From 1474cbb0aec7a0636d4d53ad09eba501d9c75458 Mon Sep 17 00:00:00 2001 From: Tommy Carpenter Date: Mon, 24 Jun 2019 15:52:59 +0000 Subject: Add CBS https/tls support Issue-ID: DCAEGEN2-1551 Change-Id: I657d13ec87e051bd4836bd4c42385a580eaebe01 Signed-off-by: Tommy Carpenter --- onap-dcae-cbs-docker-client/.gitignore | 1 + onap-dcae-cbs-docker-client/Changelog.md | 3 ++ onap-dcae-cbs-docker-client/README.md | 9 ++-- onap-dcae-cbs-docker-client/example/README.md | 21 +++++++++ onap-dcae-cbs-docker-client/example/testclient.py | 5 +++ .../onap_dcae_cbs_docker_client/client.py | 11 +++-- onap-dcae-cbs-docker-client/pom.xml | 4 +- onap-dcae-cbs-docker-client/setup.py | 5 +-- onap-dcae-cbs-docker-client/tests/conftest.py | 50 +++++++++++++++------- onap-dcae-cbs-docker-client/tests/test_client.py | 22 ++++++++-- onap-dcae-cbs-docker-client/tox.ini | 4 +- 11 files changed, 100 insertions(+), 35 deletions(-) create mode 100644 onap-dcae-cbs-docker-client/example/README.md create mode 100644 onap-dcae-cbs-docker-client/example/testclient.py (limited to 'onap-dcae-cbs-docker-client') diff --git a/onap-dcae-cbs-docker-client/.gitignore b/onap-dcae-cbs-docker-client/.gitignore index 4f07413..6181519 100644 --- a/onap-dcae-cbs-docker-client/.gitignore +++ b/onap-dcae-cbs-docker-client/.gitignore @@ -1,3 +1,4 @@ +tox-local.ini .pytest_cache/ xunit-results.xml .DS_Store diff --git a/onap-dcae-cbs-docker-client/Changelog.md b/onap-dcae-cbs-docker-client/Changelog.md index d108e85..fa4764d 100644 --- a/onap-dcae-cbs-docker-client/Changelog.md +++ b/onap-dcae-cbs-docker-client/Changelog.md @@ -4,6 +4,9 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/). +## [2.1.0] - 6/24/2019 +* Add support for connecting to the CBS if it is running as HTTPS instead of HTTP + ## [2.0.0] - 6/19/2019 * The env variable CONFIG_BINDING_SERVICE now has a different meaning per DCAEGEN2-1537. Specifically this variable now holds a resolvable hostname for the CBS, rather than a consul lookup key * Since the API was broken anyway, the decision not to throw an exception was revisted and overturned. This was causing problems for some users, who were getting `{}` back in their configuration, but without knowing why; either the config wasn't set up, the config was set but as `{}`, or the CBS being unreachable altogether. This client library now throws native python exceptions, rather than logging and returning `{}`. The application client code can handle the exceptions, and retry if they choose. diff --git a/onap-dcae-cbs-docker-client/README.md b/onap-dcae-cbs-docker-client/README.md index 5c5c986..d38c515 100644 --- a/onap-dcae-cbs-docker-client/README.md +++ b/onap-dcae-cbs-docker-client/README.md @@ -4,16 +4,14 @@ Used for DCAE Dockerized microservices written in Python. Pulls your configurati # Client Usage -The environment that this client runs in, whether it be in Docker or "natievely", needs to have the following env variables: +The environment that this client runs in, whether it be in Docker or "natively", needs to have the following env variables: 1. `HOSTNAME` is the name of your component in Consul 2. `CONFIG_BINDING_SERVICE` a resolvable hostname to the CBS +3. If the CBS is running as HTTPS: `DCAE_CA_CERTPATH`: a path to a cacert file to verify the running CBS ## Usage in your code - >>> from onap_dcae_cbs_docker_client import client - >>> client.get_config() - >>> client.get_all() - +See the `example` folder for a simple test client. If the CBS is reachable, but your configuration key is not there, you will get a CantGetConfig exception: @@ -25,7 +23,6 @@ If the CBS is unreachable, you will get an exception: onap_dcae_cbs_docker_client.exceptions.CBSUnreachable - # Installation ## Via pip diff --git a/onap-dcae-cbs-docker-client/example/README.md b/onap-dcae-cbs-docker-client/example/README.md new file mode 100644 index 0000000..64f1b71 --- /dev/null +++ b/onap-dcae-cbs-docker-client/example/README.md @@ -0,0 +1,21 @@ +# Example +Shows example usage + +(`set -x` is fish's notation for bash's `export`) + +## No https +Example: + + set -x HOSTNAME <>; set -x CONFIG_BINDING_SERVICE <>; python testclient.py + +## Https +The value of the environment variable `DCAE_CA_CERTPATH` must be a path to a cacert file to verify the running CBS. +The following excerpt is from the curl manpage: + + --cacert + (TLS) Tells curl to use the specified certificate file to verify the peer. + The file may contain multiple CA certificates. + +Example: + + set -x HOSTNAME <>; set -x CONFIG_BINDING_SERVICE <>; set -x DCAE_CA_CERTPATH /opt/onapcacert.pem; python testclient.py diff --git a/onap-dcae-cbs-docker-client/example/testclient.py b/onap-dcae-cbs-docker-client/example/testclient.py new file mode 100644 index 0000000..91eb7a2 --- /dev/null +++ b/onap-dcae-cbs-docker-client/example/testclient.py @@ -0,0 +1,5 @@ +from onap_dcae_cbs_docker_client import client + +client.get_config() + +client.get_all() diff --git a/onap-dcae-cbs-docker-client/onap_dcae_cbs_docker_client/client.py b/onap-dcae-cbs-docker-client/onap_dcae_cbs_docker_client/client.py index ef0dfbc..c1193d9 100644 --- a/onap-dcae-cbs-docker-client/onap_dcae_cbs_docker_client/client.py +++ b/onap-dcae-cbs-docker-client/onap_dcae_cbs_docker_client/client.py @@ -36,17 +36,20 @@ def _get_path(path): hostname = os.environ["HOSTNAME"] # this is the name of the component itself # in most cases, this is the K8s service name which is a resolvable DNS name # if running outside k8s, this name needs to be resolvable by DNS via other means. - cbs_resolvable_hostname = os.environ["CONFIG_BINDING_SERVICE"] + cbs_name = os.environ["CONFIG_BINDING_SERVICE"] except KeyError as e: raise ENVsMissing("Required ENV Variable {0} missing".format(e)) - # TODO: https - cbs_url = "http://{0}:10000".format(cbs_resolvable_hostname) + # See if we are using https + https_cacert = os.environ.get("DCAE_CA_CERTPATH", None) + + # Get the CBS URL. + cbs_url = "https://{0}:10443".format(cbs_name) if https_cacert else "http://{0}:10000".format(cbs_name) # get my config try: my_config_endpoint = "{0}/{1}/{2}".format(cbs_url, path, hostname) - res = requests.get(my_config_endpoint) + res = requests.get(my_config_endpoint, verify=https_cacert) if https_cacert else requests.get(my_config_endpoint) res.raise_for_status() config = res.json() logger.debug( diff --git a/onap-dcae-cbs-docker-client/pom.xml b/onap-dcae-cbs-docker-client/pom.xml index f76b872..34cf2db 100644 --- a/onap-dcae-cbs-docker-client/pom.xml +++ b/onap-dcae-cbs-docker-client/pom.xml @@ -1,7 +1,7 @@