Python kubernetes.client.V1EnvVar() Examples

def volume_pipeline():
  op1 = dsl.ContainerOp(
      name='download',
      image='google/cloud-sdk',
      command=['sh', '-c'],
      arguments=['ls | tee /tmp/results.txt'],
      file_outputs={'downloaded': '/tmp/results.txt'}) \
    .add_volume(k8s_client.V1Volume(name='gcp-credentials',
                                   secret=k8s_client.V1SecretVolumeSource(
                                       secret_name='user-gcp-sa'))) \
    .add_volume_mount(k8s_client.V1VolumeMount(
      mount_path='/secret/gcp-credentials', name='gcp-credentials')) \
    .add_env_variable(k8s_client.V1EnvVar(
      name='GOOGLE_APPLICATION_CREDENTIALS',
      value='/secret/gcp-credentials/user-gcp-sa.json')) \
    .add_env_variable(k8s_client.V1EnvVar(name='Foo', value='bar'))
  op2 = dsl.ContainerOp(
      name='echo',
      image='library/bash',
      command=['sh', '-c'],
      arguments=['echo %s' % op1.output]) 

def init_envs(self, container_props, name):
        config = container_props.config
        config_dict = self.pre_process_config(config)
        configmap_name = name

        list_envs = []
        for key in config_dict:
            config_map_ref = client.V1ConfigMapKeySelector(
                key=key,
                name=configmap_name)
            env_var = client.V1EnvVarSource(
                config_map_key_ref=config_map_ref)
            env_object = client.V1EnvVar(
                name=key,
                value_from=env_var)
            list_envs.append(env_object)
        return list_envs

    # Init container object 

def create_job_object(runner_image, region, s3_path, pvc_name):
  target_folder = get_target_folder(s3_path)

  # Configureate Pod template container
  container = k8s_client.V1Container(
      name="copy-dataset-worker",
      image=runner_image,
      command=["aws"],
      args=["s3", "sync", s3_path, "/mnt/" + target_folder],
      volume_mounts=[k8s_client.V1VolumeMount(name="data-storage", mount_path='/mnt')],
      env=[k8s_client.V1EnvVar(name="AWS_REGION", value=region),
        k8s_client.V1EnvVar(name="AWS_ACCESS_KEY_ID", value_from=k8s_client.V1EnvVarSource(secret_key_ref=k8s_client.V1SecretKeySelector(key="AWS_ACCESS_KEY_ID", name="aws-secret"))),
        k8s_client.V1EnvVar(name="AWS_SECRET_ACCESS_KEY", value_from=k8s_client.V1EnvVarSource(secret_key_ref=k8s_client.V1SecretKeySelector(key="AWS_SECRET_ACCESS_KEY", name="aws-secret")))
        ],
    )
  volume = k8s_client.V1Volume(
    name='data-storage',
    persistent_volume_claim=k8s_client.V1PersistentVolumeClaimVolumeSource(claim_name=pvc_name)
  )
  # Create and configurate a spec section
  template = k8s_client.V1PodTemplateSpec(
      # metadata=k8s_client.V1ObjectMeta(labels={"app":"copy-dataset-worker"}),
      spec=k8s_client.V1PodSpec(containers=[container], volumes=[volume], restart_policy="OnFailure"))
  # Create the specification of deployment
  spec = k8s_client.V1JobSpec(
      # selector=k8s_client.V1LabelSelector(match_labels={"app":"copy-dataset-worker"}),
      template=template)
  # Instantiate the deployment object
  deployment = k8s_client.V1Job(
      api_version="batch/v1",
      kind="Job",
      metadata=k8s_client.V1ObjectMeta(name=container.name),
      spec=spec)

  return deployment 

def add_pod_env(op: BaseOp) -> BaseOp:
    """Adds pod environment info to ContainerOp.
    """
    if isinstance(op, ContainerOp) and op.pod_labels and 'add-pod-env' in op.pod_labels and op.pod_labels['add-pod-env'] == 'true':
        from kubernetes import client as k8s_client
        op.container.add_env_variable(
            k8s_client.V1EnvVar(
                name='KFP_POD_NAME', 
                value_from=k8s_client.V1EnvVarSource(
                    field_ref=k8s_client.V1ObjectFieldSelector(
                        field_path='metadata.name'
                    )
                )
            )
        ).add_env_variable(
            k8s_client.V1EnvVar(
                name='KFP_NAMESPACE', 
                value_from=k8s_client.V1EnvVarSource(
                    field_ref=k8s_client.V1ObjectFieldSelector(
                        field_path='metadata.namespace'
                    )
                )
            )
        )
    return op 

def get_container_env(self) -> Sequence[V1EnvVar]:
        secret_env_vars = {}
        shared_secret_env_vars = {}
        for k, v in self.get_env().items():
            if is_secret_ref(v):
                if is_shared_secret(v):
                    shared_secret_env_vars[k] = v
                else:
                    secret_env_vars[k] = v

        user_env = [
            V1EnvVar(name=name, value=value)
            for name, value in self.get_env().items()
            if name
            not in list(secret_env_vars.keys()) + list(shared_secret_env_vars.keys())
        ]
        user_env += self.get_kubernetes_secret_env_vars(
            secret_env_vars=secret_env_vars,
            shared_secret_env_vars=shared_secret_env_vars,
        )
        return user_env + self.get_kubernetes_environment()  # type: ignore 

def get_kubernetes_environment(self) -> Sequence[V1EnvVar]:
        kubernetes_env = [
            V1EnvVar(
                name="PAASTA_POD_IP",
                value_from=V1EnvVarSource(
                    field_ref=V1ObjectFieldSelector(field_path="status.podIP")
                ),
            ),
            V1EnvVar(
                # this is used by some functions of operator-sdk
                # it uses this environment variable to get the pods
                name="POD_NAME",
                value_from=V1EnvVarSource(
                    field_ref=V1ObjectFieldSelector(field_path="metadata.name")
                ),
            ),
            V1EnvVar(
                name="PAASTA_HOST",
                value_from=V1EnvVarSource(
                    field_ref=V1ObjectFieldSelector(field_path="spec.nodeName")
                ),
            ),
        ]
        return kubernetes_env 

def test_get_kubernetes_secret_env_vars(self):
        assert self.deployment.get_kubernetes_secret_env_vars(
            secret_env_vars={"SOME": "SECRET(a_ref)"},
            shared_secret_env_vars={"A": "SHAREDSECRET(_ref1)"},
        ) == [
            V1EnvVar(
                name="SOME",
                value_from=V1EnvVarSource(
                    secret_key_ref=V1SecretKeySelector(
                        name="paasta-secret-kurupt-a--ref", key="a_ref", optional=False
                    )
                ),
            ),
            V1EnvVar(
                name="A",
                value_from=V1EnvVarSource(
                    secret_key_ref=V1SecretKeySelector(
                        name="paasta-secret-underscore-shared-underscore-ref1",
                        key="_ref1",
                        optional=False,
                    )
                ),
            ),
        ] 

def create_wk_manifest( wk_id, wk_num, ps_num, job_name, envs, image, commands, template_file ):
    envs.append( client.V1EnvVar( name="DMLC_WORKER_ID", value=wk_id ))
    envs.append( client.V1EnvVar( name="DMLC_SERVER_ID", value="0" ))
    envs.append( client.V1EnvVar( name="DMLC_ROLE", value="worker" ))
    if job_name is not None:
        name = "mx-" + job_name + "-worker-" + wk_id
    else:
        name = "mx-worker-" + wk_id
    return create_job_manifest(envs, commands, name, image, template_file ) 

def _get_pod_spec(self):
        container = k8sclient.V1Container(
            name='fixture',
            image=self._image,
            command=self._get_cmd(),
            env=[k8sclient.V1EnvVar(name=k, value=v) for k, v in self._env.iteritems()],
        )

        return k8sclient.V1PodSpec(
            containers=[container]
        ) 

def update_ds_env(self, ds, ns, env_vars):
        config.load_kube_config(os.environ.get('KUBECONFIG'))
        api = client.AppsV1Api(client.ApiClient())
        node_ds = api.read_namespaced_daemon_set(ds, ns, exact=True, export=True)
        for container in node_ds.spec.template.spec.containers:
            if container.name == ds:
                for k, v in env_vars.items():
                    logger.info("Set %s=%s", k, v)
                    env_present = False
                    for env in container.env:
                        if env.name == k:
                            env_present = True
                    if not env_present:
                        v1_ev = client.V1EnvVar(name=k, value=v, value_from=None)
                        container.env.append(v1_ev)
        api.replace_namespaced_daemon_set(ds, ns, node_ds)

        # Wait until the DaemonSet reports that all nodes have been updated.
        while True:
            time.sleep(10)
            node_ds = api.read_namespaced_daemon_set_status("calico-node", "kube-system")
            logger.info("%d/%d nodes updated",
                      node_ds.status.updated_number_scheduled,
                      node_ds.status.desired_number_scheduled)
            if node_ds.status.updated_number_scheduled == node_ds.status.desired_number_scheduled:
                break 

def use_gcp_secret(secret_name='user-gcp-sa', secret_file_path_in_volume=None, volume_name=None, secret_volume_mount_path='/secret/gcp-credentials'):
    """An operator that configures the container to use GCP service account by service account key
        stored in a Kubernetes secret.

        For cluster setup and alternatives to using service account key, check https://www.kubeflow.org/docs/gke/authentication-pipelines/.
    """

    # permitted values for secret_name = ['admin-gcp-sa', 'user-gcp-sa']
    if secret_file_path_in_volume is None:
        secret_file_path_in_volume = '/' + secret_name + '.json'

    if volume_name is None:
        volume_name = 'gcp-credentials-' + secret_name

    else:
        import warnings
        warnings.warn('The volume_name parameter is deprecated and will be removed in next release. The volume names are now generated automatically.', DeprecationWarning)
    
    def _use_gcp_secret(task):
        from kubernetes import client as k8s_client
        task = task.add_volume(
            k8s_client.V1Volume(
                name=volume_name,
                secret=k8s_client.V1SecretVolumeSource(
                    secret_name=secret_name,
                )
            )
        )
        task.container \
            .add_volume_mount(
                    k8s_client.V1VolumeMount(
                        name=volume_name,
                        mount_path=secret_volume_mount_path,
                    )
                ) \
            .add_env_variable(
                k8s_client.V1EnvVar(
                    name='GOOGLE_APPLICATION_CREDENTIALS',
                    value=secret_volume_mount_path + secret_file_path_in_volume,
                )
            ) \
            .add_env_variable(
                k8s_client.V1EnvVar(
                    name='CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE',
                    value=secret_volume_mount_path + secret_file_path_in_volume,
                )
            ) # Set GCloud Credentials by using the env var override.
              # TODO: Is there a better way for GCloud to pick up the credential?
        return task
    
    return _use_gcp_secret 

def test_get_container_env(self):
        with mock.patch(
            "paasta_tools.kubernetes_tools.KubernetesDeploymentConfig.get_env",
            autospec=True,
            return_value={
                "mc": "grindah",
                "dj": "beats",
                "A": "SECRET(123)",
                "B": "SHAREDSECRET(456)",
            },
        ), mock.patch(
            "paasta_tools.kubernetes_tools.KubernetesDeploymentConfig.get_kubernetes_environment",
            autospec=True,
            return_value=[V1EnvVar(name="manager", value="chabuddy")],
        ), mock.patch(
            "paasta_tools.kubernetes_tools.is_secret_ref", autospec=True
        ) as mock_is_secret_ref, mock.patch(
            "paasta_tools.kubernetes_tools.is_shared_secret", autospec=True
        ) as mock_is_shared_secret, mock.patch(
            "paasta_tools.kubernetes_tools.KubernetesDeploymentConfig.get_kubernetes_secret_env_vars",
            autospec=True,
            return_value=[],
        ) as mock_get_kubernetes_secret_env_vars:
            mock_is_secret_ref.side_effect = lambda x: True if "SECRET" in x else False
            mock_is_shared_secret.side_effect = (
                lambda x: False if not x.startswith("SHARED") else True
            )
            expected = [
                V1EnvVar(name="mc", value="grindah"),
                V1EnvVar(name="dj", value="beats"),
                V1EnvVar(name="manager", value="chabuddy"),
            ]
            assert expected == self.deployment.get_container_env()
            mock_get_kubernetes_secret_env_vars.assert_called_with(
                self.deployment,
                secret_env_vars={"A": "SECRET(123)"},
                shared_secret_env_vars={"B": "SHAREDSECRET(456)"},
            ) 

def get_kubernetes_secret_env_vars(
        self,
        secret_env_vars: Mapping[str, str],
        shared_secret_env_vars: Mapping[str, str],
    ) -> Sequence[V1EnvVar]:
        ret = []
        for k, v in secret_env_vars.items():
            service = self.get_sanitised_service_name()
            secret = get_secret_name_from_ref(v)
            sanitised_secret = sanitise_kubernetes_name(secret)
            ret.append(
                V1EnvVar(
                    name=k,
                    value_from=V1EnvVarSource(
                        secret_key_ref=V1SecretKeySelector(
                            name=f"paasta-secret-{service}-{sanitised_secret}",
                            key=secret,
                            optional=False,
                        )
                    ),
                )
            )
        for k, v in shared_secret_env_vars.items():
            service = sanitise_kubernetes_name(SHARED_SECRET_SERVICE)
            secret = get_secret_name_from_ref(v)
            sanitised_secret = sanitise_kubernetes_name(secret)
            ret.append(
                V1EnvVar(
                    name=k,
                    value_from=V1EnvVarSource(
                        secret_key_ref=V1SecretKeySelector(
                            name=f"paasta-secret-{service}-{sanitised_secret}",
                            key=secret,
                            optional=False,
                        )
                    ),
                )
            )
        return ret 

def create_env(root_uri, root_port, sv_num, wk_num ):
    envs = []
    envs.append( client.V1EnvVar( name="DMLC_PS_ROOT_URI", value=root_uri))
    envs.append( client.V1EnvVar( name="DMLC_PS_ROOT_PORT", value=str(root_port)))
    envs.append( client.V1EnvVar( name="DMLC_NUM_SERVER", value=str(sv_num)))
    envs.append( client.V1EnvVar( name="DMLC_NUM_WORKER", value=str(wk_num)))
    return envs 

def create_sched_job_manifest( wk_num, ps_num, envs, image,  commands):
    envs.append( client.V1EnvVar( name="DMLC_ROLE", value="scheduler" ))
    name = ""
    for i in envs:
        if i.name is "DMLC_PS_ROOT_URI":
            name = i.value
            break
    return create_job_manifest(envs, commands, name, image, None ) 

def create_ps_manifest( ps_id, ps_num, job_name, envs, image, commands, template_file ):
    envs.append( client.V1EnvVar( name="DMLC_SERVER_ID", value=ps_id ))
    envs.append( client.V1EnvVar( name="DMLC_ROLE", value="server" ))
    if job_name is not None:
        name = "mx-" + job_name + "-server-" + ps_id
    else:
        name = "mx-server-" + ps_id
    return create_job_manifest(envs, commands, name, image, template_file ) 

def create_env(root_uri, root_port, sv_num, wk_num ):
    envs = []
    envs.append( client.V1EnvVar( name="DMLC_PS_ROOT_URI", value=root_uri))
    envs.append( client.V1EnvVar( name="DMLC_PS_ROOT_PORT", value=str(root_port)))
    envs.append( client.V1EnvVar( name="DMLC_NUM_SERVER", value=str(sv_num)))
    envs.append( client.V1EnvVar( name="DMLC_NUM_WORKER", value=str(wk_num)))
    return envs 

def create_sched_job_manifest( wk_num, ps_num, envs, image,  commands):
    envs.append( client.V1EnvVar( name="DMLC_ROLE", value="scheduler" ))
    name = ""
    for i in envs:
        if i.name is "DMLC_PS_ROOT_URI":
            name = i.value
            break
    return create_job_manifest(envs, commands, name, image, None ) 

def create_ps_manifest( ps_id, ps_num, job_name, envs, image, commands, template_file ):
    envs.append( client.V1EnvVar( name="DMLC_SERVER_ID", value=ps_id ))
    envs.append( client.V1EnvVar( name="DMLC_ROLE", value="server" ))
    if job_name is not None:
        name = "mx-" + job_name + "-server-" + ps_id
    else:
        name = "mx-server-" + ps_id
    return create_job_manifest(envs, commands, name, image, template_file ) 

def use_secret(secret_name:str, secret_volume_mount_path:str, env_variable:str=None, secret_file_path_in_volume:str=None):
    """    
       An operator that configures the container to use a secret.
       
       This assumes that the secret is created and availabel in the k8s cluster.
    
    Keyword Arguments:
        secret_name {String} -- [Required] The k8s secret name.
        secret_volume_mount_path {String} -- [Required] The path to the secret that is mounted.
        env_variable {String} -- Env variable pointing to the mounted secret file. Requires both the env_variable and secret_file_path_in_volume to be defined. 
                                 The value is the path to the secret.
        secret_file_path_in_volume {String} -- The path to the secret in the volume. This will be the value of env_variable. 
                                 Both env_variable and secret_file_path_in_volume needs to be set if any env variable should be created.
    
    Raises:
        ValueError: If not the necessary variables (secret_name, volume_name", secret_volume_mount_path) are supplied.
                    Or only one of  env_variable and secret_file_path_in_volume are supplied
    
    Returns:
        [ContainerOperator] -- Returns the container operator after it has been modified. 
    """

    secret_name = str(secret_name)
    if '{{' in secret_name:
        volume_name = ''.join(random.choices(string.ascii_lowercase + string.digits, k=10)) + "_volume"
    else:
        volume_name = secret_name
    for param, param_name in zip([secret_name, secret_volume_mount_path],["secret_name","secret_volume_mount_path"]):
        if param == "":
            raise ValueError("The '{}' must not be empty".format(param_name))
    if bool(env_variable) != bool(secret_file_path_in_volume):
        raise ValueError("Both {} and {} needs to be supplied together or not at all".format(env_variable, secret_file_path_in_volume))

    def _use_secret(task):
        import os 
        from kubernetes import client as k8s_client
        task = task.add_volume(
            k8s_client.V1Volume(
                name=volume_name,
                secret=k8s_client.V1SecretVolumeSource(
                    secret_name=secret_name
                )
            )
        ).add_volume_mount(
                k8s_client.V1VolumeMount(
                    name=volume_name,
                    mount_path=secret_volume_mount_path
                )
            )
        if env_variable:
            task.container.add_env_variable(
                k8s_client.V1EnvVar(
                    name=env_variable,
                    value=os.path.join(secret_volume_mount_path, secret_file_path_in_volume),
                )
            )
        return task
    
    return _use_secret 

def use_aws_secret(secret_name='aws-secret', aws_access_key_id_name='AWS_ACCESS_KEY_ID', aws_secret_access_key_name='AWS_SECRET_ACCESS_KEY'):
    """An operator that configures the container to use AWS credentials.

        AWS doesn't create secret along with kubeflow deployment and it requires users
        to manually create credential secret with proper permissions.
        ---
        apiVersion: v1
        kind: Secret
        metadata:
          name: aws-secret
        type: Opaque
        data:
          AWS_ACCESS_KEY_ID: BASE64_YOUR_AWS_ACCESS_KEY_ID
          AWS_SECRET_ACCESS_KEY: BASE64_YOUR_AWS_SECRET_ACCESS_KEY
    """

    def _use_aws_secret(task):
        from kubernetes import client as k8s_client
        (
            task.container
                .add_env_variable(
                    k8s_client.V1EnvVar(
                        name='AWS_ACCESS_KEY_ID',
                        value_from=k8s_client.V1EnvVarSource(
                            secret_key_ref=k8s_client.V1SecretKeySelector(
                                name=secret_name,
                                key=aws_access_key_id_name
                            )
                        )
                    )
                )
                .add_env_variable(
                    k8s_client.V1EnvVar(
                        name='AWS_SECRET_ACCESS_KEY',
                        value_from=k8s_client.V1EnvVarSource(
                            secret_key_ref=k8s_client.V1SecretKeySelector(
                                name=secret_name,
                                key=aws_secret_access_key_name
                            )
                        )
                    )
                )
        )
        return task

