Skip to content

Commit cb5640c

Browse files
author
Sam Betts
authored
Break VMClarity control plane into microservices (openclarity#481)
* Rename backend to apiserver This PR renames the vmclarity-backend cmd and backend packages to vmclarity-apiserver and apiserver respectively in preparation to split the orchestrator and uibackend out of the backend monolith. * Break VMClarity control plane into microservices This commit breaks VMClarity backend into several new microservices: * vmclarity-apiserver - Serves the VMClarity API and connects to the DB * vmclarity-orchestrator - All the controllers for reconciling scans * vmclarity-uibackend - A UI specific API wrapper service * vmclarity-ui - An nginx server responsible for serving the UI static files An example docker compose installer is added to deploy the VMClarity stack locally. * Update AWS installer to use the microservices * Microservices AWS working * Azure microservices working * GCP microservices working * Update README after microservices * Update docker compose with all services and configurations * Code review comments addressed * More code review comments * fix docker compose grype-server
1 parent 9e1263b commit cb5640c

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

82 files changed

+2220
-1606
lines changed

‎.github/workflows/build-and-push-component.yaml

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
name: 'Build and Push Component'
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
dockerfile:
7+
required: true
8+
type: string
9+
description: 'Dockerfile to build and push'
10+
image_name:
11+
required: true
12+
type: string
13+
description: 'Name of the image to publish'
14+
image_tag:
15+
required: true
16+
type: string
17+
description: 'Image tag to build and push.'
18+
push:
19+
required: false
20+
type: string
21+
description: 'If set to true, push the image.'
22+
default: false
23+
upload:
24+
required: false
25+
type: string
26+
description: 'If set to true, upload the image.'
27+
default: false
28+
29+
jobs:
30+
build-and-push:
31+
runs-on: ubuntu-latest
32+
steps:
33+
- name: Checkout code
34+
uses: actions/checkout@v3
35+
36+
- name: Set up Docker Buildx
37+
uses: docker/setup-buildx-action@v2
38+
39+
- name: Cache Docker layers
40+
uses: actions/cache@v3
41+
with:
42+
path: /tmp/.buildx-cache
43+
key: ${{ runner.os }}-buildx-${{ github.ref }}
44+
restore-keys: |
45+
${{ runner.os }}-buildx-
46+
47+
- name: Login to GitHub Container Registry
48+
uses: docker/login-action@v2
49+
with:
50+
registry: ghcr.io
51+
username: ${{ github.actor }}
52+
password: ${{ secrets.GITHUB_TOKEN }}
53+
54+
- name: Set build output env var
55+
if: ${{ inputs.upload == 'true' }}
56+
run: |
57+
echo "OUTPUTS=type=docker,dest=/tmp/${{ inputs.image_name }}.tar" >> $GITHUB_ENV
58+
59+
- name: Build
60+
uses: docker/build-push-action@v4
61+
with:
62+
context: .
63+
platforms: linux/amd64,linux/arm64
64+
tags: ghcr.io/openclarity/${{ inputs.image_name }}:${{ inputs.image_tag }}
65+
file: ${{ inputs.dockerfile }}
66+
push: ${{ inputs.push }}
67+
outputs: "${{ env.OUTPUTS }}"
68+
cache-from: type=local,src=/tmp/.buildx-cache
69+
cache-to: type=local,dest=/tmp/.buildx-cache
70+
build-args: |
71+
VERSION=${{ inputs.image_tag }}
72+
BUILD_TIMESTAMP=${{ needs.timestamp.outputs.timestamp }}
73+
COMMIT_HASH=${{ github.sha }}
74+
75+
- name: Upload artifact
76+
if: ${{ inputs.upload == 'true' }}
77+
uses: actions/upload-artifact@v3
78+
with:
79+
name: ${{ inputs.image_name }}
80+
path: /tmp/${{ inputs.image_name }}.tar

‎.github/workflows/ci.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
go-version: ${{ env.GO_VERSION }}
2121

2222
- name: Generate API code
23-
run: make api
23+
run: make gen-api
2424

2525
# This step will evaluate the repo status and exit if found changes
2626
# This should detect if the most up-to-date generated API code was pushed

‎.github/workflows/reusable-build-and-push.yml

+45-99
Original file line numberDiff line numberDiff line change
@@ -28,106 +28,52 @@ jobs:
2828
id: timestamp
2929
run: echo "::set-output name=timestamp::$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
3030

31-
vmclarity-backend:
31+
vmclarity-apiserver:
3232
needs: timestamp
33-
runs-on: ubuntu-latest
34-
steps:
35-
- name: Checkout code
36-
uses: actions/checkout@v3
37-
38-
- name: Set up Docker Buildx
39-
uses: docker/setup-buildx-action@v2
40-
41-
- name: Cache Docker layers
42-
uses: actions/cache@v3
43-
with:
44-
path: /tmp/.buildx-cache
45-
key: ${{ runner.os }}-buildx-${{ github.ref }}
46-
restore-keys: |
47-
${{ runner.os }}-buildx-
48-
49-
- name: Login to GitHub Container Registry
50-
uses: docker/login-action@v2
51-
with:
52-
registry: ghcr.io
53-
username: ${{ github.actor }}
54-
password: ${{ secrets.GITHUB_TOKEN }}
55-
56-
- name: Set build output env var
57-
if: ${{ inputs.upload == 'true' }}
58-
run: |
59-
echo "OUTPUTS=type=docker,dest=/tmp/vmclarity.tar" >> $GITHUB_ENV
60-
61-
- name: Build
62-
uses: docker/build-push-action@v4
63-
with:
64-
context: .
65-
platforms: linux/amd64,linux/arm64
66-
tags: ghcr.io/openclarity/vmclarity-backend:${{ inputs.image_tag }}
67-
file: Dockerfile.backend
68-
push: ${{ inputs.push }}
69-
outputs: "${{ env.OUTPUTS }}"
70-
cache-from: type=local,src=/tmp/.buildx-cache
71-
cache-to: type=local,dest=/tmp/.buildx-cache
72-
build-args: |
73-
VERSION=${{ inputs.image_tag }}
74-
BUILD_TIMESTAMP=${{ needs.timestamp.outputs.timestamp }}
75-
COMMIT_HASH=${{ github.sha }}
76-
77-
- name: Upload artifact
78-
if: ${{ inputs.upload == 'true' }}
79-
uses: actions/upload-artifact@v3
80-
with:
81-
name: vmclarity
82-
path: /tmp/vmclarity.tar
33+
uses: ./.github/workflows/build-and-push-component.yaml
34+
with:
35+
dockerfile: Dockerfile.apiserver
36+
image_name: vmclarity-apiserver
37+
image_tag: ${{ inputs.image_tag }}
38+
push: ${{ inputs.push }}
39+
upload: ${{ inputs.upload }}
40+
41+
vmclarity-orchestrator:
42+
needs: timestamp
43+
uses: ./.github/workflows/build-and-push-component.yaml
44+
with:
45+
dockerfile: Dockerfile.orchestrator
46+
image_name: vmclarity-orchestrator
47+
image_tag: ${{ inputs.image_tag }}
48+
push: ${{ inputs.push }}
49+
upload: ${{ inputs.upload }}
50+
51+
vmclarity-ui-backend:
52+
needs: timestamp
53+
uses: ./.github/workflows/build-and-push-component.yaml
54+
with:
55+
dockerfile: Dockerfile.uibackend
56+
image_name: vmclarity-ui-backend
57+
image_tag: ${{ inputs.image_tag }}
58+
push: ${{ inputs.push }}
59+
upload: ${{ inputs.upload }}
60+
61+
vmclarity-ui:
62+
needs: timestamp
63+
uses: ./.github/workflows/build-and-push-component.yaml
64+
with:
65+
dockerfile: Dockerfile.ui
66+
image_name: vmclarity-ui
67+
image_tag: ${{ inputs.image_tag }}
68+
push: ${{ inputs.push }}
69+
upload: ${{ inputs.upload }}
8370

8471
vmclarity-cli:
8572
needs: timestamp
86-
runs-on: ubuntu-latest
87-
steps:
88-
- name: Checkout code
89-
uses: actions/checkout@v3
90-
91-
- name: Set up Docker Buildx
92-
uses: docker/setup-buildx-action@v2
93-
94-
- name: Cache Docker layers
95-
uses: actions/cache@v3
96-
with:
97-
path: /tmp/.buildx-cache
98-
key: ${{ runner.os }}-buildx-${{ github.ref }}
99-
restore-keys: |
100-
${{ runner.os }}-buildx-
101-
102-
- name: Login to GitHub Container Registry
103-
uses: docker/login-action@v2
104-
with:
105-
registry: ghcr.io
106-
username: ${{ github.actor }}
107-
password: ${{ secrets.GITHUB_TOKEN }}
108-
109-
- name: Set build output env var
110-
if: ${{ inputs.upload == 'true' }}
111-
run: |
112-
echo "OUTPUTS=type=docker,dest=/tmp/vmclarity-cli.tar" >> $GITHUB_ENV
113-
114-
- name: Build
115-
uses: docker/build-push-action@v4
116-
with:
117-
context: .
118-
platforms: linux/amd64,linux/arm64
119-
tags: ghcr.io/openclarity/vmclarity-cli:${{ inputs.image_tag }}
120-
file: Dockerfile.cli
121-
push: ${{ inputs.push }}
122-
outputs: "${{ env.OUTPUTS }}"
123-
cache-from: type=local,src=/tmp/.buildx-cache
124-
cache-to: type=local,dest=/tmp/.buildx-cache
125-
build-args: |
126-
COMMIT_HASH=${{ github.sha }}
127-
128-
- name: Upload artifact
129-
if: ${{ inputs.upload == 'true' }}
130-
uses: actions/upload-artifact@v3
131-
with:
132-
name: vmclarity
133-
path: /tmp/vmclarity-cli.tar
73+
uses: ./.github/workflows/build-and-push-component.yaml
74+
with:
75+
dockerfile: Dockerfile.cli
76+
image_name: vmclarity-cli
77+
image_tag: ${{ inputs.image_tag }}
78+
push: ${{ inputs.push }}
79+
upload: ${{ inputs.upload }}

‎.golangci.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,6 @@ issues:
7676
- path: _test\.go
7777
linters:
7878
- govet
79-
- path: pkg/backend/database/demo.go
79+
- path: pkg/apiserver/database/demo.go
8080
linters:
8181
- gomnd

‎.goreleaser.yml

+5-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,11 @@ builds:
55
binary: vmclarity-cli
66
env:
77
- CGO_ENABLED=0
8-
ldflags: "-s -w -X github.com/openclarity/vmclarity/pkg/cli.GitRevision={{ .Version }}"
8+
ldflags:
9+
- "-s -w"
10+
- "-X github.com/openclarity/vmclarity/pkg/version.Version={{ .Version }}"
11+
- "-X github.com/openclarity/vmclarity/pkg/version.CommitHash={{.Commit}}"
12+
- "-X github.com/openclarity/vmclarity/pkg/version.BuildTimestamp={{.Timestamp}}"
913
goos:
1014
- linux
1115
- darwin

‎ARCHITECTURE.md

+19-22
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,30 @@
11
# High Level Architecture
22

3-
Today, VMClarity has two halves, the VMClarity infrastructure, and the VMClarity CLI.
3+
Today, VMClarity has two halves, the VMClarity control plane, and the
4+
VMClarity CLI.
45

5-
The VMClarity infrastructure includes:
6+
The VMClarity control plane includes several microservices:
67

7-
- **Backend**: The core component of VMClarity. Within this service there are
8-
sub-components (it is in the roadmap to break these into dedicated microservices):
8+
- **API Server**: The VMClarity API for managing all objects in the VMClarity
9+
system. This is the only component in the system which talks to the DB.
910

10-
- **API**: The VMClarity API for managing all objects in the VMClarity
11-
system. This is the only component in the system which talks to the DB.
11+
- **Orchestrator**: Orchestrates and manages the life cycle of VMClarity
12+
scan configs, scans and asset scans. Within the Orchestrator there is a
13+
pluggable "provider" which connects the orchstrator to the environment to be
14+
scanned and abstracts asset discovery, VM snapshotting as well as creation of
15+
the scanner VMs. (**Note** The only supported provider today is AWS, other
16+
hyperscalers are on the roadmap)
1217

13-
- **Orchestrator**: Orchestrates and manages the life cycle of VMClarity scan
14-
configs, scans and asset scans. Within the Orchestrator there is a
15-
pluggable "provider" which connects the orchstrator to the environment to be
16-
scanned and abstracts asset discovery, VM snapshotting as well as creation of
17-
the scanner VMs. (**Note** The only supported provider today is AWS, other
18-
hyperscalers are on the roadmap)
18+
- **UI Backend**: A separate backend API which offloads some processing from
19+
the browser to the infrastructure to process and filter data closer to the
20+
source.
1921

20-
- **UI Backend**: A separate backend API which offloads some processing from
21-
the browser to the infrastructure to process and filter data closer to the
22-
source.
22+
- **UI Webserver**: A server serving the UI static files.
2323

24-
- **UI Server**: A server serving the UI static files.
24+
- **DB**: Stores the VMClarity objects from the API. Supported options are
25+
SQLite and Postgres.
2526

26-
- **DB**: Stores the VMClarity objects from the API. Today this is SQLite but
27-
the database interface in VMClarity is pluggable and additional DB support
28-
can be added. (Postgres is in the roadmap)
29-
30-
- **Scanner services**: These services provide support to the VMClarity
27+
- **Scanner Helper services**: These services provide support to the VMClarity
3128
CLI to offload work that would need to be done in every scanner, for example
3229
downloading the latest vulnerability or malware signatures from the various DB
3330
sources. The components included today are:
@@ -54,4 +51,4 @@ the configured analysis on the mounted snapshot, and report the results to the
5451
VMClarity API. These results are then processed by the VMClarity backend into
5552
findings.
5653

57-
![VMClarity Architecture Overview](img/vmclarity-arch-20230406.svg)
54+
![VMClarity Architecture Overview](img/vmclarity-arch-20230725.svg)

‎Dockerfile.backend renamed to ‎Dockerfile.apiserver

+6-15
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,4 @@
11
# syntax=docker/dockerfile:1.2
2-
FROM --platform=$BUILDPLATFORM node:20-slim AS site-build
3-
4-
WORKDIR /app/ui-build
5-
6-
COPY ui .
7-
RUN npm i
8-
RUN npm run build
9-
102
# xx is a helper for cross-compilation
113
FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.2.1@sha256:8879a398dedf0aadaacfbd332b29ff2f84bc39ae6d4e9c0a1109db27ac5ba012 AS xx
124

@@ -33,17 +25,16 @@ ENV CGO_ENABLED=1
3325
RUN --mount=type=cache,target=/go/pkg/mod \
3426
--mount=type=cache,target=/root/.cache/go-build \
3527
go build -ldflags="-s -w -extldflags -static \
36-
-X 'github.com/openclarity/vmclarity/pkg/backend/version.Version=${VERSION}' \
37-
-X 'github.com/openclarity/vmclarity/pkg/backend/version.CommitHash=${COMMIT_HASH}' \
38-
-X 'github.com/openclarity/vmclarity/pkg/backend/version.BuildTimestamp=${BUILD_TIMESTAMP}'" -o bin/vmclarity-backend ./cmd/vmclarity-backend/main.go
28+
-X 'github.com/openclarity/vmclarity/pkg/version.Version=${VERSION}' \
29+
-X 'github.com/openclarity/vmclarity/pkg/version.CommitHash=${COMMIT_HASH}' \
30+
-X 'github.com/openclarity/vmclarity/pkg/version.BuildTimestamp=${BUILD_TIMESTAMP}'" -o bin/vmclarity-apiserver ./cmd/vmclarity-apiserver/main.go
3931

40-
RUN xx-verify bin/vmclarity-backend
32+
RUN xx-verify bin/vmclarity-apiserver
4133

4234
FROM alpine:3.18
4335

4436
WORKDIR /app
4537

46-
COPY --from=builder ["/build/bin/vmclarity-backend", "./vmclarity-backend"]
47-
COPY --from=site-build ["/app/ui-build/build", "site"]
38+
COPY --from=builder ["/build/bin/vmclarity-apiserver", "./vmclarity-apiserver"]
4839

49-
ENTRYPOINT ["/app/vmclarity-backend"]
40+
ENTRYPOINT ["/app/vmclarity-apiserver"]

‎Dockerfile.cli

+7-4
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,15 @@
22
ARG VMCLARITY_TOOLS_BASE=ghcr.io/openclarity/vmclarity-tools-base:v0.2.0@sha256:0e0ed706dc297366af44d736c71aefa350b54a0214290aa81b3603462e39872b
33
FROM --platform=$BUILDPLATFORM golang:1.20.6-alpine AS builder
44

5-
65
RUN apk add --update --no-cache ca-certificates git
76
RUN apk add build-base
87

98
# Copy vmclarity code to /build and move to that directory
109
COPY . /build
1110
WORKDIR /build
1211

12+
ARG VERSION
13+
ARG BUILD_TIMESTAMP
1314
ARG COMMIT_HASH
1415
ARG TARGETOS
1516
ARG TARGETARCH
@@ -18,9 +19,11 @@ RUN --mount=type=cache,target=/go/pkg/mod \
1819
--mount=type=cache,target=/root/.cache/go-build \
1920
GOOS=${TARGETOS} GOARCH=${TARGETARCH} CGO_ENABLED=0 \
2021
go build \
21-
-ldflags="-s -w -X 'github.com/openclarity/vmclarity/pkg/cli.GitRevision=${COMMIT_HASH}'" \
22-
-o bin/vmclarity-cli \
23-
cmd/vmclarity-cli/main.go
22+
-ldflags="-s -w \
23+
-X 'github.com/openclarity/vmclarity/pkg/version.Version=${VERSION}' \
24+
-X 'github.com/openclarity/vmclarity/pkg/version.CommitHash=${COMMIT_HASH}' \
25+
-X 'github.com/openclarity/vmclarity/pkg/version.BuildTimestamp=${BUILD_TIMESTAMP}'" \
26+
-o bin/vmclarity-cli cmd/vmclarity-cli/main.go
2427

2528
FROM ${VMCLARITY_TOOLS_BASE}
2629

0 commit comments

Comments
 (0)