be015c58c2
2nd attempt of #63111, a follow up https://github.com/sourcegraph/sourcegraph/pull/63085 rules_oci 2.0 brings a lot of performance improvement around oci_image and oci_pull, which will benefit Sourcegraph. It will also make RBE faster and have less load on remote cache. However, 2.0 makes some breaking changes like - oci_tarball's default output is no longer a tarball - oci_image no longer compresses layers that are uncompressed, somebody has to make sure all `pkg_tar` targets have a `compression` attribute set to compress it beforehand. - there is no curl fallback, but this is fine for sourcegraph as it already uses bazel 7.1. I checked all targets that use oci_tarball as much as i could to make sure nothing depends on the default tarball output of oci_tarball. there was one target which used the default output which i put a TODO for somebody else (somebody who is more on top of the repo) to tackle **later**. ## Test plan CI. Also run delivery on this PR (don't land those changes) --------- Co-authored-by: Noah Santschi-Cooney <noah@santschi-cooney.ch> |
||
|---|---|---|
| .. | ||
| docker-mirror | ||
| internal | ||
| kubernetes | ||
| vm-image | ||
| _binary.push.sh | ||
| BUILD.bazel | ||
| ci-should-rebuild.sh | ||
| image_test.yaml | ||
| main.go | ||
| README.md | ||
Executor
The executor service polls the public frontend API for work to perform. The executor will pull a job from a particular queue (configured via the envvar EXECUTOR_QUEUE_NAME), then performs the job by running a sequence of docker and src-cli commands. This service is horizontally scalable.
Since executors and Sourcegraph are separate deployments, our agreement is to support 1 minor version divergence for now. See this example for more details:
| Sourcegraph version | Executor version | Ok |
|---|---|---|
| 3.43.0 | 3.43.* | ✅ |
| 3.43.3 | 3.43.* | ✅ |
| 3.43.0 | 3.44.* | ✅ |
| 3.43.0 | 3.42.* | ✅ |
| 3.43.0 | 3.41.* | 🚫 |
| 3.43.0 | 3.45.* | 🚫 |
See the executor queue for a complete list of queues.
Building and releasing
Building and releasing is handled automatically by the CI pipeline.
Binary
The executor binary is simply built with bazel build //cmd/executor:executor.
For publishing it, see bazel run //cmd/executor:binary.push:
- In every scenario, the binary will be uploaded to
gcs://sourcegraph-artifacts/executors/$GIT_COMMIT/. - If the current branch is
mainwhen this target is run, it will also be copied over togcs://sourcegraph-artifacts/executors/latest. - If the env var
EXECUTOR_IS_TAGGED_RELEASEis set to true, it will also be copied over togcs://sourcegraph-artifacts/executors/$BUILDKITE_TAG.
VM image
The VM Image is built with packer, but it also uses an OCI image as a base for Firecracker, //docker-images/executor-vm:image_tarball which it depends on. That OCI image is a legacy image, see docker-images/executor-vm/README.md.
Because we're producing an AMI for both AWS and GCP, there are two steps involved:
bazel run //cmd/executor/vm-image:ami.buildcreates the AMI and names it according to the CI runtype.bazel run //cmd/executor/vm-image:ami.pushtakes the AMIs from above and publish them (adjust perms, naming).
While gcloud is provided by Bazel, AWS cli is expected to be available on the host running Bazel.
Building AMIs on GCP is rather quick, but it's notoriously slow on AWS (about 20m) so we use target-determinator to detect when to rebuild the image. See ci-should-rebuild.sh, which is used by the pipeline generator to skip building it if we detect that nothing changed since the parent commit.
Docker Mirror
As with the VM image, we're producing an AMI for both AWS and GCP, there are two steps involved:
bazel run //cmd/executor/docker-mirror:ami.buildcreates the AMI and names it according to the CI runtype.bazel run //cmd/executor/docker-mirror:ami.pushtakes the AMIs from above and publish them (adjust perms, naming).
While gcloud is provided by Bazel, AWS cli is expected to be available on the host running Bazel.