f8cc07220a
For Executors on Native Kubernetes deployments, the option to run jobs in a single pod has been available since Native Kubernetes has been around. The purpose of running jobs in a single pod is: 1. Efficiency. Jobs require three steps at least, and without specifying a single pod, that requires spinning up three pods. 2. Security. For Batch Changes, when jobs are run across several pods, `git`'s `safe.directory` must be set to avoid untrusted users or processes injecting code or an attack. Running the job in one pod removes the need for `safe.directory`. 3. Usability. Because of the need to set `safe.directory`, `root` access to write to `git`'s global config is required, which means that many times special configurations and sign-offs from security teams must be used for Batch Change setups. This PR takes a step toward using single pod jobs only in enabling them by default instead of requiring an environment variable to enable them. The same environment variable that was used to enable them - `KUBERNETES_SINGLE_JOB_POD` - is still available to disable them by setting it to `false`. ## Test plan Bazel and CI for now ## Changelog |
||
|---|---|---|
| .. | ||
| docker-mirror | ||
| internal | ||
| kubernetes | ||
| vm-image | ||
| _binary.push.sh | ||
| BUILD.bazel | ||
| ci-should-rebuild.sh | ||
| image_test.yaml | ||
| main.go | ||
| README.md | ||
Executor
The executor service polls the public frontend API for work to perform. The executor will pull a job from a particular queue (configured via the envvar EXECUTOR_QUEUE_NAME), then performs the job by running a sequence of docker and src-cli commands. This service is horizontally scalable.
Since executors and Sourcegraph are separate deployments, our agreement is to support 1 minor version divergence for now. See this example for more details:
| Sourcegraph version | Executor version | Ok |
|---|---|---|
| 3.43.0 | 3.43.* | ✅ |
| 3.43.3 | 3.43.* | ✅ |
| 3.43.0 | 3.44.* | ✅ |
| 3.43.0 | 3.42.* | ✅ |
| 3.43.0 | 3.41.* | 🚫 |
| 3.43.0 | 3.45.* | 🚫 |
See the executor queue for a complete list of queues.
Building and releasing
Building and releasing is handled automatically by the CI pipeline.
Binary
The executor binary is simply built with bazel build //cmd/executor:executor.
For publishing it, see bazel run //cmd/executor:binary.push:
- In every scenario, the binary will be uploaded to
gcs://sourcegraph-artifacts/executors/$GIT_COMMIT/. - If the current branch is
mainwhen this target is run, it will also be copied over togcs://sourcegraph-artifacts/executors/latest. - If the env var
EXECUTOR_IS_TAGGED_RELEASEis set to true, it will also be copied over togcs://sourcegraph-artifacts/executors/$BUILDKITE_TAG.
VM image
The VM Image is built with packer, but it also uses an OCI image as a base for Firecracker, //docker-images/executor-vm:image_tarball which it depends on. That OCI image is a legacy image, see docker-images/executor-vm/README.md.
Because we're producing an AMI for both AWS and GCP, there are two steps involved:
bazel run //cmd/executor/vm-image:ami.buildcreates the AMI and names it according to the CI runtype.bazel run //cmd/executor/vm-image:ami.pushtakes the AMIs from above and publish them (adjust perms, naming).
While gcloud is provided by Bazel, AWS cli is expected to be available on the host running Bazel.
Building AMIs on GCP is rather quick, but it's notoriously slow on AWS (about 20m) so we use target-determinator to detect when to rebuild the image. See ci-should-rebuild.sh, which is used by the pipeline generator to skip building it if we detect that nothing changed since the parent commit.
Docker Mirror
As with the VM image, we're producing an AMI for both AWS and GCP, there are two steps involved:
bazel run //cmd/executor/docker-mirror:ami.buildcreates the AMI and names it according to the CI runtype.bazel run //cmd/executor/docker-mirror:ami.pushtakes the AMIs from above and publish them (adjust perms, naming).
While gcloud is provided by Bazel, AWS cli is expected to be available on the host running Bazel.