* fix: cutover regressions + parallel Keboola legacy fallback
Bundled fixes from a fresh-deploy run on a Keboola Storage backend with
the block-shared-snowflake-access feature flag — DuckDB Keboola
extension's per-table scan can't access bucket schemas, so the legacy
kbcstorage Storage-API client is the only working path.
CUTOVER REGRESSIONS
- agnes pull hash mismatch on every Keboola local-mode table —
src/orchestrator.py:_update_sync_state stored md5(mtime+size)[:12]
while the CLI compares against full 32-char content MD5. Now stores
the same content MD5 the materialized SQL path already used.
- Trailing-slash sanitization in connectors/keboola/access.py and
extractor.py — DuckDB Keboola extension's ATTACH fails when the URL
ends in / (canonical form).
- src/profiler.py:TableInfo.description becomes optional — two call
sites instantiated without it, crashing the profiler pass.
- scripts/ops/agnes-auto-upgrade.sh: chown on UID change — older images
ran as root, current runs as agnes (uid 999). Reads target uid:gid
from /etc/passwd inside the new image and chowns ${STATE_DIR},
/data/extracts, /data/analytics when the digest moves.
- POST /api/sync/trigger is now singleton per process — two
near-simultaneous trigger calls each forked an extractor subprocess,
fought for extract.duckdb's file lock, starved uvicorn, flipped the
container to unhealthy. Trigger now returns 409
(sync_already_in_progress) when held; _run_sync acquires non-blocking.
PARALLEL LEGACY FALLBACK
- Process pool fan-out for the _extract_via_legacy queue (default 8
workers, override via AGNES_KEBOOLA_PARALLELISM). Process pool, not
thread pool, because connectors/keboola/client.py:export_table does
os.chdir(temp_dir) — process-global, so threads raced and slice files
landed in the wrong directory ("[Errno 2] No such file or directory:
'<job_id>.csv_X_Y_Z.csv'").
- Extractor subprocess timeout 1800s -> 3600s (configurable via
AGNES_EXTRACTOR_TIMEOUT_SEC). 28+ tables × multi-minute Keboola export
jobs need the headroom on telemetry-class projects.
- Process group cleanup on timeout — Popen(start_new_session=True) puts
the extractor in its own group. On timeout the parent SIGTERMs the
group (10s grace) then SIGKILLs stragglers. Without this, the pool
workers were reparented to PID 1 and continued holding open Keboola
Storage export jobs. Inline extractor script also installs a SIGTERM
-> sys.exit(143) handler so the with ProcessPoolExecutor(...) block
__exit__ runs cleanly.
Tests: existing tests that patched subprocess.run updated to patch
subprocess.Popen with a _FakePopen stand-in (same exit-code-injection
contract). Two tests that exercised the parallel path forced
AGNES_KEBOOLA_PARALLELISM=1 to keep mocks alive (mocks don't ride into
ProcessPoolExecutor subprocesses).
Squashed onto current main (was 7 commits + multi-commit CHANGELOG +
agnes-auto-upgrade.sh conflicts; squash avoids per-commit conflict
resolution against main's flat-mount STATE_DIR refactor and 0.38.0
release cut).
* feat(keboola): Storage API direct extract path; drop extension data path
The DuckDB Keboola extension's COPY routes through Keboola QueryService,
which is unreliable on linked-bucket projects (extension v0.1.6 fixes
that case but isn't yet in the community CDN, and pre-fix any project
with the block-shared-snowflake-access feature flag couldn't see bucket
schemas at all). Move the extract path off the extension entirely and
talk to the Storage API directly via signed-URL download — works on any
project, regardless of extension state.
connectors/keboola/storage_api.py (NEW)
Lightweight client built on requests.Session. Three endpoints:
- POST /v2/storage/tables/{id}/export-async (kicks off job)
- GET /v2/storage/jobs/{id} (poll until done)
- GET /v2/storage/files/{id}?federationToken=1 (signed URL detail)
- GET <signed_url> (download bytes)
Supports sliced exports (manifest + per-slice signed URLs) and gzipped
payloads. ExportFilter dataclass mirrors the Keboola filter spec
(whereFilters / columns / changedSince / limit) and handles JSON
round-trip with the registry's source_query column. Token redaction
in error messages. Bounded exponential backoff on job polling.
No cloud-SDK dependency on the data path; thread-safe.
connectors/keboola/extractor.py
- materialize_query() rewritten: takes bucket/source_table/source_query
(JSON filter spec), exports via KeboolaStorageClient, converts CSV
to parquet via DuckDB, atomic os.replace. Same return shape so
sync.py downstream code stays uniform with the BQ branch.
- _extract_via_legacy() also moved to Storage API direct (kept the
name for caller compatibility with _legacy_worker / the parallel
batch extractor). Per-call temp directories — no os.chdir, threads
don't race.
app/api/sync.py
_run_materialized_pass for source_type='keboola' rows now constructs a
KeboolaStorageClient (replaces KeboolaAccess) and passes
bucket/source_table/source_query to materialize_query. Reuses one
client across rows for HTTP keep-alive. Sources keboola URL from env
too (KEBOOLA_STACK_URL) when instance.yaml doesn't have stack_url
configured.
cli/commands/admin.py
discover-and-register defaults Keboola rows to query_mode='materialized'
(NULL source_query = full table), matching the v26 migration's
unification of the local/materialized split for Keboola. BigQuery and
Jira keep their per-source defaults.
src/db.py
Schema bump 25 → 26. Migration: UPDATE table_registry SET
query_mode='materialized' WHERE source_type='keboola' AND
query_mode='local'. NULL source_query on those rows means "full table
export" — same effective behavior the local mode provided, but now
via Storage API instead of the extension.
pyproject.toml
kbcstorage dep stays (admin-side bucket/table list still uses the
SDK in app/api/admin.py / connectors/keboola/client.py); only the
data path is migrated off the SDK. Comment updated to reflect the
new boundary.
tests
- test_keboola_storage_api.py (NEW, 19 tests): ExportFilter parsing,
HTTP client (token redaction, retry logic, polling), download_file
(single, gzipped, sliced), end-to-end export_table_to_csv.
- test_keboola_materialize.py rewritten: mocks KeboolaStorageClient
instead of FakeAccess; same atomic-write + zero-rows + unsafe-id
contracts.
- test_sync_trigger_keboola_materialized.py: registry rows now carry
bucket+source_table+JSON-shape source_query.
114+ Keboola-impacted tests green locally.
* test: schema version assertion bumped to 26 alongside the keboola query_mode migration
* fix(keboola): cutover hot-patches surfaced on agnes-dev
Five small fixes that were applied as in-container hot-patches during
agnes-dev cutover and need to be on the source-of-truth image so a fresh
upgrade does not undo them.
- app/api/sync.py: auto-discover gate considers the WHOLE registry (any
source, any mode), not just rows where source matches and query_mode
is local. After the v25→v26 keboola materialized migration an
instance can have 30 materialized rows and zero local rows; the
previous gate kept re-firing _discover_and_register_tables every
scheduler tick, creating duplicate auto-discovered rows with the
wrong bucket prefix every time.
- app/api/admin.py: _discover_and_register_tables reassembles the
bucket as <stage>.<bucket-id> (e.g. in.c-finance) instead of
dropping the stage prefix; default query_mode for keboola is now
materialized (the v26 contract); validator allows NULL source_query
for keboola materialized rows (full-table export via Storage API
export-async, no SQL needed).
- cli/commands/admin.py: register-table mirrors the server validator
(NULL source_query allowed for source_type=keboola); --bucket help
text generalized to cover both BQ dataset and Keboola bucket id.
- connectors/keboola/extractor.py: max_line_size=64 MiB on
read_csv_auto so embedded JSON / SQL cells (kbc_component_configuration
in particular) do not trip the default 2 MiB ceiling.
- connectors/keboola/storage_api.py: GCP backend support — when the
Storage API returns a manifest whose slice URLs are gs://
references with a gcsCredentials block, rewrite to the JSON REST
download endpoint and authenticate with the issued OAuth bearer
token; redact tokens in any surfaced error string.
* test: align with new keboola materialized + auto-discover-gate contracts
- test_admin_keboola_materialized: rename
test_register_keboola_materialized_rejects_missing_source_query →
test_register_keboola_materialized_accepts_missing_source_query.
v25→v26 introduced 'keboola materialized with NULL source_query
means full-table export via Storage API export-async' as the
default registration shape; the rejection case is no longer the
contract.
- test_sync_filter: add list_all() to _StubRegistry. The auto-discover
gate in _run_sync now keys off the WHOLE registry (not just local
rows) so materialized-only Keboola instances do not re-trigger
discovery on every tick.
* feat(keboola): native parquet export — skip CSV roundtrip
Storage API export-async accepts fileType={csv,parquet}. Switching the
materialized sync to parquet eliminates the CSV → DuckDB COPY → parquet
roundtrip that pinned a single uvicorn worker over 4 GiB on multi-GB
tables (read_csv with all_varchar + max_line_size=64MB has to
materialize the whole CSV in memory before COPY can stream out a
parquet). Snowflake UNLOAD on Keboola's side already produces typed,
self-contained parquet files; the extractor downloads them and renames
into place.
Two cases:
- **Single-file** export (small table): file_info.url points at one
signed URL; download_file streams chunks straight to .parquet.tmp
and we're done. No DuckDB.
- **Sliced** export (Snowflake UNLOAD respects MAX_FILE_SIZE — 16 MiB
default — so anything larger arrives as N parquet slices): each
slice is a complete parquet file with its own footer; naive concat
would corrupt them. download_file_slices keeps the slices as
separate files in a tempdir, then DuckDB COPY (SELECT * FROM
read_parquet([slice0, slice1, ...])) merges them into one
consolidated parquet. DuckDB streams row groups during this — peak
memory bounded to one row group (~1 MiB) regardless of source size.
The legacy CSV path stays as the explicit opt-in via source_query=
'{"file_type":"csv"}' for projects whose backend can't UNLOAD
parquet (none known today; cheap escape hatch). Backward-compat alias
KeboolaStorageClient.export_table_to_csv kept.
Also fixes a latent bug in download_file's gzip detection: previous
heuristic flagged any unencrypted file as gzipped, which would have
corrupted parquet downloads at gunzip time. Name-suffix-only now.
* fix: tempdir leak cleanup, every 0m schedule, /sync/trigger body shapes
Three small self-contained fixes uncovered during agnes-dev cutover.
- connectors/keboola/extractor.py: tempfile.TemporaryDirectory now uses
ignore_cleanup_errors=True so a worker death mid-write doesn't leave
multi-GiB stale slice trees on the boot disk. (12 GiB seen after a
disk-full crash where TemporaryDirectory's own cleanup also raised
and got swallowed.)
- src/scheduler.py: is_valid_schedule accepts 'every 0m' (interval=0
= always due). Force-resync of an errored row no longer requires
waiting out the default 'every 1h' interval — admin can flip the
schedule, trigger, then flip back.
- app/api/sync.py: POST /api/sync/trigger accepts both ['table_id']
(legacy bare-array body) and {'tables': ['table_id']} (matches the
response payload shape, more discoverable for clients building
requests by hand). Malformed bodies return 422 with a structured
detail; null/missing means 'sync everything' as before.
Tests cover: tempdir cleanup on raise (sliced parquet path),
is_valid_schedule + is_table_due 'every 0m' acceptance, and trigger
body parametrized matrix (8 valid shapes + 6 rejection cases).
* fix: targeted-trigger filter in materialized pass + auto-upgrade defer
Two operational gaps observed during agnes-dev cutover, in the same
sync-routing area.
- _run_materialized_pass now takes a 'tables' arg and skips rows not in
the target set with reason='not_in_target'. POST /api/sync/trigger
with a body of tables previously only scoped the legacy extractor
subprocess — the materialized pass kept iterating every due
materialized row, so an admin asking to re-sync kbc_job re-ran
every other due materialized row alongside it. Match on registry id
OR name (admins commonly pass either form). tables=None preserves
the no-filter behavior.
- New GET /api/sync/status (public, no auth) returns {locked: bool}
off _sync_lock.locked(). agnes-auto-upgrade.sh probes this before
docker compose up -d and exits 0 with a 'deferred recreate' log
line if a sync is in flight — the next 5-min cron tick retries.
Pre-fix, an auto-upgrade triggered mid-sync would recreate the
uvicorn worker and kill the in-flight extractor / Snowflake-UNLOAD
download (observed when kbc_job's first 7-day retry got SIGKILLed).
Connection failures in the probe fall through to the upgrade —
being stuck on a wedged image is worse than interrupting a
hypothetical sync.
* fix: auto-discover protects admin overrides + surfaces drift
Two real-world incidents on agnes-dev drove this:
1. kbc_job was registered manually with the correct
(in.c-kbc_telemetry, kbc_job) coordinates. A naive auto-discover
re-run would have inserted a SECOND kbc_job row at the slugified
id 'in_c-keboola-storage_kbc_job' (where Keboola's discovery
places it) — and that row's Storage API export-async 404s.
2. An earlier auto-discover bug stripped the stage prefix from
bucket ids ('c-finance' instead of 'in.c-finance'), inserting
137 rows whose syncs all failed.
Fix:
- _discover_and_register_tables now builds a plan first
(_build_keboola_discovery_plan) classifying each discovered table
into one of new / existing_match / existing_drift / invalid, then
executes only the 'new' bucket. Drift rows are reported with both
sides of the disagreement plus drift_kind:
- same_id_diff_coords: registry has the same id but different
bucket / source_table (admin migrated coords inline).
- name_collision: discovery's slugified id differs from any
registry id, but the discovered .name matches an existing row's
.name (case-insensitive). Catches the kbc_job case.
- Bucket detection now prefers the API's authoritative bucket_id
field (separate field on the Keboola tables.list response,
normalised by KeboolaClient.discover_all_tables). Falls back to
id-string parsing only when bucket_id is missing (older fallback
path inside discover_all_tables).
- Endpoint POST /api/admin/discover-and-register?dry_run=true
returns the plan without writing — would_register, drift,
invalid lists. Lets an operator audit before merging discovery
with a registry that has admin overrides.
Removed 'every 0m' from test_register_request_rejects_malformed_sync_schedule
— the runtime started accepting it in the previous commit (force-resync
override) and the validator follows suit.
* feat(keboola): AGNES_TEMP_DIR routes tempfiles off overlayfs /tmp
The container's /tmp lives on the boot disk's overlayfs (29 GiB on
agnes-dev, shared with /var). Snowflake UNLOAD of a wide table writes
slices into per-call /tmp tempdirs that fill multi-GiB / many-slice
exports long before the dedicated data disk fills. agnes-dev hit
100% boot-disk while the 20 GiB data disk had 15 GiB free.
connectors.keboola.storage_api.get_temp_root() reads AGNES_TEMP_DIR;
mkdirs the target on first use; unset / empty / unwritable falls
back to None (system tempdir, OSS-pre-fix behaviour). Both
materialize_query (parquet path) and _extract_via_legacy (CSV
fallback) and the sliced-CSV concat path in storage_api use the
helper now.
docker-compose.yml defaults AGNES_TEMP_DIR=/data/tmp on app, scheduler,
and extract services. The data volume is the dedicated disk in
production layouts and a plain docker volume in single-disk
dev/laptop setups — same blast radius as the previous /tmp default
on the latter, no regression.
167 lines
7.4 KiB
Python
167 lines
7.4 KiB
Python
"""Issue #81 Group B — Keboola extractor exit codes.
|
|
|
|
Three contracts:
|
|
- 0 = full success (every table OK)
|
|
- 1 = full failure (every table failed)
|
|
- 2 = partial (at least one OK + at least one failed)
|
|
|
|
Plus the sync.py interpretation: exit 2 must NOT be treated as a crash;
|
|
it logs a PARTIAL FAILURE notice and continues to the orchestrator
|
|
rebuild step (the orchestrator's per-table _meta machinery already
|
|
captures which tables succeeded).
|
|
"""
|
|
|
|
import subprocess as subprocess_real
|
|
|
|
import pytest
|
|
|
|
from connectors.keboola.extractor import compute_exit_code
|
|
|
|
|
|
class TestComputeExitCode:
|
|
@pytest.mark.parametrize(
|
|
"stats,total,expected",
|
|
[
|
|
# Full success
|
|
({"tables_extracted": 10, "tables_failed": 0}, 10, 0),
|
|
# Single-table full success
|
|
({"tables_extracted": 1, "tables_failed": 0}, 1, 0),
|
|
# No tables registered → 0 (vacuous success)
|
|
({"tables_extracted": 0, "tables_failed": 0}, 0, 0),
|
|
# Full failure
|
|
({"tables_extracted": 0, "tables_failed": 10}, 10, 1),
|
|
# Single-table full failure
|
|
({"tables_extracted": 0, "tables_failed": 1}, 1, 1),
|
|
# Partial — single failure in 10
|
|
({"tables_extracted": 9, "tables_failed": 1}, 10, 2),
|
|
# Partial — half-and-half
|
|
({"tables_extracted": 5, "tables_failed": 5}, 10, 2),
|
|
# Partial — only one succeeded
|
|
({"tables_extracted": 1, "tables_failed": 9}, 10, 2),
|
|
],
|
|
)
|
|
def test_exit_code_matrix(self, stats, total, expected):
|
|
assert compute_exit_code(stats, total) == expected
|
|
|
|
def test_missing_tables_failed_key_treated_as_zero(self):
|
|
"""Defensive — older stats dicts without `tables_failed` should
|
|
be treated as full success."""
|
|
assert compute_exit_code({"tables_extracted": 5}, 5) == 0
|
|
|
|
def test_failed_exceeds_total_still_full_failure(self):
|
|
"""If somehow `tables_failed > total` (counting bug, retries),
|
|
exit 1 — not 2 — so partial-failure alerting only fires on a
|
|
legitimate mixed outcome."""
|
|
assert compute_exit_code({"tables_failed": 11}, 10) == 1
|
|
|
|
|
|
class TestSyncApiPartialFailureHandling:
|
|
"""Runtime test: exit code from the extractor subprocess maps to the
|
|
correct [SYNC] log branch. Drives `_run_sync` with a mocked
|
|
`subprocess.run` and asserts the print() calls into stderr. This
|
|
catches inverted-comparison regressions (e.g. `if returncode == 1`
|
|
used for the partial branch) that a source-substring grep would
|
|
miss.
|
|
"""
|
|
|
|
def _drive_run_sync(self, monkeypatch, capsys, returncode):
|
|
"""Invoke `_run_sync` with the extractor subprocess returning
|
|
``returncode``, return the captured stderr as a single string.
|
|
|
|
sync.py does several `import` inside `_run_sync` (subprocess,
|
|
SyncOrchestrator, get_system_db). Stubs must target either the
|
|
global module (so the local import-from-cache picks them up)
|
|
or the runtime call sites via ``patch.object`` on the imported
|
|
names after the function has resolved them.
|
|
"""
|
|
from unittest.mock import MagicMock, patch
|
|
from app.api import sync as sync_mod
|
|
|
|
# _run_sync now uses subprocess.Popen (with start_new_session=True
|
|
# so the timeout path can SIGTERM the whole process group, including
|
|
# ProcessPoolExecutor workers spawned by the parallel legacy
|
|
# fallback). Patch Popen with a stand-in whose .communicate()
|
|
# returns immediately with the injected returncode — covers both
|
|
# the "happy path" (no timeout fired) and exit-code mapping.
|
|
class _FakePopen:
|
|
def __init__(self_inner, cmd, **kwargs):
|
|
self_inner.cmd = cmd
|
|
self_inner.returncode = returncode
|
|
self_inner.pid = 999
|
|
|
|
def communicate(self_inner, input=None, timeout=None):
|
|
return ("{}", "")
|
|
|
|
monkeypatch.setattr(subprocess_real, "Popen", _FakePopen)
|
|
|
|
# SyncOrchestrator is imported as `from src.orchestrator import
|
|
# SyncOrchestrator` inside _run_sync, so patching sync_mod
|
|
# doesn't reach it. Patch the source module instead.
|
|
from src import orchestrator as orch_mod
|
|
monkeypatch.setattr(
|
|
orch_mod, "SyncOrchestrator",
|
|
lambda *a, **kw: MagicMock(rebuild=MagicMock(return_value={})),
|
|
raising=False,
|
|
)
|
|
|
|
# Pretend a Keboola token is configured so the inline subprocess
|
|
# cmd is built (don't enter the missing-credentials early-exit).
|
|
monkeypatch.setenv("KEBOOLA_STORAGE_TOKEN", "test-token")
|
|
monkeypatch.setenv("KEBOOLA_STACK_URL", "https://test.example")
|
|
|
|
# _run_sync calls TableRegistryRepository.list_local on a real
|
|
# system DB connection. Stub the registry method directly so we
|
|
# don't need a populated DB; also stub get_system_db /
|
|
# get_data_source_type to avoid filesystem-dependency on a
|
|
# configured instance.yaml in CI.
|
|
from src.repositories.table_registry import TableRegistryRepository
|
|
monkeypatch.setattr(
|
|
TableRegistryRepository, "list_local",
|
|
lambda self, *a, **kw: [
|
|
{"id": "x", "name": "x", "source_type": "keboola",
|
|
"bucket": "in.c-x", "source_table": "y",
|
|
"query_mode": "local"}
|
|
],
|
|
)
|
|
|
|
# Stub system DB + data-source-type. sync.py does
|
|
# `from src.db import get_system_db` and
|
|
# `from app.instance_config import get_data_source_type`
|
|
# **inside** _run_sync (not module top-level), so we must patch
|
|
# on the SOURCE modules — patching sync_mod is silently
|
|
# ineffective because the local imports re-bind the names.
|
|
fake_conn = MagicMock()
|
|
fake_conn.close = MagicMock()
|
|
from src import db as db_mod
|
|
from app import instance_config as ic_mod
|
|
monkeypatch.setattr(db_mod, "get_system_db", lambda: fake_conn)
|
|
monkeypatch.setattr(ic_mod, "get_data_source_type", lambda: "keboola")
|
|
monkeypatch.setattr(ic_mod, "get_value", lambda *a, **kw: "")
|
|
|
|
sync_mod._run_sync()
|
|
return capsys.readouterr().err
|
|
|
|
def test_exit_0_is_logged_as_ok(self, monkeypatch, capsys):
|
|
stderr = self._drive_run_sync(monkeypatch, capsys, returncode=0)
|
|
assert "[SYNC] Extractor OK" in stderr
|
|
assert "PARTIAL FAILURE" not in stderr
|
|
assert "Extractor FAILED" not in stderr
|
|
|
|
def test_exit_1_is_logged_as_failed(self, monkeypatch, capsys):
|
|
stderr = self._drive_run_sync(monkeypatch, capsys, returncode=1)
|
|
assert "[SYNC] Extractor FAILED (exit 1)" in stderr
|
|
assert "PARTIAL FAILURE" not in stderr
|
|
assert "Extractor OK" not in stderr
|
|
|
|
def test_exit_2_is_logged_as_partial(self, monkeypatch, capsys):
|
|
stderr = self._drive_run_sync(monkeypatch, capsys, returncode=2)
|
|
assert "[SYNC] Extractor PARTIAL FAILURE (exit 2)" in stderr
|
|
# The partial branch must NOT also log OK or FAILED.
|
|
assert "Extractor OK" not in stderr
|
|
assert "Extractor FAILED (exit" not in stderr
|
|
|
|
def test_exit_124_falls_through_to_failed(self, monkeypatch, capsys):
|
|
"""Timeouts (124), signal kills (-N), and other non-zero codes
|
|
all hit the catchall else branch and log FAILED."""
|
|
stderr = self._drive_run_sync(monkeypatch, capsys, returncode=124)
|
|
assert "[SYNC] Extractor FAILED (exit 124)" in stderr
|