slawek/gcp-wif-test
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Moved IMDS emulator to a separate repository.

Browse Source
This commit is contained in:
slawek committed 2026-10-20 11:11:52 +02:00
1 parent 89c41a200d
commit 6d8cc12eda
9 files changed
+16 -1343
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/storage-transfer.md
+15 -14
View File
@@ -101,7 +101,7 @@ The containers run with the following settings:
| Container | Setting | Value |
|---|---|---|
| `imds-emulator` | Image | built from `sts-agent/Dockerfile`: a static Go binary on `gcr.io/distroless/static-debian13` |
| `imds-emulator` | Image | `gce-imds-emulator:latest`, built from the repository `skoszewski/gce-imds-emulator`, set by `IMDS_EMULATOR_IMAGE` |
| | Port | `8080`, set by `IMDS_PORT` |
| | Bind address | all interfaces, set by `IMDS_HOST` |
| | Mount | `/etc/sts-agent`, read only |
@@ -132,21 +132,31 @@ STS_AGENT_POOL=my-agents
HOSTNAME=agent-host
```
The following optional variables of `sts-agent/.env` set the health check of the emulator:
The following optional variables of `sts-agent/.env` set the image and the health check of the emulator:
| Variable | Default | Meaning |
|---|---|---|
| `IMDS_EMULATOR_IMAGE` | `gce-imds-emulator:latest` | Image of the emulator |
| `HEALTHCHECK_INTERVAL` | `10s` | Time between checks |
| `HEALTHCHECK_TIMEOUT` | `3s` | Time after which a check fails |
| `HEALTHCHECK_START_PERIOD` | `10s` | Time after the start in which failed checks do not count |
| `HEALTHCHECK_START_INTERVAL` | `1s` | Time between checks during the start period |
| `HEALTHCHECK_RETRIES` | `3` | Consecutive failed checks that make the container unhealthy |
Build the emulator and start both containers:
Build the emulator image on the agent host:
```bash
git clone https://github.com/skoszewski/gce-imds-emulator.git
cd gce-imds-emulator
docker build --pull -t gce-imds-emulator:latest .
```
The `README.md` of the emulator repository describes other ways to provide the image, through an archive or a registry. With a registry, set `IMDS_EMULATOR_IMAGE` in `sts-agent/.env` to the registry path of the image.
Start both containers from the directory of this repository:
```bash
cd sts-agent
docker compose build
docker compose up -d
```
@@ -164,16 +174,7 @@ docker compose logs imds-emulator
Requests for paths that the emulator does not serve are logged with the status 404.
The emulator is a static binary without dependencies on files of the system: it embeds the root certificates and the time zone data, and it is the first process (PID 1) of its container. On `SIGTERM` or `SIGINT`, which `docker compose stop` sends, it stops accepting connections, lets the requests in progress finish for up to 20 seconds, and exits with status 0. A second signal makes it exit with status 1 at once. The stop grace period of the container is 30 seconds, longer than the shutdown of the emulator.
The emulator keeps at most 16 token providers, one per set of scopes requested, and drops them all when the limit is reached.
The unit tests of the emulator, `sts-agent/main_test.go`, cover the request checks, the metadata endpoints, the scope parsing, the token response, the request log, the extraction of the service account email from the credentials file, the shutdown, the check mode, and runs of the emulator as a process stopped with real signals. They run during the build of the image, so a failing test stops it. To run them on a workstation with Go:
```bash
cd sts-agent
go test -race ./...
```
On `SIGTERM` or `SIGINT`, which `docker compose stop` sends, the emulator lets the requests in progress finish for up to 20 seconds. The stop grace period of the container is 30 seconds, longer than the shutdown of the emulator. The `README.md` of the emulator repository describes its endpoints, its implementation and its tests.
The source directory is mounted at the same path as on the host, because the transfer job refers to it by that path.