| # Licensed to the Apache Software Foundation (ASF) under one |
| # or more contributor license agreements. See the NOTICE file |
| # distributed with this work for additional information |
| # regarding copyright ownership. The ASF licenses this file |
| # to you under the Apache License, Version 2.0 (the |
| # "License"); you may not use this file except in compliance |
| # with the License. You may obtain a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, |
| # software distributed under the License is distributed on an |
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| # KIND, either express or implied. See the License for the |
| # specific language governing permissions and limitations |
| # under the License. |
| # |
| import shutil |
| import time |
| from openserverless.common.kube_api_client import KubeApiClient |
| import os |
| import uuid |
| import logging |
| from datetime import datetime, timezone, timedelta |
| from types import SimpleNamespace |
| import random |
| import string |
| |
| JOB_NAME = "build" |
| CM_NAME = "cm" |
| |
| class BuildService: |
| """ |
| BuildService is responsible for managing the build process in a Kubernetes environment. |
| It handles the creation of Dockerfiles, ConfigMaps, and Kubernetes Jobs to build Docker images |
| based on the provided build configuration. |
| """ |
| |
| def __init__(self, user_env=None): |
| # A super userful Kube Api Client |
| self.kube_client = KubeApiClient() |
| |
| # generate a unique ID for the build |
| self.id = str(uuid.uuid4()) |
| |
| # user environment variables |
| self.user_env = user_env if user_env is not None else {} |
| |
| self.user = self.user_env.get('wsk_user_name', '') |
| |
| # define a unique ConfigMap and Job name based on the ID |
| if len(self.user) > 0: |
| self.cm = f"{CM_NAME}-{self.user}-{self.id}" |
| self.job_name = f"{JOB_NAME}-{self.user}-{self.id}" |
| else: |
| self.cm = f"{CM_NAME}-{self.id}" |
| self.job_name = f"{JOB_NAME}-{self.id}" |
| |
| # define registry host |
| self.registry_host = self.get_registry_host() |
| logging.info(f"Using registry host: {self.registry_host}") |
| |
| # define registry auth |
| self.registry_auth = self.get_registry_auth() |
| self.custom_registry_auth = False |
| logging.info(f"Using registry auth: {self.registry_auth}") |
| |
| def init(self, build_config: dict): |
| """ |
| Initialize the build service by creating the necessary ConfigMap. |
| """ |
| logging.info("Initializing BuildService") |
| |
| self.build_config = build_config |
| |
| # install the nuvolaris-buildkitd-conf ConfigMap if not present |
| cm = self.kube_client.get_config_map("nuvolaris-buildkitd-conf") |
| if cm is None: |
| logging.info("Adding nuvolaris-buildkitd-conf ConfigMap") |
| status = self.kube_client.post_config_map( |
| cm_name="nuvolaris-buildkitd-conf", |
| file_or_dir="deploy/buildkit/buildkitd.toml", |
| namespace="nuvolaris", |
| ) |
| if status is None: |
| logging.error("Failed to create nuvolaris-buildkitd-conf ConfigMap") |
| |
| def create_registry_secret(self, username: str, password: str, registry: str): |
| randompart = ''.join(random.choices(string.ascii_lowercase + string.digits, k=5)) |
| random_name = f"reg-{self.user}-{randompart}" |
| conf = KubeApiClient.build_dockerconfigjson(username=username, password=password,registry=registry) |
| |
| data = {".dockerconfigjson": conf} |
| secret = self.kube_client.post_secret(secret_name=random_name, secret_data=data, type="kubernetes.io/dockerconfigjson") |
| return secret |
| |
| def get_registry_host(self) -> str: |
| """ |
| Retrieve the registry host |
| - firstly, check if the user environment has a registry host set |
| - otherwise retrieve the OpenServerless config map |
| - if not present use a default value |
| """ |
| # if customized by the user |
| if (self.user_env.get('REGISTRY_HOST') is not None): |
| return self.user_env.get('REGISTRY_HOST') |
| |
| # the default |
| registry_host = 'nuvolaris-registry-svc:5000' |
| ops_config_map = self.kube_client.get_config_map('config') |
| if ops_config_map is not None: |
| if 'annotations' in ops_config_map.get('metadata', {}): |
| annotations = ops_config_map['metadata']['annotations'] |
| if 'registry_host' in annotations: |
| registry_host = annotations['registry_host'] |
| |
| return registry_host |
| |
| def get_registry_auth(self) -> str: |
| """ |
| Get the name of the registry auth secret. If the user environment has a registry auth set, use it. |
| """ |
| if (self.user_env.get('REGISTRY_SECRET') is not None): |
| custom_credentials = self.user_env.get('REGISTRY_SECRET') |
| # if not ':' it means that the user is referencing an already created custom secret |
| if ":" not in custom_credentials: |
| return custom_credentials |
| |
| username, password = custom_credentials.split(":") |
| registry_secret = self.create_registry_secret( |
| username=username, password=password, |
| registry=self.registry_host |
| ) |
| if registry_secret is not None: |
| self.registry_auth = registry_secret['metadata']['name'] |
| # is custom only when is not equal to the default |
| if self.registry_auth != "registry-pull-secret": |
| self.custom_registry_auth = True |
| |
| return self.user_env.get('REGISTRY_SECRET') |
| |
| return 'registry-pull-secret-int' |
| |
| def create_docker_file(self, requirements=None) -> str: |
| """ |
| Create a Dockerfile in the current directory. |
| """ |
| source = self.build_config.get("source") |
| |
| dockerfile_content = f"FROM {source}\n\n" |
| |
| if 'file' in self.build_config: |
| if requirements is not None: |
| dockerfile_content += f"COPY {requirements} /tmp/{requirements}\n" |
| dockerfile_content += "USER root\n" |
| dockerfile_content += "RUN /bin/extend\n" |
| dockerfile_content += "USER nobody\n" |
| |
| |
| return dockerfile_content |
| |
| def get_requirements_file_from_kind(self) -> str: |
| """ |
| Get the requirements file based on the kind of the build. |
| """ |
| kind = self.build_config.get("kind") |
| if kind == 'python': |
| return 'requirements.txt' |
| elif kind == 'nodejs': |
| return 'package.json' |
| elif kind == 'php': |
| return 'composer.json' |
| elif kind == 'java': |
| return 'pom.xml' |
| elif kind == 'go': |
| return 'go.mod' |
| elif kind == 'ruby': |
| return 'Gemfile' |
| elif kind == 'dotnet': |
| return 'project.json' |
| else: |
| raise ValueError(f"Unsupported kind: {kind}") |
| |
| def build(self, image_name: str) -> str: |
| """ |
| Build the Docker image using the provided build configuration. |
| The build configuration should include the source, target, and kind. |
| """ |
| import tempfile |
| import base64 |
| |
| # define registry host |
| self.registry_host = self.get_registry_host() |
| if self.registry_host is None: |
| return None |
| logging.info(f"Using registry host: {self.registry_host}") |
| |
| # define registry auth |
| self.registry_auth = self.get_registry_auth() |
| |
| logging.info(f"Using registry auth: {self.registry_auth}") |
| |
| # firstly remove old build jobs |
| self.delete_old_build_jobs() |
| |
| tmpdirname = tempfile.mkdtemp() |
| logging.info(f"Starting the build to: {tmpdirname}") |
| requirements_file = None |
| if 'file' in self.build_config: |
| logging.info("Decoding the requirements file from base64") |
| # decode base64 self.build_config.get('file') |
| try: |
| requirements = base64.b64decode(self.build_config.get('file')).decode('utf-8') |
| requirements_file = self.get_requirements_file_from_kind() |
| |
| with open(os.path.join(tmpdirname,requirements_file), 'w') as f: |
| f.write(requirements) |
| |
| except Exception as e: |
| logging.error(f"Failed to decode the requirements file: {e}") |
| return None |
| |
| dockerfile_path = os.path.join(tmpdirname, "Dockerfile") |
| logging.info(f"Creating Dockerfile at: {dockerfile_path}") |
| with open(dockerfile_path, "w") as dockerfile: |
| dockerfile.write(self.create_docker_file(requirements=requirements_file)) |
| |
| # check if the directory contains a Dockerfile and is not empty. |
| if not self.check_build_dir(tmpdirname): |
| return None |
| |
| # Create a ConfigMap for the build context |
| logging.info(f"Creating ConfigMap {self.cm} with build context") |
| cm = self.kube_client.post_config_map( |
| cm_name=self.cm, |
| file_or_dir=tmpdirname, |
| ) |
| |
| logging.info(f"Removing temporary build directory: {tmpdirname}") |
| shutil.rmtree(tmpdirname) |
| |
| if not cm: |
| return None |
| |
| logging.info(f"ConfigMap {self.cm} created successfully") |
| job_template = self.create_build_job(image_name) |
| job = self.kube_client.post_job(job_template) |
| if not job: |
| logging.error(f"Failed to create job {self.job_name}") |
| return None |
| |
| time.sleep(3) |
| if not self.kube_client.delete_config_map(cm_name=self.cm): |
| logging.error(f"Failed to delete ConfigMap {self.cm}") |
| |
| |
| if self.custom_registry_auth: |
| if not self.kube_client.delete_secret(secret_name=self.registry_auth): |
| logging.error(f"Failed to delete Secret {self.custom_registry_auth}") |
| |
| return job |
| |
| def delete_old_build_jobs(self, max_age_hours: int = 24) -> int: |
| name_filter = f"build-{self.user}-" if self.user else "build" |
| jobs = self.kube_client.get_jobs(name_filter=name_filter) |
| |
| try: |
| cutoff_time = datetime.now(timezone.utc) - timedelta(hours=max_age_hours) |
| count = 0 |
| |
| for j in jobs: |
| job = SimpleNamespace(**j) |
| metadata = SimpleNamespace(**job.metadata) |
| status = SimpleNamespace(**job.status) |
| |
| if not metadata or not status: |
| continue |
| |
| job_name = metadata.name |
| |
| completed = False |
| # Check if job is completed |
| for c in status.conditions: |
| condition = SimpleNamespace(**c) |
| if condition.type == "Complete" and condition.status == "True": |
| completed = True |
| break |
| |
| if not completed: |
| continue |
| |
| # Check completion time |
| completion_time = status.completionTime |
| if not completion_time: |
| continue |
| job_completion_time = datetime.strptime(completion_time,"%Y-%m-%dT%H:%M:%SZ").replace(tzinfo=timezone.utc) |
| |
| if job_completion_time < cutoff_time: |
| logging.info (f"Deleting job {job_name} (completed at {completion_time})") |
| status = self.kube_client.delete_job(job_name=job_name) |
| if not status: |
| logging.error(f"Failed to delete job {job_name}") |
| else: |
| count+=1 |
| logging.info(f"Job {job_name} deleted successfully") |
| |
| return count |
| except Exception as e: |
| logging.error(f"Error deleting old build jobs: {e}") |
| return -1 |
| |
| |
| def check_build_dir(self, unzip_dir: str) -> bool: |
| """ |
| Check if the unzipped directory contains a Dockerfile and is not empty.""" |
| if not os.path.exists(unzip_dir): |
| return False |
| |
| # Check if the directory contains a Dockerfile |
| dockerfile_path = os.path.join(unzip_dir, "Dockerfile") |
| if not os.path.exists(dockerfile_path): |
| return False |
| |
| return True |
| |
| def create_build_job(self, image_name: str) -> dict: |
| """Create a Kubernetes job manifest for building the Docker image.""" |
| if not self.custom_registry_auth: |
| registry_image_name = f"{self.registry_host}/{image_name}" |
| else: |
| registry_image_name = f"{image_name}" |
| |
| # --- MANIFEST DEL JOB --- |
| job_manifest = { |
| "apiVersion": "batch/v1", |
| "kind": "Job", |
| "metadata": {"name": self.job_name}, |
| "spec": { |
| "backoffLimit": 0, |
| "template": { |
| "spec": { |
| "restartPolicy": "Never", |
| "volumes": [ |
| { |
| "name": "nuvolaris-buildkitd-conf", |
| "configMap": {"name": "nuvolaris-buildkitd-conf"}, |
| }, |
| { |
| "name": "build-context-vol", |
| "configMap": {"name": self.cm}, |
| }, |
| {"name": "workspace", "emptyDir": {}}, |
| {"name": "img-cache", "emptyDir": {}}, |
| {"name": "cdi-etc", "emptyDir": {}}, |
| {"name": "cdi-run", "emptyDir": {}}, |
| {"name": "cdi-buildkit", "emptyDir": {}}, |
| { |
| "name": "docker-config", |
| "secret": { |
| "secretName": self.registry_auth, |
| "items": [ |
| { |
| "key": ".dockerconfigjson", |
| "path": "config.json", |
| } |
| ], |
| }, |
| }, |
| ], |
| "initContainers": [ |
| { |
| "name": "copy-build-context", |
| "image": "busybox:1.36", |
| "command": [ |
| "sh", "-c", "cp -rvL /configmap/* /workspace/ && cat /workspace/Dockerfile", |
| ], |
| "volumeMounts": [ |
| { "name": "build-context-vol", "mountPath": "/configmap", }, |
| { "name": "workspace", "mountPath": "/workspace" }, |
| ], |
| } |
| ], |
| "containers": [ |
| { |
| "name": "buildkit", |
| "image": "moby/buildkit:master-rootless", |
| "command": ["sh", "-c"], |
| "args": [ |
| "rootlesskit buildkitd --config /config/buildkitd.toml & sleep 3 && " |
| f"buildctl build --progress=plain --frontend=dockerfile.v0 --local context=/workspace --local dockerfile=/workspace --output=type=image,name={registry_image_name},push=true" |
| ], |
| "securityContext": { |
| "runAsUser": 1000, |
| "runAsGroup": 1000, |
| "allowPrivilegeEscalation": True, |
| "privileged": True, |
| "seccompProfile": { "type": "Unconfined" } |
| }, |
| "env": [ |
| { "name": "BUILDKIT_ROOTLESS", "value": "1" } |
| ], |
| "volumeMounts": [ |
| { "name": "nuvolaris-buildkitd-conf", "mountPath": "/config" }, |
| { "name": "workspace", "mountPath": "/workspace" }, |
| { "name": "docker-config", "mountPath": "/home/user/.docker" }, |
| { "name": "img-cache", "mountPath": "/tmp" }, |
| { "name": "cdi-etc", "mountPath": "/etc/cdi" }, |
| { "name": "cdi-run", "mountPath": "/var/run/cdi" }, |
| { "name": "cdi-buildkit", "mountPath": "/etc/buildkit/cdi" }, |
| ], |
| } |
| ], |
| } |
| }, |
| }, |
| } |
| |
| return job_manifest |
