paasta-tools 1.21.3__py3-none-any.whl

paasta_tools/api/client.py

@@ -0,0 +1,106 @@
+#!/usr/bin/env python
+# Copyright 2015-2016 Yelp Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""
+Client interface for the Paasta rest api.
+"""
+import logging
+from dataclasses import dataclass
+from typing import Optional
+from typing import Type
+from urllib.parse import ParseResult
+from urllib.parse import urlparse
+
+import paasta_tools.paastaapi.apis as paastaapis
+from paasta_tools import paastaapi
+from paasta_tools.utils import load_system_paasta_config
+from paasta_tools.utils import SystemPaastaConfig
+
+
+log = logging.getLogger(__name__)
+
+
+@dataclass
+class PaastaOApiClient:
+    autoscaler: paastaapis.AutoscalerApi
+    default: paastaapis.DefaultApi
+    resources: paastaapis.ResourcesApi
+    service: paastaapis.ServiceApi
+    remote_run: paastaapis.RemoteRunApi
+    api_error: Type[paastaapi.ApiException]
+    connection_error: Type[paastaapi.ApiException]
+    timeout_error: Type[paastaapi.ApiException]
+    request_error: Type[paastaapi.ApiException]
+
+
+def get_paasta_oapi_client_by_url(
+    parsed_url: ParseResult,
+    cert_file: Optional[str] = None,
+    key_file: Optional[str] = None,
+    ssl_ca_cert: Optional[str] = None,
+    auth_token: str = "",
+) -> PaastaOApiClient:
+    server_variables = dict(scheme=parsed_url.scheme, host=parsed_url.netloc)
+    config = paastaapi.Configuration(
+        server_variables=server_variables,
+        discard_unknown_keys=True,
+    )
+    config.cert_file = cert_file
+    config.key_file = key_file
+    config.ssl_ca_cert = ssl_ca_cert
+
+    client = paastaapi.ApiClient(configuration=config)
+    # PAASTA-18005: Adds default timeout to paastaapi client
+    client.rest_client.pool_manager.connection_pool_kw[
+        "timeout"
+    ] = load_system_paasta_config().get_api_client_timeout()
+    # SEC-19555: support auth in PaaSTA APIs
+    if auth_token:
+        client.set_default_header("Authorization", f"Bearer {auth_token}")
+    return PaastaOApiClient(
+        autoscaler=paastaapis.AutoscalerApi(client),
+        default=paastaapis.DefaultApi(client),
+        resources=paastaapis.ResourcesApi(client),
+        service=paastaapis.ServiceApi(client),
+        remote_run=paastaapis.RemoteRunApi(client),
+        api_error=paastaapi.ApiException,
+        connection_error=paastaapi.ApiException,
+        timeout_error=paastaapi.ApiException,
+        request_error=paastaapi.ApiException,
+    )
+
+
+def get_paasta_oapi_client(
+    cluster: str = None,
+    system_paasta_config: SystemPaastaConfig = None,
+    http_res: bool = False,
+    auth_token: str = "",
+) -> Optional[PaastaOApiClient]:
+    if not system_paasta_config:
+        system_paasta_config = load_system_paasta_config()
+
+    if not cluster:
+        cluster = system_paasta_config.get_cluster()
+
+    api_endpoints = system_paasta_config.get_api_endpoints()
+    if cluster not in api_endpoints:
+        log.error("Cluster %s not in paasta-api endpoints config", cluster)
+        return None
+
+    parsed = urlparse(api_endpoints[cluster])
+    cert_file = key_file = ssl_ca_cert = None
+
+    return get_paasta_oapi_client_by_url(
+        parsed, cert_file, key_file, ssl_ca_cert, auth_token
+    )

paasta_tools/api/settings.py

@@ -0,0 +1,33 @@
+# Copyright 2015-2016 Yelp Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""
+Settings of the paasta-api server.
+"""
+import os
+from typing import Optional
+
+from paasta_tools import utils
+from paasta_tools.kubernetes_tools import KubeClient
+from paasta_tools.utils import DEFAULT_SOA_DIR
+from paasta_tools.utils import SystemPaastaConfig
+
+soa_dir: str = os.environ.get("PAASTA_API_SOA_DIR", DEFAULT_SOA_DIR)
+
+# The following `type: ignore` mypy hints are there because variables below de
+# juro have `Optional[T]` type, but de facto are always initialized to a value
+# of the corresponding type after the application is started.
+cluster: str = None  # type: ignore
+hostname: str = utils.get_hostname()
+kubernetes_client: Optional[KubeClient] = None
+system_paasta_config: Optional[SystemPaastaConfig]

paasta_tools/api/tweens/__init__.py

@@ -0,0 +1,6 @@
+from typing import Callable
+
+from pyramid.request import Request
+from pyramid.response import Response
+
+Handler = Callable[[Request], Response]

paasta_tools/api/tweens/auth.py

@@ -0,0 +1,125 @@
+#!/usr/bin/env python
+# Copyright 2015-2016 Yelp Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+import json
+import logging
+import os
+from typing import NamedTuple
+from typing import Optional
+
+import cachetools.func
+import pyramid
+import requests
+from pyramid.config import Configurator
+from pyramid.httpexceptions import HTTPForbidden
+from pyramid.registry import Registry
+from pyramid.request import Request
+from pyramid.response import Response
+
+from paasta_tools.api.tweens import Handler
+
+
+logger = logging.getLogger(__name__)
+AUTH_CACHE_SIZE = 50000
+AUTH_CACHE_TTL = 30 * 60
+
+
+class AuthorizationOutcome(NamedTuple):
+    authorized: bool
+    reason: str
+
+
+class AuthTweenFactory:
+    def __init__(self, handler: Handler, registry: Registry) -> None:
+        self.handler = handler
+        self.registry = registry
+        self.enforce = bool(os.getenv("PAASTA_API_AUTH_ENFORCE", ""))
+        self.endpoint = os.getenv("PAASTA_API_AUTH_ENDPOINT")
+        self.session = requests.Session()
+
+    def __call__(self, request: Request) -> Response:
+        """
+        Extracts relevant metadata from request, and checks if it is authorized
+        """
+        token = request.headers.get("Authorization", "").strip()
+        token = token.split()[-1] if token else ""  # removes "Bearer" prefix
+        auth_outcome = self.is_request_authorized(
+            request.path,
+            token,
+            request.method,
+            request.swagger_data.get("service", None),
+        )
+        if self.enforce and not auth_outcome.authorized:
+            return HTTPForbidden(
+                body=json.dumps({"reason": auth_outcome.reason}),
+                headers={"X-Auth-Failure-Reason": auth_outcome.reason},
+                content_type="application/json",
+                charset="utf-8",
+            )
+        return self.handler(request)
+
+    @cachetools.func.ttl_cache(maxsize=AUTH_CACHE_SIZE, ttl=AUTH_CACHE_TTL)
+    def is_request_authorized(
+        self,
+        path: str,
+        token: str,
+        method: str,
+        service: Optional[str],
+    ) -> AuthorizationOutcome:
+        """Check if API request is authorized
+
+        :param str path: API path
+        :param str token: authentication token
+        :param str method: http method
+        :return: auth outcome
+        """
+        try:
+            response = self.session.post(
+                url=self.endpoint,
+                json={
+                    "input": {
+                        "path": path,
+                        "backend": "paasta",
+                        "token": token,
+                        "method": method,
+                        "service": service,
+                    },
+                },
+                timeout=2,
+            ).json()
+        except Exception as e:
+            logger.exception(f"Issue communicating with auth endpoint: {e}")
+            return AuthorizationOutcome(False, "Auth backend error")
+
+        auth_result_allowed = response.get("result", {}).get("allowed")
+        if auth_result_allowed is None:
+            return AuthorizationOutcome(False, "Malformed auth response")
+
+        if not auth_result_allowed:
+            reason = response["result"].get("reason", "Denied")
+            return AuthorizationOutcome(False, reason)
+
+        reason = response["result"].get("reason", "Ok")
+        return AuthorizationOutcome(True, reason)
+
+
+def includeme(config: Configurator):
+    if os.getenv("PAASTA_API_AUTH_ENDPOINT"):
+        config.add_tween(
+            "paasta_tools.api.tweens.auth.AuthTweenFactory",
+            under=(
+                pyramid.tweens.INGRESS,
+                "pyramid_swagger.tween.validation_tween_factory",
+            ),
+        )

paasta_tools/api/tweens/profiling.py

@@ -0,0 +1,108 @@
+# Copyright 2015-2016 Yelp Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""
+Creates a tween that cprofiles requests
+"""
+import pyramid
+import pytz
+
+from paasta_tools.api import settings as api_settings
+
+try:
+    # hackily patch pytz, since yelp_lib (used by yelp_profiling) type checks
+    # using an older version of pytz where tzinfo didn't exist yet. this needs to
+    # happen before importing `yelp_profiling` since it is used at import time.
+    pytz.BaseTzInfo = pytz.tzinfo.BaseTzInfo  # type: ignore
+    import yelp_profiling
+    from yelp_profiling.cprofile import CProfileConfig
+    from yelp_profiling.cprofile import CProfileContextManager
+    from yelp_profiling.tweens import YelpSOARequestProcessor
+
+    class PaastaCProfileConfig(CProfileConfig):
+        """Paasta API version of yelp_profiling's CProfileConfig. Instead of reading
+        from srv-configs, this reads configs from /etc/paasta.
+        """
+
+        def __init__(self, pyramid_settings):
+            super().__init__(pyramid_settings)
+            self._cprofile_config = (
+                api_settings.system_paasta_config.get_api_profiling_config()
+            )
+
+        @property
+        def enabled(self):
+            return self._cprofile_config.get("cprofile_sampling_enabled", False)
+
+        @property
+        def output_prefix(self):
+            return self._cprofile_config.get("cprofile_output_prefix", "cprofile")
+
+        @property
+        def scribe_log_name(self):
+            return self._cprofile_config.get(
+                "cprofile_scribe_log", "tmp_paasta_api_cprofiles"
+            )
+
+        @property
+        def default_probability(self):
+            return self._cprofile_config.get("cprofile_sampling_probability", 0)
+
+        @property
+        def path_probabilities(self):
+            probabilities = {"patterns": []}
+            probabilities.update(
+                self._cprofile_config.get("cprofile_path_probabilities", {})
+            )
+            return probabilities
+
+except ImportError:
+    yelp_profiling = None
+
+
+def includeme(config):
+    if yelp_profiling is not None:
+        config.add_tween(
+            "paasta_tools.api.tweens.profiling.cprofile_tween_factory",
+            under=pyramid.tweens.INGRESS,
+        )
+
+
+def cprofile_tween_factory(handler, registry):
+    """Tween for profiling API requests and sending them to scribe.
+
+    yelp_profiling does define a tween, but it is designed more for PaaSTA
+    services. So, we need to define our own.
+    """
+
+    def cprofile_tween(request):
+        if yelp_profiling is None:
+            return handler(request)
+
+        config = PaastaCProfileConfig(registry.settings)
+        processor = YelpSOARequestProcessor(config, registry)
+        context_manager = CProfileContextManager(config, processor)
+
+        # uses the config and processor to decide whether or not to cprofile
+        # the request
+        with context_manager(request):
+            processor.begin_request(request)
+            status_code = 500
+            try:
+                response = handler(request)
+                status_code = response.status_code
+                return response
+            finally:
+                processor.end_request(request, status_code)
+
+    return cprofile_tween

paasta_tools/api/tweens/request_logger.py

@@ -0,0 +1,124 @@
+# Copyright 2015-2016 Yelp Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""
+Creates a tween that logs information about requests.
+"""
+import json
+import traceback
+from datetime import datetime
+
+import pyramid
+import pytz
+
+from paasta_tools.api import settings
+
+try:
+    import clog
+except ImportError:
+    clog = None
+
+
+DEFAULT_REQUEST_LOG_NAME = "tmp_paasta_api_requests"
+
+
+def includeme(config):
+    if clog is not None:
+        config.add_tween(
+            "paasta_tools.api.tweens.request_logger.request_logger_tween_factory",
+            under=pyramid.tweens.INGRESS,
+        )
+
+
+class request_logger_tween_factory:
+    """Tween that logs information about requests"""
+
+    def __init__(self, handler, registry):
+        self.handler = handler
+        self.registry = registry
+        self.log_name = registry.settings.get(
+            "request_log_name",
+            DEFAULT_REQUEST_LOG_NAME,
+        )
+
+    def _log(
+        self,
+        timestamp=None,
+        level="INFO",
+        additional_fields=None,
+    ):
+        if clog is not None:
+            # `settings` values are set by paasta_tools.api.api:setup_paasta_api
+            if not timestamp:
+                timestamp = datetime.now(pytz.utc)
+            dct = {
+                "human_timestamp": timestamp.strftime("%Y-%m-%dT%H:%M:%S%Z"),
+                "unix_timestamp": timestamp.timestamp(),
+                "hostname": settings.hostname,
+                "level": level,
+                "cluster": settings.cluster,
+            }
+            if additional_fields is not None:
+                dct.update(additional_fields)
+            line = json.dumps(dct, sort_keys=True)
+            clog.log_line(self.log_name, line)
+
+    def __call__(self, request):
+        start_time = datetime.now(pytz.utc)  # start clock for response time
+        request_fields = {
+            "path": request.path,
+            "params": request.params.mixed(),
+            "client_addr": request.client_addr,
+            "http_method": request.method,
+            "headers": dict(request.headers),  # incls user agent
+        }
+        response_fields = {}
+        log_level = "INFO"
+
+        try:
+            response = self.handler(request)
+
+            response_fields["status_code"] = response.status_int
+            if 300 <= response.status_int < 400:
+                log_level = "WARNING"
+            elif 400 <= response.status_int < 600:
+                log_level = "ERROR"
+                response_fields["body"] = response.body.decode("utf-8")
+
+            return response
+
+        except Exception as e:
+            log_level = "ERROR"
+            response_fields.update(
+                {
+                    "status_code": 500,
+                    "exc_type": type(e).__name__,
+                    "exc_info": traceback.format_exc(),
+                }
+            )
+            raise
+
+        finally:
+            response_time_ms = (
+                datetime.now(pytz.utc) - start_time
+            ).total_seconds() * 1000
+            response_fields["response_time_ms"] = response_time_ms
+
+            self._log(
+                timestamp=start_time,
+                level=log_level,
+                additional_fields={
+                    "request": request_fields,
+                    "response": response_fields,
+                },
+            )

paasta_tools/api/views/__init__.py

@@ -0,0 +1,13 @@
+# Copyright 2015-2016 Yelp Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.

paasta_tools/api/views/autoscaler.py

@@ -0,0 +1,100 @@
+#!/usr/bin/env python
+# Copyright 2015-2016 Yelp Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""
+PaaSTA service list (instances) etc.
+"""
+from pyramid.response import Response
+from pyramid.view import view_config
+
+from paasta_tools.api import settings
+from paasta_tools.api.views.exception import ApiFailure
+from paasta_tools.cli.utils import get_instance_config
+from paasta_tools.kubernetes_tools import KubernetesDeploymentConfig
+
+
+@view_config(route_name="service.autoscaler.get", request_method="GET", renderer="json")
+def get_autoscaler_count(request):
+    service = request.swagger_data.get("service")
+    instance = request.swagger_data.get("instance")
+    cluster = settings.cluster
+    soa_dir = settings.soa_dir
+
+    instance_config = get_instance_config(service, instance, cluster, soa_dir)
+    if not isinstance(instance_config, (KubernetesDeploymentConfig)):
+        error_message = (
+            f"Autoscaling is not supported for {service}.{instance} because instance type is not "
+            f"kubernetes."
+        )
+        raise ApiFailure(error_message, 501)
+
+    response_body = {
+        "desired_instances": instance_config.get_instances(),
+        "calculated_instances": instance_config.get_instances(with_limit=False),
+    }
+    return Response(json_body=response_body, status_code=200)
+
+
+@view_config(
+    route_name="service.autoscaler.post", request_method="POST", renderer="json"
+)
+def update_autoscaler_count(request):
+    service = request.swagger_data.get("service")
+    instance = request.swagger_data.get("instance")
+    cluster = settings.cluster
+    soa_dir = settings.soa_dir
+    desired_instances = request.swagger_data.get("json_body")["desired_instances"]
+    if not isinstance(desired_instances, int):
+        error_message = 'The provided body does not have an integer value for "desired_instances": {}'.format(
+            request.swagger_data.get("json_body")
+        )
+        raise ApiFailure(error_message, 500)
+
+    instance_config = get_instance_config(service, instance, cluster, soa_dir, True)
+    if not isinstance(instance_config, (KubernetesDeploymentConfig)):
+        error_message = (
+            f"Autoscaling is not supported for {service}.{instance} because instance type is not "
+            f"kubernetes."
+        )
+        raise ApiFailure(error_message, 501)
+
+    max_instances = instance_config.get_max_instances()
+    if max_instances is None:
+        error_message = f"Autoscaling is not enabled for {service}.{instance}"
+        raise ApiFailure(error_message, 404)
+    min_instances = instance_config.get_min_instances()
+
+    status = "SUCCESS"
+    if desired_instances > max_instances:
+        desired_instances = max_instances
+        status = (
+            "WARNING desired_instances is greater than max_instances %d" % max_instances
+        )
+    elif desired_instances < min_instances:
+        desired_instances = min_instances
+        status = (
+            "WARNING desired_instances is less than min_instances %d" % min_instances
+        )
+    try:
+        if isinstance(instance_config, KubernetesDeploymentConfig):
+            instance_config.set_autoscaled_instances(
+                instance_count=desired_instances, kube_client=settings.kubernetes_client
+            )
+        else:
+            instance_config.set_autoscaled_instances(instance_count=desired_instances)
+    except Exception as err:
+        raise ApiFailure(err, 500)
+
+    response_body = {"desired_instances": desired_instances, "status": status}
+    return Response(json_body=response_body, status_code=202)

paasta_tools/api/views/exception.py

@@ -0,0 +1,45 @@
+#!/usr/bin/env python
+# Copyright 2015-2016 Yelp Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""
+PaaSTA API error handling.
+"""
+import logging
+
+from pyramid.response import Response
+from pyramid.view import view_config
+
+
+log = logging.getLogger(__name__)
+
+
+class ApiFailure(Exception):
+    def __init__(self, msg, err):
+        self.msg = msg
+        self.err = err
+
+
+@view_config(context=ApiFailure)
+def api_failure_response(exc, request):
+    """Construct an HTTP response with an error status code. This happens when
+    the API service has to stop on a 'hard' error. In contrast, the API service
+    continues to produce results on a 'soft' error. It will place a 'message'
+    field in the output. Multiple 'soft' errors are concatenated in the same
+    'message' field when errors happen in the same hierarchy.
+    """
+    log.error(exc.msg)
+
+    response = Response("ERROR: %s" % exc.msg)
+    response.status_int = exc.err
+    return response