Fix Kubernetes config provider for recent changes in Kub API

Kubernetes secret volumes are now mounted as read-only, so we have to write the files *only* via the Kub API

Fixes https://jira.coreos.com/browse/QUAY-911

util/config/provider/k8sprovider.py

@@ -2,11 +2,13 @@ import os
 import logging
 import json
 import base64
+import time
 
 from requests import Request, Session
 
-from util.config.provider.baseprovider import get_yaml, CannotWriteConfigException
-from util.config.provider.fileprovider import FileConfigProvider
+from util.config.provider.baseprovider import CannotWriteConfigException, get_yaml
+from util.config.provider.basefileprovider import BaseFileProvider
+
 
 logger = logging.getLogger(__name__)
 
@@ -20,14 +22,12 @@ SERVICE_ACCOUNT_TOKEN_PATH = '/var/run/secrets/kubernetes.io/serviceaccount/toke
 QE_NAMESPACE = os.environ.get('QE_K8S_NAMESPACE', 'quay-enterprise')
 QE_CONFIG_SECRET = os.environ.get('QE_K8S_CONFIG_SECRET', 'quay-enterprise-config-secret')
 
-class KubernetesConfigProvider(FileConfigProvider):
+class KubernetesConfigProvider(BaseFileProvider):
   """ Implementation of the config provider that reads and writes configuration
       data from a Kubernetes Secret. """
   def __init__(self, config_volume, yaml_filename, py_filename):
     super(KubernetesConfigProvider, self).__init__(config_volume, yaml_filename, py_filename)
 
-    self.yaml_filename = yaml_filename
-
     # Load the service account token from the local store.
     if not os.path.exists(SERVICE_ACCOUNT_TOKEN_PATH):
       raise Exception('Cannot load Kubernetes service account token')
@@ -35,48 +35,47 @@ class KubernetesConfigProvider(FileConfigProvider):
     with open(SERVICE_ACCOUNT_TOKEN_PATH, 'r') as f:
       self._service_token = f.read()
 
-    # Make sure the configuration volume exists.
-    if not self.volume_exists():
-      os.makedirs(config_volume)
-
   @property
   def provider_id(self):
     return 'k8s'
 
-  def save_config(self, config_obj):
-    self._update_secret_file(self.yaml_filename, get_yaml(config_obj))
-    super(KubernetesConfigProvider, self).save_config(config_obj)
+  def get_volume_path(self, directory, filename):
+    # NOTE: Overridden to ensure we don't have subdirectories, which aren't supported
+    # in Kubernetes secrets.
+    return "_".join([directory.rstrip('/'), filename])
 
-  def write_volume_file(self, filename, contents):
-    super(KubernetesConfigProvider, self).write_volume_file(filename, contents)
-
-    try:
-      self._update_secret_file(filename, contents)
-    except IOError as ioe:
-      raise CannotWriteConfigException(str(ioe))
-    
   def volume_file_exists(self, filename):
+    # NOTE: Overridden because we don't have subdirectories, which aren't supported
+    # in Kubernetes secrets.
     secret = self._lookup_secret()
     if not secret or not secret.get('data'):
       return False
     return filename in secret['data']
-    
 
   def list_volume_directory(self, path):
+    # NOTE: Overridden because we don't have subdirectories, which aren't supported
+    # in Kubernetes secrets.
     secret = self._lookup_secret()
-    
+
     if not secret:
       return []
-    
+
     paths = []
     for filename in secret.get('data', {}):
       if filename.startswith(path):
         paths.append(filename[len(path) + 1:])
     return paths
 
-  def remove_volume_file(self, filename):
-    super(KubernetesConfigProvider, self).remove_volume_file(filename)
+  def save_config(self, config_obj):
+    self._update_secret_file(self.yaml_filename, get_yaml(config_obj))
 
+  def write_volume_file(self, filename, contents):
+    try:
+      self._update_secret_file(filename, contents)
+    except IOError as ioe:
+      raise CannotWriteConfigException(str(ioe))
+
+  def remove_volume_file(self, filename):
     try:
       self._update_secret_file(filename, None)
     except IOError as ioe:
@@ -126,6 +125,27 @@ class KubernetesConfigProvider(FileConfigProvider):
 
     self._assert_success(self._execute_k8s_api('PUT', secret_url, secret))
 
+    # Wait until the local mounted copy of the secret has been updated, as
+    # this is an eventual consistency operation, but the caller expects immediate
+    # consistency.
+    while True:
+      matching_files = set()
+      for secret_filename, encoded_value in secret['data'].iteritems():
+        expected_value = base64.b64decode(encoded_value)
+        try:
+          with self.get_volume_file(secret_filename) as f:
+            contents = f.read()
+
+          if contents == expected_value:
+            matching_files.add(secret_filename)
+        except IOError:
+          continue
+
+      if matching_files == set(secret['data'].keys()):
+        break
+
+      # Sleep for a second and then try again.
+      time.sleep(1)
 
   def _lookup_secret(self):
     secret_url = 'namespaces/%s/secrets/%s' % (QE_NAMESPACE, QE_CONFIG_SECRET)
@@ -148,6 +168,3 @@ class KubernetesConfigProvider(FileConfigProvider):
 
     request = Request(method, url, data=data, headers=headers)
     return session.send(request.prepare(), verify=False, timeout=2)
-
-  def get_volume_path(self, directory, filename):
-    return "_".join([directory.rstrip('/'), filename])