Ubuntu 16.04でDocker Swarmを使用してOpenFaaSをインストールして保護する方法

cd ~
git clone https://github.com/openfaas/faas.git

cd ~/faas

git checkout 0.8.9

OutputNote: checking out '0.8.9'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by performing another checkout.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -b with the checkout command again. Example:

  git checkout -b 

HEAD is now at 8f0d2d1 Expose scale-function endpoint

cd ~
curl -sSL -o faas-cli.sh https://cli.openfaas.com

less faas-cli.sh

chmod +x faas-cli.sh
sudo ./faas-cli.sh

Outputx86_64
Downloading package https://github.com/openfaas/faas-cli/releases/download/0.6.17/faas-cli as /tmp/faas-cli
Download complete.

Running as root - Attempting to move faas-cli to /usr/local/bin
New version of faas-cli installed to /usr/local/bin
Creating alias 'faas' for 'faas-cli'.
  ___                   _____           ____
 / _ \ _ __   ___ _ __ |  ___|_ _  __ _/ ___|
| | | | '_ \ / _ \ '_ \| |_ / _` |/ _` \___ \
| |_| | |_) |  __/ | | |  _| (_| | (_| |___) |
 \___/| .__/ \___|_| |_|_|  \__,_|\__,_|____/
      |_|

CLI:
 commit:  b5597294da6dd98457434fafe39054c993a5f7e7
 version: 0.6.17

faas-cli

Output  ___                   _____           ____
 / _ \ _ __   ___ _ __ |  ___|_ _  __ _/ ___|
| | | | '_ \ / _ \ '_ \| |_ / _` |/ _` \___ \
| |_| | |_) |  __/ | | |  _| (_| | (_| |___) |
 \___/| .__/ \___|_| |_|_|  \__,_|\__,_|____/
      |_|


Manage your OpenFaaS functions from the command line

Usage:
  faas-cli [flags]
  faas-cli [command]

Available Commands:
  build          Builds OpenFaaS function containers
  cloud          OpenFaaS Cloud commands
  deploy         Deploy OpenFaaS functions
  help           Help about any command
  invoke         Invoke an OpenFaaS function
  list           List OpenFaaS functions
  login          Log in to OpenFaaS gateway
  logout         Log out from OpenFaaS gateway
  new            Create a new template in the current folder with the name given as name
  push           Push OpenFaaS functions to remote registry (Docker Hub)
  remove         Remove deployed OpenFaaS functions
  store          OpenFaaS store commands
  template       Downloads templates from the specified github repo
  version        Display the clients version information

Flags:
      --filter string   Wildcard to match with function names in YAML file
  -h, --help            help for faas-cli
      --regex string    Regex to match with function names in YAML file
  -f, --yaml string     Path to YAML file describing function(s)

Use "faas-cli [command] --help" for more information about a command.

cd ~/faas
nano ~/faas/docker-compose.yml

version: "3.3"
services:
    traefik:
        image: traefik:v1.6
    gateway:
         ...

...
    traefik:
        image: traefik:v1.6
        command: -c --docker=true
            --docker.swarmmode=true
            --docker.domain=traefik
            --docker.watch=true
            --web=true
            --defaultEntryPoints='http,https'
            --entryPoints='Name:https Address::443 TLS'
            --entryPoints='Name:http Address::80'
            --acme=true
            --acme.entrypoint='https'
            --acme.httpchallenge=true
            --acme.httpchallenge.entrypoint='http'
            --acme.domains='example.com, www.example.com'
            --acme.email='[email protected]'
            --acme.ondemand=true
            --acme.onhostrule=true
            --acme.storage=/etc/traefik/acme/acme.json
...

        ...
        command:
            ...
        ports:
            - 80:80
            - 8080:8080
            - 443:443
        ...

        ...
        volumes:
            - "/var/run/docker.sock:/var/run/docker.sock"
            - "acme:/etc/traefik/acme"
        networks:
            - functions
        deploy:
            placement:
                constraints: [node.role == manager]

version: "3.3"
services:
    traefik:
        image: traefik:v1.6
        command: -c --docker=true
            --docker.swarmmode=true
            --docker.domain=traefik
            --docker.watch=true
            --web=true
            --defaultEntryPoints='http,https'
            --entryPoints='Name:https Address::443 TLS'
            --entryPoints='Name:http Address::80'
            --acme=true
            --acme.entrypoint='https'
            --acme.httpchallenge=true
            --acme.httpchallenge.entrypoint='http'
            --acme.domains='example.com, www.example.com'
            --acme.email='[email protected]'
            --acme.ondemand=true
            --acme.onhostrule=true
            --acme.storage=/etc/traefik/acme/acme.json
        ports:
            - 80:80
            - 8080:8080
            - 443:443
        volumes:
            - "/var/run/docker.sock:/var/run/docker.sock"
            - "acme:/etc/traefik/acme"
        networks:
          - functions
        deploy:
          placement:
            constraints: [node.role == manager]

    gateway:
        ...

...
    gateway:
        ports:
            - 8080:8080
        image: openfaas/gateway:0.8.7
        networks:
            - functions
        environment:
            functions_provider_url: "http://faas-swarm:8080/"
            read_timeout:  "300s"        # Maximum time to read HTTP request
            write_timeout: "300s"        # Maximum time to write HTTP response
            upstream_timeout: "300s"     # Maximum duration of upstream function call - should be more than read_timeout and write_timeout
            dnsrr: "true"               # Temporarily use dnsrr in place of VIP while issue persists on PWD
            faas_nats_address: "nats"
            faas_nats_port: 4222
            direct_functions: "true"    # Functions are invoked directly over the overlay network
            direct_functions_suffix: ""
            basic_auth: "${BASIC_AUTH:-true}"
            secret_mount_path: "/run/secrets/"
            scale_from_zero: "false"
        deploy:
            resources:
                # limits:   # Enable if you want to limit memory usage
                #     memory: 200M
                reservations:
                    memory: 100M
            restart_policy:
                condition: on-failure
                delay: 5s
                max_attempts: 20
                window: 380s
            placement:
                constraints:
                    - 'node.platform.os == linux'
        secrets:
            - basic-auth-user
            - basic-auth-password
...

        ...
        deploy:
            labels:
                - traefik.port=8080
                - traefik.frontend.rule=PathPrefix:/ui,/system,/function
            resources:
            ...

...
    gateway:
        image: openfaas/gateway:0.8.7
        networks:
            - functions
        environment:
            functions_provider_url: "http://faas-swarm:8080/"
            read_timeout:  "300s"        # Maximum time to read HTTP request
            write_timeout: "300s"        # Maximum time to write HTTP response
            upstream_timeout: "300s"     # Maximum duration of upstream function call - should be more than read_timeout and write_timeout
            dnsrr: "true"               # Temporarily use dnsrr in place of VIP while issue persists on PWD
            faas_nats_address: "nats"
            faas_nats_port: 4222
            direct_functions: "true"    # Functions are invoked directly over the overlay network
            direct_functions_suffix: ""
            basic_auth: "${BASIC_AUTH:-true}"
            secret_mount_path: "/run/secrets/"
            scale_from_zero: "false"
        deploy:
            labels:
                - traefik.port=8080
                - traefik.frontend.rule=PathPrefix:/ui,/system,/function
            resources:
                # limits:   # Enable if you want to limit memory usage
                #     memory: 200M
                reservations:
                    memory: 100M
            restart_policy:
                condition: on-failure
                delay: 5s
                max_attempts: 20
                window: 380s
            placement:
                constraints:
                    - 'node.platform.os == linux'
        secrets:
            - basic-auth-user
            - basic-auth-password
...

...
volumes:
    acme:

docker-machine use node-1

eval $(docker-machine env node-1)

~/faas/deploy_stack.sh

OutputAttempting to create credentials for gateway..
roozmk0y1jkn17372a8v9y63g
q1odtpij3pbqrmmf8msy3ampl
[Credentials]
 username: admin
 password: your_openfaas_password
 echo -n your_openfaas_password | faas-cli login --username=admin --password-stdin

Enabling basic authentication for gateway..

Deploying OpenFaaS core services
Creating network func_functions
Creating config func_alertmanager_config
Creating config func_prometheus_config
Creating config func_prometheus_rules
Creating service func_alertmanager
Creating service func_traefik
Creating service func_gateway
Creating service func_faas-swarm
Creating service func_nats
Creating service func_queue-worker
Creating service func_prometheus

echo -n your_openfaas_password | faas-cli login --username=admin --password-stdin --gateway https://example.com

OutputCalling the OpenFaaS server to validate the credentials...
credentials saved for admin https://example.com

faas-cli deploy -f ~/faas/stack.yml --gateway https://example.com

OutputDeploying: wordcount.

Deployed. 200 OK.
URL: https://example.com/function/wordcount

Deploying: base64.

Deployed. 200 OK.
URL: https://example.com/function/base64

Deploying: markdown.

Deployed. 200 OK.
URL: https://example.com/function/markdown

Deploying: hubstats.

Deployed. 200 OK.
URL: https://example.com/function/hubstats

Deploying: nodeinfo.

Deployed. 200 OK.
URL: https://example.com/function/nodeinfo

Deploying: echoit.

Deployed. 200 OK.
URL: https://example.com/function/echoit

faas-cli list --gateway https://example.com

OutputFunction                        Invocations     Replicas
markdown                        0               1
wordcount                       0               1
base64                          0               1
nodeinfo                        0               1
hubstats                        0               1
echoit                          0               1

curl -u admin:your_openfaas_password -X GET https://example.com/system/functions

Output[{"name":"base64","image":"functions/alpine:latest","invocationCount":0,"replicas":1,"envProcess":"base64","availableReplicas":0,"labels":{"com.openfaas.function":"base64","function":"true"}},{"name":"nodeinfo","image":"functions/nodeinfo:latest","invocationCount":0,"replicas":1,"envProcess":"","availableReplicas":0,"labels":{"com.openfaas.function":"nodeinfo","function":"true"}},{"name":"hubstats","image":"functions/hubstats:latest","invocationCount":0,"replicas":1,"envProcess":"","availableReplicas":0,"labels":{"com.openfaas.function":"hubstats","function":"true"}},{"name":"markdown","image":"functions/markdown-render:latest","invocationCount":0,"replicas":1,"envProcess":"","availableReplicas":0,"labels":{"com.openfaas.function":"markdown","function":"true"}},{"name":"echoit","image":"functions/alpine:latest","invocationCount":0,"replicas":1,"envProcess":"cat","availableReplicas":0,"labels":{"com.openfaas.function":"echoit","function":"true"}},{"name":"wordcount","image":"functions/alpine:latest","invocationCount":0,"replicas":1,"envProcess":"wc","availableReplicas":0,"labels":{"com.openfaas.function":"wordcount","function":"true"}}]

docker service logs func_gateway

curl -u admin:your_openfaas_password -X GET https://example.com/system/functions | jq

Output[
  {
    "name": "base64",
    "image": "functions/alpine:latest",
    "invocationCount": 0,
    "replicas": 1,
    "envProcess": "base64",
    "availableReplicas": 0,
    "labels": {
      "com.openfaas.function": "base64",
      "function": "true"
    }
  },
  {
    "name": "nodeinfo",
    "image": "functions/nodeinfo:latest",
    "invocationCount": 0,
    "replicas": 1,
    "envProcess": "",
    "availableReplicas": 0,
    "labels": {
      "com.openfaas.function": "nodeinfo",
      "function": "true"
    }
  },
  {
    "name": "hubstats",
    "image": "functions/hubstats:latest",
    "invocationCount": 0,
    "replicas": 1,
    "envProcess": "",
    "availableReplicas": 0,
    "labels": {
      "com.openfaas.function": "hubstats",
      "function": "true"
    }
  },
  {
    "name": "markdown",
    "image": "functions/markdown-render:latest",
    "invocationCount": 0,
    "replicas": 1,
    "envProcess": "",
    "availableReplicas": 0,
    "labels": {
      "com.openfaas.function": "markdown",
      "function": "true"
    }
  },
  {
    "name": "echoit",
    "image": "functions/alpine:latest",
    "invocationCount": 0,
    "replicas": 1,
    "envProcess": "cat",
    "availableReplicas": 0,
    "labels": {
      "com.openfaas.function": "echoit",
      "function": "true"
    }
  },
  {
    "name": "wordcount",
    "image": "functions/alpine:latest",
    "invocationCount": 0,
    "replicas": 1,
    "envProcess": "wc",
    "availableReplicas": 0,
    "labels": {
      "com.openfaas.function": "wordcount",
      "function": "true"
    }
  }
]

curl -u admin:your_openfaas_password -X POST https://example.com/function/func_echoit -d "Sammy The Shark"

OutputSammy The Shark

mkdir ~/faas-functions
cd ~/faas-functions

faas-cli new echo-input --lang python --prefix your-docker-hub-username --gateway https://example.com

Output2018/05/13 12:13:06 No templates found in current directory.
2018/05/13 12:13:06 Attempting to expand templates from https://github.com/openfaas/templates.git
2018/05/13 12:13:11 Fetched 12 template(s) : [csharp dockerfile go go-armhf node node-arm64 node-armhf python python-armhf python3 python3-armhf ruby] from https://github.com/openfaas/templates.git
Folder: echo-input created.
  ___                   _____           ____
 / _ \ _ __   ___ _ __ |  ___|_ _  __ _/ ___|
| | | | '_ \ / _ \ '_ \| |_ / _` |/ _` \___ \
| |_| | |_) |  __/ | | |  _| (_| | (_| |___) |
 \___/| .__/ \___|_| |_|_|  \__,_|\__,_|____/
      |_|


Function created in folder: echo-input
Stack file written: echo-input.yml

cd ~/faas-fucntions/echo-input

ls

cat requirements.txt

nano handler.py

def handle(req):
    """handle a request to the function
    Args:
        req (str): request body
    """

    return req

    return "Received message: " + req

cd ~/faas-functions

faas-cli build -f echo-input.yml

Output[0] > Building echo-input.
Clearing temporary build folder: ./build/echo-input/
Preparing ./echo-input/ ./build/echo-input/function
Building: sammy/echo-input with python template. Please wait..
Sending build context to Docker daemon  7.168kB
Step 1/16 : FROM python:2.7-alpine
 ---> 5fdd069daf25
Step 2/16 : RUN apk --no-cache add curl     && echo "Pulling watchdog binary from Github."     && curl -sSL https://github.com/openfaas/faas/releases/download/0.8.0/fwatchdog > /usr/bin/fwatchdog     && chmod +x /usr/bin/fwatchdog     && apk del curl --no-cache
 ---> Using cache
 ---> 247d4772623a
Step 3/16 : WORKDIR /root/
 ---> Using cache
 ---> 532cc683d67b
Step 4/16 : COPY index.py           .
 ---> Using cache
 ---> b4b512152257
Step 5/16 : COPY requirements.txt   .
 ---> Using cache
 ---> 3f9cbb311ab4
Step 6/16 : RUN pip install -r requirements.txt
 ---> Using cache
 ---> dd7415c792b1
Step 7/16 : RUN mkdir -p function
 ---> Using cache
 ---> 96c25051cefc
Step 8/16 : RUN touch ./function/__init__.py
 ---> Using cache
 ---> 77a9db274e32
Step 9/16 : WORKDIR /root/function/
 ---> Using cache
 ---> 88a876eca9e3
Step 10/16 : COPY function/requirements.txt .
 ---> Using cache
 ---> f9ba5effdc5a
Step 11/16 : RUN pip install -r requirements.txt
 ---> Using cache
 ---> 394a1dd9e4d7
Step 12/16 : WORKDIR /root/
 ---> Using cache
 ---> 5a5893c25b65
Step 13/16 : COPY function           function
 ---> eeddfa67018d
Step 14/16 : ENV fprocess="python index.py"
 ---> Running in 8e53df4583f2
Removing intermediate container 8e53df4583f2
 ---> fb5086bc7f6c
Step 15/16 : HEALTHCHECK --interval=1s CMD [ -e /tmp/.lock ] || exit 1
 ---> Running in b38681a71378
Removing intermediate container b38681a71378
 ---> b04c045b0994
Step 16/16 : CMD ["fwatchdog"]
 ---> Running in c5a11078df3d
Removing intermediate container c5a11078df3d
 ---> bc5f08157c5a
Successfully built bc5f08157c5a
Successfully tagged sammy/echo-input:latest
Image: your-docker-hub-username/echo-input built.
[0] < Building echo-input done.
[0] worker done.

faas-cli push -f echo-input.yml

Output[0] > Pushing echo-input.
The push refers to repository [docker.io/sammy/echo-input]
320ea573b385: Pushed
9d87e56f5d0c: Pushed
6f79b75e7434: Pushed
23aac2d8ecf2: Pushed
2bec17d09b7e: Pushed
e5a0e5ab3be6: Pushed
e9c8ca932f1b: Pushed
beae1d55b4ce: Pushed
2fcae03ed1f7: Pushed
62103d5daa03: Mounted from library/python
f6ac6def937b: Mounted from library/python
55c108c7613c: Mounted from library/python
e53f74215d12: Mounted from library/python
latest: digest: sha256:794fa942c2f593286370bbab2b6c6b75b9c4dcde84f62f522e59fb0f52ba05c1 size: 3033
[0] < Pushing echo-input done.
[0] worker done.

faas-cli deploy -f echo-input.yml --gateway https://example.com

OutputDeploying: echo-input.

Deployed. 200 OK.
URL: https://example.com/function/echo-input

faas-cli invoke echo-input --gateway https://example.com

OutputReading from STDIN - hit (Control + D) to stop.

Sammy The Shark!

OutputReading from STDIN - hit (Control + D) to stop.
Sammy The Shark!
Received message: Sammy The Shark!