coder/provisionersdk/tfpath/tfpath.go

package tfpath

import (
	"archive/tar"
	"bytes"
	"context"
	"fmt"
	"hash/crc32"
	"io"
	"os"
	"path/filepath"
	"strings"
	"time"

	"github.com/spf13/afero"
	"golang.org/x/xerrors"

	"cdr.dev/slog/v3"
)

const (
	// ReadmeFile is the location we look for to extract documentation from template versions.
	ReadmeFile = "README.md"

	sessionDirPrefix      = "Session"
	staleSessionRetention = 7 * 24 * time.Hour
)

// Session creates a directory structure layout for terraform execution. The
// SessionID is a unique value for creating an ephemeral working directory inside
// the parentDirPath. All helper functions will return paths for various
// terraform asserts inside this working directory.
func Session(parentDirPath, sessionID string) Layout {
	return Layout(filepath.Join(parentDirPath, sessionDirPrefix+sessionID))
}

// Layout is the terraform execution working directory structure.
// It also contains some methods for common file operations within that layout.
// Such as "Cleanup" and "ExtractArchive".
// TODO: Maybe we should include the afero.FS here as well, then all operations
// would be on the same FS?
type Layout string

// WorkDirectory returns the root working directory for Terraform files.
func (l Layout) WorkDirectory() string { return string(l) }

func (l Layout) StateFilePath() string {
	return filepath.Join(l.WorkDirectory(), "terraform.tfstate")
}

func (l Layout) PlanFilePath() string {
	return filepath.Join(l.WorkDirectory(), "terraform.tfplan")
}

func (l Layout) TerraformLockFile() string {
	return filepath.Join(l.WorkDirectory(), ".terraform.lock.hcl")
}

func (l Layout) ReadmeFilePath() string {
	return filepath.Join(l.WorkDirectory(), ReadmeFile)
}

func (l Layout) TerraformMetadataDir() string {
	return filepath.Join(l.WorkDirectory(), ".terraform")
}

func (l Layout) ModulesDirectory() string {
	return filepath.Join(l.TerraformMetadataDir(), "modules")
}

func (l Layout) ModulesFilePath() string {
	return filepath.Join(l.ModulesDirectory(), "modules.json")
}

// ExtractArchive extracts the provided template source archive and modules archive into the working directory.
// `modulesArchive` is optional and can be nil or empty.
func (l Layout) ExtractArchive(ctx context.Context, logger slog.Logger, fs afero.Fs, templateSourceArchive, modulesArchive []byte) error {
	err := extractArchive(ctx, logger, fs, l.WorkDirectory(), templateSourceArchive)
	if err != nil {
		return xerrors.Errorf("extract template source archive: %w", err)
	}

	if len(modulesArchive) > 0 {
		err = extractArchive(ctx, logger, fs, l.WorkDirectory(), modulesArchive)
		if err != nil {
			return xerrors.Errorf("extract modules archive: %w", err)
		}
	}
	return nil
}

func isValidSessionDir(dirName string) bool {
	match, err := filepath.Match(sessionDirPrefix+"*", dirName)
	return err == nil && match
}

func extractArchive(ctx context.Context, logger slog.Logger, fs afero.Fs, directory string, archive []byte) error {
	logger.Info(ctx, "unpacking source archive",
		slog.F("size_bytes", len(archive)),
	)

	err := fs.MkdirAll(directory, 0o700)
	if err != nil {
		return xerrors.Errorf("create work directory %q: %w", directory, err)
	}

	reader := tar.NewReader(bytes.NewBuffer(archive))
	for {
		header, err := reader.Next()
		if err != nil {
			if xerrors.Is(err, io.EOF) {
				break
			}
			return xerrors.Errorf("read template source archive: %w", err)
		}
		logger.Debug(context.Background(), "read archive entry",
			slog.F("name", header.Name),
			slog.F("mod_time", header.ModTime),
			slog.F("size", header.Size))

		// Security: don't untar absolute or relative paths, as this can allow a malicious tar to overwrite
		// files outside the workdir.
		if !filepath.IsLocal(header.Name) {
			return xerrors.Errorf("refusing to extract to non-local path")
		}

		// nolint: gosec // Safe to no-lint because the filepath.IsLocal check above.
		headerPath := filepath.Join(directory, header.Name)
		if !strings.HasPrefix(headerPath, filepath.Clean(directory)) {
			return xerrors.New("tar attempts to target relative upper directory")
		}
		mode := header.FileInfo().Mode()
		if mode == 0 {
			mode = 0o600
		}

		// Always check for context cancellation before reading the next header.
		// This is mainly important for unit tests, since a canceled context means
		// the underlying directory is going to be deleted. There still exists
		// the small race condition that the context is canceled after this, and
		// before the disk write.
		if ctx.Err() != nil {
			return xerrors.Errorf("context canceled: %w", ctx.Err())
		}
		switch header.Typeflag {
		case tar.TypeDir:
			err = fs.MkdirAll(headerPath, mode)
			if err != nil {
				return xerrors.Errorf("mkdir %q: %w", headerPath, err)
			}
			logger.Debug(context.Background(), "extracted directory",
				slog.F("path", headerPath),
				slog.F("mode", fmt.Sprintf("%O", mode)))
		case tar.TypeReg:
			file, err := fs.OpenFile(headerPath, os.O_CREATE|os.O_RDWR, mode)
			if err != nil {
				return xerrors.Errorf("create file %q (mode %s): %w", headerPath, mode, err)
			}

			hash := crc32.NewIEEE()
			hashReader := io.TeeReader(reader, hash)
			// Max file size of 10MiB.
			size, err := io.CopyN(file, hashReader, 10<<20)
			if xerrors.Is(err, io.EOF) {
				err = nil
			}
			if err != nil {
				_ = file.Close()
				return xerrors.Errorf("copy file %q: %w", headerPath, err)
			}
			err = file.Close()
			if err != nil {
				return xerrors.Errorf("close file %q: %s", headerPath, err)
			}
			logger.Debug(context.Background(), "extracted file",
				slog.F("size_bytes", size),
				slog.F("path", headerPath),
				slog.F("mode", mode),
				slog.F("checksum", fmt.Sprintf("%x", hash.Sum(nil))))
		}
	}

	return nil
}

// Cleanup removes the work directory and all of its contents.
func (l Layout) Cleanup(ctx context.Context, logger slog.Logger, fs afero.Fs) {
	var err error
	path := l.WorkDirectory()

	for attempt := 0; attempt < 5; attempt++ {
		err := fs.RemoveAll(path)
		if err != nil {
			// On Windows, open files cannot be removed.
			// When the provisioner daemon is shutting down,
			// it may take a few milliseconds for processes to exit.
			// See: https://github.com/golang/go/issues/50510
			logger.Debug(ctx, "failed to clean work directory; trying again", slog.Error(err))
			// TODO: Should we abort earlier if the context is done?
			time.Sleep(250 * time.Millisecond)
			continue
		}
		logger.Debug(ctx, "cleaned up work directory")
		return
	}

	// Returning an error at this point cannot do any good. The caller cannot resolve
	// this. There is a routine cleanup task that will remove old work directories
	// when this fails.
	logger.Error(ctx, "failed to clean up work directory after multiple attempts",
		slog.F("path", path), slog.Error(err))
}

// CleanStaleSessions browses the work directory searching for stale session
// directories. Coder provisioner is supposed to remove them once after finishing the provisioning,
// but there is a risk of keeping them in case of a failure.
func (l Layout) CleanStaleSessions(ctx context.Context, logger slog.Logger, fs afero.Fs, now time.Time) error {
	parent := filepath.Dir(l.WorkDirectory())
	entries, err := afero.ReadDir(fs, filepath.Dir(l.WorkDirectory()))
	if err != nil {
		return xerrors.Errorf("can't read %q directory", parent)
	}

	for _, fi := range entries {
		dirName := fi.Name()

		if fi.IsDir() && isValidSessionDir(dirName) {
			sessionDirPath := filepath.Join(parent, dirName)

			modTime := fi.ModTime() // fallback to modTime if modTime is not available (afero)

			if modTime.Add(staleSessionRetention).After(now) {
				continue
			}

			logger.Info(ctx, "remove stale session directory", slog.F("session_path", sessionDirPath))
			err = fs.RemoveAll(sessionDirPath)
			if err != nil {
				// This should not be a fatal error. If it is, the provisioner would be rendered
				// non-functional until this directory is cleaned up. Ideally there would be a
				// way to escalate this to an operator alert in Coder. Until then, the best we
				// can do is log it on every cleanup attempt (every build). Eventually the disk
				// usage will be noticeable, and hopefully these logs are noticed.
				logger.Error(ctx, "failed to remove stale session directory",
					slog.F("directory", sessionDirPath),
					slog.Error(err),
				)

				if l.WorkDirectory() == sessionDirPath {
					// This should never happen because sessions are uuid's. But if that logic ever
					// changes, this would be a bad state to be in. The directory that the
					// provisioner is going to use cannot be stale.
					return xerrors.Errorf("remove %q directory, will not work inside a stale directory: %w", sessionDirPath, err)
				}
			}
		}
	}
	return nil
}