configgin 0.18.8 → 0.19.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA256:
-  metadata.gz: 2e70a7d6e242d2f2691bba12d072af5442efdd537cf3f988fda4e030969e2fe1
-  data.tar.gz: 5e9e91192282a6719a07eabdc42137accff2f783c1141572d799783e5f09d749
+SHA1:
+  metadata.gz: 7afff002f44ef79e750661a23265886a989243c3
+  data.tar.gz: 9b9c28a4869c3d35b9ff0bb029a11f2f40aac885
 SHA512:
-  metadata.gz: 8e6a1c5d754ec99154d9d316679bcc05029120bd8b0ce3afc3b1540e450e5611566612278d2e59b4c5a98a0814d8e58782221835d9b3ffc7c9022a53f1c8692f
-  data.tar.gz: b1868d689cd5de377c1e6cf6deb3468d41895f75c65de8175ec93eb15396b5bafa2a8908384bfdff836646b6cb9aadc15e11faf0a4ecb268eded615f271b13c0
+  metadata.gz: 8883388252e21304d58e981bd14119b1f6944ab111ed5ed43b1bf1d8733c05199fc7eb3ea31faaeff590362cf64e1fe3ee03584aa294c71b0256b0e98727662d
+  data.tar.gz: 8f5fc2c019b7c4d1429c41cc95e2d2dac09b688b24803538b4d8c4cb09e5e87c732f2e6ecfcad98c71db3a67412d72178bb354c0a8aa4722855cecc89e2ea4dc

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    configgin (0.18.8)
+    configgin (0.19.0)
       bosh-template (~> 2.0)
       deep_merge (~> 1.1)
       kubeclient (~> 2.0)

data/lib/configgin.rb

@@ -1,3 +1,4 @@
+require 'base64'
 require 'json'
 
 require_relative 'cli'
@@ -59,23 +60,43 @@ class Configgin
 
   # Set the exported properties and their digests, and return the digests.
   def patch_job_metadata(jobs)
+    pod = kube_client.get_pod(@self_name, kube_namespace)
+
+    secret = Kubeclient::Resource.new
+    secret.metadata = {}
+    # Prefixing with pod.metadata.name is purely for human convenience/debugging.
+    secret.metadata.name = "#{pod.metadata.name}-#{pod.metadata.uid}"
+    secret.metadata.namespace = kube_namespace
+
+    # Make sure the secret gets removed when the pod is deleted.
+    secret.metadata.ownerReferences = [
+      {
+        apiVersion: pod.apiVersion,
+        blockOwnerDeletion: false,
+        controller: false,
+        kind: pod.kind,
+        name: pod.metadata.name,
+        uid: pod.metadata.uid,
+      }
+    ]
+
+    secret.data = {}
     digests = {}
     jobs.each do |name, job|
-      digest = property_digest(job.exported_properties)
-      kube_client.patch_pod(
-        @self_name,
-        {
-          metadata: {
-            annotations: {
-              :"skiff-exported-properties-#{name}" => job.exported_properties.to_json,
-              :"skiff-exported-digest-#{name}" => digest
-            }
-          }
-        },
-        kube_namespace
-      )
-      digests[name] = digest
+      digests[name] = property_digest(job.exported_properties)
+      secret.data["skiff-exported-properties-#{name}"] = Base64.encode64(job.exported_properties.to_json)
+      secret.data["skiff-exported-digest-#{name}"] = Base64.encode64(digests[name])
     end
+
+    # Only the main container gets to export properties; colocated sidecars don't.
+    if instance_group == ENV["KUBERNETES_CONTAINER_NAME"]
+      begin
+        kube_client.delete_secret(secret.metadata.name, kube_namespace)
+      rescue
+      end
+      kube_client.create_secret(secret)
+    end
+
     digests
   end
 

data/lib/configgin/version.rb

@@ -1,3 +1,3 @@
 class Configgin
-  VERSION = '0.18.8'.freeze
+  VERSION = '0.19.0'.freeze
 end

data/lib/kube_link_generator.rb

@@ -1,3 +1,4 @@
+require 'base64'
 require 'digest/sha1'
 require 'kubeclient'
 require 'uri'
@@ -63,10 +64,13 @@ class KubeLinkSpecs
           pods = _get_pods_for_role(role_name, sts_image)
           good_pods = pods.select do |pod|
             next false unless pod.status.podIP
-            next true if pod.metadata.annotations["skiff-exported-properties-#{job}"]
+            begin
+              secret = client.get_secret("#{pod.metadata.name}-#{pod.metadata.uid}", namespace)
+              next true if secret.data["skiff-exported-properties-#{job}"]
 
-            # Fall back to non-job-specific properties, for upgrades from older versions
-            pod.metadata.annotations['skiff-exported-properties']
+            rescue
+              pod.metadata.annotations["skiff-exported-properties-#{job}"]
+            end
           end
 
           if options[:wait_for_all]
@@ -82,21 +86,40 @@ class KubeLinkSpecs
     end
   end
 
+  def patch_pod_with_imported_properties(role_name, job_name, digest)
+    client.patch_pod(
+      ENV['HOSTNAME'],
+      { metadata: { annotations: { :"skiff-in-props-#{role_name}-#{job_name}" => digest } } },
+      namespace
+    )
+  end
+
   def get_exported_properties(role_name, pod, job_name)
-    if pod.metadata.annotations["skiff-exported-properties-#{job_name}"]
+    # Exported properties are stored in a secret linked to the pod by naming convention.
+    begin
+      secret = client.get_secret("#{pod.metadata.name}-#{pod.metadata.uid}", namespace)
+    rescue
+    end
+
+    if !secret.nil?
+      digest = secret.data["skiff-exported-digest-#{job_name}"]
+      # digest not being set only happens during the spec tests???
+      if digest
+        # Copy the digest over, so that if the source role changes we can be restarted.
+        patch_pod_with_imported_properties(role_name, job_name, Base64.decode64(digest))
+      end
+      JSON.parse(Base64.decode64(secret.data["skiff-exported-properties-#{job_name}"]))
+
+    # Older implementation stored exported properties in annotations (one per job).
+    elsif pod.metadata.annotations["skiff-exported-properties-#{job_name}"]
+      # digest not being set only happens during the spec tests???
       if pod.metadata.annotations["skiff-exported-digest-#{job_name}"]
-        # Copy the digest over, so that if the source role changes we can be
-        # restarted.
+        # Copy the digest over, so that if the source role changes we can be restarted.
         digest = pod.metadata.annotations["skiff-exported-digest-#{job_name}"]
-        client.patch_pod(
-          ENV['HOSTNAME'],
-          { metadata: { annotations: { :"skiff-in-props-#{role_name}-#{job_name}" => digest } } },
-          namespace
-        )
+        patch_pod_with_imported_properties(role_name, job_name, digest)
       end
       JSON.parse(pod.metadata.annotations["skiff-exported-properties-#{job_name}"])
-    elsif pod.metadata.annotations['skiff-exported-properties']
-      JSON.parse(pod.metadata.annotations['skiff-exported-properties'])[job_name]
+
     else
       {}
     end

data/update-stemcell.sh

@@ -11,7 +11,8 @@
 
 set -o errexit -o nounset
 
-REPO="${REPO:-../../github.com/SUSE/scf}"
+: "${HELM:=helm}"
+: "${REPO:=../scf}"
 
 REPO="$( cd "${REPO}" && echo "${PWD}" )"
 IMAGE="$( cd "${REPO}" && source .envrc && echo "${FISSILE_STEMCELL}" )"
@@ -42,9 +43,9 @@ vagrant_ready=""
 if test -z "${NO_RUN:-}" ; then
     if ( cd "${REPO}" && (vagrant status 2>/dev/null | grep --quiet running) ) ; then
         vagrant_ready="true"
-        releases=$(helm list --short)
+        releases=$("${HELM}" list --short)
         if test -n "${releases}" ; then
-            helm delete --purge ${releases}
+            "${HELM}" delete --purge ${releases}
         fi
         kubectl delete ns cf ||:
         kubectl delete ns uaa ||:
@@ -100,7 +101,7 @@ vagrant ssh -- -tt <<EOF
         sleep 1
     done
     docker images --format={{.Repository}}:{{.Tag}} | \
-        grep -E '/scf-|role-packages' | \
+        grep -E '/scf-|uaa-|role-packages' | \
         xargs --no-run-if-empty docker rmi -f
     docker images | \
         awk '/<none>/ { print \$3 }' | \

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: configgin
 version: !ruby/object:Gem::Version
-  version: 0.18.8
+  version: 0.19.0
 platform: ruby
 authors:
 - SUSE
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-08-21 00:00:00.000000000 Z
+date: 2019-10-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -182,7 +182,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 2.6.13
 signing_key: 
 specification_version: 4
 summary: A simple cli app in Ruby to generate configurations using BOSH ERB templates