paasta-tools 1.17.0__tar.gz → 1.17.2__tar.gz

{paasta-tools-1.17.0/paasta_tools.egg-info → paasta-tools-1.17.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 1.2
 Name: paasta-tools
-Version: 1.17.0
+Version: 1.17.2
 Summary: Tools for Yelps SOA infrastructure
 Home-page: UNKNOWN
 Author: Compute Infrastructure @ Yelp

{paasta-tools-1.17.0 → paasta-tools-1.17.2}/paasta_tools/__init__.py

@@ -17,4 +17,4 @@
 # setup phase, the dependencies may not exist on disk yet.
 #
 # Don't bump version manually. See `make release` docs in ./Makefile
-__version__ = "1.17.0"
+__version__ = "1.17.2"

paasta-tools-1.17.2/paasta_tools/cli/authentication.py

@@ -0,0 +1,77 @@
+# Copyright 2015-2016 Yelp Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+from functools import lru_cache
+
+from botocore.credentials import InstanceMetadataFetcher
+from botocore.credentials import InstanceMetadataProvider
+
+from paasta_tools.utils import load_system_paasta_config
+
+
+try:
+    from vault_tools.paasta_secret import get_client as get_vault_client
+    from vault_tools.paasta_secret import get_vault_url
+    from vault_tools.paasta_secret import get_vault_ca
+    from okta_auth import get_and_cache_jwt_default
+except ImportError:
+
+    def get_vault_client(url: str, capath: str) -> None:
+        pass
+
+    def get_vault_url(ecosystem: str) -> str:
+        return ""
+
+    def get_vault_ca(ecosystem: str) -> str:
+        return ""
+
+    def get_and_cache_jwt_default(client_id: str) -> str:
+        return ""
+
+
+def get_current_ecosystem() -> str:
+    """Get current ecosystem from host configs, defaults to dev if no config is found"""
+    try:
+        with open("/nail/etc/ecosystem") as f:
+            return f.read().strip()
+    except IOError:
+        pass
+    return "devc"
+
+
+@lru_cache(maxsize=1)
+def get_service_auth_token() -> str:
+    """Uses instance profile to authenticate with Vault and generate token for service authentication"""
+    ecosystem = get_current_ecosystem()
+    vault_client = get_vault_client(get_vault_url(ecosystem), get_vault_ca(ecosystem))
+    vault_role = load_system_paasta_config().get_service_auth_vault_role()
+    metadata_provider = InstanceMetadataProvider(
+        iam_role_fetcher=InstanceMetadataFetcher(),
+    )
+    instance_credentials = metadata_provider.load().get_frozen_credentials()
+    vault_client.auth.aws.iam_login(
+        instance_credentials.access_key,
+        instance_credentials.secret_key,
+        instance_credentials.token,
+        mount_point="aws-iam",
+        role=vault_role,
+        use_token=True,
+    )
+    response = vault_client.secrets.identity.generate_signed_id_token(name=vault_role)
+    return response["data"]["token"]
+
+
+def get_sso_service_auth_token() -> str:
+    """Generate an authentication token for the calling user from the Single Sign On provider"""
+    client_id = load_system_paasta_config().get_service_auth_sso_oidc_client_id()
+    return get_and_cache_jwt_default(client_id)

{paasta-tools-1.17.0 → paasta-tools-1.17.2}/paasta_tools/cli/cmds/local_run.py

@@ -34,12 +34,12 @@ from docker import errors
 from mypy_extensions import TypedDict
 
 from paasta_tools.adhoc_tools import get_default_interactive_config
+from paasta_tools.cli.authentication import get_service_auth_token
+from paasta_tools.cli.authentication import get_sso_service_auth_token
 from paasta_tools.cli.cmds.check import makefile_responds_to
 from paasta_tools.cli.cmds.cook_image import paasta_cook_image
 from paasta_tools.cli.utils import figure_out_service_name
 from paasta_tools.cli.utils import get_instance_config
-from paasta_tools.cli.utils import get_service_auth_token
-from paasta_tools.cli.utils import get_sso_service_auth_token
 from paasta_tools.cli.utils import lazy_choices_completer
 from paasta_tools.cli.utils import list_instances
 from paasta_tools.cli.utils import pick_random_port

{paasta-tools-1.17.0 → paasta-tools-1.17.2}/paasta_tools/cli/cmds/remote_run.py

@@ -13,6 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 import argparse
+import shutil
 import time
 
 from paasta_tools.cli.utils import get_paasta_oapi_api_clustername
@@ -29,7 +30,7 @@ from paasta_tools.utils import SystemPaastaConfig
 
 
 KUBECTL_CMD_TEMPLATE = (
-    "kubectl-eks-{cluster} --token {token} exec -it -n {namespace} {pod} -- /bin/bash"
+    "{kubectl_wrapper} --token {token} exec -it -n {namespace} {pod} -- /bin/bash"
 )
 
 
@@ -89,8 +90,11 @@ def paasta_remote_run_start(
         args.service, args.instance, user
     )
 
+    kubectl_wrapper = f"kubectl-eks-{args.cluster}"
+    if not shutil.which(kubectl_wrapper):
+        kubectl_wrapper = f"kubectl-{args.cluster}"
     exec_command = KUBECTL_CMD_TEMPLATE.format(
-        cluster=args.cluster,
+        kubectl_wrapper=kubectl_wrapper,
         namespace=poll_response.namespace,
         pod=poll_response.pod_name,
         token=token_response.token,

{paasta-tools-1.17.0 → paasta-tools-1.17.2}/paasta_tools/cli/cmds/spark_run.py

@@ -26,10 +26,10 @@ from service_configuration_lib.spark_config import get_resources_requested
 from service_configuration_lib.spark_config import get_spark_hourly_cost
 from service_configuration_lib.spark_config import UnsupportedClusterManagerException
 
+from paasta_tools.cli.authentication import get_service_auth_token
 from paasta_tools.cli.cmds.check import makefile_responds_to
 from paasta_tools.cli.cmds.cook_image import paasta_cook_image
 from paasta_tools.cli.utils import get_instance_config
-from paasta_tools.cli.utils import get_service_auth_token
 from paasta_tools.cli.utils import lazy_choices_completer
 from paasta_tools.cli.utils import list_instances
 from paasta_tools.clusterman import get_clusterman_metrics

{paasta-tools-1.17.0 → paasta-tools-1.17.2}/paasta_tools/cli/utils.py

@@ -39,8 +39,6 @@ from typing import Set
 from typing import Tuple
 
 import ephemeral_port_reserve
-from botocore.credentials import InstanceMetadataFetcher
-from botocore.credentials import InstanceMetadataProvider
 from mypy_extensions import NamedArg
 
 from paasta_tools import remote_git
@@ -48,6 +46,7 @@ from paasta_tools.adhoc_tools import load_adhoc_job_config
 from paasta_tools.api.client import get_paasta_oapi_client
 from paasta_tools.api.client import PaastaOApiClient
 from paasta_tools.cassandracluster_tools import load_cassandracluster_instance_config
+from paasta_tools.cli.authentication import get_sso_service_auth_token
 from paasta_tools.eks_tools import EksDeploymentConfig
 from paasta_tools.eks_tools import load_eks_service_config
 from paasta_tools.flink_tools import load_flink_instance_config
@@ -81,25 +80,6 @@ from paasta_tools.utils import PaastaColors
 from paasta_tools.utils import SystemPaastaConfig
 from paasta_tools.utils import validate_service_instance
 
-try:
-    from vault_tools.paasta_secret import get_client as get_vault_client
-    from vault_tools.paasta_secret import get_vault_url
-    from vault_tools.paasta_secret import get_vault_ca
-    from okta_auth import get_and_cache_jwt_default
-except ImportError:
-
-    def get_vault_client(url: str, capath: str) -> None:
-        pass
-
-    def get_vault_url(ecosystem: str) -> str:
-        return ""
-
-    def get_vault_ca(ecosystem: str) -> str:
-        return ""
-
-    def get_and_cache_jwt_default(client_id: str) -> str:
-        return ""
-
 
 log = logging.getLogger(__name__)
 
@@ -1104,43 +1084,6 @@ def get_paasta_oapi_api_clustername(cluster: str, is_eks: bool) -> str:
     return f"eks-{cluster}" if is_eks else cluster
 
 
-def get_current_ecosystem() -> str:
-    """Get current ecosystem from host configs, defaults to dev if no config is found"""
-    try:
-        with open("/nail/etc/ecosystem") as f:
-            return f.read().strip()
-    except IOError:
-        pass
-    return "devc"
-
-
-def get_service_auth_token() -> str:
-    """Uses instance profile to authenticate with Vault and generate token for service authentication"""
-    ecosystem = get_current_ecosystem()
-    vault_client = get_vault_client(get_vault_url(ecosystem), get_vault_ca(ecosystem))
-    vault_role = load_system_paasta_config().get_service_auth_vault_role()
-    metadata_provider = InstanceMetadataProvider(
-        iam_role_fetcher=InstanceMetadataFetcher(),
-    )
-    instance_credentials = metadata_provider.load().get_frozen_credentials()
-    vault_client.auth.aws.iam_login(
-        instance_credentials.access_key,
-        instance_credentials.secret_key,
-        instance_credentials.token,
-        mount_point="aws-iam",
-        role=vault_role,
-        use_token=True,
-    )
-    response = vault_client.secrets.identity.generate_signed_id_token(name=vault_role)
-    return response["data"]["token"]
-
-
-def get_sso_service_auth_token() -> str:
-    """Generate an authentication token for the calling user from the Single Sign On provider"""
-    client_id = load_system_paasta_config().get_service_auth_sso_oidc_client_id()
-    return get_and_cache_jwt_default(client_id)
-
-
 def get_paasta_oapi_client_with_auth(
     cluster: str = None,
     system_paasta_config: SystemPaastaConfig = None,

{paasta-tools-1.17.0 → paasta-tools-1.17.2}/paasta_tools/kubernetes/remote_run.py

@@ -374,7 +374,11 @@ def create_pod_scoped_role(
             labels={POD_OWNER_LABEL: user},
         ),
     )
-    kube_client.rbac.create_namespaced_role(namespace=namespace, body=role)
+    try:
+        kube_client.rbac.create_namespaced_role(namespace=namespace, body=role)
+    except ApiException as e:
+        if e.status != 409:
+            raise
     return role_name
 
 
@@ -411,10 +415,14 @@ def bind_role_to_service_account(
             ),
         ],
     )
-    kube_client.rbac.create_namespaced_role_binding(
-        namespace=namespace,
-        body=role_binding,
-    )
+    try:
+        kube_client.rbac.create_namespaced_role_binding(
+            namespace=namespace,
+            body=role_binding,
+        )
+    except ApiException as e:
+        if e.status != 409:
+            raise
 
 
 def get_remote_run_roles(kube_client: KubeClient, namespace: str) -> List[V1Role]:

{paasta-tools-1.17.0 → paasta-tools-1.17.2}/paasta_tools/tron/client.py

@@ -11,12 +11,14 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 import logging
+import os
 from typing import Dict
 from urllib.parse import urljoin
 
 import requests
 
 from paasta_tools import yaml_tools as yaml
+from paasta_tools.cli.authentication import get_service_auth_token
 from paasta_tools.utils import get_user_agent
 
 
@@ -43,6 +45,9 @@ class TronClient:
             response = requests.get(**kwargs)
         elif method == "POST":
             kwargs["data"] = data
+            if os.getenv("TRONCTL_API_AUTH"):
+                token = get_service_auth_token()
+                kwargs["headers"]["Authorization"] = f"Bearer {token}"
             response = requests.post(**kwargs)
         else:
             raise ValueError(f"Unrecognized method: {method}")

{paasta-tools-1.17.0 → paasta-tools-1.17.2/paasta_tools.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 1.2
 Name: paasta-tools
-Version: 1.17.0
+Version: 1.17.2
 Summary: Tools for Yelps SOA infrastructure
 Home-page: UNKNOWN
 Author: Compute Infrastructure @ Yelp

{paasta-tools-1.17.0 → paasta-tools-1.17.2}/paasta_tools.egg-info/SOURCES.txt

@@ -119,6 +119,7 @@ paasta_tools/autoscaling/max_all_k8s_services.py
 paasta_tools/autoscaling/pause_service_autoscaler.py
 paasta_tools/autoscaling/utils.py
 paasta_tools/cli/__init__.py
+paasta_tools/cli/authentication.py
 paasta_tools/cli/cli.py
 paasta_tools/cli/fsm_cmd.py
 paasta_tools/cli/paasta_tabcomplete.sh