Tuesday, February 12, 2013

Python magic and remote APIs

I'm a pretty big fan of Python as a programming language. It allows me to program by discovery, that is poke and prod at things until the work. Not having to compile an entire program every time I change something is pretty fantastic, as is the ability to insert a debug statement and be able to break a program at that point, then run arbitrary python code within that context. Pretty indispensable to how I write software.

Another thing I like about Python, which some may not, is the ability to do magic things. Not quite so magic as xkcd would like us to believe, but fun stuff indeed.

Recently one of the services at work grew a json API to bang against, and for fun I thought I'd whip up some python to play with it. My team had a few utility scripts that would bang on the old xmlrpc interface to get some data, I wanted to see how much faster it was with json.

First, if you have to do anything web stuff, you really should be using the Requests module. It is so, so much better than using urllib(2) directly.

The API I wanted to program against had an Auth end point that would return to you a token string. This string could be included with later API calls to provide authentication. Requests lets you create a session object that can have attributes that carry on to all web calls, such as a custom auth header with a token.

resp = requests.get('https://URL/api/auth/USERNAME?password=DATA')
resp.json()
  u'LONGSTRING'
token = resp.json()
session = requests.Session()
session.headers.update({'X-Auth': token})

Now the session object can be used just like requests itself, and it'll include the new header we've added. While this was neat at first, I quickly realized that I wanted to make this session object an attribute of a more generic object for working with the API. Each time you use session or requests you have to fill in a url and that's tedious, so I made a python class to handle that for me. One bit of magic I used here was a python property.

A python property is a way populate a class attribute on the fly / as needed without the code using your object needing to know that it's happening behind the scenes. It's a getter/setter without having to get and set, and it caches the value for future getting.  My class sets some data during the init process, and creates a property for the session attribute, which can then be used in later functions, like a login or query function.

class CServ(object):
    """A cservice object that we will interact with."""

    def __init__(self):
        self.API = 'URL'
        self.SessURL = self.API + 'session/'
        self.QAPI = self.API + 'query/'
        self._session = None
    
    def _login(self):
        username = myuser
        password = mypass
        data = {'password': password}
        r = requests.get('%sauth/%s' % (self.API, username), params=data)
        return r.json()
        
    @property
    def session(self):
        if not self._session:
            self._auth()
        return self._session

    def _auth(self):
        token = self._login()
        # Build up a session object with the token
        s = requests.Session()
        s.headers.update({'X-Auth': token})
        self._session = s

    def query(self, classname, load_arg, attributes=None):
        """Wrangle a query into the json interface.

        classname -- The name of the cserv api class to query against
        load_arg -- The argument to query for (can be a list)
        attributes -- an optional list of what to return

        returns jsonified results
        """

        # See if we have a list of load args to go through
        if type(load_arg) == list:
            # Build up a dict of the bits we need to pass in
            bits = []
            for arg in load_arg:
                qdict = {'class': classname, 'load_arg': arg}
                if attributes:
                    qdict['attributes'] = attributes
                bits.append(qdict)
        else:
            bits = {'class': classname, 'load_arg': load_arg}
            if attributes:
                bits['attributes'] = attributes

        data = self.session.post(self.QAPI, json.dumps(bits))
        return data.json()

With this structure we can do things like:

cserv = CServ()
cserv.query('Computer.Computer', 432807, attributes=['name'])
  [{u'count': 1, u'load_arg': 432807, u'limit': 1, u'result': 
  [{u'name': u'silly.hostname.here.com'}], u'offset': 0,
  u'class': u'Computer.Computer'}]

We get back a json blob that has what the API returned to us. What happened was that the query function built up the information for the requests bit, which was passed into self.session.post(). Since this was the first time trying to access self.session we went through the @property tagged session() function. That function determined that self._session was not populated yet and called _auth(). _auth() in turn did the login dance to generate the token, built up a requests.Session object, tweaked the header and stuffed it into self._session. session() then returned that to the caller thus delivering the actual session object. Magic!  The next time session is accessed it will quickly return the value of self._session. Properties are awesome and useful.

A CServ() object is okay, but not useful on its own. If I wanted to get a bit of data about a computer and use that data numerous times I'd either have to store a copy of the data in a local variable, or do queries each time I wanted the data. Neither are efficient. What I really want is to be able to create a Computer object, and from that object access attributes directly, like say Computer.name. Here is where some more magic comes in. We already know we can create properties to back attributes. We could go find out what all possible things we could look up about a computer in our CServ service, then write out properties for each of those. That... doesn't sound fun. Particularly if you think about this CServ having Computer items, Switch items, Account items, etc... That would be a lot of typing!

What if instead there was a way to do dynamic properties?  What if when we tried to access Computer.primary_ip the code would just know to do a query to look up the 'primary_ip' attribute of a Computer.Computer cserv API class?  Well we're in luck, because there is a way!

First we're going to create a subclass of CServ, CServOBJ. This class will be a base class for any number of objects, like Computers, Accounts, etc.. We can save a lot of code duplication by putting the shared bits in CServOBJ.

class CServOBJ(CServ):
    """A base CServ object class to build from"""

Right now we don't need to overload the __init__ method, so we can dive right into the magic. In python, when you attempt to access an object's attribute, behind the scenes an object's __getattr__(attribute) method is called. Normally you don't see it because it's all built in, but we can override it to make attribute access do something different. In our case, we want to do an API look up to get the value if we don't already have it, so we'll overload the function:

    def __getattr__(self, name):
        try:
            return self.__dict__[name]
        except KeyError:
            self._setAttrib(name)
            return self.__dict__[name]

    def _setAttrib(self, name):
        resp = self.session.get('%sattribute/%s/%s/%s' %
                                (self.API, self._qclass, self._qval, name))
        resp.raise_for_status()
        setattr(self, name, resp.json())

Objects in python also have a built in __dict__ that keeps track of all the attributes. Our simple little bit of code will try to return the value for the name of the attribute the function gets. If that attribute doesn't exist in the built in dict, a keyerror would happen. We catch that error and call our _setAttrib() function. This function is where the look up is built up using some other class attributes we'll get to later. A session call is made and the value is fed into the setattr python built-in. All this work happens behind the scenes to the bit of code just trying to access the attribute, and the lookup only happens once.  That's all we really need for now in the base class, lets create a Computer class.

class Computer(CServOBJ):
    """A class to represent the Computer.Computer CServ API class"""

    _qclass = 'Computer.Computer'
    def __init__(self, number):
        self.number = number
        self._qval = self.number
        super(Computer, self).__init__() 

That's all there is to it.  _qclass is defined as a class attribute, it does not change per-object.  It is the class name passed into the remote API.  The object creation takes a number, which is the identifier for computers in our system.  It assigns that to the number attribute so that if we reference computer.number we don't make another API call.  _qval is the place holder that will be common across all the objects for what do use as a look up key.  The parent class's init is called (which skips all the way up to CServ) to complete the object creation.

With this setup, we can program against it very easily to access and cache data:

comp = Computer(432888)
print(comp.number)
  432888
print(comp.primary_ip)
  10.14.232.158

MAGIC!

Now if you are like me, you spend a lot of time in things like ipython or bpython to interactively program stuff and play with objects and whatnot.  These environments provide tab completion, help functions, etc...  With our current code though, we couldn't tab complete the available attributes.  Only the name attribute and the functions we've created would show up.  To fix that, we need to overload the built in __dir__ function.  This function is used when getting a listing of what is available to an object, dir(object).  A useful exploratory tool.  ipython/bpython use this method to see what tab completion options to provide you.  Luckily our internal service provides an API call to get a listing of possible attributes, so we can hook that into __dir__.  But of course we only want to do this API call once (per object) so we will want to make it a property.  Since there is nothing API class specific we can put the code into the CServOBJ class:

    def __init__(self):
        self._attributes = None
        super(CServOBJ, self).__init__()

    @property
    def attribs(self):
        if not self._attribs:
            self._attribs = []
            resp = self.session.get('%sattributes/%s' %
                                    (self.API, self._qclass))
            for att in resp.json():
                self._attribs.append(att[0])
        return self._attribs

    def __dir__(self):
        return sorted(dir(type(self)) + list(self.__dict__) + self.attribs)

Since we are creating a property at this level we will grow an __init__ function to prep for that. Then we define the attribs() function. A short-cut is taken here, instead of calling out to some other function to load the attributes the load is done directly.  Any time a Computer object gets a dir() call our overloaded function will return a sorted list that is the combination of the built in functions/attributes, anything that has been added to the specific object, and the available API attributes.  Tab-completion achieved!

This has been a quick look into some of the magic you can do with Python.  It's not quite antigravity, but it is useful, and food for thought for anybody that's programming against remote APIs.  Objects are good, objects with dynamic attributes are better, and tab completion is icing on the cake.  Enjoy!

Monday, January 28, 2013

New blog name, new focus

I've renamed this blog to "Adventures in The Cloud".  My day job is now DevOps for Rackspace's public cloud, and I'll occasionally blog about those adventures.  This is where those blog posts will land.

Right now I'm still learning my way around things and finding places to help out, so not a lot to blog about yet.  My first big task is a cleanup of our cloud, finding VMs that are still running that should be deleted, VMs stuck in a delete action, or VMs that aren't running any more but our DB thinks they are.  There are various other clean up items I'm finding along the way.  The software I'm writing to do this will likely be contributed to OpenStack upstream at some point (soon) as it'll be useful to anybody running an OpenStack based cloud.  Nobody likes wasted resources!

That's all for now, back again when I have something fun to talk about.

Monday, November 26, 2012

Hanging up the Hat

Seven years ago I put on a Red Hat.  I had been a part of the community for a few years prior to that as well, first as a newbie in #redhat looking for help, later as somebody providing help to others, then as an early cabal member in the newly formed Fedora project, later as a leader of Fedora Legacy.  Along the way I've made some very strong friendships that I hope will continue.

This is my last week as a Red Hatter.

I'd like to think that the Fedora project is a better place now than when I joined.  I hope my time here has made a positive difference.  My new role will leave me with less time to participate directly in Fedora, although I will likely continue maintaining a few packages here and there for my personal use.

I do plan on being at FUDCon in January, I hope to see many of you there.

I'll likely be shutting down this particular blog this week, but a new one will start and I'll link to it from here if you really like me and wish to keep tabs on what I'm doing :)

Friday, October 12, 2012

Text Mode for Fedora 18

Anaconda has been through a pretty major UI rewrite.  Anybody that has tried either Fedora 18 Alpha or any of the nightly images since then should be well aware of this.

The UI rewrite was done for many reasons and accomplishes many goals.  I'm not going to rehash that here.  What I am going to talk about is what happened to text mode.

Text mode in F17 and before was ncurses based.  This gave some kind of pretty UI to do things.  There were drawbacks though.  ncurses didn't work on all the terminals people throw at Anaconda, in particular dumb serial terminals and x3270, the terminal for s390x.  Because of that we also had a (non-interactive) very simple display mode called 'cmdline'.  This just did simple line printing of progress during a kickstart.  Unfortunately due to the way the old UI was coded there wasn't a good complete separation of presentation from computation so many things were written 3 times.  Once for gui, once for text, and once for cmdline.  Fun right?

With Fedora 18 there is one text UI.  It is used on full featured consoles as well as dumb ones.  It doesn't use ncurses, it just uses simple line printing.  It can be used over serial (interactively!) and over x3270 (non-interactively).  It is a simple question and answer prompt.

The design of text mode for F18 and beyond is closely modelled after the design of the GUI for F18 and beyond.  A hub and a set of spokes, so that users can do tasks in whatever order they wish, potentially while things happen in the background.  There is a main setup hub where the user can set a time zone, set a root password, and do some basic storage configuration (pick target disks and a strategy to clear space on those disks).  Once all tasks are complete the user can progress into the actual installation where we just throw up a running list of tasks the backend is accomplishing.

There are very few things you can do with text mode in Fedora 18.  You cannot pick languages,  and you cannot pick installation source.  These can be provided via boot time arguments.  You also cannot do advanced storage configuration which would need a kickstart file to accomplish via "text mode".  We are planning to add some functionality for Fedora 19, but we haven't decided which items and how rich those items will be.  Text mode is still de-emphasized in favor of direct GUI or remote GUI by way of VNC.  For kickstarts however text mode is still pretty great.  The minimal UI does not prevent a fully customized kickstart from being executed.

Give text mode a spin!  It's simple, fast, unobtrusive, and gets the job done.

Thursday, October 11, 2012

Just in case you were wondering...

I've just made the Fedora 18 installer work well on s390x again.  You know, for the 10s of you out there that care.

You're welcome.

Root password in Fedora 18

As part of the Anaconda UI redesign, we had hoped to offload root password setting to the installed host.  We had envisioned a scenario where the installer locked the root account and post-install software such as Firstboot or Gnome Initial Experience would take care of adding a user to the system and marking that user as a "super" user.  This would obviate the need for a root password, as the super user could use sudo to accomplish admin tasks.

That's how things looked prior to Fedora 18 Alpha, but in testing it became apparent that we couldn't always count on Firstboot or GIE to set things up right, or even be present. 

This was particularly true of text mode, where the only packages installed was the bare minimal set.  So first text mode grew a password spoke, and we made it mandatory.

Then I wrote a password spoke for GUI mode which lived in the main setup hub.  For Alpha this was an optional spoke and it defaulted to a locked root account.  Some thought was put into flipping the optional vs mandatory state based on install data, such as whether or not Firstboot was selected for install.  Part of being able to do that was moving the spoke from the main setup hub to the install (or configuration) hub.   If it lives in this hub we should have finalized data about what packages were selected for install.  However doubts arose as to whether "part of the payload" was enough data to ensure that Firstboot or GIE actually ran and we were worried we could still lead users into being locked out of their freshly installed system.

So, for Beta, I've just pushed a set of changes that will make the password spoke a mandatory spoke.  You must visit the spoke before you can complete the install.  You can still mark the root account as disabled, just by leaving the password fields blank, but you do so at your own risk.  This configuration is likely to remain for Fedora 18.

Thursday, June 7, 2012

11 files changed, 87 insertions(+), 97 deletions(-)

I've just posted my largest change to the installer code base yet.  This pile of changes moves some functionality out of the installer itself and into the pre-exec environment of dracut and systemd.

For a while now, anaconda has had the ability to fire up an sshd server in the install environment.  It's useful to be able to ssh into the system as it's being installed and poke around on the shell.  Doubly useful when doing remote installs of headless systems.  Required for doing installs on systems that have crap for a (remote) console like s390x. 

Anaconda had 2 ways of bringing up sshd, on s390x a replacement for /sbin/init would get ran and bring up the sshd server automatically.  But on other arches it was up to anaconda itself to bring up the ssh server, if the "sshd" boot option was encountered.  Along with the sshd boot argument there was a kickstart argument "sshpw" that would get handled to set a password for the user(s) who could log in via ssh.  Of course, s390x couldn't make use of this because sshd was started prior to anaconda, and in fact, anaconda wouldn't start until somebody ssh'd in as the "install" user.  Hurray for differences!

Now that we've got systemd bringing things up and anaconda isn't "init" any more , it's just a service and target, we can do some fun things.  We can create our own anaconda-sshd.service to go along with our own sshd config specific to anaconda.  We can use a systemd generator to look for "inst.sshd" boot argument (all anaconda boot args were renamed to start with inst. in F17) or s390x arch and if found make the anaconda-sshd.service be a part of the anaconda.target.  The anaconda-sshd.service makes use of an ExecStartPre script to parse the "sshpw" kickstart line (if it exists) and setup users/passwords accordingly, before sshd itself is brought up.

This accomplishes a few goals:
  • ssh bring up is the same on s390x vs other arches
  • passwords are configurable for s390x just like other arches
  • anaconda code doesn't have to deal with service bring up
  • gets us closer to s390x bring up without having to replace init
  • results in net-negative code in the repository
So that code has been posted, ready for my peers to find all the holes in my logic and errors in my programming.  It's a significant enough change though that it feels a lot more like contributing as part of the team as opposed to the occasional run-by patching I've done before as part of other teams.