Improve the behavior of claiming (#8516)
The default cloud url has been updated to app.netdata.cloud ready for the release. The claiming process now checks the current user executing claiming and refuses to perform the claim for the wrong user. If the current UID is 0 then claiming proceeds but the file ownership is adjusted to be the correct netdata user. The default expected user is `netdata` unless the script can identify the user from the current configuration. After the claiming script is executed the CLI is used to reload the claiming state.
Andrew Moss committed
Mar 31, 2020 at 13:07 UTC
fe722cb2a48c074eb7e2739c5052a28d4aa97d56
11 files changed
+47
-13
aclk/agent_cloud_link.c
+1
-1
@@ -1321,7 +1321,7 @@ void *aclk_main(void *ptr)
1321
char *aclk_hostname = NULL; // Initializers are over-written but prevent gcc complaining about clobbering.
1322
char *aclk_port = NULL;
1323
uint32_t port_num = 0;
1324
- char *cloud_base_url = config_get(CONFIG_SECTION_CLOUD, "cloud base url", "https://netdata.cloud");
1324
+ char *cloud_base_url = config_get(CONFIG_SECTION_CLOUD, "cloud base url", DEFAULT_CLOUD_BASE_URL);
1325
if (aclk_decode_base_url(cloud_base_url, &aclk_hostname, &aclk_port)) {
1326
error("Configuration error - cannot use agent cloud link");
1327
return NULL;
claim/README.md
+1
-1
@@ -26,7 +26,7 @@ following arguments:
26
-rooms=ROOM1,ROOM2,...
27
where ROOMX is the workspace war-room to join. This list is optional.
28
-url=URL_BASE
29
- where URL_BASE is the Netdata Cloud endpoint base URL. By default, this is https://netdata.cloud.
29
+ where URL_BASE is the Netdata Cloud endpoint base URL. By default, this is https://app.netdata.cloud.
30
-id=AGENT_ID
31
where AGENT_ID is the unique identifier of the agent. This is the agent's MACHINE_GUID by default.
32
-hostname=HOSTNAME
claim/claim.c
+2
-2
@@ -53,7 +53,7 @@ void claim_agent(char *claiming_arguments)
53
54
char *cloud_base_hostname = NULL; // Initializers are over-written but prevent gcc complaining about clobbering.
55
char *cloud_base_port = NULL;
56
- char *cloud_base_url = config_get(CONFIG_SECTION_CLOUD, "cloud base url", "https://netdata.cloud");
56
+ char *cloud_base_url = config_get(CONFIG_SECTION_CLOUD, "cloud base url", DEFAULT_CLOUD_BASE_URL);
57
if( aclk_decode_base_url(cloud_base_url, &cloud_base_hostname, &cloud_base_port))
58
{
59
error("Configuration error - cannot decode \"cloud base url\"");
@@ -71,7 +71,7 @@ void claim_agent(char *claiming_arguments)
71
72
snprintfz(command_buffer,
73
CLAIMING_COMMAND_LENGTH,
74
- "exec netdata-claim.sh %s -hostname=%s -id=%s -url=%s %s",
74
+ "exec netdata-claim.sh %s -hostname=%s -id=%s -url=%s -noreload %s",
75
76
proxy_flag,
77
netdata_configured_hostname,
claim/netdata-claim.sh.in
+31
-5
@@ -10,6 +10,8 @@
10
# Exit code: 3 - Missing dependencies
11
# Exit code: 4 - Failure to connect to endpoint
12
# Exit code: 5 - Unknown HTTP error message
13
+# Exit code: 6 - The CLI didn't work
14
+# Exit code: 7 - Wrong user
15
#
16
# OK: Agent claimed successfully
17
# HTTP Status code: 204
@@ -96,13 +98,22 @@ fi
98
MACHINE_GUID_FILE="@registrydir_POST@/netdata.public.unique.id"
99
CLAIMING_DIR="${NETDATA_USER_CONFIG_DIR}/claim.d"
100
TOKEN="unknown"
99
-URL_BASE="https://netdata.cloud"
101
+URL_BASE="https://app.netdata.cloud"
102
ID="unknown"
103
ROOMS=""
104
HOSTNAME=$(hostname)
105
CLOUD_CERTIFICATE_FILE="${CLAIMING_DIR}/cloud_fullchain.pem"
106
VERBOSE=0
107
INSECURE=0
108
+RELOAD=1
109
+NETDATA_USER=netdata
110
+[ -z "$EUID" ] && EUID="$(id -u)"
111
+
112
+CONF_USER=$(grep '^[^#]*run as user[ \t]*=' "${NETDATA_USER_CONFIG_DIR}/netdata.conf" 2>/dev/null)
113
+if [ -n "$CONF_USER" ]; then
114
+ NETDATA_USER=$(echo "$CONF_USER" | sed 's/^[^=]*=[ \t]*//' | sed 's/[ \t]*$//')
115
+fi
116
+
117
118
# get the MACHINE_GUID by default
119
if [ -r "${MACHINE_GUID_FILE}" ]; then
@@ -131,12 +142,19 @@ do
142
-insecure) INSECURE=1 ;;
143
-proxy=*) PROXY=${arg:7} ;;
144
-noproxy) NOPROXY=yes ;;
145
+ -noreload) RELOAD=0 ;;
146
+ -user=*) NETDATA_USER=${arg:6} ;;
147
*) echo >&2 "Unknown argument ${arg}"
148
exit 1 ;;
149
esac
150
shift 1
151
done
152
153
+if [ "$EUID" != "0" ] && [ "$(whoami)" != "$NETDATA_USER" ]; then
154
+ echo >&2 "This script must be run by the $NETDATA_USER user account"
155
+ exit 7
156
+fi
157
+
158
# if curl not installed give warning SOCKS can't be used
159
if [[ "${URLTOOL}" != "curl" && "${PROXY:0:5}" = socks ]] ; then
160
echo >&2 "wget doesn't support SOCKS. Please install curl or disable SOCKS proxy."
@@ -149,6 +167,7 @@ echo >&2 "Id: $ID"
167
echo >&2 "Rooms: $ROOMS"
168
echo >&2 "Hostname: $HOSTNAME"
169
echo >&2 "Proxy: $PROXY"
170
+echo >&2 "Netdata user: $NETDATA_USER"
171
172
# create the claiming directory for this user
173
if [ ! -d "${CLAIMING_DIR}" ] ; then
@@ -264,10 +283,17 @@ HTTP_STATUS_CODE=$(grep "HTTP" "${CLAIMING_DIR}/tmpout.txt" | awk -F " " '{print
283
284
if [ "${HTTP_STATUS_CODE}" = "204" ] ; then
285
rm -f "${CLAIMING_DIR}/tmpout.txt"
267
- echo -n "${ID}" >"${CLAIMING_DIR}/claimed_id"
268
- rm -f "${CLAIMING_DIR}/token"
269
- echo >&2 "Node was successfully claimed."
270
- exit 0
286
+ echo -n "${ID}" >"${CLAIMING_DIR}/claimed_id" || (echo >&2 "Claiming failed"; set -e; exit 2)
287
+ rm -f "${CLAIMING_DIR}/token" || (echo >&2 "Claiming failed"; set -e; exit 2)
288
+ if [ "$EUID" == "0" ]; then
289
+ chown -R "${NETDATA_USER}:${NETDATA_USER}" ${CLAIMING_DIR} || (echo >&2 "Claiming failed"; set -e; exit 2)
290
+ fi
291
+ if [ "${RELOAD}" == "0" ] ; then
292
+ exit 0
293
+ fi
294
+ netdatacli reload-claiming-state && echo >&2 "Node was successfully claimed." && exit 0
295
+ echo "The claim was successful but the agent could not be notified ($?)- it requires a restart to connect to the cloud"
296
+ exit 6
297
fi
298
299
ERROR_MESSAGE=$(grep "\"errorMsgKey\":" "${CLAIMING_DIR}/tmpout.txt" | awk -F "errorMsgKey\":\"" '{print $2}' | awk -F "\"" '{print $1}')
daemon/commands.c
+4
@@ -190,6 +190,10 @@ static cmd_status_t cmd_reload_claiming_state_execute(char *args, char **message
190
info("The claiming feature has been disabled");
191
return CMD_STATUS_FAILURE;
192
#endif
193
+#ifndef ENABLE_ACLK
194
+ info("Cloud functionality is not enabled because of missing dependencies at build-time.");
195
+ return CMD_STATUS_FAILURE;
196
+#endif
197
198
error_log_limit_unlimited();
199
info("COMMAND: Reloading Agent Claiming configuration.");
health/notifications/alarm-notify.sh.in
+1
-1
@@ -193,7 +193,7 @@ fi
193
[ -z "${NETDATA_STOCK_CONFIG_DIR}" ] && NETDATA_STOCK_CONFIG_DIR="@libconfigdir_POST@"
194
[ -z "${NETDATA_CACHE_DIR}" ] && NETDATA_CACHE_DIR="@cachedir_POST@"
195
[ -z "${NETDATA_REGISTRY_URL}" ] && NETDATA_REGISTRY_URL="https://registry.my-netdata.io"
196
-[ -z "${NETDATA_REGISTRY_CLOUD_BASE_URL}" ] && NETDATA_REGISTRY_CLOUD_BASE_URL="https://netdata.cloud"
196
+[ -z "${NETDATA_REGISTRY_CLOUD_BASE_URL}" ] && NETDATA_REGISTRY_CLOUD_BASE_URL="https://app.netdata.cloud"
197
198
# -----------------------------------------------------------------------------
199
# parse command line parameters
libnetdata/libnetdata.h
+3
@@ -321,4 +321,7 @@ extern char *netdata_configured_host_prefix;
321
#include "health/health.h"
322
#include "string/utf8.h"
323
324
+// BEWARE: Outside of the C code this also exists in alarm-notify.sh
325
+#define DEFAULT_CLOUD_BASE_URL "https://app.netdata.cloud"
326
+
327
#endif // NETDATA_LIB_H
packaging/docker/Dockerfile
+1
@@ -47,6 +47,7 @@ RUN mkdir -p /app/usr/sbin/ \
47
mv /etc/netdata /app/etc/ && \
48
mv /usr/sbin/netdata /app/usr/sbin/ && \
49
mv /usr/sbin/netdata-claim.sh /app/usr/sbin/ && \
50
+ mv /usr/sbin/netdatacli /app/usr/sbin/ && \
51
mv packaging/docker/run.sh /app/usr/sbin/ && \
52
cp -rp /deps/* /app/usr/local/ && \
53
chmod +x /app/usr/sbin/run.sh
registry/registry_init.c
+1
-1
@@ -41,7 +41,7 @@ int registry_init(void) {
41
registry.verify_cookies_redirects = config_get_boolean(CONFIG_SECTION_REGISTRY, "verify browser cookies support", 1);
42
43
// netdata.cloud configuration, if cloud_base_url == "", cloud functionality is disabled.
44
- registry.cloud_base_url = config_get(CONFIG_SECTION_CLOUD, "cloud base url", "https://netdata.cloud");
44
+ registry.cloud_base_url = config_get(CONFIG_SECTION_CLOUD, "cloud base url", DEFAULT_CLOUD_BASE_URL);
45
46
setenv("NETDATA_REGISTRY_CLOUD_BASE_URL", registry.cloud_base_url, 1);
47
setenv("NETDATA_REGISTRY_HOSTNAME", registry.hostname, 1);
tests/alarm_repetition/netdata.conf_with_repetition
+1
-1
@@ -54,4 +54,4 @@
54
allow from = *
55
56
[cloud]
57
- cloud base url = https://netdata.cloud
57
+ cloud base url = https://app.netdata.cloud
tests/alarm_repetition/netdata.conf_without_repetition
+1
-1
@@ -54,4 +54,4 @@
54
allow from = *
55
56
[cloud]
57
- cloud base url = https://netdata.cloud
57
+ cloud base url = https://app.netdata.cloud