mlrun 1.7.0rc28__py3-none-any.whl → 1.7.0rc55__py3-none-any.whl

mlrun/runtimes/nuclio/application/application.py

@@ -15,9 +15,11 @@ import pathlib
 import typing
 
 import nuclio
+import nuclio.auth
 
 import mlrun.common.schemas as schemas
 import mlrun.errors
+import mlrun.run
 from mlrun.common.runtimes.constants import NuclioIngressAddTemplatedIngressModes
 from mlrun.runtimes import RemoteRuntime
 from mlrun.runtimes.nuclio import min_nuclio_versions
@@ -27,7 +29,7 @@ from mlrun.runtimes.nuclio.api_gateway import (
     APIGatewaySpec,
 )
 from mlrun.runtimes.nuclio.function import NuclioSpec, NuclioStatus
-from mlrun.utils import logger
+from mlrun.utils import logger, update_in
 
 
 class ApplicationSpec(NuclioSpec):
@@ -121,6 +123,11 @@ class ApplicationSpec(NuclioSpec):
             state_thresholds=state_thresholds,
             disable_default_http_trigger=disable_default_http_trigger,
         )
+
+        # Override default min/max replicas (don't assume application is stateless)
+        self.min_replicas = min_replicas or 1
+        self.max_replicas = max_replicas or 1
+
         self.internal_application_port = (
             internal_application_port
             or mlrun.mlconf.function.application.default_sidecar_internal_port
@@ -149,6 +156,7 @@ class ApplicationStatus(NuclioStatus):
         build_pod=None,
         container_image=None,
         application_image=None,
+        application_source=None,
         sidecar_name=None,
         api_gateway_name=None,
         api_gateway=None,
@@ -164,14 +172,16 @@ class ApplicationStatus(NuclioStatus):
             container_image=container_image,
         )
         self.application_image = application_image or None
+        self.application_source = application_source or None
         self.sidecar_name = sidecar_name or None
         self.api_gateway_name = api_gateway_name or None
-        self.api_gateway = api_gateway or None
+        self.api_gateway: typing.Optional[APIGateway] = api_gateway or None
         self.url = url or None
 
 
 class ApplicationRuntime(RemoteRuntime):
     kind = "application"
+    reverse_proxy_image = None
 
     @min_nuclio_versions("1.13.1")
     def __init__(self, spec=None, metadata=None):
@@ -250,6 +260,15 @@ class ApplicationRuntime(RemoteRuntime):
                     "Application sidecar spec must include a command if args are provided"
                 )
 
+    def prepare_image_for_deploy(self):
+        if self.spec.build.source and self.spec.build.load_source_on_run:
+            logger.warning(
+                "Application runtime requires loading the source into the application image. "
+                f"Even though {self.spec.build.load_source_on_run=}, loading on build will be forced."
+            )
+            self.spec.build.load_source_on_run = False
+        super().prepare_image_for_deploy()
+
     def deploy(
         self,
         project="",
@@ -263,31 +282,31 @@ class ApplicationRuntime(RemoteRuntime):
         is_kfp=False,
         mlrun_version_specifier=None,
         show_on_failure: bool = False,
-        direct_port_access: bool = False,
-        authentication_mode: schemas.APIGatewayAuthenticationMode = None,
-        authentication_creds: tuple[str] = None,
+        create_default_api_gateway: bool = True,
     ):
         """
         Deploy function, builds the application image if required (self.requires_build()) or force_build is True,
         Once the image is built, the function is deployed.
-        :param project:                 Project name
-        :param tag:                     Function tag
-        :param verbose:                 Set True for verbose logging
-        :param auth_info:               Service AuthInfo (deprecated and ignored)
-        :param builder_env:             Env vars dict for source archive config/credentials
-                                        e.g. builder_env={"GIT_TOKEN": token}
-        :param force_build:             Set True for force building the application image
-        :param with_mlrun:              Add the current mlrun package to the container build
-        :param skip_deployed:           Skip the build if we already have an image for the function
-        :param is_kfp:                  Deploy as part of a kfp pipeline
-        :param mlrun_version_specifier: Which mlrun package version to include (if not current)
-        :param show_on_failure:         Show logs only in case of build failure
-        :param direct_port_access:      Set True to allow direct port access to the application sidecar
-        :param authentication_mode:     API Gateway authentication mode
-        :param authentication_creds:    API Gateway authentication credentials as a tuple (username, password)
-        :return: True if the function is ready (deployed)
+
+        :param project:                     Project name
+        :param tag:                         Function tag
+        :param verbose:                     Set True for verbose logging
+        :param auth_info:                   Service AuthInfo (deprecated and ignored)
+        :param builder_env:                 Env vars dict for source archive config/credentials
+                                            e.g. builder_env={"GIT_TOKEN": token}
+        :param force_build:                 Set True for force building the application image
+        :param with_mlrun:                  Add the current mlrun package to the container build
+        :param skip_deployed:               Skip the build if we already have an image for the function
+        :param is_kfp:                      Deploy as part of a kfp pipeline
+        :param mlrun_version_specifier:     Which mlrun package version to include (if not current)
+        :param show_on_failure:             Show logs only in case of build failure
+        :param create_default_api_gateway:  When deploy finishes the default API gateway will be created for the
+                                            application. Disabling this flag means that the application will not be
+                                            accessible until an API gateway is created for it.
+
+        :return: The default API gateway URL if created or True if the function is ready (deployed)
         """
-        if self.requires_build() or force_build:
+        if (self.requires_build() and not self.spec.image) or force_build:
             self._fill_credentials()
             self._build_application_image(
                 builder_env=builder_env,
@@ -300,38 +319,57 @@ class ApplicationRuntime(RemoteRuntime):
                 show_on_failure=show_on_failure,
             )
 
