Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add 'apiclient exec' for running commands in host containers #1802

Merged
merged 4 commits into from Nov 10, 2021

Conversation

tjkirch
Copy link
Contributor

@tjkirch tjkirch commented Nov 3, 2021

Issue number:

Fixes #367.

Description of changes:

* 7978bd23 apiserver: fix outdated comment about access lock

* 2897fb55 apiserver: renamed SharedDataStore to SharedData
This better reflects its purpose of sharing non-request data with
handlers; it's not just for a datastore handle.

* 24c8a598 Add high-level documentation for 'apiclient exec'

* 4d98b311 Add 'apiclient exec' for running commands in host containers
This allows containers with API access to run commands in other host
containers.  For example, `apiclient exec admin bash` gives you a shell
in the admin container from the control container.

Briefly stated, apiclient requests exec, and apiserver spawns and
manages a child process, with process data and control messages going
through a WebSocket.

This lets users run commands in other host containers. I expect the most common use will be to go from the control container to the admin container via apiclient exec admin bash (or an upcoming helper script) but it's flexible and can be used to copy files (exec cat > file) or many other things.

Reviewer's note: it may be helpful to review the high-level documentation (in Markdown files) before the code, as there are user-level examples and a developer's guide.

Note: separately, I'm working on another helper script for the control container that enables admin, waits for it, and execs you in.

Testing done:

Unit tests pass. Ran aws-k8s-1.17 aarch64 and aws-k8s-1.21 x86_64 and confirmed nodes are healthy.

Ran a bunch of exec tests; nesting shells, editing with vi, robotfindskitten, some tricks like exec gunzip <file.gz >file to pass bigger data, resizing terminals, etc. It works pretty well, basically like ssh.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

This better reflects its purpose of sharing non-request data with
handlers; it's not just for a datastore handle.
Copy link
Contributor

@bcressey bcressey left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review for everything except the server side.

sources/api/api-exec.md Show resolved Hide resolved
sources/api/apiclient/src/exec.rs Outdated Show resolved Hide resolved
sources/api/apiclient/src/exec.rs Outdated Show resolved Hide resolved
sources/api/apiclient/src/exec.rs Show resolved Hide resolved
sources/api/apiclient/src/exec.rs Outdated Show resolved Hide resolved
sources/api/apiclient/src/exec.rs Outdated Show resolved Hide resolved
sources/api/apiclient/src/exec.rs Show resolved Hide resolved
sources/api/apiclient/src/exec.rs Outdated Show resolved Hide resolved
sources/api/apiclient/src/exec/terminal.rs Show resolved Hide resolved
sources/api/apiclient/src/exec/terminal.rs Show resolved Hide resolved
@tjkirch
Copy link
Contributor Author

tjkirch commented Nov 5, 2021

^ This push attempts to address @bcressey's concerns.

Copy link
Contributor

@etungsten etungsten left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🍨

@tjkirch tjkirch requested a review from bcressey November 8, 2021 20:42
Copy link
Contributor

@zmrow zmrow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🍰

Copy link
Member

@webern webern left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be hard for me to spot anything out of place in this code as to domain is quite difficult. But having looked over it here and gone over it with you 1:1, it looks great to me. Nice work!

sources/api/apiclient/src/exec.rs Outdated Show resolved Hide resolved
This allows containers with API access to run commands in other host
containers.  For example, `apiclient exec admin bash` gives you a shell
in the admin container from the control container.

Briefly stated, apiclient requests exec, and apiserver spawns and
manages a child process, with process data and control messages going
through a WebSocket.
@tjkirch
Copy link
Contributor Author

tjkirch commented Nov 9, 2021

^ This push fixes a typo caught by @webern.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Access between host containers
5 participants