Run Forseti in Docker on Kubernetes or Container-Optimized OS (Proof of Concept) #2335

angelsungoogle · 2018-12-03T05:13:50Z

Many thanks to @Red-Five for pulling up these changes and fixes! Please feel free to contribute.

@andreyk-code is Kubernetes subject matter expert and will the peer reviewer for @Red-Five work here.

Thanks for opening a Pull Request!

Here's a handy checklist to ensure your PR goes smoothly.

I signed Google's Contributor License Agreement
My code conforms to Google's python style.
My PR at a minimum doesn't decrease unit-test coverage (if applicable).
My PR has been functionally tested.
All of the unit-tests still pass.
Running pylint --rcfile=pylintrc passes.

These guidelines and more can be found in our contributing guidelines.

googlebot · 2018-12-03T05:13:56Z

So there's good news and bad news.

👍 The good news is that everyone that needs to sign a CLA (the pull request submitter and all commit authors) have done so. Everything is all good there.

😕 The bad news is that it appears that one or more commits were authored or co-authored by someone other than the pull request submitter. We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that here in the pull request.

Note to project maintainer: This is a terminal state, meaning the cla/google commit status will not change from this state. It's up to you to confirm consent of all the commit author(s), set the cla label to yes (if enabled on your project), and then merge this pull request when appropriate.

blueandgold · 2018-12-03T06:13:01Z

@angelsungoogle Can you please make sure that you have sign the CLA and that you have configured your github env to use the correct email? I will follow-up with you offline about this, in more detail.

Red-Five · 2018-12-03T14:30:06Z

😕 The bad news is that it appears that one or more commits were authored or co-authored by someone other than the pull request submitter. We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that here in the pull request.

Confirming that I would like my initial changes merged into the docker-poc branch.

Kubernetes (GKE) files will be added shortly.

googlebot · 2018-12-03T16:34:28Z

A Googler has manually verified that the CLAs look good.

(Googler, please make sure the reason for overriding the CLA status is clearly documented in these comments.)

Red-Five · 2018-12-03T17:35:22Z

@angelsungoogle This pull request is to dev. I thought we were going to keep a separate docker-poc branch for now? I'm OK either way, however you think best.

angelsungoogle · 2018-12-03T17:58:23Z

@Red-Five we do have a separate branch docker-poc, which is the branch this PR is based on. For collaboration, people could continue to push to the docker-poc branch. I'm just keeping a PR here, so that docker related issues could refer to this PR for changes, and we have a summary view of what's changed compared to dev, since eventually our goal is to merge this in when we are ready

angelsungoogle · 2018-12-03T17:59:07Z

the docker poc branch

Red-Five · 2018-12-03T20:41:49Z

* Add Docker entrypoint script to start Forseti Server in a container * Merge all docker related changes to this branch. * Fix entrypoint filename * Add.dockerignore * Update docker_entrpoint.sh comments and forseti dockerfile comments. * Update docker_entrpoint.sh Add new line at end of file. * Update docker_entrypoint.sh Add gsutil -DD debug flag * Update docker_entrypoint.sh Set forseti server log level to debug * Update docker_entrypoint.sh Remove & from forseti server command. Don't run it as background task. * Add poc k8s_setup_forseti.sh and forseti.template.yaml * Update comment in k8s_setup_forseti.sh * Update k8s_setup_forseti.sh * Add cos_setup_forseti.sh for proof of concept * Updated k8s_setup_forseti.sh, added newline at end of file * Update docker_entrypoint.sh Modified comments * Update .dockerignore. Added .git and .dockerignore entries. * Update to enable CronJob on k8s * Fix last line in k8s_setup_forseti.sh * wait 60s after starting server before running rest of job * Wait 60s after starting service to allow for it to fully start * Update forseti.template.yaml * docker_entrypoint.sh Wait 10s after servers start forseti.template.yaml Cloud SQL v1.13, never allow concurrent cronjob * Cloud SQL latest tag. Remove debugging. * Fix cloud sql connection string * Run forseti server as a background task * Temporarily add set -x for debugging * Modify forseti notifier run call * Refactor Cloud SQL Proxy to run as k8s service instead of a sidecar * Refactor Cloud SQL Proxy as k8s service instead of sidecar * Update comment * Use k8s env vars for Cloud SQL * Fix Cloud SQL connection string for Service

codecov · 2018-12-14T15:24:12Z

Codecov Report

Merging #2335 into dev will increase coverage by 0.11%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##              dev    #2335      +/-   ##
==========================================
+ Coverage   88.55%   88.67%   +0.11%     
==========================================
  Files         180      180              
  Lines       14073    13991      -82     
==========================================
- Hits        12463    12406      -57     
+ Misses       1610     1585      -25

Impacted Files	Coverage Δ
...d/forseti/scanner/scanners/enabled_apis_scanner.py	`84.61% <0%> (-4.97%)`	⬇️
google/cloud/forseti/scanner/scanner_builder.py	`86.95% <0%> (-2.33%)`	⬇️
...loud/forseti/scanner/scanners/iam_rules_scanner.py	`77.89% <0%> (-2.33%)`	⬇️
.../cloud/forseti/services/model/importer/importer.py	`91.35% <0%> (-0.31%)`	⬇️
google/cloud/forseti/scanner/scanner.py	`90.56% <0%> (-0.18%)`	⬇️
...canner/scanners/external_project_access_scanner.py	`86.59% <0%> (-0.14%)`	⬇️
google/cloud/forseti/services/cli.py	`85.4% <0%> (-0.12%)`	⬇️
google/cloud/forseti/services/client.py	`77.72% <0%> (ø)`	⬆️
...cloud/forseti/services/inventory/base/resources.py	`85.93% <0%> (+0.19%)`	⬆️
...oogle/cloud/forseti/services/inventory/base/gcp.py	`96.7% <0%> (+0.22%)`	⬆️
... and 7 more

codecov · 2018-12-14T15:24:12Z

Codecov Report

Merging #2335 into dev will decrease coverage by 0.11%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##              dev    #2335      +/-   ##
==========================================
- Coverage   88.55%   88.44%   -0.12%     
==========================================
  Files         180      194      +14     
  Lines       14073    14640     +567     
==========================================
+ Hits        12463    12949     +486     
- Misses       1610     1691      +81

Impacted Files	Coverage Δ
...d/forseti/scanner/scanners/enabled_apis_scanner.py	`84.61% <0%> (-4.97%)`	⬇️
google/cloud/forseti/scanner/scanner_builder.py	`86.95% <0%> (-2.33%)`	⬇️
...loud/forseti/scanner/scanners/iam_rules_scanner.py	`77.89% <0%> (-2.33%)`	⬇️
.../cloud/forseti/services/model/importer/importer.py	`91.35% <0%> (-0.31%)`	⬇️
google/cloud/forseti/scanner/scanner.py	`90.56% <0%> (-0.18%)`	⬇️
...canner/scanners/external_project_access_scanner.py	`86.59% <0%> (-0.14%)`	⬇️
google/cloud/forseti/services/cli.py	`85.4% <0%> (-0.12%)`	⬇️
google/cloud/forseti/services/client.py	`77.72% <0%> (ø)`	⬆️
...cloud/forseti/services/server_config/server_pb2.py	`100% <0%> (ø)`
...ogle/cloud/forseti/services/explain/explain_pb2.py	`100% <0%> (ø)`
... and 21 more

googlebot · 2018-12-14T15:24:19Z

So there's good news and bad news.

👍 The good news is that everyone that needs to sign a CLA (the pull request submitter and all commit authors) have done so. Everything is all good there.

😕 The bad news is that it appears that one or more commits were authored or co-authored by someone other than the pull request submitter. We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that here in the pull request.

