feat(stacks): support automated sync for stacks [EE-248] (#5340)

2025-07-24 15:59:41 +02:00 · 2021-08-17 13:12:07 +12:00 · 2021-08-17 13:12:07 +12:00 · bcccdfb669
commit bcccdfb669
parent 5fe90db36a
94 changed files with 2680 additions and 469 deletions
--- a/api/stacks/deploy.go
+++ b/api/stacks/deploy.go
@ -0,0 +1,138 @@
+package stacks
+
+import (
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security"
+)
+
+func RedeployWhenChanged(stackID portainer.StackID, deployer StackDeployer, datastore portainer.DataStore, gitService portainer.GitService) error {
+	stack, err := datastore.Stack().Stack(stackID)
+	if err != nil {
+		return errors.WithMessagef(err, "failed to get the stack %v", stackID)
+	}
+
+	if stack.GitConfig == nil {
+		return nil // do nothing if it isn't a git-based stack
+	}
+
+	username, password := "", ""
+	if stack.GitConfig.Authentication != nil {
+		username, password = stack.GitConfig.Authentication.Username, stack.GitConfig.Authentication.Password
+	}
+
+	newHash, err := gitService.LatestCommitID(stack.GitConfig.URL, stack.GitConfig.ReferenceName, username, password)
+	if err != nil {
+		return errors.WithMessagef(err, "failed to fetch latest commit id of the stack %v", stack.ID)
+	}
+
+	if strings.EqualFold(newHash, string(stack.GitConfig.ConfigHash)) {
+		return nil
+	}
+
+	cloneParams := &cloneRepositoryParameters{
+		url:   stack.GitConfig.URL,
+		ref:   stack.GitConfig.ReferenceName,
+		toDir: stack.ProjectPath,
+	}
+	if stack.GitConfig.Authentication != nil {
+		cloneParams.auth = &gitAuth{
+			username: username,
+			password: password,
+		}
+	}
+
+	if err := cloneGitRepository(gitService, cloneParams); err != nil {
+		return errors.WithMessagef(err, "failed to do a fresh clone of the stack %v", stack.ID)
+	}
+
+	endpoint, err := datastore.Endpoint().Endpoint(stack.EndpointID)
+	if err != nil {
+		return errors.WithMessagef(err, "failed to find the endpoint %v associated to the stack %v", stack.EndpointID, stack.ID)
+	}
+
+	author := stack.UpdatedBy
+	if author == "" {
+		author = stack.CreatedBy
+	}
+
+	registries, err := getUserRegistries(datastore, author, endpoint.ID)
+	if err != nil {
+		return err
+	}
+
+	switch stack.Type {
+	case portainer.DockerComposeStack:
+		err := deployer.DeployComposeStack(stack, endpoint, registries)
+		if err != nil {
+			return errors.WithMessagef(err, "failed to deploy a docker compose stack %v", stackID)
+		}
+	case portainer.DockerSwarmStack:
+		err := deployer.DeploySwarmStack(stack, endpoint, registries, true)
+		if err != nil {
+			return errors.WithMessagef(err, "failed to deploy a docker compose stack %v", stackID)
+		}
+	default:
+		return errors.Errorf("cannot update stack, type %v is unsupported", stack.Type)
+	}
+
+	stack.UpdateDate = time.Now().Unix()
+	stack.GitConfig.ConfigHash = newHash
+	if err := datastore.Stack().UpdateStack(stack.ID, stack); err != nil {
+		return errors.WithMessagef(err, "failed to update the stack %v", stack.ID)
+	}
+
+	return nil
+}
+
+func getUserRegistries(datastore portainer.DataStore, authorUsername string, endpointID portainer.EndpointID) ([]portainer.Registry, error) {
+	registries, err := datastore.Registry().Registries()
+	if err != nil {
+		return nil, errors.WithMessage(err, "unable to retrieve registries from the database")
+	}
+
+	user, err := datastore.User().UserByUsername(authorUsername)
+	if err != nil {
+		return nil, errors.WithMessagef(err, "failed to fetch a stack's author [%s]", authorUsername)
+	}
+
+	if user.Role == portainer.AdministratorRole {
+		return registries, nil
+	}
+
+	userMemberships, err := datastore.TeamMembership().TeamMembershipsByUserID(user.ID)
