Commit cd975b3f authored by Riabokon Stanislav(EPAM)'s avatar Riabokon Stanislav(EPAM) Committed by Rostislav Dublin (EPAM)

GONRNG-803

Changed README.md for gcp providers.
parent bbb80083
......@@ -306,78 +306,9 @@ The File service has several Service Provider Interfaces that the classes need t
| StorageService | Obligatory to implement | `file-core/src/main/java/.../provider/interfaces/StorageService` |
| ValidationService | Optional to implement | `file-core/src/main/java/.../provider/interfaces/ValidationService` |
## GCP implementation
The GCP Identity and Access Management service account for the File service must have the
`iam.serviceAccounts.signBlob` permission.
The predefined **Cloud Functions Service Agent**, **Cloud Run Service Agent**, and **Service Account
Token Creator** roles include the required permission.
For development purposes, it's recommended to create a separate service account.
It's enough to grant the **Service Account Token Creator** role to the development service account.
Obtaining user credentials for Application Default Credentials isn't suitable in this case because
signing a blob is only available with the service account credentials. Remember to set the
`GOOGLE_APPLICATION_CREDENTIALS` environment variable. Follow the [instructions on the Google
developer's portal][application-default-credentials].
### Persistence layer
The GCP implementation contains two mutually exclusive modules to work with the persistence layer.
Presently, OSDU R2 connects to legacy Cloud Datastore for compatibility with the current OpenDES
implementation. In the future OSDU releases, Cloud Datastore will be replaced by a Cloud Firestore
implementation that's already available in the project.
* The Cloud Datastore implementation is located in the **provider/file-gcp-datastore** folder.
* The Cloud Firestore implementation is located in the **provider/file-gcp** folder.
To learn more about available collections, follow to the [Firestore collections](#firestore-collections)
section.
## Datastore
The service account for File service must have the `datastore.indexes.*` permissions. The
predefined **roles/datastore.indexAdmin** and **roles/datastore.owner** roles include the required
permission.
## Firestore collections
The GCP implementation of the File service uses Cloud Firestore with the following collections
and indexes.
### `file-locations` collection
| Field | Type | Description |
| --------- | -------- | ------------------------------------------------------------------------- |
| FileID | `Object` | Unique file ID that references a file data object with Driver, Location, CreatedAt, and CreatedBy |
| Driver | `String` | Description of the storage where files were loaded |
| Location | `String` | Direct URI to the file in storage |
| CreatedAt | `String` | Time when the record was created |
| CreatedBy | `String` | ID of the user that requested file location |
> **Note**: The `Location` value might be different from the signed URL returned to the user.
> **Note**: The `CreatedBy` property isn't supported in the OSDU R2 Prototype.
### Indexes
#### Single Field
| Collection ID | Field path | Collection scope | Collection group scope |
| -------------- | ---------- | ---------------- | ---------------------- |
| file-locations | FileID | _no changes_ | _no changes_ |
#### Composite
| Collection ID | Fields | Query scope |
| -------------- | ---------------------------------- | ----------- |
| file-locations | `CreatedBy: ASC`, `CreatedAt: ASC` | Collection |
## Running integration tests
Integration tests are located in a separate project for each cloud in the ```testing``` directory under the project root directory.
### GCP
Instructions for running the GCP integration tests can be found [here](provider/file-gcp-datastore/README.md).
[application-default-credentials]: https://developers.google.com/identity/protocols/application-default-credentials#calling
## GCP Implementation
* All documentation for The Cloud Datastore implementation of File service is located [here](./provider/file-gcp-datastore/README.md).
* All documentation for The Cloud Firestore implementation of File service is located [here](./provider/file-gcp/README.md).
# file-gcp-datastore
# File Service
## Running Locally
The OSDU R2 File service provides internal and external API endpoints to let the application or
user fetch any records from the system or request file location data. For example, users can
request generation of an individual signed URL per file. Using a signed URL, OSDU R2 users will be
able to upload their files to the system.
### Requirements
The current implementation of the File service supports only cloud platform-specific locations.
The future implementations might allow the use of on-premises locations.
In order to run this service locally, you will need the following:
## Getting Started
- [Maven 3.6.0+](https://maven.apache.org/download.cgi)
- [AdoptOpenJDK8](https://adoptopenjdk.net/)
- Infrastructure dependencies, deployable through the relevant [infrastructure template](https://community.opengroup.org/osdu/platform/deployment-and-operations/infra-gcp-provisioning)
These instructions will get you a copy of the project up and running on your local machine for development and testing purposes. See deployment for notes on how to deploy the project on a live system.
### Prerequisites
Pre-requisites
* GCloud SDK with java (latest version)
* JDK 8
* Lombok 1.16 or later
* Maven
### Environment Variables
......@@ -20,6 +31,26 @@ In order to run the service locally, you will need to have the following environ
| `OSDU_ENTITLEMENTS_URL` | `/https://entitlements.com/entitlements/v1` | Entitlements API endpoint | no | output of infrastructure deployment |
| `FILE_LOCATION_BUCKET-NAME` | ex `osdu-cicd-epam-file` | Bucket name for files | no | - |
| `FILE_LOCATION_USER-ID` | ex `common-user` | User id which used to define files location in bucket | no | output of infrastructure deployment |
| `GCLOUD_PROJECT` | ex `osdu-cicd-epam` | Google cloud project id | no | -- |
| `GOOGLE_AUDIENCES` | ex `*****.apps.googleusercontent.com` | Client ID for getting access to cloud resources | yes | https://console.cloud.google.com/apis/credentials |
| `GOOGLE_APPLICATION_CREDENTIALS` | ex `/path/to/directory/service-key.json` | Service account credentials, you only need this if running locally | yes | https://console.cloud.google.com/iam-admin/serviceaccounts |
| `RECORDS_ROOT_URL` | ex `https://os-storage-dot-nice-etching-277309.uc.r.appspot.com/api/storage/v2` / Storage API endpoint | no | output of infrastructure deployment |
**Cloud roles configuration for accounts**
The GCP Identity and Access Management service account for the File service must have the
`iam.serviceAccounts.signBlob` permission.
The predefined **Cloud Functions Service Agent**, **Cloud Run Service Agent**, and **Service Account
Token Creator** roles include the required permission.
For development purposes, it's recommended to create a separate service account.
It's enough to grant the **Service Account Token Creator** role to the development service account.
Obtaining user credentials for Application Default Credentials isn't suitable in this case because
signing a blob is only available with the service account credentials. Remember to set the
`GOOGLE_APPLICATION_CREDENTIALS` environment variable. Follow the [instructions on the Google
developer's portal][application-default-credentials].
**Required to run integration tests**
......@@ -83,12 +114,50 @@ $ cat ~/.m2/settings.xml
</servers>
</settings>
```
#### Datastore
The service account for File service must have the `datastore.indexes.*` permissions. The
predefined **roles/datastore.indexAdmin** and **roles/datastore.owner** roles include the required
permission.
### Build and run the application
* Update the Google cloud SDK to the latest version:
```bash
gcloud components update
```
* Set Google Project Id:
```bash
gcloud config set project <YOUR-PROJECT-ID>
```
* Perform a basic authentication in the selected project:
```bash
gcloud auth application-default login
```
* Navigate to File Service root folder and run:
```bash
mvn clean install
```
* If you wish to see the coverage report then go to target\site\jacoco\index.html and open index.html
* If you wish to build the project without running tests
```bash
mvn clean install -DskipTests
```
After configuring your environment as specified above, you can follow these steps to build and run the application. These steps should be invoked from the *repository root.*
```bash
cd provider/file-gcp-datastore/ && mvn spring-boot:run
```
### Test the application
After the service has started it should be accessible via a web browser by visiting [http://localhost:8080/swagger-ui.html](http://localhost:8080/swagger-ui.html). If the request does not fail, you can then run the integration tests.
......@@ -104,18 +173,28 @@ $ (cd testing/file-test-core/ && mvn clean install)
$ (cd testing/file-test-gcp/ && mvn clean test)
```
## Deployment
Storage Service is compatible with Cloud Run.
* To deploy into Cloud run, please, use this documentation:
https://cloud.google.com/run/docs/quickstarts/build-and-deploy
## License
Copyright 2020 Google LLC
Copyright 2020 EPAM Systems, Inc
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
Copyright © Google LLC
Copyright © EPAM Systems
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
[http://www.apache.org/licenses/LICENSE-2.0](http://www.apache.org/licenses/LICENSE-2.0)
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
# File Service
The OSDU R2 File service provides internal and external API endpoints to let the application or
user fetch any records from the system or request file location data. For example, users can
request generation of an individual signed URL per file. Using a signed URL, OSDU R2 users will be
able to upload their files to the system.
The current implementation of the File service supports only cloud platform-specific locations.
The future implementations might allow the use of on-premises locations.
## Getting Started
These instructions will get you a copy of the project up and running on your local machine for development and testing purposes. See deployment for notes on how to deploy the project on a live system.
### Prerequisites
Pre-requisites
* GCloud SDK with java (latest version)
* JDK 8
* Lombok 1.16 or later
* Maven
### Environment Variables
In order to run the service locally, you will need to have the following environment variables defined.
| name | value | description | sensitive? | source |
| --- | --- | --- | --- | --- |
| `LOG_PREFIX` | `ingest` | Logging prefix | no | - |
| `OSDU_ENTITLEMENTS_URL` | `/https://entitlements.com/entitlements/v1` | Entitlements API endpoint | no | output of infrastructure deployment |
| `FILE_LOCATION_BUCKET-NAME` | ex `osdu-cicd-epam-file` | Bucket name for files | no | - |
| `FILE_LOCATION_USER-ID` | ex `common-user` | User id which used to define files location in bucket | no | output of infrastructure deployment |
| `GCLOUD_PROJECT` | ex `osdu-cicd-epam` | Google cloud project id | no | -- |
| `GOOGLE_AUDIENCES` | ex `*****.apps.googleusercontent.com` | Client ID for getting access to cloud resources | yes | https://console.cloud.google.com/apis/credentials |
| `GOOGLE_APPLICATION_CREDENTIALS` | ex `/path/to/directory/service-key.json` | Service account credentials, you only need this if running locally | yes | https://console.cloud.google.com/iam-admin/serviceaccounts |
| `RECORDS_ROOT_URL` | ex `https://os-storage-dot-nice-etching-277309.uc.r.appspot.com/api/storage/v2` / Storage API endpoint | no | output of infrastructure deployment |
**Cloud roles configuration for accounts**
The GCP Identity and Access Management service account for the File service must have the
`iam.serviceAccounts.signBlob` permission.
The predefined **Cloud Functions Service Agent**, **Cloud Run Service Agent**, and **Service Account
Token Creator** roles include the required permission.
For development purposes, it's recommended to create a separate service account.
It's enough to grant the **Service Account Token Creator** role to the development service account.
Obtaining user credentials for Application Default Credentials isn't suitable in this case because
signing a blob is only available with the service account credentials. Remember to set the
`GOOGLE_APPLICATION_CREDENTIALS` environment variable. Follow the [instructions on the Google
developer's portal][application-default-credentials].
**Required to run integration tests**
| name | value | description | sensitive? | source |
| --- | --- | --- | --- | --- |
| `FILE_SERVICE_HOST` | `http://localhost:8080` | File service url | no | - |
| `INTEGRATION_TESTER` | `********` | Service account for API calls. Note: this user must have entitlements configured already| yes | https://console.cloud.google.com/iam-admin/serviceaccounts |
| `NO_DATA_ACCESS_TESTER` | `********` | Service account without data access | yes | https://console.cloud.google.com/iam-admin/serviceaccounts |
| `TARGET_AUDIENCE` | `********` | client application ID | yes | https://console.cloud.google.com/apis/credentials |
| `DATA_PARTITION_ID` | `opendes` | environment data partition | no | - |
| `USER_ID` | `common-user` | User id which used to define files location in bucket | no | [defined here](src/main/resources/application.properties) |
| `TIME_ZONE` | `UTC+0` | Storage time-zone, for test requests based on time of file creation | no | - |
| `FILE_BUCKET` | `osdu-cicd-epam-file` | Bucket name for files | no | [defined here](src/main/resources/application.properties) |
| `GCLOUD_PROJECT` | ex `osdu-cicd-epam` | Google cloud project id | no | -- |
| `GCP_DEPLOY_FILE` | ex `********` | Service account for test data tear down, must have cloud storage role configured| yes | https://console.cloud.google.com/iam-admin/serviceaccounts |
**Entitlements configuration for integration accounts**
| INTEGRATION_TESTER | NO_DATA_ACCESS_TESTER |
| --- | --- |
| users<br/>service.entitlements.user<br/>service.storage.creator | users<br/>service.entitlements.user |
**Cloud roles configuration for integration accounts**
| GCP_DEPLOY_FILE|
| --- |
| storage.objects.delete access to the Google Cloud Storage |
### Configure Maven
Check that maven is installed:
```bash
$ mvn --version
Apache Maven 3.6.0
Maven home: /usr/share/maven
Java version: 1.8.0_212, vendor: AdoptOpenJDK, runtime: /usr/lib/jvm/jdk8u212-b04/jre
...
```
You may need to configure access to the remote maven repository that holds the OSDU dependencies. This file should live within `~/.mvn/community-maven.settings.xml`:
```bash
$ cat ~/.m2/settings.xml
<?xml version="1.0" encoding="UTF-8"?>
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd">
<servers>
<server>
<id>community-maven-via-private-token</id>
<!-- Treat this auth token like a password. Do not share it with anyone, including Microsoft support. -->
<!-- The generated token expires on or before 11/14/2019 -->
<configuration>
<httpHeaders>
<property>
<name>Private-Token</name>
<value>${env.COMMUNITY_MAVEN_TOKEN}</value>
</property>
</httpHeaders>
</configuration>
</server>
</servers>
</settings>
```
#### Firestore collections
The GCP implementation of the File service uses Cloud Firestore with the following collections
and indexes.
##### `file-locations` collection
| Field | Type | Description |
| --------- | -------- | ------------------------------------------------------------------------- |
| FileID | `Object` | Unique file ID that references a file data object with Driver, Location, CreatedAt, and CreatedBy |
| Driver | `String` | Description of the storage where files were loaded |
| Location | `String` | Direct URI to the file in storage |
| CreatedAt | `String` | Time when the record was created |
| CreatedBy | `String` | ID of the user that requested file location |
> **Note**: The `Location` value might be different from the signed URL returned to the user.
> **Note**: The `CreatedBy` property isn't supported in the OSDU R2 Prototype.
#### Indexes
##### Single Field
| Collection ID | Field path | Collection scope | Collection group scope |
| -------------- | ---------- | ---------------- | ---------------------- |
| file-locations | FileID | _no changes_ | _no changes_ |
##### Composite
| Collection ID | Fields | Query scope |
| -------------- | ---------------------------------- | ----------- |
| file-locations | `CreatedBy: ASC`, `CreatedAt: ASC` | Collection |
### Build and run the application
* Update the Google cloud SDK to the latest version:
```bash
gcloud components update
```
* Set Google Project Id:
```bash
gcloud config set project <YOUR-PROJECT-ID>
```
* Perform a basic authentication in the selected project:
```bash
gcloud auth application-default login
```
* Navigate to File Service root folder and run:
```bash
mvn clean install
```
* If you wish to see the coverage report then go to target\site\jacoco\index.html and open index.html
* If you wish to build the project without running tests
```bash
mvn clean install -DskipTests
```
After configuring your environment as specified above, you can follow these steps to build and run the application. These steps should be invoked from the *repository root.*
```bash
cd provider/file-gcp/ && mvn spring-boot:run
```
### Test the application
After the service has started it should be accessible via a web browser by visiting [http://localhost:8080/swagger-ui.html](http://localhost:8080/swagger-ui.html). If the request does not fail, you can then run the integration tests.
```bash
# build + install integration test core
$ (cd testing/file-test-core/ && mvn clean install)
# build + run GCP integration tests.
#
# Note: this assumes that the environment variables for integration tests as outlined
# above are already exported in your environment.
$ (cd testing/file-test-gcp/ && mvn clean test)
```
## Deployment
Storage Service is compatible with Cloud Run.
* To deploy into Cloud run, please, use this documentation:
https://cloud.google.com/run/docs/quickstarts/build-and-deploy
## License
Copyright © Google LLC
Copyright © EPAM Systems
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
[http://www.apache.org/licenses/LICENSE-2.0](http://www.apache.org/licenses/LICENSE-2.0)
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
......@@ -123,6 +123,25 @@
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.jacoco</groupId>
<artifactId>jacoco-maven-plugin</artifactId>
<version>0.7.7.201606060606</version>
<executions>
<execution>
<goals>
<goal>prepare-agent</goal>
</goals>
</execution>
<execution>
<id>report</id>
<phase>prepare-package</phase>
<goals>
<goal>report</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment