configgin 0.19.1 → 0.19.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1bee5bef106cbdbfe6621409660761a4308781e779ecd28a6ab26244152b98cf
-  data.tar.gz: e330eedc131bef6ba4afb3803539c6e1b1424fabd70ef60a65a3abf609925577
+  metadata.gz: '0954b0d8fe5cfb4809934ffe2320c96e93e95cdd20e89f590f0714ca8b5e717c'
+  data.tar.gz: 84e9ff63af4eb3af8f33e80d740bef408b762fa163266ddb849e689f3126adcd
 SHA512:
-  metadata.gz: e5a9774eea477d8a6741850e7314bccffcefac603e530ced7526c6d20a64acade710b3984dd46664eff03612c8c2003994a6f3cd5c4f8846f85d7f1cf8752b72
-  data.tar.gz: e0578301581963b1a2db5dff6fd705104d89c3369e024a607c000e8f904925aba92f090e5f5ff0ee8d9973a19884f1a70b76a10fc8c97bbe38b44950be1db20a
+  metadata.gz: 2c89cd26245c367e7181067eed17764d9c43eb5cdd2c1ee990ae367e39dc69d82d3bf2f94755e58278903da78fc1c5c1ef45c9b4b1faf041c86d56eda81f6bc9
+  data.tar.gz: 0e1fef57272d7cce1b56101a1d088e99bf100e0adabbf929428e5ff196243be600c99c55a34eff9a192430326429e39004bfe403678e3c25d7e4e49e9ed03075

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    configgin (0.19.1)
+    configgin (0.19.2)
       bosh-template (~> 2.0)
       deep_merge (~> 1.1)
       kubeclient (~> 2.0)

data/lib/configgin.rb

@@ -24,9 +24,8 @@ class Configgin
 
   def run
     jobs = generate_jobs(@job_configs, @templates)
-    job_digests = patch_job_metadata(jobs)
+    export_job_properties(jobs)
     render_job_templates(jobs, @job_configs)
-    restart_affected_pods expected_annotations(@job_configs, job_digests)
   end
 
   def generate_jobs(job_configs, templates)
@@ -58,73 +57,86 @@ class Configgin
     jobs
   end
 
-  # Set the exported properties and their digests, and return the digests.
-  def patch_job_metadata(jobs)
-    pod = kube_client.get_pod(@self_name, kube_namespace)
+  def render_job_templates(jobs, job_configs)
+    jobs.each do |job_name, job|
+      dns_encoder = KubeDNSEncoder.new(job.spec['links'])
+
+      job_configs[job_name]['files'].each do |infile, outfile|
+        job.generate(infile, outfile, dns_encoder)
+      end
+    end
+  end
+
+  # Write exported properties to secret and potentially restart affected pods.
+  def export_job_properties(jobs)
+    # co-located containers don't get to export properties
+    return unless instance_group == ENV["KUBERNETES_CONTAINER_NAME"]
+    # jobs don't export properties
+    return unless self_pod['metadata']['ownerReferences'][0]['kind'] == "StatefulSet"
 
+    sts = kube_client_stateful_set.get_stateful_set(instance_group, kube_namespace)
+
+    # Make sure the secret attached to the stateful set exists.
+    # XXX This should probably be done by fissile via the helm chart.
     secret = Kubeclient::Resource.new
-    secret.metadata = {}
-    # Prefixing with pod.metadata.name is purely for human convenience/debugging.
-    secret.metadata.name = "#{pod.metadata.name}-#{pod.metadata.uid}"
-    secret.metadata.namespace = kube_namespace
-
-    # Make sure the secret gets removed when the pod is deleted.
-    secret.metadata.ownerReferences = [
-      {
-        apiVersion: pod.apiVersion,
-        blockOwnerDeletion: false,
-        controller: false,
-        kind: pod.kind,
-        name: pod.metadata.name,
-        uid: pod.metadata.uid,
-      }
-    ]
+    secret.metadata = {
+      name: sts.metadata.name,
+      namespace: kube_namespace,
+      ownerReferences:  [
+        {
+          apiVersion: sts.apiVersion,
+          blockOwnerDeletion: false,
+          controller: false,
+          kind: sts.kind,
+          name: sts.metadata.name,
+          uid: sts.metadata.uid,
+        }
+      ]
+    }
+    begin
+      kube_client.create_secret(secret)
+    rescue
+    end
+    secret = kube_client.get_secret(instance_group, kube_namespace)
+    secret.data ||= {}
+
+    version_tag = ENV["CONFIGGIN_VERSION_TAG"]
+    new_tag = !secret.data.has_key?(version_tag)
+    secret.data = {version_tag => ""} if new_tag # make sure old properties are deleted during upgrade
 
