ajoute la liaison Laravel-OpenStack et le modèle Heat du lab 08
Un gabarit Heat généré depuis chaque lab.yaml, une stack par session de lab (création à l'admission, suppression à l'expiration via des jobs Redis et un worker systemd dédié). Passage du compte de service à une authentification par mot de passe : Heat refuse de créer un trust à partir d'un jeton d'application credential (voir ADR 0002). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Adam Belkacemi
parent
8742bde807
commit
67a754f733
34 changed files with 1095 additions and 91 deletions
107
portail/app/Services/OpenStack/GenerateurTemplateHeat.php
Normal file
107
portail/app/Services/OpenStack/GenerateurTemplateHeat.php
Normal file
|
|
@ -0,0 +1,107 @@
|
|||
<?php
|
||||
|
||||
namespace App\Services\OpenStack;
|
||||
|
||||
use App\Services\Labs\DefinitionLab;
|
||||
|
||||
/**
|
||||
* Traduit un lab.yaml en modèle Heat (étape 10) : un réseau Neutron par
|
||||
* réseau du lab, sans DHCP et sans sécurité de port (les élèves configurent
|
||||
* eux-mêmes leurs adresses), et une VM par machine, avec une interface par
|
||||
* réseau déclaré, dans l'ordre (= ordre des interfaces ens3, ens4…).
|
||||
*
|
||||
* Jamais de routeur vers l'extérieur : les réseaux de lab sont isolés,
|
||||
* conformément à CLAUDE.md (anti-abus, pas d'accès Internet depuis les VM
|
||||
* élèves).
|
||||
*/
|
||||
class GenerateurTemplateHeat
|
||||
{
|
||||
/**
|
||||
* @return array{template: array, noms_machines: array<int, string>}
|
||||
*/
|
||||
public function genererDepuis(DefinitionLab $lab, string $prefixe): array
|
||||
{
|
||||
$resources = [];
|
||||
$outputs = [];
|
||||
|
||||
foreach ($lab->reseaux as $reseau) {
|
||||
$cleReseau = self::cle($reseau['nom']);
|
||||
|
||||
$resources["reseau_{$cleReseau}"] = [
|
||||
'type' => 'OS::Neutron::Net',
|
||||
'properties' => [
|
||||
'name' => "{$prefixe}-{$reseau['nom']}",
|
||||
'port_security_enabled' => false,
|
||||
],
|
||||
];
|
||||
|
||||
$resources["sousreseau_{$cleReseau}"] = [
|
||||
'type' => 'OS::Neutron::Subnet',
|
||||
'properties' => [
|
||||
'network' => ['get_resource' => "reseau_{$cleReseau}"],
|
||||
'cidr' => $reseau['cidr'],
|
||||
'enable_dhcp' => false,
|
||||
],
|
||||
];
|
||||
}
|
||||
|
||||
$nomsMachines = [];
|
||||
|
||||
foreach ($lab->machines as $machine) {
|
||||
$cleMachine = self::cle($machine['nom']);
|
||||
$nomsMachines[] = $machine['nom'];
|
||||
$ports = [];
|
||||
|
||||
foreach ($machine['reseaux'] as $nomReseau) {
|
||||
$cleReseau = self::cle($nomReseau);
|
||||
$clePort = "port_{$cleMachine}_{$cleReseau}";
|
||||
|
||||
$resources[$clePort] = [
|
||||
'type' => 'OS::Neutron::Port',
|
||||
'properties' => [
|
||||
'network' => ['get_resource' => "reseau_{$cleReseau}"],
|
||||
'port_security_enabled' => false,
|
||||
'fixed_ips' => [],
|
||||
],
|
||||
];
|
||||
|
||||
$ports[] = ['port' => ['get_resource' => $clePort]];
|
||||
}
|
||||
|
||||
$resources["machine_{$cleMachine}"] = [
|
||||
'type' => 'OS::Nova::Server',
|
||||
'properties' => [
|
||||
'name' => "{$prefixe}-{$machine['nom']}",
|
||||
'image' => $machine['image'],
|
||||
'flavor' => $machine['flavor'],
|
||||
'networks' => $ports,
|
||||
],
|
||||
];
|
||||
|
||||
$outputs["{$cleMachine}_id"] = [
|
||||
'description' => "Id de l'instance {$machine['nom']}",
|
||||
'value' => ['get_resource' => "machine_{$cleMachine}"],
|
||||
];
|
||||
}
|
||||
|
||||
$template = [
|
||||
'heat_template_version' => '2021-04-16',
|
||||
'description' => "Lab {$lab->identifiant} ({$prefixe})",
|
||||
'resources' => $resources,
|
||||
'outputs' => $outputs,
|
||||
];
|
||||
|
||||
return ['template' => $template, 'noms_machines' => $nomsMachines];
|
||||
}
|
||||
|
||||
/**
|
||||
* Les noms de ressources Heat ne peuvent pas contenir les caractères du
|
||||
* nom du lab (ex: "pc-a" → "pc_a"). Utilisé aussi par CreerStackLab pour
|
||||
* retrouver, dans les sorties de la stack, quelle clé correspond à
|
||||
* quelle machine.
|
||||
*/
|
||||
public static function cle(string $nom): string
|
||||
{
|
||||
return str_replace('-', '_', $nom);
|
||||
}
|
||||
}
|
||||
77
portail/app/Services/OpenStack/HeatClient.php
Normal file
77
portail/app/Services/OpenStack/HeatClient.php
Normal file
|
|
@ -0,0 +1,77 @@
|
|||
<?php
|
||||
|
||||
namespace App\Services\OpenStack;
|
||||
|
||||
use Illuminate\Support\Facades\Http;
|
||||
use RuntimeException;
|
||||
|
||||
/**
|
||||
* Juste ce qu'il faut pour créer, suivre et supprimer une stack Heat
|
||||
* (étape 10) — pas de client générique, le besoin réel de Syllabus est
|
||||
* étroit (un lab = une stack, pour la durée d'une session).
|
||||
*/
|
||||
class HeatClient
|
||||
{
|
||||
public function __construct(private readonly KeystoneAuth $auth) {}
|
||||
|
||||
/**
|
||||
* @return array{id: string}
|
||||
*/
|
||||
public function creerStack(string $nom, array $template): array
|
||||
{
|
||||
$reponse = $this->requete()->post($this->url('/stacks'), [
|
||||
'stack_name' => $nom,
|
||||
'disable_rollback' => true,
|
||||
'template' => $template,
|
||||
]);
|
||||
|
||||
if ($reponse->failed()) {
|
||||
throw new RuntimeException("Heat a refusé la création de la stack {$nom} : ".$reponse->body());
|
||||
}
|
||||
|
||||
return ['id' => $reponse->json('stack.id')];
|
||||
}
|
||||
|
||||
/**
|
||||
* @return array{statut: string, raison: ?string, sorties: array<string, mixed>}
|
||||
*/
|
||||
public function etatStack(string $nom, string $id): array
|
||||
{
|
||||
$reponse = $this->requete()->get($this->url("/stacks/{$nom}/{$id}"));
|
||||
|
||||
if ($reponse->failed()) {
|
||||
throw new RuntimeException("Impossible de lire l'état de la stack {$nom} : ".$reponse->body());
|
||||
}
|
||||
|
||||
$sorties = [];
|
||||
foreach ($reponse->json('stack.outputs') ?? [] as $sortie) {
|
||||
$sorties[$sortie['output_key']] = $sortie['output_value'];
|
||||
}
|
||||
|
||||
return [
|
||||
'statut' => $reponse->json('stack.stack_status'),
|
||||
'raison' => $reponse->json('stack.stack_status_reason'),
|
||||
'sorties' => $sorties,
|
||||
];
|
||||
}
|
||||
|
||||
public function supprimerStack(string $nom, string $id): void
|
||||
{
|
||||
$reponse = $this->requete()->delete($this->url("/stacks/{$nom}/{$id}"));
|
||||
|
||||
// 404 : déjà supprimée (idempotent, pas une erreur pour nous).
|
||||
if ($reponse->failed() && $reponse->status() !== 404) {
|
||||
throw new RuntimeException("Heat a refusé la suppression de la stack {$nom} : ".$reponse->body());
|
||||
}
|
||||
}
|
||||
|
||||
private function requete()
|
||||
{
|
||||
return Http::withHeaders(['X-Auth-Token' => $this->auth->jeton()]);
|
||||
}
|
||||
|
||||
private function url(string $chemin): string
|
||||
{
|
||||
return config('openstack.heat_url').'/'.$this->auth->projetId().$chemin;
|
||||
}
|
||||
}
|
||||
66
portail/app/Services/OpenStack/KeystoneAuth.php
Normal file
66
portail/app/Services/OpenStack/KeystoneAuth.php
Normal file
|
|
@ -0,0 +1,66 @@
|
|||
<?php
|
||||
|
||||
namespace App\Services\OpenStack;
|
||||
|
||||
use Illuminate\Support\Facades\Cache;
|
||||
use Illuminate\Support\Facades\Http;
|
||||
use RuntimeException;
|
||||
|
||||
/**
|
||||
* Authentification OpenStack partagée par NovaClient (étape 9) et HeatClient
|
||||
* (étape 10), pour le compte de service `paillasse-service` (étape 6).
