Add container-canary.

.github/workflows/docker-publish.yml

@@ -82,6 +82,19 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Install Container Canary
+        run: |
+          curl -L https://github.com/NVIDIA/container-canary/releases/download/v0.2.1/canary_linux_amd64 > /usr/local/bin/canary
+          chmod +x /usr/local/bin/canary
+
+      - name: Build Container for validation
+        run: docker build -t nsls2api .
+
+      - name: Validate container
+        run: canary validate --file canary-validator.yml nsls2api
+        env:
+          IMAGE_NAME: ${{ env.IMAGE_NAME }}
+
       # Sign the resulting Docker image digest except on PRs.
       # This will only write to the public Rekor transparency log when the Docker
       # repository is public to avoid leaking data.  If you would like to publish

.gitignore

@@ -1,6 +1,9 @@
 # Project exclude paths
 /venv/
 
+# Hatch managed version file
+src/nsls2api/_version.py
+
 # HTTP Client environments
 http-client.private.env.json
 
@@ -141,4 +144,4 @@ settings.json
 
 .idea/
 .idea/dataSources.xml
-/workspace.code-workspace
+/workspace.code-workspace

Dockerfile

@@ -6,7 +6,7 @@ COPY requirements.txt .
 RUN pip install --no-cache-dir --upgrade pip wheel
 RUN pip install --no-cache-dir --upgrade -r /code/requirements.txt
 
-COPY . . 
+COPY . .
 RUN pip install '.'
 
 CMD ["uvicorn", "nsls2api.main:api", "--proxy-headers", "--host", "0.0.0.0", "--port", "8080", "--workers", "4", "--ssl-keyfile=/etc/nsls2/tls/server.key", "--ssl-certfile=/etc/nsls2/tls/server.cer"]

canary-validator.yml

@@ -0,0 +1,33 @@
+# This is used to verify that a container image has the basic expected behavior.
+# See https://github.com/NVIDIA/container-canary
+#
+# Run locally like:
+#
+# canary validate --file canary-validator.yml ghcr.io/bluesky/tiled:latest
+
+apiVersion: container-canary.nvidia.com/v2
+kind: Validator
+name: nsls2api
+description: Validate that container image is operational.
+# env:
+#  - name: ...
+#    value: 
+ports:
+ - port: 8080
+   protocol: TCP
+volumes: []
+checks:
+  - name: tcp
+    description: Is listening via TCP on port 8080
+    probe:
+      tcpSocket:
+        port: 31415
+  - name: http
+    description: Responds HTTP GET on port 8080 at route /docs
+    probe:
+      httpGet:
+        path: /docs
+        port: 8080
+      initialDelaySeconds: 5
+      timeoutSeconds: 10
+      failureThreshold: 3

src/nsls2api/main.py

@@ -66,13 +66,6 @@ def configure_routing():
     )
 
 
-@api.get("/healthy")
-async def healthy():
-    return fastapi.responses.PlainTextResponse(
-        "OK", status_code=fastapi.status.HTTP_200_OK
-    )
-
-
 @api.on_event("startup")
 async def configure_db():
     await mongodb_setup.init_connection(settings.mongodb_dsn.unicode_string())

src/nsls2api/views/home.py

@@ -20,6 +20,15 @@ def index(request: Request):
     return templates.TemplateResponse("home/index.html", data)
 
 
+# This is a test endpoint to make sure the server is running
+# It is used by haproxy to determine if the server is healthy
+@router.get("/healthy", include_in_schema=False)
+async def healthy():
+    return fastapi.responses.PlainTextResponse(
+        "OK", status_code=fastapi.status.HTTP_200_OK
+    )
+
+
 @router.get("/default", include_in_schema=False)
 def index(request: Request):
     data = {"request": request}