Merge pull request #2295 from hannseman/swarm-rotate-token

Add support for rotate_manager_unlock_key

Author: shin-

docker/api/swarm.py

@@ -406,8 +406,10 @@ def update_node(self, node_id, version, node_spec=None):
         return True
 
     @utils.minimum_version('1.24')
-    def update_swarm(self, version, swarm_spec=None, rotate_worker_token=False,
-                     rotate_manager_token=False):
+    def update_swarm(self, version, swarm_spec=None,
+                     rotate_worker_token=False,
+                     rotate_manager_token=False,
+                     rotate_manager_unlock_key=False):
         """
         Update the Swarm's configuration
 
@@ -421,6 +423,8 @@ def update_swarm(self, version, swarm_spec=None, rotate_worker_token=False,
                 ``False``.
             rotate_manager_token (bool): Rotate the manager join token.
                 Default: ``False``.
+            rotate_manager_unlock_key (bool): Rotate the manager unlock key.
+                Default: ``False``.
 
         Returns:
             ``True`` if the request went through.
@@ -429,12 +433,20 @@ def update_swarm(self, version, swarm_spec=None, rotate_worker_token=False,
             :py:class:`docker.errors.APIError`
                 If the server returns an error.
         """
-
         url = self._url('/swarm/update')
-        response = self._post_json(url, data=swarm_spec, params={
+        params = {
             'rotateWorkerToken': rotate_worker_token,
             'rotateManagerToken': rotate_manager_token,
             'version': version
-        })
+        }
+        if rotate_manager_unlock_key:
+            if utils.version_lt(self._version, '1.25'):
+                raise errors.InvalidVersion(
+                    'Rotate manager unlock key '
+                    'is only available for API version >= 1.25'
+                )
+            params['rotateManagerUnlockKey'] = rotate_manager_unlock_key
+
+        response = self._post_json(url, data=swarm_spec, params=params)
         self._raise_for_status(response)
         return True

docker/models/swarm.py

@@ -151,7 +151,7 @@ def unlock(self, key):
     unlock.__doc__ = APIClient.unlock_swarm.__doc__
 
     def update(self, rotate_worker_token=False, rotate_manager_token=False,
-               **kwargs):
+               rotate_manager_unlock_key=False, **kwargs):
         """
         Update the swarm's configuration.
 
@@ -164,7 +164,8 @@ def update(self, rotate_worker_token=False, rotate_manager_token=False,
                 ``False``.
             rotate_manager_token (bool): Rotate the manager join token.
                 Default: ``False``.
-
+            rotate_manager_unlock_key (bool): Rotate the manager unlock key.
+                Default: ``False``.
         Raises:
             :py:class:`docker.errors.APIError`
                 If the server returns an error.
@@ -178,5 +179,6 @@ def update(self, rotate_worker_token=False, rotate_manager_token=False,
             version=self.version,
             swarm_spec=self.client.api.create_swarm_spec(**kwargs),
             rotate_worker_token=rotate_worker_token,
-            rotate_manager_token=rotate_manager_token
+            rotate_manager_token=rotate_manager_token,
+            rotate_manager_unlock_key=rotate_manager_unlock_key
         )

tests/integration/api_swarm_test.py

@@ -236,6 +236,19 @@ def test_remove_main_node(self):
 
         assert e.value.response.status_code >= 400
 
+    @requires_api_version('1.25')
+    def test_rotate_manager_unlock_key(self):
+        spec = self.client.create_swarm_spec(autolock_managers=True)
+        assert self.init_swarm(swarm_spec=spec)
+        swarm_info = self.client.inspect_swarm()
+        key_1 = self.client.get_unlock_key()
+        assert self.client.update_swarm(
+            version=swarm_info['Version']['Index'],
+            rotate_manager_unlock_key=True
+        )
+        key_2 = self.client.get_unlock_key()
+        assert key_1['UnlockKey'] != key_2['UnlockKey']
+
     @requires_api_version('1.30')
     def test_init_swarm_data_path_addr(self):
         assert self.init_swarm(data_path_addr='eth0')