#NEWLINE# def run( args ) : #NEWLINE# #INDENT# k8s = Kubernetes ( args . kubernetes_url , namespace = 'noel' ) #NEWLINE# resource_version = None #NEWLINE# try : #NEWLINE# #INDENT# secret = k8s . get_secret ( 'ssh-keys' ) #NEWLINE# keys = secret [ 'data' ] #NEWLINE# resource_version = secret [ 'metadata' ] [ 'resourceVersion' ] #NEWLINE# write_authorized_keys_file ( change , args . destination ) #NEWLINE# logger . info ( 'Wrote authorized keys. {} known keys.' . format ( len ( keys ) ) ) #NEWLINE# #UNINDENT# except KubernetesError as e : #NEWLINE# #INDENT# if ( e . httperror . response . status_code == 404 ) : #NEWLINE# #INDENT# logger . warning ( 'No ssh keys found, will watch for more.' ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# logger . exception ( 'Unexpected error while retrieving initial ssh keys.' ) #NEWLINE# #UNINDENT# #UNINDENT# while True : #NEWLINE# #INDENT# try : #NEWLINE# #INDENT# params = { #NEWLINE# #INDENT# 'labelSelector' : 'type=ssh-keys' , #NEWLINE# 'resourceVersion' : resource_version , #NEWLINE# #UNINDENT# } #NEWLINE# for change in k8s . watch_secrets ( params = params ) : #NEWLINE# #INDENT# if ( change [ 'type' ] not in [ 'CREATED' , 'ADDED' , 'MODIFIED' ] ) : #NEWLINE# #INDENT# continue #NEWLINE# #UNINDENT# secret = change [ 'object' ] #NEWLINE# if ( secret [ 'metadata' ] [ 'name' ] != 'ssh-keys' ) : #NEWLINE# #INDENT# continue #NEWLINE# #UNINDENT# keys = k8s . decode_secret_data ( secret [ 'data' ] ) #NEWLINE# write_authorized_keys_file ( keys , args . destination ) #NEWLINE# logger . info ( 'Updated authorized keys. {} known keys.' . format ( len ( keys ) ) ) #NEWLINE# resource_version = secret [ 'metadata' ] [ 'resourceVersion' ] #NEWLINE# #UNINDENT# #UNINDENT# except Exception : #NEWLINE# #INDENT# logger . exception ( 'Error while refreshing ssh keys, waiting 30 seconds.' ) #NEWLINE# time . sleep ( 30 )