Update deployment instructions

Author: dazuma

.gcloudignore

@@ -4,5 +4,5 @@
 /apps/tanx_web/priv/static/
 /apps/tanx_web/test/
 /deps/
-/kube/
 /test/
+/tmp/

.toys.rb

@@ -127,7 +127,6 @@ def run
   flag :project, "--project=VALUE", "-p VALUE"
   flag :tag, "--tag=VALUE", "-t VALUE", default: ::Time.now.strftime("%Y-%m-%d-%H%M%S")
   flag :name, "--name=VALUE", "-n VALUE", default: "tanx"
-  flag :ip_addr, "--ip-addr=VALUE", "--ip=VALUE"
   flag :yes, "--yes", "-y"
 
   include :exec, exit_on_nonzero_status: true
@@ -141,22 +140,11 @@ def run
     puts("Building image: #{image} ...", :bold, :cyan)
     exec(["gcloud", "builds", "submit",
           "--project", project,
-          "--config", "cloudbuild.yaml",
-          "--substitutions", "_IMAGE=#{image},_BUILD_ID=#{tag}"])
-    if ip_addr
-      puts("Creating new deployment...", :bold, :cyan)
-      exec(["kubectl", "run", name, "--image", image, "--port", "8080"])
-      puts("Creating service...", :bold, :cyan)
-      cmd = ["kubectl", "expose", "deployment", name,
-             "--type", "LoadBalancer",
-             "--port", "80",
-             "--target-port", "8080"]
-      cmd.concat(["--load-balancer-ip", ip_addr]) unless ip_addr == "new"
-      exec(cmd)
-    else
-      puts("Updating deployment...", :bold, :cyan)
-      exec(["kubectl", "set", "image", "deployment/#{name}", "#{name}=#{image}"])
-    end
+          "--config", "deploy/cloudbuild.yml",
+          "--substitutions", "_BUILD_ID=#{tag}",
+          "."])
+    puts("Updating deployment...", :bold, :cyan)
+    exec(["kubectl", "set", "image", "deployment/#{name}", "#{name}=#{image}"])
     puts("Done", :bold, :cyan)
   end
 end

README.md

@@ -37,6 +37,10 @@ Google Kubernetes Engine.
 1.  Set up a project on [Google Cloud Console](http://cloud.google.com/console)
     if you don't have one, and enable billing.
 
+    Optional: Set the `PROJECT_ID` environment variable in your shell, to the
+    ID of the project you created. Some commands below will use this variable
+    substitution. (Or you can just substitue the value yourself.)
+
 2.  Install the [Google Cloud SDK](https://cloud.google.com/sdk/) on your
     workstation if you don't have it. This includes:
 
@@ -54,12 +58,13 @@ Google Kubernetes Engine.
 
 3.  Configure gcloud for your project.
 
-    1.  Set the default project:
+    1.  Set the default project. (Substitute your project ID.)
 
-            gcloud config set project *<your-project-id>*
+            gcloud config set project ${PROJECT_ID}
 
     2.  Set a default zone (i.e. data center location). I think "us-central1-c"
-        is a good one.
+        is generally a good one for much of the US, but you may choose one
+        closer to your location.
 
             gcloud config set compute/zone us-central1-c
 
@@ -75,27 +80,30 @@ Google Kubernetes Engine.
 
 ### Building
 
-We will use Google's [Container Builder](https://cloud.google.com/container-builder/)
+We will use Google's [Cloud Build](https://cloud.google.com/cloud-build/)
 service to build the Tanx application in a Docker image. Notice that there is
 a Dockerfile provided. It uses Distillery to produce an OTP release, and
 installs it in a Docker image based on bitwalker's Alpine-Erlang image. We
-will just hand this to Container Builder to build an image and upload it to
+will just hand this to Google Cloud Build to build an image and upload it to
 your project's container registry.
 
-To perform the first build:
+To perform the first build.
 
-    gcloud container builds submit --tag=gcr.io/${PROJECT_ID}/tanx:v1 .
+    gcloud builds submit --config deploy/cloudbuild.yml .
 
-Make sure you substitute your project ID. The period at the end is required; it
-is the root directory for the application you are building.
+The period at the end is required; it is the root directory for the application
+you are building.
 
-This will build your image in the cloud, and upload it to the tag you provided.
+This will build your image in the cloud, and upload it to your project's image
+registry.
 
 ### Local builds (optional)
 
-You may also build an image locally using, for example,
-`docker build -t tanx .`. Note that Docker 17.05 or later is required because
-the Dockerfile is a multistage script.
+You may also build an image locally using, for example:
+
+    docker build -f deploy/Dockerfile -t tanx .
+
+Note that Docker 17.05 or later is required.
 
 You may run a local build using:
 
@@ -106,18 +114,18 @@ container.
 
 ### Create a cluster
 
-Now we'll set up container engine to host an online tanx server.
+Now we'll set up Google Kubernetes Engine to host an online tanx server.
 
 1.  Choose a cluster name. For the rest of these instructions, I'll assume that
     name is "tanx-cluster-1".
 
 2.  Create the cluster.
 
-        gcloud container clusters create tanx-cluster-1 --machine-type=n1-highcpu-2 --num-nodes=1
+        gcloud container clusters create tanx-cluster-1 --num-nodes=2
 
-    You can of course replace the cluster name with a name of your choosing.
-    You can use a different machine type as well, although for now I recommend
-    highcpu types since the application seems CPU bound for the moment.
+    You can of course replace the cluster name with a name of your choosing, as
+    well as change the number of nodes in the cluster and the machine type.
+    For now, the defaults will get you started.
 
 3.  Configure gcloud to use your cluster as default so you don't have to
     specify it every time for the remaining gcloud commands.
@@ -126,59 +134,70 @@ Now we'll set up container engine to host an online tanx server.
 
     Replace the name if you named your cluster differently.
 
-Check the cloud console at http://cloud.google.com/console under container
-engine to see that your cluster is running. Note that once the cluster is
-running, you will be charged for the VM usage.
+4.  Check the cloud console at http://console.cloud.google.com/kubernetes to
+    make sure your cluster is running. Note that once the cluster is running,
+    you will be charged for the VM usage.
+
+5.  The app will need to access the kubernetes API so it can configure the OTP
+    cluster. To set up that access, first give yourself the ability to edit
+    your cluster's role bindings.
+
+        kubectl create clusterrolebinding my-admin-binding \
+          --clusterrole cluster-admin \
+          --user $(gcloud config get-value account)
+
+6.  Now give the necessary access to the cluster default service account. The
+    necessary role and binding objects are provided in a config file:
+
+        kubectl create -f deploy/cluster-roles.yml
 
 ### Deploy to the cluster
 
-A production deployment comprises two parts: a running phoenix container, and a
-front-end load balancer (which doesn't do much load balancing per se, but
-provides a public IP address.)
+A production deployment comprises two parts: a cluster of running containers
+managed by a Kubernetes _deployment_, and a front-end load balancer.
 
-We'll assume that you built the image to `gcr.io/${PROJECT_ID}/tanx:v1` and
-you've created the Kubernetes cluster as described above.
+We'll assume that you've built the image and created the Kubernetes cluster as
+described above.
 
-Next we'll create a deployment
+First we'll create the deployment and load balancer:
 
-    kubectl run tanx-1 --image=gcr.io/${PROJECT_ID}/tanx:v1 --port 8080
+    kubectl create -f deploy/tanx-deployment.yml
 
-This will run your image on a Kubernetes pod. You may view the running pods
-using:
+This will create the Kubernetes resources and start up containers in pods. The
+initial deployment, however, just runs nginx in a container (rather than your
+app). So next you'll need to set the image:
 
-    kubectl get pods
+    kubectl set image deployment/tanx tanx=gcr.io/${PROJECT_ID}/tanx:latest
 
-Now, we need to "expose" the application using a load balancer.
+You may view the running pods using:
 
-    kubectl expose deployment tanx-1 --type=LoadBalancer --port 80 --target-port 8080
+    kubectl get pods
 
-This creates a "service" resource pointing at your running tanx pod. After
-creating the service, run
+And the load balancer using:
 
     kubectl get service
 
-to view the service. Initially, the "external IP" will be pending while
-container engine works to procure an IP address for you. If you rerun the
-`kubectl get service` command, eventually the IP address will appear. You can
-then point your browser at that URL to view the running application.
+Initially, the "external IP" for the service will be pending while Kubernetes
+Engine works to procure an IP address for you. If you rerun the `get service`
+command, eventually the IP address will appear. You can then point your browser
+at that URL to view the running application.
 
 ### Updating the app
 
 To update the tanx app to reflect changes you have made, rebuild with a new
 version tag. For example, if your original build image was tagged
 `gcr.io/${PROJECT_ID}/tanx:v1`, you might do a new build as:
 
-    gcloud container builds submit --tag=gcr.io/${PROJECT_ID}/tanx:v2 .
+    gcloud builds submit --config deploy/cloudbuild.yml \
+      --substitutions _BUILD_ID=v2 .
 
 Now the new image `gcr.io/${PROJECT_ID}/tanx:v2` will be available in your
 project's container registry. You may deploy it by setting the pod's image
 to the new image:
 
-    kubectl set image deployment/tanx-1 tanx-1=gcr.io/${PROJECT_ID}/tanx:v2
+    kubectl set image deployment/tanx tanx=gcr.io/${PROJECT_ID}/tanx:v2
 
-This generally performs a "rolling" update for zero downtime deploys. However,
-since our service has only one instance, it simply stops and starts that single
-instance.
+This performs a "rolling" update for zero downtime deploys.
 
 ### Cleanup and tearing down a deployment
 
@@ -187,7 +206,7 @@ following.
 
 1.  Delete the service
 
-        kubectl delete service tanx-1
+        kubectl delete service tanx
 
 2.  Wait for the load balancer to go away. This may take a few minutes. You
     may watch the output of the following command to see when this is complete.

cloudbuild.yaml

@@ -0,0 +1,12 @@
+steps:
+  - name: "gcr.io/cloud-builders/docker"
+    args: ["build", "-f", "deploy/Dockerfile",
+           "-t", "gcr.io/$PROJECT_ID/tanx:$_BUILD_ID",
+           "--build-arg", "build_id=$_BUILD_ID",
+           "."]
+
+substitutions:
+  _BUILD_ID: latest
+
+images:
+  - "gcr.io/$PROJECT_ID/tanx:$_BUILD_ID"

Dockerfile renamed to deploy/Dockerfile

@@ -0,0 +1,92 @@
+apiVersion: apps/v1beta1
+kind: Deployment
+metadata:
+  name: tanx
+  labels:
+    run: tanx
+  namespace: default
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 2
+  selector:
+    matchLabels:
+      run: tanx
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        run: tanx
+    spec:
+      containers:
+      - env:
+        - name: PORT
+          value: "8080"
+        - name: REPLACE_OS_VARS
+          value: "true"
+        - name: MY_POD_IP
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: status.podIP
+        image: nginx:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /k8s/pre-stop
+              port: 8080
+              scheme: HTTP
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /k8s/live
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: tanx
+        ports:
+        - containerPort: 8080
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /k8s/ready
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 5
+          periodSeconds: 3
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: tanx
+  labels:
+    run: tanx
+  namespace: default
+spec:
+  externalTrafficPolicy: Cluster
+  ports:
+  - port: 80
+    protocol: TCP
+    targetPort: 8080
+  selector:
+    run: tanx
+  sessionAffinity: None
+  type: LoadBalancer