Note to project maintainer: This is a terminal state, meaning the cla/google commit status will not change from this state. It's up to you to confirm consent of all the commit author(s), set the cla label to yes (if enabled on your project), and then merge this pull request when appropriate.

googlebot · 2018-12-21T18:42:35Z

A Googler has manually verified that the CLAs look good.

(Googler, please make sure the reason for overriding the CLA status is clearly documented in these comments.)

Red-Five · 2018-12-21T22:14:47Z

The next steps will likely be to make a forseti.service.template.yaml following the GKE Service Tutorial, and add something like a if statement here

Very rough draft, not ready yet: #2440

angelsungoogle · 2018-12-21T22:22:01Z

Thanks Duncan!
@blueandgold our favorite client has just done the work for us, right before Christmas XD

Red-Five · 2019-01-10T23:33:31Z

This might be worth looking into. https://cloud.google.com/knative/

angelsungoogle · 2019-01-14T16:21:27Z

@blueandgold

* Add Docker entrypoint script to start Forseti Server in a container * Merge all docker related changes to this branch. * Fix entrypoint filename * Add.dockerignore * Update docker_entrpoint.sh comments and forseti dockerfile comments. * Update docker_entrpoint.sh Add new line at end of file. * Update docker_entrypoint.sh Add gsutil -DD debug flag * Update docker_entrypoint.sh Set forseti server log level to debug * Update docker_entrypoint.sh Remove & from forseti server command. Don't run it as background task. * Add poc k8s_setup_forseti.sh and forseti.template.yaml * Update comment in k8s_setup_forseti.sh * Update k8s_setup_forseti.sh * Add cos_setup_forseti.sh for proof of concept * Updated k8s_setup_forseti.sh, added newline at end of file * Update docker_entrypoint.sh Modified comments * Update .dockerignore. Added .git and .dockerignore entries. * Update to enable CronJob on k8s * Fix last line in k8s_setup_forseti.sh * wait 60s after starting server before running rest of job * Wait 60s after starting service to allow for it to fully start * Update forseti.template.yaml * docker_entrypoint.sh Wait 10s after servers start forseti.template.yaml Cloud SQL v1.13, never allow concurrent cronjob * Cloud SQL latest tag. Remove debugging. * Fix cloud sql connection string * Run forseti server as a background task * Temporarily add set -x for debugging * Modify forseti notifier run call * Refactor Cloud SQL Proxy to run as k8s service instead of a sidecar * Refactor Cloud SQL Proxy as k8s service instead of sidecar * Update comment * Use k8s env vars for Cloud SQL * Fix Cloud SQL connection string for Service * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh Refactor forseti.template.yaml * Refactor forseti.template.yaml * Refactor forseti.template.yaml * Refactor forseti.template.yaml * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * cloudbuild.yaml cache base image to speed up builds * cloudbuild.yaml cache base image to speed up builds * k8s-setup-forseti.sh use latest stackdriver k8s support Change disk size docker_entrypoint.sh fix scanner command * cloudbuild.yaml cache base image * Rename forseti.template.yaml to forseti.cronjob.template.yaml * Comment change * docker_entrypoint.sh default cloud sql host and port to localhost 3306 * cos_setup_forseti.sh add --bucket * cos_setup_forseti.sh comments * docker_entrypoint.sh comment change * k8s_setup_forseti.sh comment changes * Update docker_entrypoint.sh default RUN_CRONJOB=false * Run forseti as a k8s Cluster IP Service * Update usage comments. Remove start_client, its not needed Renamed download_configuration_files to download_server_configuration_files Added download_client_configuration_files placeholder Modified main accordingly * Update usage comments. * Turn off running server as default, set RUN_SERVER=FALSE * Refactor variables. * Rename forset.server.template.yaml to forseti.server.template.yaml * k8s_setup_forseti.sh exit on error, print commands, fix if statements. * k8s_setup_forseti.sh changed comment * docker_entrypoint.sh modify if statements in main * cloudbuild.yaml comment out optional unit tests step * docker_entrpoint.sh run long lived server as foreground process, short lived cronjob as background process * docker_entrpoint.sh run long lived server as foreground process, short lived cronjob as background process * docker_entrpoint.sh run long lived server as foreground process, short lived cronjob as background process * Added client_cli_setup() placeholder * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable server console log. * Revert * Revert "Temporarily enable StackDriver debugger. Do merge into upstream." This reverts commit b5ea186 * Revert "Temporarily enable StackDriver debugger. Do merge into upstream." This reverts commit 2fc42ae * Revert "Temporarily enable StackDriver debugger. Do merge into upstream." This reverts commit 385f8f2 * Revert "Temporarily enable StackDriver debugger. Do merge into upstream." This reverts commit eda058f * Temporary inventory service logging * Temporary inventory service logging

codecov · 2019-02-04T20:15:20Z

Codecov Report

Merging #2335 into dev will decrease coverage by 0.2%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##              dev    #2335      +/-   ##
==========================================
- Coverage   88.62%   88.41%   -0.21%     
==========================================
  Files         189      203      +14     
  Lines       14953    15602     +649     
==========================================
+ Hits        13252    13795     +543     
- Misses       1701     1807     +106

Impacted Files	Coverage Δ
...cloud/forseti/services/server_config/server_pb2.py	`100% <0%> (ø)`
...ogle/cloud/forseti/services/explain/explain_pb2.py	`100% <0%> (ø)`
google/cloud/forseti/enforcer/enforcer_log_pb2.py	`100% <0%> (ø)`
.../forseti/services/server_config/server_pb2_grpc.py	`47.05% <0%> (ø)`
...ogle/cloud/forseti/services/scanner/scanner_pb2.py	`100% <0%> (ø)`
google/cloud/forseti/services/model/model_pb2.py	`100% <0%> (ø)`
...cloud/forseti/services/scanner/scanner_pb2_grpc.py	`52.63% <0%> (ø)`
...d/forseti/services/inventory/inventory_pb2_grpc.py	`53.84% <0%> (ø)`
...le/cloud/forseti/services/notifier/notifier_pb2.py	`100% <0%> (ø)`
...le/cloud/forseti/enforcer/enforcer_log_pb2_grpc.py	`0% <0%> (ø)`
... and 4 more

googlebot · 2019-02-04T20:15:27Z

So there's good news and bad news.

👍 The good news is that everyone that needs to sign a CLA (the pull request submitter and all commit authors) have done so. Everything is all good there.

😕 The bad news is that it appears that one or more commits were authored or co-authored by someone other than the pull request submitter. We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that here in the pull request.

Note to project maintainer: This is a terminal state, meaning the cla/google commit status will not change from this state. It's up to you to confirm consent of all the commit author(s), set the cla label to yes (if enabled on your project), and then merge this pull request when appropriate.

