-
Notifications
You must be signed in to change notification settings - Fork 1.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Move autoupdate code in proxy to make more sense #49484
Merged
Merged
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,111 @@ | ||
| /* | ||
| * Teleport | ||
| * Copyright (C) 2024 Gravitational, Inc. | ||
| * | ||
| * This program is free software: you can redistribute it and/or modify | ||
| * it under the terms of the GNU Affero General Public License as published by | ||
| * the Free Software Foundation, either version 3 of the License, or | ||
| * (at your option) any later version. | ||
| * | ||
| * This program is distributed in the hope that it will be useful, | ||
| * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| * GNU Affero General Public License for more details. | ||
| * | ||
| * You should have received a copy of the GNU Affero General Public License | ||
| * along with this program. If not, see <http://www.gnu.org/licenses/>. | ||
| */ | ||
|
|
||
| package web | ||
|
|
||
| import ( | ||
| "context" | ||
|
|
||
| "github.com/gravitational/trace" | ||
|
|
||
| "github.com/gravitational/teleport/api" | ||
| "github.com/gravitational/teleport/api/client/webclient" | ||
| autoupdatepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/autoupdate/v1" | ||
| "github.com/gravitational/teleport/api/types/autoupdate" | ||
| ) | ||
|
|
||
| // automaticUpdateSettings184 crafts the automatic updates part of the ping/find response | ||
| // as described in RFD-184 (agents) and RFD-144 (tools). | ||
| // TODO: add the request as a parameter when we'll need to modulate the content based on the UUID and group | ||
| func (h *Handler) automaticUpdateSettings184(ctx context.Context) webclient.AutoUpdateSettings { | ||
| autoUpdateConfig, err := h.cfg.AccessPoint.GetAutoUpdateConfig(ctx) | ||
| // TODO(vapopov) DELETE IN v18.0.0 check of IsNotImplemented, must be backported to all latest supported versions. | ||
| if err != nil && !trace.IsNotFound(err) && !trace.IsNotImplemented(err) { | ||
| h.logger.ErrorContext(ctx, "failed to receive AutoUpdateConfig", "error", err) | ||
| } | ||
|
|
||
| autoUpdateVersion, err := h.cfg.AccessPoint.GetAutoUpdateVersion(ctx) | ||
| // TODO(vapopov) DELETE IN v18.0.0 check of IsNotImplemented, must be backported to all latest supported versions. | ||
| if err != nil && !trace.IsNotFound(err) && !trace.IsNotImplemented(err) { | ||
| h.logger.ErrorContext(ctx, "failed to receive AutoUpdateVersion", "error", err) | ||
| } | ||
|
|
||
| return webclient.AutoUpdateSettings{ | ||
| ToolsAutoUpdate: getToolsAutoUpdate(autoUpdateConfig), | ||
| ToolsVersion: getToolsVersion(autoUpdateVersion), | ||
| AgentUpdateJitterSeconds: DefaultAgentUpdateJitterSeconds, | ||
| AgentVersion: getAgentVersion184(autoUpdateVersion), | ||
| AgentAutoUpdate: agentShouldUpdate184(autoUpdateConfig, autoUpdateVersion), | ||
| } | ||
| } | ||
|
|
||
| func getToolsAutoUpdate(config *autoupdatepb.AutoUpdateConfig) bool { | ||
| // If we can't get the AU config or if AUs are not configured, we default to "disabled". | ||
| // This ensures we fail open and don't accidentally update agents if something is going wrong. | ||
| // If we want to enable AUs by default, it would be better to create a default "autoupdate_config" resource | ||
| // than changing this logic. | ||
| if config.GetSpec().GetTools() != nil { | ||
| return config.GetSpec().GetTools().GetMode() == autoupdate.ToolsUpdateModeEnabled | ||
| } | ||
| return false | ||
| } | ||
|
|
||
| func getToolsVersion(version *autoupdatepb.AutoUpdateVersion) string { | ||
| // If we can't get the AU version or tools AU version is not specified, we default to the current proxy version. | ||
| // This ensures we always advertise a version compatible with the cluster. | ||
| if version.GetSpec().GetTools() == nil { | ||
| return api.Version | ||
| } | ||
| return version.GetSpec().GetTools().GetTargetVersion() | ||
| } | ||
|
|
||
| func getAgentVersion184(version *autoupdatepb.AutoUpdateVersion) string { | ||
| // If we can't get the AU version or tools AU version is not specified, we default to the current proxy version. | ||
| // This ensures we always advertise a version compatible with the cluster. | ||
| // TODO: read the version from the autoupdate_agent_rollout when the resource is implemented | ||
| if version.GetSpec().GetAgents() == nil { | ||
| return api.Version | ||
| } | ||
|
|
||
| return version.GetSpec().GetAgents().GetTargetVersion() | ||
| } | ||
|
|
||
| func agentShouldUpdate184(config *autoupdatepb.AutoUpdateConfig, version *autoupdatepb.AutoUpdateVersion) bool { | ||
| // TODO: read the data from the autoupdate_agent_rollout when the resource is implemented | ||
|
|
||
| // If we can't get the AU config or if AUs are not configured, we default to "disabled". | ||
| // This ensures we fail open and don't accidentally update agents if something is going wrong. | ||
| // If we want to enable AUs by default, it would be better to create a default "autoupdate_config" resource | ||
| // than changing this logic. | ||
| if config.GetSpec().GetAgents() == nil { | ||
| return false | ||
| } | ||
| if version.GetSpec().GetAgents() == nil { | ||
| return false | ||
| } | ||
| configMode := config.GetSpec().GetAgents().GetMode() | ||
| versionMode := version.GetSpec().GetAgents().GetMode() | ||
|
|
||
| // We update only if both version and config agent modes are "enabled" | ||
| if configMode != autoupdate.AgentsUpdateModeEnabled || versionMode != autoupdate.AgentsUpdateModeEnabled { | ||
| return false | ||
| } | ||
|
|
||
| scheduleName := version.GetSpec().GetAgents().GetSchedule() | ||
| return scheduleName == autoupdate.AgentsScheduleImmediate | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we refer to this a legacy automatic upgrades instead of referencing the RFD in code?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't really like calling them legacy because some parts of the RFD109 will still be used as a fallback for RFD184, and the RFD109 APIs will soon be able to tell to update based on RFD184 configuration.
So you can have legacy updaters using legacy APIs to update according to the new schedule, and new updaters using the new API to update according to the legacy schedule.
As both systems will share a common update logic I don't see channels as legacy, just as a different API service the same content.
The interoperability logic will be introduced in #49380
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I also asked the question here: https://gravitational.slack.com/archives/C04P78M46F2/p1732304167957549