История

Heschi Kreinick 97ac8cdb8a all: re-disable container native routing This reverts CL 422594. Apparently we were misinformed. Change-Id: I199ca3780ba3b8a7003490534609255ae15861e9 Reviewed-on: https://go-review.googlesource.com/c/build/+/423341 Auto-Submit: Heschi Kreinick <heschi@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Heschi Kreinick <heschi@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>		2022-08-12 18:07:47 +00:00
..
Dockerfile	influx: put influx behind a reverse proxy	2022-03-23 21:58:56 +00:00
Makefile	influx: add kubernetes deployment	2022-03-23 21:59:02 +00:00
README.md	all: clean up and consolidate deployment documentation	2022-07-07 18:00:38 +00:00
deployment-prod.yaml	all: re-disable container native routing	2022-08-12 18:07:47 +00:00
main.go	influx: move shared constants to common package	2022-04-08 17:02:43 +00:00

README.md

InfluxDB container image

This directory contains the source for the InfluxDB container image used in the Go Performance Monitoring system. The image is based on the Google-maintained GCP InfluxDB 2 image, with an additional small program to perform initial database setup and push access credentials to Google Secret Manager.

Local

To run an instance locally:

$ make docker-prod
$ docker run --rm -p 443:8086 gcr.io/symbolic-datum-552/influx:latest

Browse / API connect to https://localhost:8086 (note that the instance uses a self-signed certificate), and authenticate with user 'admin' or 'reader' with the password or API token logged by the container.

Google Cloud

One-time setup:

IAM setup, based on https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#authenticating_to:

a. Create GCP service account:

$ gcloud iam service-accounts create influx \
    --description="Runs golang.org/x/build/influx"

c. Allow Kubernetes service account (created by deployment-prod.yaml) to impersonate the GCP service account:

$ gcloud iam service-accounts add-iam-policy-binding \
    influx@<PROJECT>.iam.gserviceaccount.com \
    --role roles/iam.workloadIdentityUser \
    --member "serviceAccount:<PROJECT>.svc.id.goog[prod/influx]"

Secret Manager set up:

a. Create the secrets to store InfluxDB passwords/tokens in:

$ gcloud secrets create influx-admin-pass
$ gcloud secrets create influx-admin-token
$ gcloud secrets create influx-reader-pass
$ gcloud secrets create influx-reader-token

b. Grant access to the GCP service account to update the secrets.

$ gcloud secrets add-iam-policy-binding influx-admin-pass --member=serviceAccount:influx@<PROJECT>.iam.gserviceaccount.com --role="roles/secretmanager.secretVersionAdder"
$ gcloud secrets add-iam-policy-binding influx-admin-token --member=serviceAccount:influx@<PROJECT>.iam.gserviceaccount.com --role="roles/secretmanager.secretVersionAdder"
$ gcloud secrets add-iam-policy-binding influx-reader-pass --member=serviceAccount:influx@<PROJECT>.iam.gserviceaccount.com --role="roles/secretmanager.secretVersionAdder"
$ gcloud secrets add-iam-policy-binding influx-reader-token --member=serviceAccount:influx@<PROJECT>.iam.gserviceaccount.com --role="roles/secretmanager.secretVersionAdder"

Accessing Influx

The available users on Influx are 'admin' (full access) and 'reader' (read-only). To login as 'reader', use the following to access the password:

$ gcloud --project=symbolic-datum-552 secrets versions access latest --secret=influx-reader-pass

Then login at https://influx.golang.org.

To access the admin password, admin API token, or reader API token, change to --secret to one of influx-admin-pass, influx-admin-token, or influx-reader-token, respectively.

Deployment

See the documentation on deployment.