Merge pull request ceph#56190 from rhcs-dashboard/disable-multi-cluster-non-hub

mgr/dashboard: disable multi-cluster feature for non-hub clusters


Reviewed-by: Ankush Behl <[email protected]>

Author: aaSharma14

src/pybind/mgr/dashboard/controllers/multi_cluster.py

@@ -56,40 +56,93 @@ def _proxy(self, method, base_url, path, params=None, payload=None, verify=False
     def auth(self, url: str, cluster_alias: str, username: str,
              password=None, token=None, hub_url=None, cluster_fsid=None,
              prometheus_api_url=None, ssl_verify=False, ssl_certificate=None):
+        try:
+            hub_fsid = mgr.get('config')['fsid']
+        except KeyError:
+            hub_fsid = ''
+
         if password:
             payload = {
                 'username': username,
                 'password': password
             }
-            content = self._proxy('POST', url, 'api/auth', payload=payload)
-            if 'token' not in content:
-                raise DashboardException(
-                    "Could not authenticate to remote cluster",
-                    http_status_code=400,
-                    component='dashboard')
-
-            cluster_token = content['token']
+            cluster_token = self.check_cluster_connection(url, payload, username,
+                                                          ssl_verify, ssl_certificate)
 
             self._proxy('PUT', url, 'ui-api/multi-cluster/set_cors_endpoint',
                         payload={'url': hub_url}, token=cluster_token, verify=ssl_verify,
                         cert=ssl_certificate)
+
             fsid = self._proxy('GET', url, 'api/health/get_cluster_fsid', token=cluster_token)
 
+            managed_by_clusters_content = self._proxy('GET', url,
+                                                      'api/settings/MANAGED_BY_CLUSTERS',
+                                                      token=cluster_token)
+
+            managed_by_clusters_config = managed_by_clusters_content['value']
+
+            if managed_by_clusters_config is not None:
+                managed_by_clusters_config.append({'url': hub_url, 'fsid': hub_fsid})
+
+            self._proxy('PUT', url, 'api/settings/MANAGED_BY_CLUSTERS',
+                        payload={'value': managed_by_clusters_config}, token=cluster_token,
+                        verify=ssl_verify, cert=ssl_certificate)
+
             # add prometheus targets
             prometheus_url = self._proxy('GET', url, 'api/settings/PROMETHEUS_API_HOST',
                                          token=cluster_token)
+
             _set_prometheus_targets(prometheus_url['value'])
 
             self.set_multi_cluster_config(fsid, username, url, cluster_alias,
                                           cluster_token, prometheus_url['value'],
                                           ssl_verify, ssl_certificate)
-            return
+            return True
 
         if token and cluster_fsid and prometheus_api_url:
             _set_prometheus_targets(prometheus_api_url)
             self.set_multi_cluster_config(cluster_fsid, username, url,
                                           cluster_alias, token, prometheus_api_url,
                                           ssl_verify, ssl_certificate)
+        return True
+
+    def check_cluster_connection(self, url, payload, username, ssl_verify, ssl_certificate):
+        try:
+            content = self._proxy('POST', url, 'api/auth', payload=payload,
+                                  verify=ssl_verify, cert=ssl_certificate)
+            if 'token' not in content:
+                raise DashboardException(msg=content['detail'], code='invalid_credentials',
+                                         component='multi-cluster')
+
+            user_content = self._proxy('GET', url, f'api/user/{username}',
+                                       token=content['token'])
+
+            if 'status' in user_content and user_content['status'] == '403 Forbidden':
+                raise DashboardException(msg='User is not an administrator',
+                                         code='invalid_permission', component='multi-cluster')
+            if 'roles' in user_content and 'administrator' not in user_content['roles']:
+                raise DashboardException(msg='User is not an administrator',
+                                         code='invalid_permission', component='multi-cluster')
+
+        except Exception as e:
+            if '[Errno 111] Connection refused' in str(e):
+                raise DashboardException(msg='Connection refused',
+                                         code='connection_refused', component='multi-cluster')
+            raise DashboardException(msg=str(e), code='connection_failed',
+                                     component='multi-cluster')
+
+        cluster_token = content['token']
+
+        managed_by_clusters_content = self._proxy('GET', url, 'api/settings/MANAGED_BY_CLUSTERS',
+                                                  token=cluster_token)
+
+        managed_by_clusters_config = managed_by_clusters_content['value']
+
+        if len(managed_by_clusters_config) > 1:
+            raise DashboardException(msg='Cluster is already managed by another cluster',
+                                     code='cluster_managed_by_another_cluster',
+                                     component='multi-cluster')
+        return cluster_token
 
     def set_multi_cluster_config(self, fsid, username, url, cluster_alias, token,
                                  prometheus_url=None, ssl_verify=False, ssl_certificate=None):
@@ -144,7 +197,7 @@ def set_config(self, config: object):
 