-        self._ensure_reverse_proxy_configurations()
+        # This is a class method that accepts a function instance, so we pass self as the function instance
+        self._ensure_reverse_proxy_configurations(self)
         self._configure_application_sidecar()
 
-        # we only allow accessing the application via the API Gateway
-        name_tag = tag or self.metadata.tag
-        self.status.api_gateway_name = (
-            f"{self.metadata.name}-{name_tag}" if name_tag else self.metadata.name
-        )
+        # We only allow accessing the application via the API Gateway
         self.spec.add_templated_ingress_host_mode = (
             NuclioIngressAddTemplatedIngressModes.never
         )
 
         super().deploy(
-            project,
-            tag,
-            verbose,
-            auth_info,
-            builder_env,
+            project=project,
+            tag=tag,
+            verbose=verbose,
+            auth_info=auth_info,
+            builder_env=builder_env,
         )
-
-        ports = self.spec.internal_application_port if direct_port_access else []
-        self.create_api_gateway(
-            name=self.status.api_gateway_name,
-            ports=ports,
-            authentication_mode=authentication_mode,
-            authentication_creds=authentication_creds,
+        logger.info(
+            "Successfully deployed function.",
         )
 
+        # Restore the source in case it was removed to make nuclio not consider it when building
+        if not self.spec.build.source and self.status.application_source:
+            self.spec.build.source = self.status.application_source
+        self.save(versioned=False)
+
+        if create_default_api_gateway:
+            try:
+                api_gateway_name = self.resolve_default_api_gateway_name()
+                return self.create_api_gateway(api_gateway_name, set_as_default=True)
+            except Exception as exc:
+                logger.warning(
+                    "Failed to create default API gateway, application may not be accessible. "
+                    "Use the `create_api_gateway` method to make it accessible",
+                    exc=mlrun.errors.err_to_str(exc),
+                )
+        elif not self.status.api_gateway:
+            logger.warning(
+                "Application is online but may not be accessible since default gateway creation was not requested."
+                "Use the `create_api_gateway` method to make it accessible."
+            )
+
+        return True
+
     def with_source_archive(
-        self, source, workdir=None, pull_at_runtime=True, target_dir=None
+        self,
+        source,
+        workdir=None,
+        pull_at_runtime: bool = False,
+        target_dir: str = None,
     ):
-        """load the code from git/tar/zip archive at runtime or build
+        """load the code from git/tar/zip archive at build
 
         :param source:          valid absolute path or URL to git, zip, or tar file, e.g.
                                 git://github.com/mlrun/something.git
@@ -339,18 +377,50 @@ class ApplicationRuntime(RemoteRuntime):
                                 note path source must exist on the image or exist locally when run is local
                                 (it is recommended to use 'workdir' when source is a filepath instead)
         :param workdir:         working dir relative to the archive root (e.g. './subdir') or absolute to the image root
-        :param pull_at_runtime: load the archive into the container at job runtime vs on build/deploy
+        :param pull_at_runtime: currently not supported, source must be loaded into the image during the build process
         :param target_dir:      target dir on runtime pod or repo clone / archive extraction
         """
+        if pull_at_runtime:
+            logger.warning(
+                f"{pull_at_runtime=} is currently not supported for application runtime "
+                "and will be overridden to False",
+                pull_at_runtime=pull_at_runtime,
+            )
+
         self._configure_mlrun_build_with_source(
             source=source,
             workdir=workdir,
-            pull_at_runtime=pull_at_runtime,
+            pull_at_runtime=False,
             target_dir=target_dir,
         )
 
-    @classmethod
-    def get_filename_and_handler(cls) -> (str, str):
+    def from_image(self, image):
+        """
+        Deploy the function with an existing nuclio processor image.
+        This applies only for the reverse proxy and not the application image.
+
+        :param image: image name
+        """
+        super().from_image(image)
+        # nuclio implementation detail - when providing the image and emptying out the source code and build source,
+        # nuclio skips rebuilding the image and simply takes the prebuilt image
+        self.spec.build.functionSourceCode = ""
+        self.status.application_source = self.spec.build.source
+        self.spec.build.source = ""
+
+        # save the image in the status, so we won't repopulate the function source code
+        self.status.container_image = image
+
+        # ensure golang runtime and handler for the reverse proxy
+        self.spec.nuclio_runtime = "golang"
+        update_in(
+            self.spec.base_spec,
+            "spec.handler",
+            "main:Handler",
+        )
+
+    @staticmethod
+    def get_filename_and_handler() -> (str, str):
         reverse_proxy_file_path = pathlib.Path(__file__).parent / "reverse_proxy.go"
         return str(reverse_proxy_file_path), "Handler"
 
@@ -358,16 +428,55 @@ class ApplicationRuntime(RemoteRuntime):
         self,
         name: str = None,
         path: str = None,
-        ports: list[int] = None,
+        direct_port_access: bool = False,
         authentication_mode: schemas.APIGatewayAuthenticationMode = None,
-        authentication_creds: tuple[str] = None,
+        authentication_creds: tuple[str, str] = None,
+        ssl_redirect: bool = None,
+        set_as_default: bool = False,
+        gateway_timeout: typing.Optional[int] = None,
     ):
+        """
+        Create the application API gateway. Once the application is deployed, the API gateway can be created.
+        An application without an API gateway is not accessible.
+
+        :param name:                    The name of the API gateway
+        :param path:                    Optional path of the API gateway, default value is "/".
+                                        The given path should be supported by the deployed application
+        :param direct_port_access:      Set True to allow direct port access to the application sidecar
+        :param authentication_mode:     API Gateway authentication mode
+        :param authentication_creds:    API Gateway basic authentication credentials as a tuple (username, password)
+        :param ssl_redirect:            Set True to force SSL redirect, False to disable. Defaults to
+                                        mlrun.mlconf.force_api_gateway_ssl_redirect()
+        :param set_as_default:          Set the API gateway as the default for the application (`status.api_gateway`)
+        :param gateway_timeout:         nginx ingress timeout in sec (request timeout, when will the gateway return an
+                                        error)
+        :return:                        The API gateway URL
+        """
+        if not name:
+            raise mlrun.errors.MLRunInvalidArgumentError(
+                "API gateway name must be specified."
+            )
+
+        if not set_as_default and name == self.resolve_default_api_gateway_name():
+            raise mlrun.errors.MLRunInvalidArgumentError(
+                f"Non-default API gateway cannot use the default gateway name, {name=}."
+            )
+
+        if (
+            authentication_mode == schemas.APIGatewayAuthenticationMode.basic
+            and not authentication_creds
+        ):
+            raise mlrun.errors.MLRunInvalidArgumentError(
+                "Authentication credentials not provided"
+            )
+
+        ports = self.spec.internal_application_port if direct_port_access else []
+
         api_gateway = APIGateway(
             APIGatewayMetadata(
                 name=name,
                 namespace=self.metadata.namespace,
-                labels=self.metadata.labels,
-                annotations=self.metadata.annotations,
+                labels=self.metadata.labels.copy(),
             ),
             APIGatewaySpec(
                 functions=[self],
@@ -377,6 +486,14 @@ class ApplicationRuntime(RemoteRuntime):
             ),
         )
 
