Configure Kokoro build with RBE.

PiperOrigin-RevId: 226552586
Change-Id: I078502d46e2e4a8252ef0477309af8d3ffbbf88d

4 files changed, 216 insertions, 20 deletions

diff --git a/.bazelrc_rbe b/.bazelrc_rbe
new file mode 100644
index 000000000..126f91dfe
--- /dev/null
+++ b/.bazelrc_rbe
@@ -0,0 +1,121 @@
+# Copyright 2016 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Note for gVisor authors:
+#   This version is a derivative of: bazel-0.20.0.bazelrc
+#   From: https://github.com/bazelbuild/bazel-toolchains/blob/master/bazelrc/bazel-0.20.0.bazelrc
+
+# This .bazelrc file contains all of the flags required for the toolchain,
+# Remote Build Execution, and the Bazel Build Results UI. Specific flags in
+# your Bazel command allow you to use only the remote build, to use only the
+# results UI, or to use them both together.
+
+# Remote Build Execution requires a strong hash function, such as SHA256.
+startup --host_jvm_args=-Dbazel.DigestFunction=SHA256
+
+# Depending on how many machines are in the remote execution instance, setting
+# this higher can make builds faster by allowing more jobs to run in parallel.
+# Setting it too high can result in jobs that timeout, however, while waiting
+# for a remote machine to execute them.
+build:remote --jobs=50
+
+# Set several flags related to specifying the platform, toolchain and java
+# properties.
+# These flags are duplicated rather than imported from (for example)
+# %workspace%/configs/ubuntu16_04_clang/1.1/toolchain.bazelrc to make this
+# bazelrc a standalone file that can be copied more easily.
+# These flags should only be used as is for the rbe-ubuntu16-04 container
+# and need to be adapted to work with other toolchain containers.
+build:remote --host_javabase=@bazel_toolchains//configs/ubuntu16_04_clang/1.1:jdk8
+build:remote --javabase=@bazel_toolchains//configs/ubuntu16_04_clang/1.1:jdk8
+build:remote --host_java_toolchain=@bazel_tools//tools/jdk:toolchain_hostjdk8
+build:remote --java_toolchain=@bazel_tools//tools/jdk:toolchain_hostjdk8
+build:remote --crosstool_top=@bazel_toolchains//configs/ubuntu16_04_clang/1.1/bazel_0.20.0/default:toolchain
+build:remote --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
+# Platform flags:
+# The toolchain container used for execution is defined in the target indicated
+# by "extra_execution_platforms", "host_platform" and "platforms".
+# If you are using your own toolchain container, you need to create a platform
+# target with "constraint_values" that allow for the toolchain specified with
+# "extra_toolchains" to be selected (given constraints defined in
+# "exec_compatible_with").
+# More about platforms: https://docs.bazel.build/versions/master/platforms.html
+build:remote --extra_toolchains=@bazel_toolchains//configs/ubuntu16_04_clang/1.1/bazel_0.20.0/cpp:cc-toolchain-clang-x86_64-default
+build:remote --extra_execution_platforms=@bazel_toolchains//configs/ubuntu16_04_clang/1.1:rbe_ubuntu1604
+build:remote --host_platform=@bazel_toolchains//configs/ubuntu16_04_clang/1.1:rbe_ubuntu1604
+build:remote --platforms=@bazel_toolchains//configs/ubuntu16_04_clang/1.1:rbe_ubuntu1604
+
+# Set various strategies so that all actions execute remotely. Mixing remote
+# and local execution will lead to errors unless the toolchain and remote
+# machine exactly match the host machine.
+build:remote --spawn_strategy=remote
+build:remote --strategy=Javac=remote
+build:remote --strategy=Closure=remote
+build:remote --genrule_strategy=remote
+build:remote --define=EXECUTOR=remote
+
+# Enable the remote cache so action results can be shared across machines,
+# developers, and workspaces.
+build:remote --remote_cache=remotebuildexecution.googleapis.com
+
+# Enable remote execution so actions are performed on the remote systems.
+build:remote --remote_executor=remotebuildexecution.googleapis.com
+
+# Enable encryption.
+build:remote --tls_enabled=true
+
+# Enforce stricter environment rules, which eliminates some non-hermetic
+# behavior and therefore improves both the remote cache hit rate and the
+# correctness and repeatability of the build.
+build:remote --experimental_strict_action_env=true
+
+# Set a higher timeout value, just in case.
+build:remote --remote_timeout=3600
+
+# Enable authentication. This will pick up application default credentials by
+# default. You can use --auth_credentials=some_file.json to use a service
+# account credential instead.
+build:remote --auth_enabled=true
+build:remote --auth_scope="https://www.googleapis.com/auth/cloud-source-tools"
+
+# Set flags for uploading to BES in order to view results in the Bazel Build
+# Results UI.
+build:results --bes_backend="buildeventservice.googleapis.com"
+build:results --bes_timeout=60s
+build:results --tls_enabled
+
+# Output BES results url
+build:results --bes_results_url="https://source.cloud.google.com/results/invocations/"
+
+# Set flags for uploading to BES without Remote Build Execution.
+build:results-local --bes_backend="buildeventservice.googleapis.com"
+build:results-local --bes_timeout=60s
+build:results-local --tls_enabled=true
+build:results-local --auth_enabled=true
+build:results-local --spawn_strategy=local
+build:results-local --remote_cache=remotebuildexecution.googleapis.com
+build:results-local --remote_timeout=3600
+build:results-local --bes_results_url="https://source.cloud.google.com/results/invocations/"
+
+# The following flags enable the remote cache so action results can be shared
+# across machines, developers, and workspaces.
+build:remote-cache --remote_cache=remotebuildexecution.googleapis.com
+build:remote-cache --tls_enabled=true
+build:remote-cache --experimental_strict_action_env=true
+build:remote-cache --remote_timeout=3600
+build:remote-cache --auth_enabled=true
+build:remote-cache --spawn_strategy=standalone
+build:remote-cache --strategy=Javac=standalone
+build:remote-cache --strategy=Closure=standalone
+build:remote-cache --genrule_strategy=standalone
diff --git a/WORKSPACE b/WORKSPACE
index 4e8c6b83b..243999323 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -17,6 +17,18 @@ go_register_toolchains(go_version="1.11.4")
 load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies", "go_repository")
 gazelle_dependencies()
 
+# Load bazel_toolchain to support Remote Build Execution.
+# See releases at https://releases.bazel.build/bazel-toolchains.html
+http_archive(
+  name = "bazel_toolchains",
+  urls = [
+    "https://mirror.bazel.build/github.com/bazelbuild/bazel-toolchains/archive/31b5dc8c4e9c7fd3f5f4d04c6714f2ce87b126c1.tar.gz",
+    "https://github.com/bazelbuild/bazel-toolchains/archive/31b5dc8c4e9c7fd3f5f4d04c6714f2ce87b126c1.tar.gz",
+  ],
+  strip_prefix = "bazel-toolchains-31b5dc8c4e9c7fd3f5f4d04c6714f2ce87b126c1",
+  sha256 = "07a81ee03f5feae354c9f98c884e8e886914856fb2b6a63cba4619ef10aaaf0b",
+)
+
 # External repositories, in sorted order.
 go_repository(
     name = "com_github_cenkalti_backoff",
@@ -96,7 +108,13 @@ go_repository(
     commit = "0dd5e194bbf5eb84a39666eb4c98a4d007e4203a",
 )
 
-# System Call test dependencies
+go_repository(
+    name = "com_github_google_btree",
+    importpath = "github.com/google/btree",
+    commit = "4030bb1f1f0c35b30ca7009e9ebd06849dd45306",
+)
+
+# System Call test dependencies.
 http_archive(
     name = "com_github_gflags_gflags",
     sha256 = "6e16c8bc91b1310a44f3965e616383dbda48f83e8c1eaa2370a215057b00cabe",
@@ -114,16 +132,6 @@ http_archive(
 )
 
 http_archive(
-    name = "com_google_googletest",
-    sha256 = "353ab86e35cea1cd386115279cf4b16695bbf21b897bfbf2721cf4cb5f64ade8",
-    strip_prefix = "googletest-997d343dd680e541ef96ce71ee54a91daf2577a0",
-    urls = [
-        "https://mirror.bazel.build/github.com/google/googletest/archive/997d343dd680e541ef96ce71ee54a91daf2577a0.zip",
-        "https://github.com/google/googletest/archive/997d343dd680e541ef96ce71ee54a91daf2577a0.zip",
-    ],
-)
-
-http_archive(
     name = "com_google_glog",
     sha256 = "eaabbfc16ecfacb36960ca9c8977f40172c51e4b03234331a1f84040a77ab12c",
     strip_prefix = "glog-781096619d3dd368cfebd33889e417a168493ce7",
@@ -133,8 +141,12 @@ http_archive(
     ],
 )
 
