Validate settings before running up a Pulp instance

[lubosmj]

When you run the Pulp in One Container instance without configuring the pulp-container's related settings first, the following error is returned:

podman pull localhost:8080/library/busybox --tls-verify=false

pulp [ebdbf4ba17f345fb958f0531041300a8]: django.request:ERROR: Internal Server Error: /v2/
Traceback (most recent call last):
  File "/usr/local/lib/python3.8/site-packages/rest_framework/views.py", line 497, in dispatch
    self.initial(request, *args, **kwargs)
  File "/usr/local/lib/python3.8/site-packages/rest_framework/views.py", line 415, in initial
    self.check_permissions(request)
  File "/usr/local/lib/python3.8/site-packages/rest_framework/views.py", line 332, in check_permissions
    if not permission.has_permission(request, self):
  File "/usr/local/lib/python3.8/site-packages/pulp_container/app/token_verification.py", line 209, in has_permission
    raise NotAuthenticated()
rest_framework.exceptions.NotAuthenticated: {'errors': [{'code': 'UNAUTHORIZED', 'message': ErrorDetail(string='Authentication credentials were not provided.', code='not_authenticated'), 'detail': {}}]}

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.8/site-packages/django/core/handlers/exception.py", line 55, in inner
    response = get_response(request)
  File "/usr/local/lib/python3.8/site-packages/django/core/handlers/base.py", line 197, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "/usr/local/lib/python3.8/site-packages/django/views/decorators/csrf.py", line 56, in wrapper_view
    return view_func(*args, **kwargs)
  File "/usr/local/lib/python3.8/site-packages/django/views/generic/base.py", line 104, in view
    return self.dispatch(request, *args, **kwargs)
  File "/usr/local/lib/python3.8/site-packages/rest_framework/views.py", line 509, in dispatch
    response = self.handle_exception(exc)
  File "/usr/local/lib/python3.8/site-packages/pulp_container/app/registry_api.py", line 258, in handle_exception
    response = super().handle_exception(exc)
  File "/usr/local/lib/python3.8/site-packages/rest_framework/views.py", line 456, in handle_exception
    auth_header = self.get_authenticate_header(self.request)
  File "/usr/local/lib/python3.8/site-packages/rest_framework/views.py", line 190, in get_authenticate_header
    return authenticators[0].authenticate_header(request)
  File "/usr/local/lib/python3.8/site-packages/pulp_container/app/token_verification.py", line 149, in authenticate_header
    realm = settings.TOKEN_SERVER
  File "/usr/local/lib/python3.8/site-packages/dynaconf/base.py", line 145, in __getattr__
    value = getattr(self._wrapped, name)
  File "/usr/local/lib/python3.8/site-packages/dynaconf/base.py", line 328, in __getattribute__
    return super().__getattribute__(name)
AttributeError: 'HookableSettings' object has no attribute 'TOKEN_SERVER'
('pulp [ebdbf4ba17f345fb958f0531041300a8]: ::ffff:127.0.0.1 - - [13/Mar/2024:10:28:52 +0000] "GET /v2/ HTTP/1.0" 500 145 "-" "containers/5.29.2 (github.com/containers/image)"',)

This error is visible when accessing the live API (docker API, v2/* endpoints).

---

Solution

Instead of returning an uncaught exception, we should clearly state that the admin needs to pre-configure the token server: https://staging-docs.pulpproject.org/pulp_container/docs/admin/learn/authentication/#token-authentication.

I can imagine doing the following:

try:
    settings.TOKEN_SERVER
except AttributeError:
   raise ConfigurationError("The token server was not configured. Please, follow the documentation at ... to proceed further.")

Details

From https://pulpproject.org/pulp-in-one-container/, it is unclear whether the admin needs to provide any additional settings besides the default ones. It might be worth adding a note about the plugin's specific settings. There is no reference to the pulp-container's documentation either.

Visiting https://docs.pulpproject.org/pulp_container/installation.html#configure-required-settings and https://docs.pulpproject.org/pulp_container/authentication.html#token-authentication-label might not be obvious for new-comers when the entry point was https://pulpproject.org/pulp-in-one-container/

[ipanova]

We could add settings validator in pulp_container/app/settings.py when certain settings like token server is missing (with token_auth_disabled set to false). This way pulp will refuse to start unless settings validation passes

[lubosmj]

We merged this pulp/pulpproject.org#465, so the traceback is not relevant anymore. We should focus on adding the validator instead.

[lubosmj]

Note that the traceback can be still raised when a user forgets to set up any settings required for pulp-container.