Add Kubernetes configuration provider which writes config to a secret

Fixes #145

util/config/provider/__init__.py

@@ -1,10 +1,16 @@
 from util.config.provider.fileprovider import FileConfigProvider
 from util.config.provider.testprovider import TestConfigProvider
+from util.config.provider.k8sprovider import KubernetesConfigProvider
 
-def get_config_provider(config_volume, yaml_filename, py_filename, testing=False):
+import os
+
+def get_config_provider(config_volume, yaml_filename, py_filename, testing=False, kubernetes=False):
   """ Loads and returns the config provider for the current environment. """
   if testing:
     return TestConfigProvider()
 
+  if kubernetes:
+    return KubernetesConfigProvider(config_volume, yaml_filename, py_filename)
+
   return FileConfigProvider(config_volume, yaml_filename, py_filename)
 

util/config/provider/baseprovider.py

@@ -24,10 +24,13 @@ def import_yaml(config_obj, config_file):
   return config_obj
 
 
+def get_yaml(config_obj):
+  return yaml.safe_dump(config_obj, encoding='utf-8', allow_unicode=True)
+
 def export_yaml(config_obj, config_file):
   try:
     with open(config_file, 'w') as f:
-      f.write(yaml.safe_dump(config_obj, encoding='utf-8', allow_unicode=True))
+      f.write(get_yaml(config_obj))
   except IOError as ioe:
     raise CannotWriteConfigException(str(ioe))
 
@@ -36,20 +39,24 @@ class BaseProvider(object):
   """ A configuration provider helps to load, save, and handle config override in the application.
   """
 
+  @property
+  def provider_id(self):
+    raise NotImplementedError
+
   def update_app_config(self, app_config):
     """ Updates the given application config object with the loaded override config. """
     raise NotImplementedError
 
-  def get_yaml(self):
-    """ Returns the contents of the YAML config override file, or None if none. """
+  def get_config(self):
+    """ Returns the contents of the config override file, or None if none. """
     raise NotImplementedError
 
-  def save_yaml(self, config_object):
-    """ Updates the contents of the YAML config override file to those given. """
+  def save_config(self, config_object):
+    """ Updates the contents of the config override file to those given. """
     raise NotImplementedError
 
-  def yaml_exists(self):
-    """ Returns true if a YAML config override file exists in the config volume. """
+  def config_exists(self):
+    """ Returns true if a config override file exists in the config volume. """
     raise NotImplementedError
 
   def volume_exists(self):

util/config/provider/fileprovider.py

@@ -16,6 +16,10 @@ class FileConfigProvider(BaseProvider):
     self.yaml_path = os.path.join(config_volume, yaml_filename)
     self.py_path = os.path.join(config_volume, py_filename)
 
+  @property
+  def provider_id(self):
+    return 'file'
+
   def update_app_config(self, app_config):
     if os.path.exists(self.py_path):
       logger.debug('Applying config file: %s', self.py_path)
@@ -25,7 +29,7 @@ class FileConfigProvider(BaseProvider):
       logger.debug('Applying config file: %s', self.yaml_path)
       import_yaml(app_config, self.yaml_path)
 
-  def get_yaml(self):
+  def get_config(self):
     if not os.path.exists(self.yaml_path):
       return None
 
@@ -33,10 +37,10 @@ class FileConfigProvider(BaseProvider):
     import_yaml(config_obj, self.yaml_path)
     return config_obj
 
-  def save_yaml(self, config_obj):
+  def save_config(self, config_obj):
     export_yaml(config_obj, self.yaml_path)
 
-  def yaml_exists(self):
+  def config_exists(self):
     return self.volume_file_exists(self.yaml_filename)
 
   def volume_exists(self):
@@ -49,13 +53,16 @@ class FileConfigProvider(BaseProvider):
     return open(os.path.join(self.config_volume, filename), mode)
 
   def save_volume_file(self, filename, flask_file):
+    filepath = os.path.join(self.config_volume, filename)
     try:
-      flask_file.save(os.path.join(self.config_volume, filename))
+      flask_file.save(filepath)
     except IOError as ioe:
       raise CannotWriteConfigException(str(ioe))
 
+    return filepath
+
   def requires_restart(self, app_config):
-    file_config = self.get_yaml()
+    file_config = self.get_config()
     if not file_config:
       return False
 

util/config/provider/k8sprovider.py

@@ -0,0 +1,109 @@
+import os
+import logging
+import json
+import base64
+
+from requests import Request, Session
+
+from util.config.provider.baseprovider import get_yaml, CannotWriteConfigException
+from util.config.provider.fileprovider import FileConfigProvider
+
+logger = logging.getLogger(__name__)
+
+KUBERNETES_API_HOST = 'kubernetes.default.svc.cluster.local'
+
+SERVICE_ACCOUNT_TOKEN_PATH = '/var/run/secrets/kubernetes.io/serviceaccount/token'
+
+ER_NAMESPACE = 'quay'
+ER_CONFIG_SECRET = 'quay-config-secret'
+
+class KubernetesConfigProvider(FileConfigProvider):
+  """ Implementation of the config provider that reads and writes configuration
+      data from a Kubernetes Secret. """
+  def __init__(self, config_volume, yaml_filename, py_filename):
+    super(KubernetesConfigProvider, self).__init__(config_volume, yaml_filename, py_filename)
+
+    self.yaml_filename = yaml_filename
+
+    # Load the service account token from the local store.
+    if not os.path.exists(SERVICE_ACCOUNT_TOKEN_PATH):
+      raise Exception('Cannot load Kubernetes service account token')
+
+    with open(SERVICE_ACCOUNT_TOKEN_PATH, 'r') as f:
+      self._service_token = f.read()
+
+    # Make sure the configuration volume exists.
+    if not self.volume_exists():
+      os.makedirs(config_volume)
+
+  @property
+  def provider_id(self):
+    return 'k8s'
+
+  def save_config(self, config_obj):
+    self._update_secret_file(self.yaml_filename, get_yaml(config_obj))
+    super(KubernetesConfigProvider, self).save_config(config_obj)
+
+  def save_volume_file(self, filename, flask_file):
+    filepath = super(KubernetesConfigProvider, self).save_volume_file(filename, flask_file)
+
+    try:
+      with open(filepath, 'r') as f:
+        self._update_secret_file(filename, f.read())
+    except IOError as ioe:
+      raise CannotWriteConfigException(str(ioe))
+
+  def _assert_success(self, response):
+    if response.status_code != 200:
+      logger.error('K8s API call failed with response: %s => %s', response.status_code,
+                   response.text)
+      raise CannotWriteConfigException('K8s API call failed. Please report this to support')
+
+  def _update_secret_file(self, filename, value):
+    secret_data = {}
+    secret_data[filename] = base64.b64encode(value)
+
+    data = {
+      "kind": "Secret",
+      "apiVersion": "v1",
+      "metadata": {
+        "name": ER_CONFIG_SECRET
+      },
+      "data": secret_data
+    }
+
+    secret_url = 'namespaces/%s/secrets/%s' % (ER_NAMESPACE, ER_CONFIG_SECRET)
+    secret = self._lookup_secret()
+    if not secret:
+      self._assert_success(self._execute_k8s_api('POST', secret_url, data))
+      return
+
+    if not 'data' in secret:
+      secret['data'] = {}
+
+    secret['data'][filename] = base64.b64encode(value)
+    self._assert_success(self._execute_k8s_api('PUT', secret_url, secret))
+
+
+  def _lookup_secret(self):
+    secret_url = 'namespaces/%s/secrets/%s' % (ER_NAMESPACE, ER_CONFIG_SECRET)
+    response = self._execute_k8s_api('GET', secret_url)
+    if response.status_code != 200:
+      return None
+
+    return json.loads(response.text)
+
+  def _execute_k8s_api(self, method, relative_url, data=None):
+    headers = {
+      'Authorization': 'Bearer ' + self._service_token
+    }
+
+    if data:
+      headers['Content-Type'] = 'application/json'
+
+    data = json.dumps(data) if data else None
+    session = Session()
+    url = 'https://%s/api/v1/%s' % (KUBERNETES_API_HOST, relative_url)
+
+    request = Request(method, url, data=data, headers=headers)
+    return session.send(request.prepare(), verify=False, timeout=2)

util/config/provider/testprovider.py

@@ -10,19 +10,23 @@ class TestConfigProvider(BaseProvider):
     self.files = {}
     self._config = None
 
+  @property
+  def provider_id(self):
+    return 'test'
+
   def update_app_config(self, app_config):
     self._config = app_config
 
-  def get_yaml(self):
+  def get_config(self):
     if not 'config.yaml' in self.files:
       return None
 
     return json.loads(self.files.get('config.yaml', '{}'))
 
-  def save_yaml(self, config_obj):
+  def save_config(self, config_obj):
     self.files['config.yaml'] = json.dumps(config_obj)
 
-  def yaml_exists(self):
+  def config_exists(self):
     return 'config.yaml' in self.files
 
   def volume_exists(self):