mlrun 1.7.0rc5__py3-none-any.whl → 1.7.0rc7__py3-none-any.whl

mlrun/runtimes/nuclio/api_gateway.py

@@ -12,15 +12,17 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 import base64
+import typing
 from typing import Optional, Union
 from urllib.parse import urljoin
 
 import requests
+from requests.auth import HTTPBasicAuth
 
 import mlrun
 import mlrun.common.schemas
 
-from .function import RemoteRuntime
+from .function import RemoteRuntime, get_fullname
 from .serving import ServingRuntime
 
 NUCLIO_API_GATEWAY_AUTHENTICATION_MODE_BASIC_AUTH = "basicAuth"
@@ -28,6 +30,67 @@ NUCLIO_API_GATEWAY_AUTHENTICATION_MODE_NONE = "none"
 PROJECT_NAME_LABEL = "nuclio.io/project-name"
 
 
+class APIGatewayAuthenticator(typing.Protocol):
+    @property
+    def authentication_mode(self) -> str:
+        return NUCLIO_API_GATEWAY_AUTHENTICATION_MODE_NONE
+
+    @classmethod
+    def from_scheme(cls, api_gateway_spec: mlrun.common.schemas.APIGatewaySpec):
+        if (
+            api_gateway_spec.authenticationMode
+            == NUCLIO_API_GATEWAY_AUTHENTICATION_MODE_BASIC_AUTH
+        ):
+            if api_gateway_spec.authentication:
+                return BasicAuth(
+                    username=api_gateway_spec.authentication.get("username", ""),
+                    password=api_gateway_spec.authentication.get("password", ""),
+                )
+            else:
+                return BasicAuth()
+        else:
+            return NoneAuth()
+
+    def to_scheme(
+        self,
+    ) -> Optional[dict[str, Optional[mlrun.common.schemas.APIGatewayBasicAuth]]]:
+        return None
+
+
+class NoneAuth(APIGatewayAuthenticator):
+    """
+    An API gateway authenticator with no authentication.
+    """
+
+    pass
+
+
+class BasicAuth(APIGatewayAuthenticator):
+    """
+    An API gateway authenticator with basic authentication.
+
+    :param username: (str) The username for basic authentication.
+    :param password: (str) The password for basic authentication.
+    """
+
+    def __init__(self, username=None, password=None):
+        self._username = username
+        self._password = password
+
+    @property
+    def authentication_mode(self) -> str:
+        return NUCLIO_API_GATEWAY_AUTHENTICATION_MODE_BASIC_AUTH
+
+    def to_scheme(
+        self,
+    ) -> Optional[dict[str, Optional[mlrun.common.schemas.APIGatewayBasicAuth]]]:
+        return {
+            "authentication": mlrun.common.schemas.APIGatewayBasicAuth(
+                username=self._username, password=self._password
+            )
+        }
+
+
 class APIGateway:
     def __init__(
         self,
@@ -47,22 +110,34 @@ class APIGateway:
         ],
         description: str = "",
         path: str = "/",
-        authentication_mode: Optional[
-            str
-        ] = NUCLIO_API_GATEWAY_AUTHENTICATION_MODE_NONE,
+        authentication: Optional[APIGatewayAuthenticator] = NoneAuth(),
         host: Optional[str] = None,
         canary: Optional[list[int]] = None,
-        username: Optional[str] = None,
-        password: Optional[str] = None,
     ):
+        """
+        Initialize the APIGateway instance.
+
+        :param project: The project name
+        :param name: The name of the API gateway
+        :param functions: The list of functions associated with the API gateway
+            Can be a list of function names (["my-func1", "my-func2"])
+            or a list or a single entity of
+            :py:class:`~mlrun.runtimes.nuclio.function.RemoteRuntime` OR
+            :py:class:`~mlrun.runtimes.nuclio.serving.ServingRuntime`
+
+        :param description: Optional description of the API gateway
+        :param path: Optional path of the API gateway, default value is "/"
+        :param authentication: The authentication for the API gateway of type
+                :py:class:`~mlrun.runtimes.nuclio.api_gateway.BasicAuth`
+        :param host:  The host of the API gateway (optional). If not set, it will be automatically generated
+        :param canary: The canary percents for the API gateway of type list[int]; for instance: [20,80]
+        """
         self.functions = None
         self._validate(
             project=project,
             functions=functions,
             name=name,
             canary=canary,
-            username=username,
-            password=password,
         )
         self.project = project
         self.name = name
@@ -70,14 +145,8 @@ class APIGateway:
 
         self.path = path
         self.description = description
-        self.authentication_mode = (
-            authentication_mode
-            if authentication_mode
-            else self._enrich_authentication_mode(username=username, password=password)
-        )
         self.canary = canary
-        self._username = username
-        self._password = password
+        self.authentication = authentication
 
     def invoke(
         self,
@@ -86,24 +155,94 @@ class APIGateway:
         auth: Optional[tuple[str, str]] = None,
         **kwargs,
     ):
+        """
+        Invoke the API gateway.
+
+        :param method: (str, optional) The HTTP method for the invocation.
+        :param headers: (dict, optional) The HTTP headers for the invocation.
+        :param auth: (Optional[tuple[str, str]], optional) The authentication creds for the invocation if required.
+        :param kwargs: (dict) Additional keyword arguments.
+
+        :return: The response from the API gateway invocation.
+        """
         if not self.invoke_url:
-            raise mlrun.errors.MLRunInvalidArgumentError(
-                "Invocation url is not set. Set up gateway's `invoke_url` attribute."
-            )
+            # try to resolve invoke_url before fail
+            self.sync()
+            if not self.invoke_url:
+                raise mlrun.errors.MLRunInvalidArgumentError(
+                    "Invocation url is not set. Set up gateway's `invoke_url` attribute."
+                )
         if (
-            self.authentication_mode
+            self.authentication.authentication_mode
             == NUCLIO_API_GATEWAY_AUTHENTICATION_MODE_BASIC_AUTH
             and not auth
         ):
             raise mlrun.errors.MLRunInvalidArgumentError(
                 "API Gateway invocation requires authentication. Please pass credentials"
             )
-        if auth:
-            headers["Authorization"] = self._generate_basic_auth(*auth)
         return requests.request(
-            method=method, url=self.invoke_url, headers=headers, **kwargs
+            method=method,
+            url=self.invoke_url,
+            headers=headers,
+            **kwargs,
+            auth=HTTPBasicAuth(*auth) if auth else None,
         )
 
+    def sync(self):
+        """
+        Synchronize the API gateway from the server.
+        """
+        synced_gateway = mlrun.get_run_db().get_api_gateway(self.name, self.project)
+        synced_gateway = self.from_scheme(synced_gateway)
+
+        self.host = synced_gateway.host
+        self.path = synced_gateway.path
+        self.authentication = synced_gateway.authentication
+        self.functions = synced_gateway.functions
+        self.canary = synced_gateway.canary
+        self.description = synced_gateway.description
+
+    def with_basic_auth(self, username: str, password: str):
+        """
+        Set basic authentication for the API gateway.
+
+        :param username: (str) The username for basic authentication.
+        :param password: (str) The password for basic authentication.
+        """
+        self.authentication = BasicAuth(username=username, password=password)
+
+    def with_canary(
+        self,
+        functions: Union[
+            list[str],
+            list[
+                Union[
+                    RemoteRuntime,
+                    ServingRuntime,
+                ]
+            ],
+        ],
+        canary: list[int],
+    ):
+        """
+        Set canary function for the API gateway
+
+        :param functions: The list of functions associated with the API gateway
+            Can be a list of function names (["my-func1", "my-func2"])
+            or a list of nuclio functions of types
+            :py:class:`~mlrun.runtimes.nuclio.function.RemoteRuntime` OR
+            :py:class:`~mlrun.runtimes.nuclio.serving.ServingRuntime`
+        :param canary: The canary percents for the API gateway of type list[int]; for instance: [20,80]
+
+        """
+        if len(functions) != 2:
+            raise mlrun.errors.MLRunInvalidArgumentError(
+                f"Gateway with canary can be created only with two functions, "
+                f"the number of functions passed is {len(functions)}"
+            )
+        self.functions = self._validate_functions(self.project, functions)
+        self.canary = self._validate_canary(canary)
+
     @classmethod
     def from_scheme(cls, api_gateway: mlrun.common.schemas.APIGateway):
         project = api_gateway.metadata.labels.get(PROJECT_NAME_LABEL)
@@ -114,7 +253,7 @@ class APIGateway:
             name=api_gateway.spec.name,
             host=api_gateway.spec.host,
             path=api_gateway.spec.path,
-            authentication_mode=str(api_gateway.spec.authenticationMode),
+            authentication=APIGatewayAuthenticator.from_scheme(api_gateway.spec),
             functions=functions,
             canary=canary,
         )
@@ -141,26 +280,26 @@ class APIGateway:
             spec=mlrun.common.schemas.APIGatewaySpec(
                 name=self.name,
                 description=self.description,
+                host=self.host,
                 path=self.path,
-                authentication_mode=mlrun.common.schemas.APIGatewayAuthenticationMode.from_str(
-                    self.authentication_mode
+                authenticationMode=mlrun.common.schemas.APIGatewayAuthenticationMode.from_str(
+                    self.authentication.authentication_mode
                 ),
                 upstreams=upstreams,
             ),
         )
-        if (
-            self.authentication_mode
-            is NUCLIO_API_GATEWAY_AUTHENTICATION_MODE_BASIC_AUTH
-        ):
-            api_gateway.spec.authentication = mlrun.common.schemas.APIGatewayBasicAuth(
-                username=self._username, password=self._password
-            )
+        api_gateway.spec.authentication = self.authentication.to_scheme()
         return api_gateway
 
     @property
     def invoke_url(
         self,
     ):
+        """
+        Get the invoke URL.
+
+        :return: (str) The invoke URL.
+        """
         return urljoin(self.host, self.path)
 
     def _validate(
@@ -180,8 +319,6 @@ class APIGateway:
             ],
         ],
         canary: Optional[list[int]] = None,
-        username: Optional[str] = None,
-        password: Optional[str] = None,
     ):
         if not name:
             raise mlrun.errors.MLRunInvalidArgumentError(
@@ -192,26 +329,23 @@ class APIGateway:
 
         # validating canary
         if canary:
-            if len(self.functions) != len(canary):
-                raise mlrun.errors.MLRunInvalidArgumentError(
-                    "Function and canary lists lengths do not match"
-                )
-            for canary_percent in canary:
-                if canary_percent < 0 or canary_percent > 100:
-                    raise mlrun.errors.MLRunInvalidArgumentError(
-                        "The percentage value must be in the range from 0 to 100"
-                    )
-            if sum(canary) != 100:
+            self._validate_canary(canary)
+
+    def _validate_canary(self, canary: list[int]):
+        if len(self.functions) != len(canary):
+            raise mlrun.errors.MLRunInvalidArgumentError(
+                "Function and canary lists lengths do not match"
+            )
+        for canary_percent in canary:
+            if canary_percent < 0 or canary_percent > 100:
                 raise mlrun.errors.MLRunInvalidArgumentError(
-                    "The sum of canary function percents should be equal to 100"
+                    "The percentage value must be in the range from 0 to 100"
                 )
-
-        # validating auth
-        if username and not password:
-            raise mlrun.errors.MLRunInvalidArgumentError("Password is not specified")
-
-        if password and not username:
-            raise mlrun.errors.MLRunInvalidArgumentError("Username is not specified")
+        if sum(canary) != 100:
+            raise mlrun.errors.MLRunInvalidArgumentError(
+                "The sum of canary function percents should be equal to 100"
+            )
+        return canary
 
     @staticmethod
     def _validate_functions(
@@ -257,17 +391,10 @@ class APIGateway:
                     f"input function {function_name} "
                     f"does not belong to this project"
                 )
-            function_names.append(func.uri)
+            nuclio_name = get_fullname(function_name, project, func.metadata.tag)
+            function_names.append(nuclio_name)
         return function_names
 
-    @staticmethod
-    def _enrich_authentication_mode(username, password):
-        return (
-            NUCLIO_API_GATEWAY_AUTHENTICATION_MODE_NONE
-            if username is not None and password is not None
-            else NUCLIO_API_GATEWAY_AUTHENTICATION_MODE_BASIC_AUTH
-        )
-
     @staticmethod
     def _generate_basic_auth(username: str, password: str):
         token = base64.b64encode(f"{username}:{password}".encode()).decode()

mlrun/runtimes/nuclio/application/__init__.py

@@ -0,0 +1,15 @@
+# Copyright 2024 Iguazio
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from .application import ApplicationRuntime

mlrun/runtimes/nuclio/application/application.py

@@ -0,0 +1,283 @@
+# Copyright 2024 Iguazio
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+import pathlib
+
+import nuclio
+
+import mlrun.errors
+from mlrun.common.schemas import AuthInfo
+from mlrun.runtimes import RemoteRuntime
+from mlrun.runtimes.nuclio import min_nuclio_versions
+from mlrun.runtimes.nuclio.function import NuclioSpec, NuclioStatus
+
+
+class ApplicationSpec(NuclioSpec):
+    _dict_fields = NuclioSpec._dict_fields + [
+        "internal_application_port",
+    ]
+
+    def __init__(
+        self,
+        command=None,
+        args=None,
+        image=None,
+        mode=None,
+        entry_points=None,
+        description=None,
+        replicas=None,
+        min_replicas=None,
+        max_replicas=None,
+        volumes=None,
+        volume_mounts=None,
+        env=None,
+        resources=None,
+        config=None,
+        base_spec=None,
+        no_cache=None,
+        source=None,
+        image_pull_policy=None,
+        function_kind=None,
+        build=None,
+        service_account=None,
+        readiness_timeout=None,
+        readiness_timeout_before_failure=None,
+        default_handler=None,
+        node_name=None,
+        node_selector=None,
+        affinity=None,
+        disable_auto_mount=False,
+        priority_class_name=None,
+        pythonpath=None,
+        workdir=None,
+        image_pull_secret=None,
+        tolerations=None,
+        preemption_mode=None,
+        security_context=None,
+        service_type=None,
+        add_templated_ingress_host_mode=None,
+        clone_target_dir=None,
+        state_thresholds=None,
+        disable_default_http_trigger=None,
+        internal_application_port=None,
+    ):
+        super().__init__(
+            command=command,
+            args=args,
+            image=image,
+            mode=mode,
+            entry_points=entry_points,
+            description=description,
+            replicas=replicas,
+            min_replicas=min_replicas,
+            max_replicas=max_replicas,
+            volumes=volumes,
+            volume_mounts=volume_mounts,
+            env=env,
+            resources=resources,
+            config=config,
+            base_spec=base_spec,
+            no_cache=no_cache,
+            source=source,
+            image_pull_policy=image_pull_policy,
+            function_kind=function_kind,
+            build=build,
+            service_account=service_account,
+            readiness_timeout=readiness_timeout,
+            readiness_timeout_before_failure=readiness_timeout_before_failure,
+            default_handler=default_handler,
+            node_name=node_name,
+            node_selector=node_selector,
+            affinity=affinity,
+            disable_auto_mount=disable_auto_mount,
+            priority_class_name=priority_class_name,
+            pythonpath=pythonpath,
+            workdir=workdir,
+            image_pull_secret=image_pull_secret,
+            tolerations=tolerations,
+            preemption_mode=preemption_mode,
+            security_context=security_context,
+            service_type=service_type,
+            add_templated_ingress_host_mode=add_templated_ingress_host_mode,
+            clone_target_dir=clone_target_dir,
+            state_thresholds=state_thresholds,
+            disable_default_http_trigger=disable_default_http_trigger,
+        )
+        self.internal_application_port = internal_application_port or 8080
+
+    @property
+    def internal_application_port(self):
+        return self._internal_application_port
+
+    @internal_application_port.setter
+    def internal_application_port(self, port):
+        port = int(port)
+        if port < 0 or port > 65535:
+            raise ValueError("Port must be in the range 0-65535")
+        self._internal_application_port = port
+
+
+class ApplicationStatus(NuclioStatus):
+    def __init__(
+        self,
+        state=None,
+        nuclio_name=None,
+        address=None,
+        internal_invocation_urls=None,
+        external_invocation_urls=None,
+        build_pod=None,
+        container_image=None,
+        application_image=None,
+        sidecar_name=None,
+    ):
+        super().__init__(
+            state=state,
+            nuclio_name=nuclio_name,
+            address=address,
+            internal_invocation_urls=internal_invocation_urls,
+            external_invocation_urls=external_invocation_urls,
+            build_pod=build_pod,
+            container_image=container_image,
+        )
+        self.application_image = application_image or None
+        self.sidecar_name = sidecar_name or None
+
+
+class ApplicationRuntime(RemoteRuntime):
+    kind = "application"
+
+    @min_nuclio_versions("1.12.7")
+    def __init__(self, spec=None, metadata=None):
+        super().__init__(spec=spec, metadata=metadata)
+
+    @property
+    def spec(self) -> ApplicationSpec:
+        return self._spec
+
+    @spec.setter
+    def spec(self, spec):
+        self._spec = self._verify_dict(spec, "spec", ApplicationSpec)
+
+    @property
+    def status(self) -> ApplicationStatus:
+        return self._status
+
+    @status.setter
+    def status(self, status):
+        self._status = self._verify_dict(status, "status", ApplicationStatus)
+
+    def set_internal_application_port(self, port: int):
+        self.spec.internal_application_port = port
+
+    def pre_deploy_validation(self):
+        super().pre_deploy_validation()
+        if not self.spec.config.get("spec.sidecars"):
+            raise mlrun.errors.MLRunBadRequestError(
+                "Application spec must include a sidecar configuration"
+            )
+
+        sidecars = self.spec.config["spec.sidecars"]
+        for sidecar in sidecars:
+            if not sidecar.get("image"):
+                raise mlrun.errors.MLRunBadRequestError(
+                    "Application sidecar spec must include an image"
+                )
+
+            if not sidecar.get("ports"):
+                raise mlrun.errors.MLRunBadRequestError(
+                    "Application sidecar spec must include at least one port"
+                )
+
+            ports = sidecar["ports"]
+            for port in ports:
+                if not port.get("containerPort"):
+                    raise mlrun.errors.MLRunBadRequestError(
+                        "Application sidecar port spec must include a containerPort"
+                    )
+
+                if not port.get("name"):
+                    raise mlrun.errors.MLRunBadRequestError(
+                        "Application sidecar port spec must include a name"
+                    )
+
+            if not sidecar.get("command") and sidecar.get("args"):
+                raise mlrun.errors.MLRunBadRequestError(
+                    "Application sidecar spec must include a command if args are provided"
+                )
+
+    def deploy(
+        self,
+        project="",
+        tag="",
+        verbose=False,
+        auth_info: AuthInfo = None,
+        builder_env: dict = None,
+        force_build: bool = False,
+    ):
+        self._ensure_reverse_proxy_configurations()
+        self._configure_application_sidecar()
+        super().deploy(
+            project,
+            tag,
+            verbose,
+            auth_info,
+            builder_env,
+            force_build,
+        )
+
+    def _ensure_reverse_proxy_configurations(self):
+        if self.spec.build.functionSourceCode or self.status.container_image:
+            return
+
+        filename, handler = ApplicationRuntime.get_filename_and_handler()
+        name, spec, code = nuclio.build_file(
+            filename,
+            name=self.metadata.name,
+            handler=handler,
+        )
+        self.spec.function_handler = mlrun.utils.get_in(spec, "spec.handler")
+        self.spec.build.functionSourceCode = mlrun.utils.get_in(
+            spec, "spec.build.functionSourceCode"
+        )
+        self.spec.nuclio_runtime = mlrun.utils.get_in(spec, "spec.runtime")
+
+    def _configure_application_sidecar(self):
+        # Save the application image in the status to allow overriding it with the reverse proxy entry point
+        if self.spec.image and (
+            not self.status.application_image
+            or self.spec.image != self.status.container_image
+        ):
+            self.status.application_image = self.spec.image
+            self.spec.image = ""
+
+        if self.status.container_image:
+            self.from_image(self.status.container_image)
+            # nuclio implementation detail - when providing the image and emptying out the source code,
+            # nuclio skips rebuilding the image and simply takes the prebuilt image
+            self.spec.build.functionSourceCode = ""
+
+        self.status.sidecar_name = f"{self.metadata.name}-sidecar"
+        self.with_sidecar(
+            name=self.status.sidecar_name,
+            image=self.status.application_image,
+            ports=self.spec.internal_application_port,
+            command=self.spec.command,
+            args=self.spec.args,
+        )
+        self.set_env("SIDECAR_PORT", self.spec.internal_application_port)
+        self.set_env("SIDECAR_HOST", "http://localhost")
+
+    @classmethod
+    def get_filename_and_handler(cls) -> (str, str):
+        reverse_proxy_file_path = pathlib.Path(__file__).parent / "reverse_proxy.go"
+        return str(reverse_proxy_file_path), "Handler"