Add scaffolding to stand up Trillian on k8s.

.github/workflows/kind-scaffolding-e2e-createtree.yml

@@ -0,0 +1,78 @@
+name: Kind scaffolding test
+
+on:
+ pull_request:
+ branches: [ 'main', 'release-*' ]
+
+permissions: read-all
+
+jobs:
+ e2e-tests:
+ name: test tree creation with scaffolding
+ runs-on: ubuntu-latest
+
+ strategy:
+ fail-fast: false # Keep running if one leg fails.
+ matrix:
+ k8s-version:
+ - v1.22.x
+ - v1.23.x
+ - v1.24.x
+ - v1.25.x
+
+ env:
+ REGISTRY_NAME: registry.local
+ REGISTRY_PORT: 5000
+ KO_DOCKER_REPO: registry.local:5000/trillian
+
+ steps:
+ - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v2.4.0
+ - uses: actions/setup-go@b22fbbc2921299758641fab08929b4ac52b32923 # v2.2.0
+ with:
+ go-version: '1.19'
+ check-latest: true
+
+ - uses: ko-build/[email protected]
+
+ - name: Install yq
+ uses: mikefarah/yq@70403375d7b96075bd68b40c434807cff1593568 # v4.25.1
+
+ - name: Setup mirror
+ uses: chainguard-dev/actions/setup-mirror@main
+ with:
+ mirror: mirror.gcr.io
+
+ - name: Setup kind cluster
+ uses: chainguard-dev/actions/setup-kind@main
+ with:
+ k8s-version: ${{ matrix.k8s-version }}
+ cluster-suffix: c${{ github.run_id }}.local
+
+ - name: Setup knative
+ uses: chainguard-dev/actions/setup-knative@main
+ with:
+ k8s-version: ${{ matrix.k8s-version }}
+ cluster-suffix: c${{ github.run_id }}.local
+
+ - name: Install Trillian
+ run: |
+ echo '::group:: install Trillian scaffolding'
+ ko apply -BRf ./examples/deployment/kubernetes/scaffolding
+ echo '::endgroup::'
+ echo '::group:::' waiting for services to come up
+ kubectl wait -n trillian-system --for=condition=Ready --timeout=5m ksvc --all
+ echo '::endgroup::'
+
+ - name: Create a tree on it
+ run: |
+ echo '::group:: install create tree job'
+ kubectl apply -Rf ./examples/deployment/kubernetes/createtree
+ echo '::endgroup::'
+ echo '::group:::' waiting for job to complete'
+ kubectl wait -n createtree --for=condition=Complete --timeout=5m jobs createtree
+ echo '::endgroup::'
+ kubectl -n createtree get cm trillian-tree -ojsonpath='{.data.treeID}'
+
+ - name: Collect diagnostics
+ if: ${{ failure() }}
+ uses: chainguard-dev/actions/kind-diag@84c993eaf02da1c325854fb272a4df9184bd80fc # main

cmd/createtree-k8s/main.go

@@ -0,0 +1,149 @@
+// Copyright 2023 Google LLC. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package main contains the implementation and entry point for the
+// creating a tree in Trillian and adding it into a ConfigMap.
+// More details and use cases are in:
+// ../../examples/deployment/kubernetes/README-SCAFFOLDING.md
+package main
+
+import (
+ "context"
+ "flag"
+ "fmt"
+ "time"
+
+ "github.com/google/trillian"
+ "github.com/google/trillian/client"
+ "github.com/google/trillian/client/rpcflags"
+ "github.com/pkg/errors"
+ "google.golang.org/grpc"
+ "google.golang.org/protobuf/types/known/durationpb"
+ metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+ "k8s.io/client-go/kubernetes"
+ "k8s.io/client-go/rest"
+ "knative.dev/pkg/logging"
+ "knative.dev/pkg/signals"
+ "sigs.k8s.io/release-utils/version"
+)
+
+const (
+ // Key in the configmap holding the value of the tree.
+ treeKey = "treeID"
+)
+
+var (
+ ns = flag.String("namespace", "", "Namespace where to update the configmap in")
+ cmname = flag.String("configmap", "", "Name of the configmap where the treeID lives")
+ adminServerAddr = flag.String("admin_server", "log-server.trillian-system.svc:80", "Address of the gRPC Trillian Admin Server (host:port)")
+ treeState = flag.String("tree_state", trillian.TreeState_ACTIVE.String(), "State of the new tree")
+ treeType = flag.String("tree_type", trillian.TreeType_LOG.String(), "Type of the new tree")
+ displayName = flag.String("display_name", "", "Display name of the new tree")
+ description = flag.String("description", "", "Description of the new tree")
+ maxRootDuration = flag.Duration("max_root_duration", time.Hour, "Interval after which a new signed root is produced despite no submissions; zero means never")
+ force = flag.Bool("force", false, "Force create a new tree and update configmap")
+)
+
+func main() {
+ flag.Parse()
+ ctx := signals.NewContext()
+ if *ns == "" {
+ logging.FromContext(ctx).Fatal("Need to specify --namespace for where to update the configmap in")
+ }
+ if *cmname == "" {
+ logging.FromContext(ctx).Fatal("Need to specify --configmap for which configmap to update")
+ }
+
+ versionInfo := version.GetVersionInfo()
+ logging.FromContext(ctx).Infof("running Version: %s GitCommit: %s BuildDate: %s", versionInfo.GitVersion, versionInfo.GitCommit, versionInfo.BuildDate)
+
+ config, err := rest.InClusterConfig()
+ if err != nil {
+ logging.FromContext(ctx).Fatalf("Failed to get InClusterConfig: %v", err)
+ }
+ clientset, err := kubernetes.NewForConfig(config)
+ if err != nil {
+ logging.FromContext(ctx).Fatalf("Failed to get clientset: %v", err)
+ }
+ cm, err := clientset.CoreV1().ConfigMaps(*ns).Get(ctx, *cmname, metav1.GetOptions{})
+ if err != nil {
+ logging.FromContext(ctx).Fatalf("Failed to get the configmap %s/%s: %v", *ns, *cmname, err)
+ }
+
+ if cm.Data == nil {
+ cm.Data = make(map[string]string)
+ }
+ if treeID, ok := cm.Data[treeKey]; ok && !*force {
+ logging.FromContext(ctx).Infof("Found existing TreeID: %s", treeID)
+ return
+ }
+
+ tree, err := createTree(ctx)
+ if err != nil {
+ logging.FromContext(ctx).Fatalf("Failed to create the trillian tree: %v", err)
+ }
+ cm.Data[treeKey] = fmt.Sprint(tree.TreeId)
+ logging.FromContext(ctx).Infof("Created a new tree %d updating configmap %s/%s", tree.TreeId, *ns, *cmname)
+
+ _, err = clientset.CoreV1().ConfigMaps(*ns).Update(ctx, cm, metav1.UpdateOptions{})
+ if err != nil {
+ logging.FromContext(ctx).Fatalf("Failed to update the configmap: %v", err)
+ }
+}
+
+func createTree(ctx context.Context) (*trillian.Tree, error) {
+ req, err := newRequest(ctx)
+ if err != nil {
+ return nil, err
+ }
+
+ dialOpts, err := rpcflags.NewClientDialOptionsFromFlags()
+ if err != nil {
+ return nil, errors.Wrap(err, "failed to determine dial options")
+ }
+
+ conn, err := grpc.Dial(*adminServerAddr, dialOpts...)
+ if err != nil {
+ return nil, errors.Wrap(err, "failed to dial")
+ }
+ defer conn.Close()
+
+ adminClient := trillian.NewTrillianAdminClient(conn)
+ logClient := trillian.NewTrillianLogClient(conn)
+
+ return client.CreateAndInitTree(ctx, req, adminClient, logClient)
+}
+
+func newRequest(ctx context.Context) (*trillian.CreateTreeRequest, error) {
+ ts, ok := trillian.TreeState_value[*treeState]
+ if !ok {
+ return nil, fmt.Errorf("unknown TreeState: %v", *treeState)
+ }
+
+ tt, ok := trillian.TreeType_value[*treeType]
+ if !ok {
+ return nil, fmt.Errorf("unknown TreeType: %v", *treeType)
+ }
+
+ ctr := &trillian.CreateTreeRequest{Tree: &trillian.Tree{
+ TreeState: trillian.TreeState(ts),
+ TreeType: trillian.TreeType(tt),
+ DisplayName: *displayName,
+ Description: *description,
+ MaxRootDuration: durationpb.New(*maxRootDuration),
+ }}
+ logging.FromContext(ctx).Infof("Creating Tree: %+v", ctr.Tree)
+
+ return ctr, nil
+}

examples/deployment/kubernetes/README-SCAFFOLDING.md

@@ -0,0 +1,65 @@
+# Deploying onto Kubernetes
+
+This document guides you through the process of spinning up an example Trillian
+deployment on Kubernetes cluster with [Knative](https://knative.dev/docs/)
+installed. It's suitable for GitHub action based e2e tests
+as well as local testing using something like kind cluster.
+
+## Prerequisites
+
+1. You should have this repo checked out :)
+1. A Kubernetes cluster with [Knative](https://knative.dev/docs/) installed. One
+example for installing local kind cluster with Knative is
+[here](https:/sigstore/scaffolding/blob/main/getting-started.md#running-locally-on-kind)
+and ignoring the sigstore parts after installing the cluster.
+1. [ko](https:/google/ko) installed.
+1. You have `kubectl` installed.
+
+## Process
+
+1. Create the scaffolding parts of the Trillian system.
+```shell
+kubectl apply -Rf ./examples/deployment/kubernetes/scaffolding
+```
+This spins up a namespace `trillian-system` where it deploys
+the following components:
+ * log-signer
+ * log-server
+ * mysql server
+2. Let's make sure everything comes up ready:
+```shell
+kubectl wait -n trillian-system --for=condition=Ready --timeout=5m ksvc --all
+```
+
+You should see something like this:
+```shell
+vaikas@villes-mbp scaffolding % kubectl wait -n trillian-system --for=condition=Ready --timeout=5m ksvc --all
+service.serving.knative.dev/log-server condition met
+service.serving.knative.dev/log-signer condition met
+```
+3. Then create a tree in the Trillian:
+```shell
+ko apply -BRf ./examples/deployment/kubernetes/createtree
+```
+
+And make sure it completes.
+
+```shell
+kubectl wait -n createtree --for=condition=Complete --timeout=5m jobs createtree
+```
+
+4. Check out the tree:
+```shell
+kubectl -n createtree get cm trillian-tree -ojsonpath='{.data.treeID}'
+```
+
+You should see something like this:
+```shell
+vaikas@villes-mbp scaffolding % kubectl -n createtree get cm trillian-tree -ojsonpath='{.data.treeID}'
+5213139395739357930%
+```
+
+5. You can then use the TreeID for example to run CTLog on
+top of newly created Trillian.
+
+6. TODO: Add examples for talking to Trillian for other things.

examples/deployment/kubernetes/createtree/100-namespace.yaml

@@ -0,0 +1,4 @@
+kind: Namespace
+apiVersion: v1
+metadata:
+ name: createtree

examples/deployment/kubernetes/createtree/101-binding.yaml

@@ -0,0 +1,24 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ namespace: createtree
+ name: cm-operator
+rules:
+- apiGroups: [""] # "" indicates the core API group
+ resources: ["configmaps"]
+ resourceNames: ["trillian-tree"]
+ verbs: ["get", "update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: role-cm-updater
+ namespace: createtree
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: Role
+ name: cm-operator
+subjects:
+- kind: ServiceAccount
+ name: createtree
+ namespace: createtree

examples/deployment/kubernetes/createtree/101-configmap.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: trillian-tree
+ namespace: createtree
+data:
+ __placeholder: |
+ ###################################################################
+ # Just a placeholder so that reapplying this won't overwrite treeID
+ # if it already exists. This caused grief, do not remove.
+ ###################################################################
+

examples/deployment/kubernetes/createtree/101-service-account.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: createtree
+ namespace: createtree

examples/deployment/kubernetes/createtree/300-createtree.yaml

@@ -0,0 +1,18 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+ name: createtree
+ namespace: createtree
+spec:
+ template:
+ spec:
+ serviceAccountName: createtree
+ restartPolicy: Never
+ containers:
+ - name: createtree
+ image: ko:/google/trillian/cmd/createtree-k8s
+ args: [
+ "--namespace=createtree",
+ "--configmap=trillian-tree",
+ "--display_name=ctlogtree"
+ ]

examples/deployment/kubernetes/scaffolding/log-server/100-namespace.yaml

@@ -0,0 +1,4 @@
+kind: Namespace
+apiVersion: v1
+metadata:
+ name: trillian-system