Merge ~johnsca/charm-prometheus2:johnsca/feature/manual-job-relation-2 into ~prometheus-charmers/charm-prometheus2:master

[Cory Johns]

Refactor ca_file writing logic out of interface layer into charm

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Stuart Bishop (stub)]

Looks good. Please add the glob.escape() bits per inline comment before landing; even if the job name and id are from trusted sources, its easy to escape so others don't need to worry about it.

Still needs a ~prometheus-charmers review.

review: Approve

[Cory Johns (johnsca)]

Good catch, thanks.

[Cory Johns (johnsca)]

1.3.0 of charms.reactive is released with the relevant change, as well as the interface layer PRs.

[Jeremy Lounder (jldev)]

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision 24325849d1c27faa6ffcb4a37b85de1a6234ca96

diff --git a/reactive/prometheus.py b/reactive/prometheus.py
index fbf1626..29de54a 100644
--- a/reactive/prometheus.py
+++ b/reactive/prometheus.py
@@ -3,10 +3,13 @@ import pwd
 import subprocess
 import yaml
 import re
+import glob
 from jinja2 import Template
 import shutil
 import time
+from hashlib import sha1
 from urllib.parse import urlparse
+from pathlib import Path
 
 from charmhelpers import fetch
 from charmhelpers.core import host, hookenv, unitdata
@@ -37,6 +40,7 @@ PATHS = {
     'promreg_yml': '/var/snap/promreg/common/promreg.yaml',
     'promreg_tgts_yml': '/var/snap/promreg/common/promreg/targets.yaml',
     'promreg_service_name': 'snap.promreg.promreg',
+    'certs_dir': '/var/snap/prometheus/common/certs',
 }
 
 
@@ -572,8 +576,38 @@ def update_prometheus_scrape_targets(target):
 
 @when('endpoint.manual-jobs.has_jobs')
 def update_prometheus_manual_jobs(manual_jobs):
-    unitdata.kv().set('manual_jobs', [job.to_json()
-                                      for job in manual_jobs.jobs])
+    job_jsons = []
+    certs_dir = Path(PATHS['certs_dir'])
+    certs_dir.mkdir(parents=True, exist_ok=True)
+    for job in manual_jobs.jobs:
+        if job.ca_cert:
+            # escape path special chars to be safe when saving
+            job_name = job.job_name.replace('/', '_')
+            request_id = job.request_id.replace('/', '_')
+            # escape glob special chars to be safe when cleaning up
+            g_job_name = glob.escape(job_name)
+            g_request_id = glob.escape(request_id)
+            # include a hash of the cert data rather than just the request ID
+            # so that check_reconfig_prometheus can detect changes to the data
+            # via the filename
+            cert_hash = sha1(job.ca_cert.encode('utf8')).hexdigest()
+            cert_path = certs_dir / '{}-{}-{}.crt'.format(job_name,
+                                                          request_id,
+                                                          cert_hash)
+            # avoid re-writing the file if contents haven't changed
+            if not cert_path.exists():
+                # clean up previous versions of the cert
+                for old_cert in certs_dir.glob('{}-{}-*.crt'
+                                               ''.format(g_job_name,
+                                                         g_request_id)):
+                    old_cert.unlink()
+                # NB: ensure trailing newline because some programs fail
+                # without it (haven't tested prometheus specifically)
+                cert_path.write_text(job.ca_cert.rstrip() + '\n')
+            job_jsons.append(job.to_json(cert_path))
+        else:
+            job_jsons.append(job.to_json())
+    unitdata.kv().set('manual_jobs', job_jsons)
     set_state('prometheus.do-check-reconfig')