Support for de-novo creation of all the OpenShift / NFS fixtures (in namespace wwp-int)

Restore-Connector-doc.md

@@ -0,0 +1,20 @@
+# Temporary documentation about how to utilize ssh or oc connector for the restore-from-prod task set
+Targeted tasks by the connector: 
+    wp-ops/ansible/inventory/wp-int/wordpress-instances
+    wp-ops/ansible/roles/wordpress-instance/tasks/restore-from-prod.yml
+
+Prerequisits:
+    logged in oc on project "wp-int"
+    running mgmt pod on project "wp-int"
+    running desired httpd pod for the desired restores on project "wp-int"
+    export mgmt ssh port to desired local port:
+        `oc port-forward -n wp-int <mgmt_pod_name> <local_port>:22`
+    change `port` variable in wp-ops/ansible/inventory/wp-int/wordpress-instances to be equal to `<local_port>` (default local port is 2222)
+
+Usage:
+    ```
+    cd wp-ops/ansible
+    ./wpsible -l <group> --connector <connector>
+    ```
+    where <connector> is either `ssh` or `oc`
+    `--connector` option is *not* optional for this inventory and is *ignored* for other inventories

WWP-INT-DOC.txt

@@ -0,0 +1,56 @@
+Feature: wwp-int
+
+This feature allows restoring from backups on a sandbox openshift cluster
+
+PREREQUISITES:
+  - python 3 with pyyaml library(for inventory and filters)
+  - a working oc client
+  - a working ansible installation
+  - current-context must be "wwp-int/pub-os-exopge-epfl-ch:443/"*:
+	use "oc config current-context" to check the current context
+	use "oc config use-context <context_name>" to choose context
+	use "oc login" to login to the desired context
+
+USAGE:
+
+  - if wwp-int cluster is empty:
+      "./wpsible" will only deploy mgmt with:
+       - mount on production backup nas in /backups
+       - mount on wwp-int's persistent volume provision system in /srv
+
+  - if mgmt is deployed AND mgmt pod is running (if not, deploy mgmt manually on the OKD console or use "oc rollout latest dc/mgmt"):
+      - if respective wordpress servers are NOT deployed:
+         "./wpsible" will deploy all httpd deployments only (permission for creating file structure will be denied)
+      - if respective wordpress servers ARE deployed:
+         "./wpsible" will deploy all httpd deployments AND wordpress instances gathered from /backup mount
+
+      - to limit httpd server deployments :
+       "./wpsible -l '<server_name1>, <server_name2>..' " where <server_name#> is of the form httpd-[environment]
+
+      - to limit wordpress instances :
+
+	* "./wpsible -l '<instance_name1>, <instance_name2> ...' " where <instance_name#> is the name of the backup 
+	  folder for the specific instance (fetched from /backups)
+		example: 
+			./wpsible -l  _srv_www_www.epfl.ch_htdocs
+			./wpsible -l '_srv_www_www.epfl.ch_htdocs, _srv_www_www.epfl.ch_htdocs_about'
+
+
+	* "./wpsible -l '<environment1>, ...' " where <environment1> is the name of the group of wordpress instances
+		example: 
+			./wpsible -l httpd-www
+			./wpsible -l 'httpd-www, httpd-inside'
+
+	* edit the python dynamic inventory ansible/inventory/wp-int/wordpress-instances:
+	  - call generate_inventory(sorted= True, limit=0, max_depth=-1) (bottom of the file)
+	    "sorted" will sort instances by file depth, 
+	    "limit" will truncate instance lists in each group until the specified number. A value of 0 will not limit instances number 
+	    "max_depth" will filter instances by file depth. A depth strictly smaller than 0 will not filter instances, 0 yields root 
+	     wordpress directories only, ect.
+
+   - to get an inventory listing for a given dynamic inventory:
+      structured:
+        ansible-inventory -i <inventory_script> --graph
+      full variable listing:
+        ansible-inventory -i <inventory_script> --list
+

ansible/ansible.cfg

@@ -0,0 +1,2 @@
+[ssh_connection]
+pipelining = true

ansible/eyaml/epfl_wp_blue.pem

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC2TCCAcGgAwIBAgIBATANBgkqhkiG9w0BAQsFADAAMCAXDTE5MDcxNzExMjgz
+MVoYDzIwNjkwNzA0MTEyODMxWjAAMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEA3zdra3NGYwb/mrroMSuJsO0uUK9us6sWErBiBb4OT4CC1K0G57Fgq5Kh
+lSsZ+0OLV/CtIJYNYnl0dQzdHJgS/h2YC2kfTGHPRFULE5mysIvXZrEQXJvEaJpS
+pxFu3L7gZlacGHTPNlXmEmtfVFetpfRZKo0btDf76XdSEZ1d9ItOMXNYH+MUM3qk
+dHzgfDnA8eyQI7naGAdBtCrouMDWWfQKuKl2swZeMdh1FnB4z0r1cQhnanWvajwg
+p35iw72Ltkz18bXH6Fh0ODo985Mgzyar71bbl3HdidGpLB2VhywQQxEO6Sn1Ikte
+IP2PZ+lIQmbLZ+doqfo+8d2Ci5N6hwIDAQABo1wwWjAPBgNVHRMBAf8EBTADAQH/
+MB0GA1UdDgQWBBQQUtgvd0IhtNfSrP7UDHFnpely3DAoBgNVHSMEITAfgBQQUtgv
+d0IhtNfSrP7UDHFnpely3KEEpAIwAIIBATANBgkqhkiG9w0BAQsFAAOCAQEApyiZ
+0DkuWPlDgA+clkxPMyKkVoi9+BMespjslvES/rFbpPVZ/6kuYAxG9/4SW5V3xsx3
+hwHWDts/tu46IiSw3p2tXX0QMnSJmoFqg8KNZOdc3cVZdo8apZjq8A27qMeOlWwC
+YmMcf94Of8ipCg2NthdxDDmbwPTkz2JiGz8gAI9LTUrOQjMrvEw3DHRKYIlpnm9u
+eo+pzPyeUOxHjBtQdmbcrJ1Yw5EwVSFtkgLdxR18C/eIBD/qT3q9WkKRl+ufwjap
+Lwi1ePHgj9Edd7t0PfUJjHA2Y6W5qDyF89FUL/H3sZmTYJX0rW8vjrXvXq4bDJ9F
+6Ivpnv8vwBjDM62mMA==
+-----END CERTIFICATE-----

ansible/inventory/wp-int/group_vars/openshift-namespaces-blue

@@ -0,0 +1,36 @@
+# -*- mode: yaml; -*-
+#
+# Variables that only apply to members of group "openshift-namespaces-prod"
+ansible_user: www-data
+ansible_connection: local
+openshift_namespace: wwp-int
+
+
+eyaml_keys:
+  priv: "/keybase/team/epfl_wwp_blue/private_key.pkcs7.pem"
+  pub: "{{ playbook_dir }}/../eyaml/epfl_wp_blue.pem"
+
+# To edit the encrypted secrets below, you need eyaml installed.
+# Familiarize yourself with
+# https://puppet.com/blog/encrypt-your-data-using-hiera-eyaml first.
+# The edit command goes like this,
+#
+#   eyaml edit -d \
+#     --pkcs7-public-key ansible/eyaml/epfl_wp_blue.pem \
+#     ansible/inventory/wp-int/group_vars/openshift-namespaces-blue
+#
+# 💡 This *will not* decrypt anything for you because chances are, you
+# don't need to decrypt secrets (YA RLY). For those cases where you
+# do, wielding the private key from Keybase is left as an exercise to
+# the reader.
+
+mgmt_sshd_keys:
+  ssh_host_ecdsa_key:
+    pub: ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKmlErFrPfGGaMaC/wMjgkOoLO25HDGbcjIw2pbZwS3yTEU4EUVQBMDkw+1EyKqD/81aj+8wjwkC+k7qIwngVPM= root@mgmt-351-build
+    priv: ENC[PKCS7,MIICXAYJKoZIhvcNAQcDoIICTTCCAkkCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAcYLjW33kpI3CS/XXpclVr2zJM6ylOtalADBXBOBz7JGWa8o8OBpOjKyREJd5kL4F0C3IqVnRRWdMDqbAQyOjBgX0+kXNz/Eq4S6JqgonhqySynwkUcgbQtwQdUF//LBvmTN6q8krni5J6FgQuKY48DcqBbHI17uZZA/HpkY4Yz0KRi1yqBjwJMfa4otA6pcYMEWMVatQYkr3owucj+3+W3re60gsZol5u7+uEEaQev7JUum5yXFmBgFlOgGOR29gjxliC3pKx7FM1zRggtJtzwWRj8SV/HKfivhhtRJ3BHDx4DsfZQt1scrD83Hv/fj+aMl9zJ/NSouPzK8edMEZmTCCAR0GCSqGSIb3DQEHATAdBglghkgBZQMEASoEELDkWgqv5e93SSwP7jaahMWAgfB01bKEPwjwfZr8IYY4k1TDjusrY8PMqNI3BZ8qOptmrrcWZabdhFas976tQzapAQcBqH0RMuXOKybODF7kbkIKxwVpIKoasBx0sNyxwJOmKzM3BKmnwyYa0ngz8KN/qV0GdLYck3tGEwuzMo/EJ7HJbWPMAX7y9D3GZmTCndhOriDmuH8mfOuB5sht0QReZBDSUIW1RJsWGDMZpOg9BjzkVm3GjnKwADcxa/ihppqgmjF2WT85IhvFTRnZie1xyM082bqc1nTuepdhb0ZGIazjQN4dpJbu+/8XeCCS1PVL9L8UFo0hD4cAA5utvuMLXnk=]
+  ssh_host_ed25519_key:
+    pub: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJsZjfDG3M17TXJf7n5pGI/gnkvCvp4UV2LV4uxv+TmF root@mgmt-351-build
+    priv: ENC[PKCS7,MIIDDQYJKoZIhvcNAQcDoIIC/jCCAvoCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAgM0eCCYeu30OuzRqVxtLrCciKP7ttl7fUarduXd708D3iT+VcudNxf6wsQH/DLOEqEGbUQq84vvBx/ubGJfBHerzpqktmqTtCkVp+nqRQ7u4M6l/IriBR9TaWKguDN/eO69D0n/1X1RgZabLbHYbyZ4U73CC4Y02yPXNmNwp/2YGAMuw/dK5NTZ7p6+44oTfmuINkC1wtiIb28/jvfWj3a4fKSS9+TXC+oc/AaM4nElYTMD9rYmRNZuuWOrDPL0iv3WEF8JcawZQs2ZBWyzwZac3RvhkxSVNCZp1QwWsepe51F3QNLNgpTVwu2D+jvYnKn+GhHUVlhC3luFATKY55TCCAc4GCSqGSIb3DQEHATAdBglghkgBZQMEASoEELWEfJ4XW/FkJ1tUijFqdC6AggGg7ICSSFz8NqnF2EGIPblxalf1uh8JZ774nzeShP33ExtGg6mOo1836fj01elp6YumhpgsiJ3rI2IZZ/wozRJdkcQ5vevj2FFAP+5YOnfINipt8ZJwzDH3LuIYpiW6lcvf1v4k0VX4ccsi+BFQXcWnncTTfP2prG/+AjGmVDP25Prt2RBSnSUZPQ1Sk9t0sW6GaP7Ux/aDEn/XIt7ITmhVcjlT/SiSV9JkAmypxMRhZwYa4kjD6t9fci+Ot1XWOqOJexBgfiEQg0ohjm0AzdrRPsQ2f8YJmdygpMbdk4X2Xj2ACwXj0/nElmfYjCNiHAAe0/+tqzVX20qWAZBUwB8okE0ZLHMfOl4FveMTXIj+t4x+2p6Oc0T2LFO0hNoFNNDiKKrHZvji2CHUhzQYbOUz+hISGrGBfdeHbc0iLj9tiQ8TZAhvEJBjNEdWSvqJT+19e/EIXd1Jb8TQeMi5xNdfZXVCizw3Adu18/uSmOZIMdwTm2ZExa4vewXrTFlJdkcE9xIMnsm4oWJaPEl20eYL0ThFu13w7RfZ7IcKwJpdfLg=]
+  ssh_host_rsa_key:
+    pub: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDIFASWuEt3hU0U5uE0EdWtvkclRNDevlzceoBi4SEqe/WHFsLLARll7u6MFbx0a732dHkMHGX9FtHPKZzgzEuGoM8h/kyBD+kbsg1fpXrKU/juJucvkHmAblKIuk3vNQLNMjIdpS7mrDsCLVKe6aatFTuiLTfUaQDoDO8z+4qXRvp3ZqSkHytZmNS7ZBahSal9kmihRylufbe0L/ced54XQh01ilUo2hMgFaxYapMyf1NYFVI+N9U6Gp+YHImp0TZYe/3tDp6/ZpEBC79QA0PTrbh5qAjwHki18mLY6VGEGSK1OqfZ2PAU8UIlWuFi22+ylsBdU5BesZ75dgzVLCeP root@mgmt-351-build
+    priv: ENC[PKCS7,MIIH/QYJKoZIhvcNAQcDoIIH7jCCB+oCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAG5vNmdHZ141X1uA47NSBW4uqR3dsKh+H4rOnhCVxoP/Vmrb9E4e5aRbyVbUoXxAVCi8LMqY3UZB6OtklkDESC556qWGrB20aCNSD7qfgdrf0YwW3xWigGH+wbC2mDKmeZ/XjoPrti/y0uqjf8VlN636GNVFvkhmbppEs2SWTY320OSVYYx+EvAmHZJ6wbCevFlwiwycfaXGx2EisxLOEdm5btK1KxAzv7mESVlTu8mOivgfYjQeXUOeiq4VajOUKLfZk7+qucnc/OX6jmZRmROW7K3NmOBVEBmhwgjwxQD9ro0qzh/8GvIEpmJznZcK5t5B6phaZhJ42SqmUKFHuhzCCBr4GCSqGSIb3DQEHATAdBglghkgBZQMEASoEEKV/ZBlA2hgNAPfNla4M5Q+AggaQaockr5XPTO8k4CGbzhCD5ELq//2dpQt6i0fdcrizIF+jKh0sa2YzyssQ1S+LLnK5wbvTyeW0BqMET7InnraNJ5kGZG9Ug/pqBZ8agW1jbwrLFyQSfPdO4v91p0e6G6pRh1S+fdl2AmyebB4HFolklQCox04tY54XJXZ9MzX1r1QiqL7xa/3X8+JMIIVpwCwJccsSX6WEEhqdBY6Zrp5K/YrKjc2r/LNmIk82L/g03B6uKG0XoQrEThDwC4D4pl8TTozNAxeqh9DiEeh1YYa0LPbwmMRdBWU7YygoNuaQJjuLyELgTjbP9QTQ4bCl8gSV7fvqdZPD8MuRLItGw0cN0vBud138s9yjaydMm5Y5gmRWpbwQqbduuOSiexr38CxPBcS9Avt//ZNKF91WNTBBKvaZyMfYyB4Tx0hFiZuVvzapv+E3hZGJtOAwy4oOotMxdZigi/j1m86MUdZ7tODfcBMlY6eUP4aG2bIgrSKJLHJjKlkwi5FYI8za/DWVIbwPG5jWSQcNcIyaC0mq4K75yT2oJPJGljacAd9vWXE4XFoISmbrE8iBoL+VlgWPSUwnLcmBkWR1WMWIQ8LHI2iH3HYzlpOBcJ+GHEtHZTNi3G3nYbrBzfGcP+AJOjwv4t+Mos8xiwvkpit5XyAuIa3OqlmxNrFEvwdOZh4brTHsATLp/Az45s4H9ep7vTYmvl4jK7fGBm3UY/tvwFsm46ho0rc4DojzvRtqj4x0RijScq0DedKOAeV2G3JozKxMBoPHjQAjQq8pHbzmEOamucW2dY9EieHsTw3JXVDOGVNPUqxm0mo/IbnzxALumtpsPiIY9N7FggomnWYet5YK7/Y+1V/sHbA5arE6RPIHTo/eYiwbMHlDzzNh7aDR7ypaWPNIzwEdzIQViGlB81NaM2rPAjLqFeT77lr6MpGXra8zWnt/ULcfIvun57fE0qbmqHqebiMv4YBDEPCIZCIuDrloAis+B+h252B4WmQFf25fcO+oj6M2BY1os0sqzn3jB6quIenipMb50bj5ic+XaV2FWUc3uEvIMVyzpWVOQJPuPWLOKCPRyKsJavhAg+106tcxGQ049+9qDCETSxbaQG3EOPLwxrmIETG26PHKmr+Oa6eQMgGJHCODMC9lGeFPgOUwwzYq+IfTCZYH89Wozzhw8/6UYRGY5967s/7VElgrCfjbJrthgZ9pg+luzqhqHL5DFVjfWW042E5iVEl1ybYXZqsyRP3+ZjsXAgtruQG4x3VTI3g1HE7JJ8XJGhFmByfg78A/bFY58Vvtuz9JS5WdaXGBVSpSDDAXD4ouZUBq/r66EZWuWCTpPz3MPVXlb3xdxzhWFc7iRCCFmVJRLGgutsy51DRQHTllCZam6DegvpMIh3+sFEdYw0JK1/LBsRIw3I4WA4MAYh9mqkN7RsdY7drSZyITuxTGoec83Kf/UF+Jh7cZMVod3oS+XrM8TV1bvpGB0rUAThTXE2trsjirki08XkvX4VVO0KnY75BODcZnoB/Ex598kzPcLA0pxoJv3whLyJ1/WJ1lVLD0ZZOSEBH+YRjhB9YAXJTTIxYCokjbpFtwukxStTU0/F/MfnlP8+R87z1shHW+kWd+P69v1uexwP3sP3FY3+17d5XfPcNhnp/ggeO/81CGYk9SjPi3sVBZBgRDJuNUT+sRjxVj79m92c7zKXzzj7rI2WAN+BhKxaE0R7vHvS8d2+XYEg/Rm/QDKoMurHl4l5oASH9wnCNuCjWGBEWbZ8j/+Mi6njxwKYOQpOykhn/BSGoKlFjoKYZWebKCJBXh7i9chMKjZP+wwB9kjQDNVw1iZGGi2F09I/vRkMdYXf4UiHeNjAIf0lKH1Y9bo6ZKwTokp+XpWfcT7jgjvPokvSXPirIPzEkwVTsSKjBYHwd1OEid7gUzMgQrZ0INTiIDtFyM6L6UMk9UdtLjPqaGo5Umf3JCKrCZhI/t26WvK6qv8LxfAtvgciRLsc3AuBkuSLiXSpPNPYmS24hj6Vg11SFqONnHYdLtEXChvv+uHe13mbkrhplozNnoytE383KPOOcdqrGs4MYPpqmAvq4h1G7enP0rRnyOy1I2/ubXYN7+G6krzyv2/mbGtVgfZ1VzU73wsXmkaOA+5NmOew3eS5yqNOJcQoDKbL9kaHyQBHWWoXdNuc5+HonyGfug0HTW2VTV/9dgvEoovv91/IKBBWqilWiG1tMUykzSdoTK16uPl0SkGIek]