-go_repository(
-    name = "com_github_google_btree",
-    importpath = "github.com/google/btree",
-    commit = "4030bb1f1f0c35b30ca7009e9ebd06849dd45306",
+http_archive(
+    name = "com_google_googletest",
+    sha256 = "353ab86e35cea1cd386115279cf4b16695bbf21b897bfbf2721cf4cb5f64ade8",
+    strip_prefix = "googletest-997d343dd680e541ef96ce71ee54a91daf2577a0",
+    urls = [
+        "https://mirror.bazel.build/github.com/google/googletest/archive/997d343dd680e541ef96ce71ee54a91daf2577a0.zip",
+        "https://github.com/google/googletest/archive/997d343dd680e541ef96ce71ee54a91daf2577a0.zip",
+    ],
 )
diff --git a/kokoro/common.cfg b/kokoro/common.cfg
new file mode 100644
index 000000000..f6776ae84
--- /dev/null
+++ b/kokoro/common.cfg
@@ -0,0 +1,29 @@
+# Give Kokoro access to Remote Build Executor (RBE) service account key.
+before_action {
+  fetch_keystore {
+    keystore_resource {
+      keystore_config_id: 73898
+      keyname: "kokoro-rbe-service-account"
+    }
+  }
+}
+
+# Configure bazel to access RBE.
+bazel_setting {
+  # Our GCP project name
+  project_id: "copybara-shentu"
+
+  # Use RBE for execution as well as caching.
+  local_execution: false
+
+  # This must match the values in the job config.
+  auth_credential: {
+    keystore_config_id: 73898
+    keyname: "kokoro-rbe-service-account"
+  }
+
+  # Do not change unless you know what you are doing.
+  bes_backend_address: "buildeventservice.googleapis.com"
+  foundry_backend_address: "remotebuildexecution.googleapis.com"
+  upsalite_frontend_address: "https://source.cloud.google.com"
+}
diff --git a/kokoro/run_tests.sh b/kokoro/run_tests.sh
index 0acb92d7a..3f9c48865 100755
--- a/kokoro/run_tests.sh
+++ b/kokoro/run_tests.sh
@@ -24,9 +24,16 @@ set -eux
 
 readonly WORKSPACE_DIR="${PWD}/git/repo"
 
+# Used to configure RBE.
+readonly CLOUD_PROJECT_ID="copybara-shentu"
+readonly RBE_PROJECT_ID="projects/${CLOUD_PROJECT_ID}/instances/default_instance"
+
 # Random runtime name to avoid collisions.
 readonly RUNTIME="runsc_test_$((RANDOM))"
 
+# Packages that will be built and tested.
+# TODO: Include syscall tests in "test" directory.
+readonly TEST_PACKAGES=("//pkg/..." "//runsc/..." "//tools/...")
 
 #######################
 # BAZEL CONFIGURATION #
@@ -37,6 +44,27 @@ use_bazel.sh latest
 which bazel
 bazel version
 
+# Bazel start-up flags for RBE.
+BAZEL_RBE_FLAGS=(
+  "--bazelrc=${WORKSPACE_DIR}/.bazelrc_rbe"
+)
+
+# General Bazel build/test flags.
+BAZEL_BUILD_FLAGS=(
+  "--show_timestamps"
+  "--test_output=errors"
+  "--keep_going"
+  "--verbose_failures=true"
+)
+
+# Bazel build/test for RBE, a super-set of BAZEL_BUILD_FLAGS.
+BAZEL_BUILD_RBE_FLAGS=(
+  "${BAZEL_BUILD_FLAGS[@]}"
+  "--config=remote"
+  "--project_id=${CLOUD_PROJECT_ID}"
+  "--remote_instance_name=${RBE_PROJECT_ID}"
+  "--auth_credentials=${KOKORO_BAZEL_AUTH_CREDENTIAL}"
+)
 
 ####################
 # Helper Functions #
@@ -44,16 +72,20 @@ bazel version
 
 build_everything() {
   cd ${WORKSPACE_DIR}
-  # TODO: Include "test" directory.
-  bazel build //pkg/... //runsc/... //tools/...
+  bazel \
+    "${BAZEL_RBE_FLAGS[@]}" \
+    build \
+    "${BAZEL_BUILD_RBE_FLAGS[@]}" \
+    "${TEST_PACKAGES[@]}"
 }
 
 # Run simple tests runs the tests that require no special setup or
 # configuration.
 run_simple_tests() {
   cd ${WORKSPACE_DIR}
-  # TODO: Include "test" directory.
-  bazel test --test_output=errors //pkg/... //runsc/... //tools/...
+  bazel test \
+    "${BAZEL_BUILD_FLAGS[@]}" \
+    "${TEST_PACKAGES[@]}"
 }
 
 install_runtime() {
@@ -121,7 +153,9 @@ run_docker_tests() {
   declare -a variations=("" "-kvm" "-hostnet" "-overlay")
   for v in "${variations[@]}"; do
     # Run runsc tests with docker that are tagged manual.
-    bazel test --test_output=errors --test_env=RUNSC_RUNTIME="${RUNTIME}${v}" \
+    bazel test \
+      "${BAZEL_BUILD_FLAGS[@]}" \
+      --test_env=RUNSC_RUNTIME="${RUNTIME}${v}" \
       //runsc/test/image:image_test \
       //runsc/test/integration:integration_test
   done