From 4d8d3721e99f84a4517661952c7f6986c2406879 Mon Sep 17 00:00:00 2001 From: Filip Grzadkowski Date: Mon, 28 Sep 2015 14:34:14 +0200 Subject: [PATCH] Fix phabricator example --- examples_test.go | 5 +- phabricator/README.md | 134 +++++++----------- phabricator/authenticator-controller.json | 31 ---- phabricator/cloudsql-authenticator/Dockerfile | 8 -- phabricator/cloudsql-authenticator/run.sh | 32 ----- phabricator/phabricator-controller.json | 14 ++ phabricator/setup.sh | 1 - phabricator/teardown.sh | 2 - 8 files changed, 69 insertions(+), 158 deletions(-) delete mode 100644 phabricator/authenticator-controller.json delete mode 100644 phabricator/cloudsql-authenticator/Dockerfile delete mode 100755 phabricator/cloudsql-authenticator/run.sh diff --git a/examples_test.go b/examples_test.go index 8341722d..ff7d2a0f 100644 --- a/examples_test.go +++ b/examples_test.go @@ -318,9 +318,8 @@ func TestExampleObjectSchemas(t *testing.T) { "secret": nil, }, "../examples/phabricator": { - "authenticator-controller": &api.ReplicationController{}, - "phabricator-controller": &api.ReplicationController{}, - "phabricator-service": &api.Service{}, + "phabricator-controller": &api.ReplicationController{}, + "phabricator-service": &api.Service{}, }, "../examples/redis": { "redis-controller": &api.ReplicationController{}, diff --git a/phabricator/README.md b/phabricator/README.md index d9fca4bb..2409a9bb 100644 --- a/phabricator/README.md +++ b/phabricator/README.md @@ -43,16 +43,36 @@ This example assumes that you have a basic understanding of kubernetes [services ```sh $ cd kubernetes -$ hack/dev-build-and-up.sh +$ cluster/kube-up.sh ``` ### Step One: Set up Cloud SQL instance Follow the [official instructions](https://cloud.google.com/sql/docs/getting-started) to set up Cloud SQL instance. -In the remaining part of this example we will assume that your instance is named "phabricator-db", has IP 173.194.242.66 and the password is "1234". +In the remaining part of this example we will assume that your instance is named "phabricator-db", has IP 1.2.3.4, is listening on port 3306 and the password is "1234". -### Step Two: Turn up the phabricator +### Step Two: Authenticate phabricator in Cloud SQL + +In order to allow phabricator to connect to your Cloud SQL instance you need to run the following command to authorize all your nodes within a cluster: + +```bash +NODE_NAMES=`kubectl get nodes | cut -d" " -f1 | tail -n+2` +NODE_IPS=`gcloud compute instances list $NODE_NAMES | tr -s " " | cut -d" " -f 5 | tail -n+2` +gcloud sql instances patch phabricator-db --authorized-networks $NODE_IPS +``` + +Otherwise you will see the following logs: + +```bash +$ kubectl logs phabricator-controller-02qp4 +[...] +Raw MySQL Error: Attempt to connect to root@1.2.3.4 failed with error +#2013: Lost connection to MySQL server at 'reading initial communication packet', system error: 0. + +``` + +### Step Three: Turn up the phabricator To start Phabricator server use the file [`examples/phabricator/phabricator-controller.json`](phabricator-controller.json) which describes a [replication controller](../../docs/user-guide/replication-controller.md) with a single [pod](../../docs/user-guide/pods.md) running an Apache server with Phabricator PHP source: @@ -89,6 +109,20 @@ To start Phabricator server use the file [`examples/phabricator/phabricator-cont "name": "http-server", "containerPort": 80 } + ], + "env": [ + { + "name": "MYSQL_SERVICE_IP", + "value": "1.2.3.4" + }, + { + "name": "MYSQL_SERVICE_PORT", + "value": "3306" + }, + { + "name": "MYSQL_PASSWORD", + "value": "1234" + } ] } ] @@ -107,6 +141,8 @@ Create the phabricator pod in your Kubernetes cluster by running: $ kubectl create -f examples/phabricator/phabricator-controller.json ``` +**Note:** Remember to substitute environment variable values in json file before create replication controller. + Once that's up you can list the pods in the cluster, to verify that it is running: ```sh @@ -132,84 +168,11 @@ CONTAINER ID IMAGE COMMAND CREATED (Note that initial `docker pull` may take a few minutes, depending on network conditions. During this time, the `get pods` command will return `Pending` because the container has not yet started ) -### Step Three: Authenticate phabricator in Cloud SQL - -If you read logs of the phabricator container you will notice the following error message: - -```bash -$ kubectl logs phabricator-controller-02qp4 -[...] -Raw MySQL Error: Attempt to connect to root@173.194.252.142 failed with error -#2013: Lost connection to MySQL server at 'reading initial communication packet', system error: 0. - -``` - -This is because the host on which this container is running is not authorized in Cloud SQL. To fix this run: - -```bash -gcloud sql instances patch phabricator-db --authorized-networks 130.211.141.151 -``` - -To automate this process and make sure that a proper host is authorized even if pod is rescheduled to a new machine we need a separate pod that periodically lists pods and authorizes hosts. Use the file [`examples/phabricator/authenticator-controller.json`](authenticator-controller.json): - - - -```json -{ - "kind": "ReplicationController", - "apiVersion": "v1", - "metadata": { - "name": "authenticator-controller", - "labels": { - "name": "authenticator" - } - }, - "spec": { - "replicas": 1, - "selector": { - "name": "authenticator" - }, - "template": { - "metadata": { - "labels": { - "name": "authenticator" - } - }, - "spec": { - "containers": [ - { - "name": "authenticator", - "image": "gcr.io/google_containers/cloudsql-authenticator:v1" - } - ] - } - } - } -} -``` - -[Download example](authenticator-controller.json?raw=true) - - -To create the pod run: - -```sh -$ kubectl create -f examples/phabricator/authenticator-controller.json -``` - - ### Step Four: Turn up the phabricator service A Kubernetes 'service' is a named load balancer that proxies traffic to one or more containers. The services in a Kubernetes cluster are discoverable inside other containers via *environment variables*. Services find the containers to load balance based on pod labels. These environment variables are typically referenced in application code, shell scripts, or other places where one node needs to talk to another in a distributed system. You should catch up on [kubernetes services](../../docs/user-guide/services.md) before proceeding. -The pod that you created in Step One has the label `name=phabricator`. The selector field of the service determines which pods will receive the traffic sent to the service. Since we are setting up a service for an external application we also need to request external static IP address (otherwise it will be assigned dynamically): - -```sh -$ gcloud compute addresses create phabricator --region us-central1 -Created [https://www.googleapis.com/compute/v1/projects/myproject/regions/us-central1/addresses/phabricator]. -NAME REGION ADDRESS STATUS -phabricator us-central1 107.178.210.6 RESERVED -``` +The pod that you created in Step Three has the label `name=phabricator`. The selector field of the service determines which pods will receive the traffic sent to the service. Use the file [`examples/phabricator/phabricator-service.json`](phabricator-service.json): @@ -247,16 +210,25 @@ $ kubectl create -f examples/phabricator/phabricator-service.json phabricator ``` -To play with the service itself, find the `EXTERNAL_IP` of the load balancer: +To play with the service itself, find the external IP of the load balancer: ```console -$ kubectl get services phabricator -NAME CLUSTER_IP EXTERNAL_IP PORT(S) SELECTOR AGE -phabricator 10.0.0.2 1.2.3.4 8080/TCP ... ... +$ kubectl get services +NAME LABELS SELECTOR IP(S) PORT(S) +kubernetes component=apiserver,provider=kubernetes 10.0.0.1 443/TCP +phabricator name=phabricator 10.0.31.173 80/TCP +$ kubectl get services phabricator -o json | grep ingress -A 4 + "ingress": [ + { + "ip": "104.197.13.125" + } + ] ``` and then visit port 80 of that IP address. +**Note**: Provisioning of the external IP address may take few minutes. + **Note**: You may need to open the firewall for port 80 using the [console][cloud-console] or the `gcloud` tool. The following command will allow traffic from any source to instances tagged `kubernetes-minion`: ```sh diff --git a/phabricator/authenticator-controller.json b/phabricator/authenticator-controller.json deleted file mode 100644 index fbc449a7..00000000 --- a/phabricator/authenticator-controller.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "kind": "ReplicationController", - "apiVersion": "v1", - "metadata": { - "name": "authenticator-controller", - "labels": { - "name": "authenticator" - } - }, - "spec": { - "replicas": 1, - "selector": { - "name": "authenticator" - }, - "template": { - "metadata": { - "labels": { - "name": "authenticator" - } - }, - "spec": { - "containers": [ - { - "name": "authenticator", - "image": "gcr.io/google_containers/cloudsql-authenticator:v1" - } - ] - } - } - } -} diff --git a/phabricator/cloudsql-authenticator/Dockerfile b/phabricator/cloudsql-authenticator/Dockerfile deleted file mode 100644 index 50456c0f..00000000 --- a/phabricator/cloudsql-authenticator/Dockerfile +++ /dev/null @@ -1,8 +0,0 @@ -FROM google/cloud-sdk - -RUN apt-get update && apt-get install -y curl - -ADD run.sh /run.sh -RUN chmod a+x /*.sh - -CMD ["/run.sh"] diff --git a/phabricator/cloudsql-authenticator/run.sh b/phabricator/cloudsql-authenticator/run.sh deleted file mode 100755 index 8b84da8e..00000000 --- a/phabricator/cloudsql-authenticator/run.sh +++ /dev/null @@ -1,32 +0,0 @@ -#!/bin/bash - -# Copyright 2015 The Kubernetes Authors All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# TODO: This loop updates authorized networks even if nothing has changed. It -# should only send updates if something changes. We should be able to do -# this by comparing pod creation time with the last scan time. -while true; do - hostport="https://kubernetes.default.svc.cluster.local" - token=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token) - path="api/v1/pods" - query="labels=$SELECTOR" - - # TODO: load in the CAS cert when we distributed it on all platforms. - ips_json=`curl ${hostport}/${path}?${query} --insecure --header "Authorization: Bearer ${token}" 2>/dev/null | grep hostIP` - ips=`echo $ips_json | cut -d'"' -f 4 | sed 's/,$//'` - echo "Adding IPs $ips" - gcloud sql instances patch $CLOUDSQL_DB --authorized-networks $ips - sleep 10 -done diff --git a/phabricator/phabricator-controller.json b/phabricator/phabricator-controller.json index 7a6355cd..b13103e1 100644 --- a/phabricator/phabricator-controller.json +++ b/phabricator/phabricator-controller.json @@ -28,6 +28,20 @@ "name": "http-server", "containerPort": 80 } + ], + "env": [ + { + "name": "MYSQL_SERVICE_IP", + "value": "1.2.3.4" + }, + { + "name": "MYSQL_SERVICE_PORT", + "value": "3306" + }, + { + "name": "MYSQL_PASSWORD", + "value": "1234" + } ] } ] diff --git a/phabricator/setup.sh b/phabricator/setup.sh index 860c93f0..d6adbf01 100755 --- a/phabricator/setup.sh +++ b/phabricator/setup.sh @@ -16,6 +16,5 @@ echo "Create Phabricator replication controller" && kubectl create -f phabricator-controller.json echo "Create Phabricator service" && kubectl create -f phabricator-service.json -echo "Create Authenticator replication controller" && kubectl create -f authenticator-controller.json echo "Create firewall rule" && gcloud compute firewall-rules create phabricator-node-80 --allow=tcp:80 --target-tags kubernetes-minion diff --git a/phabricator/teardown.sh b/phabricator/teardown.sh index 884c5f4b..898c0910 100755 --- a/phabricator/teardown.sh +++ b/phabricator/teardown.sh @@ -14,9 +14,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -echo "Deleting Authenticator replication controller" && kubectl stop rc authenticator-controller echo "Deleting Phabricator service" && kubectl delete -f phabricator-service.json echo "Deleting Phabricator replication controller" && kubectl stop rc phabricator-controller - echo "Delete firewall rule" && gcloud compute firewall-rules delete -q phabricator-node-80