ansible/inventory/wp-int/openshift-namespaces-blue

@@ -0,0 +1,5 @@
+[all-openshift-namespaces:children]
+openshift-namespaces-blue
+
+[openshift-namespaces-blue]
+wp-blue nfs_path=nfsshare

ansible/inventory/wp-int/wordpress-deployments

@@ -0,0 +1,113 @@
+#!/usr/bin/env python3
+
+import subprocess
+import yaml
+from sys import stdout
+from collections import OrderedDict
+
+pod_name = subprocess.check_output('oc get pods -o name |grep mgmt | cut -d "/" -f2', shell=True).decode('utf-8').replace('\n','')
+
+def parse_backup_directory(nb_sites):
+    if pod_name == "":
+        return ""
+    command = "oc exec %(pod_name)s -- ls /backups " %{"pod_name":pod_name}
+    ls = subprocess.check_output(command, shell=True).decode('utf-8')
+    if "Error" in ls:
+        return ""
+    return list(filter(lambda x: len(x) > 0, ls.split('\n') ))
+
+inventory = {
+             "all-wordpress-deployments":{
+                 "children":
+                   ["wordpress_deployments_test_blue"]
+              },
+              "wordpress_deployments_test_blue":{
+                 "vars":{
+                   "openshift_namespace":"wwp-int"
+                 }
+              },
+              "_meta":{
+                "hostvars":{}
+              }
+             }
+
+def group_by_env(hostvars):
+    groups={}
+    group_hosts={}
+    for k in hostvars:
+        env = hostvars[k]["wp_env"]
+        if not env in groups:
+            groups[env]= {}
+        if not env in group_hosts:
+            group_hosts[env]={}
+            group_hosts[env]["hosts"]= []
+        groups[env][k]=hostvars[k]
+        group_hosts[env]["hosts"].append(k)
+    return {"group_hosts":group_hosts, "groups":hostvars}
+
+
+def populate_vars():
+    ls = parse_backup_directory(20)
+    ls_hosts= []
+    vs = {}
+    for name in ls:
+        vars = parse_vars(name)
+        name = vars["wp_hostname"].split('.')[0]+"-"+vars["wp_path"]
+        ls_hosts.append(name)
+        vs[name] = vars
+    return vs
+
+def get_latest_full_backup(bkp_string):
+    #TODO performance bottleneck in the repeated oc command
+    command = "oc exec %(pod_name)s -- ls /backups/%(bkp)s " %{"pod_name":pod_name, "bkp": bkp_string}
+    ls = subprocess.check_output(command, shell=True).decode('utf-8')
+    bkp_list = list(filter(lambda x: len(x) and "full" in x > 0, ls.split('\n') ))
+    bkp_list.sort()
+    reversed_bkp_list = bkp_list[::-1]
+    #TODO check edge cases: we suppose that each archive has a same-named sql backup 
+    #and that there exist backups in the first place
+    if len(reversed_bkp_list) > 1:
+        return {"restore_archive_name": reversed_bkp_list[0], "restore_sql_name": reversed_bkp_list[1]}
+    else:
+        return {"restore_archive_name": "none", "restore_sql_name": "none"}
+
+
+def parse_vars(bkp_string):
+    if '_' in bkp_string:
+       path = bkp_string.split('_')[2:]
+       wp_env = path[0]  #TODO make wordpress environnements dynamic as well > use path[0]
+       wp_hostname= path[1]
+       wp_path = bkp_string.split("htdocs")[1].replace('_','')
+       # wp_archives= get_latest_full_backup(bkp_string)
+       return {
+               "name":wp_env,
+               "wp_env":wp_env,
+               "wp_hostname":wp_hostname,
+               "wp_path":wp_path,
+#               "restore_archive_name":wp_archives["restore_archive_name"],
+#               "restore_sql_name": wp_archives["restore_sql_name"],
+#               "restore_backup_folder": bkp_string
+       }
+    else: return {"name":"",
+               "wp_env":"",
+               "wp_hostname":"",
+               "wp_path":"",}
+
+gen = populate_vars()
+#inventory["_meta"]["hostvars"] = gen
+output = group_by_env(gen)
+inventory["wordpress_deployments_test_blue"]["children"] = []
+for k in output["group_hosts"]:
+    if len(k)>0:
+        inventory["g-httpd-"+k] = ["httpd-"+k]
+        inventory["wordpress_deployments_test_blue"]["children"].append("g-httpd-"+k)
+        inventory["_meta"]["hostvars"]["httpd-"+k]= {"name":"httpd-"+k, "env":k}
+
+
+
+
+print ( yaml.dump(inventory) )
+#print ( inventory)
+#print(yaml.dump(group_by_env(gen)))
+
+