From 9a709f5cc9db5998c5f3c53243cf3aa206ad7865 Mon Sep 17 00:00:00 2001 From: M Umar Khan Date: Wed, 24 Aug 2022 12:06:10 +0500 Subject: [PATCH] feat: Convert ansible to dockerfile --- Dockerfile | 216 +++++++++++++++------------ configuration_files/credentials.conf | 9 ++ configuration_files/credentials.yml | 61 ++++++++ configuration_files/supervisor.conf | 29 ++++ configuration_files/supervisorctl | 8 + credentials_gunicorn.py | 18 +++ scripts/credentials.sh | 11 ++ scripts/devstack.sh | 31 ++++ 8 files changed, 289 insertions(+), 94 deletions(-) create mode 100644 configuration_files/credentials.conf create mode 100644 configuration_files/credentials.yml create mode 100644 configuration_files/supervisor.conf create mode 100644 configuration_files/supervisorctl create mode 100644 credentials_gunicorn.py create mode 100644 scripts/credentials.sh create mode 100644 scripts/devstack.sh diff --git a/Dockerfile b/Dockerfile index 275d5b8874..3a1018ce81 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,112 +1,140 @@ -FROM ubuntu:focal as base -MAINTAINER devops@edx.org +FROM ubuntu:focal as app -# Warning: This file is experimental. -# -# Short-term goals: -# * Be a suitable replacement for the `edxops/credentials` image in devstack (in progress). -# * Take advantage of Docker caching layers: aim to put commands in order of -# increasing cache-busting frequency. -# * Related to ^, use no Ansible or Paver. -# Long-term goal: -# * Be a suitable base for production Credentials images. This may not yet be the case. +# System requirements -# Packages installed: -# git; Used to pull in particular requirements from github rather than pypi, -# and to check the sha of the code checkout. +RUN apt-get update && \ +apt-get install -y software-properties-common && \ +apt-add-repository -y ppa:deadsnakes/ppa && apt-get update && \ +apt-get upgrade -qy && apt-get install language-pack-en locales git \ +python3.8-dev python3-virtualenv libmysqlclient-dev libssl-dev build-essential wget unzip -qy && \ +rm -rf /var/lib/apt/lists/* -# language-pack-en locales; ubuntu locale support so that system utilities have a consistent -# language and time zone. +# Python is Python3. +RUN ln -s /usr/bin/python3 /usr/bin/python -# python; ubuntu doesnt ship with python, so this is the python we will use to run the application +# Use UTF-8. +RUN locale-gen en_US.UTF-8 +ENV LANG en_US.UTF-8 +ENV LANGUAGE en_US:en +ENV LC_ALL en_US.UTF-8 -# python3-pip; install pip to install application requirements.txt files -# libssl-dev; # mysqlclient wont install without this. +ARG COMMON_CFG_DIR="/edx/etc" +ENV CREDENTIALS_CFG_DIR="${COMMON_CFG_DIR}/credentials" -# libmysqlclient-dev; to install header files needed to use native C implementation for -# MySQL-python for performance gains. +ARG COMMON_APP_DIR="/edx/app" +ARG CREDENTIALS_SERVICE_NAME="xxx" +ARG CREDENTIALS_APP_DIR="${COMMON_APP_DIR}/credentials" +ENV CREDENTIALS_APP_DIR="${COMMON_APP_DIR}/credentials" +ENV SUPERVISOR_APP_DIR="${COMMON_APP_DIR}/supervisor" +ENV CREDENTIALS_VENV_DIR="${COMMON_APP_DIR}/credentials/venvs/credentials" +ARG SUPERVISOR_VENV_DIR="${SUPERVISOR_APP_DIR}/venvs/supervisor" +ARG SUPERVISOR_AVAILABLE_DIR="${SUPERVISOR_APP_DIR}/conf.available.d" +ARG SUPERVISOR_VENV_BIN="${SUPERVISOR_VENV_DIR}/bin" +ARG SUPEVISOR_CTL="${SUPERVISOR_VENV_BIN}/supervisorctl" +ARG SUPERVISOR_CFG_DIR="${SUPERVISOR_APP_DIR}/conf.d" +ENV CREDENTIALS_CODE_DIR="${CREDENTIALS_APP_DIR}/credentials" +ARG