Skip to content

Commit 2879142

Browse files
phbnfphbnf
committed
put preloader in its own module
# Conflicts: # deployment/live/gcp/static-ct-staging/cloudbuild/staging/terragrunt.hcl
1 parent 7d579fa commit 2879142

File tree

5 files changed

+225
-61
lines changed

5 files changed

+225
-61
lines changed

‎deployment/live/gcp/static-ct-staging/cloudbuild/preloader/.terraform.lock.hcl

Lines changed: 22 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎deployment/live/gcp/static-ct-staging/cloudbuild/preloader/terragrunt.hcl

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
terraform {
2+
source = "${get_repo_root()}/deployment/modules/gcp//cloudbuild/preloader"
3+
}
4+
5+
locals {
6+
env = "staging"
7+
docker_env = "staging"
8+
project_id = get_env("GOOGLE_PROJECT", "static-ct-staging")
9+
location = get_env("GOOGLE_REGION", "us-central1")
10+
github_owner = get_env("GITHUB_OWNER", "transparency-dev")
11+
}
12+
13+
inputs = local
14+
15+
remote_state {
16+
backend = "gcs"
17+
18+
config = {
19+
project = local.project_id
20+
location = local.location
21+
bucket = "${local.project_id}-cloudbuild-preloader-terraform-state"
22+
prefix = "terraform.tfstate"
23+
24+
gcs_bucket_labels = {
25+
name = "terraform_state"
26+
env = "${local.env}"
27+
}
28+
}
29+
}
30+

