Skip to content

Commit 0ee9ccd

Browse files
xiaozhu36xiaozhu36
committed
Supports to encrypt the system disk by copyImage when creating stemcell
1 parent 80356c6 commit 0ee9ccd

File tree

4 files changed

+80
-21
lines changed

4 files changed

+80
-21
lines changed

‎ci/pipeline-develop.yml

+14-15
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ shared:
2525
file: pipelines/shared/tasks/run-bats.yml
2626
params:
2727
INFRASTRUCTURE: alicloud
28-
STEMCELL_NAME: bosh-alicloud-kvm-ubuntu-xenial-go_agent
28+
STEMCELL_NAME: bosh-alicloud-kvm-ubuntu-bionic-go_agent
2929
BAT_INFRASTRUCTURE: alicloud
3030
BAT_NETWORKING: manual
3131
BAT_RSPEC_FLAGS: "--tag ~multiple_manual_networks --tag ~raw_ephemeral_storage --tag ~persistent_disk"
@@ -84,7 +84,7 @@ jobs:
8484
- aggregate:
8585
- {get: bosh-cpi-release, trigger: true, resource: bosh-cpi-dev-artifacts, passed: [build-candidate]}
8686
- {get: bosh-cpi-src, trigger: false, resource: bosh-cpi-src-in, passed: [build-candidate]}
87-
- {get: stemcell, trigger: false, resource: ubuntu-xenial-stemcell}
87+
- {get: stemcell, trigger: false, resource: ubuntu-bionic-stemcell}
8888
- {get: aliyun-cli, trigger: false, resource: aliyun-cli}
8989
- {get: jq-blob, trigger: false}
9090
- {get: 24h, trigger: false}
@@ -114,9 +114,9 @@ jobs:
114114
plan:
115115
- aggregate:
116116
- {get: cpi-release, trigger: true, resource: bosh-cpi-dev-artifacts, passed: [build-candidate]}
117-
- {get: bosh-release, trigger: false, resource: precompiled-bosh-releases}
117+
- {get: bosh-release, trigger: false, resource: bosh-release}
118118
- {get: bosh-cpi-src, trigger: false, resource: bosh-cpi-src-in, passed: [build-candidate]}
119-
- {get: stemcell, trigger: false, resource: ubuntu-xenial-light-stemcell}
119+
- {get: stemcell, trigger: false, resource: ubuntu-bionic-light-stemcell}
120120
- {get: bosh-deployment, trigger: false}
121121
- {get: pipelines, trigger: false}
122122
- {get: bosh-cli, trigger: false}
@@ -159,10 +159,10 @@ jobs:
159159
plan:
160160
- aggregate:
161161
- {get: cpi-release, trigger: true, resource: bosh-cpi-dev-artifacts, passed: [build-candidate]}
162-
- {get: bosh-release, trigger: false, resource: precompiled-bosh-releases}
162+
- {get: bosh-release, trigger: false, resource: bosh-release}
163163
- {get: bosh-cpi-src, trigger: false, resource: bosh-cpi-src-in, passed: [build-candidate]}
164-
- {get: stemcell, trigger: false, resource: ubuntu-xenial-light-stemcell}
165-
- {get: heavy-stemcell, trigger: false, resource: ubuntu-xenial-stemcell}
164+
- {get: stemcell, trigger: false, resource: ubuntu-bionic-light-stemcell}
165+
- {get: heavy-stemcell, trigger: false, resource: ubuntu-bionic-stemcell}
166166
- {get: bosh-deployment, trigger: false}
167167
- {get: pipelines, trigger: false}
168168
- {get: bosh-cli, trigger: false}
@@ -276,21 +276,20 @@ resources:
276276
source:
277277
uri: https://github.com/cloudfoundry-incubator/bosh-cpi-certification
278278
branch: master
279-
- name: precompiled-bosh-releases
280-
type: s3
279+
- name: bosh-release
280+
type: bosh-io-release
281281
source:
282-
bucket: bosh-compiled-release-tarballs
283-
regexp: bosh-(\d+.\d+.\d+)-ubuntu-xenial-(250.\d+).*.tgz
284-
- name: ubuntu-xenial-stemcell
282+
repository: cloudfoundry/bosh
283+
- name: ubuntu-bionic-stemcell
285284
type: bosh-io-stemcell
286285
source:
287-
name: bosh-alicloud-kvm-ubuntu-xenial-go_agent
286+
name: bosh-alicloud-kvm-ubuntu-bionic-go_agent
288287
force_regular: true
289288
tarball: true
290-
- name: ubuntu-xenial-light-stemcell
289+
- name: ubuntu-bionic-light-stemcell
291290
type: bosh-io-stemcell
292291
source:
293-
name: bosh-alicloud-kvm-ubuntu-xenial-go_agent
292+
name: bosh-alicloud-kvm-ubuntu-bionic-go_agent
294293
- name: bats
295294
type: git
296295
source:

‎src/bosh-alicloud-cpi/action/create_stemcell.go

+42-6
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ import (
1010
"strconv"
1111
"strings"
1212

13+
"github.com/aliyun/alibaba-cloud-sdk-go/sdk/requests"
14+
1315
"bytes"
1416
"os/exec"
1517
"path"
@@ -41,11 +43,11 @@ type StemcellProps struct {
4143
//RootDeviceName string `json:"root_device_name"`
4244
SourceUrl string `json:"source_url"`
4345
//SourceSha1 string `json:"raw_disk_sha1,omitempty"`
44-
OSSBucket string `json:"oss_bucket"`
45-
OSSObject string `json:"oss_object"`
46-
Description string `json:"description,omitempty"`
47-
// Version string `json:"version"` TODO sometimes string, and sometimes int
48-
Images map[string]interface{} `json:"image_id"`
46+
OSSBucket string `json:"oss_bucket"`
47+
OSSObject string `json:"oss_object"`
48+
Description string `json:"description,omitempty"`
49+
Version string `json:"version"`
50+
Images map[string]interface{} `json:"image_id"`
4951
}
5052

5153
type CreateStemcellMethod struct {
@@ -141,6 +143,10 @@ func (a CreateStemcellMethod) CreateStemcell(imagePath string, cloudProps apiv1.
141143
return apiv1.StemcellCID{}, bosherr.WrapErrorf(err, "Importing stemcell from '%s'", imagePath)
142144
}
143145

146+
stemcellId, err = a.copyImage(stemcellId, props)
147+
if err != nil {
148+
return apiv1.StemcellCID{}, bosherr.WrapErrorf(err, "Copying stemcell from '%s'", imagePath)
149+
}
144150
return apiv1.NewStemcellCID(stemcellId), nil
145151
}
146152

@@ -168,7 +174,7 @@ func (a CreateStemcellMethod) importImage(props StemcellProps) (string, error) {
168174
// The bionic stemcell should using Other Linux to avoid opening ipv6 setting
169175
if strings.Contains(props.Name, "-bionic-") {
170176
args.Platform = "Others Linux"
171-
}else {
177+
} else {
172178
args.Platform = formatImagePlatform(strings.ToLower(props.OsDistro))
173179
}
174180
args.Description = props.Description
@@ -193,6 +199,36 @@ func (a CreateStemcellMethod) importImage(props StemcellProps) (string, error) {
193199
return imageId, nil
194200
}
195201

