├── .gitignore ├── app ├── requirements.txt ├── static │ ├── linuxtips-logo.png │ ├── css │ │ ├── styles.css │ │ └── output.css │ └── js │ │ └── main.js ├── tailwind.config.js ├── templates │ ├── lista_senhas.html │ └── index.html ├── app.py └── LICENSE ├── static ├── github-actions.png ├── grafana_queries.png ├── prometheus_rules.png ├── dashboard_overview.png ├── grafana_memory_usage.png ├── grafana_pods_counter.png ├── high_level_overview.png ├── grafana_senhas_geradas.png ├── grafana_service_status.png ├── prometheus_pod_monitor.png └── prometheus_service_monitor.png ├── manifestos ├── app │ ├── storage-class.yml │ ├── redis-pvc.yml │ ├── redis-svc.yml │ ├── giropops-senhas-nodeport-svc.yml │ ├── giropops-senhas-svc.yml │ ├── redis-deploy.yml │ └── giropops-senhas-deploy.yml ├── monitoria │ ├── test-ingress │ │ ├── grafana-external-svc.yml │ │ ├── alert-manager-external-svc.yml │ │ ├── prometheus-external-svc.yml │ │ └── network-policy.yml │ ├── giropops-senhas-servicemonitor.yml │ ├── giropops-senhas-podmonitor.yml │ └── giropops-senhas-prometeusrule.yml ├── performance │ ├── giropops-senhas-deployment-hpa.yml │ └── performance-testes │ │ └── performance-teste.js └── ingress │ ├── projeto-pick-ingress.yml │ └── projeto-pick-ingress-prod.yml ├── letsencrypt ├── staging-issuer.yml └── production-issuer.yml ├── Dockerfile ├── .yamllint.yaml ├── .github └── workflows │ └── github-actions.yml └── README.md /.gitignore: -------------------------------------------------------------------------------- 1 | *.key 2 | *.crt 3 | trust-policy.json 4 | manifestos/admin/* 5 | -------------------------------------------------------------------------------- /app/requirements.txt: -------------------------------------------------------------------------------- 1 | Flask==2.3.2 2 | redis==4.5.4 3 | prometheus-client==0.16.0 4 | Werkzeug>=2.2,<3.0 5 | -------------------------------------------------------------------------------- /static/github-actions.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Isadoramenezes/LINUXtips-giropops-senhas/HEAD/static/github-actions.png -------------------------------------------------------------------------------- /static/grafana_queries.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Isadoramenezes/LINUXtips-giropops-senhas/HEAD/static/grafana_queries.png -------------------------------------------------------------------------------- /static/prometheus_rules.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Isadoramenezes/LINUXtips-giropops-senhas/HEAD/static/prometheus_rules.png -------------------------------------------------------------------------------- /app/static/linuxtips-logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Isadoramenezes/LINUXtips-giropops-senhas/HEAD/app/static/linuxtips-logo.png -------------------------------------------------------------------------------- /static/dashboard_overview.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Isadoramenezes/LINUXtips-giropops-senhas/HEAD/static/dashboard_overview.png -------------------------------------------------------------------------------- /static/grafana_memory_usage.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Isadoramenezes/LINUXtips-giropops-senhas/HEAD/static/grafana_memory_usage.png -------------------------------------------------------------------------------- /static/grafana_pods_counter.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Isadoramenezes/LINUXtips-giropops-senhas/HEAD/static/grafana_pods_counter.png -------------------------------------------------------------------------------- /static/high_level_overview.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Isadoramenezes/LINUXtips-giropops-senhas/HEAD/static/high_level_overview.png -------------------------------------------------------------------------------- /static/grafana_senhas_geradas.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Isadoramenezes/LINUXtips-giropops-senhas/HEAD/static/grafana_senhas_geradas.png -------------------------------------------------------------------------------- /static/grafana_service_status.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Isadoramenezes/LINUXtips-giropops-senhas/HEAD/static/grafana_service_status.png -------------------------------------------------------------------------------- /static/prometheus_pod_monitor.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Isadoramenezes/LINUXtips-giropops-senhas/HEAD/static/prometheus_pod_monitor.png -------------------------------------------------------------------------------- /static/prometheus_service_monitor.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Isadoramenezes/LINUXtips-giropops-senhas/HEAD/static/prometheus_service_monitor.png -------------------------------------------------------------------------------- /manifestos/app/storage-class.yml: -------------------------------------------------------------------------------- 1 | apiVersion: storage.k8s.io/v1 2 | kind: StorageClass 3 | metadata: 4 | name: ebs-sc 5 | provisioner: ebs.csi.aws.com 6 | volumeBindingMode: WaitForFirstConsumer 7 | -------------------------------------------------------------------------------- /manifestos/app/redis-pvc.yml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: PersistentVolumeClaim 3 | metadata: 4 | name: redis-pvc 5 | spec: 6 | storageClassName: ebs-sc 7 | accessModes: 8 | - ReadWriteOnce 9 | resources: 10 | requests: 11 | storage: 1Gi 12 | -------------------------------------------------------------------------------- /manifestos/app/redis-svc.yml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: redis-service 5 | spec: 6 | selector: 7 | app: redis 8 | ports: 9 | - protocol: TCP 10 | port: 6379 11 | targetPort: 6379 12 | type: ClusterIP 13 | -------------------------------------------------------------------------------- /app/tailwind.config.js: -------------------------------------------------------------------------------- 1 | /** @type {import('tailwindcss').Config} */ 2 | module.exports = { 3 | content: ["./templates/*.html"], 4 | theme: { 5 | fontFamily: { 6 | emoji: ["Material Icons", "sans-serif"], 7 | }, 8 | extend: {}, 9 | }, 10 | plugins: [], 11 | }; 12 | -------------------------------------------------------------------------------- /manifestos/app/giropops-senhas-nodeport-svc.yml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: giropops-senhas-nodeport 5 | labels: 6 | app: giropops-senhas 7 | spec: 8 | selector: 9 | app: giropops-senhas 10 | ports: 11 | - port: 5000 12 | name: giropops-port 13 | targetPort: 5000 14 | type: NodePort 15 | -------------------------------------------------------------------------------- /manifestos/app/giropops-senhas-svc.yml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: giropops-senhas 5 | labels: 6 | app: giropops-senhas 7 | spec: 8 | selector: 9 | app: giropops-senhas 10 | ports: 11 | - protocol: TCP 12 | port: 5000 13 | targetPort: 5000 14 | name: tcp-app 15 | type: ClusterIP 16 | -------------------------------------------------------------------------------- /manifestos/monitoria/test-ingress/grafana-external-svc.yml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: grafana-svc-bridge 5 | namespace: default 6 | spec: 7 | type: ExternalName 8 | externalName: grafana.monitoring.svc.cluster.local 9 | ports: 10 | - port: 3000 11 | protocol: TCP 12 | targetPort: 3000 13 | sessionAffinity: None 14 | -------------------------------------------------------------------------------- /manifestos/monitoria/giropops-senhas-servicemonitor.yml: -------------------------------------------------------------------------------- 1 | apiVersion: monitoring.coreos.com/v1 2 | kind: ServiceMonitor 3 | metadata: 4 | name: giropops-senhas-servicemonitor 5 | labels: 6 | app: giropops-senhas 7 | spec: 8 | selector: 9 | matchLabels: 10 | app: giropops-senhas 11 | endpoints: 12 | - interval: 30s 13 | path: /metrics 14 | targetPort: 5000 15 | -------------------------------------------------------------------------------- /manifestos/monitoria/test-ingress/alert-manager-external-svc.yml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: alertmanager-main-svc-bridge 5 | namespace: default 6 | spec: 7 | type: ExternalName 8 | externalName: alertmanager-main.monitoring.svc.cluster.local 9 | ports: 10 | - port: 9093 11 | protocol: TCP 12 | targetPort: 9093 13 | sessionAffinity: None 14 | -------------------------------------------------------------------------------- /manifestos/monitoria/test-ingress/prometheus-external-svc.yml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: prometheus-operator-svc-bridge 5 | namespace: default 6 | spec: 7 | type: ExternalName 8 | externalName: prometheus-operator.monitoring.svc.cluster.local 9 | ports: 10 | - port: 8443 11 | protocol: TCP 12 | targetPort: 8443 13 | sessionAffinity: None 14 | -------------------------------------------------------------------------------- /letsencrypt/staging-issuer.yml: -------------------------------------------------------------------------------- 1 | apiVersion: cert-manager.io/v1 2 | kind: Issuer 3 | metadata: 4 | name: letsencrypt-staging 5 | spec: 6 | acme: 7 | server: https://acme-staging-v02.api.letsencrypt.org/directory 8 | email: isadoranezes@gmail.com 9 | privateKeySecretRef: 10 | name: letsencrypt-staging 11 | solvers: 12 | - http01: 13 | ingress: 14 | ingressClassName: nginx 15 | -------------------------------------------------------------------------------- /letsencrypt/production-issuer.yml: -------------------------------------------------------------------------------- 1 | apiVersion: cert-manager.io/v1 2 | kind: ClusterIssuer 3 | metadata: 4 | name: letsencrypt-prod 5 | spec: 6 | acme: 7 | server: https://acme-v02.api.letsencrypt.org/directory 8 | email: isadoranezes@gmail.com 9 | privateKeySecretRef: 10 | name: giropops-letsencrypt-prod 11 | solvers: 12 | - http01: 13 | ingress: 14 | ingressClassName: nginx 15 | -------------------------------------------------------------------------------- /manifestos/monitoria/giropops-senhas-podmonitor.yml: -------------------------------------------------------------------------------- 1 | apiVersion: monitoring.coreos.com/v1 2 | kind: PodMonitor 3 | metadata: 4 | name: giropops-senhas-pod-monitor 5 | labels: 6 | app: giropops-senhas 7 | spec: 8 | namespaceSelector: 9 | matchNames: 10 | - default 11 | selector: 12 | matchLabels: 13 | app: giropops-senhas 14 | podMetricsEndpoints: 15 | - interval: 10s 16 | path: /metrics 17 | targetPort: 5000 18 | -------------------------------------------------------------------------------- /manifestos/performance/giropops-senhas-deployment-hpa.yml: -------------------------------------------------------------------------------- 1 | apiVersion: autoscaling/v2 2 | kind: HorizontalPodAutoscaler 3 | metadata: 4 | name: giropops-senhas-deployment-hpa 5 | spec: 6 | scaleTargetRef: 7 | apiVersion: apps/v1 8 | kind: Deployment 9 | name: giropops-senhas 10 | minReplicas: 1 11 | maxReplicas: 5 12 | metrics: 13 | - type: Resource 14 | resource: 15 | name: cpu 16 | target: 17 | type: Utilization 18 | averageUtilization: 60 19 | - type: Resource 20 | resource: 21 | name: memory 22 | target: 23 | type: Utilization 24 | averageUtilization: 80 25 | -------------------------------------------------------------------------------- /manifestos/ingress/projeto-pick-ingress.yml: -------------------------------------------------------------------------------- 1 | apiVersion: networking.k8s.io/v1 2 | kind: Ingress 3 | metadata: 4 | name: giropops-senhas 5 | annotations: 6 | nginx.ingress.kubernetes.io/rewrite-target: / 7 | cert-manager.io/issuer: "letsencrypt-staging" 8 | spec: 9 | ingressClassName: nginx 10 | tls: 11 | - hosts: 12 | - aula-pick.ibmenezes.com 13 | secretName: "aula-pick-tls" 14 | rules: 15 | - host: aula-pick.ibmenezes.com 16 | http: 17 | paths: 18 | - path: / 19 | pathType: Prefix 20 | backend: 21 | service: 22 | name: giropops-senhas 23 | port: 24 | number: 5000 25 | -------------------------------------------------------------------------------- /manifestos/ingress/projeto-pick-ingress-prod.yml: -------------------------------------------------------------------------------- 1 | apiVersion: networking.k8s.io/v1 2 | kind: Ingress 3 | metadata: 4 | name: giropops-senhas 5 | annotations: 6 | nginx.ingress.kubernetes.io/rewrite-target: / 7 | cert-manager.io/cluster-issuer: "letsencrypt-prod" 8 | spec: 9 | ingressClassName: nginx 10 | tls: 11 | - hosts: 12 | - giropops-senhas.ibmenezes.com 13 | secretName: "giropops-senhas-tls" 14 | rules: 15 | - host: giropops-senhas.ibmenezes.com 16 | http: 17 | paths: 18 | - path: / 19 | pathType: Prefix 20 | backend: 21 | service: 22 | name: giropops-senhas 23 | port: 24 | number: 5000 25 | -------------------------------------------------------------------------------- /manifestos/monitoria/test-ingress/network-policy.yml: -------------------------------------------------------------------------------- 1 | apiVersion: networking.k8s.io/v1 2 | kind: NetworkPolicy 3 | metadata: 4 | labels: 5 | app.kubernetes.io/component: grafana 6 | app.kubernetes.io/name: grafana 7 | app.kubernetes.io/part-of: kube-prometheus 8 | app.kubernetes.io/version: 9.0.1 9 | name: grafana 10 | namespace: monitoring 11 | spec: 12 | egress: 13 | - {} 14 | ingress: 15 | - ports: 16 | - port: 3000 17 | protocol: TCP 18 | podSelector: 19 | matchLabels: 20 | app.kubernetes.io/component: grafana 21 | app.kubernetes.io/name: grafana 22 | app.kubernetes.io/part-of: kube-prometheus 23 | policyTypes: 24 | - Egress 25 | - Ingress 26 | -------------------------------------------------------------------------------- /app/static/css/styles.css: -------------------------------------------------------------------------------- 1 | /* styles.css */ 2 | @tailwind base; 3 | @tailwind components; 4 | @tailwind utilities; 5 | 6 | body { 7 | font-family: Ubuntu, sans-serif; 8 | background-color: #eeeeee; 9 | background-image: url("data:image/svg+xml,%3Csvg width='52' height='26' viewBox='0 0 52 26' xmlns='http://www.w3.org/2000/svg'%3E%3Cg fill='none' fill-rule='evenodd'%3E%3Cg fill='%23aeb8af' fill-opacity='0.4'%3E%3Cpath d='M10 10c0-2.21-1.79-4-4-4-3.314 0-6-2.686-6-6h2c0 2.21 1.79 4 4 4 3.314 0 6 2.686 6 6 0 2.21 1.79 4 4 4 3.314 0 6 2.686 6 6 0 2.21 1.79 4 4 4v2c-3.314 0-6-2.686-6-6 0-2.21-1.79-4-4-4-3.314 0-6-2.686-6-6zm25.464-1.95l8.486 8.486-1.414 1.414-8.486-8.486 1.414-1.414z' /%3E%3C/g%3E%3C/g%3E%3C/svg%3E"); 10 | } 11 | -------------------------------------------------------------------------------- /Dockerfile: -------------------------------------------------------------------------------- 1 | FROM cgr.dev/chainguard/python:latest-dev as builder 2 | 3 | WORKDIR /app 4 | 5 | COPY ./app/requirements.txt . 