18842: Initial work adding disk cache option to configuration
[arvados.git] / lib / config / export.go
1 // Copyright (C) The Arvados Authors. All rights reserved.
2 //
3 // SPDX-License-Identifier: AGPL-3.0
4
5 package config
6
7 import (
8         "encoding/json"
9         "errors"
10         "fmt"
11         "io"
12         "strings"
13
14         "git.arvados.org/arvados.git/sdk/go/arvados"
15 )
16
17 // ExportJSON writes a JSON object with the safe (non-secret) portions
18 // of the cluster config to w.
19 func ExportJSON(w io.Writer, cluster *arvados.Cluster) error {
20         buf, err := json.Marshal(cluster)
21         if err != nil {
22                 return err
23         }
24         var m map[string]interface{}
25         err = json.Unmarshal(buf, &m)
26         if err != nil {
27                 return err
28         }
29
30         // ClusterID is not marshalled by default (see `json:"-"`).
31         // Add it back here so it is included in the exported config.
32         m["ClusterID"] = cluster.ClusterID
33         err = redactUnsafe(m, "", "")
34         if err != nil {
35                 return err
36         }
37         return json.NewEncoder(w).Encode(m)
38 }
39
40 // whitelist classifies configs as safe/unsafe to reveal to
41 // unauthenticated clients.
42 //
43 // Every config entry must either be listed explicitly here along with
44 // all of its parent keys (e.g., "API" + "API.RequestTimeout"), or
45 // have an ancestor listed as false (e.g.,
46 // "PostgreSQL.Connection.password" has an ancestor
47 // "PostgreSQL.Connection" with a false value). Otherwise, it is a bug
48 // which should be caught by tests.
49 //
50 // Example: API.RequestTimeout is safe because whitelist["API"] == and
51 // whitelist["API.RequestTimeout"] == true.
52 //
53 // Example: PostgreSQL.Connection.password is not safe because
54 // whitelist["PostgreSQL.Connection"] == false.
55 //
56 // Example: PostgreSQL.BadKey would cause an error because
57 // whitelist["PostgreSQL"] isn't false, and neither
58 // whitelist["PostgreSQL.BadKey"] nor whitelist["PostgreSQL.*"]
59 // exists.
60 var whitelist = map[string]bool{
61         // | sort -t'"' -k2,2
62         "API":                                      true,
63         "API.AsyncPermissionsUpdateInterval":       false,
64         "API.DisabledAPIs":                         false,
65         "API.FreezeProjectRequiresDescription":     true,
66         "API.FreezeProjectRequiresProperties":      true,
67         "API.FreezeProjectRequiresProperties.*":    true,
68         "API.KeepServiceRequestTimeout":            false,
69         "API.MaxConcurrentRequests":                false,
70         "API.MaxIndexDatabaseRead":                 false,
71         "API.MaxItemsPerResponse":                  true,
72         "API.MaxKeepBlobBuffers":                   false,
73         "API.MaxRequestAmplification":              false,
74         "API.MaxRequestSize":                       true,
75         "API.MaxTokenLifetime":                     false,
76         "API.RequestTimeout":                       true,
77         "API.SendTimeout":                          true,
78         "API.UnfreezeProjectRequiresAdmin":         true,
79         "API.VocabularyPath":                       false,
80         "API.WebsocketClientEventQueue":            false,
81         "API.WebsocketServerEventQueue":            false,
82         "AuditLogs":                                false,
83         "AuditLogs.MaxAge":                         false,
84         "AuditLogs.MaxDeleteBatch":                 false,
85         "AuditLogs.UnloggedAttributes":             false,
86         "ClusterID":                                true,
87         "Collections":                              true,
88         "Collections.BalanceCollectionBatch":       false,
89         "Collections.BalanceCollectionBuffers":     false,
90         "Collections.BalancePeriod":                false,
91         "Collections.BalanceTimeout":               false,
92         "Collections.BalanceUpdateLimit":           false,
93         "Collections.BlobDeleteConcurrency":        false,
94         "Collections.BlobMissingReport":            false,
95         "Collections.BlobReplicateConcurrency":     false,
96         "Collections.BlobSigning":                  true,
97         "Collections.BlobSigningKey":               false,
98         "Collections.BlobSigningTTL":               true,
99         "Collections.BlobTrash":                    false,
100         "Collections.BlobTrashCheckInterval":       false,
101         "Collections.BlobTrashConcurrency":         false,
102         "Collections.BlobTrashLifetime":            false,
103         "Collections.CollectionVersioning":         true,
104         "Collections.DefaultReplication":           true,
105         "Collections.DefaultTrashLifetime":         true,
106         "Collections.ForwardSlashNameSubstitution": true,
107         "Collections.KeepproxyPermission":          false,
108         "Collections.ManagedProperties":            true,
109         "Collections.ManagedProperties.*":          true,
110         "Collections.ManagedProperties.*.*":        true,
111         "Collections.PreserveVersionIfIdle":        true,
112         "Collections.S3FolderObjects":              true,
113         "Collections.TrashSweepInterval":           false,
114         "Collections.TrustAllContent":              true,
115         "Collections.WebDAVCache":                  false,
116         "Collections.WebDAVLogEvents":              false,
117         "Collections.WebDAVPermission":             false,
118         "Containers":                               true,
119         "Containers.AlwaysUsePreemptibleInstances": true,
120         "Containers.CloudVMs":                      false,
121         "Containers.CrunchRunArgumentsList":        false,
122         "Containers.CrunchRunCommand":              false,
123         "Containers.DefaultKeepCacheRAM":           true,
124         "Containers.DefaultKeepCacheDisk":          true,
125         "Containers.DispatchPrivateKey":            false,
126         "Containers.JobsAPI":                       true,
127         "Containers.JobsAPI.Enable":                true,
128         "Containers.JobsAPI.GitInternalDir":        false,
129         "Containers.LocalKeepBlobBuffersPerVCPU":   false,
130         "Containers.LocalKeepLogsToContainerLog":   false,
131         "Containers.Logging":                       false,
132         "Containers.LogReuseDecisions":             false,
133         "Containers.LSF":                           false,
134         "Containers.MaxComputeVMs":                 false,
135         "Containers.MaxDispatchAttempts":           false,
136         "Containers.MaxRetryAttempts":              true,
137         "Containers.MinRetryPeriod":                true,
138         "Containers.PreemptiblePriceFactor":        false,
139         "Containers.ReserveExtraRAM":               true,
140         "Containers.RuntimeEngine":                 true,
141         "Containers.ShellAccess":                   true,
142         "Containers.ShellAccess.Admin":             true,
143         "Containers.ShellAccess.User":              true,
144         "Containers.SLURM":                         false,
145         "Containers.StaleLockTimeout":              false,
146         "Containers.SupportedDockerImageFormats":   true,
147         "Containers.SupportedDockerImageFormats.*": true,
148         "Git":                                  false,
149         "InstanceTypes":                        true,
150         "InstanceTypes.*":                      true,
151         "InstanceTypes.*.*":                    true,
152         "InstanceTypes.*.*.*":                  true,
153         "Login":                                true,
154         "Login.Google":                         true,
155         "Login.Google.AlternateEmailAddresses": false,
156         "Login.Google.AuthenticationRequestParameters":        false,
157         "Login.Google.ClientID":                               false,
158         "Login.Google.ClientSecret":                           false,
159         "Login.Google.Enable":                                 true,
160         "Login.IssueTrustedTokens":                            false,
161         "Login.LDAP":                                          true,
162         "Login.LDAP.AppendDomain":                             false,
163         "Login.LDAP.EmailAttribute":                           false,
164         "Login.LDAP.Enable":                                   true,
165         "Login.LDAP.InsecureTLS":                              false,
166         "Login.LDAP.SearchAttribute":                          false,
167         "Login.LDAP.SearchBase":                               false,
168         "Login.LDAP.SearchBindPassword":                       false,
169         "Login.LDAP.SearchBindUser":                           false,
170         "Login.LDAP.SearchFilters":                            false,
171         "Login.LDAP.StartTLS":                                 false,
172         "Login.LDAP.StripDomain":                              false,
173         "Login.LDAP.URL":                                      false,
174         "Login.LDAP.UsernameAttribute":                        false,
175         "Login.LoginCluster":                                  true,
176         "Login.OpenIDConnect":                                 true,
177         "Login.OpenIDConnect.AcceptAccessToken":               false,
178         "Login.OpenIDConnect.AcceptAccessTokenScope":          false,
179         "Login.OpenIDConnect.AuthenticationRequestParameters": false,
180         "Login.OpenIDConnect.ClientID":                        false,
181         "Login.OpenIDConnect.ClientSecret":                    false,
182         "Login.OpenIDConnect.EmailClaim":                      false,
183         "Login.OpenIDConnect.EmailVerifiedClaim":              false,
184         "Login.OpenIDConnect.Enable":                          true,
185         "Login.OpenIDConnect.Issuer":                          false,
186         "Login.OpenIDConnect.UsernameClaim":                   false,
187         "Login.PAM":                                           true,
188         "Login.PAM.DefaultEmailDomain":                        false,
189         "Login.PAM.Enable":                                    true,
190         "Login.PAM.Service":                                   false,
191         "Login.RemoteTokenRefresh":                            true,
192         "Login.Test":                                          true,
193         "Login.Test.Enable":                                   true,
194         "Login.Test.Users":                                    false,
195         "Login.TokenLifetime":                                 false,
196         "Login.TrustedClients":                                false,
197         "Mail":                                                true,
198         "Mail.EmailFrom":                                      false,
199         "Mail.IssueReporterEmailFrom":                         false,
200         "Mail.IssueReporterEmailTo":                           false,
201         "Mail.MailchimpAPIKey":                                false,
202         "Mail.MailchimpListID":                                false,
203         "Mail.SendUserSetupNotificationEmail":                 false,
204         "Mail.SupportEmailAddress":                            true,
205         "ManagementToken":                                     false,
206         "PostgreSQL":                                          false,
207         "RemoteClusters":                                      true,
208         "RemoteClusters.*":                                    true,
209         "RemoteClusters.*.ActivateUsers":                      true,
210         "RemoteClusters.*.Host":                               true,
211         "RemoteClusters.*.Insecure":                           true,
212         "RemoteClusters.*.Proxy":                              true,
213         "RemoteClusters.*.Scheme":                             true,
214         "Services":                                            true,
215         "Services.*":                                          true,
216         "Services.*.ExternalURL":                              true,
217         "Services.*.InternalURLs":                             false,
218         "StorageClasses":                                      true,
219         "StorageClasses.*":                                    true,
220         "StorageClasses.*.Default":                            true,
221         "StorageClasses.*.Priority":                           true,
222         "SystemLogs":                                          false,
223         "SystemRootToken":                                     false,
224         "TLS":                                                 false,
225         "TLS.Certificate":                                     false,
226         "TLS.Insecure":                                        true,
227         "TLS.Key":                                             false,
228         "Users":                                               true,
229         "Users.ActivatedUsersAreVisibleToOthers":              false,
230         "Users.ActivityLoggingPeriod":                         false,
231         "Users.AdminNotifierEmailFrom":                        false,
232         "Users.AnonymousUserToken":                            true,
233         "Users.AutoAdminFirstUser":                            false,
234         "Users.AutoAdminUserWithEmail":                        false,
235         "Users.AutoSetupNewUsers":                             false,
236         "Users.AutoSetupNewUsersWithRepository":               false,
237         "Users.AutoSetupNewUsersWithVmUUID":                   false,
238         "Users.AutoSetupUsernameBlacklist":                    false,
239         "Users.EmailSubjectPrefix":                            false,
240         "Users.NewInactiveUserNotificationRecipients":         false,
241         "Users.NewUserNotificationRecipients":                 false,
242         "Users.NewUsersAreActive":                             false,
243         "Users.PreferDomainForUsername":                       false,
244         "Users.RoleGroupsVisibleToAll":                        false,
245         "Users.UserNotifierEmailBcc":                          false,
246         "Users.UserNotifierEmailFrom":                         false,
247         "Users.UserProfileNotificationAddress":                false,
248         "Users.UserSetupMailText":                             false,
249         "Volumes":                                             true,
250         "Volumes.*":                                           true,
251         "Volumes.*.*":                                         false,
252         "Volumes.*.AccessViaHosts":                            true,
253         "Volumes.*.AccessViaHosts.*":                          true,
254         "Volumes.*.AccessViaHosts.*.ReadOnly":                 true,
255         "Volumes.*.ReadOnly":                                  true,
256         "Volumes.*.Replication":                               true,
257         "Volumes.*.StorageClasses":                            true,
258         "Volumes.*.StorageClasses.*":                          true,
259         "Workbench":                                           true,
260         "Workbench.ActivationContactLink":                     false,
261         "Workbench.APIClientConnectTimeout":                   true,
262         "Workbench.APIClientReceiveTimeout":                   true,
263         "Workbench.APIResponseCompression":                    true,
264         "Workbench.ApplicationMimetypesWithViewIcon":          true,
265         "Workbench.ApplicationMimetypesWithViewIcon.*":        true,
266         "Workbench.ArvadosDocsite":                            true,
267         "Workbench.ArvadosPublicDataDocURL":                   true,
268         "Workbench.DefaultOpenIdPrefix":                       false,
269         "Workbench.DisableSharingURLsUI":                      true,
270         "Workbench.EnableGettingStartedPopup":                 true,
271         "Workbench.EnablePublicProjectsPage":                  true,
272         "Workbench.FileViewersConfigURL":                      true,
273         "Workbench.IdleTimeout":                               true,
274         "Workbench.InactivePageHTML":                          true,
275         "Workbench.LogViewerMaxBytes":                         true,
276         "Workbench.MultiSiteSearch":                           true,
277         "Workbench.ProfilingEnabled":                          true,
278         "Workbench.Repositories":                              false,
279         "Workbench.RepositoryCache":                           false,
280         "Workbench.RunningJobLogRecordsToFetch":               true,
281         "Workbench.SecretKeyBase":                             false,
282         "Workbench.ShowRecentCollectionsOnDashboard":          true,
283         "Workbench.ShowUserAgreementInline":                   true,
284         "Workbench.ShowUserNotifications":                     true,
285         "Workbench.SiteName":                                  true,
286         "Workbench.SSHHelpHostSuffix":                         true,
287         "Workbench.SSHHelpPageHTML":                           true,
288         "Workbench.Theme":                                     true,
289         "Workbench.UserProfileFormFields":                     true,
290         "Workbench.UserProfileFormFields.*":                   true,
291         "Workbench.UserProfileFormFields.*.*":                 true,
292         "Workbench.UserProfileFormFields.*.*.*":               true,
293         "Workbench.UserProfileFormMessage":                    true,
294         "Workbench.WelcomePageHTML":                           true,
295         "Workbench.BannerURL":                                 true,
296 }
297
298 func redactUnsafe(m map[string]interface{}, mPrefix, lookupPrefix string) error {
299         var errs []string
300         for k, v := range m {
301                 lookupKey := k
302                 safe, ok := whitelist[lookupPrefix+k]
303                 if !ok {
304                         lookupKey = "*"
305                         safe, ok = whitelist[lookupPrefix+"*"]
306                 }
307                 if !ok {
308                         errs = append(errs, fmt.Sprintf("config bug: key %q not in whitelist map", lookupPrefix+k))
309                         continue
310                 }
311                 if !safe {
312                         delete(m, k)
313                         continue
314                 }
315                 if v, ok := v.(map[string]interface{}); ok {
316                         err := redactUnsafe(v, mPrefix+k+".", lookupPrefix+lookupKey+".")
317                         if err != nil {
318                                 errs = append(errs, err.Error())
319                         }
320                 }
321         }
322         if len(errs) > 0 {
323                 return errors.New(strings.Join(errs, "\n"))
324         }
325         return nil
326 }