feat(apigw_manager/config): add BK_APP_TENANT_ID (TencentBlueKing#227)

Author: wklken

sdks/apigw-manager/CHANGE.md

@@ -1,5 +1,13 @@
 ## Change logs
 
+### 4.1.0
+
+- [breaking change] 做了多租户改造的全租户应用必须显式设置 `BK_APP_TENANT_ID=system` (环境变量或django settings)
+
+### 4.0.1
+
+- 支持多租户
+
 ### 4.0.0
 
 - [breaking change] drop support for python 3.6/3.7, request >=3.8 and < 3.13

sdks/apigw-manager/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "apigw-manager"
-version = "4.0.4"
+version = "4.1.0"
 description = "The SDK for managing blueking gateway resource."
 readme = "README.md"
 authors = ["blueking <blueking@tencent.com>"]

sdks/apigw-manager/src/apigw_manager/apigw/utils.py

@@ -1,22 +1,24 @@
 # -*- coding: utf-8 -*-
 """
- * TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-蓝鲸 PaaS 平台(BlueKing-PaaS) available.
- * Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
- * Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at http://opensource.org/licenses/MIT
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
- * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations under the License.
+* TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-蓝鲸 PaaS 平台(BlueKing-PaaS) available.
+* Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
+* Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at http://opensource.org/licenses/MIT
+* Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+* an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+* specific language governing permissions and limitations under the License.
 """
+
 import os
 import re
 import zipfile
 
 import yaml
-from bkapi_client_core.config import SettingKeys, settings
-from packaging.version import Version as _Version, InvalidVersion
+from packaging.version import InvalidVersion
+from packaging.version import Version as _Version
 
 from apigw_manager.core import configuration
+from bkapi_client_core.config import SettingKeys, settings
 
 
 def get_configuration(**kwargs):
@@ -27,6 +29,7 @@ def get_configuration(**kwargs):
         ("BK_APP_CODE", "bk_app_code"),
         ("BK_APP_SECRET", "bk_app_secret"),
         ("BK_APIGW_JWT_PROVIDER_CLS", "jwt_provider_cls"),
+        ("BK_APP_TENANT_ID", "bk_app_tenant_id"),
     ]
 
     for attr, key in settings_mappings:
@@ -107,7 +110,7 @@ def _get_archived_files(cls, path):
         for root, _, files in os.walk(path):
             for name in files:
                 file_path = os.path.join(root, name)
-                path_to_name[file_path] = file_path[len(path):]
+                path_to_name[file_path] = file_path[len(path) :]
 
         return path_to_name
 

sdks/apigw-manager/src/apigw_manager/core/configuration.py

@@ -1,12 +1,12 @@
 # -*- coding: utf-8 -*-
 """
- * TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-蓝鲸 PaaS 平台(BlueKing-PaaS) available.
- * Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
- * Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at http://opensource.org/licenses/MIT
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
- * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations under the License.
+* TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-蓝鲸 PaaS 平台(BlueKing-PaaS) available.
+* Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
+* Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at http://opensource.org/licenses/MIT
+* Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+* an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+* specific language governing permissions and limitations under the License.
 """
 
 
@@ -23,6 +23,7 @@ def __init__(
         api_cache=None,
         access_token=None,
         jwt_provider_cls=None,
+        bk_app_tenant_id=None,
         *args,
         **kwargs,
     ):
@@ -34,3 +35,4 @@ def __init__(
         self.api_cache = api_cache
         self.access_token = access_token
         self.jwt_provider_cls = jwt_provider_cls
+        self.bk_app_tenant_id = bk_app_tenant_id

sdks/apigw-manager/src/apigw_manager/core/handler.py

@@ -1,21 +1,23 @@
 # -*- coding: utf-8 -*-
 """
- * TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-蓝鲸 PaaS 平台(BlueKing-PaaS) available.
- * Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
- * Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at http://opensource.org/licenses/MIT
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
- * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations under the License.
+* TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-蓝鲸 PaaS 平台(BlueKing-PaaS) available.
+* Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
+* Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at http://opensource.org/licenses/MIT
+* Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+* an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+* specific language governing permissions and limitations under the License.
 """
+
 import json
 import logging
+import os
 import typing
 
 from bkapi.bk_apigateway.client import Client as BKAPIGatewayClient
-from bkapi_client_core.exceptions import ResponseError
 
 from apigw_manager.core.exceptions import ApiException, ApiResponseError, ApiResultError
+from bkapi_client_core.exceptions import ResponseError
 
 if typing.TYPE_CHECKING:
     from apigw_manager.core import configuration  # noqa
@@ -75,6 +77,28 @@ def _call_with_cache(self, operation, **kwargs):
 
         return result
 
+    def _get_tenant_id(self):
+        """
+        获取应用所属的租户 ID
+        Note: BKPAAS_APP_TENANT_ID 和 BK_APP_TENANT_ID 的含义不一样
+            BKPAAS_APP_TENANT_ID 是应用的租户模式标识，表示应用是全租户还是单租户
+            BK_APP_TENANT_ID 是应用所属的租户 ID，表示应用是属于哪个租户的，即由哪个租户产生的
+        """
+        # [大多数是外部 SaaS 场景] PaaS 平台上部署运行的应用，会自动内置 BKPAAS_APP_TENANT_ID 环境变量，表示应用是全租户的还是单租户的
+        paas_app_tenant_id = os.environ.get("BKPAAS_APP_TENANT_ID")
+        if paas_app_tenant_id is not None:
+            # 空字符串表示全租户应用，则返回 system，因为全租户应用只能在运营租户 (system) 下创建
+            return paas_app_tenant_id or "system"
+
+        # 对于单租户应用，BK_APP_TENANT_ID 可以不设置; 对于全租户应用，BK_APP_TENANT_ID 必须设置，建议设置为 system
+        bk_app_tenant_id = self.config.bk_app_tenant_id or ""
+        logger.warning(
+            "the [X-Bk-Tenant-Id=%s], if the syncing to apigateway failed, and your app(%s) is a global tenant app, please set the environment variable BK_APP_TENANT_ID to `system` (or set django settings.BK_APP_TENANT_ID to `system`) and try again",
+            bk_app_tenant_id,
+            self.config.bk_app_code,
+        )
+        return bk_app_tenant_id
+
     def _call(self, operation, files=None, **kwargs):
         """Call the API instance"""
         data = {
@@ -84,7 +108,7 @@ def _call(self, operation, files=None, **kwargs):
                 "X-Bkapi-Authorization": kwargs.pop("x_bkapi_authorization", self._get_bkapi_authorization()),
                 # the header is required by the API gateway plugin bk-tenant-validate, for global tenant app!
                 # so we set it to system, it would not be used in the gateway
-                "X-Bk-Tenant-Id": "system",
+                "X-Bk-Tenant-Id": self._get_tenant_id(),
             },
             "files": files,
         }

sdks/apigw-manager/tests/apigw_manager/apigw/test_utils.py

@@ -1,13 +1,14 @@
 # -*- coding: utf-8 -*-
 """
- * TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-蓝鲸 PaaS 平台(BlueKing-PaaS) available.
- * Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
- * Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at http://opensource.org/licenses/MIT
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
- * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations under the License.
+* TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-蓝鲸 PaaS 平台(BlueKing-PaaS) available.
+* Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
+* Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at http://opensource.org/licenses/MIT
+* Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+* an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+* specific language governing permissions and limitations under the License.
 """
+
 import os
 import tempfile
 import zipfile
@@ -48,6 +49,17 @@ def test_jwt_provider_cls(self, settings, faker):
 
         assert configuration.jwt_provider_cls == settings.BK_APIGW_JWT_PROVIDER_CLS
 
+    def test_bk_app_tenant_id(self, settings, faker):
+        settings.BK_APP_TENANT_ID = faker.color()
+        configuration = get_configuration()
+        assert configuration.bk_app_tenant_id == settings.BK_APP_TENANT_ID
+
+    def test_bk_app_tenant_id_by_env(self, settings, faker, monkeypatch):
+        tenant_id = faker.color()
+        monkeypatch.setenv("BK_APP_TENANT_ID", tenant_id)
+        configuration = get_configuration()
+        assert configuration.bk_app_tenant_id == tenant_id
+
     @pytest.mark.parametrize(
         ("kwargs", "expected"),
         [
@@ -144,7 +156,6 @@ def test_get_archived_files(self):
 
 
 class TestVersion:
-
     def test_valid_versions(self):
         valid_versions = [
             "1.0.0",
@@ -155,11 +166,10 @@ def test_valid_versions(self):
             "6.0.0-alpha+build.1",
             "7.0.0-feature-layered-alpha2",
             "8.0.0-feature-layered-alpha.2",
-            "3.14.1-feature-layered-alpha2"
+            "3.14.1-feature-layered-alpha2",
         ]
         for version in valid_versions:
             try:
                 parse_version(version)
             except InvalidVersion:
                 pytest.fail(f"Valid version '{version}' raised InvalidVersion")
-

sdks/apigw-manager/tests/apigw_manager/core/test_hander.py

@@ -1,19 +1,20 @@
 # -*- coding: utf-8 -*-
 """
- * TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-蓝鲸 PaaS 平台(BlueKing-PaaS) available.
- * Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
- * Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at http://opensource.org/licenses/MIT
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
- * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations under the License.
+* TencentBlueKing is pleased to support the open source community by making 蓝鲸智云-蓝鲸 PaaS 平台(BlueKing-PaaS) available.
+* Copyright (C) 2017-2021 THL A29 Limited, a Tencent company. All rights reserved.
+* Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at http://opensource.org/licenses/MIT
+* Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+* an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+* specific language governing permissions and limitations under the License.
 """
+
 import pytest
-from bkapi_client_core.exceptions import HTTPResponseError
 from faker import Faker
 
 from apigw_manager.core.exceptions import ApiResponseError
 from apigw_manager.core.handler import Handler
+from bkapi_client_core.exceptions import HTTPResponseError
 
 
 @pytest.fixture()
@@ -119,3 +120,15 @@ def test_call_request_error_with_no_json(self, handler: Handler, operation, mock
 
         with pytest.raises(ApiResponseError):
             handler._call(operation)
+
+    def test_get_tenant_id_from_config(self, handler: Handler, mocker):
+        handler.config.bk_app_tenant_id = "123"
+        assert handler._get_tenant_id() == "123"
+
+    def test_get_tenant_id_from_env(self, handler: Handler, monkeypatch):
+        monkeypatch.setenv("BKPAAS_APP_TENANT_ID", "123")
+        assert handler._get_tenant_id() == "123"
+
+    def test_get_tenant_id_from_env_default_system(self, handler: Handler, monkeypatch):
+        monkeypatch.setenv("BKPAAS_APP_TENANT_ID", "")
+        assert handler._get_tenant_id() == "system"