Skip to content

Deploying DSS services

Prerequisites

Before beginning services deployment:

  • Deploy appropriate infrastructure (Kubernetes cluster is available)
  • Complete appropriate pooling configuration
  • Download & install the following tools to your workstation:
    • Install kubectl to interact with kubernetes
      • Confirm successful installation with kubectl version --client (should succeed from any working directory).
      • Note that kubectl can alternatively be installed via the Google Cloud SDK gcloud shell if using Google Cloud.
    • Install tanka
      • On Linux, after downloading the binary per instructions, run sudo chmod +x /usr/local/bin/tk
      • Confirm successful installation with tk --version
    • Install Docker.
      • Confirm successful installation with docker --version

Services deployment

This section describes how to deploy services for a DSS instance once the prerequisites have been satisified.

Depending on infrastructure deployment method, deploy services:

Then, deploy any necessary support services.

Docker images

The application logic of the DSS is located in core-service which is provided in a Docker image. To use the prebuilt InterUSS Docker images (without building them yourself), simply use docker.io/interuss/dss for VAR_DOCKER_IMAGE_NAME and the rest of this section may be skipped.

Instead of using the prebuilt images, you can build the image locally and push it to a Docker registry of your choice. All major cloud providers have a docker registry service, or you can set up your own.

To build these images locally and, optionally, push them to a docker registry:

  1. Set the environment variable DOCKER_URL to your docker registry url endpoint.

    1. DOCKER_URL should be set similarly to as described here, like gcr.io/your-project-id (do not include the image name; it will be appended by the build script)

  2. Ensure you are logged into your docker registry service.

    1. These are the recommended instructions (gcloud auth configure-docker). Ensure that appropriate permissions are enabled.

  3. Use the build.sh script to build and push an image tagged with the current date and git commit hash.

  4. Note the VAR_* value printed at the end of the script.

  1. Set the environment variable DOCKER_URL to your docker registry url endpoint.

    1. DOCKER_URL should be set similarly to as described here, like ${aws_account_id}.dkr.ecr.${region}.amazonaws.com/ (do not include the image name; it will be appended by the build script)

  2. Ensure you are logged into your docker registry service.

    1. Create a private repository by following the instructions here, then login as described here.

  3. Use the build.sh script to build and push an image tagged with the current date and git commit hash.

  4. Note the VAR_* value printed at the end of the script.

Access to private repository

See the description of VAR_DOCKER_IMAGE_PULL_SECRET in TFVARS.gen.md to configure authentication when using terraform to deploy infrastructure.

Verify signature of prebuilt InterUSS Docker images

The prebuilt docker images are signed using sigstore. The identity of the CI workflow, attested by GitHub, is used so sign the images.

The signature may be verified by using cosign: 

1
2
3
4
docker pull "docker.io/interuss/dss:latest"
cosign verify "docker.io/interuss/dss:latest" \
  --certificate-identity-regexp="https://github.com/interuss/dss/.github/workflows/dss-publish.yml@refs/*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

Adapt the version specified if required.