139 lines
5.9 KiB
YAML
139 lines
5.9 KiB
YAML
# services/harbor/bootstrap-jobs/cassandra-registry-ensure-job.yaml
|
|
# One-off repair/audit job for the Cassandra Harbor migration.
|
|
# Keep suspended unless the Harbor project or robot scopes need to be recreated.
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: cassandra-registry-ensure-1
|
|
namespace: harbor
|
|
spec:
|
|
suspend: true
|
|
backoffLimit: 1
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
vault.hashicorp.com/agent-inject: "true"
|
|
vault.hashicorp.com/agent-pre-populate-only: "true"
|
|
vault.hashicorp.com/role: "harbor"
|
|
vault.hashicorp.com/agent-inject-secret-harbor-admin.sh: "kv/data/atlas/harbor/harbor-core"
|
|
vault.hashicorp.com/agent-inject-template-harbor-admin.sh: |
|
|
{{- with secret "kv/data/atlas/harbor/harbor-core" }}
|
|
export HARBOR_ADMIN_PASSWORD="{{ .Data.data.harbor_admin_password }}"
|
|
{{- end }}
|
|
spec:
|
|
restartPolicy: Never
|
|
serviceAccountName: harbor-vault-sync
|
|
containers:
|
|
- name: ensure
|
|
image: python:3.11-alpine
|
|
command: ["python", "-c"]
|
|
args:
|
|
- |
|
|
import base64
|
|
import json
|
|
import os
|
|
import urllib.error
|
|
import urllib.request
|
|
|
|
secret_path = "/vault/secrets/harbor-admin.sh"
|
|
env = {}
|
|
with open(secret_path, "r", encoding="utf-8") as handle:
|
|
for line in handle:
|
|
line = line.strip()
|
|
if not line.startswith("export "):
|
|
continue
|
|
key, value = line[len("export ") :].split("=", 1)
|
|
env[key] = value.strip('"')
|
|
|
|
password = env["HARBOR_ADMIN_PASSWORD"]
|
|
api = os.environ.get(
|
|
"HARBOR_API",
|
|
"http://harbor-core.harbor.svc.cluster.local/api/v2.0",
|
|
).rstrip("/")
|
|
auth = base64.b64encode(f"admin:{password}".encode("utf-8")).decode("ascii")
|
|
|
|
def request(method, path, payload=None, ok=(200,)):
|
|
data = None
|
|
headers = {"Authorization": f"Basic {auth}"}
|
|
if payload is not None:
|
|
data = json.dumps(payload).encode("utf-8")
|
|
headers["Content-Type"] = "application/json"
|
|
req = urllib.request.Request(
|
|
f"{api}{path}",
|
|
data=data,
|
|
method=method,
|
|
headers=headers,
|
|
)
|
|
try:
|
|
with urllib.request.urlopen(req, timeout=30) as response:
|
|
body = response.read()
|
|
if response.status not in ok:
|
|
raise RuntimeError(f"{method} {path} returned {response.status}")
|
|
if not body:
|
|
return None
|
|
return json.loads(body.decode("utf-8"))
|
|
except urllib.error.HTTPError as exc:
|
|
detail = exc.read().decode("utf-8", errors="replace")
|
|
if exc.code in ok:
|
|
return None
|
|
raise RuntimeError(f"{method} {path} returned {exc.code}: {detail}") from exc
|
|
|
|
projects = request("GET", "/projects?name=cassandra")
|
|
if not projects:
|
|
request(
|
|
"POST",
|
|
"/projects",
|
|
{
|
|
"project_name": "cassandra",
|
|
"metadata": {
|
|
"public": "false",
|
|
"auto_scan": "false",
|
|
"enable_content_trust": "false",
|
|
"prevent_vul": "false",
|
|
"reuse_sys_cve_allowlist": "true",
|
|
},
|
|
},
|
|
ok=(201, 409),
|
|
)
|
|
|
|
def ensure_permission(robot_name, access, description=None):
|
|
robots = request("GET", "/robots?page_size=100")
|
|
matches = [robot for robot in robots if robot.get("name") == robot_name]
|
|
if not matches:
|
|
raise RuntimeError(f"Harbor robot {robot_name} not found")
|
|
robot = request("GET", f"/robots/{matches[0]['id']}")
|
|
permissions = list(robot.get("permissions") or [])
|
|
if not any(
|
|
item.get("kind") == "project" and item.get("namespace") == "cassandra"
|
|
for item in permissions
|
|
):
|
|
permissions.append(
|
|
{"kind": "project", "namespace": "cassandra", "access": access}
|
|
)
|
|
payload = {
|
|
"name": robot["name"],
|
|
"level": robot["level"],
|
|
"disable": bool(robot.get("disable", False)),
|
|
"duration": int(robot.get("duration", -1)),
|
|
"permissions": permissions,
|
|
}
|
|
if description:
|
|
payload["description"] = description
|
|
elif robot.get("description"):
|
|
payload["description"] = robot["description"]
|
|
request("PUT", f"/robots/{robot['id']}", payload, ok=(200,))
|
|
|
|
ensure_permission(
|
|
"robot$pull-atlas",
|
|
[{"resource": "repository", "action": "pull"}],
|
|
)
|
|
ensure_permission(
|
|
"robot$jenkins-pipelines",
|
|
[
|
|
{"resource": "repository", "action": "pull"},
|
|
{"resource": "repository", "action": "push"},
|
|
],
|
|
"Jenkins image push robot for bstein, veles, and cassandra pipelines",
|
|
)
|
|
print("Cassandra Harbor project and robot scopes are present")
|