FM / config

/snap/core18/2999/usr/lib/python3/dist-packages/cloudinit/config/

/snap/core18/2999/usr/lib/python3/dist-packages/cloudinit/config

Name	Size	Mode	Actions
schemas/	-	0755	rm
__pycache__/	-	0755	rm
cc_ansible.py	8568	0644	edit dl rm
cc_apk_configure.py	5883	0644	edit dl rm
cc_apt_configure.py	33237	0644	edit dl rm
cc_apt_pipelining.py	2888	0644	edit dl rm
cc_bootcmd.py	2940	0644	edit dl rm
cc_byobu.py	3757	0644	edit dl rm
cc_ca_certs.py	8251	0644	edit dl rm
cc_chef.py	14118	0644	edit dl rm
cc_disable_ec2_metadata.py	2093	0644	edit dl rm
cc_disk_setup.py	33115	0644	edit dl rm
cc_fan.py	3184	0644	edit dl rm
cc_final_message.py	3490	0644	edit dl rm
cc_growpart.py	19890	0644	edit dl rm
cc_grub_dpkg.py	5619	0644	edit dl rm
cc_install_hotplug.py	3901	0644	edit dl rm
cc_keyboard.py	2126	0644	edit dl rm
cc_keys_to_console.py	3713	0644	edit dl rm
cc_landscape.py	4976	0644	edit dl rm
cc_locale.py	1923	0644	edit dl rm
cc_lxd.py	18387	0644	edit dl rm
cc_mcollective.py	6349	0644	edit dl rm
cc_migrator.py	3599	0644	edit dl rm
cc_mounts.py	19486	0644	edit dl rm
cc_ntp.py	20172	0644	edit dl rm
cc_package_update_upgrade_install.py	4530	0644	edit dl rm
cc_phone_home.py	5636	0644	edit dl rm
cc_power_state_change.py	7838	0644	edit dl rm
cc_puppet.py	14066	0644	edit dl rm
cc_refresh_rmc_and_interface.py	5614	0644	edit dl rm
cc_reset_rmc.py	4642	0644	edit dl rm
cc_resizefs.py	10818	0644	edit dl rm
cc_resolv_conf.py	5130	0644	edit dl rm
cc_rh_subscription.py	17456	0644	edit dl rm
cc_rightscale_userdata.py	4407	0644	edit dl rm
cc_rsyslog.py	10001	0644	edit dl rm
cc_runcmd.py	2993	0644	edit dl rm
cc_salt_minion.py	5668	0644	edit dl rm
cc_scripts_per_boot.py	1717	0644	edit dl rm
cc_scripts_per_instance.py	1873	0644	edit dl rm
cc_scripts_per_once.py	1823	0644	edit dl rm
cc_scripts_user.py	1913	0644	edit dl rm
cc_scripts_vendor.py	2367	0644	edit dl rm
cc_seed_random.py	4928	0644	edit dl rm
cc_set_hostname.py	5012	0644	edit dl rm
cc_set_passwords.py	11315	0644	edit dl rm
cc_snap.py	6539	0644	edit dl rm
cc_spacewalk.py	3604	0644	edit dl rm
cc_ssh.py	14371	0644	edit dl rm
cc_ssh_authkey_fingerprints.py	4338	0644	edit dl rm
cc_ssh_import_id.py	5955	0644	edit dl rm
cc_timezone.py	1475	0644	edit dl rm
cc_ubuntu_advantage.py	17281	0644	edit dl rm
cc_ubuntu_autoinstall.py	4672	0644	edit dl rm
cc_ubuntu_drivers.py	4736	0644	edit dl rm
cc_update_etc_hosts.py	5235	0644	edit dl rm
cc_update_hostname.py	3721	0644	edit dl rm
cc_users_groups.py	7787	0644	edit dl rm
cc_wireguard.py	9507	0644	edit dl rm
cc_write_files.py	6910	0644	edit dl rm
cc_write_files_deferred.py	1718	0644	edit dl rm
cc_yum_add_repo.py	7653	0644	edit dl rm
cc_zypper_add_repo.py	6840	0644	edit dl rm
modules.py	11700	0644	edit dl rm
schema.py	44173	0644	edit dl rm
__init__.py	14	0644	edit dl rm

Edit: /snap/core18/2999/usr/lib/python3/dist-packages/cloudinit/config/cc_wireguard.py (9507B)

# Author: Fabian Lichtenegger-Lukas <fabian.lichtenegger-lukas@nts.eu>
# Author: Josef Tschiggerl <josef.tschiggerl@nts.eu>
# This file is part of cloud-init. See LICENSE file for license information.

"""Wireguard"""
import re
from logging import Logger
from textwrap import dedent

from cloudinit import log as logging
from cloudinit import subp, util
from cloudinit.cloud import Cloud
from cloudinit.config import Config
from cloudinit.config.schema import MetaSchema, get_meta_doc
from cloudinit.settings import PER_INSTANCE

MODULE_DESCRIPTION = dedent(
    """\
Wireguard module provides a dynamic interface for configuring
Wireguard (as a peer or server) in an easy way.

This module takes care of:
  - writing interface configuration files
  - enabling and starting interfaces
  - installing wireguard-tools package
  - loading wireguard kernel module
  - executing readiness probes

What's a readiness probe?\n
The idea behind readiness probes is to ensure Wireguard connectivity
before continuing the cloud-init process. This could be useful if you
need access to specific services like an internal APT Repository Server
(e.g Landscape) to install/update packages.

Example:\n
An edge device can't access the internet but uses cloud-init modules which
will install packages (e.g landscape, packages, ubuntu_advantage). Those
modules will fail due to missing internet connection. The "wireguard" module
fixes that problem as it waits until all readinessprobes (which can be
arbitrary commands - e.g. checking if a proxy server is reachable over
Wireguard network) are finished before continuing the cloud-init
"config" stage.

.. note::
    In order to use DNS with Wireguard you have to install ``resolvconf``
    package or symlink it to systemd's ``resolvectl``, otherwise ``wg-quick``
    commands will throw an error message that executable ``resolvconf`` is
    missing which leads wireguard module to fail.
"""
)

meta: MetaSchema = {
    "id": "cc_wireguard",
    "name": "Wireguard",
    "title": "Module to configure Wireguard tunnel",
    "description": MODULE_DESCRIPTION,
    "distros": ["ubuntu"],
    "frequency": PER_INSTANCE,
    "activate_by_schema_keys": ["wireguard"],
    "examples": [
        dedent(
            """\
    # Configure one or more WG interfaces and provide optional readinessprobes
    wireguard:
      interfaces:
        - name: wg0
          config_path: /etc/wireguard/wg0.conf
          content: |
            [Interface]
            PrivateKey = <private_key>
            Address = <address>
            [Peer]
            PublicKey = <public_key>
            Endpoint = <endpoint_ip>:<endpoint_ip_port>
            AllowedIPs = <allowedip1>, <allowedip2>, ...
        - name: wg1
          config_path: /etc/wireguard/wg1.conf
          content: |
            [Interface]
            PrivateKey = <private_key>
            Address = <address>
            [Peer]
            PublicKey = <public_key>
            Endpoint = <endpoint_ip>:<endpoint_ip_port>
            AllowedIPs = <allowedip1>
      readinessprobe:
        - 'systemctl restart service'
        - 'curl https://webhook.endpoint/example'
        - 'nc -zv some-service-fqdn 443'
    """
        ),
    ],
}

__doc__ = get_meta_doc(meta)

LOG = logging.getLogger(__name__)

REQUIRED_WG_INT_KEYS = frozenset(["name", "config_path", "content"])
WG_CONFIG_FILE_MODE = 0o600
NL = "\n"
MIN_KERNEL_VERSION = (5, 6)

def supplemental_schema_validation(wg_int: dict):
    """Validate user-provided wg:interfaces option values.

This function supplements flexible jsonschema validation with specific
    value checks to aid in triage of invalid user-provided configuration.

@param wg_int: Dict of configuration value under 'wg:interfaces'.

@raises: ValueError describing invalid values provided.
    """
    errors = []
    missing = REQUIRED_WG_INT_KEYS.difference(set(wg_int.keys()))
    if missing:
        keys = ", ".join(sorted(missing))
        errors.append(f"Missing required wg:interfaces keys: {keys}")

for key, value in sorted(wg_int.items()):
        if key == "name" or key == "config_path" or key == "content":
            if not isinstance(value, str):
                errors.append(
                    f"Expected a string for wg:interfaces:{key}. Found {value}"
                )

if errors:
        raise ValueError(
            f"Invalid wireguard interface configuration:{NL}{NL.join(errors)}"
        )

def write_config(wg_int: dict):
    """Writing user-provided configuration into Wireguard
    interface configuration file.

@param wg_int: Dict of configuration value under 'wg:interfaces'.

@raises: RuntimeError for issues writing of configuration file.
    """
    LOG.debug("Configuring Wireguard interface %s", wg_int["name"])
    try:
        LOG.debug("Writing wireguard config to file %s", wg_int["config_path"])
        util.write_file(
            wg_int["config_path"], wg_int["content"], mode=WG_CONFIG_FILE_MODE
        )
    except Exception as e:
        raise RuntimeError(
            "Failure writing Wireguard configuration file"
            f' {wg_int["config_path"]}:{NL}{str(e)}'
        ) from e

def enable_wg(wg_int: dict, cloud: Cloud):
    """Enable and start Wireguard interface

@param wg_int: Dict of configuration value under 'wg:interfaces'.

@raises: RuntimeError for issues enabling WG interface.
    """
    try:
        LOG.debug("Enabling wg-quick@%s at boot", wg_int["name"])
        cloud.distro.manage_service("enable", f'wg-quick@{wg_int["name"]}')
        LOG.debug("Bringing up interface wg-quick@%s", wg_int["name"])
        cloud.distro.manage_service("restart", f'wg-quick@{wg_int["name"]}')
    except subp.ProcessExecutionError as e:
        raise RuntimeError(
            f"Failed enabling/starting Wireguard interface(s):{NL}{str(e)}"
        ) from e

def readinessprobe_command_validation(wg_readinessprobes: list):
    """Basic validation of user-provided probes

@param wg_readinessprobes: List of readinessprobe probe(s).

@raises: ValueError of wrong datatype provided for probes.
    """
    errors = []
    pos = 0
    for c in wg_readinessprobes:
        if not isinstance(c, str):
            errors.append(
                f"Expected a string for readinessprobe at {pos}. Found {c}"
            )
            pos += 1

if errors:
        raise ValueError(
            f"Invalid readinessProbe commands:{NL}{NL.join(errors)}"
        )

def readinessprobe(wg_readinessprobes: list):
    """Execute provided readiness probe(s)

@param wg_readinessprobes: List of readinessprobe probe(s).

@raises: ProcessExecutionError for issues during execution of probes.
    """
    errors = []
    for c in wg_readinessprobes:
        try:
            LOG.debug("Running readinessprobe: '%s'", str(c))
            subp.subp(c, capture=True, shell=True)
        except subp.ProcessExecutionError as e:
            errors.append(f"{c}: {e}")

if errors:
        raise RuntimeError(
            f"Failed running readinessprobe command:{NL}{NL.join(errors)}"
        )

def maybe_install_wireguard_packages(cloud: Cloud):
    """Install wireguard packages and tools

@param cloud: Cloud object

@raises: Exception for issues during package
    installation.
    """

packages = ["wireguard-tools"]

if subp.which("wg"):
        return

# Install DKMS when Kernel Verison lower 5.6
    if util.kernel_version() < MIN_KERNEL_VERSION:
        packages.append("wireguard")

try:
        cloud.distro.update_package_sources()
    except Exception:
        util.logexc(LOG, "Package update failed")
        raise
    try:
        cloud.distro.install_packages(packages)
    except Exception:
        util.logexc(LOG, "Failed to install wireguard-tools")
        raise

def load_wireguard_kernel_module():
    """Load wireguard kernel module

@raises: ProcessExecutionError for issues modprobe
    """
    try:
        out = subp.subp("lsmod", capture=True, shell=True)
        if not re.search("wireguard", out.stdout.strip()):
            LOG.debug("Loading wireguard kernel module")
            subp.subp("modprobe wireguard", capture=True, shell=True)
    except subp.ProcessExecutionError as e:
        util.logexc(LOG, f"Could not load wireguard module:{NL}{str(e)}")
        raise

def handle(
    name: str, cfg: Config, cloud: Cloud, log: Logger, args: list
) -> None:
    wg_section = None

if "wireguard" in cfg:
        LOG.debug("Found Wireguard section in config")
        wg_section = cfg["wireguard"]
    else:
        LOG.debug(
            "Skipping module named %s, no 'wireguard' configuration found",
            name,
        )
        return

# install wireguard tools, enable kernel module
    maybe_install_wireguard_packages(cloud)
    load_wireguard_kernel_module()

for wg_int in wg_section["interfaces"]:
        # check schema
        supplemental_schema_validation(wg_int)

# write wg config files
        write_config(wg_int)

# enable wg interfaces
        enable_wg(wg_int, cloud)

# parse and run readinessprobe parameters
    if (
        "readinessprobe" in wg_section
        and wg_section["readinessprobe"] is not None
    ):
        wg_readinessprobes = wg_section["readinessprobe"]
        readinessprobe_command_validation(wg_readinessprobes)
        readinessprobe(wg_readinessprobes)
    else:
        LOG.debug("Skipping readinessprobe - no checks defined")

cmd: