def _assert_get_value(self, override_strategy): base_config_contents = { 'Section_1': { 'name': 'pi', 'is_number': 'True', 'value': '3.1415' } } config_overrides_v1a = { 'Section_1': { 'name': 'sqrt(2)', 'value': '1.4142' } } config_overrides_v2 = { 'Section_1': { 'name': 'e', 'value': '2.7183' }, 'Section_2': { 'foo': 'bar' } } config_overrides_v1b = { 'Section_1': { 'name': 'sqrt(4)', 'value': '2.0' } } codec = IniCodec() current_user = getpass.getuser() with tempfile.NamedTemporaryFile() as base_config: # Write initial config contents. operating_system.write_file(base_config.name, base_config_contents, codec) manager = ConfigurationManager(base_config.name, current_user, current_user, codec, requires_root=False, override_strategy=override_strategy) # Test default value. self.assertIsNone(manager.get_value('Section_2')) self.assertEqual('foo', manager.get_value('Section_2', 'foo')) # Test value before applying overrides. self.assertEqual('pi', manager.get_value('Section_1')['name']) self.assertEqual('3.1415', manager.get_value('Section_1')['value']) # Test value after applying overrides. manager.apply_user_override(config_overrides_v1a, change_id='id1') self.assertEqual('sqrt(2)', manager.get_value('Section_1')['name']) self.assertEqual('1.4142', manager.get_value('Section_1')['value']) manager.apply_user_override(config_overrides_v2, change_id='id2') self.assertEqual('e', manager.get_value('Section_1')['name']) self.assertEqual('2.7183', manager.get_value('Section_1')['value']) self.assertEqual('bar', manager.get_value('Section_2')['foo']) # Editing change 'id1' become visible only after removing # change 'id2', which overrides 'id1'. manager.apply_user_override(config_overrides_v1b, change_id='id1') self.assertEqual('e', manager.get_value('Section_1')['name']) self.assertEqual('2.7183', manager.get_value('Section_1')['value']) # Test value after removing overrides. # The edited values from change 'id1' should be visible after # removing 'id2'. manager.remove_user_override(change_id='id2') self.assertEqual('sqrt(4)', manager.get_value('Section_1')['name']) self.assertEqual('2.0', manager.get_value('Section_1')['value']) # Back to the base. manager.remove_user_override(change_id='id1') self.assertEqual('pi', manager.get_value('Section_1')['name']) self.assertEqual('3.1415', manager.get_value('Section_1')['value']) self.assertIsNone(manager.get_value('Section_2')) # Test system overrides. manager.apply_system_override(config_overrides_v1b, change_id='id1') self.assertEqual('sqrt(4)', manager.get_value('Section_1')['name']) self.assertEqual('2.0', manager.get_value('Section_1')['value']) # The system values should take precedence over the user # override. manager.apply_user_override(config_overrides_v1a, change_id='id1') self.assertEqual('sqrt(4)', manager.get_value('Section_1')['name']) self.assertEqual('2.0', manager.get_value('Section_1')['value']) # The user values should become visible only after removing the # system change. manager.remove_system_override(change_id='id1') self.assertEqual('sqrt(2)', manager.get_value('Section_1')['name']) self.assertEqual('1.4142', manager.get_value('Section_1')['value']) # Back to the base. manager.remove_user_override(change_id='id1') self.assertEqual('pi', manager.get_value('Section_1')['name']) self.assertEqual('3.1415', manager.get_value('Section_1')['value']) self.assertIsNone(manager.get_value('Section_2'))
class RedisApp(object): """ Handles installation and configuration of redis on a trove instance. """ def __init__(self, state_change_wait_time=None): """ Sets default status and state_change_wait_time """ if state_change_wait_time: self.state_change_wait_time = state_change_wait_time else: self.state_change_wait_time = CONF.state_change_wait_time revision_dir = guestagent_utils.build_file_path( os.path.dirname(system.REDIS_CONFIG), ConfigurationManager.DEFAULT_STRATEGY_OVERRIDES_SUB_DIR) config_value_mappings = {'yes': True, 'no': False, "''": None} self._value_converter = StringConverter(config_value_mappings) self.configuration_manager = ConfigurationManager( system.REDIS_CONFIG, system.REDIS_OWNER, system.REDIS_OWNER, PropertiesCodec(unpack_singletons=False, string_mappings=config_value_mappings), requires_root=True, override_strategy=OneFileOverrideStrategy(revision_dir)) self.admin = self._build_admin_client() self.status = RedisAppStatus(self.admin) def _build_admin_client(self): password = self.get_configuration_property('requirepass') socket = self.get_configuration_property('unixsocket') cmd = self.get_config_command_name() return RedisAdmin(password=password, unix_socket_path=socket, config_cmd=cmd) def _refresh_admin_client(self): self.admin = self._build_admin_client() self.status.set_client(self.admin) return self.admin def install_if_needed(self, packages): """ Install redis if needed do nothing if it is already installed. """ LOG.info('Preparing Guest as Redis Server.') if not packager.pkg_is_installed(packages): LOG.info('Installing Redis.') self._install_redis(packages) LOG.info('Redis installed completely.') def _install_redis(self, packages): """ Install the redis server. """ LOG.debug('Installing redis server.') LOG.debug("Creating %s.", system.REDIS_CONF_DIR) operating_system.create_directory(system.REDIS_CONF_DIR, as_root=True) pkg_opts = {} packager.pkg_install(packages, pkg_opts, TIME_OUT) self.start_db() LOG.debug('Finished installing redis server.') def stop_db(self, update_db=False, do_not_start_on_reboot=False): self.status.stop_db_service(system.SERVICE_CANDIDATES, self.state_change_wait_time, disable_on_boot=do_not_start_on_reboot, update_db=update_db) def restart(self): self.status.restart_db_service(system.SERVICE_CANDIDATES, self.state_change_wait_time) def update_overrides(self, context, overrides, remove=False): if overrides: self.configuration_manager.apply_user_override(overrides) # apply requirepass at runtime # TODO(zhaochao): updating 'requirepass' here will be removed # in the future releases, Redis only use enable_root/disable_root # to set this parameter. if 'requirepass' in overrides: self.admin.config_set('requirepass', overrides['requirepass']) self._refresh_admin_client() def apply_overrides(self, client, overrides): """Use the 'CONFIG SET' command to apply configuration at runtime. Commands that appear multiple times have values separated by a white space. For instance, the following two 'save' directives from the configuration file... save 900 1 save 300 10 ... would be applied in a single command as: CONFIG SET save "900 1 300 10" Note that the 'CONFIG' command has been renamed to prevent users from using it to bypass configuration groups. """ for prop_name, prop_args in overrides.items(): args_string = self._join_lists( self._value_converter.to_strings(prop_args), ' ') client.config_set(prop_name, args_string) # NOTE(zhaochao): requirepass applied in update_overrides is # only kept for back compatibility. Now requirepass is set # via enable_root/disable_root, Redis admin client should be # refreshed here. if prop_name == "requirepass": client = self._refresh_admin_client() def _join_lists(self, items, sep): """Join list items (including items from sub-lists) into a string. Non-list inputs are returned unchanged. _join_lists('1234', ' ') = "1234" _join_lists(['1','2','3','4'], ' ') = "1 2 3 4" _join_lists([['1','2'], ['3','4']], ' ') = "1 2 3 4" """ if isinstance(items, list): return sep.join( [sep.join(e) if isinstance(e, list) else e for e in items]) return items def remove_overrides(self): self.configuration_manager.remove_user_override() def make_read_only(self, read_only): # Redis has no mechanism to make an instance read-only at present pass def start_db_with_conf_changes(self, config_contents): LOG.info('Starting redis with conf changes.') if self.status.is_running: format = 'Cannot start_db_with_conf_changes because status is %s.' LOG.debug(format, self.status) raise RuntimeError(format % self.status) LOG.info("Initiating config.") self.configuration_manager.save_configuration(config_contents) # The configuration template has to be updated with # guestagent-controlled settings. self.apply_initial_guestagent_configuration() self.start_db(True) def start_db(self, update_db=False): self.status.start_db_service(system.SERVICE_CANDIDATES, self.state_change_wait_time, enable_on_boot=True, update_db=update_db) def apply_initial_guestagent_configuration(self): """Update guestagent-controlled configuration properties. """ # Hide the 'CONFIG' command from end users by mangling its name. self.admin.set_config_command_name(self._mangle_config_command_name()) self.configuration_manager.apply_system_override({ 'daemonize': 'yes', 'protected-mode': 'no', 'supervised': 'systemd', 'pidfile': system.REDIS_PID_FILE, 'logfile': system.REDIS_LOG_FILE, 'dir': system.REDIS_DATA_DIR }) def get_config_command_name(self): """Get current name of the 'CONFIG' command. """ renamed_cmds = self.configuration_manager.get_value('rename-command') if renamed_cmds: for name_pair in renamed_cmds: if name_pair[0] == 'CONFIG': return name_pair[1] return None def _mangle_config_command_name(self): """Hide the 'CONFIG' command from the clients by renaming it to a random string known only to the guestagent. Return the mangled name. """ mangled = utils.generate_random_password() self._rename_command('CONFIG', mangled) return mangled def _rename_command(self, old_name, new_name): """It is possible to completely disable a command by renaming it to an empty string. """ self.configuration_manager.apply_system_override( {'rename-command': [old_name, new_name]}) def get_logfile(self): """Specify the log file name. Also the empty string can be used to force Redis to log on the standard output. Note that if you use standard output for logging but daemonize, logs will be sent to /dev/null """ return self.get_configuration_property('logfile') def get_db_filename(self): """The filename where to dump the DB. """ return self.get_configuration_property('dbfilename') def get_working_dir(self): """The DB will be written inside this directory, with the filename specified the 'dbfilename' configuration directive. The Append Only File will also be created inside this directory. """ return self.get_configuration_property('dir') def get_persistence_filepath(self): """Returns the full path to the persistence file.""" return guestagent_utils.build_file_path(self.get_working_dir(), self.get_db_filename()) def get_port(self): """Port for this instance or default if not set.""" return self.get_configuration_property('port', system.REDIS_PORT) def get_auth_password(self): """Client authentication password for this instance or None if not set. """ return self.get_configuration_property('requirepass') def is_appendonly_enabled(self): """True if the Append Only File (AOF) persistence mode is enabled. """ return self.get_configuration_property('appendonly', False) def get_append_file_name(self): """The name of the append only file (AOF). """ return self.get_configuration_property('appendfilename') def is_cluster_enabled(self): """Only nodes that are started as cluster nodes can be part of a Redis Cluster. """ return self.get_configuration_property('cluster-enabled', False) def enable_cluster(self): """In order to start a Redis instance as a cluster node enable the cluster support """ self.configuration_manager.apply_system_override( {'cluster-enabled': 'yes'}, CLUSTER_CFG) def get_cluster_config_filename(self): """Cluster node configuration file. """ return self.get_configuration_property('cluster-config-file') def set_cluster_config_filename(self, name): """Make sure that instances running in the same system do not have overlapping cluster configuration file names. """ self.configuration_manager.apply_system_override( {'cluster-config-file': name}, CLUSTER_CFG) def get_cluster_node_timeout(self): """Cluster node timeout is the amount of milliseconds a node must be unreachable for it to be considered in failure state. """ return self.get_configuration_property('cluster-node-timeout') def get_configuration_property(self, name, default=None): """Return the value of a Redis configuration property. Returns a single value for single-argument properties or a list otherwise. """ return utils.unpack_singleton( self.configuration_manager.get_value(name, default)) def cluster_meet(self, ip, port): try: utils.execute_with_timeout('redis-cli', 'cluster', 'meet', ip, port) except exception.ProcessExecutionError: LOG.exception('Error joining node to cluster at %s.', ip) raise def cluster_addslots(self, first_slot, last_slot): try: group_size = 200 # Create list of slots represented in strings # eg. ['10', '11', '12', '13'] slots = list(map(str, range(first_slot, last_slot + 1))) while slots: cmd = (['redis-cli', 'cluster', 'addslots'] + slots[0:group_size]) out, err = utils.execute_with_timeout(*cmd, run_as_root=True, root_helper='sudo') if 'OK' not in out: raise RuntimeError(_('Error executing addslots: %s') % out) del slots[0:group_size] except exception.ProcessExecutionError: LOG.exception( 'Error adding slots %(first_slot)s-%(last_slot)s' ' to cluster.', { 'first_slot': first_slot, 'last_slot': last_slot }) raise def _get_node_info(self): try: out, _ = utils.execute_with_timeout('redis-cli', '--csv', 'cluster', 'nodes') return [line.split(' ') for line in out.splitlines()] except exception.ProcessExecutionError: LOG.exception('Error getting node info.') raise def _get_node_details(self): for node_details