paasta-tools 1.30.9__tar.gz → 1.35.4__tar.gz

{paasta_tools-1.30.9/paasta_tools.egg-info → paasta_tools-1.35.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: paasta-tools
-Version: 1.30.9
+Version: 1.35.4
 Summary: Tools for Yelps SOA infrastructure
 Author: Compute Infrastructure @ Yelp
 Author-email: compute-infra@yelp.com
@@ -34,7 +34,7 @@ Requires-Dist: ipaddress>=1.0.22
 Requires-Dist: isodate>=0.7.2
 Requires-Dist: jsonschema[format]
 Requires-Dist: kazoo>=2.0.0
-Requires-Dist: kubernetes<26.0.0,>=18.20.0
+Requires-Dist: kubernetes<35.0.0,>=29.0.0
 Requires-Dist: ldap3
 Requires-Dist: manhole
 Requires-Dist: mypy-extensions>=0.3.0

{paasta_tools-1.30.9 → paasta_tools-1.35.4}/paasta_tools/__init__.py

@@ -17,4 +17,4 @@
 # setup phase, the dependencies may not exist on disk yet.
 #
 # Don't bump version manually. See `make release` docs in ./Makefile
-__version__ = "1.30.9"
+__version__ = "1.35.4"

{paasta_tools-1.30.9 → paasta_tools-1.35.4}/paasta_tools/api/api_docs/swagger.json

@@ -1788,6 +1788,11 @@
         "KubernetesVersion": {
             "type": "object",
             "properties": {
+                "container_port": {
+                    "description": "Port the container is expecting to receive traffic on",
+                    "type": "integer",
+                    "format": "int32"
+                },
                 "type": {
                     "description": "Type of version (ReplicaSet or ControllerRevision)",
                     "type": "string"

{paasta_tools-1.30.9 → paasta_tools-1.35.4}/paasta_tools/cli/cmds/local_run.py

@@ -12,6 +12,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+import base64
 import datetime
 import json
 import os
@@ -31,7 +32,9 @@ from urllib.parse import urlparse
 import boto3
 import requests
 from docker import errors
+from docker.api.client import APIClient
 from mypy_extensions import TypedDict
+from service_configuration_lib import read_service_configuration
 
 from paasta_tools.adhoc_tools import get_default_interactive_config
 from paasta_tools.cli.authentication import get_service_auth_token
@@ -612,26 +615,83 @@ class LostContainerException(Exception):
     pass
 
