Merge branch 'RESTAPI-973-redeploy-k8s-on-conf-change' into 'master'

Added reloader to redeploy on change See merge request firecrest/firecrest!257
eth-cscs · Dec 11, 2023 · f6c465c · f6c465c
2 parents 009767f + 252e8c7
commit f6c465c
Show file tree

Hide file tree

Showing 18 changed files with 93 additions and 21 deletions.
diff --git a/deploy/k8s/certificator/templates/cm.certificator.yaml b/deploy/k8s/certificator/templates/cm.certificator.yaml
@@ -10,3 +10,5 @@ kind: ConfigMap
 metadata:
   name: certificator-env-file
   namespace: {{ .Values.global.namespace }}
+  annotations:
+    reloader.stakater.com/match: "true"
diff --git a/deploy/k8s/certificator/templates/deploy.certificator.yaml b/deploy/k8s/certificator/templates/deploy.certificator.yaml
@@ -5,6 +5,11 @@ items:
   metadata:
     name: deploy-certificator
     namespace: {{ .Values.global.namespace }}
+    {{ if ne .Values.global.environment "dev" }}
+    annotations:
+      configmap.reloader.stakater.com/reload: "certificator-env-file,common-env-file"
+      secret.reloader.stakater.com/reload: "firecrest-ca-key-secret"
+    {{ end }}
   spec:
     selector:
       matchLabels:

diff --git a/deploy/k8s/compute/templates/cm.compute.yaml b/deploy/k8s/compute/templates/cm.compute.yaml
@@ -9,3 +9,5 @@ kind: ConfigMap
 metadata:
   name: compute-env-file
   namespace: {{ .Values.global.namespace }}
+  annotations:
+    reloader.stakater.com/match: "true"
diff --git a/deploy/k8s/compute/templates/deploy.compute.yaml b/deploy/k8s/compute/templates/deploy.compute.yaml
@@ -3,6 +3,10 @@ kind: Deployment
 metadata:
   name: deploy-compute
   namespace: {{ .Values.global.namespace }}
+  {{ if ne .Values.global.environment "dev" }}
+  annotations:
+    configmap.reloader.stakater.com/reload: "compute-env-file,common-env-file"    
+  {{ end }}
 spec:
   replicas: 1
   selector:

diff --git a/deploy/k8s/config/templates/_helpers.tpl b/deploy/k8s/config/templates/_helpers.tpl
@@ -0,0 +1,15 @@
+{{- define "list.listPubKeys" -}}
+{{- $map := dict }}
+{{- range .Values.global.auth }}
+{{- $_ := set $map .F7T_AUTH_REALM_PUBKEY ""}}
+{{- end }}
+{{- keys $map | join ";" }}
+{{- end }}
+
+{{- define "list.listPubKeyTypes" -}}
+{{- $map := dict }}
+{{- range .Values.global.auth }}
+{{- $_ := set $map .F7T_AUTH_REALM_TYPE ""}}
+{{- end }}
+{{- keys $map | join ";" }}
+{{- end }}
diff --git a/deploy/k8s/config/templates/cm.common.yaml b/deploy/k8s/config/templates/cm.common.yaml
@@ -18,8 +18,8 @@ data:
   F7T_JAEGER_AGENT: "{{ .Values.F7T_JAEGER_AGENT }}"
   F7T_KONG_URL: "{{ .Values.F7T_KONG_URL }}"  
   F7T_OBJECT_STORAGE: "{{ .Values.F7T_OBJECT_STORAGE }}"
-  F7T_REALM_RSA_PUBLIC_KEY: "{{ .Values.global.F7T_AUTH_REALM_PUBKEY }}"
-  F7T_REALM_RSA_TYPE: "{{ .Values.global.F7T_AUTH_REALM_TYPE }}"
+  F7T_REALM_RSA_PUBLIC_KEY: '{{ include "list.listPubKeys" . }}'
+  F7T_REALM_RSA_TYPE: '{{ include "list.listPubKeyTypes" . }}'
   F7T_SSH_CERTIFICATE_WRAPPER: "{{ .Values.F7T_SSH_CERTIFICATE_WRAPPER }}"
   F7T_SSL_CRT: "{{ .Values.F7T_SSL_CRT }}"
   F7T_SSL_KEY: "{{ .Values.F7T_SSL_KEY }}"
@@ -33,3 +33,5 @@ kind: ConfigMap
 metadata:
   name: common-env-file
   namespace: {{ .Values.global.namespace }}
+  annotations:
+    reloader.stakater.com/match: "true"
diff --git a/deploy/k8s/kong/templates/cm.kong.yaml b/deploy/k8s/kong/templates/cm.kong.yaml
@@ -5,6 +5,8 @@ items:
   metadata:
     name: f7t-kong
     namespace: {{ .Values.global.namespace }}
+    annotations:
+      reloader.stakater.com/match: "true"
   data:
     kong.yaml: |
       _format_version: "1.1"
@@ -44,18 +46,23 @@ items:
           - Content-Type
           credentials: false
           max_age: 3600
+
       consumers:
-      - username: firecrest
-        custom_id: firecrest
+      {{- range .Values.global.auth }}
+      - username: {{ .username }}
+        custom_id: {{ .username }}
+      {{- end }}
       - username: docs
         custom_id: docs
 
+      {{- range .Values.global.auth }}
       jwt_secrets:
-      - consumer: firecrest
-        key: "{{ .Values.global.F7T_AUTH_URL }}/auth/realms/{{ .Values.global.F7T_AUTH_REALM }}"
-        algorithm: "{{ .Values.global.F7T_AUTH_REALM_TYPE }}"
-        rsa_public_key: "-----BEGIN PUBLIC KEY-----\n{{ .Values.global.F7T_AUTH_REALM_PUBKEY }}\n-----END PUBLIC KEY-----"
-
+      - key: "{{ .F7T_AUTH_URL }}/auth/realms/{{ .F7T_AUTH_REALM }}"
+        algorithm: "{{ .F7T_AUTH_REALM_TYPE }}"
+        rsa_public_key: "-----BEGIN PUBLIC KEY-----\n{{ .F7T_AUTH_REALM_PUBKEY }}\n-----END PUBLIC KEY-----"
+        consumer: "{{ .username }}"
+      {{- end }}
+        
       routes:
       - name: reject
         # rejects any undefined route with 'request-termination' plugin

diff --git a/deploy/k8s/kong/templates/deploy.kong.yaml b/deploy/k8s/kong/templates/deploy.kong.yaml
@@ -3,6 +3,10 @@ kind: Deployment
 metadata:
   name: deploy-kong
   namespace: {{ .Values.global.namespace }}
+  {{ if ne .Values.global.environment "dev" }}
+  annotations:
+    configmap.reloader.stakater.com/reload: "f7t-kong,common-env-file"    
+  {{ end }}
 spec:
   replicas: 1
   selector:

diff --git a/deploy/k8s/status/templates/cm.status.yaml b/deploy/k8s/status/templates/cm.status.yaml
@@ -7,3 +7,5 @@ kind: ConfigMap
 metadata:
   name: status-env-file
   namespace: {{ .Values.global.namespace }}
+  annotations:
+    reloader.stakater.com/match: "true"
diff --git a/deploy/k8s/status/templates/deploy.status.yaml b/deploy/k8s/status/templates/deploy.status.yaml
@@ -3,6 +3,10 @@ kind: Deployment
 metadata:
   name: deploy-status
   namespace: {{ .Values.global.namespace }}
+  {{ if ne .Values.global.environment "dev" }}
+  annotations:
+    configmap.reloader.stakater.com/reload: "status-env-file,common-env-file"
+  {{ end }}
 spec:
   replicas: 1
   selector:

diff --git a/deploy/k8s/storage/templates/cm.storage.yaml b/deploy/k8s/storage/templates/cm.storage.yaml
@@ -28,3 +28,5 @@ kind: ConfigMap
 metadata:
   name: storage-env-file
   namespace: {{ .Values.global.namespace }}
+  annotations:
+    reloader.stakater.com/match: "true"
diff --git a/deploy/k8s/storage/templates/deploy.storage.yaml b/deploy/k8s/storage/templates/deploy.storage.yaml
@@ -3,6 +3,11 @@ kind: Deployment
 metadata:
   name: deploy-storage
   namespace: {{ .Values.global.namespace }}
+  {{ if ne .Values.global.environment "dev" }}
+  annotations:
+    configmap.reloader.stakater.com/reload: "storage-env-file,common-env-file"
+    secret.reloader.stakater.com/reload: "firecrest-common-secrets"
+  {{ end }}
 spec:
   replicas: 1
   selector:

diff --git a/deploy/k8s/tasks/templates/cm.tasks.yaml b/deploy/k8s/tasks/templates/cm.tasks.yaml
@@ -3,9 +3,11 @@ data:
   F7T_TASKS_PORT: "{{ .Values.F7T_TASKS_PORT }}"
   F7T_PERSISTENCE_IP: "{{ .Values.F7T_PERSISTENCE_IP }}"
   F7T_PERSIST_PORT: "{{ .Values.F7T_PERSIST_PORT }}"
-  F7T_COMPUTE_TASK_EXP_TIME: "{{ .Values.F7T_COMPUTE_TASK_EXP_TIME }}"
-  F7T_STORAGE_TASK_EXP_TIME: "{{ .Values.F7T_STORAGE_TASK_EXP_TIME }}"
+  F7T_COMPUTE_TASK_EXP_TIME: "{{ .Values.F7T_COMPUTE_TASK_EXP_TIME | toString }}"
+  F7T_STORAGE_TASK_EXP_TIME: "{{ .Values.F7T_STORAGE_TASK_EXP_TIME | toString }}"
 kind: ConfigMap
 metadata:
   name: tasks-env-file
   namespace: {{ .Values.global.namespace }}
+  annotations:
+    reloader.stakater.com/match: "true"
diff --git a/deploy/k8s/tasks/templates/deploy.tasks.yaml b/deploy/k8s/tasks/templates/deploy.tasks.yaml
@@ -3,6 +3,11 @@ kind: Deployment
 metadata:
   name: deploy-tasks
   namespace: {{ .Values.global.namespace }}
+  {{ if ne .Values.global.environment "dev" }}
+  annotations:
+    configmap.reloader.stakater.com/reload: "tasks-env-file,common-env-file"
+    secret.reloader.stakater.com/reload: "firecrest-common-secrets"
+  {{ end }}
 spec:
   replicas: 1
   selector:
@@ -41,7 +46,7 @@ spec:
         - mountPath: /var/log
           name: logs-endpoint
         - mountPath: /data
-          name: data-endpoint
+          name: redis-data
         - mountPath: /redis
           name: redis-config
 
@@ -82,8 +87,13 @@ spec:
       volumes:
       - name: logs-endpoint
         emptyDir: {}
-      - name: data-endpoint
+      - name: redis-data
+        {{ if ne .Values.global.environment "dev" }}
+        persistentVolumeClaim:
+          claimName: firecrest-redis-pvc
+        {{ else }}
         emptyDir: {}
+        {{ end }}
       - name: redis-config
         configMap:
           name: f7t-redis

diff --git a/deploy/k8s/utilities/templates/cm.utilities.yaml b/deploy/k8s/utilities/templates/cm.utilities.yaml
@@ -5,3 +5,5 @@ kind: ConfigMap
 metadata:
   name: utilities-env-file
   namespace: {{ .Values.global.namespace }}
+  annotations:
+    reloader.stakater.com/match: "true"
diff --git a/deploy/k8s/utilities/templates/deploy.utilities.yaml b/deploy/k8s/utilities/templates/deploy.utilities.yaml
@@ -3,6 +3,10 @@ kind: Deployment
 metadata:
   name: deploy-utilities
   namespace: {{ .Values.global.namespace }}
+  {{ if ne .Values.global.environment "dev" }}
+  annotations:
+    configmap.reloader.stakater.com/reload: "utilities-env-file,common-env-file"    
+  {{ end }}
 spec:
   replicas: 1
   selector:

diff --git a/deploy/k8s/values-dev.yaml b/deploy/k8s/values-dev.yaml
@@ -19,8 +19,6 @@ F7T_JAEGER_AGENT: svc-jaeger
 F7T_KONG_URL: http://svc-kong:8000
 F7T_BASE_URL: http://svc-kong:8000
 F7T_OBJECT_STORAGE: s3v4
-F7T_REALM_RSA_PUBLIC_KEY: 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqB44q32bQp8LbyW6dQvgsjseXESkLT1g5LQKGb+P79AC+nOAtxhn8i/kmgc6zsQH8NlUtNJruLxlzdo2/OGmlDGYZH1x6VmAwvJPJ4er0xPUrvZ8YclxYQC16PY5LFiQRNBMRyQwP5Kne1O46FpmADFVWMfoabdnaqoXexxB56b25o8tE2ulRBgfpnrRgZAvf7kWjugRCNO06FV074FVMYHA1aBk0ICyaFCDM/Tb5oaDyGr5c/ZvdrRUrw8vaiYyMgaAnnJPL75cebGoHeMJaEyZalsHA+iuhRAfeAwpSClsmhVqnfH7a7hqrqumVRo27dydqmfVgpFjU5gbFcBZ5wIDAQAB'
-F7T_REALM_RSA_TYPE: RS256
 F7T_RESERVATIONS_URL: https://svc-reservations:5005
 F7T_SSH_CERTIFICATE_WRAPPER: True
 F7T_SSL_CRT: /f7t-ssl.crt
@@ -93,7 +91,9 @@ global:
   F7T_UTILITIES_HOST: "https://svc-utilities"
   F7T_RESERVATIONS_PORT: "5005"
   F7T_RESERVATIONS_HOST: "https://svc-reservations"
-  F7T_AUTH_URL: "http://svc-keycloak:8080"
-  F7T_AUTH_REALM: "kcrealm"
-  F7T_AUTH_REALM_PUBKEY: 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqB44q32bQp8LbyW6dQvgsjseXESkLT1g5LQKGb+P79AC+nOAtxhn8i/kmgc6zsQH8NlUtNJruLxlzdo2/OGmlDGYZH1x6VmAwvJPJ4er0xPUrvZ8YclxYQC16PY5LFiQRNBMRyQwP5Kne1O46FpmADFVWMfoabdnaqoXexxB56b25o8tE2ulRBgfpnrRgZAvf7kWjugRCNO06FV074FVMYHA1aBk0ICyaFCDM/Tb5oaDyGr5c/ZvdrRUrw8vaiYyMgaAnnJPL75cebGoHeMJaEyZalsHA+iuhRAfeAwpSClsmhVqnfH7a7hqrqumVRo27dydqmfVgpFjU5gbFcBZ5wIDAQAB'
-  F7T_AUTH_REALM_TYPE: "RS256"
+  auth:
+    - username: kc-demo
+      F7T_AUTH_URL: "http://svc-keycloak:8080"
+      F7T_AUTH_REALM: "kcrealm"
+      F7T_AUTH_REALM_PUBKEY: 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqB44q32bQp8LbyW6dQvgsjseXESkLT1g5LQKGb+P79AC+nOAtxhn8i/kmgc6zsQH8NlUtNJruLxlzdo2/OGmlDGYZH1x6VmAwvJPJ4er0xPUrvZ8YclxYQC16PY5LFiQRNBMRyQwP5Kne1O46FpmADFVWMfoabdnaqoXexxB56b25o8tE2ulRBgfpnrRgZAvf7kWjugRCNO06FV074FVMYHA1aBk0ICyaFCDM/Tb5oaDyGr5c/ZvdrRUrw8vaiYyMgaAnnJPL75cebGoHeMJaEyZalsHA+iuhRAfeAwpSClsmhVqnfH7a7hqrqumVRo27dydqmfVgpFjU5gbFcBZ5wIDAQAB'
+      F7T_AUTH_REALM_TYPE: "RS256"
diff --git a/src/common/cscs_api_common.py b/src/common/cscs_api_common.py
@@ -41,9 +41,9 @@ def get_boolean_var(var):
 # var <- object
 # returns -> value | None 
 def get_null_var(var):
-    var = str(var).upper()
+    _var = str(var).upper()
 
-    return None if (len(var) == 0 or var == "NONE" or var == "NULL") else var
+    return None if (len(_var) == 0 or _var == "NONE" or _var == "NULL") else var
 
 
 DEBUG_MODE = get_boolean_var(os.environ.get("F7T_DEBUG_MODE", False))