krane 1.0.0

data/lib/krane/cli/krane.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require 'krane'
+require 'thor'
+require 'krane/cli/version_command'
+require 'krane/cli/restart_command'
+require 'krane/cli/run_command'
+require 'krane/cli/render_command'
+require 'krane/cli/deploy_command'
+require 'krane/cli/global_deploy_command'
+
+module Krane
+  module CLI
+    class Krane < Thor
+      TIMEOUT_EXIT_CODE = 70
+      FAILURE_EXIT_CODE = 1
+
+      package_name "Krane"
+
+      def self.expand_options(task_options)
+        task_options.each { |option_name, config| method_option(option_name, config) }
+      end
+
+      desc("render", "Render templates")
+      expand_options(RenderCommand::OPTIONS)
+      def render
+        rescue_and_exit do
+          RenderCommand.from_options(options)
+        end
+      end
+
+      desc("version", "Prints the version")
+      expand_options(VersionCommand::OPTIONS)
+      def version
+        VersionCommand.from_options(options)
+      end
+
+      desc("restart NAMESPACE CONTEXT", "Restart the pods in one or more deployments")
+      expand_options(RestartCommand::OPTIONS)
+      def restart(namespace, context)
+        rescue_and_exit do
+          RestartCommand.from_options(namespace, context, options)
+        end
+      end
+
+      desc("run NAMESPACE CONTEXT", "Run a pod that exits upon completing a task")
+      expand_options(RunCommand::OPTIONS)
+      def run_command(namespace, context)
+        rescue_and_exit do
+          RunCommand.from_options(namespace, context, options)
+        end
+      end
+
+      desc("deploy NAMESPACE CONTEXT", "Ship resources to a namespace")
+      expand_options(DeployCommand::OPTIONS)
+      def deploy(namespace, context)
+        rescue_and_exit do
+          DeployCommand.from_options(namespace, context, options)
+        end
+      end
+
+      desc("global-deploy CONTEXT", "Ship non-namespaced resources to a cluster")
+      expand_options(GlobalDeployCommand::OPTIONS)
+      def global_deploy(context)
+        rescue_and_exit do
+          GlobalDeployCommand.from_options(context, options)
+        end
+      end
+
+      def self.exit_on_failure?
+        true
+      end
+
+      private
+
+      def rescue_and_exit
+        yield
+      rescue ::Krane::DeploymentTimeoutError
+        exit(TIMEOUT_EXIT_CODE)
+      rescue ::Krane::FatalDeploymentError
+        exit(FAILURE_EXIT_CODE)
+      rescue ::Krane::DurationParser::ParsingError => e
+        STDERR.puts(<<~ERROR_MESSAGE)
+          Error parsing duration
+          #{e.message}. Duration must be a full ISO8601 duration or time value (e.g. 300s, 10m, 1h)
+        ERROR_MESSAGE
+        exit(FAILURE_EXIT_CODE)
+      end
+    end
+  end
+end

data/lib/krane/cli/render_command.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Krane
+  module CLI
+    class RenderCommand
+      OPTIONS = {
+        "bindings" => { type: :array, banner: "foo=bar abc=def", desc: 'Bindings for erb' },
+        "filenames" => { type: :array, banner: 'config/deploy/production config/deploy/my-extra-resource.yml',
+                         required: false, default: [], aliases: 'f', desc: 'Directories and files to render' },
+        "stdin" => { type: :boolean, desc: "Read resources from stdin", default: false },
+        "current-sha" => { type: :string, banner: "SHA", desc: "Expose SHA `current_sha` in ERB bindings",
+                           lazy_default: '' },
+      }
+
+      def self.from_options(options)
+        require 'krane/render_task'
+        require 'krane/bindings_parser'
+        require 'krane/options_helper'
+
+        bindings_parser = ::Krane::BindingsParser.new
+        options[:bindings]&.each { |b| bindings_parser.add(b) }
+
+        # never mutate options directly
+        filenames = options[:filenames].dup
+        filenames << "-" if options[:stdin]
+        if filenames.empty?
+          raise Thor::RequiredArgumentMissingError, 'At least one of --filenames or --stdin must be set'
+        end
+
+        ::Krane::OptionsHelper.with_processed_template_paths(filenames, render_erb: true) do |paths|
+          renderer = ::Krane::RenderTask.new(
+            current_sha: options['current-sha'],
+            filenames: paths,
+            bindings: bindings_parser.parse,
+          )
+          renderer.run!(stream: STDOUT)
+        end
+      end
+    end
+  end
+end

data/lib/krane/cli/restart_command.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module Krane
+  module CLI
+    class RestartCommand
+      DEFAULT_RESTART_TIMEOUT = '300s'
+      OPTIONS = {
+        "deployments" => { type: :array, banner: "list of deployments",
+                           desc: "List of workload names to restart" },
+        "global-timeout" => { type: :string, banner: "duration", default: DEFAULT_RESTART_TIMEOUT,
+                              desc: "Max duration to monitor workloads correctly restarted" },
+        "selector" => { type: :string, banner: "'label=value'",
+                        desc: "Select workloads by selector(s)" },
+        "verify-result" => { type: :boolean, default: true,
+                             desc: "Verify workloads correctly restarted" },
+      }
+
+      def self.from_options(namespace, context, options)
+        require 'krane/restart_task'
+        selector = ::Krane::LabelSelector.parse(options[:selector]) if options[:selector]
+        restart = ::Krane::RestartTask.new(
+          namespace: namespace,
+          context: context,
+          global_timeout: ::Krane::DurationParser.new(options["global-timeout"]).parse!.to_i,
+        )
+        restart.run!(
+          deployments: options[:deployments],
+          selector: selector,
+          verify_result: options["verify-result"]
+        )
+      end
+    end
+  end
+end

data/lib/krane/cli/run_command.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+module Krane
+  module CLI
+    class RunCommand
+      DEFAULT_RUN_TIMEOUT = '300s'
+
+      OPTIONS = {
+        "global-timeout" => {
+          type: :string,
+          banner: "duration",
+          desc: "Timeout error is raised if the pod runs for longer than the specified number of seconds",
+          default: DEFAULT_RUN_TIMEOUT,
+        },
+        "arguments" => {
+          type: :string,
+          banner: '"ARG1 ARG2 ARG3"',
+          desc: "Override the default arguments for the command with a space-separated list of arguments",
+        },
+        "verify-result" => { type: :boolean, desc: "Wait for completion and verify pod success", default: true },
+        "command" => { type: :array, desc: "Override the default command in the container image" },
+        "template" => {
+          type: :string,
+          desc: "The template file you'll be rendering",
+          required: true,
+          aliases: :f,
+        },
+        "env-vars" => {
+          type: :string,
+          banner: "VAR=val,FOO=bar",
+          desc: "A Comma-separated list of env vars",
+          default: '',
+        },
+      }
+
+      def self.from_options(namespace, context, options)
+        require "krane/runner_task"
+        runner = ::Krane::RunnerTask.new(
+          namespace: namespace,
+          context: context,
+          global_timeout: ::Krane::DurationParser.new(options["global-timeout"]).parse!.to_i,
+        )
+
+        runner.run!(
+          verify_result: options['verify-result'],
+          template: options['template'],
+          command: options['command'],
+          arguments: options['arguments']&.split(" "),
+          env_vars: options['env-vars'].split(','),
+        )
+      end
+    end
+  end
+end

data/lib/krane/cli/version_command.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Krane
+  module CLI
+    class VersionCommand
+      OPTIONS = {}
+
+      def self.from_options(_)
+        puts("krane #{::Krane::VERSION}")
+      end
+    end
+  end
+end

data/lib/krane/cluster_resource_discovery.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+module Krane
+  class ClusterResourceDiscovery
+    delegate :namespace, :context, :logger, to: :@task_config
+
+    def initialize(task_config:, namespace_tags: [])
+      @task_config = task_config
+      @namespace_tags = namespace_tags
+    end
+
+    def crds
+      @crds ||= fetch_crds.map do |cr_def|
+        CustomResourceDefinition.new(namespace: namespace, context: context, logger: logger,
+          definition: cr_def, statsd_tags: @namespace_tags)
+      end
+    end
+
+    def prunable_resources(namespaced:)
+      black_list = %w(Namespace Node ControllerRevision)
+      api_versions = fetch_api_versions
+
+      fetch_resources(namespaced: namespaced).uniq { |r| r['kind'] }.map do |resource|
+        next unless resource['verbs'].one? { |v| v == "delete" }
+        next if black_list.include?(resource['kind'])
+        group_versions = api_versions[resource['apigroup'].to_s]
+        version = version_for_kind(group_versions, resource['kind'])
+        [resource['apigroup'], version, resource['kind']].compact.join("/")
+      end.compact
+    end
+
+    # kubectl api-resources -o wide returns 5 columns
+    # NAME SHORTNAMES APIGROUP NAMESPACED KIND VERBS
+    # SHORTNAMES and APIGROUP may be blank
+    # VERBS is an array
+    # serviceaccounts sa <blank> true ServiceAccount [create delete deletecollection get list patch update watch]
+    def fetch_resources(namespaced: false)
+      command = %w(api-resources)
+      command << "--namespaced=#{namespaced}"
+      raw, _, st = kubectl.run(*command, output: "wide", attempts: 5,
+        use_namespace: false)
+      if st.success?
+        rows = raw.split("\n")
+        header = rows[0]
+        resources = rows[1..-1]
+        full_width_field_names = header.downcase.scan(/[a-z]+[\W]*/)
+        cursor = 0
+        fields = full_width_field_names.each_with_object({}) do |name, hash|
+          start = cursor
+          cursor = start + name.length
+          # Last field should consume the remainder of the line
+          cursor = 0 if full_width_field_names.last == name.strip
+          hash[name.strip] = [start, cursor - 1]
+        end
+        resources.map do |resource|
+          resource = fields.map { |k, (s, e)| [k.strip, resource[s..e].strip] }.to_h
+          # Manually parse verbs: "[get list]" into %w(get list)
+          resource["verbs"] = resource["verbs"][1..-2].split
+          resource
+        end
+      else
+        []
+      end
+    end
+
+    private
+
+    # kubectl api-versions returns a list of group/version strings e.g. autoscaling/v2beta2
+    # A kind may not exist in all versions of the group.
+    def fetch_api_versions
+      raw, _, st = kubectl.run("api-versions", attempts: 5, use_namespace: false)
+      # The "core" group is represented by an empty string
+      versions = { "" => %w(v1) }
+      if st.success?
+        rows = raw.split("\n")
+        rows.each do |group_version|
+          group, version = group_version.split("/")
+          versions[group] ||= []
+          versions[group] << version
+        end
+      end
+      versions
+    end
+
+    def version_for_kind(versions, kind)
+      # Override list for kinds that don't appear in the lastest version of a group
+      version_override = { "CronJob" => "v1beta1", "VolumeAttachment" => "v1beta1",
+                           "CSIDriver" => "v1beta1", "Ingress" => "v1beta1", "CSINode" => "v1beta1" }
+
+      pattern = /v(?<major>\d+)(?<pre>alpha|beta)?(?<minor>\d+)?/
+      latest = versions.sort_by do |version|
+        match = version.match(pattern)
+        pre = { "alpha" => 0, "beta" => 1, nil => 2 }.fetch(match[:pre])
+        [match[:major].to_i, pre, match[:minor].to_i]
+      end.last
+      version_override.fetch(kind, latest)
+    end
+
+    def fetch_crds
+      raw_json, _, st = kubectl.run("get", "CustomResourceDefinition", output: "json", attempts: 5,
+        use_namespace: false)
+      if st.success?
+        JSON.parse(raw_json)["items"]
+      else
+        []
+      end
+    end
+
+    def kubectl
+      @kubectl ||= Kubectl.new(task_config: @task_config, log_failure_by_default: true)
+    end
+  end
+end

data/lib/krane/common.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require 'active_support/core_ext/object/blank'
+require 'active_support/core_ext/hash/reverse_merge'
+require 'active_support/core_ext/hash/slice'
+require 'active_support/core_ext/numeric/time'
+require 'active_support/core_ext/string/inflections'
+require 'active_support/core_ext/string/strip'
+require 'active_support/core_ext/hash/keys'
+require 'active_support/core_ext/array/conversions'
+require 'colorized_string'
+
+require 'krane/version'
+require 'krane/oj'
+require 'krane/errors'
+require 'krane/formatted_logger'
+require 'krane/statsd'
+require 'krane/task_config'
+require 'krane/task_config_validator'
+
+module Krane
+  MIN_KUBE_VERSION = '1.11.0'
+end

data/lib/krane/concerns/template_reporting.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Krane
+  module TemplateReporting
+    def record_invalid_template(logger:, err:, filename:, content: nil)
+      debug_msg = ColorizedString.new("Invalid template: #{filename}\n").red
+      debug_msg += "> Error message:\n#{Krane::FormattedLogger.indent_four(err)}"
+      if content
+        debug_msg += if content =~ /kind:\s*Secret/
+          "\n> Template content: Suppressed because it may contain a Secret"
+        else
+          "\n> Template content:\n#{Krane::FormattedLogger.indent_four(content)}"
+        end
+      end
+      logger.summary.add_paragraph(debug_msg)
+    end
+
+    def record_warnings(logger:, warning:, filename:)
+      warn_msg = "Template warning: #{filename}\n"
+      warn_msg += "> Warning message:\n#{Krane::FormattedLogger.indent_four(warning)}"
+      logger.summary.add_paragraph(ColorizedString.new(warn_msg).yellow)
+    end
+
+    def add_para_from_list(logger:, action:, enum:)
+      logger.summary.add_action(action)
+      logger.summary.add_paragraph(enum.map { |e| "- #{e}" }.join("\n"))
+    end
+  end
+end

data/lib/krane/concurrency.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+module Krane
+  module Concurrency
+    MAX_THREADS = 8
+
+    def self.split_across_threads(all_work, &block)
+      return if all_work.empty?
+      raise ArgumentError, "Block of work is required" unless block_given?
+
+      slice_size = ((all_work.length + MAX_THREADS - 1) / MAX_THREADS)
+      threads = []
+      all_work.each_slice(slice_size) do |work_group|
+        threads << Thread.new { work_group.each(&block) }
+      end
+      threads.each(&:join)
+    end
+  end
+end

data/lib/krane/container_logs.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+module Krane
+  class ContainerLogs
+    attr_reader :lines, :container_name
+
+    DEFAULT_LINE_LIMIT = 250
+
+    def initialize(parent_id:, container_name:, namespace:, context:, logger:)
+      @parent_id = parent_id
+      @container_name = container_name
+      @namespace = namespace
+      @context = context
+      @logger = logger
+      @lines = []
+      @next_print_index = 0
+      @printed_latest = false
+    end
+
+    def sync
+      new_logs = fetch_latest
+      return unless new_logs.present?
+      @lines += sort_and_deduplicate(new_logs)
+    end
+
+    def empty?
+      lines.empty?
+    end
+
+    def print_latest(prefix: false)
+      prefix_str = "[#{container_name}]  " if prefix
+
+      lines[@next_print_index..-1].each do |msg|
+        @logger.info("#{prefix_str}#{msg}")
+      end
+
+      @next_print_index = lines.length
+      @printed_latest = true
+    end
+
+    def print_all
+      lines.each { |line| @logger.info("\t#{line}") }
+    end
+
+    def printing_started?
+      @printed_latest
+    end
+
+    private
+
+    def fetch_latest
+      cmd = ["logs", @parent_id, "--container=#{container_name}", "--timestamps"]
+      cmd << if @last_timestamp.present?
+        "--since-time=#{rfc3339_timestamp(@last_timestamp)}"
+      else
+        "--tail=#{DEFAULT_LINE_LIMIT}"
+      end
+      out, _err, _st = kubectl.run(*cmd, log_failure: false)
+      out.split("\n")
+    end
+
+    def kubectl
+      task_config = TaskConfig.new(@context, @namespace, @logger)
+      @kubectl ||= Kubectl.new(task_config: task_config, log_failure_by_default: false)
+    end
+
+    def rfc3339_timestamp(time)
+      time.strftime("%FT%T.%N%:z")
+    end
+
+    def sort_and_deduplicate(logs)
+      parsed_lines = logs.map { |line| split_timestamped_line(line) }
+      sorted_lines = parsed_lines.sort do |(timestamp1, _msg1), (timestamp2, _msg2)|
+        if timestamp1.nil?
+          -1
+        elsif timestamp2.nil?
+          1
+        else
+          timestamp1 <=> timestamp2
+        end
+      end
+
+      deduped = []
+      sorted_lines.each do |timestamp, msg|
+        next if likely_duplicate?(timestamp)
+        @last_timestamp = timestamp if timestamp
+        deduped << msg
+      end
+      deduped
+    end
+
+    def split_timestamped_line(log_line)
+      timestamp, message = log_line.split(" ", 2)
+      [Time.parse(timestamp), message]
+    rescue ArgumentError
+      # Don't fail on unparsable timestamp
+      [nil, log_line]
+    end
+
+    def likely_duplicate?(timestamp)
+      return false unless @last_timestamp && timestamp
+      # The --since-time granularity the API server supports is not adequate to prevent duplicates
+      # This comparison takes the fractional seconds into account
+      timestamp <= @last_timestamp
+    end
+  end
+end