ansible: update nodejs to 20 in Dockerfile

[trivikr]

Refs: #3697 (comment)

I went through the JavaScript source code run in these Dockerfiles, and verified that there are no Node.js APIs being used which were deprecated between Node.js 14.x and 20.x

cc @richardlau

[trivikr]

As per the documentation, the user with write access on container registry need to run the following steps:

• gcloud auth configure-docker
• docker build -t gcr.io/nodejs-org/processcloudflare:latest .
• docker push gcr.io/nodejs-org/processcloudflare:latest
• gcloud run deploy processcloudflare --image gcr.io/nodejs-org/processcloudflare:latest

Repeat the steps for other container registries

• gcr.io/nodejs-org/index-generator
• gcr.io/nodejs-org/producesummaries

[mhdawson]

LGTM

[trivikr]

Is this PR good to merge and deploy?

It has been open for 48 hours during the week as required by governance, and received 5 approvals.

[trivikr]

The deploy instructions are in comment #3767 (comment), which a person with write permissions need to run.

Once they succeed, I'll add them them in the metrics README https://github.com/nodejs/build/tree/main/ansible/roles/metrics

[targos]

@trivikr I'm getting some prompts at the last step:

$ gcloud run deploy processcloudflare --image gcr.io/nodejs-org/processcloudflare:latest
Please specify a region:
 [1] africa-south1
 ...
 [32] us-central1
 ...
 [41] cancel
Please enter numeric choice or text value (must exactly match list item):  32

Allow unauthenticated invocations to [processcloudflare] (y/N)?

I selected us-central1 based on the current deployment but I don't know what to answer to the next question.

[targos]

According to the help, the region can be passed with --region=REGION.

For the unauthenticated question, the docs say:

     --ingress=INGRESS; default="all"
        Set the ingress traffic sources allowed to call the service. For Cloud
        Run (fully managed) the --[no-]allow-unauthenticated flag separately
        controls the identities allowed to call the service. INGRESS must be
        one of:

         all
            Inbound requests from all sources are allowed.
         internal
            For Cloud Run (fully managed), only inbound requests from VPC
            networks in the same project or VPC Service Controls perimeter, as
            well as Pub/Sub subscriptions and Eventarc events in the same
            project or VPC Service Controls perimeter are allowed. All other
            requests are rejected. See
            https://cloud.google.com/run/docs/securing/ingress for full details
            on the definition of internal traffic for Cloud Run (fully
            managed). For Cloud Run for Anthos, only inbound requests from the
            same cluster are allowed.

         internal-and-cloud-load-balancing
            Only supported for Cloud Run (fully managed). Only inbound requests
            from Google Cloud Load Balancing or a traffic source allowed by the
            internal option are allowed.

[trivikr]

I confirmed from existing YAML files that all Google Cloud Run instances have ingress all.

  labels:
    cloud.googleapis.com/location: us-central1
  annotations:
    run.googleapis.com/ingress: all
    run.googleapis.com/ingress-status: all

I also verified from Console Networking tab that Ingress is "All".

However, under Security Tab Authentication section, the "Require authentication: Manage authorized users with Cloud IAM." is checked, and "Allow unauthenticated invocations" is not.

Based on this observation, I think the command should be:

gcloud run deploy processcloudflare --image gcr.io/nodejs-org/processcloudflare:latest --region us-central1 --no-allow-unauthenticated

[targos]

$ gcloud run deploy processcloudflare --image gcr.io/nodejs-org/processcloudflare:latest --region us-central1 --no-allow-unauthenticated
Deploying container to Cloud Run service [processcloudflare] in project [nodejs-org] region [us-central1]
X Deploying...
  - Creating Revision...
  . Routing traffic...
  ✓ Setting IAM Policy...
Deployment failed
ERROR: (gcloud.run.deploy) Revision 'processcloudflare-00002-vmp' is not ready and cannot serve traffic. The user-provided container failed to start and listen on the port defined provided by the PORT=8080 environment variable. Logs for this revision might contain more information.

Logs URL: https://console.cloud.google.com/logs/viewer?project=nodejs-org&resource=cloud_run_revision/service_name/processcloudflare/revision_name/processcloudflare-00002-vmp&advancedFilter=resource.type%3D%22cloud_run_revision%22%0Aresource.labels.service_name%3D%22processcloudflare%22%0Aresource.labels.revision_name%3D%22processcloudflare-00002-vmp%22
For more troubleshooting guidance, see https://cloud.google.com/run/docs/troubleshooting#container-failed-to-start

[targos]

The logs say: terminated: Application failed to start: failed to load /usr/local/bin/docker-entrypoint.sh: exec format error

[trivikr]

The logs say: terminated: Application failed to start: failed to load /usr/local/bin/docker-entrypoint.sh: exec format error

As per Reddit, this might be happening if docker build is run on different architecture
https://www.reddit.com/r/webdev/comments/17hc1rz/comment/k6mjobq/

The solution was to use https://github.com/docker/buildx, which is included with Docker Desktop.

• docker buildx build --platform linux/amd64 -t gcr.io/nodejs-org/processcloudflare:latest .
• docker push gcr.io/nodejs-org/processcloudflare:latest
• gcloud run deploy processlogs --image gcr.io/nodejs-org/processcloudflare:latest --region us-central1 --no-allow-unauthenticated

I also noticed the service name is processlogs while the Container Registry name is processcloudflare.
The names is same for other folders in Container Registry and Cloud Run.

[targos]

Thanks, it worked this time.

There's something missing though (service crashes continuously):

I reverted the service to the previous revision.
Note that I won't have more time to spend on it today.

I also deleted the processcloudflare service that was created by my previous command.

[trivikr]

I requested an Editor role at #3774

[trivikr]

I'd to run one more command to serve traffic to latest revision:

$ gcloud run services update-traffic processlogs --to-latest --region us-central1

[trivikr]

The deployment is successful:

EVENT TYPE:  OBJECT_FINALIZE
Node version is: v20.14.0
BUCKET cloudflare-logs-nodejs
FILENAME 20240625/20240625T143942Z_20240625T144053Z_f733a7db.log.gz
PROCESSEDFILENAME 20240625/20240625T143942Z_20240625T144053Z
INSIDE CREATE PIPELINE
String length:  31023581
Array Length:  61791
SyntaxError: Unexpected end of JSON input     at JSON.parse (<anonymous>)     at /usr/src/app/process-cloudflare.js:164:34     at callback (/usr/src/app/node_modules/@google-cloud/storage/build/src/file.js:1624:17)     at /usr/src/app/node_modules/@google-cloud/storage/build/src/file.js:1640:87     at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
Upload complete
rss 195.75 MB
heapTotal 62.63 MB
heapUsed 47.92 MB
external 34.1 MB
arrayBuffers 30.99 MB

I'll deploy other folders, and post a PR with update instructions in README for each of the Cloud Run source code folder.

[trivikr]

Commands run for summaries folder:

• Copy metrics-processor-service-key.json
• docker buildx build --platform linux/amd64 -t gcr.io/nodejs-org/producesummaries:latest .
• docker push gcr.io/nodejs-org/producesummaries:latest
• gcloud run deploy produce-summaries --image gcr.io/nodejs-org/producesummaries:latest --region us-central1 --no-allow-unauthenticated

The update-traffic was not required to run, since it was automatically updated.
The logs can be verified around 2024-06-26 04:00:04.175 PDT

[trivikr]

Commands run for index-generator folder:

• Copy metrics-processor-service-key.json
• docker buildx build --platform linux/amd64 -t gcr.io/nodejs-org/index-generator:latest .
• docker push gcr.io/nodejs-org/index-generator:latest
• gcloud run deploy index-generator --image gcr.io/nodejs-org/index-generator:latest --region us-central1 --no-allow-unauthenticated

The update-traffic was not required to run, since it was automatically updated.
The logs can be verified once produce summaries is fixed in #3697

[targos]

Copy metrics-processor-service-key.json

Copy from where?

[trivikr]

Copy metrics-processor-service-key.json

Copy from where?

I copied them from earlier version of Dockerfile.

They maybe available in secrets/build/infra too, if the existing README is correct https://github.com/nodejs/build/tree/main/ansible/roles/metrics#accesing-the-gcp-from-command-line

Btw, I added update instructions in #3779

[trivikr]

I came across attaching a service account with Cloud Run so that copying of credentials in local file is not needed.

I created a feature request at #3789
And updated the existing documentation PR to use ADC through service account #3779