diff --git a/deploy/packaging/caduceus_spruce.yaml b/.release/docker/caduceus_spruce.yaml similarity index 90% rename from deploy/packaging/caduceus_spruce.yaml rename to .release/docker/caduceus_spruce.yaml index 609a4026..3ce03058 100644 --- a/deploy/packaging/caduceus_spruce.yaml +++ b/.release/docker/caduceus_spruce.yaml @@ -121,6 +121,12 @@ metric: # (Optional) subsystem: "caduceus" +touchstone: + # DefaultNamespace is the prometheus namespace to apply when a metric has no namespace + defaultNamespace: "xmidt" + # DefaultSubsystem is the prometheus subsystem to apply when a metric has no subsystem + defaultSubsystem: "caduceus" + ######################################## # Service Discovery Configuration ######################################## @@ -212,6 +218,35 @@ log: # (Optional) defaults to false json: true +zap: + # OutputPaths is a list of URLs or file paths to write logging output to. + outputPaths: + - stdout + # - /var/log/caduceus/caduceus.log + + # Level is the minimum enabled logging level. Note that this is a dynamic + # level, so calling Config.Level.SetLevel will atomically change the log + # level of all loggers descended from this config. + level: debug + + # EncoderConfig sets options for the chosen encoder. See + # zapcore.EncoderConfig for details. + errorOutputPaths: + - stderr + # - /var/log/caduceus/caduceus.log + + # EncoderConfig sets options for the chosen encoder. See + # zapcore.EncoderConfig for details. + encoderConfig: + messageKey: message + levelKey: key + levelEncoder: lowercase + + # Encoding sets the logger's encoding. Valid values are "json" and + # "console", as well as any third-party encodings registered via + # RegisterEncoder. + encoding: json + ######################################## # Authorization Related Configuration ######################################## @@ -283,7 +318,9 @@ webhook: # Raw: parser assumes all of the token payload == JWT token # (Optional). Defaults to 'simple'. JWTParserType: (( grab $WEBHOOK_JWT_PARSER_TYPE || "raw" )) - argus: + BasicClientConfig: + # listen is the subsection that configures the listening feature of the argus client + # (Optional) listen: # pullInterval is how often to call argus to update the webhook structure. pullInterval: (( grab $ARGUS_PULL_INTERVAL || "5s" )) @@ -352,6 +389,13 @@ sender: # (Deprecated) # clientTimeout: 60s + # disableClientHostnameValidation provides a way to bypass TLS validation + # failures on HTTPS requests when sending events to webhooks. + # NOTE: Setting this to true allows for a potential man-in-the-middle + # scenario between caduceus and a webhook. + # (Optional) defaults to false + disableClientHostnameValidation: false + # deliveryRetries is the maximum number of delivery attempts caduceus will # make before dropping an event deliveryRetries: 1 @@ -363,7 +407,7 @@ sender: # responseHeaderTimeout is the time to wait for a response before giving up # and marking the delivery a failure responseHeaderTimeout: 10s - + # customPIDs is a custom list of allowed PartnerIDs that will be used if a message # has no partner IDs. When empty, a message with no partner IDs will not be sent # to any listeners when enforcing the partner ID check. @@ -415,4 +459,4 @@ argusClientTimeout: # the API at the same time from the same application. When this is true, # caduceus will support both "/v3" and "/v4" endpoints. When false, only "/v4" # endpoints will be supported. -previousVersionSupport: (( grab $PREV_VERSION_SUPPORT || true )) \ No newline at end of file +previousVersionSupport: (( grab $PREV_VERSION_SUPPORT || true )) diff --git a/.release/docker/entrypoint.sh b/.release/docker/entrypoint.sh new file mode 100755 index 00000000..3d34d4f3 --- /dev/null +++ b/.release/docker/entrypoint.sh @@ -0,0 +1,37 @@ +#!/usr/bin/env sh +set -e + +# check arguments for an option that would cause /caduceus to stop +# return true if there is one +_want_help() { + local arg + for arg; do + case "$arg" in + -'?'|--help|-v) + return 0 + ;; + esac + done + return 1 +} + +_main() { + # if command starts with an option, prepend caduceus + if [ "${1:0:1}" = '-' ]; then + set -- /caduceus "$@" + fi + + # skip setup if they aren't running /caduceus or want an option that stops /caduceus + if [ "$1" = '/caduceus' ] && ! _want_help "$@"; then + echo "Entrypoint script for caduceus Server ${VERSION} started." + + if [ ! -s /etc/caduceus/caduceus.yaml ]; then + echo "Building out template for file" + /bin/spruce merge /tmp/caduceus_spruce.yaml > /etc/caduceus/caduceus.yaml + fi + fi + + exec "$@" +} + +_main "$@" diff --git a/deploy/helm/caduceus/.helmignore b/.release/helm/caduceus/.helmignore similarity index 100% rename from deploy/helm/caduceus/.helmignore rename to .release/helm/caduceus/.helmignore diff --git a/deploy/helm/caduceus/Chart.yaml b/.release/helm/caduceus/Chart.yaml similarity index 100% rename from deploy/helm/caduceus/Chart.yaml rename to .release/helm/caduceus/Chart.yaml diff --git a/deploy/helm/caduceus/templates/caduceus.yaml b/.release/helm/caduceus/templates/caduceus.yaml similarity index 100% rename from deploy/helm/caduceus/templates/caduceus.yaml rename to .release/helm/caduceus/templates/caduceus.yaml diff --git a/deploy/helm/caduceus/values.yaml b/.release/helm/caduceus/values.yaml similarity index 100% rename from deploy/helm/caduceus/values.yaml rename to .release/helm/caduceus/values.yaml diff --git a/Dockerfile b/Dockerfile index 6c628f62..954a2c12 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,18 +16,40 @@ RUN apk add --no-cache --no-progress \ libc-dev \ upx +# Download spruce here to eliminate the need for curl in the final image RUN mkdir -p /go/bin && \ - curl -o /go/bin/spruce https://github.com/geofffranks/spruce/releases/download/v1.29.0/spruce-linux-amd64 && \ + curl -L -o /go/bin/spruce https://github.com/geofffranks/spruce/releases/download/v1.29.0/spruce-linux-amd64 && \ chmod +x /go/bin/spruce + COPY . . + RUN make test release -FROM alpine:3.12.1 +########################## +# Build the final image. +########################## + +FROM alpine:latest + +# Copy over the standard things you'd expect. +COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ +COPY --from=builder /src/caduceus / +COPY --from=builder /src/.release/docker/entrypoint.sh / + +# Copy over spruce and the spruce template file used to make the actual configuration file. +COPY --from=builder /src/.release/docker/caduceus_spruce.yaml /tmp/caduceus_spruce.yaml +COPY --from=builder /go/bin/spruce /bin/ + +# Include compliance details about the container and what it contains. +COPY --from=builder /src/Dockerfile \ + /src/NOTICE \ + /src/LICENSE \ + /src/CHANGELOG.md / -COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ -COPY --from=builder /src/caduceus /src/caduceus.yaml /src/deploy/packaging/entrypoint.sh /go/bin/spruce /src/Dockerfile /src/NOTICE /src/LICENSE /src/CHANGELOG.md / -COPY --from=builder /src/deploy/packaging/caduceus_spruce.yaml /tmp/caduceus_spruce.yaml -COPY --from=builder /src/caduceus.yaml /etc/caduceus/caduceus.yaml +# Make the location for the configuration file that will be used. +RUN mkdir /etc/caduceus/ \ + && touch /etc/caduceus/caduceus.yaml \ + && chmod 666 /etc/caduceus/caduceus.yaml USER nobody diff --git a/Makefile b/Makefile index 049d3c08..77048d9b 100644 --- a/Makefile +++ b/Makefile @@ -2,10 +2,8 @@ DOCKER ?= docker -GO ?= go -GOFMT ?= $(GO)fmt APP := caduceus -DOCKER_ORG := xmidt +DOCKER_ORG := ghcr.io/xmidt-org VERSION ?= $(shell git describe --tag --always --dirty) PROGVER ?= $(shell git describe --tags `git rev-list --tags --max-count=1` | tail -1 | sed 's/v\(.*\)/\1/') @@ -16,21 +14,21 @@ GOBUILDFLAGS = -a -ldflags "-w -s -X 'main.BuildTime=$(BUILDTIME)' -X main.GitCo default: build generate: - $(GO) generate ./... - $(GO) install ./... + go generate ./... + go install ./... test: - $(GO) test -v -race -coverprofile=coverage.txt ./... - $(GO) test -v -race -json ./... > report.json + go test -v -race -coverprofile=coverage.txt ./... + go test -v -race -json ./... > report.json style: - ! $(GOFMT) -d $$(find . -path ./vendor -prune -o -name '*.go' -print) | grep '^' + ! gofmt -d $$(find . -path ./vendor -prune -o -name '*.go' -print) | grep '^' check: golangci-lint run -n | tee errors.txt build: - CGO_ENABLED=0 $(GO) build $(GOBUILDFLAGS) + CGO_ENABLED=0 go build $(GOBUILDFLAGS) release: build upx $(APP) @@ -42,8 +40,8 @@ docker: binaries: generate mkdir -p ./.ignore - CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 $(GO) build -o ./.ignore/$(APP)-$(PROGVER).darwin-amd64 -ldflags "-X 'main.BuildTime=$(BUILDTIME)' -X main.GitCommit=$(GITCOMMIT) -X main.Version=$(VERSION)" - CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -o ./.ignore/$(APP)-$(PROGVER).linux-amd64 -ldflags "-X 'main.BuildTime=$(BUILDTIME)' -X main.GitCommit=$(GITCOMMIT) -X main.Version=$(VERSION)" + CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -o ./.ignore/$(APP)-$(PROGVER).darwin-amd64 -ldflags "-X 'main.BuildTime=$(BUILDTIME)' -X main.GitCommit=$(GITCOMMIT) -X main.Version=$(VERSION)" + CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o ./.ignore/$(APP)-$(PROGVER).linux-amd64 -ldflags "-X 'main.BuildTime=$(BUILDTIME)' -X main.GitCommit=$(GITCOMMIT) -X main.Version=$(VERSION)" upx ./.ignore/$(APP)-$(PROGVER).darwin-amd64 upx ./.ignore/$(APP)-$(PROGVER).linux-amd64 diff --git a/conf/caduceus.env.example b/conf/caduceus.env.example deleted file mode 100644 index baaeed0b..00000000 --- a/conf/caduceus.env.example +++ /dev/null @@ -1,6 +0,0 @@ -#KERNEL_OPEN_FILES=95000 -#ULIMIT_OPEN_FILES=75000 -#NET_CORE_SOMAXCONN=1000 -#NET_IPV4_TCP_MAX_SYN_BACKLOG=1000 -#NET_IPV4_TCP_MEM="100000000 100000000 100000000" -DAEMON_COREFILE_LIMIT=unlimited diff --git a/conf/caduceus.service b/conf/caduceus.service deleted file mode 100644 index 5c5cb693..00000000 --- a/conf/caduceus.service +++ /dev/null @@ -1,18 +0,0 @@ - -[Unit] -Description=The Xmidt server for delivering events. -After=network.target remote-fs.target nss-lookup.target - -[Service] -Type=simple -PIDFile=/run/caduceus.pid -ExecStartPre=/usr/bin/rm -f /run/caduceus.pid -ExecStart=/usr/bin/caduceus -ExecReload=/bin/kill -s HUP $MAINPID -TimeoutStopSec=10 -KillMode=process -PrivateTmp=true -Restart=always - -[Install] -WantedBy=multi-user.target diff --git a/deploy/packaging/caduceus.spec b/deploy/packaging/caduceus.spec deleted file mode 100644 index bf027e3e..00000000 --- a/deploy/packaging/caduceus.spec +++ /dev/null @@ -1,90 +0,0 @@ -%define __os_install_post %{nil} -%define debug_package %{nil} - -Name: caduceus -Version: v{{{ git_tag_version }}} -Release: 1%{?dist} -Summary: The Xmidt API interface server. - -Vendor: Comcast -Packager: Comcast -Group: System Environment/Daemons -License: ASL 2.0 -URL: https://github.com/xmidt-org/caduceus -Source0: https://github.com/xmidt-org/%{name}/archive/%{version}.tar.gz - -Prefix: /opt -BuildRoot: %{_tmppath}/%{name} -BuildRequires: systemd -BuildRequires: golang >= 1.12 -BuildRequires: git - -%description -The XMiDT server for delivering events - -%prep -%setup -n %{name}-{{{ git_tag_version }}} - -%build -GOPROXY=https://proxy.golang.org go build -ldflags "-linkmode=external -X 'main.BuildTime=`date -u '+%c'`' -X main.GitCommit={{{ git_short_hash }}} -X main.Version=%{version}" -o %{name} . - -%install -echo rm -rf %{buildroot} -%{__install} -d %{buildroot}%{_bindir} -%{__install} -d %{buildroot}%{_initddir} -%{__install} -d %{buildroot}%{_sysconfdir}/%{name} -%{__install} -d %{buildroot}%{_localstatedir}/log/%{name} -%{__install} -d %{buildroot}%{_localstatedir}/run/%{name} -%{__install} -d %{buildroot}%{_unitdir} - -%{__install} -p %{name} %{buildroot}%{_bindir} -%{__install} -p conf/%{name}.service %{buildroot}%{_unitdir}/%{name}.service -%{__install} -p %{name}.yaml %{buildroot}%{_sysconfdir}/%{name}/%{name}.yaml - -%files -%defattr(644, root, root, 755) -%doc LICENSE CHANGELOG.md NOTICE - -%attr(755, root, root) %{_bindir}/%{name} - -%{_unitdir}/%{name}.service - -%dir %{_sysconfdir}/%{name} -%config %{_sysconfdir}/%{name}/%{name}.yaml - -%dir %attr(755, %{name}, %{name}) %{_localstatedir}/log/%{name} -%dir %attr(755, %{name}, %{name}) %{_localstatedir}/run/%{name} - -%pre -id %{name} >/dev/null 2>&1 -if [ $? != 0 ]; then - /usr/sbin/groupadd -r %{name} >/dev/null 2>&1 - /usr/sbin/useradd -d /var/run/%{name} -r -g %{name} %{name} >/dev/null 2>&1 -fi - -%post -if [ $1 = 1 ]; then - systemctl preset %{name}.service >/dev/null 2>&1 || : -fi - -%preun -if [ -e /etc/init.d/%{name} ]; then - systemctl --no-reload disable %{name}.service > /dev/null 2>&1 || : - systemctl stop %{name}.service > /dev/null 2>&1 || : -fi - -# If not an upgrade, then delete -if [ $1 = 0 ]; then - systemctl disable %{name}.service >/dev/null 2>&1 || : -fi - -%postun -# Do not remove anything if this is not an uninstall -if [ $1 = 0 ]; then - /usr/sbin/userdel -r %{name} >/dev/null 2>&1 - /usr/sbin/groupdel %{name} >/dev/null 2>&1 - # Ignore errors from above - true -fi - -%changelog diff --git a/deploy/packaging/entrypoint.sh b/deploy/packaging/entrypoint.sh deleted file mode 100755 index c38d0948..00000000 --- a/deploy/packaging/entrypoint.sh +++ /dev/null @@ -1,49 +0,0 @@ -#!/usr/bin/env sh - - -set -e - -# check to see if this file is being run or sourced from another script -_is_sourced() { - # https://unix.stackexchange.com/a/215279 - [ "${#FUNCNAME[@]}" -ge 2 ] \ - && [ "${FUNCNAME[0]}" = '_is_sourced' ] \ - && [ "${FUNCNAME[1]}" = 'source' ] -} - -# check arguments for an option that would cause /caduceus to stop -# return true if there is one -_want_help() { - local arg - for arg; do - case "$arg" in - -'?'|--help|-v) - return 0 - ;; - esac - done - return 1 -} - -_main() { - # if command starts with an option, prepend caduceus - if [ "${1:0:1}" = '-' ]; then - set -- /caduceus "$@" - fi - # skip setup if they aren't running /caduceus or want an option that stops /caduceus - if [ "$1" = '/caduceus' ] && ! _want_help "$@"; then - echo "Entrypoint script for caduceus Server ${VERSION} started." - - if [ ! -s /etc/caduceus/caduceus.yaml ]; then - echo "Building out template for file" - /spruce merge --prune service.fixed /caduceus.yaml /tmp/caduceus_spruce.yaml > /etc/caduceus/caduceus.yaml - fi - fi - - exec "$@" -} - -# If we are sourced from elsewhere, don't perform any further actions -if ! _is_sourced; then - _main "$@" -fi \ No newline at end of file diff --git a/rpkg.conf b/rpkg.conf deleted file mode 100644 index 957dc058..00000000 --- a/rpkg.conf +++ /dev/null @@ -1,2 +0,0 @@ -[rpkg] -user_macros = "${git_props:root}/rpkg.macros" diff --git a/rpkg.macros b/rpkg.macros deleted file mode 100644 index 0e49be8a..00000000 --- a/rpkg.macros +++ /dev/null @@ -1,23 +0,0 @@ -function git_short_hash { - short_hash="$(cached git_short_hash)" - - if [ -z "$short_hash" ]; then - short_hash="$(git rev-parse --short HEAD)" - fi - - output "$short_hash" -} - -function git_tag_version { - tag="$(cached git_tag_version)" - - if [ -z "$tag" ]; then - tag="$(git describe --tags --abbrev=0)" - fi - - # Remove the potential prefix of `v` - if [[ $tag =~ ^v[0-9].* ]]; then - tag="${tag:1}" - fi - output "$tag" -}