Product license verification in Console (#518)
Operator UI - Provide and store License key - New License section in Operator UI will allow user to provide the license key via input form - New License section in Operator UI will allow the user to fetch the license key using subnet credentials - Console backend has to verify provided license is valid - https://godoc.org/github.com/minio/minio/pkg/licverifier#example-package - Console backend has to store the license key in k8s secrets Operator UI - Set license to tenant during provisioning - Check if license key exists in k8s secret during tenant creation - If License is present attach the license-key jwt to the new console tenant via an environment variable Operator UI - Set license for an existing tenant - Tenant view will display information about the current status of the Tenant License - If Tenant doesn't have a License then Operator-UI will allow to attach new license by clicking the Add License button - Console backend will extract the license from the k8s secret and save the license-key jwt in the tenant console environment variable and redeploy
This commit is contained in:
Lenin Alevski
GitHub
273
restapi/admin_subscription.go
Normal file
273
restapi/admin_subscription.go
Normal file
@@ -0,0 +1,273 @@
|
||||
// This file is part of MinIO Console Server
|
||||
// Copyright (c) 2020 MinIO, Inc.
|
||||
//
|
||||
// This program is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU Affero General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU Affero General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU Affero General Public License
|
||||
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
//
|
||||
|
||||
package restapi
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"log"
|
||||
"time"
|
||||
|
||||
operator "github.com/minio/operator/pkg/apis/minio.min.io/v1"
|
||||
|
||||
"github.com/minio/console/pkg/acl"
|
||||
|
||||
"github.com/minio/console/cluster"
|
||||
"github.com/minio/console/pkg/subnet"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
|
||||
"github.com/go-openapi/runtime/middleware"
|
||||
"github.com/minio/console/models"
|
||||
"github.com/minio/console/restapi/operations"
|
||||
"github.com/minio/console/restapi/operations/admin_api"
|
||||
)
|
||||
|
||||
func registerSubscriptionHandlers(api *operations.ConsoleAPI) {
|
||||
// Validate subscription handler
|
||||
api.AdminAPISubscriptionValidateHandler = admin_api.SubscriptionValidateHandlerFunc(func(params admin_api.SubscriptionValidateParams, session *models.Principal) middleware.Responder {
|
||||
license, err := getSubscriptionValidateResponse(session, params.Body)
|
||||
if err != nil {
|
||||
return admin_api.NewSubscriptionValidateDefault(int(err.Code)).WithPayload(err)
|
||||
}
|
||||
return admin_api.NewSubscriptionValidateOK().WithPayload(license)
|
||||
})
|
||||
// Activate license subscription for a particular tenant
|
||||
api.AdminAPISubscriptionActivateHandler = admin_api.SubscriptionActivateHandlerFunc(func(params admin_api.SubscriptionActivateParams, session *models.Principal) middleware.Responder {
|
||||
err := getSubscriptionActivateResponse(session, params.Namespace, params.Tenant)
|
||||
if err != nil {
|
||||
return admin_api.NewSubscriptionActivateDefault(int(err.Code)).WithPayload(err)
|
||||
}
|
||||
return admin_api.NewSubscriptionActivateNoContent()
|
||||
})
|
||||
// Get subscription information handler
|
||||
api.AdminAPISubscriptionInfoHandler = admin_api.SubscriptionInfoHandlerFunc(func(params admin_api.SubscriptionInfoParams, session *models.Principal) middleware.Responder {
|
||||
license, err := getSubscriptionInfoResponse(session)
|
||||
if err != nil {
|
||||
return admin_api.NewSubscriptionInfoDefault(int(err.Code)).WithPayload(err)
|
||||
}
|
||||
return admin_api.NewSubscriptionInfoOK().WithPayload(license)
|
||||
})
|
||||
}
|
||||
|
||||
// addSubscriptionLicenseToTenant replace existing console tenant secret and adds the subnet license key
|
||||
