// WatchAuthorisedKeys starts a watcher to track changes to the authorised ssh keys
// for the specified machines.
// The current implementation relies on global authorised keys being stored in the environment config.
// This will change as new user management and authorisation functionality is added.
func (api *KeyUpdaterAPI) WatchAuthorisedKeys(arg params.Entities) (params.NotifyWatchResults, error) {
results := make([]params.NotifyWatchResult, len(arg.Entities))
canRead, err := api.getCanRead()
if err != nil {
return params.NotifyWatchResults{}, err
}
for i, entity := range arg.Entities {
// 1. Check permissions
if !canRead(entity.Tag) {
results[i].Error = common.ServerError(common.ErrPerm)
continue
}
// 2. Check entity exists
if _, err := api.state.FindEntity(entity.Tag); err != nil {
if errors.IsNotFound(err) {
results[i].Error = common.ServerError(common.ErrPerm)
} else {
results[i].Error = common.ServerError(err)
}
continue
}
// 3. Watch fr changes
var err error
watch := api.state.WatchForEnvironConfigChanges()
// Consume the initial event.
if _, ok := <-watch.Changes(); ok {
results[i].NotifyWatcherId = api.resources.Register(watch)
} else {
err = watcher.MustErr(watch)
}
results[i].Error = common.ServerError(err)
}
return params.NotifyWatchResults{Results: results}, nil
}
func (u *UnitUpgraderAPI) watchAssignedMachine(unitTag string) (string, error) {
machine, err := u.getAssignedMachine(unitTag)
if err != nil {
return "", err
}
watch := machine.Watch()
// Consume the initial event. Technically, API
// calls to Watch 'transmit' the initial event
// in the Watch response. But NotifyWatchers
// have no state to transmit.
if _, ok := <-watch.Changes(); ok {
return u.resources.Register(watch), nil
}
return "", watcher.MustErr(watch)
}
func (p *environProvisioner) loop() error {
var environConfigChanges <-chan struct{}
environWatcher, err := p.st.WatchForEnvironConfigChanges()
if err != nil {
return err
}
environConfigChanges = environWatcher.Changes()
defer watcher.Stop(environWatcher, &p.tomb)
p.environ, err = worker.WaitForEnviron(environWatcher, p.st, p.tomb.Dying())
if err != nil {
return err
}
p.broker = p.environ
safeMode := p.environ.Config().ProvisionerSafeMode()
task, err := p.getStartTask(safeMode)
if err != nil {
return err
}
defer watcher.Stop(task, &p.tomb)
for {
select {
case <-p.tomb.Dying():
return tomb.ErrDying
case <-task.Dying():
err := task.Err()
logger.Errorf("environ provisioner died: %v", err)
return err
case _, ok := <-environConfigChanges:
if !ok {
return watcher.MustErr(environWatcher)
}
environConfig, err := p.st.EnvironConfig()
if err != nil {
logger.Errorf("cannot load environment configuration: %v", err)
return err
}
if err := p.setConfig(environConfig); err != nil {
logger.Errorf("loaded invalid environment configuration: %v", err)
}
task.SetSafeMode(environConfig.ProvisionerSafeMode())
}
}
}
func (a *AgentEntityWatcher) watchEntity(tag string) (string, error) {
entity0, err := a.st.FindEntity(tag)
if err != nil {
return "", err
}
entity, ok := entity0.(state.NotifyWatcherFactory)
if !ok {
return "", NotSupportedError(tag, "watching")
}
watch := entity.Watch()
// Consume the initial event. Technically, API
// calls to Watch 'transmit' the initial event
// in the Watch response. But NotifyWatchers
// have no state to transmit.
if _, ok := <-watch.Changes(); ok {
return a.resources.Register(watch), nil
}
return "", watcher.MustErr(watch)
}
// WatchLoggingConfig starts a watcher to track changes to the logging config
// for the agents specified.. Unfortunately the current infrastruture makes
// watching parts of the config non-trivial, so currently any change to the
// config will cause the watcher to notify the client.
func (api *LoggerAPI) WatchLoggingConfig(arg params.Entities) params.NotifyWatchResults {
result := make([]params.NotifyWatchResult, len(arg.Entities))
for i, entity := range arg.Entities {
err := common.ErrPerm
if api.authorizer.AuthOwner(entity.Tag) {
watch := api.state.WatchForEnvironConfigChanges()
// Consume the initial event. Technically, API calls to Watch
// 'transmit' the initial event in the Watch response. But
// NotifyWatchers have no state to transmit.
