Repo that ties to https://reactor8.atlassian.net/browse/DTK-3746
Action proxy is a kubernetes service & deployment which routes action messages from workflow-executor to remote-executor and handles invocation errors.
For action proxy to function properly, there has to be
actions.dtk.io crd applied on the machine or for local use, ## ORactions.dtk.io crd applied on the machineSince Action proxy creates and invokes remote-executor knative service, there must be Istio and Knative installed on minikube/kubernetes cluster (follow this link for installation on minikube:
Istio/Knative installation on Minikube: https://github.com/dtk/remote-executor/blob/master/knative_installation/minikube/knative_prereqs_install.sh
Istio/Knative installation on Kubernetes cluster: https://github.com/dtk/remote-executor/blob/master/knative_installation/cluster/knative_prereqs_install.sh of dtk/remote-executor repo.
for testing purposes - grpcurl can be downloaded, installed and used.
Action proxy is dockerized by executing following commands in root directory of this repo.
sudo docker build -t {docker-user_name}/controller-action-proxy .
sudo docker push {docker-user_name}/controller-action_proxy
Run bash script: kube_resources/init_kube_resources.sh to install all controller-action-proxy prereqs and to deploy controller-action proxy on Kubernetes.
For action proxy to be deployed, there has to be a service account that has the right Kubernetes API privileges with which the action proxy container will be spun up.
An example of service account/cluster role/role binding is shown in file kube_resources/api-access-service-account.yaml in root directory of this repo.
To create this service account and set up cluster role, execute following commands:
kubectl create serviceaccount api-service-account
kubectl apply -f kube_resources/api-access-service-account.yaml
Also, Action proxy has a configmap with some values as the Knative service IP address, so make sure to update the configmap.yaml file to contain right IP address (obtained by running command kubectl get svc -n istio-system istio-ingressgateway). After that apply the configmap to Kubernetes.
kubectl apply -f kube_resources/configmap.yaml
Action proxy is deployed by executing following commands in root directory of this repo:
kubectl apply -f service.yaml
kubectl apply -f deployment.yaml
Note: Change deployment and service yaml files to have appropriate deployment name, docker image and service account name.
Action proxy is invoked with action_invocation_message
message ActionMessage {
required string image = 1;
optional string serviceAccountName = 2;
optional string secretName = 3;
required string action_crd_object = 4;
required string step = 5;
}
action_crd_object contains namespace/action_name. That namespace is the namespace in which knative service will be created/invoked.
IP address and port of action proxy, can be obtained:
kubectl get svc action-proxy (CLUSTER-IP and PORT)minikube service action-proxy --url (IP address and PORT - without http://)To test out invocation of action proxy, grpcurl can be used. Examples of usage are shown below.
ubuntu@ip-10-0-0-31:~/controller-action-proxy/examples/kubeapi-test/data$ ./grpcurl -plaintext -proto action_invocation_message.proto -d '{ "image":"docker.io/eminahuskic/remote-executor-refactored","serviceAccountName": "test-sa","action_crd_object":"test/action-instance1", "step":"21"}' ip-10-0-0-31:30671 pckg_action_invocation_message.ActionRequest/ReqReceived
{
"status": "OK",
"errorMessage": ""
}
ubuntu@ip-10-0-0-31:~/controller-action-proxy/examples/kubeapi-test/data$ ./grpcurl -plaintext -proto action_invocation_message.proto -d '{ "image":"docker.io/eminahuskic/remote-executor-refactored","serviceAccountName": "test-sa-bad","action_crd_object":"test/action-instance1", "step":"21"}' ip-10-0-0-31:30671 pckg_action_invocation_message.ActionRequest/ReqReceived
{
"status": "NOTOK",
"errorMessage": "Revision \"test--comp-rhcsf\" failed with message: Unable to fetch image \"docker.io/eminahuskic/remote-executor-refactored\": serviceaccounts \"test-sa-bad\" not found."
}
ubuntu@ip-10-0-0-31:~/controller-action-proxy/examples/kubeapi-test/data$ ./grpcurl -plaintext -proto action_invocation_message.proto -d '{ "image":"docker.io/eminahuskic/remote-executor-refactored ad","serviceAccountName": "test-sa","action_crd_object":"test/action-instance1", "step":"21"}' ip-10-0-0-31:30671 pckg_action_invocation_message.ActionRequest/ReqReceived
{
"status": "NOTOK",
"errorMessage": "Error: Internal error occurred: admission webhook \"webhook.serving.knative.dev\" denied the request: mutation failed: Failed to parse image reference: spec.runLatest.configuration.revisionTemplate.spec.container.image\nimage: \"docker.io/eminahuskic/remote-executor-refactored ad\", error: could not parse reference"
}
ubuntu@ip-10-0-0-31:~/controller-action-proxy/examples/kubeapi-test/data$ ./grpcurl -plaintext -proto action_invocation_message.proto -d '{ "image":"docker.io/eminahuskic/remote-executor-refactored-bad","serviceAccountName": "test-sa","action_crd_object":"test/action-instance1", "step":"21"}' ip-10-0-0-31:30671 pckg_action_invocation_message.ActionRequest/ReqReceived
{
"status": "NOTOK",
"errorMessage": "Revision \"test--comp-dbvqt\" failed with message: Unable to fetch image \"docker.io/eminahuskic/remote-executor-refactored-bad\": UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:eminahuskic/remote-executor-refactored-bad Type:repository]]."
}
ubuntu@ip-10-0-0-31:~/controller-action-proxy/examples/kubeapi-test/data$ ./grpcurl -plaintext -proto action_invocation_message.proto -d '{ "image":"docker.io/eminahuskic/remote-executor-refactored","serviceAccountName": "test-sa","action_crd_object":"test/action-instance1-bad", "step":"21"}' ip-10-0-0-31:30671 pckg_action_invocation_message.ActionRequest/ReqReceived
{
"status": "NOTOK",
"errorMessage": "Error: Action test/action-instance1-bad is not found. "
}
ubuntu@ip-10-0-0-31:~/controller-action-proxy/examples/kubeapi-test/data$ ./grpcurl -plaintext -proto action_invocation_message.proto -d '{ "image":"docker.io/eminahuskic/remote-executor-refactored","serviceAccountName": "test-sa","action_crd_object":"test/action-instance1", "step":"123"}' ip-10-0-0-31:30671 pckg_action_invocation_message.ActionRequest/ReqReceived
{
"status": "NOTOK",
"errorMessage": "5 NOT_FOUND: Action with id = 123 does not exist in CRD file.5 NOT_FOUND: Action with id = 123 does not exist in CRD file."
}
Content type
Image
Digest
Size
156.3 MB
Last updated
over 6 years ago
docker pull getdtk/controller-action-proxy