Initial commit

kustomize/components/google-cloud-operations/README.md

@@ -0,0 +1,123 @@
+# Integrate Online Boutique with Google Cloud Operations
+
+By default, [Google Cloud Operations](https://cloud.google.com/products/operations) instrumentation is **turned off** for Online Boutique deployments. This includes Monitoring (Stats), Tracing, and Profiler. This means that even if you're running this app on [GKE](https://cloud.google.com/kubernetes-engine), traces (for example) will not be exported to [Google Cloud Trace](https://cloud.google.com/trace).
+
+If you want to re-enable Google Cloud Operations instrumentation, the easiest way is to enable the included kustomize module, which enables traces, metrics, and adds a deployment of the [Open Telemetry Collector](https://opentelemetry.io/docs/collector/) to gather the traces and metrics and forward them to the appropriate Google Cloud backend.
+
+From the `kustomize/` folder at the root level of this repository, execute this command:
+
+```bash
+kustomize edit add component components/google-cloud-operations
+```
+
+This will update the `kustomize/kustomization.yaml` file which could be similar to:
+
+```yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- base
+components:
+- components/google-cloud-operations
+```
+
+You can locally render these manifests by running `kubectl kustomize .` as well as deploying them by running `kubectl apply -k .`.
+
+You will also need to make sure that you have the associated Google APIs enabled in your Google Cloud project:
+
+```bash
+PROJECT_ID=<your-gcp-project-id>
+gcloud services enable \
+    monitoring.googleapis.com \
+    cloudtrace.googleapis.com \
+    cloudprofiler.googleapis.com \
+    --project ${PROJECT_ID}
+```
+
+In addition to that, you will need to grant the following IAM roles associated to your Google Service Account (GSA):
+
+```bash
+PROJECT_ID=<your-gcp-project-id>
+GSA_NAME=<your-gsa>
+
+gcloud projects add-iam-policy-binding ${PROJECT_ID} \
+  --member "serviceAccount:${GSA_NAME}@${PROJECT_ID}.iam.gserviceaccount.com" \
+  --role roles/cloudtrace.agent
+
+gcloud projects add-iam-policy-binding ${PROJECT_ID} \
+  --member "serviceAccount:${GSA_NAME}@${PROJECT_ID}.iam.gserviceaccount.com" \
+  --role roles/monitoring.metricWriter
+  
+gcloud projects add-iam-policy-binding ${PROJECT_ID} \
+  --member "serviceAccount:${GSA_NAME}@${PROJECT_ID}.iam.gserviceaccount.com" \
+  --role roles/cloudprofiler.agent
+```
+
+**Note**
+Currently only trace is supported.  Support for metrics, and more is coming soon.
+
+## Changes
+
+When enabling this kustomize module, most services will be patched with a configuration similar to the following:
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: productcatalogservice
+spec:
+  template:
+    spec:
+      containers:
+        - name: server
+          env:
+          - name: COLLECTOR_SERVICE_ADDR
+            value: "opentelemetrycollector:4317"
+          - name: ENABLE_STATS
+            value: "1"
+          - name: ENABLE_TRACING
+            value: "1"
+```
+
+This patch sets environment variables to enable export of stats and tracing, as well as a variable to tell the service how to reach the new collector deployment.
+
+## OpenTelemetry Collector
+
+Currently, this component adds a single collector service which collects traces and metrics from individual services and forwards them to the appropriate Google Cloud backend.
+
+![Collector Architecture Diagram](collector-model.png)
+
+If you wish to experiment with different backends, you can modify the appropriate lines in [otel-collector.yaml](otel-collector.yaml) to export traces or metrics to a different backend.  See the [OpenTelemetry docs](https://opentelemetry.io/docs/collector/configuration/) for more details.
+
+## Workload Identity
+
+If you are running this sample on GKE, your GKE cluster may be configured to use [Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity) to manage access to Google Cloud APIs (like Cloud Trace). If this is the case, you may not see traces properly exported, or may see an error message like `failed to export to Google Cloud Trace: rpc error: code = PermissionDenied desc = The caller does not have permission` logged by your `opentelemetrycollector` Pod(s). In order to export traces with such a setup, you need to associate the Kubernetes [ServiceAccount](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) (`default/default`) with your [default compute service account](https://cloud.google.com/compute/docs/access/service-accounts#default_service_account) on Google Cloud (or a custom Google Cloud service account you may create for this purpose).
+
+* To get the email address associated with your Google service account, check in the IAM section of the Cloud Console.  Or run the following command in your terminal:
+
+```bash
+gcloud iam service-accounts list
+```
+
+* Then, allow the Kubernetes service account to act as your Google service account with the following command (using your own `PROJECT_ID` and the `GSA_EMAIL` you found in the previous step):
+
+```bash
+gcloud iam service-accounts add-iam-policy-binding ${GSA_EMAIL} \
+  --role roles/iam.workloadIdentityUser \
+  --member "serviceAccount:${PROJECT_ID}.svc.id.goog[default/default]"
+```
+
+* Annotate your Kubernetes service account (`default/default` for the `default` namespace) to use the Google IAM service account:
+
+```bash
+kubectl annotate serviceaccount default \
+  iam.gke.io/gcp-service-account=${GSA_EMAIL}
+```
+
+* Finally, restart your `opentelemetrycollector` deployment to reflect the new settings:
+
+```bash
+kubectl rollout restart deployment opentelemetrycollector
+```
+
+When the new Pod rolls out, you should start to see traces appear in the cloud console.

kustomize/components/google-cloud-operations/kustomization.yaml

@@ -0,0 +1,174 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+resources:
+  - otel-collector.yaml
+patches:
+# adservice - not yet implemented
+# checkoutservice - tracing, profiler
+- patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: checkoutservice
+    spec:
+      template:
+        spec:
+          containers:
+            - name: server
+              env:
+              - name: COLLECTOR_SERVICE_ADDR
+                value: "opentelemetrycollector:4317"
+              - name: OTEL_SERVICE_NAME
+                value: "checkoutservice"
+              - name: ENABLE_TRACING
+                value: "1"
+              - name: ENABLE_PROFILER
+                value: "1"
+# currencyservice - tracing, profiler
+- patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: currencyservice
+    spec:
+      template:
+        spec:
+          containers:
+            - name: server
+              env:
+              - name: COLLECTOR_SERVICE_ADDR
+                value: "opentelemetrycollector:4317"
+              - name: OTEL_SERVICE_NAME
+                value: "currencyservice"
+              - name: ENABLE_TRACING
+                value: "1"
+              - name: DISABLE_PROFILER
+                $patch: delete
+# emailservice - tracing, profiler
+- patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: emailservice
+    spec:
+      template:
+        spec:
+          containers:
+            - name: server
+              env:
+              - name: COLLECTOR_SERVICE_ADDR
+                value: "opentelemetrycollector:4317"
+              - name: OTEL_SERVICE_NAME
+                value: "emailservice"
+              - name: ENABLE_TRACING
+                value: "1"
+              - name: DISABLE_PROFILER
+                $patch: delete
+# frontend - tracing, profiler
+- patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: frontend
+    spec:
+      template:
+        spec:
+          containers:
+            - name: server
+              env:
+              - name: ENABLE_TRACING
+                value: "1"
+              - name: COLLECTOR_SERVICE_ADDR
+                value: "opentelemetrycollector:4317"
+              - name: OTEL_SERVICE_NAME
+                value: "frontend"
+              - name: ENABLE_PROFILER
+                value: "1"
+# paymentservice - tracing, profiler
+- patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: paymentservice
+    spec:
+      template:
+        spec:
+          containers:
+            - name: server
+              env:
+              - name: COLLECTOR_SERVICE_ADDR
+                value: "opentelemetrycollector:4317"
+              - name: OTEL_SERVICE_NAME
+                value: "paymentservice"
+              - name: ENABLE_TRACING
+                value: "1"
+              - name: DISABLE_PROFILER
+                $patch: delete
+# productcatalogservice - tracing, profiler
+- patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: productcatalogservice
+    spec:
+      template:
+        spec:
+          containers:
+            - name: server
+              env:
+              - name: COLLECTOR_SERVICE_ADDR
+                value: "opentelemetrycollector:4317"
+              - name: OTEL_SERVICE_NAME
+                value: "productcatalogservice"
+              - name: ENABLE_TRACING
+                value: "1"
+              - name: DISABLE_PROFILER
+                value: "1"
+# recommendationservice - tracing, profiler
+- patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: recommendationservice
+    spec:
+      template:
+        spec:
+          containers:
+            - name: server
+              env:
+              - name: COLLECTOR_SERVICE_ADDR
+                value: "opentelemetrycollector:4317"
+              - name: OTEL_SERVICE_NAME
+                value: "recommendationservice"
+              - name: ENABLE_TRACING
+                value: "1"
+              - name: DISABLE_PROFILER
+                $patch: delete
+# shippingservice - stats, tracing, profiler
+- patch: |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: shippingservice
+    spec:
+      template:
+        spec:
+          containers:
+            - name: server
+              env:
+              - name: DISABLE_PROFILER
+                $patch: delete

kustomize/components/google-cloud-operations/otel-collector.yaml

@@ -0,0 +1,126 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: opentelemetrycollector
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: opentelemetrycollector
+  template:
+    metadata:
+      labels:
+        app: opentelemetrycollector
+    spec:
+      securityContext:
+        fsGroup: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
+        runAsUser: 1000
+      # Init container retrieves the current cloud project id from the metadata server
+      # and inserts it into the collector config template
+      # https://cloud.google.com/compute/docs/storing-retrieving-metadata
+      initContainers:
+      - name: otel-gateway-init
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          privileged: false
+          readOnlyRootFilesystem: true
+        image: busybox:latest@sha256:e226d6308690dbe282443c8c7e57365c96b5228f0fe7f40731b5d84d37a06839
+        command:
+        - '/bin/sh'
+        - '-c'
+        - |
+           sed "s/{{PROJECT_ID}}/$(curl -H 'Metadata-Flavor: Google' http://metadata.google.internal/computeMetadata/v1/project/project-id)/" /template/collector-gateway-config-template.yaml >> /conf/collector-gateway-config.yaml
+        volumeMounts:
+        - name: collector-gateway-config-template
+          mountPath: /template
+        - name: collector-gateway-config
+          mountPath: /conf
+      containers:
+      # This gateway container will receive traces and metrics from each microservice
+      # and forward it to GCP
+      - name: otel-gateway
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          privileged: false
+          readOnlyRootFilesystem: true
+        args:
+        - --config=/conf/collector-gateway-config.yaml
+        image: otel/opentelemetry-collector-contrib:0.144.0@sha256:213886eb6407af91b87fa47551c3632be1a6419ff3a5114ef1e6fc364628496f
+        volumeMounts:
+        - name: collector-gateway-config
+          mountPath: /conf
+      volumes:
+      # Simple ConfigMap volume with template file
+      - name: collector-gateway-config-template
+        configMap:
+          items:
+          - key: collector-gateway-config-template.yaml
+            path: collector-gateway-config-template.yaml
+          name: collector-gateway-config-template
+      # Create a volume to store the expanded template (with correct cloud project ID)
+      - name: collector-gateway-config
+        emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: opentelemetrycollector
+spec:
+  ports:
+  - name: grpc-otlp
+    port: 4317
+    protocol: TCP
+    targetPort: 4317
+  selector:
+    app: opentelemetrycollector
+  type: ClusterIP
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: collector-gateway-config-template
+# Open Telemetry Collector config
+# https://opentelemetry.io/docs/collector/configuration/
+data:
+  collector-gateway-config-template.yaml: |
+    receivers:
+      otlp:
+        protocols: 
+          grpc:
+    processors:
+    exporters:
+      googlecloud:
+        project: {{PROJECT_ID}}
+    service:
+      pipelines:
+        traces:
+          receivers: [otlp] # Receive otlp-formatted data from other collector instances
+          processors: []
+          exporters: [googlecloud] # Export traces directly to Google Cloud
+        metrics:
+          receivers: [otlp]
+          processors: []
+          exporters: [googlecloud] # Export metrics to Google Cloud