updated how the S3 service accounts are created on booking

This commit is contained in:
pb 2025-08-12 12:16:01 +02:00
parent ad62aa24f3
commit 8176c4d8b8
3 changed files with 234 additions and 39 deletions

View File

@ -3,11 +3,14 @@ package controllers
import (
"encoding/json"
"fmt"
"slices"
oclib "cloud.o-forge.io/core/oc-lib"
"cloud.o-forge.io/core/oc-lib/dbs"
"cloud.o-forge.io/core/oc-lib/models/common/enum"
"cloud.o-forge.io/core/oc-lib/models/resources"
"cloud.o-forge.io/core/oc-lib/models/workflow"
"cloud.o-forge.io/core/oc-lib/models/workflow/graph"
"cloud.o-forge.io/core/oc-lib/models/workflow_execution"
"cloud.o-forge.io/core/oc-lib/tools"
beego "github.com/beego/beego/v2/server/web"
@ -138,48 +141,55 @@ func (o *WorkflowSchedulerController) SearchScheduledDraftOrder() {
}
func createStorageServiceAccount(execId string, peerID string, wfId string, wfs *workflow_execution.WorkflowSchedule, caller *tools.HTTPCaller, user string, groups []string) error {
l := oclib.GetLogger()
func createStorageServiceAccount(execId string, peerID string, wfId string, wfs *workflow_execution.WorkflowSchedule, caller *tools.HTTPCaller, user string, groups []string) error {
// Retrieve the Workflow in the WorkflowSchedule
// For each storage
wf := loadWorkflow(wfId,peerID)
for _, id := range wf.Storages {
// storageItems := wf.GetGraphItems(wf.Graph.IsStorage)
itemMap := wf.GetItemsByResources()
// mapStorageRessources, err := getItemByRessourceId(wf, storageItems)
for id, items := range itemMap[tools.STORAGE_RESOURCE] {
_ = items
// Load the storage
res := oclib.NewRequest(oclib.LibDataEnum(oclib.STORAGE_RESOURCE), user, peerID, groups,nil).LoadOne(id)
if res.Code != 200 {
l := oclib.GetLogger()
l.Error().Msg("Error while loading a storage for creation of the serviceAccount")
return fmt.Errorf(res.Err)
s, err := oclib.LoadOneStorage(id, user, peerID, groups)
if err != nil {
return err
}
s := res.ToStorageResource()
if s.StorageType == enum.S3 {
fmt.Println("Creating a service account on " + peerID + " for " + s.Name)
res = oclib.NewRequest(oclib.LibDataEnum(oclib.PEER), "", peerID, []string{},nil).LoadOne(s.CreatorID)
if res.Code != 200 {
l.Error().Msg("Error while loading a peer for creation of the serviceAccount")
return fmt.Errorf(res.Err)
}
p := res.ToPeer()
// DEV MULTI PEER MINIO CREDENTIAL CREATION
// retrieve all the processing linked to a compute using the storage : processing -- compute -- storage
// In this case we need to retrieve the Item ID(s) for each storage to be able to evaluate links with other items
associatedComputingResources := getAssociatedComputeRessources(*wf, itemMap[tools.STORAGE_RESOURCE][id])
for _, computeId := range associatedComputingResources {
caller.URLS[tools.MINIO_SVCACC] = map[tools.METHOD]string{
tools.POST: "/serviceaccount/" + s.UUID + "/" + execId ,
}
l.Debug().Msg("Lauching execution on" + p.UUID)
_, err := p.LaunchPeerExecution(p.UUID, wfId,tools.MINIO_SVCACC,tools.POST,nil,caller)
if err != nil {
l.Error().Msg("Error when executing on peer at " + p.Url)
l.Error().Msg(err.Error())
return err
}
if caller.LastResults["code"].(int) != 200 {
l.Error().Msg(fmt.Sprint("Error when trying to create a serviceAccount on storage " + s.Name + " on peer at " + p.Url))
if _, ok := caller.LastResults["body"]; ok {
l.Error().Msg(string(caller.LastResults["body"].([]byte)))
return fmt.Errorf(string(caller.LastResults["body"].(map[string]interface{})["error"].([]byte)))
c, err := oclib.LoadOneComputing(computeId, user, peerID, groups)
if err != nil {
return err
}
if c.CreatorID == s.CreatorID {
// post on datacenter /minio/createServiceAccount
err := postCreateServiceAccount(peerID, s, caller, execId, wfId)
if err != nil {
// Add a logger.Info() here
return err
}
} else {
// get on storage datacenter /minio/createServiceAccount
access, secret, err := getServiceAccountCredentials(peerID, *s, caller, execId, wfId, *c)
if err != nil {
// Add a logger.Info() here
return err
}
// post on computing datacenter /minio/createSAsecret
err = postS3Secret(peerID, *s, caller, execId, wfId,*c, access, secret) // create the secret holding the retrieved access on c's peer
if err != nil {
// Add a logger.Info() here
return err
}
}
}
}
@ -189,6 +199,38 @@ func createStorageServiceAccount(execId string, peerID string, wfId string, wfs
return nil
}
func postCreateServiceAccount(peerID string, s *resources.StorageResource, caller *tools.HTTPCaller, execId string, wfId string) error {
l := oclib.GetLogger()
fmt.Println("Creating a service account on " + peerID + " for " + s.Name)
res := oclib.NewRequest(oclib.LibDataEnum(oclib.PEER), "", peerID, []string{}, nil).LoadOne(s.CreatorID)
if res.Code != 200 {
l.Error().Msg("Error while loading a peer for creation of the serviceAccount")
return fmt.Errorf(res.Err)
}
p := res.ToPeer()
caller.URLS[tools.MINIO_SVCACC] = map[tools.METHOD]string{
tools.POST: "/serviceaccount/" + s.UUID + "/" + execId,
}
l.Debug().Msg("Lauching execution on" + p.UUID)
_, err := p.LaunchPeerExecution(p.UUID, wfId, tools.MINIO_SVCACC, tools.POST, nil, caller)
if err != nil {
l.Error().Msg("Error when executing on peer at " + p.Url + " when creating a S3 service account")
l.Error().Msg(err.Error())
return err
}
if caller.LastResults["code"].(int) != 200 {
l.Error().Msg(fmt.Sprint("Error when trying to create a serviceAccount on storage " + s.Name + " on peer at " + p.Url))
if _, ok := caller.LastResults["body"]; ok {
l.Error().Msg(string(caller.LastResults["body"].([]byte)))
return fmt.Errorf(string(caller.LastResults["body"].(map[string]interface{})["error"].([]byte)))
}
}
return nil
}
func loadWorkflow(workflowId string, peerId string) *workflow.Workflow {
res := oclib.NewRequest(oclib.LibDataEnum(oclib.WORKFLOW), "", peerId, []string{},nil).LoadOne(workflowId)
if res.Code != 200 {
@ -199,4 +241,135 @@ func loadWorkflow(workflowId string, peerId string) *workflow.Workflow {
return res.ToWorkflow()
}
}
// func getItemByRessourceId(storages string) (map[string][]string, error) {
// var storagesMap map[string][]string
// }
func getAssociatedComputeRessources(wf workflow.Workflow, storageNodes []string) []string {
storageProcessingLinks := make([]string,0)
for _, id := range storageNodes{
processings := getStorageRelatedProcessing(wf, id) // Retrieve all the Processing item linked to one storage node
for _, procId := range processings {
computings := getComputeProcessing(wf, procId)
if !slices.Contains(storageProcessingLinks,computings){
storageProcessingLinks= append(storageProcessingLinks, computings)
}
}
}
return storageProcessingLinks
}
// returns a list of processing item's Id that use the Storage
// theses item Id can be used to instantiate the resource
func getStorageRelatedProcessing(wf workflow.Workflow, storageId string) (relatedProcessing []string) {
var storageLinks []graph.GraphLink
// Only keep the links that are associated to the storage
for _, link := range wf.Graph.Links {
if link.Destination.ID == storageId || link.Source.ID == storageId {
storageLinks = append(storageLinks,link)
}
}
for _, link := range storageLinks {
var resourceId string
if link.Source.ID != storageId { resourceId = link.Source.ID } else { resourceId = link.Destination.ID }
if wf.Graph.IsProcessing(wf.Graph.Items[resourceId]){ relatedProcessing = append(relatedProcessing, resourceId) }
}
return
}
func getComputeProcessing(wf workflow.Workflow, processingId string) (res string) {
computeRel := wf.GetByRelatedProcessing(processingId,wf.Graph.IsCompute)
for _, rel := range computeRel {
return rel.Node.GetID()
}
return ""
}
func getServiceAccountCredentials(peerID string, storageRes resources.StorageResource, caller *tools.HTTPCaller, execId string, wfId string, computeRes resources.ComputeResource) (string, string, error) {
l := oclib.GetLogger()
fmt.Println("Getting a service account for" + computeRes.CreatorID + " on S3 " + storageRes.Name + " on peer " + storageRes.CreatorID )
res := oclib.NewRequest(oclib.LibDataEnum(oclib.PEER), "", peerID, []string{}, nil).LoadOne(storageRes.CreatorID)
if res.Code != 200 {
l.Error().Msg("Error while loading a peer for creation of the serviceAccount")
return "", "", fmt.Errorf(res.Err)
}
p := res.ToPeer()
caller.URLS[tools.MINIO_SVCACC] = map[tools.METHOD]string{
tools.POST: "/serviceaccount/" + storageRes.UUID + "/" + execId,
}
body := map[string]bool{"retrieve": true}
l.Debug().Msg("Lauching execution on" + p.UUID)
resp, err := p.LaunchPeerExecution(p.UUID, wfId, tools.MINIO_SVCACC, tools.POST, body, caller)
if err != nil {
l.Error().Msg("Error when executing on peer at " + p.Url + " when retrieving S3 credentials")
l.Error().Msg(err.Error())
return "", "", err
}
result_code := caller.LastResults["code"].(int)
if !slices.Contains([]int{200,201}, result_code) {
l.Error().Msg(fmt.Sprint("Error when trying to create a serviceAccount on storage " + storageRes.Name + " on peer at " + p.Url))
if _, ok := caller.LastResults["body"]; ok {
l.Error().Msg(string(caller.LastResults["body"].([]byte)))
return "", "", fmt.Errorf(string(caller.LastResults["body"].(map[string]interface{})["error"].([]byte)))
}
}
var access, secret string
if a, ok := resp["access"]; !ok {
return "", "", fmt.Errorf("Error in the response returned when creating a S3 serviceAccount on " + storageRes.Name + " on peer " + p.UUID)
} else {
access = a.(string)
}
if s, ok := resp["secret"]; !ok {
return "", "", fmt.Errorf("Error in the response returned when creating a S3 serviceAccount on " + storageRes.Name + " on peer " + p.UUID)
} else {
secret = s.(string)
}
return access, secret, nil
}
func postS3Secret(peerID string, s resources.StorageResource, caller *tools.HTTPCaller, execId string, wfId string, c resources.ComputeResource, access string, secret string) error {
l := oclib.GetLogger()
res := oclib.NewRequest(oclib.LibDataEnum(oclib.PEER), "", peerID, []string{}, nil).LoadOne(c.CreatorID)
if res.Code != 200 {
l.Error().Msg("Error while loading a peer for creation of the serviceAccount")
return fmt.Errorf(res.Err)
}
p := res.ToPeer()
caller.URLS[tools.MINIO_SVCACC_SECRET] = map[tools.METHOD]string{
tools.POST: "/secret/" + s.UUID + "/" + execId,
}
body := map[string]string{"access": access, "secret": secret}
_, err := p.LaunchPeerExecution(p.UUID, wfId, tools.MINIO_SVCACC_SECRET, tools.POST, body, caller)
if err != nil {
l.Error().Msg("Error when executing on peer at " + p.Url + " when creating a secret holding s3 credentials in namespace " + execId)
l.Error().Msg(err.Error())
return fmt.Errorf("Error when executing on peer at " + p.Url + " when creating a secret holding s3 credentials" + " : " + err.Error())
}
result_code := caller.LastResults["code"].(int)
if !slices.Contains([]int{200,201}, result_code) {
l.Error().Msg(fmt.Sprint("Error when trying to post the credential to " + s.Name + "to a secret on peer at " + p.Url))
if _, ok := caller.LastResults["body"]; ok {
l.Error().Msg(string(caller.LastResults["body"].([]byte)))
return fmt.Errorf(string(caller.LastResults["body"].(map[string]interface{})["error"].([]byte)))
}
}
return nil
}

10
go.mod
View File

@ -5,7 +5,7 @@ go 1.23.0
toolchain go1.24.0
require (
cloud.o-forge.io/core/oc-lib v0.0.0-20250710094754-98a2359c9d9f
cloud.o-forge.io/core/oc-lib v0.0.0-20250805113921-40a61387b9f1
github.com/beego/beego/v2 v2.3.8
github.com/google/uuid v1.6.0
github.com/smartystreets/goconvey v1.7.2
@ -34,11 +34,11 @@ require (
github.com/mitchellh/mapstructure v1.5.0 // indirect
github.com/montanaflynn/stats v0.7.1 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/nats-io/nats.go v1.43.0 // indirect
github.com/nats-io/nats.go v1.44.0 // indirect
github.com/nats-io/nkeys v0.4.11 // indirect
github.com/nats-io/nuid v1.0.1 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/prometheus/client_golang v1.22.0 // indirect
github.com/prometheus/client_golang v1.23.0 // indirect
github.com/prometheus/client_model v0.6.2 // indirect
github.com/prometheus/common v0.65.0 // indirect
github.com/prometheus/procfs v0.17.0 // indirect
@ -51,8 +51,8 @@ require (
github.com/xdg-go/scram v1.1.2 // indirect
github.com/xdg-go/stringprep v1.0.4 // indirect
github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
golang.org/x/crypto v0.39.0 // indirect
golang.org/x/net v0.41.0 // indirect
golang.org/x/crypto v0.40.0 // indirect
golang.org/x/net v0.42.0 // indirect
golang.org/x/sync v0.16.0 // indirect
golang.org/x/sys v0.34.0 // indirect
golang.org/x/text v0.27.0 // indirect

22
go.sum
View File

@ -12,6 +12,20 @@ cloud.o-forge.io/core/oc-lib v0.0.0-20250709154237-83e590d4e190 h1:/8uQ2nkJnv13K