6 | 7 | RUN pip install --no-cache-dir -r requirements.txt --user 8 | 9 | FROM cgr.dev/chainguard/python:latest 10 | 11 | WORKDIR /app 12 | 13 | #Changed the python version to 3.12 14 | COPY --from=builder /home/nonroot/.local/lib/python3.12/site-packages /home/nonroot/.local/lib/python3.12/site-packages 15 | #Changed to have sh available 16 | COPY --from=builder /home/nonroot/.local/bin /home/nonroot/.local/bin 17 | ENV PATH=$PATH:/home/nonroot/.local/bin 18 | 19 | COPY ["./app/tailwind.config.js", "./app/LICENSE", "."] 20 | COPY ./app/static/ static/ 21 | COPY ./app/templates/ templates/ 22 | COPY ./app/app.py . 23 | ENTRYPOINT ["flask", "run", "--host=0.0.0.0"] 24 | -------------------------------------------------------------------------------- /.yamllint.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | 3 | yaml-files: 4 | - '*.yaml' 5 | - '*.yml' 6 | - '.yamllint' 7 | 8 | rules: 9 | anchors: enable 10 | braces: enable 11 | brackets: disable 12 | colons: enable 13 | commas: enable 14 | comments: 15 | level: warning 16 | comments-indentation: 17 | level: warning 18 | document-end: disable 19 | document-start: 20 | level: warning 21 | empty-lines: enable 22 | empty-values: disable 23 | float-values: disable 24 | hyphens: enable 25 | indentation: disable 26 | key-duplicates: enable 27 | key-ordering: disable 28 | line-length: disable 29 | new-line-at-end-of-file: enable 30 | new-lines: enable 31 | octal-values: disable 32 | quoted-strings: disable 33 | trailing-spaces: enable 34 | truthy: 35 | level: warning 36 | -------------------------------------------------------------------------------- /manifestos/app/redis-deploy.yml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | labels: 5 | app: redis 6 | name: redis-deployment 7 | spec: 8 | replicas: 1 9 | selector: 10 | matchLabels: 11 | app: redis 12 | template: 13 | metadata: 14 | labels: 15 | app: redis 16 | spec: 17 | containers: 18 | - image: redis 19 | name: redis 20 | ports: 21 | - containerPort: 6379 22 | resources: 23 | limits: 24 | memory: "256Mi" 25 | cpu: "500m" 26 | requests: 27 | memory: "128Mi" 28 | cpu: "250m" 29 | volumeMounts: 30 | - mountPath: "/data" 31 | name: redis-persistent-storage 32 | volumes: 33 | - name: redis-persistent-storage 34 | persistentVolumeClaim: 35 | claimName: redis-pvc 36 | -------------------------------------------------------------------------------- /manifestos/app/giropops-senhas-deploy.yml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | labels: 5 | app: giropops-senhas 6 | name: giropops-senhas 7 | spec: 8 | replicas: 2 9 | selector: 10 | matchLabels: 11 | app: giropops-senhas 12 | template: 13 | metadata: 14 | labels: 15 | app: giropops-senhas 16 | spec: 17 | containers: 18 | - image: isadora/linuxtips-giropops-senhas:3.0 19 | name: giropops-senhas 20 | env: 21 | - name: REDIS_HOST 22 | value: redis-service 23 | ports: 24 | - containerPort: 5000 25 | imagePullPolicy: Always 26 | livenessProbe: 27 | httpGet: 28 | path: / 29 | port: 5000 30 | initialDelaySeconds: 10 31 | periodSeconds: 10 32 | timeoutSeconds: 4 33 | failureThreshold: 3 34 | resources: 35 | limits: 36 | cpu: 0.5 37 | memory: "256Mi" 38 | requests: 39 | cpu: 0.3 40 | memory: "64Mi" 41 | -------------------------------------------------------------------------------- /app/templates/lista_senhas.html: -------------------------------------------------------------------------------- 1 |
2 | 35 |
36 | -------------------------------------------------------------------------------- /manifestos/performance/performance-testes/performance-teste.js: -------------------------------------------------------------------------------- 1 | // import necessary modules 2 | import { check } from "k6"; 3 | import http from "k6/http"; 4 | 5 | // define configuration 6 | export const options = { 7 | // define thresholds 8 | thresholds: { 9 | http_req_failed: [{ threshold: "rate<0.01", abortOnFail: true }], // availability threshold for error rate 10 | // http_req_duration: ["p(90)<1000"], // Latency threshold for percentile 11 | }, 12 | // define scenarios 13 | scenarios: { 14 | breaking: { 15 | executor: "ramping-vus", 16 | stages: [ 17 | { duration: "10s", target: 20 }, 18 | { duration: "10s", target: 100 }, 19 | { duration: "20s", target: 300 }, 20 | { duration: "20s", target: 400 }, 21 | { duration: "20s", target: 600 }, 22 | { duration: "20s", target: 800 }, 23 | { duration: "60s", target: 1000 }, 24 | { duration: "10s", target: 500 }, 25 | { duration: "10s", target: 250 }, 26 | { duration: "10s", target: 20 }, 27 | //.... 28 | ], 29 | }, 30 | }, 31 | }; 32 | 33 | export default function () { 34 | // define URL and request body 35 | const url = "https://giropops-senhas.ibmenezes.com"; 36 | 37 | // send a post request and save response as a variable 38 | const res = http.post(url); 39 | 40 | // check that response is 200 41 | check(res, { 42 | "response code was 200": (res) => res.status == 200, 43 | }); 44 | } 45 | 46 | 47 | -------------------------------------------------------------------------------- /app/static/js/main.js: -------------------------------------------------------------------------------- 1 | "use strict"; 2 | 3 | function showSenha() { 4 | const input = document.getElementById("senha"); 5 | const senhaIcon = document.getElementById("senha-icon"); 6 | if (input.attributes.type.nodeValue == "password") { 7 | input.setAttribute("type", "text"); 8 | senhaIcon.innerText = "visibility_off"; 9 | } else { 10 | input.setAttribute("type", "password"); 11 | senhaIcon.innerText = "visibility"; 12 | } 13 | } 14 | function showSenhaPorId(id) { 15 | console.log(id); 16 | const input = document.getElementById("senha-" + id); 17 | const senhaIcon = document.getElementById("senha-icon-" + id); 18 | if (input.attributes.type.nodeValue == "password") { 19 | input.setAttribute("type", "text"); 20 | senhaIcon.innerText = "visibility_off"; 21 | } else { 22 | input.setAttribute("type", "password"); 23 | senhaIcon.innerText = "visibility"; 24 | } 25 | } 26 | function copiarParaAreaDeTransferencia() { 27 | const senhaElemento = document.getElementById("senha"); 28 | navigator.clipboard.writeText(senhaElemento.value).then( 29 | () => { 30 | alert("Senha copiada para a área de transferência!"); 31 | }, 32 | (err) => { 33 | alert("Não foi possível copiar a senha: " + err); 34 | } 35 | ); 36 | } 37 | 38 | function copiarParaAreaDeTransferenciaPorId(id) { 39 | const senhaElemento = document.getElementById("senha-" + id); 40 | navigator.clipboard.writeText(senhaElemento.value).then( 41 | () => { 42 | alert("Senha copiada para a área de transferência!"); 43 | }, 44 | (err) => { 45 | alert("Não foi possível copiar a senha: " + err); 46 | } 47 | ); 48 | } 49 | 50 | function toggleUsuarios() { 51 | const listaUsuariosContainer = document.getElementById( 52 | "lista-usuarios-container" 53 | ); 54 | listaUsuariosContainer.classList.toggle("hidden"); 55 | } 56 | function buscarUltimasSenhas() { 57 | navigation.reload(); 58 | } 59 | -------------------------------------------------------------------------------- /manifestos/monitoria/giropops-senhas-prometeusrule.yml: -------------------------------------------------------------------------------- 1 | apiVersion: monitoring.coreos.com/v1 2 | kind: PrometheusRule 3 | metadata: 4 | name: giropops-senhas-prometheus-rule 5 | namespace: monitoring 6 | labels: 7 | prometheus: k8s 8 | role: alert-rules 9 | app.kubernets.io/name: kube-prometheus 10 | app.kubernetes.io/part-of: kube-prometheus 11 | spec: 12 | groups: 13 | - name: giropops-senhas-prometheus-rule 14 | rules: 15 | - alert: GiropopsSenhasDown 16 | expr: up{job="giropops-senhas"} == 0 17 | for: 1m 18 | labels: 19 | severity: critical 20 | annotations: 21 | summary: "Giropops Senhas sem pods rodando" 22 | description: "Todos os pods do giropops senhas estao indisponiveis" 23 | - alert: GiropopsSenhasCounter 24 | expr: senha_gerada_total > 10 25 | for: 1m 26 | labels: 27 | severity: warning 28 | annotations: 29 | summary: "Alto numero de senhas criadas" 30 | description: "A aplicacao criou mais de dez senhas nos ultimos cinco minutos" 31 | - alert: HighMemoryUsageGiropopsSenhas 32 | expr: sum(container_memory_usage_bytes{pod_name="giropops-senhas"}) / sum(container_spec_memory_limit_bytes{pod_name="giropops-senhas"}) * 100 > 75 33 | for: 5m 34 | labels: 35 | severity: warning 36 | annotations: 37 | summary: "O uso de memoria pelo Giropops Senhas esta alto" 38 | description: "O Giropops senhas esta consumindo 75% da memoria" 39 | - alert: HighCPUUsageGiropopsSenhas 40 | expr: sum(rate(container_cpu_usage_seconds_total{pod_name="giropops-senhas"}[5m])) / sum(container_spec_cpu_limit{pod_name="giropops-senhas"}) * 100 > 60 41 | for: 5m 42 | labels: 43 | severity: warning 44 | annotations: 45 | summary: "O uso de CPU pelo Giropops Senhas esta alto" 46 | description: "O Giropops senhas esta consumindo 60% da CPU" 47 | -------------------------------------------------------------------------------- /app/app.py: -------------------------------------------------------------------------------- 1 | from flask import Flask, render_template, request, jsonify 2 | import redis 3 | import string 4 | import random 5 | import os 6 | from prometheus_client import Counter, start_http_server, generate_latest 7 | 8 | 9 | app = Flask(__name__) 10 | 11 | redis_host = os.environ.get('REDIS_HOST', 'redis-service') 12 | redis_port = 6379 13 | redis_password = "" 14 | 15 | r = redis.StrictRedis(host=redis_host, port=redis_port, password=redis_password, decode_responses=True) 16 | 17 | senha_gerada_counter = Counter('senha_gerada', 'Contador de senhas geradas') 18 | 19 | 20 | def criar_senha(tamanho, incluir_numeros, incluir_caracteres_especiais): 21 | caracteres = string.ascii_letters 22 | 23 | if incluir_numeros: 24 | caracteres += string.digits 25 | 26 | if incluir_caracteres_especiais: 27 | caracteres += string.punctuation 28 | 29 | senha = ''.join(random.choices(caracteres, k=tamanho)) 30 | 31 | return senha 32 | 33 | @app.route('/', methods=['GET', 'POST']) 34 | def index(): 35 | if request.method == 'POST': 36 | tamanho = int(request.form.get('tamanho', 8)) 37 | incluir_numeros = request.form.get('incluir_numeros') == 'on' 38 | incluir_caracteres_especiais = request.form.get('incluir_caracteres_especiais') == 'on' 39 | senha = criar_senha(tamanho, incluir_numeros, incluir_caracteres_especiais) 40 | 41 | r.lpush("senhas", senha) 42 | senha_gerada_counter.inc() 43 | senhas = r.lrange("senhas", 0, 9) 44 | if senhas: 45 | senhas_geradas = [{"id": index + 1, "senha": senha} for index, senha in enumerate(senhas)] 46 | return render_template('index.html', senhas_geradas=senhas_geradas, senha=senhas_geradas[0]['senha'] or '' ) 47 | return render_template('index.html') 48 | 49 | 50 | @app.route('/api/gerar-senha', methods=['POST']) 51 | def gerar_senha_api(): 52 | dados = request.get_json() 53 | 54 | tamanho = int(dados.get('tamanho', 8)) 55 | incluir_numeros = dados.get('incluir_numeros', False) 56 | incluir_caracteres_especiais = dados.get('incluir_caracteres_especiais', False) 57 | 58 | senha = criar_senha(tamanho, incluir_numeros, incluir_caracteres_especiais) 59 | r.lpush("senhas", senha) 60 | senha_gerada_counter.inc() 61 | 62 | return jsonify({"senha": senha}) 63 | 64 | @app.route('/api/senhas', methods=['GET']) 65 | def listar_senhas(): 66 | senhas = r.lrange("senhas", 0, 9) 67 | 68 | resposta = [{"id": index + 1, "senha": senha} for index, senha in enumerate(senhas)] 69 | return jsonify(resposta) 70 | 71 | @app.route('/metrics') 72 | def metrics(): 73 | return generate_latest() 74 | 75 | if __name__ == '__main__': 76 | import logging 77 | logging.basicConfig(filename='error.log', level=logging.DEBUG) 78 | start_http_server(8088) 79 | app.run(debug=True) 80 | -------------------------------------------------------------------------------- /.github/workflows/github-actions.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Build and Lint 3 | 4 | on: 5 | push: 6 | branches: 7 | - feature/* 8 | - main 9 | 10 | env: 11 | # Use docker.io for Docker Hub if empty 12 | REGISTRY: docker.io 13 | # github.repository as / 14 | IMAGE_NAME: isadora/linuxtips-giropops-senhas 15 | 16 | jobs: 17 | lint-yaml: 18 | runs-on: ubuntu-latest 19 | 20 | steps: 21 | - name: Checkout code 22 | uses: actions/checkout@v2 23 | - name: Install yamllint 24 | run: | 25 | pip install yamllint 26 | - name: Lint YAML files recursively 27 | uses: karancode/yamllint-github-action@master 28 | with: 29 | yamllint_strict: false 30 | yamllint_comment: true 31 | yamllint_config_filepath: '.yamllint.yaml' 32 | 33 | build-docker: 34 | runs-on: ubuntu-latest 35 | needs: lint-yaml 36 | permissions: 37 | contents: read 38 | packages: write 39 | id-token: write 40 | security-events: write 41 | steps: 42 | - name: Checkout repository 43 | uses: actions/checkout@v3 44 | 45 | # Install the cosign tool except on PR 46 | # https://github.com/sigstore/cosign-installer 47 | - name: Install cosign 48 | if: github.event_name != 'pull_request' 49 | uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1 50 | with: 51 | cosign-release: 'v2.1.1' 52 | 53 | # Set up BuildKit Docker container builder to be able to build 54 | # multi-platform images and export cache 55 | # https://github.com/docker/setup-buildx-action 56 | - name: Set up Docker Buildx 57 | uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0 58 | 59 | - name: Log in to Docker Hub 60 | uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a 61 | with: 62 | username: ${{ secrets.DOCKER_USERNAME }} 63 | password: ${{ secrets.DOCKER_PASSWORD }} 64 | # Extract metadata (tags, labels) for Docker 65 | # https://github.com/docker/metadata-action 66 | - name: Extract Docker metadata 67 | id: meta 68 | uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0 69 | with: 70 | images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} 71 | 72 | # Build and push Docker image with Buildx (don't push on PR) 73 | # https://github.com/docker/build-push-action 74 | - name: Build and push Docker image 75 | id: build-and-push 76 | uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0 77 | with: 78 | context: . 79 | push: ${{ github.event_name != 'pull_request' }} 80 | tags: ${{ steps.meta.outputs.tags }} 81 | labels: ${{ steps.meta.outputs.labels }} 82 | cache-from: type=gha 83 | cache-to: type=gha,mode=max 84 | 85 | # Sign the resulting Docker image digest except on PRs. 86 | # This will only write to the public Rekor transparency log when the Docker 87 | # repository is public to avoid leaking data. If you would like to publish 88 | # transparency data even for private images, pass --force to cosign below. 89 | # https://github.com/sigstore/cosign 90 | - name: Sign the published Docker image 91 | if: ${{ github.event_name != 'pull_request' }} 92 | env: 93 | # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable 94 | TAGS: ${{ steps.meta.outputs.tags }} 95 | DIGEST: ${{ steps.build-and-push.outputs.digest }} 96 | # This step uses the identity token to provision an ephemeral certificate 97 | # against the sigstore community Fulcio instance. 98 | run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} 99 | 100 | - name: Run Trivy vulnerability scanner 101 | uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe 102 | with: 103 | image-ref: 'isadora/linuxtips-giropops-senhas:${{ steps.meta.outputs.version }}' 104 | format: 'sarif' 105 | output: 'trivy-results.sarif' 106 | severity: 'CRITICAL,HIGH' 107 | security-checks: 'vuln' 108 | debug: true 109 | - name: Push trivy results 110 | uses: github/codeql-action/upload-sarif@v2 111 | with: 112 | sarif_file: 'trivy-results.sarif' 113 | debug: true 114 | -------------------------------------------------------------------------------- /app/templates/index.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Gerador de Senhas 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 |
17 | 25 |
26 |
27 |
28 |
29 |
30 |

Gerar senha

31 |
32 |
33 |
34 | 35 | 36 | 8 37 |
38 |
39 | 40 | 41 |
42 |
43 | 44 | 45 |
46 | 50 |
51 | {% if senha %} 52 |
53 |

Senha gerada:

54 | 56 |
57 | 61 | 65 |
66 | {% endif %} 67 |
68 |
69 |
70 |
71 |
72 |
73 |

74 | Últimas senhas criadas 75 |

76 |
77 | 82 | {% include 'lista_senhas.html' %} 83 |
84 |
85 | 88 | 89 | 90 | 91 | 92 | -------------------------------------------------------------------------------- /app/static/css/output.css: -------------------------------------------------------------------------------- 1 | /* styles.css */ 2 | 3 | /* ! tailwindcss v3.2.7 | MIT License | https://tailwindcss.com */ 4 | 5 | /* 6 | 1. Prevent padding and border from affecting element width. (https://github.com/mozdevs/cssremedy/issues/4) 7 | 2. Allow adding a border to an element by just adding a border-width. (https://github.com/tailwindcss/tailwindcss/pull/116) 8 | */ 9 | 10 | *, 11 | ::before, 12 | ::after { 13 | box-sizing: border-box; 14 | /* 1 */ 15 | border-width: 0; 16 | /* 2 */ 17 | border-style: solid; 18 | /* 2 */ 19 | border-color: #e5e7eb; 20 | /* 2 */ 21 | } 22 | 23 | ::before, 24 | ::after { 25 | --tw-content: ''; 26 | } 27 | 28 | /* 29 | 1. Use a consistent sensible line-height in all browsers. 30 | 2. Prevent adjustments of font size after orientation changes in iOS. 31 | 3. Use a more readable tab size. 32 | 4. Use the user's configured `sans` font-family by default. 33 | 5. Use the user's configured `sans` font-feature-settings by default. 34 | */ 35 | 36 | html { 37 | line-height: 1.5; 38 | /* 1 */ 39 | -webkit-text-size-adjust: 100%; 40 | /* 2 */ 41 | -moz-tab-size: 4; 42 | /* 3 */ 43 | -o-tab-size: 4; 44 | tab-size: 4; 45 | /* 3 */ 46 | font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, "Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; 47 | /* 4 */ 48 | font-feature-settings: normal; 49 | /* 5 */ 50 | } 51 | 52 | /* 53 | 1. Remove the margin in all browsers. 54 | 2. Inherit line-height from `html` so users can set them as a class directly on the `html` element. 55 | */ 56 | 57 | body { 58 | margin: 0; 59 | /* 1 */ 60 | line-height: inherit; 61 | /* 2 */ 62 | } 63 | 64 | /* 65 | 1. Add the correct height in Firefox. 66 | 2. Correct the inheritance of border color in Firefox. (https://bugzilla.mozilla.org/show_bug.cgi?id=190655) 67 | 3. Ensure horizontal rules are visible by default. 68 | */ 69 | 70 | hr { 71 | height: 0; 72 | /* 1 */ 73 | color: inherit; 74 | /* 2 */ 75 | border-top-width: 1px; 76 | /* 3 */ 77 | } 78 | 79 | /* 80 | Add the correct text decoration in Chrome, Edge, and Safari. 81 | */ 82 | 83 | abbr:where([title]) { 84 | -webkit-text-decoration: underline dotted; 85 | text-decoration: underline dotted; 86 | } 87 | 88 | /* 89 | Remove the default font size and weight for headings. 90 | */ 91 | 92 | h1, 93 | h2, 94 | h3, 95 | h4, 96 | h5, 97 | h6 { 98 | font-size: inherit; 99 | font-weight: inherit; 100 | } 101 | 102 | /* 103 | Reset links to optimize for opt-in styling instead of opt-out. 104 | */ 105 | 106 | a { 107 | color: inherit; 108 | text-decoration: inherit; 109 | } 110 | 111 | /* 112 | Add the correct font weight in Edge and Safari. 113 | */ 114 | 115 | b, 116 | strong { 117 | font-weight: bolder; 118 | } 119 | 120 | /* 121 | 1. Use the user's configured `mono` font family by default. 122 | 2. Correct the odd `em` font sizing in all browsers. 123 | */ 124 | 125 | code, 126 | kbd, 127 | samp, 128 | pre { 129 | font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace; 130 | /* 1 */ 131 | font-size: 1em; 132 | /* 2 */ 133 | } 134 | 135 | /* 136 | Add the correct font size in all browsers. 137 | */ 138 | 139 | small { 140 | font-size: 80%; 141 | } 142 | 143 | /* 144 | Prevent `sub` and `sup` elements from affecting the line height in all browsers. 145 | */ 146 | 147 | sub, 148 | sup { 149 | font-size: 75%; 150 | line-height: 0; 151 | position: relative; 152 | vertical-align: baseline; 153 | } 154 | 155 | sub { 156 | bottom: -0.25em; 157 | } 158 | 159 | sup { 160 | top: -0.5em; 161 | } 162 | 163 | /* 164 | 1. Remove text indentation from table contents in Chrome and Safari. (https://bugs.chromium.org/p/chromium/issues/detail?id=999088, https://bugs.webkit.org/show_bug.cgi?id=201297) 165 | 2. Correct table border color inheritance in all Chrome and Safari. (https://bugs.chromium.org/p/chromium/issues/detail?id=935729, https://bugs.webkit.org/show_bug.cgi?id=195016) 166 | 3. Remove gaps between table borders by default. 167 | */ 168 | 169 | table { 170 | text-indent: 0; 171 | /* 1 */ 172 | border-color: inherit; 173 | /* 2 */ 174 | border-collapse: collapse; 175 | /* 3 */ 176 | } 177 | 178 | /* 179 | 1. Change the font styles in all browsers. 180 | 2. Remove the margin in Firefox and Safari. 181 | 3. Remove default padding in all browsers. 182 | */ 183 | 184 | button, 185 | input, 186 | optgroup, 187 | select, 188 | textarea { 189 | font-family: inherit; 190 | /* 1 */ 191 | font-size: 100%; 192 | /* 1 */ 193 | font-weight: inherit; 194 | /* 1 */ 195 | line-height: inherit; 196 | /* 1 */ 197 | color: inherit; 198 | /* 1 */ 199 | margin: 0; 200 | /* 2 */ 201 | padding: 0; 202 | /* 3 */ 203 | } 204 | 205 | /* 206 | Remove the inheritance of text transform in Edge and Firefox. 207 | */ 208 | 209 | button, 210 | select { 211 | text-transform: none; 212 | } 213 | 214 | /* 215 | 1. Correct the inability to style clickable types in iOS and Safari. 216 | 2. Remove default button styles. 217 | */ 218 | 219 | button, 220 | [type='button'], 221 | [type='reset'], 222 | [type='submit'] { 223 | -webkit-appearance: button; 224 | /* 1 */ 225 | background-color: transparent; 226 | /* 2 */ 227 | background-image: none; 228 | /* 2 */ 229 | } 230 | 231 | /* 232 | Use the modern Firefox focus style for all focusable elements. 233 | */ 234 | 235 | :-moz-focusring { 236 | outline: auto; 237 | } 238 | 239 | /* 240 | Remove the additional `:invalid` styles in Firefox. (https://github.com/mozilla/gecko-dev/blob/2f9eacd9d3d995c937b4251a5557d95d494c9be1/layout/style/res/forms.css#L728-L737) 241 | */ 242 | 243 | :-moz-ui-invalid { 244 | box-shadow: none; 245 | } 246 | 247 | /* 248 | Add the correct vertical alignment in Chrome and Firefox. 249 | */ 250 | 251 | progress { 252 | vertical-align: baseline; 253 | } 254 | 255 | /* 256 | Correct the cursor style of increment and decrement buttons in Safari. 257 | */ 258 | 259 | ::-webkit-inner-spin-button, 260 | ::-webkit-outer-spin-button { 261 | height: auto; 262 | } 263 | 264 | /* 265 | 1. Correct the odd appearance in Chrome and Safari. 266 | 2. Correct the outline style in Safari. 267 | */ 268 | 269 | [type='search'] { 270 | -webkit-appearance: textfield; 271 | /* 1 */ 272 | outline-offset: -2px; 273 | /* 2 */ 274 | } 275 | 276 | /* 277 | Remove the inner padding in Chrome and Safari on macOS. 278 | */ 279 | 280 | ::-webkit-search-decoration { 281 | -webkit-appearance: none; 282 | } 283 | 284 | /* 285 | 1. Correct the inability to style clickable types in iOS and Safari. 286 | 2. Change font properties to `inherit` in Safari. 287 | */ 288 | 289 | ::-webkit-file-upload-button { 290 | -webkit-appearance: button; 291 | /* 1 */ 292 | font: inherit; 293 | /* 2 */ 294 | } 295 | 296 | /* 297 | Add the correct display in Chrome and Safari. 298 | */ 299 | 300 | summary { 301 | display: list-item; 302 | } 303 | 304 | /* 305 | Removes the default spacing and border for appropriate elements. 306 | */ 307 | 308 | blockquote, 309 | dl, 310 | dd, 311 | h1, 312 | h2, 313 | h3, 314 | h4, 315 | h5, 316 | h6, 317 | hr, 318 | figure, 319 | p, 320 | pre { 321 | margin: 0; 322 | } 323 | 324 | fieldset { 325 | margin: 0; 326 | padding: 0; 327 | } 328 | 329 | legend { 330 | padding: 0; 331 | } 332 | 333 | ol, 334 | ul, 335 | menu { 336 | list-style: none; 337 | margin: 0; 338 | padding: 0; 339 | } 340 | 341 | /* 342 | Prevent resizing textareas horizontally by default. 343 | */ 344 | 345 | textarea { 346 | resize: vertical; 347 | } 348 | 349 | /* 350 | 1. Reset the default placeholder opacity in Firefox. (https://github.com/tailwindlabs/tailwindcss/issues/3300) 351 | 2. Set the default placeholder color to the user's configured gray 400 color. 352 | */ 353 | 354 | input::-moz-placeholder, textarea::-moz-placeholder { 355 | opacity: 1; 356 | /* 1 */ 357 | color: #9ca3af; 358 | /* 2 */ 359 | } 360 | 361 | input::placeholder, 362 | textarea::placeholder { 363 | opacity: 1; 364 | /* 1 */ 365 | color: #9ca3af; 366 | /* 2 */ 367 | } 368 | 369 | /* 370 | Set the default cursor for buttons. 371 | */ 372 | 373 | button, 374 | [role="button"] { 375 | cursor: pointer; 376 | } 377 | 378 | /* 379 | Make sure disabled buttons don't get the pointer cursor. 380 | */ 381 | 382 | :disabled { 383 | cursor: default; 384 | } 385 | 386 | /* 387 | 1. Make replaced elements `display: block` by default. (https://github.com/mozdevs/cssremedy/issues/14) 388 | 2. Add `vertical-align: middle` to align replaced elements more sensibly by default. (https://github.com/jensimmons/cssremedy/issues/14#issuecomment-634934210) 389 | This can trigger a poorly considered lint error in some tools but is included by design. 390 | */ 391 | 392 | img, 393 | svg, 394 | video, 395 | canvas, 396 | audio, 397 | iframe, 398 | embed, 399 | object { 400 | display: block; 401 | /* 1 */ 402 | vertical-align: middle; 403 | /* 2 */ 404 | } 405 | 406 | /* 407 | Constrain images and videos to the parent width and preserve their intrinsic aspect ratio. (https://github.com/mozdevs/cssremedy/issues/14) 408 | */ 409 | 410 | img, 411 | video { 412 | max-width: 100%; 413 | height: auto; 414 | } 415 | 416 | /* Make elements with the HTML hidden attribute stay hidden by default */ 417 | 418 | [hidden] { 419 | display: none; 420 | } 421 | 422 | *, ::before, ::after { 423 | --tw-border-spacing-x: 0; 424 | --tw-border-spacing-y: 0; 425 | --tw-translate-x: 0; 426 | --tw-translate-y: 0; 427 | --tw-rotate: 0; 428 | --tw-skew-x: 0; 429 | --tw-skew-y: 0; 430 | --tw-scale-x: 1; 431 | --tw-scale-y: 1; 432 | --tw-pan-x: ; 433 | --tw-pan-y: ; 434 | --tw-pinch-zoom: ; 435 | --tw-scroll-snap-strictness: proximity; 436 | --tw-ordinal: ; 437 | --tw-slashed-zero: ; 438 | --tw-numeric-figure: ; 439 | --tw-numeric-spacing: ; 440 | --tw-numeric-fraction: ; 441 | --tw-ring-inset: ; 442 | --tw-ring-offset-width: 0px; 443 | --tw-ring-offset-color: #fff; 444 | --tw-ring-color: rgb(59 130 246 / 0.5); 445 | --tw-ring-offset-shadow: 0 0 #0000; 446 | --tw-ring-shadow: 0 0 #0000; 447 | --tw-shadow: 0 0 #0000; 448 | --tw-shadow-colored: 0 0 #0000; 449 | --tw-blur: ; 450 | --tw-brightness: ; 451 | --tw-contrast: ; 452 | --tw-grayscale: ; 453 | --tw-hue-rotate: ; 454 | --tw-invert: ; 455 | --tw-saturate: ; 456 | --tw-sepia: ; 457 | --tw-drop-shadow: ; 458 | --tw-backdrop-blur: ; 459 | --tw-backdrop-brightness: ; 460 | --tw-backdrop-contrast: ; 461 | --tw-backdrop-grayscale: ; 462 | --tw-backdrop-hue-rotate: ; 463 | --tw-backdrop-invert: ; 464 | --tw-backdrop-opacity: ; 465 | --tw-backdrop-saturate: ; 466 | --tw-backdrop-sepia: ; 467 | } 468 | 469 | ::backdrop { 470 | --tw-border-spacing-x: 0; 471 | --tw-border-spacing-y: 0; 472 | --tw-translate-x: 0; 473 | --tw-translate-y: 0; 474 | --tw-rotate: 0; 475 | --tw-skew-x: 0; 476 | --tw-skew-y: 0; 477 | --tw-scale-x: 1; 478 | --tw-scale-y: 1; 479 | --tw-pan-x: ; 480 | --tw-pan-y: ; 481 | --tw-pinch-zoom: ; 482 | --tw-scroll-snap-strictness: proximity; 483 | --tw-ordinal: ; 484 | --tw-slashed-zero: ; 485 | --tw-numeric-figure: ; 486 | --tw-numeric-spacing: ; 487 | --tw-numeric-fraction: ; 488 | --tw-ring-inset: ; 489 | --tw-ring-offset-width: 0px; 490 | --tw-ring-offset-color: #fff; 491 | --tw-ring-color: rgb(59 130 246 / 0.5); 492 | --tw-ring-offset-shadow: 0 0 #0000; 493 | --tw-ring-shadow: 0 0 #0000; 494 | --tw-shadow: 0 0 #0000; 495 | --tw-shadow-colored: 0 0 #0000; 496 | --tw-blur: ; 497 | --tw-brightness: ; 498 | --tw-contrast: ; 499 | --tw-grayscale: ; 500 | --tw-hue-rotate: ; 501 | --tw-invert: ; 502 | --tw-saturate: ; 503 | --tw-sepia: ; 504 | --tw-drop-shadow: ; 505 | --tw-backdrop-blur: ; 506 | --tw-backdrop-brightness: ; 507 | --tw-backdrop-contrast: ; 508 | --tw-backdrop-grayscale: ; 509 | --tw-backdrop-hue-rotate: ; 510 | --tw-backdrop-invert: ; 511 | --tw-backdrop-opacity: ; 512 | --tw-backdrop-saturate: ; 513 | --tw-backdrop-sepia: ; 514 | } 515 | 516 | .static { 517 | position: static; 518 | } 519 | 520 | .fixed { 521 | position: fixed; 522 | } 523 | 524 | .top-0 { 525 | top: 0px; 526 | } 527 | 528 | .z-10 { 529 | z-index: 10; 530 | } 531 | 532 | .my-14 { 533 | margin-top: 3.5rem; 534 | margin-bottom: 3.5rem; 535 | } 536 | 537 | .mb-4 { 538 | margin-bottom: 1rem; 539 | } 540 | 541 | .mb-6 { 542 | margin-bottom: 1.5rem; 543 | } 544 | 545 | .ml-2 { 546 | margin-left: 0.5rem; 547 | } 548 | 549 | .ml-4 { 550 | margin-left: 1rem; 551 | } 552 | 553 | .ml-auto { 554 | margin-left: auto; 555 | } 556 | 557 | .mr-10 { 558 | margin-right: 2.5rem; 559 | } 560 | 561 | .mr-16 { 562 | margin-right: 4rem; 563 | } 564 | 565 | .mr-2 { 566 | margin-right: 0.5rem; 567 | } 568 | 569 | .mr-4 { 570 | margin-right: 1rem; 571 | } 572 | 573 | .mr-8 { 574 | margin-right: 2rem; 575 | } 576 | 577 | .mr-auto { 578 | margin-right: auto; 579 | } 580 | 581 | .mt-10 { 582 | margin-top: 2.5rem; 583 | } 584 | 585 | .mt-12 { 586 | margin-top: 3rem; 587 | } 588 | 589 | .mt-4 { 590 | margin-top: 1rem; 591 | } 592 | 593 | .mt-40 { 594 | margin-top: 10rem; 595 | } 596 | 597 | .flex { 598 | display: flex; 599 | } 600 | 601 | .h-10 { 602 | height: 2.5rem; 603 | } 604 | 605 | .h-16 { 606 | height: 4rem; 607 | } 608 | 609 | .h-24 { 610 | height: 6rem; 611 | } 612 | 613 | .h-32 { 614 | height: 8rem; 615 | } 616 | 617 | .w-40 { 618 | width: 10rem; 619 | } 620 | 621 | .w-9 { 622 | width: 2.25rem; 623 | } 624 | 625 | .w-full { 626 | width: 100%; 627 | } 628 | 629 | .max-w-3xl { 630 | max-width: 48rem; 631 | } 632 | 633 | .max-w-4xl { 634 | max-width: 56rem; 635 | } 636 | 637 | .grow { 638 | flex-grow: 1; 639 | } 640 | 641 | .flex-col { 642 | flex-direction: column; 643 | } 644 | 645 | .items-center { 646 | align-items: center; 647 | } 648 | 649 | .justify-center { 650 | justify-content: center; 651 | } 652 | 653 | .justify-between { 654 | justify-content: space-between; 655 | } 656 | 657 | .justify-evenly { 658 | justify-content: space-evenly; 659 | } 660 | 661 | .self-start { 662 | align-self: flex-start; 663 | } 664 | 665 | .self-end { 666 | align-self: flex-end; 667 | } 668 | 669 | .whitespace-nowrap { 670 | white-space: nowrap; 671 | } 672 | 673 | .rounded { 674 | border-radius: 0.25rem; 675 | } 676 | 677 | .rounded-lg { 678 | border-radius: 0.5rem; 679 | } 680 | 681 | .rounded-t-lg { 682 | border-top-left-radius: 0.5rem; 683 | border-top-right-radius: 0.5rem; 684 | } 685 | 686 | .border { 687 | border-width: 1px; 688 | } 689 | 690 | .bg-emerald-200 { 691 | --tw-bg-opacity: 1; 692 | background-color: rgb(167 243 208 / var(--tw-bg-opacity)); 693 | } 694 | 695 | .bg-emerald-700 { 696 | --tw-bg-opacity: 1; 697 | background-color: rgb(4 120 87 / var(--tw-bg-opacity)); 698 | } 699 | 700 | .bg-green-700 { 701 | --tw-bg-opacity: 1; 702 | background-color: rgb(21 128 61 / var(--tw-bg-opacity)); 703 | } 704 | 705 | .bg-slate-300 { 706 | --tw-bg-opacity: 1; 707 | background-color: rgb(203 213 225 / var(--tw-bg-opacity)); 708 | } 709 | 710 | .bg-slate-50 { 711 | --tw-bg-opacity: 1; 712 | background-color: rgb(248 250 252 / var(--tw-bg-opacity)); 713 | } 714 | 715 | .p-3 { 716 | padding: 0.75rem; 717 | } 718 | 719 | .px-10 { 720 | padding-left: 2.5rem; 721 | padding-right: 2.5rem; 722 | } 723 | 724 | .px-2 { 725 | padding-left: 0.5rem; 726 | padding-right: 0.5rem; 727 | } 728 | 729 | .px-3 { 730 | padding-left: 0.75rem; 731 | padding-right: 0.75rem; 732 | } 733 | 734 | .py-1 { 735 | padding-top: 0.25rem; 736 | padding-bottom: 0.25rem; 737 | } 738 | 739 | .pb-8 { 740 | padding-bottom: 2rem; 741 | } 742 | 743 | .text-center { 744 | text-align: center; 745 | } 746 | 747 | .font-emoji { 748 | font-family: Material Icons, sans-serif; 749 | } 750 | 751 | .text-2xl { 752 | font-size: 1.5rem; 753 | line-height: 2rem; 754 | } 755 | 756 | .text-4xl { 757 | font-size: 2.25rem; 758 | line-height: 2.5rem; 759 | } 760 | 761 | .text-lg { 762 | font-size: 1.125rem; 763 | line-height: 1.75rem; 764 | } 765 | 766 | .font-bold { 767 | font-weight: 700; 768 | } 769 | 770 | .tracking-wider { 771 | letter-spacing: 0.05em; 772 | } 773 | 774 | .text-emerald-600 { 775 | --tw-text-opacity: 1; 776 | color: rgb(5 150 105 / var(--tw-text-opacity)); 777 | } 778 | 779 | .text-slate-50 { 780 | --tw-text-opacity: 1; 781 | color: rgb(248 250 252 / var(--tw-text-opacity)); 782 | } 783 | 784 | .text-white { 785 | --tw-text-opacity: 1; 786 | color: rgb(255 255 255 / var(--tw-text-opacity)); 787 | } 788 | 789 | .shadow { 790 | --tw-shadow: 0 1px 3px 0 rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1); 791 | --tw-shadow-colored: 0 1px 3px 0 var(--tw-shadow-color), 0 1px 2px -1px var(--tw-shadow-color); 792 | box-shadow: var(--tw-ring-offset-shadow, 0 0 #0000), var(--tw-ring-shadow, 0 0 #0000), var(--tw-shadow); 793 | } 794 | 795 | .shadow-lg { 796 | --tw-shadow: 0 10px 15px -3px rgb(0 0 0 / 0.1), 0 4px 6px -4px rgb(0 0 0 / 0.1); 797 | --tw-shadow-colored: 0 10px 15px -3px var(--tw-shadow-color), 0 4px 6px -4px var(--tw-shadow-color); 798 | box-shadow: var(--tw-ring-offset-shadow, 0 0 #0000), var(--tw-ring-shadow, 0 0 #0000), var(--tw-shadow); 799 | } 800 | 801 | body { 802 | font-family: Ubuntu, sans-serif; 803 | background-color: #eeeeee; 804 | background-image: url("data:image/svg+xml,%3Csvg width='52' height='26' viewBox='0 0 52 26' xmlns='http://www.w3.org/2000/svg'%3E%3Cg fill='none' fill-rule='evenodd'%3E%3Cg fill='%23aeb8af' fill-opacity='0.4'%3E%3Cpath d='M10 10c0-2.21-1.79-4-4-4-3.314 0-6-2.686-6-6h2c0 2.21 1.79 4 4 4 3.314 0 6 2.686 6 6 0 2.21 1.79 4 4 4 3.314 0 6 2.686 6 6 0 2.21 1.79 4 4 4v2c-3.314 0-6-2.686-6-6 0-2.21-1.79-4-4-4-3.314 0-6-2.686-6-6zm25.464-1.95l8.486 8.486-1.414 1.414-8.486-8.486 1.414-1.414z' /%3E%3C/g%3E%3C/g%3E%3C/svg%3E"); 805 | } 806 | 807 | .hover\:bg-green-800:hover { 808 | --tw-bg-opacity: 1; 809 | background-color: rgb(22 101 52 / var(--tw-bg-opacity)); 810 | } 811 | 812 | .hover\:bg-slate-400:hover { 813 | --tw-bg-opacity: 1; 814 | background-color: rgb(148 163 184 / var(--tw-bg-opacity)); 815 | } 816 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # LINUXTips - Giropops Senhas 2 | 3 | ### Descrição 4 | Esse repositório agrupa os arquivos de deploy da aplicação Giropops Senhas num cluter Kubernetes como parte da avaliação do Programa Intensivo de Containers e Kubernetes da @LinuxTips. 5 | 6 | ### A Aplicação 7 | 8 | A aplicação Giropops Senhas é uma API escrita em Flask que, conectada a um Redis, gera e armazena strings aleatórias de acordo com as especificações de número de caracteres, caracteres especiais e números passadas pelo usuário. 9 | 10 | ## Configuração 11 | ### Construção da Imagem Giropops-Senhas e pipeline 12 | 13 | A imagem da aplicação foi construída pensando nas melhores práticas em containers. 14 | 15 | A primeira coisa é que a imagem é _distroless_. Isso significa que a imagem contém unicamente os componentes necessários para sua execução, o que não apenas reduz o tamanho da imagem (diminuindo custos), mas também aumenta a segurança (pela diminuição das opções de ataque). No caso deste projeto a imagem base é da [Chainguard](https://edu.chainguard.dev/chainguard/chainguard-images/reference/python/). 16 | 17 | A segunda prática utilizada foi a utilização de _multi-stage build_. Essa prática permite que a imagem final seja mais limpa e segura também. Nesse projeto, toda a instalação de dependências da imagem é feita usando como base a imagem `cgr.dev/chainguard/python:latest-dev` que permite mais flexibilidade no download e instalação. Após todos os requisitos instalados, a única pasta necessária é `/home/nonroot/.local/lib/python3.12/site-packages`, que é copiada para a imagem final, onde a aplicação será montada para ser executada. 18 | 19 | Além dessas práticas, a imagem foi assinada e passou por verificação de vulnerabilidades do Trivy e do docker scout. Os resultados de cada uma dessas etapas pode ser verificado na seção de [resultados](#resultados) deste documento. Essas etapas também foram automatizadas, e o pipeline de build da imagem pode ser verificado abaixo: 20 | 21 | ![github-actions-pipeline](./static/github-actions.png) 22 | 23 | A cada push para branches com prefixo 'feature/' ou para a branch main, esse pipeline executará: 24 | 25 | 1. O lint para todos os arquivos yaml/yml no repositório; 26 | 2. O build da imagem baseado no Dockerfile e a publicação no docker hub (é importante notar que algumas configuraçãos de segredos no repositório são necessárias); 27 | 3. A assinatura, usando cosign, da imagem publicada; 28 | 4. O scan de vulnerabilidades utilizando o trivy, da aqua security. 29 | 30 | ### :warning: Aviso 31 | Note que neste estágio (v1.0.0), a imagem não é automaticamente deployada no cluster kubernetes. Seu deploy depende da atualização manual dos arquivos de configuração que serão discutidos abaixo. 32 | 33 | ### Configuração do Cluster Kubernetes 34 | 35 | 36 |
37 | Especificações 38 |
39 | 40 | Esse projeto foi executado e validado usando o serviço EKS da AWS. Validações em cluster do tipo Kind ou bare metal serão realizadas. 41 | 42 | Atualmente a especificação é: 43 | 44 | Para o cluster: 45 | 46 | - 2 Workers t3.medium 47 | - 1 Control Plane gerenciado pela AWS 48 | 49 | Para build automatizado da aplicação: 50 | 51 | - Conta no dockerhub 52 | - Repositório no github com acesso ao GitHub Actions 53 | 54 | Para builds locais: 55 | 56 | - Docker CLI 57 | 58 |
59 | 60 |
61 | Visão geral 62 |
63 | Os componentes da configuração podem ser visualizados em alto nível na imagem abaixo. O passo a passo de como instalar e configurar cada componente pode ser verificado no item [Execução](#execução): 64 | 65 | ![high-level-overview](./static/high_level_overview.png) 66 |
67 | 68 |
69 | Deploy e Serviço da aplicação 70 |
71 | Os manifestos de deployment e criação de serviço do giropops-senhas e do redis podem ser encontrados em manifestos/app/. 72 | 73 | O destaque do deploy do giropops senhas temos: 74 | - Variável de ambiente REDIS_HOST apontando para o serviço do redis; 75 | - LivenessProbe, executando requisições GET em `/` para validar que o serviço está ativo; 76 | - Limitação e requisição de recursos de CPU e Memória. 77 | 78 | Os dois serviços são expostos dentro do cluster com serviços do tipo `ClusterIP` e, para o giropops-senhas, também há um serviço do tipo `NodePort` para troubleshooting. 79 |
80 | 81 |
82 | Exposição do serviço 83 |
84 | 85 | Nesta configuração o serviço está exposto externamente através do Nginx Ingress Controler. Ele atua como um controlador de balanceamento de carga e roteamento, permitindo redirecionamentos e o uso de certificados SSL/TLS em conjunto com o [CertManager](https://cert-manager.io/) e o [Let's Encrypt](https://letsencrypt.org/). 86 | 87 | Em manifestos/ingress/ estão os arquivos de configuração do ingress para o ambiente de staging (com certificado não assinado) e para ambiente produtivo (com certificado assinado pelo let's encrypt). Os issuers para cada um desses cenários podem criados com base nos arquivos em letsencrypt/. 88 | 89 |
90 | 91 |
92 | Monitoria 93 |
94 | A monitoração do clusters está sendo feita utilizando o Prometheus Operator. Por padrão a instalação conta com o Prometheus, o Grafana e o AlertManager. 95 | 96 | No Prometheus foram criadas duas regras, para o case do número de pods ativos ser 0, e para o caso do número de senhas geradas supere certo threshold (essa regra foi mais para disparar os alertas). 97 | 98 | ![prometheus_rules](./static/prometheus_rules.png) 99 | 100 | Além disso, um service monitor foi criado para a monitoração de métricas do serviço e um pod monitor foi criado para monitoração de métricas do Pod. Todos esses arquivos de configuração podem ser encontrados em manifestos/monitoria/. 101 | 102 | 103 | ![prometheus_pod_monitor](./static/prometheus_pod_monitor.png) 104 | 105 | ![prometheus_service_monitor](./static/prometheus_service_monitor.png) 106 | 107 | Uma vez que as métricas do serviço estavam sendo ingeridas pelo Prometheus, um painel de monitoria foi criado no Grafana. 108 | ![grafana_queries](./static/grafana_queries.png) 109 | 110 | Foram criadas visualizações para: 111 | 112 | 1. Uso de memória 113 | ![grafana_memory_usage](./static/grafana_memory_usage.png) 114 | 115 | 2. Status do Serviço 116 | ![grafana_service_status](./static/grafana_service_status.png) 117 | 118 | 3. Número de Senhas geradas 119 | ![grafana_senhas_geradas](./static/grafana_senhas_geradas.png) 120 | 121 | 4. Número de Pods ativos 122 | ![grafana_pods_counter](./static/grafana_pods_counter.png) 123 | 124 |
125 | 126 | 127 |
128 | Performance 129 |
130 | 131 | Para assegurar que a aplicação pode lidar com grandes workloads, foi também configurado um HPA - Horizontal Pod Autoscaler. Ele monitora a utilização de recursos e escala automaticamente (para mais e para menos) o número de pods em execução. No caso deste projeto o HPA está configurado para de CPU e Memória em 50 e 70% respectivamente. A configuração pode ser encontrada em manifestos/performance. 132 | 133 |
134 | 135 | ## Resultados 136 | 137 | ### Testes de Vulnerabilidades 138 | 139 | Os testes de vulnerabilidade da imagem foram feitos utilizando o Trivy e o Docker Scout. As duas ferramentas servem ao mesmo propósito aqui: Analisar os pacotes presentes em na imagem em busca de vulnerabilidades. Para esse projeto o docker scout foi executado localmente e o trivy está integrado ao pipeline. 140 | 141 | 142 | 143 |
144 | Resultados do Scan do trivy contra a versão 2.0 145 |
146 | 147 | Com os pacotes padrões da aplicação giropops-senhas disponívels na aplicação original foram identificadas três vulnerabilidades. Todas elas já possuem correções. 148 | 149 | ``` 150 | ➜ app git:(feature/dockerfile) ✗ sudo trivy image isadora/linuxtips-giropops-senhas:2.0 151 | 2023-11-26T10:30:50.893Z INFO Vulnerability scanning is enabled 152 | 2023-11-26T10:30:50.893Z INFO Secret scanning is enabled 153 | 2023-11-26T10:30:50.893Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 154 | 2023-11-26T10:30:50.893Z INFO Please see also https://aquasecurity.github.io/trivy/v0.47/docs/scanner/secret/#recommendation for faster secret detection 155 | 2023-11-26T10:30:51.039Z INFO Detected OS: wolfi 156 | 2023-11-26T10:30:51.039Z INFO Detecting Wolfi vulnerabilities... 157 | 2023-11-26T10:30:51.043Z INFO Number of language-specific files: 1 158 | 2023-11-26T10:30:51.048Z INFO Detecting python-pkg vulnerabilities... 159 | 160 | isadora/linuxtips-giropops-senhas:2.0 (wolfi 20230201) 161 | 162 | Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) 163 | 164 | 2023-11-26T10:30:51.049Z INFO Table result includes only package filenames. Use '--format json' option to get the full path to the package file. 165 | 166 | Python (python-pkg) 167 | 168 | Total: 3 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 1, CRITICAL: 0) 169 | 170 | ┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬────────────────────────────────────────────────────────────┐ 171 | │ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ 172 | ├──────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼────────────────────────────────────────────────────────────┤ 173 | │ Flask (METADATA) │ CVE-2023-30861 │ HIGH │ fixed │ 2.1.1 │ 2.3.2, 2.2.5 │ flask: Possible disclosure of permanent session cookie due │ 174 | │ │ │ │ │ │ │ to missing Vary: Cookie... │ 175 | │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-30861 │ 176 | ├──────────────────┼────────────────┼──────────┤ ├───────────────────┼─────────────────────┼────────────────────────────────────────────────────────────┤ 177 | │ redis (METADATA) │ CVE-2023-28859 │ MEDIUM │ │ 4.5.2 │ 4.5.4, 4.4.4 │ Async command information disclosure │ 178 | │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-28859 │ 179 | │ ├────────────────┼──────────┤ │ ├─────────────────────┼────────────────────────────────────────────────────────────┤ 180 | │ │ CVE-2023-28858 │ LOW │ │ │ 4.4.3, 4.5.3, 4.3.6 │ Async command information disclosure │ 181 | │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-28858 │ 182 | └──────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴────────────────────────────────────────────────────────────┘ 183 | ``` 184 |
185 | 186 |
187 | Resultados do Scan do trivy contra a versão 3.0 188 |
189 | 190 | Uma vez que os pacotes foram atualizados para as versões com correções, nenhuma vulnerabilidade conhecida está presente na imagem giropops-senhas. 191 | 192 | ``` 193 | ➜ app git:(feature/dockerfile) ✗ sudo trivy image isadora/linuxtips-giropops-senhas:3.0 194 | 2023-11-26T10:33:48.789Z INFO Vulnerability scanning is enabled 195 | 2023-11-26T10:33:48.789Z INFO Secret scanning is enabled 196 | 2023-11-26T10:33:48.789Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 197 | 2023-11-26T10:33:48.789Z INFO Please see also https://aquasecurity.github.io/trivy/v0.47/docs/scanner/secret/#recommendation for faster secret detection 198 | 2023-11-26T10:33:50.255Z INFO Detected OS: wolfi 199 | 2023-11-26T10:33:50.255Z INFO Detecting Wolfi vulnerabilities... 200 | 2023-11-26T10:33:50.256Z INFO Number of language-specific files: 1 201 | 2023-11-26T10:33:50.256Z INFO Detecting python-pkg vulnerabilities... 202 | 203 | isadora/linuxtips-giropops-senhas:3.0 (wolfi 20230201) 204 | 205 | Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) 206 | ``` 207 |
208 | 209 |
210 | Resultados do docker scout contra a versão 3.0 211 |
212 | 213 | De forma similar ao Trivy, o docker scout não identificou nenhuma vulnerabilidade na versão 3.0. 214 | 215 | ``` 216 | ➜ LINUXtips-giropops-senhas git:(feature/dockerfile) docker scout CVEs isadora/linuxtips-giropops-senhas:3.0 217 | ...Storing image for indexing 218 | ✓ Image stored for indexing 219 | ...Indexing 220 | ✓ Indexed 39 packages 221 | ✓ No vulnerable package detected 222 | ``` 223 | 224 | ``` 225 | │ Analyzed Image 226 | ────────────────────┼────────────────────────────────────────── 227 | Target │ isadora/linuxtips-giropops-senhas:3.0 228 | digest │ 67d8a6f7edab 229 | platform │ linux/amd64 230 | vulnerabilities │ 0C 0H 0M 0L 231 | size │ 25 MB 232 | packages │ 39 233 | ``` 234 |
235 | 236 | 237 | ### Testes de Performance 238 | 239 | Os testes de performance foram feitos utilizando o [K6](https://k6.io/). A configuração do teste pode ser encontrada em manifestos/performance/performance-testes. 240 | A carga sobre o serviço obedeceu a seguinte distribuição para todos os testes: 241 | 242 | ``` 243 | duration: "10s" -> target: 20 244 | duration: "10s" -> target: 100 245 | duration: "20s" -> target: 300 246 | duration: "20s" -> target: 400 247 | duration: "20s" -> target: 600 248 | duration: "20s" -> target: 800 249 | duration: "60s" -> target: 1000 250 | duration: "10s" -> target: 500 251 | duration: "10s" -> target: 250 252 | duration: "10s" -> target: 20 253 | ``` 254 | 255 | Onde `duration` é o intervalo de tempo e `target` é o número de requisições nesse intervalo. Em média foram lançadas 159000 requisições sobre o serviço em cada teste. 256 | 257 |
258 | Resultados do primeiro teste de performance usando o K6 259 |
260 | 261 | No primeiro teste o npumero de requisições foi 149581, com 498 perdidas. Nesse momento o HPA tinha um problema de configuração e não foi capaz de escalar o deployment do giropops-senhas. 262 | 263 | ``` 264 | ✗ response code was 200 265 | ↳ 99% — ✓ 149581 / ✗ 498 266 | 267 | checks.........................: 99.66% ✓ 149581 ✗ 498 268 | data_received..................: 2.2 GB 10 MB/s 269 | data_sent......................: 20 MB 92 kB/s 270 | http_req_blocked...............: avg=139.49µs min=0s med=2.28µs max=157.47ms p(90)=2.5µs p(95)=3.35µs 271 | http_req_connecting............: avg=18.7µs min=0s med=0s max=27.67ms p(90)=0s p(95)=0s 272 | ✗ http_req_duration..............: avg=701.81ms min=1.92ms med=35.5ms max=1m0s p(90)=1.49s p(95)=3.89s 273 | { expected_response:true }...: avg=573.12ms min=3.45ms med=35.29ms max=59.74s p(90)=1.45s p(95)=3.76s 274 | ✓ http_req_failed................: 0.33% ✓ 498 ✗ 149581 275 | http_req_receiving.............: avg=909.33µs min=0s med=468.87µs max=59.26ms p(90)=1.5ms p(95)=2.35ms 276 | http_req_sending...............: avg=42.89µs min=13.93µs med=39.15µs max=6.45ms p(90)=61.96µs p(95)=74.93µs 277 | http_req_tls_handshaking.......: avg=116.67µs min=0s med=0s max=154.91ms p(90)=0s p(95)=0s 278 | http_req_waiting...............: avg=700.86ms min=1.87ms med=34.86ms max=1m0s p(90)=1.49s p(95)=3.89s 279 | http_reqs......................: 150079 707.59271/s 280 | iteration_duration.............: avg=702.07ms min=2.35ms med=35.86ms max=1m0s p(90)=1.49s p(95)=3.89s 281 | iterations.....................: 150079 707.59271/s 282 | vus............................: 1 min=1 max=999 283 | vus_max........................: 1000 min=1000 max=1000 284 | 285 | 286 | running (3m32.1s), 0000/1000 VUs, 150079 complete and 36 interrupted iterations 287 | breaking ✓ [======================================] 0000/1000 VUs 3m10s 288 | ERRO[0213] thresholds on metrics 'http_req_duration' have been crossed 289 | 290 | ``` 291 |
292 | 293 | 294 |
295 | Resultado do segundo teste de performance usando o K6 após configuração do HPA 296 |
297 | 298 | No segundo teste o npumero de requisições foi 158545 , com 29 perdidas. Nesse momento o HPA foi corrigido o número de pods disponíveis foi 5. 299 | 300 | ``` 301 | ✗ response code was 200 302 | ↳ 99% — ✓ 158545 / ✗ 29 303 | 304 | checks.........................: 99.98% ✓ 158545 ✗ 29 305 | data_received..................: 2.3 GB 12 MB/s 306 | data_sent......................: 20 MB 106 kB/s 307 | http_req_blocked...............: avg=672.88µs min=0s med=2.27µs max=566.92ms p(90)=2.51µs p(95)=3.45µs 308 | http_req_connecting............: avg=17.33µs min=0s med=0s max=16.92ms p(90)=0s p(95)=0s 309 | ✗ http_req_duration..............: avg=649.8ms min=3.6ms med=316.7ms max=58.98s p(90)=1.71s p(95)=2.15s 310 | { expected_response:true }...: avg=647.16ms min=3.6ms med=316.68ms max=58.98s p(90)=1.71s p(95)=2.15s 311 | ✓ http_req_failed................: 0.01% ✓ 29 ✗ 158545 312 | http_req_receiving.............: avg=1.65ms min=0s med=1.15ms max=79.22ms p(90)=3.42ms p(95)=6.96ms 313 | http_req_sending...............: avg=42.66µs min=14.49µs med=36.8µs max=8.14ms p(90)=61.43µs p(95)=75.71µs 314 | http_req_tls_handshaking.......: avg=651.61µs min=0s med=0s max=564.3ms p(90)=0s p(95)=0s 315 | http_req_waiting...............: avg=648.11ms min=454.35µs med=314.32ms max=58.97s p(90)=1.7s p(95)=2.14s 316 | http_reqs......................: 158574 834.490291/s 317 | iteration_duration.............: avg=650.6ms min=3.7ms med=317.7ms max=58.98s p(90)=1.71s p(95)=2.15s 318 | iterations.....................: 158574 834.490291/s 319 | vus............................: 25 min=2 max=999 320 | vus_max........................: 1000 min=1000 max=1000 321 | ``` 322 |
323 | 324 | 325 |
326 | Resultado no terceiro teste, sem considerar latencia 327 |
328 | 329 | No segundo teste o npumero de requisições foi 160502, com 15 perdidas. O HPA não reduziu o número de pods durante essa execução e apenas 0,0000000934% das requisições foram perdidas. 330 | 331 | ``` 332 | 333 | checks.........................: 99.99% ✓ 160502 ✗ 15 334 | data_received..................: 2.3 GB 12 MB/s 335 | data_sent......................: 21 MB 107 kB/s 336 | http_req_blocked...............: avg=1.31ms min=0s med=2.27µs max=1.85s p(90)=2.52µs p(95)=3.52µs 337 | http_req_connecting............: avg=19.39µs min=0s med=0s max=24.26ms p(90)=0s p(95)=0s 338 | http_req_duration..............: avg=639.9ms min=3.91ms med=446.62ms max=55.37s p(90)=1.23s p(95)=2.03s 339 | { expected_response:true }...: avg=637.11ms min=3.91ms med=446.57ms max=55.37s p(90)=1.23s p(95)=2.03s 340 | ✓ http_req_failed................: 0.00% ✓ 15 ✗ 160502 341 | http_req_receiving.............: avg=2.05ms min=0s med=1.24ms max=130.07ms p(90)=5.71ms p(95)=8.23ms 342 | http_req_sending...............: avg=42.01µs min=13.56µs med=35.7µs max=9.01ms p(90)=61.6µs p(95)=76.02µs 343 | http_req_tls_handshaking.......: avg=1.28ms min=0s med=0s max=1.85s p(90)=0s p(95)=0s 344 | http_req_waiting...............: avg=637.8ms min=3.47ms med=444.08ms max=55.37s p(90)=1.23s p(95)=2.03s 345 | http_reqs......................: 160517 829.880724/s 346 | iteration_duration.............: avg=641.34ms min=4.02ms med=447.87ms max=55.37s p(90)=1.23s p(95)=2.03s 347 | iterations.....................: 160517 829.880724/s 348 | vus............................: 2 min=2 max=999 349 | vus_max........................: 1000 min=1000 max=1000 350 | 351 | 352 | running (3m13.4s), 0000/1000 VUs, 160517 complete and 3 interrupted iterations 353 | breaking ✓ [======================================] 0000/1000 VUs 3m10s 354 | 355 | ``` 356 | 357 |
358 | 359 | 360 |
361 | Evento de scale UP no HPA 362 |
363 | 364 | ``` 365 | ➜ manifestos git:(feature/performance-testes) ✗ k describe hpa giropops-senhas-deployment-hpa 366 | Name: giropops-senhas-deployment-hpa 367 | Namespace: default 368 | Labels: 369 | Annotations: 370 | CreationTimestamp: Sun, 03 Dec 2023 19:51:01 +0000 371 | Reference: Deployment/giropops-senhas 372 | Metrics: ( current / target ) 373 | resource memory on pods (as a percentage of request): 59% (39926169600m) / 70% 374 | resource cpu on pods (as a percentage of request): 0% (1m) / 50% 375 | Min replicas: 3 376 | Max replicas: 5 377 | Deployment pods: 5 current / 5 desired 378 | Conditions: 379 | Type Status Reason Message 380 | ---- ------ ------ ------- 381 | AbleToScale True ScaleDownStabilized recent recommendations were higher than current one, applying the highest recent recommendation 382 | ScalingActive True ValidMetricFound the HPA was able to successfully calculate a replica count from memory resource utilization (percentage of request) 383 | ScalingLimited True TooManyReplicas the desired replica count is more than the maximum replica count 384 | Events: 385 | Type Reason Age From Message 386 | ---- ------ ---- ---- ------- 387 | Normal SuccessfulRescale 15m horizontal-pod-autoscaler New size: 5; reason: cpu resource utilization (percentage of request) above target 388 | ``` 389 |
390 | 391 | 392 | ## Execução 393 | 394 | 1. Crie um cluster EKS 395 | 396 | ```bash 397 | eksctl create cluster --name=eks-cluster-pick --version=1.23 --region=us-east-1 --nodegroup-name=eks-cluster-pick-nodegroup --node-type=t3.medium --nodes=2 --nodes-min=1 --nodes-max=3 --managed 398 | ``` 399 | 400 | 2. Crie os serviços e deployments: 401 | ```bash 402 | ➜ k apply -f app/giropops-senhas-deploy.yml 403 | deployment.apps/giropops-senhas created 404 | ➜ k apply -f app/giropops-senhas-svc.yml 405 | service/giropops-senhas created 406 | ➜ k apply -f app/redis-deploy.yml 407 | deployment.apps/redis-deployment created 408 | ➜ k apply -f app/redis-svc.yml 409 | ``` 410 | 411 | 3. Instale o Nginx-Ingress 412 | ```bash 413 | ➜ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.2/deploy/static/provider/aws/deploy.yaml 414 | 415 | ➜ k get all -n ingress-nginx 416 | NAME READY STATUS RESTARTS AGE 417 | pod/ingress-nginx-admission-create-4kk2c 0/1 Completed 0 25s 418 | pod/ingress-nginx-admission-patch-9p9v6 0/1 Completed 1 25s 419 | pod/ingress-nginx-controller-76df4778bf-xjx6p 1/1 Running 0 25s 420 | 421 | ``` 422 | 423 | 4. Instale o Cert-Manager 424 | ```bash 425 | ➜ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.2/cert-manager.yaml 426 | 427 | ``` 428 | 429 | 5. Crie um produtction issuer 430 | ```bash 431 | k apply -f letsencrypt/production-issuer.yml 432 | ``` 433 | 434 | 6. Crie certificado para a aplicação 435 | ```bash 436 | openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout projeto-pick.key -out projeto-pick.crt 437 | ``` 438 | 439 | 7. Crie um secret com o certificado 440 | ```bash 441 | k create secret tls projeto-pick-tls --cert=projeto-pick.crt --key=projeto-pick.key 442 | ``` 443 | 444 | 8. Crie o Ingress e aguarde até o que o endereço do LoadBalancer seja atribuido 445 | Aqui é importante lembrar que para o certificado ser validado pelo let's encrypt é importante que o DNS senha resolvível de dentro do cluster, e que o serviço esteja escutando na porta 443. 446 | ```bash 447 | k apply -f manifestos/ingress/projeto-pick-ingress-prod.ym 448 | ➜ k get ingress -A -w 449 | NAMESPACE NAME CLASS HOSTS ADDRESS PORTS AGE 450 | default cm-acme-http-solver-mbp5n nginx projeto-pick.ibmenezes.com 80 15s 451 | default giropops-senhas nginx projeto-pick.ibmenezes.com 80, 443 17s 452 | default cm-acme-http-solver-mbp5n nginx projeto-pick.ibmenezes.com afa24b32d08e042839e13b2c51ddc66e-806f16f55c9c9c6d.elb.us-east-1.amazonaws.com 80 33s 453 | default giropops-senhas nginx projeto-pick.ibmenezes.com afa24b32d08e042839e13b2c51ddc66e-806f16f55c9c9c6d.elb.us-east-1.amazonaws.com 80, 443 35s 454 | ``` 455 | 456 | 9. Instale o Prometheus Operator 457 | 458 | ```bash 459 | ➜ git clone https://github.com/prometheus-operator/kube-prometheus 460 | ➜ cd kube-prometheus 461 | ➜ kubectl create -f manifests/setup 462 | ➜ k apply -f manifests 463 | ``` 464 | 465 | Para acessar os serviços, edite cada um deles para que tenham uma NodePort. 466 | Atenção: Essa não é a prática recomendada, o Prometheus e o Alert manager não tem autenticação por padrão e essa configuração não deve ser feita em ambientes produtivos. 467 | 468 | 469 | ``` 470 | k edit svc -n monitoring prometheus-k8s 471 | k edit svc -n monitoring alertmanager-main 472 | k edit svc grafana -n monitoring 473 | ``` -------------------------------------------------------------------------------- /app/LICENSE: -------------------------------------------------------------------------------- 1 | GNU GENERAL PUBLIC LICENSE 2 | Version 3, 29 June 2007 3 | 4 | Copyright (C) 2007 Free Software Foundation, Inc. 5 | Everyone is permitted to copy and distribute verbatim copies 6 | of this license document, but changing it is not allowed. 7 | 8 | Preamble 9 | 10 | The GNU General Public License is a free, copyleft license for 11 | software and other kinds of works. 12 | 13 | The licenses for most software and other practical works are designed 14 | to take away your freedom to share and change the works. By contrast, 15 | the GNU General Public License is intended to guarantee your freedom to 16 | share and change all versions of a program--to make sure it remains free 17 | software for all its users. We, the Free Software Foundation, use the 18 | GNU General Public License for most of our software; it applies also to 19 | any other work released this way by its authors. You can apply it to 20 | your programs, too. 21 | 22 | When we speak of free software, we are referring to freedom, not 23 | price. Our General Public Licenses are designed to make sure that you 24 | have the freedom to distribute copies of free software (and charge for 25 | them if you wish), that you receive source code or can get it if you 26 | want it, that you can change the software or use pieces of it in new 27 | free programs, and that you know you can do these things. 28 | 29 | To protect your rights, we need to prevent others from denying you 30 | these rights or asking you to surrender the rights. Therefore, you have 31 | certain responsibilities if you distribute copies of the software, or if 32 | you modify it: responsibilities to respect the freedom of others. 33 | 34 | For example, if you distribute copies of such a program, whether 35 | gratis or for a fee, you must pass on to the recipients the same 36 | freedoms that you received. You must make sure that they, too, receive 37 | or can get the source code. And you must show them these terms so they 38 | know their rights. 39 | 40 | Developers that use the GNU GPL protect your rights with two steps: 41 | (1) assert copyright on the software, and (2) offer you this License 42 | giving you legal permission to copy, distribute and/or modify it. 43 | 44 | For the developers' and authors' protection, the GPL clearly explains 45 | that there is no warranty for this free software. For both users' and 46 | authors' sake, the GPL requires that modified versions be marked as 47 | changed, so that their problems will not be attributed erroneously to 48 | authors of previous versions. 49 | 50 | Some devices are designed to deny users access to install or run 51 | modified versions of the software inside them, although the manufacturer 52 | can do so. This is fundamentally incompatible with the aim of 53 | protecting users' freedom to change the software. The systematic 54 | pattern of such abuse occurs in the area of products for individuals to 55 | use, which is precisely where it is most unacceptable. Therefore, we 56 | have designed this version of the GPL to prohibit the practice for those 57 | products. If such problems arise substantially in other domains, we 58 | stand ready to extend this provision to those domains in future versions 59 | of the GPL, as needed to protect the freedom of users. 60 | 61 | Finally, every program is threatened constantly by software patents. 62 | States should not allow patents to restrict development and use of 63 | software on general-purpose computers, but in those that do, we wish to 64 | avoid the special danger that patents applied to a free program could 65 | make it effectively proprietary. To prevent this, the GPL assures that 66 | patents cannot be used to render the program non-free. 67 | 68 | The precise terms and conditions for copying, distribution and 69 | modification follow. 70 | 71 | TERMS AND CONDITIONS 72 | 73 | 0. Definitions. 74 | 75 | "This License" refers to version 3 of the GNU General Public License. 76 | 77 | "Copyright" also means copyright-like laws that apply to other kinds of 78 | works, such as semiconductor masks. 79 | 80 | "The Program" refers to any copyrightable work licensed under this 81 | License. Each licensee is addressed as "you". "Licensees" and 82 | "recipients" may be individuals or organizations. 83 | 84 | To "modify" a work means to copy from or adapt all or part of the work 85 | in a fashion requiring copyright permission, other than the making of an 86 | exact copy. The resulting work is called a "modified version" of the 87 | earlier work or a work "based on" the earlier work. 88 | 89 | A "covered work" means either the unmodified Program or a work based 90 | on the Program. 91 | 92 | To "propagate" a work means to do anything with it that, without 93 | permission, would make you directly or secondarily liable for 94 | infringement under applicable copyright law, except executing it on a 95 | computer or modifying a private copy. Propagation includes copying, 96 | distribution (with or without modification), making available to the 97 | public, and in some countries other activities as well. 98 | 99 | To "convey" a work means any kind of propagation that enables other 100 | parties to make or receive copies. Mere interaction with a user through 101 | a computer network, with no transfer of a copy, is not conveying. 102 | 103 | An interactive user interface displays "Appropriate Legal Notices" 104 | to the extent that it includes a convenient and prominently visible 105 | feature that (1) displays an appropriate copyright notice, and (2) 106 | tells the user that there is no warranty for the work (except to the 107 | extent that warranties are provided), that licensees may convey the 108 | work under this License, and how to view a copy of this License. If 109 | the interface presents a list of user commands or options, such as a 110 | menu, a prominent item in the list meets this criterion. 111 | 112 | 1. Source Code. 113 | 114 | The "source code" for a work means the preferred form of the work 115 | for making modifications to it. "Object code" means any non-source 116 | form of a work. 117 | 118 | A "Standard Interface" means an interface that either is an official 119 | standard defined by a recognized standards body, or, in the case of 120 | interfaces specified for a particular programming language, one that 121 | is widely used among developers working in that language. 122 | 123 | The "System Libraries" of an executable work include anything, other 124 | than the work as a whole, that (a) is included in the normal form of 125 | packaging a Major Component, but which is not part of that Major 126 | Component, and (b) serves only to enable use of the work with that 127 | Major Component, or to implement a Standard Interface for which an 128 | implementation is available to the public in source code form. A 129 | "Major Component", in this context, means a major essential component 130 | (kernel, window system, and so on) of the specific operating system 131 | (if any) on which the executable work runs, or a compiler used to 132 | produce the work, or an object code interpreter used to run it. 133 | 134 | The "Corresponding Source" for a work in object code form means all 135 | the source code needed to generate, install, and (for an executable 136 | work) run the object code and to modify the work, including scripts to 137 | control those activities. However, it does not include the work's 138 | System Libraries, or general-purpose tools or generally available free 139 | programs which are used unmodified in performing those activities but 140 | which are not part of the work. For example, Corresponding Source 141 | includes interface definition files associated with source files for 142 | the work, and the source code for shared libraries and dynamically 143 | linked subprograms that the work is specifically designed to require, 144 | such as by intimate data communication or control flow between those 145 | subprograms and other parts of the work. 146 | 147 | The Corresponding Source need not include anything that users 148 | can regenerate automatically from other parts of the Corresponding 149 | Source. 150 | 151 | The Corresponding Source for a work in source code form is that 152 | same work. 153 | 154 | 2. Basic Permissions. 155 | 156 | All rights granted under this License are granted for the term of 157 | copyright on the Program, and are irrevocable provided the stated 158 | conditions are met. This License explicitly affirms your unlimited 159 | permission to run the unmodified Program. The output from running a 160 | covered work is covered by this License only if the output, given its 161 | content, constitutes a covered work. This License acknowledges your 162 | rights of fair use or other equivalent, as provided by copyright law. 163 | 164 | You may make, run and propagate covered works that you do not 165 | convey, without conditions so long as your license otherwise remains 166 | in force. You may convey covered works to others for the sole purpose 167 | of having them make modifications exclusively for you, or provide you 168 | with facilities for running those works, provided that you comply with 169 | the terms of this License in conveying all material for which you do 170 | not control copyright. Those thus making or running the covered works 171 | for you must do so exclusively on your behalf, under your direction 172 | and control, on terms that prohibit them from making any copies of 173 | your copyrighted material outside their relationship with you. 174 | 175 | Conveying under any other circumstances is permitted solely under 176 | the conditions stated below. Sublicensing is not allowed; section 10 177 | makes it unnecessary. 178 | 179 | 3. Protecting Users' Legal Rights From Anti-Circumvention Law. 180 | 181 | No covered work shall be deemed part of an effective technological 182 | measure under any applicable law fulfilling obligations under article 183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or 184 | similar laws prohibiting or restricting circumvention of such 185 | measures. 186 | 187 | When you convey a covered work, you waive any legal power to forbid 188 | circumvention of technological measures to the extent such circumvention 189 | is effected by exercising rights under this License with respect to 190 | the covered work, and you disclaim any intention to limit operation or 191 | modification of the work as a means of enforcing, against the work's 192 | users, your or third parties' legal rights to forbid circumvention of 193 | technological measures. 194 | 195 | 4. Conveying Verbatim Copies. 196 | 197 | You may convey verbatim copies of the Program's source code as you 198 | receive it, in any medium, provided that you conspicuously and 199 | appropriately publish on each copy an appropriate copyright notice; 200 | keep intact all notices stating that this License and any 201 | non-permissive terms added in accord with section 7 apply to the code; 202 | keep intact all notices of the absence of any warranty; and give all 203 | recipients a copy of this License along with the Program. 204 | 205 | You may charge any price or no price for each copy that you convey, 206 | and you may offer support or warranty protection for a fee. 207 | 208 | 5. Conveying Modified Source Versions. 209 | 210 | You may convey a work based on the Program, or the modifications to 211 | produce it from the Program, in the form of source code under the 212 | terms of section 4, provided that you also meet all of these conditions: 213 | 214 | a) The work must carry prominent notices stating that you modified 215 | it, and giving a relevant date. 216 | 217 | b) The work must carry prominent notices stating that it is 218 | released under this License and any conditions added under section 219 | 7. This requirement modifies the requirement in section 4 to 220 | "keep intact all notices". 221 | 222 | c) You must license the entire work, as a whole, under this 223 | License to anyone who comes into possession of a copy. This 224 | License will therefore apply, along with any applicable section 7 225 | additional terms, to the whole of the work, and all its parts, 226 | regardless of how they are packaged. This License gives no 227 | permission to license the work in any other way, but it does not 228 | invalidate such permission if you have separately received it. 229 | 230 | d) If the work has interactive user interfaces, each must display 231 | Appropriate Legal Notices; however, if the Program has interactive 232 | interfaces that do not display Appropriate Legal Notices, your 233 | work need not make them do so. 234 | 235 | A compilation of a covered work with other separate and independent 236 | works, which are not by their nature extensions of the covered work, 237 | and which are not combined with it such as to form a larger program, 238 | in or on a volume of a storage or distribution medium, is called an 239 | "aggregate" if the compilation and its resulting copyright are not 240 | used to limit the access or legal rights of the compilation's users 241 | beyond what the individual works permit. Inclusion of a covered work 242 | in an aggregate does not cause this License to apply to the other 243 | parts of the aggregate. 244 | 245 | 6. Conveying Non-Source Forms. 246 | 247 | You may convey a covered work in object code form under the terms 248 | of sections 4 and 5, provided that you also convey the 249 | machine-readable Corresponding Source under the terms of this License, 250 | in one of these ways: 251 | 252 | a) Convey the object code in, or embodied in, a physical product 253 | (including a physical distribution medium), accompanied by the 254 | Corresponding Source fixed on a durable physical medium 255 | customarily used for software interchange. 256 | 257 | b) Convey the object code in, or embodied in, a physical product 258 | (including a physical distribution medium), accompanied by a 259 | written offer, valid for at least three years and valid for as 260 | long as you offer spare parts or customer support for that product 261 | model, to give anyone who possesses the object code either (1) a 262 | copy of the Corresponding Source for all the software in the 263 | product that is covered by this License, on a durable physical 264 | medium customarily used for software interchange, for a price no 265 | more than your reasonable cost of physically performing this 266 | conveying of source, or (2) access to copy the 267 | Corresponding Source from a network server at no charge. 268 | 269 | c) Convey individual copies of the object code with a copy of the 270 | written offer to provide the Corresponding Source. This 271 | alternative is allowed only occasionally and noncommercially, and 272 | only if you received the object code with such an offer, in accord 273 | with subsection 6b. 274 | 275 | d) Convey the object code by offering access from a designated 276 | place (gratis or for a charge), and offer equivalent access to the 277 | Corresponding Source in the same way through the same place at no 278 | further charge. You need not require recipients to copy the 279 | Corresponding Source along with the object code. If the place to 280 | copy the object code is a network server, the Corresponding Source 281 | may be on a different server (operated by you or a third party) 282 | that supports equivalent copying facilities, provided you maintain 283 | clear directions next to the object code saying where to find the 284 | Corresponding Source. Regardless of what server hosts the 285 | Corresponding Source, you remain obligated to ensure that it is 286 | available for as long as needed to satisfy these requirements. 287 | 288 | e) Convey the object code using peer-to-peer transmission, provided 289 | you inform other peers where the object code and Corresponding 290 | Source of the work are being offered to the general public at no 291 | charge under subsection 6d. 292 | 293 | A separable portion of the object code, whose source code is excluded 294 | from the Corresponding Source as a System Library, need not be 295 | included in conveying the object code work. 296 | 297 | A "User Product" is either (1) a "consumer product", which means any 298 | tangible personal property which is normally used for personal, family, 299 | or household purposes, or (2) anything designed or sold for incorporation 300 | into a dwelling. In determining whether a product is a consumer product, 301 | doubtful cases shall be resolved in favor of coverage. For a particular 302 | product received by a particular user, "normally used" refers to a 303 | typical or common use of that class of product, regardless of the status 304 | of the particular user or of the way in which the particular user 305 | actually uses, or expects or is expected to use, the product. A product 306 | is a consumer product regardless of whether the product has substantial 307 | commercial, industrial or non-consumer uses, unless such uses represent 308 | the only significant mode of use of the product. 309 | 310 | "Installation Information" for a User Product means any methods, 311 | procedures, authorization keys, or other information required to install 312 | and execute modified versions of a covered work in that User Product from 313 | a modified version of its Corresponding Source. The information must 314 | suffice to ensure that the continued functioning of the modified object 315 | code is in no case prevented or interfered with solely because 316 | modification has been made. 317 | 318 | If you convey an object code work under this section in, or with, or 319 | specifically for use in, a User Product, and the conveying occurs as 320 | part of a transaction in which the right of possession and use of the 321 | User Product is transferred to the recipient in perpetuity or for a 322 | fixed term (regardless of how the transaction is characterized), the 323 | Corresponding Source conveyed under this section must be accompanied 324 | by the Installation Information. But this requirement does not apply 325 | if neither you nor any third party retains the ability to install 326 | modified object code on the User Product (for example, the work has 327 | been installed in ROM). 328 | 329 | The requirement to provide Installation Information does not include a 330 | requirement to continue to provide support service, warranty, or updates 331 | for a work that has been modified or installed by the recipient, or for 332 | the User Product in which it has been modified or installed. Access to a 333 | network may be denied when the modification itself materially and 334 | adversely affects the operation of the network or violates the rules and 335 | protocols for communication across the network. 336 | 337 | Corresponding Source conveyed, and Installation Information provided, 338 | in accord with this section must be in a format that is publicly 339 | documented (and with an implementation available to the public in 340 | source code form), and must require no special password or key for 341 | unpacking, reading or copying. 342 | 343 | 7. Additional Terms. 344 | 345 | "Additional permissions" are terms that supplement the terms of this 346 | License by making exceptions from one or more of its conditions. 347 | Additional permissions that are applicable to the entire Program shall 348 | be treated as though they were included in this License, to the extent 349 | that they are valid under applicable law. If additional permissions 350 | apply only to part of the Program, that part may be used separately 351 | under those permissions, but the entire Program remains governed by 352 | this License without regard to the additional permissions. 353 | 354 | When you convey a copy of a covered work, you may at your option 355 | remove any additional permissions from that copy, or from any part of 356 | it. (Additional permissions may be written to require their own 357 | removal in certain cases when you modify the work.) You may place 358 | additional permissions on material, added by you to a covered work, 359 | for which you have or can give appropriate copyright permission. 360 | 361 | Notwithstanding any other provision of this License, for material you 362 | add to a covered work, you may (if authorized by the copyright holders of 363 | that material) supplement the terms of this License with terms: 364 | 365 | a) Disclaiming warranty or limiting liability differently from the 366 | terms of sections 15 and 16 of this License; or 367 | 368 | b) Requiring preservation of specified reasonable legal notices or 369 | author attributions in that material or in the Appropriate Legal 370 | Notices displayed by works containing it; or 371 | 372 | c) Prohibiting misrepresentation of the origin of that material, or 373 | requiring that modified versions of such material be marked in 374 | reasonable ways as different from the original version; or 375 | 376 | d) Limiting the use for publicity purposes of names of licensors or 377 | authors of the material; or 378 | 379 | e) Declining to grant rights under trademark law for use of some 380 | trade names, trademarks, or service marks; or 381 | 382 | f) Requiring indemnification of licensors and authors of that 383 | material by anyone who conveys the material (or modified versions of 384 | it) with contractual assumptions of liability to the recipient, for 385 | any liability that these contractual assumptions directly impose on 386 | those licensors and authors. 387 | 388 | All other non-permissive additional terms are considered "further 389 | restrictions" within the meaning of section 10. If the Program as you 390 | received it, or any part of it, contains a notice stating that it is 391 | governed by this License along with a term that is a further 392 | restriction, you may remove that term. If a license document contains 393 | a further restriction but permits relicensing or conveying under this 394 | License, you may add to a covered work material governed by the terms 395 | of that license document, provided that the further restriction does 396 | not survive such relicensing or conveying. 397 | 398 | If you add terms to a covered work in accord with this section, you 399 | must place, in the relevant source files, a statement of the 400 | additional terms that apply to those files, or a notice indicating 401 | where to find the applicable terms. 402 | 403 | Additional terms, permissive or non-permissive, may be stated in the 404 | form of a separately written license, or stated as exceptions; 405 | the above requirements apply either way. 406 | 407 | 8. Termination. 408 | 409 | You may not propagate or modify a covered work except as expressly 410 | provided under this License. Any attempt otherwise to propagate or 411 | modify it is void, and will automatically terminate your rights under 412 | this License (including any patent licenses granted under the third 413 | paragraph of section 11). 414 | 415 | However, if you cease all violation of this License, then your 416 | license from a particular copyright holder is reinstated (a) 417 | provisionally, unless and until the copyright holder explicitly and 418 | finally terminates your license, and (b) permanently, if the copyright 419 | holder fails to notify you of the violation by some reasonable means 420 | prior to 60 days after the cessation. 421 | 422 | Moreover, your license from a particular copyright holder is 423 | reinstated permanently if the copyright holder notifies you of the 424 | violation by some reasonable means, this is the first time you have 425 | received notice of violation of this License (for any work) from that 426 | copyright holder, and you cure the violation prior to 30 days after 427 | your receipt of the notice. 428 | 429 | Termination of your rights under this section does not terminate the 430 | licenses of parties who have received copies or rights from you under 431 | this License. If your rights have been terminated and not permanently 432 | reinstated, you do not qualify to receive new licenses for the same 433 | material under section 10. 434 | 435 | 9. Acceptance Not Required for Having Copies. 436 | 437 | You are not required to accept this License in order to receive or 438 | run a copy of the Program. Ancillary propagation of a covered work 439 | occurring solely as a consequence of using peer-to-peer transmission 440 | to receive a copy likewise does not require acceptance. However, 441 | nothing other than this License grants you permission to propagate or 442 | modify any covered work. These actions infringe copyright if you do 443 | not accept this License. Therefore, by modifying or propagating a 444 | covered work, you indicate your acceptance of this License to do so. 445 | 446 | 10. Automatic Licensing of Downstream Recipients. 447 | 448 | Each time you convey a covered work, the recipient automatically 449 | receives a license from the original licensors, to run, modify and 450 | propagate that work, subject to this License. You are not responsible 451 | for enforcing compliance by third parties with this License. 452 | 453 | An "entity transaction" is a transaction transferring control of an 454 | organization, or substantially all assets of one, or subdividing an 455 | organization, or merging organizations. If propagation of a covered 456 | work results from an entity transaction, each party to that 457 | transaction who receives a copy of the work also receives whatever 458 | licenses to the work the party's predecessor in interest had or could 459 | give under the previous paragraph, plus a right to possession of the 460 | Corresponding Source of the work from the predecessor in interest, if 461 | the predecessor has it or can get it with reasonable efforts. 462 | 463 | You may not impose any further restrictions on the exercise of the 464 | rights granted or affirmed under this License. For example, you may 465 | not impose a license fee, royalty, or other charge for exercise of 466 | rights granted under this License, and you may not initiate litigation 467 | (including a cross-claim or counterclaim in a lawsuit) alleging that 468 | any patent claim is infringed by making, using, selling, offering for 469 | sale, or importing the Program or any portion of it. 470 | 471 | 11. Patents. 472 | 473 | A "contributor" is a copyright holder who authorizes use under this 474 | License of the Program or a work on which the Program is based. The 475 | work thus licensed is called the contributor's "contributor version". 476 | 477 | A contributor's "essential patent claims" are all patent claims 478 | owned or controlled by the contributor, whether already acquired or 479 | hereafter acquired, that would be infringed by some manner, permitted 480 | by this License, of making, using, or selling its contributor version, 481 | but do not include claims that would be infringed only as a 482 | consequence of further modification of the contributor version. For 483 | purposes of this definition, "control" includes the right to grant 484 | patent sublicenses in a manner consistent with the requirements of 485 | this License. 486 | 487 | Each contributor grants you a non-exclusive, worldwide, royalty-free 488 | patent license under the contributor's essential patent claims, to 489 | make, use, sell, offer for sale, import and otherwise run, modify and 490 | propagate the contents of its contributor version. 491 | 492 | In the following three paragraphs, a "patent license" is any express 493 | agreement or commitment, however denominated, not to enforce a patent 494 | (such as an express permission to practice a patent or covenant not to 495 | sue for patent infringement). To "grant" such a patent license to a 496 | party means to make such an agreement or commitment not to enforce a 497 | patent against the party. 498 | 499 | If you convey a covered work, knowingly relying on a patent license, 500 | and the Corresponding Source of the work is not available for anyone 501 | to copy, free of charge and under the terms of this License, through a 502 | publicly available network server or other readily accessible means, 503 | then you must either (1) cause the Corresponding Source to be so 504 | available, or (2) arrange to deprive yourself of the benefit of the 505 | patent license for this particular work, or (3) arrange, in a manner 506 | consistent with the requirements of this License, to extend the patent 507 | license to downstream recipients. "Knowingly relying" means you have 508 | actual knowledge that, but for the patent license, your conveying the 509 | covered work in a country, or your recipient's use of the covered work 510 | in a country, would infringe one or more identifiable patents in that 511 | country that you have reason to believe are valid. 512 | 513 | If, pursuant to or in connection with a single transaction or 514 | arrangement, you convey, or propagate by procuring conveyance of, a 515 | covered work, and grant a patent license to some of the parties 516 | receiving the covered work authorizing them to use, propagate, modify 517 | or convey a specific copy of the covered work, then the patent license 518 | you grant is automatically extended to all recipients of the covered 519 | work and works based on it. 520 | 521 | A patent license is "discriminatory" if it does not include within 522 | the scope of its coverage, prohibits the exercise of, or is 523 | conditioned on the non-exercise of one or more of the rights that are 524 | specifically granted under this License. You may not convey a covered 525 | work if you are a party to an arrangement with a third party that is 526 | in the business of distributing software, under which you make payment 527 | to the third party based on the extent of your activity of conveying 528 | the work, and under which the third party grants, to any of the 529 | parties who would receive the covered work from you, a discriminatory 530 | patent license (a) in connection with copies of the covered work 531 | conveyed by you (or copies made from those copies), or (b) primarily 532 | for and in connection with specific products or compilations that 533 | contain the covered work, unless you entered into that arrangement, 534 | or that patent license was granted, prior to 28 March 2007. 535 | 536 | Nothing in this License shall be construed as excluding or limiting 537 | any implied license or other defenses to infringement that may 538 | otherwise be available to you under applicable patent law. 539 | 540 | 12. No Surrender of Others' Freedom. 541 | 542 | If conditions are imposed on you (whether by court order, agreement or 543 | otherwise) that contradict the conditions of this License, they do not 544 | excuse you from the conditions of this License. If you cannot convey a 545 | covered work so as to satisfy simultaneously your obligations under this 546 | License and any other pertinent obligations, then as a consequence you may 547 | not convey it at all. For example, if you agree to terms that obligate you 548 | to collect a royalty for further conveying from those to whom you convey 549 | the Program, the only way you could satisfy both those terms and this 550 | License would be to refrain entirely from conveying the Program. 551 | 552 | 13. Use with the GNU Affero General Public License. 553 | 554 | Notwithstanding any other provision of this License, you have 555 | permission to link or combine any covered work with a work licensed 556 | under version 3 of the GNU Affero General Public License into a single 557 | combined work, and to convey the resulting work. The terms of this 558 | License will continue to apply to the part which is the covered work, 559 | but the special requirements of the GNU Affero General Public License, 560 | section 13, concerning interaction through a network will apply to the 561 | combination as such. 562 | 563 | 14. Revised Versions of this License. 564 | 565 | The Free Software Foundation may publish revised and/or new versions of 566 | the GNU General Public License from time to time. Such new versions will 567 | be similar in spirit to the present version, but may differ in detail to 568 | address new problems or concerns. 569 | 570 | Each version is given a distinguishing version number. If the 571 | Program specifies that a certain numbered version of the GNU General 572 | Public License "or any later version" applies to it, you have the 573 | option of following the terms and conditions either of that numbered 574 | version or of any later version published by the Free Software 575 | Foundation. If the Program does not specify a version number of the 576 | GNU General Public License, you may choose any version ever published 577 | by the Free Software Foundation. 578 | 579 | If the Program specifies that a proxy can decide which future 580 | versions of the GNU General Public License can be used, that proxy's 581 | public statement of acceptance of a version permanently authorizes you 582 | to choose that version for the Program. 583 | 584 | Later license versions may give you additional or different 585 | permissions. However, no additional obligations are imposed on any 586 | author or copyright holder as a result of your choosing to follow a 587 | later version. 588 | 589 | 15. Disclaimer of Warranty. 590 | 591 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY 592 | APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT 593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY 594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, 595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 596 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM 597 | IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF 598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 599 | 600 | 16. Limitation of Liability. 601 | 602 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING 603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS 604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY 605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE 606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF 607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD 608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), 609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF 610 | SUCH DAMAGES. 611 | 612 | 17. Interpretation of Sections 15 and 16. 613 | 614 | If the disclaimer of warranty and limitation of liability provided 615 | above cannot be given local legal effect according to their terms, 616 | reviewing courts shall apply local law that most closely approximates 617 | an absolute waiver of all civil liability in connection with the 618 | Program, unless a warranty or assumption of liability accompanies a 619 | copy of the Program in return for a fee. 620 | 621 | END OF TERMS AND CONDITIONS 622 | 623 | How to Apply These Terms to Your New Programs 624 | 625 | If you develop a new program, and you want it to be of the greatest 626 | possible use to the public, the best way to achieve this is to make it 627 | free software which everyone can redistribute and change under these terms. 628 | 629 | To do so, attach the following notices to the program. It is safest 630 | to attach them to the start of each source file to most effectively 631 | state the exclusion of warranty; and each file should have at least 632 | the "copyright" line and a pointer to where the full notice is found. 633 | 634 | 635 | Copyright (C) 636 | 637 | This program is free software: you can redistribute it and/or modify 638 | it under the terms of the GNU General Public License as published by 639 | the Free Software Foundation, either version 3 of the License, or 640 | (at your option) any later version. 641 | 642 | This program is distributed in the hope that it will be useful, 643 | but WITHOUT ANY WARRANTY; without even the implied warranty of 644 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 645 | GNU General Public License for more details. 646 | 647 | You should have received a copy of the GNU General Public License 648 | along with this program. If not, see . 649 | 650 | Also add information on how to contact you by electronic and paper mail. 651 | 652 | If the program does terminal interaction, make it output a short 653 | notice like this when it starts in an interactive mode: 654 | 655 | Copyright (C) 656 | This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. 657 | This is free software, and you are welcome to redistribute it 658 | under certain conditions; type `show c' for details. 659 | 660 | The hypothetical commands `show w' and `show c' should show the appropriate 661 | parts of the General Public License. Of course, your program's commands 662 | might be different; for a GUI interface, you would use an "about box". 663 | 664 | You should also get your employer (if you work as a programmer) or school, 665 | if any, to sign a "copyright disclaimer" for the program, if necessary. 666 | For more information on this, and how to apply and follow the GNU GPL, see 667 | . 668 | 669 | The GNU General Public License does not permit incorporating your program 670 | into proprietary programs. If your program is a subroutine library, you 671 | may consider it more useful to permit linking proprietary applications with 672 | the library. If this is what you want to do, use the GNU Lesser General 673 | Public License instead of this License. But first, please read 674 | . 675 | --------------------------------------------------------------------------------