使用Container Canary在多个平台上测试容器图像

既然有了清单，我就可以对容器进行测试了。首先，我选择了一个我知道不会通过要求的公共形象，比如 流行的 web 服务器 NGINX 。

$ canary validate --file https://github.com/NVIDIA/container-canary/raw/main/examples/kubeflow.yaml nginx:latest Cannot find nginx:latest, pulling…
Validating nginx:latest against kubeflow Home directory is /home/jovyan [failed]  User is jovyan [failed] User ID is 1000 [failed]  Exposes an HTTP interface on port 8888 [failed]  Sets 'Access-Control-Allow-Origin: *' header [failed]  Correctly routes the NB_PREFIX [failed]
validation failed

毫不奇怪，这张图片没有通过验证。

接下来，我尝试了一款设计用于 Kubeflow 笔记本电脑的 官方 Kubeflow 图片 。

$ canary validate --file https://github.com/NVIDIA/container-canary/raw/main/examples/kubeflow.yaml public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-pytorch-cuda:v1.5.0 Cannot find public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-pytorch-cuda:v1.5.0, pulling…
Validating public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-pytorch-cuda:v1.5.0 against kubeflow Home directory is /home/jovyan [passed]  User is jovyan [passed]  User ID is 1000 [passed]  Sets 'Access-Control-Allow-Origin: *' header [passed]  Correctly routes the NB_PREFIX [passed]  Exposes an HTTP interface on port 8888 [passed]
validation passed

　　成功这张图片通过了验证。

　　如果要在 Kubeflow 上创建图像，可以用同样的方法验证它们，并确信当其他用户来运行它们时，所做的更改不会导致问题。

　　编写自己的验证清单

　　您还可以编写自己的清单来验证容器。 Container Canary 可以帮助您确保您的容器清单将在您自己的部署和第三方平台中运行。它还帮助您在容器构建上运行单元测试。

　　每个清单都是一个以一些元数据开头的 YAML 文件。

# Manifest versioning
apiVersion: container-canary.nvidia.com/v1
kind: Validator # Metadata
name: foo # The name of the platform that this manifest validates for
description: Foo runs containers for you # Optional, A description of that platform
documentation: https://example.com # Optional, A link to the documentation that defines the container requirements in prose

接下来，您可以为容器配置一些运行时选项。当 Container Canary 启动图像进行验证时，将使用这些选项，并应模仿在目标平台上设置的选项。其中包括环境变量、要公开的端口和要连接的卷。

env: - name: NB_PREFIX value: /hub/jovyan/
ports: - port: 8888 protocol: TCP
volumes: - mountPath: /home/jovyan

然后，指定支票。检查是针对容器运行的测试，以确保其符合要求。每个检查都包含一个与容器交互的探针。这些交互包括运行命令、发出 HTTP 请求和 ping TCP 套接字。

Container Canary 中的探针是 库伯内特斯的那些 的超集，因此如果您以前使用过这些探针，应该对它们很熟悉。

checks: - name: mycheck # Name of the check description: Ensuring a thing # Description of what is being checked (will be used in output) probe: ... # A probe to run

exec检查会在正在运行的容器中运行命令。如果命令以 0 退出，则检查通过。

checks: - name: uid description: User ID is 1234 probe: exec: command: - /bin/sh - -c - "id | grep uid=1234"

HTTP Get检查对您的容器执行HTTP GET请求。如果响应代码< 300 且可选响应标题匹配，则检查通过。

checks: - name: http description: Exposes an HTTP interface on port 80 probe: httpGet: path: / port: 80 httpHeaders: # Optional, headers to set in the request - name: Foo-Header value: "myheader" responseHttpHeaders: # Optional, headers that you expect to see in the response - name: Access-Control-Allow-Origin value: "*"

有关更多信息，请参阅 验证程序 API 参考 。

编写清单后，可以使用canary来测试带有清单的容器。

$ canary validate --file examples/awesome.yaml your/container:latest
Validating your/container:latest against awesome Required packages are installed [passed]  Expected services are running [passed]  Your container is awesome [passed]
validation passed

from fastapi import FastAPI
import uvicorn app = FastAPI() @app.get("/")
def read_root(): return {"Hello": "World"} @app.get("/foo")
def foo(): return {"foo": "bar"} if __name__ == "__main__": uvicorn.run(app, host="0.0.0.0", port=5000, log_level="info")

FROM python COPY app.py /app.py RUN pip install fastapi uvicorn[standard] EXPOSE 5000 CMD python /app.py

apiVersion: container-canary.nvidia.com/v1
kind: Validator
name: example
description: Container Canary CI Example
env: []
ports: - port: 5000 protocol: TCP
volumes: []
checks: - name: http description: Exposes an HTTP interface on port 5000 probe: httpGet: path: /foo port: 5000 failureThreshold: 30 - name: python description: Has Python installed probe: exec: command: - /bin/sh - -c - "which python"

name: ci on: push: pull_request: jobs: canary: runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v2 - name: Install Container Canary run: | curl -L https://github.com/NVIDIA/container-canary/releases/download/v0.2.0/canary_linux_amd64 > /usr/local/bin/canary chmod +x /usr/local/bin/canary - name: Build Container run: docker build -t foo/canary-ci-example:latest . - name: Validate container run: canary validate --file canary-validator.yaml foo/canary-ci-example:latest