‎deployment/modules/gcp/cloudbuild/preloader/main.tf

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
terraform {
2+
backend "gcs" {}
3+
4+
required_providers {
5+
google = {
6+
source = "registry.terraform.io/hashicorp/google"
7+
version = "6.12.0"
8+
}
9+
}
10+
}
11+
12+
# Cloud Build
13+
14+
locals {
15+
cloudbuild_service_account = "cloudbuild-${var.env}-sa@${var.project_id}.iam.gserviceaccount.com"
16+
scheduler_service_account = "scheduler-${var.env}-sa@${var.project_id}.iam.gserviceaccount.com"
17+
}
18+
19+
resource "google_project_service" "cloudbuild_api" {
20+
service = "cloudbuild.googleapis.com"
21+
disable_on_destroy = false
22+
}
23+
24+
## Service usage API is required on the project to enable APIs.
25+
## https://cloud.google.com/apis/docs/getting-started#enabling_apis
26+
## serviceusage.googleapis.com acts as a central point for managing the API
27+
## lifecycle within your project. By ensuring the required APIs are enabled
28+
## and accessible, it allows Cloud Build to function seamlessly and interact
29+
## with other Google Cloud services as needed.
30+
##
31+
## The Cloud Build service account also needs roles/serviceusage.serviceUsageViewer.
32+
resource "google_project_service" "serviceusage_api" {
33+
service = "serviceusage.googleapis.com"
34+
disable_on_destroy = false
35+
}
36+
37+
resource "google_cloudbuild_trigger" "preloader_trigger" {
38+
name = "preloader-${var.env}"
39+
service_account = "projects/${var.project_id}/serviceAccounts/${local.cloudbuild_service_account}"
40+
location = var.location
41+
42+
# TODO(phboneff): use a better mechanism to trigger releases that re-uses Docker containters, or based on branches rather.
43+
# This is a temporary mechanism to speed up development.
44+
github {
45+
owner = var.github_owner
46+
name = "static-ct"
47+
push {
48+
tag = "^staging-deploy-(.+)$"
49+
}
50+
}
51+
52+
build {
53+
## Since TesseraCT's infrastructure is not publicly accessible, we need to use
54+
## bearer tokens for the test to access them.
55+
## This step creates those, and stores them for later use.
56+
step {
57+
id = "bearer_token"
58+
name = "gcr.io/cloud-builders/gcloud"
59+
script = <<EOT
60+
gcloud auth print-access-token --lifetime=4200 > /workspace/cb_access
61+
curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/${local.cloudbuild_service_account}/identity?audience=${var.submission_url}" > /workspace/cb_identity
62+
EOT
63+
}
64+
65+
## TODO(phboneff): move to its own container / cloudrun / batch job.
66+
## Preload entries.
67+
## Leave enough time for the preloader to run, until the token expires.
68+
timeout = "4200s" // 60 minutes
69+
step {
70+
id = "ct_preloader"
71+
name = "golang"
72+
script = <<EOT
73+
START_INDEX=$(curl -H "Authorization: Bearer $(cat /workspace/cb_access)" https://storage.googleapis.com/${var.monitoring_url}/checkpoint | head -2 | tail -1)
74+
echo "Will start preloader at index $START_INDEX"
75+
go run github.com/google/certificate-transparency-go/preload/preloader@master \
76+
--target_log_uri=${var.submission_url}/ \
77+
--target_bearer_token="$(cat /workspace/cb_identity)" \
78+
--source_log_uri=https://ct.googleapis.com/logs/us1/argon2025h1 \
79+
--start_index=$START_INDEX \
80+
--num_workers=20 \
81+
--parallel_fetch=20 \
82+
--parallel_submit=20
83+
EOT
84+
wait_for = ["bearer_token"]
85+
timeout = "3600s" // 60 minutes, duration of token validity.
86+
}
87+
88+
options {
89+
logging = "CLOUD_LOGGING_ONLY"
90+
machine_type = "E2_HIGHCPU_8"
91+
}
92+
}
93+
}
94+
95+
resource "google_cloud_scheduler_job" "deploy_cron" {
96+
paused = false
97+
project = var.project_id
98+
region = var.location
99+
name = "deploy-cron"
100+
101+
schedule = "50 * * * *"
102+
time_zone = "America/Los_Angeles"
103+
104+
attempt_deadline = "120s"
105+
106+
// TODO(phboneff): use a batch job instead maybe
107+
http_target {
108+
http_method = "POST"
109+
uri = "https://cloudbuild.googleapis.com/v1/projects/${var.project_id}/locations/${var.location}/triggers/${google_cloudbuild_trigger.preloader_trigger.trigger_id}:run"
110+
body = base64encode(jsonencode({
111+
source = {
112+
branchName = "preloader"
113+
}
114+
}))
115+
headers = {
116+
"Content-Type" = "application/json"
117+
}
118+
119+
oauth_token {
120+
service_account_email = local.scheduler_service_account
121+
}
122+
}
123+
}

‎deployment/modules/gcp/cloudbuild/preloader/variables.tf

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
variable "project_id" {
2+
description = "GCP project ID where the log is hosted"
3+
type = string
4+
}
5+
6+
variable "location" {
7+
description = "Location in which to create resources"
8+
type = string
9+
}
10+
11+
variable "env" {
12+
description = "Unique identifier for the env, e.g. dev or ci or prod"
13+
type = string
14+
}
15+
16+
variable "docker_env" {
17+
description = "Unique identifier for the Docker env, e.g. dev or ci or prod"
18+
type = string
19+
}
20+
21+
variable "github_owner" {
22+
description = "GitHub owner used in Cloud Build trigger repository mapping"
23+
type = string
24+
}
25+
26+
variable "submission_url" {
27+
description = "Submission URL of the destination log"
28+
type = string
29+
}
30+
31+
variable "monitoring_url" {
32+
description = "Monitoring URL of the destination log"
33+
type = string
34+
}

‎deployment/modules/gcp/cloudbuild/tesseract/main.tf

Lines changed: 16 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -127,42 +127,27 @@ resource "google_cloudbuild_trigger" "build_trigger" {
127127
wait_for = ["docker_push_conformance_gcp"]
128128
}
129129

130-
## Since the conformance infrastructure is not publicly accessible, we need to use
131-
## bearer tokens for the test to access them.
132-
## This step creates those, and stores them for later use.
130+
## Apply the deployment/live/gcp/static-staging/cloudbuild/preloader terragrunt config.
131+
## This will bring up the preloader agaist the conformance infrastructure.
133132
step {
134-
id = "bearer_token"
135-
name = "gcr.io/cloud-builders/gcloud"
136-
script = <<EOT
137-
gcloud auth print-access-token > /workspace/cb_access
138-
curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/${local.cloudbuild_service_account}/identity?audience=$(cat /workspace/conformance_url)" > /workspace/cb_identity
133+
id = "terraform_apply_preloader"
134+
name = "alpine/terragrunt"
135+
script = <<EOT
136+
terragrunt --terragrunt-non-interactive --terragrunt-no-color apply -auto-approve -no-color -var="submission_url=$(cat /workspace/conformance_url)/arche2025h1.ct.transparency.dev/" -var="monitoring_url=$(cat /workspace/conformance_bucket_name)" 2>&1
139137
EOT
138+
dir = "deployment/live/gcp/static-ct-staging/cloudbuild/preloader"
139+
env = [
140+
"GOOGLE_PROJECT=${var.project_id}",
141+
"TF_IN_AUTOMATION=1",
142+
"TF_INPUT=false",
143+
"TF_VAR_project_id=${var.project_id}",
144+
"TF_VAR_location=${var.location}",
145+
"TF_VAR_env=${var.env}",
146+
"TF_VAR_github_owner=${var.github_owner}",
147+
]
140148
wait_for = ["terraform_apply_conformance_staging"]
141149
}
142150

143-
## TODO(phboneff): move to its own container.
144-
## Test against the conformance server with CT Preloader.
145-
## Leave enough time for the preloader to run, until the token expires.
146-
timeout = "3600s" // 60 minutes
147-
step {
148-
id = "ct_preloader"
149-
name = "golang"
150-
script = <<EOT
151-
START_INDEX=$(curl -H "Authorization: Bearer $(cat /workspace/cb_access)" https://storage.googleapis.com/$(cat /workspace/conformance_bucket_name)/checkpoint | head -2 | tail -1)
152-
echo "Will start preloader at index $START_INDEX"
153-
go run github.com/google/certificate-transparency-go/preload/preloader@master \
154-
--target_log_uri=$(cat /workspace/conformance_url)/arche2025h1.ct.transparency.dev \
155-
--target_bearer_token="$(cat /workspace/cb_identity)" \
156-
--source_log_uri=https://ct.googleapis.com/logs/us1/argon2025h1 \
157-
--start_index=$START_INDEX \
158-
--num_workers=20 \
159-
--parallel_fetch=20 \
160-
--parallel_submit=20
161-
EOT
162-
wait_for = ["bearer_token"]
163-
timeout = "3000s" // 50 minutes
164-
}
165-
166151
options {
167152
logging = "CLOUD_LOGGING_ONLY"
168153
machine_type = "E2_HIGHCPU_8"
@@ -173,33 +158,3 @@ resource "google_cloudbuild_trigger" "build_trigger" {
173158
module.artifactregistry
174159
]
175160
}
176-
177-
resource "google_cloud_scheduler_job" "deploy_cron" {
178-
paused = false
179-
project = var.project_id
180-
region = var.location
181-
name = "deploy-cron"
182-
183-
schedule = "*/50 * * * *"
184-
time_zone = "America/Los_Angeles"
185-
186-
attempt_deadline = "120s"
187-
188-
// TODO(phboneff): use a batch job instead maybe
189-
http_target {
190-
http_method = "POST"
191-
uri = "https://cloudbuild.googleapis.com/v1/projects/${var.project_id}/locations/${var.location}/triggers/${google_cloudbuild_trigger.build_trigger.trigger_id}:run"
192-
body = base64encode(jsonencode({
193-
source = {
194-
branchName = "preloader"
195-
}
196-
}))
197-
headers = {
198-
"Content-Type" = "application/json"
199-
}
200-
201-
oauth_token {
202-
service_account_email = local.scheduler_service_account
203-
}
204-
}
205-
}

0 commit comments

Comments
 (0)