Skip to content

Commit 21c8187

Browse files
FlyingliuhubFlyingliuhub
authored
[Future-Playground] Adding future playground to deployment pipeline (#214)
* add future playground Signed-off-by: Tao Liu <liutaoaz@amazon.com> * add future yml file Signed-off-by: Tao Liu <liutaoaz@amazon.com> --------- Signed-off-by: Tao Liu <liutaoaz@amazon.com>
1 parent ee48bf2 commit 21c8187

File tree

4 files changed

+1522
-0
lines changed

4 files changed

+1522
-0
lines changed

‎.github/workflows/README.md

+9
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,15 @@ The current workflows folder contains one deployment workflow(os-osd-deployment.
4646
>> - `additional_args`: JSON string of additional options for the build. Default value is `'{}'`.
4747
>> - `build_number`: The build number. This parameter is optional.
4848
49+
> trigger-future-deployment.yaml
50+
>> This GitHub Actions workflow is responsible for deploying OpenSearch and OpenSearch Dashboards in the future playground environment. It provides options for both fresh deployment and upgrade deployment. The input parameters as following:
51+
>> - `deploy_fresh`: Specifies whether to perform a fresh deployment of OpenSearch and OpenSearch Dashboards. Default is `false`.
52+
>> - `deploy_upgrade`: Specifies whether to perform an upgrade deployment of OpenSearch and OpenSearch Dashboards. Default is `true`.
53+
>> - `osd_image_tag`: The image tag for OpenSearch Dashboards.
54+
>> - `osd_image_repo`: The image repository for OpenSearch Dashboards.
55+
>> - `os_image_tag`: The image tag for OpenSearch.
56+
>> - `os_image_repo`: The image repository for OpenSearch.
57+
4958
## Appendix
5059

5160
- GitHub workflow: https://docs.github.com/en/actions/using-workflows/about-workflows

‎.github/workflows/trigger-future-deployment.yml

+108
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
name: Future Playground Deployment
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
deploy_fresh:
7+
required: false
8+
type: boolean
9+
description: 'Fresh Deploy OpenSearch and OpenSearch Dashboards'
10+
default: false
11+
deploy_upgrade:
12+
required: false
13+
type: boolean
14+
description: 'Upgrade OpenSearch and OpenSearch Dashboards'
15+
default: true
16+
osd_image_tag:
17+
required: true
18+
type: string
19+
description: 'Image tag for OpenSearch Dashboards'
20+
default: '3.0.0-8219474312'
21+
osd_image_repo:
22+
required: true
23+
type: string
24+
description: 'Image repo for OpenSearch Dashboards'
25+
default: 'public.ecr.aws/y0r0d3v8/actionrunner'
26+
os_image_tag:
27+
required: false
28+
type: string
29+
description: 'Image tag for OpenSearch'
30+
default: '3.0.0'
31+
os_image_repo:
32+
required: false
33+
type: string
34+
description: 'Image repo for OpenSearch'
35+
default: 'opensearchstaging/opensearch'
36+
37+
jobs:
38+
39+
Future-OS-OSD-Deployment:
40+
runs-on: ubuntu-latest
41+
42+
steps:
43+
- uses: actions/checkout@v3
44+
- name: Replace Tokens for opensearch-dashboards.yml
45+
uses: cschleiden/replace-tokens@v1
46+
with:
47+
files: '["${{ github.workspace }}/config/playground/helm/future/helm-opensearch-dashboards.yaml"]'
48+
tokenPrefix: '${'
49+
tokenSuffix: '}'
50+
env:
51+
OPENID_CLIENT_ID: ${{ secrets.OPENID_CLIENT_ID_FUTURE }}
52+
OPENID_CLIENT_SECRET: ${{ secrets.OPENID_CLIENT_SECRET_FUTURE }}
53+
OPENID_BASE_REDIRECT_URL: ${{ secrets.OPENID_BASE_REDIRECT_URL_FUTURE }}
54+
OPENID_LOGOUT_URL: ${{ secrets.OPENID_LOGOUT_URL_FUTURE }}
55+
GA_TRACKING_ID: ${{ secrets.GA_TRACKING_ID_FUTURE }}
56+
CERTIFICATE_ARN: ${{ secrets.CERTIFICATE_ARN_FUTURE }}
57+
KIBANASERVER: ${{ secrets.KIBANASERVER }}
58+
OSD_IMAGE_TAG: ${{ inputs.osd_image_tag }}
59+
OSD_IMAGE_REPO: ${{ inputs.osd_image_repo }}
60+
- name: Replace Token in opensearch.yml
61+
uses: cschleiden/replace-tokens@v1
62+
with:
63+
files: '["${{ github.workspace }}/config/playground/helm/future/helm-opensearch.yaml"]'
64+
tokenPrefix: '${'
65+
tokenSuffix: '}'
66+
env:
67+
ESNODE_CERT: ${{ secrets.esnode_cert }}
68+
ESNODE_KEY_CERT: ${{ secrets.esnode_key_cert }}
69+
ROOT_CA_CERT: ${{ secrets.root_ca_cert }}
70+
OS_IMAGE_TAG: ${{ inputs.os_image_tag }}
71+
OS_IMAGE_REPO: ${{ inputs.os_image_repo }}
72+
- name: Configure AWS Credentials
73+
uses: aws-actions/configure-aws-credentials@v2
74+
with:
75+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_PINK }}
76+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_PINK }}
77+
aws-region: ${{ secrets.AWS_REGION_PINK }}
78+
- name: Fresh Deploy OpenSearch and OpenSearch Dashboards By Helm Chart
79+
if: ${{ inputs.deploy_fresh }}
80+
uses: elastic-analytics/dashboards-action@main
81+
env:
82+
KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_DATA_PINK }}
83+
with:
84+
plugins: "" # optional, list of Helm plugins. eg. helm-secrets or helm-diff.
85+
# Teardown the current OS and OSD and then install the lastest version
86+
# of OS and OSD as it only takes 23 seconds for the process, will add
87+
# blue/green deployment later.
88+
command: |
89+
helm uninstall opensearch --namespace default
90+
helm uninstall dashboards --namespace default
91+
kubectl get pvc | grep opensearch-cluster-leader-opensearch-cluster-leader- | awk '{print $1}'| xargs kubectl delete pvc
92+
helm install opensearch opensearch/opensearch -f config/playground/helm/future/helm-opensearch.yaml
93+
helm install dashboards opensearch/opensearch-dashboards -f config/playground/helm/future/helm-opensearch-dashboards.yaml
94+
95+
- name: Upgrade Deploy OpenSearch/OpenSearch Dashboards By Helm Chart
96+
if: ${{ inputs.deploy_upgrade }}
97+
uses: elastic-analytics/dashboards-action@main
98+
env:
99+
KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_DATA_PINK }}
100+
with:
101+
plugins: "" # optional, list of Helm plugins. eg. helm-secrets or helm-diff.
102+
# Teardown the current OS and OSD and then install the lastest version
103+
# of OS and OSD as it only takes 23 seconds for the process, will add
104+
# blue/green deployment later.
105+
command: |
106+
helm upgrade opensearch opensearch/opensearch -f config/playground/helm/future/helm-opensearch.yaml
107+
helm upgrade dashboards opensearch/opensearch-dashboards -f config/playground/helm/future/helm-opensearch-dashboards.yaml
108+

‎config/playground/helm/future/helm-opensearch-dashboards.yaml

+246
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,246 @@
1+
# Copyright OpenSearch Contributors
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
# Default values for opensearch-dashboards.
5+
# This is a YAML-formatted file.
6+
# Declare variables to be passed into your templates.
7+
8+
opensearchHosts: "https://opensearch-cluster-leader:9200"
9+
replicaCount: 2
10+
11+
image:
12+
repository: ${OSD_IMAGE_REPO}
13+
# override image tag, which is .Chart.AppVersion by default
14+
tag: ${OSD_IMAGE_TAG}
15+
pullPolicy: "Always"
16+
17+
startupProbe:
18+
tcpSocket:
19+
port: 5601
20+
periodSeconds: 10
21+
timeoutSeconds: 5
22+
failureThreshold: 20
23+
successThreshold: 1
24+
initialDelaySeconds: 10
25+
26+
livenessProbe:
27+
tcpSocket:
28+
port: 5601
29+
periodSeconds: 20
30+
timeoutSeconds: 5
31+
failureThreshold: 10
32+
successThreshold: 1
33+
initialDelaySeconds: 10
34+
35+
readinessProbe:
36+
tcpSocket:
37+
port: 5601
38+
periodSeconds: 20
39+
timeoutSeconds: 5
40+
failureThreshold: 10
41+
successThreshold: 1
42+
initialDelaySeconds: 10
43+
44+
imagePullSecrets: []
45+
nameOverride: ""
46+
fullnameOverride: ""
47+
48+
serviceAccount:
49+
# Specifies whether a service account should be created
50+
create: true
51+
# Annotations to add to the service account
52+
annotations: {}
53+
# The name of the service account to use.
54+
# If not set and create is true, a name is generated using the fullname template
55+
name: ""
56+
57+
rbac:
58+
create: true
59+
60+
# A list of secrets and their paths to mount inside the pod
61+
# This is useful for mounting certificates for security and for mounting
62+
# the X-Pack license
63+
secretMounts: []
64+
65+
podAnnotations: {}
66+
67+
extraEnvs: []
68+
69+
envFrom: []
70+
71+
extraVolumes: []
72+
73+
extraVolumeMounts: []
74+
75+
extraInitContainers: ""
76+
77+
extraContainers: ""
78+
79+
podSecurityContext: {}
80+
81+
securityContext:
82+
capabilities:
83+
drop:
84+
- ALL
85+
# readOnlyRootFilesystem: true
86+
runAsNonRoot: true
87+
runAsUser: 1000
88+
89+
config:
90+
# Default OpenSearch Dashboards configuration from docker image of Dashboards
91+
opensearch_dashboards.yml:
92+
opensearch.hosts: [https://localhost:9200]
93+
opensearch.ssl.verificationMode: none
94+
opensearch.username: kibanaserver
95+
opensearch.password: ${KIBANASERVER}
96+
opensearch.requestHeadersWhitelist: [authorization, securitytenant]
97+
opensearch_security.auth.anonymous_auth_enabled: true
98+
opensearch_security.multitenancy.enabled: true
99+
opensearch_security.multitenancy.tenants.enable_global: true
100+
opensearch_security.multitenancy.tenants.enable_private: true
101+
opensearch_security.multitenancy.tenants.preferred: [Global, Private]
102+
opensearch_security.readonly_mode.roles: [kibana_read_only]
103+
# Use this setting if you are running opensearch-dashboards without https
104+
opensearch_security.cookie.secure: false
105+
server.host: '0.0.0.0'
106+
# Use the consolidated menu and global header bar
107+
opensearchDashboards.branding.useExpandedHeader: false
108+
# Enable multiple datasource
109+
data_source.enabled: true
110+
data_source.endpointDeniedIPs: [
111+
'127.0.0.0/8',
112+
'::1/128',
113+
'169.254.0.0/16',
114+
'fe80::/10',
115+
'10.0.0.0/8',
116+
'172.16.0.0/12',
117+
'192.168.0.0/16',
118+
'fc00::/7',
119+
'0.0.0.0/8',
120+
'100.64.0.0/10',
121+
'192.0.0.0/24',
122+
'192.0.2.0/24',
123+
'198.18.0.0/15',
124+
'192.88.99.0/24',
125+
'198.51.100.0/24',
126+
'203.0.113.0/24',
127+
'224.0.0.0/4',
128+
'240.0.0.0/4',
129+
'255.255.255.255/32',
130+
'::/128',
131+
'2001:db8::/32',
132+
'ff00::/8',
133+
]
134+
# Enable ml_commons_dashboards
135+
# ml_commons_dashboards.enabled: true
136+
# Content security policy(csp) settings
137+
csp.rules: [ "connect-src 'self' www.google-analytics.com vectors.maps.opensearch.org tiles.maps.opensearch.org maps.opensearch.org;" ]
138+
csp.warnLegacyBrowsers: false
139+
google_analytics_plugin.trackingID: ${GA_TRACKING_ID}
140+
141+
# security plugin for openid
142+
opensearch_security.auth.type: ['Basicauth','openid']
143+
opensearch_security.auth.multiple_auth_enabled: true
144+
opensearch_security.ui.openid.login.buttonname: "Log in with Google account"
145+
opensearch_security.ui.openid.login.brandimage: "https://opensearch.org/assets/brand/PNG/Mark/opensearch_mark_default.png"
146+
opensearch_security.ui.openid.login.showbrandimage: true
147+
opensearch_security.openid.base_redirect_url: ${OPENID_REDIRECT_URL}
148+
opensearch_security.openid.scope: 'openid profile email'
149+
opensearch_security.openid.verify_hostnames: false
150+
opensearch_security.openid.refresh_tokens: false
151+
152+
opensearch_security.openid.connect_url: "https://accounts.google.com/.well-known/openid-configuration"
153+
opensearch_security.openid.client_id: ${OPENID_CLIENT_ID}
154+
opensearch_security.openid.client_secret: ${OPENID_CLIENT_SECRET}
155+
opensearch_security.openid.logout_url: ${OPENID_LOGOUT_URL}
156+
157+
uiSettings:
158+
overrides:
159+
"theme:next": true
160+
"theme:darkMode": false
161+
162+
priorityClassName: ""
163+
164+
opensearchAccount:
165+
secret: ""
166+
keyPassphrase:
167+
enabled: false
168+
169+
labels: {}
170+
171+
hostAliases: []
172+
173+
serverHost: "0.0.0.0"
174+
175+
service:
176+
type: NodePort
177+
# The IP family and IP families options are to set the behaviour in a dual-stack environment
178+
# Omitting these values will let the service fall back to whatever the CNI dictates the defaults
179+
# should be
180+
#
181+
# ipFamilyPolicy: SingleStack
182+
# ipFamilies:
183+
# - IPv4
184+
port: 5601
185+
#targetPort: 5601
186+
loadBalancerIP: ""
187+
nodePort: ""
188+
labels: {}
189+
annotations: {}
190+
loadBalancerSourceRanges: []
191+
# 0.0.0.0/0
192+
httpPortName: http
193+
194+
ingress:
195+
enabled: true
196+
ingressClassName: alb
197+
annotations:
198+
alb.ingress.kubernetes.io/scheme: internet-facing
199+
alb.ingress.kubernetes.io/certificate-arn: ${CERTIFICATE_ARN}
200+
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
201+
alb.ingress.kubernetes.io/target-type: ip
202+
alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
203+
labels: {}
204+
hosts:
205+
- host: future.playground.opensearch.org
206+
paths:
207+
- path: /
208+
backend:
209+
service:
210+
name: "dashboards-opensearch-dashboards"
211+
port:
212+
number: 5601
213+
tls: []
214+
215+
resources:
216+
requests:
217+
cpu: "1"
218+
memory: "8G"
219+
limits:
220+
cpu: "3"
221+
memory: "24G"
222+
223+
autoscaling:
224+
# This requires metrics server to be installed, to install use kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
225+
# See https://github.com/kubernetes-sigs/metrics-server
226+
enabled: false
227+
minReplicas: 2
228+
maxReplicas: 10
229+
targetCPUUtilizationPercentage: 80
230+
231+
updateStrategy:
232+
type: "Recreate"
233+
234+
nodeSelector: {}
235+
236+
tolerations: []
237+
238+
affinity: {}
239+
240+
# -- Array of extra K8s manifests to deploy
241+
extraObjects: []
242+
243+
# specify the external plugins to install
244+
plugins:
245+
enabled: true
246+
installList: ["https://github.com/BionIT/google-analytics-plugin/releases/download/3.0.0/googleAnalytics-3.0.0.zip"]

0 commit comments

Comments
 (0)