|
||||
*
|
||||
* Par mot de passe, pas par application credential : voir config/openstack.php
|
||||
* pour pourquoi (Heat a besoin de créer un trust Keystone, ce qu'une
|
||||
* application credential ne peut jamais faire).
|
||||
*/
|
||||
class KeystoneAuth
|
||||
{
|
||||
public function jeton(): string
|
||||
{
|
||||
return $this->authentifier()['jeton'];
|
||||
}
|
||||
|
||||
public function projetId(): string
|
||||
{
|
||||
return $this->authentifier()['projet_id'];
|
||||
}
|
||||
|
||||
/**
|
||||
* @return array{jeton: string, projet_id: string}
|
||||
*/
|
||||
private function authentifier(): array
|
||||
{
|
||||
return Cache::remember('openstack.authentification', now()->addMinutes(50), function () {
|
||||
$reponse = Http::post(config('openstack.auth_url').'/v3/auth/tokens', [
|
||||
'auth' => [
|
||||
'identity' => [
|
||||
'methods' => ['password'],
|
||||
'password' => [
|
||||
'user' => [
|
||||
'name' => config('openstack.username'),
|
||||
'domain' => ['id' => 'default'],
|
||||
'password' => config('openstack.password'),
|
||||
],
|
||||
],
|
||||
],
|
||||
'scope' => [
|
||||
'project' => [
|
||||
'name' => config('openstack.project_name'),
|
||||
'domain' => ['id' => 'default'],
|
||||
],
|
||||
],
|
||||
],
|
||||
]);
|
||||
|
||||
if ($reponse->failed()) {
|
||||
throw new RuntimeException('Authentification OpenStack refusée : '.$reponse->body());
|
||||
}
|
||||
|
||||
return [
|
||||
'jeton' => $reponse->header('X-Subject-Token'),
|
||||
'projet_id' => $reponse->json('token.project.id'),
|
||||
];
|
||||
});
|
||||
}
|
||||
}
|
||||
|
|
@ -2,21 +2,22 @@
|
|||
|
||||
namespace App\Services\OpenStack;
|
||||
|
||||
use Illuminate\Support\Facades\Cache;
|
||||
use Illuminate\Support\Facades\Http;
|
||||
use RuntimeException;
|
||||
|
||||
/**
|
||||
* Juste ce qu'il faut pour demander à Nova l'adresse de la console série
|
||||
* d'une VM (étape 9). La liaison Laravel ↔ OpenStack complète (Heat, labs)
|
||||
* est l'étape 10 : on ne construit pas de client générique ici.
|
||||
* est l'étape 10 : voir HeatClient.
|
||||
*/
|
||||
class NovaClient
|
||||
{
|
||||
public function __construct(private readonly KeystoneAuth $auth) {}
|
||||
|
||||
public function consoleSerielle(string $instanceId): string
|
||||
{
|
||||
$reponse = Http::withHeaders([
|
||||
'X-Auth-Token' => $this->jetonKeystone(),
|
||||
'X-Auth-Token' => $this->auth->jeton(),
|
||||
'OpenStack-API-Version' => 'compute 2.99',
|
||||
])
|
||||
->post(config('openstack.nova_url')."/servers/{$instanceId}/remote-consoles", [
|
||||
|
|
@ -29,31 +30,4 @@ class NovaClient
|
|||
|
||||
return $reponse->json('remote_console.url');
|
||||
}
|
||||
|
||||
/**
|
||||
* Jeton Keystone mis en cache (un jeton v3 dure 1h côté Keystone, on le
|
||||
* garde un peu moins longtemps par prudence).
|
||||
*/
|
||||
private function jetonKeystone(): string
|
||||
{
|
||||
return Cache::remember('openstack.jeton_keystone', now()->addMinutes(50), function () {
|
||||
$reponse = Http::post(config('openstack.auth_url').'/v3/auth/tokens', [
|
||||
'auth' => [
|
||||
'identity' => [
|
||||
'methods' => ['application_credential'],
|
||||
'application_credential' => [
|
||||
'id' => config('openstack.application_credential_id'),
|
||||
'secret' => config('openstack.application_credential_secret'),
|
||||
],
|
||||
],
|
||||
],
|
||||
]);
|
||||
|
||||
if ($reponse->failed()) {
|
||||
throw new RuntimeException('Authentification OpenStack refusée : '.$reponse->body());
|
||||
}
|
||||
|
||||
return $reponse->header('X-Subject-Token');
|
||||
});
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue