16369691288

Committed 18 Jul 2025 11:43AM UTC coverage: 87.186% (-0.04%) from 87.229%

Build # 16369691288

Build Type

Pull #929

github

Committed by

web-flow

Commit Message

Merge 03ce98685 into 8be58eb79

Pull Request Pull Request #929: exp: session api proxy

Run Details

8 of 21 new or added lines in 3 files covered. (38.1%)

13 existing lines in 5 files now uncovered.

21486 of 24644 relevant lines covered (87.19%)

1.53 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

46.67

/components/renku_data_services/notebooks/api/amalthea_patches/api_proxy.py

"""Patches for the api proxy container."""

from typing import TYPE_CHECKING

from kubernetes import client

from renku_data_services.base_models.core import AnonymousAPIUser, AuthenticatedAPIUser
from renku_data_services.notebooks.api.amalthea_patches.utils import get_certificates_volume_mounts
from renku_data_services.notebooks.config import NotebooksConfig

if TYPE_CHECKING:
    # NOTE: If these are directly imported then you get circular imports.
    pass


def main_container(
    session_id: str,
    user: AnonymousAPIUser | AuthenticatedAPIUser,
    config: NotebooksConfig,
) -> client.V1Container | None:
    """The patch that adds the api proxy container to a session statefulset."""
    if not user.is_authenticated or user.access_token is None or user.refresh_token is None:
        return None

    etc_cert_volume_mount = get_certificates_volume_mounts(
        config,
        custom_certs=False,
        etc_certs=True,
        read_only_etc_certs=True,
    )

    prefix = "API_PROXY_"
    env = [
        client.V1EnvVar(name=f"{prefix}HOST", value=""),
        client.V1EnvVar(name=f"{prefix}PORT", value="58080"),
        client.V1EnvVar(name=f"{prefix}SESSION_ID", value=session_id),
        client.V1EnvVar(name=f"{prefix}RENKU_ACCESS_TOKEN", value=str(user.access_token)),
        client.V1EnvVar(name=f"{prefix}RENKU_REFRESH_TOKEN", value=str(user.refresh_token)),
        client.V1EnvVar(name=f"{prefix}RENKU_REALM", value=config.keycloak_realm),
        client.V1EnvVar(
            name=f"{prefix}RENKU_CLIENT_ID",
            value=str(config.sessions.git_proxy.renku_client_id),
        ),
        client.V1EnvVar(
            name=f"{prefix}RENKU_CLIENT_SECRET",
            value=str(config.sessions.git_proxy.renku_client_secret),
        ),
        client.V1EnvVar(name=f"{prefix}RENKU_URL", value="https://" + config.sessions.ingress.host),
    ]
    container = client.V1Container(
        image="leafty/test:api-proxy-8b05fcca",
        security_context={
            "runAsGroup": 1000,
            "runAsUser": 1000,
            "allowPrivilegeEscalation": False,
            "runAsNonRoot": True,
        },
        name="api-proxy",
        env=env,
        liveness_probe={
            "httpGet": {
                "path": "/health",
                "port": 58080,
            },
            "initialDelaySeconds": 3,
        },
        readiness_probe={
            "httpGet": {
                "path": "/health",
                "port": 58080,
            },
            "initialDelaySeconds": 3,
        },
        volume_mounts=etc_cert_volume_mount,
        resources={
            "requests": {"memory": "16Mi", "cpu": "50m"},
        },
    )
    return container

1	"""Patches for the api proxy container."""
2
3	from typing import TYPE_CHECKING	2✔
4
5	from kubernetes import client	2✔
6
7	from renku_data_services.base_models.core import AnonymousAPIUser, AuthenticatedAPIUser	2✔
8	from renku_data_services.notebooks.api.amalthea_patches.utils import get_certificates_volume_mounts	2✔
9	from renku_data_services.notebooks.config import NotebooksConfig	2✔
10
11	if TYPE_CHECKING:	2✔
12	# NOTE: If these are directly imported then you get circular imports.
NEW 13	pass	×
14
15
16	def main_container(	2✔
17	session_id: str,
18	user: AnonymousAPIUser \| AuthenticatedAPIUser,
19	config: NotebooksConfig,
20	) -> client.V1Container \| None:
21	"""The patch that adds the api proxy container to a session statefulset."""
NEW 22	if not user.is_authenticated or user.access_token is None or user.refresh_token is None:	×
NEW 23	return None	×
24
NEW 25	etc_cert_volume_mount = get_certificates_volume_mounts(	×
26	config,
27	custom_certs=False,
28	etc_certs=True,
29	read_only_etc_certs=True,
30	)
31
NEW 32	prefix = "API_PROXY_"	×
NEW 33	env = [	×
34	client.V1EnvVar(name=f"{prefix}HOST", value=""),
35	client.V1EnvVar(name=f"{prefix}PORT", value="58080"),
36	client.V1EnvVar(name=f"{prefix}SESSION_ID", value=session_id),
37	client.V1EnvVar(name=f"{prefix}RENKU_ACCESS_TOKEN", value=str(user.access_token)),
38	client.V1EnvVar(name=f"{prefix}RENKU_REFRESH_TOKEN", value=str(user.refresh_token)),
39	client.V1EnvVar(name=f"{prefix}RENKU_REALM", value=config.keycloak_realm),
40	client.V1EnvVar(
41	name=f"{prefix}RENKU_CLIENT_ID",
42	value=str(config.sessions.git_proxy.renku_client_id),
43	),
44	client.V1EnvVar(
45	name=f"{prefix}RENKU_CLIENT_SECRET",
46	value=str(config.sessions.git_proxy.renku_client_secret),
47	),
48	client.V1EnvVar(name=f"{prefix}RENKU_URL", value="https://" + config.sessions.ingress.host),
49	]
NEW 50	container = client.V1Container(	×
51	image="leafty/test:api-proxy-8b05fcca",
52	security_context={
53	"runAsGroup": 1000,
54	"runAsUser": 1000,
55	"allowPrivilegeEscalation": False,
56	"runAsNonRoot": True,
57	},
58	name="api-proxy",
59	env=env,
60	liveness_probe={
61	"httpGet": {
62	"path": "/health",
63	"port": 58080,
64	},
65	"initialDelaySeconds": 3,
66	},
67	readiness_probe={
68	"httpGet": {
69	"path": "/health",
70	"port": 58080,
71	},
72	"initialDelaySeconds": 3,
73	},
74	volume_mounts=etc_cert_volume_mount,
75	resources={
76	"requests": {"memory": "16Mi", "cpu": "50m"},
77	},
78	)
NEW 79	return container	×

SwissDataScienceCenter / renku-data-services / 16369691288

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous