Skip to content

Commit 64286b8

Browse files
swarooparswaroopar
committed
build dev zitadel docker images
1 parent b1fb895 commit 64286b8

23 files changed

+506
-148
lines changed

‎.github/workflows/build-zitadel-dev-images.yml

+60-12
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,17 @@ name: Build Zitadel Dev Images
33
on:
44
workflow_dispatch:
55

6+
env:
7+
BOT_USER_NAME: eclipse-xpanse-bot
8+
BOT_EMAIL_ID: [email protected]
9+
REGISTRY: ghcr.io
10+
611
jobs:
712
build:
813
runs-on: ubuntu-latest
14+
permissions:
15+
contents: write
16+
packages: write
917

1018
steps:
1119
- name: Check out code
@@ -14,28 +22,68 @@ jobs:
1422
- name: Set up Docker Buildx
1523
uses: docker/setup-buildx-action@v2
1624

25+
- name: Login to Github Packages
26+
uses: docker/login-action@v3
27+
with:
28+
registry: ghcr.io
29+
username: ${{ env.BOT_USER_NAME }}
30+
password: ${{ secrets.BOT_GITHUB_DOCKER_TOKEN }}
31+
1732
- name: Set up Terraform
1833
uses: hashicorp/setup-terraform@v3
1934
with:
20-
terraform_version: 1.6.0
35+
terraform_version: 1.6.1
2136

22-
- name: start containers using docker compose
37+
- name: build custom postgres image with changed PGDATA
2338
run: |
24-
docker compose up -d
25-
working-directory: zitadel/local/compose
39+
docker build -t custom-pg-db:latest .
40+
working-directory: zitadel/local/build
2641

27-
- name: copy admin service account key
42+
- name: start containers using docker build
2843
run: |
29-
cp machineKey/zitadel-admin-sa.json ../../terraform
30-
working-directory: zitadel/local/compose
44+
mkdir ${{ runner.temp }}/machinekey
45+
VOLUME_POINT=${{ runner.temp }}/machinekey docker compose up -d
46+
working-directory: zitadel/local/build
47+
48+
- name: Wait for API Response
49+
uses: mydea/action-wait-for-api@v1
50+
continue-on-error: true
51+
with:
52+
url: "http://localhost:8088/debug/healthz"
53+
expected-status: "200" # You can specify other 2xx codes as needed
54+
timeout: "60" # Maximum wait time in seconds
55+
interval: "10"
3156

3257
- name: copy admin service account key
33-
run: |
34-
curl -sSL https://raw.githubusercontent.com/vishnubob/wait-for-it/master/wait-for-it.sh -o wait-for-it.sh
35-
chmod +x wait-for-it.sh
36-
./wait-for-it.sh localhost:8088 --timeout=180 --strict -- echo "Application is up!"
58+
run: |
59+
cp ${{ runner.temp }}/machinekey/* .
60+
working-directory: zitadel/terraform
3761

3862
- name: configure Zitadel
3963
run: |
64+
terraform init
4065
terraform apply -var-file=environments/local.tfvars -auto-approve
41-
working-directory: zitadel/terraform
66+
terraform output -json > output.json
67+
working-directory: zitadel/terraform
68+
69+
- name: Upload Artifacts
70+
uses: actions/upload-artifact@v4
71+
with:
72+
name: access details # Name of the artifact
73+
path: zitadel/terraform/*.json
74+
75+
- name: commit images
76+
run: |
77+
JOB_LINK="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
78+
docker stop compose-zitadel-1
79+
docker stop compose-db-1
80+
docker commit --change="LABEL job_link=\"$JOB_LINK\"" compose-zitadel-1 xpanse-zitadel-dev-server
81+
docker commit --change="LABEL job_link=\"$JOB_LINK\"" compose-db-1 xpanse-zitadel-dev-db
82+
83+
- name: Build and push Docker image
84+
run: |
85+
JOB_LINK="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
86+
docker tag xpanse-zitadel-dev-server:latest ${{ env.REGISTRY }}/${{ github.repository_owner }}/xpanse-zitadel-dev-server:latest
87+
docker tag xpanse-zitadel-dev-db:latest ${{ env.REGISTRY }}/${{ github.repository_owner }}/xpanse-zitadel-dev-db:latest
88+
docker push ${{ env.REGISTRY }}/${{ github.repository_owner }}/xpanse-zitadel-dev-server:latest
89+
docker push ${{ env.REGISTRY }}/${{ github.repository_owner }}/xpanse-zitadel-dev-db:latest

‎.gitignore

+2-1
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,5 @@
55
*.hcl
66
*.tfstate
77
*token.json
8-
*.tfstate.backup
8+
*.tfstate.backup
9+
zitadel-admin-sa.json

‎zitadel/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ config the xpanse project with the service instance of Zitadel.
1212

1313
Here are two types of service instance deployment solutions. You can deploy a local service instance
1414
of Zitadel according
15-
to the document [local-installation-steps.md](local/local-installation-steps.md) or deploy a
15+
to the document [local-installation-steps.md](local/run/run-dev-zitadel-containers) or deploy a
1616
production service instance of
1717
Zitadel according to the
1818
document [testbed-installation-steps.md](testlab/testbed-installation-steps.md).

‎zitadel/local/build/Dockerfile

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
FROM postgres:16-alpine
2+
3+
# This is necessary. Otherwise the data written to the container will not be part of the created image.
4+
RUN mkdir -p /var/lib/postgresql-static/data
5+
ENV PGDATA=/var/lib/postgresql-static/data

‎zitadel/local/build/build-dev-zitadel-images.md

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Build Zitadel Dev Docker Images
2+
3+
To enhance developer experience, we prepare the Zitadel development docker images with all necessary configurations.
4+
The developer will have to simply start these application and database docker containers and
5+
then the environment is ready to use without any additional configuration.
6+
7+
## Image Build Job
8+
9+
The GitHub action [build-dev-images](../../../.github/workflows/build-zitadel-dev-images.yml) builds the necessary images
10+
and uploads it to the GitHub packages and also uploads all configuration details to action artifacts.
11+
12+
> Images will be always simply built with 'latest' tag.
13+
14+
## Configure Client Systems
15+
16+
Whenever this job is executed, the images generated will contain new information for all clients.
17+
Hence, it is necessary for the developer to also update the following files whenever a new image is created
18+
and also inform team that the latest images must be pulled.
19+
20+
- [xpanse UI auth config](https://github.com/eclipse-xpanse/xpanse-ui/blob/main/.env.zitadel-local)
21+
- [xpanse app auth config](https://github.com/eclipse-xpanse/xpanse/blob/main/runtime/src/main/resources/application-zitadel.properties)

‎zitadel/local/build/docker-compose.yaml

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
services:
2+
zitadel:
3+
user: "${UID:-1001}"
4+
restart: 'always'
5+
networks:
6+
- 'zitadel'
7+
image: 'ghcr.io/zitadel/zitadel:latest'
8+
command: 'start-from-init --masterkey "MasterkeyNeedsToHave32Characters" --tlsMode disabled'
9+
environment:
10+
ZITADEL_DATABASE_POSTGRES_HOST: db
11+
ZITADEL_DATABASE_POSTGRES_PORT: 5432
12+
ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
13+
ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel
14+
ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: zitadel
15+
ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
16+
ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: postgres
17+
ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: postgres
18+
ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
19+
ZITADEL_EXTERNALSECURE: false
20+
ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH: /machinekey/zitadel-admin-sa.json
21+
ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_USERNAME: zitadel-admin-sa
22+
ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_NAME: Admin
23+
ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINEKEY_TYPE: 1
24+
ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORDCHANGEREQUIRED: false
25+
ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD: Zitadel@123 # Default admin password.
26+
depends_on:
27+
db:
28+
condition: 'service_healthy'
29+
ports:
30+
- '8088:8080'
31+
volumes:
32+
- ${VOLUME_POINT:-./machinekey}:/machinekey:rw
33+
34+
db:
35+
restart: 'always'
36+
image: custom-pg-db # Custom postgres image.
37+
environment:
38+
PGUSER: postgres
39+
POSTGRES_PASSWORD: postgres
40+
networks:
41+
- 'zitadel'
42+
healthcheck:
43+
test: [ "CMD-SHELL", "pg_isready", "-d", "zitadel", "-U", "postgres" ]
44+
interval: '10s'
45+
timeout: '2400s'
46+
retries: 500
47+
start_period: '20s'
48+
49+
networks:
50+
zitadel:

‎zitadel/local/build/machinekey/.gitkeep

Whitespace-only changes.

‎zitadel/local/compose/docker-compose-local.yaml

-38
This file was deleted.

‎zitadel/local/local-installation-steps.md

-37
This file was deleted.

‎zitadel/local/run/docker-compose.yml

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
services:
2+
zitadel:
3+
# The user should have the permission to write to ./machinekey
4+
user: "${UID:-1001}"
5+
restart: 'always'
6+
networks:
7+
- 'zitadel-dev'
8+
image: ghcr.io/eclipse-xpanse/xpanse-zitadel-dev-server:latest # image built locally by commiting an already initialized zitadel server
9+
command: 'start --masterkey "MasterkeyNeedsToHave32Characters" --tlsMode disabled'
10+
depends_on:
11+
db:
12+
condition: 'service_healthy'
13+
ports:
14+
- '8088:8080'
15+
16+
db:
17+
restart: 'always'
18+
image: ghcr.io/eclipse-xpanse/xpanse-zitadel-dev-db:latest # image built locally by commiting an already initialized zitadel Postgres DB
19+
healthcheck:
20+
test: [ "CMD-SHELL", "pg_isready", "-d", "zitadel", "-U", "postgres" ]
21+
interval: '10s'
22+
timeout: '2400s'
23+
retries: 500
24+
start_period: '20s'
25+
networks:
26+
- 'zitadel-dev'
27+
28+
networks:
29+
zitadel-dev:

‎zitadel/local/run/run-dev-zitadel-containers.md

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# Local Development Applications of Xpanse with Local Service of Zitadel
2+
3+
This document will describe how to use docker to build a local service of Zitadel.
4+
5+
Clone project [xpanse-iam](https://github.com/eclipse-xpanse/xpanse-iam.git) from remote to workspace in local machine.
6+
Then enter the root path.
7+
8+
```shell
9+
git clone https://github.com/eclipse-xpanse/xpanse-iam.git
10+
cd xpanse-iam/zitadel/local
11+
```
12+
13+
## Deploy Local Service of Zitadel
14+
15+
Before deploying the local service of Zitadel, please install and start the Docker and Docker Compose service in the
16+
local machine. Then start the local service of Zitadel using the below command:
17+
18+
```shell
19+
docker compose up -d --pull always
20+
```
21+
22+
The below display appears to indicate that the service has started normally.
23+
This step can take around 2 minutes since the database container must sync the changes from
24+
25+
```shell
26+
✔ Network run_zitadel-dev Created 0.4s
27+
✔ Container run-db-1 Healthy 10.1s
28+
✔ Container run-zitadel-1 Started
29+
```
30+
31+
Now you can open favorite internet browser and navigate to http://localhost:8088/ui/console. This is the default IAM
32+
admin users login:
33+
34+
* username: [email protected]
35+
* password: Zitadel@123
36+
37+
Other application users can be found [here](../../terraform/environments/local.tfvars).
38+
39+
40+

‎zitadel/static/docker_run_zitadel_services.png

-8.9 KB
Binary file not shown.

‎zitadel/terraform/client-credentials.tf

+1-39
Original file line numberDiff line numberDiff line change
@@ -4,43 +4,5 @@ resource "zitadel_machine_user" "api_client_user" {
44
name = "api-client"
55
description = "user for xpanse to make authenticated API calls"
66
access_token_type = "ACCESS_TOKEN_TYPE_JWT"
7-
}
8-
9-
// get the default organization ID. The deployer user is on the default organization.
10-
data "zitadel_orgs" "default" {
11-
name = "ZITADEL"
12-
name_method = "TEXT_QUERY_METHOD_EQUALS"
13-
}
14-
15-
// get the user ID of the deployer user.
16-
data "zitadel_machine_users" "deployer" {
17-
user_name = "deployer"
18-
user_name_method = "TEXT_QUERY_METHOD_EQUALS"
19-
}
20-
21-
resource "zitadel_instance_member" "default" {
22-
user_id = data.zitadel_machine_users.deployer.user_ids[0]
23-
roles = ["IAM_OWNER"]
24-
}
25-
26-
resource "zitadel_personal_access_token" "apiclient_user_id_token" {
27-
org_id = data.zitadel_orgs.default.ids[0]
28-
user_id = data.zitadel_machine_users.deployer.user_ids[0]
29-
}
30-
31-
// direct API call since no terraform module available for creating client credentials
32-
resource "terracurl_request" "machine_secret" {
33-
name = "machine_secret"
34-
url = "https://${var.domain}:${var.port}/management/v1/users/${resource.zitadel_machine_user.api_client_user.id}/secret"
35-
method = "PUT"
36-
response_codes = [
37-
200
38-
]
39-
headers = {
40-
x-zitadel-orgid = zitadel_org.xpanse.id
41-
Content-Type = "application/json"
42-
Accept = "application/json"
43-
Authorization = "Bearer ${resource.zitadel_personal_access_token.apiclient_user_id_token.token}"
44-
}
45-
request_body = ""
7+
with_secret = true
468
}

0 commit comments

Comments
 (0)