-    secret.data = {}
     digests = {}
     jobs.each do |name, job|
       digests[name] = property_digest(job.exported_properties)
       secret.data["skiff-exported-properties-#{name}"] = Base64.encode64(job.exported_properties.to_json)
-      secret.data["skiff-exported-digest-#{name}"] = Base64.encode64(digests[name])
-    end
 
-    # Only the main container gets to export properties; colocated sidecars don't.
-    if instance_group == ENV["KUBERNETES_CONTAINER_NAME"]
-      begin
-        kube_client.delete_secret(secret.metadata.name, kube_namespace)
-      rescue
+      encoded_digest = Base64.encode64(digests[name])
+
+      # Record initial digest values whenever the tag changes, in which case the pod startup
+      # order is already controlled by the "CONFIGGIN_IMPORT_#{role}" references to the new
+      # tags in the corresponding secrets. There is no annotation when importing this set of
+      # initial values because the helm chart doesn't include any annotations, and we don't
+      # want to trigger a pod restart by adding them.
+      if new_tag
+        secret.data["skiff-initial-digest-#{name}"] = encoded_digest
+      end
+      if secret.data["skiff-initial-digest-#{name}"] == encoded_digest
+        digests[name] = nil
       end
-      kube_client.create_secret(secret)
     end
 
-    digests
-  end
+    kube_client.update_secret(secret)
 
-  def render_job_templates(jobs, job_configs)
-    jobs.each do |job_name, job|
-      dns_encoder = KubeDNSEncoder.new(job.spec['links'])
+    return if new_tag
 
-      job_configs[job_name]['files'].each do |infile, outfile|
-        job.generate(infile, outfile, dns_encoder)
-      end
-    end
-  end
-
-  # Some pods might have depended on the properties exported by this pod; given
-  # the annotations expected on the pods (keyed by the instance group name),
-  # patch the StatefulSets such that they will be restarted.
-  def restart_affected_pods(expected_annotations)
-    expected_annotations.each_pair do |instance_group_name, digests|
+    # Some pods might have depended on the properties exported by this pod; given
+    # the annotations expected on the pods (keyed by the instance group name),
+    # patch the StatefulSets such that they will be restarted.
+    expected_annotations(@job_configs, digests).each_pair do |instance_group_name, digests|
       # Avoid restarting our own pod
       next if instance_group_name == instance_group
 
       begin
-        kube_client_stateful_set.patch_stateful_set(
-          instance_group_name,
-          { spec: { template: { metadata: { annotations: digests } } } },
-          kube_namespace
-        )
-        warn "Patched StatefulSet #{instance_group_name} for new exported digests"
+        sts = kube_client_stateful_set.get_stateful_set(instance_group_name, kube_namespace)
       rescue KubeException => e
         begin
           begin
@@ -142,6 +154,18 @@ class Configgin
           raise
         end
       end
+
+      annotations = sts.spec.template.metadata.annotations
+      digests.each_pair do |key, value|
+        annotations[key] = value
+      end
+
+      kube_client_stateful_set.merge_patch_stateful_set(
+        instance_group_name,
+        { spec: { template: { metadata: { annotations: annotations } } } },
+        kube_namespace
+      )
+      warn "Patched StatefulSet #{instance_group_name} for new exported digests"
     end
   end
 
@@ -198,8 +222,11 @@ class Configgin
     @kube_client_stateful_set ||= create_kube_client(path: '/apis/apps')
   end
 
-  def instance_group
+  def self_pod
     @pod ||= kube_client.get_pod(@self_name, kube_namespace)
-    @pod['metadata']['labels']['app.kubernetes.io/component']
+  end
+
+  def instance_group
+    self_pod['metadata']['labels']['app.kubernetes.io/component']
   end
 end

data/lib/configgin/version.rb

@@ -1,3 +1,3 @@
 class Configgin
-  VERSION = '0.19.1'.freeze
+  VERSION = '0.19.2'.freeze
 end

data/lib/kube_link_generator.rb

@@ -62,19 +62,8 @@ class KubeLinkSpecs
       30.times do
         1.times do
           pods = _get_pods_for_role(role_name, sts_image)
-          good_pods = pods.select do |pod|
-            next false unless pod.status.podIP
-            begin
-              secret = client.get_secret("#{pod.metadata.name}-#{pod.metadata.uid}", namespace)
-              next true if secret.data["skiff-exported-properties-#{job}"]
-
-            rescue
-              pod.metadata.annotations["skiff-exported-properties-#{job}"]
-            end
-          end
-
+          good_pods = pods.select { |pod| pod.status.podIP }
           if options[:wait_for_all]
-            # Wait until all pods have IP addresses and properties
             break unless good_pods.length == pods.length
           end
           return good_pods unless good_pods.empty?
@@ -86,43 +75,12 @@ class KubeLinkSpecs
     end
   end
 
