feat: Add debugging container target to Helm (#960)

Co-authored-by: Ware, Joseph (DLSLtd,RAL,LSCI) <[email protected]>

Author: keithralphs

.github/workflows/_container.yml

@@ -59,7 +59,27 @@ jobs:
           tags: |
             type=ref,event=tag
             type=raw,value=latest
-
+      
+      - name: Create tags for publishing debug image
+        id: debug-meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=ref,event=tag,suffix=-debug
+            type=raw,value=latest-debug
+      
+      - name: Build and publish debug image to container registry
+        if: github.ref_type == 'tag'
+        uses: docker/build-push-action@v6
+        env:
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        with:
+          context: .
+          push: true
+          target: debug
+          tags: ${{ steps.debug-meta.outputs.tags }}
+            
       - name: Push cached image to container registry
         if: github.ref_type == 'tag'
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6

Dockerfile

@@ -21,18 +21,38 @@ ENV PATH=/venv/bin:$PATH
 
 # The build stage installs the context into the venv
 FROM developer AS build
-COPY . /context
-WORKDIR /context
+RUN mkdir -p /.cache/pip; chmod o+wrX /.cache/pip
+COPY --chmod=o+wrX . /workspaces/blueapi
+WORKDIR /workspaces/blueapi
 RUN touch dev-requirements.txt && pip install --upgrade pip && pip install -c dev-requirements.txt .
 
+FROM build AS debug
+
+# Set origin to use ssh
+RUN git remote set-url origin [email protected]:diamondlightsource/DiamondLightSource/blueapi.git
+
+# For this pod to understand finding user information from LDAP
+RUN apt update
+RUN DEBIAN_FRONTEND=noninteractive apt install libnss-ldapd -y
+RUN sed -i 's/files/ldap files/g' /etc/nsswitch.conf
+
+# Make editable and debuggable
+RUN pip install debugpy
+RUN pip install -e .
+
+# Alternate entrypoint to allow devcontainer to attach
+ENTRYPOINT [ "/bin/bash", "-c", "--" ]
+CMD [ "while true; do sleep 30; done;" ]
+
 # The runtime stage copies the built venv into a slim runtime container
 FROM python:${PYTHON_VERSION%@*}-slim AS runtime
 # Add apt-get system dependecies for runtime here if needed
 RUN apt-get update && apt-get install -y --no-install-recommends \
     # Git required for installing packages at runtime
     git \
     && rm -rf /var/lib/apt/lists/*
-COPY --from=build /venv/ /venv/
+COPY --from=build --chmod=o+wrX /venv/ /venv/
+COPY --from=build --chmod=o+wrX /.cache/pip /.cache/pip
 ENV PATH=/venv/bin:$PATH
 ENV PYTHONPYCACHEPREFIX=/tmp/blueapi_pycache
 
@@ -43,7 +63,5 @@ ENV PYTHONPYCACHEPREFIX=/tmp/blueapi_pycache
 
 ENV MPLCONFIGDIR=/tmp/matplotlib
 
-RUN mkdir -p /.cache/pip; chmod -R 777 /venv /.cache/pip
-
 ENTRYPOINT ["blueapi"]
 CMD ["serve"]

helm/blueapi/templates/statefulset.yaml

@@ -52,6 +52,14 @@ spec:
         emptyDir:
           sizeLimit: 5Gi
       {{- end }}
+      {{- if .Values.debug.enabled }}
+      - name: home  # Required for vscode to install plugins
+        emptyDir:
+          sizeLimit: 500Mi
+      - name: nslcd  # Shared volume between main and sidecar container
+        emptyDir:
+          sizeLimit: 5Mi
+      {{- end }}      
       {{- if .Values.initContainer.enabled }}
       initContainers:
       - name: setup-scratch
@@ -81,7 +89,7 @@ spec:
         - name: {{ .Chart.Name }}
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}{{ ternary "-debug" "" .Values.debug.enabled }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
@@ -96,15 +104,31 @@ spec:
             - name: venv
               mountPath: /venv
             {{- end }}
+            {{- if .Values.debug.enabled }}
+            - mountPath: /home
+              name: home
+            - mountPath: /var/run/nslcd
+              name: nslcd
+            {{- end }}
+          {{- if not .Values.debug.enabled }}
           args:
             - "-c"
             - "/config/config.yaml"
             - "serve"
+          {{ end }}
           envFrom:
             - configMapRef:
                 name: {{ include "blueapi.fullname" . }}-otel-config
           env:
             {{- toYaml .Values.extraEnvVars | nindent 12 }}
+        {{- if .Values.debug.enabled }}
+        - name: debug-account-sync
+          image: ghcr.io/diamondlightsource/account-sync-sidecar:3.0.0
+          volumeMounts:
+          # This allows the nslcd socket to be shared between the main container and the sidecar
+          - mountPath: /var/run/nslcd
+            name: nslcd
+        {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

helm/blueapi/values.yaml

@@ -126,3 +126,6 @@ worker:
       port: 12232
 initContainer:
   enabled: false
+
+debug:
+  enabled: false