 
-def docker_pull_image(docker_url):
-    """Pull an image via ``docker pull``. Uses the actual pull command instead of the python
-    bindings due to the docker auth/registry transition. Once we are past Docker 1.6
-    we can use better credential management, but for now this function assumes the
-    user running the command has already been authorized for the registry"""
+class DockerAuthConfig(TypedDict):
+    username: str
+    password: str
+
+
+def get_readonly_docker_registry_auth_config(
+    docker_url: str,
+) -> DockerAuthConfig | None:
+    system_paasta_config = load_system_paasta_config()
+    config_path = system_paasta_config.get_readonly_docker_registry_auth_file()
+
+    try:
+        with open(config_path) as f:
+            docker_config = json.load(f)
+    except Exception:
+        print(
+            PaastaColors.yellow(
+                "Warning: unable to load read-only docker registry credentials."
+            ),
+            file=sys.stderr,
+        )
+        # the best we can do is try to pull with whatever auth the user has configured locally
+        # i.e., root-owned docker config in /root/.docker/config.json
+        return None
+    registry = docker_url.split("/")[0]
+
+    # find matching auth config - our usual ro config will have at least two entries
+    # at the time this comment was written
+    auths = docker_config
+    for auth_url, auth_data in auths.items():
+        if registry in auth_url:
+            # Decode the base64 auth string if present
+            if "auth" in auth_data:
+                auth_string = base64.b64decode(auth_data["auth"]).decode("utf-8")
+                username, password = auth_string.split(":", 1)
+                return {"username": username, "password": password}
+
+    # we'll hit this for registries like docker-dev or extra-private internal registries
+    return None
+
+
+def docker_pull_image(docker_client: APIClient, docker_url: str) -> None:
+    """Pull an image using the docker-py library with read-only registry credentials"""
     print(
-        "Please wait while the image (%s) is pulled (times out after 30m)..."
-        % docker_url,
+        f"Please wait while the image ({docker_url}) is pulled (times out after 30m)...",
         file=sys.stderr,
     )
-    with Timeout(
-        seconds=1800, error_message=f"Timed out pulling docker image from {docker_url}"
-    ), open(os.devnull, mode="wb") as DEVNULL:
-        ret, _ = _run("docker pull %s" % docker_url, stream=True, stdin=DEVNULL)
-        if ret != 0:
-            print(
-                "\nPull failed. Are you authorized to run docker commands?",
-                file=sys.stderr,
-            )
-            sys.exit(ret)
+
+    auth_config = get_readonly_docker_registry_auth_config(docker_url)
+    if not auth_config:
+        print(
+            PaastaColors.yellow(
+                "Warning: No read-only docker registry credentials found, attempting to pull without them."
+            ),
+            file=sys.stderr,
+        )
+
+    try:
+        with Timeout(
+            seconds=1800,
+            error_message=f"Timed out pulling docker image from {docker_url}",
+        ):
+            # this is slightly funky since pull() returns the output line-by-line, but as a dict
+            # ...that we then need to format back to the usual `docker pull` output
+            # :p
+            for line in docker_client.pull(
+                docker_url, auth_config=auth_config, stream=True, decode=True
+            ):
+                # not all lines have an 'id' key :(
+                id_prefix = f"{line['id']}: " if "id" in line else ""
+                print(f"{id_prefix}{line['status']}", file=sys.stderr)
+    except Exception as e:
+        print(
+            f"\nPull failed. Error: {e}",
+            file=sys.stderr,
+        )
+        sys.exit(1)
 
 
 def get_container_id(docker_client, container_name):
@@ -1226,7 +1286,7 @@ def configure_and_run_docker_container(
             return 1
 
     if pull_image:
-        docker_pull_image(docker_url)
+        docker_pull_image(docker_client, docker_url)
 
     for volume in instance_config.get_volumes(
         system_paasta_config.get_volumes(),
@@ -1302,10 +1362,40 @@ def docker_config_available():
     )
 
 
+def should_reexec_as_root(
+    service: str, skip_secrets: bool, action: str, soa_dir: str = DEFAULT_SOA_DIR
+) -> bool:
+    # local-run can't pull secrets from Vault in prod without a root-owned token
+    need_vault_token = not skip_secrets and action == "pull"
+
+    # there are some special teams with their own private docker registries and no ro creds
+    # however, we don't know what registry is to be used without loading the service config
+    service_info = read_service_configuration(service, soa_dir)
+    # technically folks can set the standard registry as a value here, but atm no one is doing that :p
+    registry_override = service_info.get("docker_registry")
+    # note: we could also have a list of registries that have ro creds, but this seems fine for now
+    uses_private_registry = (
+        registry_override
+        and registry_override
+        in load_system_paasta_config().get_private_docker_registries()
+    )
+    need_docker_config = uses_private_registry and action == "pull"
+
+    return (need_vault_token or need_docker_config) and os.geteuid() != 0
+
+
 def paasta_local_run(args):
-    if args.action == "pull" and os.geteuid() != 0 and not docker_config_available():
-        print("Re-executing paasta local-run --pull with sudo..")
-        os.execvp("sudo", ["sudo", "-H"] + sys.argv)
+    service = figure_out_service_name(args, soa_dir=args.yelpsoa_config_root)
+    if should_reexec_as_root(
+        service, args.skip_secrets, args.action, args.yelpsoa_config_root
+    ):
+        # XXX: we should re-architect this to not need sudo, but for now,
+        # re-exec ourselves with sudo to get access to the paasta vault token
+        # NOTE: once we do that, we can also remove the venv check above :)
+        print(
+            "Re-executing paasta local-run --pull with sudo for Vault/Docker registry access..."
+        )
+        os.execvp("sudo", ["sudo", "-H", "/usr/bin/paasta"] + sys.argv[1:])
     if args.action == "build" and not makefile_responds_to("cook-image"):
         print(
             "A local Makefile with a 'cook-image' target is required for --build",
@@ -1332,8 +1422,6 @@ def paasta_local_run(args):
 
     local_run_config = system_paasta_config.get_local_run_config()
 
-    service = figure_out_service_name(args, soa_dir=args.yelpsoa_config_root)
-
     if args.cluster:
         cluster = args.cluster
     else:

{paasta_tools-1.30.9 → paasta_tools-1.35.4}/paasta_tools/cli/cmds/mark_for_deployment.py

@@ -1264,7 +1264,15 @@ class MarkForDeploymentProcess(RollbackSlackDeploymentProcess):
             self.ping_authors()
 
     def send_manual_rollback_instructions(self) -> None:
-        if self.deployment_version != self.old_deployment_version:
+        # NOTE: new deploy groups are not exactly a particularly frequent occurrence, but
+        # we want to prevent sending messages that look like
+        # `If you need to roll back manually, run: paasta rollback --service $S --deploy-group $G --commit None`
+        # since that's not actually valid/actionable.
+        # thus the seemingly out-of-nowhere old_git_sha check: new deploy groups won't have value set there.
+        if (
+            self.deployment_version != self.old_deployment_version
+            and self.old_git_sha is not None
+        ):
             extra_rollback_args = ""
             if self.old_deployment_version.image_version:
                 extra_rollback_args = (

{paasta_tools-1.30.9 → paasta_tools-1.35.4}/paasta_tools/cli/cmds/remote_run.py

@@ -295,11 +295,19 @@ def paasta_remote_run_stop(
 
 
 def add_common_args_to_parser(parser: argparse.ArgumentParser):
+    def _validate_service_name(name: str) -> str:
+        if name not in _list_services_and_toolboxes():
+            raise ValueError(f"{name} is not a known service name")
+        return name
+
     service_arg = parser.add_argument(
         "-s",
         "--service",
         help="The name of the service you wish to inspect. Required.",
         required=True,
+        # not using `choices` for validation to avoid the help text
+        # for the command being incredibly large
+        type=_validate_service_name,
     )
     service_arg.completer = lazy_choices_completer(_list_services_and_toolboxes)  # type: ignore
     instance_or_toolbox = parser.add_mutually_exclusive_group()
@@ -323,6 +331,7 @@ def add_common_args_to_parser(parser: argparse.ArgumentParser):
         "--cluster",
         help="The name of the cluster you wish to run your task on. Required.",
         required=True,
+        choices=list_clusters(),
     )
     cluster_arg.completer = lazy_choices_completer(list_clusters)  # type: ignore
 

{paasta_tools-1.30.9 → paasta_tools-1.35.4}/paasta_tools/cli/cmds/secret.py

@@ -212,7 +212,7 @@ def _add_vault_auth_args(parser: argparse.ArgumentParser):
         dest="vault_auth_method",
         required=False,
         default="token",
-        choices=["token", "ldap"],
+        choices=["token", "okta"],
     )
     parser.add_argument(
         "--vault-token-file",
@@ -456,7 +456,7 @@ def paasta_secret(args):
                 "vault_token_file": args.vault_token_file,
                 # best solution so far is to change the below string to "token",
                 # so that token file is picked up from argparse
-                "vault_auth_method": "ldap",  # must have LDAP to get 2FA push for prod
+                "vault_auth_method": "okta",  # must use Okta to get 2FA push
             },
         )
         secret_provider.write_secret(

{paasta_tools-1.30.9 → paasta_tools-1.35.4}/paasta_tools/cli/cmds/spark_run.py

@@ -897,6 +897,8 @@ def configure_and_run_docker_container(
         )
     )  # type:ignore
     environment.update(extra_driver_envs)
+    if "jupyter-lab" == args.cmd:
+        environment["SPARK_DRIVER_TYPE"] = "jupyter"
 
     if args.use_service_auth_token:
         environment["YELP_SVC_AUTHZ_TOKEN"] = get_service_auth_token()

{paasta_tools-1.30.9 → paasta_tools-1.35.4}/paasta_tools/cli/cmds/status.py

@@ -917,11 +917,13 @@ def _print_flink_status_from_job_manager(
             else f"{pod_evicted_count}"
         )
 
+    pods_total_count = pod_running_count + pod_evicted_count + pod_other_count
     output.append(
         "    Pods:"
         f" {pod_running_count} running,"
         f" {evicted} evicted,"
-        f" {pod_other_count} other"
+        f" {pod_other_count} other,"
+        f" {pods_total_count} total"
     )
 
     if not should_job_info_be_shown(status["state"]):
@@ -944,12 +946,19 @@ def _print_flink_status_from_job_manager(
             output.append(str(e))
             return 1
 
+        jobs_total_count = (
+            overview.jobs_running
+            + overview.jobs_finished
+            + overview.jobs_failed
+            + overview.jobs_cancelled
+        )
         output.append(
             "    Jobs:"
             f" {overview.jobs_running} running,"
             f" {overview.jobs_finished} finished,"
             f" {overview.jobs_failed} failed,"
-            f" {overview.jobs_cancelled} cancelled"
+            f" {overview.jobs_cancelled} cancelled,"
+            f" {jobs_total_count} total"
         )
         output.append(
             "   "
@@ -1313,7 +1322,9 @@ def get_version_table_entry(
             for state in ReplicaState
             if state in replica_state_counts
         ]
-        entry.append(f"  Replica States: {' / '.join(replica_state_display)}")
+        entry.append(
+            f"  Replica States: {' / '.join(replica_state_display)} / {replica_state_counts.total()} total"
+        )
         if not verbose:
             unhealthy_replicas = [
                 (state, pod) for state, pod in replica_states if state.is_unhealthy()
@@ -1321,13 +1332,23 @@ def get_version_table_entry(
             if unhealthy_replicas:
                 entry.append("    Unhealthy Replicas:")
                 replica_table = create_replica_table(
-                    unhealthy_replicas, service, instance, cluster, verbose
+                    unhealthy_replicas,
+                    service,
+                    instance,
+                    cluster,
+                    version.container_port,
+                    verbose,
                 )
                 for line in replica_table:
                     entry.append(f"      {line}")
         else:
             replica_table = create_replica_table(
-                replica_states, service, instance, cluster, verbose
+                replica_states,
+                service,
+                instance,
+                cluster,
+                version.container_port,
+                verbose,
             )
             for line in replica_table:
                 entry.append(f"    {line}")
@@ -1467,6 +1488,7 @@ def create_replica_table(
     service: str,
     instance: str,
     cluster: str,
+    container_port: int,
     verbose: int = 0,
 ) -> List[str]:
     header = ["ID", "IP/Port", "Host deployed to", "Started at what localtime", "State"]
@@ -1474,9 +1496,10 @@ def create_replica_table(
     for state, pod in pods:
         start_datetime = datetime.fromtimestamp(pod.create_timestamp)
         humanized_start_time = humanize.naturaltime(start_datetime)
+
         row = [
             pod.name,
-            f"{pod.ip}:8888" if pod.ip else "None",
+            f"{pod.ip}:{container_port}" if pod.ip else "None",
             pod.host or "None",
             humanized_start_time,
             state.formatted_message,

{paasta_tools-1.30.9 → paasta_tools-1.35.4}/paasta_tools/cli/cmds/validate.py

@@ -22,6 +22,7 @@ from datetime import datetime
 from functools import lru_cache
 from functools import partial
 from glob import glob
+from pathlib import Path
 from typing import Any
 from typing import Callable
 from typing import cast
@@ -34,6 +35,9 @@ from typing import Union
 
 import pytz
 from croniter import croniter
+from environment_tools.type_utils import available_location_types
+from environment_tools.type_utils import compare_types
+from environment_tools.type_utils import convert_location_type
 from jsonschema import Draft4Validator
 from jsonschema import exceptions
 from jsonschema import FormatChecker
@@ -64,6 +68,7 @@ from paasta_tools.long_running_service_tools import METRICS_PROVIDER_PISCINA
 from paasta_tools.long_running_service_tools import METRICS_PROVIDER_PROMQL
 from paasta_tools.long_running_service_tools import METRICS_PROVIDER_UWSGI
 from paasta_tools.long_running_service_tools import METRICS_PROVIDER_UWSGI_V2
+from paasta_tools.long_running_service_tools import METRICS_PROVIDER_WORKER_LOAD
 from paasta_tools.secret_tools import get_secret_name_from_ref
 from paasta_tools.secret_tools import is_secret_ref
 from paasta_tools.secret_tools import is_shared_secret
@@ -120,6 +125,7 @@ SCHEMA_TYPES = {
     "rollback",  # automatic rollbacks during deployments
     "tron",  # batch workloads
     "eks",  # eks workloads
+    "smartstack",  # mesh configs
     "autotuned_defaults/kubernetes",
     "autotuned_defaults/cassandracluster",
 }
@@ -163,9 +169,33 @@ INVALID_AUTOSCALING_FIELDS = {
         "desired_active_requests_per_replica",
         "prometheus-adapter-config",
     },
+    METRICS_PROVIDER_WORKER_LOAD: {
+        "desired_active_requests_per_replica",
+        "prometheus-adapter-config",
+    },
     METRICS_PROVIDER_PROMQL: {"desired_active_requests_per_replica"},
 }
 
+# Listener names in Envoy cannot exceed 128 characters and use the
+# following format:
+#    service_name.namespace.listener
+# This naming scheme leaves 128 - 10 = 118 characters
+# for the Smartstack service name and namespace.
+# See COREBACK-6303 for more context.
+MAX_ENVOY_NAME_LEN = 118
+
+# Socket names cannot exceed 108 characters, and the longest socket
+# name generated by HAProxy uses the following format:
+#    /var/run/synapse/sockets/service_name.namespace.LONGPID.sock.tmp
+# This naming scheme leaves 108 - 43 = 65 characters combined for the
+# Smartstack service name and namespace. We leave a generous buffer
+# to arrive at a maximum name length of 55, in case e.g. the .sock
+# suffix is renamed to a longer name for certain sockets.
+# See SMTSTK-204 for more context.
+# NOTE: the above is mostly still true - but the path we use is now /var/run/envoy/sockets/...
+# so we may want to adjust this a tad in the future ;)
+MAX_SMARTSTACK_NAME_LEN = 55
+
 
 class ConditionConfig(TypedDict, total=False):
     """
@@ -978,6 +1008,191 @@ def validate_cpu_burst(service_path: str) -> bool:
     return returncode
 
 
+def _check_smartstack_name_length_envoy(service: str, namespace: str) -> None:
+    """Ensures that Smartstack service name and namespace does not
+    exceed the limit on the length of Envoy's listener names
+    """
+    if len(service) + len(namespace) > MAX_ENVOY_NAME_LEN:
+        raise ValueError(
+            "Service name and namespace exceeds max listener name length in Envoy. Note that the full listener name "
+            'is "{}.{}.listener". Please rename so that the combined length of the service name and namespace does '
+            "not exceed {} characters".format(service, namespace, MAX_ENVOY_NAME_LEN),
+        )
+
+
+def _check_smartstack_name_length(service: str, namespace: str) -> None:
+    """Ensure that Smartstack name does not
+    exceed limits on HAProxy socket name
+    """
+    if len(service + namespace) > MAX_SMARTSTACK_NAME_LEN:
+        socket_name = "/var/run/synapse/sockets/{}.{}.sock.LONGPID.tmp".format(
+            service,
+            namespace,
+        )
+        raise ValueError(
+            "Name exceeds max socket name length. Note that the full socket name under the HAProxy naming scheme "
+            'is "{}". Please rename so that the combined length of the service name and namespace does not '
+            "exceed {} characters".format(socket_name, MAX_SMARTSTACK_NAME_LEN),
+        )
+
+
+@lru_cache()
+def _get_etc_services() -> list[str]:
+    with open("/etc/services") as f:
+        return f.read().splitlines()
+
+
+@lru_cache()
+def _get_etc_services_entry(port_lookup: int) -> str | None:
+    entries = _get_etc_services()
+    for entry in entries:
+        try:
+            service = entry.split()[0]
+            port = entry.split()[1]
+            if port.startswith("%s/" % str(port_lookup)):
+                return service
+        except IndexError:
+            continue
+    return None
+
+
+def _check_proxy_port_in_use(service: str, namespace: str, port: int) -> bool:
+    if port is None:
+        return False
+
+    # TODO(luisp): this should probably check the distributed /nail/etc/services
+    # smartstack.yamls OR we should more automatically manage /etc/services
+    etc_services_entry = _get_etc_services_entry(port)
+    if etc_services_entry is None:
+        return False
+    elif f"{service}.{namespace}" == etc_services_entry:
+        return False
+    else:
+        raise ValueError(
+            (
+                "port {} is already in use by {} according to /etc/services, it cannot be used by "
+                "{}.{}. Please either pick a different port or update /etc/services via puppet"
+            ).format(port, etc_services_entry, service, namespace),
+        )
+
+
+def _check_advertise_discover(
+    smartstack_data: dict[str, Any]
+) -> None:  # XXX: we should use a TypedDict here
+    """Need to ensure a few properties about smartstack files
+    1) discover is a member of advertise
+    2) discovery and advertise contain valid locations
+    3) extra_advertise contains valid locations
+    4) rhs of extra_advertise are >= discover type
+    """
+
+    def assert_valid_type(location_type: str) -> None:
+        if location_type not in available_location_types():
+            raise ValueError(
+                'Location type "{}" not a valid Yelp location type'.format(
+                    location_type,
+                ),
+            )
+
+    def assert_valid_location(location_string: str) -> None:
+        try:
+            typ, loc = location_string.split(":")
+            assert len(convert_location_type(loc, typ, typ)) == 1
+        except Exception:
+            raise ValueError(
+                'Location string "{}" not a valid Yelp location'.format(
+                    location_string,
+                ),
+            )
+
+    advertise = smartstack_data.get("advertise", ["region"])
+    discover = smartstack_data.get("discover", "region")
+    if discover not in advertise:
+        raise ValueError(
+            'discover key "{}" not a member of advertise "{}"'.format(
+                discover,
+                advertise,
+            ),
+        )
+    for location_type in [discover] + advertise:
+        assert_valid_type(location_type)
+
+    extra_advertisements = smartstack_data.get("extra_advertise", {})
+    for source, destinations in extra_advertisements.items():
+        assert_valid_location(source)
+        for destination in destinations:
+            assert_valid_location(destination)
+            dest_type = destination.split(":")[0]
+            if compare_types(dest_type, discover) > 0:
+                raise ValueError(
+                    'Right hand side "{}" less general than discover type "{}". Your advertisement would potentially '
+                    "result in more hosts seeing your service than intended. Please change the type of your RHS to be "
+                    ">= the discover type".format(destination, discover),
+                )
+
+
+def _check_smartstack_valid_proxy(proxied_through: str, soa_dir: str) -> None:
+    """Checks whether its parameter is a valid Smartstack namespace. Can be used for proxied_through or clb_proxy."""
+    proxy_service, proxy_namespace = proxied_through.split(".")
+    proxy_smartstack_filename = Path(soa_dir) / proxy_service / "smartstack.yaml"
+    try:
+        yaml_data = get_config_file_dict(proxy_smartstack_filename)
+        if proxy_namespace not in yaml_data:
+            raise ValueError(
+                f"{proxied_through} is not a valid Smartstack namespace to proxy through: "
+                f"{proxy_namespace} not found in {proxy_smartstack_filename}.",
+            )
+    except FileNotFoundError:
+        raise ValueError(
+            f"{proxied_through} is not a valid Smartstack namespace to proxy through: "
+            f"{proxy_smartstack_filename} does not exist.",
+        )
+
+
+def _check_smartstack_proxied_through(
+    smartstack_data: dict[str, Any],
+    soa_dir: str,
+) -> None:  # XXX: we should use a TypedDict here
+    """Checks the proxied_through field of a Smartstack namespace refers to another valid Smartstack namespace"""
+    if "proxied_through" not in smartstack_data:
+        return
+
+    proxied_through = smartstack_data["proxied_through"]
+    _check_smartstack_valid_proxy(proxied_through, soa_dir)
+
+
+def validate_smartstack(service_path: str) -> bool:
+    if not os.path.exists(os.path.join(service_path, "smartstack.yaml")):
+        # not every service is mesh-registered, exit early if this is the case
+        return True
+
+    config = get_config_file_dict(os.path.join(service_path, "smartstack.yaml"))
+    if not config:
+        print(
+            failure(
+                "smartstack.yaml is empty - if this service is not mesh-registered, please remove this file.",
+                "http://paasta.readthedocs.io/en/latest/yelpsoa_configs.html",
+            )
+        )
+        return False
+
+    soa_dir, service = path_to_soa_dir_service(service_path)
+    for namespace, namespace_config in config.items():
+        # XXX(luisp): these should all really either return bools or be enforced in the schema
+        # ...i'm mostly leaving these as-is since i'm trying to remove some internal code that
+        # duplicates a bunch of paasta validate checks (i.e., py-gitolite)
+        _check_smartstack_name_length_envoy(service, namespace)
+        if namespace_config["proxy_port"]:
+            _check_smartstack_name_length(service, namespace)
+        proxy_port = namespace_config["proxy_port"]
+        _check_proxy_port_in_use(service, namespace, proxy_port)
+        _check_advertise_discover(namespace_config)
+        _check_smartstack_proxied_through(namespace_config, soa_dir)
+
+    print(success("All SmartStack configs are valid"))
+    return True
+
+
 def paasta_validate_soa_configs(
     service: str, service_path: str, verbose: bool = False
 ) -> bool:
@@ -1000,6 +1215,7 @@ def paasta_validate_soa_configs(
         validate_secrets,
         validate_min_max_instances,
         validate_cpu_burst,
+        validate_smartstack,
     ]
 
     # NOTE: we're explicitly passing a list comprehension to all()
@@ -1013,8 +1229,13 @@ def paasta_validate(args):
 
     :param args: argparse.Namespace obj created from sys.args by cli
     """
-    service_path = get_service_path(args.service, args.yelpsoa_config_root)
     service = args.service or guess_service_name()
+    service_path = get_service_path(service, args.yelpsoa_config_root)
+
+    # not much we can do if we have no path to inspect ;)
+    if not service_path:
+        return 1
+
     if not paasta_validate_soa_configs(service, service_path, args.verbose):
         print("Invalid configs found. Please try again.")
         return 1

{paasta_tools-1.30.9 → paasta_tools-1.35.4}/paasta_tools/cli/schemas/autoscaling_schema.json

@@ -10,8 +10,9 @@
                     "cpu",
                     "piscina",
                     "gunicorn",
-                    "arbitrary_promql",
-                    "active-requests"
+                    "active-requests",
+                    "arbitrary-promql",
+                    "worker-load"
                 ]
             },
             "decision_policy": {