* Add Docker entrypoint script to start Forseti Server in a container * Merge all docker related changes to this branch. * Fix entrypoint filename * Add.dockerignore * Update docker_entrpoint.sh comments and forseti dockerfile comments. * Update docker_entrpoint.sh Add new line at end of file. * Update docker_entrypoint.sh Add gsutil -DD debug flag * Update docker_entrypoint.sh Set forseti server log level to debug * Update docker_entrypoint.sh Remove & from forseti server command. Don't run it as background task. * Add poc k8s_setup_forseti.sh and forseti.template.yaml * Update comment in k8s_setup_forseti.sh * Update k8s_setup_forseti.sh * Add cos_setup_forseti.sh for proof of concept * Updated k8s_setup_forseti.sh, added newline at end of file * Update docker_entrypoint.sh Modified comments * Update .dockerignore. Added .git and .dockerignore entries. * Update to enable CronJob on k8s * Fix last line in k8s_setup_forseti.sh * wait 60s after starting server before running rest of job * Wait 60s after starting service to allow for it to fully start * Update forseti.template.yaml * docker_entrypoint.sh Wait 10s after servers start forseti.template.yaml Cloud SQL v1.13, never allow concurrent cronjob * Cloud SQL latest tag. Remove debugging. * Fix cloud sql connection string * Run forseti server as a background task * Temporarily add set -x for debugging * Modify forseti notifier run call * Refactor Cloud SQL Proxy to run as k8s service instead of a sidecar * Refactor Cloud SQL Proxy as k8s service instead of sidecar * Update comment * Use k8s env vars for Cloud SQL * Fix Cloud SQL connection string for Service * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh Refactor forseti.template.yaml * Refactor forseti.template.yaml * Refactor forseti.template.yaml * Refactor forseti.template.yaml * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * cloudbuild.yaml cache base image to speed up builds * cloudbuild.yaml cache base image to speed up builds * k8s-setup-forseti.sh use latest stackdriver k8s support Change disk size docker_entrypoint.sh fix scanner command * cloudbuild.yaml cache base image * Rename forseti.template.yaml to forseti.cronjob.template.yaml * Comment change * docker_entrypoint.sh default cloud sql host and port to localhost 3306 * cos_setup_forseti.sh add --bucket * cos_setup_forseti.sh comments * docker_entrypoint.sh comment change * k8s_setup_forseti.sh comment changes * Update docker_entrypoint.sh default RUN_CRONJOB=false * Run forseti as a k8s Cluster IP Service * Update usage comments. Remove start_client, its not needed Renamed download_configuration_files to download_server_configuration_files Added download_client_configuration_files placeholder Modified main accordingly * Update usage comments. * Turn off running server as default, set RUN_SERVER=FALSE * Refactor variables. * Rename forset.server.template.yaml to forseti.server.template.yaml * k8s_setup_forseti.sh exit on error, print commands, fix if statements. * k8s_setup_forseti.sh changed comment * docker_entrypoint.sh modify if statements in main * cloudbuild.yaml comment out optional unit tests step * docker_entrpoint.sh run long lived server as foreground process, short lived cronjob as background process * docker_entrpoint.sh run long lived server as foreground process, short lived cronjob as background process * docker_entrpoint.sh run long lived server as foreground process, short lived cronjob as background process * Added client_cli_setup() placeholder * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable server console log. * Revert * Revert "Temporarily enable StackDriver debugger. Do merge into upstream." This reverts commit b5ea186 * Revert "Temporarily enable StackDriver debugger. Do merge into upstream." This reverts commit 2fc42ae * Revert "Temporarily enable StackDriver debugger. Do merge into upstream." This reverts commit 385f8f2 * Revert "Temporarily enable StackDriver debugger. Do merge into upstream." This reverts commit eda058f * Temporary inventory service logging * Temporary inventory service logging * enable server console log * Cloud build cache step updates. * grpc issue investigation * Code style fix * Remove temporary logging code

Red-Five · 2019-02-27T02:31:54Z

Pending merge of PR #2590

* Add Docker entrypoint script to start Forseti Server in a container * Merge all docker related changes to this branch. * Fix entrypoint filename * Add.dockerignore * Update docker_entrpoint.sh comments and forseti dockerfile comments. * Update docker_entrpoint.sh Add new line at end of file. * Update docker_entrypoint.sh Add gsutil -DD debug flag * Update docker_entrypoint.sh Set forseti server log level to debug * Update docker_entrypoint.sh Remove & from forseti server command. Don't run it as background task. * Add poc k8s_setup_forseti.sh and forseti.template.yaml * Update comment in k8s_setup_forseti.sh * Update k8s_setup_forseti.sh * Add cos_setup_forseti.sh for proof of concept * Updated k8s_setup_forseti.sh, added newline at end of file * Update docker_entrypoint.sh Modified comments * Update .dockerignore. Added .git and .dockerignore entries. * Update to enable CronJob on k8s * Fix last line in k8s_setup_forseti.sh * wait 60s after starting server before running rest of job * Wait 60s after starting service to allow for it to fully start * Update forseti.template.yaml * docker_entrypoint.sh Wait 10s after servers start forseti.template.yaml Cloud SQL v1.13, never allow concurrent cronjob * Cloud SQL latest tag. Remove debugging. * Fix cloud sql connection string * Run forseti server as a background task * Temporarily add set -x for debugging * Modify forseti notifier run call * Refactor Cloud SQL Proxy to run as k8s service instead of a sidecar * Refactor Cloud SQL Proxy as k8s service instead of sidecar * Update comment * Use k8s env vars for Cloud SQL * Fix Cloud SQL connection string for Service * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh Refactor forseti.template.yaml * Refactor forseti.template.yaml * Refactor forseti.template.yaml * Refactor forseti.template.yaml * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * Refactor docker_entrypoint.sh * cloudbuild.yaml cache base image to speed up builds * cloudbuild.yaml cache base image to speed up builds * k8s-setup-forseti.sh use latest stackdriver k8s support Change disk size docker_entrypoint.sh fix scanner command * cloudbuild.yaml cache base image * Rename forseti.template.yaml to forseti.cronjob.template.yaml * Comment change * docker_entrypoint.sh default cloud sql host and port to localhost 3306 * cos_setup_forseti.sh add --bucket * cos_setup_forseti.sh comments * docker_entrypoint.sh comment change * k8s_setup_forseti.sh comment changes * Update docker_entrypoint.sh default RUN_CRONJOB=false * Run forseti as a k8s Cluster IP Service * Update usage comments. Remove start_client, its not needed Renamed download_configuration_files to download_server_configuration_files Added download_client_configuration_files placeholder Modified main accordingly * Update usage comments. * Turn off running server as default, set RUN_SERVER=FALSE * Refactor variables. * Rename forset.server.template.yaml to forseti.server.template.yaml * k8s_setup_forseti.sh exit on error, print commands, fix if statements. * k8s_setup_forseti.sh changed comment * docker_entrypoint.sh modify if statements in main * cloudbuild.yaml comment out optional unit tests step * docker_entrpoint.sh run long lived server as foreground process, short lived cronjob as background process * docker_entrpoint.sh run long lived server as foreground process, short lived cronjob as background process * docker_entrpoint.sh run long lived server as foreground process, short lived cronjob as background process * Added client_cli_setup() placeholder * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Client CLI container code * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable StackDriver debugger. Do merge into upstream. * Temporarily enable server console log. * Revert * Revert "Temporarily enable StackDriver debugger. Do merge into upstream." This reverts commit b5ea186 * Revert "Temporarily enable StackDriver debugger. Do merge into upstream." This reverts commit 2fc42ae * Revert "Temporarily enable StackDriver debugger. Do merge into upstream." This reverts commit 385f8f2 * Revert "Temporarily enable StackDriver debugger. Do merge into upstream." This reverts commit eda058f * Temporary inventory service logging * Temporary inventory service logging * enable server console log * Cloud build cache step updates. * grpc issue investigation * Code style fix * Remove temporary logging code * Update forseti.cronjob.template.yaml Change secretName * Update cloudbuild.yaml Comment out base image cache step. * Set allowPrivilegeEscalation: false * Update k8s_setup_forseti.sh Minor comment and formatting changes * Update apt_packages.txt Add cron to support running cronjobs in Docker container. * Update forset.cronjob.template.yaml Remove explain from list of services as its not used in k8s cronjobs * Changes to support both k8s and docker versions of cronjob * Update docker_entrypoint.sh Create env file needed for run_forseti.sh Call run_forseti.sh to execute the cronjob code * Update cloudbuild.yaml comment out additional cache lines * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update forseti.server.template.yaml Fix cmd args. * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update docker_entrypoint.sh Continuation: Code for creating server env file * Update docker_entrypoint.sh Continuation: Code for creating server env file * Rename client key file * Add disk type option * Try a workaround for the env setup issue. * Added flag to optionally create cluster * Run server as background process if running as k8s CronJob or Docker based cron process is running in the same container * Docker cronjob support * Docker cronjob support * Docker cronjob support * Docker cronjob support * Docker cronjob support * Docker cronjob support * Docker cronjob support * Docker cronjob support * Cache base image * Cache base image * Cache base image * allowPrivilegeEscalation: false in all k8s deployment templates * Source client env script in .bashrc

blueandgold

Thank you so much for pulling all these together! Please ack the CLA one more time.

Red-Five

I have signed CLA and agree to all these changes going into dev branch.

Red-Five · 2019-02-24T17:41:45Z

install/docker/base

-# Install the CloudSDK for `gcloud`.
-RUN curl -sSL https://sdk.cloud.google.com 1> /dev/null | bash
+# Install Google Cloud SDK
+RUN curl -sSL https://sdk.cloud.google.com | bash


How to install Google Cloud SDK so that it doesn't require root to use it?

Run chmod or chown?

… (Proof of Concept) (#2335)" This reverts commit 3215ce7.

… (Proof of Concept) (#2335)" (#2610) This reverts commit 3215ce7.

blueandgold · 2019-12-03T05:26:45Z

Adding cla: yes label, as all commit authors have contributed to this project.

Red-Five added 4 commits December 2, 2018 21:01

Merge all docker related changes to this branch.

c2f3022

Fix entrypoint filename

41cee94

Add.dockerignore

107b3f6

Update docker_entrpoint.sh comments and forseti dockerfile comments.

0d2d6ec

forseti-security-waffle-bot added the status: in-progress label Dec 3, 2018

googlebot added the cla: no label Dec 3, 2018

angelsungoogle self-assigned this Dec 3, 2018

angelsungoogle added 2 commits December 2, 2018 21:43

adding back the missing entrypoint...

e0cf107

removing the &

2800e62

angelsungoogle added cla: yes and removed cla: no labels Dec 3, 2018

This was referenced Dec 3, 2018

Add a Forseti Server Docker ENTRYPOINT Script #2285

Closed

base dockerfile Google Cloud SDK installation bug #2284

Closed

cloudbuild.yaml Add a Unit Test Build Step #2228

Closed

cloudbuild.yaml Fix File Paths #2227

Closed

googlebot added cla: no and removed cla: yes labels Dec 14, 2018

angelsungoogle added the cla: yes label Dec 14, 2018

googlebot added cla: no and removed cla: yes labels Feb 4, 2019

blueandgold and others added 2 commits February 4, 2019 12:23

Update cloudbuild.yaml

3fecda1

This was referenced Feb 20, 2019

Add docs for deploying Forseti on Kubernetes #2582

Merged

Support for Kubernetes #1470

Closed

Red-Five and others added 2 commits February 27, 2019 13:02

Merge branch 'dev' into docker-poc

b9fe858

blueandgold approved these changes Feb 27, 2019

View reviewed changes

Red-Five approved these changes Feb 27, 2019

View reviewed changes

blueandgold changed the title ~~Docker Proof of Concept (Collaboration Welcomed!)~~ Run Forseti in Docker on Kubernetes or Container-Optimized OS (Proof of Concept) Feb 27, 2019

Add licenses

e1aeb3d

blueandgold merged commit 3215ce7 into dev Feb 28, 2019

forseti-security-waffle-bot removed the status: in-progress label Feb 28, 2019

blueandgold added a commit that referenced this pull request Mar 1, 2019

Revert "Run Forseti in Docker on Kubernetes or Container-Optimized OS…

884666d

… (Proof of Concept) (#2335)" This reverts commit 3215ce7.

blueandgold mentioned this pull request Mar 1, 2019

Revert "Run Forseti in Docker on Kubernetes or Container-Optimized OS (Proof of Concept)" #2610

Merged

blueandgold added a commit that referenced this pull request Mar 1, 2019

Revert "Run Forseti in Docker on Kubernetes or Container-Optimized OS…

9d38683

… (Proof of Concept) (#2335)" (#2610) This reverts commit 3215ce7.

blueandgold deleted the docker-poc branch August 2, 2019 17:21

blueandgold added cla: yes and removed cla: no labels Dec 3, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Run Forseti in Docker on Kubernetes or Container-Optimized OS (Proof of Concept) #2335

Run Forseti in Docker on Kubernetes or Container-Optimized OS (Proof of Concept) #2335

angelsungoogle commented Dec 3, 2018 •

edited by blueandgold

Loading

googlebot commented Dec 3, 2018

blueandgold commented Dec 3, 2018

Red-Five commented Dec 3, 2018 •

edited

Loading

googlebot commented Dec 3, 2018

Red-Five commented Dec 3, 2018

angelsungoogle commented Dec 3, 2018 •

edited

Loading

angelsungoogle commented Dec 3, 2018

Red-Five commented Dec 3, 2018 •

edited

Loading

codecov bot commented Dec 14, 2018

codecov bot commented Dec 14, 2018 •

edited

Loading

googlebot commented Dec 14, 2018

googlebot commented Dec 21, 2018

Red-Five commented Dec 21, 2018 •

edited

Loading

angelsungoogle commented Dec 21, 2018

Red-Five commented Jan 10, 2019 •

edited

Loading

angelsungoogle commented Jan 14, 2019

codecov bot commented Feb 4, 2019 •

edited

Loading

googlebot commented Feb 4, 2019

Red-Five commented Feb 27, 2019 •

edited

Loading

blueandgold left a comment

Red-Five left a comment •

edited

Loading

Red-Five Feb 24, 2019

blueandgold Feb 28, 2019

blueandgold commented Dec 3, 2019

Run Forseti in Docker on Kubernetes or Container-Optimized OS (Proof of Concept) #2335

Run Forseti in Docker on Kubernetes or Container-Optimized OS (Proof of Concept) #2335

Conversation

angelsungoogle commented Dec 3, 2018 • edited by blueandgold Loading

googlebot commented Dec 3, 2018

blueandgold commented Dec 3, 2018

Red-Five commented Dec 3, 2018 • edited Loading

googlebot commented Dec 3, 2018

Red-Five commented Dec 3, 2018

angelsungoogle commented Dec 3, 2018 • edited Loading

angelsungoogle commented Dec 3, 2018

Red-Five commented Dec 3, 2018 • edited Loading

codecov bot commented Dec 14, 2018

Codecov Report

codecov bot commented Dec 14, 2018 • edited Loading

Codecov Report

googlebot commented Dec 14, 2018

googlebot commented Dec 21, 2018

Red-Five commented Dec 21, 2018 • edited Loading

angelsungoogle commented Dec 21, 2018

Red-Five commented Jan 10, 2019 • edited Loading

angelsungoogle commented Jan 14, 2019

codecov bot commented Feb 4, 2019 • edited Loading

Codecov Report

googlebot commented Feb 4, 2019

Red-Five commented Feb 27, 2019 • edited Loading

blueandgold left a comment

Choose a reason for hiding this comment

Red-Five left a comment • edited Loading

Choose a reason for hiding this comment

Red-Five Feb 24, 2019

Choose a reason for hiding this comment

blueandgold Feb 28, 2019

Choose a reason for hiding this comment

blueandgold commented Dec 3, 2019

angelsungoogle commented Dec 3, 2018 •

edited by blueandgold

Loading

Red-Five commented Dec 3, 2018 •

edited

Loading

angelsungoogle commented Dec 3, 2018 •

edited

Loading

Red-Five commented Dec 3, 2018 •

edited

Loading

codecov bot commented Dec 14, 2018 •

edited

Loading

Red-Five commented Dec 21, 2018 •

edited

Loading

Red-Five commented Jan 10, 2019 •

edited

Loading

codecov bot commented Feb 4, 2019 •

edited

Loading

Red-Five commented Feb 27, 2019 •

edited

Loading

Red-Five left a comment •

edited

Loading