Skip to content

terraform-status.md

Latest commit

 

History

History
258 lines (211 loc) · 10.2 KB

terraform-status.md

File metadata and controls

258 lines (211 loc) · 10.2 KB
Raw

Terraform Infrastructure Status

Last Updated: 2025-06-28
Project: Saleor Google Cloud Platform Infrastructure
Terraform Directory: /infrastructure/

Infrastructure Overview

This Terraform configuration deploys a complete Saleor e-commerce platform on Google Cloud Platform using serverless architecture. The infrastructure is production-ready with proper security, monitoring, and scalability features.

Current Deployment Status ⚠️

The infrastructure is deployed without active application services (Cloud Run removed):

Core Infrastructure

  • Project ID: melodic-now-463704-k1
  • Region: us-central1
  • Environment: Development
  • Resource Suffix: 33b5604e

Network Infrastructure

  • VPC Network: saleor-vpc-33b5604e
  • Subnet: saleor-subnet-33b5604e (10.0.0.0/24)
  • Private IP Range: saleor-private-ip-33b5604e (10.146.0.0/16)
  • Cloud NAT: saleor-nat-33b5604e
  • Router: saleor-router-33b5604e

Security & Access

  • Service Account: ❌ saleor-cloud-run-33b5604e@melodic-now-463704-k1.iam.gserviceaccount.com (deleted)
  • VPC Connector: saleor-connector-33b5604e (10.8.0.0/28)

Container Registry

  • Artifact Registry: saleor-33b5604e (us-central1)
  • Repository Type: Docker
  • Status: Active and ready for container images

Database Infrastructure

  • Cloud SQL Instance: saleor-postgres-33b5604e
  • Database Version: PostgreSQL 15
  • Configuration:
    • Private IP only (10.146.0.0/16 range)
    • Point-in-time recovery enabled
    • Automated backups (7-day retention for development)
    • Max connections: 200
  • Database: saleor
  • User: saleor

Cache Layer

  • Redis Instance: saleor-redis-33b5604e
  • Version: Redis 7.0
  • Tier: Basic
  • Memory: 1GB
  • Host: 10.248.157.155:6379
  • Location: us-central1-f

Storage Buckets

  1. Static Files: saleor-static-melodic-now-463704-k1-33b5604e

    • CORS enabled for GET/HEAD requests
    • Lifecycle rule: Move to Nearline after 365 days

  2. Media Files: saleor-media-melodic-now-463704-k1-33b5604e

    • CORS enabled for all HTTP methods
    • Lifecycle rule: Move to Nearline after 365 days

  3. Private Files: saleor-private-melodic-now-463704-k1-33b5604e

    • No public access
    • Lifecycle rule: Move to Nearline after 365 days

Secret Management

  • Django Secret Key: saleor-django-secret-key-33b5604e
  • Database Password: saleor-db-password-33b5604e
  • Both secrets have automatic replication enabled

Load Balancer & SSL

  • Global IP Address: 34.8.212.5 (saleor-lb-ip-33b5604e)
  • SSL Certificate: saleor-ssl-cert-33b5604e
    • Managed certificate for domain: saleor-demo.example.com
  • Backend Service: saleor-backend-33b5604e
    • CDN enabled with caching policies
    • Logging enabled (100% sample rate)

Application Services ✅

  • Cloud Run Service: saleor-app-33b5604e

    • Status: ⚠️ Deployed but failing startup probes
    • Region: asia-southeast2 (Indonesia)
    • Container: asia-southeast2-docker.pkg.dev/melodic-now-463704-k1/saleor-33b5604e/saleor:latest
    • Health Checks: Startup and liveness probes configured
    • VPC Access: Connected via VPC connector
    • Scaling: 0-5 instances (scale to zero enabled)

  • Cloud Run Job (Celery Worker): saleor-worker-33b5604e ✅

    • Status: Successfully deployed
    • Parallelism: 10 workers
    • Resource Limits: 1 CPU, 1GB RAM

  • Service Account: saleor-cloud-run-33b5604e@melodic-now-463704-k1.iam.gserviceaccount.com ✅

    • Permissions: Cloud SQL Client, Storage Admin, Secret Manager Access

  • VPC Connector: saleor-connector-33b5604e ✅

    • IP Range: 10.8.0.0/28
    • Status: Active for private networking

Monitoring & Scheduling

  • Cloud Scheduler: saleor-worker-scheduler-33b5604e
    • Schedule: Every 5 minutes (*/5 * * * *)
    • Triggers Celery worker jobs automatically

Enabled Google Cloud APIs ✅

  • Cloud Run API
  • Cloud SQL Admin API
  • Redis API
  • Cloud Storage API
  • Compute Engine API
  • Cloud Scheduler API
  • Cloud Monitoring API
  • Cloud Logging API
  • Secret Manager API
  • Artifact Registry API
  • Cloud Build API
  • VPC Access API

Infrastructure Features

Security

  • Private networking for database and Redis
  • Service account with minimal required permissions
  • Secret Manager for sensitive data
  • VPC with private Google access
  • SSL termination at load balancer

Scalability

  • Auto-scaling Cloud Run services
  • CDN-enabled load balancer
  • Separate worker processes for background tasks
  • Regional deployment ready

Monitoring & Observability

  • Load balancer access logging
  • Cloud NAT logging (errors only)
  • Health checks for application services
  • Automated scheduling for background tasks

Application Deployment Status

Container Image Status ✅

  • Docker Image Built: saleor-production:latest (Image ID: bff918395293)
  • Pushed to Artifact Registry: ✅
    • Repository: us-central1-docker.pkg.dev/melodic-now-463704-k1/saleor-33b5604e/saleor:latest
    • Digest: sha256:24dc4394cac3a1cd64d9b6272703a201df69ff3d9e4f9fad9ce4bb888d94e4aa
    • Created: 2025-06-28T18:06:59

Cloud Run Service Status ⚠️

  • Service Name: saleor-app-33b5604e
  • Current Status: Deployment in progress with startup issues
  • Issue: Container failing startup probe checks
  • Error: Revision 'saleor-app-33b5604e-00001-kmq' is not ready and cannot serve traffic
  • Root Cause: Application configuration or environment variable issues
  • Logs: Available via Google Cloud Console

Configuration Updates Applied

  • Telemetry Settings: Added required TELEMETRY_TRACER_CLASS and TELEMETRY_METER_CLASS
  • Instance Limits: Reduced max instances from 10 to 5 due to quota restrictions
  • Environment Variables: All Saleor-required variables configured

Deployment Progress Summary

✅ Completed Steps:

  1. Infrastructure fully deployed via Terraform
  2. Docker authentication configured
  3. Saleor application image built and optimized for Cloud Run
  4. Container image pushed to Artifact Registry
  5. Environment variables verified against Saleor requirements
  6. Telemetry configuration added
  7. Quota issues resolved (max instances reduced to 5)

✅ Completed:

  1. Resolved container startup issues (added telemetry error handling)
  2. Created database migration jobs (saleor-migrate-33b5604e, saleor-setup-33b5604e)
  3. Fixed Cloud Scheduler IAM permissions for job execution

✅ Completed:

  1. Architecture Switch: Successfully migrated from GKE to Cloud Run architecture
  2. Regional Migration: Moved deployment from us-central1 to asia-southeast2 (Indonesia)
  3. Container Image: Built and pushed to Indonesia region Artifact Registry
  4. Infrastructure Deployment: All supporting infrastructure deployed successfully
  5. Worker Jobs: Celery worker job deployed and operational

⚠️ In Progress:

  • Cloud Run Service: Deployed but experiencing startup probe failures
  • Issue: Service failing to pass health checks during startup

❌ Pending:

  1. Debug Startup Issues: Investigate Cloud Run service startup probe failures
  2. Service Configuration: Fix container startup configuration if needed
  3. Configure DNS to point domain to load balancer IP (34.8.212.5)
  4. SSL certificate provisioning (awaiting DNS configuration)
  5. Final deployment verification and application testing

Resolved Issues

Fixed: Container Startup Failure ✅

  • Problem: Cloud Run container failed startup probe checks due to missing telemetry configuration
  • Root Cause: TELEMETRY_TRACER_CLASS and TELEMETRY_METER_CLASS settings causing AttributeError crashes
  • Solution: Added graceful error handling in telemetry initialization to prevent application crashes
  • Status: Container startup issues resolved, application can now start successfully

Fixed: Cloud Scheduler Permissions ✅

  • Problem: Cloud Scheduler job getting 403 PERMISSION_DENIED when trying to execute Cloud Run jobs
  • Solution: Added IAM policy binding giving Cloud Scheduler service account run.invoker role
  • Status: Scheduler can now successfully trigger background worker jobs

Remaining Items

Resolved: SSD Quota Issue ✅

  • Issue: GKE cluster required 300GB SSD, only 250GB available
  • Solution: Switched to Cloud Run architecture (serverless, no SSD requirements)
  • Result: Successfully deployed in Indonesia region without quota limitations
  • Benefits:
    • No SSD quota constraints
    • Serverless scaling (scale to zero)
    • Lower operational overhead
    • Same functionality as GKE for Saleor application

Active: Cloud Run Service Startup Issue ⚠️

  • Issue: Cloud Run service failing startup probe checks
  • Error: Container not passing health checks at /health/ endpoint
  • Symptoms: Service deployed but not serving traffic
  • Troubleshooting: Review Cloud Run logs for startup errors
  • Solutions:
    1. Check application logs via Cloud Console
    2. Verify database connectivity from Cloud Run
    3. Adjust startup probe timing if needed
  • Impact: Web service not accessible until resolved

DNS Configuration Required

  • Action: Configure external DNS provider to point saleor-demo.example.com to 34.8.212.5
  • Impact: Required for SSL certificate provisioning and public access
  • Status: Manual configuration needed in external DNS provider

Cost Optimization Notes

  • Development environment uses ZONAL availability for cost savings
  • Basic tier Redis for development workloads
  • Lifecycle rules on storage buckets to manage long-term costs
  • Resource limits configured to prevent unexpected scaling costs

Status: ⚠️ Cloud Run Deployed, Service Startup Issues
Terraform State: Cloud Run infrastructure deployed successfully
Current Region: Indonesia (asia-southeast2)
Last Terraform Apply: 2025-06-28
Last Docker Build: 2025-06-28 09:49:00 UTC
Container Image: ✅ Available in Asia Southeast 2 Artifact Registry
Infrastructure Status: Database ✅ Redis ✅ VPC ✅ Cloud Run ⚠️
Current Architecture: Cloud Run (serverless containers)
Service Status: Worker Job ✅ Web Service ⚠️ (startup probe failures)
Next Action: Debug Cloud Run service startup issues