CREDENTIALS_NODEENV_DIR="${COMMON_APP_DIR}/credentials/nodeenvs/credentials" +ARG CREDENTIALS_NODE_VERSION="16.14.0" +ARG CREDENTIALS_NPM_VERSION="8.5.x" +ARG SUPERVISOR_VERSION="4.2.1" -# wget to download a watchman binary archive +ENV PATH="$CREDENTIALS_VENV_DIR/bin:$PATH" -# unzip to unzip a watchman binary archive +ENV CREDENTIALS_NODEENV_DIR "${COMMON_APP_DIR}/credentials/nodeenvs/credentials" +ENV CREDENTIALS_NODEENV_BIN "${CREDENTIALS_NODEENV_DIR}/bin" +ENV CREDENTIALS_NODE_MODULES_DIR "${CREDENTIALS_CODE_DIR}}/node_modules" +ENV CREDENTIALS_NODE_BIN "${CREDENTIALS_NODE_MODULES_DIR}/.bin" -# If you add a package here please include a comment above describing what it is used for -RUN apt-get update && \ -apt-get install -y software-properties-common && \ -apt-add-repository -y ppa:deadsnakes/ppa && apt-get update && \ -apt-get upgrade -qy && apt-get install language-pack-en locales git \ -python3.8-dev python3.8-venv libmysqlclient-dev libssl-dev build-essential wget unzip -qy && \ -rm -rf /var/lib/apt/lists/* +RUN addgroup credentials +RUN adduser --disabled-login --disabled-password credentials --ingroup credentials + + +RUN mkdir -p "$CREDENTIALS_APP_DIR" + +# Working directory will be root of repo. +WORKDIR ${CREDENTIALS_CODE_DIR} + +RUN virtualenv -p python3.8 --always-copy ${CREDENTIALS_VENV_DIR} +RUN virtualenv -p python3.8 --always-copy ${SUPERVISOR_VENV_DIR} -# Create Python env -ENV VIRTUAL_ENV=/edx/app/credentials/venvs/credentials -RUN python3.8 -m venv $VIRTUAL_ENV -ENV PATH="$VIRTUAL_ENV/bin:$PATH" -# Create Node env +ENV PATH "${CREDENTIALS_NODEENV_DIR}/bin:$PATH" +# No need to activate credentials venv as it is already in path RUN pip install nodeenv -ENV NODE_ENV=/edx/app/credentials/nodeenvs/credentials -RUN nodeenv $NODE_ENV --node=16.14.0 --prebuilt -ENV PATH="$NODE_ENV/bin:$PATH" -RUN npm install -g npm@8.5.3 -RUN locale-gen en_US.UTF-8 -ENV LANG en_US.UTF-8 -ENV LANGUAGE en_US:en -ENV LC_ALL en_US.UTF-8 -ENV DJANGO_SETTINGS_MODULE credentials.settings.production +#install supervisor and deps in its virtualenv +RUN . ${SUPERVISOR_VENV_BIN}/activate && \ + pip install supervisor==${SUPERVISOR_VERSION} backoff==1.4.3 boto==2.48.0 && \ + deactivate +RUN nodeenv ${CREDENTIALS_NODEENV_DIR} --node=${CREDENTIALS_NODE_VERSION} --prebuilt +RUN npm install -g npm@${CREDENTIALS_NPM_VERSION} + +# Copy just JS requirements and install them. +COPY package.json package.json +COPY package-lock.json package-lock.json +RUN npm install --production + +# create supervisor job +COPY /configuration_files/supervisor.conf /etc/systemd/system/supervisor.service +COPY /configuration_files/supervisorctl ${SUPERVISOR_VENV_BIN}/supervisorctl + +# Copy just Python requirements & install them. +COPY requirements ${CREDENTIALS_CODE_DIR}/requirements +COPY Makefile ${CREDENTIALS_CODE_DIR} + +#Configurations from edx_service task +RUN mkdir ${CREDENTIALS_APP_DIR}/data/ +RUN mkdir ${CREDENTIALS_APP_DIR}/staticfiles/ +RUN mkdir -p /edx/var/credentials/ +# Log dir +RUN mkdir -p /edx/var/log/ + + +ENV CREDENTIALS_CFG="${COMMON_CFG_DIR}/credentials.yml" +COPY configuration_files/credentials.yml ${CREDENTIALS_CFG} + +# credentials service config commands below +RUN pip install -r ${CREDENTIALS_CODE_DIR}/requirements/production.txt + +# After the requirements so changes to the code will not bust the image cache +COPY . ${CREDENTIALS_CODE_DIR}/ + +COPY scripts/devstack.sh "$CREDENTIALS_APP_DIR/devstack.sh" +# Enable supervisor script +COPY scripts/credentials.sh $CREDENTIALS_APP_DIR/credentials.sh +COPY /configuration_files/credentials.conf ${SUPERVISOR_AVAILABLE_DIR}/credentials.conf +COPY /configuration_files/credentials.conf ${SUPERVISOR_CFG_DIR}/credentials.conf +# Manage.py symlink +COPY /manage.py /edx/bin/manage.credentials + +RUN chown credentials:credentials "$CREDENTIALS_APP_DIR/devstack.sh" && chmod a+x "$CREDENTIALS_APP_DIR/devstack.sh" + +# placeholder file for the time being unless devstack provisioning scripts need it. +RUN touch ${CREDENTIALS_APP_DIR}/credentials_env +# Expose ports. EXPOSE 18150 -RUN useradd -m --shell /bin/false app - -# Install watchman -RUN wget https://github.com/facebook/watchman/releases/download/v2020.08.17.00/watchman-v2020.08.17.00-linux.zip -RUN unzip watchman-v2020.08.17.00-linux.zip -RUN mkdir -p /usr/local/{bin,lib} /usr/local/var/run/watchman -RUN cp watchman-v2020.08.17.00-linux/bin/* /usr/local/bin -RUN cp watchman-v2020.08.17.00-linux/lib/* /usr/local/lib -RUN chmod 755 /usr/local/bin/watchman -RUN chmod 2777 /usr/local/var/run/watchman - -# Now install credentials -WORKDIR /edx/app/credentials/credentials - -# Copy the requirements explicitly even though we copy everything below -# this prevents the image cache from busting unless the dependencies have changed. -COPY requirements/production.txt /edx/app/credentials/credentials/requirements/production.txt -COPY requirements/pip_tools.txt /edx/app/credentials/credentials/requirements/pip_tools.txt - -# Dependencies are installed as root so they cannot be modified by the application user. -RUN pip install -r requirements/pip_tools.txt -RUN pip install -r requirements/production.txt - -RUN mkdir -p /edx/var/log - -# Code is owned by root so it cannot be modified by the application user. -# So we copy it before changing users. -USER app - -# Gunicorn 19 does not log to stdout or stderr by default. Once we are past gunicorn 19, the logging to STDOUT need not be specified. -CMD gunicorn --workers=2 --name credentials -c /edx/app/credentials/credentials/credentials/docker_gunicorn_configuration.py --log-file - --max-requests=1000 credentials.wsgi:application - -# This line is after the requirements so that changes to the code will not -# bust the image cache -COPY . /edx/app/credentials/credentials - -# We don't switch back to the app user for devstack because we need devstack users to be -# able to update requirements and generally run things as root. -FROM base as dev -USER root -ENV DJANGO_SETTINGS_MODULE credentials.settings.devstack -RUN pip install -r /edx/app/credentials/credentials/requirements/dev.txt -# Temporary compatibility hack while devstack is supporting -# both the old `edxops/credentials` image and this image: -# Add in a dummy ../credentials_env file. -# The credentials_env file was originally needed for sourcing to get -# environment variables like DJANGO_SETTINGS_MODULE, but now we just set -# those variables right in the Dockerfile. -RUN touch ../credentials_env -CMD while true; do python ./manage.py runserver 0.0.0.0:18150; sleep 2; done +FROM app as production + +ENV DJANGO_SETTINGS_MODULE credentials.settings.production + +COPY scripts/credentials.sh "$CREDENTIALS_APP_DIR/credentials.sh" + +#CMD ["gunicorn", "--workers=2", "--name", "credentials", "-c", "/edx/app/credentials/credentials/credentials/docker_gunicorn_configuration.py", "--log-file", "-", "--max-requests=1000", "credentials.wsgi:application"] +#CMD ["sh", "-c", "gunicorn", "--workers=2", "--name", "credentials", "-c", "${CREDENTIALS_CODE_DIR}/docker_gunicorn_configuration.py", "--log-file", "-", "--max-requests=1000", "credentials.wsgi:application"] +ENTRYPOINT ["/edx/app/credentials/credentials.sh"] + + +FROM app as dev + +# credentials service config commands below +RUN pip install -r ${CREDENTIALS_CODE_DIR}/requirements/dev.txt + + +ENV DJANGO_SETTINGS_MODULE credentials.settings.devstack + +ENTRYPOINT ["/edx/app/credentials/devstack.sh"] +CMD ["start"] diff --git a/configuration_files/credentials.conf b/configuration_files/credentials.conf new file mode 100644 index 0000000000..543c45a29b --- /dev/null +++ b/configuration_files/credentials.conf @@ -0,0 +1,9 @@ +[program:credentials] + +command=/edx/app/credentials/credentials.sh +user=www-data +directory=/edx/app/credentials/credentials +stdout_logfile=/edx/var/log/supervisor/%(program_name)s-stdout.log +stderr_logfile=/edx/var/log/supervisor/%(program_name)s-stderr.log +killasgroup=true +stopasgroup=true diff --git a/configuration_files/credentials.yml b/configuration_files/credentials.yml new file mode 100644 index 0000000000..4cd04b6c99 --- /dev/null +++ b/configuration_files/credentials.yml @@ -0,0 +1,61 @@ +--- + +API_ROOT: null +BACKEND_SERVICE_EDX_OAUTH2_KEY: credentials-backend-service-key +BACKEND_SERVICE_EDX_OAUTH2_PROVIDER_URL: http://localhost:18000/oauth2 +BACKEND_SERVICE_EDX_OAUTH2_SECRET: credentials-backend-service-secret +CACHES: + default: + BACKEND: django.core.cache.backends.memcached.MemcachedCache + KEY_PREFIX: credentials + LOCATION: + - edx.devstack.memcached:11211 +CERTIFICATE_LANGUAGES: + en: English + es_419: Spanish +CREDENTIALS_SERVICE_USER: credentials_service_user +CSRF_COOKIE_SECURE: false +DATABASES: + default: + ATOMIC_REQUESTS: false + CONN_MAX_AGE: 60 + ENGINE: django.db.backends.mysql + HOST: edx.devstack.mysql + NAME: credentials + OPTIONS: + connect_timeout: 10 + init_command: SET sql_mode='STRICT_TRANS_TABLES' + PASSWORD: password + PORT: '3306' + USER: credentials001 +EDX_DRF_EXTENSIONS: + OAUTH2_USER_INFO_URL: http://edx.devstack.lms:18000/oauth2/user_info +EXTRA_APPS: +- credentials.apps.edx_credentials_extensions +FILE_STORAGE_BACKEND: {} +JWT_AUTH: + JWT_AUTH_COOKIE_HEADER_PAYLOAD: edx-jwt-cookie-header-payload + JWT_AUTH_COOKIE_SIGNATURE: edx-jwt-cookie-signature + JWT_ISSUERS: + - AUDIENCE: lms-key + ISSUER: http://localhost:18000/oauth2 + SECRET_KEY: lms-secret + JWT_PUBLIC_SIGNING_JWK_SET: '' +LANGUAGE_CODE: en +LANGUAGE_COOKIE_NAME: openedx-language-preference +MEDIA_STORAGE_BACKEND: + DEFAULT_FILE_STORAGE: django.core.files.storage.FileSystemStorage + MEDIA_ROOT: /edx/var/credentials/media + MEDIA_URL: /media/ +SECRET_KEY: SET-ME-TO-A-UNIQUE-LONG-RANDOM-STRING +SESSION_EXPIRE_AT_BROWSER_CLOSE: false +SOCIAL_AUTH_EDX_OAUTH2_ISSUER: http://127.0.0.1:8000 +SOCIAL_AUTH_EDX_OAUTH2_KEY: credentials-sso-key +SOCIAL_AUTH_EDX_OAUTH2_LOGOUT_URL: http://localhost:18000/logout +SOCIAL_AUTH_EDX_OAUTH2_SECRET: credentials-sso-secret +SOCIAL_AUTH_EDX_OAUTH2_URL_ROOT: http://127.0.0.1:8000 +SOCIAL_AUTH_REDIRECT_IS_HTTPS: false +STATICFILES_STORAGE: django.contrib.staticfiles.storage.ManifestStaticFilesStorage +STATIC_ROOT: /edx/var/credentials/staticfiles +TIME_ZONE: UTC +USERNAME_REPLACEMENT_WORKER: OVERRIDE THIS WITH A VALID USERNAME diff --git a/configuration_files/supervisor.conf b/configuration_files/supervisor.conf new file mode 100644 index 0000000000..c73ddb5212 --- /dev/null +++ b/configuration_files/supervisor.conf @@ -0,0 +1,29 @@ +[Unit] +Description=supervisord - Supervisor process control system +Documentation=http://supervisord.org +After=network.target + + +[Service] + +# User will be applied only to ExecStart, not other commands (i.e. ExecStartPre) +# This is needed because pre_supervisor needs to write to supervisor/conf.d, which +# supervisor_service_user does not have permission to do. +PermissionsStartOnly=true +User=www-data + +Type=forking +TimeoutSec=432000 + +ExecStart=/edx/app/supervisor/venvs/supervisor/bin/supervisord --configuration /edx/app/supervisor/supervisord.conf +ExecReload=/edx/app/supervisor/venvs/supervisor/bin/supervisorctl reload +ExecStop=/edx/app/supervisor/venvs/supervisor/bin/supervisorctl shutdown + +# Trust supervisor to kill all its children +# Otherwise systemd will see that ExecStop ^ comes back synchronously and say "Oh, I can kill everyone in this cgroup" +# https://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecStop= +# https://www.freedesktop.org/software/systemd/man/systemd.kill.html +KillMode=none + +[Install] +WantedBy=multi-user.target diff --git a/configuration_files/supervisorctl b/configuration_files/supervisorctl new file mode 100644 index 0000000000..380081e3e4 --- /dev/null +++ b/configuration_files/supervisorctl @@ -0,0 +1,8 @@ +#!/edx/app/supervisor/venvs/supervisor/bin/python +# -*- coding: utf-8 -*- +import re +import sys +from supervisor.supervisorctl import main +if __name__ == '__main__': + sys.argv[0] = re.sub(r'(-script\.pyw|\.exe)?$', '', sys.argv[0]) + sys.exit(main()) diff --git a/credentials_gunicorn.py b/credentials_gunicorn.py new file mode 100644 index 0000000000..3408bb3e31 --- /dev/null +++ b/credentials_gunicorn.py @@ -0,0 +1,18 @@ +""" +gunicorn configuration file: http://docs.gunicorn.org/en/develop/configure.html +Ansible managed +""" + +timeout = 300 +bind = "127.0.0.1:8150" +pythonpath = "/edx/app/credentials/credentials" +workers = 2 +worker_class = "gevent" + +limit_request_field_size = 16384 + + + + +def pre_request(worker, req): + worker.log.info("%s %s" % (req.method, req.path)) diff --git a/scripts/credentials.sh b/scripts/credentials.sh new file mode 100644 index 0000000000..395589d2ad --- /dev/null +++ b/scripts/credentials.sh @@ -0,0 +1,11 @@ +#!/usr/bin/env bash + +# Ansible managed + + + +export EDX_REST_API_CLIENT_NAME="default_env-default_deployment-credentials" + +source /edx/app/credentials/credentials_env + +exec /edx/app/credentials/venvs/credentials/bin/gunicorn -c /edx/app/credentials/credentials_gunicorn.py --reload credentials.wsgi:application diff --git a/scripts/devstack.sh b/scripts/devstack.sh new file mode 100644 index 0000000000..d287bb9a43 --- /dev/null +++ b/scripts/devstack.sh @@ -0,0 +1,31 @@ +#!/usr/bin/env bash + +# Ansible managed + +source /edx/app/credentials/credentials_env +COMMAND=$1 + +case $COMMAND in + start) + /edx/app/supervisor/venvs/supervisor/bin/supervisord -n --configuration /edx/app/supervisor/supervisord.conf + ;; + open) + . /edx/app/credentials/nodeenvs/credentials/bin/activate + . /edx/app/credentials/venvs/credentials/bin/activate + cd /edx/app/credentials/credentials + + /bin/bash + ;; + exec) + shift + + . /edx/app/credentials/nodeenvs/credentials/bin/activate + . /edx/app/credentials/venvs/credentials/bin/activate + cd "/edx/app/credentials/credentials" + + "$@" + ;; + *) + "$@" + ;; +esac