3 from datetime import datetime
4 from collections import defaultdict
5 from core.models import *
6 from django.db.models import F, Q
7 from openstack.manager import OpenStackManager
8 from util.logger import Logger, logging
11 logger = Logger(logfile='observer.log', level=logging.INFO)
13 class OpenStackObserver:
16 self.manager = OpenStackManager()
19 if not self.manager.enabled or not self.manager.has_openstack:
26 self.sync_user_tenant_roles()
28 self.sync_sliver_ips()
35 save all role that don't already exist in keystone. Remove keystone roles that
36 don't exist in planetstack
38 # sync all roles that don't already in keystone
39 keystone_roles = self.manager.driver.shell.keystone.roles.findall()
40 keystone_role_names = [kr.name for kr in keystone_roles]
41 pending_roles = Role.objects.all()
42 pending_role_names = [r.role_type for r in pending_roles]
43 for role in pending_roles:
44 if role.role_type not in keystone_role_names:
46 self.manager.save_role(role)
47 logger.info("save role: %s" % (role))
49 logger.log_exc("save role failed: %s" % role)
52 # don't delete roles for now
54 # delete keystone roles that don't exist in planetstack
55 for keystone_role in keystone_roles:
56 if keystone_role.name == 'admin':
58 if keystone_role.name not in pending_role_names:
60 self.manager.driver.delete_role({id: keystone_role.id})
65 def sync_tenants(self):
67 Save all sites and sliceswhere enacted < updated or enacted == None.
68 Remove sites and slices that no don't exist in openstack db if they
69 have an enacted time (enacted != None).
71 # get all sites that need to be synced (enacted < updated or enacted is None)
72 pending_sites = Site.objects.filter(Q(enacted__lt=F('updated')) | Q(enacted=None))
73 for site in pending_sites:
75 self.manager.save_site(site)
76 logger.info("saved site %s" % site)
78 logger.log_exc("save site failed: %s" % site)
80 # get all slices that need to be synced (enacted < updated or enacted is None)
81 pending_slices = Slice.objects.filter(Q(enacted__lt=F('updated')) | Q(enacted=None))
82 for slice in pending_slices:
84 self.manager.init_caller(slice.creator, slice.creator.site.login_base)
85 self.manager.save_slice(slice)
86 logger.info("saved slice %s" % slice)
88 logger.log_exc("save slice failed: %s" % slice)
90 # get all sites that where enacted != null. We can assume these sites
91 # have previously been synced and need to be checed for deletion.
92 sites = Site.objects.filter(enacted__isnull=False)
95 site_dict[site.login_base] = site
97 # get all slices that where enacted != null. We can assume these slices
98 # have previously been synced and need to be checed for deletion.
99 slices = Slice.objects.filter(enacted__isnull=False)
102 slice_dict[slice.name] = slice
104 # delete keystone tenants that don't have a site record
105 tenants = self.manager.driver.shell.keystone.tenants.findall()
106 system_tenants = ['admin','service']
107 for tenant in tenants:
108 if tenant.name in system_tenants:
110 if tenant.name not in site_dict and tenant.name not in slice_dict:
112 self.manager.driver.delete_tenant(tenant.id)
113 logger.info("deleted tenant: %s" % (tenant))
115 logger.log_exc("delete tenant failed: %s" % tenant)
118 def sync_users(self):
120 save all users where enacted < updated or enacted == None. Remove users that
121 no don't exist in openstack db if they have an enacted time (enacted != None).
123 # get all users that need to be synced (enacted < updated or enacted is None)
124 pending_users = User.objects.filter(Q(enacted__lt=F('updated')) | Q(enacted=None))
125 for user in pending_users:
127 self.manager.save_user(user)
128 logger.info("saved user: %s" % (user))
130 logger.log_exc("save user failed: %s" %user)
132 # get all users that where enacted != null. We can assume these users
133 # have previously been synced and need to be checed for deletion.
134 users = User.objects.filter(enacted__isnull=False)
137 user_dict[user.kuser_id] = user
139 # delete keystone users that don't have a user record
140 system_users = ['admin', 'nova', 'quantum', 'glance', 'cinder', 'swift', 'service']
141 users = self.manager.driver.shell.keystone.users.findall()
143 if user.name in system_users:
145 if user.id not in user_dict:
147 #self.manager.driver.delete_user(user.id)
148 logger.info("deleted user: %s" % user)
150 logger.log_exc("delete user failed: %s" % user)
153 def sync_user_tenant_roles(self):
155 Save all site privileges and slice memberships wheree enacted < updated or
156 enacted == None. Remove ones that don't exist in openstack db if they have
157 an enacted time (enacted != None).
159 # sync site privileges
160 pending_site_privileges = SitePrivilege.objects.filter(Q(enacted__lt=F('updated')) | Q(enacted=None))
161 for site_priv in pending_site_privileges:
163 self.manager.save_site_privilege(site_priv)
164 logger.info("saved site privilege: %s" % (site_priv))
165 except: logger.log_exc("save site privilege failed: %s " % site_priv)
167 # sync slice memberships
168 pending_slice_memberships = SliceMembership.objects.filter(Q(enacted__lt=F('updated')) | Q(enacted=None))
169 for slice_memb in pending_slice_memberships:
171 self.manager.save_slice_membership(slice_memb)
172 logger.info("saved slice membership: %s" % (slice_memb))
173 except: logger.log_exc("save slice membership failed: %s" % slice_memb)
175 # get all site privileges and slice memberships that have been enacted
176 user_tenant_roles = defaultdict(list)
177 for site_priv in SitePrivilege.objects.filter(enacted__isnull=False):
178 user_tenant_roles[(site_priv.user.kuser_id, site_priv.site.tenant_id)].append(site_priv.role.role)
179 for slice_memb in SliceMembership.objects.filter(enacted__isnull=False):
180 user_tenant_roles[(slice_memb.user.kuser_id, slice_memb.slice.tenant_id)].append(slice_memb.role.role)
182 # Some user tenant role aren't stored in planetstack but they must be preserved.
183 # Role that fall in this category are
184 # 1. Never remove a user's role that their home site
185 # 2. Never remove a user's role at a slice they've created.
186 # Keep track of all roles that must be preserved.
187 users = User.objects.all()
190 tenant_ids = [s['tenant_id'] for s in user.slices.values()]
191 tenant_ids.append(user.site.tenant_id)
192 preserved_roles[user.kuser_id] = tenant_ids
195 # begin removing user tenant roles from keystone. This is stored in the
197 for metadata in self.manager.driver.shell.keystone_db.get_metadata():
199 if metadata.user_id == self.manager.driver.admin_user.id:
201 # skip preserved tenant ids
202 if metadata.user_id in preserved_roles and \
203 metadata.tenant_id in preserved_roles[metadata.user_id]:
205 # get roles for user at this tenant
206 user_tenant_role_ids = user_tenant_roles.get((metadata.user_id, metadata.tenant_id), [])
208 if user_tenant_role_ids:
209 # The user has roles at the tenant. Check if roles need to
211 user_keystone_role_ids = metadata.data.get('roles', [])
212 for role_id in user_keystone_role_ids:
213 if role_id not in user_tenant_role_ids:
214 user_keystone_role_ids.pop(user_keystone_role_ids.index(role_id))
216 # The user has no roles at this tenant.
217 metadata.data['roles'] = []
218 #session.add(metadata)
219 logger.info("pruning metadata for %s at %s" % (metadata.user_id, metadata.tenant_id))
221 def sync_slivers(self):
223 save all slivers where enacted < updated or enacted == None. Remove slivers that
224 no don't exist in openstack db if they have an enacted time (enacted != None).
226 # get all users that need to be synced (enacted < updated or enacted is None)
227 pending_slivers = Sliver.objects.filter(Q(enacted__lt=F('updated')) | Q(enacted=None))
228 for sliver in pending_slivers:
229 if not sliver.instance_id and sliver.creator:
231 # update manager context
232 self.manager.init_caller(sliver.creator, sliver.slice.name)
233 self.manager.save_sliver(sliver)
234 logger.info("saved sliver: %s %s" % (sliver))
236 logger.log_exc("save sliver failed: %s" % sliver)
238 # get all slivers that where enacted != null. We can assume these users
239 # have previously been synced and need to be checed for deletion.
240 slivers = Sliver.objects.filter(enacted__isnull=False)
242 for sliver in slivers:
243 sliver_dict[sliver.instance_id] = sliver
245 # delete sliver that don't have a sliver record
246 ctx = self.manager.driver.shell.nova_db.ctx
247 instances = self.manager.driver.shell.nova_db.instance_get_all(ctx)
248 for instance in instances:
249 if instance.id not in sliver_dict:
251 # lookup tenant and update context
252 tenant = self.manager.driver.shell.keystone.tenants.find(id=instance.project_id)
253 self.manager.init_admin(tenant=tenant.name)
254 self.manager.driver.destroy_instance(instance.id)
255 logger.info("destroyed sliver: %s" % (instance))
257 logger.log_exc("destroy sliver failed: %s" % instance)
260 def sync_sliver_ips(self):
261 # fill in null ip addresses
262 slivers = Sliver.objects.filter(ip=None)
263 for sliver in slivers:
265 self.manager.init_admin(tenant=sliver.slice.name)
266 servers = self.manager.client.nova.servers.findall(id=sliver.instance_id)
270 ips = server.addresses.get(sliver.slice.name, [])
273 sliver.ip = ips[0]['addr']
275 logger.info("saved sliver ip: %s %s" % (sliver, ips[0]))