+        api_gateway.with_gateway_timeout(gateway_timeout)
+        if ssl_redirect is None:
+            ssl_redirect = mlrun.mlconf.force_api_gateway_ssl_redirect()
+        if ssl_redirect:
+            # Force ssl redirect so that the application is only accessible via https
+            api_gateway.with_force_ssl_redirect()
+
+        # Add authentication if required
         authentication_mode = (
             authentication_mode
             or mlrun.mlconf.function.application.default_authentication_mode
@@ -390,28 +507,64 @@ class ApplicationRuntime(RemoteRuntime):
         api_gateway_scheme = db.store_api_gateway(
             api_gateway=api_gateway.to_scheme(), project=self.metadata.project
         )
-        if not self.status.api_gateway_name:
+
+        if set_as_default:
             self.status.api_gateway_name = api_gateway_scheme.metadata.name
-        self.status.api_gateway = APIGateway.from_scheme(api_gateway_scheme)
-        self.status.api_gateway.wait_for_readiness()
-        self.url = self.status.api_gateway.invoke_url
+            self.status.api_gateway = APIGateway.from_scheme(api_gateway_scheme)
+            self.status.api_gateway.wait_for_readiness()
+            self.url = self.status.api_gateway.invoke_url
+            url = self.url
+        else:
+            api_gateway = APIGateway.from_scheme(api_gateway_scheme)
+            api_gateway.wait_for_readiness()
+            url = api_gateway.invoke_url
+            # Update application status (enriches invocation url)
+            self._get_state(raise_on_exception=False)
+
+        logger.info("Successfully created API gateway", url=url)
+        return url
+
+    def delete_api_gateway(self, name: str):
+        """
+        Delete API gateway by name.
+        Refreshes the application status to update api gateway and invocation URLs.
+        :param name:    The API gateway name
+        """
+        self._get_db().delete_api_gateway(name=name, project=self.metadata.project)
+        if name == self.status.api_gateway_name:
+            self.status.api_gateway_name = None
+            self.status.api_gateway = None
+        self._get_state()
 
     def invoke(
         self,
-        path: str,
-        body: typing.Union[str, bytes, dict] = None,
+        path: str = "",
+        body: typing.Optional[typing.Union[str, bytes, dict]] = None,
         method: str = None,
         headers: dict = None,
         dashboard: str = "",
         force_external_address: bool = False,
         auth_info: schemas.AuthInfo = None,
         mock: bool = None,
+        credentials: tuple[str, str] = None,
         **http_client_kwargs,
     ):
         self._sync_api_gateway()
+
         # If the API Gateway is not ready or not set, try to invoke the function directly (without the API Gateway)
         if not self.status.api_gateway:
-            super().invoke(
+            logger.warning(
+                "Default API gateway is not configured, invoking function invocation URL."
+            )
+            # create a requests auth object if credentials are provided and not already set in the http client kwargs
+            auth = http_client_kwargs.pop("auth", None) or (
+                nuclio.auth.AuthInfo(
+                    username=credentials[0], password=credentials[1]
+                ).to_requests_auth()
+                if credentials
+                else None
+            )
+            return super().invoke(
                 path,
                 body,
                 method,
@@ -420,21 +573,84 @@ class ApplicationRuntime(RemoteRuntime):
                 force_external_address,
                 auth_info,
                 mock,
+                auth=auth,
                 **http_client_kwargs,
             )
 
-        credentials = (auth_info.username, auth_info.password) if auth_info else None
-
         if not method:
             method = "POST" if body else "GET"
+
         return self.status.api_gateway.invoke(
             method=method,
             headers=headers,
             credentials=credentials,
             path=path,
+            body=body,
             **http_client_kwargs,
         )
 
+    @classmethod
+    def deploy_reverse_proxy_image(cls):
+        """
+        Build the reverse proxy image and save it.
+        The reverse proxy image is used to route requests to the application sidecar.
+        This is useful when you want to decrease build time by building the application image only once.
+
+        :param use_cache:   Use the cache when building the image
+        """
+        # create a function that includes only the reverse proxy, without the application
+
+        reverse_proxy_func = mlrun.run.new_function(
+            name="reverse-proxy-temp", kind="remote"
+        )
+        # default max replicas is 4, we only need one replica for the reverse proxy
+        reverse_proxy_func.spec.max_replicas = 1
+
+        # the reverse proxy image should not be based on another image
+        reverse_proxy_func.set_config("spec.build.baseImage", None)
+        reverse_proxy_func.spec.image = ""
+        reverse_proxy_func.spec.build.base_image = ""
+
+        cls._ensure_reverse_proxy_configurations(reverse_proxy_func)
+        reverse_proxy_func.deploy()
+
+        # save the created container image
+        cls.reverse_proxy_image = reverse_proxy_func.status.container_image
+
+        # delete the function to avoid cluttering the project
+        mlrun.get_run_db().delete_function(
+            reverse_proxy_func.metadata.name, reverse_proxy_func.metadata.project
+        )
+
+    def resolve_default_api_gateway_name(self):
+        return (
+            f"{self.metadata.name}-{self.metadata.tag}"
+            if self.metadata.tag
+            else self.metadata.name
+        )
+
+    @min_nuclio_versions("1.13.1")
+    def disable_default_http_trigger(
+        self,
+    ):
+        raise mlrun.runtimes.RunError(
+            "Application runtime does not support disabling the default HTTP trigger"
+        )
+
+    @min_nuclio_versions("1.13.1")
+    def enable_default_http_trigger(
+        self,
+    ):
+        pass
+
+    def _run(self, runobj: "mlrun.RunObject", execution):
+        raise mlrun.runtimes.RunError(
+            "Application runtime .run() is not yet supported. Use .invoke() instead."
+        )
+
+    def _enrich_command_from_status(self):
+        pass
+
     def _build_application_image(
         self,
         builder_env: dict = None,
@@ -454,6 +670,13 @@ class ApplicationRuntime(RemoteRuntime):
                 args=self.spec.args,
             )
 
+        if self.spec.build.source in [".", "./"]:
+            logger.info(
+                "The application is configured to use the project's source. "
+                "Application runtime requires loading the source into the application image. "
+                "Loading on build will be forced regardless of whether 'pull_at_runtime=True' was configured."
+            )
+
         with_mlrun = self._resolve_build_with_mlrun(with_mlrun)
         return self._build_image(
             builder_env=builder_env,
@@ -466,21 +689,29 @@ class ApplicationRuntime(RemoteRuntime):
             with_mlrun=with_mlrun,
         )
 
-    def _ensure_reverse_proxy_configurations(self):
-        if self.spec.build.functionSourceCode or self.status.container_image:
+    @staticmethod
+    def _ensure_reverse_proxy_configurations(function: RemoteRuntime):
+        if function.spec.build.functionSourceCode or function.status.container_image:
             return
 
         filename, handler = ApplicationRuntime.get_filename_and_handler()
         name, spec, code = nuclio.build_file(
             filename,
-            name=self.metadata.name,
+            name=function.metadata.name,
             handler=handler,
         )
-        self.spec.function_handler = mlrun.utils.get_in(spec, "spec.handler")
-        self.spec.build.functionSourceCode = mlrun.utils.get_in(
+        function.spec.function_handler = mlrun.utils.get_in(spec, "spec.handler")
+        function.spec.build.functionSourceCode = mlrun.utils.get_in(
             spec, "spec.build.functionSourceCode"
         )
-        self.spec.nuclio_runtime = mlrun.utils.get_in(spec, "spec.runtime")
+        function.spec.nuclio_runtime = mlrun.utils.get_in(spec, "spec.runtime")
+
+        # default the reverse proxy logger level to info
+        logger_sinks_key = "spec.loggerSinks"
+        if not function.spec.config.get(logger_sinks_key):
+            function.set_config(
+                logger_sinks_key, [{"level": "info", "sink": "myStdoutLoggerSink"}]
+            )
 
     def _configure_application_sidecar(self):
         # Save the application image in the status to allow overriding it with the reverse proxy entry point
@@ -491,11 +722,12 @@ class ApplicationRuntime(RemoteRuntime):
             self.status.application_image = self.spec.image
             self.spec.image = ""
 
-        if self.status.container_image:
-            self.from_image(self.status.container_image)
-            # nuclio implementation detail - when providing the image and emptying out the source code,
-            # nuclio skips rebuilding the image and simply takes the prebuilt image
-            self.spec.build.functionSourceCode = ""
+        # reuse the reverse proxy image if it was built before
+        if (
+            reverse_proxy_image := self.status.container_image
+            or self.reverse_proxy_image
+        ):
+            self.from_image(reverse_proxy_image)
 
         self.status.sidecar_name = f"{self.metadata.name}-sidecar"
         self.with_sidecar(
@@ -508,6 +740,11 @@ class ApplicationRuntime(RemoteRuntime):
         self.set_env("SIDECAR_PORT", self.spec.internal_application_port)
         self.set_env("SIDECAR_HOST", "http://localhost")
 
+        # configure the sidecar container as the default container for logging purposes
+        self.metadata.annotations["kubectl.kubernetes.io/default-container"] = (
+            self.status.sidecar_name
+        )
+
     def _sync_api_gateway(self):
         if not self.status.api_gateway_name:
             return