+	if err != nil {
+		return nil, errors.WithMessagef(err, "failed to fetch memberships of the stack author [%s]", authorUsername)
+	}
+
+	filteredRegistries := make([]portainer.Registry, 0, len(registries))
+	for _, registry := range registries {
+		if security.AuthorizedRegistryAccess(&registry, user, userMemberships, endpointID) {
+			filteredRegistries = append(filteredRegistries, registry)
+		}
+	}
+
+	return filteredRegistries, nil
+}
+
+type cloneRepositoryParameters struct {
+	url   string
+	ref   string
+	toDir string
+	auth  *gitAuth
+}
+
+type gitAuth struct {
+	username string
+	password string
+}
+
+func cloneGitRepository(gitService portainer.GitService, cloneParams *cloneRepositoryParameters) error {
+	if cloneParams.auth != nil {
+		return gitService.CloneRepository(cloneParams.toDir, cloneParams.url, cloneParams.ref, cloneParams.auth.username, cloneParams.auth.password)
+	}
+	return gitService.CloneRepository(cloneParams.toDir, cloneParams.url, cloneParams.ref, "", "")
+}
--- a/api/stacks/deploy_test.go
+++ b/api/stacks/deploy_test.go
@ -0,0 +1,221 @@
+package stacks
+
+import (
+	"errors"
+	"io/ioutil"
+	"strings"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	bolt "github.com/portainer/portainer/api/bolt/bolttest"
+	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/stretchr/testify/assert"
+)
+
+type gitService struct {
+	cloneErr error
+	id       string
+}
+
+func (g *gitService) CloneRepository(destination, repositoryURL, referenceName, username, password string) error {
+	return g.cloneErr
+}
+
+func (g *gitService) LatestCommitID(repositoryURL, referenceName, username, password string) (string, error) {
+	return g.id, nil
+}
+
+type noopDeployer struct{}
+
+func (s *noopDeployer) DeploySwarmStack(stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry, prune bool) error {
+	return nil
+}
+
+func (s *noopDeployer) DeployComposeStack(stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry) error {
+	return nil
+}
+
+func Test_redeployWhenChanged_FailsWhenCannotFindStack(t *testing.T) {
+	store, teardown := bolt.MustNewTestStore(true)
+	defer teardown()
+
+	err := RedeployWhenChanged(1, nil, store, nil)
+	assert.Error(t, err)
+	assert.Truef(t, strings.HasPrefix(err.Error(), "failed to get the stack"), "it isn't an error we expected: %v", err.Error())
+}
+
+func Test_redeployWhenChanged_DoesNothingWhenNotAGitBasedStack(t *testing.T) {
+	store, teardown := bolt.MustNewTestStore(true)
+	defer teardown()
+
+	err := store.Stack().CreateStack(&portainer.Stack{ID: 1})
+	assert.NoError(t, err, "failed to create a test stack")
+
+	err = RedeployWhenChanged(1, nil, store, &gitService{nil, ""})
+	assert.NoError(t, err)
+}
+
+func Test_redeployWhenChanged_DoesNothingWhenNoGitChanges(t *testing.T) {
+	store, teardown := bolt.MustNewTestStore(true)
+	defer teardown()
+
+	tmpDir, _ := ioutil.TempDir("", "stack")
+
+	err := store.Stack().CreateStack(&portainer.Stack{
+		ID:          1,
+		ProjectPath: tmpDir,
+		GitConfig: &gittypes.RepoConfig{
+			URL:           "url",
+			ReferenceName: "ref",
+			ConfigHash:    "oldHash",
+		}})
+	assert.NoError(t, err, "failed to create a test stack")
+
+	err = RedeployWhenChanged(1, nil, store, &gitService{nil, "oldHash"})
+	assert.NoError(t, err)
+}
+
+func Test_redeployWhenChanged_FailsWhenCannotClone(t *testing.T) {
+	cloneErr := errors.New("failed to clone")
+	store, teardown := bolt.MustNewTestStore(true)
+	defer teardown()
+
+	err := store.Stack().CreateStack(&portainer.Stack{
+		ID: 1,
+		GitConfig: &gittypes.RepoConfig{
+			URL:           "url",
+			ReferenceName: "ref",
+			ConfigHash:    "oldHash",
+		}})
+	assert.NoError(t, err, "failed to create a test stack")
+
+	err = RedeployWhenChanged(1, nil, store, &gitService{cloneErr, "newHash"})
+	assert.Error(t, err)
+	assert.ErrorIs(t, err, cloneErr, "should failed to clone but didn't, check test setup")
+}
+
+func Test_redeployWhenChanged(t *testing.T) {
+	store, teardown := bolt.MustNewTestStore(true)
+	defer teardown()
+
+	tmpDir, _ := ioutil.TempDir("", "stack")
+
+	err := store.Endpoint().CreateEndpoint(&portainer.Endpoint{ID: 1})
+	assert.NoError(t, err, "error creating endpoint")
+
+	username := "user"
+	err = store.User().CreateUser(&portainer.User{Username: username, Role: portainer.AdministratorRole})
+	assert.NoError(t, err, "error creating a user")
+
+	stack := portainer.Stack{
+		ID:          1,
+		EndpointID:  1,
+		ProjectPath: tmpDir,
+		UpdatedBy:   username,
+		GitConfig: &gittypes.RepoConfig{
+			URL:           "url",
+			ReferenceName: "ref",
+			ConfigHash:    "oldHash",
+		}}
+	err = store.Stack().CreateStack(&stack)
+	assert.NoError(t, err, "failed to create a test stack")
+
+	t.Run("can deploy docker compose stack", func(t *testing.T) {
+		stack.Type = portainer.DockerComposeStack
+		store.Stack().UpdateStack(stack.ID, &stack)
+
+		err = RedeployWhenChanged(1, &noopDeployer{}, store, &gitService{nil, "newHash"})
+		assert.NoError(t, err)
+	})
+
+	t.Run("can deploy docker swarm stack", func(t *testing.T) {
+		stack.Type = portainer.DockerSwarmStack
+		store.Stack().UpdateStack(stack.ID, &stack)
+
+		err = RedeployWhenChanged(1, &noopDeployer{}, store, &gitService{nil, "newHash"})
+		assert.NoError(t, err)
+	})
+
+	t.Run("can NOT deploy kube stack", func(t *testing.T) {
+		stack.Type = portainer.KubernetesStack
+		store.Stack().UpdateStack(stack.ID, &stack)
+
+		err = RedeployWhenChanged(1, &noopDeployer{}, store, &gitService{nil, "newHash"})
+		assert.EqualError(t, err, "cannot update stack, type 3 is unsupported")
+	})
+}
+
+func Test_getUserRegistries(t *testing.T) {
+	store, teardown := bolt.MustNewTestStore(true)
+	defer teardown()
+
+	endpointID := 123
+
+	admin := portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	err := store.User().CreateUser(&admin)
+	assert.NoError(t, err, "error creating an admin")
+
+	user := portainer.User{ID: 2, Username: "user", Role: portainer.StandardUserRole}
+	err = store.User().CreateUser(&user)
+	assert.NoError(t, err, "error creating a user")
+
+	team := portainer.Team{ID: 1, Name: "team"}
+
+	store.TeamMembership().CreateTeamMembership(&portainer.TeamMembership{
+		ID:     1,
+		UserID: user.ID,
+		TeamID: team.ID,
+		Role:   portainer.TeamMember,
+	})
+
+	registryReachableByUser := portainer.Registry{
+		ID: 1,
+		RegistryAccesses: portainer.RegistryAccesses{
+			portainer.EndpointID(endpointID): {
+				UserAccessPolicies: map[portainer.UserID]portainer.AccessPolicy{
+					user.ID: {RoleID: portainer.RoleID(portainer.StandardUserRole)},
+				},
+			},
+		},
+	}
+	err = store.Registry().CreateRegistry(&registryReachableByUser)
+	assert.NoError(t, err, "couldn't create a registry")
+
+	registryReachableByTeam := portainer.Registry{
+		ID: 2,
+		RegistryAccesses: portainer.RegistryAccesses{
+			portainer.EndpointID(endpointID): {
+				TeamAccessPolicies: map[portainer.TeamID]portainer.AccessPolicy{
+					team.ID: {RoleID: portainer.RoleID(portainer.StandardUserRole)},
+				},
+			},
+		},
+	}
+	err = store.Registry().CreateRegistry(&registryReachableByTeam)
+	assert.NoError(t, err, "couldn't create a registry")
+
+	registryRestricted := portainer.Registry{
+		ID: 3,
+		RegistryAccesses: portainer.RegistryAccesses{
