paasta-tools 1.33.3__tar.gz → 1.34.0__tar.gz

{paasta_tools-1.33.3/paasta_tools.egg-info → paasta_tools-1.34.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: paasta-tools
-Version: 1.33.3
+Version: 1.34.0
 Summary: Tools for Yelps SOA infrastructure
 Author: Compute Infrastructure @ Yelp
 Author-email: compute-infra@yelp.com
@@ -34,7 +34,7 @@ Requires-Dist: ipaddress>=1.0.22
 Requires-Dist: isodate>=0.7.2
 Requires-Dist: jsonschema[format]
 Requires-Dist: kazoo>=2.0.0
-Requires-Dist: kubernetes<26.0.0,>=18.20.0
+Requires-Dist: kubernetes<35.0.0,>=29.0.0
 Requires-Dist: ldap3
 Requires-Dist: manhole
 Requires-Dist: mypy-extensions>=0.3.0

{paasta_tools-1.33.3 → paasta_tools-1.34.0}/paasta_tools/__init__.py

@@ -17,4 +17,4 @@
 # setup phase, the dependencies may not exist on disk yet.
 #
 # Don't bump version manually. See `make release` docs in ./Makefile
-__version__ = "1.33.3"
+__version__ = "1.34.0"

{paasta_tools-1.33.3 → paasta_tools-1.34.0}/paasta_tools/cli/cmds/local_run.py

@@ -1385,8 +1385,9 @@ def should_reexec_as_root(
 
 
 def paasta_local_run(args):
+    service = figure_out_service_name(args, soa_dir=args.yelpsoa_config_root)
     if should_reexec_as_root(
-        args.service, args.skip_secrets, args.action, args.yelpsoa_config_root
+        service, args.skip_secrets, args.action, args.yelpsoa_config_root
     ):
         # XXX: we should re-architect this to not need sudo, but for now,
         # re-exec ourselves with sudo to get access to the paasta vault token
@@ -1421,8 +1422,6 @@ def paasta_local_run(args):
 
     local_run_config = system_paasta_config.get_local_run_config()
 
-    service = figure_out_service_name(args, soa_dir=args.yelpsoa_config_root)
-
     if args.cluster:
         cluster = args.cluster
     else:

{paasta_tools-1.33.3 → paasta_tools-1.34.0}/paasta_tools/cli/schemas/eks_schema.json

@@ -1,6 +1,6 @@
 {
     "$schema": "http://json-schema.org/draft-04/schema#",
-    "description": "http://paasta.readthedocs.io/en/latest/yelpsoa_configs.html#kubernetes-clustername-yaml",
+    "description": "http://paasta.readthedocs.io/en/latest/yelpsoa_configs.html#eks-clustername-yaml",
     "type": "object",
     "additionalProperties": false,
     "minProperties": 1,
@@ -955,6 +955,28 @@
                             },
                             "max_skew": {
                                 "type": "integer"
+                            },
+                            "match_label_keys": {
+                                "type": "array",
+                                "items": {
+                                    "allOf": [
+                                        {
+                                            "type": "string",
+                                            "pattern": "^([a-zA-Z0-9]([-a-zA-Z0-9_.]*[a-zA-Z0-9])?/)?[a-zA-Z0-9]([-a-zA-Z0-9_.]*[a-zA-Z0-9])?$",
+                                            "maxLength": 63
+                                        },
+                                        {
+                                            "not": {
+                                                "enum": [
+                                                    "paasta.yelp.com/service",
+                                                    "paasta.yelp.com/instance"
+                                                ]
+                                            }
+                                        }
+                                    ],
+                                    "$comment": "Valid Kubernetes label key: optional prefix (DNS subdomain) followed by '/' and name segment (max 63 chars each)"
+                                },
+                                "uniqueItems": true
                             }
                         },
                         "required": []

{paasta_tools-1.33.3 → paasta_tools-1.34.0}/paasta_tools/instance/hpa_metrics_parser.py

@@ -1,8 +1,6 @@
 from typing import Optional
 
-from kubernetes.client.models.v2beta2_object_metric_status import (
-    V2beta2ObjectMetricStatus,
-)
+from kubernetes.client import V2ObjectMetricStatus
 from mypy_extensions import TypedDict
 
 
@@ -102,7 +100,7 @@ class HPAMetricsParser:
         )
 
     def parse_object_metric(
-        self, metric_spec: V2beta2ObjectMetricStatus, status: HPAMetricsDict
+        self, metric_spec: V2ObjectMetricStatus, status: HPAMetricsDict
     ) -> None:
         status["name"] = metric_spec.metric.name
         status["target_value"] = (
@@ -112,7 +110,7 @@ class HPAMetricsParser:
         )
 
     def parse_object_metric_current(
-        self, metric_spec: V2beta2ObjectMetricStatus, status: HPAMetricsDict
+        self, metric_spec: V2ObjectMetricStatus, status: HPAMetricsDict
     ) -> None:
         status["name"] = metric_spec.metric.name
         status["current_value"] = (

{paasta_tools-1.33.3 → paasta_tools-1.34.0}/paasta_tools/kubernetes/remote_run.py

@@ -20,6 +20,7 @@ from typing import Sequence
 from typing import TypedDict
 
 from kubernetes.client import AuthenticationV1TokenRequest
+from kubernetes.client import RbacV1Subject
 from kubernetes.client import V1Job
 from kubernetes.client import V1ObjectMeta
 from kubernetes.client import V1Pod
@@ -28,7 +29,6 @@ from kubernetes.client import V1Role
 from kubernetes.client import V1RoleBinding
 from kubernetes.client import V1RoleRef
 from kubernetes.client import V1ServiceAccount
-from kubernetes.client import V1Subject
 from kubernetes.client import V1TokenRequestSpec
 from kubernetes.client.exceptions import ApiException
 
@@ -522,7 +522,7 @@ def bind_role_to_service_account(
             name=role,
         ),
         subjects=[
-            V1Subject(
+            RbacV1Subject(
                 kind="ServiceAccount",
                 name=service_account,
             ),

{paasta_tools-1.33.3 → paasta_tools-1.34.0}/paasta_tools/kubernetes_tools.py

@@ -50,6 +50,7 @@ from kubernetes import client as kube_client
 from kubernetes import config as kube_config
 from kubernetes.client import CoreV1Event
 from kubernetes.client import models
+from kubernetes.client import RbacV1Subject
 from kubernetes.client import V1Affinity
 from kubernetes.client import V1AWSElasticBlockStoreVolumeSource
 from kubernetes.client import V1Capabilities
@@ -113,7 +114,6 @@ from kubernetes.client import V1ServiceAccount
 from kubernetes.client import V1ServiceAccountTokenProjection
 from kubernetes.client import V1StatefulSet
 from kubernetes.client import V1StatefulSetSpec
-from kubernetes.client import V1Subject
 from kubernetes.client import V1TCPSocketAction
 from kubernetes.client import V1TopologySpreadConstraint
 from kubernetes.client import V1Volume
@@ -2992,7 +2992,7 @@ def ensure_paasta_api_rolebinding(kube_client: KubeClient, namespace: str) -> No
                 name="paasta-api-server-per-namespace",
             ),
             subjects=[
-                V1Subject(
+                RbacV1Subject(
                     kind="User",
                     name="yelp.com/paasta-api-server",
                 ),
@@ -4172,6 +4172,10 @@ def create_pod_topology_spread_constraints(
                 when_unsatisfiable=constraint.get(
                     "when_unsatisfiable", "ScheduleAnyway"
                 ),
+                # we might want to default this to someting else in the future
+                # but for now, make this opt-in
+                # (null or empty list means only match against the labelSelector)
+                match_label_keys=constraint.get("match_label_keys", None),
             )
         )
 
@@ -4375,7 +4379,7 @@ def ensure_service_account(
                     name=k8s_role,
                 ),
                 subjects=[
-                    V1Subject(
+                    RbacV1Subject(
                         kind="ServiceAccount",
                         namespace=namespace,
                         name=sa_name,

{paasta_tools-1.33.3 → paasta_tools-1.34.0}/paasta_tools/utils.py

@@ -1950,6 +1950,7 @@ class TopologySpreadConstraintDict(TypedDict, total=False):
     topology_key: str
     when_unsatisfiable: Literal["ScheduleAnyway", "DoNotSchedule"]
     max_skew: int
+    match_label_keys: List[str]
 
 
 class SystemPaastaConfigDict(TypedDict, total=False):

{paasta_tools-1.33.3 → paasta_tools-1.34.0/paasta_tools.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: paasta-tools
-Version: 1.33.3
+Version: 1.34.0
 Summary: Tools for Yelps SOA infrastructure
 Author: Compute Infrastructure @ Yelp
 Author-email: compute-infra@yelp.com
@@ -34,7 +34,7 @@ Requires-Dist: ipaddress>=1.0.22
 Requires-Dist: isodate>=0.7.2
 Requires-Dist: jsonschema[format]
 Requires-Dist: kazoo>=2.0.0
-Requires-Dist: kubernetes<26.0.0,>=18.20.0
+Requires-Dist: kubernetes<35.0.0,>=29.0.0
 Requires-Dist: ldap3
 Requires-Dist: manhole
 Requires-Dist: mypy-extensions>=0.3.0

{paasta_tools-1.33.3 → paasta_tools-1.34.0}/paasta_tools.egg-info/requires.txt

@@ -25,7 +25,7 @@ ipaddress>=1.0.22
 isodate>=0.7.2
 jsonschema[format]
 kazoo>=2.0.0
-kubernetes<26.0.0,>=18.20.0
+kubernetes<35.0.0,>=29.0.0
 ldap3
 manhole
 mypy-extensions>=0.3.0

{paasta_tools-1.33.3 → paasta_tools-1.34.0}/requirements-minimal.txt

@@ -30,7 +30,7 @@ kazoo >= 2.0.0
 # that we can use across our different clusters (e.g, if X.0.0 removes an API version that we use
 # in any cluster, this upper-bound should be < X.0.0)
 # we should probably also be better at setting a correct lower-bound, but that's less likely to cause issues.
-kubernetes >= 18.20.0, < 26.0.0
+kubernetes >= 29.0.0, < 35.0.0
 ldap3
 manhole
 mypy-extensions >= 0.3.0

{paasta_tools-1.33.3 → paasta_tools-1.34.0}/tests/test_kubernetes_tools.py

@@ -13,6 +13,7 @@ from hypothesis import given
 from hypothesis.strategies import floats
 from hypothesis.strategies import integers
 from kubernetes import client as kube_client
+from kubernetes.client import RbacV1Subject
 from kubernetes.client import V1Affinity
 from kubernetes.client import V1AWSElasticBlockStoreVolumeSource
 from kubernetes.client import V1Capabilities
@@ -62,7 +63,6 @@ from kubernetes.client import V1ServiceAccountList
 from kubernetes.client import V1ServiceAccountTokenProjection
 from kubernetes.client import V1StatefulSet
 from kubernetes.client import V1StatefulSetSpec
-from kubernetes.client import V1Subject
 from kubernetes.client import V1TCPSocketAction
 from kubernetes.client import V1TopologySpreadConstraint
 from kubernetes.client import V1Volume
@@ -554,18 +554,18 @@ class TestKubernetesDeploymentConfig:
         ), mock.patch(
             "paasta_tools.kubernetes_tools.KubernetesDeploymentConfig.get_sidecar_resource_requirements",
             autospec=True,
-            return_value={
-                "limits": {
+            return_value=V1ResourceRequirements(
+                limits={
                     "cpu": 0.1,
                     "memory": "1024Mi",
                     "ephemeral-storage": "256Mi",
                 },
-                "requests": {
+                requests={
                     "cpu": 0.1,
                     "memory": "1024Mi",
                     "ephemeral-storage": "256Mi",
                 },
-            },
+            ),
         ):
             mock_system_config = mock.Mock(
                 get_hacheck_sidecar_image_url=mock.Mock(
@@ -2205,6 +2205,7 @@ class TestKubernetesDeploymentConfig:
                 max_skew=1,
                 topology_key="kubernetes.io/hostname",
                 when_unsatisfiable="ScheduleAnyway",
+                match_label_keys=None,
             ),
             V1TopologySpreadConstraint(
                 label_selector=V1LabelSelector(
@@ -2216,6 +2217,183 @@ class TestKubernetesDeploymentConfig:
                 max_skew=3,
                 topology_key="topology.kubernetes.io/zone",
                 when_unsatisfiable="DoNotSchedule",
+                match_label_keys=None,
+            ),
+        ]
+
+        assert (
+            kubernetes_tools.create_pod_topology_spread_constraints(
+                "schematizer", "main", configured_constraints
+            )
+            == expected_constraints
+        )
+
+    def test_create_pod_topology_spread_constraints_with_match_label_keys(self):
+        """Test that match_label_keys are properly passed through when specified"""
+        configured_constraints: List[TopologySpreadConstraintDict] = [
+            {
+                "topology_key": "kubernetes.io/hostname",
+                "max_skew": 1,
+                "when_unsatisfiable": "ScheduleAnyway",
+                "match_label_keys": ["paasta.yelp.com/git_sha"],
+            },
+        ]
+
+        expected_constraints = [
+            V1TopologySpreadConstraint(
+                label_selector=V1LabelSelector(
+                    match_labels={
+                        "paasta.yelp.com/service": "schematizer",
+                        "paasta.yelp.com/instance": "main",
+                    }
+                ),
+                max_skew=1,
+                topology_key="kubernetes.io/hostname",
+                when_unsatisfiable="ScheduleAnyway",
+                match_label_keys=["paasta.yelp.com/git_sha"],
+            ),
+        ]
+
+        assert (
+            kubernetes_tools.create_pod_topology_spread_constraints(
+                "schematizer", "main", configured_constraints
+            )
+            == expected_constraints
+        )
+
+    def test_create_pod_topology_spread_constraints_with_multiple_match_label_keys(
+        self,
+    ):
+        """Test that multiple match_label_keys are properly passed through"""
+        configured_constraints: List[TopologySpreadConstraintDict] = [
+            {
+                "topology_key": "topology.kubernetes.io/zone",
+                "max_skew": 2,
+                "when_unsatisfiable": "DoNotSchedule",
+                "match_label_keys": [
+                    "paasta.yelp.com/git_sha",
+                    "paasta.yelp.com/config_sha",
+                ],
+            },
+        ]
+
+        expected_constraints = [
+            V1TopologySpreadConstraint(
+                label_selector=V1LabelSelector(
+                    match_labels={
+                        "paasta.yelp.com/service": "schematizer",
+                        "paasta.yelp.com/instance": "main",
+                    }
+                ),
+                max_skew=2,
+                topology_key="topology.kubernetes.io/zone",
+                when_unsatisfiable="DoNotSchedule",
+                match_label_keys=[
+                    "paasta.yelp.com/git_sha",
+                    "paasta.yelp.com/config_sha",
+                ],
+            ),
+        ]
+
+        assert (
+            kubernetes_tools.create_pod_topology_spread_constraints(
+                "schematizer", "main", configured_constraints
+            )
+            == expected_constraints
+        )
+
+    def test_create_pod_topology_spread_constraints_with_empty_match_label_keys(self):
+        """Test that explicitly setting match_label_keys to empty list is preserved"""
+        configured_constraints: List[TopologySpreadConstraintDict] = [
+            {
+                "topology_key": "kubernetes.io/hostname",
+                "max_skew": 1,
+                "when_unsatisfiable": "ScheduleAnyway",
+                "match_label_keys": [],
+            },
+        ]
+
+        expected_constraints = [
+            V1TopologySpreadConstraint(
+                label_selector=V1LabelSelector(
+                    match_labels={
+                        "paasta.yelp.com/service": "schematizer",
+                        "paasta.yelp.com/instance": "main",
+                    }
+                ),
+                max_skew=1,
+                topology_key="kubernetes.io/hostname",
+                when_unsatisfiable="ScheduleAnyway",
+                match_label_keys=[],
+            ),
+        ]
+
+        assert (
+            kubernetes_tools.create_pod_topology_spread_constraints(
+                "schematizer", "main", configured_constraints
+            )
+            == expected_constraints
+        )
+
+    def test_create_pod_topology_spread_constraints_mixed_match_label_keys(self):
+        """Test constraints where some have match_label_keys and some don't"""
+        configured_constraints: List[TopologySpreadConstraintDict] = [
+            {
+                "topology_key": "kubernetes.io/hostname",
+                "max_skew": 1,
+                "when_unsatisfiable": "ScheduleAnyway",
+                "match_label_keys": ["paasta.yelp.com/git_sha"],
+            },
+            {
+                "topology_key": "topology.kubernetes.io/zone",
+                "max_skew": 3,
+                "when_unsatisfiable": "DoNotSchedule",
+                # No match_label_keys specified, should default to None
+            },
+            {
+                "topology_key": "kubernetes.io/region",
+                "max_skew": 5,
+                "when_unsatisfiable": "ScheduleAnyway",
+                "match_label_keys": [],  # Explicitly empty
+            },
+        ]
+
+        expected_constraints = [
+            V1TopologySpreadConstraint(
+                label_selector=V1LabelSelector(
+                    match_labels={
+                        "paasta.yelp.com/service": "schematizer",
+                        "paasta.yelp.com/instance": "main",
+                    }
+                ),
+                max_skew=1,
+                topology_key="kubernetes.io/hostname",
+                when_unsatisfiable="ScheduleAnyway",
+                match_label_keys=["paasta.yelp.com/git_sha"],
+            ),
+            V1TopologySpreadConstraint(
+                label_selector=V1LabelSelector(
+                    match_labels={
+                        "paasta.yelp.com/service": "schematizer",
+                        "paasta.yelp.com/instance": "main",
+                    }
+                ),
+                max_skew=3,
+                topology_key="topology.kubernetes.io/zone",
+                when_unsatisfiable="DoNotSchedule",
+                match_label_keys=None,
+            ),
+            V1TopologySpreadConstraint(
+                label_selector=V1LabelSelector(
+                    match_labels={
+                        "paasta.yelp.com/service": "schematizer",
+                        "paasta.yelp.com/instance": "main",
+                    }
+                ),
+                max_skew=5,
+                topology_key="kubernetes.io/region",
+                when_unsatisfiable="ScheduleAnyway",
+                match_label_keys=[],
             ),
         ]
 
@@ -4769,7 +4947,7 @@ def test_warning_big_bounce_default_config():
             job_config.format_kubernetes_app().spec.template.metadata.labels[
                 "paasta.yelp.com/config_sha"
             ]
-            == "config477c36f2"
+            == "configeed84480"
         ), "If this fails, just change the constant in this test, but be aware that deploying this change will cause every service to bounce!"
 
 
@@ -4815,7 +4993,7 @@ def test_warning_big_bounce_routable_pod():
             job_config.format_kubernetes_app().spec.template.metadata.labels[
                 "paasta.yelp.com/config_sha"
             ]
-            == "config8f26372a"
+            == "config2c86f676"
         ), "If this fails, just change the constant in this test, but be aware that deploying this change will cause every smartstack-registered service to bounce!"
 
 
@@ -4862,7 +5040,7 @@ def test_warning_big_bounce_common_config():
             job_config.format_kubernetes_app().spec.template.metadata.labels[
                 "paasta.yelp.com/config_sha"
             ]
-            == "configcf829e28"
+            == "config0e657f9b"
         ), "If this fails, just change the constant in this test, but be aware that deploying this change will cause every service to bounce!"
 
 
@@ -5088,7 +5266,7 @@ def test_ensure_service_account_with_k8s_role_new():
                     name=k8s_role,
                 ),
                 subjects=[
-                    V1Subject(
+                    RbacV1Subject(
                         kind="ServiceAccount",
                         namespace=namespace,
                         name=expected_sa_name,
@@ -5141,7 +5319,7 @@ def test_ensure_service_account_existing():
                     name=k8s_role,
                 ),
                 subjects=[
-                    V1Subject(
+                    RbacV1Subject(
                         kind="ServiceAccount",
                         namespace=namespace,
                         name=expected_sa_name,
@@ -5202,7 +5380,7 @@ def test_ensure_service_account_existing_different_role():
                     name=k8s_role,
                 ),
                 subjects=[
-                    V1Subject(
+                    RbacV1Subject(
                         kind="ServiceAccount",
                         namespace=namespace,
                         name=expected_sa_name,
@@ -5326,7 +5504,7 @@ def test_ensure_service_account_caps_with_k8s():
                     name=k8s_role,
                 ),
                 subjects=[
-                    V1Subject(
+                    RbacV1Subject(
                         kind="ServiceAccount",
                         namespace=namespace,
                         name=expected_sa_name,