Lambda layer release automation #1814

reakaleek · 2023-04-27T11:44:04Z

What does this pull request do?

Based on #1796

Relevant commit range: https://github.com/elastic/apm-agent-python/pull/1814/files/766da7e9b5e9f8c4d5067ffac3f4c4087ade5554..436c7f5c8748bfb7fffac092bd763e963dc2f3ac

Adds lambda layer release automation
Add creation of github release draft to facilitate the arn file

How to test

ELASTIC_LAYER_NAME=test ./.ci/publish-aws.sh

With valid AWS credentials

reakaleek · 2023-04-27T11:56:06Z

.github/workflows/release.yml

+  github-draft:
+    needs:
+      - publish-lambda-layers
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/download-artifact@v3
+        with:
+          name: arn-file
+      - run: >- 
+          gh release create "${GITHUB_REF_NAME}"
+          --title="${GITHUB_REF_NAME}"
+          --generate-notes
+          --notes-file=".arn-file.md"
+          --draft
+        env:
+          GH_TOKEN: ${{ github.token }}


@basepi

I'm creating a github release draft here, which can be adjusted and published manually later.

I did this so we have the arn table already in the draft.

example arn table created during testing

Elastic APM Python agent layer ARNs

Region ARN

ap-northeast-1 arn:aws:lambda:ap-northeast-1:627286350134:layer:jcal-dev-elastic-apm-python:6

ap-northeast-2 arn:aws:lambda:ap-northeast-2:627286350134:layer:jcal-dev-elastic-apm-python:6

ap-northeast-3 arn:aws:lambda:ap-northeast-3:627286350134:layer:jcal-dev-elastic-apm-python:6

ap-south-1 arn:aws:lambda:ap-south-1:627286350134:layer:jcal-dev-elastic-apm-python:8

ap-southeast-1 arn:aws:lambda:ap-southeast-1:627286350134:layer:jcal-dev-elastic-apm-python:6

ap-southeast-2 arn:aws:lambda:ap-southeast-2:627286350134:layer:jcal-dev-elastic-apm-python:6

ca-central-1 arn:aws:lambda:ca-central-1:627286350134:layer:jcal-dev-elastic-apm-python:6

eu-central-1 arn:aws:lambda:eu-central-1:627286350134:layer:jcal-dev-elastic-apm-python:6

eu-north-1 arn:aws:lambda:eu-north-1:627286350134:layer:jcal-dev-elastic-apm-python:6

eu-west-1 arn:aws:lambda:eu-west-1:627286350134:layer:jcal-dev-elastic-apm-python:6

eu-west-2 arn:aws:lambda:eu-west-2:627286350134:layer:jcal-dev-elastic-apm-python:6

eu-west-3 arn:aws:lambda:eu-west-3:627286350134:layer:jcal-dev-elastic-apm-python:6

sa-east-1 arn:aws:lambda:sa-east-1:627286350134:layer:jcal-dev-elastic-apm-python:6

us-east-1 arn:aws:lambda:us-east-1:627286350134:layer:jcal-dev-elastic-apm-python:6

us-east-2 arn:aws:lambda:us-east-2:627286350134:layer:jcal-dev-elastic-apm-python:6

us-west-1 arn:aws:lambda:us-west-1:627286350134:layer:jcal-dev-elastic-apm-python:6

us-west-2 arn:aws:lambda:us-west-2:627286350134:layer:jcal-dev-elastic-apm-python:6

WDYT?

Looks great!

reakaleek · 2023-04-27T12:53:11Z

@elastic/apm-agent-python

Not sure if related, but the windows tests seem to be stuck.

amannocci

LGTM

Note: Some minor feedbacks

.github/workflows/release.yml

v1v

LGTM, with some comments

v1v · 2023-04-27T16:15:05Z

.ci/publish-aws.sh

+    --region="${region}" \
+    --layer-name="${FULL_LAYER_NAME}" \
+    --description="AWS Lambda Extension Layer for the Elastic APM Python Agent" \
+    --license="Apache-2.0" \


As far as I see the apm-agent-python uses a different license. But I don't know what's the one for the AWS lambda, can we clarify this?

Good point. It's copied from apm-aws-lambda. I mistakenly assumed it will be the same.

Any suggestions @basepi @beniwohli ?

The Layer will be licensed with BSD 3 Clause, same as the agent: https://github.com/elastic/apm-agent-python/blob/main/LICENSE

(This is due to legacy code, Apache-2.0 would definitely be my preference but we're stuck with the original license.)

v1v · 2023-04-27T16:16:12Z

.github/workflows/release.yml

+      - uses: actions/download-artifact@v3
+        with:
+          name: arn-file
+      - run: >- 


NIT: Use name for the step?

Suggested change

- run: >-

- name: Create GitHub Draft Release

run: >-

v1v · 2023-04-27T16:17:40Z

.github/workflows/release.yml

+    if: always()
+    needs:
+      - publish-lambda-layers
+      - release


What about github-draft? Though, it has a dependency with publish-lambda-layers, if added, will it work in the case github-draft failed?

Suggested change

- release

- publish-pypi

- github-draft

basepi

Looking great! Thank you for the fast turnaround here. Once we fix up the license and the other review feedback we should be good.

reakaleek · 2023-04-27T21:59:58Z

@basepi one last thing that I noticed while checking the license.

what are the compatible runtimes?

these are the available options:

python2.7
python3.6
python3.7
python3.8

can be one or more

basepi · 2023-04-27T23:26:47Z

what are the compatible runtimes?

3.6, 3.7, 3.8, 3.9 (3.9 is an option too, it's just up at the top of the dropdown with the other "latest versions")

reakaleek · 2023-04-28T06:10:59Z

what are the compatible runtimes?

3.6, 3.7, 3.8, 3.9 (3.9 is an option too, it's just up at the top of the dropdown with the other "latest versions")

Ah ups, thanks for double checking. I was looking at the example of the cli documentation

https://awscli.amazonaws.com/v2/documentation/api/2.0.34/reference/lambda/publish-layer-version.html and the list is incomplete.

reakaleek · 2023-04-28T06:17:07Z

3.6, 3.7, 3.8, 3.9 (3.9 is an option too, it's just up at the top of the dropdown with the other "latest versions")

18f561b

v1v

LGTM, with a minor comment

v1v · 2023-04-28T09:37:56Z

.github/workflows/release.yml

    tags:
      - "v*.*.*"

+permissions:


NIT: if it is only used when creating the draft release, then it can be configured in that particular job rather than globally

basepi · 2023-04-28T19:17:55Z

Windows tests are unrelated: #1817

reakaleek · 2023-05-02T09:56:21Z

@basepi

To be sure: are we good to merge this PR including the changes from #1796?

basepi · 2023-05-02T19:35:54Z

@reakaleek are we good to merge this PR including the changes from #1796?

Please do not merge this. #1796 needs to be reviewed and merged first, then we'll merge the automation.

basepi · 2023-05-05T19:13:14Z

@reakaleek I updated #1796 to better handle the docker image paths, and added a Dockerfile. You'll want to rebase.

Similar to the nodejs docker file, it expects an AGENT_DIR arg, which in the this case should be ./build/dist/package/python.

This will result in the same directory structure in both the lambda layer (mounted at /opt) and the docker image.

Can you please add support for building and uploading the docker image? Thanks!

reakaleek · 2023-05-08T20:36:31Z

@reakaleek I updated #1796 to better handle the docker image paths, and added a Dockerfile. You'll want to rebase.

Similar to the nodejs docker file, it expects an AGENT_DIR arg, which in the this case should be ./build/dist/package/python.

This will result in the same directory structure in both the lambda layer (mounted at /opt) and the docker image.

Can you please add support for building and uploading the docker image? Thanks!

63b7294

basepi · 2023-05-09T17:03:34Z

#1796 is merged, so you can rebase and merge this at your convenience.

basepi · 2023-05-09T17:18:47Z

Actually, I have one more request, @reakaleek -- I think we should be testing make-distribution.sh to make sure we don't end up with a dependency conflict in dev-utils/requirements.txt. Since I'm dynamically injecting into requirements.txt at build time, Dependabot can't properly check for incompatibilities in the dependency chain. I think we should be testing this regularly, rather than finding out it fails when we try to release.

I could throw a set -e at the beginning of the script and then write a unit test that runs this command. But I think it probably makes sense to run it as a github action. Do you agree?

Edit: We already do set -o errexit which is equivalent to set -e so we just need to run it and check the retcode.

reakaleek · 2023-05-15T09:25:41Z

Actually, I have one more request, @reakaleek -- I think we should be testing make-distribution.sh to make sure we don't end up with a dependency conflict in dev-utils/requirements.txt. Since I'm dynamically injecting into requirements.txt at build time, Dependabot can't properly check for incompatibilities in the dependency chain. I think we should be testing this regularly, rather than finding out it fails when we try to release.

I could throw a set -e at the beginning of the script and then write a unit test that runs this command. But I think it probably makes sense to run it as a github action. Do you agree?

Edit: We already do set -o errexit which is equivalent to set -e so we just need to run it and check the retcode.

Hi @basepi,

Sorry for the delay, just got back from sick leave.

I think we should be testing this regularly, rather than finding out it fails when we try to release.

I agree, testing this regularly makes sense.

I could throw a set -e at the beginning of the script and then write a unit test that runs this command. But I think it probably makes sense to run it as a github action. Do you agree?

Can you elaborate on this more? Do you mean we run the script make-distribution.sh on a PR level in it's own GH workflow job? Or do you mean we should create a custom action that does it?

Co-authored-by: Adrien Mannocci <[email protected]>

reakaleek · 2023-05-15T11:45:13Z

Actually, I have one more request, @reakaleek -- I think we should be testing make-distribution.sh to make sure we don't end up with a dependency conflict in dev-utils/requirements.txt. Since I'm dynamically injecting into requirements.txt at build time, Dependabot can't properly check for incompatibilities in the dependency chain. I think we should be testing this regularly, rather than finding out it fails when we try to release.
I could throw a set -e at the beginning of the script and then write a unit test that runs this command. But I think it probably makes sense to run it as a github action. Do you agree?
Edit: We already do set -o errexit which is equivalent to set -e so we just need to run it and check the retcode.

Hi @basepi,

Sorry for the delay, just got back from sick leave.

I think we should be testing this regularly, rather than finding out it fails when we try to release.

I agree, testing this regularly makes sense.

I could throw a set -e at the beginning of the script and then write a unit test that runs this command. But I think it probably makes sense to run it as a github action. Do you agree?

Can you elaborate on this more? Do you mean we run the script make-distribution.sh on a PR level in it's own GH workflow job? Or do you mean we should create a custom action that does it?

I extracted the build-distribution script into a reusable workflow and it's now called in the release and the test workflow.

Let me know if this matches your suggestion/request.

2f2253e

basepi · 2023-05-16T18:12:53Z

I extracted the build-distribution script into a reusable workflow and it's now called in the release and the test workflow.

Let me know if this matches your suggestion/request.

This should be perfect! Thank you.

github-actions bot added agent-python community Issues opened by the community triage Issues awaiting triage labels Apr 27, 2023

reakaleek requested review from a team, basepi and beniwohli April 27, 2023 11:44

reakaleek marked this pull request as ready for review April 27, 2023 11:51

reakaleek commented Apr 27, 2023

View reviewed changes

reakaleek marked this pull request as draft April 27, 2023 12:00

reakaleek self-assigned this Apr 27, 2023

reakaleek marked this pull request as ready for review April 27, 2023 12:15

amannocci approved these changes Apr 27, 2023

View reviewed changes

.github/workflows/release.yml Outdated Show resolved Hide resolved

.github/workflows/release.yml Show resolved Hide resolved

v1v reviewed Apr 27, 2023

View reviewed changes

basepi approved these changes Apr 27, 2023

View reviewed changes

v1v approved these changes Apr 28, 2023

View reviewed changes

basepi mentioned this pull request May 5, 2023

Update lambda docs for lambda layer + docker image #1826

Merged

reakaleek force-pushed the feature/lambda-layer-release-automation branch 3 times, most recently from 33a23a1 to 489cffe Compare May 8, 2023 10:35

reakaleek requested a review from basepi May 8, 2023 20:36

reakaleek requested a review from a team May 9, 2023 10:14

v1v approved these changes May 9, 2023

View reviewed changes

basepi approved these changes May 9, 2023

View reviewed changes

reakaleek and others added 11 commits May 15, 2023 11:28

Add lambda layer publishing to release

d489c37

Add draft option

05207b4

Add AWS credentials

4c0bdc5

Update .github/workflows/release.yml

2a119c1

Co-authored-by: Adrien Mannocci <[email protected]>

Add github-draft as dependency for notification

765bdd0

Add name to step

a2bf78b

Fix license

3925c43

Add compatible-runtimes

87dd7cd

Move permissions to job

ed294d1

Refactor secret path into env

f119ce9

Add docker build and push job

beeab0c

reakaleek force-pushed the feature/lambda-layer-release-automation branch from 63b7294 to beeab0c Compare May 15, 2023 09:28

Run build-distribution also in test workflow

2f2253e

reakaleek requested a review from basepi May 15, 2023 11:54

basepi approved these changes May 16, 2023

View reviewed changes

Merge branch 'main' into feature/lambda-layer-release-automation

2d6161a

reakaleek merged commit 2898e3f into elastic:main May 17, 2023

reakaleek deleted the feature/lambda-layer-release-automation branch May 17, 2023 10:48

Region	ARN
ap-northeast-1	arn:aws:lambda:ap-northeast-1:627286350134:layer:jcal-dev-elastic-apm-python:6
ap-northeast-2	arn:aws:lambda:ap-northeast-2:627286350134:layer:jcal-dev-elastic-apm-python:6
ap-northeast-3	arn:aws:lambda:ap-northeast-3:627286350134:layer:jcal-dev-elastic-apm-python:6
ap-south-1	arn:aws:lambda:ap-south-1:627286350134:layer:jcal-dev-elastic-apm-python:8
ap-southeast-1	arn:aws:lambda:ap-southeast-1:627286350134:layer:jcal-dev-elastic-apm-python:6
ap-southeast-2	arn:aws:lambda:ap-southeast-2:627286350134:layer:jcal-dev-elastic-apm-python:6
ca-central-1	arn:aws:lambda:ca-central-1:627286350134:layer:jcal-dev-elastic-apm-python:6
eu-central-1	arn:aws:lambda:eu-central-1:627286350134:layer:jcal-dev-elastic-apm-python:6
eu-north-1	arn:aws:lambda:eu-north-1:627286350134:layer:jcal-dev-elastic-apm-python:6
eu-west-1	arn:aws:lambda:eu-west-1:627286350134:layer:jcal-dev-elastic-apm-python:6
eu-west-2	arn:aws:lambda:eu-west-2:627286350134:layer:jcal-dev-elastic-apm-python:6
eu-west-3	arn:aws:lambda:eu-west-3:627286350134:layer:jcal-dev-elastic-apm-python:6
sa-east-1	arn:aws:lambda:sa-east-1:627286350134:layer:jcal-dev-elastic-apm-python:6
us-east-1	arn:aws:lambda:us-east-1:627286350134:layer:jcal-dev-elastic-apm-python:6
us-east-2	arn:aws:lambda:us-east-2:627286350134:layer:jcal-dev-elastic-apm-python:6
us-west-1	arn:aws:lambda:us-west-1:627286350134:layer:jcal-dev-elastic-apm-python:6
us-west-2	arn:aws:lambda:us-west-2:627286350134:layer:jcal-dev-elastic-apm-python:6

Lambda layer release automation #1814

Lambda layer release automation #1814

Uh oh!

Conversation

reakaleek commented Apr 27, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this pull request do?

How to test

Uh oh!

Choose a reason for hiding this comment

Elastic APM Python agent layer ARNs

Uh oh!

Choose a reason for hiding this comment

Uh oh!

reakaleek commented Apr 27, 2023

Uh oh!

amannocci left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

v1v left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

basepi Apr 27, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

basepi left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

reakaleek commented Apr 27, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

basepi commented Apr 27, 2023

Uh oh!

reakaleek commented Apr 28, 2023

Uh oh!

reakaleek commented Apr 28, 2023

Uh oh!

v1v left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

basepi commented Apr 28, 2023

Uh oh!

reakaleek commented May 2, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

basepi commented May 2, 2023

Uh oh!

basepi commented May 5, 2023

Uh oh!

reakaleek commented May 8, 2023

Uh oh!

basepi commented May 9, 2023

Uh oh!

basepi commented May 9, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

reakaleek commented Apr 27, 2023 •

edited

Loading

basepi Apr 27, 2023 •

edited

Loading

basepi left a comment •

edited

Loading

reakaleek commented Apr 27, 2023 •

edited

Loading

reakaleek commented May 2, 2023 •

edited

Loading

basepi commented May 9, 2023 •

edited

Loading