Merge branch 'main' into gpu-quota

.github/workflows/build.yml

@@ -1,8 +1,9 @@
 name: Build
 on:
-  schedule:
-    - cron: '0 2 * * *'
+  #schedule:
+  #  - cron: '0 2 * * *'
   push:
+  workflow_dispatch:
 
 env:
   REGISTRY: ghcr.io

requirements.txt

@@ -1,10 +1,10 @@
 dacite
-kubernetes==24.2.0
+kubernetes>=28,<29
 flask==2.3.2
 jsonify
 waitress
 PyHamcrest
 requests_mock
 dataclasses-json
 python-dotenv
-git+https://github.com/ucsd-ets/awsed_python_client.git@Rebuild
+git+https://github.com/ucsd-ets/awsed_python_client.git@2024.1.2-RC1

src/dsmlp/app/id_validator.py

@@ -23,21 +23,32 @@ def validate_pod(self, request: Request):
         Validate pods for namespaces with the 'k8s-sync' label
         """
         username = request.namespace
-    #        namespace = self.kube.get_namespace(request.namespace)
+#        namespace = self.kube.get_namespace(request.namespace)
 
-    #        if 'k8s-sync' in namespace.labels:
+#        if 'k8s-sync' in namespace.labels:
         user = self.awsed.describe_user(username)
+        if not user:
+            raise ValidationFailure(f"namespace: no AWSEd user found with username {username}")
         allowed_uid = user.uid
+        allowed_courses = user.enrollments
 
         team_response = self.awsed.list_user_teams(username)
         allowed_gids = [team.gid for team in team_response.teams]
         allowed_gids.append(0)
         allowed_gids.append(100)
 
+        metadata = request.object.metadata
         spec = request.object.spec
+        self.validate_course_enrollment(allowed_courses, metadata.labels)
         self.validate_pod_security_context(allowed_uid, allowed_gids, spec.securityContext)
         self.validate_containers(allowed_uid, allowed_gids, spec)
 
+    def validate_course_enrollment(self, allowed_courses: List[str], labels: Dict[str, str]):
+        if not 'dsmlp/course' in labels:
+            return
+        if not labels['dsmlp/course'] in allowed_courses:
+            raise ValidationFailure(f"metadata.labels: dsmlp/course must be in range {allowed_courses}")
+
     def validate_pod_security_context(
             self,
             authorized_uid: int,

src/dsmlp/app/validator.py

@@ -1,6 +1,6 @@
 from dataclasses import dataclass
 import json
-from typing import List, Optional
+from typing import Dict, List, Optional
 
 from dataclasses_json import dataclass_json
 from dsmlp.plugin.awsed import AwsedClient, UnsuccessfulRequest

src/dsmlp/ext/awsed.py

@@ -15,7 +15,9 @@ def __init__(self):
 
     def describe_user(self, username: str) -> UserResponse:
         usrResultJson = self.client.describe_user(username)
-        return UserResponse(uid=usrResultJson.uid)
+        if not usrResultJson:
+            return None
+        return UserResponse(uid=usrResultJson.uid, enrollments=usrResultJson.enrollments)
 
     def list_user_teams(self, username: str) -> ListTeamsResponse:
         usrTeams = self.client.list_teams(username)
@@ -24,4 +26,4 @@ def list_user_teams(self, username: str) -> ListTeamsResponse:
         for team in usrTeams.teams:
             teams.append(TeamJson(gid=team.gid))
 
-        return ListTeamsResponse(teams=teams)
+        return ListTeamsResponse(teams=teams)

src/dsmlp/plugin/awsed.py

@@ -16,6 +16,7 @@ class ListTeamsResponse:
 @dataclass
 class UserResponse:
     uid: int
+    enrollments: List[str]
 
 
 class AwsedClient(metaclass=ABCMeta):

tests/fakes.py

@@ -27,7 +27,7 @@ def describe_user(self, username: str) -> UserResponse:
         try:
             return self.users[username]
         except KeyError:
-            raise UnsuccessfulRequest()
+            return None
 
     def add_user(self, username, user: UserResponse):
         self.users[username] = user