    return _use_aws_secret 

def _BuildPodManifest(self) -> k8s_client.V1Pod:
    if isinstance(self._serving_binary, serving_bins.TensorFlowServing):
      env_vars_dict = self._serving_binary.MakeEnvVars(
          model_path=self._model_path)
      env_vars = [k8s_client.V1EnvVar(name=key, value=value)
                  for key, value in env_vars_dict.items()]
    else:
      raise NotImplementedError('Unsupported serving binary {}'.format(
          type(self._serving_binary).__name__))

    service_account_name = (self._config.service_account_name or
                            self._executor_pod.spec.service_account_name)
    active_deadline_seconds = (self._config.active_deadline_seconds or
                               _DEFAULT_ACTIVE_DEADLINE_SEC)
    if active_deadline_seconds < 0:
      raise ValueError('active_deadline_seconds should be > 0. Got {}'
                       .format(active_deadline_seconds))

    result = k8s_client.V1Pod(
        metadata=k8s_client.V1ObjectMeta(
            generate_name=_MODEL_SERVER_POD_NAME_PREFIX,
            labels=self._label_dict,
            # Resources with ownerReferences are automatically deleted once all
            # its owners are deleted.
            owner_references=[
                k8s_client.V1OwnerReference(
                    api_version=self._executor_pod.api_version,
                    kind=self._executor_pod.kind,
                    name=self._executor_pod.metadata.name,
                    uid=self._executor_pod.metadata.uid,
                ),
            ],
        ),
        spec=k8s_client.V1PodSpec(
            containers=[
                k8s_client.V1Container(
                    name=_MODEL_SERVER_CONTAINER_NAME,
                    image=self._serving_binary.image,
                    env=env_vars,
                    volume_mounts=[],
                ),
            ],
            service_account_name=service_account_name,
            # No retry in case model server container failed. Retry will happen
            # at the outermost loop (executor.py).
            restart_policy=_RestartPolicy.NEVER.value,
            # This is a hard deadline for the model server container to ensure
            # the Pod is properly cleaned up even with an unexpected termination
            # of an infra validator. After the deadline, container will be
            # removed but Pod resource won't. This makes the Pod log visible
            # after the termination.
            active_deadline_seconds=active_deadline_seconds,
            volumes=[],
            # TODO(b/152002076): Add TTL controller once it graduates Beta.
            # ttl_seconds_after_finished=,
        )
    )

    self._SetupModelVolumeIfNeeded(result)

    return result 

def create(image_data):
        """
        :param image_data: ImageMetadata
        :return: V1Pod,
            https://github.com/kubernetes-client/python/blob/master/kubernetes/docs/V1Pod.md
        """

        # convert environment variables to Kubernetes objects
        env_variables = []
        for key, value in image_data.env_variables.items():
            env_variables.append(client.V1EnvVar(name=key, value=value))

        # convert exposed ports to Kubernetes objects
        exposed_ports = []
        if image_data.exposed_ports is not None:
            for port in image_data.exposed_ports:
                splits = port.split("/", 1)
                port = int(splits[0])
                protocol = splits[1].upper() if len(splits) > 1 else None
                exposed_ports.append(client.V1ContainerPort(container_port=port, protocol=protocol))

        # generate container name {image-name}-{username}-{random-4-letters}
        # take just name of image and remove tag
        image_name = image_data.name.split("/")[-1].split(":")[0]
        random_string = ''.join(
            random.choice(string.ascii_lowercase + string.digits) for _ in range(4))
        container_name = '{image_name}-{user_name}-{random_string}'.format(
            image_name=image_name,
            user_name=getpass.getuser(),
            random_string=random_string)

        container = client.V1Container(command=image_data.command,
                                       env=env_variables,
                                       image=image_data.name,
                                       name=container_name,
                                       ports=exposed_ports)

        pod_metadata = client.V1ObjectMeta(name=container_name + "-pod")
        pod_spec = client.V1PodSpec(containers=[container])
        pod = client.V1Pod(spec=pod_spec, metadata=pod_metadata)

        return pod