Merge pull request #209 from whole-tale/env_api_key

Propagate girder API key to instances

Author: Xarthisius

gwvolman/tasks_kubernetes.py

@@ -17,6 +17,7 @@
     _get_user_and_instance,
     new_user,
     _get_container_config,
+    _get_api_key,
 )
 from .utils_k8s import tale_deployment, tale_service, tale_ingress
 
@@ -172,6 +173,7 @@ def launch_container(self, task, payload):
             "claimName": K8SDeployment.existing_claim,
             "claimSubPath": K8SDeployment.existing_claim_subpath,
             "girderApiUrl": girder_api_url,
+            "girderApiKey": _get_api_key(task.girder_client),
             "mounterImage": self.deployment.mounter_image,
             "instanceId": instanceId,
             "girderToken": task.girder_client.token,
@@ -197,6 +199,7 @@ def launch_container(self, task, payload):
         template_params["girderfsDef"] = {
             "mounts": payload["mounts"],
             "girderApiUrl": girder_api_url,
+            "girderApiKey": _get_api_key(task.girder_client),
             "girderToken": task.girder_client.token,
             "taleId": tale["_id"],
             "userId": user["_id"],

gwvolman/utils.py

@@ -87,7 +87,7 @@ class K8SDeployment(object):
 
     __name__ = "K8SDeployment"
     dashboard_url = f"https://dashboard.{DOMAIN}"
-    #girder_url = f"http://{os.environ.get('GIRDER_SERVICE_HOST')}:8080"
+    # girder_url = f"http://{os.environ.get('GIRDER_SERVICE_HOST')}:8080"
     girder_url = f"https://girder.{DOMAIN}"
     registry_url = f"https://registry.{DOMAIN}"
     builder_url = os.environ.get("BUILDER_URL", "https://builder.{DOMAIN}")
@@ -107,6 +107,7 @@ class DockerDeployment(object):
     This class allows to read and store configuration of services in a WT
     deployment. It's meant to be used as a singleton across gwvolman.
     """
+
     __name__ = "DockerDeployment"
     _dashboard_url = None
     _girder_url = None
@@ -296,19 +297,24 @@ def _launch_container(volume_info, container_config, gc):
 
     # inject Girder token into the container
     environment = container_config.environment or []
-    environment += [f"GIRDER_TOKEN={gc.token}", f"GIRDER_API_URL={gc.urlBase}"]
+    environment += [
+        f"GIRDER_TOKEN={gc.token}",
+        f"GIRDER_API_URL={gc.urlBase}",
+        f"GIRDER_API_KEY={_get_api_key(gc)}",
+    ]
 
     source_mount = os.path.join(VOLUMES_ROOT, "mountpoints", volume_info["volumeName"])
     mounts = []
     volumes = _get_container_volumes(source_mount, container_config, MOUNTPOINTS)
     user = gc.get("/user/me")
     volumes[os.path.join(VOLUMES_ROOT, f"homes/{user['login'][0]}/{user['login']}")] = {
-        "bind": os.path.join(container_config.target_mount, "home"), "mode": "rw"
+        "bind": os.path.join(container_config.target_mount, "home"),
+        "mode": "rw",
     }
     tale = gc.get("/tale/%s" % volume_info["taleId"])
-    volumes[os.path.join(VOLUMES_ROOT, f"workspaces/{tale['_id'][0]}/{tale['_id']}")] = {
-        "bind": os.path.join(container_config.target_mount, "workspace"), "mode": "rw"
-    }
+    volumes[
+        os.path.join(VOLUMES_ROOT, f"workspaces/{tale['_id'][0]}/{tale['_id']}")
+    ] = {"bind": os.path.join(container_config.target_mount, "workspace"), "mode": "rw"}
 
     for source in volumes:
         mounts.append(
@@ -317,7 +323,7 @@ def _launch_container(volume_info, container_config, gc):
             )
         )
 
-    host = 'tmp-{}'.format(new_user(12).lower())
+    host = "tmp-{}".format(new_user(12).lower())
     environment.append(f"TMP_URL={host}.{DOMAIN}")
 
     # https://github.com/containous/traefik/issues/2582#issuecomment-354107053

gwvolman/utils_k8s.py

@@ -1,11 +1,35 @@
 import json
 import os
+import re
 
 from kubernetes import client, config
 
 from .constants import NFS_PATH, NFS_SERVER, VOLUMES_ROOT
 
 
+def split_and_clean_quotes(input_string):
+    """
+    Splits a string by whitespace, ignoring whitespace within single quotes,
+    and removes the surrounding single quotes from the resulting quoted tokens.
+    """
+    # 1. Find all tokens (quoted or unquoted)
+    pattern = r"'[^']+'|\S+"
+    tokens = re.findall(pattern, input_string)
+
+    # 2. Clean the quotes from the found tokens
+    cleaned_tokens = []
+    for token in tokens:
+        # Check if the token starts and ends with a single quote
+        if token.startswith("'") and token.endswith("'"):
+            # Remove the first and last character (the quotes)
+            cleaned_tokens.append(token[1:-1])
+        else:
+            # Keep unquoted tokens as they are
+            cleaned_tokens.append(token)
+
+    return cleaned_tokens
+
+
 def tale_ingress(params: dict) -> None:
     host = f"{params['host']}.{params['domain']}"
     annotations = {
@@ -193,7 +217,9 @@ def tale_deployment(params):
             client.V1VolumeMount(
                 mount_path=os.path.join(params["mountPoint"], "workspace"),
                 name=params["claimName"],
-                sub_path=os.path.join(params["claimSubPath"], params["workspaceSubPath"]),
+                sub_path=os.path.join(
+                    params["claimSubPath"], params["workspaceSubPath"]
+                ),
             ),
             client.V1VolumeMount(
                 mount_path=os.path.join(params["mountPoint"], "home"),
@@ -214,6 +240,7 @@ def tale_deployment(params):
         ]
 
     # Apply the deployment
+    command_array = split_and_clean_quotes(params["command"])
     api_instance = client.AppsV1Api()
     api_instance.create_namespaced_deployment(
         body=client.V1Deployment(
@@ -248,7 +275,8 @@ def tale_deployment(params):
                         containers=[
                             client.V1Container(
                                 name="instance",
-                                command=params["command"].split(" "),
+                                command=[command_array[0]],
+                                args=command_array[1:],
                                 image=params["instanceImage"],
                                 ports=[
                                     client.V1ContainerPort(
@@ -266,6 +294,20 @@ def tale_deployment(params):
                                         "cpu": "1",
                                     },
                                 ),
+                                env=[
+                                    client.V1EnvVar(
+                                        name="GIRDER_API_KEY",
+                                        value=params["girderApiKey"],
+                                    ),
+                                    client.V1EnvVar(
+                                        name="GIRDER_API_URL",
+                                        value=params["girderApiUrl"],
+                                    ),
+                                    client.V1EnvVar(
+                                        name="TMP_URL",
+                                        value=f"{params['host']}.{params['domain']}",
+                                    ),
+                                ],
                             ),
                             client.V1Container(
                                 name="mounter",

setup.py

@@ -2,7 +2,7 @@
 
 setup(
     name="gwvolman",
-    version="2.1.2",
+    version="2.1.3",
     description="WholeTale Girder Volume Manager",
     author="Kacper Kowalik",
     author_email="[email protected]",

tests/test_tasks_kubernetes.py

@@ -38,6 +38,8 @@ def mock_gc_get(path, parameters=None):
         }
     elif path == "/run/123abc":
         return {"_id": "123abc", "name": "run1", "runVersionId": "xyz234"}
+    elif path == "/api_key":
+        return [{"name": "tmpnb", "active": True, "key": "girderApiKey"}]
 
 
 @pytest.fixture