X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/53b1b5bbe6d6ae007e8ce546ba2539e0c061e25a..4115524460e89f36b99f2fb5de1adebd86daaf4a:/sdk/go/arvadosclient/arvadosclient.go diff --git a/sdk/go/arvadosclient/arvadosclient.go b/sdk/go/arvadosclient/arvadosclient.go index 1cce0a7fc9..021b9471ff 100644 --- a/sdk/go/arvadosclient/arvadosclient.go +++ b/sdk/go/arvadosclient/arvadosclient.go @@ -5,15 +5,20 @@ package arvadosclient import ( "bytes" "crypto/tls" + "crypto/x509" "encoding/json" "errors" "fmt" "io" + "io/ioutil" "net/http" "net/url" "os" "regexp" "strings" + "time" + + "git.curoverse.com/arvados.git/sdk/go/arvados" ) type StringMatcher func(string) bool @@ -25,6 +30,14 @@ var MissingArvadosApiHost = errors.New("Missing required environment variable AR var MissingArvadosApiToken = errors.New("Missing required environment variable ARVADOS_API_TOKEN") var ErrInvalidArgument = errors.New("Invalid argument") +// A common failure mode is to reuse a keepalive connection that has been +// terminated (in a way that we can't detect) for being idle too long. +// POST and DELETE are not safe to retry automatically, so we minimize +// such failures by always using a new or recently active socket. +var MaxIdleConnectionDuration = 30 * time.Second + +var RetryDelay = 2 * time.Second + // Indicates an error that was returned by the API server. type APIServerError struct { // Address of server returning error, of the form "host:port". @@ -58,6 +71,9 @@ type Dict map[string]interface{} // Information about how to contact the Arvados server type ArvadosClient struct { + // https + Scheme string + // Arvados API server, form "host:port" ApiServer string @@ -74,25 +90,102 @@ type ArvadosClient struct { // the client is outside the cluster. External bool + // Base URIs of Keep services, e.g., {"https://host1:8443", + // "https://host2:8443"}. If this is nil, Keep clients will + // use the arvados.v1.keep_services.accessible API to discover + // available services. + KeepServiceURIs []string + // Discovery document DiscoveryDoc Dict + + lastClosedIdlesAt time.Time + + // Number of retries + Retries int +} + +var CertFiles = []string{ + "/etc/arvados/ca-certificates.crt", + "/etc/ssl/certs/ca-certificates.crt", // Debian/Ubuntu/Gentoo etc. + "/etc/pki/tls/certs/ca-bundle.crt", // Fedora/RHEL +} + +// MakeTLSConfig sets up TLS configuration for communicating with Arvados and Keep services. +func MakeTLSConfig(insecure bool) *tls.Config { + tlsconfig := tls.Config{InsecureSkipVerify: insecure} + + if !insecure { + // Look for /etc/arvados/ca-certificates.crt in addition to normal system certs. + certs := x509.NewCertPool() + for _, file := range CertFiles { + data, err := ioutil.ReadFile(file) + if err == nil { + success := certs.AppendCertsFromPEM(data) + if !success { + fmt.Printf("Unable to load any certificates from %v", file) + } else { + tlsconfig.RootCAs = certs + break + } + } + } + // Will use system default CA roots instead. + } + + return &tlsconfig } -// Create a new ArvadosClient, initialized with standard Arvados environment -// variables ARVADOS_API_HOST, ARVADOS_API_TOKEN, and (optionally) -// ARVADOS_API_HOST_INSECURE. -func MakeArvadosClient() (ac ArvadosClient, err error) { +// New returns an ArvadosClient using the given arvados.Client +// configuration. This is useful for callers who load arvados.Client +// fields from configuration files but still need to use the +// arvadosclient.ArvadosClient package. +func New(c *arvados.Client) (*ArvadosClient, error) { + ac := &ArvadosClient{ + Scheme: "https", + ApiServer: c.APIHost, + ApiToken: c.AuthToken, + ApiInsecure: c.Insecure, + Client: &http.Client{Transport: &http.Transport{ + TLSClientConfig: MakeTLSConfig(c.Insecure)}}, + External: false, + Retries: 2, + lastClosedIdlesAt: time.Now(), + } + + return ac, nil +} + +// MakeArvadosClient creates a new ArvadosClient using the standard +// environment variables ARVADOS_API_HOST, ARVADOS_API_TOKEN, +// ARVADOS_API_HOST_INSECURE, ARVADOS_EXTERNAL_CLIENT, and +// ARVADOS_KEEP_SERVICES. +func MakeArvadosClient() (ac *ArvadosClient, err error) { var matchTrue = regexp.MustCompile("^(?i:1|yes|true)$") insecure := matchTrue.MatchString(os.Getenv("ARVADOS_API_HOST_INSECURE")) external := matchTrue.MatchString(os.Getenv("ARVADOS_EXTERNAL_CLIENT")) - ac = ArvadosClient{ + ac = &ArvadosClient{ + Scheme: "https", ApiServer: os.Getenv("ARVADOS_API_HOST"), ApiToken: os.Getenv("ARVADOS_API_TOKEN"), ApiInsecure: insecure, Client: &http.Client{Transport: &http.Transport{ - TLSClientConfig: &tls.Config{InsecureSkipVerify: insecure}}}, - External: external} + TLSClientConfig: MakeTLSConfig(insecure)}}, + External: external, + Retries: 2} + + for _, s := range strings.Split(os.Getenv("ARVADOS_KEEP_SERVICES"), " ") { + if s == "" { + continue + } + if u, err := url.Parse(s); err != nil { + return ac, fmt.Errorf("ARVADOS_KEEP_SERVICES: %q: %s", s, err) + } else if !u.IsAbs() { + return ac, fmt.Errorf("ARVADOS_KEEP_SERVICES: %q: not an absolute URI", s) + } + ac.KeepServiceURIs = append(ac.KeepServiceURIs, s) + } if ac.ApiServer == "" { return ac, MissingArvadosApiHost @@ -101,16 +194,20 @@ func MakeArvadosClient() (ac ArvadosClient, err error) { return ac, MissingArvadosApiToken } + ac.lastClosedIdlesAt = time.Now() + return ac, err } // CallRaw is the same as Call() but returns a Reader that reads the // response body, instead of taking an output object. -func (c ArvadosClient) CallRaw(method string, resourceType string, uuid string, action string, parameters Dict) (reader io.ReadCloser, err error) { - var req *http.Request - +func (c *ArvadosClient) CallRaw(method string, resourceType string, uuid string, action string, parameters Dict) (reader io.ReadCloser, err error) { + scheme := c.Scheme + if scheme == "" { + scheme = "https" + } u := url.URL{ - Scheme: "https", + Scheme: scheme, Host: c.ApiServer} if resourceType != API_DISCOVERY_RESOURCE { @@ -140,36 +237,73 @@ func (c ArvadosClient) CallRaw(method string, resourceType string, uuid string, } } - if method == "GET" || method == "HEAD" { - u.RawQuery = vals.Encode() - if req, err = http.NewRequest(method, u.String(), nil); err != nil { - return nil, err - } - } else { - if req, err = http.NewRequest(method, u.String(), bytes.NewBufferString(vals.Encode())); err != nil { - return nil, err - } - req.Header.Add("Content-Type", "application/x-www-form-urlencoded") + retryable := false + switch method { + case "GET", "HEAD", "PUT", "OPTIONS", "DELETE": + retryable = true } - // Add api token header - req.Header.Add("Authorization", fmt.Sprintf("OAuth2 %s", c.ApiToken)) - if c.External { - req.Header.Add("X-External-Client", "1") + // Non-retryable methods such as POST are not safe to retry automatically, + // so we minimize such failures by always using a new or recently active socket + if !retryable { + if time.Since(c.lastClosedIdlesAt) > MaxIdleConnectionDuration { + c.lastClosedIdlesAt = time.Now() + c.Client.Transport.(*http.Transport).CloseIdleConnections() + } } // Make the request + var req *http.Request var resp *http.Response - if resp, err = c.Client.Do(req); err != nil { - return nil, err - } - if resp.StatusCode == http.StatusOK { - return resp.Body, nil + for attempt := 0; attempt <= c.Retries; attempt++ { + if method == "GET" || method == "HEAD" { + u.RawQuery = vals.Encode() + if req, err = http.NewRequest(method, u.String(), nil); err != nil { + return nil, err + } + } else { + if req, err = http.NewRequest(method, u.String(), bytes.NewBufferString(vals.Encode())); err != nil { + return nil, err + } + req.Header.Add("Content-Type", "application/x-www-form-urlencoded") + } + + // Add api token header + req.Header.Add("Authorization", fmt.Sprintf("OAuth2 %s", c.ApiToken)) + if c.External { + req.Header.Add("X-External-Client", "1") + } + + resp, err = c.Client.Do(req) + if err != nil { + if retryable { + time.Sleep(RetryDelay) + continue + } else { + return nil, err + } + } + + if resp.StatusCode == http.StatusOK { + return resp.Body, nil + } + + defer resp.Body.Close() + + switch resp.StatusCode { + case 408, 409, 422, 423, 500, 502, 503, 504: + time.Sleep(RetryDelay) + continue + default: + return nil, newAPIServerError(c.ApiServer, resp) + } } - defer resp.Body.Close() - return nil, newAPIServerError(c.ApiServer, resp) + if resp != nil { + return nil, newAPIServerError(c.ApiServer, resp) + } + return nil, err } func newAPIServerError(ServerAddress string, resp *http.Response) APIServerError { @@ -213,7 +347,7 @@ func newAPIServerError(ServerAddress string, resp *http.Response) APIServerError // Returns a non-nil error if an error occurs making the API call, the // API responds with a non-successful HTTP status, or an error occurs // parsing the response body. -func (c ArvadosClient) Call(method string, resourceType string, uuid string, action string, parameters Dict, output interface{}) error { +func (c *ArvadosClient) Call(method, resourceType, uuid, action string, parameters Dict, output interface{}) error { reader, err := c.CallRaw(method, resourceType, uuid, action, parameters) if reader != nil { defer reader.Close() @@ -232,22 +366,22 @@ func (c ArvadosClient) Call(method string, resourceType string, uuid string, act } // Create a new resource. See Call for argument descriptions. -func (c ArvadosClient) Create(resourceType string, parameters Dict, output interface{}) error { +func (c *ArvadosClient) Create(resourceType string, parameters Dict, output interface{}) error { return c.Call("POST", resourceType, "", "", parameters, output) } // Delete a resource. See Call for argument descriptions. -func (c ArvadosClient) Delete(resource string, uuid string, parameters Dict, output interface{}) (err error) { +func (c *ArvadosClient) Delete(resource string, uuid string, parameters Dict, output interface{}) (err error) { return c.Call("DELETE", resource, uuid, "", parameters, output) } // Modify attributes of a resource. See Call for argument descriptions. -func (c ArvadosClient) Update(resourceType string, uuid string, parameters Dict, output interface{}) (err error) { +func (c *ArvadosClient) Update(resourceType string, uuid string, parameters Dict, output interface{}) (err error) { return c.Call("PUT", resourceType, uuid, "", parameters, output) } // Get a resource. See Call for argument descriptions. -func (c ArvadosClient) Get(resourceType string, uuid string, parameters Dict, output interface{}) (err error) { +func (c *ArvadosClient) Get(resourceType string, uuid string, parameters Dict, output interface{}) (err error) { if !UUIDMatch(uuid) && !(resourceType == "collections" && PDHMatch(uuid)) { // No object has uuid == "": there is no need to make // an API call. Furthermore, the HTTP request for such @@ -259,7 +393,7 @@ func (c ArvadosClient) Get(resourceType string, uuid string, parameters Dict, ou } // List resources of a given type. See Call for argument descriptions. -func (c ArvadosClient) List(resource string, parameters Dict, output interface{}) (err error) { +func (c *ArvadosClient) List(resource string, parameters Dict, output interface{}) (err error) { return c.Call("GET", resource, "", "", parameters, output) }