anyscale 0.5.108__tar.gz → 0.5.110__tar.gz

{anyscale-0.5.108/anyscale.egg-info → anyscale-0.5.110}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: anyscale
-Version: 0.5.108
+Version: 0.5.110
 Summary: Command Line Interface for Anyscale
 Home-page: UNKNOWN
 Author: Anyscale Inc.

{anyscale-0.5.108 → anyscale-0.5.110}/anyscale/aws_iam_policies.py

@@ -42,6 +42,7 @@ ANYSCALE_IAM_PERMISSIONS_EC2_STEADY_STATE: Dict[str, Any] = {
                 "ec2:DescribeAvailabilityZones",
                 "ec2:DescribeInstanceTypes",
                 "ec2:DescribeRegions",
+                "ec2:DescribeAccountAttributes",
             ],
             "Resource": "*",
         },
@@ -124,7 +125,7 @@ ANYSCALE_IAM_PERMISSIONS_EC2_STEADY_STATE: Dict[str, Any] = {
         {
             "Sid": "CreateSpotRole",
             "Effect": "Allow",
-            "Action": ["iam:CreateServiceLinkedRole", "iam:PutRolePolicy"],
+            "Action": ["iam:CreateServiceLinkedRole"],
             "Resource": "arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot",
             "Condition": {"StringLike": {"iam:AWSServiceName": "spot.amazonaws.com"}},
         },
@@ -287,7 +288,7 @@ ANYSCALE_IAM_PERMISSIONS_SERVICE_STEADY_STATE = {
             },
         },
         {
-            "Sid": "LinkELBService",
+            "Sid": "CreateELBServiceLinkedRole",
             "Effect": "Allow",
             "Action": "iam:CreateServiceLinkedRole",
             "Resource": "*",
@@ -297,18 +298,6 @@ ANYSCALE_IAM_PERMISSIONS_SERVICE_STEADY_STATE = {
                 }
             },
         },
-        {
-            "Sid": "IAMPolicies",
-            "Effect": "Allow",
-            "Action": [
-                "iam:AttachRolePolicy",
-                "iam:PutRolePolicy",
-                "iam:UpdateRoleDescription",
-                "iam:DeleteServiceLinkedRole",
-                "iam:GetServiceLinkedRoleDeletionStatus",
-            ],
-            "Resource": "*",
-        },
     ],
 }
 

{anyscale-0.5.108 → anyscale-0.5.110}/anyscale/commands/service_commands.py

@@ -19,14 +19,14 @@ def service_cli() -> None:
     pass
 
 
-@service_cli.command(name="deploy", help="Deploy a service to Anyscale.")
+@service_cli.command(name="deploy", help="Deploy a v1 service to Anyscale.")
 @click.argument("service-config-file", required=True)
 @click.option("--name", "-n", required=False, default=None, help="Name of service.")
 @click.option(
     "--description", required=False, default=None, help="Description of service."
 )
 @click.option(
-    "--healthcheck-url", required=False, help="Healthcheck URL for Service.",
+    "--healthcheck-url", required=False, help="Healthcheck URL for service.",
 )
 @click.argument(
     "entrypoint", required=False, nargs=-1,
@@ -56,7 +56,7 @@ def deploy(
 
 @service_cli.command(
     name="rollout",
-    help="Rollout a Service v2 to Anyscale. Please contact support for details.",
+    help="Rollout a v2 service to Anyscale. Please contact support for details.",
 )
 @click.option(
     "-f",
@@ -71,7 +71,7 @@ def deploy(
     required=False,
     default=None,
     type=int,
-    help="The percentage of traffic going to the new version of Service that you are deploying",
+    help="The percentage of traffic to send to the canary version of the service.",
 )
 @click.option(
     "--rollout-strategy",

{anyscale-0.5.108 → anyscale-0.5.110}/anyscale/controllers/cloud_controller.py

@@ -1485,6 +1485,8 @@ class CloudController(BaseController):
     ) -> bool:
         """
         Deletes a cloud by name or id.
+        TODO Delete all GCE resources on cloud delete
+        Including: Anyscale maanged resources, ALB resources, and TLS certs
         """
         cloud_id, cloud_name = get_cloud_id_and_name(
             self.api_client, cloud_id, cloud_name
@@ -1535,18 +1537,19 @@ class CloudController(BaseController):
 
         if cloud.is_bring_your_own_resource is False:
             # managed setup clouds
-            try:
-                if cloud_provider == CloudProviders.AWS:
-                    self.delete_aws_managed_cloud(cloud=cloud)
-                elif cloud_provider == CloudProviders.GCP:
+            if cloud_provider == CloudProviders.AWS:
+                self.delete_all_aws_resources(cloud, skip_confirmation)
+
+            elif cloud_provider == CloudProviders.GCP:
+                try:
                     self.delete_gcp_managed_cloud(cloud=cloud)
-            except ClickException as e:
-                confirm(
-                    f"Error while trying to clean up {cloud_provider} resources:\n{e}\n"
-                    "Do you want to force delete this cloud? You will need to clean up any associated resources on your own.\n"
-                    "Continue with force deletion?",
-                    skip_confirmation,
-                )
+                except ClickException as e:
+                    confirm(
+                        f"Error while trying to clean up {cloud_provider} resources:\n{e}\n"
+                        "Do you want to force delete this cloud? You will need to clean up any associated resources on your own.\n"
+                        "Continue with force deletion?",
+                        skip_confirmation,
+                    )
         elif (
             cloud_provider == CloudProviders.AWS
             and not cloud.is_k8s
@@ -1556,6 +1559,9 @@ class CloudController(BaseController):
             self.log.warning(
                 f"The trust policy that allows Anyscale to assume {cloud.credentials} is still in place. Please delete it manually if you no longer wish anyscale to have access."
             )
+            self.log.warning(
+                "If services v2 were used in this cloud, please delete all TLS certificates and ALB stacks associated to the cloud to avoid unintended costs on your AWS account. "
+            )
         elif (
             cloud_provider == CloudProviders.GCP
             and not cloud.is_k8s
@@ -1579,6 +1585,69 @@ class CloudController(BaseController):
         self.log.info(f"Deleted cloud with name {cloud_name}.")
         return True
 
+    def delete_all_aws_resources(
+        self, cloud: CloudWithCloudResource, skip_confirmation: bool
+    ) -> bool:
+        # Delete service v2 resources
+        # If there is an error while cleaning up service v2 resources, abort
+        try:
+            self.delete_tagged_managed_resources(cloud=cloud)
+            self.delete_tls_certs(cloud=cloud)
+        except ClickException as e:
+            raise ClickException(
+                f"Error while trying to cleanup service v2 resources:\n{e}\n"
+                "Please check your AWS account for relevant errors. "
+                "Manually delete the aforementioned resources and rerun cloud delete once resolved. "
+                "If you experience issues, reach out to Anyscale support for help."
+            )
+        try:
+            # Delete AWS cloud resources
+            self.delete_aws_managed_cloud(cloud=cloud)
+        except ClickException as e:
+            confirm(
+                f"Error while trying to clean up cloud resources:\n{e}\n"
+                "Do you want to force delete this cloud? You will need to clean up any associated resources on your own.\n"
+                "Continue with force deletion?",
+                skip_confirmation,
+            )
+
+        return True
+
+    def delete_tls_certs(self, cloud: CloudWithCloudResource) -> bool:
+        tag_name = "anyscale-cloud-id"
+        key_name = cloud.id
+
+        acm = boto3.client("acm", cloud.region)
+
+        response = acm.list_certificates()
+
+        matching_certs = []
+
+        if "CertificateSummaryList" in response:
+            for certificate in response["CertificateSummaryList"]:
+                if "CertificateArn" in certificate:
+
+                    certificate_arn = certificate["CertificateArn"]
+                    response = acm.list_tags_for_certificate(
+                        CertificateArn=certificate_arn
+                    )
+
+                    if "Tags" in response:
+                        tags = response["Tags"]
+                        for tag in tags:
+                            if (
+                                "Key" in tag
+                                and tag["Key"] == tag_name
+                                and "Value" in tag
+                                and tag["Value"] == key_name
+                            ):
+                                matching_certs.append(certificate_arn)
+
+        resource_delete_status = []
+        for certificate_arn in matching_certs:
+            resource_delete_status.append(self.delete_tls_cert(certificate_arn, cloud))
+        return all(resource_delete_status)
+
     def delete_aws_managed_cloud(self, cloud: CloudWithCloudResource) -> bool:
         if (
             not cloud.cloud_resource
@@ -1588,9 +1657,68 @@ class CloudController(BaseController):
                 f"This cloud {cloud.id} does not have a cloudformation stack."
             )
 
-        cfn_client = _client("cloudformation", cloud.region)
         cfn_stack_arn = cloud.cloud_resource.aws_cloudformation_stack_id
+
+        self.log.info(
+            f"\nThe S3 bucket ({cloud.cloud_resource.aws_s3_id}) associated with this cloud still exists."
+            "\nIf you no longer need the data associated with this bucket, please delete it."
+        )
+
+        return self.delete_aws_cloudformation_stack(
+            cfn_stack_arn=cfn_stack_arn, cloud=cloud
+        )
+
+    def delete_tagged_managed_resources(self, cloud: CloudWithCloudResource) -> bool:
+
+        tag_name = "anyscale-cloud-id"
+        key_name = cloud.id
+
+        cfn_client = _client("cloudformation", cloud.region)
+        # Get a list of all the CloudFormation stacks with the specified tag
+        stacks = cfn_client.list_stacks()
+
+        resources_to_cleanup = []
+
+        for stack in stacks.get("StackSummaries", []):
+            if "StackName" in stack and "StackId" in stack:
+                cfn_stack_arn = stack["StackId"]
+                stack["StackName"]
+
+                stack_description = cfn_client.describe_stacks(StackName=cfn_stack_arn)
+
+                # Extract the tags from the response
+                if (
+                    "Stacks" in stack_description
+                    and stack_description["Stacks"]
+                    and "Tags" in stack_description["Stacks"][0]
+                ):
+                    tags = stack_description["Stacks"][0]["Tags"]
+                    for tag in tags:
+                        if (
+                            "Key" in tag
+                            and tag["Key"] == tag_name
+                            and "Value" in tag
+                            and tag["Value"] == key_name
+                        ):
+                            resources_to_cleanup.append(cfn_stack_arn)
+
+        resource_delete_status = []
+        for cfn_stack_arn in resources_to_cleanup:
+            resource_delete_status.append(
+                self.delete_aws_cloudformation_stack(
+                    cfn_stack_arn=cfn_stack_arn, cloud=cloud
+                )
+            )
+
+        return all(resource_delete_status)
+
+    def delete_aws_cloudformation_stack(
+        self, cfn_stack_arn: str, cloud: CloudWithCloudResource
+    ) -> bool:
+        cfn_client = _client("cloudformation", cloud.region)
+
         cfn_stack_url = f"https://{cloud.region}.console.aws.amazon.com/cloudformation/home?region={cloud.region}#/stacks/stackinfo?stackId={cfn_stack_arn}"
+
         try:
             cfn_client.delete_stack(StackName=cfn_stack_arn)
         except ClientError:
@@ -1599,7 +1727,9 @@ class CloudController(BaseController):
             ) from None
 
         self.log.info(f"\nTrack progress of cloudformation at {cfn_stack_url}")
-        with self.log.spinner("Deleting cloud resources through cloudformation..."):
+        with self.log.spinner(
+            f"Deleting cloud resource {cfn_stack_arn} through cloudformation..."
+        ):
             end_time = time.time() + CLOUDFORMATION_TIMEOUT_SECONDS
             while time.time() < end_time:
                 try:
@@ -1617,7 +1747,7 @@ class CloudController(BaseController):
                     )
                     break
 
