paasta-tools 0.231.0__tar.gz → 0.232.1__tar.gz

{paasta-tools-0.231.0/paasta_tools.egg-info → paasta-tools-0.232.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 1.2
 Name: paasta-tools
-Version: 0.231.0
+Version: 0.232.1
 Summary: Tools for Yelps SOA infrastructure
 Home-page: UNKNOWN
 Author: Compute Infrastructure @ Yelp

{paasta-tools-0.231.0 → paasta-tools-0.232.1}/paasta_tools/__init__.py

@@ -17,4 +17,4 @@
 # setup phase, the dependencies may not exist on disk yet.
 #
 # Don't bump version manually. See `make release` docs in ./Makefile
-__version__ = "0.231.0"
+__version__ = "0.232.1"

{paasta-tools-0.231.0 → paasta-tools-0.232.1}/paasta_tools/cli/cmds/rollback.py

@@ -52,12 +52,21 @@ def add_subparser(subparsers: argparse._SubParsersAction) -> None:
             "'paasta rollback' is a human-friendly tool for marking a particular "
             "docker image for deployment, which invokes a bounce. While the command "
             "is called 'rollback', it can be used to roll forward or back, as long "
-            "as there is a docker image available for the input git SHA."
+            "as there is a docker image available for the input Git SHA."
         ),
         epilog=(
             "This rollback command uses the Git control plane, which requires network "
-            "connectivity as well as authorization to the git repo."
+            "connectivity as well as authorization to the Git repo.\n\n"
+            + PaastaColors.red(
+                "WARNING: You MUST manually revert changes in Git and go through the normal push process after using this command.\n"
+            )
+            + PaastaColors.red(
+                "WARNING: Failing to do so means that Jenkins will redeploy the latest code on the next scheduled build!"
+            )
         ),
+        # we manually format the epilog to add newlines + give it an attention-grabbing color
+        # re: reverting changes in Git post-rollback
+        formatter_class=argparse.RawDescriptionHelpFormatter,
     )
     arg_commit = list_parser.add_argument(
         "-k",
@@ -66,7 +75,6 @@ def add_subparser(subparsers: argparse._SubParsersAction) -> None:
         "A commit to rollback to is required for paasta rollback to run. However if one is not provided, "
         "paasta rollback will instead output a list of valid git shas to rollback to.",
         required=False,
-        type=validate_full_git_sha,
     )
     arg_commit.completer = lazy_choices_completer(list_previously_deployed_shas)  # type: ignore
     arg_version = list_parser.add_argument(
@@ -228,6 +236,13 @@ def paasta_rollback(args: argparse.Namespace) -> int:
     deploy groups and sha. These arguments will be verified and passed onto
     mark_for_deployment.
     """
+
+    try:
+        validate_full_git_sha(args.commit)
+    except argparse.ArgumentTypeError as e:
+        print(PaastaColors.red(f"Error: {e}"))
+        return 1
+
     soa_dir = args.soa_dir
     service = figure_out_service_name(args, soa_dir)
 
@@ -319,8 +334,13 @@ def paasta_rollback(args: argparse.Namespace) -> int:
 
     if returncode == 0:
         print(
-            PaastaColors.cyan(
-                f"Warning: Don't forget to revert in git as well. Use 'git revert {rolled_back_from.sha}', and go through the normal push process. "
+            PaastaColors.red(
+                f"WARNING: You MUST manually revert changes in Git! Use 'git revert {rolled_back_from.sha}', and go through the normal push process. "
+            )
+        )
+        print(
+            PaastaColors.red(
+                f"WARNING: Failing to do so means that Jenkins will redeploy the latest code on the next scheduled build!"
             )
         )
 

{paasta-tools-0.231.0 → paasta-tools-0.232.1}/paasta_tools/cli/schemas/eks_schema.json

@@ -586,6 +586,28 @@
                     },
                     "uniqueItems": true
                 },
+                "projected_sa_volumes": {
+                    "type": "array",
+                    "items": {
+                        "type": "object",
+                        "properties": {
+                            "container_path": {
+                                "type": "string"
+                            },
+                            "audience": {
+                                "type": "string"
+                            },
+                            "expiration_seconds": {
+                                "type": "integer"
+                            }
+                        },
+                        "required": [
+                            "container_path",
+                            "audience"
+                        ]
+                    },
+                    "uniqueItems": true
+                },
                 "replication_threshold": {
                     "type": "integer",
                     "minimum": 0

{paasta-tools-0.231.0 → paasta-tools-0.232.1}/paasta_tools/cli/schemas/kubernetes_schema.json

@@ -586,6 +586,28 @@
                     },
                     "uniqueItems": true
                 },
+                "projected_sa_volumes": {
+                    "type": "array",
+                    "items": {
+                        "type": "object",
+                        "properties": {
+                            "container_path": {
+                                "type": "string"
+                            },
+                            "audience": {
+                                "type": "string"
+                            },
+                            "expiration_seconds": {
+                                "type": "integer"
+                            }
+                        },
+                        "required": [
+                            "container_path",
+                            "audience"
+                        ]
+                    },
+                    "uniqueItems": true
+                },
                 "replication_threshold": {
                     "type": "integer",
                     "minimum": 0

{paasta-tools-0.231.0 → paasta-tools-0.232.1}/paasta_tools/cli/schemas/tron_schema.json

@@ -283,6 +283,28 @@
                     },
                     "uniqueItems": true
                 },
+                "projected_sa_volumes": {
+                    "type": "array",
+                    "items": {
+                        "type": "object",
+                        "properties": {
+                            "container_path": {
+                                "type": "string"
+                            },
+                            "audience": {
+                                "type": "string"
+                            },
+                            "expiration_seconds": {
+                                "type": "integer"
+                            }
+                        },
+                        "required": [
+                            "container_path",
+                            "audience"
+                        ]
+                    },
+                    "uniqueItems": true
+                },
                 "cluster": {
                     "type": "string"
                 },

{paasta-tools-0.231.0 → paasta-tools-0.232.1}/paasta_tools/cli/utils.py

@@ -977,11 +977,11 @@ def validate_given_deploy_groups(
 
 
 def short_to_full_git_sha(short, refs):
-    """Converts a short git sha to a full sha
+    """Converts a short git sha to a full SHA
 
-    :param short: A short git sha represented as a string
-    :param refs: A list of refs in the git repository
-    :return: The full git sha or None if one can't be found
+    :param short: A short Git SHA represented as a string
+    :param refs: A list of refs in the Git repository
+    :return: The full Git SHA or None if one can't be found
     """
     return [sha for sha in set(refs.values()) if sha.startswith(short)]
 
@@ -989,15 +989,15 @@ def short_to_full_git_sha(short, refs):
 def validate_short_git_sha(value):
     pattern = re.compile("[a-f0-9]{4,40}")
     if not pattern.match(value):
-        raise argparse.ArgumentTypeError("%s is not a valid git sha" % value)
+        raise argparse.ArgumentTypeError("%s is not a valid Git SHA" % value)
     return value
 
 
-def validate_full_git_sha(value):
+def validate_full_git_sha(value: str) -> str:
     pattern = re.compile("[a-f0-9]{40}")
     if not pattern.match(value):
         raise argparse.ArgumentTypeError(
-            "%s is not a full git sha, and PaaSTA needs the full sha" % value
+            "%s is not a full Git SHA, and PaaSTA needs the full SHA" % value
         )
     return value
 
@@ -1011,7 +1011,7 @@ def validate_git_sha(sha, git_url):
         commits = short_to_full_git_sha(short=sha, refs=refs)
         if len(commits) != 1:
             raise ValueError(
-                "%s matched %d git shas (with refs pointing at them). Must match exactly 1."
+                "%s matched %d Git SHAs (with refs pointing at them). Must match exactly 1."
                 % (sha, len(commits))
             )
         return commits[0]

{paasta-tools-0.231.0 → paasta-tools-0.232.1}/paasta_tools/kubernetes_tools.py

@@ -98,6 +98,7 @@ from kubernetes.client import V1PodSpec
 from kubernetes.client import V1PodTemplateSpec
 from kubernetes.client import V1PreferredSchedulingTerm
 from kubernetes.client import V1Probe
+from kubernetes.client import V1ProjectedVolumeSource
 from kubernetes.client import V1ReplicaSet
 from kubernetes.client import V1ResourceRequirements
 from kubernetes.client import V1RoleBinding
@@ -108,6 +109,7 @@ from kubernetes.client import V1SecretKeySelector
 from kubernetes.client import V1SecretVolumeSource
 from kubernetes.client import V1SecurityContext
 from kubernetes.client import V1ServiceAccount
+from kubernetes.client import V1ServiceAccountTokenProjection
 from kubernetes.client import V1StatefulSet
 from kubernetes.client import V1StatefulSetSpec
 from kubernetes.client import V1Subject
@@ -115,6 +117,7 @@ from kubernetes.client import V1TCPSocketAction
 from kubernetes.client import V1TopologySpreadConstraint
 from kubernetes.client import V1Volume
 from kubernetes.client import V1VolumeMount
+from kubernetes.client import V1VolumeProjection
 from kubernetes.client import V1WeightedPodAffinityTerm
 from kubernetes.client import V2beta2CrossVersionObjectReference
 from kubernetes.client import V2beta2HorizontalPodAutoscaler
@@ -171,6 +174,7 @@ from paasta_tools.utils import load_v2_deployments_json
 from paasta_tools.utils import PaastaColors
 from paasta_tools.utils import PaastaNotConfiguredError
 from paasta_tools.utils import PersistentVolume
+from paasta_tools.utils import ProjectedSAVolume
 from paasta_tools.utils import SecretVolume
 from paasta_tools.utils import SystemPaastaConfig
 from paasta_tools.utils import time_cache
@@ -227,6 +231,9 @@ DEFAULT_SIDECAR_REQUEST: KubeContainerResourceRequest = {
     "ephemeral-storage": "256Mi",
 }
 
+DEFAULT_PROJECTED_SA_EXPIRATION_SECONDS = 3600
+PROJECTED_SA_TOKEN_PATH = "token"
+
 
 # conditions is None when creating a new HPA, but the client raises an error in that case.
 # For detail, https://github.com/kubernetes-client/python/issues/553
@@ -1002,6 +1009,14 @@ class KubernetesDeploymentConfig(LongRunningServiceConfig):
             "secret--{name}".format(name=secret_volume["secret_name"]), length_limit=63
         )
 
+    def get_projected_sa_volume_name(
+        self, projected_sa_volume: ProjectedSAVolume
+    ) -> str:
+        return self.get_sanitised_volume_name(
+            "projected-sa--{audience}".format(audience=projected_sa_volume["audience"]),
+            length_limit=63,
+        )
+
     def get_boto_secret_volume_name(self, service_name: str) -> str:
         return self.get_sanitised_volume_name(
             f"secret-boto-key-{service_name}", length_limit=63
@@ -1130,6 +1145,7 @@ class KubernetesDeploymentConfig(LongRunningServiceConfig):
                     aws_ebs_volumes=[],
                     persistent_volumes=[],
                     secret_volumes=[],
+                    projected_sa_volumes=[],
                 ),
             )
         return None
@@ -1440,6 +1456,7 @@ class KubernetesDeploymentConfig(LongRunningServiceConfig):
                 aws_ebs_volumes=aws_ebs_volumes,
                 persistent_volumes=self.get_persistent_volumes(),
                 secret_volumes=secret_volumes,
+                projected_sa_volumes=self.get_projected_sa_volumes(),
             ),
         )
         containers = [service_container] + self.get_sidecar_containers(  # type: ignore
@@ -1477,6 +1494,7 @@ class KubernetesDeploymentConfig(LongRunningServiceConfig):
         docker_volumes: Sequence[DockerVolume],
         aws_ebs_volumes: Sequence[AwsEbsVolume],
         secret_volumes: Sequence[SecretVolume],
+        projected_sa_volumes: Sequence[ProjectedSAVolume],
     ) -> Sequence[V1Volume]:
         pod_volumes = []
         unique_docker_volumes = {
@@ -1534,6 +1552,27 @@ class KubernetesDeploymentConfig(LongRunningServiceConfig):
                     ),
                 )
             )
+        for projected_volume in projected_sa_volumes:
+            pod_volumes.append(
+                V1Volume(
+                    name=self.get_projected_sa_volume_name(projected_volume),
+                    projected=V1ProjectedVolumeSource(
+                        sources=[
+                            V1VolumeProjection(
+                                service_account_token=V1ServiceAccountTokenProjection(
+                                    audience=projected_volume["audience"],
+                                    expiration_seconds=projected_volume.get(
+                                        "expiration_seconds",
+                                        DEFAULT_PROJECTED_SA_EXPIRATION_SECONDS,
+                                    ),
+                                    path=PROJECTED_SA_TOKEN_PATH,
+                                )
+                            )
+                        ],
+                    ),
+                ),
+            )
+
         boto_volume = self.get_boto_volume()
         if boto_volume:
             pod_volumes.append(boto_volume)
@@ -1694,6 +1733,7 @@ class KubernetesDeploymentConfig(LongRunningServiceConfig):
         aws_ebs_volumes: Sequence[AwsEbsVolume],
         persistent_volumes: Sequence[PersistentVolume],
         secret_volumes: Sequence[SecretVolume],
+        projected_sa_volumes: Sequence[ProjectedSAVolume],
     ) -> Sequence[V1VolumeMount]:
         volume_mounts = (
             [
@@ -1728,6 +1768,14 @@ class KubernetesDeploymentConfig(LongRunningServiceConfig):
                 )
                 for volume in secret_volumes
             ]
+            + [
+                V1VolumeMount(
+                    mount_path=volume["container_path"],
+                    name=self.get_projected_sa_volume_name(volume),
+                    read_only=True,
+                )
+                for volume in projected_sa_volumes
+            ]
         )
         if self.config_dict.get("boto_keys", []):
             secret_hash = self.get_boto_secret_hash()
@@ -2140,6 +2188,7 @@ class KubernetesDeploymentConfig(LongRunningServiceConfig):
                 docker_volumes=docker_volumes + hacheck_sidecar_volumes,
                 aws_ebs_volumes=self.get_aws_ebs_volumes(),
                 secret_volumes=self.get_secret_volumes(),
+                projected_sa_volumes=self.get_projected_sa_volumes(),
             ),
         )
         # need to check if there are node selectors/affinities. if there are none

{paasta-tools-0.231.0 → paasta-tools-0.232.1}/paasta_tools/utils.py

@@ -287,6 +287,12 @@ class SecretVolume(TypedDict, total=False):
     items: List[SecretVolumeItem]
 
 
+class ProjectedSAVolume(TypedDict, total=False):
+    container_path: str
+    audience: str
+    expiration_seconds: int
+
+
 class TronSecretVolume(SecretVolume, total=False):
     secret_volume_name: str
 
@@ -331,6 +337,7 @@ class InstanceConfigDict(TypedDict, total=False):
     extra_volumes: List[DockerVolume]
     aws_ebs_volumes: List[AwsEbsVolume]
     secret_volumes: List[SecretVolume]
+    projected_sa_volumes: List[ProjectedSAVolume]
     security: SecurityConfigDict
     dependencies_reference: str
     dependencies: Dict[str, Dict]
@@ -960,6 +967,9 @@ class InstanceConfig:
     def get_secret_volumes(self) -> List[SecretVolume]:
         return self.config_dict.get("secret_volumes", [])
 
+    def get_projected_sa_volumes(self) -> List[ProjectedSAVolume]:
+        return self.config_dict.get("projected_sa_volumes", [])
+
     def get_iam_role(self) -> str:
         return self.config_dict.get("iam_role", "")
 

{paasta-tools-0.231.0 → paasta-tools-0.232.1/paasta_tools.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 1.2
 Name: paasta-tools
-Version: 0.231.0
+Version: 0.232.1
 Summary: Tools for Yelps SOA infrastructure
 Home-page: UNKNOWN
 Author: Compute Infrastructure @ Yelp