paasta-tools 1.17.2__tar.gz → 1.19.0__tar.gz

{paasta-tools-1.17.2/paasta_tools.egg-info → paasta-tools-1.19.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 1.2
 Name: paasta-tools
-Version: 1.17.2
+Version: 1.19.0
 Summary: Tools for Yelps SOA infrastructure
 Home-page: UNKNOWN
 Author: Compute Infrastructure @ Yelp

{paasta-tools-1.17.2 → paasta-tools-1.19.0}/paasta_tools/__init__.py

@@ -17,4 +17,4 @@
 # setup phase, the dependencies may not exist on disk yet.
 #
 # Don't bump version manually. See `make release` docs in ./Makefile
-__version__ = "1.17.2"
+__version__ = "1.19.0"

{paasta-tools-1.17.2 → paasta-tools-1.19.0}/paasta_tools/api/api_docs/swagger.json

@@ -2,7 +2,7 @@
     "swagger": "2.0",
     "info": {
         "title": "Paasta API",
-        "version": "1.1.1"
+        "version": "1.2.0"
     },
     "basePath": "/v1",
     "schemes": [
@@ -994,6 +994,19 @@
                         "name": "job_name",
                         "required": true,
                         "type": "string"
+                    },
+                    {
+                        "in": "query",
+                        "description": "User requesting the job",
+                        "name": "user",
+                        "required": true,
+                        "type": "string"
+                    },
+                    {
+                        "in": "query",
+                        "description": "Whether this is a toolbox job",
+                        "name": "toolbox",
+                        "type": "boolean"
                     }
                 ]
             }
@@ -2184,6 +2197,9 @@
                 },
                 "max_duration": {
                     "type": "integer"
+                },
+                "toolbox": {
+                    "type": "boolean"
                 }
             },
             "required": [
@@ -2195,6 +2211,9 @@
             "properties": {
                 "user": {
                     "type": "string"
+                },
+                "toolbox": {
+                    "type": "boolean"
                 }
             },
             "required": [
@@ -2213,6 +2232,9 @@
                 "pod_name": {
                     "type": "string"
                 },
+                "pod_address": {
+                    "type": "string"
+                },
                 "job_name": {
                     "type": "string"
                 },

{paasta-tools-1.17.2 → paasta-tools-1.19.0}/paasta_tools/api/views/remote_run.py

@@ -34,6 +34,7 @@ def view_remote_run_start(request):
     user = request.swagger_data["json_body"]["user"]
     interactive = request.swagger_data["json_body"].get("interactive", True)
     recreate = request.swagger_data["json_body"].get("recreate", False)
+    is_toolbox = request.swagger_data["json_body"].get("toolbox", False)
     max_duration = min(
         request.swagger_data["json_body"].get("max_duration", DEFAULT_MAX_DURATION),
         get_max_job_duration_limit(),
@@ -47,6 +48,7 @@ def view_remote_run_start(request):
             interactive=interactive,
             recreate=recreate,
             max_duration=max_duration,
+            is_toolbox=is_toolbox,
         )
     except Exception:
         error_message = traceback.format_exc()
@@ -58,12 +60,16 @@ def view_remote_run_poll(request):
     service = request.swagger_data["service"]
     instance = request.swagger_data["instance"]
     job_name = request.swagger_data["job_name"]
+    user = request.swagger_data["user"]
+    is_toolbox = request.swagger_data.get("toolbox", False)
     try:
         return remote_run_ready(
             service=service,
             instance=instance,
             cluster=settings.cluster,
             job_name=job_name,
+            user=user,
+            is_toolbox=is_toolbox,
         )
     except Exception:
         error_message = traceback.format_exc()
@@ -75,12 +81,14 @@ def view_remote_run_stop(request):
     service = request.swagger_data["service"]
     instance = request.swagger_data["instance"]
     user = request.swagger_data["json_body"]["user"]
+    is_toolbox = request.swagger_data["json_body"].get("toolbox", False)
     try:
         return remote_run_stop(
             service=service,
             instance=instance,
             cluster=settings.cluster,
             user=user,
+            is_toolbox=is_toolbox,
         )
     except Exception:
         error_message = traceback.format_exc()

{paasta-tools-1.17.2 → paasta-tools-1.19.0}/paasta_tools/cli/cmds/remote_run.py

@@ -15,14 +15,17 @@
 import argparse
 import shutil
 import time
+from typing import List
 
 from paasta_tools.cli.utils import get_paasta_oapi_api_clustername
 from paasta_tools.cli.utils import get_paasta_oapi_client_with_auth
 from paasta_tools.cli.utils import lazy_choices_completer
 from paasta_tools.cli.utils import run_interactive_cli
+from paasta_tools.kubernetes.remote_run import TOOLBOX_MOCK_SERVICE
 from paasta_tools.paastaapi.model.remote_run_start import RemoteRunStart
 from paasta_tools.paastaapi.model.remote_run_stop import RemoteRunStop
 from paasta_tools.utils import get_username
+from paasta_tools.utils import list_all_instances_for_service
 from paasta_tools.utils import list_clusters
 from paasta_tools.utils import list_services
 from paasta_tools.utils import load_system_paasta_config
@@ -34,6 +37,21 @@ KUBECTL_CMD_TEMPLATE = (
 )
 
 
+def _list_services_and_toolboxes() -> List[str]:
+    try:
+        toolbox_instances = list_all_instances_for_service(
+            TOOLBOX_MOCK_SERVICE, instance_type="adhoc"
+        )
+    except Exception:
+        toolbox_instances = set()
+    # NOTE: API authorization is enforced by service, and we want different rules
+    # for each toolbox, so we combine service and instance in this case to properly
+    # allow that to happen.
+    return list(list_services()) + sorted(
+        f"{TOOLBOX_MOCK_SERVICE}-{instance}" for instance in toolbox_instances
+    )
+
+
 def paasta_remote_run_start(
     args: argparse.Namespace,
     system_paasta_config: SystemPaastaConfig,
@@ -55,6 +73,7 @@ def paasta_remote_run_start(
             interactive=args.interactive,
             recreate=args.recreate,
             max_duration=args.max_duration,
+            toolbox=args.toolbox,
         ),
     )
     if start_response.status >= 300:
@@ -67,9 +86,11 @@ def paasta_remote_run_start(
     start_time = time.time()
     while time.time() - start_time < args.timeout:
         poll_response = client.remote_run.remote_run_poll(
-            args.service,
-            args.instance,
-            start_response.job_name,
+            service=args.service,
+            instance=args.instance,
+            job_name=start_response.job_name,
+            user=user,
+            toolbox=args.toolbox,
         )
         if poll_response.status == 200:
             print("")
@@ -80,25 +101,32 @@ def paasta_remote_run_start(
         print("Timed out while waiting for job to start")
         return 1
 
-    if not args.interactive:
+    if not args.interactive and not args.toolbox:
         print("Successfully started remote-run job")
         return 0
 
     print("Pod ready, establishing interactive session...")
 
-    token_response = client.remote_run.remote_run_token(
-        args.service, args.instance, user
-    )
+    if args.toolbox:
+        # NOTE: we only do this for toolbox containers since those images are built with interactive
+        # access in mind, and SSH sessions provide better auditability of user actions.
+        # I.e., being `nobody` is fine in a normal remote-run, but in toolbox containers
+        # we will require knowing the real user (and some tools may need that too).
+        exec_command = f"ssh -A {poll_response.pod_address}"
+    else:
+        token_response = client.remote_run.remote_run_token(
+            args.service, args.instance, user
+        )
+        kubectl_wrapper = f"kubectl-eks-{args.cluster}"
+        if not shutil.which(kubectl_wrapper):
+            kubectl_wrapper = f"kubectl-{args.cluster}"
+        exec_command = KUBECTL_CMD_TEMPLATE.format(
+            kubectl_wrapper=kubectl_wrapper,
+            namespace=poll_response.namespace,
+            pod=poll_response.pod_name,
+            token=token_response.token,
+        )
 
-    kubectl_wrapper = f"kubectl-eks-{args.cluster}"
-    if not shutil.which(kubectl_wrapper):
-        kubectl_wrapper = f"kubectl-{args.cluster}"
-    exec_command = KUBECTL_CMD_TEMPLATE.format(
-        kubectl_wrapper=kubectl_wrapper,
-        namespace=poll_response.namespace,
-        pod=poll_response.pod_name,
-        token=token_response.token,
-    )
     run_interactive_cli(exec_command)
     return 0
 
@@ -115,7 +143,9 @@ def paasta_remote_run_stop(
         print("Cannot get a paasta-api client")
         return 1
     response = client.remote_run.remote_run_stop(
-        args.service, args.instance, RemoteRunStop(user=get_username())
+        args.service,
+        args.instance,
+        RemoteRunStop(user=get_username(), toolbox=args.toolbox),
     )
     print(response.message)
     return 0 if response.status < 300 else 1
@@ -128,15 +158,22 @@ def add_common_args_to_parser(parser: argparse.ArgumentParser):
         help="The name of the service you wish to inspect. Required.",
         required=True,
     )
-    service_arg.completer = lazy_choices_completer(list_services)  # type: ignore
-    parser.add_argument(
+    service_arg.completer = lazy_choices_completer(_list_services_and_toolboxes)  # type: ignore
+    instance_or_toolbox = parser.add_mutually_exclusive_group()
+    instance_or_toolbox.add_argument(
         "-i",
         "--instance",
         help=(
             "Simulate a docker run for a particular instance of the "
             "service, like 'main' or 'canary'. Required."
         ),
-        required=True,
+        default="main",
+    )
+    instance_or_toolbox.add_argument(
+        "--toolbox",
+        help="The selected service is a 'toolbox' container",
+        action="store_true",
+        default=False,
     )
     cluster_arg = parser.add_argument(
         "-c",

{paasta-tools-1.17.2 → paasta-tools-1.19.0}/paasta_tools/cli/schemas/adhoc_schema.json

@@ -158,6 +158,9 @@
                         "type": "string"
                     }
                 },
+                "privileged": {
+                    "type": "boolean"
+                },
                 "cfs_period_us": {
                     "type": "integer",
                     "minimum": 1000,
@@ -180,6 +183,15 @@
                 },
                 "role": {
                     "type": "string"
+                },
+                "namespace": {
+                    "type": "string"
+                },
+                "container_port": {
+                    "type": "integer"
+                },
+                "docker_url": {
+                    "type": "string"
                 }
             }
         }

{paasta-tools-1.17.2 → paasta-tools-1.19.0}/paasta_tools/cli/schemas/eks_schema.json

@@ -837,6 +837,9 @@
                 "routable_ip": {
                     "type": "boolean"
                 },
+                "enable_aws_lb_readiness_gate": {
+                    "type": "boolean"
+                },
                 "lifecycle": {
                     "type": "object",
                     "properties": {

{paasta-tools-1.17.2 → paasta-tools-1.19.0}/paasta_tools/cli/schemas/kubernetes_schema.json

@@ -837,6 +837,9 @@
                 "routable_ip": {
                     "type": "boolean"
                 },
+                "enable_aws_lb_readiness_gate": {
+                    "type": "boolean"
+                },
                 "lifecycle": {
                     "type": "object",
                     "properties": {

{paasta-tools-1.17.2 → paasta-tools-1.19.0}/paasta_tools/kubernetes/remote_run.py

@@ -32,6 +32,8 @@ from kubernetes.client import V1Subject
 from kubernetes.client import V1TokenRequestSpec
 from kubernetes.client.exceptions import ApiException
 
+from paasta_tools.adhoc_tools import load_adhoc_job_config
+from paasta_tools.eks_tools import EksDeploymentConfig
 from paasta_tools.eks_tools import load_eks_service_config
 from paasta_tools.kubernetes.application.controller_wrappers import (
     get_application_wrapper,
@@ -47,6 +49,7 @@ from paasta_tools.utils import load_system_paasta_config
 logger = logging.getLogger(__name__)
 REMOTE_RUN_JOB_LABEL = "remote-run"
 POD_OWNER_LABEL = paasta_prefixed("pod_owner")
+TOOLBOX_MOCK_SERVICE = "prod-toolbox"
 DEFAULT_MAX_DURATION_LIMIT = 8 * 60 * 60  # 8 hours
 
 
@@ -59,6 +62,7 @@ class RemoteRunOutcome(TypedDict, total=False):
     message: str
     job_name: str
     pod_name: str
+    pod_address: str
     namespace: str
 
 
@@ -83,6 +87,7 @@ def remote_run_start(
     interactive: bool,
     recreate: bool,
     max_duration: int,
+    is_toolbox: bool,
 ) -> RemoteRunOutcome:
     """Trigger remote-run job
 
@@ -93,21 +98,27 @@ def remote_run_start(
     :param bool interactive: whether it is expected to access the remote-run job interactively
     :param bool recreate: whether to recreate remote-run job if existing
     :param int max_duration: maximum allowed duration for the remote-ruh job
+    :param bool is_toolbox: requested job is for a toolbox container
     :return: outcome of the operation, and resulting Kubernetes pod information
     """
     kube_client = KubeClient()
 
     # Load the service deployment settings
-    deployment_config = load_eks_service_config(service, instance, cluster)
+    deployment_config = (
+        generate_toolbox_deployment(service, cluster, user)
+        if is_toolbox
+        else load_eks_service_config(service, instance, cluster)
+    )
 
     # Set to interactive mode
-    if interactive:
+    if interactive and not is_toolbox:
         deployment_config.config_dict["cmd"] = f"sleep {max_duration}"
 
     # Create the app with a new name
     formatted_job = deployment_config.format_kubernetes_job(
         job_label=REMOTE_RUN_JOB_LABEL,
         deadline_seconds=max_duration,
+        keep_routable_ip=is_toolbox,
     )
     job_name = _format_remote_run_job_name(formatted_job, user)
     formatted_job.metadata.name = job_name
@@ -122,7 +133,13 @@ def remote_run_start(
         if e.status != 409:
             raise
         if recreate:
-            remote_run_stop(service, instance, cluster, user)
+            remote_run_stop(
+                service=service,
+                instance=instance,
+                cluster=cluster,
+                user=user,
+                is_toolbox=is_toolbox,
+            )
             return remote_run_start(
                 service=service,
                 instance=instance,
@@ -131,6 +148,7 @@ def remote_run_start(
                 interactive=interactive,
                 recreate=False,
                 max_duration=max_duration,
+                is_toolbox=is_toolbox,
             )
 
     return {
@@ -141,7 +159,12 @@ def remote_run_start(
 
 
 def remote_run_ready(
-    service: str, instance: str, cluster: str, job_name: str
+    service: str,
+    instance: str,
+    cluster: str,
+    job_name: str,
+    user: str,
+    is_toolbox: bool,
 ) -> RemoteRunOutcome:
     """Check if remote-run pod is ready
 
@@ -149,24 +172,32 @@ def remote_run_ready(
     :param str instance: service instance
     :param str cluster: paasta cluster
     :param str job_name: name of the remote-run job to check
+    :param bool is_toolbox: requested job is for a toolbox container
     :return: job status, with pod info
     """
     kube_client = KubeClient()
 
     # Load the service deployment settings
-    deployment_config = load_eks_service_config(service, instance, cluster)
+    deployment_config = (
+        generate_toolbox_deployment(service, cluster, user)
+        if is_toolbox
+        else load_eks_service_config(service, instance, cluster)
+    )
     namespace = deployment_config.get_namespace()
 
     pod = find_job_pod(kube_client, namespace, job_name)
     if not pod:
         return {"status": 404, "message": "No pod found"}
     if pod.status.phase == "Running":
-        return {
+        result: RemoteRunOutcome = {
             "status": 200,
             "message": "Pod ready",
             "pod_name": pod.metadata.name,
             "namespace": namespace,
         }
+        if is_toolbox:
+            result["pod_address"] = pod.status.pod_ip
+        return result
     return {
         "status": 204,
         "message": "Pod not ready",
@@ -174,7 +205,11 @@ def remote_run_ready(
 
 
 def remote_run_stop(
-    service: str, instance: str, cluster: str, user: str
+    service: str,
+    instance: str,
+    cluster: str,
+    user: str,
+    is_toolbox: bool,
 ) -> RemoteRunOutcome:
     """Stop remote-run job
 
@@ -182,12 +217,17 @@ def remote_run_stop(
     :param str instance: service instance
     :param str cluster: paasta cluster
     :param str user: the user requesting the remote-run sandbox
+    :param bool is_toolbox: requested job is for a toolbox container
     :return: outcome of the operation
     """
     kube_client = KubeClient()
 
     # Load the service deployment settings
-    deployment_config = load_eks_service_config(service, instance, cluster)
+    deployment_config = (
+        generate_toolbox_deployment(service, cluster, user)
+        if is_toolbox
+        else load_eks_service_config(service, instance, cluster)
+    )
 
     # Rebuild the job metadata
     formatted_job = deployment_config.format_kubernetes_job(
@@ -244,6 +284,50 @@ def remote_run_token(
     return create_temp_exec_token(kube_client, namespace, service_account)
 
 
+def generate_toolbox_deployment(
+    service: str, cluster: str, user: str
+) -> EksDeploymentConfig:
+    """Creates virtual EKS deployment for toolbox containers starting from adhoc configuration
+
+    :param str service: toolbox name
+    :param str cluster: target deployment cluster
+    :param str user: user requesting the toolbox
+    :return: deployment configuration
+    """
+    if not user.isalnum():
+        raise RemoteRunError(
+            f"Provided username contains non-alphanumeric characters: {user}"
+        )
+    # NOTE: API authorization is enforced by service, and we want different rules
+    # for each toolbox, so clients send a combined service-instance string, and then
+    # we split it here to load the correct instance settings.
+    adhoc_instance = service[len(TOOLBOX_MOCK_SERVICE) + 1 :]
+    adhoc_deployment = load_adhoc_job_config(
+        TOOLBOX_MOCK_SERVICE,
+        adhoc_instance,
+        cluster,
+        load_deployments=False,
+    )
+    # NOTE: we're explicitly dynamically mounting a single user's public keys
+    # as we want these pods to only be usable by said user.
+    adhoc_deployment.config_dict.setdefault("extra_volumes", []).append(
+        {
+            "containerPath": f"/etc/authorized_keys.d/{user}.pub",
+            "hostPath": f"/etc/authorized_keys.d/{user}.pub",
+            "mode": "RO",
+        },
+    )
+    adhoc_deployment.config_dict.setdefault("env", {})["SANDBOX_USER"] = user
+    adhoc_deployment.config_dict["routable_ip"] = True
+    return EksDeploymentConfig(
+        service=service,
+        cluster=cluster,
+        instance="main",
+        config_dict=adhoc_deployment.config_dict,
+        branch_dict=adhoc_deployment.branch_dict,
+    )
+
+
 def find_job_pod(
     kube_client: KubeClient,
     namespace: str,

{paasta-tools-1.17.2 → paasta-tools-1.19.0}/paasta_tools/kubernetes_tools.py

@@ -374,6 +374,7 @@ KubePodLabels = TypedDict(
         "paasta.yelp.com/weight": str,
         "yelp.com/owner": str,
         "paasta.yelp.com/managed": str,
+        "elbv2.k8s.aws/pod-readiness-gate-inject": str,
     },
     total=False,
 )
@@ -439,6 +440,7 @@ class KubernetesDeploymentConfigDict(LongRunningServiceConfigDict, total=False):
     crypto_keys: CryptoKeyConfig
     datastore_credentials: DatastoreCredentialsConfig
     topology_spread_constraints: List[TopologySpreadConstraintDict]
+    enable_aws_lb_readiness_gate: bool
 
 
 def load_kubernetes_service_config_no_cache(
@@ -1418,8 +1420,18 @@ class KubernetesDeploymentConfig(LongRunningServiceConfig):
 
     def get_security_context(self) -> Optional[V1SecurityContext]:
         cap_add = self.config_dict.get("cap_add", None)
+        context_kwargs = (
+            # passing parameter like this to avoid all services to bounce
+            # when this change is released
+            {"privileged": self.config_dict["privileged"]}
+            if "privileged" in self.config_dict
+            else {}
+        )
         if cap_add is None:
-            return V1SecurityContext(capabilities=V1Capabilities(drop=CAPS_DROP))
+            return V1SecurityContext(
+                capabilities=V1Capabilities(drop=CAPS_DROP),
+                **context_kwargs,
+            )
         else:
             return V1SecurityContext(
                 # XXX: we should probably generally work in sets, but V1Capabilities is typed as accepting
@@ -1432,7 +1444,8 @@ class KubernetesDeploymentConfig(LongRunningServiceConfig):
                     # WARNING: this must be sorted - otherwise the order of the capabilities will be different
                     # on every setup_kubernetes_job run and cause unnecessary redeployments
                     drop=sorted(list(set(CAPS_DROP) - set(cap_add))),
-                )
+                ),
+                **context_kwargs,
             )
 
     def get_kubernetes_containers(
@@ -2216,6 +2229,9 @@ class KubernetesDeploymentConfig(LongRunningServiceConfig):
             return "true"
         return "false"
 
+    def should_enable_aws_lb_readiness_gate(self) -> bool:
+        return self.config_dict.get("enable_aws_lb_readiness_gate", False)
+
     def get_pod_template_spec(
         self,
         git_sha: str,
@@ -2398,6 +2414,13 @@ class KubernetesDeploymentConfig(LongRunningServiceConfig):
             labels["paasta.yelp.com/deploy_group"] = self.get_deploy_group()
             labels["paasta.yelp.com/scrape_gunicorn_prometheus"] = "true"
 
+        # the default AWS LB Controller behavior is to enable this by-namespace
+        # ...but that's kinda annoying to do in a toggleable way - so let's instead
+        # toggle based on pod labels (which of course, will require changing the controller
+        # settings :p)
+        if self.should_enable_aws_lb_readiness_gate():
+            labels["elbv2.k8s.aws/pod-readiness-gate-inject"] = "enabled"
+
         return V1PodTemplateSpec(
             metadata=V1ObjectMeta(
                 labels=labels,

{paasta-tools-1.17.2 → paasta-tools-1.19.0}/paasta_tools/paastaapi/__init__.py

@@ -7,7 +7,7 @@
 
     No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)  # noqa: E501
 
-    The version of the OpenAPI document: 1.1.1
+    The version of the OpenAPI document: 1.2.0
     Generated by: https://openapi-generator.tech
 """
 

{paasta-tools-1.17.2 → paasta-tools-1.19.0}/paasta_tools/paastaapi/api/autoscaler_api.py

@@ -5,7 +5,7 @@
 
     No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)  # noqa: E501
 
-    The version of the OpenAPI document: 1.1.1
+    The version of the OpenAPI document: 1.2.0
     Generated by: https://openapi-generator.tech
 """
 

{paasta-tools-1.17.2 → paasta-tools-1.19.0}/paasta_tools/paastaapi/api/default_api.py

@@ -5,7 +5,7 @@
 
     No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)  # noqa: E501
 
-    The version of the OpenAPI document: 1.1.1
+    The version of the OpenAPI document: 1.2.0
     Generated by: https://openapi-generator.tech
 """