Skip to content

Commit 39d6bb4

Browse files
Timo-1Timo-1
authored
Merge pull request #70 from ibm-hyper-protect/sample-daytrader
Daytrader sample
2 parents 0588238 + 396af1b commit 39d6bb4

File tree

5 files changed

+186
-0
lines changed

5 files changed

+186
-0
lines changed

‎terraform-hpvs/sample-daytrader/README.md‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
## Contract generation example for the Daytrader sample application
2+
3+
This sample creates an encrypted and signed contract and stores it locally in a file. You can later use the contract to provision a HPVS for VPC instance.
4+
The contract will define the container image, the container registry and the credentials for pulling your workload container image.
5+
6+
### Build the daytrader sample application
7+
On LinuxONE, e.g. a virtual server for VPC with s390x architecture, build the container image for the DayTrader sample application.
8+
9+
To do so, clone or [download](https://github.com/OpenLiberty/sample.daytrader8/archive/master.zip) this [repository](https://github.com/OpenLiberty/sample.daytrader8/).
10+
11+
From inside the sample.daytrader8 directory, build the application with the following commands:
12+
```
13+
mvn clean package
14+
docker build . -t daytrader:s390x
15+
```
16+
17+
Then tag and push the resulting container image to your container registry.
18+
19+
### Prerequisite
20+
21+
Prepare your local environment according to [these steps](../README.md)
22+
23+
### Define your settings
24+
25+
Define your settings:
26+
- logdna_ingestion_hostname: The ingestion host name of your Log instance which you provisioned previously
27+
- logdna_ingestion_key: The ingestion key of your Log instance
28+
- registry: The container registry where the workload container image is pulled from, e.g. `us.icr.io`
29+
- pull_username: The container registry username for pulling your workload container image
30+
- pull_password: The container registry password for pulling your workload container image
31+
32+
The settings are defined in form of Terraform variables.
33+
34+
Define the variables in a template file:
35+
36+
1. `cp my-settings.auto.tfvars-template my-settings.auto.tfvars`
37+
2. Fill the values in `my-settings.auto.tfvars`
38+
39+
### Define your workload
40+
41+
Create the file `compose\pod.yml` for your workload. Adapt the value for `image` to reference your container registry and your container image including the digest, e.g.:
42+
43+
```
44+
apiVersion: v1
45+
kind: Pod
46+
metadata:
47+
name: daytrader
48+
spec:
49+
containers:
50+
- name: daytrader
51+
image: us.icr.io/sample/daytrader@sha256:5f4f20aee41e27858a8ed320faed6c2eb8b62dd4bf3e1737f54575a756c7a5da
52+
ports:
53+
- containerPort: 9080
54+
hostPort: 9080
55+
protocol: tcp
56+
```
57+
58+
### Create the contract
59+
60+
```bash
61+
terraform init
62+
terraform apply
63+
```
64+
65+
### Further steps
66+
67+
The contract will be written to the file `build/contract.yml` and can now be used for e.g. provisining a HPVS for VPC instance.
68+
69+
Note that you will need to create a public gateway in your VPC before creating the HPVS for VPC instance. This is necessary to allow the HPVS for VPC instance to reach your Log instance through the public gateway. Also assign a floating IP to your HPVS for VPC instance.
70+
71+
Once the instance is started, you can access the application at: `http://<floatingip>:9080/daytrader`
72+
73+
After provisioning the HPVS for VPC instance you can use JMeter to test your daytrader application. To do so follow [these instructions](https://github.com/OpenLiberty/sample.daytrader8/blob/main/README_LOAD_TEST.md).

‎terraform-hpvs/sample-daytrader/compose/pod.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: daytrader
5+
spec:
6+
containers:
7+
- name: daytrader10
8+
image: us.icr.io/sample/daytrader@sha256:5f4f20aee41e27858a8ed320faed6c2eb8b62dd4bf3e1737f54575a756c7a5da
9+
ports:
10+
- containerPort: 9080
11+
hostPort: 9080
12+
protocol: tcp

‎terraform-hpvs/sample-daytrader/my-settings.auto.tfvars-template‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
logdna_ingestion_key="Your LogDNA ingestion key" # You can find this in "Linux/ubuntu" section of `Logging sources` tab of "IBM Log Analysis" instance in [cloud.ibm.com](https://cloud.ibm.com)
2+
logdna_ingestion_hostname="rsyslog endpoint of IBM Log Analysis instance" # Example: "syslog-a.<log_region>.logging.cloud.ibm.com". Where <log_region> is the region on which IBM Log Analysis is deployed
3+
registry="Prefix for the dynamic registry" # e.g. docker.io/library or us.icr.io
4+
pull_username="Username for registry" # Username with read access to the container registry
5+
pull_password="Password for registry" # Password with read access to the container registry

‎terraform-hpvs/sample-daytrader/terraform.tf‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
terraform {
2+
required_providers {
3+
hpcr = {
4+
source = "ibm-hyper-protect/hpcr"
5+
version = ">= 0.1.6"
6+
}
7+
}
8+
}
9+
10+
# archive of the folder containing the pod.yml file. This folder could create additional resources such as files
11+
# to be mounted into containers, environment files etc. This is why all of these files get bundled in a tgz file (base64 encoded)
12+
resource "hpcr_tgz" "contract" {
13+
folder = "compose"
14+
}
15+
16+
locals {
17+
# contract in clear text
18+
contract = yamlencode({
19+
"env" : {
20+
"type" : "env",
21+
"logging" : {
22+
"logDNA" : {
23+
"ingestionKey" : var.logdna_ingestion_key,
24+
"hostname" : var.logdna_ingestion_hostname,
25+
}
26+
},
27+
"auths" : {
28+
(var.registry) : {
29+
"username" : var.pull_username,
30+
"password" : var.pull_password
31+
}
32+
},
33+
"env" : {
34+
"REGISTRY" : var.registry
35+
}
36+
},
37+
"workload" : {
38+
"type" : "workload",
39+
"play" : {
40+
"archive" : hpcr_tgz.contract.rendered
41+
}
42+
}
43+
})
44+
}
45+
46+
# In this step we encrypt the fields of the contract and sign the env and workload field. The certificate to execute the
47+
# encryption it built into the provider and matches the latest HPCR image. If required it can be overridden.
48+
# We use a temporary, random keypair to execute the signature. This could also be overriden.
49+
resource "hpcr_contract_encrypted" "contract" {
50+
contract = local.contract
51+
}
52+
53+
resource "local_file" "contract" {
54+
content = hpcr_contract_encrypted.contract.rendered
55+
filename = "${path.module}/build/contract.yml"
56+
}

‎terraform-hpvs/sample-daytrader/variables.tf‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
variable "logdna_ingestion_key" {
2+
type = string
3+
sensitive = true
4+
description = <<-DESC
5+
Ingestion key for IBM Log Analysis instance. This can be
6+
obtained from "Linux/Ubuntu" section of "Logging resource"
7+
tab of IBM Log Analysis instance
8+
DESC
9+
}
10+
11+
variable "logdna_ingestion_hostname" {
12+
type = string
13+
description = <<-DESC
14+
rsyslog endpoint of IBM Log Analysis instance.
15+
Don't include the port. Example:
16+
syslog-a.<log_region>.logging.cloud.ibm.com
17+
log_region is the region where IBM Log Analysis is deployed
18+
DESC
19+
}
20+
21+
variable "registry" {
22+
type = string
23+
description = <<-DESC
24+
Prefix of the container registry used to pull the image
25+
DESC
26+
}
27+
28+
variable "pull_username" {
29+
type = string
30+
description = <<-DESC
31+
Username to pull from the above registry
32+
DESC
33+
}
34+
35+
variable "pull_password" {
36+
type = string
37+
description = <<-DESC
38+
Password to pull from the above registry
39+
DESC
40+
}

0 commit comments

Comments
 (0)