Merge ~pjdc/influxdb-charm/+git/influxdb-charm:better-auth into influxdb-charm:master

[Paul Collins]

Add some authentication support. This branch teaches the charm to create "admin" and "nagios" accounts, storing the credentials in appropriate places, and updates the backup script to use authentication.

Not implemented yet is any support for e.g. the grafana-source relation or, indeed, for anything else.

[Haw Loeung (hloeung)]

LGTM, +1

review: Approve

diff --git a/.gitignore b/.gitignore
index 71d6f3c..6c03fc3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,5 @@
+*~
+*#
+.#*
 builds
 deps
diff --git a/README.md b/README.md
index 31d19fe..d940e1d 100644
--- a/README.md
+++ b/README.md
@@ -31,4 +31,21 @@ However, you still need to create an InfluxDB database and populate the
 Grafana data source page with its details. Once you have created an
 InfluxDB database, visit the Grafana /datasources page, choose your
 InfluxDB juju generated data source, and edit the database settings
-accordingly.
\ No newline at end of file
+accordingly.
+
+# Authentication
+
+To enable authentication, add "http.auth-enabled=true" to
+extra_configs, e.g., if there are no other options set:
+
+    juju config influxdb extra_configs="- http.auth-enabled=true"
+
+Whether authentication is enabled or not, the charm will create an
+"admin" account at install time and store the credentials in
+`/root/.influx-auth`.  If the application is related to cs:nrpe, it
+will create a "nagios" account and store the credentials in
+`/var/lib/nagios/.influx-auth`, as the Nagios check expects.
+Due to the way the check works, this is also an admin account.
+
+All other authentication management must be done manually, including
+to allow a related grafana access to use an InfluxDB data source.
diff --git a/reactive/influxdb.py b/reactive/influxdb.py
index 24b51bf..984d27e 100644
--- a/reactive/influxdb.py
+++ b/reactive/influxdb.py
@@ -5,12 +5,20 @@ from charmhelpers.core.templating import render
 from charmhelpers.fetch import apt_install
 from charms.reactive import hook, set_state, remove_state, when, when_all, when_not
 
-import re
 import os
+import pwd
+import re
 import shutil
 import subprocess
+import uuid
 import yaml
 
+try:
+    import influxdb
+    have_influxdbclient = True
+except ImportError:
+    have_influxdbclient = False
+
 CRONFILE = '/etc/cron.daily/influxdb-charm-backup'
 CHECK_SRC = 'files/check_influxdb.py'
 CHECK_DIR = '/usr/local/lib/nagios/plugins'
@@ -46,6 +54,59 @@ def install_influx():
     # python3-influxdb only exists in Ubuntu Xenial and beyond - LP: #1732015.
     if series not in ('precise', 'trusty'):
         apt_install('python3-influxdb')
+        # Yes, this is gross, but we're going to need it shortly.
+        global have_influxdbclient, influxdb
+        import influxdb
+        have_influxdbclient = True
+    if have_influxdbclient:
+        configure_influxdb_auth()
+
+
+def get_influxdb_credentials(local_user='root'):
+    """Locate and return influx credentials for the given local user."""
+    try:
+        home_dir = pwd.getpwnam(local_user).pw_dir
+        with open(os.path.join(home_dir, '.influx-auth')) as auth:
+            line = auth.readline().rstrip()
+            if line.count(' ') == 1:
+                fields = line.split(' ')
+                return fields[0], fields[1]
+    except KeyError:
+        hookenv.log('Local user {} not found'.format(local_user))
+    except FileNotFoundError:
+        hookenv.log('Credentials for local user {} not found'.format(local_user))
+
+    return None, None
+
+
+def create_influxdb_user(username, admin=False, local_user=None):
+    currentusername, currentpassword = get_influxdb_credentials(local_user=local_user)
+    if currentusername and currentusername == username:
+        return currentpassword
+
+    adminuser, adminpass = get_influxdb_credentials()
+    influx = influxdb.InfluxDBClient(username=adminuser, password=adminpass)
+    password = str(uuid.uuid4())
+    influx.create_user(username, password, admin=admin)
+
+    if local_user:
+        passwd_entry = pwd.getpwnam(local_user)
+        with open(os.path.join(passwd_entry.pw_dir, '.influx-auth'), mode='w') as auth:
+            os.chmod(auth.name, 0o0600)
+            auth.write('{} {}\n'.format(username, password))
+            os.chown(auth.name, passwd_entry.pw_uid, passwd_entry.pw_gid)
+
+    set_state('influxdb.{}.account.created'.format(username))
+
+    return password
+
+
+def configure_influxdb_auth():
+    # Create admin account, if it doesn't already exist.
+    username, password = get_influxdb_credentials()
+    if not username:
+        username = 'admin'
+        create_influxdb_user(username, admin=True, local_user='root')
 
 
 def apply_configs(fh, config):
@@ -99,7 +160,7 @@ def apply_configs(fh, config):
     return ''.join(new_config)
 
 
-@when_all('influxdb.configured', 'config.changed')
+@when_all('influxdb.configured', 'influxdb.admin.account.created', 'config.changed')
 def config_changed():
     config = hookenv.config()
     conf = {
@@ -159,11 +220,38 @@ def create_backup_job():
 
 @hook('upgrade-charm')
 def upgrade_charm():
+    # If auth is not configured correctly, block the upgrade.
+    if os.path.exists('/root/.influx-auth'):
+        # This could be more rigorously checked.
+        set_state('influxdb.admin.account.created')
+    else:
+        ic = influxdb.InfluxDBClient()
+        try:
+            ic.get_list_database()
+        except influxdb.exceptions.InfluxDBClientError as e:
+            if e.code == 403:
+                # InfluxDB throws 403 if there is no admin account, but
+                # will still allow it to be created, without authenticating.
+                hookenv.log(
+                    'Received 403 from InfluxDB, which indicates authentication is enabled '
+                    'but no admin account exists.  Continuing to let it be created.')
+            elif e.code == 401:
+                auth_error_message = \
+                    'Authentication is enabled but /root/.influx-auth does not exist. ' \
+                    'Please place username and password for an admin account ' \
+                    'named "admin" in this file and retry the upgrade.'
+                hookenv.status_set('blocked', auth_error_message)
+                hookenv.log(auth_error_message, hookenv.ERROR)
+                raise
+            else:
+                raise
+
     remove_state('influxdb.configured')
     set_state('config.changed.backup_dir')
     # If we have an NRPE relation, force run of that as well
     if hookenv.relation_ids('nrpe-exteral-master'):
         set_state('nrpe-external-master.available')
+    hookenv.status_set('active', '')
 
 
 @when('query.api.available')
@@ -195,3 +283,8 @@ def update_nrpe_config(svc):
         check_cmd=CHECK_CMD,
     )
     nrpe_setup.write()
+
+
+@when('nrpe-external-master.available', 'influxdb.admin.account.created')
+def create_nagios_influxdb_user(svc):
+    create_influxdb_user('nagios', admin=True, local_user='nagios')
diff --git a/templates/influxdb-backup b/templates/influxdb-backup
index 9c3fdf9..cb53a44 100644
--- a/templates/influxdb-backup
+++ b/templates/influxdb-backup
@@ -11,6 +11,12 @@ NUM="{{backup_retention}}"
 TODAY_DIR="$BACKUP_DIR/$(date -I)"
 mkdir -p $TODAY_DIR
 
+# Use authentication, if configured.
+if [ -r /root/.influx-auth ]; then
+    read INFLUX_USERNAME INFLUX_PASSWORD dummy < /root/.influx-auth
+    export INFLUX_USERNAME INFLUX_PASSWORD
+fi
+
 DATABASES=$(influx --execute 'show databases' --format=json | jq --raw-output '.results[0].series[0].values[][0]' | grep -ve '^_internal$')
 
 # back up metadata