cloudbridge 4.4.0__tar.gz → 4.4.2__tar.gz

{cloudbridge-4.4.0 → cloudbridge-4.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudbridge
-Version: 4.4.0
+Version: 4.4.2
 Summary: A simple layer of abstraction over multiple cloud providers.
 Author-email: Galaxy and GVL Projects <help@genome.edu.au>
 License-Expression: MIT
@@ -26,6 +26,7 @@ Description-Content-Type: text/x-rst
 License-File: LICENSE
 Requires-Dist: tenacity>=6.0
 Requires-Dist: pyeventsystem<2
+Requires-Dist: cryptography>=3.4
 Provides-Extra: aws
 Requires-Dist: boto3<2.0.0,>=1.9.86; extra == "aws"
 Provides-Extra: azure

{cloudbridge-4.4.0 → cloudbridge-4.4.2}/cloudbridge/__init__.py

@@ -3,7 +3,7 @@ import logging
 from typing import Any
 
 # Current version of the library
-__version__ = '4.4.0'
+__version__ = '4.4.2'
 
 
 def get_version() -> str:

{cloudbridge-4.4.0 → cloudbridge-4.4.2}/cloudbridge/base/provider.py

@@ -193,6 +193,13 @@ class BaseCloudProvider(CloudProvider):
         """
         A convenience method to extract a configuration value.
 
+        The config dict is consulted first, then an attribute of the same
+        name on the config object, then the ``[<provider id>]`` section of
+        the cloudbridge ini file. A value is taken from the first source
+        that has it set; only ``None`` and the empty string count as unset,
+        so ``False`` and ``0`` are returned as configured rather than
+        replaced by the default.
+
         :type key: str
         :param key: a field to look for in the ``self.config`` field
 
@@ -204,12 +211,15 @@ class BaseCloudProvider(CloudProvider):
         """
         log.debug("Getting config key %s, with supplied default value: %s",
                   key, default_value)
-        value = default_value
-        if isinstance(self.config, dict) and self.config.get(key):
-            value = self.config.get(key, default_value)
-        elif hasattr(self.config, key) and getattr(self.config, key):
-            value = getattr(self.config, key)
-        elif (self._config_parser.has_option(self.PROVIDER_ID, key) and
-              self._config_parser.get(self.PROVIDER_ID, key)):
+        value = self.config.get(key) if isinstance(self.config, dict) else None
+        if not self._is_set(value):
+            value = getattr(self.config, key, None)
+        if (not self._is_set(value) and
+                self._config_parser.has_option(self.PROVIDER_ID, key)):
             value = self._config_parser.get(self.PROVIDER_ID, key)
-        return value
+        return value if self._is_set(value) else default_value
+
+    @staticmethod
+    def _is_set(value: Any) -> bool:
+        """Whether a config value was supplied, as opposed to left blank."""
+        return value is not None and value != ''

{cloudbridge-4.4.0 → cloudbridge-4.4.2}/cloudbridge/providers/gcp/helpers.py

@@ -13,12 +13,45 @@ from googleapiclient.errors import HttpError
 
 import tenacity
 
+from cloudbridge.interfaces.exceptions import DuplicateResourceException
 from cloudbridge.interfaces.exceptions import ProviderInternalException
 
 if TYPE_CHECKING:
     from .provider import GCPCloudProvider
 
 
+class GCPOperationError(ProviderInternalException):
+    """A GCP operation completed with an error.
+
+    Raised by ``wait_for_operation`` with the operation's ``error`` payload,
+    so callers can act on the error codes rather than parse the message.
+    """
+
+    def __init__(self, error: Any) -> None:
+        super().__init__(error)
+        self.error = error
+
+    @property
+    def codes(self) -> list[str]:
+        return [e.get('code', '') for e in self.error.get('errors', [])]
+
+
+class MetadataWriteNotApplied(ProviderInternalException):
+    """A common-metadata write completed as DONE but is absent when read back.
+
+    Observed under concurrent writers: GCP accepts several writes against
+    the same fingerprint while an earlier one is still pending, and a later
+    one can complete without its change surviving. The write is retried on
+    fresh metadata; this is raised only once the retries are exhausted.
+    """
+
+    def __init__(self, keys: list[str]) -> None:
+        super().__init__(
+            'Project metadata write reported done, but these keys do not '
+            'hold the written value: {}'.format(', '.join(keys)))
+        self.keys = keys
+
+
 def gcp_projects(provider: "GCPCloudProvider") -> Any:
     return provider.gcp_compute.projects()
 
@@ -43,8 +76,18 @@ def get_common_metadata(provider: "GCPCloudProvider") -> Any:
     return metadata["commonInstanceMetadata"]
 
 
-def __if_fingerprint_differs(e: BaseException) -> bool:
-    # return True if the CloudError exception is due to subnet being in use
+def __metadata_write_lost_to_a_concurrent_writer(e: BaseException) -> bool:
+    """Whether ``e`` means a metadata write must be redone on fresh metadata.
+
+    A concurrent writer shows up in three shapes: an HTTP 412 on the request
+    itself, a submitted operation that completes with ``CONDITION_NOT_MET``,
+    or - when GCP accepted both writes against the same fingerprint - an
+    operation that completes as DONE without the change surviving.
+    """
+    if isinstance(e, GCPOperationError):
+        return 'CONDITION_NOT_MET' in e.codes
+    if isinstance(e, MetadataWriteNotApplied):
+        return True
     if isinstance(e, HttpError):
         expected_message = 'Supplied fingerprint does not match current ' \
                            'metadata fingerprint.'
@@ -53,8 +96,14 @@ def __if_fingerprint_differs(e: BaseException) -> bool:
     return False
 
 
+def _metadata_values(metadata: Any) -> dict[str, Any]:
+    return {item['key']: item.get('value')
+            for item in metadata.get('items', [])}
+
+
 @tenacity.retry(stop=tenacity.stop_after_attempt(10),
-                retry=tenacity.retry_if_exception(__if_fingerprint_differs),
+                retry=tenacity.retry_if_exception(
+                    __metadata_write_lost_to_a_concurrent_writer),
                 wait=tenacity.wait_exponential(max=10),
                 reraise=True)
 def gcp_metadata_save_op(provider: "GCPCloudProvider",
@@ -66,16 +115,36 @@ def gcp_metadata_save_op(provider: "GCPCloudProvider",
     retrieves the metadata, invokes the provided callback with that
     metadata, and saves the metadata using the original fingerprint
     immediately afterwards, ensuring that update conflicts can be detected.
+
+    The fingerprint alone is not enough: a write that GCP reports as done
+    can still be missing from the document when another write was accepted
+    against the same fingerprint. So the write is only finished once the
+    callback's changes can be read back, and is redone on fresh metadata
+    otherwise. A callback that changes nothing sends no write at all - every
+    write re-uploads the whole document and moves the fingerprint, which
+    would only add contention for other writers.
     """
     def _save_common_metadata(provider: "GCPCloudProvider") -> None:
         # get the latest metadata (so we get the latest fingerprint)
         metadata = get_common_metadata(provider)
+        before = _metadata_values(metadata)
         # allow callback to do processing on it
         callback(metadata)
+        wanted = _metadata_values(metadata)
+        changes = {key: wanted.get(key) for key in before.keys() | wanted.keys()
+                   if before.get(key) != wanted.get(key)}
+        if not changes:
+            return
         # save the metadata
         operation = gcp_projects(provider).setCommonInstanceMetadata(
             project=provider.project_name, body=metadata).execute()
         provider.wait_for_operation(operation)
+        # ...and make sure it stuck
+        current = _metadata_values(get_common_metadata(provider))
+        lost = sorted(key for key, value in changes.items()
+                      if current.get(key) != value)
+        if lost:
+            raise MetadataWriteNotApplied(lost)
 
     # Retry a few times if the fingerprints conflict
     _save_common_metadata(provider)
@@ -98,15 +167,24 @@ def modify_or_add_metadata_item(provider: "GCPCloudProvider", key: str,
     gcp_metadata_save_op(provider, _update_metadata_key)
 
 
-# This function will raise an HttpError with message containing
-# "Metadata has duplicate key" if it's not unique, unlike the previous
-# method which either adds or updates the value corresponding to that key
 def add_metadata_item(provider: "GCPCloudProvider", key: str,
                       value: str) -> None:
+    """Add ``key``, raising ``DuplicateResourceException`` if it is taken.
+
+    Unlike ``modify_or_add_metadata_item`` this never overwrites. The
+    check is done on the freshly fetched metadata so that a retry after a
+    lost write does not append a second copy of a key that did land: a key
+    already holding this very value is this write, and counts as done.
+    """
     def _add_metadata_key(metadata: Any) -> None:
-        entry = {'key': key, 'value': value}
         entries = metadata.get('items', [])
-        entries.append(entry)
+        existing = [item for item in entries if item['key'] == key]
+        if existing:
+            if existing[-1].get('value') == value:
+                return
+            raise DuplicateResourceException(
+                'Metadata key {0} already exists'.format(key))
+        entries.append({'key': key, 'value': value})
         # Reassign explicitly in case the original get returned [] although
         # if not it will be already updated
         metadata['items'] = entries
@@ -136,30 +214,25 @@ def get_metadata_item_value(provider: "GCPCloudProvider", key: str) -> Any:
 
 
 def remove_metadata_item(provider: "GCPCloudProvider", key: str) -> bool:
-    def _remove_metadata_by_key(metadata: Any) -> bool | None:
-        items = metadata.get('items', [])
-        # No metadata to delete
-        if not items:
-            return False
-        else:
-            entries = [item for item in metadata.get('items', [])
-                       if item['key'] != key]
-
-            # Make sure only one entry is deleted
-            if len(entries) < len(items) - 1:
-                raise ProviderInternalException("Multiple metadata entries "
-                                                "found for the same key {}"
-                                                .format(key))
-            # If none is deleted indicate so by returning False
-            elif len(entries) == len(items):
-                return False
+    """Remove ``key``; ``False`` if there was nothing to remove."""
+    removed = False
 
-            else:
-                metadata['items'] = entries
-                return None
+    def _remove_metadata_by_key(metadata: Any) -> None:
+        nonlocal removed
+        items = metadata.get('items', [])
+        entries = [item for item in items if item['key'] != key]
+        # Make sure only one entry is deleted
+        if len(entries) < len(items) - 1:
+            raise ProviderInternalException("Multiple metadata entries "
+                                            "found for the same key {}"
+                                            .format(key))
+        # A retry after a lost write finds the key still present and
+        # removes it again; the first attempt decides whether it was there.
+        removed = removed or len(entries) < len(items)
+        metadata['items'] = entries
 
     gcp_metadata_save_op(provider, _remove_metadata_by_key)
-    return True
+    return removed
 
 
 def __if_label_fingerprint_differs(e: BaseException) -> bool:

{cloudbridge-4.4.0 → cloudbridge-4.4.2}/cloudbridge/providers/gcp/provider.py

@@ -30,6 +30,7 @@ from cloudbridge.interfaces.services import NetworkingService
 from cloudbridge.interfaces.services import SecurityService
 from cloudbridge.interfaces.services import StorageService
 
+from .helpers import GCPOperationError
 from .services import GCPComputeService
 from .services import GCPDnsService
 from .services import GCPNetworkingService
@@ -401,7 +402,7 @@ class GCPCloudProvider(BaseCloudProvider):
             result = operations.get(**args).execute()
             if result['status'] == 'DONE':
                 if 'error' in result:
-                    raise Exception(result['error'])
+                    raise GCPOperationError(result['error'])
                 return result
 
             time.sleep(0.5)

{cloudbridge-4.4.0 → cloudbridge-4.4.2}/cloudbridge/providers/gcp/services.py

@@ -188,7 +188,12 @@ class GCPKeyPairService(BaseKeyPairService):
                                       GCPKeyPair.KP_TAG_PREFIX + name,
                                       metadata_value)
             return GCPKeyPair(provider, kp_info, private_key)
+        except DuplicateResourceException:
+            raise DuplicateResourceException(
+                'A KeyPair with name {0} already exists'.format(name))
         except googleapiclient.errors.HttpError as err:
+            # GCP's own duplicate-key rejection, should a concurrent create
+            # slip past the check on the fetched metadata.
             if err.resp.get('content-type', '').startswith('application/json'):
                 message = (json.loads(err.content).get('error', {})
                            .get('errors', [{}])[0].get('message'))

{cloudbridge-4.4.0 → cloudbridge-4.4.2}/cloudbridge/providers/openstack/provider.py

@@ -44,14 +44,29 @@ class OpenStackCloudProvider(BaseCloudProvider):
         super(OpenStackCloudProvider, self).__init__(config)
 
         # Initialize cloud connection fields
-        self.app_cred_id = self._get_config_value(
-            'os_application_credential_id', get_env('OS_APPLICATION_CREDENTIAL_ID'))
-        self.app_cred_secret = self._get_config_value(
-            'os_application_credential_secret', get_env('OS_APPLICATION_CREDENTIAL_SECRET'))
-        self.username = self._get_config_value(
-            'os_username', get_env('OS_USERNAME'))
-        self.password = self._get_config_value(
-            'os_password', get_env('OS_PASSWORD'))
+        # Credentials come from the config first and the OS_* environment
+        # second. The two credential sets are resolved separately: the
+        # environment only completes the set the config names, so a provider
+        # configured with an application credential never picks up the
+        # process's own OS_USERNAME/OS_PASSWORD and signs in as that identity
+        # instead (and vice versa). With neither set configured, both are read
+        # from the environment as before.
+        app_cred_id = self._get_config_value('os_application_credential_id')
+        app_cred_secret = self._get_config_value(
+            'os_application_credential_secret')
+        username = self._get_config_value('os_username')
+        password = self._get_config_value('os_password')
+        env_app_cred = not (username or password)
+        env_password = not (app_cred_id or app_cred_secret)
+        self.app_cred_id = app_cred_id or (
+            get_env('OS_APPLICATION_CREDENTIAL_ID') if env_app_cred else None)
+        self.app_cred_secret = app_cred_secret or (
+            get_env('OS_APPLICATION_CREDENTIAL_SECRET') if env_app_cred
+            else None)
+        self.username = username or (
+            get_env('OS_USERNAME') if env_password else None)
+        self.password = password or (
+            get_env('OS_PASSWORD') if env_password else None)
         self.project_name = self._get_config_value(
             'os_project_name', get_env('OS_PROJECT_NAME')
             or get_env('OS_TENANT_NAME'))

{cloudbridge-4.4.0 → cloudbridge-4.4.2}/cloudbridge.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudbridge
-Version: 4.4.0
+Version: 4.4.2
 Summary: A simple layer of abstraction over multiple cloud providers.
 Author-email: Galaxy and GVL Projects <help@genome.edu.au>
 License-Expression: MIT
@@ -26,6 +26,7 @@ Description-Content-Type: text/x-rst
 License-File: LICENSE
 Requires-Dist: tenacity>=6.0
 Requires-Dist: pyeventsystem<2
+Requires-Dist: cryptography>=3.4
 Provides-Extra: aws
 Requires-Dist: boto3<2.0.0,>=1.9.86; extra == "aws"
 Provides-Extra: azure

{cloudbridge-4.4.0 → cloudbridge-4.4.2}/cloudbridge.egg-info/SOURCES.txt

@@ -62,6 +62,7 @@ tests/test_compute_service.py
 tests/test_default_network.py
 tests/test_dns_service.py
 tests/test_download_driver.py
+tests/test_gcp_metadata_save.py
 tests/test_image_service.py
 tests/test_interface.py
 tests/test_iter_content.py
@@ -70,6 +71,7 @@ tests/test_multipart_driver.py
 tests/test_network_service.py
 tests/test_object_life_cycle.py
 tests/test_object_store_service.py
+tests/test_openstack_credentials.py
 tests/test_region_service.py
 tests/test_security_service.py
 tests/test_vm_types_service.py

{cloudbridge-4.4.0 → cloudbridge-4.4.2}/cloudbridge.egg-info/requires.txt

@@ -1,5 +1,6 @@
 tenacity>=6.0
 pyeventsystem<2
+cryptography>=3.4
 
 [aws]
 boto3<2.0.0,>=1.9.86

{cloudbridge-4.4.0 → cloudbridge-4.4.2}/pyproject.toml

@@ -31,6 +31,11 @@ classifiers = [
 dependencies = [
     "tenacity>=6.0",
     "pyeventsystem<2",
+    # Imported at module scope by cloudbridge.base.helpers, which almost
+    # everything else imports, so it is required for the library to import at
+    # all - not just for generate_key_pair, which is what actually uses it.
+    # Kept unpinned above the floor, per the general-purpose library policy.
+    "cryptography>=3.4",
 ]
 dynamic = ["version"]
 

{cloudbridge-4.4.0 → cloudbridge-4.4.2}/tests/test_cloud_helpers.py

@@ -98,3 +98,29 @@ class CloudHelpersTestCase(ProviderTestBase):
         int_value = self.provider._get_config_value(
             'default_result_limit', None)
         self.assertIsInstance(int_value, int)
+
+    def test_config_value_set_to_false_is_honored(self):
+        # A boolean option turned off must not be mistaken for an unset one:
+        # `s3_validate_certs: False` has to reach the SDK as False, not as
+        # the default of True.
+        self.provider.config['falsy_bool_check'] = False
+        # pylint:disable=protected-access
+        self.assertIs(
+            self.provider._get_config_value('falsy_bool_check', True), False)
+
+    def test_config_value_set_to_zero_is_honored(self):
+        self.provider.config['falsy_int_check'] = 0
+        # pylint:disable=protected-access
+        self.assertEqual(
+            self.provider._get_config_value('falsy_int_check', 4), 0)
+
+    def test_config_value_none_or_blank_falls_back_to_default(self):
+        # None and the empty string are what an absent value looks like
+        # coming from YAML, a blank environment variable or a blank ini
+        # option, so those alone mean "not configured".
+        for unset in (None, ''):
+            self.provider.config['unset_check'] = unset
+            # pylint:disable=protected-access
+            self.assertEqual(
+                self.provider._get_config_value('unset_check', 'default'),
+                'default', repr(unset))

cloudbridge-4.4.2/tests/test_gcp_metadata_save.py

@@ -0,0 +1,208 @@
+"""Making GCP common-metadata writes stick.
+
+GCP keeps labels and key pairs in the project-wide common instance metadata,
+which every write re-uploads under an optimistic fingerprint. Under
+concurrent writers two things happen that a write has to survive: the
+operation fails with ``CONDITION_NOT_MET`` (a different path from the
+HTTP-level 412), and - observed in the live suite - the operation reports
+``DONE`` yet the change is absent from the document afterwards. Both must
+lead to the write being re-applied on freshly fetched metadata. No SDK is
+involved: the compute client is a fake with a server-side document, and the
+provider's real ``wait_for_operation`` polls it.
+"""
+
+import unittest
+from unittest import mock
+
+import tenacity
+
+from cloudbridge.interfaces.exceptions import DuplicateResourceException
+from cloudbridge.providers.gcp.helpers import GCPOperationError
+from cloudbridge.providers.gcp.helpers import MetadataWriteNotApplied
+from cloudbridge.providers.gcp.helpers import add_metadata_item
+from cloudbridge.providers.gcp.helpers import gcp_metadata_save_op
+from cloudbridge.providers.gcp.helpers import modify_or_add_metadata_item
+from cloudbridge.providers.gcp.helpers import remove_metadata_item
+from cloudbridge.providers.gcp.provider import GCPCloudProvider
+
+FINGERPRINT_CONFLICT = {
+    'errors': [{'code': 'CONDITION_NOT_MET',
+                'message': 'Supplied fingerprint does not match current '
+                           'metadata fingerprint.'}]}
+OTHER_FAILURE = {
+    'errors': [{'code': 'RESOURCE_NOT_FOUND',
+                'message': "The resource 'projects/p' was not found"}]}
+
+# Scripted outcomes for successive set operations.
+APPLY = 'apply'        # the write lands and the fingerprint moves on
+LOST = 'lost'          # reported DONE, but nothing changed
+CONFLICT = 'conflict'  # CONDITION_NOT_MET, nothing changed
+
+
+class _Call:
+    def __init__(self, result):
+        self._result = result
+
+    def execute(self):
+        return self._result
+
+
+class _FakeCompute:
+    """A compute client holding one project metadata document.
+
+    ``projects().get()`` returns a copy of the document; each
+    ``setCommonInstanceMetadata()`` yields an operation whose fate is the
+    next entry in ``outcomes``, resolved when ``wait_for_operation`` polls
+    ``globalOperations().get()``.
+    """
+
+    def __init__(self, outcomes, items=None):
+        self.outcomes = list(outcomes)
+        self.document = {'fingerprint': 'fp-0',
+                         'items': list(items or [])}
+        self.version = 0
+        self.fetches = 0
+        self.saved_bodies = []
+        self._pending = {}
+
+    def projects(self):
+        return self
+
+    def globalOperations(self):
+        return self
+
+    def get(self, project, operation=None):
+        if operation is not None:
+            return self._resolve(operation)
+        self.fetches += 1
+        return _Call({'commonInstanceMetadata': {
+            'fingerprint': self.document['fingerprint'],
+            'items': [dict(i) for i in self.document['items']]}})
+
+    def setCommonInstanceMetadata(self, project, body):
+        self.saved_bodies.append(body)
+        name = 'op-%d' % len(self.saved_bodies)
+        self._pending[name] = body
+        return _Call({'name': name})
+
+    def _resolve(self, name):
+        body = self._pending.pop(name)
+        outcome = self.outcomes.pop(0)
+        result = {'status': 'DONE'}
+        if outcome == APPLY:
+            self.version += 1
+            self.document = {'fingerprint': 'fp-%d' % self.version,
+                             'items': [dict(i) for i in body['items']]}
+        elif outcome == CONFLICT:
+            result['error'] = FINGERPRINT_CONFLICT
+        elif outcome == LOST:
+            pass
+        else:
+            result['error'] = outcome
+        return _Call(result)
+
+    def keys(self):
+        return {i['key']: i['value'] for i in self.document['items']}
+
+
+class _FakeProvider:
+    project_name = 'p'
+    wait_for_operation = GCPCloudProvider.wait_for_operation
+