     @Endpoint('PUT')
     @UpdatePermission
-    # pylint: disable=unused-variable
+    # pylint: disable=W0613
     def reconnect_cluster(self, url: str, username=None, password=None, token=None,
                           ssl_verify=False, ssl_certificate=None):
         multicluster_config = self.load_multi_cluster_config()
@@ -153,24 +206,18 @@ def reconnect_cluster(self, url: str, username=None, password=None, token=None,
                 'username': username,
                 'password': password
             }
-            content = self._proxy('POST', url, 'api/auth', payload=payload,
-                                  verify=ssl_verify, cert=ssl_certificate)
-            if 'token' not in content:
-                raise DashboardException(
-                    "Could not authenticate to remote cluster",
-                    http_status_code=400,
-                    component='dashboard')
 
-            token = content['token']
+            cluster_token = self.check_cluster_connection(url, payload, username,
+                                                          ssl_verify, ssl_certificate)
 
-        if username and token:
+        if username and cluster_token:
             if "config" in multicluster_config:
                 for _, cluster_details in multicluster_config["config"].items():
                     for cluster in cluster_details:
                         if cluster["url"] == url and cluster["user"] == username:
-                            cluster['token'] = token
+                            cluster['token'] = cluster_token
             Settings.MULTICLUSTER_CONFIG = multicluster_config
-        return Settings.MULTICLUSTER_CONFIG
+        return True
 
     @Endpoint('PUT')
     @UpdatePermission
@@ -189,10 +236,17 @@ def edit_cluster(self, url, cluster_alias, username):
     @DeletePermission
     def delete_cluster(self, cluster_name, cluster_user):
         multicluster_config = self.load_multi_cluster_config()
+        try:
+            hub_fsid = mgr.get('config')['fsid']
+        except KeyError:
+            hub_fsid = ''
         if "config" in multicluster_config:
             for key, value in list(multicluster_config['config'].items()):
                 if value[0]['name'] == cluster_name and value[0]['user'] == cluster_user:
-
+                    cluster_url = value[0]['url']
+                    cluster_token = value[0]['token']
+                    cluster_ssl_certificate = value[0]['ssl_certificate']
+                    cluster_ssl_verify = value[0]['ssl_verify']
                     orch_backend = mgr.get_module_option_ex('orchestrator', 'orchestrator')
                     try:
                         if orch_backend == 'cephadm':
@@ -204,55 +258,25 @@ def delete_cluster(self, cluster_name, cluster_user):
                     except KeyError:
                         pass
 
+                    managed_by_clusters_content = self._proxy('GET', cluster_url,
+                                                              'api/settings/MANAGED_BY_CLUSTERS',
+                                                              token=cluster_token)
+
+                    managed_by_clusters_config = managed_by_clusters_content['value']
+                    for cluster in managed_by_clusters_config:
+                        if cluster['fsid'] == hub_fsid:
+                            managed_by_clusters_config.remove(cluster)
+
+                    self._proxy('PUT', cluster_url, 'api/settings/MANAGED_BY_CLUSTERS',
+                                payload={'value': managed_by_clusters_config}, token=cluster_token,
+                                verify=cluster_ssl_verify, cert=cluster_ssl_certificate)
+
                     del multicluster_config['config'][key]
                     break
 
         Settings.MULTICLUSTER_CONFIG = multicluster_config
         return Settings.MULTICLUSTER_CONFIG
 
-    @Endpoint('POST')
-    @CreatePermission
-    # pylint: disable=R0911
-    def verify_connection(self, url=None, username=None, password=None, token=None,
-                          ssl_verify=False, ssl_certificate=None):
-        if token:
-            try:
-                payload = {
-                    'token': token
-                }
-                content = self._proxy('POST', url, 'api/auth/check', payload=payload,
-                                      verify=ssl_verify, cert=ssl_certificate)
-                if 'permissions' not in content:
-                    return content['detail']
-                user_content = self._proxy('GET', url, f'api/user/{username}',
-                                           token=content['token'])
-                if 'status' in user_content and user_content['status'] == '403 Forbidden':
-                    return 'User is not an administrator'
-            except Exception as e:  # pylint: disable=broad-except
-                if '[Errno 111] Connection refused' in str(e):
-                    return 'Connection refused'
-                return 'Connection failed'
-
-        if username and password:
-            try:
-                payload = {
-                    'username': username,
-                    'password': password
-                }
-                content = self._proxy('POST', url, 'api/auth', payload=payload,
-                                      verify=ssl_verify, cert=ssl_certificate)
-                if 'token' not in content:
-                    return content['detail']
-                user_content = self._proxy('GET', url, f'api/user/{username}',
-                                           token=content['token'])
-                if 'status' in user_content and user_content['status'] == '403 Forbidden':
-                    return 'User is not an administrator'
-            except Exception as e:  # pylint: disable=broad-except
-                if '[Errno 111] Connection refused' in str(e):
-                    return 'Connection refused'
-                return 'Connection failed'
-        return 'Connection successful'
-
     @Endpoint()
     @ReadPermission
     def get_config(self):

src/pybind/mgr/dashboard/frontend/src/app/ceph/cluster/multi-cluster/multi-cluster-form/multi-cluster-form.component.html

@@ -220,40 +220,27 @@
         </div>
 
         <!-- ssl_cert -->
-          <div *ngIf="remoteClusterForm.controls.ssl.value"
-               class="form-group row">
-            <label class="cd-col-form-label"
-                   for="ssl_cert">
-              <span i18n>Certificate</span>
-              <cd-helper i18n>The SSL certificate in PEM format.</cd-helper>
-            </label>
-            <div class="cd-col-form-input">
-              <textarea id="ssl_cert"
-                        class="form-control resize-vertical text-monospace text-pre"
-                        formControlName="ssl_cert"
-                        rows="5">
-              </textarea>
-              <input type="file"
-                     (change)="fileUpload($event.target.files, 'ssl_cert')">
-              <span class="invalid-feedback"
-                    *ngIf="remoteClusterForm.showError('ssl_cert', frm, 'required')"
-                    i18n>This field is required.</span>
-              <span class="invalid-feedback"
-                    *ngIf="remoteClusterForm.showError('ssl_cert', frm, 'pattern')"
-                    i18n>Invalid SSL certificate.</span>
-            </div>
-          </div>
-        <div class="form-group row"
-             *ngIf="!showCrossOriginError && action !== 'edit' && !remoteClusterForm.getValue('showToken') && !connectionVerified">
-          <div class="cd-col-form-offset">
-            <div class="custom-control">
-              <button class="btn btn-primary"
-                      type="button"
-                      [disabled]="(remoteClusterForm.getValue('showToken') && remoteClusterForm.getValue('apiToken') === '') || (!remoteClusterForm.getValue('showToken') && (remoteClusterForm.getValue('username') === '' || remoteClusterForm.getValue('password') === ''))"
-                      (click)="verifyConnection()">
-                Verify Connection
-              </button>
-            </div>
+        <div *ngIf="remoteClusterForm.controls.ssl.value"
+             class="form-group row">
+          <label class="cd-col-form-label"
+                 for="ssl_cert">
+            <span i18n>Certificate</span>
+            <cd-helper i18n>The SSL certificate in PEM format.</cd-helper>
+          </label>
+          <div class="cd-col-form-input">
+            <textarea id="ssl_cert"
+                      class="form-control resize-vertical text-monospace text-pre"
+                      formControlName="ssl_cert"
+                      rows="5">
+            </textarea>
+            <input type="file"
+                   (change)="fileUpload($event.target.files, 'ssl_cert')">
+            <span class="invalid-feedback"
+                  *ngIf="remoteClusterForm.showError('ssl_cert', frm, 'required')"
+                  i18n>This field is required.</span>
+            <span class="invalid-feedback"
+                  *ngIf="remoteClusterForm.showError('ssl_cert', frm, 'pattern')"
+                  i18n>Invalid SSL certificate.</span>
           </div>
         </div>
       </div>