paasta-tools 1.35.1__tar.gz → 1.35.3__tar.gz

{paasta_tools-1.35.1/paasta_tools.egg-info → paasta_tools-1.35.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: paasta-tools
-Version: 1.35.1
+Version: 1.35.3
 Summary: Tools for Yelps SOA infrastructure
 Author: Compute Infrastructure @ Yelp
 Author-email: compute-infra@yelp.com

{paasta_tools-1.35.1 → paasta_tools-1.35.3}/paasta_tools/__init__.py

@@ -17,4 +17,4 @@
 # setup phase, the dependencies may not exist on disk yet.
 #
 # Don't bump version manually. See `make release` docs in ./Makefile
-__version__ = "1.35.1"
+__version__ = "1.35.3"

{paasta_tools-1.35.1 → paasta_tools-1.35.3}/paasta_tools/cli/cmds/secret.py

@@ -212,7 +212,7 @@ def _add_vault_auth_args(parser: argparse.ArgumentParser):
         dest="vault_auth_method",
         required=False,
         default="token",
-        choices=["token", "ldap"],
+        choices=["token", "okta"],
     )
     parser.add_argument(
         "--vault-token-file",
@@ -456,7 +456,7 @@ def paasta_secret(args):
                 "vault_token_file": args.vault_token_file,
                 # best solution so far is to change the below string to "token",
                 # so that token file is picked up from argparse
-                "vault_auth_method": "ldap",  # must have LDAP to get 2FA push for prod
+                "vault_auth_method": "okta",  # must use Okta to get 2FA push
             },
         )
         secret_provider.write_secret(

{paasta_tools-1.35.1 → paasta_tools-1.35.3}/paasta_tools/kubernetes/application/controller_wrappers.py

@@ -173,19 +173,31 @@ class Application(ABC):
         self, kube_client: KubeClient, namespace: str
     ) -> V1PodDisruptionBudget:
         max_unavailable: Union[str, int]
+
+        system_paasta_config = load_system_paasta_config()
+
         if "bounce_margin_factor" in self.soa_config.config_dict:
             max_unavailable = (
                 f"{int((1 - self.soa_config.get_bounce_margin_factor()) * 100)}%"
             )
         else:
-            system_paasta_config = load_system_paasta_config()
             max_unavailable = system_paasta_config.get_pdb_max_unavailable()
 
+        if "unhealthy_pod_eviction_policy" in self.soa_config.config_dict:
+            unhealthy_pod_eviction_policy = (
+                self.soa_config.get_unhealthy_pod_eviction_policy()
+            )
+        else:
+            unhealthy_pod_eviction_policy = (
+                system_paasta_config.get_unhealthy_pod_eviction_policy()
+            )
+
         pdr = pod_disruption_budget_for_service_instance(
             service=self.kube_deployment.service,
             instance=self.kube_deployment.instance,
             max_unavailable=max_unavailable,
             namespace=namespace,
+            unhealthy_pod_eviction_policy=unhealthy_pod_eviction_policy,
         )
         try:
             existing_pdr = kube_client.policy.read_namespaced_pod_disruption_budget(
@@ -198,12 +210,21 @@ class Application(ABC):
                 raise
 
         if existing_pdr:
+            """
+            Update the pod disruption budget only if spec.max_unavailable
+            or spec.unhealthy_pod_eviction_policy have changed;
+            ignore changes to other fields
+            """
             if existing_pdr.spec.min_available is not None:
                 logging.info(
                     "Not updating poddisruptionbudget: can't have both "
                     "min_available and max_unavailable"
                 )
-            elif existing_pdr.spec.max_unavailable != pdr.spec.max_unavailable:
+            elif (
+                existing_pdr.spec.max_unavailable != pdr.spec.max_unavailable
+                or existing_pdr.spec.unhealthy_pod_eviction_policy
+                != pdr.spec.unhealthy_pod_eviction_policy
+            ):
                 logging.info(f"Updating poddisruptionbudget {pdr.metadata.name}")
                 return kube_client.policy.patch_namespaced_pod_disruption_budget(
                     name=pdr.metadata.name, namespace=pdr.metadata.namespace, body=pdr

{paasta_tools-1.35.1 → paasta_tools-1.35.3}/paasta_tools/kubernetes_tools.py

@@ -3374,21 +3374,26 @@ def pod_disruption_budget_for_service_instance(
     instance: str,
     max_unavailable: Union[str, int],
     namespace: str,
+    unhealthy_pod_eviction_policy: str,
 ) -> V1PodDisruptionBudget:
+    selector = V1LabelSelector(
+        match_labels={
+            "paasta.yelp.com/service": service,
+            "paasta.yelp.com/instance": instance,
+        }
+    )
+    spec = V1PodDisruptionBudgetSpec(
+        max_unavailable=max_unavailable,
+        unhealthy_pod_eviction_policy=unhealthy_pod_eviction_policy,
+        selector=selector,
+    )
+
     return V1PodDisruptionBudget(
         metadata=V1ObjectMeta(
             name=get_kubernetes_app_name(service, instance),
             namespace=namespace,
         ),
-        spec=V1PodDisruptionBudgetSpec(
-            max_unavailable=max_unavailable,
-            selector=V1LabelSelector(
-                match_labels={
-                    "paasta.yelp.com/service": service,
-                    "paasta.yelp.com/instance": instance,
-                }
-            ),
-        ),
+        spec=spec,
     )
 
 

{paasta_tools-1.35.1 → paasta_tools-1.35.3}/paasta_tools/long_running_service_tools.py

@@ -88,6 +88,7 @@ class LongRunningServiceConfigDict(InstanceConfigDict, total=False):
     bounce_margin_factor: float
     should_ping_for_unhealthy_pods: bool
     weight: int
+    unhealthy_pod_eviction_policy: str
 
 
 class ServiceNamespaceConfig(dict):
@@ -413,6 +414,9 @@ class LongRunningServiceConfig(InstanceConfig):
     def get_bounce_margin_factor(self) -> float:
         return self.config_dict.get("bounce_margin_factor", 0.95)
 
+    def get_unhealthy_pod_eviction_policy(self) -> str:
+        return self.config_dict.get("unhealthy_pod_eviction_policy", "IfHealthyBudget")
+
     def get_should_ping_for_unhealthy_pods(self, default: bool) -> bool:
         return self.config_dict.get("should_ping_for_unhealthy_pods", default)
 

{paasta_tools-1.35.1 → paasta_tools-1.35.3}/paasta_tools/utils.py

@@ -2070,6 +2070,7 @@ class SystemPaastaConfigDict(TypedDict, total=False):
     default_spark_driver_pool_override: str
     readonly_docker_registry_auth_file: str
     private_docker_registries: List[str]
+    unhealthy_pod_eviction_policy: str
 
 
 def load_system_paasta_config(
@@ -2855,6 +2856,15 @@ class SystemPaastaConfig:
         """Get all the internal Docker registries without generally-available RO creds."""
         return set(self.config_dict.get("private_docker_registries", []))
 
+    def get_unhealthy_pod_eviction_policy(self) -> str:
+        """
+        Get the unhealthy pod eviction policy for the cluster. Posible values:
+        * IfHealthyBudget: unhealthy pods will only be evicted wrt to PodDisruptionBudget
+        * AlwaysAllow: evict unhealthy pods regardless of the PodDisruptionBudget status.
+        Defaults to IfHealthyBudget
+        """
+        return self.config_dict.get("unhealthy_pod_eviction_policy", "IfHealthyBudget")
+
 
 def _run(
     command: Union[str, List[str]],

{paasta_tools-1.35.1 → paasta_tools-1.35.3/paasta_tools.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: paasta-tools
-Version: 1.35.1
+Version: 1.35.3
 Summary: Tools for Yelps SOA infrastructure
 Author: Compute Infrastructure @ Yelp
 Author-email: compute-infra@yelp.com

{paasta_tools-1.35.1 → paasta_tools-1.35.3}/requirements-minimal.txt

@@ -29,6 +29,7 @@ kazoo >= 2.0.0
 # from our pinned-dependencies. The upper-bound should generally be the latest kubernetes version
 # that we can use across our different clusters (e.g, if X.0.0 removes an API version that we use
 # in any cluster, this upper-bound should be < X.0.0)
+# NOTE: the above is not exactly true anymore due to our legacy clusters...
 # we should probably also be better at setting a correct lower-bound, but that's less likely to cause issues.
 kubernetes >= 29.0.0, < 35.0.0
 ldap3

{paasta_tools-1.35.1 → paasta_tools-1.35.3}/tests/test_kubernetes_tools.py

@@ -4085,14 +4085,39 @@ def test_max_unavailable(instances, bmf):
     assert type(res) is int
 
 
-def test_pod_disruption_budget_for_service_instance():
+@pytest.mark.parametrize(
+    "unhealthy_eviction_enabled,expected_policy",
+    (
+        (None, "IfHealthyBudget"),
+        ("IfHealthyBudget", "IfHealthyBudget"),
+        ("AlwaysAllow", "AlwaysAllow"),
+    ),
+)
+def test_pod_disruption_budget_for_service_instance(
+    unhealthy_eviction_enabled, expected_policy
+):
     mock_namespace = "paasta"
-    x = pod_disruption_budget_for_service_instance(
-        service="foo_1",
-        instance="bar_1",
-        max_unavailable="10%",
-        namespace=mock_namespace,
-    )
+    with mock.patch(
+        "paasta_tools.utils.load_system_paasta_config",
+        return_value=SystemPaastaConfig(
+            {
+                "enable_unhealthy_pod_eviction": unhealthy_eviction_enabled,
+            },
+            "/fake/dir/",
+        ),
+        autospec=True,
+    ) as mock_load_system_paasta_config, mock.patch(
+        "paasta_tools.kubernetes_tools.load_system_paasta_config",
+        new=mock_load_system_paasta_config,
+        autospec=False,
+    ):
+        x = pod_disruption_budget_for_service_instance(
+            service="foo_1",
+            instance="bar_1",
+            max_unavailable="10%",
+            namespace=mock_namespace,
+            unhealthy_pod_eviction_policy=expected_policy,
+        )
 
     assert x.metadata.name == "foo--1-bar--1"
     assert x.metadata.namespace == "paasta"
@@ -4101,6 +4126,7 @@ def test_pod_disruption_budget_for_service_instance():
         "paasta.yelp.com/service": "foo_1",
         "paasta.yelp.com/instance": "bar_1",
     }
+    assert x.spec.unhealthy_pod_eviction_policy == expected_policy
 
 
 def test_create_pod_disruption_budget():