-  def patch_pod_with_imported_properties(role_name, job_name, digest)
-    client.patch_pod(
-      ENV['HOSTNAME'],
-      { metadata: { annotations: { :"skiff-in-props-#{role_name}-#{job_name}" => digest } } },
-      namespace
-    )
-  end
-
-  def get_exported_properties(role_name, pod, job_name)
-    # Exported properties are stored in a secret linked to the pod by naming convention.
-    begin
-      secret = client.get_secret("#{pod.metadata.name}-#{pod.metadata.uid}", namespace)
-    rescue
-    end
-
-    if !secret.nil?
-      digest = secret.data["skiff-exported-digest-#{job_name}"]
-      # digest not being set only happens during the spec tests???
-      if digest
-        # Copy the digest over, so that if the source role changes we can be restarted.
-        patch_pod_with_imported_properties(role_name, job_name, Base64.decode64(digest))
-      end
-      JSON.parse(Base64.decode64(secret.data["skiff-exported-properties-#{job_name}"]))
-
-    # Older implementation stored exported properties in annotations (one per job).
-    elsif pod.metadata.annotations["skiff-exported-properties-#{job_name}"]
-      # digest not being set only happens during the spec tests???
-      if pod.metadata.annotations["skiff-exported-digest-#{job_name}"]
-        # Copy the digest over, so that if the source role changes we can be restarted.
-        digest = pod.metadata.annotations["skiff-exported-digest-#{job_name}"]
-        patch_pod_with_imported_properties(role_name, job_name, digest)
-      end
-      JSON.parse(pod.metadata.annotations["skiff-exported-properties-#{job_name}"])
-
-    else
-      {}
-    end
+  def get_exported_properties(role_name, job_name)
+    # Containers are not starting until all the properties they want to import already exist.
+    # This is done using the CONFIGGIN_IMPORT_ROLE environment variables referencing the version
+    # tag in the corresponding secret.
+    secret = client.get_secret(role_name, namespace)
+    JSON.parse(Base64.decode64(secret.data["skiff-exported-properties-#{job_name}"]))
   end
 
   def get_pod_instance_info(role_name, pod, job, pods_per_image)
@@ -134,7 +92,7 @@ class KubeLinkSpecs
       'id' => pod.metadata.name,
       'az' => pod.metadata.annotations['failure-domain.beta.kubernetes.io/zone'] || 'az0',
       'address' => "#{pod.metadata.name}.#{pod.spec.subdomain}.#{ENV['KUBERNETES_NAMESPACE']}.svc.#{ENV['KUBERNETES_CLUSTER_DOMAIN']}",
-      'properties' => get_exported_properties(role_name, pod, job),
+      'properties' => get_exported_properties(role_name, job),
       'bootstrap' => pods_per_image[pod.metadata.uid] < 2
     }
   end
@@ -164,9 +122,10 @@ class KubeLinkSpecs
       'name' => svc.metadata.name,
       'index' => 0, # Completely made up index; there is only ever one service
       'id' => svc.metadata.name,
+      # XXX bogus, but what can we do?
       'az' => pod.metadata.annotations['failure-domain.beta.kubernetes.io/zone'] || 'az0',
       'address' => svc.spec.clusterIP,
-      'properties' => get_exported_properties(role_name, pod, job),
+      'properties' => get_exported_properties(role_name, job),
       'bootstrap' => true
     }
   end
@@ -182,7 +141,8 @@ class KubeLinkSpecs
         'id' => ss.metadata.name,
         'az' => pod.metadata.annotations['failure-domain.beta.kubernetes.io/zone'] || 'az0',
         'address' => "#{ss.metadata.name}-#{i}.#{ss.spec.serviceName}",
-        'properties' => get_exported_properties(role_name, pod, job),
+        'properties' => get_exported_properties(role_name, job),
+        # XXX not actually correct during updates
         'bootstrap' => i.zero?
       }
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: configgin
 version: !ruby/object:Gem::Version
-  version: 0.19.1
+  version: 0.19.2
 platform: ruby
 authors:
 - SUSE
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-10-22 00:00:00.000000000 Z
+date: 2019-11-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler