Examples with KubernetesFunctionAuthProvider org.apache.pulsar.functions.auth.KubernetesFunctionAuthProvider used on opensource projects

Example 1 with KubernetesFunctionAuthProvider

use of org.apache.pulsar.functions.auth.KubernetesFunctionAuthProvider in project pulsar by apache.

the class KubernetesRuntimeFactory method initialize.

@Override
public void initialize(WorkerConfig workerConfig, AuthenticationConfig authenticationConfig, SecretsProviderConfigurator secretsProviderConfigurator, ConnectorsManager connectorsManager, Optional<FunctionAuthProvider> functionAuthProvider, Optional<RuntimeCustomizer> runtimeCustomizer) {
    KubernetesRuntimeFactoryConfig factoryConfig = RuntimeUtils.getRuntimeFunctionConfig(workerConfig.getFunctionRuntimeFactoryConfigs(), KubernetesRuntimeFactoryConfig.class);
    this.k8Uri = factoryConfig.getK8Uri();
    if (!isEmpty(factoryConfig.getJobNamespace())) {
        this.jobNamespace = factoryConfig.getJobNamespace();
    } else {
        this.jobNamespace = "default";
    }
    if (!isEmpty(factoryConfig.getJobName())) {
        this.jobName = factoryConfig.getJobName();
    } else {
        this.jobName = null;
    }
    if (!isEmpty(factoryConfig.getPulsarDockerImageName())) {
        this.pulsarDockerImageName = factoryConfig.getPulsarDockerImageName();
    } else {
        this.pulsarDockerImageName = "apachepulsar/pulsar";
    }
    this.functionDockerImages = factoryConfig.getFunctionDockerImages();
    if (!isEmpty(factoryConfig.getImagePullPolicy())) {
        this.imagePullPolicy = factoryConfig.getImagePullPolicy();
    } else {
        this.imagePullPolicy = "IfNotPresent";
    }
    if (!isEmpty(factoryConfig.getPulsarRootDir())) {
        this.pulsarRootDir = factoryConfig.getPulsarRootDir();
    } else {
        this.pulsarRootDir = "/pulsar";
    }
    if (!isEmpty(factoryConfig.getConfigAdminCLI())) {
        this.configAdminCLI = factoryConfig.getConfigAdminCLI();
    } else {
        this.configAdminCLI = "/bin/pulsar-admin";
    }
    this.downloadDirectory = isNotEmpty(workerConfig.getDownloadDirectory()) ? workerConfig.getDownloadDirectory() : // for backward comp
    this.pulsarRootDir;
    if (!Paths.get(this.downloadDirectory).isAbsolute()) {
        this.downloadDirectory = this.pulsarRootDir + "/" + this.downloadDirectory;
    }
    this.submittingInsidePod = factoryConfig.getSubmittingInsidePod();
    this.installUserCodeDependencies = factoryConfig.getInstallUserCodeDependencies();
    this.pythonDependencyRepository = factoryConfig.getPythonDependencyRepository();
    this.pythonExtraDependencyRepository = factoryConfig.getPythonExtraDependencyRepository();
    if (StringUtils.isNotEmpty(factoryConfig.getExtraFunctionDependenciesDir())) {
        if (Paths.get(factoryConfig.getExtraFunctionDependenciesDir()).isAbsolute()) {
            this.extraDependenciesDir = factoryConfig.getExtraFunctionDependenciesDir();
        } else {
            this.extraDependenciesDir = this.pulsarRootDir + "/" + factoryConfig.getExtraFunctionDependenciesDir();
        }
    } else {
        this.extraDependenciesDir = this.pulsarRootDir + "/instances/deps";
    }
    this.customLabels = factoryConfig.getCustomLabels();
    this.percentMemoryPadding = factoryConfig.getPercentMemoryPadding();
    this.cpuOverCommitRatio = factoryConfig.getCpuOverCommitRatio();
    this.memoryOverCommitRatio = factoryConfig.getMemoryOverCommitRatio();
    this.gracePeriodSeconds = factoryConfig.getGracePeriodSeconds();
    this.pulsarServiceUrl = StringUtils.isEmpty(factoryConfig.getPulsarServiceUrl()) ? workerConfig.getPulsarServiceUrl() : factoryConfig.getPulsarServiceUrl();
    this.pulsarAdminUrl = StringUtils.isEmpty(factoryConfig.getPulsarAdminUrl()) ? workerConfig.getPulsarWebServiceUrl() : factoryConfig.getPulsarAdminUrl();
    this.stateStorageServiceUri = workerConfig.getStateStorageServiceUrl();
    this.authConfig = authenticationConfig;
    this.expectedMetricsCollectionInterval = factoryConfig.getExpectedMetricsCollectionInterval() == null ? -1 : factoryConfig.getExpectedMetricsCollectionInterval();
    this.changeConfigMap = factoryConfig.getChangeConfigMap();
    this.changeConfigMapNamespace = factoryConfig.getChangeConfigMapNamespace();
    this.functionInstanceMinResources = workerConfig.getFunctionInstanceMinResources();
    this.functionInstanceMaxResources = workerConfig.getFunctionInstanceMaxResources();
    this.functionInstanceResourceGranularities = workerConfig.getFunctionInstanceResourceGranularities();
    this.functionInstanceResourceChangeInLockStep = workerConfig.isFunctionInstanceResourceChangeInLockStep();
    this.secretsProviderConfigurator = secretsProviderConfigurator;
    this.authenticationEnabled = workerConfig.isAuthenticationEnabled();
    this.javaInstanceJarFile = this.pulsarRootDir + "/instances/java-instance.jar";
    this.pythonInstanceFile = this.pulsarRootDir + "/instances/python-instance/python_instance_main.py";
    this.serverCaBytes = workerConfig.getTlsTrustChainBytes();
    try {
        setupClient();
    } catch (Exception e) {
        log.error("Failed to setup client", e);
        throw new RuntimeException(e);
    }
    // make sure the provided class is a kubernetes auth provider, this needs to run before the authProvider!
    if (runtimeCustomizer.isPresent()) {
        if (!(runtimeCustomizer.get() instanceof KubernetesManifestCustomizer)) {
            throw new IllegalArgumentException("Function runtime customizer " + runtimeCustomizer.get().getClass().getName() + " must implement KubernetesManifestCustomizer");
        } else {
            KubernetesManifestCustomizer manifestCustomizer = (KubernetesManifestCustomizer) runtimeCustomizer.get();
            this.manifestCustomizer = Optional.of(manifestCustomizer);
        }
    } else {
        this.manifestCustomizer = Optional.empty();
    }
    // make sure the provided class is a kubernetes auth provider
    if (functionAuthProvider.isPresent()) {
        if (!(functionAuthProvider.get() instanceof KubernetesFunctionAuthProvider)) {
            throw new IllegalArgumentException("Function authentication provider " + functionAuthProvider.get().getClass().getName() + " must implement KubernetesFunctionAuthProvider");
        } else {
            KubernetesFunctionAuthProvider kubernetesFunctionAuthProvider = (KubernetesFunctionAuthProvider) functionAuthProvider.get();
            kubernetesFunctionAuthProvider.initialize(coreClient, serverCaBytes, (funcDetails) -> getRuntimeCustomizer().map((customizer) -> customizer.customizeNamespace(funcDetails, jobNamespace)).orElse(jobNamespace));
            this.authProvider = Optional.of(kubernetesFunctionAuthProvider);
        }
    } else {
        this.authProvider = Optional.empty();
    }
    this.grpcPort = factoryConfig.getGrpcPort();
    this.metricsPort = factoryConfig.getMetricsPort();
    this.narExtractionDirectory = factoryConfig.getNarExtractionDirectory();
    this.functionInstanceClassPath = factoryConfig.getFunctionInstanceClassPath();
}

Example 2 with KubernetesFunctionAuthProvider

use of org.apache.pulsar.functions.auth.KubernetesFunctionAuthProvider in project pulsar by apache.

the class KubernetesRuntime method submitStatefulSet.

private void submitStatefulSet() throws Exception {
    final V1StatefulSet statefulSet = createStatefulSet();
    // Configure function authentication if needed
    if (authenticationEnabled) {
        functionAuthDataCacheProvider.ifPresent(kubernetesFunctionAuthProvider -> kubernetesFunctionAuthProvider.configureAuthDataStatefulSet(statefulSet, Optional.ofNullable(getFunctionAuthData(Optional.ofNullable(instanceConfig.getFunctionAuthenticationSpec())))));
    }
    log.info("Submitting the following spec to k8 {}", appsClient.getApiClient().getJSON().serialize(statefulSet));
    String fqfn = FunctionCommon.getFullyQualifiedName(instanceConfig.getFunctionDetails());
    Actions.Action createStatefulSet = Actions.Action.builder().actionName(String.format("Submitting statefulset for function %s", fqfn)).numRetries(KubernetesRuntimeFactory.numRetries).sleepBetweenInvocationsMs(KubernetesRuntimeFactory.sleepBetweenRetriesMs).supplier(() -> {
        final V1StatefulSet response;
        try {
            response = appsClient.createNamespacedStatefulSet(jobNamespace, statefulSet, null, null, null);
        } catch (ApiException e) {
            // already exists
            if (e.getCode() == HTTP_CONFLICT) {
                log.warn("Statefulset already present for function {}", fqfn);
                return Actions.ActionResult.builder().success(true).build();
            }
            String errorMsg = e.getResponseBody() != null ? e.getResponseBody() : e.getMessage();
            return Actions.ActionResult.builder().success(false).errorMsg(errorMsg).build();
        }
        return Actions.ActionResult.builder().success(true).build();
    }).build();
    AtomicBoolean success = new AtomicBoolean(false);
    Actions.newBuilder().addAction(createStatefulSet.toBuilder().onSuccess((ignored) -> success.set(true)).build()).run();
    if (!success.get()) {
        throw new RuntimeException(String.format("Failed to create statefulset for function %s", fqfn));
    }
}

Example 3 with KubernetesFunctionAuthProvider

use of org.apache.pulsar.functions.auth.KubernetesFunctionAuthProvider in project pulsar by yahoo.

the class KubernetesRuntime method submitStatefulSet.

private void submitStatefulSet() throws Exception {
    final V1StatefulSet statefulSet = createStatefulSet();
    // Configure function authentication if needed
    if (authenticationEnabled) {
        functionAuthDataCacheProvider.ifPresent(kubernetesFunctionAuthProvider -> kubernetesFunctionAuthProvider.configureAuthDataStatefulSet(statefulSet, Optional.ofNullable(getFunctionAuthData(Optional.ofNullable(instanceConfig.getFunctionAuthenticationSpec())))));
    }
    log.info("Submitting the following spec to k8 {}", appsClient.getApiClient().getJSON().serialize(statefulSet));
    String fqfn = FunctionCommon.getFullyQualifiedName(instanceConfig.getFunctionDetails());
    Actions.Action createStatefulSet = Actions.Action.builder().actionName(String.format("Submitting statefulset for function %s", fqfn)).numRetries(KubernetesRuntimeFactory.numRetries).sleepBetweenInvocationsMs(KubernetesRuntimeFactory.sleepBetweenRetriesMs).supplier(() -> {
        final V1StatefulSet response;
        try {
            response = appsClient.createNamespacedStatefulSet(jobNamespace, statefulSet, null, null, null);
        } catch (ApiException e) {
            // already exists
            if (e.getCode() == HTTP_CONFLICT) {
                log.warn("Statefulset already present for function {}", fqfn);
                return Actions.ActionResult.builder().success(true).build();
            }
            String errorMsg = e.getResponseBody() != null ? e.getResponseBody() : e.getMessage();
            return Actions.ActionResult.builder().success(false).errorMsg(errorMsg).build();
        }
        return Actions.ActionResult.builder().success(true).build();
    }).build();
    AtomicBoolean success = new AtomicBoolean(false);
    Actions.newBuilder().addAction(createStatefulSet.toBuilder().onSuccess((ignored) -> success.set(true)).build()).run();
    if (!success.get()) {
        throw new RuntimeException(String.format("Failed to create statefulset for function %s", fqfn));
    }
}

Example 4 with KubernetesFunctionAuthProvider

use of org.apache.pulsar.functions.auth.KubernetesFunctionAuthProvider in project pulsar by yahoo.

the class KubernetesRuntimeFactory method initialize.

@Override
public void initialize(WorkerConfig workerConfig, AuthenticationConfig authenticationConfig, SecretsProviderConfigurator secretsProviderConfigurator, ConnectorsManager connectorsManager, Optional<FunctionAuthProvider> functionAuthProvider, Optional<RuntimeCustomizer> runtimeCustomizer) {
    KubernetesRuntimeFactoryConfig factoryConfig = RuntimeUtils.getRuntimeFunctionConfig(workerConfig.getFunctionRuntimeFactoryConfigs(), KubernetesRuntimeFactoryConfig.class);
    this.k8Uri = factoryConfig.getK8Uri();
    if (!isEmpty(factoryConfig.getJobNamespace())) {
        this.jobNamespace = factoryConfig.getJobNamespace();
    } else {
        this.jobNamespace = "default";
    }
    if (!isEmpty(factoryConfig.getJobName())) {
        this.jobName = factoryConfig.getJobName();
    } else {
        this.jobName = null;
    }
    if (!isEmpty(factoryConfig.getPulsarDockerImageName())) {
        this.pulsarDockerImageName = factoryConfig.getPulsarDockerImageName();
    } else {
        this.pulsarDockerImageName = "apachepulsar/pulsar";
    }
    this.functionDockerImages = factoryConfig.getFunctionDockerImages();
    if (!isEmpty(factoryConfig.getImagePullPolicy())) {
        this.imagePullPolicy = factoryConfig.getImagePullPolicy();
    } else {
        this.imagePullPolicy = "IfNotPresent";
    }
    if (!isEmpty(factoryConfig.getPulsarRootDir())) {
        this.pulsarRootDir = factoryConfig.getPulsarRootDir();
    } else {
        this.pulsarRootDir = "/pulsar";
    }
    if (!isEmpty(factoryConfig.getConfigAdminCLI())) {
        this.configAdminCLI = factoryConfig.getConfigAdminCLI();
    } else {
        this.configAdminCLI = "/bin/pulsar-admin";
    }
    this.downloadDirectory = isNotEmpty(workerConfig.getDownloadDirectory()) ? workerConfig.getDownloadDirectory() : // for backward comp
    this.pulsarRootDir;
    if (!Paths.get(this.downloadDirectory).isAbsolute()) {
        this.downloadDirectory = this.pulsarRootDir + "/" + this.downloadDirectory;
    }
    this.submittingInsidePod = factoryConfig.getSubmittingInsidePod();
    this.installUserCodeDependencies = factoryConfig.getInstallUserCodeDependencies();
    this.pythonDependencyRepository = factoryConfig.getPythonDependencyRepository();
    this.pythonExtraDependencyRepository = factoryConfig.getPythonExtraDependencyRepository();
    if (StringUtils.isNotEmpty(factoryConfig.getExtraFunctionDependenciesDir())) {
        if (Paths.get(factoryConfig.getExtraFunctionDependenciesDir()).isAbsolute()) {
            this.extraDependenciesDir = factoryConfig.getExtraFunctionDependenciesDir();
        } else {
            this.extraDependenciesDir = this.pulsarRootDir + "/" + factoryConfig.getExtraFunctionDependenciesDir();
        }
    } else {
        this.extraDependenciesDir = this.pulsarRootDir + "/instances/deps";
    }
    this.customLabels = factoryConfig.getCustomLabels();
    this.percentMemoryPadding = factoryConfig.getPercentMemoryPadding();
    this.cpuOverCommitRatio = factoryConfig.getCpuOverCommitRatio();
    this.memoryOverCommitRatio = factoryConfig.getMemoryOverCommitRatio();
    this.gracePeriodSeconds = factoryConfig.getGracePeriodSeconds();
    this.pulsarServiceUrl = StringUtils.isEmpty(factoryConfig.getPulsarServiceUrl()) ? workerConfig.getPulsarServiceUrl() : factoryConfig.getPulsarServiceUrl();
    this.pulsarAdminUrl = StringUtils.isEmpty(factoryConfig.getPulsarAdminUrl()) ? workerConfig.getPulsarWebServiceUrl() : factoryConfig.getPulsarAdminUrl();
    this.stateStorageServiceUri = workerConfig.getStateStorageServiceUrl();
    this.authConfig = authenticationConfig;
    this.expectedMetricsCollectionInterval = factoryConfig.getExpectedMetricsCollectionInterval() == null ? -1 : factoryConfig.getExpectedMetricsCollectionInterval();
    this.changeConfigMap = factoryConfig.getChangeConfigMap();
    this.changeConfigMapNamespace = factoryConfig.getChangeConfigMapNamespace();
    this.functionInstanceMinResources = workerConfig.getFunctionInstanceMinResources();
    this.functionInstanceMaxResources = workerConfig.getFunctionInstanceMaxResources();
    this.functionInstanceResourceGranularities = workerConfig.getFunctionInstanceResourceGranularities();
    this.functionInstanceResourceChangeInLockStep = workerConfig.isFunctionInstanceResourceChangeInLockStep();
    this.secretsProviderConfigurator = secretsProviderConfigurator;
    this.authenticationEnabled = workerConfig.isAuthenticationEnabled();
    this.javaInstanceJarFile = this.pulsarRootDir + "/instances/java-instance.jar";
    this.pythonInstanceFile = this.pulsarRootDir + "/instances/python-instance/python_instance_main.py";
    this.serverCaBytes = workerConfig.getTlsTrustChainBytes();
    try {
        setupClient();
    } catch (Exception e) {
        log.error("Failed to setup client", e);
        throw new RuntimeException(e);
    }
    // make sure the provided class is a kubernetes auth provider, this needs to run before the authProvider!
    if (runtimeCustomizer.isPresent()) {
        if (!(runtimeCustomizer.get() instanceof KubernetesManifestCustomizer)) {
            throw new IllegalArgumentException("Function runtime customizer " + runtimeCustomizer.get().getClass().getName() + " must implement KubernetesManifestCustomizer");
        } else {
            KubernetesManifestCustomizer manifestCustomizer = (KubernetesManifestCustomizer) runtimeCustomizer.get();
            this.manifestCustomizer = Optional.of(manifestCustomizer);
        }
    } else {
        this.manifestCustomizer = Optional.empty();
    }
    // make sure the provided class is a kubernetes auth provider
    if (functionAuthProvider.isPresent()) {
        if (!(functionAuthProvider.get() instanceof KubernetesFunctionAuthProvider)) {
            throw new IllegalArgumentException("Function authentication provider " + functionAuthProvider.get().getClass().getName() + " must implement KubernetesFunctionAuthProvider");
        } else {
            KubernetesFunctionAuthProvider kubernetesFunctionAuthProvider = (KubernetesFunctionAuthProvider) functionAuthProvider.get();
            kubernetesFunctionAuthProvider.initialize(coreClient, serverCaBytes, (funcDetails) -> getRuntimeCustomizer().map((customizer) -> customizer.customizeNamespace(funcDetails, jobNamespace)).orElse(jobNamespace));
            this.authProvider = Optional.of(kubernetesFunctionAuthProvider);
        }
    } else {
        this.authProvider = Optional.empty();
    }
    this.grpcPort = factoryConfig.getGrpcPort();
    this.metricsPort = factoryConfig.getMetricsPort();
    this.narExtractionDirectory = factoryConfig.getNarExtractionDirectory();
    this.functionInstanceClassPath = factoryConfig.getFunctionInstanceClassPath();
}

Example 5 with KubernetesFunctionAuthProvider

use of org.apache.pulsar.functions.auth.KubernetesFunctionAuthProvider in project pulsar by yahoo.

the class KubernetesRuntimeFactory method createContainer.

@Override
public KubernetesRuntime createContainer(InstanceConfig instanceConfig, String codePkgUrl, String originalCodeFileName, Long expectedHealthCheckInterval) throws Exception {
    String instanceFile = null;
    switch(instanceConfig.getFunctionDetails().getRuntime()) {
        case JAVA:
            instanceFile = javaInstanceJarFile;
            break;
        case PYTHON:
            instanceFile = pythonInstanceFile;
            break;
        case GO:
            break;
        default:
            throw new RuntimeException("Unsupported Runtime " + instanceConfig.getFunctionDetails().getRuntime());
    }
    // adjust the auth config to support auth
    if (authenticationEnabled) {
        authProvider.ifPresent(kubernetesFunctionAuthProvider -> kubernetesFunctionAuthProvider.configureAuthenticationConfig(authConfig, Optional.ofNullable(getFunctionAuthData(Optional.ofNullable(instanceConfig.getFunctionAuthenticationSpec())))));
    }
    Optional<KubernetesManifestCustomizer> manifestCustomizer = getRuntimeCustomizer();
    String overriddenNamespace = manifestCustomizer.map((customizer) -> customizer.customizeNamespace(instanceConfig.getFunctionDetails(), jobNamespace)).orElse(jobNamespace);
    String overriddenName = manifestCustomizer.map((customizer) -> customizer.customizeName(instanceConfig.getFunctionDetails(), jobName)).orElse(jobName);
    // pass metricsPort configured in functionRuntimeFactoryConfigs.metricsPort in functions_worker.yml
    if (metricsPort != null) {
        instanceConfig.setMetricsPort(metricsPort);
    }
    return new KubernetesRuntime(appsClient, coreClient, // get the namespace for this function
    overriddenNamespace, overriddenName, customLabels, installUserCodeDependencies, pythonDependencyRepository, pythonExtraDependencyRepository, pulsarDockerImageName, functionDockerImages, imagePullPolicy, pulsarRootDir, instanceConfig, instanceFile, extraDependenciesDir, logDirectory, configAdminCLI, codePkgUrl, originalCodeFileName, pulsarServiceUrl, pulsarAdminUrl, stateStorageServiceUri, authConfig, secretsProviderConfigurator, expectedMetricsCollectionInterval, percentMemoryPadding, cpuOverCommitRatio, memoryOverCommitRatio, gracePeriodSeconds, authProvider, authenticationEnabled, grpcPort, narExtractionDirectory, manifestCustomizer, functionInstanceClassPath, downloadDirectory);
}