quay/config_app/config_util/k8saccessor.py

import logging
import json
import base64
import datetime
import os

from requests import Request, Session
from util.config.validator import EXTRA_CA_DIRECTORY, EXTRA_CA_DIRECTORY_PREFIX

from config_app.config_util.k8sconfig import KubernetesConfig

logger = logging.getLogger(__name__)

QE_DEPLOYMENT_LABEL = 'quay-enterprise-component'


class KubernetesAccessorSingleton(object):
  """ Singleton allowing access to kubernetes operations """
  _instance = None

  def __init__(self, kube_config=None):
    self.kube_config = kube_config
    if kube_config is None:
      self.kube_config = KubernetesConfig.from_env()

    KubernetesAccessorSingleton._instance = self

  @classmethod
  def get_instance(cls, kube_config=None):
    """
    Singleton getter implementation, returns the instance if one exists, otherwise creates the
    instance and ties it to the class.
    :return: KubernetesAccessorSingleton
    """
    if cls._instance is None:
      return cls(kube_config)

    return cls._instance

  def save_secret_to_directory(self, dir_path):
    """
    Saves all files in the kubernetes secret to a local directory.
    Assumes the directory is empty.
    """
    secret = self._lookup_secret()

    secret_data = secret.get('data', {})

    # Make the `extra_ca_certs` dir to ensure we can populate extra certs
    extra_ca_dir_path = os.path.join(dir_path, EXTRA_CA_DIRECTORY)
    os.mkdir(extra_ca_dir_path)

    for secret_filename, data in secret_data.iteritems():
      write_path = os.path.join(dir_path, secret_filename)

      if EXTRA_CA_DIRECTORY_PREFIX in secret_filename:
        write_path = os.path.join(extra_ca_dir_path, secret_filename.replace(EXTRA_CA_DIRECTORY_PREFIX, ''))

      with open(write_path, 'w') as f:
        f.write(base64.b64decode(data))

    return 200

  def save_file_as_secret(self, name, file_pointer):
    value = file_pointer.read()
    self._update_secret_file(name, value)

  def replace_qe_secret(self, new_secret_data):
    """
    Removes the old config and replaces it with the new_secret_data as one action
    """
    # Check first that the namespace for Quay Enterprise exists. If it does not, report that
    # as an error, as it seems to be a common issue.
    namespace_url = 'namespaces/%s' % (self.kube_config.qe_namespace)
    response = self._execute_k8s_api('GET', namespace_url)
    if response.status_code // 100 != 2:
      msg = 'A Kubernetes namespace with name `%s` must be created to save config' % self.kube_config.qe_namespace
      raise Exception(msg)

    # Check if the secret exists. If not, then we create an empty secret and then update the file
    # inside.
    secret_url = 'namespaces/%s/secrets/%s' % (self.kube_config.qe_namespace, self.kube_config.qe_config_secret)
    secret = self._lookup_secret()
    if secret is None:
      self._assert_success(self._execute_k8s_api('POST', secret_url, {
        "kind": "Secret",
        "apiVersion": "v1",
        "metadata": {
          "name": self.kube_config.qe_config_secret
        },
        "data": {}
      }))

    # Update the secret to reflect the file change.
    secret['data'] = new_secret_data

    self._assert_success(self._execute_k8s_api('PUT', secret_url, secret))

  def get_qe_deployments(self):
    """"
    Returns all deployments matching the label selector provided in the KubeConfig
    """
    deployment_selector_url = 'namespaces/%s/deployments?labelSelector=%s%%3D%s' % (
      self.kube_config.qe_namespace, QE_DEPLOYMENT_LABEL, self.kube_config.qe_deployment_selector
    )

    response = self._execute_k8s_api('GET', deployment_selector_url, api_prefix='apis/extensions/v1beta1')
    if response.status_code != 200:
      return None
    return json.loads(response.text)

  def cycle_qe_deployments(self, deployment_names):
    """"
    Triggers a rollout of all desired deployments in the qe namespace
    """

    for name in deployment_names:
      logger.debug('Cycling deployment %s', name)
      deployment_url = 'namespaces/%s/deployments/%s' % (self.kube_config.qe_namespace, name)

      # There is currently no command to simply rolling restart all the pods: https://github.com/kubernetes/kubernetes/issues/13488
      # Instead, we modify the template of the deployment with a dummy env variable to trigger a cycle of the pods
      # (based off this comment: https://github.com/kubernetes/kubernetes/issues/13488#issuecomment-240393845)
      self._assert_success(self._execute_k8s_api('PATCH', deployment_url, {
        'spec': {
          'template': {
            'spec': {
              'containers': [{
                'name': 'quay-enterprise-app', 'env': [{
                  'name': 'RESTART_TIME',
                  'value': str(datetime.datetime.now())
                }]
              }]
            }
          }
        }
      }, api_prefix='apis/extensions/v1beta1', content_type='application/strategic-merge-patch+json'))

  def _assert_success(self, response):
    if response.status_code != 200:
      logger.error('Kubernetes API call failed with response: %s => %s', response.status_code,
                   response.text)
      raise Exception('Kubernetes API call failed: %s' % response.text)

  def _update_secret_file(self, relative_file_path, value=None):
    if '/' in relative_file_path:
      raise Exception('Expected path from get_volume_path, but found slashes')

    # Check first that the namespace for Quay Enterprise exists. If it does not, report that
    # as an error, as it seems to be a common issue.
    namespace_url = 'namespaces/%s' % (self.kube_config.qe_namespace)
    response = self._execute_k8s_api('GET', namespace_url)
    if response.status_code // 100 != 2:
      msg = 'A Kubernetes namespace with name `%s` must be created to save config' % self.kube_config.qe_namespace
      raise Exception(msg)

    # Check if the secret exists. If not, then we create an empty secret and then update the file
    # inside.
    secret_url = 'namespaces/%s/secrets/%s' % (self.kube_config.qe_namespace, self.kube_config.qe_config_secret)
    secret = self._lookup_secret()
    if secret is None:
      self._assert_success(self._execute_k8s_api('POST', secret_url, {
        "kind": "Secret",
        "apiVersion": "v1",
        "metadata": {
          "name": self.kube_config.qe_config_secret
        },
        "data": {}
      }))

    # Update the secret to reflect the file change.
    secret['data'] = secret.get('data', {})

    if value is not None:
      secret['data'][relative_file_path] = base64.b64encode(value)
    else:
      secret['data'].pop(relative_file_path)

    self._assert_success(self._execute_k8s_api('PUT', secret_url, secret))

  def _lookup_secret(self):
    secret_url = 'namespaces/%s/secrets/%s' % (self.kube_config.qe_namespace, self.kube_config.qe_config_secret)
    response = self._execute_k8s_api('GET', secret_url)
    if response.status_code != 200:
      return None
    return json.loads(response.text)

  def _execute_k8s_api(self, method, relative_url, data=None, api_prefix='api/v1', content_type='application/json'):
    headers = {
      'Authorization': 'Bearer ' + self.kube_config.service_account_token
    }

    if data:
      headers['Content-Type'] = content_type

    data = json.dumps(data) if data else None
    session = Session()
    url = 'https://%s/%s/%s' % (self.kube_config.api_host, api_prefix, relative_url)

    request = Request(method, url, data=data, headers=headers)
    return session.send(request.prepare(), verify=False, timeout=2)