bug5311: added a second bearer token field to allow for distinguishing between master/security and application replica replication

2026-11-14 22:43:57 +00:00 · 2021-09-23 18:44:38 +02:00
1 parent 38e2fe5ff0
commit bb9e31ff53
@@ -15,25 +15,31 @@ import com.sap.sse.gwt.client.dialog.DataEntryDialog;

 public abstract class AbstractApplicationReplicaSetDialog<I extends AbstractApplicationReplicaSetDialog.AbstractApplicationReplicaSetInstructions> extends DataEntryDialog<I> {
    public static class AbstractApplicationReplicaSetInstructions {
-        private final String replicationBearerToken;
+        private final String masterReplicationBearerToken;
+        private final String replicaReplicationBearerToken;
        private final String releaseNameOrNullForLatestMaster;
        
-        public AbstractApplicationReplicaSetInstructions(String releaseNameOrNullForLatestMaster, String replicationBearerToken) {
+        public AbstractApplicationReplicaSetInstructions(String releaseNameOrNullForLatestMaster, String masterReplicationBearerToken, String replicaReplicationBearerToken) {
            super();
-            this.replicationBearerToken = replicationBearerToken;
+            this.masterReplicationBearerToken = masterReplicationBearerToken;
+            this.replicaReplicationBearerToken = replicaReplicationBearerToken;
            this.releaseNameOrNullForLatestMaster = releaseNameOrNullForLatestMaster;
        }
        public String getReleaseNameOrNullForLatestMaster() {
            return releaseNameOrNullForLatestMaster;
        }
-        public String getReplicationBearerToken() {
-            return replicationBearerToken;
+        public String getMasterReplicationBearerToken() {
+            return masterReplicationBearerToken;
+        }
+        public String getReplicaReplicationBearerToken() {
+            return replicaReplicationBearerToken;
        }
    }
    
    private final StringMessages stringMessages;
    private final SuggestBox releaseNameBox;
-    private final TextBox replicationBearerTokenBox;
+    private final TextBox masterReplicationBearerTokenBox;
+    private final TextBox replicaReplicationBearerTokenBox;

    public AbstractApplicationReplicaSetDialog(String title, LandscapeManagementWriteServiceAsync landscapeManagementService,
            Iterable<String> releaseNames, StringMessages stringMessages, ErrorReporter errorReporter, Validator<I> validator, DialogCallback<I> callback) {
@@ -49,7 +55,8 @@ public abstract class AbstractApplicationReplicaSetDialog<I extends AbstractAppl
            ((MultiWordSuggestOracle) releaseNameBox.getSuggestOracle()).setComparator(newestFirstComaprator);
        }
        releaseNameBox.setValue(stringMessages.latestMasterRelease());
-        replicationBearerTokenBox = createTextBox("", 40);
+        masterReplicationBearerTokenBox = createTextBox("", 40);
+        replicaReplicationBearerTokenBox = createTextBox("", 40);
    }
    
    protected StringMessages getStringMessages() {
@@ -65,7 +72,11 @@ public abstract class AbstractApplicationReplicaSetDialog<I extends AbstractAppl
                ? null : releaseNameBox.getValue();
    }
    
-    protected TextBox getReplicationBearerTokenBox() {
-        return replicationBearerTokenBox;
+    protected TextBox getMasterReplicationBearerTokenBox() {
+        return masterReplicationBearerTokenBox;
+    }
+    
+    protected TextBox getReplicaReplicationBearerTokenBox() {
+        return replicaReplicationBearerTokenBox;
    }
 }
@@ -24,8 +24,8 @@ public class CreateApplicationReplicaSetDialog extends AbstractApplicationReplic
        
        public CreateApplicationReplicaSetInstructions(String name, String instanceType,
                String releaseNameOrNullForLatestMaster, boolean dynamicLoadBalancerMapping,
-                String securityReplicationBearerToken, String optionalDomainName) {
-            super(releaseNameOrNullForLatestMaster, securityReplicationBearerToken);
+                String masterReplicationBearerToken, String replicaReplicationBearerToken, String optionalDomainName) {
+            super(releaseNameOrNullForLatestMaster, masterReplicationBearerToken, replicaReplicationBearerToken);
            this.name = name;
            this.dynamicLoadBalancerMapping = dynamicLoadBalancerMapping;
            this.optionalDomainName = Util.hasLength(optionalDomainName) ? optionalDomainName : null;
@@ -57,7 +57,7 @@ public class CreateApplicationReplicaSetDialog extends AbstractApplicationReplic
            final String result;
            if (!Util.hasLength(valueToValidate.getInstanceType())) {
                result = stringMessages.pleaseSelectInstanceTypeForNewMaster();
-            } else if (!Util.hasLength(valueToValidate.getReplicationBearerToken())) {
+            } else if (!Util.hasLength(valueToValidate.getMasterReplicationBearerToken())) {
                result = stringMessages.pleaseProvideBearerTokenForSecurityReplication();
            } else if (!Util.hasLength(valueToValidate.getName())) {
                result = stringMessages.pleaseProvideApplicationReplicaSetName();
@@ -90,7 +90,7 @@ public class CreateApplicationReplicaSetDialog extends AbstractApplicationReplic

    @Override
    protected Widget getAdditionalWidget() {
-        final Grid result = new Grid(6, 2);
+        final Grid result = new Grid(7, 2);
        int row=0;
        result.setWidget(row, 0, new Label(stringMessages.name()));
        result.setWidget(row++, 1, nameBox);
@@ -101,7 +101,9 @@ public class CreateApplicationReplicaSetDialog extends AbstractApplicationReplic
        result.setWidget(row, 0, new Label(stringMessages.useDynamicLoadBalancer()));
        result.setWidget(row++, 1, dynamicLoadBalancerCheckBox);
        result.setWidget(row, 0, new Label(stringMessages.bearerTokenForSecurityReplication()));
-        result.setWidget(row++, 1, getReplicationBearerTokenBox());
+        result.setWidget(row++, 1, getMasterReplicationBearerTokenBox());
+        result.setWidget(row, 0, new Label(stringMessages.replicaReplicationBearerToken()));
+        result.setWidget(row++, 1, getReplicaReplicationBearerTokenBox());
        result.setWidget(row, 0, new Label(stringMessages.domainName()));
        result.setWidget(row++, 1, domainNameBox);
        return result;
@@ -114,7 +116,9 @@ public class CreateApplicationReplicaSetDialog extends AbstractApplicationReplic
    
    @Override
    protected CreateApplicationReplicaSetInstructions getResult() {
-        return new CreateApplicationReplicaSetInstructions(nameBox.getValue(), getInstanceTypeListBox().getSelectedValue(),
-                getReleaseNameBoxValue(), dynamicLoadBalancerCheckBox.getValue(), getReplicationBearerTokenBox().getValue(), domainNameBox.getValue());
+        return new CreateApplicationReplicaSetInstructions(nameBox.getValue(),
+                getInstanceTypeListBox().getSelectedValue(), getReleaseNameBoxValue(),
+                dynamicLoadBalancerCheckBox.getValue(), getMasterReplicationBearerTokenBox().getValue(),
+                getReplicaReplicationBearerTokenBox().getValue(), domainNameBox.getValue());
    }
 }
@@ -390,7 +390,8 @@ public class LandscapeManagementPanel extends SimplePanel {
                                        sshKeyManagementPanel.getSelectedKeyPair()==null?null:sshKeyManagementPanel.getSelectedKeyPair().getName(),
                                                sshKeyManagementPanel.getPassphraseForPrivateKeyDecryption() != null
                                                ? sshKeyManagementPanel.getPassphraseForPrivateKeyDecryption().getBytes() : null,
-                                                instructions.getReplicationBearerToken(),instructions.getOptionalDomainName(),
+                                                instructions.getMasterReplicationBearerToken(), instructions.getReplicaReplicationBearerToken(),
+                                                instructions.getOptionalDomainName(),
                                                new AsyncCallback<SailingApplicationReplicaSetDTO<String>>() {
                                 @Override
                                 public void onFailure(Throwable caught) {
@@ -678,7 +679,7 @@ public class LandscapeManagementPanel extends SimplePanel {
                                                    sshKeyManagementPanel.getSelectedKeyPair()==null?null:sshKeyManagementPanel.getSelectedKeyPair().getName(),
                                                            sshKeyManagementPanel.getPassphraseForPrivateKeyDecryption() != null
                                                            ? sshKeyManagementPanel.getPassphraseForPrivateKeyDecryption().getBytes() : null,
-                                                    upgradeInstructions.getReplicationBearerToken(),
+                                                    upgradeInstructions.getMasterReplicationBearerToken(),
                                                    new AsyncCallback<SailingApplicationReplicaSetDTO<String>>() {
                                                        @Override
                                                        public void onFailure(Throwable caught) {
@@ -71,7 +71,7 @@ public interface LandscapeManagementWriteService extends RemoteService {

    SailingApplicationReplicaSetDTO<String> createApplicationReplicaSet(String regionId, String name, String masterInstanceType,
            boolean dynamicLoadBalancerMapping, String releaseNameOrNullForLatestMaster, String optionalKeyName,
-            byte[] privateKeyEncryptionPassphrase, String securityReplicationBearerToken, String optionalDomainName) throws Exception;
+            byte[] privateKeyEncryptionPassphrase, String securityReplicationBearerToken, String replicaReplicationBearerToken, String optionalDomainName) throws Exception;

    void defineDefaultRedirect(String regionId, String hostname, RedirectDTO redirect, String keyName, String passphraseForPrivateKeyDecryption);

@@ -89,7 +89,8 @@ public interface LandscapeManagementWriteServiceAsync {

    void createApplicationReplicaSet(String regionId, String name, String masterInstanceType,
            boolean dynamicLoadBalancerMapping, String releaseNameOrNullForLatestMaster, String optionalKeyName,
-            byte[] privateKeyEncryptionPassphrase, String securityReplicationBearerToken, String optionalDomainName,
+            byte[] privateKeyEncryptionPassphrase, String securityReplicationBearerToken, String replicaReplicationBearerToken,
+            String optionalDomainName,
            AsyncCallback<SailingApplicationReplicaSetDTO<String>> callback);

    void serializationDummy(ProcessDTO mongoProcessDTO, AwsInstanceDTO awsInstanceDTO,
@@ -9,8 +9,8 @@ import com.sap.sse.gwt.client.ErrorReporter;

 public class UpgradeApplicationReplicaSetDialog extends AbstractApplicationReplicaSetDialog<UpgradeApplicationReplicaSetDialog.UpgradeApplicationReplicaSetInstructions> {
    public static class UpgradeApplicationReplicaSetInstructions extends AbstractApplicationReplicaSetDialog.AbstractApplicationReplicaSetInstructions {
-        public UpgradeApplicationReplicaSetInstructions(String releaseNameOrNullForLatestMaster, String replicationBearerToken) {
-            super(releaseNameOrNullForLatestMaster, replicationBearerToken);
+        public UpgradeApplicationReplicaSetInstructions(String releaseNameOrNullForLatestMaster, String masterReplicationBearerToken, String replicaReplicationBearerToken) {
+            super(releaseNameOrNullForLatestMaster, masterReplicationBearerToken, replicaReplicationBearerToken);
        }
    }
    
@@ -28,8 +28,8 @@ public class UpgradeApplicationReplicaSetDialog extends AbstractApplicationRepli
        int row=0;
        result.setWidget(row, 0, new Label(stringMessages.release()));
        result.setWidget(row++, 1, getReleaseNameBox());
-        result.setWidget(row, 0, new Label(stringMessages.bearerTokenForSecurityReplication()));
-        result.setWidget(row++, 1, getReplicationBearerTokenBox());
+        result.setWidget(row, 0, new Label(stringMessages.replicaReplicationBearerToken()));
+        result.setWidget(row++, 1, getReplicaReplicationBearerTokenBox());
        return result;
    }

@@ -40,6 +40,6 @@ public class UpgradeApplicationReplicaSetDialog extends AbstractApplicationRepli
    
    @Override
    protected UpgradeApplicationReplicaSetInstructions getResult() {
-        return new UpgradeApplicationReplicaSetInstructions(getReleaseNameBoxValue(), getReplicationBearerTokenBox().getValue());
+        return new UpgradeApplicationReplicaSetInstructions(getReleaseNameBoxValue(), getMasterReplicationBearerTokenBox().getValue(), getReplicaReplicationBearerTokenBox().getValue());
    }
 }
@@ -107,4 +107,5 @@ com.sap.sse.gwt.adminconsole.StringMessages {
    String bearerTokenOrNullForArchive();
    String numberOfMinutesBeforeAndBetweenCompareServers();
    String numberOfCompareServersAttempts();
+    String replicaReplicationBearerToken();
 }
@@ -95,4 +95,5 @@ removeArchivedReplicaSet=Remove archived replica set after successful verificati
 bearerTokenOrNullForApplicationReplicaSetToArchive=Bearer token for application replica set {0} (leave empty for current user)
 bearerTokenOrNullForArchive=Bearer token for archive (leave empty for current user)
 numberOfMinutesBeforeAndBetweenCompareServers=Minutes before and between verification attempts
-numberOfCompareServersAttempts=Maximum number of verification attempts
+numberOfCompareServersAttempts=Maximum number of verification attempts
+replicaReplicationBearerToken=Bearer token for replicas to replicate master
@@ -95,4 +95,5 @@ removeArchivedReplicaSet=Anwendungs-Cluster nach dem Archivieren entfernen?
 bearerTokenOrNullForApplicationReplicaSetToArchive=Token für zu archivierendes Anwendungs-Cluster {0} (leer für aktuellen Benutzer)
 bearerTokenOrNullForArchive=Token für Archive-Server (leer für aktuellen Benutzer)
 numberOfMinutesBeforeAndBetweenCompareServers=Minuten vor und zwischen den Verifikations-Läufen
-numberOfCompareServersAttempts=Maximale Anzahl Verifikations-Läufe
+numberOfCompareServersAttempts=Maximale Anzahl Verifikations-Läufe
+replicaReplicationBearerToken=Token für Replikas, um den Master-Server zu replizieren
@@ -574,7 +574,7 @@ public class LandscapeManagementWriteServiceImpl extends ResultCachingProxiedRem
    @Override
    public SailingApplicationReplicaSetDTO<String> createApplicationReplicaSet(String regionId, String name, String masterInstanceType,
            boolean dynamicLoadBalancerMapping, String releaseNameOrNullForLatestMaster, String optionalKeyName,
-            byte[] privateKeyEncryptionPassphrase, String replicationBearerToken, String optionalDomainName)
+            byte[] privateKeyEncryptionPassphrase, String masterReplicationBearerToken, String replicaReplicationBearerToken, String optionalDomainName)
            throws Exception {
        checkLandscapeManageAwsPermission();
        final AwsLandscape<String> landscape = getLandscape();
@@ -582,8 +582,8 @@ public class LandscapeManagementWriteServiceImpl extends ResultCachingProxiedRem
        final com.sap.sailing.landscape.procedures.StartSailingAnalyticsMasterHost.Builder<?, String> masterHostBuilder = StartSailingAnalyticsMasterHost.masterHostBuilder(masterConfigurationBuilder);
        final AwsRegion region = new AwsRegion(regionId);
        establishServerGroupAndTryToMakeCurrentUserItsOwnerAndMember(name);
-        final String bearerTokenUsedByMaster = Util.hasLength(replicationBearerToken) ? replicationBearerToken : getSecurityService().getOrCreateAccessToken(SessionUtils.getPrincipal().toString());
-        final String bearerTokenUsedByReplicas = getSecurityService().getAccessToken(SessionUtils.getPrincipal().toString()); // TODO how about using an explicit replicationBearerToken only for master and prefer the current user's token for replicas? Doesn't work, though, for testing with disconnected caller security
+        final String bearerTokenUsedByMaster = Util.hasLength(masterReplicationBearerToken) ? masterReplicationBearerToken : getSecurityService().getOrCreateAccessToken(SessionUtils.getPrincipal().toString());
+        final String bearerTokenUsedByReplicas = Util.hasLength(replicaReplicationBearerToken) ? replicaReplicationBearerToken : getSecurityService().getOrCreateAccessToken(SessionUtils.getPrincipal().toString());
        final Release release = getRelease(releaseNameOrNullForLatestMaster);
        masterConfigurationBuilder
            .setLandscape(landscape)
@@ -949,13 +949,13 @@ public class LandscapeManagementWriteServiceImpl extends ResultCachingProxiedRem
    @Override
    public SailingApplicationReplicaSetDTO<String> upgradeApplicationReplicaSet(String regionId,
            SailingApplicationReplicaSetDTO<String> applicationReplicaSetToUpgrade, String releaseOrNullForLatestMaster,
-            String optionalKeyName, byte[] privateKeyEncryptionPassphrase, String replicationBearerToken) throws Exception {
+            String optionalKeyName, byte[] privateKeyEncryptionPassphrase, String replicaReplicationBearerToken) throws Exception {
        checkLandscapeManageAwsPermission();
        final Release release = getRelease(releaseOrNullForLatestMaster);
        final AwsRegion region = new AwsRegion(regionId);
        final AwsApplicationReplicaSet<String, SailingAnalyticsMetrics, SailingAnalyticsProcess<String>> replicaSet =
                convertFromApplicationReplicaSetDTO(region, applicationReplicaSetToUpgrade);
-        final String bearerToken = Util.hasLength(replicationBearerToken) ? replicationBearerToken :
+        final String effectiveReplicaReplicationBearerToken = Util.hasLength(replicaReplicationBearerToken) ? replicaReplicationBearerToken :
            getSecurityService().getOrCreateAccessToken(SessionUtils.getPrincipal().toString());
        final SailingAnalyticsProcess<String> additionalReplicaStarted;
        final int oldAutoScalingGroupMinSize;
@@ -970,7 +970,7 @@ public class LandscapeManagementWriteServiceImpl extends ResultCachingProxiedRem
            logger.info("No replica found for replica set " + replicaSet.getName()
                    + "; spinning one up and waiting for it to become healthy");
            additionalReplicaStarted = launchReplicaAndWaitUntilHealthy(replicaSet, Optional.ofNullable(optionalKeyName),
-                    privateKeyEncryptionPassphrase, bearerToken);
+                    privateKeyEncryptionPassphrase, effectiveReplicaReplicationBearerToken);
            replicas.add(additionalReplicaStarted);
        } else {
            additionalReplicaStarted = null;
@@ -978,7 +978,7 @@ public class LandscapeManagementWriteServiceImpl extends ResultCachingProxiedRem
        logger.info("Stopping replication for replica set "+replicaSet.getName());
        for (final SailingAnalyticsProcess<String> replica : replicas) {
            logger.info("...asking replica "+replica+" to stop replication");
-            replica.stopReplicatingFromMaster(bearerToken, WAIT_FOR_PROCESS_TIMEOUT);
+            replica.stopReplicatingFromMaster(effectiveReplicaReplicationBearerToken, WAIT_FOR_PROCESS_TIMEOUT);
        }
        logger.info("Done stopping replication. Removing master "+replicaSet.getMaster()+" from target groups "+
                replicaSet.getPublicTargetGroup()+" and "+replicaSet.getMasterTargetGroup());