if _, ok := <-watch.Changes(); ok {
result[i].NotifyWatcherId = api.resources.Register(watch)
err = nil
} else {
err = watcher.MustErr(watch)
}
}
result[i].Error = common.ServerError(err)
}
return params.NotifyWatchResults{Results: result}
}
// watchLoop watches the service's exposed flag for changes.
func (sd *serviceData) watchLoop(exposed bool) {
defer sd.tomb.Done()
w, err := sd.service.Watch()
if err != nil {
sd.fw.tomb.Kill(err)
return
}
defer watcher.Stop(w, &sd.tomb)
for {
select {
case <-sd.tomb.Dying():
return
case _, ok := <-w.Changes():
if !ok {
sd.fw.tomb.Kill(watcher.MustErr(w))
return
}
if err := sd.service.Refresh(); err != nil {
if !params.IsCodeNotFound(err) {
sd.fw.tomb.Kill(err)
}
return
}
change, err := sd.service.IsExposed()
if err != nil {
sd.fw.tomb.Kill(err)
return
}
if change == exposed {
continue
}
exposed = change
select {
case sd.fw.exposedChange <- &exposedChange{sd, change}:
case <-sd.tomb.Dying():
return
}
}
}
}
// watchLoop watches the unit for port changes.
func (ud *unitData) watchLoop(latestPorts []instance.Port) {
defer ud.tomb.Done()
w, err := ud.unit.Watch()
if err != nil {
ud.fw.tomb.Kill(err)
return
}
defer watcher.Stop(w, &ud.tomb)
for {
select {
case <-ud.tomb.Dying():
return
case _, ok := <-w.Changes():
if !ok {
ud.fw.tomb.Kill(watcher.MustErr(w))
return
}
if err := ud.unit.Refresh(); err != nil {
if !params.IsCodeNotFound(err) {
ud.fw.tomb.Kill(err)
}
return
}
change, err := ud.unit.OpenedPorts()
if err != nil {
ud.fw.tomb.Kill(err)
return
}
if samePorts(change, latestPorts) {
continue
}
latestPorts = append(latestPorts[:0], change...)
select {
case ud.fw.portsChange <- &portsChange{ud, change}:
case <-ud.tomb.Dying():
return
}
}
}
}
func (u *UnitsWatcher) watchOneEntityUnits(canWatch AuthFunc, tag string) (params.StringsWatchResult, error) {
nothing := params.StringsWatchResult{}
if !canWatch(tag) {
return nothing, ErrPerm
}
entity0, err := u.st.FindEntity(tag)
if err != nil {
return nothing, err
}
entity, ok := entity0.(state.UnitsWatcher)
if !ok {
return nothing, NotSupportedError(tag, "watching units")
}
watch := entity.WatchUnits()
// Consume the initial event and forward it to the result.
if changes, ok := <-watch.Changes(); ok {
return params.StringsWatchResult{
StringsWatcherId: u.resources.Register(watch),
Changes: changes,
}, nil
}
return nothing, watcher.MustErr(watch)
}
// watchLoop watches the machine for units added or removed.
func (md *machineData) watchLoop(unitw apiwatcher.StringsWatcher) {
defer md.tomb.Done()
defer watcher.Stop(unitw, &md.tomb)
for {
select {
case <-md.tomb.Dying():
return
case change, ok := <-unitw.Changes():
if !ok {
_, err := md.machine()
if !params.IsCodeNotFound(err) {
md.fw.tomb.Kill(watcher.MustErr(unitw))
}
return
}
select {
case md.fw.unitsChange <- &unitsChange{md, change}:
case <-md.tomb.Dying():
return
}
}
}
}
// WatchAPIVersion starts a watcher to track if there is a new version
// of the API that we want to upgrade to
func (u *UpgraderAPI) WatchAPIVersion(args params.Entities) (params.NotifyWatchResults, error) {
result := params.NotifyWatchResults{
Results: make([]params.NotifyWatchResult, len(args.Entities)),
}
for i, agent := range args.Entities {
err := common.ErrPerm
if u.authorizer.AuthOwner(agent.Tag) {
watch := u.st.WatchForEnvironConfigChanges()
// Consume the initial event. Technically, API
// calls to Watch 'transmit' the initial event
// in the Watch response. But NotifyWatchers
// have no state to transmit.
if _, ok := <-watch.Changes(); ok {
result.Results[i].NotifyWatcherId = u.resources.Register(watch)
err = nil
} else {
err = watcher.MustErr(watch)
}
}
result.Results[i].Error = common.ServerError(err)
}
return result, nil
}
// startMachine creates a new data value for tracking details of the
// machine and starts watching the machine for units added or removed.
func (fw *Firewaller) startMachine(tag string) error {
machined := &machineData{
fw: fw,
tag: tag,
unitds: make(map[string]*unitData),
ports: make([]instance.Port, 0),
}
m, err := machined.machine()
if params.IsCodeNotFound(err) {
return nil
} else if err != nil {
return errors.Annotate(err, "cannot watch machine units")
}
unitw, err := m.WatchUnits()
if err != nil {
return err
}
select {
case <-fw.tomb.Dying():
stop("units watcher", unitw)
return tomb.ErrDying
case change, ok := <-unitw.Changes():
if !ok {
stop("units watcher", unitw)
return watcher.MustErr(unitw)
}
fw.machineds[tag] = machined
err = fw.unitsChanged(&unitsChange{machined, change})
if err != nil {
stop("units watcher", unitw)
delete(fw.machineds, tag)
return errors.Annotatef(err, "cannot respond to units changes for %q", tag)
}
}
go machined.watchLoop(unitw)
return nil
}
// WatchForRsyslogChanges starts a watcher to track if there are changes
// that require we update the rsyslog.d configurations for a machine and/or unit.
func (api *RsyslogAPI) WatchForRsyslogChanges(args params.Entities) (params.NotifyWatchResults, error) {
result := params.NotifyWatchResults{
Results: make([]params.NotifyWatchResult, len(args.Entities)),
}
for i := range args.Entities {
err := common.ErrPerm
if api.authorizer.AuthMachineAgent() || api.authorizer.AuthUnitAgent() {
watch := api.st.WatchAPIHostPorts()
// Consume the initial event. Technically, API
// calls to Watch 'transmit' the initial event
// in the Watch response. But NotifyWatchers
// have no state to transmit.
if _, ok := <-watch.Changes(); ok {
result.Results[i].NotifyWatcherId = api.resources.Register(watch)
err = nil
} else {
err = watcher.MustErr(watch)
}
}
result.Results[i].Error = common.ServerError(err)
}
return result, nil
}
func (fw *Firewaller) loop() error {
defer fw.stopWatchers()
var err error
var reconciled bool
fw.environ, err = worker.WaitForEnviron(fw.environWatcher, fw.st, fw.tomb.Dying())
if err != nil {
return err
}
if fw.environ.Config().FirewallMode() == config.FwGlobal {
fw.globalMode = true
fw.globalPortRef = make(map[instance.Port]int)
}
for {
select {
case <-fw.tomb.Dying():
return tomb.ErrDying
case _, ok := <-fw.environWatcher.Changes():
if !ok {
return watcher.MustErr(fw.environWatcher)
}
config, err := fw.st.EnvironConfig()
if err != nil {
return err
}
if err := fw.environ.SetConfig(config); err != nil {
logger.Errorf("loaded invalid environment configuration: %v", err)
}
case change, ok := <-fw.machinesWatcher.Changes():
if !ok {
return watcher.MustErr(fw.machinesWatcher)
}
for _, machineId := range change {
fw.machineLifeChanged(names.MachineTag(machineId))
}
if !reconciled {
reconciled = true
var err error
if fw.globalMode {
err = fw.reconcileGlobal()
} else {
err = fw.reconcileInstances()
}
if err != nil {
return err
}
}
case change := <-fw.unitsChange:
if err := fw.unitsChanged(change); err != nil {
return err
}
case change := <-fw.portsChange:
change.unitd.ports = change.ports
if err := fw.flushUnits([]*unitData{change.unitd}); err != nil {
return errors.Annotate(err, "cannot change firewall ports")
}
case change := <-fw.exposedChange:
change.serviced.exposed = change.exposed
unitds := []*unitData{}
for _, unitd := range change.serviced.unitds {
unitds = append(unitds, unitd)
}
if err := fw.flushUnits(unitds); err != nil {
return errors.Annotate(err, "cannot change firewall ports")
}
}
}
}
func (f *filter) loop(unitTag string) (err error) {
defer func() {
if params.IsCodeNotFoundOrCodeUnauthorized(err) {
err = worker.ErrTerminateAgent
}
}()
if f.unit, err = f.st.Unit(unitTag); err != nil {
return err
}
if err = f.unitChanged(); err != nil {
return err
}
f.service, err = f.unit.Service()
if err != nil {
return err
}
if err = f.serviceChanged(); err != nil {
return err
}
unitw, err := f.unit.Watch()
if err != nil {
return err
}
defer f.maybeStopWatcher(unitw)
servicew, err := f.service.Watch()
if err != nil {
return err
}
defer f.maybeStopWatcher(servicew)
// configw and relationsw can get restarted, so we need to use
// their eventual values in the defer calls.
var configw apiwatcher.NotifyWatcher
var configChanges <-chan struct{}
curl, err := f.unit.CharmURL()
if err == nil {
configw, err = f.unit.WatchConfigSettings()
if err != nil {
return err
}
configChanges = configw.Changes()
f.upgradeFrom.url = curl
} else if err != uniter.ErrNoCharmURLSet {
filterLogger.Errorf("unit charm: %v", err)
return err
}
defer func() {
if configw != nil {
watcher.Stop(configw, &f.tomb)
}
}()
relationsw, err := f.service.WatchRelations()
if err != nil {
return err
}
defer func() {
if relationsw != nil {
watcher.Stop(relationsw, &f.tomb)
}
}()
// Config events cannot be meaningfully discarded until one is available;
// once we receive the initial change, we unblock discard requests by
// setting this channel to its namesake on f.
var discardConfig chan struct{}
for {
var ok bool
select {
case <-f.tomb.Dying():
return tomb.ErrDying
// Handle watcher changes.
case _, ok = <-unitw.Changes():
filterLogger.Debugf("got unit change")
if !ok {
return watcher.MustErr(unitw)
}
if err = f.unitChanged(); err != nil {
return err
}
case _, ok = <-servicew.Changes():
filterLogger.Debugf("got service change")
if !ok {
return watcher.MustErr(servicew)
}
if err = f.serviceChanged(); err != nil {
return err
}
case _, ok = <-configChanges:
filterLogger.Debugf("got config change")
if !ok {
return watcher.MustErr(configw)
}
filterLogger.Debugf("preparing new config event")
f.outConfig = f.outConfigOn
discardConfig = f.discardConfig
case keys, ok := <-relationsw.Changes():
filterLogger.Debugf("got relations change")
if !ok {
return watcher.MustErr(relationsw)
}
var ids []int
for _, key := range keys {
relationTag := names.RelationTag(key)
rel, err := f.st.Relation(relationTag)
if params.IsCodeNotFoundOrCodeUnauthorized(err) {
// If it's actually gone, this unit cannot have entered
// scope, and therefore never needs to know about it.
} else if err != nil {
return err
} else {
ids = append(ids, rel.Id())
}
}
f.relationsChanged(ids)
// Send events on active out chans.
case f.outUpgrade <- f.upgrade:
filterLogger.Debugf("sent upgrade event")
f.outUpgrade = nil
case f.outResolved <- f.resolved:
filterLogger.Debugf("sent resolved event")
f.outResolved = nil
case f.outConfig <- nothing:
filterLogger.Debugf("sent config event")
f.outConfig = nil
case f.outRelations <- f.relations:
filterLogger.Debugf("sent relations event")
f.outRelations = nil
f.relations = nil
// Handle explicit requests.
case curl := <-f.setCharm:
filterLogger.Debugf("changing charm to %q", curl)
// We need to restart the config watcher after setting the
// charm, because service config settings are distinct for
// different service charms.
if configw != nil {
if err := configw.Stop(); err != nil {
return err
}
}
if err := f.unit.SetCharmURL(curl); err != nil {
filterLogger.Debugf("failed setting charm url %q: %v", curl, err)
return err
}
select {
case <-f.tomb.Dying():
return tomb.ErrDying
case f.didSetCharm <- nothing:
}
configw, err = f.unit.WatchConfigSettings()
if err != nil {
return err
}
configChanges = configw.Changes()
// Restart the relations watcher.
if err := relationsw.Stop(); err != nil {
return err
}
relationsw, err = f.service.WatchRelations()
if err != nil {
return err
}
f.upgradeFrom.url = curl
if err = f.upgradeChanged(); err != nil {
return err
}
case force := <-f.wantForcedUpgrade:
filterLogger.Debugf("want forced upgrade %v", force)
f.upgradeFrom.force = force
if err = f.upgradeChanged(); err != nil {
return err
}
case <-f.wantResolved:
filterLogger.Debugf("want resolved event")
if f.resolved != params.ResolvedNone {
f.outResolved = f.outResolvedOn
}
case <-f.clearResolved:
filterLogger.Debugf("resolved event handled")
f.outResolved = nil
if err := f.unit.ClearResolved(); err != nil {
return err
}
if err := f.unitChanged(); err != nil {
return err
}
select {
case <-f.tomb.Dying():
return tomb.ErrDying
case f.didClearResolved <- nothing:
}
case <-discardConfig:
filterLogger.Debugf("discarded config event")
f.outConfig = nil
}
}
}