-                if cfn_stack["StackStatus"] in ("DELETE_FAILED",):
+                if cfn_stack["StackStatus"] in ("DELETE_FAILED"):
                     # Provide link to cloudformation
                     raise ClickException(
                         f"Failed to delete cloud resources. Please check your cloudformation stack for errors. {cfn_stack_url}"
@@ -1628,10 +1758,21 @@ class CloudController(BaseController):
                 raise ClickException(
                     f"Timed out deleting AWS resources. Please check your cloudformation stack for errors. {cfn_stack['StackId']}"
                 )
-        self.log.info(
-            f"\nThe S3 bucket ({cloud.cloud_resource.aws_s3_id}) associated with this cloud still exists."
-            "\nIf you no longer need the data associated with this bucket, please delete it."
-        )
+
+        return True
+
+    def delete_tls_cert(
+        self, certificate_arn: str, cloud: CloudWithCloudResource
+    ) -> bool:
+        acm = boto3.client("acm", cloud.region)
+
+        try:
+            acm.delete_certificate(CertificateArn=certificate_arn)
+        except ClientError:
+            raise ClickException(
+                f"Failed to delete TLS certificate {certificate_arn}."
+            ) from None
+
         return True
 
     def delete_gcp_managed_cloud(self, cloud: CloudWithCloudResourceGCP) -> bool:

anyscale-0.5.110/anyscale/version.py

@@ -0,0 +1 @@
+__version__ = "0.5.110"

{anyscale-0.5.108 → anyscale-0.5.110/anyscale.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: anyscale
-Version: 0.5.108
+Version: 0.5.110
 Summary: Command Line Interface for Anyscale
 Home-page: UNKNOWN
 Author: Anyscale Inc.

{anyscale-0.5.108 → anyscale-0.5.110}/tests/controllers/BUILD.bazel

@@ -29,6 +29,7 @@ py_tests_with_shim(
         requirement("humanize"),
         requirement("tzlocal"),
         requirement("smart_open"),
+        requirement("mypy-boto3-cloudformation"),
     ],
 )
 

{anyscale-0.5.108 → anyscale-0.5.110}/tests/controllers/test_cloud_controller.py

@@ -1,13 +1,14 @@
 from datetime import timedelta
 import json
-from typing import Any, Dict, Iterator, Optional
+from typing import Any, Dict, Iterator, List, Optional
 from unittest.mock import ANY, MagicMock, Mock, patch
 
 import boto3
 from click import ClickException
 from google.api_core.exceptions import NotFound
 from google.auth.credentials import AnonymousCredentials
-from moto import mock_cloudformation
+from moto import mock_acm, mock_cloudformation
+import mypy_boto3_cloudformation.type_defs as cf_types
 import pytest
 
 from anyscale.client.openapi_client.models import (
@@ -1160,6 +1161,8 @@ def test_delete_cloud(provider: str):
 
         cloud_controller.api_client.delete_cloud_api_v2_clouds_cloud_id_delete = Mock()
         cloud_controller.delete_aws_managed_cloud = Mock()  # type: ignore[assignment]
+        cloud_controller.delete_tagged_managed_resources = Mock()  # type: ignore[assignment]
+        cloud_controller.delete_tls_certs = Mock()  # type: ignore[assignment]
         cloud_controller.delete_gcp_managed_cloud = Mock()  # type: ignore[assignment]
         mock_confirm = Mock(return_value=True)
 
@@ -1177,6 +1180,16 @@ def test_delete_cloud(provider: str):
         )
 
         if provider == "AWS":
+            cloud_controller.delete_aws_managed_cloud.assert_called_with(
+                cloud=mock_cloud.result
+            )
+            cloud_controller.delete_tagged_managed_resources.assert_called_with(
+                cloud=mock_cloud.result
+            )
+            cloud_controller.delete_tls_certs.assert_called_with(
+                cloud=mock_cloud.result
+            )
+
             cloud_controller.delete_aws_managed_cloud.assert_called_with(
                 cloud=mock_cloud.result
             )
@@ -1198,6 +1211,45 @@ def test_delete_cloud(provider: str):
             )
 
 
+@pytest.mark.parametrize("exception_delete_managed_resources", [True, False])
+@pytest.mark.parametrize("exception_delete_tls_certs", [True, False])
+@mock_cloudformation
+def test_fail_delete_service_resources(
+    exception_delete_managed_resources: bool, exception_delete_tls_certs: bool
+):
+    """
+    If either delete_tagged_managed_resources, or delete_tls_certs throws an exception,
+    make sure that delete_aws_managed_cloud is not called
+    """
+
+    cloud_controller = CloudController()
+    mock_log_spinner = MagicMock()
+    mock_log_spinner.return_value.__enter__.return_value = Mock()
+    cloud_controller.log = Mock(spinner=mock_log_spinner)
+
+    cloud_controller.delete_tagged_managed_resources = Mock()  # type: ignore[assignment]
+    cloud_controller.delete_tls_certs = Mock()  # type: ignore[assignment]
+    cloud_controller.delete_aws_managed_cloud = Mock()  # type: ignore[assignment]
+
+    if exception_delete_managed_resources:
+        cloud_controller.delete_tagged_managed_resources.side_effect = ClickException(
+            "Mock Error"
+        )
+
+    if exception_delete_tls_certs:
+        cloud_controller.delete_tls_certs.side_effect = ClickException("Mock Error")
+
+    if exception_delete_managed_resources or exception_delete_tls_certs:
+        with pytest.raises(ClickException):
+            cloud_controller.delete_all_aws_resources(Mock(), Mock())
+
+        cloud_controller.delete_aws_managed_cloud.assert_not_called()
+
+    else:
+        cloud_controller.delete_all_aws_resources(Mock(), Mock())
+        cloud_controller.delete_aws_managed_cloud.assert_called_once()
+
+
 @pytest.mark.parametrize("pre_deleted", [True, False])
 @mock_cloudformation
 def test_delete_aws_managed_cloud(pre_deleted: bool):
@@ -1219,7 +1271,130 @@ def test_delete_aws_managed_cloud(pre_deleted: bool):
     mock_log_spinner.return_value.__enter__.return_value = Mock()
     cloud_controller.log = Mock(spinner=mock_log_spinner)
 
-    assert cloud_controller.delete_aws_managed_cloud(cloud=cloud_mock)
+    with patch.object(
+        cloud_controller,
+        "delete_aws_cloudformation_stack",
+        return_value=cloud_controller.delete_aws_cloudformation_stack,
+    ) as mock_delete_aws_cloudformation_stack:
+
+        assert cloud_controller.delete_aws_managed_cloud(cloud=cloud_mock)
+
+        mock_delete_aws_cloudformation_stack.assert_called_once_with(
+            cfn_stack_arn=stack_id, cloud=cloud_mock
+        )
+
+        assert mock_delete_aws_cloudformation_stack.return_value
+
+
+@pytest.mark.parametrize("pre_deleted", [True, False])
+@mock_acm
+def test_delete_tls_certs(pre_deleted: bool):
+    mock_cloud_id = "mock_cloud_id"
+
+    acm = boto3.client("acm", region_name="us-west-2")
+
+    aws_tags: List[cf_types.TagTypeDef] = [
+        {"Key": "anyscale-cloud-id", "Value": mock_cloud_id}
+    ]
+    domain = "mockdomain.com"
+    acm_response = acm.request_certificate(
+        DomainName=domain, ValidationMethod="DNS", Tags=aws_tags,
+    )
+
+    certificates = acm.list_certificates()
+    assert certificates["CertificateSummaryList"]
+
+    certificate_arn = acm_response["CertificateArn"]
+    if pre_deleted:
+        acm.delete_certificate(CertificateArn=certificate_arn)
+
+    cloud_mock = Mock(id=mock_cloud_id, region="us-west-2", cloud_resource=Mock(),)
+    cloud_controller = CloudController()
+    mock_log_spinner = MagicMock()
+    mock_log_spinner.return_value.__enter__.return_value = Mock()
+    cloud_controller.log = Mock(spinner=mock_log_spinner)
+
+    assert cloud_controller.delete_tls_certs(cloud=cloud_mock)
+
+    # Check that the TLS cert was deleted
+    certificates = acm.list_certificates()
+    assert not certificates["CertificateSummaryList"]
+
+
+@pytest.mark.parametrize("pre_deleted", [True, False])
+@mock_cloudformation
+def test_delete_tagged_managed_resources(pre_deleted: bool):
+    mock_cloud_id = "mock_cloud_id"
+
+    cfn = boto3.client("cloudformation", region_name="us-west-2")
+    aws_tags: List[cf_types.TagTypeDef] = [
+        {"Key": "anyscale-cloud-id", "Value": mock_cloud_id}
+    ]
+
+    stack_response = cfn.create_stack(
+        StackName="stack_name", TemplateBody="{Resources: {}}", Tags=aws_tags,
+    )
+    stack_id = stack_response["StackId"]
+    if pre_deleted:
+        cfn.delete_stack(StackName=stack_id)
+
+    cloud_mock = Mock(
+        id=mock_cloud_id,
+        region="us-west-2",
+        cloud_resource=Mock(aws_cloudformation_stack_id=stack_id,),
+    )
+    cloud_controller = CloudController()
+    mock_log_spinner = MagicMock()
+    mock_log_spinner.return_value.__enter__.return_value = Mock()
+    cloud_controller.log = Mock(spinner=mock_log_spinner)
+
+    with patch.object(
+        cloud_controller,
+        "delete_aws_cloudformation_stack",
+        return_value=cloud_controller.delete_aws_cloudformation_stack,
+    ) as mock_delete_aws_cloudformation_stack:
+
+        assert cloud_controller.delete_tagged_managed_resources(cloud=cloud_mock)
+
+        mock_delete_aws_cloudformation_stack.assert_called_once_with(
+            cfn_stack_arn=stack_id, cloud=cloud_mock
+        )
+
+        assert mock_delete_aws_cloudformation_stack.return_value
+
+
+@pytest.mark.parametrize("valid_stack_id", [True, False])
+@mock_cloudformation
+def test_delete_aws_cloudformation_stack(valid_stack_id: bool):
+    mock_cloud_id = "mock_cloud_id"
+
+    cfn = boto3.client("cloudformation", region_name="us-west-2")
+
+    stack_response = cfn.create_stack(
+        StackName="stack_name", TemplateBody="{Resources: {}}",
+    )
+    stack_id = stack_response["StackId"]
+    cloud_mock = Mock(
+        id=mock_cloud_id,
+        region="us-west-2",
+        cloud_resource=Mock(aws_cloudformation_stack_id=stack_id,),
+    )
+    cloud_controller = CloudController()
+    mock_log_spinner = MagicMock()
+    mock_log_spinner.return_value.__enter__.return_value = Mock()
+    cloud_controller.log = Mock(spinner=mock_log_spinner)
+
+    if valid_stack_id:
+        assert cloud_controller.delete_aws_cloudformation_stack(
+            cfn_stack_arn=stack_id, cloud=cloud_mock
+        )
+    else:
+        with pytest.raises(
+            ClickException, match=r"Failed to fetch the cloudformation stack",
+        ):
+            cloud_controller.delete_aws_cloudformation_stack(
+                cfn_stack_arn="mock_id", cloud=cloud_mock
+            )
 
 
 @mock_cloudformation

{anyscale-0.5.108 → anyscale-0.5.110}/tests/test_util.py

@@ -433,11 +433,11 @@ def test_populate_dict_method_in_workspace(config_dict: Dict[str, Any]):
             {
                 "iam:PassRole",
                 "iam:CreateServiceLinkedRole",
-                "iam:PutRolePolicy",
                 "iam:GetInstanceProfile",
                 "ec2:DescribeAvailabilityZones",
                 "ec2:DescribeInstanceTypes",
                 "ec2:DescribeRegions",
+                "ec2:DescribeAccountAttributes",
                 "ec2:DescribeInstances",
                 "ec2:DescribeSubnets",
                 "ec2:DescribeRouteTables",

anyscale-0.5.108/anyscale/version.py

@@ -1 +0,0 @@
-__version__ = "0.5.108"