+    def __init__(self, outcomes, items=None):
+        self.gcp_compute = _FakeCompute(outcomes, items)
+
+
+class GCPMetadataSaveTestCase(unittest.TestCase):
+
+    def setUp(self):
+        # The production wait between attempts is exponential backoff; these
+        # tests are about whether a retry happens, not how long it waits.
+        patcher = mock.patch.object(gcp_metadata_save_op.retry, 'wait',
+                                    tenacity.wait_none())
+        patcher.start()
+        self.addCleanup(patcher.stop)
+
+    def test_fingerprint_conflict_is_retried_with_fresh_metadata(self):
+        provider = _FakeProvider([CONFLICT, APPLY])
+        callback = mock.Mock(side_effect=lambda md: md['items'].append(
+            {'key': 'k', 'value': 'v'}))
+
+        gcp_metadata_save_op(provider, callback)
+
+        # Two attempts, each on metadata fetched anew so the retry carries
+        # the fingerprint the conflict invalidated.
+        self.assertEqual(callback.call_count, 2)
+        self.assertEqual(
+            [b['fingerprint'] for b in provider.gcp_compute.saved_bodies],
+            ['fp-0', 'fp-0'])
+        self.assertEqual(provider.gcp_compute.keys(), {'k': 'v'})
+
+    def test_write_reported_done_but_absent_is_reapplied(self):
+        # The live suite showed operations completing as DONE with the
+        # change missing from the document. A write is only finished once
+        # it can be read back.
+        provider = _FakeProvider([LOST, APPLY])
+
+        modify_or_add_metadata_item(provider, 'k', 'v')
+
+        self.assertEqual(len(provider.gcp_compute.saved_bodies), 2)
+        self.assertEqual(provider.gcp_compute.keys(), {'k': 'v'})
+
+    def test_write_that_never_lands_is_reported_after_retries(self):
+        provider = _FakeProvider([LOST] * 10)
+
+        with self.assertRaises(MetadataWriteNotApplied) as raised:
+            modify_or_add_metadata_item(provider, 'k', 'v')
+
+        self.assertIn('k', str(raised.exception))
+        self.assertEqual(len(provider.gcp_compute.saved_bodies), 10)
+
+    def test_other_operation_failures_are_raised_as_typed_errors(self):
+        provider = _FakeProvider([OTHER_FAILURE])
+        callback = mock.Mock(side_effect=lambda md: md['items'].append(
+            {'key': 'k', 'value': 'v'}))
+
+        with self.assertRaises(GCPOperationError) as raised:
+            gcp_metadata_save_op(provider, callback)
+
+        self.assertEqual(callback.call_count, 1)
+        self.assertEqual(raised.exception.codes, ['RESOURCE_NOT_FOUND'])
+        self.assertIn("was not found", str(raised.exception))
+
+    def test_a_write_that_changes_nothing_is_not_sent(self):
+        # Every set re-uploads the whole document and moves the fingerprint,
+        # so a no-op (removing an absent key, re-setting the current value)
+        # would only add contention for other writers.
+        provider = _FakeProvider([], items=[{'key': 'k', 'value': 'v'}])
+
+        self.assertFalse(remove_metadata_item(provider, 'absent'))
+        modify_or_add_metadata_item(provider, 'k', 'v')
+
+        self.assertEqual(provider.gcp_compute.saved_bodies, [])
+
+    def test_remove_is_reapplied_until_the_key_is_gone(self):
+        provider = _FakeProvider([LOST, APPLY],
+                                 items=[{'key': 'k', 'value': 'v'}])
+
+        self.assertTrue(remove_metadata_item(provider, 'k'))
+
+        self.assertEqual(len(provider.gcp_compute.saved_bodies), 2)
+        self.assertEqual(provider.gcp_compute.keys(), {})
+
+    def test_add_is_satisfied_by_its_own_value_already_present(self):
+        # A retry must not append a second copy if the earlier attempt did
+        # land after all.
+        provider = _FakeProvider([], items=[{'key': 'k', 'value': 'v'}])
+
+        add_metadata_item(provider, 'k', 'v')
+
+        self.assertEqual(provider.gcp_compute.saved_bodies, [])
+
+    def test_add_rejects_a_key_someone_else_holds(self):
+        provider = _FakeProvider([], items=[{'key': 'k', 'value': 'theirs'}])
+
+        with self.assertRaises(DuplicateResourceException):
+            add_metadata_item(provider, 'k', 'mine')
+
+        self.assertEqual(provider.gcp_compute.saved_bodies, [])

cloudbridge-4.4.2/tests/test_openstack_credentials.py

@@ -0,0 +1,109 @@
+"""Which OpenStack credentials a provider authenticates with.
+
+The provider reads credentials from its config dict and, failing that, from
+the ``OS_*`` environment. These tests pin the precedence between the two:
+credentials configured explicitly win over whatever happens to be in the
+process environment, so a provider built for one identity never signs in as
+another. Nothing here touches a network: the Keystone version probe is
+patched and keystoneauth plugins are plain objects until used.
+"""
+
+import os
+import unittest
+from unittest import mock
+
+from keystoneauth1.identity import v3
+
+from cloudbridge.providers.openstack.provider import OpenStackCloudProvider
+
+AUTH_URL = 'https://keystone.example.org:5000/v3'
+
+PASSWORD_ENV = {
+    'OS_USERNAME': 'ambient-user',
+    'OS_PASSWORD': 'ambient-password',
+    'OS_PROJECT_NAME': 'ambient-project',
+}
+
+APP_CRED_ENV = {
+    'OS_APPLICATION_CREDENTIAL_ID': 'ambient-app-cred-id',
+    'OS_APPLICATION_CREDENTIAL_SECRET': 'ambient-app-cred-secret',
+}
+
+ALL_CREDENTIAL_VARS = tuple(PASSWORD_ENV) + tuple(APP_CRED_ENV)
+
+
+def _environment(**values):
+    """The process environment with only the given OS_* credentials set."""
+    env = {k: v for k, v in os.environ.items() if k not in ALL_CREDENTIAL_VARS}
+    env.update(values)
+    return mock.patch.dict(os.environ, env, clear=True)
+
+
+def _provider(**config):
+    # A configured zone keeps the compute service from asking Nova for one
+    # while the provider is being built.
+    return OpenStackCloudProvider(
+        dict(config, os_auth_url=AUTH_URL, os_zone_name='nova'))
+
+
+def _keystone_auth(provider):
+    with mock.patch.object(OpenStackCloudProvider, '_keystone_version',
+                           new_callable=mock.PropertyMock, return_value=3):
+        # pylint:disable=protected-access
+        return provider._keystone_session.auth
+
+
+class OpenStackCredentialPrecedenceTestCase(unittest.TestCase):
+
+    def test_configured_application_credential_ignores_ambient_password(self):
+        # The process may carry the server's own OS_USERNAME/OS_PASSWORD; a
+        # provider configured with an application credential must use that
+        # credential, not the ambient identity.
+        with _environment(**PASSWORD_ENV):
+            provider = _provider(
+                os_application_credential_id='configured-id',
+                os_application_credential_secret='configured-secret')
+            self.assertIsNone(provider.username)
+            self.assertIsNone(provider.password)
+            auth = _keystone_auth(provider)
+        self.assertIsInstance(auth, v3.ApplicationCredential)
+        self.assertEqual(auth.auth_methods[0].application_credential_id,
+                         'configured-id')
+
+    def test_configured_password_ignores_ambient_application_credential(self):
+        with _environment(**APP_CRED_ENV):
+            provider = _provider(os_username='configured-user',
+                                 os_password='configured-password',
+                                 os_project_name='configured-project')
+            self.assertIsNone(provider.app_cred_id)
+            self.assertIsNone(provider.app_cred_secret)
+            auth = _keystone_auth(provider)
+        self.assertIsInstance(auth, v3.Password)
+        self.assertEqual(auth.auth_methods[0].username, 'configured-user')
+
+    def test_environment_is_used_when_nothing_is_configured(self):
+        with _environment(**PASSWORD_ENV):
+            provider = _provider()
+            self.assertEqual(provider.username, 'ambient-user')
+            self.assertEqual(provider.password, 'ambient-password')
+            auth = _keystone_auth(provider)
+        self.assertIsInstance(auth, v3.Password)
+
+    def test_environment_completes_a_partially_configured_credential(self):
+        # Keeping the secret out of the config file and in the environment is
+        # legitimate: the environment fills in the missing half of the set
+        # that is configured, and only that set.
+        with _environment(**PASSWORD_ENV, **APP_CRED_ENV):
+            provider = _provider(os_username='configured-user')
+            self.assertEqual(provider.username, 'configured-user')
+            self.assertEqual(provider.password, 'ambient-password')
+            self.assertIsNone(provider.app_cred_id)
+            self.assertIsNone(provider.app_cred_secret)
+
+        with _environment(**PASSWORD_ENV, **APP_CRED_ENV):
+            provider = _provider(os_application_credential_id='configured-id')
+            self.assertEqual(provider.app_cred_id, 'configured-id')
+            self.assertEqual(provider.app_cred_secret,
+                             'ambient-app-cred-secret')
+            self.assertIsNone(provider.username)
+            self.assertIsNone(provider.password)