Commit Graph

12 Commits

Author SHA1 Message Date
Roman Gorshunov 31e5b898a2 Fix: Pegleg Exceptions docs rendering on RTD
Readthedocs failed to render Pegleg exceptions with error:
> WARNING: autodoc: failed to import exception ... from module
> 'pegleg'; the following exception was raised: No module named 'click'

Trying to add Pegleg requirements to the installed requirements list,
so that Readthedocs has all modules, including those needed for the
Pegleg itself.

Change-Id: I1780a9be3aeb0c3e2e775cbb1f713c2033f13e08
2019-07-12 16:48:43 +02:00
Lev Morgan f938029b36 Revised exception for missing passphrase catalog
The exception raised on attempting to generate passphrases without a
passphrase catalog has been revised from a
PassphraseSchemaNotFoundException to a
PassphraseCatalogNotFoundException

Change-Id: Ifbb2903638ffffe5008db52adb6f874bcfa25a99
2019-04-03 16:27:28 -05:00
Ahmad Mahmoudi c4f25b4d4f CLI: Add command to generate genesis bundle
Added a pegleg cli command to build genesis.sh bundle for
a site deployment.
Pegleg imports promenade engine, and uses promenade to build
and encrypt the genesis.sh deployment bundle.

Change-Id: I1a489459b2c56b7b53018c32aab5e6550c69e1d2
2019-03-07 03:00:30 -06:00
pallav b79d5b7a98 CLI capability to generate and encrypt passphrases
1. Adds the passphrases generation capability in Pegleg CLI,
so that pegleg can generation random passwords based on a
specification declared in pegleg/PassphrasesCatalog documents
2. Pegleg also wraps the generated passphrase documents in
pegleg managed documents, and encrypts the data.
3. Adds unit test cases for passphrase generation.
4. Updates pegleg CLI document.

Change-Id: I21d7668788cc24a8e0cc9cb0fb11df97600d0090
2019-01-29 16:24:31 -06:00
Felipe Monteiro 2a8d2638b3 pki: Port Promenade's PKI catalog into Pegleg
This patch set implements the PKICatalog [0] requirements
as well as PeglegManagedDocument [1] generation requirements
outlined in the spec [2].

Included in this patch set:

* New CLI entry point called "pegleg site secrets generate-pki"
* PeglegManagedDocument generation logic in
  engine.cache.managed_document
* Refactored PKICatalog logic in engine.cache.pki_catalog derived
  from the Promenade PKI implementation [3], responsible for
  generating certificates, CAs, and keypairs
* Refactored PKIGenerator logic in engine.cache.pki_generator
  derived from Promenade Generator implementation [4],
  responsible for reading in pegleg/PKICatalog/v1 documents (as
  well as promenade/PKICatalog/v1 documents for backwards
  compatibility) and generating required secrets and storing
  them into the paths specified under [0]
* Unit tests for all of the above [5]
* Example pki-catalog.yaml document under pegleg/site_yamls
* Validation schema for pki-catalog.yaml (TODO: implement
  validation logic here: [6])
* Updates to CLI documentation and inclusion of PKICatalog
  and PeglegManagedDocument documentation
* Documentation updates with PKI information [7]

TODO (in follow-up patch sets):

* Expand on overview documentation to include new Pegleg
  responsibilities
* Allow the original repository (not the copied one) to
  be the destination where the secrets are written to
* Finish up cert expiry/revocation logic

[0] https://airship-specs.readthedocs.io/en/latest/specs/approved/pegleg-secrets.html#document-generation
[1] https://airship-specs.readthedocs.io/en/latest/specs/approved/pegleg-secrets.html#peglegmanageddocument
[2] https://airship-specs.readthedocs.io/en/latest/specs/approved/pegleg-secrets.html
[3] https://github.com/openstack/airship-promenade/blob/master/promenade/pki.py
[4] https://github.com/openstack/airship-promenade/blob/master/promenade/generator.py
[5] https://review.openstack.org/#/c/611739/
[6] https://review.openstack.org/#/c/608159/
[7] https://review.openstack.org/#/c/611738/

Change-Id: I3010d04cac6d22c656d144f0dafeaa5e19a13068
2019-01-15 13:29:21 -06:00
Nishant Kumar 9113d249ff CLI: Add support for uploading documents to Shipyard
This PS enables Pegleg to upload documents directly to Shipyard
thus ensuring that unencrypted data never gets stored in disk.

The flow for this new CLI command is as follows:

- Collect documents as per the provided site repository
- Decrypt the collected documets(TODO)
- Upload document to Shipyard:
  - one collection per repository will be uploaded to Shipyard

    Eg-
        pegleg site -r /opt/aic-clcp-site-manifests \
        -e global=/opt/aic-clcp-manifests upload <site-name>

        Two collections will be created in shipyard since there are two
        repositories provided. The name of the collections will be the
        name of repositories provided.
  - Commit the documents in shipyard buffer.

Change-Id: I6275252b044ebb82d8bb2009c0bea6ebf7033bce
2018-11-27 19:29:42 +00:00
Tin Lam ae81ade94d Refactor Pegleg exceptions
This patch set cleans up the current implementation of pegleg.  As
all the git exceptions inconsistently inits or override the message.
This also cleans up a handful of incorrect kwarg keywords, and improve
handling of the exception messages.

Change-Id: I438eb032728c71cbf972c2120a76d06106cb1580
Signed-off-by: Tin Lam <tin@irrational.io>
2018-11-13 08:58:54 -06:00
Felipe Monteiro 2e51779d57 refactor: Exchange NotADirectoryError for better exception
This patch set replaces raising NotADirectoryError after trying
to parse a repository for its root path (normalize_repo_path in
pegleg.engine.util.git) with a better exception
(exceptions.GitInvalidRepoException). It is better because a
folder can still not be a repo, so raising the first exception
isn't apropos.

Next, this patch set changes where the exception is raised --
which is in normalize_repo_path itself, which is more appropriate
as the function is used in many places and so there should be
intrinsic error handling so as to avoid having to wrap it every
time.

Change-Id: I918d8c293f1140eb80c83499dba2c23af232b79e
2018-10-26 10:37:17 -04:00
Felipe Monteiro 33fe583e08 fix: Pegleg exceptions documentation incorrectly rendering
This patch set changes Pegleg's exceptions documentation
(contained underneath operators guide) because it isn't rendering
correctly as a list table on RTD (the autoexception information
is missing) [0].

The easy fix is to change the tabularized view (list table)
into basically a series of autoexception classes which sufficiently
captures the level of detail required, anyway.

Note that running `tox -e docs` locally and opening the resulting
index.html page appears to work -- but not when hosted on RTD.

[0] https://airship-pegleg.readthedocs.io/en/latest/exceptions.html

Change-Id: Ie4bc01f1fe6aee9b9a58fd956f5b350df44bef51
2018-09-25 04:28:47 +00:00
Felipe Monteiro 73fbf264ca Allow "dirty" local repositories to be safely modified
This patch set rolls back previously introduced behavior in
https://review.openstack.org/#/c/584482/ which forbids users
from basically performing any Pegleg command that references
a dirty local repository. This is annoying, forcing users to
create temporary commits before executing a Pegleg command.

Fortunately with https://review.openstack.org/#/c/577886/
Pegleg copies over all repositories to temporary folders,
within which dirty repos can have their changes temporarily
committed, allowing different references to then be safely
checked out, without ever modifying any local repositories.

Change-Id: I2142ae434f8ad57d0ab81cb104e21d952dc23148
2018-09-14 05:25:21 +00:00
Felipe Monteiro 5369efeec1 git: Raise exception on ref checkout from dirty repo
This raises an exception on trying to checkout a ref from a
dirty repo in the git_handler module. The parent patch
https://review.openstack.org/#/c/582652/ currently forcibly
cleans the repo but this is undesirable as it may have local
user changes that need to be resolved first.

The safest path is for Pegleg to immediately raise an exception
on any tracked/untracked files that are detected using the
GitPython API.

Unit tests are added for both untracked/tracked file cases.

Change-Id: I2241bc981dca1999508c3c7e95948fe47a5ddebf
2018-07-24 18:58:09 +00:00
Felipe Monteiro 20dcaa45ae Add git and branch revision support to pegleg
* Add support for URLs and directories including git clone support
* Add support for http://, https://, and ssh:// git cloning
* Add support for cloning behind proxy
* Add support for checking out references of cloned repos
* Add support for checking out references of local repos
* Add support for Pegleg Git exceptions

This patch set also adds support for including Pegleg
source code in documentation and adds exceptions
documentation.

Change-Id: I417a62c815f97a70f3abc432cc342707e8ce1f54
2018-07-20 01:14:13 +01:00