Adding backup to gcs using gcsfuse with an auto option. #215
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| # Copyright 2025 Google LLC | ||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
|
|
||
| --- | ||
| - name: gcsfuse | gcsfuse install | ||
| include_tasks: gcsfuse.yml | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,151 @@ | ||
| # Copyright 2025 Google LLC | ||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
|
|
||
| --- | ||
| - name: gcsfuse | gcsfuse install | ||
| include_tasks: gcsfuse.yml | ||
|
|
||
| - name: gcsfuse enable resource manager API | Enable resource manager API auto creation of bucket | ||
|
There was a problem hiding this comment. Although I appreciate the intent of making this plug-and-play, google cloud security recommendations are not to allow a VM's default service account to do powerful things like enable APIs. |
||
| shell: | ||
|
There was a problem hiding this comment. It might be more secure to use the command module with ignore_errors |
||
| cmd: "gcloud services enable cloudresourcemanager.googleapis.com || true" | ||
| register: services_cloudresourcemanager | ||
| changed_when: not services_cloudresourcemanager.failed | ||
|
|
||
| - name: gcsfuse extract project number | GCE instance project number value | ||
| shell: | ||
| cmd: "gcloud projects describe $(gcloud config get-value project) --format=\"value(projectNumber)\"" | ||
|
There was a problem hiding this comment. Is there a way to do this in native Ansible rather than shelling out? |
||
| register: gce_project_number | ||
| changed_when: not gce_project_number.failed | ||
|
|
||
| - name: gcsfuse project number results | GCE instance project number value results | ||
| debug: | ||
| var: gce_project_number.stdout | ||
| verbosity: 1 | ||
|
|
||
| - name: gcsfuse extract instance_id number | GCE instance_id value | ||
| shell: | ||
| cmd: "curl -s http://metadata.google.internal/computeMetadata/v1/instance/id -H Metadata-Flavor:Google" | ||
|
There was a problem hiding this comment. Can we use the built-in uri module for this rather than shelling out? |
||
| register: gce_instance_id | ||
| changed_when: not gce_instance_id.failed | ||
|
|
||
| - name: gcsfuse instance_id results | GCE instance instance_id value results | ||
| debug: | ||
| var: gce_instance_id.stdout | ||
| verbosity: 1 | ||
|
|
||
| - name: gcsfuse service account verification | GCE gcsfuse service account verification | ||
| shell: | ||
| cmd: "gcloud iam service-accounts list --format json|egrep -i gcsfuse-{{ gce_instance_id.stdout }}|egrep -i email |awk -F'\"' '{print $4}'" | ||
|
There was a problem hiding this comment. I don't think the default service account can run iam commands by default. Nor is it a great security practice to allow VMs to interrogate their own security policy. Is there another way to validate this, perhaps as a fail_when or a rescue in a bucket command |
||
| register: gcsfuse_backup_service_account_verification | ||
|
There was a problem hiding this comment. One idea: can we put the manipulation of cloud constructs into the Terraform we're working on, coupled with docs on how do it manually? |
||
| failed_when: gcsfuse_backup_service_account_verification.rc not in [0, 1] | ||
| changed_when: false | ||
| check_mode: false | ||
|
|
||
| - name: gcsfuse create service account | GCE gcsfuse service account | ||
| shell: | ||
| cmd: "gcloud iam service-accounts create gcsfuse-{{ gce_instance_id.stdout }}" | ||
|
There was a problem hiding this comment. This type of command is even more sensitive security-wise. Let's please have a way to work with more restrictive permissions (perhaps documentation, or even a script that a user can run in cloud shell?) |
||
| register: gcsfuse_backup_service_account | ||
| when: | ||
| - gcsfuse_backup_service_account_verification.stdout | length == 0 | ||
| changed_when: not gcsfuse_backup_service_account.failed | ||
|
|
||
| - name: gcsfuse wait for service account propagation | ||
| pause: | ||
| seconds: 15 | ||
| when: not ansible_check_mode | ||
|
|
||
| - name: gcsfuse service account verification | GCE gcsfuse service account verification | ||
| shell: | ||
| cmd: "gcloud iam service-accounts list --format json|egrep -i gcsfuse-{{ gce_instance_id.stdout }}|egrep -i email |awk -F'\"' '{print $4}'" | ||
| register: gcsfuse_backup_service_account_verification | ||
| failed_when: gcsfuse_backup_service_account_verification.rc not in [0, 1] | ||
| changed_when: false | ||
| check_mode: false | ||
|
|
||
| - name: gcsfuse service account verification results | GCE gcsfuse service account results | ||
| debug: | ||
| var: gcsfuse_backup_service_account_verification.stdout | ||
| verbosity: 1 | ||
|
|
||
| - name: gcsfuse service account keys verification | GCE gcsfuse service account keys verification | ||
| shell: | ||
| cmd: "gcloud iam service-accounts keys list --managed-by=user --iam-account={{ gcsfuse_backup_service_account_verification.stdout }}" | ||
| register: gcsfuse_backup_service_account_keys_verification | ||
| failed_when: gcsfuse_backup_service_account_keys_verification.stderr != "Listed 0 items." | ||
| changed_when: false | ||
| check_mode: false | ||
|
|
||
| - name: gcsfuse create temp directory| GCE gcsfuse create temp directory | ||
| become: true | ||
| file: | ||
| path: "{{ gcsfuse_backup_temp_path }}/{{ gcsfuse_backup_temp_prefix }}{{ gce_instance_id.stdout }}" | ||
| state: directory | ||
| mode: 0760 | ||
| owner: "{{ oracle_user }}" | ||
| group: "{{ oracle_group }}" | ||
|
|
||
| - name: gcsfuse create bucket mount directory| GCE gcsfuse create bucket mount directory | ||
| become: true | ||
| file: | ||
| path: "{{ gcsfuse_backup_mount_path }}/{{ gcsfuse_backup_mount_prefix }}{{ gce_instance_id.stdout }}" | ||
| state: directory | ||
| mode: 0760 | ||
| owner: "{{ oracle_user }}" | ||
| group: "{{ oracle_group }}" | ||
|
|
||
| - name: gcsfuse create bucket| GCE gcsfuse create bucket | ||
| shell: | ||
| cmd: "gcloud storage buckets create gs://{{ gcsfuse_bucket_prefix }}-{{ gce_instance_id.stdout }} --pap" | ||
| register: gcsfuse_create_bucket | ||
|
|
||
| - name: gcsfuse wait for gcsbucket propagation | ||
| pause: | ||
| seconds: 15 | ||
| when: not ansible_check_mode | ||
|
|
||
| - name: gcsfuse set bucket service account iam policy| GCE set bucket service account iam policy | ||
| shell: | ||
| cmd: "gcloud storage buckets add-iam-policy-binding gs://{{ gcsfuse_bucket_prefix }}-{{ gce_instance_id.stdout }}/ --member=\"serviceAccount:{{ gcsfuse_backup_service_account_verification.stdout }}\" --role=roles/storage.legacyBucketOwner" | ||
| register: gcsfuse_service_account_iam | ||
| changed_when: not gcsfuse_service_account_iam.failed | ||
|
|
||
| - name: gcsfuse wait for gcsbucket iam-policy propagation | ||
| pause: | ||
| seconds: 15 | ||
| when: not ansible_check_mode | ||
|
|
||
| - name: gcsfuse create service account key | GCE gcsfuse service account key | ||
|
There was a problem hiding this comment. Sorry for harping about security, but bearer tokens are a bad thing. Application default credentials would be better. |
||
| shell: | ||
| cmd: "gcloud iam service-accounts keys create {{ gcsfuse_backup_temp_path }}/{{ gcsfuse_backup_temp_prefix }}{{ gce_instance_id.stdout }}/{{ gce_instance_id.stdout }}.json --iam-account={{ gcsfuse_backup_service_account_verification.stdout }}" | ||
| register: gcsfuse_backup_service_account_json_key | ||
| when: gcsfuse_backup_service_account_keys_verification.stderr == "Listed 0 items." | ||
| changed_when: not gcsfuse_backup_service_account_json_key.failed | ||
|
|
||
| - name: gcsfuse wait for service account keys propagation | ||
| pause: | ||
| seconds: 15 | ||
| when: not ansible_check_mode | ||
|
|
||
| - name: gcsfuse mount bucket GCE gcsfuse mount directory | ||
|
There was a problem hiding this comment. How will this survive reboots? |
||
| mount: | ||
| path: "{{ gcsfuse_backup_mount_path }}/{{ gcsfuse_backup_mount_prefix }}{{ gce_instance_id.stdout }}" | ||
| src: "{{ gcsfuse_bucket_prefix }}-{{ gce_instance_id.stdout }}" | ||
| fstype: gcsfuse | ||
| opts: temp_dir={{ gcsfuse_backup_temp_path }}/{{ gcsfuse_backup_temp_prefix }}{{ gce_instance_id.stdout }},rw,dir_mode=777,uid={{ oracle_user }},gid={{ oracle_group }},noexec,nodev,allow_other,key_file={{ gcsfuse_backup_temp_path }}/{{ gcsfuse_backup_temp_prefix }}{{ gce_instance_id.stdout }}/{{ gce_instance_id.stdout }}.json | ||
| state: mounted | ||
| when: gcsfuse_backup_service_account_verification is defined | ||
|
|
||
| - name: gcsfuse set backup directory | GCE gcsfuse service account key | ||
| set_fact: | ||
| backup_dest: "{{ gcsfuse_backup_mount_path }}/{{ gcsfuse_backup_mount_prefix }}{{ gce_instance_id.stdout }}" | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We need to handle the case where $REMOVE_AUTOGCS_BUCKET is blank too. (see sample output: https://oss.gprow.dev/view/gs/bmaas-testing-prow-bucket/pr-logs/pull/google_oracle-toolkit/215/oracle-toolkit-install/1895185501892120576)