update grpc-proxy. Partial deephaven#516. (deephaven#595)

.github/workflows/build-ci.yml

@@ -103,6 +103,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v2
 
+      - name: Setup JDK
+        id: setup-java
+        uses: actions/setup-java@v1
+        with:
+          java-version: '8.0.292'
+
       - name: Docker meta
         id: docker_meta
         uses: crazy-max/ghaction-docker-meta@v1
@@ -111,9 +117,6 @@ jobs:
           tag-semver: |
             {{version}}
             {{major}}.{{minor}}
-          label-custom: |
-            org.opencontainers.image.title=deephaven/grpc-proxy
-            org.opencontainers.image.description=Deephaven grpc-proxy
 
       - name: Set up Docker Buildx
         id: buildx
@@ -129,13 +132,26 @@ jobs:
           username: ${{ secrets.GHCR_USER }}
           password: ${{ secrets.GHCR_PAT }}
 
+      - name: Setup gradle properties
+        run: |
+          mkdir -p $HOME/.gradle
+          cp .github/env/${{ runner.os }}/gradle.properties $HOME/.gradle/gradle.properties
+          echo "org.gradle.java.installations.paths=${{ steps.setup-java.outputs.path }}" >> $HOME/.gradle/gradle.properties
+
+      - name: Create Dockerfile and context
+        uses: burrunan/gradle-cache-action@v1
+        with:
+          job-id: build-grpc-proxy
+          arguments: --scan grpc-proxy:prepareDocker
+          gradle-version: wrapper
+
       - name: Docker build
         uses: docker/build-push-action@v2
         with:
           tags: ${{ steps.docker_meta.outputs.tags }}
           labels: ${{ steps.docker_meta.outputs.labels }}
           builder: ${{ steps.buildx.outputs.name }}
-          context: ./grpc-proxy/
+          context: ./grpc-proxy/build/docker/
           push: ${{ github.event_name != 'pull_request' }}
 
   envoy:

build.gradle

@@ -399,7 +399,8 @@ tasks.register('prepareCompose') {
     it.description 'A lifecycle task that prepares prequisites for local docker-compose builds'
     it.dependsOn project(':grpc-api-server-docker').tasks.findByName('dockerBuildImage'),
             project(':web-client-ide').tasks.findByName('buildDocker'),
-            project(':envoy').tasks.findByName('buildDocker')
+            project(':envoy').tasks.findByName('buildDocker'),
+            project(':grpc-proxy').tasks.findByName('buildDocker')
 }
 
 tasks.register('smoke') {

docker-compose.yml

@@ -1,15 +1,13 @@
-# Simple draft docker-compose that works with the existing enterprise codebase
-# to demonstrate how this could eventually look in OSS. Note that as of this
-# commit, the JS doesn't actually work, so we while we can't connect, you can
-# still make demo calls to see if they function.
+# This is a development-oriented local docker compose file, meant to link together the components of
+# the Deephaven Community Core.
 #
-# The purpose of this file is to showcase how localhost deployments probably
-# will work in lieu of the user installing a self-signed cert into their
-# browser - a websocket will be used in place of each http/2 stream, with a
-# proxy to provide this (one needed per worker) and an envoy instance to
-# reverse proxy to both a simple http server and the websocket proxy. There
-# is probably no need to use envoy here (nginx could suffice), but there are
-# probably benefits to always using envoy as our user-facing proxy.
+# There are some simplifying assumptions:
+#
+# 1. Docker is running locally and has access to filesystem bind mounts
+# 2. The images are being built via ./gradlew prepareCompose
+# 3. The user is running a non-production system, and does not want to deal with TLS
+#
+# Please see README.md with more details on how to get started.
 
 version: "3.8"
 
@@ -53,13 +51,9 @@ services:
           cpus: '1'
           memory: 256M
 
+  # Should only be used for non-production deployments, see grpc-proxy/README.md for more info
   grpc-proxy:
-    # The (alpha-quality, see https://github.com/improbable-eng/grpc-web#status)
-    # grpc -> grpc-web+websocket proxy from improbably-eng. No docker image is
-    # presently available for this, so we have our own Dockerfile - refer to it
-    # for how we have it configured.
-    build: grpc-proxy/
-    image: "${REPO}deephaven/grpc-proxy:${TAG}"
+    image: deephaven/grpc-proxy
     environment:
       - BACKEND_ADDR=grpc-api:8080
     depends_on:

grpc-proxy/Dockerfile

@@ -1,15 +1,24 @@
-# Simple dockerfile for the improbable-eng grpc to grpc-web/websocket proxy
+FROM docker.io/library/alpine:3.13
 
-# in theory we can use scratch, but we need the sh -c syntax to include envs vars, or hardcode the backend addr
-FROM alpine
+COPY contents/ .
 
-ADD https://github.com/improbable-eng/grpc-web/releases/download/v0.13.0/grpcwebproxy-v0.13.0-linux-x86_64.zip /grpcwebproxy.zip
+ENV GRPCWEBPROXY_VERSION=v0.13.0
+
+# Note(deephaven-core#599): Consider moving grpcwebproxy DL into gradle
 RUN set -eux; \
-    unzip /grpcwebproxy.zip; \
-    mv dist/grpcwebproxy* /grpcwebproxy
+    apk add --no-cache tini; \
+    wget -q "https://github.com/improbable-eng/grpc-web/releases/download/${GRPCWEBPROXY_VERSION}/grpcwebproxy-${GRPCWEBPROXY_VERSION}-linux-x86_64.zip"; \
+    sha256sum -c checksums.txt; \
+    unzip -d /app "grpcwebproxy-${GRPCWEBPROXY_VERSION}-linux-x86_64.zip"; \
+    rm "grpcwebproxy-${GRPCWEBPROXY_VERSION}-linux-x86_64.zip"; \
+    mv "/app/dist/grpcwebproxy-${GRPCWEBPROXY_VERSION}-linux-x86_64" /app/dist/grpcwebproxy
 
 EXPOSE 8080 8443
 
-ENV BACKEND_ADDR=""
+ENTRYPOINT ["/sbin/tini", "--", "/docker-entrypoint.sh"]
 
-ENTRYPOINT /grpcwebproxy --run_tls_server=false --backend_addr=$BACKEND_ADDR --backend_tls=false --allow_all_origins --use_websockets --backend_max_call_recv_msg_size=104857600
+LABEL org.opencontainers.image.vendor="Deephaven Data Labs" \
+  org.opencontainers.image.title="Deephaven gRPC web proxy" \
+  org.opencontainers.image.description="Deephaven gRPC web proxy, for the improbable-eng grpc to grpc-web/websocket proxy" \
+  org.opencontainers.image.source="https://github.com/deephaven/deephaven-core" \
+  org.opencontainers.image.licenses="Apache-2.0"

grpc-proxy/README.md

@@ -0,0 +1,18 @@
+# grpc-proxy
+
+grpc-proxy is a proxy that exposes a gRPC service via websockets, allowing for the gRPC service to
+be consumed from browsers.
+
+## Configuration
+
+The environment variable `BACKEND_ADDR` must be set to the gRPC service to be proxied.
+See [Dockerfile](Dockerfile) for more details.
+
+## Build
+
+To build: `./gradlew grpc-proxy:buildDocker`
+
+## Notes
+
+The implementation uses the [grpc-web](https://github.com/improbable-eng/grpc-web)
+grpc -> grpc-web+websocket proxy from improbably-eng. It is currently [alpha-quality](https://github.com/improbable-eng/grpc-web#status).

grpc-proxy/build.gradle

@@ -0,0 +1,19 @@
+import com.bmuschko.gradle.docker.tasks.image.DockerBuildImage
+
+plugins {
+  id 'com.bmuschko.docker-remote-api'
+}
+
+task prepareDocker(type: Sync) {
+  from 'Dockerfile'
+  from ('contents') {
+    into 'contents'
+  }
+  // TODO(deephaven-core#518): Add license and notice to docker images
+  into 'build/docker'
+}
+
+task buildDocker(type: DockerBuildImage) {
+  dependsOn prepareDocker
+  images.add('deephaven/grpc-proxy')
+}

grpc-proxy/contents/checksums.txt

@@ -0,0 +1 @@
+3a327a0625e818c5a7d0a62c4ffc7016a79d5c068ef72d18b6a144f3163ae663  grpcwebproxy-v0.13.0-linux-x86_64.zip

grpc-proxy/contents/docker-entrypoint.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env sh
+
+set -o nounset
+
+exec /app/dist/grpcwebproxy \
+  --run_tls_server=false \
+  --backend_addr="${BACKEND_ADDR}" \
+  --backend_tls=false \
+  --allow_all_origins \
+  --use_websockets \
+  --backend_max_call_recv_msg_size=104857600

settings.gradle

@@ -140,6 +140,8 @@ include(':ParquetHadoop')
 
 include(':envoy')
 
+include(':grpc-proxy')
+
 // Apply "vanity naming" (look for .gradle files matching ProjectName/ProjectName.gradle)
 File root = settings.rootDir
 mods.each {