Running a containerized app in Yandex Serverless Containers

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

1. Create a service account named mongo-express:

   yc iam service-account create --name mongo-express
   

2. Assign the service account the container-registry.images.puller, lockbox.payloadViewer, and serverless-containers.containerInvoker roles for the folder that will host your container:

   yc resource-manager folder add-access-binding <folder_name_or_ID> \
     --role container-registry.images.puller, lockbox.payloadViewer, serverless-containers.containerInvoker \
     --subject serviceAccount:<service_account_ID>
   

   Where:

   • <folder_name_or_ID>: Name or ID of the folder to host the container.
   • --subject serviceAccount: mongo-express service account ID.

To create a service account, use the create REST API method for the ServiceAccount resource or the ServiceAccountService/Create gRPC API call.

To assign the service account a role for the folder, use the updateAccessBindings REST API method for the Folder resource or the FolderService/UpdateAccessBindings gRPC API call.

1. Create a cloud network:

   yc vpc network create \
     --name mongo-express-network
   

2. Get the name or ID of the group to edit:

   yc vpc security-groups list
   

   Result:

   +----------------------+---------------------------------+------------------------------------+----------------------+
   |          ID          |              NAME               |          DESCRIPTION               |      NETWORK-ID      |
   +----------------------+---------------------------------+------------------------------------+----------------------+
   | enp9bmjge93b******** | default-sg-enp509crtquf******** | Default security group for network | enp509crtquf******** |
   +----------------------+---------------------------------+------------------------------------+----------------------+
   

3. Add a rule using the update-rules command and the --add-rule parameter:

   yc vpc security-group update-rules <group_name_or_ID> \
     --add-rule "direction=ingress,port=27017,protocol=any,v4-cidrs=[0.0.0.0/0,0.0.0.0/0]"
   

   Where <group_name_or_ID> is the value obtained at the previous step.

1. To create a cloud network, use the create REST API method for the Network resource or the NetworkService/Create gRPC API call, and provide the following in the request:

   • ID of the folder to host the network.
   • Name of the new mongo-express-network network in the name parameter.

2. To add a rule to a security group, use the updateRules REST API method for the SecurityGroup resource or the SecurityGroupService/UpdateRules gRPC API call, and provide the following in your request:

   • ID of the security group you want to add rules to, in the securityGroupId parameter.

     To get the security group ID, use the list REST API method for the SecurityGroup resource or the SecurityGroup/List gRPC API call and provide the folder ID in the folderId request parameter.

   • New security group rules, in the additionRuleSpecs[] array.

     • Traffic direction: ingress.
     • Name of the traffic transmission protocol, in the additionRuleSpecs[].protocolName parameter: any.
     • List of CIDRs and subnet masks in the additionRuleSpecs[].cidrBlocks.v4CidrBlocks[] parameter: [0.0.0.0/0,0.0.0.0/0].
     • First port in the traffic port range, in the additionRuleSpecs[].ports.fromPort parameter: 0.
     • Last port in the traffic port range, in the additionRuleSpecs[].ports.fromPort parameter: 65535.

1. Prepare a key pair (public and private keys) for SSH access to the VM.

2. Create the docker-spec.yaml Docker container specification file:

   version: '3.1'
   
   services:
     mongo:
       image: mongo
       restart: always
       environment:
         MONGO_INITDB_ROOT_USERNAME: mongo_db_user
         MONGO_INITDB_ROOT_PASSWORD: <password>
       ports:
         - 27017:27017
   

   In the MONGO_INITDB_ROOT_PASSWORD parameter, specify the password to use for accessing the database. To create a password, you can use the password generator. Save the password as you will need it in the next steps.

3. Run this command:

   yc compute instance create-with-container \
     --coi-spec-file docker-spec.yaml \
     --name mongo-vm \
     --zone ru-central1-b \
     --ssh-key ssh-key.pub \
     --create-boot-disk size=30
   

   Where:

   • --coi-spec-file: Path to the Docker container specification file.
   • --name: VM name.
   • --zone: Availability zone.
   • --ssh-key: Contents of the public key file. You need to create a key pair for the SSH connection yourself.
   • --create-boot-disk size: Boot disk size. It must be at least 30 GB.

   Result:

   done (1m40s)
    id: epde18u4mahl********
    folder_id: b1g7gvsi89m3********
    created_at: "2023-02-08T10:34:06.601Z"
    name: mongo-vm
    ...
   

1. Create the mongodb-creds secret using this command:

   yc lockbox secret create \
     --name mongodb-creds \
     --payload "[{'key': 'login', 'text_value': 'mongo_db_user'},{'key': 'password', 'text_value': '<password>'}]"
   

   Where:

   • --name: Secret name
   • --payload: Contents of the secret as a YAML or JSON array
   • <password>: MONGO_INITDB_ROOT_PASSWORD value from the VM specification

   Result:

   id: e6q6nbjfu9m2********
   folder_id: b1qt6g8ht345********
   created_at: "2023-02-08T10:34:06.601Z"
   name: mongodb-creds
   status: ACTIVE
   current_version:
     id: e6q0s9airqca********
     secret_id: e6q6nbjfu9m2********
     created_at: "2023-02-08T10:34:06.601Z"
     status: ACTIVE
     payload_entry_keys:
       - login
       - password
   

To create a secret, use the create REST API method for the Secret resource or the SecretService/Create gRPC API call.

Create the app-registry registry:

yc container registry create --name app-registry

Result:

done
id: crpd50616s9a********
folder_id: b1g88tflru0e********
name: app-registry
status: ACTIVE
created_at: "2023-02-08T10:34:06.601Z"

To create a registry, use the create REST API method for the Registry resource or the RegistryService/CreateRegistryRequest gRPC API call.

1. Create a container:

   yc serverless container create --name mongo-express-container
   

   Result:

   id: bba3fva6ka5g********
   folder_id: b1gqvft7kjk3********
   created_at: "2023-02-08T10:34:06.601Z"
   name: mongo-express-container
   url: https://bba3fva6ka5g********.containers.yandexcloud.net/
   status: ACTIVE
   

2. Create a container revision:

   yc serverless container revision deploy \
     --container-name mongo-express-container \
     --image <Docker_image_URL> \
     --cores 1 \
     --memory 1GB \
     --concurrency 1 \
     --execution-timeout 15s \
     --service-account-id <mongo-express_service_account_ID> \
     --environment ME_CONFIG_BASICAUTH_USERNAME="", ME_CONFIG_BASICAUTH_PASSWORD="", VCAP_APP_PORT=8080, ME_CONFIG_MONGODB_SERVER=<VM_public_address> \
     --secret environment-variable=ME_CONFIG_MONGODB_AUTH_USERNAME,key=login \
     --secret environment-variable=ME_CONFIG_MONGODB_AUTH_PASSWORD,key=password
   

   Where:

   • --image: URL of the mongo-express Docker image pushed previously.

   • --service-account-id: ID of the mongo-express service account created previously.

   • --environment: Environment variables:

     • ME_CONFIG_BASICAUTH_USERNAME: Leave empty.
     • ME_CONFIG_BASICAUTH_PASSWORD: Leave empty.
     • VCAP_APP_PORT: Specify port 8080.
     • ME_CONFIG_MONGODB_SERVER: Specify the VM public IP address obtained previously.

   • --secret environment-variable: ME_CONFIG_MONGODB_AUTH_USERNAME and ME_CONFIG_MONGODB_AUTH_PASSWORD secrets created previously.

   Result:

   id: bbajn5q2d74c********
   container_id: bba3fva6ka5g********
   created_at: "2023-02-08T10:34:06.601Z"
   image:
     image_url: cr.yandex/crpd3cicopk7********/mongo-express-container:latest
     image_digest: sha256:de8e1dce7ceceeafaae122f7670084a1119c961cd9ea1795eae92bd********
   resources:
     memory: "1073741824"
     cores: "1"
   execution_timeout: 15s
   service_account_id: ajeqnasj95o7********
   status: ACTIVE
   

To create a container, use the create REST API method for the Container resource or the ContainerService/Create gRPC API call.

To create a container revision, use the deployRevision REST API method for the Container resource or the ContainerService/DeployRevision gRPC API call.

1. Prepare an OpenAPI 3.0 API specification file.

   Specification

   openapi: 3.0.0
   info:
     title: Sample API
     version: 1.0.0
   servers:
     - url: https://mongo-express-container.apigw.yandexcloud.net
   paths:
     /{proxy+}:
       x-yc-apigateway-any-method:
         x-yc-apigateway-integration:
           type: serverless_containers
           container_id: <container_ID>
           service_account_id: <service_account_ID>
         parameters:
         - explode: false
           in: path
           name: proxy
           required: false
           schema:
             default: '-'
             type: string
           style: simple
   

   Where:

   • container_id: mongo-express-container ID
   • service_account_id: mongo-express service account ID

2. Specify the parameters and create an API gateway using this command:

   yc serverless api-gateway create \
       --name mongo-express-gw \
       --spec=<path_to_specification_file>
   

To create an API gateway, use the create REST API method for the ApiGateway resource or the ApiGatewayService/Create gRPC API call.