kubernetes-deploy 0.29.0 → 1.0.0.pre.2

data/lib/{kubernetes-deploy → krane}/duration_parser.rb

@@ -2,13 +2,11 @@
 
 require 'active_support/duration'
 
-module KubernetesDeploy
-  ##
+module Krane
   # This class is a less strict extension of ActiveSupport::Duration::ISO8601Parser.
   # In addition to full ISO8601 durations, it can parse unprefixed ISO8601 time components (e.g. '1H').
   # It is also case-insensitive.
   # For example, this class considers the values "1H", "1h" and "PT1H" to be valid and equivalent.
-
   class DurationParser
     class ParsingError < ArgumentError; end
 

data/lib/{kubernetes-deploy → krane}/ejson_secret_provisioner.rb

@@ -2,9 +2,9 @@
 require 'json'
 require 'base64'
 require 'open3'
-require 'kubernetes-deploy/kubectl'
+require 'krane/kubectl'
 
-module KubernetesDeploy
+module Krane
   class EjsonSecretError < FatalDeploymentError
     def initialize(msg)
       super("Generation of Kubernetes secrets from ejson failed: #{msg}")
@@ -16,19 +16,16 @@ module KubernetesDeploy
     EJSON_SECRET_KEY = "kubernetes_secrets"
     EJSON_SECRETS_FILE = "secrets.ejson"
     EJSON_KEYS_SECRET = "ejson-keys"
+    delegate :namespace, :context, :logger, to: :@task_config
 
-    def initialize(namespace:, context:, ejson_keys_secret:, ejson_file:, logger:, statsd_tags:, selector: nil)
-      @namespace = namespace
-      @context = context
+    def initialize(task_config:, ejson_keys_secret:, ejson_file:, statsd_tags:, selector: nil)
       @ejson_keys_secret = ejson_keys_secret
       @ejson_file = ejson_file
-      @logger = logger
       @statsd_tags = statsd_tags
       @selector = selector
+      @task_config = task_config
       @kubectl = Kubectl.new(
-        namespace: @namespace,
-        context: @context,
-        logger: @logger,
+        task_config: @task_config,
         log_failure_by_default: false,
         output_is_sensitive_default: true # output may contain ejson secrets
       )
@@ -48,7 +45,7 @@ module KubernetesDeploy
       with_decrypted_ejson do |decrypted|
         secrets = decrypted[EJSON_SECRET_KEY]
         unless secrets.present?
-          @logger.warn("#{EJSON_SECRETS_FILE} does not have key #{EJSON_SECRET_KEY}."\
+          logger.warn("#{EJSON_SECRETS_FILE} does not have key #{EJSON_SECRET_KEY}."\
             "No secrets will be created.")
           return []
         end
@@ -108,14 +105,14 @@ module KubernetesDeploy
         'metadata' => {
           "name" => secret_name,
           "labels" => labels,
-          "namespace" => @namespace,
+          "namespace" => namespace,
           "annotations" => { EJSON_SECRET_ANNOTATION => "true" },
         },
         "data" => encoded_data,
       }
 
-      KubernetesDeploy::Secret.build(
-        namespace: @namespace, context: @context, logger: @logger, definition: secret, statsd_tags: @statsd_tags,
+      Krane::Secret.build(
+        namespace: namespace, context: context, logger: logger, definition: secret, statsd_tags: @statsd_tags,
       )
     end
 

data/lib/krane/errors.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Krane
+  class FatalDeploymentError < StandardError; end
+  class FatalKubeAPIError < FatalDeploymentError; end
+  class KubectlError < StandardError; end
+  class TaskConfigurationError < FatalDeploymentError; end
+
+  class InvalidTemplateError < FatalDeploymentError
+    attr_reader :content
+    attr_accessor :filename
+    def initialize(err, filename: nil, content: nil)
+      @filename = filename
+      @content = content
+      super(err)
+    end
+  end
+
+  class DeploymentTimeoutError < FatalDeploymentError; end
+
+  class EjsonPrunableError < FatalDeploymentError
+    def initialize
+      super("Found #{KubernetesResource::LAST_APPLIED_ANNOTATION} annotation on " \
+          "#{EjsonSecretProvisioner::EJSON_KEYS_SECRET} secret. " \
+          "krane will not continue since it is extremely unlikely that this secret should be pruned.")
+    end
+  end
+end

data/lib/{kubernetes-deploy → krane}/formatted_logger.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 require 'logger'
 require 'colorized_string'
-require 'kubernetes-deploy/deferred_summary_logging'
+require 'krane/deferred_summary_logging'
 
-module KubernetesDeploy
+module Krane
   class FormattedLogger < Logger
     include DeferredSummaryLogging
 

data/lib/krane/global_deploy_task.rb

@@ -0,0 +1,210 @@
+# frozen_string_literal: true
+require 'tempfile'
+
+require 'krane/common'
+require 'krane/concurrency'
+require 'krane/resource_cache'
+require 'krane/kubectl'
+require 'krane/kubeclient_builder'
+require 'krane/cluster_resource_discovery'
+require 'krane/template_sets'
+require 'krane/resource_deployer'
+require 'krane/kubernetes_resource'
+require 'krane/global_deploy_task_config_validator'
+require 'krane/concerns/template_reporting'
+
+%w(
+  custom_resource
+  custom_resource_definition
+).each do |subresource|
+  require "krane/kubernetes_resource/#{subresource}"
+end
+
+module Krane
+  # Ship global resources to a context
+  class GlobalDeployTask
+    extend Krane::StatsD::MeasureMethods
+    include TemplateReporting
+    delegate :context, :logger, :global_kinds, to: :@task_config
+
+    # Initializes the deploy task
+    #
+    # @param context [String] Kubernetes context
+    # @param global_timeout [Integer] Timeout in seconds
+    # @param selector [Hash] Selector(s) parsed by Krane::LabelSelector
+    # @param template_paths [Array<String>] An array of template paths
+    def initialize(context:, global_timeout: nil, selector: nil, filenames: [], logger: nil)
+      template_paths = filenames.map { |path| File.expand_path(path) }
+
+      @task_config = TaskConfig.new(context, nil, logger)
+      @template_sets = TemplateSets.from_dirs_and_files(paths: template_paths,
+        logger: @task_config.logger)
+      @global_timeout = global_timeout
+      @selector = selector
+    end
+
+    # Runs the task, returning a boolean representing success or failure
+    #
+    # @return [Boolean]
+    def run(*args)
+      run!(*args)
+      true
+    rescue FatalDeploymentError
+      false
+    end
+
+    # Runs the task, raising exceptions in case of issues
+    #
+    # @param verify_result [Boolean] Wait for completion and verify success
+    # @param prune [Boolean] Enable deletion of resources that match the provided
+    #  selector and do not appear in the template dir
+    #
+    # @return [nil]
+    def run!(verify_result: true, prune: true)
+      start = Time.now.utc
+      logger.reset
+
+      logger.phase_heading("Initializing deploy")
+      validate_configuration
+      resources = discover_resources
+      validate_resources(resources)
+
+      logger.phase_heading("Checking initial resource statuses")
+      check_initial_status(resources)
+
+      logger.phase_heading("Deploying all resources")
+      deploy!(resources, verify_result, prune)
+
+      StatsD.client.event("Deployment succeeded",
+        "Successfully deployed all resources to #{context}",
+        alert_type: "success", tags: statsd_tags + %w(status:success))
+      StatsD.client.distribution('all_resources.duration', StatsD.duration(start),
+        tags: statsd_tags << "status:success")
+      logger.print_summary(:success)
+    rescue Krane::DeploymentTimeoutError
+      logger.print_summary(:timed_out)
+      StatsD.client.event("Deployment timed out",
+        "One or more resources failed to deploy to #{context} in time",
+        alert_type: "error", tags: statsd_tags + %w(status:timeout))
+      StatsD.client.distribution('all_resources.duration', StatsD.duration(start),
+        tags: statsd_tags << "status:timeout")
+      raise
+    rescue Krane::FatalDeploymentError => error
+      logger.summary.add_action(error.message) if error.message != error.class.to_s
+      logger.print_summary(:failure)
+      StatsD.client.event("Deployment failed",
+        "One or more resources failed to deploy to #{context}",
+        alert_type: "error", tags: statsd_tags + %w(status:failed))
+      StatsD.client.distribution('all_resources.duration', StatsD.duration(start),
+        tags: statsd_tags << "status:failed")
+      raise
+    end
+
+    private
+
+    def deploy!(resources, verify_result, prune)
+      resource_deployer = ResourceDeployer.new(task_config: @task_config,
+        prune_whitelist: prune_whitelist, max_watch_seconds: @global_timeout,
+        selector: @selector, statsd_tags: statsd_tags)
+      resource_deployer.deploy!(resources, verify_result, prune)
+    end
+
+    def validate_configuration
+      task_config_validator = GlobalDeployTaskConfigValidator.new(@task_config,
+        kubectl, kubeclient_builder)
+      errors = []
+      errors += task_config_validator.errors
+      errors += @template_sets.validate
+      errors << "Selector is required" unless @selector.to_h.present?
+      unless errors.empty?
+        add_para_from_list(logger: logger, action: "Configuration invalid", enum: errors)
+        raise TaskConfigurationError
+      end
+
+      logger.info("Using resource selector #{@selector}")
+      logger.info("All required parameters and files are present")
+    end
+    measure_method(:validate_configuration)
+
+    def validate_resources(resources)
+      validate_globals(resources)
+
+      Concurrency.split_across_threads(resources) do |r|
+        r.validate_definition(@kubectl, selector: @selector)
+      end
+
+      resources.select(&:has_warnings?).each do |resource|
+        record_warnings(logger: logger, warning: resource.validation_warning_msg,
+          filename: File.basename(resource.file_path))
+      end
+
+      failed_resources = resources.select(&:validation_failed?)
+      if failed_resources.present?
+        failed_resources.each do |r|
+          content = File.read(r.file_path) if File.file?(r.file_path) && !r.sensitive_template_content?
+          record_invalid_template(logger: logger, err: r.validation_error_msg,
+            filename: File.basename(r.file_path), content: content)
+        end
+        raise FatalDeploymentError, "Template validation failed"
+      end
+    end
+    measure_method(:validate_resources)
+
+    def validate_globals(resources)
+      return unless (namespaced = resources.reject(&:global?).presence)
+      namespaced_names = namespaced.map do |resource|
+        "#{resource.name} (#{resource.type}) in #{File.basename(resource.file_path)}"
+      end
+      namespaced_names = FormattedLogger.indent_four(namespaced_names.join("\n"))
+
+      logger.summary.add_paragraph(ColorizedString.new("Namespaced resources:\n#{namespaced_names}").yellow)
+      raise FatalDeploymentError, "This command cannot deploy namespaced resources"
+    end
+
+    def discover_resources
+      logger.info("Discovering resources:")
+      resources = []
+      crds_by_kind = cluster_resource_discoverer.crds.map { |crd| [crd.name, crd] }.to_h
+      @template_sets.with_resource_definitions do |r_def|
+        crd = crds_by_kind[r_def["kind"]]&.first
+        r = KubernetesResource.build(context: context, logger: logger, definition: r_def,
+          crd: crd, global_names: global_kinds, statsd_tags: statsd_tags)
+        resources << r
+        logger.info("  - #{r.id}")
+      end
+
+      resources.sort
+    rescue InvalidTemplateError => e
+      record_invalid_template(logger: logger, err: e.message, filename: e.filename, content: e.content)
+      raise FatalDeploymentError, "Failed to parse template"
+    end
+    measure_method(:discover_resources)
+
+    def cluster_resource_discoverer
+      @cluster_resource_discoverer ||= ClusterResourceDiscovery.new(task_config: @task_config)
+    end
+
+    def statsd_tags
+      %W(context:#{context})
+    end
+
+    def kubectl
+      @kubectl ||= Kubectl.new(task_config: @task_config, log_failure_by_default: true)
+    end
+
+    def kubeclient_builder
+      @kubeclient_builder ||= KubeclientBuilder.new
+    end
+
+    def prune_whitelist
+      cluster_resource_discoverer.prunable_resources(namespaced: false)
+    end
+
+    def check_initial_status(resources)
+      cache = ResourceCache.new(@task_config)
+      Concurrency.split_across_threads(resources) { |r| r.sync(cache) }
+      resources.each { |r| logger.info(r.pretty_status) }
+    end
+    measure_method(:check_initial_status, "initial_status.duration")
+  end
+end

data/lib/krane/global_deploy_task_config_validator.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+require 'krane/task_config_validator'
+
+module Krane
+  class GlobalDeployTaskConfigValidator < Krane::TaskConfigValidator
+    def initialize(*arguments)
+      super(*arguments)
+      @validations -= [:validate_namespace_exists]
+    end
+  end
+end

data/lib/{kubernetes-deploy → krane}/kubeclient_builder.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'kubeclient'
 
-module KubernetesDeploy
+module Krane
   class KubeclientBuilder
     class ContextMissingError < FatalDeploymentError
       def initialize(context_name, kubeconfig)
@@ -55,9 +55,9 @@ module KubernetesDeploy
       )
     end
 
-    def build_apps_v1beta1_kubeclient(context)
+    def build_apps_v1_kubeclient(context)
       build_kubeclient(
-        api_version: "v1beta1",
+        api_version: "v1",
         context: context,
         endpoint_path: "/apis/apps"
       )
@@ -103,6 +103,14 @@ module KubernetesDeploy
       )
     end
 
+    def build_scheduling_v1beta1_kubeclient(context)
+      build_kubeclient(
+        api_version: "v1beta1",
+        context: context,
+        endpoint_path: "/apis/scheduling.k8s.io"
+      )
+    end
+
     def validate_config_files
       errors = []
       if @kubeconfig_files.empty?
@@ -137,8 +145,8 @@ module KubernetesDeploy
         ssl_options: kube_context.ssl_options,
         auth_options: kube_context.auth_options,
         timeouts: {
-          open: KubernetesDeploy::Kubectl::DEFAULT_TIMEOUT,
-          read: KubernetesDeploy::Kubectl::DEFAULT_TIMEOUT,
+          open: Krane::Kubectl::DEFAULT_TIMEOUT,
+          read: Krane::Kubectl::DEFAULT_TIMEOUT,
         }
       )
       client.discover

data/lib/{kubernetes-deploy → krane}/kubectl.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'open3'
 
-module KubernetesDeploy
+module Krane
   class Kubectl
     ERROR_MATCHERS = {
       not_found: /NotFound/,
@@ -13,30 +13,28 @@ module KubernetesDeploy
 
     class ResourceNotFoundError < StandardError; end
 
-    def initialize(namespace:, context:, logger:, log_failure_by_default:, default_timeout: DEFAULT_TIMEOUT,
+    delegate :namespace, :context, :logger, to: :@task_config
+
+    def initialize(task_config:, log_failure_by_default:, default_timeout: DEFAULT_TIMEOUT,
       output_is_sensitive_default: false)
-      @namespace = namespace
-      @context = context
-      @logger = logger
+      @task_config = task_config
       @log_failure_by_default = log_failure_by_default
       @default_timeout = default_timeout
       @output_is_sensitive_default = output_is_sensitive_default
-
-      raise ArgumentError, "namespace is required" if namespace.blank?
-      raise ArgumentError, "context is required" if context.blank?
     end
 
     def run(*args, log_failure: nil, use_context: true, use_namespace: true, output: nil,
       raise_if_not_found: false, attempts: 1, output_is_sensitive: nil, retry_whitelist: nil)
+      raise ArgumentError, "namespace is required" if namespace.blank? && use_namespace
       log_failure = @log_failure_by_default if log_failure.nil?
       output_is_sensitive = @output_is_sensitive_default if output_is_sensitive.nil?
       cmd = build_command_from_options(args, use_namespace, use_context, output)
       out, err, st = nil
 
       (1..attempts).to_a.each do |current_attempt|
-        @logger.debug("Running command (attempt #{current_attempt}): #{cmd.join(' ')}")
+        logger.debug("Running command (attempt #{current_attempt}): #{cmd.join(' ')}")
         out, err, st = Open3.capture3(*cmd)
-        @logger.debug("Kubectl out: " + out.gsub(/\s+/, ' ')) unless output_is_sensitive
+        logger.debug("Kubectl out: " + out.gsub(/\s+/, ' ')) unless output_is_sensitive
 
         break if st.success?
         raise(ResourceNotFoundError, err) if err.match(ERROR_MATCHERS[:not_found]) && raise_if_not_found
@@ -49,12 +47,12 @@ module KubernetesDeploy
           else
             "The following command failed and cannot be retried"
           end
-          @logger.warn("#{warning}: #{Shellwords.join(cmd)}")
-          @logger.warn(err) unless output_is_sensitive
+          logger.warn("#{warning}: #{Shellwords.join(cmd)}")
+          logger.warn(err) unless output_is_sensitive
         else
-          @logger.debug("Kubectl err: #{output_is_sensitive ? '<suppressed sensitive output>' : err}")
+          logger.debug("Kubectl err: #{output_is_sensitive ? '<suppressed sensitive output>' : err}")
         end
-        StatsD.increment('kubectl.error', 1, tags: { context: @context, namespace: @namespace, cmd: cmd[1] })
+        StatsD.client.increment('kubectl.error', 1, tags: { context: context, namespace: namespace, cmd: cmd[1] })
 
         break unless retriable_err?(err, retry_whitelist) && current_attempt < attempts
         sleep(retry_delay(current_attempt))
@@ -93,8 +91,8 @@ module KubernetesDeploy
 
     def build_command_from_options(args, use_namespace, use_context, output)
       cmd = ["kubectl"] + args
-      cmd.push("--namespace=#{@namespace}")              if use_namespace
-      cmd.push("--context=#{@context}")                  if use_context
+      cmd.push("--namespace=#{namespace}")              if use_namespace
+      cmd.push("--context=#{context}")                  if use_context
       cmd.push("--output=#{output}")                     if output
       cmd.push("--request-timeout=#{@default_timeout}")  if @default_timeout
       cmd