cloud-init-dev team mailing list archive

[Dan Watkins <daniel.watkins@xxxxxxxxxxxxx>]

Diff comments:

> diff --git a/cloudinit/config/cc_ubuntu_advantage.py b/cloudinit/config/cc_ubuntu_advantage.py
> index 5e082bd..9732ffa 100644
> --- a/cloudinit/config/cc_ubuntu_advantage.py
> +++ b/cloudinit/config/cc_ubuntu_advantage.py
> @@ -1,150 +1,125 @@
> -# Copyright (C) 2018 Canonical Ltd.
> -#
>  # This file is part of cloud-init. See LICENSE file for license information.
>  
> -"""Ubuntu advantage: manage ubuntu-advantage offerings from Canonical."""
> +"""ubuntu_advantage: Configure Ubuntu Advantage support entitlements"""
>  
> -import sys
>  from textwrap import dedent
>  
> -from cloudinit import log as logging
>  from cloudinit.config.schema import (
>      get_schema_doc, validate_cloudconfig_schema)
> +from cloudinit import log as logging
>  from cloudinit.settings import PER_INSTANCE
> -from cloudinit.subp import prepend_base_command
>  from cloudinit import util
>  
>  
> -distros = ['ubuntu']
> -frequency = PER_INSTANCE
> +UA_URL = 'https://ubuntu.com/advantage'
>  
> -LOG = logging.getLogger(__name__)
> +distros = ['ubuntu']
>  
>  schema = {
>      'id': 'cc_ubuntu_advantage',
>      'name': 'Ubuntu Advantage',
> -    'title': 'Install, configure and manage ubuntu-advantage offerings',
> +    'title': 'Configure Ubuntu Advantage support entitlements',
>      'description': dedent("""\
> -        This module provides configuration options to setup ubuntu-advantage
> -        subscriptions.
> -
> -        .. note::
> -            Both ``commands`` value can be either a dictionary or a list. If
> -            the configuration provided is a dictionary, the keys are only used
> -            to order the execution of the commands and the dictionary is
> -            merged with any vendor-data ubuntu-advantage configuration
> -            provided. If a ``commands`` is provided as a list, any vendor-data
> -            ubuntu-advantage ``commands`` are ignored.
> -
> -        Ubuntu-advantage ``commands`` is a dictionary or list of
> -        ubuntu-advantage commands to run on the deployed machine.
> -        These commands can be used to enable or disable subscriptions to
> -        various ubuntu-advantage products. See 'man ubuntu-advantage' for more
> -        information on supported subcommands.
> -
> -        .. note::
> -           Each command item can be a string or list. If the item is a list,
> -           'ubuntu-advantage' can be omitted and it will automatically be
> -           inserted as part of the command.
> +        Attach machine to an existing Ubuntu Advantage support contract and
> +        enable or disable support entitlements such as livepatch, ESM,
> +        FIPS, FIPS Updates and CIS Audit tools. When attaching a machine to
> +        Ubuntu Advantage, one can also specify entitlements to
> +        enable.  When the 'entitlements' list is present, any named entitlement
> +        will be enabled and all absent entitlements will remain disabled.
> +
> +        Note that when enabling FIPS or FIPS updates you will need to schedule
> +        a reboot to ensure the machine is running the FIPS-compliant kernel.
> +        See :ref:`Power State Change` for information on how to configure
> +        cloud-init to perform this reboot.
>          """),
>      'distros': distros,
>      'examples': [dedent("""\
> -        # Enable Extended Security Maintenance using your service auth token
> +        # Attach the machine to a Ubuntu Advantage support contract with a
> +        # UA user token obtained from %s.
> +        ubuntu_advantage:
> +          token: <ua_user_token>
> +    """ % UA_URL), dedent("""\
> +        # Attach the machine to an Ubuntu Advantage support contract enabling
> +        # only fips and esm entitlements. Entitlements will only be enabled if
> +        # the environment supports said entitlement. Otherwise warnings will
> +        # be logged for incompatible entitlements specified.
>          ubuntu-advantage:
> -            commands:
> -              00: ubuntu-advantage enable-esm <token>
> +          token: <ua_user_token>
> +          entitlements:
> +          - fips
> +          - esm
>      """), dedent("""\
> -        # Enable livepatch by providing your livepatch token
> +        # Attach the machine to an Ubuntu Advantage support contract and enable
> +        # the FIPS entitlement.  Perform a reboot once cloud-init has
> +        # completed.
> +        power_state:
> +          mode: reboot
>          ubuntu-advantage:
> -            commands:
> -                00: ubuntu-advantage enable-livepatch <livepatch-token>
> -
> -    """), dedent("""\
> -        # Convenience: the ubuntu-advantage command can be omitted when
> -        # specifying commands as a list and 'ubuntu-advantage' will
> -        # automatically be prepended.
> -        # The following commands are equivalent
> -        ubuntu-advantage:
> -            commands:
> -                00: ['enable-livepatch', 'my-token']
> -                01: ['ubuntu-advantage', 'enable-livepatch', 'my-token']
> -                02: ubuntu-advantage enable-livepatch my-token
> -                03: 'ubuntu-advantage enable-livepatch my-token'
> -    """)],
> +          token: <ua_user_token>
> +          entitlements:
> +          - fips
> +        """)],
>      'frequency': PER_INSTANCE,
>      'type': 'object',
>      'properties': {
> -        'ubuntu-advantage': {
> +        'ubuntu_advantage': {
>              'type': 'object',
>              'properties': {
> -                'commands': {
> -                    'type': ['object', 'array'],  # Array of strings or dict
> -                    'items': {
> -                        'oneOf': [
> -                            {'type': 'array', 'items': {'type': 'string'}},
> -                            {'type': 'string'}]
> -                    },
> -                    'additionalItems': False,  # Reject non-string & non-list
> -                    'minItems': 1,
> -                    'minProperties': 1,
> +                'entitlements': {
> +                    'type': 'array',
> +                    'items': {'type': 'string'},
> +                },
> +                'token': {
> +                    'type': 'string',
> +                    'description': "A user-token obtained from %s." % UA_URL
>                  }
>              },
> -            'additionalProperties': False,  # Reject keys not in schema
> -            'required': ['commands']
> +            'required': ['token'],
> +            'additionalProperties': False
>          }
>      }
>  }
>  
> -# TODO schema for 'assertions' and 'commands' are too permissive at the moment.
> -# Once python-jsonschema supports schema draft 6 add support for arbitrary
> -# object keys with 'patternProperties' constraint to validate string values.
> -
>  __doc__ = get_schema_doc(schema)  # Supplement python help()
>  
> -UA_CMD = "ubuntu-advantage"
> +LOG = logging.getLogger(__name__)
>  
>  
> -def run_commands(commands):
> -    """Run the commands provided in ubuntu-advantage:commands config.
> +def configure_ua(token=None, entitlements=None):
> +    """Call ua commandline client to attach or enable entitlements."""
> +    error = None
> +    if not token:
> +        error = ('ubuntu_advantage: token must be provided')
> +        LOG.error(error)
> +        raise RuntimeError(error)
>  
> -     Commands are run individually. Any errors are collected and reported
> -     after attempting all commands.
> +    entitlement_cmds = []
> +    if entitlements is not None:  # Entitlements explicitly enabled
> +        entitlement_cmds.extend(
> +            [['ua', 'enable', name] for name in entitlements])
>  
> -     @param commands: A list or dict containing commands to run. Keys of a
> -         dict will be used to order the commands provided as dict values.
> -     """
> -    if not commands:
> -        return
> -    LOG.debug('Running user-provided ubuntu-advantage commands')
> -    if isinstance(commands, dict):
> -        # Sort commands based on dictionary key
> -        commands = [v for _, v in sorted(commands.items())]
> -    elif not isinstance(commands, list):
> -        raise TypeError(
> -            'commands parameter was not a list or dict: {commands}'.format(
> -                commands=commands))
> -
> -    fixed_ua_commands = prepend_base_command('ubuntu-advantage', commands)
> -
> -    cmd_failures = []
> -    for command in fixed_ua_commands:
> -        shell = isinstance(command, str)
> -        try:
> -            util.subp(command, shell=shell, status_cb=sys.stderr.write)
> -        except util.ProcessExecutionError as e:
> -            cmd_failures.append(str(e))
> -    if cmd_failures:
> -        msg = (
> -            'Failures running ubuntu-advantage commands:\n'
> -            '{cmd_failures}'.format(
> -                cmd_failures=cmd_failures))
> +    attach_cmd = ['ua', 'attach', token]
> +    LOG.debug('Attaching to Ubuntu Advantage. %s', ' '.join(attach_cmd))
> +    try:
> +        util.subp(attach_cmd)
> +    except util.ProcessExecutionError as e:
> +        msg = 'Failure attaching ubuntu advantage:\n{error}'.format(
> +            error=str(e))
>          util.logexc(LOG, msg)
>          raise RuntimeError(msg)
> +    for cmd in entitlement_cmds:
> +        try:
> +            util.subp(cmd, capture=True)
> +        except util.ProcessExecutionError as e:
> +            msg = 'Failure enabling ubuntu advantage:\n{error}'.format(
> +                error=str(e))
> +            util.logexc(LOG, msg)
> +            raise RuntimeError(msg)
>  
>  
>  def maybe_install_ua_tools(cloud):
>      """Install ubuntu-advantage-tools if not present."""

One note: this won't ensure that a version of ubuntu-advantage-tools new enough to include the Python client will be installed.  Given that ubuntu-advantage-tools is already included in the cloud images for all target releases (including trusty), this will apply everywhere.

We should consider making the test more than just `which` and either check apt versions, or (probably better given that we'll be doing backports) assert on the output of `--help` or similar.

> -    if util.which('ubuntu-advantage'):
> +    if util.which('ua'):
>          return
>      try:
>          cloud.distro.update_package_sources()


-- 
https://code.launchpad.net/~daniel-thewatkins/cloud-init/+git/cloud-init/+merge/365366
Your team cloud-init commiters is requested to review the proposed merge of ~daniel-thewatkins/cloud-init/+git/cloud-init:feature/cc-uaclient into cloud-init:master.