package ec2
import (
+ "crypto/md5"
+ "crypto/rsa"
+ "crypto/sha1"
+ "crypto/x509"
"encoding/base64"
"encoding/json"
"fmt"
- "log"
+ "math/big"
"strings"
+ "sync"
"git.curoverse.com/arvados.git/lib/cloud"
"git.curoverse.com/arvados.git/sdk/go/arvados"
"golang.org/x/crypto/ssh"
)
-const ARVADOS_DISPATCH_ID = "arvados-dispatch-id"
-const TAG_PREFIX = "arvados-dispatch-tag-"
+const arvadosDispatchID = "arvados-dispatch-id"
+const tagPrefix = "arvados-dispatch-tag-"
// Driver is the ec2 implementation of the cloud.Driver interface.
var Driver = cloud.DriverFunc(newEC2InstanceSet)
type ec2InstanceSetConfig struct {
- AccessKeyID string
- SecretAccessKey string
- Region string
- SecurityGroupId string
- SubnetId string
- AdminUsername string
- KeyPairName string
+ AccessKeyID string
+ SecretAccessKey string
+ Region string
+ SecurityGroupIDs []string
+ SubnetID string
+ AdminUsername string
+ EBSVolumeType string
+}
+
+type ec2Interface interface {
+ DescribeKeyPairs(input *ec2.DescribeKeyPairsInput) (*ec2.DescribeKeyPairsOutput, error)
+ ImportKeyPair(input *ec2.ImportKeyPairInput) (*ec2.ImportKeyPairOutput, error)
+ RunInstances(input *ec2.RunInstancesInput) (*ec2.Reservation, error)
+ DescribeInstances(input *ec2.DescribeInstancesInput) (*ec2.DescribeInstancesOutput, error)
+ CreateTags(input *ec2.CreateTagsInput) (*ec2.CreateTagsOutput, error)
+ TerminateInstances(input *ec2.TerminateInstancesInput) (*ec2.TerminateInstancesOutput, error)
}
type ec2InstanceSet struct {
ec2config ec2InstanceSetConfig
dispatcherID cloud.InstanceSetID
logger logrus.FieldLogger
- client *ec2.EC2
- importedKey bool
+ client ec2Interface
+ keysMtx sync.Mutex
+ keys map[string]string
}
func newEC2InstanceSet(config json.RawMessage, dispatcherID cloud.InstanceSetID, logger logrus.FieldLogger) (prv cloud.InstanceSet, err error) {
"")).
WithRegion(instanceSet.ec2config.Region)
instanceSet.client = ec2.New(session.Must(session.NewSession(awsConfig)))
+ instanceSet.keys = make(map[string]string)
+ if instanceSet.ec2config.EBSVolumeType == "" {
+ instanceSet.ec2config.EBSVolumeType = "gp2"
+ }
return instanceSet, nil
}
+func awsKeyFingerprint(pk ssh.PublicKey) (md5fp string, sha1fp string, err error) {
+ // AWS key fingerprints don't use the usual key fingerprint
+ // you get from ssh-keygen or ssh.FingerprintLegacyMD5()
+ // (you can get that from md5.Sum(pk.Marshal())
+ //
+ // AWS uses the md5 or sha1 of the PKIX DER encoding of the
+ // public key, so calculate those fingerprints here.
+ var rsaPub struct {
+ Name string
+ E *big.Int
+ N *big.Int
+ }
+ if err := ssh.Unmarshal(pk.Marshal(), &rsaPub); err != nil {
+ return "", "", fmt.Errorf("agent: Unmarshal failed to parse public key: %v", err)
+ }
+ rsaPk := rsa.PublicKey{
+ E: int(rsaPub.E.Int64()),
+ N: rsaPub.N,
+ }
+ pkix, _ := x509.MarshalPKIXPublicKey(&rsaPk)
+ md5pkix := md5.Sum([]byte(pkix))
+ sha1pkix := sha1.Sum([]byte(pkix))
+ md5fp = ""
+ sha1fp = ""
+ for i := 0; i < len(md5pkix); i += 1 {
+ md5fp += fmt.Sprintf(":%02x", md5pkix[i])
+ }
+ for i := 0; i < len(sha1pkix); i += 1 {
+ sha1fp += fmt.Sprintf(":%02x", sha1pkix[i])
+ }
+ return md5fp[1:], sha1fp[1:], nil
+}
+
func (instanceSet *ec2InstanceSet) Create(
instanceType arvados.InstanceType,
imageID cloud.ImageID,
initCommand cloud.InitCommand,
publicKey ssh.PublicKey) (cloud.Instance, error) {
- if !instanceSet.importedKey {
- instanceSet.client.ImportKeyPair(&ec2.ImportKeyPairInput{
- KeyName: &instanceSet.ec2config.KeyPairName,
- PublicKeyMaterial: ssh.MarshalAuthorizedKey(publicKey),
+ md5keyFingerprint, sha1keyFingerprint, err := awsKeyFingerprint(publicKey)
+ if err != nil {
+ return nil, fmt.Errorf("Could not make key fingerprint: %v", err)
+ }
+ instanceSet.keysMtx.Lock()
+ var keyname string
+ var ok bool
+ if keyname, ok = instanceSet.keys[md5keyFingerprint]; !ok {
+ keyout, err := instanceSet.client.DescribeKeyPairs(&ec2.DescribeKeyPairsInput{
+ Filters: []*ec2.Filter{&ec2.Filter{
+ Name: aws.String("fingerprint"),
+ Values: []*string{&md5keyFingerprint, &sha1keyFingerprint},
+ }},
})
- instanceSet.importedKey = true
+ if err != nil {
+ return nil, fmt.Errorf("Could not search for keypair: %v", err)
+ }
+
+ if len(keyout.KeyPairs) > 0 {
+ keyname = *(keyout.KeyPairs[0].KeyName)
+ } else {
+ keyname = "arvados-dispatch-keypair-" + md5keyFingerprint
+ _, err := instanceSet.client.ImportKeyPair(&ec2.ImportKeyPairInput{
+ KeyName: &keyname,
+ PublicKeyMaterial: ssh.MarshalAuthorizedKey(publicKey),
+ })
+ if err != nil {
+ return nil, fmt.Errorf("Could not import keypair: %v", err)
+ }
+ }
+ instanceSet.keys[md5keyFingerprint] = keyname
}
+ instanceSet.keysMtx.Unlock()
ec2tags := []*ec2.Tag{
&ec2.Tag{
- Key: aws.String(ARVADOS_DISPATCH_ID),
+ Key: aws.String(arvadosDispatchID),
Value: aws.String(string(instanceSet.dispatcherID)),
},
&ec2.Tag{
}
for k, v := range newTags {
ec2tags = append(ec2tags, &ec2.Tag{
- Key: aws.String(TAG_PREFIX + k),
+ Key: aws.String(tagPrefix + k),
Value: aws.String(v),
})
}
InstanceType: &instanceType.ProviderType,
MaxCount: aws.Int64(1),
MinCount: aws.Int64(1),
- KeyName: &instanceSet.ec2config.KeyPairName,
+ KeyName: &keyname,
NetworkInterfaces: []*ec2.InstanceNetworkInterfaceSpecification{
&ec2.InstanceNetworkInterfaceSpecification{
AssociatePublicIpAddress: aws.Bool(false),
DeleteOnTermination: aws.Bool(true),
DeviceIndex: aws.Int64(0),
- Groups: []*string{&instanceSet.ec2config.SecurityGroupId},
- SubnetId: &instanceSet.ec2config.SubnetId,
+ Groups: aws.StringSlice(instanceSet.ec2config.SecurityGroupIDs),
+ SubnetId: &instanceSet.ec2config.SubnetID,
}},
DisableApiTermination: aws.Bool(false),
InstanceInitiatedShutdownBehavior: aws.String("terminate"),
}},
}
- if instanceType.ExtraScratch > 0 {
+ if instanceType.AddedScratch > 0 {
rii.BlockDeviceMappings = []*ec2.BlockDeviceMapping{&ec2.BlockDeviceMapping{
DeviceName: aws.String("/dev/xvdt"),
Ebs: &ec2.EbsBlockDevice{
DeleteOnTermination: aws.Bool(true),
- VolumeSize: aws.Int64((int64(instanceType.ExtraScratch) / 1000000000) + 1),
- VolumeType: aws.String("gp2"),
+ VolumeSize: aws.Int64((int64(instanceType.AddedScratch) + (1<<30 - 1)) >> 30),
+ VolumeType: &instanceSet.ec2config.EBSVolumeType,
}}}
}
func (instanceSet *ec2InstanceSet) Instances(cloud.InstanceTags) (instances []cloud.Instance, err error) {
dii := &ec2.DescribeInstancesInput{
Filters: []*ec2.Filter{&ec2.Filter{
- Name: aws.String("tag:" + ARVADOS_DISPATCH_ID),
+ Name: aws.String("tag:" + arvadosDispatchID),
Values: []*string{aws.String(string(instanceSet.dispatcherID))},
}}}
for _, rsv := range dio.Reservations {
for _, inst := range rsv.Instances {
- instances = append(instances, &ec2Instance{instanceSet, inst})
+ if *inst.State.Name != "shutting-down" && *inst.State.Name != "terminated" {
+ instances = append(instances, &ec2Instance{instanceSet, inst})
+ }
}
}
if dio.NextToken == nil {
func (inst *ec2Instance) SetTags(newTags cloud.InstanceTags) error {
ec2tags := []*ec2.Tag{
&ec2.Tag{
- Key: aws.String(ARVADOS_DISPATCH_ID),
+ Key: aws.String(arvadosDispatchID),
Value: aws.String(string(inst.provider.dispatcherID)),
},
}
for k, v := range newTags {
ec2tags = append(ec2tags, &ec2.Tag{
- Key: aws.String(TAG_PREFIX + k),
+ Key: aws.String(tagPrefix + k),
Value: aws.String(v),
})
}
tags := make(map[string]string)
for _, t := range inst.instance.Tags {
- if strings.HasPrefix(*t.Key, TAG_PREFIX) {
- tags[(*t.Key)[len(TAG_PREFIX):]] = *t.Value
+ if strings.HasPrefix(*t.Key, tagPrefix) {
+ tags[(*t.Key)[len(tagPrefix):]] = *t.Value
}
}
}
func (inst *ec2Instance) Destroy() error {
- log.Printf("terminating %v", *inst.instance.InstanceId)
_, err := inst.provider.client.TerminateInstances(&ec2.TerminateInstancesInput{
InstanceIds: []*string{inst.instance.InstanceId},
})