From 8abff83afc85ac8033efd767d70f6f2189281ccf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=B1=88=E8=BD=A9?= Date: Mon, 1 Apr 2019 17:40:05 +0800 Subject: [PATCH] =?UTF-8?q?=E5=90=8C=E6=AD=A5=E5=AE=89=E5=85=A8=E7=BB=84?= =?UTF-8?q?=E4=BB=A5=E5=85=AC=E6=9C=89=E4=BA=91=E4=B8=BA=E4=B8=BB?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- pkg/cloudprovider/resources.go | 2 +- pkg/compute/models/cloudsync.go | 45 ++++------------------------- pkg/compute/models/guest_actions.go | 5 ++-- pkg/compute/models/guests.go | 25 ++++++++++++---- pkg/compute/models/secgrouprules.go | 8 +++-- pkg/compute/models/secgroups.go | 1 + pkg/util/aliyun/instance.go | 4 +-- pkg/util/aws/instance.go | 4 +-- pkg/util/azure/classic_instance.go | 4 +-- pkg/util/azure/instance.go | 4 +-- pkg/util/esxi/virtualmachine.go | 4 +-- pkg/util/huawei/instance.go | 5 ++-- pkg/util/openstack/instance.go | 13 +++++---- pkg/util/qcloud/instance.go | 4 +-- pkg/util/ucloud/instance.go | 5 ++-- 15 files changed, 60 insertions(+), 73 deletions(-) diff --git a/pkg/cloudprovider/resources.go b/pkg/cloudprovider/resources.go index 8ff945f9e5..34cde69908 100644 --- a/pkg/cloudprovider/resources.go +++ b/pkg/cloudprovider/resources.go @@ -232,7 +232,7 @@ type ICloudVM interface { GetMachine() string GetInstanceType() string - GetSecurityGroupIds() []string + GetSecurityGroupIds() ([]string, error) AssignSecurityGroup(secgroupId string) error SetSecurityGroups(secgroupIds []string) error diff --git a/pkg/compute/models/cloudsync.go b/pkg/compute/models/cloudsync.go index d3e8ee587e..9f1f4df388 100644 --- a/pkg/compute/models/cloudsync.go +++ b/pkg/compute/models/cloudsync.go @@ -194,46 +194,8 @@ func syncVpcSecGroup(ctx context.Context, userCred mcclient.TokenCredential, syn _, _, result := SecurityGroupCacheManager.SyncSecurityGroupCaches(ctx, userCred, provider, secgroups, localVpc) syncResults.Add(SecurityGroupCacheManager, result) - - /* - msg := result.Result() - notes := fmt.Sprintf("SyncSecurityGroup for VPC %s result: %s", localVpc.Name, msg) - log.Infof(notes) - if result.IsError() { - return - } - for i := 0; i < len(localSecgroups); i++ { - func() { - lockman.LockObject(ctx, &localSecgroups[i]) - defer lockman.ReleaseObject(ctx, &localSecgroups[i]) - - syncSecurityGroupRules(ctx, userCred, syncResults, &localSecgroups[i], removeSecgroups[i]) - }() - } - */ } -/* -func syncSecurityGroupRules(ctx context.Context, userCred mcclient.TokenCredential, syncResults SSyncResultSet, localSecgroup *SSecurityGroup, remoteSecgroup cloudprovider.ICloudSecurityGroup) { - rules, err := remoteSecgroup.GetRules() - if err != nil { - msg := fmt.Sprintf("Get SecurityGroup Rules for secgroup %s failed %s", localSecgroup.Name, err) - log.Errorf(msg) - return - } - - //可以同步规则的安全组都是本地刚新建的,所以安全组规则只需要添加就可以了 - result := SecurityGroupRuleManager.SyncRules(ctx, userCred, localSecgroup, rules) - syncResults.Add(SecurityGroupRuleManager, result) - msg := result.Result() - notes := fmt.Sprintf("SyncSecurityGroupRule for Secgroup %s result: %s", localSecgroup.Name, msg) - log.Infof(notes) - if result.IsError() { - return - } -} -*/ - func syncVpcRouteTables(ctx context.Context, userCred mcclient.TokenCredential, syncResults SSyncResultSet, provider *SCloudprovider, localVpc *SVpc, remoteVpc cloudprovider.ICloudVpc, syncRange *SSyncRange) { routeTables, err := remoteVpc.GetIRouteTables() if err != nil { @@ -567,7 +529,12 @@ func syncVMEip(ctx context.Context, userCred mcclient.TokenCredential, provider } func syncVMSecgroups(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, localVM *SGuest, remoteVM cloudprovider.ICloudVM) { - secgroupIds := remoteVM.GetSecurityGroupIds() + secgroupIds, err := remoteVM.GetSecurityGroupIds() + if err != nil { + msg := fmt.Sprintf("GetSecurityGroupIds for VM %s failed %s", remoteVM.GetName(), err) + log.Errorf(msg) + return + } result := localVM.SyncVMSecgroups(ctx, userCred, provider, secgroupIds) msg := result.Result() log.Infof("SyncVMSecgroups for VM %s result: %s", localVM.Name, msg) diff --git a/pkg/compute/models/guest_actions.go b/pkg/compute/models/guest_actions.go index d158492342..ea8859cdf5 100644 --- a/pkg/compute/models/guest_actions.go +++ b/pkg/compute/models/guest_actions.go @@ -1957,9 +1957,8 @@ func (self *SGuest) RevokeAllSecgroups(ctx context.Context, userCred mcclient.To if err != nil { return err } - err = self.revokeSecgroup(ctx, userCred, self.getSecgroup()) - if err != nil { - return err + if secgroup := self.getSecgroup(); secgroup != nil { + return self.revokeSecgroup(ctx, userCred, secgroup) } return nil } diff --git a/pkg/compute/models/guests.go b/pkg/compute/models/guests.go index 37f9805077..033effd837 100644 --- a/pkg/compute/models/guests.go +++ b/pkg/compute/models/guests.go @@ -3865,13 +3865,15 @@ func (self *SGuest) SyncVMSecgroups(ctx context.Context, userCred mcclient.Token secgroupExternalIds := self.getSecgroupExternalIds(provider) + _secgroupIds := []string{} for _, secgroupId := range secgroupIds { + secgroup, err := self.getSecgroupByCache(provider, secgroupId) + if err != nil { + syncResult.AddError(err) + continue + } + _secgroupIds = append(_secgroupIds, secgroup.Id) if !utils.IsInStringArray(secgroupId, secgroupExternalIds) { - secgroup, err := self.getSecgroupByCache(provider, secgroupId) - if err != nil { - syncResult.AddError(err) - continue - } if len(self.SecgrpId) == 0 { _, err := db.Update(self, func() error { self.SecgrpId = secgroup.Id @@ -3890,6 +3892,19 @@ func (self *SGuest) SyncVMSecgroups(ctx context.Context, userCred mcclient.Token syncResult.Add() } } + + //移除公有云未关联的安全组 + secgroups := self.GetSecgroups() + for i := 0; i < len(secgroups); i++ { + if !utils.IsInStringArray(secgroups[i].Id, _secgroupIds) { + err := self.revokeSecgroup(ctx, userCred, &secgroups[i]) + if err != nil { + log.Errorf("revoke secgroup %s(%s) error: %v", secgroups[i].Name, secgroups[i].Id, err) + continue + } + syncResult.Delete() + } + } return syncResult } diff --git a/pkg/compute/models/secgrouprules.go b/pkg/compute/models/secgrouprules.go index ca31a5fde4..e8e04921b1 100644 --- a/pkg/compute/models/secgrouprules.go +++ b/pkg/compute/models/secgrouprules.go @@ -29,6 +29,7 @@ import ( "yunion.io/x/sqlchemy" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -349,7 +350,7 @@ func (manager *SSecurityGroupRuleManager) getRulesBySecurityGroup(secgroup *SSec func (manager *SSecurityGroupRuleManager) SyncRules(ctx context.Context, userCred mcclient.TokenCredential, secgroup *SSecurityGroup, rules []secrules.SecurityRule) compare.SyncResult { syncResult := compare.SyncResult{} for i := 0; i < len(rules); i++ { - _, err := manager.newFromCloudSecurityGroup(rules[i], secgroup) + _, err := manager.newFromCloudSecurityGroup(ctx, userCred, rules[i], secgroup) if err != nil { syncResult.AddError(err) continue @@ -359,7 +360,10 @@ func (manager *SSecurityGroupRuleManager) SyncRules(ctx context.Context, userCre return syncResult } -func (manager *SSecurityGroupRuleManager) newFromCloudSecurityGroup(rule secrules.SecurityRule, secgroup *SSecurityGroup) (*SSecurityGroupRule, error) { +func (manager *SSecurityGroupRuleManager) newFromCloudSecurityGroup(ctx context.Context, userCred mcclient.TokenCredential, rule secrules.SecurityRule, secgroup *SSecurityGroup) (*SSecurityGroupRule, error) { + lockman.LockClass(ctx, manager, manager.GetOwnerId(userCred)) + defer lockman.ReleaseClass(ctx, manager, manager.GetOwnerId(userCred)) + protocol := rule.Protocol if len(protocol) == 0 { protocol = secrules.PROTO_ANY diff --git a/pkg/compute/models/secgroups.go b/pkg/compute/models/secgroups.go index 411f6f0188..bd7355949c 100644 --- a/pkg/compute/models/secgroups.go +++ b/pkg/compute/models/secgroups.go @@ -428,6 +428,7 @@ func (manager *SSecurityGroupManager) newFromCloudSecgroup(ctx context.Context, srs.AddRule(rules[i]) } + // 查询所有的安全组，比对寻找一个与云上安全组规则相同的安全组 secgroups := []SSecurityGroup{} q := manager.Query() if err := db.FetchModelObjects(manager, q, &secgroups); err != nil { diff --git a/pkg/util/aliyun/instance.go b/pkg/util/aliyun/instance.go index 7f1f4f60fe..4687aa02e0 100644 --- a/pkg/util/aliyun/instance.go +++ b/pkg/util/aliyun/instance.go @@ -218,8 +218,8 @@ func (self *SRegion) fetchTags(resourceType string, resourceId string) (*jsonuti return tags, nil } -func (self *SInstance) GetSecurityGroupIds() []string { - return self.SecurityGroupIds.SecurityGroupId +func (self *SInstance) GetSecurityGroupIds() ([]string, error) { + return self.SecurityGroupIds.SecurityGroupId, nil } func (self *SInstance) GetMetadata() *jsonutils.JSONDict { diff --git a/pkg/util/aws/instance.go b/pkg/util/aws/instance.go index 69b1ec79dd..a3cf9a93eb 100644 --- a/pkg/util/aws/instance.go +++ b/pkg/util/aws/instance.go @@ -170,8 +170,8 @@ func (self *SInstance) GetInstanceType() string { return self.InstanceType } -func (self *SInstance) GetSecurityGroupIds() []string { - return self.SecurityGroupIds.SecurityGroupId +func (self *SInstance) GetSecurityGroupIds() ([]string, error) { + return self.SecurityGroupIds.SecurityGroupId, nil } func (self *SInstance) GetMetadata() *jsonutils.JSONDict { diff --git a/pkg/util/azure/classic_instance.go b/pkg/util/azure/classic_instance.go index e91947551c..d302732723 100644 --- a/pkg/util/azure/classic_instance.go +++ b/pkg/util/azure/classic_instance.go @@ -141,12 +141,12 @@ type SClassicInstance struct { Location string } -func (self *SClassicInstance) GetSecurityGroupIds() []string { +func (self *SClassicInstance) GetSecurityGroupIds() ([]string, error) { secgroupIds := []string{} if self.Properties.NetworkProfile.NetworkSecurityGroup != nil { secgroupIds = append(secgroupIds, self.Properties.NetworkProfile.NetworkSecurityGroup.ID) } - return secgroupIds + return secgroupIds, nil } func (self *SClassicInstance) GetMetadata() *jsonutils.JSONDict { diff --git a/pkg/util/azure/instance.go b/pkg/util/azure/instance.go index a40a459b78..4af2f9fa4b 100644 --- a/pkg/util/azure/instance.go +++ b/pkg/util/azure/instance.go @@ -207,7 +207,7 @@ func (self *SRegion) doDeleteVM(instanceId string) error { return self.client.Delete(instanceId) } -func (self *SInstance) GetSecurityGroupIds() []string { +func (self *SInstance) GetSecurityGroupIds() ([]string, error) { secgroupIds := []string{} if nics, err := self.getNics(); err == nil { for _, nic := range nics { @@ -218,7 +218,7 @@ func (self *SInstance) GetSecurityGroupIds() []string { } } } - return secgroupIds + return secgroupIds, nil } func (self *SInstance) GetMetadata() *jsonutils.JSONDict { diff --git a/pkg/util/esxi/virtualmachine.go b/pkg/util/esxi/virtualmachine.go index 4447f68a01..a0aafa5899 100644 --- a/pkg/util/esxi/virtualmachine.go +++ b/pkg/util/esxi/virtualmachine.go @@ -56,8 +56,8 @@ func NewVirtualMachine(manager *SESXiClient, vm *mo.VirtualMachine, dc *SDatacen return svm } -func (self *SVirtualMachine) GetSecurityGroupIds() []string { - return []string{} +func (self *SVirtualMachine) GetSecurityGroupIds() ([]string, error) { + return []string{}, cloudprovider.ErrNotSupported } func (self *SVirtualMachine) GetMetadata() *jsonutils.JSONDict { diff --git a/pkg/util/huawei/instance.go b/pkg/util/huawei/instance.go index 691ecb9a67..25d81e464b 100644 --- a/pkg/util/huawei/instance.go +++ b/pkg/util/huawei/instance.go @@ -236,9 +236,8 @@ func (self *SInstance) GetInstanceType() string { return self.Flavor.ID } -func (self *SInstance) GetSecurityGroupIds() []string { - secgroupIds, _ := self.host.zone.region.GetInstanceSecrityGroupIds(self.GetId()) - return secgroupIds +func (self *SInstance) GetSecurityGroupIds() ([]string, error) { + return self.host.zone.region.GetInstanceSecrityGroupIds(self.GetId()) } func (self *SInstance) GetMetadata() *jsonutils.JSONDict { diff --git a/pkg/util/openstack/instance.go b/pkg/util/openstack/instance.go index 899bf6afac..b8542dc45e 100644 --- a/pkg/util/openstack/instance.go +++ b/pkg/util/openstack/instance.go @@ -176,15 +176,16 @@ func (region *SRegion) GetInstance(instanceId string) (*SInstance, error) { return instance, resp.Unmarshal(instance, "server") } -func (instance *SInstance) GetSecurityGroupIds() []string { +func (instance *SInstance) GetSecurityGroupIds() ([]string, error) { secgroupIds := []string{} secgroups, err := instance.host.zone.region.GetSecurityGroupsByInstance(instance.ID) - if err == nil { - for _, secgroup := range secgroups { - secgroupIds = append(secgroupIds, secgroup.ID) - } + if err != nil { + return nil, err } - return secgroupIds + for _, secgroup := range secgroups { + secgroupIds = append(secgroupIds, secgroup.ID) + } + return secgroupIds, nil } func (instance *SInstance) GetMetadata() *jsonutils.JSONDict { diff --git a/pkg/util/qcloud/instance.go b/pkg/util/qcloud/instance.go index 00d756730e..fc7c91143e 100644 --- a/pkg/util/qcloud/instance.go +++ b/pkg/util/qcloud/instance.go @@ -152,8 +152,8 @@ func (self *SRegion) GetInstances(zoneId string, ids []string, offset int, limit return instances, int(total), nil } -func (self *SInstance) GetSecurityGroupIds() []string { - return self.SecurityGroupIds +func (self *SInstance) GetSecurityGroupIds() ([]string, error) { + return self.SecurityGroupIds, nil } func (self *SInstance) GetMetadata() *jsonutils.JSONDict { diff --git a/pkg/util/ucloud/instance.go b/pkg/util/ucloud/instance.go index 581cb73f5a..1eb13dbf72 100644 --- a/pkg/util/ucloud/instance.go +++ b/pkg/util/ucloud/instance.go @@ -64,10 +64,11 @@ type SInstance struct { BootDiskState string `json:"BootDiskState"` } -func (self *SInstance) GetSecurityGroupIds() []string { +func (self *SInstance) GetSecurityGroupIds() ([]string, error) { secgroups, err := self.GetSecurityGroups() if err != nil { log.Errorf(err.Error()) + return nil, err } secgroupIds := make([]string, 0) @@ -75,7 +76,7 @@ func (self *SInstance) GetSecurityGroupIds() []string { secgroupIds = append(secgroupIds, secgroup.GetId()) } - return secgroupIds + return secgroupIds, nil } func (self *SInstance) GetProjectId() string {