[ENG-847] add project_deleter (#985)

Author: petrucci89

Makefile

@@ -51,6 +51,7 @@ test_unit:
 test_integration: docker_build
 	docker compose -f tests/docker/docker-compose.yaml pull -q; \
 	docker compose --project-directory=`pwd` -f tests/docker/docker-compose.yaml up -d; \
+	bash tests/integration/project_deleter_fixture.sh; \
 	poetry run pytest -vv tests/integration; \
 	exit_code=$$?; \
 	docker compose -f tests/docker/docker-compose.yaml kill; \

charts/platform-registry/templates/deployment.yml

@@ -65,6 +65,12 @@ spec:
         - name: NP_REGISTRY_AUTH_TOKEN
 {{- if .Values.platform.token }}
 {{ toYaml .Values.platform.token | indent 10 }}
+{{- end }}
+        - name: NP_REGISTRY_EVENTS_URL
+          value: {{ .Values.platform.eventsUrl }}
+        - name: NP_REGISTRY_EVENTS_TOKEN
+{{- if .Values.platform.token }}
+{{- toYaml .Values.platform.token | nindent 10 }}
 {{- end }}
         {{- if .Values.sentry }}
         - name: SENTRY_DSN

charts/platform-registry/values.yaml

@@ -9,6 +9,7 @@ replicas: 2
 platform:
   clusterName: ""
   authUrl: ""
+  eventsUrl: http://platform-events:8080/apis/events
   token: {}
 
 upstreamRegistry:

platform_registry_api/api.py

@@ -38,6 +38,8 @@
 )
 from pydantic import BaseModel, ConfigDict, ValidationError
 
+from platform_registry_api.project_deleter import ProjectDeleter
+
 from .config import (
     Config,
     EnvironConfigFactory,
@@ -260,8 +262,14 @@ async def on_request_redirect(
 
             app[V2_APP][UPSTREAM_CLIENT] = upstream_client
 
+            deleter = await exit_stack.enter_async_context(
+                ProjectDeleter(upstream_client, config.events)
+            )
+
             yield
 
+            await deleter.aclose()
+
     app.cleanup_ctx.append(_init_app)
 
     root_handler = RootHandler()

platform_registry_api/config.py

@@ -5,6 +5,7 @@
 from enum import Enum
 from typing import Any
 
+from apolo_events_client import EventsClientConfig
 from yarl import URL
 
 
@@ -67,6 +68,7 @@ class Config:
     upstream_registry: UpstreamRegistryConfig
     auth: AuthConfig
     cluster_name: str
+    events: EventsClientConfig | None = None
 
 
 class EnvironConfigFactory:
@@ -143,15 +145,24 @@ def create_auth(self) -> AuthConfig:
         token = self._environ["NP_REGISTRY_AUTH_TOKEN"]
         return AuthConfig(server_endpoint_url=url, service_token=token)
 
+    def create_events(self) -> EventsClientConfig | None:
+        if "NP_REGISTRY_EVENTS_URL" in self._environ:
+            url = URL(self._environ["NP_REGISTRY_EVENTS_URL"])
+            token = self._environ["NP_REGISTRY_EVENTS_TOKEN"]
+            return EventsClientConfig(url=url, token=token, name="platform-registry")
+        return None
+
     def create(self) -> Config:
         server_config = self.create_server()
         upstream_registry_config = self.create_upstream_registry()
         auth_config = self.create_auth()
         cluster_name = self._environ["NP_CLUSTER_NAME"]
+        events = self.create_events()
         assert cluster_name
         return Config(
             server=server_config,
             upstream_registry=upstream_registry_config,
             auth=auth_config,
             cluster_name=cluster_name,
+            events=events,
         )

