mirror of
https://github.com/google/nomulus.git
synced 2025-06-03 11:07:34 +02:00
84eab90000
When not running locally, the logging formatter is set to convert the log record to a single-line JSON string that Stackdriver logging agent running in GKE will pick up and parse correctly. Also removed redundant logging handler in the proxy frontend connection. They have two problems: 1) it is possible to leak PII when all frontend traffic is logged, such as client IPs. Even though this is less of a concern because the GCP TCP proxy load balancer masquerade source IPs. 2) We are only logging the HTTP request/response that the frontend connection is sending to/receiving from the backend connection, but the backend already has its own logging handler to log the same message that it gets from/sends to the GAE app, so the logging in the frontend connection does not really give extra information. Logging of some potential PII information such as the source IP of a proxied connection are also removed. Thirdly, added a k8s autoscaling object that scales the containers based on CPU load. The default target load is 80%. This, in connection with GKE cluster VM autoscaling, means that when traffic is low, we'll only have one VM running one container of the proxy. Fixes a bug where the MetricsComponent generates a separate ProxyConfig that does not call parse method on the command line args passed, resulting default Environment always being used in constructing the metric reporter. Lastly a little bit of cleaning of the MOE config script, no newlines are necessary as the BUILD are formatted after string substitution. ------------- Created by MOE: https://github.com/google/moe MOE_MIGRATED_REVID=188029019
48 lines
1.1 KiB
YAML
48 lines
1.1 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: proxy-deployment
|
|
labels:
|
|
app: proxy
|
|
spec:
|
|
replicas: 3
|
|
selector:
|
|
matchLabels:
|
|
app: proxy
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: proxy
|
|
spec:
|
|
volumes:
|
|
- name: service-account
|
|
secret:
|
|
secretName: proxy-account
|
|
containers:
|
|
- name: proxy
|
|
image: gcr.io/GCP_PROJECT/IMAGE_NAME:bazel
|
|
ports:
|
|
- containerPort: 30000
|
|
name: health-check
|
|
- containerPort: 30001
|
|
name: whois
|
|
- containerPort: 30002
|
|
name: epp
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: health-check
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: health-check
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 20
|
|
volumeMounts:
|
|
- name: service-account
|
|
mountPath: /var/secrets/google
|
|
imagePullPolicy: Always
|
|
args: ["--env", "alpha", "--log"]
|
|
env:
|
|
- name: GOOGLE_APPLICATION_CREDENTIALS
|
|
value: /var/secrets/google/service-account.json
|