relay-core

Relay Core

This repository contains a Kubernetes-based execution engine for running workflows or processing webhook triggers.

Installation

kustomize build manifests | kubectl apply -f -
kustomize build examples/install | kubectl apply -f -

Requirements

• Kubernetes v1.20+
• Tekton (v0.32.1+)
• Knative Serving (v1.1.2+)
• Kourier (v1.1.0+)

Components

Operator

The Relay operator is responsible for reconciling the Relay custom resource definitions (CRDs). It is built using controller-runtime, although it does not use a higher-level framework like Kubebuilder or Operator SDK.

The entry point for the operator is in cmd/relay-operator.

Resources

Metadata API

The metadata API provides runtime information to a pod running under the supervision of the Relay operator.

The entry point for the metadata API is in cmd/relay-metadata-api.

Endpoints

Requests to the metadata API are always authenticated. In production mode, we use the source IP of the request to look up an annotation containing an encrypted token that grants access to the resources for that pod. Once authenticated, the following endpoints are available:

Testing

To test the metadata API without deploying it in a live environment, you can run it using a sample configuration. A selection of sample configurations are provided in the examples/sample-configs directory.

You can specify a JWT signing key for authenticating requests explicitly using the RELAY_METADATA_API_SAMPLE_HS256_SIGNING_KEY environment variable. If not specified, the metadata API process will generate and print one when it starts up.

For example:

$ go build -o relay-metadata-api ./cmd/relay-metadata-api
$ export RELAY_METADATA_API_SAMPLE_CONFIG_FILES=examples/sample-configs/simple.yaml
$ ./relay-metadata-api &
[...] created new HMAC-SHA256 signing key     key=[...]
[...] generated JWT for step                  run-id=1234 step-name=foo token=eyJhbGciOiJIUzI1NiJ9.[...]
[...] listening for metadata connections      addr=0.0.0.0:7000
$ curl -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.[...]' http://localhost:7000/spec | jq .
{
  "value": {
    "aws": {
      "accessKeyID": "AKIASAMPLEKEY",
      "secretAccessKey": "6bkpuV9fF3LX1Yo79OpfTwsw8wt5wsVLGTPJjDTu"
    },
    "foo": "bar"
  },
  "unresolvable": {},
  "complete": true
}

Contributing

See CONTRIBUTING.md for more information on how to contribute to this project.