zorya
Schedule GCE Instances, Cloud SQL and GKE node pools
In Slavic mythology, Zoryas are two guardian goddesses. The Zoryas represent the morning star and the evening star,โโโif you have read or watched Neil Gaimanโs American Gods, you will probably remember these sisters).
Installation
pip install -r requirements.txt -t lib
Next step: Download and install Yarn.
Known Issues for Installation
-
Deployment from Google Cloud Shell fails with an error #25.
-
Building on macOS running on Apple Silicon (arm M1) may fail due to issues building grpcio. Use the following workaround:
GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=1 \ GRPC_PYTHON_BUILD_SYSTEM_ZLIB=1 \ pip install -r requirements.txt -t lib
Enable required GCP APIs:
- Cloud Tasks
- App Engine
- Cloud Storage
- Datastore
- IAP
- Cloud Build
- Cloud Scheduler
- Compute Engine
- Cloud SQL Admin API
Deploy Backend and GUI:
./deploy.sh project-id
Access the app
gcloud app browse
WARNING: By default this application is public; ensure you turn on IAP, as follows:
To sign into the app, we are using Cloud Identity-Aware Proxy (Cloud IAP). Cloud IAP works by verifying a userโs identity and determining if that user should be allowed to access the application. The setup is as simple as heading over to GCP console, enabling IAP on your GAE app and adding the users who should have access to it.
Authorization
For Zorya to work, its service account requires the folling roles:
- Cloud Tasks Enqueuer
- Cloud Datastore User
- Logs Writer
For any project that Zorya is supposed to be managing resources for, Zorya's service account requires the following additional roles:
- Compute Instance Admin (v1)
- Kubernetes Engine Cluster Admin
- Cloud SQL Editor
The name of the service account you will need to assign permissions to is as following:<YOUR_PROJECT_ID>@appspot.gserviceaccount.com and will have been automatically created by Google App Engine. NOTE: this is done under IAM, selecting the account, choosing Permissions and then adding the roles above to it; not under Service Accounts.
Flow
- Every hour on the hour a cron job calls
/tasks/schedulewhich loop over all the policies - We are checking the desired state vs the previous hour desired state of Zorya states. If they are not the same we will apply the change.
Creating a Schedule
Creating a Policy
App Engine Flex is now supported - in order to add an App engine flex to the policy please look at Adding GAE Flex to Zorya policy.