From bcfcc9101f560610c41f79afd723e51b813ff5c2 Mon Sep 17 00:00:00 2001 From: Hunor Csomortáni Date: Aug 08 2017 08:02:10 +0000 Subject: [PATCH 1/7] Add Dockerfile and OpenShift template Summary: Add Dockerfile to build image from rpm and OpenShift template. Based on the work done by dcallagh for waiverdb[0]. At this point the resultsdb image is looked for in the internal registry of the cluster. [0] Test Plan: 1. Start and configure local OpenShift cluster: oc cluster up oc login -u system:admin oadm policy add-role-to-user system:registry developer oadm policy add-role-to-user system:image-builder developer 2. Login to the internal registry of the cluster: oc login -u developer -p developer docker login -u developer -p $(oc whoami -t) 172.30.1.1:5000 3. Build, tag and push resultsdb image to internal registry: docker build -f openshift/Dockerfile --tag resultsdb --build-arg resultsdb_rpm=resultsdb-2.0.2-1.fc25.noarch.rpm . docker tag resultsdb 172.30.1.1:5000/myproject/resultsdb:latest docker push 172.30.1.1:5000/myproject/resultsdb:latest 4. Create environment from template: oc process -f openshift/resultsdb-test-template.yaml -p TEST_ID=123 -p RESULTSDB_APP_VERSION=latest | oc apply -f - Subscribers: tflink Differential Revision: https://phab.qa.fedoraproject.org/D1206 --- diff --git a/openshift/Dockerfile b/openshift/Dockerfile new file mode 100644 index 0000000..177e480 --- /dev/null +++ b/openshift/Dockerfile @@ -0,0 +1,27 @@ +# This will produce an image to be used in Openshift +# Build should be triggered from repo root like: +# docker build -f openshift/Dockerfile --build-arg resultsdb_rpm=resultsdb-2.0.2-1.fc25.noarch.rpm . + +FROM centos:7 +LABEL \ + name="ResultsDB application" \ + vendor="ResultsDB developers" \ + license="GPLv2+" \ + build-date="" +RUN yum -y install epel-release && yum -y clean all +# The caller should build a resultsdb RPM package using and then pass it in this arg. +ARG resultsdb_rpm +COPY $resultsdb_rpm /tmp + +RUN yum -y install --setopt=tsflags=nodocs \ + nss_wrapper python-psycopg2 \ + /tmp/$(basename $resultsdb_rpm) \ + && yum clean all + +COPY runapp.py /usr/bin/run_resultsdb +COPY openshift/run_app.sh /usr/bin/run_app + +RUN chmod 770 /usr/bin/run_resultsdb /usr/bin/run_app + +EXPOSE 5001 +ENTRYPOINT run_app diff --git a/openshift/resultsdb-test-template.yaml b/openshift/resultsdb-test-template.yaml new file mode 100644 index 0000000..97cc6c9 --- /dev/null +++ b/openshift/resultsdb-test-template.yaml @@ -0,0 +1,214 @@ + +# Template to produce a new test environment in OpenShift. Uses OpenID Connect +# against iddev.fedorainfracloud.org for authentication, and ephemeral storage +# for Postgres data. +# +# To create an environment from the template, process and apply it: +# oc process -f openshift/resultsdb-test-template.yaml -p TEST_ID=123 -p RESULTSDB_APP_VERSION=latest | oc apply -f - +# To clean up the environment, use a selector on the environment label: +# oc delete dc,deploy,pod,configmap,secret,svc,route -l environment=test-123 + +--- +apiVersion: v1 +kind: Template +metadata: + name: resultsdb-test-template +parameters: +- name: TEST_ID + displayName: Test id + description: Short unique identifier for this test run (e.g. Jenkins job number) + required: true +- name: RESULTSDB_APP_VERSION + displayName: ResultsDB application version + description: Python version of the ResultsDB application being tested + required: true +- name: DATABASE_PASSWORD + displayName: Database password + generate: expression + from: "[\\w]{32}" +- name: RESULTSDB_SECRET_KEY + displayName: Secret Key for ResultsDB + generate: expression + from: "[\\w]{32}" +objects: +- apiVersion: v1 + kind: Secret + metadata: + name: "resultsdb-test-${TEST_ID}-secret" + labels: + environment: "test-${TEST_ID}" + stringData: + database-password: "${DATABASE_PASSWORD}" +- apiVersion: v1 + kind: ConfigMap + metadata: + name: "resultsdb-test-${TEST_ID}-configmap" + labels: + environment: "test-${TEST_ID}" + data: + settings.py: |- + SECRET_KEY = '${RESULTSDB_SECRET_KEY}' + SQLALCHEMY_DATABASE_URI = 'postgresql+psycopg2://resultsdb:${DATABASE_PASSWORD}@resultsdb-test-${TEST_ID}-database:5432/resultsdb' + FILE_LOGGING = False + LOGFILE = '/var/log/resultsdb/resultsdb.log' + SYSLOG_LOGGING = False + STREAM_LOGGING = True + RUN_HOST= '0.0.0.0' + RUN_PORT = 5001 + MESSAGE_BUS_PUBLISH = False + MESSAGE_BUS_PLUGIN = 'fedmsg' + MESSAGE_BUS_KWARGS = {'modname': 'resultsdb'} +- apiVersion: v1 + kind: Service + metadata: + name: "resultsdb-test-${TEST_ID}-database" + labels: + environment: "test-${TEST_ID}" + spec: + selector: + environment: "test-${TEST_ID}" + service: database + ports: + - name: postgresql + port: 5432 + targetPort: 5432 +- apiVersion: v1 + kind: DeploymentConfig + metadata: + name: "resultsdb-test-${TEST_ID}-database" + labels: + environment: "test-${TEST_ID}" + service: database + spec: + replicas: 1 + strategy: + type: Recreate + selector: + environment: "test-${TEST_ID}" + service: database + template: + metadata: + labels: + environment: "test-${TEST_ID}" + service: database + spec: + containers: + - name: postgresql + image: registry.access.redhat.com/rhscl/postgresql-95-rhel7:latest + imagePullPolicy: Always + ports: + - containerPort: 5432 + readinessProbe: + timeoutSeconds: 1 + initialDelaySeconds: 5 + exec: + command: [ /bin/sh, -i, -c, "psql -h 127.0.0.1 -U $POSTGRESQL_USER -q -d $POSTGRESQL_DATABASE -c 'SELECT 1'" ] + livenessProbe: + timeoutSeconds: 1 + initialDelaySeconds: 30 + tcpSocket: + port: 5432 + env: + - name: POSTGRESQL_USER + value: resultsdb + - name: POSTGRESQL_PASSWORD + valueFrom: + secretKeyRef: + name: "resultsdb-test-${TEST_ID}-secret" + key: database-password + - name: POSTGRESQL_DATABASE + value: resultsdb + triggers: + - type: ConfigChange +- apiVersion: v1 + kind: Service + metadata: + name: "resultsdb-test-${TEST_ID}-api" + labels: + environment: "test-${TEST_ID}" + annotations: + service.alpha.openshift.io/dependencies: |- + [{"name": "resultsdb-test-${TEST_ID}-database", "kind": "Service"}] + spec: + selector: + environment: "test-${TEST_ID}" + service: api + ports: + - name: api + port: 5001 + targetPort: 5001 +- apiVersion: v1 + kind: Route + metadata: + name: "resultsdb-test-${TEST_ID}-api" + labels: + environment: "test-${TEST_ID}" + spec: + port: + targetPort: api + to: + kind: Service + name: "resultsdb-test-${TEST_ID}-api" + tls: + termination: edge + insecureEdgeTerminationPolicy: Redirect +- apiVersion: v1 + kind: DeploymentConfig + metadata: + name: "resultsdb-test-${TEST_ID}-api" + labels: + environment: "test-${TEST_ID}" + service: api + spec: + replicas: 2 + selector: + environment: "test-${TEST_ID}" + service: api + template: + metadata: + labels: + environment: "test-${TEST_ID}" + service: api + spec: + containers: + - name: api + image: "172.30.1.1:5000/myproject/resultsdb:${RESULTSDB_APP_VERSION}" + ports: + - containerPort: 5001 + volumeMounts: + - name: config-volume + mountPath: /etc/resultsdb + readOnly: true + env: + - name: DATABASE_PASSWORD + valueFrom: + secretKeyRef: + name: "resultsdb-test-${TEST_ID}-secret" + key: database-password + readinessProbe: + timeoutSeconds: 1 + initialDelaySeconds: 5 + httpGet: + path: /api/v2.0/ + port: 5001 + livenessProbe: + timeoutSeconds: 1 + initialDelaySeconds: 30 + httpGet: + path: /api/v2.0/ + port: 5001 + # Limit to 384MB memory. This is probably *not* enough but it is + # necessary in the current environment to allow for 2 replicas and + # rolling updates, without hitting the (very aggressive) memory quota. + resources: + limits: + memory: 384Mi + volumes: + - name: config-volume + configMap: + name: "resultsdb-test-${TEST_ID}-configmap" + - name: secret-volume + secret: + secretName: "resultsdb-test-${TEST_ID}-secret" + triggers: + - type: ConfigChange diff --git a/openshift/run_app.sh b/openshift/run_app.sh new file mode 100755 index 0000000..4116b28 --- /dev/null +++ b/openshift/run_app.sh @@ -0,0 +1,32 @@ +#!/bin/bash +set -x +set -e + +# do the nss wrapper magic +export USER_ID=$(id -u) +export GROUP_ID=$(id -g) +cat < /tmp/passwd +root:x:0:0:root:/root:/bin/bash +bin:x:1:1:bin:/bin:/sbin/nologin +daemon:x:2:2:daemon:/sbin:/sbin/nologin +adm:x:3:4:adm:/var/adm:/sbin/nologin +lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin +sync:x:5:0:sync:/sbin:/bin/sync +shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown +halt:x:7:0:halt:/sbin:/sbin/halt +mail:x:8:12:mail:/var/spool/mail:/sbin/nologin +operator:x:11:0:operator:/root:/sbin/nologin +games:x:12:100:games:/usr/games:/sbin/nologin +ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin +nobody:x:99:99:Nobody:/:/sbin/nologin +resultsdb:x:${USER_ID}:${GROUP_ID}:ResultsDB:${HOME}:/sbin/nologin +EOF + +export LD_PRELOAD=libnss_wrapper.so +export NSS_WRAPPER_PASSWD=/tmp/passwd +export NSS_WRAPPER_GROUP=/etc/group + +# initialize db (in a non-destructive manner) +env resultsdb init_db +# run ResultsDB +env run_resultsdb From af2e4eb79da60bb52b4b3bff33aeb8aa0678496f Mon Sep 17 00:00:00 2001 From: Hunor Csomortáni Date: Aug 08 2017 08:02:10 +0000 Subject: [PATCH 2/7] Delete resultsdb rpm after yum install Signed-off-by: Hunor Csomortáni --- diff --git a/openshift/Dockerfile b/openshift/Dockerfile index 177e480..1dd4f9c 100644 --- a/openshift/Dockerfile +++ b/openshift/Dockerfile @@ -8,6 +8,7 @@ LABEL \ vendor="ResultsDB developers" \ license="GPLv2+" \ build-date="" + RUN yum -y install epel-release && yum -y clean all # The caller should build a resultsdb RPM package using and then pass it in this arg. ARG resultsdb_rpm @@ -16,7 +17,8 @@ COPY $resultsdb_rpm /tmp RUN yum -y install --setopt=tsflags=nodocs \ nss_wrapper python-psycopg2 \ /tmp/$(basename $resultsdb_rpm) \ - && yum clean all + && yum clean all \ + && rm -f /tmp/$(basename $resultsdb_rpm) COPY runapp.py /usr/bin/run_resultsdb COPY openshift/run_app.sh /usr/bin/run_app From 27f83256063822e16cb87c63a2f4eb490b281a17 Mon Sep 17 00:00:00 2001 From: Hunor Csomortáni Date: Aug 08 2017 08:02:10 +0000 Subject: [PATCH 3/7] Set user ID instead of using nss wrapper Signed-off-by: Hunor Csomortáni --- diff --git a/openshift/Dockerfile b/openshift/Dockerfile index 1dd4f9c..b3cdaeb 100644 --- a/openshift/Dockerfile +++ b/openshift/Dockerfile @@ -15,7 +15,7 @@ ARG resultsdb_rpm COPY $resultsdb_rpm /tmp RUN yum -y install --setopt=tsflags=nodocs \ - nss_wrapper python-psycopg2 \ + python-psycopg2 \ /tmp/$(basename $resultsdb_rpm) \ && yum clean all \ && rm -f /tmp/$(basename $resultsdb_rpm) @@ -25,5 +25,6 @@ COPY openshift/run_app.sh /usr/bin/run_app RUN chmod 770 /usr/bin/run_resultsdb /usr/bin/run_app +USER 1001 EXPOSE 5001 ENTRYPOINT run_app diff --git a/openshift/run_app.sh b/openshift/run_app.sh index 4116b28..5091b4a 100755 --- a/openshift/run_app.sh +++ b/openshift/run_app.sh @@ -2,30 +2,6 @@ set -x set -e -# do the nss wrapper magic -export USER_ID=$(id -u) -export GROUP_ID=$(id -g) -cat < /tmp/passwd -root:x:0:0:root:/root:/bin/bash -bin:x:1:1:bin:/bin:/sbin/nologin -daemon:x:2:2:daemon:/sbin:/sbin/nologin -adm:x:3:4:adm:/var/adm:/sbin/nologin -lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin -sync:x:5:0:sync:/sbin:/bin/sync -shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown -halt:x:7:0:halt:/sbin:/sbin/halt -mail:x:8:12:mail:/var/spool/mail:/sbin/nologin -operator:x:11:0:operator:/root:/sbin/nologin -games:x:12:100:games:/usr/games:/sbin/nologin -ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin -nobody:x:99:99:Nobody:/:/sbin/nologin -resultsdb:x:${USER_ID}:${GROUP_ID}:ResultsDB:${HOME}:/sbin/nologin -EOF - -export LD_PRELOAD=libnss_wrapper.so -export NSS_WRAPPER_PASSWD=/tmp/passwd -export NSS_WRAPPER_GROUP=/etc/group - # initialize db (in a non-destructive manner) env resultsdb init_db # run ResultsDB From 722802092158d03732ac898fdbdc3f5c81351d67 Mon Sep 17 00:00:00 2001 From: Hunor Csomortáni Date: Aug 08 2017 08:02:10 +0000 Subject: [PATCH 4/7] Use ImageStream for API container This avoid hardcoding the internal registry IP and port and makes the OpenShift project in which the application is created configurable. Signed-off-by: Hunor Csomortáni --- diff --git a/openshift/resultsdb-test-template.yaml b/openshift/resultsdb-test-template.yaml index 97cc6c9..92d296a 100644 --- a/openshift/resultsdb-test-template.yaml +++ b/openshift/resultsdb-test-template.yaml @@ -18,6 +18,11 @@ parameters: displayName: Test id description: Short unique identifier for this test run (e.g. Jenkins job number) required: true +- name: IMAGE_STREAM_NAMESPACE + displayName: ResultsDB ImageStream namespace + description: The namespace/project where the image for ResultsDB was pushed. + value: myproject + required: true - name: RESULTSDB_APP_VERSION displayName: ResultsDB application version description: Python version of the ResultsDB application being tested @@ -172,7 +177,7 @@ objects: spec: containers: - name: api - image: "172.30.1.1:5000/myproject/resultsdb:${RESULTSDB_APP_VERSION}" + image: resultsdb ports: - containerPort: 5001 volumeMounts: @@ -212,3 +217,12 @@ objects: secretName: "resultsdb-test-${TEST_ID}-secret" triggers: - type: ConfigChange + - type: ImageChange + imageChangeParams: + automatic: true + containerNames: + - api + from: + kind: ImageStreamTag + namespace: ${IMAGE_STREAM_NAMESPACE} + name: "resultsdb:${RESULTSDB_APP_VERSION}" From 9449c0b74270dcf8a86d1a32c43dc394f6bff282 Mon Sep 17 00:00:00 2001 From: Hunor Csomortáni Date: Aug 08 2017 08:02:10 +0000 Subject: [PATCH 5/7] Use gunicorn to run app This will switch using gunicorn instead of flask.run() for running the app. It also swtiches storing settings.py in a Secret instead of a ConfigMap in order to keep secret information under control. Template asks for image name instead of version, this way resultsdb image stored in an external registry can be also used. Note that this is not a production ready solution, as resultsdb requires authorization to be handled by the server. In current deployements this is done using httpd configuration, but I was not able to find a similar solution with gunicorn. --- diff --git a/openshift/Dockerfile b/openshift/Dockerfile index b3cdaeb..92cdcc5 100644 --- a/openshift/Dockerfile +++ b/openshift/Dockerfile @@ -14,16 +14,19 @@ RUN yum -y install epel-release && yum -y clean all ARG resultsdb_rpm COPY $resultsdb_rpm /tmp -RUN yum -y install --setopt=tsflags=nodocs \ +RUN yum -y update \ + && yum -y install --setopt=tsflags=nodocs \ + python-gunicorn \ python-psycopg2 \ /tmp/$(basename $resultsdb_rpm) \ && yum clean all \ && rm -f /tmp/$(basename $resultsdb_rpm) -COPY runapp.py /usr/bin/run_resultsdb COPY openshift/run_app.sh /usr/bin/run_app +# hack +RUN ln -s /usr/share/resultsdb/resultsdb.wsgi /lib/python2.7/site-packages/resultsdb/wsgi.py -RUN chmod 770 /usr/bin/run_resultsdb /usr/bin/run_app +RUN chmod 770 /usr/bin/run_app USER 1001 EXPOSE 5001 diff --git a/openshift/resultsdb-test-template.yaml b/openshift/resultsdb-test-template.yaml index 92d296a..7443a80 100644 --- a/openshift/resultsdb-test-template.yaml +++ b/openshift/resultsdb-test-template.yaml @@ -4,7 +4,7 @@ # for Postgres data. # # To create an environment from the template, process and apply it: -# oc process -f openshift/resultsdb-test-template.yaml -p TEST_ID=123 -p RESULTSDB_APP_VERSION=latest | oc apply -f - +# oc process -f openshift/resultsdb-test-template.yaml -p TEST_ID=123 | oc apply -f - # To clean up the environment, use a selector on the environment label: # oc delete dc,deploy,pod,configmap,secret,svc,route -l environment=test-123 @@ -18,14 +18,10 @@ parameters: displayName: Test id description: Short unique identifier for this test run (e.g. Jenkins job number) required: true -- name: IMAGE_STREAM_NAMESPACE - displayName: ResultsDB ImageStream namespace - description: The namespace/project where the image for ResultsDB was pushed. - value: myproject - required: true -- name: RESULTSDB_APP_VERSION - displayName: ResultsDB application version - description: Python version of the ResultsDB application being tested +- name: RESULTSDB_IMAGE + displayName: ResultsDB container image + description: Image to be used for ResultsDB deployement + value: 172.30.1.1:5000/myproject/resultsdb:latest required: true - name: DATABASE_PASSWORD displayName: Database password @@ -45,12 +41,12 @@ objects: stringData: database-password: "${DATABASE_PASSWORD}" - apiVersion: v1 - kind: ConfigMap + kind: Secret metadata: - name: "resultsdb-test-${TEST_ID}-configmap" + name: "resultsdb-test-${TEST_ID}-config" labels: environment: "test-${TEST_ID}" - data: + stringData: settings.py: |- SECRET_KEY = '${RESULTSDB_SECRET_KEY}' SQLALCHEMY_DATABASE_URI = 'postgresql+psycopg2://resultsdb:${DATABASE_PASSWORD}@resultsdb-test-${TEST_ID}-database:5432/resultsdb' @@ -177,19 +173,14 @@ objects: spec: containers: - name: api - image: resultsdb + image: "${RESULTSDB_IMAGE}" + imagePullPolicy: Always ports: - containerPort: 5001 volumeMounts: - name: config-volume mountPath: /etc/resultsdb readOnly: true - env: - - name: DATABASE_PASSWORD - valueFrom: - secretKeyRef: - name: "resultsdb-test-${TEST_ID}-secret" - key: database-password readinessProbe: timeoutSeconds: 1 initialDelaySeconds: 5 @@ -210,19 +201,7 @@ objects: memory: 384Mi volumes: - name: config-volume - configMap: - name: "resultsdb-test-${TEST_ID}-configmap" - - name: secret-volume secret: - secretName: "resultsdb-test-${TEST_ID}-secret" + secretName: "resultsdb-test-${TEST_ID}-config" triggers: - type: ConfigChange - - type: ImageChange - imageChangeParams: - automatic: true - containerNames: - - api - from: - kind: ImageStreamTag - namespace: ${IMAGE_STREAM_NAMESPACE} - name: "resultsdb:${RESULTSDB_APP_VERSION}" diff --git a/openshift/run_app.sh b/openshift/run_app.sh index 5091b4a..2ccc84e 100755 --- a/openshift/run_app.sh +++ b/openshift/run_app.sh @@ -5,4 +5,4 @@ set -e # initialize db (in a non-destructive manner) env resultsdb init_db # run ResultsDB -env run_resultsdb +env gunicorn --bind 0.0.0.0:5001 --access-logfile=- resultsdb.wsgi From 9e848f9069657270f73bfed26dbcd77de1dafb48 Mon Sep 17 00:00:00 2001 From: Hunor Csomortáni Date: Aug 08 2017 08:02:10 +0000 Subject: [PATCH 6/7] Use mod_wsgi-express as a server This allows using authorization on the server side (a feature gunicorn does not have). This setup works as follows: * resultsdb instances associated with a publicly exposed service will accept only GET requests; * resultsdb instances associated with an internal only service will accept any kind of requests and can be accessed from other pods running in the cluster by the internal service name. Signed-off-by: Hunor Csomortáni --- diff --git a/openshift/Dockerfile b/openshift/Dockerfile index 92cdcc5..183fd38 100644 --- a/openshift/Dockerfile +++ b/openshift/Dockerfile @@ -1,31 +1,41 @@ # This will produce an image to be used in Openshift # Build should be triggered from repo root like: -# docker build -f openshift/Dockerfile --build-arg resultsdb_rpm=resultsdb-2.0.2-1.fc25.noarch.rpm . +# docker build -f openshift/Dockerfile.express --tag 172.30.1.1:5000/myproject/resultsdb:latest --build-arg resultsdb_rpm=resultsdb-2.0.2-1.fc25.noarch.rpm . -FROM centos:7 +FROM centos/httpd:latest LABEL \ name="ResultsDB application" \ vendor="ResultsDB developers" \ license="GPLv2+" \ build-date="" +USER 0 + RUN yum -y install epel-release && yum -y clean all + # The caller should build a resultsdb RPM package using and then pass it in this arg. ARG resultsdb_rpm COPY $resultsdb_rpm /tmp RUN yum -y update \ && yum -y install --setopt=tsflags=nodocs \ - python-gunicorn \ python-psycopg2 \ + httpd-devel \ + python-devel \ + gcc \ + python2-pip \ /tmp/$(basename $resultsdb_rpm) \ && yum clean all \ && rm -f /tmp/$(basename $resultsdb_rpm) -COPY openshift/run_app.sh /usr/bin/run_app -# hack -RUN ln -s /usr/share/resultsdb/resultsdb.wsgi /lib/python2.7/site-packages/resultsdb/wsgi.py +# This is installed from pypi, in order to get +# mod_wsgi-express. +RUN pip install mod_wsgi +# Empty server configuration +RUN touch /etc/httpd/conf.d/resultsdb.conf + +COPY openshift/run_app.sh /usr/bin/run_app RUN chmod 770 /usr/bin/run_app USER 1001 diff --git a/openshift/resultsdb-test-template.yaml b/openshift/resultsdb-test-template.yaml index 7443a80..33456f8 100644 --- a/openshift/resultsdb-test-template.yaml +++ b/openshift/resultsdb-test-template.yaml @@ -60,6 +60,19 @@ objects: MESSAGE_BUS_PLUGIN = 'fedmsg' MESSAGE_BUS_KWARGS = {'modname': 'resultsdb'} - apiVersion: v1 + kind: ConfigMap + metadata: + name: "resultsdb-test-${TEST_ID}-httpd-config" + labels: + environment: "test-${TEST_ID}" + data: + resultsdb.conf: |- + + + Require method GET + + +- apiVersion: v1 kind: Service metadata: name: "resultsdb-test-${TEST_ID}-database" @@ -154,6 +167,23 @@ objects: termination: edge insecureEdgeTerminationPolicy: Redirect - apiVersion: v1 + kind: Service + metadata: + name: "resultsdb-test-${TEST_ID}-internal-api" + labels: + environment: "test-${TEST_ID}" + annotations: + service.alpha.openshift.io/dependencies: |- + [{"name": "resultsdb-test-${TEST_ID}-database", "kind": "Service"}] + spec: + selector: + environment: "test-${TEST_ID}" + service: internal-api + ports: + - name: api + port: 5001 + targetPort: 5001 +- apiVersion: v1 kind: DeploymentConfig metadata: name: "resultsdb-test-${TEST_ID}-api" @@ -161,7 +191,7 @@ objects: environment: "test-${TEST_ID}" service: api spec: - replicas: 2 + replicas: 1 selector: environment: "test-${TEST_ID}" service: api @@ -181,6 +211,64 @@ objects: - name: config-volume mountPath: /etc/resultsdb readOnly: true + - name: httpd-config-volume + mountPath: /etc/httpd/conf.d + readOnly: true + readinessProbe: + timeoutSeconds: 1 + initialDelaySeconds: 5 + httpGet: + path: /api/v2.0/ + port: 5001 + livenessProbe: + timeoutSeconds: 1 + initialDelaySeconds: 30 + httpGet: + path: /api/v2.0/ + port: 5001 + # Limit to 384MB memory. This is probably *not* enough but it is + # necessary in the current environment to allow for 2 replicas and + # rolling updates, without hitting the (very aggressive) memory quota. + resources: + limits: + memory: 384Mi + volumes: + - name: config-volume + secret: + secretName: "resultsdb-test-${TEST_ID}-config" + - name: httpd-config-volume + configMap: + name: "resultsdb-test-${TEST_ID}-httpd-config" + triggers: + - type: ConfigChange +- apiVersion: v1 + kind: DeploymentConfig + metadata: + name: "resultsdb-test-${TEST_ID}-internal-api" + labels: + environment: "test-${TEST_ID}" + service: internal-api + spec: + replicas: 1 + selector: + environment: "test-${TEST_ID}" + service: internal-api + template: + metadata: + labels: + environment: "test-${TEST_ID}" + service: internal-api + spec: + containers: + - name: api + image: "${RESULTSDB_IMAGE}" + imagePullPolicy: Always + ports: + - containerPort: 5001 + volumeMounts: + - name: config-volume + mountPath: /etc/resultsdb + readOnly: true readinessProbe: timeoutSeconds: 1 initialDelaySeconds: 5 diff --git a/openshift/run_app.sh b/openshift/run_app.sh index 2ccc84e..404a2f5 100755 --- a/openshift/run_app.sh +++ b/openshift/run_app.sh @@ -4,5 +4,12 @@ set -e # initialize db (in a non-destructive manner) env resultsdb init_db -# run ResultsDB -env gunicorn --bind 0.0.0.0:5001 --access-logfile=- resultsdb.wsgi + +exec mod_wsgi-express start-server /usr/share/resultsdb/resultsdb.wsgi \ + --user apache --group apache \ + --port 5001 --threads 5 \ + --include-file /etc/httpd/conf.d/resultsdb.conf \ + --log-level info \ + --log-to-terminal \ + --access-log \ + --startup-log From e9cef4779a219a69179109eb1a88fd7f8f17ac1f Mon Sep 17 00:00:00 2001 From: Hunor Csomortáni Date: Aug 08 2017 08:02:10 +0000 Subject: [PATCH 7/7] Add empty httpd config to internal instance This resolves the ambiguity around access control limitations. Signed-off-by: Hunor Csomortáni --- diff --git a/openshift/Dockerfile b/openshift/Dockerfile index 183fd38..226d192 100644 --- a/openshift/Dockerfile +++ b/openshift/Dockerfile @@ -1,6 +1,6 @@ # This will produce an image to be used in Openshift # Build should be triggered from repo root like: -# docker build -f openshift/Dockerfile.express --tag 172.30.1.1:5000/myproject/resultsdb:latest --build-arg resultsdb_rpm=resultsdb-2.0.2-1.fc25.noarch.rpm . +# docker build -f openshift/Dockerfile --tag 172.30.1.1:5000/myproject/resultsdb:latest --build-arg resultsdb_rpm=resultsdb-2.0.2-1.fc25.noarch.rpm . FROM centos/httpd:latest LABEL \ @@ -32,9 +32,6 @@ RUN yum -y update \ # mod_wsgi-express. RUN pip install mod_wsgi -# Empty server configuration -RUN touch /etc/httpd/conf.d/resultsdb.conf - COPY openshift/run_app.sh /usr/bin/run_app RUN chmod 770 /usr/bin/run_app diff --git a/openshift/resultsdb-test-template.yaml b/openshift/resultsdb-test-template.yaml index 33456f8..1685976 100644 --- a/openshift/resultsdb-test-template.yaml +++ b/openshift/resultsdb-test-template.yaml @@ -62,17 +62,29 @@ objects: - apiVersion: v1 kind: ConfigMap metadata: - name: "resultsdb-test-${TEST_ID}-httpd-config" + name: "resultsdb-test-${TEST_ID}-public-httpd-config" labels: environment: "test-${TEST_ID}" data: resultsdb.conf: |- + # allow only GET Require method GET - apiVersion: v1 + kind: ConfigMap + metadata: + name: "resultsdb-test-${TEST_ID}-internal-httpd-config" + labels: + environment: "test-${TEST_ID}" + data: + resultsdb.conf: |- + + # allow all methods + +- apiVersion: v1 kind: Service metadata: name: "resultsdb-test-${TEST_ID}-database" @@ -238,7 +250,7 @@ objects: secretName: "resultsdb-test-${TEST_ID}-config" - name: httpd-config-volume configMap: - name: "resultsdb-test-${TEST_ID}-httpd-config" + name: "resultsdb-test-${TEST_ID}-public-httpd-config" triggers: - type: ConfigChange - apiVersion: v1 @@ -269,6 +281,9 @@ objects: - name: config-volume mountPath: /etc/resultsdb readOnly: true + - name: httpd-config-volume + mountPath: /etc/httpd/conf.d + readOnly: true readinessProbe: timeoutSeconds: 1 initialDelaySeconds: 5 @@ -291,5 +306,8 @@ objects: - name: config-volume secret: secretName: "resultsdb-test-${TEST_ID}-config" + - name: httpd-config-volume + configMap: + name: "resultsdb-test-${TEST_ID}-internal-httpd-config" triggers: - type: ConfigChange