Skip to content
Snippets Groups Projects
Commit 03064637 authored by Oleksii Kliukin's avatar Oleksii Kliukin
Browse files

Allow disabling access to the DB and the Teams API.

Command-line options --nodatabaseaccess and --noteamsapi disable all
teams api interaction and access to the Postgres database. This is
useful for debugging purposes when the operator runs out of cluster
(with --outofcluster flag).

The same effect can be achieved by setting enable_db_access and/or
enable_teams_api to false.
parent fb007b16
Branches
Tags
No related merge requests found
......@@ -19,12 +19,16 @@ var (
podNamespace string
configMapName spec.NamespacedName
OutOfCluster bool
noTeamsAPI bool
noDBAccess bool
version string
)
func init() {
flag.StringVar(&KubeConfigFile, "kubeconfig", "", "Path to kubeconfig file with authorization and master location information.")
flag.BoolVar(&OutOfCluster, "outofcluster", false, "Whether the operator runs in- our outside of the Kubernetes cluster.")
flag.BoolVar(&noDBAccess, "nodatabaseaccess", false, "Disable all access to the database from the operator side.")
flag.BoolVar(&noTeamsAPI, "noteamsapi", false, "Disable all access to the teams API")
flag.Parse()
podNamespace = os.Getenv("MY_POD_NAMESPACE")
......@@ -87,6 +91,12 @@ func main() {
if configMapData["namespace"] == "" { // Namespace in ConfigMap has priority over env var
configMapData["namespace"] = podNamespace
}
if noDBAccess {
configMapData["enable_db_access"] = "false"
}
if noTeamsAPI {
configMapData["enable_teams_api"] = "false"
}
cfg := config.NewFromMap(configMapData)
log.Printf("Config: %s", cfg.MustMarshal())
......
......@@ -227,19 +227,21 @@ func (c *Cluster) Create(stopCh <-chan struct{}) error {
}
c.logger.Infof("Pods are ready")
if !c.masterLess {
if err = c.initDbConn(); err != nil {
if !(c.masterLess || c.DatabaseAccessDisabled()) {
if err := c.initDbConn(); err != nil {
return fmt.Errorf("Can't init db connection: %s", err)
}
} else {
if err = c.createUsers(); err != nil {
return fmt.Errorf("Can't create users: %s", err)
} else {
c.logger.Infof("Users have been successfully created")
}
}
} else {
if c.masterLess {
c.logger.Warnln("Cluster is masterless")
}
}
c.ListResources()
......
......@@ -32,9 +32,13 @@ func (c *Cluster) pgConnectionString() string {
strings.Replace(password, "$", "\\$", -1))
}
func (c *Cluster) initDbConn() error {
//TODO: concurrent safe?
if c.pgDb == nil {
func (c *Cluster) DatabaseAccessDisabled() bool {
if c.OpConfig.EnableDBAccess == false {
c.logger.Debugf("Database access is disabled")
}
return c.OpConfig.EnableDBAccess == false
}
func (c *Cluster) initDbConn() (err error) {
if c.pgDb == nil {
conn, err := sql.Open("postgres", c.pgConnectionString())
if err != nil {
......@@ -48,7 +52,6 @@ func (c *Cluster) initDbConn() error {
c.pgDb = conn
}
}
return nil
}
......
......@@ -36,6 +36,9 @@ func (c *Cluster) SyncCluster(stopCh <-chan struct{}) {
if err := c.syncStatefulSet(); err != nil {
c.logger.Errorf("Can't sync StatefulSets: %s", err)
}
if c.DatabaseAccessDisabled() {
return
}
if err := c.initDbConn(); err != nil {
c.logger.Errorf("Can't init db connection: %s", err)
} else {
......
......@@ -50,7 +50,7 @@ func New(controllerConfig *Config, operatorConfig *config.Config) *Controller {
logger.Level = logrus.DebugLevel
}
controllerConfig.TeamsAPIClient = teams.NewTeamsAPI(operatorConfig.TeamsAPIUrl, logger)
controllerConfig.TeamsAPIClient = teams.NewTeamsAPI(operatorConfig.TeamsAPIUrl, logger, operatorConfig.EnableTeamsAPI)
return &Controller{
Config: *controllerConfig,
opConfig: operatorConfig,
......
......@@ -52,6 +52,8 @@ type Config struct {
WALES3Bucket string `name:"wal_s3_bucket"`
KubeIAMRole string `name:"kube_iam_role"`
DebugLogging bool `name:"debug_logging" default:"false"`
EnableDBAccess bool `name:"enable_db_access" default:"true"`
EnableTeamsAPI bool `name:"enable_teams_api" default:"true"`
DNSNameFormat string `name:"dns_name_format" default:"%s.%s.%s"`
Workers uint32 `name:"workers" default:"4"`
}
......
......@@ -42,13 +42,15 @@ type TeamsAPI struct {
httpClient *http.Client
logger *logrus.Entry
RefreshTokenAction func() (string, error)
enabled bool
}
func NewTeamsAPI(url string, log *logrus.Logger) *TeamsAPI {
func NewTeamsAPI(url string, log *logrus.Logger, enabled bool) *TeamsAPI {
t := TeamsAPI{
url: strings.TrimRight(url, "/"),
httpClient: &http.Client{},
logger: log.WithField("pkg", "teamsapi"),
enabled: enabled,
}
return &t
......@@ -56,6 +58,10 @@ func NewTeamsAPI(url string, log *logrus.Logger) *TeamsAPI {
func (t *TeamsAPI) TeamInfo(teamId string) (*Team, error) {
// TODO: avoid getting a new token on every call to the Teams API.
if !t.enabled {
t.logger.Debug("Team API is disabled, returning empty list of members")
return &Team{}, nil
}
token, err := t.RefreshTokenAction()
if err != nil {
return nil, err
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment