Google Cloud Platform extension for the Chaos Toolkit
Project description
Chaos Toolkit Extension for Google Cloud Platform
This project is a collection of actions and probes, gathered as an extension to the Chaos Toolkit. It targets the Google Cloud Platform.
Install
This package requires Python 3.7+
To be used from your experiment, this package must be installed in the Python environment where chaostoolkit already lives.
$ pip install --prefer-binary -U chaostoolkit-google-cloud-platform
Usage
To use the probes and actions from this package, add the following to your experiment file:
{
"version": "1.0.0",
"title": "create and delete a cloud run service",
"description": "n/a",
"configuration": {
"gcp_project_id": "...",
"gcp_region": "..."
},
"method": [
{
"name": "create-cloud-run-service",
"type": "action",
"provider": {
"type": "python",
"module": "chaosgcp.cloudrun.actions",
"func": "create_service",
"arguments": {
"project_id": "...",
"region": "europe-west2",
"service_id": "demo",
"container": {
"name": "demo",
"image": "gcr.io/google-samples/hello-app:1.0"
}
}
}
},
{
"name": "delete-cloud-run-service",
"type": "action",
"provider": {
"type": "python",
"module": "chaosgcp.cloudrun.actions",
"func": "delete_service",
"arguments": {
"project_id": "...",
"region": "europe-west2",
"name": "demo"
}
}
}
]
}
That's it!
Please explore the code to see existing probes and actions.
Configuration
Project and Cluster Information
All operations in this extension expect to know about the target project and, almost always, the region as well. These can be provided in two ways.
- Each action or probe takes a
project_id
andregion
arguments - For some activities, you can also set the
parent
argument which looks likeprojects/<ID>/locations/</region>
. This is equivalent to the previous approach so it's a matter of taste - You can pass the context via the
configuration
section of your experiment:
{
"configuration": {
"gcp_project_id": "...",
"gcp_gke_cluster_name": "...",
"gcp_region": "...",
"gcp_zone": "..."
}
}
Note that the arguments will always take precedence over the configuration.
You always need to set at least the project_id
either with the
configuration block (when it's the same project for all activities in the
experiment) or on each activity directly. This is because the extension
cannot always infer these from the credentials and therefore doesn't
attempt to.
Credentials
This extension allows you to reuse the authentication available to whichever user you are logged in on the machine running the experiment. In such case, the extension delegates the lookup of the appropriate credentials to the underlying GCP Python client.
In addition, the extension allows you to provide a service account with enough permissions to perform its operations.
Once you have created your service account, either keep the file on the same
machine where you will be running the experiment from. Or, pass its content
as part of the secrets
section, although this is not recommended because your
sensitive data will be quite visible.
Here is the first way:
{
"secrets": {
"gcp": {
"service_account_file": "/path/to/sa.json"
}
}
}
You can also use the well-known GOOGLE_APPLICATION_CREDENTIALS
environment
variables. iI that case, you do not need to set any secrets in the
experiment.
Finally, the embedded way looks like this (it should rarely be needed and avoided):
{
"secrets": {
"k8s": {
"KUBERNETES_CONTEXT": "..."
},
"gcp": {
"service_account_info": {
"type": "service_account",
"project_id": "...",
"private_key_id": "...",
"private_key": "...",
"client_email": "...",
"client_id": "...",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://accounts.google.com/o/oauth2/token",
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/...."
}
}
}
}
Notice also how we provided here the k8s
entry. This is only because, in our
example we use the swap_nodepool
action which drains the Kubernetes nodes
and it requires the Kubernetes cluster credentials to work. These are documented
in the Kubernetes extension for Chaos Toolkit. This is the only
action that requires such a secret payload, others only speak to the GCP API.
Putting it all together
Here is a full example which creates a node pool then swap it for a new one.
{
"version": "1.0.0",
"title": "do stuff ye",
"description": "n/a",
"secrets": {
"k8s": {
"KUBERNETES_CONTEXT": "gke_..."
},
"gcp": {
"service_account_file": "service-account.json"
}
},
"method": [
{
"name": "create-our-nodepool",
"type": "action",
"provider": {
"type": "python",
"module": "chaosgcp.gke.nodepool.actions",
"func": "create_new_nodepool",
"secrets": ["gcp"],
"arguments": {
"parent": "projects/.../locations/.../clusters/...",
"body": {
"config": {
"oauth_scopes": [
"gke-version-default",
"https://www.googleapis.com/auth/devstorage.read_only",
"https://www.googleapis.com/auth/logging.write",
"https://www.googleapis.com/auth/monitoring",
"https://www.googleapis.com/auth/service.management.readonly",
"https://www.googleapis.com/auth/servicecontrol",
"https://www.googleapis.com/auth/trace.append"
]
},
"initial_node_count": 1,
"name": "default-pool"
}
}
}
},
{
"name": "fetch-our-nodepool",
"type": "probe",
"provider": {
"type": "python",
"module": "chaosgcp.gke.nodepool.probes",
"func": "get_nodepool",
"secrets": ["gcp"],
"arguments": {
"parent": "projects/.../locations/.../clusters/.../nodePools/default-pool"
}
}
},
{
"name": "swap-our-nodepool",
"type": "action",
"provider": {
"type": "python",
"module": "chaosgcp.gke.nodepool.actions",
"func": "swap_nodepool",
"secrets": ["gcp", "k8s"],
"arguments": {
"parent": "projects/.../locations/.../clusters/...",
"delete_old_node_pool": true,
"old_node_pool_id": "default-pool",
"new_nodepool_body": {
"config": {
"oauth_scopes": [
"gke-version-default",
"https://www.googleapis.com/auth/devstorage.read_only",
"https://www.googleapis.com/auth/logging.write",
"https://www.googleapis.com/auth/monitoring",
"https://www.googleapis.com/auth/service.management.readonly",
"https://www.googleapis.com/auth/servicecontrol",
"https://www.googleapis.com/auth/trace.append"
]
},
"initial_node_count": 1,
"name": "default-pool-1"
}
}
}
}
]
}
Contribute
If you wish to contribute more functions to this package, you are more than welcome to do so. Please, fork this project, make your changes following the usual PEP 8 code style, sprinkling with tests and submit a PR for review.
The Chaos Toolkit projects require all contributors must sign a Developer Certificate of Origin on each commit they would like to merge into the master branch of the repository. Please, make sure you can abide by the rules of the DCO before submitting a PR.
If you wish to add a new function to this extension, that is related to a Google Cloud product that is not available yet in this package, please use the product short name or acronym as a first level subpackage (eg. iam, gke, sql, storage, ...). See the list of [GCP products and services][gcp_products].
[gcp_products] https://cloud.google.com/products/
Develop
If you wish to develop on this project, make sure to install the development dependencies. But first, create a virtual environment and then install those dependencies.
$ pip install -r requirements-dev.txt -r requirements.txt
Then, point your environment to this directory:
$ python setup.py develop
Now, you can edit the files and they will be automatically be seen by your
environment, even when running from the chaos
command locally.
Test
To run the tests for the project execute the following:
$ pytest
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for chaostoolkit-google-cloud-platform-0.15.0.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | eb51e96d00436abf97118bd25e421b3831010d0815cad3cb0423eb4aa7f511ac |
|
MD5 | 1c3618d0541bf3d3f3d4d4231150566c |
|
BLAKE2b-256 | 99f19a79d5ce97ff35c62098aa6f99f86c88103420b0f2e41f01f5a11cd714c5 |
Hashes for chaostoolkit_google_cloud_platform-0.15.0-py2.py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | b2cb41375a5afd324873668b9621e8cb636eab8a2016a93d96b8d7e6083abe3e |
|
MD5 | 01016314e757f7f4d846acba707c7bf7 |
|
BLAKE2b-256 | 09e1fce98dc5ff08603a970af0e4a3c950fd170aa44038387e7341bbede52118 |