Implement setup tool support for Clair

Fixes #1387

util/secscan/api.py

@@ -21,26 +21,23 @@ _API_METHOD_INSERT = 'layers'
 _API_METHOD_GET_LAYER = 'layers/%s'
 _API_METHOD_MARK_NOTIFICATION_READ = 'notifications/%s'
 _API_METHOD_GET_NOTIFICATION = 'notifications/%s'
+_API_METHOD_PING = 'metrics'
 
 
 class SecurityScannerAPI(object):
   """ Helper class for talking to the Security Scan service (Clair). """
-  def __init__(self, config, config_provider, storage):
-    self.config = config
-    self.config_provider = config_provider
+  def __init__(self, config, storage, client=None, skip_validation=False):
+    if not skip_validation:
+      config_validator = SecurityConfigValidator(config)
+      if not config_validator.valid():
+        logger.warning('Invalid config provided to SecurityScannerAPI')
+        return
 
+    self._config = config
+    self._client = client or config['HTTPCLIENT']
     self._storage = storage
-    self._security_config = None
-
-    config_validator = SecurityConfigValidator(config, config_provider)
-    if not config_validator.valid():
-      logger.warning('Invalid config provided to SecurityScannerAPI')
-      return
-
     self._default_storage_locations = config['DISTRIBUTED_STORAGE_PREFERENCE']
-
-    self._security_config = config.get('SECURITY_SCANNER')
-    self._target_version = self._security_config['ENGINE_VERSION_TARGET']
+    self._target_version = config.get('SECURITY_SCANNER_ENGINE_VERSION_TARGET', 2)
 
 
   def _get_image_url(self, image):
@@ -62,7 +59,7 @@ class SecurityScannerAPI(object):
     if uri is None:
       # Handle local storage.
       local_storage_enabled = False
-      for storage_type, _ in self.config.get('DISTRIBUTED_STORAGE_CONFIG', {}).values():
+      for storage_type, _ in self._config.get('DISTRIBUTED_STORAGE_CONFIG', {}).values():
         if storage_type == 'LocalStorage':
           local_storage_enabled = True
 
@@ -99,6 +96,23 @@ class SecurityScannerAPI(object):
     return request
 
 
+  def ping(self):
+    """ Calls GET on the metrics endpoint of the security scanner to ensure it is running
+        and properly configured. Returns the HTTP response.
+    """
+    try:
+      return self._call('GET', _API_METHOD_PING)
+    except requests.exceptions.Timeout:
+      logger.exception('Timeout when trying to connect to security scanner endpoint')
+      raise Exception('Timeout when trying to connect to security scanner endpoint')
+    except requests.exceptions.ConnectionError:
+      logger.exception('Connection error when trying to connect to security scanner endpoint')
+      raise Exception('Connection error when trying to connect to security scanner endpoint')
+    except (requests.exceptions.RequestException, ValueError):
+      logger.exception('Exception when trying to connect to security scanner endpoint')
+      raise Exception('Exception when trying to connect to security scanner endpoint')
+
+
   def analyze_layer(self, layer):
     """ Posts the given layer to the security scanner for analysis, blocking until complete.
         Returns a tuple containing the analysis version (on success, None on failure) and
@@ -122,6 +136,7 @@ class SecurityScannerAPI(object):
       logger.exception('Failed to post layer data response for %s', layer.id)
       return None, False
 
+
     # Handle any errors from the security scanner.
     if response.status_code != 201:
       message = json_response.get('Error').get('Message', '')
@@ -235,25 +250,23 @@ class SecurityScannerAPI(object):
         This function disconnects from the database while awaiting a response
         from the API server.
     """
-    security_config = self._security_config
-    if security_config is None:
+    if self._config is None:
       raise Exception('Cannot call unconfigured security system')
 
-    client = self.config['HTTPCLIENT']
+    client = self._client
     headers = {'Connection': 'close'}
 
-    timeout = security_config['API_TIMEOUT_SECONDS']
-    endpoint = security_config['ENDPOINT']
+    timeout = self._config.get('SECURITY_SCANNER_API_TIMEOUT_SECONDS', 10)
+    endpoint = self._config['SECURITY_SCANNER_ENDPOINT']
     if method != 'GET':
-      timeout = security_config.get('API_BATCH_TIMEOUT_SECONDS', timeout)
-      endpoint = security_config.get('ENDPOINT_BATCH', endpoint)
+      timeout = self._config.get('SECURITY_SCANNER_API_BATCH_TIMEOUT_SECONDS', timeout)
+      endpoint = self._config.get('SECURITY_SCANNER_ENDPOINT_BATCH') or endpoint
 
-    api_url = urljoin(endpoint, '/' + security_config['API_VERSION']) + '/'
+    api_url = urljoin(endpoint, '/' + self._config.get('SECURITY_SCANNER_API_VERSION', 'v1')) + '/'
     url = urljoin(api_url, relative_url)
-    signer_proxy_url = self.config.get('JWTPROXY_SIGNER', 'localhost:8080')
+    signer_proxy_url = self._config.get('JWTPROXY_SIGNER', 'localhost:8080')
 
-
-    with CloseForLongOperation(self.config):
+    with CloseForLongOperation(self._config):
       logger.debug('%sing security URL %s', method.upper(), url)
       return client.request(method, url, json=body, params=params, timeout=timeout,
                             verify='/conf/mitm.cert', headers=headers,