cloud.o-forge.io/core/oc-lib v0.0.0-20250709154237-83e590d4e190/go.mod h1:vHWauJsS6ryf7UDqq8hRXoYD5RsONxcFTxeZPOztEuI=
cloud.o-forge.io/core/oc-lib v0.0.0-20250710094754-98a2359c9d9f h1:PZ8yVeZ4q85lMQ06KIRyHkSJnrlFf78fxgV2fjzZHqc=
cloud.o-forge.io/core/oc-lib v0.0.0-20250710094754-98a2359c9d9f/go.mod h1:vHWauJsS6ryf7UDqq8hRXoYD5RsONxcFTxeZPOztEuI=
cloud.o-forge.io/core/oc-lib v0.0.0-20250730160123-76d83878ebd3 h1:SCG9evvlT1yrYi9mxvIX2hZaQAuv33AdH6rKqAOH6yg=
cloud.o-forge.io/core/oc-lib v0.0.0-20250730160123-76d83878ebd3/go.mod h1:vHWauJsS6ryf7UDqq8hRXoYD5RsONxcFTxeZPOztEuI=
cloud.o-forge.io/core/oc-lib v0.0.0-20250730161555-a093369dc5a2 h1:M6bVZ08gSYnwOHWS/zqNe8+7xwc4zewjmxDor5kBXqo=
cloud.o-forge.io/core/oc-lib v0.0.0-20250730161555-a093369dc5a2/go.mod h1:vHWauJsS6ryf7UDqq8hRXoYD5RsONxcFTxeZPOztEuI=
cloud.o-forge.io/core/oc-lib v0.0.0-20250730162109-be2a1cc11474 h1:LpC+PkWmzKcsqKJbaqDiHnO5UxeGaJtscJ2aEqMXD0I=
cloud.o-forge.io/core/oc-lib v0.0.0-20250730162109-be2a1cc11474/go.mod h1:vHWauJsS6ryf7UDqq8hRXoYD5RsONxcFTxeZPOztEuI=
cloud.o-forge.io/core/oc-lib v0.0.0-20250731135305-cc3091d401ea h1:yJ4cdFycOw8+X97gh8e33piztu6J0V+iWWkVtvx9V/g=
cloud.o-forge.io/core/oc-lib v0.0.0-20250731135305-cc3091d401ea/go.mod h1:vHWauJsS6ryf7UDqq8hRXoYD5RsONxcFTxeZPOztEuI=
cloud.o-forge.io/core/oc-lib v0.0.0-20250805095627-76e9b2562e9b h1:ktjmh3VA0gb+TAfbnQNX0XAGUpA6HYm9p9myyvYL1IE=
cloud.o-forge.io/core/oc-lib v0.0.0-20250805095627-76e9b2562e9b/go.mod h1:vHWauJsS6ryf7UDqq8hRXoYD5RsONxcFTxeZPOztEuI=
cloud.o-forge.io/core/oc-lib v0.0.0-20250805112547-cc939451fd81 h1:539qIasa1Vz+FY8nEdLTQHXJqZBSLDuRY7mWo2r+vDg=
cloud.o-forge.io/core/oc-lib v0.0.0-20250805112547-cc939451fd81/go.mod h1:vHWauJsS6ryf7UDqq8hRXoYD5RsONxcFTxeZPOztEuI=
cloud.o-forge.io/core/oc-lib v0.0.0-20250805113921-40a61387b9f1 h1:53KzZ+1JqRY6J7EVzQpNBmLzNuxb8oHNW3UgqxkYABo=
cloud.o-forge.io/core/oc-lib v0.0.0-20250805113921-40a61387b9f1/go.mod h1:vHWauJsS6ryf7UDqq8hRXoYD5RsONxcFTxeZPOztEuI=
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
github.com/beego/beego/v2 v2.3.8 h1:wplhB1pF4TxR+2SS4PUej8eDoH4xGfxuHfS7wAk9VBc=
github.com/beego/beego/v2 v2.3.8/go.mod h1:8vl9+RrXqvodrl9C8yivX1e6le6deCK6RWeq8R7gTTg=
@ -94,6 +108,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
github.com/nats-io/nats.go v1.43.0 h1:uRFZ2FEoRvP64+UUhaTokyS18XBCR/xM2vQZKO4i8ug=
github.com/nats-io/nats.go v1.43.0/go.mod h1:iRWIPokVIFbVijxuMQq4y9ttaBTMe0SFdlZfMDd+33g=
github.com/nats-io/nats.go v1.44.0 h1:ECKVrDLdh/kDPV1g0gAQ+2+m2KprqZK5O/eJAyAnH2M=
github.com/nats-io/nats.go v1.44.0/go.mod h1:iRWIPokVIFbVijxuMQq4y9ttaBTMe0SFdlZfMDd+33g=
github.com/nats-io/nkeys v0.4.11 h1:q44qGV008kYd9W1b1nEBkNzvnWxtRSQ7A8BoqRrcfa0=
github.com/nats-io/nkeys v0.4.11/go.mod h1:szDimtgmfOi9n25JpfIdGw12tZFYXqhGxjhVxsatHVE=
github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
@ -106,6 +122,8 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
@ -150,6 +168,8 @@ golang.org/x/crypto v0.0.0-20191112222119-e1110fd1c708/go.mod h1:LzIPMQfyMNhhGPh
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@ -158,6 +178,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=