feat(config): enable strict config-check before deploying

* modify pillars and examples to pass config-check

BREAKING CHANGE: the configuration file now is checked before deployment
to make sure it's valid. As keys and tokens now are checked to make sure
they comply with Arvados' requirements, old configurations might fail to
deploy

diff --git a/arvados/config/file.sls b/arvados/config/file.sls
index fb9ab6733548ca251c241700431226d35ab7c731..4d997217ebd924ce4328b0adc9e8be2197979806 100644 (file)
--- a/arvados/config/file.sls
+++ b/arvados/config/file.sls
@@ -25,6 +25,6 @@ arvados-config-file-file-managed:
     - template: jinja
     - context:
         arvados: {{ arvados | json }}
-    - check_cmd: /usr/bin/arvados-server config-dump -config
+    - check_cmd: {{ arvados.config.check_command }}
     - require:
       - pkg: arvados-config-package-install-pkg-installed

diff --git a/arvados/defaults.yaml b/arvados/defaults.yaml
index da441d0db388342eee3cff9f79d610d72d1ff5d7..d737ee487e17490a35a09ff5bc923aeb9ca2bdeb 100644 (file)
--- a/arvados/defaults.yaml
+++ b/arvados/defaults.yaml
@@ -37,14 +37,13 @@ arvados:
     user: root
     group: root
     mode: 640
+    check_command: /usr/bin/arvados-server config-check -config
 
   # Experimental feature
   # only available when 'release: development'
   auto_reload_config: false
 
   cluster:
-    force_legacy_api14: false
-
     database:
       connection_pool_max: 32
 

diff --git a/arvados/files/default/config.tmpl.jinja b/arvados/files/default/config.tmpl.jinja
index 9c9db2fe4e6cb43d331b39b77037f1a1de5ee6ba..017c6722a6fb61ad7a95a039d5034b17ba7f1c6a 100644 (file)
--- a/arvados/files/default/config.tmpl.jinja
+++ b/arvados/files/default/config.tmpl.jinja
@@ -19,8 +19,6 @@ Clusters:
     SystemRootToken: {{ arvados.cluster.tokens.system_root | yaml_encode }}
     ManagementToken: {{ arvados.cluster.tokens.management | yaml_encode }}
 
-    ForceLegacyAPI14: {{ arvados.cluster.force_legacy_api14 }}
-
     API:
     {%- if 'API' in arvados.cluster %}
       {{ arvados.cluster.API | default('') | yaml(False) | indent(6) }}

diff --git a/pillar.example b/pillar.example
index b8acf4514745c336e45e6dfb0fd8ef516e05bcbd..4105b66ce3c4673b6d4150503a8c87442d58d8d7 100644 (file)
--- a/pillar.example
+++ b/pillar.example
@@ -8,23 +8,23 @@ arvados:
   ### GENERAL CONFIG
   # version: '2.1.0'
   # release: production
-  ## It makes little sense to disable this flag, but you can, if you want :)
+  ### It makes little sense to disable this flag, but you can, if you want :)
   # use_upstream_repo: true
 
-  ## Repo URL is built with grains values. If desired, it can be completely
-  ## overwritten with the pillar parameter 'repo_url'
+  ### Repo URL is built with grains values. If desired, it can be completely
+  ### overwritten with the pillar parameter 'repo_url'
   # repo:
   #   humanname: Arvados Official Repository
 
-  ## IMPORTANT!!!!!
-  ## api, workbench and shell require some gems, so you need to make sure ruby
-  ## and deps are installed in order to install and compile the gems.
-  ## We default to `false` in these two variables as it's expected you already
-  ## manage OS packages with some other tool and you don't want us messing up
-  ## with your setup.
+  # IMPORTANT!!!!!
+  # api, workbench and shell require some gems, so you need to make sure ruby
+  # and deps are installed in order to install and compile the gems.
+  # We default to `false` in these two variables as it's expected you already
+  # manage OS packages with some other tool and you don't want us messing up
+  # with your setup.
   ruby:
-    ## We set these to `true` here for testing purposes.
-    ## They both default to `false`.
+    # We set these to `true` here for testing purposes.
+    # They both default to `false`.
     manage_ruby: true
     use_rvm: false     # If you want to use rvm. Defaults to true for centos-7
     # pkg: ruby        # Can specify a version like ruby-2.5.7 for rvm
@@ -47,11 +47,26 @@ arvados:
   # config:
   #   file: /etc/arvados/config.yml
   #   user: root
-  ## IMPORTANT!!!!!
-  ## If you're intalling any of the rails apps (api, workbench), the group
-  ## should be set to that of the web server, usually `www-data`
+  ### IMPORTANT!!!!!
+  ### If you're intalling any of the rails apps (api, workbench), the group
+  ### should be set to that of the web server, usually `www-data`
   #   group: root
   #   mode: 640
+  #
+  ### This is the command run to verify the configuration is correct before
+  ### deploying it. By default it uses `-strict=true`, so it will error on
+  ### warnings (ie, unknown/deprecated parameters)
+  #
+  #   check_command: /usr/bin/arvados-server config-check -config
+  #
+  ### To fail only on errors, you can use
+  #
+  #   check_command: /usr/bin/arvados-server config-check -strict=false -config
+  #
+  ### and to disable configuration checking (not recommended), just set it to
+  ### any command that returns true
+  #
+  #   check_command: /bin/true
 
   ### ARVADOS CLUSTER CONFIG
   cluster:
@@ -68,9 +83,9 @@ arvados:
       # You can pass extra database connections parameters here,
       # which will be rendered as yaml.
       # extra_conn_params:
-      #  sslmode: prefer
-      #  verify-ca: false
-      #  client_encoding: UTF8
+      #   sslmode: prefer
+      #   verify-ca: false
+      #   client_encoding: UTF8
 
 
     tls:
@@ -84,25 +99,21 @@ arvados:
       # Secrets and tokens have to be +32 alphanumeric,
       # it does not accept underscores or special characters.
       # See https://dev.arvados.org/issues/17150
-      system_root: changemesystemroottoken
-      management: changememanagementtoken
+      system_root: systemroottokenmushaveatleast32characters
+      management: managementtokenmushaveatleast32characters
       # The AnonymousUserToken can be set here or in the
-      # USers dictionary below. The latter will be used if set.
-      anonymous_user: changemeanonymoususertoken
+      # Users dictionary below. The latter will be used if set.
+      anonymous_user: anonymoususertokenmushaveatleast32characters
 
     ### KEYS
     secrets:
-      blob_signing_key: changemeblobsigningkey
-      workbench_secret_key: changemeworkbenchsecretkey
+      blob_signing_key: blobsigningkeymushaveatleast32characters
+      workbench_secret_key: workbenchsecretkeymushaveatleast32characters
       dispatcher_access_key: changemedispatcheraccesskey
       dispatcher_secret_key: changemedispatchersecretkey
       keep_access_key: changemekeepaccesskey
       keep_secret_key: changemekeepsecretkey
 
-    AuditLogs:
-      Section_to_ignore:
-        - some_random_value
-
     ### VOLUMES
     ## This should usually match all your `keepstore` instances
     Volumes:

diff --git a/test/integration/workbench/controls/config_spec.rb b/test/integration/workbench/controls/config_spec.rb
index 9a14383d7ed27d0210a804993e7ecb316cdf8b97..8e33e84ebb8c507a9b51671802f4c3a7bf2bbfb5 100644 (file)
--- a/test/integration/workbench/controls/config_spec.rb
+++ b/test/integration/workbench/controls/config_spec.rb
@@ -2,7 +2,7 @@
 
 workbench_config = <<-WORKBENCH_STANZA
     Workbench:
-      SecretKeyBase: "changemeworkbenchsecretkey"
+      SecretKeyBase: "workbenchsecretkeymushaveatleast32characters"
       SiteName: FIXME
 WORKBENCH_STANZA
 

diff --git a/test/salt/pillar/arvados.sls b/test/salt/pillar/arvados.sls
index 635b894e759ca0b87a361e8d5e61570e328b88d6..d8117c62537ae3676a4bcd87bf3bc6cda57d5148 100644 (file)
--- a/test/salt/pillar/arvados.sls
+++ b/test/salt/pillar/arvados.sls
@@ -57,23 +57,19 @@ arvados:
 
     ### TOKENS
     tokens:
-      system_root: changemesystemroottoken
-      management: changememanagementtoken
+      system_root: systemroottokenmushaveatleast32characters
+      management: managementtokenmushaveatleast32characters
       anonymous_user: anonymoususertokensetinthetokensdict
 
     ### KEYS
     secrets:
-      blob_signing_key: changemeblobsigningkey
-      workbench_secret_key: changemeworkbenchsecretkey
+      blob_signing_key: blobsigningkeymushaveatleast32characters
+      workbench_secret_key: workbenchsecretkeymushaveatleast32characters
       dispatcher_access_key: changemedispatcheraccesskey
       dispatcher_secret_key: changemedispatchersecretkey
       keep_access_key: changemekeepaccesskey
       keep_secret_key: changemekeepsecretkey
 
-    AuditLogs:
-      Section_to_ignore:
-        - some_random_value
-
     ### VOLUMES
     ## This should usually match all your `keepstore` instances
     Volumes:

diff --git a/test/salt/pillar/arvados_dev.sls b/test/salt/pillar/arvados_dev.sls
index 1dcc78b8844db43c9b547f8de49806599fb47f5e..2160b938dbde5660f67e65a5b33f231305b65a35 100644 (file)
--- a/test/salt/pillar/arvados_dev.sls
+++ b/test/salt/pillar/arvados_dev.sls
@@ -83,22 +83,18 @@ arvados:
 
     ### TOKENS
     tokens:
-      system_root: changemesystemroottoken
-      management: changememanagementtoken
+      system_root: systemroottokenmushaveatleast32characters
+      management: managementtokenmushaveatleast32characters
 
     ### KEYS
     secrets:
-      blob_signing_key: changemeblobsigningkey
-      workbench_secret_key: changemeworkbenchsecretkey
+      blob_signing_key: blobsigningkeymushaveatleast32characters
+      workbench_secret_key: workbenchsecretkeymushaveatleast32characters
       dispatcher_access_key: changemedispatcheraccesskey
       dispatcher_secret_key: changemedispatchersecretkey
       keep_access_key: changemekeepaccesskey
       keep_secret_key: changemekeepsecretkey
 
-    AuditLogs:
-      Section_to_ignore:
-        - some_random_value
-
     ### VOLUMES
     ## This should usually match all your `keepstore` instances
     Volumes: