Skip to content

Commit 21cb751

Browse files
author
James Belchamber
committed
Refactoring Juicebox GCP Service (#3)
1 parent 6933156 commit 21cb751

File tree

10 files changed

+212
-106
lines changed

10 files changed

+212
-106
lines changed

‎.devcontainer/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Dockerfile
2-
FROM docker.io/golang:latest
2+
FROM docker.io/golang:1.22.6
33

44
RUN apt-get update &&\
55
apt-get upgrade -y &&\

‎.github/workflows/build_and_publish.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: Build and Publish
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
env:
9+
REGISTRY: ghcr.io
10+
IMAGE_NAME: ${{ github.repository }}
11+
12+
jobs:
13+
build_and_publish:
14+
name: Build and Publish
15+
runs-on: ubuntu-latest
16+
17+
permissions:
18+
contents: read
19+
packages: write
20+
attestations: write
21+
id-token: write
22+
23+
steps:
24+
- name: Checkout Code
25+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
26+
27+
- name: Set up Go
28+
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
29+
with:
30+
go-version: "1.22.6"
31+
check-latest: false
32+
33+
- name: Build Executable
34+
run: |
35+
go build ./cmd/jb-sw-realm
36+
37+
- name: Login to GitHub Container Registry
38+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
39+
with:
40+
registry: ${{ env.REGISTRY }}
41+
username: ${{ github.actor }}
42+
password: ${{ secrets.GITHUB_TOKEN }}
43+
44+
- name: Extract metadata (tags, labels) for Docker
45+
id: meta
46+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
47+
with:
48+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
49+
50+
- name: Build and push Docker image
51+
id: push
52+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
53+
with:
54+
context: .
55+
push: true
56+
tags: ${{ steps.meta.outputs.tags }}
57+
labels: ${{ steps.meta.outputs.labels }}
58+
59+
- name: Generate artifact attestation
60+
uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
61+
with:
62+
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
63+
subject-digest: ${{ steps.push.outputs.digest }}
64+
push-to-registry: true

‎.github/workflows/lint_and_test.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Lint and Test
2+
3+
on:
4+
pull_request: {}
5+
workflow_dispatch: {}
6+
7+
jobs:
8+
lint_and_test:
9+
name: Lint and Test
10+
runs-on: ubuntu-latest
11+
steps:
12+
- name: Checkout Code
13+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
14+
15+
- name: Set up Go
16+
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
17+
with:
18+
go-version: "1.22.6"
19+
check-latest: false
20+
21+
- name: Run revive (v1.10.0)
22+
run: |
23+
go install github.com/mgechev/revive@6becd540e4f864330381c0f2cd0cf05089aa8aa3
24+
revive -config revive.toml -formatter friendly ./...
25+
26+
- name: Run staticcheck (v0.6.1)
27+
run: |
28+
go install honnef.co/go/tools/cmd/staticcheck@b8ec13ce4d00445d75da053c47498e6f9ec5d7d6
29+
staticcheck ./...
30+
31+
- name: Run govulncheck (v1.1.4)
32+
run: |
33+
go version
34+
go install golang.org/x/vuln/cmd/govulncheck@d1f380186385b4f64e00313f31743df8e4b89a77
35+
govulncheck ./...
36+
37+
- name: Run go test
38+
run: go test -v ./...
39+
40+
- name: Build Executables
41+
run: |
42+
go build ./cmd/jb-sw-realm
43+
go build ./cmd/tenant_log
44+
45+
- name: Run go mod tidy
46+
run: go mod tidy && git diff --quiet

‎.github/workflows/main.yml‎

Lines changed: 0 additions & 49 deletions
This file was deleted.

‎Dockerfile‎

Lines changed: 4 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,13 @@
1-
FROM golang:1.22.6 as build-env
1+
FROM debian:latest
22

3-
WORKDIR /app
3+
RUN apt update && apt install -y ca-certificates
44

5-
COPY go.mod go.sum ./
6-
7-
RUN go mod download
8-
9-
COPY . .
10-
11-
RUN CGO_ENABLED=0 go build -o /jb-sw-realm ./cmd/jb-sw-realm
12-
13-
FROM debian:11-slim
14-
15-
RUN apt-get update && apt-get install -y curl supervisor
16-
17-
WORKDIR /otel
18-
19-
RUN curl -LO https://github.com/open-telemetry/opentelemetry-collector-releases/releases/download/v0.77.0/otelcol-contrib_0.77.0_linux_amd64.tar.gz \
20-
&& tar -xzvf otelcol-contrib_0.77.0_linux_amd64.tar.gz \
21-
&& mv otelcol-contrib /usr/local/bin/otelcol-contrib \
22-
&& rm -rf /otel
23-
24-
COPY otel-collector-config.yaml /etc/otelcol-contrib/config.yaml
25-
26-
COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
27-
28-
COPY --from=build-env /jb-sw-realm /usr/local/bin/jb-sw-realm
5+
COPY jb-sw-realm /usr/local/bin/jb-sw-realm
296

307
ENV PORT 8080
318

329
EXPOSE 8080
3310

3411
HEALTHCHECK CMD curl --fail "http://localhost:8080" || exit 1
3512

36-
ENTRYPOINT ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]
13+
ENTRYPOINT ["/usr/local/bin/jb-sw-realm"]

‎gcp/run.tf‎

Lines changed: 52 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,18 @@ resource "google_cloud_run_v2_service" "juicebox" {
1010
template {
1111
timeout = "300s"
1212
service_account = google_service_account.service_account.email
13+
volumes {
14+
name = "otel-config"
15+
secret {
16+
secret = google_secret_manager_secret.opentelemetry_configuration.secret_id
17+
items {
18+
version = "latest"
19+
path = "config.yaml"
20+
}
21+
}
22+
}
1323
containers {
14-
name = "juicebox-1"
24+
name = "jb-sw-realms"
1525
ports {
1626
name = "http1"
1727
container_port = 8080
@@ -49,6 +59,10 @@ resource "google_cloud_run_v2_service" "juicebox" {
4959
name = "REALM_ID"
5060
value = var.realm_id
5161
}
62+
env {
63+
name = "OPENTELEMETRY_ENDPOINT"
64+
value = "localhost:4317"
65+
}
5266
dynamic "env" {
5367
for_each = var.juicebox_vars
5468
content {
@@ -57,11 +71,27 @@ resource "google_cloud_run_v2_service" "juicebox" {
5771
}
5872
}
5973
}
60-
}
61-
lifecycle {
62-
ignore_changes = [
63-
client
64-
]
74+
containers {
75+
name = "otel-collector"
76+
resources {
77+
limits = {
78+
cpu = "1"
79+
memory = "512Mi"
80+
}
81+
}
82+
image = "${var.otelcol_image_url}:${var.otelcol_image_version}"
83+
volume_mounts {
84+
name = "otel-config"
85+
mount_path = "/etc/otelcol-contrib/"
86+
}
87+
dynamic "env" {
88+
for_each = var.otelcol_vars
89+
content {
90+
name = env.key
91+
value = env.value
92+
}
93+
}
94+
}
6595
}
6696
}
6797

@@ -73,6 +103,22 @@ resource "google_project_iam_binding" "logs_writer_binding" {
73103
]
74104
}
75105

106+
resource "google_project_iam_binding" "metrics_writer_binding" {
107+
project = var.project_id
108+
role = "roles/monitoring.metricWriter"
109+
members = [
110+
"serviceAccount:${google_service_account.service_account.email}"
111+
]
112+
}
113+
114+
resource "google_project_iam_binding" "cloud_trace_agent_binding" {
115+
project = var.project_id
116+
role = "roles/cloudtrace.agent"
117+
members = [
118+
"serviceAccount:${google_service_account.service_account.email}"
119+
]
120+
}
121+
76122
resource "google_cloud_run_v2_service_iam_binding" "allow_unauthenticated_users" {
77123
project = var.project_id
78124
name = google_cloud_run_v2_service.juicebox.name

‎gcp/secret-manager.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,24 @@ resource "google_secret_manager_secret_iam_binding" "access" {
2121
"serviceAccount:${google_service_account.service_account.email}"
2222
]
2323
}
24+
25+
resource "google_secret_manager_secret" "opentelemetry_configuration" {
26+
secret_id = "jb-sw-otel-config"
27+
replication {
28+
auto {}
29+
}
30+
}
31+
32+
resource "google_secret_manager_secret_version" "opentelemetry_configuration" {
33+
secret = google_secret_manager_secret.opentelemetry_configuration.id
34+
secret_data = var.otelcol_config_b64 == "INTERNAL" ? file("../otel-collector-config.yaml") : base64decode(var.otelcol_config_b64)
35+
}
36+
37+
resource "google_secret_manager_secret_iam_binding" "opentelemetry_configuration" {
38+
secret_id = google_secret_manager_secret.opentelemetry_configuration.id
39+
role = "roles/secretmanager.secretAccessor"
40+
41+
members = [
42+
"serviceAccount:${google_service_account.service_account.email}"
43+
]
44+
}

‎gcp/variables.tf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,26 @@ variable "juicebox_vars" {
3838
type = map(string)
3939
default = {}
4040
}
41+
42+
variable "otelcol_image_url" {
43+
description = "The url of the opentelemetry collector docker image"
44+
type = string
45+
}
46+
47+
variable "otelcol_image_version" {
48+
description = "The version of the opentelemetry collector docker image"
49+
type = string
50+
}
51+
52+
variable "otelcol_config_b64" {
53+
description = "A configuration file for the OpenTelemetry Collector, encoded in base64"
54+
type = string
55+
default = "INTERNAL"
56+
# This default is captured in secret-manager.tf to deploy ../otel-collector-config.yaml from this repository.
57+
}
58+
59+
variable "otelcol_vars" {
60+
description = "Environment variables for the juicebox container"
61+
type = map(string)
62+
default = {}
63+
}

‎revive.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
ignoreGeneratedHeader = false
22
severity = "warning"
33
confidence = 0.8
4-
errorCode = 0
4+
errorCode = 1
55
warningCode = 0
66

77
[rule.blank-imports]

‎supervisord.conf‎

Lines changed: 0 additions & 22 deletions
This file was deleted.

0 commit comments

Comments
 (0)