster", "renew-crypto", "--force",

         "--new-cluster-certificate", "--new-hmac-key",

         "--new-rapi-certificate"]

  AssertEqual(StartSSH(master["primary"],

                       utils.ShellQuoteArgs(cmd)).wait(), 0)

import OpenSSL

def _RenewCrypto(new_cluster_cert, new_rapi_cert, rapi_cert_filename,

                 new_hmac_key, force):

  """Renews cluster certificates, keys and secrets.

  @type new_cluster_cert: bool

  @param new_cluster_cert: Whether to generate a new cluster certificate

  @type new_rapi_cert: bool

  @param new_rapi_cert: Whether to generate a new RAPI certificate

  @type rapi_cert_filename: string

  @param rapi_cert_filename: Path to file containing new RAPI certificate

  @type new_hmac_key: bool

  @param new_hmac_key: Whether to generate a new HMAC key

  @type force: bool

  @param force: Whether to ask user for confirmation

  """

  assert new_cluster_cert or new_rapi_cert or rapi_cert_filename or new_hmac_key

  if new_rapi_cert and rapi_cert_filename:

    ToStderr("Only one of the --new-rapi-certficate and --rapi-certificate"

             " options can be specified at the same time.")

    return 1

  if rapi_cert_filename:

    # Read and verify new certificate

    try:

      rapi_cert_pem = utils.ReadFile(rapi_cert_filename)

      OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_PEM,

                                      rapi_cert_pem)

    except Exception, err: # pylint: disable-msg=W0703

      ToStderr("Can't load new RAPI certificate from %s: %s" %

               (rapi_cert_filename, str(err)))

      return 1

    try:

      OpenSSL.crypto.load_privatekey(OpenSSL.crypto.FILETYPE_PEM, rapi_cert_pem)

    except Exception, err: # pylint: disable-msg=W0703

      ToStderr("Can't load new RAPI private key from %s: %s" %

               (rapi_cert_filename, str(err)))

      return 1

  else:

    rapi_cert_pem = None

  if not force:

    usertext = ("This requires all daemons on all nodes to be restarted and"

                " may take some time. Continue?")

    if not AskUser(usertext):

      return 1

  def _RenewCryptoInner(ctx):

    ctx.feedback_fn("Updating certificates and keys")

    bootstrap.GenerateClusterCrypto(new_cluster_cert, new_rapi_cert,

                                    new_hmac_key,

                                    rapi_cert_pem=rapi_cert_pem)

    files_to_copy = []

    if new_cluster_cert:

      files_to_copy.append(constants.SSL_CERT_FILE)

    if new_rapi_cert or rapi_cert_pem:

      files_to_copy.append(constants.RAPI_CERT_FILE)

    if new_hmac_key:

      files_to_copy.append(constants.HMAC_CLUSTER_KEY)

    if files_to_copy:

      for node_name in ctx.nonmaster_nodes:

        ctx.feedback_fn("Copying %s to %s" %

                        (", ".join(files_to_copy), node_name))

        for file_name in files_to_copy:

          ctx.ssh.CopyFileToNode(node_name, file_name)

  RunWhileClusterStopped(ToStdout, _RenewCryptoInner)

  ToStdout("All requested certificates and keys have been replaced."

           " Running \"gnt-cluster verify\" now is recommended.")

  return 0

def RenewCrypto(opts, args):

  """Renews cluster certificates, keys and secrets.

  """

  return _RenewCrypto(opts.new_cluster_cert,

                      opts.new_rapi_cert,

                      opts.rapi_cert,

                      opts.new_hmac_key,

                      opts.force)

    ToStderr("Options --no-lvm-storage and --vg-name conflict.")

  if not opts.lvm_storage:

    vg_name = ""

  "renew-crypto": (

    RenewCrypto, ARGS_NONE,

    [NEW_CLUSTER_CERT_OPT, NEW_RAPI_CERT_OPT, RAPI_CERT_OPT, NEW_HMAC_KEY_OPT,

     FORCE_OPT],

    "[opts...]",

    "Renews cluster certificates, keys and secrets"),