in self._get_node_info(): if 'myself' in node_details[2]: return node_details raise exception.TroveError(_("Unable to determine node details")) def get_node_ip(self): """Returns [ip, port] where both values are strings""" return self._get_node_details()[1].split(':') def get_node_id_for_removal(self): node_details = self._get_node_details() node_id = node_details[0] my_ip = node_details[1].split(':')[0] try: slots, _ = utils.execute_with_timeout('redis-cli', '--csv', 'cluster', 'slots') return node_id if my_ip not in slots else None except exception.ProcessExecutionError: LOG.exception('Error validating node to for removal.') raise def remove_nodes(self, node_ids): try: for node_id in node_ids: utils.execute_with_timeout('redis-cli', 'cluster', 'forget', node_id) except exception.ProcessExecutionError: LOG.exception('Error removing node from cluster.') raise def enable_root(self, password=None): if not password: password = utils.generate_random_password() redis_password = RedisRootUser(password=password) try: self.configuration_manager.apply_system_override( { 'requirepass': password, 'masterauth': password }, change_id=SYS_OVERRIDES_AUTH) self.apply_overrides(self.admin, { 'requirepass': password, 'masterauth': password }) except exception.TroveError: LOG.exception('Error enabling authentication for instance.') raise return redis_password.serialize() def disable_root(self): try: self.configuration_manager.remove_system_override( change_id=SYS_OVERRIDES_AUTH) self.apply_overrides(self.admin, { 'requirepass': '', 'masterauth': '' }) except exception.TroveError: LOG.exception('Error disabling authentication for instance.') raise
def _assert_get_value(self, override_strategy): base_config_contents = {'Section_1': {'name': 'pi', 'is_number': 'True', 'value': '3.1415'} } config_overrides_v1a = {'Section_1': {'name': 'sqrt(2)', 'value': '1.4142'} } config_overrides_v2 = {'Section_1': {'name': 'e', 'value': '2.7183'}, 'Section_2': {'foo': 'bar'} } config_overrides_v1b = {'Section_1': {'name': 'sqrt(4)', 'value': '2.0'} } codec = IniCodec() current_user = getpass.getuser() with tempfile.NamedTemporaryFile() as base_config: # Write initial config contents. operating_system.write_file( base_config.name, base_config_contents, codec) manager = ConfigurationManager( base_config.name, current_user, current_user, codec, requires_root=False, override_strategy=override_strategy) # Test default value. self.assertIsNone(manager.get_value('Section_2')) self.assertEqual('foo', manager.get_value('Section_2', 'foo')) # Test value before applying overrides. self.assertEqual('pi', manager.get_value('Section_1')['name']) self.assertEqual('3.1415', manager.get_value('Section_1')['value']) # Test value after applying overrides. manager.apply_user_override(config_overrides_v1a, change_id='id1') self.assertEqual('sqrt(2)', manager.get_value('Section_1')['name']) self.assertEqual('1.4142', manager.get_value('Section_1')['value']) manager.apply_user_override(config_overrides_v2, change_id='id2') self.assertEqual('e', manager.get_value('Section_1')['name']) self.assertEqual('2.7183', manager.get_value('Section_1')['value']) self.assertEqual('bar', manager.get_value('Section_2')['foo']) # Editing change 'id1' become visible only after removing # change 'id2', which overrides 'id1'. manager.apply_user_override(config_overrides_v1b, change_id='id1') self.assertEqual('e', manager.get_value('Section_1')['name']) self.assertEqual('2.7183', manager.get_value('Section_1')['value']) # Test value after removing overrides. # The edited values from change 'id1' should be visible after # removing 'id2'. manager.remove_user_override(change_id='id2') self.assertEqual('sqrt(4)', manager.get_value('Section_1')['name']) self.assertEqual('2.0', manager.get_value('Section_1')['value']) # Back to the base. manager.remove_user_override(change_id='id1') self.assertEqual('pi', manager.get_value('Section_1')['name']) self.assertEqual('3.1415', manager.get_value('Section_1')['value']) self.assertIsNone(manager.get_value('Section_2')) # Test system overrides. manager.apply_system_override( config_overrides_v1b, change_id='id1') self.assertEqual('sqrt(4)', manager.get_value('Section_1')['name']) self.assertEqual('2.0', manager.get_value('Section_1')['value']) # The system values should take precedence over the user # override. manager.apply_user_override( config_overrides_v1a, change_id='id1') self.assertEqual('sqrt(4)', manager.get_value('Section_1')['name']) self.assertEqual('2.0', manager.get_value('Section_1')['value']) # The user values should become visible only after removing the # system change. manager.remove_system_override(change_id='id1') self.assertEqual('sqrt(2)', manager.get_value('Section_1')['name']) self.assertEqual('1.4142', manager.get_value('Section_1')['value']) # Back to the base. manager.remove_user_override(change_id='id1') self.assertEqual('pi', manager.get_value('Section_1')['name']) self.assertEqual('3.1415', manager.get_value('Section_1')['value']) self.assertIsNone(manager.get_value('Section_2'))
class PgSqlApp(object): OS = operating_system.get_os() LISTEN_ADDRESSES = ['*'] # Listen on all available IP (v4/v6) interfaces. ADMIN_USER = '******' # Trove's administrative user. def __init__(self): super(PgSqlApp, self).__init__() self._current_admin_user = None self.status = PgSqlAppStatus(self.pgsql_extra_bin_dir) revision_dir = guestagent_utils.build_file_path( os.path.dirname(self.pgsql_config), ConfigurationManager.DEFAULT_STRATEGY_OVERRIDES_SUB_DIR) self.configuration_manager = ConfigurationManager( self.pgsql_config, self.pgsql_owner, self.pgsql_owner, PropertiesCodec( delimiter='=', string_mappings={'on': True, 'off': False, "''": None}), requires_root=True, override_strategy=OneFileOverrideStrategy(revision_dir)) @property def service_candidates(self): return ['postgresql'] @property def pgsql_owner(self): return 'postgres' @property def default_superuser_name(self): return "postgres" @property def pgsql_base_data_dir(self): return '/var/lib/postgresql/' @property def pgsql_pid_file(self): return guestagent_utils.build_file_path(self.pgsql_run_dir, 'postgresql.pid') @property def pgsql_run_dir(self): return '/var/run/postgresql/' @property def pgsql_extra_bin_dir(self): """Redhat and Ubuntu packages for PgSql do not place 'extra' important binaries in /usr/bin, but rather in a directory like /usr/pgsql-9.4/bin in the case of PostgreSQL 9.4 for RHEL/CentOS """ return { operating_system.DEBIAN: '/usr/lib/postgresql/%s/bin/', operating_system.REDHAT: '/usr/pgsql-%s/bin/', operating_system.SUSE: '/usr/bin/' }[self.OS] % self.pg_version[1] @property def pgsql_config(self): return self._find_config_file('postgresql.conf') @property def pgsql_hba_config(self): return self._find_config_file('pg_hba.conf') @property def pgsql_ident_config(self): return self._find_config_file('pg_ident.conf') def _find_config_file(self, name_pattern): version_base = guestagent_utils.build_file_path(self.pgsql_config_dir, self.pg_version[1]) return sorted(operating_system.list_files_in_directory( version_base, recursive=True, pattern=name_pattern, as_root=True), key=len)[0] @property def pgsql_config_dir(self): return { operating_system.DEBIAN: '/etc/postgresql/', operating_system.REDHAT: '/var/lib/postgresql/', operating_system.SUSE: '/var/lib/pgsql/' }[self.OS] @property def pgsql_log_dir(self): return "/var/log/postgresql/" def build_admin(self): return PgSqlAdmin(self.get_current_admin_user()) def update_overrides(self, context, overrides, remove=False): if remove: self.configuration_manager.remove_user_override() elif overrides: self.configuration_manager.apply_user_override(overrides) def set_current_admin_user(self, user): self._current_admin_user = user def get_current_admin_user(self): if self._current_admin_user is not None: return self._current_admin_user if self.status.is_installed: return models.PostgreSQLUser(self.ADMIN_USER) return models.PostgreSQLUser(self.default_superuser_name) def apply_overrides(self, context, overrides): self.reload_configuration() def reload_configuration(self): """Send a signal to the server, causing configuration files to be reloaded by all server processes. Active queries or connections to the database will not be interrupted. NOTE: Do not use the 'SET' command as it only affects the current session. """ self.build_admin().psql( "SELECT pg_reload_conf()") def reset_configuration(self, context, configuration): """Reset the PgSql configuration to the one given. """ config_contents = configuration['config_contents'] self.configuration_manager.save_configuration(config_contents) def start_db_with_conf_changes(self, context, config_contents): """Starts the PgSql instance with a new configuration.""" if self.status.is_running: raise RuntimeError(_("The service is still running.")) self.configuration_manager.save_configuration(config_contents) # The configuration template has to be updated with # guestagent-controlled settings. self.apply_initial_guestagent_configuration() self.start_db() def apply_initial_guestagent_configuration(self): """Update guestagent-controlled configuration properties. """ LOG.debug("Applying initial guestagent configuration.") file_locations = { 'data_directory': self._quote(self.pgsql_data_dir), 'hba_file': self._quote(self.pgsql_hba_config), 'ident_file': self._quote(self.pgsql_ident_config), 'external_pid_file': self._quote(self.pgsql_pid_file), 'unix_socket_directories': self._quote(self.pgsql_run_dir), 'listen_addresses': self._quote(','.join(self.LISTEN_ADDRESSES)), 'port': cfg.get_configuration_property('postgresql_port')} self.configuration_manager.apply_system_override(file_locations) self._apply_access_rules() @staticmethod def _quote(value): return "'%s'" % value def _apply_access_rules(self): LOG.debug("Applying database access rules.") # Connections to all resources are granted. # # Local access from administrative users is implicitly trusted. # # Remote access from the Trove's account is always rejected as # it is not needed and could be used by malicious users to hijack the # instance. # # Connections from other accounts always require a double-MD5-hashed # password. # # Make the rules readable only by the Postgres service. # # NOTE: The order of entries is important. # The first failure to authenticate stops the lookup. # That is why the 'local' connections validate first. # The OrderedDict is necessary to guarantee the iteration order. local_admins = ','.join([self.default_superuser_name, self.ADMIN_USER]) remote_admins = self.ADMIN_USER access_rules = OrderedDict( [('local', [['all', local_admins, None, 'trust'], ['replication', local_admins, None, 'trust'], ['all', 'all', None, 'md5']]), ('host', [['all', local_admins, '127.0.0.1/32', 'trust'], ['all', local_admins, '::1/128', 'trust'], ['all', local_admins, 'localhost', 'trust'], ['all', remote_admins, '0.0.0.0/0', 'reject'], ['all', remote_admins, '::/0', 'reject'], ['all', 'all', '0.0.0.0/0', 'md5'], ['all', 'all', '::/0', 'md5']]) ]) operating_system.write_file(self.pgsql_hba_config, access_rules, PropertiesCodec( string_mappings={'\t': None}), as_root=True) operating_system.chown(self.pgsql_hba_config, self.pgsql_owner, self.pgsql_owner, as_root=True) operating_system.chmod(self.pgsql_hba_config, FileMode.SET_USR_RO, as_root=True) def disable_backups(self): """Reverse overrides applied by PgBaseBackup strategy""" if not self.configuration_manager.has_system_override( BACKUP_CFG_OVERRIDE): return LOG.info("Removing configuration changes for backups") self.configuration_manager.remove_system_override(BACKUP_CFG_OVERRIDE) self.remove_wal_archive_dir() self.restart() def enable_backups(self): """Apply necessary changes to config to enable WAL-based backups if we are using the PgBaseBackup strategy """ LOG.info("Checking if we need to apply changes to WAL config") if 'PgBaseBackup' not in self.backup_strategy: return if self.configuration_manager.has_system_override(BACKUP_CFG_OVERRIDE): return LOG.info("Applying changes to WAL config for use by base backups") arch_cmd = "'test ! -f {wal_arch}/%f && cp %p {wal_arch}/%f'".format( wal_arch=self.wal_archive_location ) opts = { # FIXME(atomic77) These spaces after the options are needed until # DBAAS-949 is fixed 'wal_level ': 'hot_standby', 'archive_mode ': 'on', 'max_wal_senders': 8, # 'checkpoint_segments ': 8, 'wal_keep_segments': 8, 'archive_command': arch_cmd } if self.pg_version[1] in ('9.4', '9.5'): opts['wal_log_hints'] = 'on' self.configuration_manager.apply_system_override(opts, BACKUP_CFG_OVERRIDE) # self.enable_debugging(level=1) self.restart() def disable_debugging(self, level=1): """Enable debug-level logging in postgres""" self.configuration_manager.remove_system_override(DEBUG_MODE_OVERRIDE) def enable_debugging(self, level=1): """Enable debug-level logging in postgres""" opt = {'log_min_messages': 'DEBUG%s' % level} self.configuration_manager.apply_system_override(opt, DEBUG_MODE_OVERRIDE) def install(self, context, packages): """Install one or more packages that postgresql needs to run. The packages parameter is a string representing the package names that should be given to the system's package manager. """ LOG.debug( "{guest_id}: Beginning PgSql package installation.".format( guest_id=CONF.guest_id ) ) self.recreate_wal_archive_dir() packager = pkg.Package() if not packager.pkg_is_installed(packages): try: LOG.info( _("{guest_id}: Installing ({packages}).").format( guest_id=CONF.guest_id, packages=packages, ) ) packager.pkg_install(packages, {}, 1000) except (pkg.PkgAdminLockError, pkg.PkgPermissionError, pkg.PkgPackageStateError, pkg.PkgNotFoundError, pkg.PkgTimeout, pkg.PkgScriptletError, pkg.PkgDownloadError, pkg.PkgSignError, pkg.PkgBrokenError): LOG.exception( "{guest_id}: There was a package manager error while " "trying to install ({packages}).".format( guest_id=CONF.guest_id, packages=packages, ) ) raise except Exception: LOG.exception( "{guest_id}: The package manager encountered an unknown " "error while trying to install ({packages}).".format( guest_id=CONF.guest_id, packages=packages, ) ) raise else: self.start_db() LOG.debug( "{guest_id}: Completed package installation.".format( guest_id=CONF.guest_id, ) ) @property def pgsql_recovery_config(self): return os.path.join(self.pgsql_data_dir, "recovery.conf") @property def pgsql_data_dir(self): return os.path.dirname(self.pg_version[0]) @property def pg_version(self): """Find the database version file stored in the data directory. :returns: A tuple with the path to the version file (in the root of the data directory) and the version string. """ version_files = operating_system.list_files_in_directory( self.pgsql_base_data_dir, recursive=True, pattern='PG_VERSION', as_root=True) version_file = sorted(version_files, key=len)[0] version = operating_system.read_file(version_file, as_root=True) return version_file, version.strip() def restart(self): self.status.restart_db_service( self.service_candidates, CONF.state_change_wait_time) def start_db(self, enable_on_boot=True, update_db=False): self.status.start_db_service( self.service_candidates, CONF.state_change_wait_time, enable_on_boot=enable_on_boot, update_db=update_db) def stop_db(self, do_not_start_on_reboot=False, update_db=False): self.status.stop_db_service( self.service_candidates, CONF.state_change_wait_time, disable_on_boot=do_not_start_on_reboot, update_db=update_db) def secure(self, context): """Create an administrative user for Trove. Force password encryption. Also disable the built-in superuser """ password = utils.generate_random_password() os_admin_db = models.PostgreSQLSchema(self.ADMIN_USER) os_admin = models.PostgreSQLUser(self.ADMIN_USER, password) os_admin.databases.append(os_admin_db.serialize()) postgres = models.PostgreSQLUser(self.default_superuser_name) admin = PgSqlAdmin(postgres) admin._create_database(context, os_admin_db) admin._create_admin_user(context, os_admin, encrypt_password=True) PgSqlAdmin(os_admin).alter_user(context, postgres, None, 'NOSUPERUSER', 'NOLOGIN') self.set_current_admin_user(os_admin) def pg_current_xlog_location(self): """Wrapper for pg_current_xlog_location() Cannot be used against a running slave """ r = self.build_admin().query("SELECT pg_current_xlog_location()") return r[0][0] def pg_last_xlog_replay_location(self): """Wrapper for pg_last_xlog_replay_location() For use on standby servers """ r = self.build_admin().query("SELECT pg_last_xlog_replay_location()") return r[0][0] def pg_is_in_recovery(self): """Wrapper for pg_is_in_recovery() for detecting a server in standby mode """ r = self.build_admin().query("SELECT pg_is_in_recovery()") return r[0][0] def pg_primary_host(self): """There seems to be no way to programmatically determine this on a hot standby, so grab what we have written to the recovery file """ r = operating_system.read_file(self.pgsql_recovery_config, as_root=True) regexp = re.compile("host=(\d+.\d+.\d+.\d+) ") m = regexp.search(r) return m.group(1) def recreate_wal_archive_dir(self): wal_archive_dir = self.wal_archive_location operating_system.remove(wal_archive_dir, force=True, recursive=True, as_root=True) operating_system.create_directory(wal_archive_dir, user=self.pgsql_owner, group=self.pgsql_owner, force=True, as_root=True) def remove_wal_archive_dir(self): wal_archive_dir = self.wal_archive_location operating_system.remove(wal_archive_dir, force=True, recursive=True, as_root=True) def is_root_enabled(self, context): """Return True if there is a superuser account enabled. """ results = self.build_admin().query( pgsql_query.UserQuery.list_root(), timeout=30, ) # There should be only one superuser (Trove's administrative account). return len(results) > 1 or (results[0][0] != self.ADMIN_USER) def enable_root(self, context, root_password=None): """Create a superuser user or reset the superuser password. The default PostgreSQL administration account is 'postgres'. This account always exists and cannot be removed. Its attributes and access can however be altered. Clients can connect from the localhost or remotely via TCP/IP: Local clients (e.g. psql) can connect from a preset *system* account called 'postgres'. This system account has no password and is *locked* by default, so that it can be used by *local* users only. It should *never* be enabled (or it's password set)!!! That would just open up a new attack vector on the system account. Remote clients should use a build-in *database* account of the same name. It's password can be changed using the "ALTER USER" statement. Access to this account is disabled by Trove exposed only once the superuser access is requested. Trove itself creates its own administrative account. {"_name": "postgres", "_password": "******"} """ user = self.build_root_user(root_password) self.build_admin().alter_user( context, user, None, *PgSqlAdmin.ADMIN_OPTIONS) return user.serialize() def build_root_user(self, password=None): return models.PostgreSQLRootUser(password=password) def pg_start_backup(self, backup_label): r = self.build_admin().query( "SELECT pg_start_backup('%s', true)" % backup_label) return r[0][0] def pg_xlogfile_name(self, start_segment): r = self.build_admin().query( "SELECT pg_xlogfile_name('%s')" % start_segment) return r[0][0] def pg_stop_backup(self): r = self.build_admin().query("SELECT pg_stop_backup()") return r[0][0] def disable_root(self, context): """Generate a new random password for the public superuser account. Do not disable its access rights. Once enabled the account should stay that way. """ self.enable_root(context) def enable_root_with_password(self, context, root_password=None): return self.enable_root(context, root_password) @property def wal_archive_location(self): return cfg.get_configuration_property('wal_archive_location') @property def backup_strategy(self): return cfg.get_configuration_property('backup_strategy') def save_files_pre_upgrade(self, mount_point): LOG.debug('Saving files pre-upgrade.') mnt_etc_dir = os.path.join(mount_point, 'save_etc') if self.OS != operating_system.REDHAT: # No need to store the config files away for Redhat because # they are already stored in the data volume. operating_system.remove(mnt_etc_dir, force=True, as_root=True) operating_system.copy(self.pgsql_config_dir, mnt_etc_dir, preserve=True, recursive=True, as_root=True) return {'save_etc': mnt_etc_dir} def restore_files_post_upgrade(self, upgrade_info): LOG.debug('Restoring files post-upgrade.') if self.OS != operating_system.REDHAT: # No need to restore the config files for Redhat because # they are already in the data volume. operating_system.copy('%s/.' % upgrade_info['save_etc'], self.pgsql_config_dir, preserve=True, recursive=True, force=True, as_root=True) operating_system.remove(upgrade_info['save_etc'], force=True, as_root=True)
def _assert_get_value(self, override_strategy): base_config_contents = {"Section_1": {"name": "pi", "is_number": "True", "value": "3.1415"}} config_overrides_v1a = {"Section_1": {"name": "sqrt(2)", "value": "1.4142"}} config_overrides_v2 = {"Section_1": {"name": "e", "value": "2.7183"}, "Section_2": {"foo": "bar"}} config_overrides_v1b = {"Section_1": {"name": "sqrt(4)", "value": "2.0"}} codec = IniCodec() current_user = getpass.getuser() with tempfile.NamedTemporaryFile() as base_config: # Write initial config contents. operating_system.write_file(base_config.name, base_config_contents, codec) manager = ConfigurationManager( base_config.name, current_user, current_user, codec, requires_root=False, override_strategy=override_strategy, ) # Test default value. self.assertIsNone(manager.get_value("Section_2")) self.assertEqual("foo", manager.get_value("Section_2", "foo")) # Test value before applying overrides. self.assertEqual("pi", manager.get_value("Section_1")["name"]) self.assertEqual("3.1415", manager.get_value("Section_1")["value"]) # Test value after applying overrides. manager.apply_user_override(config_overrides_v1a, change_id="id1") self.assertEqual("sqrt(2)", manager.get_value("Section_1")["name"]) self.assertEqual("1.4142", manager.get_value("Section_1")["value"]) manager.apply_user_override(config_overrides_v2, change_id="id2") self.assertEqual("e", manager.get_value("Section_1")["name"]) self.assertEqual("2.7183", manager.get_value("Section_1")["value"]) self.assertEqual("bar", manager.get_value("Section_2")["foo"]) # Editing change 'id1' become visible only after removing # change 'id2', which overrides 'id1'. manager.apply_user_override(config_overrides_v1b, change_id="id1") self.assertEqual("e", manager.get_value("Section_1")["name"]) self.assertEqual("2.7183", manager.get_value("Section_1")["value"]) # Test value after removing overrides. # The edited values from change 'id1' should be visible after # removing 'id2'. manager.remove_user_override(change_id="id2") self.assertEqual("sqrt(4)", manager.get_value("Section_1")["name"]) self.assertEqual("2.0", manager.get_value("Section_1")["value"]) # Back to the base. manager.remove_user_override(change_id="id1") self.assertEqual("pi", manager.get_value("Section_1")["name"]) self.assertEqual("3.1415", manager.get_value("Section_1")["value"]) self.assertIsNone(manager.get_value("Section_2")) # Test system overrides. manager.apply_system_override(config_overrides_v1b, change_id="id1") self.assertEqual("sqrt(4)", manager.get_value("Section_1")["name"]) self.assertEqual("2.0", manager.get_value("Section_1")["value"]) # The system values should take precedence over the user # override. manager.apply_user_override(config_overrides_v1a, change_id="id1") self.assertEqual("sqrt(4)", manager.get_value("Section_1")["name"]) self.assertEqual("2.0", manager.get_value("Section_1")["value"]) # The user values should become visible only after removing the # system change. manager.remove_system_override(change_id="id1") self.assertEqual("sqrt(2)", manager.get_value("Section_1")["name"]) self.assertEqual("1.4142", manager.get_value("Section_1")["value"]) # Back to the base. manager.remove_user_override(change_id="id1") self.assertEqual("pi", manager.get_value("Section_1")["name"]) self.assertEqual("3.1415", manager.get_value("Section_1")["value"]) self.assertIsNone(manager.get_value("Section_2"))
class PgSqlApp(object): OS = operating_system.get_os() LISTEN_ADDRESSES = ['*'] # Listen on all available IP (v4/v6) interfaces. ADMIN_USER = '******' # Trove's administrative user. def __init__(self): super(PgSqlApp, self).__init__() self._current_admin_user = None self.status = PgSqlAppStatus(self.pgsql_extra_bin_dir) revision_dir = guestagent_utils.build_file_path( os.path.dirname(self.pgsql_config), ConfigurationManager.DEFAULT_STRATEGY_OVERRIDES_SUB_DIR) self.configuration_manager = ConfigurationManager( self.pgsql_config, self.pgsql_owner, self.pgsql_owner, PropertiesCodec(delimiter='=', string_mappings={ 'on': True, 'off': False, "''": None }), requires_root=True, override_strategy=OneFileOverrideStrategy(revision_dir)) @property def service_candidates(self): return ['postgresql'] @property def pgsql_owner(self): return 'postgres' @property def default_superuser_name(self): return "postgres" @property def pgsql_base_data_dir(self): return '/var/lib/postgresql/' @property def pgsql_pid_file(self): return guestagent_utils.build_file_path(self.pgsql_run_dir, 'postgresql.pid') @property def pgsql_run_dir(self): return '/var/run/postgresql/' @property def pgsql_extra_bin_dir(self): """Redhat and Ubuntu packages for PgSql do not place 'extra' important binaries in /usr/bin, but rather in a directory like /usr/pgsql-9.4/bin in the case of PostgreSQL 9.4 for RHEL/CentOS """ return { operating_system.DEBIAN: '/usr/lib/postgresql/%s/bin/', operating_system.REDHAT: '/usr/pgsql-%s/bin/', operating_system.SUSE: '/usr/bin/' }[self.OS] % self.pg_version[1] @property def pgsql_config(self): return self._find_config_file('postgresql.conf') @property def pgsql_hba_config(self): return self._find_config_file('pg_hba.conf') @property def pgsql_ident_config(self): return self._find_config_file('pg_ident.conf') def _find_config_file(self, name_pattern): version_base = guestagent_utils.build_file_path( self.pgsql_config_dir, self.pg_version[1]) return sorted(operating_system.list_files_in_directory( version_base, recursive=True, pattern=name_pattern, as_root=True), key=len)[0] @property def pgsql_config_dir(self): return { operating_system.DEBIAN: '/etc/postgresql/', operating_system.REDHAT: '/var/lib/postgresql/', operating_system.SUSE: '/var/lib/pgsql/' }[self.OS] @property def pgsql_log_dir(self): return "/var/log/postgresql/" def build_admin(self): return PgSqlAdmin(self.get_current_admin_user()) def update_overrides(self, context, overrides, remove=False): if remove: self.configuration_manager.remove_user_override() elif overrides: self.configuration_manager.apply_user_override(overrides) def set_current_admin_user(self, user): self._current_admin_user = user def get_current_admin_user(self): if