-
Notifications
You must be signed in to change notification settings - Fork 502
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
services/horizon/docker/ledgerexporter: deploy ledgerexporter image as service #4490
Changes from 7 commits
846c6fc
cdd60d5
2cc3a3d
b1589f0
466b366
433ed4f
ffd3990
873e79f
b56e089
2c8589c
f0321b6
6c95fe8
452b20c
eebaedd
a02547b
415950e
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -121,7 +121,6 @@ func (b *S3ArchiveBackend) PutFile(pth string, in io.ReadCloser) error { | |
params := &s3.PutObjectInput{ | ||
Bucket: aws.String(b.bucket), | ||
Key: aws.String(key), | ||
ACL: aws.String(s3.ObjectCannedACLPublicRead), | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Current txmeta bucket uses policy for auth, which requires credentials(access key/id) from an IAM principal(I initially used a user in the AWS account, need to create a non-user service account) but when using policy on s3 bucket, it can trigger auth error if explicit ACLs are set by client when updating the bucket, and this ACL was causing I can either change the new txmeta bucket to be ACL based and revert this, or we go with the AWS recommendation on s3 bucket policy and migrate existing buckets by adding a policy to them which has Allow statement There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I went with alternative approach and added ACL config option - 452b20c, this way client can work with buckets in either permissions config. |
||
Body: bytes.NewReader(buf.Bytes()), | ||
} | ||
req, _ := b.svc.PutObjectRequest(params) | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,30 @@ | ||
PEER_PORT=11725 | ||
DATABASE = "sqlite3:///cc/stellar.db" | ||
|
||
UNSAFE_QUORUM=true | ||
FAILURE_SAFETY=1 | ||
|
||
[[HOME_DOMAINS]] | ||
HOME_DOMAIN="testnet.stellar.org" | ||
QUALITY="HIGH" | ||
|
||
[[VALIDATORS]] | ||
NAME="sdf_testnet_1" | ||
HOME_DOMAIN="testnet.stellar.org" | ||
PUBLIC_KEY="GDKXE2OZMJIPOSLNA6N6F2BVCI3O777I2OOC4BV7VOYUEHYX7RTRYA7Y" | ||
ADDRESS="core-testnet1.stellar.org" | ||
HISTORY="curl -sf http://history.stellar.org/prd/core-testnet/core_testnet_001/{0} -o {1}" | ||
|
||
[[VALIDATORS]] | ||
NAME="sdf_testnet_2" | ||
HOME_DOMAIN="testnet.stellar.org" | ||
PUBLIC_KEY="GCUCJTIYXSOXKBSNFGNFWW5MUQ54HKRPGJUTQFJ5RQXZXNOLNXYDHRAP" | ||
ADDRESS="core-testnet2.stellar.org" | ||
HISTORY="curl -sf http://history.stellar.org/prd/core-testnet/core_testnet_002/{0} -o {1}" | ||
|
||
[[VALIDATORS]] | ||
NAME="sdf_testnet_3" | ||
HOME_DOMAIN="testnet.stellar.org" | ||
PUBLIC_KEY="GC2V2EFSXN6SQTWVYA5EPJPBWWIMSD2XQNKUOHGEKB535AQE2I6IXV2Z" | ||
ADDRESS="core-testnet3.stellar.org" | ||
HISTORY="curl -sf http://history.stellar.org/prd/core-testnet/core_testnet_003/{0} -o {1}" |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,92 @@ | ||
# this file contains the ledgerexporter deployment and it's config artifacts. | ||
# when importing the manifest with kubectl, will only create, skips any that already exist. | ||
# | ||
# make sure to include namespace destination, the manifest does not specify, | ||
# otherwise it'll go in your current kubectl context. | ||
# | ||
# if defining the secrets for first time, substitue <base64 encoded value here> placeholders. | ||
# | ||
# $ kubectl create -f ledgerexporter.yml -n horizon-dev | ||
apiVersion: v1 | ||
kind: ConfigMap | ||
metadata: | ||
annotations: | ||
fluxcd.io/ignore: "true" | ||
labels: | ||
app: ledgerexporter | ||
name: ledgerexporter-pubnet-env | ||
data: | ||
START: "2" | ||
END: "0" | ||
# can only have CONTINUE or START set, not both. | ||
#CONTINUE: "true" | ||
WRITE_LATEST_PATH: "true" | ||
sreuland marked this conversation as resolved.
Show resolved
Hide resolved
|
||
CAPTIVE_CORE_USE_DB: "true" | ||
HISTORY_ARCHIVE_URLS: "https://history.stellar.org/prd/core-live/core_live_001,https://history.stellar.org/prd/core-live/core_live_002,https://history.stellar.org/prd/core-live/core_live_003" | ||
NETWORK_PASSPHRASE: "Public Global Stellar Network ; September 2015" | ||
ARCHIVE_TARGET: "s3://horizon-ledgermeta-pubnet" | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. i've config'd the horizon-ledgermeta-pubnet bucket in same AWS account as Batch, with There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. You mean you changed the existing bucket settings? Unfortunately the S3-writing code (HistoryArchive) code assumes ACLs are enabled (because it writes them). That's why they where enabled. I am not against the change but then we should also change the writing code. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I haven't changed any existing bucket permissions, but this looks fairly constrained on ACL usage though, only one place in s3 writing code sets the object ACL to include So, the net seems to be in identifying how many existing buckets which could have been written to by this routine in There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I updated approach and added ACL config option on s3 - 452b20c, this way client can work with buckets in either permissions config. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @2opremio , I added more to permissions on I noticed slight diff on their main config, horizon-ledgermeta-prodnet-test had |
||
--- | ||
apiVersion: v1 | ||
kind: Secret | ||
metadata: | ||
labels: | ||
app: ledgerexporter | ||
name: ledgerexporter-pubnet-secret | ||
type: Opaque | ||
data: | ||
AWS_REGION: <base64 encoded value here> | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. AWS credentials get loaded into the cluster as secrets, which deployment pulls into ledgerexporter container as env variables. |
||
AWS_ACCESS_KEY_ID: <base64 encoded value here> | ||
AWS_SECRET_ACCESS_KEY: <base64 encoded value here> | ||
--- | ||
apiVersion: apps/v1 | ||
kind: Deployment | ||
metadata: | ||
annotations: | ||
fluxcd.io/ignore: "true" | ||
deployment.kubernetes.io/revision: "3" | ||
labels: | ||
app: ledgerexporter | ||
name: ledgerexporter-deployment | ||
spec: | ||
selector: | ||
matchLabels: | ||
app: ledgerexporter | ||
replicas: 1 | ||
template: | ||
metadata: | ||
annotations: | ||
fluxcd.io/ignore: "true" | ||
# if we expect to add metrics at some point to ledgerexporter | ||
# this just needs to be set to true | ||
prometheus.io/port: "6060" | ||
prometheus.io/scrape: "false" | ||
labels: | ||
app: ledgerexporter | ||
spec: | ||
containers: | ||
- envFrom: | ||
- secretRef: | ||
name: ledgerexporter-pubnet-secret | ||
- configMapRef: | ||
name: ledgerexporter-pubnet-env | ||
image: stellar/horizon-ledgerexporter:latest | ||
imagePullPolicy: Always | ||
name: ledgerexporter | ||
resources: | ||
limits: | ||
cpu: 1 | ||
memory: 4Gi | ||
requests: | ||
cpu: 250m | ||
memory: 500m | ||
volumeMounts: | ||
- mountPath: /cc | ||
name: tempfs-volume | ||
dnsPolicy: ClusterFirst | ||
volumes: | ||
- name: tempfs-volume | ||
emptyDir: | ||
medium: Memory | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. captive core's on-disk db(stellar.db) will be on this tempfs RAM drive There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. scratch that, after further testing on cluster, found the tempfs ram was not suitable/stable for captive core on-disk db usage, the size of this volume is derived from the underlying host k8s node RAM, and is limited by default to half, so, it's variable, anytime the pod restarts it could end up running on a diff node with different RAM and I saw a few OOMKilled due to this, switched volume to use a PV/PVC. |
||
|
||
|
||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
during testing with END=0, ran into this as it was stopping before generation anything
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good catch