kubernetes-deploy 0.6.1 → 0.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8d4d12495a2c45feea06818619b789fe435c9458
-  data.tar.gz: be4b5c1fd86dd89e61ff4c209325dd355a9c4ca6
+  metadata.gz: 55540c9fa5a002f87eba1c06883e0b237d194803
+  data.tar.gz: 5d2e45261bb51d18d34f5337eb7006892885b99e
 SHA512:
-  metadata.gz: dbc9a37c932a11084c881b5333bb32d2d86500095c704f0a17ad2e0d53331f91105b4f0afbe5134a30f244fdce6b53b48cc9e43f8005d6c6bcfc4ed6ff59c29a
-  data.tar.gz: 3910718f3c377f15a88e478211c1ebc25a9ba365af017405f7999f1c0a2fcdf14f43b0b348d900666640200a623baaef2b3c37149d32ccee83f75246e6130cd5
+  metadata.gz: 0fb77ac54ebf8f56eb7c116a29ef373da76d694c4977a5c704f78cafacf9c97c2cad25e5137e9991eaf689661323ab889b205da8db96a87c02c0ce94d641f023
+  data.tar.gz: 2e00d11e27cd3965e30592552adcf77ea7b599cb120a376d2c32b226b7bd07f4c0a1040da24534304b9910ed8c95cf4ad447937a3773d01cc11d5e1b5eac3e2a

data/Gemfile

@@ -4,6 +4,7 @@ source 'https://rubygems.org'
 gemspec
 
 gem 'pry'
+gem 'pry-byebug'
 gem 'rubocop'
 gem 'timecop'
 gem 'byebug'

data/README.md

@@ -40,6 +40,42 @@ The following command will restart all pods in the `web` and `jobs` deployments:
 
 `kubernetes-restart <kube namespace> <kube context> --deployments=web,jobs`
 
+### Deploying Kubernetes secrets
+
+**Note: If you're a Shopify employee using our cloud platform, this setup has already been done for you. Please consult the CloudPlatform User Guide for usage instructions.**
+
+Since their data is only base64 encoded, Kubernetes secrets should not be committed to your repository. Instead, `kubernetes-deploy` supports generating secrets from an encrypted [ejson](https://github.com/Shopify/ejson) file in your template directory. Here's how to use this feature:
+
+1. Install the ejson gem: `gem install ejson`
+2. Generate a new keypair: `ejson keygen` (prints the keypair to stdout)
+3. Create a Kubernetes secret in your target namespace with the new keypair: `kubectl create secret generic ejson-keys --from-literal=YOUR_PUBLIC_KEY=YOUR_PRIVATE_KEY --namespace=TARGET_NAMESPACE`
+4. (optional but highly recommended) Back up the keypair somewhere secure, such as a password manager, for disaster recovery purposes.
+5. In your template directory (alongside your Kubernetes templates), create `secrets.ejson` with the format shown below. The `_type` key should have the value “kubernetes.io/tls” for TLS secrets and “Opaque” for all others. The `data` key must be a json object, but its keys and values can be whatever you need.
+
+```json
+{
+  "_public_key": "YOUR_PUBLIC_KEY",
+  "kubernetes_secrets": {
+    "catphotoscom": {
+      "_type": "kubernetes.io/tls",
+      "data": {
+        "tls.crt": "cert-data-here",
+        "tls.key": "key-data-here"
+      }
+    },
+    "monitoring-token": {
+      "_type": "Opaque",
+      "data": {
+        "api-token": "token-value-here"
+      }
+    }
+  }
+}
+```
+
+6. Encrypt the file: `ejson encrypt /PATH/TO/secrets.ejson`
+7. Commit the encrypted file and deploy as usual. The deploy will create secrets from the data in the `kubernetes_secrets` key.
+
 ### Running one off tasks
 
 To trigger a one-off job such as a rake task _outside_ of a deploy, use the following command:
@@ -50,7 +86,7 @@ This command assumes that you've already deployed a `PodTemplate` named `task-ru
 
 #### Creating a PodTemplate
 
-The [`PodTemplate`](https://kubernetes.io/docs/api-reference/v1.6/#podtemplate-v1-core) object should have a field `template` containing a `Pod` specification which does not include the `apiVersion` or `kind` parameters. An example is provided in this repo in `test/fixtures/hello-cloud/template-runner.yml`. 
+The [`PodTemplate`](https://kubernetes.io/docs/api-reference/v1.6/#podtemplate-v1-core) object should have a field `template` containing a `Pod` specification which does not include the `apiVersion` or `kind` parameters. An example is provided in this repo in `test/fixtures/hello-cloud/template-runner.yml`.
 
 #### Providing multiple different task-runner configurations
 

data/exe/kubernetes-restart

@@ -8,16 +8,11 @@ require 'kubernetes-deploy/restart_task'
 
 raw_deployments = nil
 ARGV.options do |opts|
-  opts.on("--deployments=LIST") { |v| raw_deployments = v }
+  opts.on("--deployments=LIST") { |v| raw_deployments = v.split(",") }
   opts.parse!
 end
 
-if raw_deployments.nil?
-  puts "Failed: specify at least one deployment to restart with --deployments flag"
-  exit 1
-end
-
 KubernetesDeploy::Runner.with_friendly_errors do
   restart = KubernetesDeploy::RestartTask.new(namespace: ARGV[0], context: ARGV[1])
-  restart.perform(raw_deployments.split(","))
+  restart.perform(raw_deployments)
 end

data/kubernetes-deploy.gemspec

@@ -23,10 +23,12 @@ Gem::Specification.new do |spec|
   spec.add_dependency "activesupport", ">= 4.2"
   spec.add_dependency "kubeclient", "~> 2.3"
   spec.add_dependency "googleauth", ">= 0.5"
+  spec.add_dependency "ejson", "1.0.1"
 
   spec.add_development_dependency "bundler", "~> 1.13"
   spec.add_development_dependency "rake", "~> 10.0"
   spec.add_development_dependency "minitest", "~> 5.0"
   spec.add_development_dependency "minitest-stub-const", "~> 0.6"
   spec.add_development_dependency "webmock", "~> 3.0"
+  spec.add_development_dependency "mocha", "~> 1.1"
 end

data/lib/kubernetes-deploy.rb

@@ -4,18 +4,12 @@ require 'active_support/core_ext/hash/slice'
 require 'active_support/core_ext/numeric/time'
 require 'active_support/core_ext/string/inflections'
 require 'active_support/core_ext/string/strip'
+require 'active_support/core_ext/hash/keys'
 
+require 'kubernetes-deploy/errors'
 require 'kubernetes-deploy/logger'
 require 'kubernetes-deploy/runner'
 
 module KubernetesDeploy
-  class FatalDeploymentError < StandardError; end
-
-  class NamespaceNotFoundError < FatalDeploymentError
-    def initialize(name, context)
-      super("Namespace `#{name}` not found in context `#{context}`. Aborting the task.")
-    end
-  end
-
   include Logger
 end

data/lib/kubernetes-deploy/ejson_secret_provisioner.rb

@@ -0,0 +1,168 @@
+# frozen_string_literal: true
+require 'json'
+require 'base64'
+require 'open3'
+require 'kubernetes-deploy/logger'
+
+module KubernetesDeploy
+  class EjsonSecretError < FatalDeploymentError
+    def initialize(msg)
+      super("Creation of Kubernetes secrets from ejson failed: #{msg}")
+    end
+  end
+
+  class EjsonSecretProvisioner
+    MANAGEMENT_ANNOTATION = "kubernetes-deploy.shopify.io/ejson-secret"
+    MANAGED_SECRET_EJSON_KEY = "kubernetes_secrets"
+    EJSON_SECRETS_FILE = "secrets.ejson"
+    EJSON_KEYS_SECRET = "ejson-keys"
+
+    def initialize(namespace:, template_dir:, client:)
+      @namespace = namespace
+      @ejson_file = "#{template_dir}/#{EJSON_SECRETS_FILE}"
+      @kubeclient = client
+    end
+
+    def secret_changes_required?
+      File.exist?(@ejson_file) || managed_secrets_exist?
+    end
+
+    def run
+      create_secrets
+      prune_managed_secrets
+    end
+
+    private
+
+    def create_secrets
+      with_decrypted_ejson do |decrypted|
+        secrets = decrypted[MANAGED_SECRET_EJSON_KEY]
+        unless secrets.present?
+          KubernetesDeploy.logger.warn("#{EJSON_SECRETS_FILE} does not have key #{MANAGED_SECRET_EJSON_KEY}."\
+            "No secrets will be created.")
+          return
+        end
+
+        secrets.each do |secret_name, secret_spec|
+          validate_secret_spec(secret_name, secret_spec)
+          create_or_update_secret(secret_name, secret_spec["_type"], secret_spec["data"])
+        end
+      end
+    end
+
+    def prune_managed_secrets
+      ejson_secret_names = encrypted_ejson.fetch(MANAGED_SECRET_EJSON_KEY, {}).keys
+      live_secrets = @kubeclient.get_secrets(namespace: @namespace)
+
+      live_secrets.each do |secret|
+        secret_name = secret.metadata.name
+        next unless secret_managed?(secret)
+        next if ejson_secret_names.include?(secret_name)
+
+        KubernetesDeploy.logger.info("Pruning secret #{secret_name}")
+        @kubeclient.delete_secret(secret_name, @namespace)
+      end
+    end
+
+    def managed_secrets_exist?
+      all_secrets = @kubeclient.get_secrets(namespace: @namespace)
+      all_secrets.any? { |secret| secret_managed?(secret) }
+    end
+
+    def secret_managed?(secret)
+      secret.metadata.annotations.to_h.stringify_keys.key?(MANAGEMENT_ANNOTATION)
+    end
+
+    def encrypted_ejson
+      @encrypted_ejson ||= load_ejson_from_file
+    end
+
+    def public_key
+      encrypted_ejson["_public_key"]
+    end
+
+    def private_key
+      @private_key ||= fetch_private_key_from_secret
+    end
+
+    def validate_secret_spec(secret_name, spec)
+      errors = []
+      errors << "secret type unspecified" if spec["_type"].blank?
+      errors << "no data provided" if spec["data"].blank?
+
+      unless errors.empty?
+        raise EjsonSecretError, "Ejson incomplete for secret #{secret_name}: #{errors.join(', ')}"
+      end
+    end
+
+    def create_or_update_secret(secret_name, secret_type, data)
+      metadata = {
+        name: secret_name,
+        labels: { "name" => secret_name },
+        namespace: @namespace,
+        annotations: { MANAGEMENT_ANNOTATION => "true" }
+      }
+      secret = Kubeclient::Secret.new(type: secret_type, stringData: data, metadata: metadata)
+      if secret_exists?(secret)
+        KubernetesDeploy.logger.info("Updating secret #{secret_name}")
+        @kubeclient.update_secret(secret)
+      else
+        KubernetesDeploy.logger.info("Creating secret #{secret_name}")
+        @kubeclient.create_secret(secret)
+      end
+    rescue KubeException => e
+      raise unless e.error_code == 400
+      raise EjsonSecretError, "Data for secret #{secret_name} was invalid: #{e}"
+    end
+
+    def secret_exists?(secret)
+      @kubeclient.get_secret(secret.metadata.name, @namespace)
+      true
+    rescue KubeException => error
+      raise unless error.error_code == 404
+      false
+    end
+
+    def load_ejson_from_file
+      return {} unless File.exist?(@ejson_file)
+      JSON.parse(File.read(@ejson_file))
+    rescue JSON::ParserError => e
+      raise EjsonSecretError, "Failed to parse encrypted ejson:\n  #{e}"
+    end
+
+    def with_decrypted_ejson
+      return unless File.exist?(@ejson_file)
+
+      Dir.mktmpdir("ejson_keydir") do |key_dir|
+        File.write(File.join(key_dir, public_key), private_key)
+        decrypted = decrypt_ejson(key_dir)
+        yield decrypted
+      end
+    end
+
+    def decrypt_ejson(key_dir)
+      KubernetesDeploy.logger.info("Decrypting #{EJSON_SECRETS_FILE}")
+      # ejson seems to dump both errors and output to STDOUT
+      out_err, st = Open3.capture2e("EJSON_KEYDIR=#{key_dir} ejson decrypt #{@ejson_file}")
+      raise EjsonSecretError, out_err unless st.success?
+      JSON.parse(out_err)
+    rescue JSON::ParserError => e
+      raise EjsonSecretError, "Failed to parse decrypted ejson:\n  #{e}"
+    end
+
+    def fetch_private_key_from_secret
+      KubernetesDeploy.logger.info("Fetching ejson private key from secret #{EJSON_KEYS_SECRET}")
+      secret = @kubeclient.get_secret(EJSON_KEYS_SECRET, @namespace)
+      encoded_private_key = secret["data"][public_key]
+      unless encoded_private_key
+        raise EjsonSecretError, "Private key for #{public_key} not found in #{EJSON_KEYS_SECRET} secret"
+      end
+
+      Base64.decode64(encoded_private_key)
+    rescue KubeException => error
+      raise unless error.error_code == 404
+      secret_missing_err = "Failed to decrypt ejson: secret #{EJSON_KEYS_SECRET} not found in namespace #{@namespace}."
+      raise EjsonSecretError, secret_missing_err
+    end
+  end
+end

data/lib/kubernetes-deploy/errors.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+module KubernetesDeploy
+  class FatalDeploymentError < StandardError; end
+
+  class NamespaceNotFoundError < FatalDeploymentError
+    def initialize(name, context)
+      super("Namespace `#{name}` not found in context `#{context}`. Aborting the task.")
+    end
+  end
+end

data/lib/kubernetes-deploy/restart_task.rb

@@ -23,6 +23,7 @@ module KubernetesDeploy
     end
 
     HTTP_OK_RANGE = 200..299
+    ANNOTATION = "shipit.shopify.io/restart"
 
     def initialize(context:, namespace:, logger: KubernetesDeploy.logger)
       @context = context
@@ -32,22 +33,33 @@ module KubernetesDeploy
       @v1beta1_kubeclient = build_v1beta1_kubeclient(context)
     end
 
-    def perform(deployments_names)
+    def perform(deployments_names = nil)
       verify_namespace
 
-      if deployments_names.empty?
-        raise ArgumentError, "#perform takes at least one deployment to restart"
+      if deployments_names
+        deployments = fetch_deployments(deployments_names.uniq)
+
+        if deployments.none?
+          raise ArgumentError, "no deployments with names #{deployments_names} found in namespace #{@namespace}"
+        end
+      else
+        deployments = @v1beta1_kubeclient
+          .get_deployments(namespace: @namespace)
+          .select { |d| d.metadata.annotations[ANNOTATION] }
+
+        if deployments.none?
+          raise ArgumentError, "no deployments found in namespace #{@namespace} with #{ANNOTATION} annotation available"
+        end
       end
 
       phase_heading("Triggering restart by touching ENV[RESTARTED_AT]")
-      deployments = fetch_deployments(deployments_names.uniq)
       patch_kubeclient_deployments(deployments)
 
       phase_heading("Waiting for rollout")
       wait_for_rollout(deployments)
 
       names = deployments.map { |d| "`#{d.metadata.name}`" }
-      @logger.info "Restart of #{names.join(', ')} deployments succeeded"
+      @logger.info "Restart of #{names.sort.join(', ')} deployments succeeded"
     end
 
     private

data/lib/kubernetes-deploy/runner.rb

@@ -23,10 +23,13 @@ end
 require 'kubernetes-deploy/resource_watcher'
 require "kubernetes-deploy/ui_helpers"
 require 'kubernetes-deploy/kubectl'
+require 'kubernetes-deploy/kubeclient_builder'
+require 'kubernetes-deploy/ejson_secret_provisioner'
 
 module KubernetesDeploy
   class Runner
     include UIHelpers
+    include KubeclientBuilder
 
     PREDEPLOY_SEQUENCE = %w(
       Cloudsql
@@ -39,6 +42,7 @@ module KubernetesDeploy
     PROTECTED_NAMESPACES = %w(
       default
       kube-system
+      kube-public
     )
 
     # Things removed from default prune whitelist:
@@ -109,6 +113,16 @@ MSG
       phase_heading("Checking initial resource statuses")
       resources.each(&:sync)
 
+      ejson = EjsonSecretProvisioner.new(
+        namespace: @namespace,
+        template_dir: @template_dir,
+        client: build_v1_kubeclient(@context)
+      )
+      if ejson.secret_changes_required?
+        phase_heading("Deploying kubernetes secrets from #{EjsonSecretProvisioner::EJSON_SECRETS_FILE}")
+        ejson.run
+      end
+
       phase_heading("Predeploying priority resources")
       predeploy_priority_resources(resources)
 

data/lib/kubernetes-deploy/version.rb

@@ -1,3 +1,3 @@
 module KubernetesDeploy
-  VERSION = "0.6.1"
+  VERSION = "0.6.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kubernetes-deploy
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.6.2
 platform: ruby
 authors:
 - Kir Shatrov
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-05-01 00:00:00.000000000 Z
+date: 2017-05-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -54,6 +54,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0.5'
+- !ruby/object:Gem::Dependency
+  name: ejson
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.0.1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.0.1
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -124,6 +138,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: mocha
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.1'
 description: Kubernetes deploy scripts
 email:
 - ops-accounts+shipit@shopify.com
@@ -147,6 +175,8 @@ files:
 - exe/kubernetes-run
 - kubernetes-deploy.gemspec
 - lib/kubernetes-deploy.rb
+- lib/kubernetes-deploy/ejson_secret_provisioner.rb
+- lib/kubernetes-deploy/errors.rb
 - lib/kubernetes-deploy/kubeclient_builder.rb
 - lib/kubernetes-deploy/kubeclient_builder/google_friendly_config.rb
 - lib/kubernetes-deploy/kubectl.rb
@@ -188,7 +218,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5.1
+rubygems_version: 2.5.1
 signing_key: 
 specification_version: 4
 summary: Kubernetes deploy scripts