Draft: implement space-owned service-account lifecycle and runtime identity

app/actions/app_assign_service_account.rb

@@ -0,0 +1,64 @@
+require 'repositories/service_account_event_repository'
+
+module VCAP::CloudController
+  class AppAssignServiceAccount
+    class Error < StandardError; end
+    class Unauthorized < Error; end
+    class Conflict < Error; end
+
+    def initialize(permissions, actor: nil)
+      @permissions = permissions
+      @actor = actor
+    end
+
+    def assign(app, account, provision: false)
+      job = nil
+      app.db.transaction do
+        app.lock!
+        raise Unauthorized.new('not authorized to update the app') unless @permissions.can_write_to_active_space?(app.space.id)
+
+        if account
+          account.lock!
+          raise Conflict.new('account must belong to the app owning space') unless account.space_guid == app.space_guid
+
+          validate_ready!(account, provision)
+          raise Conflict.new('another service account is already assigned; unbind first') if app.service_account_guid && app.service_account_guid != account.guid
+
+          job = provision_account(account) unless account.status == 'ready'
+        end
+
+        unless app.service_account_guid == account&.guid
+          previous_guid = app.service_account_guid
+          app.update(service_account: account)
+          record_assignment(app, account, previous_guid) if @actor
+        end
+      end
+      provision ? job : app
+    end
+
+    private
+
+    def record_assignment(app, account, previous_guid)
+      Repositories::ServiceAccountEventRepository.record(
+        app, account ? 'assign' : 'unassign', @actor,
+        service_account_guid: account&.guid || previous_guid
+      )
+    end
+
+    def validate_ready!(account, provision)
+      raise Conflict.new('service account is not ready or enabled') unless account.enabled && (account.status == 'ready' || provision)
+
+      if PollableJobModel.where(resource_guid: account.guid, resource_type: 'service_account', state: %w[PROCESSING POLLING]).exclude(operation: 'service_account.provision').any?
+        raise Conflict.new('service account lifecycle operation is in progress')
+      end
+    end
+
+    def provision_account(account)
+      job = PollableJobModel.first(resource_guid: account.guid, operation: 'service_account.provision', state: %w[PROCESSING POLLING])
+      return job if job
+
+      account.update(status: 'reconciling')
+      Jobs::Enqueuer.new(queue: Jobs::Queues.generic).enqueue_pollable(Jobs::V3::ServiceAccountProvision.new(account.guid))
+    end
+  end
+end

app/actions/process_restart.rb

@@ -14,7 +14,7 @@ def restart(process:, config:, stop_in_runtime:, revision: nil)
             runners(config).runner_for_process(process).stop
           end
 
-          process.update(state: ProcessModel::STARTED, revision: revision_to_set)
+          process.update(state: ProcessModel::STARTED, revision: revision_to_set, service_account_guid: process.app.service_account_guid, service_account_snapshot: true)
           runners(config).runner_for_process(process).start
         end
       end

app/actions/service_account_creation_budget.rb

@@ -0,0 +1,25 @@
+module VCAP::CloudController
+  class ServiceAccountCreationBudget
+    WINDOW = 7.days
+
+    def self.consume(principal, exempt:)
+      return yield if exempt
+
+      # Lock the authenticated principal, not a space: requests on different API
+      # instances and in different spaces must share one atomic budget.
+      principal.lock!
+      now = Time.now.utc
+      creations = ServiceAccountModel.db[:service_account_creations]
+      limit = Config.config.get(:service_account_creation_limit) || -1
+      used = creations.where(principal_guid: principal.guid).where { created_at > now - WINDOW }.count
+      raise CloudController::Errors::V3::ApiError.new_from_details('ServiceAccountCreationLimitExceeded') if limit.between?(0, used)
+
+      result = yield
+      # Independent of accounts, tombstones and audit-event retention. Failed
+      # creations roll this back; successful deletions never refund the budget.
+      creations.insert(principal_guid: principal.guid, created_at: now) # rubocop:disable Rails/SkipsModelValidations -- Transactional creation ledger, not an ActiveRecord model.
+      creations.where(principal_guid: principal.guid).where { created_at <= now - WINDOW }.delete
+      result
+    end
+  end
+end

app/actions/service_account_provision.rb

@@ -0,0 +1,112 @@
+module VCAP::CloudController
+  class ServiceAccountProvision
+    class Conflict < StandardError; end
+
+    def initialize(clients, identity_ca:)
+      @clients = clients
+      @identity_ca = identity_ca
+    end
+
+    def provision(account)
+      failure = nil
+      account.db.transaction(savepoint: true) do
+        account.lock!
+        raise Conflict.new('service account is disabled') unless account.enabled
+
+        begin
+          account.db.transaction(savepoint: true) do
+            principal = User.first(guid: account.client_id)
+            raise Conflict.new('principal identity collision') if principal && !principal.is_oauth_client
+
+            desired = registration(account)
+            existing = existing_client(account.client_id)
+            if existing
+              raise Conflict.new('client identity collision') unless matching_registration?(existing, desired)
+            else
+              @clients.add(:client, desired)
+            end
+
+            User.create(guid: account.client_id, is_oauth_client: true, active: true) unless principal
+            account.update(status: 'ready')
+          end
+        rescue StandardError => e
+          failure = e
+          account.reload.update(status: 'failed')
+        end
+      end
+      raise failure if failure
+
+      account
+    end
+
+    def deprovision(account, delete: false)
+      failure = nil
+      account.db.transaction(savepoint: true) do
+        account.lock!
+        raise Conflict.new('service account was enabled again') if account.enabled
+        raise Conflict.new('service account is still assigned or in use') if delete && account.in_use?
+
+        begin
+          account.db.transaction(savepoint: true) do
+            principal = User.first(guid: account.client_id)
+            raise Conflict.new('principal identity collision') if principal && !principal.is_oauth_client
+
+            existing = existing_client(account.client_id)
+            if existing
+              raise Conflict.new('client identity collision') unless matching_registration?(existing, registration(account))
+
+              @clients.delete(:client, account.client_id)
+            end
+            if delete
+              principal&.destroy
+              account.destroy
+            else
+              account.update(status: 'disabled')
+            end
+          end
+        rescue StandardError => e
+          failure = e
+          account.reload.update(status: 'failed')
+        end
+      end
+      raise failure if failure
+    end
+
+    private
+
+    def matching_registration?(existing, desired)
+      tls_keys = existing.keys.select { |key| key.start_with?('tls-client-auth-', 'tls_client_auth_') }
+      return false unless tls_keys.sort == desired.keys.grep(/\Atls[-_]/).sort
+
+      desired.all? do |key, value|
+        actual = existing[key]
+        actual = [] if key == 'scope' && !existing.key?(key)
+        actual = [] if key == 'scope' && actual == ['uaa.none']
+        if value.is_a?(Array)
+          actual.is_a?(Array) && actual.all? { |entry| entry.is_a?(String) } && actual.sort == value.sort
+        else
+          actual == value
+        end
+      end
+    end
+
+    def existing_client(client_id)
+      @clients.get(:client, client_id)
+    rescue CF::UAA::NotFound
+      nil
+    end
+
+    def registration(account)
+      {
+        'client_id' => account.client_id,
+        'authorized_grant_types' => ['client_credentials'],
+        'authorities' => %w[cloud_controller.read cloud_controller.write],
+        'scope' => [],
+        'access_token_validity' => 300,
+        'tls-client-auth-ca' => @identity_ca,
+        'tls_client_auth_san_dns' => account.certificate_dns_san,
+        'cf_service_account_guid' => account.guid
+      }
+    end
+  end
+end

app/actions/space_delete.rb

@@ -1,5 +1,6 @@
 require 'actions/v3/service_instance_delete'
 require 'jobs/v3/delete_service_instance_job'
+require 'repositories/service_account_event_repository'
 
 module VCAP::CloudController
   class SpaceDelete
@@ -24,6 +25,11 @@ def delete(dataset)
 
         next unless instance_delete_errors.empty? && instance_unshare_errors.empty?
 
+        account_delete_errors = delete_service_accounts(space_model)
+        err = accumulate_space_deletion_error(account_delete_errors, space_model.name)
+        errors << err unless err.nil?
+        next unless account_delete_errors.empty?
+
         Space.db.transaction do
           delete_apps(space_model)
           space_model.destroy
@@ -76,7 +82,36 @@ def unshare_service_instances(space_model)
     end
 
     def delete_apps(space_model)
-      AppDelete.new(@user_audit_info).delete(space_model.app_models)
+      AppDelete.new(@user_audit_info).delete(space_model.app_models_dataset.all)
+    end
+
+    def delete_service_accounts(space_model)
+      accounts = ServiceAccountModel.where(space_guid: space_model.guid).order(:guid).all
+      return [] if accounts.empty?
+
+      ServiceAccountModel.db.transaction do
+        accounts.each do |account|
+          account.lock!
+          if PollableJobModel.where(resource_guid: account.guid, resource_type: 'service_account', state: %w[PROCESSING POLLING]).any?
+            raise ServiceAccountProvision::Conflict.new('service account operation is already in progress')
+          end
+
+          account.update(enabled: false, status: 'deleting')
+        end
+      end
+
+      # AppDelete removes service bindings, tasks and process snapshots. Do not
+      # roll this back if later UAA cleanup fails: retries must see real progress.
+      delete_apps(space_model)
+      provisioner = CloudController::DependencyLocator.instance.service_account_provisioner
+      accounts.each_with_object([]) do |account, errors|
+        Repositories::ServiceAccountEventRepository.record(account, 'delete', @user_audit_info, { recursive: true })
+        provisioner.deprovision(account, delete: true)
+      rescue StandardError => e
+        errors << e
+      end
+    rescue StandardError => e
+      [e]
     end
 
     def delete_service_brokers(space_model)

app/actions/task_create.rb

@@ -24,6 +24,8 @@ def create(app, message, user_audit_info, droplet: nil)
         task = TaskModel.create(
           name: use_requested_name_or_generate_name(message),
           app: app,
+          service_account_guid: app.service_account_guid,
+          service_account_snapshot: true,
           state: TaskModel::PENDING_STATE,
           droplet: droplet,
           command: command(message, template_process),

app/collection_transformers/username_populator.rb

@@ -8,9 +8,11 @@ def initialize(uaa_client)
 
     def transform(users, _opts={})
       users = Array(users)
-      user_ids = users.collect(&:guid)
-      username_mapping = uaa_client.usernames_for_ids(user_ids)
-      users.each { |user| user.username = username_mapping[user.guid] }
+      accounts = ServiceAccountModel.where(name: users.select(&:is_oauth_client).map { |user| user.guid.delete_prefix('cf:service-account:') }).all
+      account_names = accounts.to_h { |account| [account.client_id, account.name] }
+      human_users = users.reject { |user| user.is_oauth_client && account_names.key?(user.guid) }
+      username_mapping = human_users.empty? ? {} : uaa_client.usernames_for_ids(human_users.collect(&:guid))
+      users.each { |user| user.username = user.is_oauth_client && account_names.key?(user.guid) ? account_names[user.guid] : username_mapping[user.guid] }
     end
   end
 end

app/controllers/v3/app_service_accounts_controller.rb

@@ -0,0 +1,43 @@
+require 'actions/app_assign_service_account'
+require 'messages/app_service_account_update_message'
+require 'fetchers/app_fetcher'
+require 'jobs/v3/service_account_provision'
+
+class AppServiceAccountsController < ApplicationController
+  def show
+    app, = fetch_readable_app
+    render status: :ok, json: relationship(app)
+  end
+
+  def update
+    app, space = fetch_readable_app
+    unauthorized! unless permission_queryer.can_write_to_active_space?(space.id)
+    require_writable_space!(space)
+    message = AppServiceAccountUpdateMessage.new(hashed_params[:body])
+    unprocessable!(message.errors.full_messages) unless message.valid?
+
+    account = ServiceAccountModel.where(guid: message.account_guid).first if message.account_guid
+    resource_not_found!(:service_account) if message.account_guid && !account
+    job = AppAssignServiceAccount.new(permission_queryer, actor: user_audit_info).assign(app, account, provision: Config.config.get(:service_account_provisioning_enabled) == true)
+    add_warning_headers(["Restart #{app.name} for the service-account assignment change to take effect."])
+    return head :accepted, 'Location' => url_builder.build_url(path: "/v3/jobs/#{job.guid}") if job.is_a?(PollableJobModel)
+
+    render status: :ok, json: relationship(app)
+  rescue AppAssignServiceAccount::Unauthorized
+    unauthorized!
+  rescue AppAssignServiceAccount::Conflict => e
+    raise CloudController::Errors::V3::ApiError.new_from_details('ServiceAccountAssignmentConflict', e.message)
+  end
+
+  private
+
+  def fetch_readable_app
+    app, space = AppFetcher.new.fetch(hashed_params[:app_guid])
+    resource_not_found!(:app) unless app && permission_queryer.can_read_from_space?(space.id, space.organization_id)
+    [app, space]
+  end
+
+  def relationship(app)
+    { data: app.service_account_guid ? { guid: app.service_account_guid } : nil }
+  end
+end