diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml new file mode 100644 index 0000000..2bda9ba --- /dev/null +++ b/.github/workflows/build.yml @@ -0,0 +1,37 @@ +name: Build +on: + push: + branches: + - master + - develop + pull_request: + types: [opened, synchronize, reopened] +jobs: + build: + name: Build + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v2 + with: + fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis + - name: Set up JDK 11 + uses: actions/setup-java@v1 + with: + java-version: 11 + - name: Cache SonarCloud packages + uses: actions/cache@v1 + with: + path: ~/.sonar/cache + key: ${{ runner.os }}-sonar + restore-keys: ${{ runner.os }}-sonar + - name: Cache Gradle packages + uses: actions/cache@v1 + with: + path: ~/.gradle/caches + key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }} + restore-keys: ${{ runner.os }}-gradle + - name: Build and analyze + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + run: ./gradlew build sonarqube --info \ No newline at end of file diff --git a/.gitignore b/.gitignore index b6e4761..48ab8b0 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,25 @@ +build +.gradle +.vscode + +*.log +*.jar +*.war +*.nar +*.ear +*.zip +*.tar.gz +*.rar + +# MAC +**/.DS_Store + +# internal +*internal* + +# k8s +python-ping-api.yaml + # Byte-compiled / optimized / DLL files __pycache__/ *.py[cod] diff --git a/README.md b/README.md index 6656edd..c779fed 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,102 @@ -# _eks-python-api -Python REST API sample for EKS +# Python sample project for EKS + +[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=DevSecOpsSamples_eks-python-api&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=DevSecOpsSamples_eks-python-api) [![Lines of Code](https://sonarcloud.io/api/project_badges/measure?project=DevSecOpsSamples_eks-python-api&metric=ncloc)](https://sonarcloud.io/summary/new_code?id=DevSecOpsSamples_eks-python-api) + +The sample project to deploy Python REST API application, Service, HorizontalPodAutoscaler, Ingress on EKS. + +- [app.py](app/app.py) +- [Dockerfile](app/Dockerfile) +- [python-ping-api-template.yaml](app/python-ping-api-template.yaml) + +--- + +## Prerequisites + +### Installation + +- [Installing or updating the latest version of the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) + +### Set AWS configurations + +Set AWS configurations with `aws configure` for default region and keys: + +```bash +aws configure +``` + +```bash +AWS Access Key ID [None]: +AWS Secret Access Key [None]: +Default region name [None]: us-east-1 +Default output format [None]: +``` + +```bash +aws configure get default.region +us-east-1 +``` + +--- + +## Create an EKS cluster and deploy AWS Load Balancer Controller + +Refer to the https://github.com/DevSecOpsSamples/eks-eksctl page. + +## Set environment variables + +```bash +REGION=$(aws configure get default.region) +ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text) +CLUSTER_NAME=$(kubectl config current-context | cut -d '@' -f2 | cut -d '.' -f1) +echo "REGION: ${REGION}, ACCOUNT_ID: ${ACCOUNT_ID}, CLUSTER_NAME: ${CLUSTER_NAME}" +``` + +## Deploy python-ping-api + +Build and push to ECR: + +```bash +cd ../app +docker build -t python-ping-api . --platform linux/amd64 + +docker tag python-ping-api:latest ${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com/python-ping-api:latest + +aws ecr get-login-password --region ${REGION} | docker login --username AWS --password-stdin ${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com + +docker push ${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com/python-ping-api:latest +``` + +Create and deploy K8s Deployment, Service, HorizontalPodAutoscaler, Ingress using the [python-ping-api-template.yaml](app/python-ping-api-template.yaml) template file. + +```bash + +sed -e "s||${ACCOUNT_ID}|g" python-ping-api-template.yaml | sed -e "s||${REGION}|g" > python-ping-api.yaml +cat python-ping-api.yaml + +kubectl apply -f python-ping-api.yaml +``` + +It may take around 5 minutes to create a load balancer, including health checking. + +Confirm that Pod and ALB logs. + +```bash +kubectl logs -l app=python-ping-api + +kubectl describe pods + +kubectl logs -f $(kubectl get po -n kube-system | egrep -o 'aws-load-balancer-controller-[A-Za-z0-9-]+') -n kube-system +``` + +--- + +## Cleanup + +```bash +kubectl delete -f app/python-ping-api.yaml + +``` + +## References + +- [Application load balancing on Amazon EKS](https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html) diff --git a/app/Dockerfile b/app/Dockerfile new file mode 100644 index 0000000..1aba69d --- /dev/null +++ b/app/Dockerfile @@ -0,0 +1,14 @@ +FROM python:3.9-alpine + +VOLUME ./:app/ + +COPY requirements.txt requirements.txt +RUN pip install -r requirements.txt + +COPY . /app/ + +WORKDIR /app + +EXPOSE 8000 + +CMD ["gunicorn", "app:app", "--bind", "0.0.0.0:8000"] diff --git a/app/app.py b/app/app.py new file mode 100644 index 0000000..6933309 --- /dev/null +++ b/app/app.py @@ -0,0 +1,37 @@ +from flask import Flask +from flask import request +from flask import json +from werkzeug.exceptions import HTTPException + +app = Flask(__name__) + +@app.route("/") +def ping_root(): + return ping() + +@app.route("/") +def ping_path1(path1): + return ping() + +def ping(): + return { + "host": request.host, + "url": request.url, + "method": request.method, + "message": "ping-api" + } + +@app.errorhandler(HTTPException) +def handle_exception(e): + response = e.get_response() + response.data = json.dumps({ + "code": e.code, + "name": e.name, + "description": e.description, + }) + response.content_type = "application/json" + return response + +if __name__ == '__main__': + app.debug = True + app.run(host='0.0.0.0', port=8000) diff --git a/app/build.sh b/app/build.sh new file mode 100755 index 0000000..38c744c --- /dev/null +++ b/app/build.sh @@ -0,0 +1,17 @@ +#!/bin/bash +set -e + +ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text) +REGION=$(aws configure get default.region) + +echo "ACCOUNT_ID: $ACCOUNT_ID" +echo "REGION: $REGION" +sleep 1 + +docker build -t python-ping-api . --platform linux/amd64 + +docker tag python-ping-api:latest ${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com/python-ping-api:latest + +aws ecr get-login-password --region ${REGION} | docker login --username AWS --password-stdin ${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com + +docker push ${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com/python-ping-api:latest \ No newline at end of file diff --git a/app/gunicorn.config.py b/app/gunicorn.config.py new file mode 100644 index 0000000..8a7d5e8 --- /dev/null +++ b/app/gunicorn.config.py @@ -0,0 +1,2 @@ +import multiprocessing +workers = multiprocessing.cpu_count() * 2 + 1 \ No newline at end of file diff --git a/app/python-ping-api-template.yaml b/app/python-ping-api-template.yaml new file mode 100644 index 0000000..5fbb5a3 --- /dev/null +++ b/app/python-ping-api-template.yaml @@ -0,0 +1,101 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: python-ping-api + annotations: + app: 'python-ping-api' +spec: + replicas: 2 + selector: + matchLabels: + app: python-ping-api + template: + metadata: + labels: + app: python-ping-api + spec: + containers: + - name: python-ping-api + image: .dkr.ecr..amazonaws.com/python-ping-api:latest + imagePullPolicy: Always + ports: + - containerPort: 8000 + resources: + requests: + cpu: "0.25" + memory: "256Mi" + limits: + cpu: "0.25" + memory: "256Mi" + env: + - name: env + value: "dev" +--- +apiVersion: v1 +kind: Service +metadata: + name: python-ping-api + annotations: + app: 'python-ping-api' + alb.ingress.kubernetes.io/healthcheck-path: "/ping" +spec: + selector: + app: python-ping-api + type: NodePort + ports: + - port: 8000 + targetPort: 8000 + protocol: TCP +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: "python-ping-api-ingress" + annotations: + app: 'python-ping-api' + kubernetes.io/ingress.class: alb + alb.ingress.kubernetes.io/scheme: internet-facing + alb.ingress.kubernetes.io/target-type: ip + alb.ingress.kubernetes.io/load-balancer-name: python-ping-api + alb.ingress.kubernetes.io/load-balancer-attributes: idle_timeout.timeout_seconds=30 + alb.ingress.kubernetes.io/target-group-attributes: deregistration_delay.timeout_seconds=10 + alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}]' + # alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]' + # alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:::certificate/ + # alb.ingress.kubernetes.io/ssl-redirect: '443' + alb.ingress.kubernetes.io/tags: env=dev + alb.ingress.kubernetes.io/healthcheck-interval-seconds: '16' + alb.ingress.kubernetes.io/healthcheck-timeout-seconds: '15' + alb.ingress.kubernetes.io/healthy-threshold-count: '2' + alb.ingress.kubernetes.io/unhealthy-threshold-count: '5' +spec: + rules: + - http: + paths: + - path: /* + pathType: ImplementationSpecific + backend: + service: + name: python-ping-api + port: + number: 8000 +--- +apiVersion: autoscaling/v2beta2 +kind: HorizontalPodAutoscaler +metadata: + name: 'python-ping-api-hpa' +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: 'python-ping-api' + minReplicas: 2 + maxReplicas: 10 + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 50 \ No newline at end of file diff --git a/app/requirements.txt b/app/requirements.txt new file mode 100644 index 0000000..b690bf6 --- /dev/null +++ b/app/requirements.txt @@ -0,0 +1,2 @@ +Flask==2.1.1 +gunicorn==20.1.0 diff --git a/build.gradle b/build.gradle new file mode 100644 index 0000000..5d45c78 --- /dev/null +++ b/build.gradle @@ -0,0 +1,26 @@ +plugins { + id 'base' + id "org.sonarqube" version "3.4.0.2513" +} + +repositories { + mavenCentral() +} + +sonarqube { + properties { + property "sonar.projectName", "eks-python-api" + property "sonar.projectKey", "DevSecOpsSamples_eks-python-api" + property "sonar.organization", "devsecopssamples" + // property "sonar.host.url", "http://127.0.0.1:9000" + property "sonar.host.url", "https://sonarcloud.io" + property "sonar.sourceEncoding", "UTF-8" + property "sonar.sources", "." + property "sonar.python.version", "3.9" + property "sonar.exclusions", "**/node_modules/**, **/cdk.out/**" + property "sonar.issue.ignore.multicriteria", "e1" + property "sonar.issue.ignore.multicriteria.e1.ruleKey", "typescript:S1848" + property "sonar.issue.ignore.multicriteria.e1.resourceKey", "**/*.ts" + property "sonar.links.ci", "https://github.com/DevSecOpsSamples/eks-python-api" + } +} \ No newline at end of file diff --git a/gradle/wrapper/gradle-wrapper.jar b/gradle/wrapper/gradle-wrapper.jar new file mode 100644 index 0000000..e708b1c Binary files /dev/null and b/gradle/wrapper/gradle-wrapper.jar differ diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties new file mode 100644 index 0000000..3ab0b72 --- /dev/null +++ b/gradle/wrapper/gradle-wrapper.properties @@ -0,0 +1,5 @@ +distributionBase=GRADLE_USER_HOME +distributionPath=wrapper/dists +distributionUrl=https\://services.gradle.org/distributions/gradle-6.9.1-bin.zip +zipStoreBase=GRADLE_USER_HOME +zipStorePath=wrapper/dists diff --git a/gradlew b/gradlew new file mode 100755 index 0000000..4f906e0 --- /dev/null +++ b/gradlew @@ -0,0 +1,185 @@ +#!/usr/bin/env sh + +# +# Copyright 2015 the original author or authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +############################################################################## +## +## Gradle start up script for UN*X +## +############################################################################## + +# Attempt to set APP_HOME +# Resolve links: $0 may be a link +PRG="$0" +# Need this for relative symlinks. +while [ -h "$PRG" ] ; do + ls=`ls -ld "$PRG"` + link=`expr "$ls" : '.*-> \(.*\)$'` + if expr "$link" : '/.*' > /dev/null; then + PRG="$link" + else + PRG=`dirname "$PRG"`"/$link" + fi +done +SAVED="`pwd`" +cd "`dirname \"$PRG\"`/" >/dev/null +APP_HOME="`pwd -P`" +cd "$SAVED" >/dev/null + +APP_NAME="Gradle" +APP_BASE_NAME=`basename "$0"` + +# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. +DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"' + +# Use the maximum available, or set MAX_FD != -1 to use that value. +MAX_FD="maximum" + +warn () { + echo "$*" +} + +die () { + echo + echo "$*" + echo + exit 1 +} + +# OS specific support (must be 'true' or 'false'). +cygwin=false +msys=false +darwin=false +nonstop=false +case "`uname`" in + CYGWIN* ) + cygwin=true + ;; + Darwin* ) + darwin=true + ;; + MINGW* ) + msys=true + ;; + NONSTOP* ) + nonstop=true + ;; +esac + +CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar + + +# Determine the Java command to use to start the JVM. +if [ -n "$JAVA_HOME" ] ; then + if [ -x "$JAVA_HOME/jre/sh/java" ] ; then + # IBM's JDK on AIX uses strange locations for the executables + JAVACMD="$JAVA_HOME/jre/sh/java" + else + JAVACMD="$JAVA_HOME/bin/java" + fi + if [ ! -x "$JAVACMD" ] ; then + die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME + +Please set the JAVA_HOME variable in your environment to match the +location of your Java installation." + fi +else + JAVACMD="java" + which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. + +Please set the JAVA_HOME variable in your environment to match the +location of your Java installation." +fi + +# Increase the maximum file descriptors if we can. +if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then + MAX_FD_LIMIT=`ulimit -H -n` + if [ $? -eq 0 ] ; then + if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then + MAX_FD="$MAX_FD_LIMIT" + fi + ulimit -n $MAX_FD + if [ $? -ne 0 ] ; then + warn "Could not set maximum file descriptor limit: $MAX_FD" + fi + else + warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT" + fi +fi + +# For Darwin, add options to specify how the application appears in the dock +if $darwin; then + GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\"" +fi + +# For Cygwin or MSYS, switch paths to Windows format before running java +if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then + APP_HOME=`cygpath --path --mixed "$APP_HOME"` + CLASSPATH=`cygpath --path --mixed "$CLASSPATH"` + + JAVACMD=`cygpath --unix "$JAVACMD"` + + # We build the pattern for arguments to be converted via cygpath + ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null` + SEP="" + for dir in $ROOTDIRSRAW ; do + ROOTDIRS="$ROOTDIRS$SEP$dir" + SEP="|" + done + OURCYGPATTERN="(^($ROOTDIRS))" + # Add a user-defined pattern to the cygpath arguments + if [ "$GRADLE_CYGPATTERN" != "" ] ; then + OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)" + fi + # Now convert the arguments - kludge to limit ourselves to /bin/sh + i=0 + for arg in "$@" ; do + CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -` + CHECK2=`echo "$arg"|egrep -c "^-"` ### Determine if an option + + if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then ### Added a condition + eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"` + else + eval `echo args$i`="\"$arg\"" + fi + i=`expr $i + 1` + done + case $i in + 0) set -- ;; + 1) set -- "$args0" ;; + 2) set -- "$args0" "$args1" ;; + 3) set -- "$args0" "$args1" "$args2" ;; + 4) set -- "$args0" "$args1" "$args2" "$args3" ;; + 5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;; + 6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;; + 7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;; + 8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;; + 9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;; + esac +fi + +# Escape application args +save () { + for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done + echo " " +} +APP_ARGS=`save "$@"` + +# Collect all arguments for the java command, following the shell quoting and substitution rules +eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS" + +exec "$JAVACMD" "$@" diff --git a/gradlew.bat b/gradlew.bat new file mode 100644 index 0000000..ac1b06f --- /dev/null +++ b/gradlew.bat @@ -0,0 +1,89 @@ +@rem +@rem Copyright 2015 the original author or authors. +@rem +@rem Licensed under the Apache License, Version 2.0 (the "License"); +@rem you may not use this file except in compliance with the License. +@rem You may obtain a copy of the License at +@rem +@rem https://www.apache.org/licenses/LICENSE-2.0 +@rem +@rem Unless required by applicable law or agreed to in writing, software +@rem distributed under the License is distributed on an "AS IS" BASIS, +@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +@rem See the License for the specific language governing permissions and +@rem limitations under the License. +@rem + +@if "%DEBUG%" == "" @echo off +@rem ########################################################################## +@rem +@rem Gradle startup script for Windows +@rem +@rem ########################################################################## + +@rem Set local scope for the variables with windows NT shell +if "%OS%"=="Windows_NT" setlocal + +set DIRNAME=%~dp0 +if "%DIRNAME%" == "" set DIRNAME=. +set APP_BASE_NAME=%~n0 +set APP_HOME=%DIRNAME% + +@rem Resolve any "." and ".." in APP_HOME to make it shorter. +for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi + +@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. +set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m" + +@rem Find java.exe +if defined JAVA_HOME goto findJavaFromJavaHome + +set JAVA_EXE=java.exe +%JAVA_EXE% -version >NUL 2>&1 +if "%ERRORLEVEL%" == "0" goto execute + +echo. +echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. +echo. +echo Please set the JAVA_HOME variable in your environment to match the +echo location of your Java installation. + +goto fail + +:findJavaFromJavaHome +set JAVA_HOME=%JAVA_HOME:"=% +set JAVA_EXE=%JAVA_HOME%/bin/java.exe + +if exist "%JAVA_EXE%" goto execute + +echo. +echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% +echo. +echo Please set the JAVA_HOME variable in your environment to match the +echo location of your Java installation. + +goto fail + +:execute +@rem Setup the command line + +set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar + + +@rem Execute Gradle +"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %* + +:end +@rem End local scope for the variables with windows NT shell +if "%ERRORLEVEL%"=="0" goto mainEnd + +:fail +rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of +rem the _cmd.exe /c_ return code! +if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1 +exit /b 1 + +:mainEnd +if "%OS%"=="Windows_NT" endlocal + +:omega