go
/
build
зеркало из https://github.com/golang/build.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
build/influx
История
Carlos Amedee e8c8ca12ab all: add license headers 
This change adds license headers to files which are missing them.
A modified version of the addlicense tool was used to add these headers:
https://github.com/google/addlicense

The command issued was:
addlicense -c "Go Authors" -l bsd *

Change-Id: Id6fd17c587f99b3ff0ef5f5f35befcfe5aaeef72
Reviewed-on: https://go-review.googlesource.com/c/build/+/409614
Run-TryBot: Carlos Amedee <carlos@golang.org>
Auto-Submit: Carlos Amedee <carlos@golang.org>
Reviewed-by: Carlos Amedee <carlos@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Alex Rakoczy <alex@golang.org>
 		2022-06-01 18:19:15 +00:00
..
Dockerfile influx: put influx behind a reverse proxy 2022-03-23 21:58:56 +00:00
Makefile influx: add kubernetes deployment 2022-03-23 21:59:02 +00:00
README.md perf: convert app to run on kubernetes 2022-04-08 20:45:57 +00:00
deployment-prod.yaml all: add license headers 2022-06-01 18:19:15 +00:00
main.go influx: move shared constants to common package 2022-04-08 17:02:43 +00:00

README.md

InfluxDB container image

This directory contains the source for the InfluxDB container image used in the Go Performance Monitoring system. The image is based on the Google-maintained GCP InfluxDB 2 image, with an additional small program to perform initial database setup and push access credentials to Google Secret Manager.

Local

To run an instance locally:

$ make docker-prod
$ docker run --rm -p 443:8086 gcr.io/symbolic-datum-552/influx:latest

Browse / API connect to https://localhost:8086 (note that the instance uses a self-signed certificate), and authenticate with user 'admin' or 'reader' with the password or API token logged by the container.

Google Cloud

One-time setup:

  1. IAM setup, based on https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#authenticating_to:

a. Create GCP service account:

$ gcloud iam service-accounts create influx \
    --description="Runs golang.org/x/build/influx"

c. Allow Kubernetes service account (created by deployment-prod.yaml) to impersonate the GCP service account:

$ gcloud iam service-accounts add-iam-policy-binding \
    influx@<PROJECT>.iam.gserviceaccount.com \
    --role roles/iam.workloadIdentityUser \
    --member "serviceAccount:<PROJECT>.svc.id.goog[prod/influx]"
  1. Secret Manager set up:

a. Create the secrets to store InfluxDB passwords/tokens in:

$ gcloud secrets create influx-admin-pass
$ gcloud secrets create influx-admin-token
$ gcloud secrets create influx-reader-pass
$ gcloud secrets create influx-reader-token

b. Grant access to the GCP service account to update the secrets.

$ gcloud secrets add-iam-policy-binding influx-admin-pass --member=serviceAccount:influx@<PROJECT>.iam.gserviceaccount.com --role="roles/secretmanager.secretVersionAdder"
$ gcloud secrets add-iam-policy-binding influx-admin-token --member=serviceAccount:influx@<PROJECT>.iam.gserviceaccount.com --role="roles/secretmanager.secretVersionAdder"
$ gcloud secrets add-iam-policy-binding influx-reader-pass --member=serviceAccount:influx@<PROJECT>.iam.gserviceaccount.com --role="roles/secretmanager.secretVersionAdder"
$ gcloud secrets add-iam-policy-binding influx-reader-token --member=serviceAccount:influx@<PROJECT>.iam.gserviceaccount.com --role="roles/secretmanager.secretVersionAdder"

Accessing Influx

The available users on Influx are 'admin' (full access) and 'reader' (read-only). To login as 'reader', use the following to access the password:

$ gcloud --project=symbolic-datum-552 secrets versions access latest --secret=influx-reader-pass

Then login at https://influx.golang.org.

To access the admin password, admin API token, or reader API token, change to --secret to one of influx-admin-pass, influx-admin-token, or influx-reader-token, respectively.