Skip to content

Commit 9624cbf

Browse files
alexellisalexellis
committed
Add pro-builder docs for faasd-pro
Signed-off-by: Alex Ellis (OpenFaaS Ltd) <alexellis2@gmail.com>
1 parent cc4a15e commit 9624cbf

2 files changed

Lines changed: 138 additions & 0 deletions

File tree

‎docs/edge/builder.md‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
# Function Builder API for OpenFaaS Edge
2+
3+
The Function Builder API is available in OpenFaaS Edge and allows you to build functions from source code using a variety of templates.
4+
5+
The builder runs as a non-root user making use of user namespaces in Linux.
6+
7+
## Prerequisites
8+
9+
* An OpenFaaS for Enterprises license or an additional entitlement for the Function Builder API is required to use this feature.
10+
* Your operating system must support user namespaces, generally most modern Linux distributions do.
11+
* Docker must not be installed on the host system.
12+
* faasd-pro version 0.2.23 or later is required.
13+
14+
## Create a registry secret
15+
16+
For testing purposes, you can use an ephemeral registry which requires no authentication such as [ttl.sh](https://ttl.sh).
17+
18+
Bear in mind that this ephemeral cluster is public, and have much more latency than your final production setup.
19+
20+
```bash
21+
sudo tee /var/lib/faasd/secrets/docker-config <<EOF
22+
{
23+
}
24+
```
25+
26+
For production use, create a secret with a proper authenticated registry, see the notes on the [Function Builder API for Kubernetes](/openfaas-pro/builder).
27+
28+
## Create a payload secret
29+
30+
The payload secret will be used to sign the payloads sent to the Function Builder's API.
31+
32+
```bash
33+
openssl rand -base64 32 | sudo tee /var/lib/faasd/secrets/payload-secret
34+
```
35+
36+
## Update your docker-compose.yaml
37+
38+
Add the following services to your `docker-compose.yaml` file:
39+
40+
```yaml
41+
pro-builder:
42+
depends_on: [buildkit]
43+
user: "app"
44+
group_add: ["1000"]
45+
restart: always
46+
image: ghcr.io/openfaasltd/pro-builder:0.5.3
47+
environment:
48+
buildkit-workspace: /tmp/
49+
enable_lchown: false
50+
insecure: true
51+
buildkit_url: unix:///home/app/.local/run/buildkit/buildkitd.sock
52+
disable_hmac: false
53+
# max_inflight: 10 # Set this line if you wish to limit the amount of concurrent builds
54+
command:
55+
- "./pro-builder"
56+
- "-license-file=/run/secrets/openfaas-license"
57+
volumes:
58+
- type: bind
59+
source: ./secrets/payload-secret
60+
target: /var/openfaas/secrets/payload-secret
61+
- type: bind
62+
source: ./secrets/openfaas_license
63+
target: /run/secrets/openfaas-license
64+
- type: bind
65+
source: ./secrets/docker-config
66+
target: /home/app/.docker/config.json
67+
- type: bind
68+
source: ./buildkit-rootless-run
69+
target: /home/app/.local/run
70+
- type: bind
71+
source: ./buildkit-sock
72+
target: /home/app/.local/run/buildkit
73+
deploy:
74+
replicas: 1
75+
ports:
76+
- "127.0.0.1:8088:8080"
77+
78+
buildkit:
79+
restart: always
80+
image: docker.io/moby/buildkit:v0.23.2-rootless
81+
group_add: ["2000"]
82+
user: "1000:1000"
83+
cap_add:
84+
- CAP_SETUID
85+
- CAP_SETGID
86+
command:
87+
- rootlesskit
88+
- buildkitd
89+
- "--addr"
90+
- unix:///home/user/.local/share/bksock/buildkitd.sock # <— outside XDG_RUNTIME_DIR
91+
- --oci-worker-no-process-sandbox
92+
security_opt:
93+
- no-new-privileges=false
94+
- seccomp=unconfined # allow mount(2)
95+
volumes:
96+
# runtime dir for rootlesskit/buildkit socket
97+
- ./buildkit-rootless-run:/home/user/.local/run
98+
- /sys/fs/cgroup:/sys/fs/cgroup
99+
# persistent state/cache
100+
- ./buildkit-rootless-state:/home/user/.local/share/buildkit
101+
- ./buildkit-sock:/home/user/.local/share/bksock
102+
environment:
103+
XDG_RUNTIME_DIR: /home/user/.local/run
104+
TZ: "UTC"
105+
BUILDKIT_DEBUG: "1" # Optional, useful during initial testing
106+
BUILDKIT_EXPERIMENTAL: "1" # if you want type=containerd exporter
107+
deploy:
108+
replicas: 1
109+
```
110+
111+
## Test the Function Builder API via faas-cli
112+
113+
Now use faas-cli to perform a test build on the faasd host directly.
114+
115+
```bash
116+
faas-cli new --lang python3-http \
117+
--prefix ttl.sh/openfaas-tests \
118+
pytest
119+
120+
sudo cp /var/lib/faasd/secrets/payload-secret ./payload-secret
121+
122+
faas-cli up \
123+
--remote-builder http://127.0.0.1:8088 \
124+
--payload-secret ./payload-secret
125+
```
126+
127+
## Turn off access to the Function Builder API via the host
128+
129+
Under the `pro-builder` service in your `docker-compose.yaml` file, comment out or remove the following lines:
130+
131+
You should be calling the function builder via its internal service name http://pro-builder:8080
132+
133+
```yaml
134+
ports:
135+
- "127.0.0.1:8088:8080"
136+
```
137+

‎mkdocs.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,7 @@ nav:
180180
- Custom DNS: ./edge/custom-dns.md
181181
- Scale to Zero: ./edge/scale-to-zero.md
182182
- Kafka connector: ./edge/kafka-deployment.md
183+
- Function Builder: ./edge/builder.md
183184
- GPU for services: ./edge/gpus.md
184185
- gVisor: ./edge/gvisor.md
185186
- OpenTelemetry: ./edge/open-telemetry.md

0 commit comments

Comments
 (0)