From 0d11f61ddd0bee6a679956ef2c15b868fa825add Mon Sep 17 00:00:00 2001 From: Tom Clegg Date: Mon, 25 Nov 2019 15:32:21 -0500 Subject: [PATCH] 15720: Warn about empty ManagementToken or SystemRootToken. Arvados-DCO-1.1-Signed-off-by: Tom Clegg --- .../management-token.html.textile.liquid | 33 ++++++++++--------- lib/config/cmd.go | 27 ++++++++++++++- lib/config/cmd_test.go | 18 +++++----- 3 files changed, 54 insertions(+), 24 deletions(-) diff --git a/doc/admin/management-token.html.textile.liquid b/doc/admin/management-token.html.textile.liquid index 5380f38f9c..cf3e273ceb 100644 --- a/doc/admin/management-token.html.textile.liquid +++ b/doc/admin/management-token.html.textile.liquid @@ -16,17 +16,6 @@ Services must have ManagementToken configured. This is used to authorize access To access a monitoring endpoint, the requester must provide the HTTP header @Authorization: Bearer (ManagementToken)@. -h2. API server - -Set @ManagementToken@ in the appropriate section of @application.yml@ - -
-production:
-  # Token to be included in all healthcheck requests. Disabled by default.
-  # Server expects request header of the format "Authorization: Bearer xxx"
-  ManagementToken: xxx
-
- h2. Node Manager Set @port@ (the listen port) and @ManagementToken@ in the @Manage@ section of @node-manager.ini@. @@ -45,12 +34,26 @@ Set @port@ (the listen port) and @ManagementToken@ in the @Manage@ section of @n ManagementToken = xxx -h2. Other services +h2. API server and other services -The following services also support monitoring. Set @ManagementToken@ in the respective yaml config file for each service. +The following services also support monitoring. +* API server +* arv-git-httpd +* controller +* keep-balance +* keepproxy * keepstore * keep-web -* keepproxy -* arv-git-httpd * websockets + +Set @ManagementToken@ in the appropriate section of @/etc/arvados/config.yml@. + + +
Clusters:
+  uuid_prefix:
+    # Token to be included in all healthcheck requests. Disabled by default.
+    # Server expects request header of the format "Authorization: Bearer xxx"
+    ManagementToken: xxx
+
+ diff --git a/lib/config/cmd.go b/lib/config/cmd.go index e9ceaca864..1ca278391a 100644 --- a/lib/config/cmd.go +++ b/lib/config/cmd.go @@ -12,6 +12,7 @@ import ( "os" "os/exec" + "git.curoverse.com/arvados.git/sdk/go/arvados" "git.curoverse.com/arvados.git/sdk/go/ctxlog" "github.com/ghodss/yaml" "github.com/sirupsen/logrus" @@ -124,6 +125,10 @@ func (checkCommand) RunCommand(prog string, args []string, stdin io.Reader, stdo if err != nil { return 1 } + problems := false + if warnAboutProblems(logger, withDepr) { + problems = true + } cmd := exec.Command("diff", "-u", "--label", "without-deprecated-configs", "--label", "relying-on-deprecated-configs", "/dev/fd/3", "/dev/fd/4") for _, obj := range []interface{}{withoutDepr, withDepr} { y, _ := yaml.Marshal(obj) @@ -153,7 +158,27 @@ func (checkCommand) RunCommand(prog string, args []string, stdin io.Reader, stdo if logbuf.Len() > 0 { return 1 } - return 0 + + if problems { + return 1 + } else { + return 0 + } +} + +func warnAboutProblems(logger logrus.FieldLogger, cfg *arvados.Config) bool { + warned := false + for id, cc := range cfg.Clusters { + if cc.SystemRootToken == "" { + logger.Warnf("Clusters.%s.SystemRootToken is empty; see https://doc.arvados.org/master/install/install-keepstore.html", id) + warned = true + } + if cc.ManagementToken == "" { + logger.Warnf("Clusters.%s.ManagementToken is empty; see https://doc.arvados.org/admin/management-token.html", id) + warned = true + } + } + return warned } var DumpDefaultsCommand defaultsCommand diff --git a/lib/config/cmd_test.go b/lib/config/cmd_test.go index fb1cba38b4..c275e4c35b 100644 --- a/lib/config/cmd_test.go +++ b/lib/config/cmd_test.go @@ -30,25 +30,27 @@ func (s *CommandSuite) SetUpSuite(c *check.C) { os.Unsetenv("ARVADOS_API_TOKEN") } -func (s *CommandSuite) TestBadArg(c *check.C) { +func (s *CommandSuite) TestDump_BadArg(c *check.C) { var stderr bytes.Buffer code := DumpCommand.RunCommand("arvados config-dump", []string{"-badarg"}, bytes.NewBuffer(nil), bytes.NewBuffer(nil), &stderr) c.Check(code, check.Equals, 2) c.Check(stderr.String(), check.Matches, `(?ms)flag provided but not defined: -badarg\nUsage:\n.*`) } -func (s *CommandSuite) TestEmptyInput(c *check.C) { +func (s *CommandSuite) TestDump_EmptyInput(c *check.C) { var stdout, stderr bytes.Buffer code := DumpCommand.RunCommand("arvados config-dump", []string{"-config", "-"}, &bytes.Buffer{}, &stdout, &stderr) c.Check(code, check.Equals, 1) c.Check(stderr.String(), check.Matches, `config does not define any clusters\n`) } -func (s *CommandSuite) TestCheckNoDeprecatedKeys(c *check.C) { +func (s *CommandSuite) TestCheck_NoWarnings(c *check.C) { var stdout, stderr bytes.Buffer in := ` Clusters: z1234: + ManagementToken: xyzzy + SystemRootToken: xyzzy API: MaxItemsPerResponse: 1234 PostgreSQL: @@ -73,7 +75,7 @@ Clusters: c.Check(stderr.String(), check.Equals, "") } -func (s *CommandSuite) TestCheckDeprecatedKeys(c *check.C) { +func (s *CommandSuite) TestCheck_DeprecatedKeys(c *check.C) { var stdout, stderr bytes.Buffer in := ` Clusters: @@ -86,7 +88,7 @@ Clusters: c.Check(stdout.String(), check.Matches, `(?ms).*\n\- +.*MaxItemsPerResponse: 1000\n\+ +MaxItemsPerResponse: 1234\n.*`) } -func (s *CommandSuite) TestCheckOldKeepstoreConfigFile(c *check.C) { +func (s *CommandSuite) TestCheck_OldKeepstoreConfigFile(c *check.C) { f, err := ioutil.TempFile("", "") c.Assert(err, check.IsNil) defer os.Remove(f.Name()) @@ -106,7 +108,7 @@ Clusters: c.Check(stderr.String(), check.Matches, `(?ms).*you should remove the legacy keepstore config file.*\n`) } -func (s *CommandSuite) TestCheckUnknownKey(c *check.C) { +func (s *CommandSuite) TestCheck_UnknownKey(c *check.C) { var stdout, stderr bytes.Buffer in := ` Clusters: @@ -130,7 +132,7 @@ Clusters: c.Check(stderr.String(), check.Matches, `(?ms).*unexpected object in config entry: Clusters.z1234.PostgreSQL.ConnectionPool"\n.*`) } -func (s *CommandSuite) TestDumpFormatting(c *check.C) { +func (s *CommandSuite) TestDump_Formatting(c *check.C) { var stdout, stderr bytes.Buffer in := ` Clusters: @@ -149,7 +151,7 @@ Clusters: c.Check(stdout.String(), check.Matches, `(?ms).*http://localhost:12345: {}\n.*`) } -func (s *CommandSuite) TestDumpUnknownKey(c *check.C) { +func (s *CommandSuite) TestDump_UnknownKey(c *check.C) { var stdout, stderr bytes.Buffer in := ` Clusters: -- 2.30.2