func addSubscriptionLicenseToTenant(ctx context.Context, clientSet K8sClientI, license, namespace, tenantName, secretName string) error {
|
||||
// Retrieve console secret for Tenant
|
||||
consoleSecret, err := clientSet.getSecret(ctx, namespace, secretName, metav1.GetOptions{})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
// Copy current console secret
|
||||
dataNewSecret := consoleSecret.Data
|
||||
// Add subnet license to the new console secret
|
||||
dataNewSecret[ConsoleSubnetLicense] = []byte(license)
|
||||
// Delete existing console secret
|
||||
err = clientSet.deleteSecret(ctx, cluster.Namespace, secretName, metav1.DeleteOptions{})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
// Prepare the new Console Secret
|
||||
imm := true
|
||||
newConsoleSecret := &corev1.Secret{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: secretName,
|
||||
Labels: map[string]string{
|
||||
operator.TenantLabel: tenantName,
|
||||
},
|
||||
},
|
||||
Immutable: &imm,
|
||||
Data: dataNewSecret,
|
||||
}
|
||||
// Create new Console secret with the subnet License
|
||||
_, err = clientSet.createSecret(ctx, cluster.Namespace, newConsoleSecret, metav1.CreateOptions{})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
// restart Console pods based on label:
|
||||
// v1.min.io/console: TENANT-console
|
||||
err = clientSet.deletePodCollection(ctx, namespace, metav1.DeleteOptions{}, metav1.ListOptions{
|
||||
LabelSelector: fmt.Sprintf("%s=%s%s", operator.ConsoleTenantLabel, tenantName, operator.ConsoleName),
|
||||
})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func getSubscriptionActivateResponse(session *models.Principal, namespace, tenant string) *models.Error {
|
||||
// 20 seconds timeout
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
|
||||
defer cancel()
|
||||
opClientClientSet, err := cluster.OperatorClient(session.STSSessionToken)
|
||||
if err != nil {
|
||||
return prepareError(errorGeneric, nil, err)
|
||||
}
|
||||
clientSet, err := cluster.K8sClient(session.STSSessionToken)
|
||||
if err != nil {
|
||||
return prepareError(errorGeneric, nil, err)
|
||||
}
|
||||
opClient := &operatorClient{
|
||||
client: opClientClientSet,
|
||||
}
|
||||
minTenant, err := getTenant(ctx, opClient, namespace, tenant)
|
||||
if err != nil {
|
||||
return prepareError(err, errorGeneric)
|
||||
}
|
||||
// If console is not deployed for this tenant return an error
|
||||
if minTenant.Spec.Console == nil {
|
||||
return prepareError(errorGenericNotFound)
|
||||
}
|
||||
|
||||
// configure kubernetes client
|
||||
k8sClient := k8sClient{
|
||||
client: clientSet,
|
||||
}
|
||||
// Get cluster subscription license
|
||||
license, err := getSubscriptionLicense(ctx, &k8sClient, cluster.Namespace, OperatorSubnetLicenseSecretName)
|
||||
if err != nil {
|
||||
return prepareError(errInvalidCredentials, nil, err)
|
||||
}
|
||||
// add subscription license to existing console Tenant
|
||||
if err = addSubscriptionLicenseToTenant(ctx, &k8sClient, license, namespace, tenant, minTenant.Spec.Console.ConsoleSecret.Name); err != nil {
|
||||
return prepareError(err, errorGeneric)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// saveSubscriptionLicense will create or replace an existing subnet license secret in the k8s cluster
|
||||
func saveSubscriptionLicense(ctx context.Context, clientSet K8sClientI, license string) error {
|
||||
// Delete subnet license secret if exists
|
||||
err := clientSet.deleteSecret(ctx, cluster.Namespace, OperatorSubnetLicenseSecretName, metav1.DeleteOptions{})
|
||||
if err != nil {
|
||||
// log the error if any and continue
|
||||
log.Println(err)
|
||||
}
|
||||
// Save subnet license in k8s secrets
|
||||
imm := true
|
||||
licenseSecret := &corev1.Secret{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: OperatorSubnetLicenseSecretName,
|
||||
},
|
||||
Immutable: &imm,
|
||||
Data: map[string][]byte{
|
||||
ConsoleSubnetLicense: []byte(license),
|
||||
},
|
||||
}
|
||||
_, err = clientSet.createSecret(ctx, cluster.Namespace, licenseSecret, metav1.CreateOptions{})
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// subscriptionValidate will validate the provided jwt license against the subnet public key
|
||||
func subscriptionValidate(client cluster.HTTPClientI, license, email, password string) (*models.License, string, error) {
|
||||
licenseInfo, rawLicense, err := subnet.ValidateLicense(client, license, email, password)
|
||||
if err != nil {
|
||||
return nil, "", err
|
||||
}
|
||||
return &models.License{
|
||||
Email: licenseInfo.Email,
|
||||
AccountID: licenseInfo.AccountID,
|
||||
StorageCapacity: licenseInfo.StorageCapacity,
|
||||
Plan: licenseInfo.ServiceType,
|
||||
ExpiresAt: licenseInfo.ExpiresAt.String(),
|
||||
Organization: licenseInfo.TeamName,
|
||||
}, rawLicense, nil
|
||||
}
|
||||
|
||||
// getSubscriptionValidateResponse
|
||||
func getSubscriptionValidateResponse(session *models.Principal, params *models.SubscriptionValidateRequest) (*models.License, *models.Error) {
|
||||
// 20 seconds timeout
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
|
||||
defer cancel()
|
||||
|
||||
client := &cluster.HTTPClient{
|
||||
Client: GetConsoleSTSClient(),
|
||||
}
|
||||
// validate license key
|
||||
licenseInfo, license, err := subscriptionValidate(client, params.License, params.Email, params.Password)
|
||||
if err != nil {
|
||||
return nil, prepareError(errInvalidLicense, nil, err)
|
||||
}
|
||||
// configure kubernetes client
|
||||
clientSet, err := cluster.K8sClient(session.STSSessionToken)
|
||||
k8sClient := k8sClient{
|
||||
client: clientSet,
|
||||
}
|
||||
if err != nil {
|
||||
return nil, prepareError(errorGeneric, nil, err)
|
||||
}
|
||||
// save license key to k8s
|
||||
if err = saveSubscriptionLicense(ctx, &k8sClient, license); err != nil {
|
||||
return nil, prepareError(errorGeneric, nil, err)
|
||||
}
|
||||
return licenseInfo, nil
|
||||
}
|
||||
|
||||
// getSubscriptionLicense will retrieve stored license jwt from k8s secret
|
||||
func getSubscriptionLicense(ctx context.Context, clientSet K8sClientI, namespace, secretName string) (string, error) {
|
||||
// retrieve license stored in k8s
|
||||
licenseSecret, err := clientSet.getSecret(ctx, namespace, secretName, metav1.GetOptions{})
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
license, ok := licenseSecret.Data[ConsoleSubnetLicense]
|
||||
if !ok {
|
||||
log.Println("subnet secret doesn't contain jwt license")
|
||||
return "", errorGeneric
|
||||
}
|
||||
return string(license), nil
|
||||
}
|
||||
|
||||
// getSubscriptionInfoResponse returns information about the current configured subnet license for Console
|
||||
func getSubscriptionInfoResponse(session *models.Principal) (*models.License, *models.Error) {
|
||||
// 20 seconds timeout
|
||||
ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
|
||||
defer cancel()
|
||||
var licenseInfo *models.License
|
||||
var license string
|
||||
client := &cluster.HTTPClient{
|
||||
Client: GetConsoleSTSClient(),
|
||||
}
|
||||
// If Console is running in operator mode retrieve License stored in K8s secrets
|
||||
if acl.GetOperatorMode() {
|
||||
// configure kubernetes client
|
||||
clientSet, err := cluster.K8sClient(session.STSSessionToken)
|
||||
if err != nil {
|
||||
return nil, prepareError(errInvalidLicense, nil, err)
|
||||
}
|
||||
k8sClient := k8sClient{
|
||||
client: clientSet,
|
||||
}
|
||||
// Get cluster subscription license
|
||||
license, err = getSubscriptionLicense(ctx, &k8sClient, cluster.Namespace, OperatorSubnetLicenseSecretName)
|
||||
if err != nil {
|
||||
return nil, prepareError(errLicenseNotFound, nil, err)
|
||||
}
|
||||
} else {
|
||||
// If Console is running in Tenant Admin mode retrieve license from env variable
|
||||
license = GetSubnetLicense()
|
||||
}
|
||||
// validate license key and obtain license info
|
||||
licenseInfo, _, err := subscriptionValidate(client, license, "", "")
|
||||
if err != nil {
|
||||
return nil, prepareError(errLicenseNotFound, nil, err)
|
||||
}
|
||||
return licenseInfo, nil
|
||||
}
|
||||
Reference in New Issue
Block a user