self._current_admin_user is not None: return self._current_admin_user if self.status.is_installed: return models.PostgreSQLUser(self.ADMIN_USER) return models.PostgreSQLUser(self.default_superuser_name) def apply_overrides(self, context, overrides): self.reload_configuration() def reload_configuration(self): """Send a signal to the server, causing configuration files to be reloaded by all server processes. Active queries or connections to the database will not be interrupted. NOTE: Do not use the 'SET' command as it only affects the current session. """ self.build_admin().psql("SELECT pg_reload_conf()") def reset_configuration(self, context, configuration): """Reset the PgSql configuration to the one given. """ config_contents = configuration['config_contents'] self.configuration_manager.save_configuration(config_contents) def start_db_with_conf_changes(self, context, config_contents): """Starts the PgSql instance with a new configuration.""" if self.status.is_running: raise RuntimeError(_("The service is still running.")) self.configuration_manager.save_configuration(config_contents) # The configuration template has to be updated with # guestagent-controlled settings. self.apply_initial_guestagent_configuration() self.start_db() def apply_initial_guestagent_configuration(self): """Update guestagent-controlled configuration properties. """ LOG.debug("Applying initial guestagent configuration.") file_locations = { 'data_directory': self._quote(self.pgsql_data_dir), 'hba_file': self._quote(self.pgsql_hba_config), 'ident_file': self._quote(self.pgsql_ident_config), 'external_pid_file': self._quote(self.pgsql_pid_file), 'unix_socket_directories': self._quote(self.pgsql_run_dir), 'listen_addresses': self._quote(','.join(self.LISTEN_ADDRESSES)), 'port': cfg.get_configuration_property('postgresql_port') } self.configuration_manager.apply_system_override(file_locations) self._apply_access_rules() @staticmethod def _quote(value): return "'%s'" % value def _apply_access_rules(self): LOG.debug("Applying database access rules.") # Connections to all resources are granted. # # Local access from administrative users is implicitly trusted. # # Remote access from the Trove's account is always rejected as # it is not needed and could be used by malicious users to hijack the # instance. # # Connections from other accounts always require a double-MD5-hashed # password. # # Make the rules readable only by the Postgres service. # # NOTE: The order of entries is important. # The first failure to authenticate stops the lookup. # That is why the 'local' connections validate first. # The OrderedDict is necessary to guarantee the iteration order. local_admins = ','.join([self.default_superuser_name, self.ADMIN_USER]) remote_admins = self.ADMIN_USER access_rules = OrderedDict([ ('local', [['all', local_admins, None, 'trust'], ['replication', local_admins, None, 'trust'], ['all', 'all', None, 'md5']]), ('host', [['all', local_admins, '127.0.0.1/32', 'trust'], ['all', local_admins, '::1/128', 'trust'], ['all', local_admins, 'localhost', 'trust'], ['all', remote_admins, '0.0.0.0/0', 'reject'], ['all', remote_admins, '::/0', 'reject'], ['all', 'all', '0.0.0.0/0', 'md5'], ['all', 'all', '::/0', 'md5']]) ]) operating_system.write_file( self.pgsql_hba_config, access_rules, PropertiesCodec(string_mappings={'\t': None}), as_root=True) operating_system.chown(self.pgsql_hba_config, self.pgsql_owner, self.pgsql_owner, as_root=True) operating_system.chmod(self.pgsql_hba_config, FileMode.SET_USR_RO, as_root=True) def disable_backups(self): """Reverse overrides applied by PgBaseBackup strategy""" if not self.configuration_manager.has_system_override( BACKUP_CFG_OVERRIDE): return LOG.info("Removing configuration changes for backups") self.configuration_manager.remove_system_override(BACKUP_CFG_OVERRIDE) self.remove_wal_archive_dir() self.restart() def enable_backups(self): """Apply necessary changes to config to enable WAL-based backups if we are using the PgBaseBackup strategy """ LOG.info("Checking if we need to apply changes to WAL config") if 'PgBaseBackup' not in self.backup_strategy: return if self.configuration_manager.has_system_override(BACKUP_CFG_OVERRIDE): return LOG.info("Applying changes to WAL config for use by base backups") wal_arch_loc = self.wal_archive_location if not os.path.isdir(wal_arch_loc): raise RuntimeError( _("Cannot enable backup as WAL dir '%s' does " "not exist.") % wal_arch_loc) arch_cmd = "'test ! -f {wal_arch}/%f && cp %p {wal_arch}/%f'".format( wal_arch=wal_arch_loc) # Only support pg version > 9.6, wal_level set to replica, and # remove parameter "checkpoint_segments". opts = { 'wal_level': 'replica', 'archive_mode': 'on', 'max_wal_senders': 8, 'wal_log_hints': 'on', 'wal_keep_segments': 8, 'archive_command': arch_cmd } self.configuration_manager.apply_system_override( opts, BACKUP_CFG_OVERRIDE) self.restart() def disable_debugging(self, level=1): """Disable debug-level logging in postgres""" self.configuration_manager.remove_system_override(DEBUG_MODE_OVERRIDE) def enable_debugging(self, level=1): """Enable debug-level logging in postgres""" opt = {'log_min_messages': 'DEBUG%s' % level} self.configuration_manager.apply_system_override( opt, DEBUG_MODE_OVERRIDE) def install(self, context, packages): """Install one or more packages that postgresql needs to run. The packages parameter is a string representing the package names that should be given to the system's package manager. """ LOG.debug("{guest_id}: Beginning PgSql package installation.".format( guest_id=CONF.guest_id)) self.recreate_wal_archive_dir() packager = pkg.Package() if not packager.pkg_is_installed(packages): try: LOG.info("{guest_id}: Installing ({packages}).".format( guest_id=CONF.guest_id, packages=packages, )) packager.pkg_install(packages, {}, 1000) except (pkg.PkgAdminLockError, pkg.PkgPermissionError, pkg.PkgPackageStateError, pkg.PkgNotFoundError, pkg.PkgTimeout, pkg.PkgScriptletError, pkg.PkgDownloadError, pkg.PkgSignError, pkg.PkgBrokenError): LOG.exception( "{guest_id}: There was a package manager error while " "trying to install ({packages}).".format( guest_id=CONF.guest_id, packages=packages, )) raise except Exception: LOG.exception( "{guest_id}: The package manager encountered an unknown " "error while trying to install ({packages}).".format( guest_id=CONF.guest_id, packages=packages, )) raise else: self.start_db() LOG.debug("{guest_id}: Completed package installation.".format( guest_id=CONF.guest_id, )) @property def pgsql_recovery_config(self): return os.path.join(self.pgsql_data_dir, "recovery.conf") @property def pgsql_data_dir(self): return os.path.dirname(self.pg_version[0]) @property def pg_version(self): """Find the database version file stored in the data directory. :returns: A tuple with the path to the version file (in the root of the data directory) and the version string. """ version_files = operating_system.list_files_in_directory( self.pgsql_base_data_dir, recursive=True, pattern='PG_VERSION', as_root=True) version_file = sorted(version_files, key=len)[0] version = operating_system.read_file(version_file, as_root=True) return version_file, version.strip() def restart(self): self.status.restart_db_service(self.service_candidates, CONF.state_change_wait_time) def start_db(self, enable_on_boot=True, update_db=False): self.status.start_db_service(self.service_candidates, CONF.state_change_wait_time, enable_on_boot=enable_on_boot, update_db=update_db) def stop_db(self, do_not_start_on_reboot=False, update_db=False): self.status.stop_db_service(self.service_candidates, CONF.state_change_wait_time, disable_on_boot=do_not_start_on_reboot, update_db=update_db) def secure(self, context): """Create an administrative user for Trove. Force password encryption. Also disable the built-in superuser """ password = utils.generate_random_password() os_admin_db = models.PostgreSQLSchema(self.ADMIN_USER) os_admin = models.PostgreSQLUser(self.ADMIN_USER, password) os_admin.databases.append(os_admin_db.serialize()) postgres = models.PostgreSQLUser(self.default_superuser_name) admin = PgSqlAdmin(postgres) admin._create_database(context, os_admin_db) admin._create_admin_user(context, os_admin, encrypt_password=True) PgSqlAdmin(os_admin).alter_user(context, postgres, None, 'NOSUPERUSER', 'NOLOGIN') self.set_current_admin_user(os_admin) def pg_current_xlog_location(self): """Wrapper for pg_current_xlog_location() Cannot be used against a running slave """ version = int(self.pg_version[1]) if version < 10: query = "SELECT pg_current_xlog_location()" else: query = "SELECT pg_current_wal_lsn()" r = self.build_admin().query(query) return r[0][0] def pg_last_xlog_replay_location(self): """Wrapper for pg_last_xlog_replay_location() For use on standby servers """ version = int(self.pg_version[1]) if version < 10: query = "SELECT pg_last_xlog_replay_location()" else: query = "SELECT pg_last_wal_replay_lsn()" r = self.build_admin().query(query) return r[0][0] def pg_is_in_recovery(self): """Wrapper for pg_is_in_recovery() for detecting a server in standby mode """ r = self.build_admin().query("SELECT pg_is_in_recovery()") return r[0][0] def pg_primary_host(self): """There seems to be no way to programmatically determine this on a hot standby, so grab what we have written to the recovery file """ r = operating_system.read_file(self.pgsql_recovery_config, as_root=True) regexp = re.compile(r"host=(\d+.\d+.\d+.\d+) ") m = regexp.search(r) return m.group(1) def recreate_wal_archive_dir(self): wal_archive_dir = self.wal_archive_location operating_system.remove(wal_archive_dir, force=True, recursive=True, as_root=True) operating_system.create_directory(wal_archive_dir, user=self.pgsql_owner, group=self.pgsql_owner, force=True, as_root=True) def remove_wal_archive_dir(self): wal_archive_dir = self.wal_archive_location operating_system.remove(wal_archive_dir, force=True, recursive=True, as_root=True) def is_root_enabled(self, context): """Return True if there is a superuser account enabled. """ results = self.build_admin().query( pgsql_query.UserQuery.list_root(), timeout=30, ) # There should be only one superuser (Trove's administrative account). return len(results) > 1 or (results[0][0] != self.ADMIN_USER) def enable_root(self, context, root_password=None): """Create a superuser user or reset the superuser password. The default PostgreSQL administration account is 'postgres'. This account always exists and cannot be removed. Its attributes and access can however be altered. Clients can connect from the localhost or remotely via TCP/IP: Local clients (e.g. psql) can connect from a preset *system* account called 'postgres'. This system account has no password and is *locked* by default, so that it can be used by *local* users only. It should *never* be enabled (or its password set)!!! That would just open up a new attack vector on the system account. Remote clients should use a build-in *database* account of the same name. It's password can be changed using the "ALTER USER" statement. Access to this account is disabled by Trove exposed only once the superuser access is requested. Trove itself creates its own administrative account. {"_name": "postgres", "_password": "******"} """ user = self.build_root_user(root_password) self.build_admin().alter_user(context, user, None, *PgSqlAdmin.ADMIN_OPTIONS) return user.serialize() def build_root_user(self, password=None): return models.PostgreSQLUser.root(password=password) def pg_start_backup(self, backup_label): r = self.build_admin().query("SELECT pg_start_backup('%s', true)" % backup_label) return r[0][0] def pg_xlogfile_name(self, start_segment): version = int(self.pg_version[1]) if version < 10: query = "SELECT pg_xlogfile_name('%s')" else: query = "SELECT pg_walfile_name('%s')" r = self.build_admin().query(query % start_segment) return r[0][0] def pg_stop_backup(self): r = self.build_admin().query("SELECT pg_stop_backup()") return r[0][0] def disable_root(self, context): """Generate a new random password for the public superuser account. Do not disable its access rights. Once enabled the account should stay that way. """ self.enable_root(context) def enable_root_with_password(self, context, root_password=None): return self.enable_root(context, root_password) @property def wal_archive_location(self): return cfg.get_configuration_property('wal_archive_location') @property def backup_strategy(self): return cfg.get_configuration_property('backup_strategy') def save_files_pre_upgrade(self, mount_point): LOG.debug('Saving files pre-upgrade.') mnt_etc_dir = os.path.join(mount_point, 'save_etc') if self.OS not in [operating_system.REDHAT]: # No need to store the config files away for Redhat because # they are already stored in the data volume. operating_system.remove(mnt_etc_dir, force=True, as_root=True) operating_system.copy(self.pgsql_config_dir, mnt_etc_dir, preserve=True, recursive=True, as_root=True) return {'save_etc': mnt_etc_dir} def restore_files_post_upgrade(self, upgrade_info): LOG.debug('Restoring files post-upgrade.') if self.OS not in [operating_system.REDHAT]: # No need to restore the config files for Redhat because # they are already in the data volume. operating_system.copy('%s/.' % upgrade_info['save_etc'], self.pgsql_config_dir, preserve=True, recursive=True, force=True, as_root=True) operating_system.remove(upgrade_info['save_etc'], force=True, as_root=True) self.configuration_manager.refresh_cache() self.status.set_ready()