Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Multi tenant workspace cleaning #7243

Merged
merged 13 commits into from
Nov 10, 2017
Merged

Multi tenant workspace cleaning #7243

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
6ae96f2
Add the ability to find the workspaceId from the machine token
davidfestal Nov 8, 2017
f651db8
Add a log when a synchronous che-server shutdown is requested
davidfestal Nov 8, 2017
4dd5c7b
Add a mechanism that allows keeping track of workspace user informations
davidfestal Nov 8, 2017
070035a
Make the `OpenshiftConnector` use the new `WorkspaceSubjectRegistry`...
davidfestal Nov 8, 2017
56ee2ff
Adapt the OS workspace file cleaning to the multi-tenant use-case...
davidfestal Nov 8, 2017
f39184e
First stop the che server before deleting all the resources...
davidfestal Nov 8, 2017
15642ff
Change log level to DEBUG
davidfestal Nov 8, 2017
499a947
Add a test for the newly-created `getWorkspaceId()` method.
davidfestal Nov 8, 2017
3b91135
Add JavaDoc to the `WorkspaceSubjectRegistry` class
davidfestal Nov 8, 2017
9d94514
Throw when a workspace is started by the anonymous user...
davidfestal Nov 9, 2017
4a4a4f0
Add unit tests for the `WorkspaceSubjectRegistry`
davidfestal Nov 9, 2017
cc96961
reduce the stop timeout to 3 minutes
davidfestal Nov 9, 2017
e7050f0
Also test users are cleaned when all the related workspaces are stopped
davidfestal Nov 10, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions dockerfiles/init/modules/openshift/files/scripts/deploy_che.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -266,6 +266,8 @@ echo "done!"
# If command == clean up then delete all openshift objects
# -------------------------------------------------------------
if [ "${COMMAND}" == "cleanup" ]; then
echo "[CHE] Stopping the Che server..."
oc scale --replicas=0 --timeout=3m dc che
echo "[CHE] Deleting all OpenShift objects..."
oc delete all --all
echo "[CHE] Cleanup successfully started. Use \"oc get all\" to verify that all resources have been deleted."
Expand Down
4 changes: 4 additions & 0 deletions multiuser/keycloak/che-multiuser-keycloak-server/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,10 @@
<groupId>org.eclipse.che.core</groupId>
<artifactId>che-core-api-user</artifactId>
</dependency>
<dependency>
<groupId>org.eclipse.che.core</groupId>
<artifactId>che-core-api-workspace</artifactId>
</dependency>
<dependency>
<groupId>org.eclipse.che.core</groupId>
<artifactId>che-core-commons-annotations</artifactId>
Expand Down
7 changes: 6 additions & 1 deletion ...ava/org/eclipse/che/multiuser/keycloak/server/KeycloakEnvironmentInitalizationFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@
import org.eclipse.che.api.core.model.user.User;
import org.eclipse.che.api.user.server.UserManager;
import org.eclipse.che.api.user.server.model.impl.UserImpl;
import org.eclipse.che.api.workspace.server.WorkspaceSubjectRegistry;
import org.eclipse.che.commons.auth.token.RequestTokenExtractor;
import org.eclipse.che.commons.env.EnvironmentContext;
import org.eclipse.che.commons.subject.Subject;
Expand All @@ -51,15 +52,18 @@ public class KeycloakEnvironmentInitalizationFilter extends AbstractKeycloakFilt
private final UserManager userManager;
private final RequestTokenExtractor tokenExtractor;
private final PermissionChecker permissionChecker;
private final WorkspaceSubjectRegistry workspaceSubjectRegistry;

@Inject
public KeycloakEnvironmentInitalizationFilter(
UserManager userManager,
RequestTokenExtractor tokenExtractor,
PermissionChecker permissionChecker) {
PermissionChecker permissionChecker,
WorkspaceSubjectRegistry workspaceSubjectRegistry) {
this.userManager = userManager;
this.tokenExtractor = tokenExtractor;
this.permissionChecker = permissionChecker;
this.workspaceSubjectRegistry = workspaceSubjectRegistry;
}

@Override
Expand Down Expand Up @@ -91,6 +95,7 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
subject =
new AuthorizedSubject(
new SubjectImpl(user.getName(), user.getId(), token, false), permissionChecker);
workspaceSubjectRegistry.updateSubject(subject);
session.setAttribute("che_subject", subject);
} catch (ServerException | ConflictException e) {
throw new ServletException(
Expand Down
20 changes: 20 additions & 0 deletions ...in/java/org/eclipse/che/multiuser/machine/authentication/server/MachineTokenRegistry.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,26 @@ public String getUserId(String token) throws NotFoundException {
}
}

/**
* Gets workspaceId by machine token
*
* @return workspace identifier
* @throws NotFoundException when no such machine token exists
*/
public String getWorkspaceId(String token) throws NotFoundException {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this method should be tested in multiuser/machine-auth/che-multiuser-machine-authentication/src/test/java/org/eclipse/che/multiuser/machine/authentication/server/MachineTokenRegistryTest.java

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can't find where this method is used

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This method is used by the rh-che assembly, in order to get an up-to-date Keycloak token that we can inject into the Bayesian Language server when starting it.

See PR redhat-developer/rh-che#417, and especially this line

lock.readLock().lock();
try {
for (Table.Cell<String, String, String> tokenCell : tokens.cellSet()) {
if (tokenCell.getValue().equals(token)) {
return tokenCell.getRowKey();
}
}
throw new NotFoundException("Workspace not found for token " + token);
} finally {
lock.readLock().unlock();
}
}

/**
* Invalidates machine security tokens for all users of given workspace.
*
Expand Down
15 changes: 15 additions & 0 deletions ...ava/org/eclipse/che/multiuser/machine/authentication/server/MachineTokenRegistryTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,4 +53,19 @@ private static boolean exists(MachineTokenRegistry registry, String user, String
return false;
}
}

@Test
public void shouldreturnWorkspaceId() throws Exception {
final MachineTokenRegistry registry = new MachineTokenRegistry();

String token11 = registry.generateToken("user1", "workspace1");
String token12 = registry.generateToken("user1", "workspace2");
String token21 = registry.generateToken("user2", "workspace1");
String token22 = registry.generateToken("user2", "workspace2");

assertEquals(registry.getWorkspaceId(token11), "workspace1");
assertEquals(registry.getWorkspaceId(token12), "workspace2");
assertEquals(registry.getWorkspaceId(token21), "workspace1");
assertEquals(registry.getWorkspaceId(token22), "workspace2");
}
}
Loading