[A2-572] Add 'viewer' and 'editor' users to local-dev and dev/acceptance envs, add --skip-policy-migration to upgrade-to-v2

.studiorc

@@ -117,7 +117,7 @@ GETTING_STARTED
 
 # Memory check. Because we all always forget to change the docker preferences
 # when we re-install it
-total_memory_kb=$(cat /proc/meminfo | grep MemTotal | grep -o -E '[[:digit:]]+')
+total_memory_kb=$(grep MemTotal /proc/meminfo | grep -o -E '[[:digit:]]+')
 # 8 gigs == 8164340kb, subtract a few kb so we can just do a less than comp
 if (( $total_memory_kb < 8164000 )); then
   warn "!!!"
@@ -128,13 +128,16 @@ fi
 
 document "start_all_services" <<DOC
   Simple wrapper for 'start_deployment_service' and 'chef-automate dev deployinate'.
+  Also applies a license (if present), creates IAM v2 dev users, and upgrades IAM to v2.
 DOC
 function start_all_services() {
   start_deployment_service
   chef-automate dev deployinate
   if [[ -f "/src/dev/license.jwt" ]]; then
      chef-automate license apply "/src/dev/license.jwt"
   fi
+  chef-automate dev create-iam-dev-users
+  chef-automate iam upgrade-to-v2 --skip-policy-migration
 }
 
 document "get_admin_token" <<DOC

api/interservice/authz/v2/policy.proto

@@ -225,6 +225,7 @@ enum Flag {
 
 message MigrateToV2Req {
     Flag flag = 1;
+    bool skip_v1_policies = 2;
 }
 message MigrateToV2Resp {
     repeated string reports = 1;

components/authz-service/server/v2/migration.go

@@ -3,7 +3,6 @@ package v2
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 
 	"github.com/pkg/errors"
@@ -54,7 +53,7 @@ func (s *policyServer) migrateV1Policies(ctx context.Context) ([]error, error) {
 			if err := s.addTokenToAdminPolicy(ctx, adminTokenPolicy.Subjects[0]); err != nil {
 				errs = append(errs, errors.Wrapf(err, "adding members %q for admin policy %q", pol.Subjects, pol.ID.String()))
 			}
-			continue //don't migrate admin policies with single token
+			continue // don't migrate admin policies with single token
 		}
 		storagePol, err := migrateV1Policy(pol)
 		if err != nil {
@@ -100,8 +99,7 @@ func (s *policyServer) addTokenToAdminPolicy(ctx context.Context, tok string) er
 }
 
 func checkForAdminTokenPolicy(pol *storage_v1.Policy) (*storage_v1.Policy, error) {
-	var tokenRE = regexp.MustCompile(`^token`)
-	if pol.Action == "*" && pol.Resource == "*" && len(pol.Subjects) == 1 && tokenRE.MatchString(pol.Subjects[0]) {
+	if pol.Action == "*" && pol.Resource == "*" && len(pol.Subjects) == 1 && strings.HasPrefix(pol.Subjects[0], "token:") {
 		return pol, nil
 	}
 	return nil, nil

components/authz-service/server/v2/policy.go

@@ -2,6 +2,7 @@ package v2
 
 import (
 	"context"
+	"fmt"
 	"strings"
 
 	"github.com/pkg/errors"
@@ -556,14 +557,27 @@ func (s *policyServer) MigrateToV2(ctx context.Context,
 		}
 	}
 
-	errs, err := s.migrateV1Policies(ctx)
-	if err != nil {
-		recordFailure()
-		return nil, status.Errorf(codes.Internal, "migrate v1 policies: %s", err.Error())
-	}
-	reports := make([]string, len(errs))
-	for i, e := range errs {
-		reports[i] = e.Error()
+	var reports []string
+	if !req.SkipV1Policies {
+		errs, err := s.migrateV1Policies(ctx)
+		if err != nil {
+			recordFailure()
+			return nil, status.Errorf(codes.Internal, "migrate v1 policies: %s", err.Error())
+		}
+		for _, e := range errs {
+			reports = append(reports, e.Error())
+		}
+	} else {
+		// Note 2019/05/22 (sr): policies without subjects are silently ignored -- this
+		// is to be in line with the migration case, that does the same. However, this
+		// could be worth revisiting?
+		pols, err := s.v1.ListPoliciesWithSubjects(ctx)
+		if err != nil {
+			recordFailure()
+			return nil, status.Errorf(codes.Internal, "list v1 policies: %s", err.Error())
+		}
+		reports = append(reports, fmt.Sprintf("%d v1 policies", len(pols)))
+
 	}
 
 	err = s.store.ApplyV2DataMigrations(ctx)

components/authz-service/server/v2/policy_test.go

@@ -2226,6 +2226,23 @@ func TestMigrateToV2(t *testing.T) {
 			pol := getPolicyFromStore(t, policyStore, constants_v2.ComplianceTokenPolicyID)
 			assert.Equal(t, "[Legacy] Compliance Profile Access", pol.Name)
 		},
+		"legacy default and custom v1 policies are skipped when asked to skip them": func(t *testing.T) {
+			polID := genUUID(t)
+			v1List = v1Lister{pols: []*storage_v1.Policy{
+				wellknown(t, constants_v1.ComplianceTokenReadProfilesPolicyID),
+				{
+					ID:       polID,
+					Subjects: []string{"user:ldap:bob", "team:ldap:ops"},
+					Action:   "create",
+					Resource: "ingest:nodes",
+				},
+			}}
+
+			resp, err := cl.MigrateToV2(ctx, &api_v2.MigrateToV2Req{SkipV1Policies: true})
+			require.NoError(t, err)
+			assert.NotNil(t, resp)
+			assert.Equal(t, defaultPolicyCount, policyStore.ItemCount()) // nothing extra
+		},
 		// --------- migration status related tests ---------
 		"when no migration has been run, migration status is set to v1": func(t *testing.T) {
 			s, err := status.MigrationStatus(ctx)

components/automate-cli/cmd/chef-automate/dev.go

@@ -20,6 +20,8 @@ import (
 	dc "github.com/chef/automate/api/config/deployment"
 	w "github.com/chef/automate/api/config/shared/wrappers"
 	api "github.com/chef/automate/api/interservice/deployment"
+	"github.com/chef/automate/components/automate-cli/pkg/adminmgmt"
+	"github.com/chef/automate/components/automate-cli/pkg/client/apiclient"
 	"github.com/chef/automate/components/automate-cli/pkg/dev/hab"
 	"github.com/chef/automate/components/automate-cli/pkg/docs"
 	"github.com/chef/automate/components/automate-cli/pkg/status"
@@ -81,6 +83,7 @@ func init() {
 	devCmd.AddCommand(newVerifyPackagesCmd())
 	devCmd.AddCommand(newEnablePrometheusCmd())
 	devCmd.AddCommand(newDisablePrometheusCmd())
+	devCmd.AddCommand(newCreateIAMDevUsersCmd())
 	RootCmd.AddCommand(devCmd)
 }
 
@@ -940,6 +943,15 @@ func newDisablePrometheusCmd() *cobra.Command {
 	}
 }
 
+func newCreateIAMDevUsersCmd() *cobra.Command {
+	return &cobra.Command{
+		Use:   "create-iam-dev-users",
+		RunE:  runCreateIAMDevUsersCmd,
+		Short: `Create IAM v2 dev users ("viewer" and "editor") idempotently`,
+		Args:  cobra.NoArgs,
+	}
+}
+
 // Equivalent to patching the config with the following toml:
 // [deployment.v1.svc]
 // enable_dev_monitoring = true
@@ -974,3 +986,35 @@ func runDisablePrometheusCmd(*cobra.Command, []string) error {
 	}
 	return nil
 }
+
+func runCreateIAMDevUsersCmd(*cobra.Command, []string) error {
+	ctx := context.TODO()
+	apiClient, err := apiclient.OpenConnection(ctx)
+	if err != nil {
+		return err
+	}
+	for username, data := range map[string]struct {
+		displayName, password, team string
+	}{
+		"viewer": {"Viewer User", "chefautomate", "viewers"},
+		"editor": {"Editor User", "chefautomate", "editors"},
+	} {
+		userID, _, err := adminmgmt.CreateUserOrUpdatePassword(ctx,
+			apiClient, username, data.displayName, data.password, false /* dry run */)
+		if err != nil {
+			return err
+		}
+		// Note: the teams SHOULD exist. But since you never know what happens in a
+		// long running acceptance env, we'll better ensure them:
+		teamID, _, err := adminmgmt.EnsureTeam(ctx, data.team, data.team /* description */, apiClient, false /* dry run */)
+		if err != nil {
+			return err
+		}
+		_, err = adminmgmt.AddUserToTeam(ctx, apiClient, teamID, userID, false /* dry run */)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}

components/automate-cli/cmd/chef-automate/iam.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
 	"google.golang.org/grpc/codes"
 	grpc_status "google.golang.org/grpc/status"
 
@@ -20,10 +21,11 @@ import (
 )
 
 var iamCmdFlags = struct {
-	dryRun      bool
-	adminToken  bool
-	tokenID     string
-	betaVersion bool
+	dryRun            bool
+	adminToken        bool
+	tokenID           string
+	betaVersion       bool
+	skipLegacyUpgrade bool
 }{}
 
 func newIAMCommand() *cobra.Command {
@@ -93,17 +95,20 @@ func newIAMUpgradeToV2Cmd() *cobra.Command {
 		RunE: runIAMUpgradeToV2Cmd,
 		Args: cobra.ExactArgs(0),
 	}
+	cmd.PersistentFlags().BoolVar(
+		&iamCmdFlags.skipLegacyUpgrade,
+		"skip-policy-migration",
+		false,
+		"Do not migrate policies from IAM v1.")
 	cmd.PersistentFlags().BoolVar(
 		&iamCmdFlags.betaVersion,
 		"beta2.1",
 		false,
 		"Upgrade to version 2.1 with beta project authorization.")
-	err := cmd.PersistentFlags().MarkHidden("beta2.1")
-	// we could also ignore the lint error :shrug:
-	if err != nil {
-		fmt.Printf("failed configuring cobra: %s\n", err.Error())
-		panic(err.Error())
-	}
+
+	// all flags are hidden right now
+	cmd.PersistentFlags().VisitAll(func(f *pflag.Flag) { f.Hidden = !isDevMode() })
+
 	return cmd
 }
 
@@ -153,18 +158,27 @@ const alreadyMigratedMessage = `You have already upgraded to IAM %s.
   Then re-run this command.`
 
 func runIAMUpgradeToV2Cmd(cmd *cobra.Command, args []string) error {
+	label := map[bool]string{
+		true:  "v2.1",
+		false: "v2",
+	}
+
 	upgradeReq := &policies_req.UpgradeToV2Req{
-		Flag: policies_common.Flag_VERSION_2_0,
+		Flag:           policies_common.Flag_VERSION_2_0,
+		SkipV1Policies: iamCmdFlags.skipLegacyUpgrade,
 	}
-	isBetaVersion := iamCmdFlags.betaVersion
 
+	isBetaVersion := iamCmdFlags.betaVersion
 	if isBetaVersion {
 		upgradeReq.Flag = policies_common.Flag_VERSION_2_1
 		writer.Title("Enabling IAM v2.1")
 	} else {
 		writer.Title("Upgrading to IAM v2")
 	}
-	writer.Println("Migrating v1 policies...")
+
+	if !iamCmdFlags.skipLegacyUpgrade {
+		writer.Println("Migrating v1 policies...")
+	}
 
 	ctx := context.Background()
 	apiClient, err := apiclient.OpenConnection(ctx)
@@ -188,11 +202,7 @@ func runIAMUpgradeToV2Cmd(cmd *cobra.Command, args []string) error {
 		return status.Wrap(err, status.IAMUpgradeV2DatabaseError,
 			"Migration to IAM v2 already in progress")
 	case codes.AlreadyExists:
-		if isBetaVersion {
-			writer.Failf(alreadyMigratedMessage, "v2.1")
-		} else {
-			writer.Failf(alreadyMigratedMessage, "v2")
-		}
+		writer.Failf(alreadyMigratedMessage, label[isBetaVersion])
 		return nil
 	default: // something else: fail
 		return status.Wrap(err, status.IAMUpgradeV2DatabaseError,
@@ -222,10 +232,6 @@ func runIAMUpgradeToV2Cmd(cmd *cobra.Command, args []string) error {
 			"Failed to migrate teams service")
 	}
 
-	label := map[bool]string{
-		true:  "v2.1",
-		false: "v2",
-	}
 	writer.Successf("Enabled IAM %s", label[isBetaVersion])
 	return nil
 }
@@ -234,7 +240,7 @@ func outputReport(report string) {
 	// if it's got ":" in it, split on the first
 	parts := strings.SplitN(report, ":", 2)
 	writer.Body(parts[0])
-	if parts[1] != "" {
+	if len(parts) >= 2 {
 		writer.Body(strings.TrimSpace(parts[1]))
 	}
 }