You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@beam.apache.org by da...@apache.org on 2023/05/08 19:38:32 UTC
[beam] branch master updated: [Playground] Account review (#26555)
This is an automated email from the ASF dual-hosted git repository.
damccorm pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/beam.git
The following commit(s) were added to refs/heads/master by this push:
new ea4411f0082 [Playground] Account review (#26555)
ea4411f0082 is described below
commit ea4411f0082a65b7a974222b5954a44bd8dc8d31
Author: MakarkinSAkvelon <67...@users.noreply.github.com>
AuthorDate: Tue May 9 01:38:25 2023 +0600
[Playground] Account review (#26555)
* Remove unused privileges and info
* Check code
* Space added
---------
Co-authored-by: Sergey Makarkin <se...@akvelon.com>
---
playground/infrastructure/helm/Chart.yaml | 20 ------
.../infrastructure/helm/templates/_helpers.tpl | 76 ----------------------
.../helm/templates/deployment-backend-go.yaml | 71 --------------------
.../helm/templates/deployment-backend-java.yaml | 71 --------------------
.../helm/templates/deployment-backend-python.yaml | 71 --------------------
.../infrastructure/helm/templates/service-go.yaml | 32 ---------
.../helm/templates/service-java.yaml | 32 ---------
.../helm/templates/service-python.yaml | 32 ---------
.../helm/templates/serviceaccount.yaml | 24 -------
playground/infrastructure/helm/values.yaml | 66 -------------------
playground/terraform/infrastructure/setup/iam.tf | 32 +--------
11 files changed, 1 insertion(+), 526 deletions(-)
diff --git a/playground/infrastructure/helm/Chart.yaml b/playground/infrastructure/helm/Chart.yaml
deleted file mode 100644
index ac96c361411..00000000000
--- a/playground/infrastructure/helm/Chart.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements. See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-apiVersion: v2
-name: playground
-description: A Helm chart for Apache Beam Application Deployment
-type: application
-version: 0.0.1
-appVersion: "1.16.0"
diff --git a/playground/infrastructure/helm/templates/_helpers.tpl b/playground/infrastructure/helm/templates/_helpers.tpl
deleted file mode 100644
index d2adb18da05..00000000000
--- a/playground/infrastructure/helm/templates/_helpers.tpl
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- Licensed to the Apache Software Foundation (ASF) under one or more
- contributor license agreements. See the NOTICE file distributed with
- this work for additional information regarding copyright ownership.
- The ASF licenses this file to You under the Apache License, Version 2.0
- (the "License"); you may not use this file except in compliance with
- the License. You may obtain a copy of the License at
- http://www.apache.org/licenses/LICENSE-2.0
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
-*/
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "playground.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "playground.fullname" -}}
-{{- if .Values.fullnameOverride }}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- $name := default .Chart.Name .Values.nameOverride }}
-{{- if contains $name .Release.Name }}
-{{- .Release.Name | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "playground.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Common labels
-*/}}
-{{- define "playground.labels" -}}
-helm.sh/chart: {{ include "playground.chart" . }}
-{{ include "playground.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "playground.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "playground.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
-{{/*
-Create the name of the service account to use
-*/}}
-{{- define "playground.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create }}
-{{- default (include "playground.fullname" .) .Values.serviceAccount.name }}
-{{- else }}
-{{- default "default" .Values.serviceAccount.name }}
-{{- end }}
-{{- end }}
diff --git a/playground/infrastructure/helm/templates/deployment-backend-go.yaml b/playground/infrastructure/helm/templates/deployment-backend-go.yaml
deleted file mode 100644
index c9e458a38ac..00000000000
--- a/playground/infrastructure/helm/templates/deployment-backend-go.yaml
+++ /dev/null
@@ -1,71 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements. See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
- name: {{ include "playground.fullname" . }}-go
- labels:
- {{- include "playground.labels" . | nindent 4 }}
-spec:
- {{- if not .Values.autoscaling.enabled }}
- replicas: {{ .Values.replicaCount }}
- {{- end }}
- selector:
- matchLabels:
- {{- include "playground.selectorLabels" . | nindent 6 }}
- template:
- metadata:
- {{- with .Values.podAnnotations }}
- annotations:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- labels:
- {{- include "playground.selectorLabels" . | nindent 8 }}
- backend-app: "go"
- spec:
- {{- with .Values.imagePullSecrets }}
- imagePullSecrets:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- serviceAccountName: {{ include "playground.serviceAccountName" . }}
- securityContext:
- {{- toYaml .Values.podSecurityContext | nindent 8 }}
- containers:
- - name: {{ .Chart.Name }}
- securityContext:
- {{- toYaml .Values.securityContext | nindent 12 }}
- image: "{{ .Values.global.registry}}/{{ .Values.image.repository_go }}:{{ .Values.global.tag }}"
- imagePullPolicy: {{ .Values.image.pullPolicy }}
- env:
- - name: "PROTOCOL_TYPE"
- value: "TCP"
- ports:
- - name: http
- containerPort: 8080
- protocol: TCP
- resources:
- {{- toYaml .Values.resources | nindent 12 }}
- {{- with .Values.nodeSelector }}
- nodeSelector:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- {{- with .Values.affinity }}
- affinity:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- {{- with .Values.tolerations }}
- tolerations:
- {{- toYaml . | nindent 8 }}
- {{- end }}
diff --git a/playground/infrastructure/helm/templates/deployment-backend-java.yaml b/playground/infrastructure/helm/templates/deployment-backend-java.yaml
deleted file mode 100644
index d3d03134c7c..00000000000
--- a/playground/infrastructure/helm/templates/deployment-backend-java.yaml
+++ /dev/null
@@ -1,71 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements. See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
- name: {{ include "playground.fullname" . }}-java
- labels:
- {{- include "playground.labels" . | nindent 4 }}
-spec:
- {{- if not .Values.autoscaling.enabled }}
- replicas: {{ .Values.replicaCount }}
- {{- end }}
- selector:
- matchLabels:
- {{- include "playground.selectorLabels" . | nindent 6 }}
- template:
- metadata:
- {{- with .Values.podAnnotations }}
- annotations:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- labels:
- {{- include "playground.selectorLabels" . | nindent 8 }}
- backend-app: "java"
- spec:
- {{- with .Values.imagePullSecrets }}
- imagePullSecrets:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- serviceAccountName: {{ include "playground.serviceAccountName" . }}
- securityContext:
- {{- toYaml .Values.podSecurityContext | nindent 8 }}
- containers:
- - name: {{ .Chart.Name }}
- securityContext:
- {{- toYaml .Values.securityContext | nindent 12 }}
- image: "{{ .Values.global.registry}}/{{ .Values.image.repository_java }}:{{ .Values.global.tag }}"
- imagePullPolicy: {{ .Values.image.pullPolicy }}
- env:
- - name: "PROTOCOL_TYPE"
- value: "TCP"
- ports:
- - name: http
- containerPort: 8080
- protocol: TCP
- resources:
- {{- toYaml .Values.resources | nindent 12 }}
- {{- with .Values.nodeSelector }}
- nodeSelector:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- {{- with .Values.affinity }}
- affinity:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- {{- with .Values.tolerations }}
- tolerations:
- {{- toYaml . | nindent 8 }}
- {{- end }}
diff --git a/playground/infrastructure/helm/templates/deployment-backend-python.yaml b/playground/infrastructure/helm/templates/deployment-backend-python.yaml
deleted file mode 100644
index 5c1eeb928e1..00000000000
--- a/playground/infrastructure/helm/templates/deployment-backend-python.yaml
+++ /dev/null
@@ -1,71 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements. See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
- name: {{ include "playground.fullname" . }}-python
- labels:
- {{- include "playground.labels" . | nindent 4 }}
-spec:
- {{- if not .Values.autoscaling.enabled }}
- replicas: {{ .Values.replicaCount }}
- {{- end }}
- selector:
- matchLabels:
- {{- include "playground.selectorLabels" . | nindent 6 }}
- template:
- metadata:
- {{- with .Values.podAnnotations }}
- annotations:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- labels:
- {{- include "playground.selectorLabels" . | nindent 8 }}
- backend-app: "python"
- spec:
- {{- with .Values.imagePullSecrets }}
- imagePullSecrets:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- serviceAccountName: {{ include "playground.serviceAccountName" . }}
- securityContext:
- {{- toYaml .Values.podSecurityContext | nindent 8 }}
- containers:
- - name: {{ .Chart.Name }}
- securityContext:
- {{- toYaml .Values.securityContext | nindent 12 }}
- image: "{{ .Values.global.registry}}/{{ .Values.image.repository_python }}:{{ .Values.global.tag }}"
- imagePullPolicy: {{ .Values.image.pullPolicy }}
- env:
- - name: "PROTOCOL_TYPE"
- value: "TCP"
- ports:
- - name: http
- containerPort: 8080
- protocol: TCP
- resources:
- {{- toYaml .Values.resources | nindent 12 }}
- {{- with .Values.nodeSelector }}
- nodeSelector:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- {{- with .Values.affinity }}
- affinity:
- {{- toYaml . | nindent 8 }}
- {{- end }}
- {{- with .Values.tolerations }}
- tolerations:
- {{- toYaml . | nindent 8 }}
- {{- end }}
diff --git a/playground/infrastructure/helm/templates/service-go.yaml b/playground/infrastructure/helm/templates/service-go.yaml
deleted file mode 100644
index 39aa2db6343..00000000000
--- a/playground/infrastructure/helm/templates/service-go.yaml
+++ /dev/null
@@ -1,32 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements. See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-apiVersion: v1
-kind: Service
-metadata:
- name: service-go
- labels:
- app: service-go
- annotations:
- cloud.google.com/neg: '{"exposed_ports": {"8081":{}}}'
-spec:
- ports:
- - name: 8080-8081
- port: 8082
- protocol: TCP
- targetPort: 8080
- selector:
- backend-app: go
- # Use LoadBalancer type instead of ClusterIP
- type: LoadBalancer
diff --git a/playground/infrastructure/helm/templates/service-java.yaml b/playground/infrastructure/helm/templates/service-java.yaml
deleted file mode 100644
index f1993d348c5..00000000000
--- a/playground/infrastructure/helm/templates/service-java.yaml
+++ /dev/null
@@ -1,32 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements. See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-apiVersion: v1
-kind: Service
-metadata:
- name: service-java
- labels:
- app: service-java
- annotations:
- cloud.google.com/neg: '{"exposed_ports": {"8081":{}}}'
-spec:
- ports:
- - name: 8080-8081
- port: 8080
- protocol: TCP
- targetPort: 8080
- selector:
- backend-app: java
- # Use LoadBalancer type instead of ClusterIP
- type: LoadBalancer
diff --git a/playground/infrastructure/helm/templates/service-python.yaml b/playground/infrastructure/helm/templates/service-python.yaml
deleted file mode 100644
index b220dcd11cf..00000000000
--- a/playground/infrastructure/helm/templates/service-python.yaml
+++ /dev/null
@@ -1,32 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements. See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-apiVersion: v1
-kind: Service
-metadata:
- name: service-python
- labels:
- app: service-python
- annotations:
- cloud.google.com/neg: '{"exposed_ports": {"8080":{}}}'
-spec:
- ports:
- - name: 8080-8081
- port: 8081
- protocol: TCP
- targetPort: 8080
- selector:
- backend-app: python
- # Use LoadBalancer type instead of ClusterIP
- type: LoadBalancer
diff --git a/playground/infrastructure/helm/templates/serviceaccount.yaml b/playground/infrastructure/helm/templates/serviceaccount.yaml
deleted file mode 100644
index fb4c05e74ee..00000000000
--- a/playground/infrastructure/helm/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements. See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
- name: {{ include "playground.serviceAccountName" . }}
- labels:
- {{- include "playground.labels" . | nindent 4 }}
- {{- with .Values.serviceAccount.annotations }}
- annotations:
- {{- toYaml . | nindent 4 }}
- {{- end }}
diff --git a/playground/infrastructure/helm/values.yaml b/playground/infrastructure/helm/values.yaml
deleted file mode 100644
index 47b45989414..00000000000
--- a/playground/infrastructure/helm/values.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one or more
-# contributor license agreements. See the NOTICE file distributed with
-# this work for additional information regarding copyright ownership.
-# The ASF licenses this file to You under the Apache License, Version 2.0
-# (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-replicaCount: 1
-
-image:
- repository_java: beam_playground-backend-java
- repository_go: beam_playground-backend-go
- repository_router: beam_playground-backend-router
- repository_python: beam_playground-backend-python
- pullPolicy: Always
- tag: "pre-beta-demo"
-
-imagePullSecrets: []
-nameOverride: ""
-fullnameOverride: ""
-
-serviceAccount:
- create: true
- annotations: {}
- name: ""
-
-podAnnotations: {}
-
-podSecurityContext: {}
-
-securityContext: {}
-
-service:
- type: NodePort
- port: 8080
-
-ingress:
- enabled: false
- className: ""
- annotations: {}
- hosts:
- - host: chart-example.local
- paths:
- - path: /
- pathType: ImplementationSpecific
- tls: []
-resources: {}
-autoscaling:
- enabled: false
- minReplicas: 1
- maxReplicas: 100
- targetCPUUtilizationPercentage: 80
-
-nodeSelector: {}
-
-tolerations: []
-
-affinity: {}
diff --git a/playground/terraform/infrastructure/setup/iam.tf b/playground/terraform/infrastructure/setup/iam.tf
index 55bfdf215d6..ff7cc5cfda8 100644
--- a/playground/terraform/infrastructure/setup/iam.tf
+++ b/playground/terraform/infrastructure/setup/iam.tf
@@ -17,36 +17,6 @@
# under the License.
#
-#resource "google_service_account" "terraform_service_account" {
-# account_id = "terraform"
-# display_name = "terraform"
-#}
-#
-#resource "google_project_iam_member" "terraform_service_account_roles" {
-# for_each = toset([
-# // TODO: add the required roles to provision resources (not OWNER :-)!)
-# ])
-# role = each.key
-# member = "serviceAccount:${google_service_account.terraform_service_account.email}"
-# project = var.project_id
-#}
-#
-#resource "google_service_account_iam_binding" "terraform_service_account_token_permissions" {
-# service_account_id = google_service_account.terraform_service_account.id
-# members = [
-# "user:${var.developer_account_email}" // TODO: add variable
-# ]
-# role = "roles/iam.serviceAccountTokenCreator"
-#}
-
-#resource "google_service_account_iam_binding" "application_service_account_binding" {
-# members = [
-# "serviceAccount:${google_service_account.terraform_service_account.email}"
-# ]
-# role = "roles/iam.serviceAccountUser"
-# service_account_id = google_service_account.playground_service_account.id
-#}
-
resource "google_service_account" "playground_service_account" {
account_id = var.service_account_id
display_name = var.service_account_id
@@ -59,7 +29,7 @@ resource "google_service_account" "playground_service_account_cf" {
resource "google_project_iam_member" "terraform_service_account_roles" {
for_each = toset([
- "roles/container.developer", "roles/artifactregistry.reader", "roles/datastore.viewer", "roles/redis.serviceAgent", "roles/redis.viewer",
+ "roles/container.nodeServiceAccount", "roles/datastore.viewer", "roles/artifactregistry.reader", "roles/logging.logWriter", "roles/monitoring.metricWriter", "roles/stackdriver.resourceMetadata.writer",
])
role = each.value
member = "serviceAccount:${google_service_account.playground_service_account.email}"