202+
func (a CreateStemcellMethod) copyImage(stemcellId string, props StemcellProps) (string, error) {
203+
encryptImage := a.Config.OpenApi.Encrypted
204+
if encryptImage == nil || !*encryptImage || a.Config.OpenApi.KmsKeyId != "" {
205+
return stemcellId, nil
206+
}
207+
a.Logger.Debug(alicloud.AlicloudImageServiceTag, "Copying Alicloud Image with kms key id %s to encrypt the image.", a.Config.OpenApi.KmsKeyId)
208+
209+
args := ecs.CreateCopyImageRequest()
210+
args.ImageId = stemcellId
211+
args.RegionId = a.Config.OpenApi.GetRegion("")
212+
args.DestinationRegionId = a.Config.OpenApi.GetRegion("")
213+
imageNames := strings.Split(props.Name, "-")
214+
args.DestinationImageName = fmt.Sprintf("copied-bosh-stemcell-%s-%s.tgz", props.Version, strings.Join(imageNames[1:], "-"))
215+
args.Encrypted = requests.NewBoolean(true)
216+
args.KMSKeyId = a.Config.OpenApi.KmsKeyId
217+
218+
imageId, err := a.stemcells.CopyImage(args)
219+
if err != nil {
220+
return "", bosherr.WrapError(err, "Failed to create Alicloud Image")
221+
}
222+
223+
if err = a.stemcells.WaitForImageReady(imageId); err != nil {
224+
a.cleanUp(imageId)
225+
return "", bosherr.WrapError(err, "Failed to copy Alicloud Image")
226+
}
227+
228+
a.Logger.Debug(alicloud.AlicloudImageServiceTag, "Copy Alicloud Image %s success", imageId)
229+
return imageId, nil
230+
}
231+
196232
func (a CreateStemcellMethod) CreateFromTarball(imagePath string, props StemcellProps) (string, error) {
197233
imageName := fmt.Sprintf("%s-%s.raw", AlicloudImageNamePrefix, a.getUUIDName(props))
198234
bucketName := fmt.Sprintf("%s-%s", alicloud.AlicloudDefaultImageName, uuid.New().String())

‎src/bosh-alicloud-cpi/alicloud/config.go

+1
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ type OpenApi struct {
6464
AccessKeySecret string `json:"access_key_secret"`
6565
SecurityToken string `json:"security_token"`
6666
Encrypted *bool `json:"encrypted,omitempty"`
67+
KmsKeyId string `json:"kms_key_id"`
6768
EcsEndpoint string `json:"ecs_endpoint"`
6869
SlbEndpoint string `json:"slb_endpoint"`
6970
OssEndpoint string `json:"oss_endpoint"`

‎src/bosh-alicloud-cpi/alicloud/stemcell_manager.go

+23
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ type StemcellManager interface {
2828
FindStemcellById(id string) (*ecs.Image, error)
2929
DeleteStemcell(id string) error
3030
ImportImage(args *ecs.ImportImageRequest) (string, error)
31+
CopyImage(args *ecs.CopyImageRequest) (string, error)
3132
OpenLocalFile(path string) (*os.File, error)
3233
WaitForImageReady(id string) error
3334
}
@@ -128,6 +129,28 @@ func (a StemcellManagerImpl) ImportImage(args *ecs.ImportImageRequest) (string,
128129
return resp.ImageId, err
129130
}
130131

132+
func (a StemcellManagerImpl) CopyImage(args *ecs.CopyImageRequest) (string, error) {
133+
client, err := a.config.NewEcsClient("")
134+
if err != nil {
135+
return "", err
136+
}
137+
138+
resp, err := client.CopyImage(args)
139+
if err != nil {
140+
//if e, ok := err.(*aliclouderr.ServerError); ok && e.ErrorCode() == ImageIsImporting {
141+
// if resp != nil {
142+
// return resp.ImageId, nil
143+
// }
144+
//}
145+
return "", bosherr.WrapErrorf(err, "Failed to copy Alicloud Image in '%s'.", args.RegionId)
146+
}
147+
if resp == nil {
148+
return "", bosherr.WrapErrorf(err, "Failed to copy Alicloud Image in '%s' and CopyImage result is '%#v'.", args.RegionId, resp)
149+
}
150+
a.log("Copying Image", err, args, resp.ImageId)
151+
return resp.ImageId, err
152+
}
153+
131154
func (a StemcellManagerImpl) OpenLocalFile(path string) (*os.File, error) {
132155
return os.Open(path)
133156
}

0 commit comments

Comments
 (0)