platform_registry_api/project_deleter.py

@@ -0,0 +1,47 @@
+import logging
+from typing import Self
+
+from apolo_events_client import (
+    EventsClientConfig,
+    EventType,
+    RecvEvent,
+    StreamType,
+    from_config,
+)
+
+from .upstream_client import UpstreamV2ApiClient
+
+
+logger = logging.getLogger(__name__)
+
+
+class ProjectDeleter:
+    ADMIN_STREAM = StreamType("platform-admin")
+    PROJECT_REMOVE = EventType("project-remove")
+
+    def __init__(
+        self, upstream_client: UpstreamV2ApiClient, config: EventsClientConfig | None
+    ) -> None:
+        self._upstream_client = upstream_client
+        self._client = from_config(config)
+
+    async def __aenter__(self) -> Self:
+        logger.info("Subscribe for %r", self.ADMIN_STREAM)
+        await self._client.subscribe_group(self.ADMIN_STREAM, self._on_admin_event)
+        logger.info("Subscribed")
+        return self
+
+    async def __aexit__(self, exc_typ: object, exc_val: object, exc_tb: object) -> None:
+        await self.aclose()
+
+    async def aclose(self) -> None:
+        await self._client.aclose()
+
+    async def _on_admin_event(self, ev: RecvEvent) -> None:
+        if ev.event_type == self.PROJECT_REMOVE:
+            assert ev.org
+            assert ev.project
+            await self._upstream_client.delete_project_images(
+                org=ev.org, project=ev.project
+            )
+            await self._client.ack({self.ADMIN_STREAM: [ev.tag]})

poetry.lock

@@ -32,6 +32,7 @@ neuro-logging = "^25.6.1"
 yarl = "^1.18.3"
 pydantic = "^2.11.7"
 pyjwt = "^2.10.1"
+apolo-events-client = "^25.7.7"
 
 [tool.poetry.group.dev]
 optional = true

pyproject.toml

@@ -13,6 +13,9 @@ services:
     volumes:
     - ./tests/docker/registry/config.yml:/etc/docker/registry/config.yml
     - ./tests/docker/docker_auth/server.pem:/etc/docker/registry/server.pem
+    - registry_data:/var/lib/registry
+    environment:
+    - REGISTRY_STORAGE_DELETE_ENABLED=true
     links:
     - auth
 
@@ -43,3 +46,6 @@ services:
     - auth
     - upstream
     - auth_server
+
+volumes:
+  registry_data:

tests/docker/docker-compose.yaml

@@ -4,176 +4,7 @@ set -e
 set -x
 export SHELLOPTS
 
-CLUSTER_NAME=test-cluster
-
-function fix_base64() {
-    if command -v gbase64 >/dev/null 2>&1 ; then
-        gbase64 "$@"
-    else
-        base64 "$@"
-    fi
-}
-
-ORG=test-org
-PROJECT=test-project
-
-function generate_user_token() {
-    local name=$1
-    local auth_container=$(docker ps --filter name=auth_server -q)
-    docker exec $auth_container platform-auth-make-token $name
-}
-
-function create_regular_user() {
-    local name=$1
-    local data="{\"name\": \"$name\"}"
-    curl --fail --data "$data" -H "Authorization: Bearer $ADMIN_TOKEN" \
-        http://localhost:5003/api/v1/users
-    # Grant permissions to the user images
-    local url="http://localhost:5003/api/v1/users/$name/permissions"
-    local data="[{\"uri\":\"image://$CLUSTER_NAME/$ORG\",\"action\":\"manage\"}]"
-    curl -s -X POST -H "Authorization: Bearer $ADMIN_TOKEN" -d "$data" $url --fail
-}
-
-function share_resource_on_read() {
-    local resource=$1
-    local who_token=$2
-    local whom=$3
-    local url="http://localhost:5003/api/v1/users/$whom/permissions"
-    local data="[{\"uri\":$resource,\"action\":\"read\"}]"
-    curl -s -X POST -H "Authorization: Bearer $who_token" -d "$data" $url --fail
-}
-
-function wait_for_registry() {
-    local cmd="curl http://127.0.0.1:5000/v2/ &> /dev/null"
-    # this for loop waits until the registry api is available
-    for _ in {1..150}; do # timeout for 5 minutes
-        if eval "$cmd"; then
-            break
-        fi
-        sleep 2
-    done
-}
-
-
-function docker_login() {
-    local name=$1
-    local token=$2
-    docker login -u $name -p $token 127.0.0.1:5000
-}
-
-function test_push_catalog_pull() {
-    echo -e "\n"
-
-    local name=$(uuidgen | awk '{print tolower($0)}')
-    local token=$(generate_user_token $name)
-    create_regular_user $name
-    docker_login $name $token
-    local repo_path="$ORG/$PROJECT"
-
-    echo "step 1: pull non existent"
-    local output=$(docker pull 127.0.0.1:5000/$repo_path/unknown:latest 2>&1)
-    [[ $output == *"manifest for 127.0.0.1:5000/$repo_path/unknown:latest not found"* ]]
-
-    echo "step 2: remove images and check catalog"
-    docker rmi ubuntu:latest 127.0.0.1:5000/$repo_path/ubuntu:latest || :
-    docker rmi alpine:latest 127.0.0.1:5000/$repo_path/alpine:latest || :
-    test_catalog $name $token ""
-
-    echo "step 3: push ubuntu, check catalog"
-    docker_tag_push $name $token "ubuntu"
-    local expected="\"$repo_path/ubuntu\""
-    test_catalog $name $token "$expected"
-    test_repo_tags_list $name $token "$repo_path/ubuntu"
-
-    echo "step 4: push alpine, check catalog"
-    docker_tag_push $name $token "alpine"
-    local expected="\"$repo_path/alpine\", \"$repo_path/ubuntu\""
-    test_catalog $name $token "$expected"
-
-    echo "step 5: remove ubuntu, check pull"
-    docker rmi ubuntu:latest
-    docker pull 127.0.0.1:5000/$repo_path/ubuntu:latest
-
-    echo "step 6: remove alpine, check pull"
-    docker rmi alpine:latest
-    docker pull 127.0.0.1:5000/$repo_path/alpine:latest
-}
-
-
-function docker_tag_push() {
-    local name=$1
-    local token=$2
-    local image=$3
-    docker pull $image:latest
-    docker tag $image:latest 127.0.0.1:5000/$ORG/$PROJECT/$image:latest
-    docker push 127.0.0.1:5000/$ORG/$PROJECT/$image:latest
-}
-
-function test_catalog() {
-    local name=$1
-    local token=$2
-    local expected="$3"
-    local url="http://127.0.0.1:5000/v2/_catalog?org=$ORG&project=$PROJECT"
-    local auth_basic_token=$(echo -n $name:$token | fix_base64 -w 0)
-    local output=$(curl -sH "Authorization: Basic $auth_basic_token" $url)
-    echo $output | grep -w "{\"repositories\": \[$expected\]}"
-}
-
-function test_digest() {
-    local name=$1
-    local token=$2
-    local image=$3
-    local tag=$4
-    local url="http://127.0.0.1:5000/v2/$image/manifests/$tag"
-    local auth_basic_token=$(echo -n $name:$token | fix_base64 -w 0)
-    local output=$(curl --verbose -sH "Authorization: Basic $auth_basic_token" $url 2>&1)
-    echo $output | grep -w "Docker-Content-Digest:"
-}
-
-function test_repo_tags_list() {
-    local name=$1
-    local token=$2
-    local repo="$3"
-    local url="http://127.0.0.1:5000/v2/$repo/tags/list"
-    local auth_basic_token=$(echo -n $name:$token | fix_base64 -w 0)
-    local output=$(curl -sH "Authorization: Basic $auth_basic_token" $url)
-    echo $output | grep "\"name\": \"$repo\""
-    echo $output | grep "\"tags\": \["
-}
-
-function get_registry_token_for_catalog() {
-    # the way to get auth token for accessing _catalog without using platform-registry-api:
-    local username=$1
-    local password=$2
-    local registry_url=$3
-    local service=$4
-    local auth_url="$registry_url?service=$service&scope=registry:catalog:*"
-    local auth_basic_token=$(echo -n $username:$password | fix_base64 -w 0)
-    curl -sH "Authorization: Basic $auth_basic_token" "$auth_url" | jq -r .token
-    # NOTE (A Yushkovskiy, 25.12.2018) Read materials:
-    # - on docker registry auth protocol:
-    #   https://github.com/docker/distribution/blob/master/docs/spec/auth/token.md
-    # - on docker listing catalog REST API:
-    #   https://docs.docker.com/registry/spec/api/#listing-repositories
-    # - examples of ACL rules for docker registry image:
-    #   https://github.com/cesanta/docker_auth/blob/master/examples/reference.yml
-}
-
-function debug_docker_catalog_local() {
-    local user=testuser
-    local password=testpassword
-    local registry_token=`get_registry_token_for_catalog "$user" "$password" "http://localhost:5001/auth" "upstream"`
-    curl -sH "Authorization: Bearer $registry_token" "http://localhost:5002/v2/_catalog" | jq
-}
-
-function debug_docker_catalog_gcr() {
-    local user=$1
-    local password=$2
-    local registry_token=`get_registry_token_for_catalog "$user" "$password" "https://gcr.io/v2/token" "gcr.io"`
-    curl -sH "Authorization: Bearer $registry_token" "https://gcr.io/v2/_catalog" | jq
-}
-
-ADMIN_TOKEN=$(generate_user_token admin)
+source tests/test_utils.sh
 
 wait_for_registry