-
Notifications
You must be signed in to change notification settings - Fork 6
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
disable present bmc admin user and create new superuser (#28)
- Loading branch information
Sandro Koll
authored
Nov 4, 2020
1 parent
cbed6b8
commit 030e594
Showing
8 changed files
with
186 additions
and
112 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| package cmd | ||
|
|
||
| import ( | ||
| "context" | ||
| "crypto/tls" | ||
| "crypto/x509" | ||
| "errors" | ||
| "github.com/metal-stack/metal-hammer/cmd/event" | ||
| "github.com/metal-stack/metal-hammer/metal-core/client/certs" | ||
| "google.golang.org/grpc" | ||
| "google.golang.org/grpc/credentials" | ||
| "google.golang.org/grpc/keepalive" | ||
| "time" | ||
| ) | ||
|
|
||
| type GrpcClient struct { | ||
| *event.EventEmitter | ||
| addr string | ||
| dialOpts []grpc.DialOption | ||
| } | ||
|
|
||
| // NewGrpcClient fetches the address and certificates from metal-core needed to communicate with metal-api via grpc, | ||
| // and returns a new grpc client that can be used to invoke all provided grpc endpoints. | ||
| func NewGrpcClient(certsClient *certs.Client, emitter *event.EventEmitter) (*GrpcClient, error) { | ||
| params := certs.NewGrpcClientCertParams() | ||
| resp, err := certsClient.GrpcClientCert(params) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| clientCert, err := tls.X509KeyPair([]byte(resp.Payload.Cert), []byte(resp.Payload.Key)) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| caCertPool := x509.NewCertPool() | ||
| ok := caCertPool.AppendCertsFromPEM([]byte(resp.Payload.CaCert)) | ||
| if !ok { | ||
| return nil, errors.New("bad certificate") | ||
| } | ||
|
|
||
| kacp := keepalive.ClientParameters{ | ||
| Time: 10 * time.Second, // send pings every 10 seconds if there is no activity | ||
| Timeout: time.Second, // wait 1 second for ping ack before considering the connection dead | ||
| PermitWithoutStream: true, // send pings even without active streams | ||
| } | ||
|
|
||
| tlsConfig := &tls.Config{ | ||
| RootCAs: caCertPool, | ||
| Certificates: []tls.Certificate{clientCert}, | ||
| } | ||
| return &GrpcClient{ | ||
| EventEmitter: emitter, | ||
| addr: resp.Payload.Address, | ||
| dialOpts: []grpc.DialOption{ | ||
| grpc.WithKeepaliveParams(kacp), | ||
| grpc.WithTransportCredentials(credentials.NewTLS(tlsConfig)), | ||
| grpc.WithBlock(), | ||
| }, | ||
| }, nil | ||
| } | ||
|
|
||
| func (c *GrpcClient) newConnection() (*grpc.ClientConn, error) { | ||
| ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second) | ||
| defer cancel() | ||
|
|
||
| conn, err := grpc.DialContext(ctx, c.addr, c.dialOpts...) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return conn, err | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| package cmd | ||
|
|
||
| import ( | ||
| "context" | ||
| "github.com/metal-stack/go-hal/pkg/api" | ||
| v1 "github.com/metal-stack/metal-api/pkg/api/v1" | ||
| "github.com/pkg/errors" | ||
| "io" | ||
| ) | ||
|
|
||
| func (c *GrpcClient) newSuperUserPasswordClient() (v1.SuperUserPasswordClient, io.Closer, error) { | ||
| conn, err := c.newConnection() | ||
| if err != nil { | ||
| return nil, nil, err | ||
| } | ||
| return v1.NewSuperUserPasswordClient(conn), conn, nil | ||
| } | ||
|
|
||
| // createBmcSuperuser creates the bmc super user. | ||
| func (h *Hammer) createBmcSuperuser() error { | ||
| client, closer, err := h.GrpcClient.newSuperUserPasswordClient() | ||
| if err != nil { | ||
| return err | ||
| } | ||
| defer closer.Close() | ||
|
|
||
| req := &v1.SuperUserPasswordRequest{} | ||
| resp, err := client.FetchSuperUserPassword(context.Background(), req) | ||
| if err != nil { | ||
| return errors.Wrap(err, "failed to fetch SuperUser password") | ||
| } | ||
|
|
||
| if resp.FeatureDisabled { | ||
| return nil | ||
| } | ||
|
|
||
| bmcConn := h.Hal.BMCConnection() | ||
| err = bmcConn.CreateUser(bmcConn.SuperUser(), api.AdministratorPrivilege, resp.SuperUserPassword) | ||
| if err != nil { | ||
| return errors.Wrapf(err, "failed to create bmc superuser: %s", bmcConn.SuperUser().Name) | ||
| } | ||
|
|
||
| return nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.