+			portainer.EndpointID(endpointID): {
+				UserAccessPolicies: map[portainer.UserID]portainer.AccessPolicy{
+					user.ID + 100: {RoleID: portainer.RoleID(portainer.StandardUserRole)},
+				},
+			},
+		},
+	}
+	err = store.Registry().CreateRegistry(&registryRestricted)
+	assert.NoError(t, err, "couldn't create a registry")
+
+	t.Run("admin should has access to all registries", func(t *testing.T) {
+		registries, err := getUserRegistries(store, admin.Username, portainer.EndpointID(endpointID))
+		assert.NoError(t, err)
+		assert.ElementsMatch(t, []portainer.Registry{registryReachableByUser, registryReachableByTeam, registryRestricted}, registries)
+	})
+
+	t.Run("regular user has access to registries allowed to him and/or his team", func(t *testing.T) {
+		registries, err := getUserRegistries(store, user.Username, portainer.EndpointID(endpointID))
+		assert.NoError(t, err)
+		assert.ElementsMatch(t, []portainer.Registry{registryReachableByUser, registryReachableByTeam}, registries)
+	})
+}
--- a/api/stacks/deployer.go
+++ b/api/stacks/deployer.go
@ -0,0 +1,46 @@
+package stacks
+
+import (
+	"sync"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+type StackDeployer interface {
+	DeploySwarmStack(stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry, prune bool) error
+	DeployComposeStack(stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry) error
+}
+
+type stackDeployer struct {
+	lock                *sync.Mutex
+	swarmStackManager   portainer.SwarmStackManager
+	composeStackManager portainer.ComposeStackManager
+}
+
+func NewStackDeployer(swarmStackManager portainer.SwarmStackManager, composeStackManager portainer.ComposeStackManager) *stackDeployer {
+	return &stackDeployer{
+		lock:                &sync.Mutex{},
+		swarmStackManager:   swarmStackManager,
+		composeStackManager: composeStackManager,
+	}
+}
+
+func (d *stackDeployer) DeploySwarmStack(stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry, prune bool) error {
+	d.lock.Lock()
+	defer d.lock.Unlock()
+
+	d.swarmStackManager.Login(registries, endpoint)
+	defer d.swarmStackManager.Logout(endpoint)
+
+	return d.swarmStackManager.Deploy(stack, prune, endpoint)
+}
+
+func (d *stackDeployer) DeployComposeStack(stack *portainer.Stack, endpoint *portainer.Endpoint, registries []portainer.Registry) error {
+	d.lock.Lock()
+	defer d.lock.Unlock()
+
+	d.swarmStackManager.Login(registries, endpoint)
+	defer d.swarmStackManager.Logout(endpoint)
+
+	return d.composeStackManager.Up(stack, endpoint)
+}
--- a/api/stacks/scheduled.go
+++ b/api/stacks/scheduled.go
@ -0,0 +1,34 @@
+package stacks
+
+import (
+	"log"
+	"time"
+
+	"github.com/pkg/errors"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/scheduler"
+)
+
+func StartStackSchedules(scheduler *scheduler.Scheduler, stackdeployer StackDeployer, datastore portainer.DataStore, gitService portainer.GitService) error {
+	stacks, err := datastore.Stack().RefreshableStacks()
+	if err != nil {
+		return errors.Wrap(err, "failed to fetch refreshable stacks")
+	}
+	for _, stack := range stacks {
+		d, err := time.ParseDuration(stack.AutoUpdate.Interval)
+		if err != nil {
+			return errors.Wrap(err, "Unable to parse auto update interval")
+		}
+		jobID := scheduler.StartJobEvery(d, func() {
+			if err := RedeployWhenChanged(stack.ID, stackdeployer, datastore, gitService); err != nil {
+				log.Printf("[ERROR] %s\n", err)
+			}
+		})
+
+		stack.AutoUpdate.JobID = jobID
+		if err := datastore.Stack().UpdateStack(stack.ID, &stack); err != nil {
+			return errors.Wrap(err, "failed to update stack job id")
+		}
+	}
+	return nil
+}