relaycorp / awala-pong Goto Github PK
View Code? Open in Web Editor NEWAwala Ping Service Application (pong messages only)
License: GNU Affero General Public License v3.0
Awala Ping Service Application (pong messages only)
License: GNU Affero General Public License v3.0
Using relaycorp/relaynet-pohttp-js#3
Send them using fire-and-forget from current process. In the future, these should probably be send to a queue like Amazon SQS.
We'll probably have to use a service like https://requestbin.fullcontact.com/ to test that things work.
The objective here is to deploy the app to GCP, but leverage Kubernetes as much as possible to avoid vendor lock-in.
We're currently creating a mock HTTP server that mimics the gateway and runs on the host computer, so the Pong queue can't reach it from within Kubernetes.
Instead of finding an awful workaround to make this mock server reachable from a pod, we should just deploy the public gateway. This is essentially what we're already doing in the Relaynet-Internet Gateway functional test suite: We're deploying both apps locally, and then using a PoWeb client to communicate with the Pong app.
Once we do this, we should also ditch Circle CI and move the functional test suite run into the existing GitHub Actions workflow.
To receive ping messages.
The scope of this ticket is to return the appropriate HTTP response per PoHTTP, without actually processing the parcel -- That'd be part of #2.
Then remove the implementation from the core lib as this is the last place where it's used.
This will require changing relaynet-pong to expose a script to do this and also relaynet-core-js to expose the certificate serial number in SessionlessEnvelopedData
values.
Bull v3 only supports JSON serialization, so we have to base64-encode binary data like the service message in the parcel: OptimalBits/bull#1411
However, this is too inefficient performance- and storage-wise, so we should find a way to store buffers instead. Bull v4 may support that per the issue above.
See counterpart: relaycorp/awala-ping-desktop#6
Specifying the current endpoint id in the ENDPOINT_KEY_ID
environment variable makes it extremely cumbersome to bootstrap a new environment or do key rotation, so we should store that pointer to the current key id in a persistent data store like etcd or MongoDB.
ConfigMap
library. See relaycorp/cloud-gateway#87I struggled to get this to work in #16 so I left the CircleCI job in .circleci/config.yml
but disabled it.
For some reason it seems to get stuck at trying to compile the TS -> JS; e.g.: https://app.circleci.com/jobs/github/relaycorp/relaynet-pong/123
See also:
To make sure we use tini when deploying the image on k8s.
Using OpenCensus unless OpenTelemetry is production-ready.
Data will be pushed to Datadog.
So that we can ditch Vault in production and use GCP KMS instead.
For consistency with other Relaycorp server-side apps and to make it possible to use Kubernetes-specific functionality (needed for #26, for example).
The current implementation only supports one key pair at a time and the private key should be specified in the environment, which makes it hard to deploy and operate this app securely.
To solve this, we should integrate Hashicorp Vault, possibly along with istio to avoid having to manage Vault client credentials.
We're getting the following in prod after regenerating the key (relaycorp/cloud-pong#5):
UnknownKeyError: Key is not a node key
at VaultPrivateKeyStore.fetchNodeKey (/opt/pong/node_modules/@relaycorp/relaynet-core/build/main/lib/keyStores/privateKeyStore.js:30:19)
at processTicksAndRejections (internal/process/task_queues.js:94:5)
https://console.cloud.google.com/errors/CLzLyfK1oNKuLg?time=P30D&project=relaycorp-cloud-ping
They should be rotated every 6 months.
We could use a k8s CronJob.
Not sure when they broke, but they don't work with 5feabd8 at least. 56a2a0e may be the culprit, considering the error:
gateway_1 | FAIL build/main/functional_tests/main.test.js
gateway_1 | โ Test suite failed to run
gateway_1 |
gateway_1 | Cannot find module '@relaycorp/keystore-vault' from 'main.test.js'
gateway_1 |
gateway_1 | 1 | /* tslint:disable:no-let */
gateway_1 | > 2 | import { VaultPrivateKeyStore } from '@relaycorp/keystore-vault';
gateway_1 | | ^
gateway_1 | 3 | import {
gateway_1 | 4 | Certificate,
gateway_1 | 5 | EnvelopedData,
gateway_1 |
gateway_1 | at Resolver.resolveModule (node_modules/jest-resolve/build/index.js:259:17)
gateway_1 | at Object.<anonymous> (src/functional_tests/main.test.ts:2:1)
gateway_1 |
gateway_1 | Test Suites: 1 failed, 1 total
gateway_1 | Tests: 0 total
gateway_1 | Snapshots: 0 total
gateway_1 | Time: 0.914s
gateway_1 | Ran all test suites.
The odd thing is that the functional test suite works perfectly on Circle CI.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.