Improving the FRIDGE API build process and fixing issue with Minio STS token expiry

fridge-job-api/.dockerignore

@@ -0,0 +1,7 @@
+__pycache__/
+*.pyc
+*.pyo
+.venv/
+README.md
+.python-version
+package-lock.json

fridge-job-api/Dockerfile

@@ -1,23 +1,21 @@
-FROM ghcr.io/astral-sh/uv:python3.13-bookworm
-
-RUN groupadd -g 1001 appuser && useradd -m -u 1001 -g appuser appuser
+FROM ghcr.io/astral-sh/uv:python3.13-bookworm AS builder
 
 WORKDIR /app
 # Install dependencies
 RUN --mount=type=cache,target=/root/.cache/uv \
     --mount=type=bind,source=uv.lock,target=uv.lock \
     --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
     uv sync --locked --no-install-project --no-editable
-ADD . /app
-
+COPY . /app
+RUN uv sync --locked --no-editable
 # Sync the project
-RUN --mount=type=cache,target=/root/.cache/uv \
-    uv sync --locked --no-editable
+# --mount=type=cache,target=/root/.cache/uv \
 
 # Place executables in the environment at the front of the path
+FROM python:3.13-slim-bookworm
+RUN groupadd -g 1001 appuser && useradd -m -u 1001 -g appuser appuser
+WORKDIR /app
+COPY --from=builder --chown=appuser:appuseer /app /app
 ENV PATH="/app/.venv/bin:$PATH"
-ENTRYPOINT []
-
-RUN chown -R appuser:appuser /app
 USER appuser
 CMD ["fastapi", "run", "--host", "0.0.0.0", "app/main.py"]

fridge-job-api/app/minio_client.py

@@ -79,9 +79,6 @@ def handle_sts_auth(self):
         # Read service account token
         sa_token = Path(self.SA_TOKEN_FILE).read_text().strip()
 
-        # Cache the token used here for change detection
-        self._last_token = sa_token
-
         ssl_context = ssl.create_default_context(cafile=self.KUBE_CA_CRT)
 
         # Create urllib3 client which accepts kube CA cert
@@ -104,6 +101,8 @@ def handle_sts_auth(self):
             secret_key = credentials.find("sts:SecretAccessKey", ns).text
             session_token = credentials.find("sts:SessionToken", ns).text
 
+            # Cache the token used here for change detection
+            self._last_token = sa_token
             return access_key, secret_key, session_token
 
     def _token_has_changed(self):
@@ -129,6 +128,9 @@ def _refresh_token(self):
                     print("Minio client token refreshed successfully")
                 else:
                     print("Failed to refresh Minio client token")
+                    raise HTTPException(
+                        status_code=500, detail="Failed to refresh Minio token"
+                    )
             except Exception as e:
                 print(f"Failed to refresh Minio client token: {e}")
                 raise HTTPException(