DefectDetectionApplication/recipe-arm64.yaml at main · awslabs/DefectDetectionApplication · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
---
RecipeFormatVersion: "2020-01-25"
ComponentName: "aws.edgeml.dda.LocalServer.arm64"
ComponentVersion: "1.0.0"
ComponentDescription: DDA Local Web Server App - ARM64 CPU
ComponentPublisher: Amazon
ComponentDependencies:
  aws.greengrass.Nucleus:
    VersionRequirement: ">=2.4.0"
  aws.greengrass.ShadowManager:
    VersionRequirement: ">=2.2.0"
  aws.greengrass.Cli:
    VersionRequirement: ">=2.6.0"
    # SOFT (triton-model-cleanup-wedge): the CLI restarts whenever a
    # deployment merges configuration. A HARD dependency made each restart
    # restart LocalServer and, through their HARD dependency on it, every
    # model component. LocalServer needs only the CLI's IPC operations
    # (restart, list, component details) at call time.
    DependencyType: SOFT
  # The backend fetches Portal-managed stream credentials with the device's
  # TES credentials (rtsp-rtmp-stream-cameras 17.1, finding 25). The ECR
  # publish path adds the same dependency.
  aws.greengrass.TokenExchangeService:
    VersionRequirement: "~2.0.0"
ComponentConfiguration:
  DefaultConfiguration:
    StreamShadowName: "streamConfigurationShadow"
    AppRunnerShadowName: "appRunnerShadow"
    StationName: "DDA_Station_ARM64"
    ComponentName: "aws.edgeml.dda.LocalServer.arm64"
    LocalLoginEnabled: "false"
    # Self-heal is on by default; merge "false" to opt a device out (triton-model-cleanup-wedge).
    ModelLoadSelfHealEnabled: "true"
    accessControl:
      aws.greengrass.ShadowManager:
        'aws.edgeml.dda.LocalServer.arm64:shadow:1':
          policyDescription: 'Allows access to shadows'
          operations:
            - 'aws.greengrass#GetThingShadow'
            - 'aws.greengrass#UpdateThingShadow'
          resources:
            - $aws/things/*/shadow
            - $aws/things/*/shadow/name/*
        'aws.edgeml.dda.LocalServer.arm64:shadow:2':
          policyDescription: 'Allows access to things with shadows'
          operations:
            - 'aws.greengrass#ListNamedShadowsForThing'
          resources:
            - '*'
      aws.greengrass.ipc.mqttproxy:
        'aws.edgeml.dda.LocalServer.arm64:mqttproxy:1':
          policyDescription: Allows access to shadow pubsub topics
          operations:
            - "aws.greengrass#SubscribeToIoTCore"
            - "aws.greengrass#PublishToIoTCore"
          resources:
            - $aws/things/*/shadow/name/*
        'aws.edgeml.dda.LocalServer.arm64:mqttproxy:2':
          policyDescription: 'Allows workflow mqtt_publish output publishes: the node topic parameter is free-form user input, so no topic prefix can cover it and publish must be authorized on the wildcard resource. Deliberately publish-only; SubscribeToIoTCore is NOT broadened beyond the shadow topics in mqttproxy:1'
          operations:
            - "aws.greengrass#PublishToIoTCore"
          resources:
            - '*'
      aws.greengrass.Cli:
        'aws.edgeml.dda.LocalServer.arm64:cli:1':
          policyDescription: 'Allows access to restart and stop DDA greengrass components'
          operations:
            - 'aws.greengrass#RestartComponent'
            - 'aws.greengrass#StopComponent'
          resources:
            - 'aws.edgeml.dda.*'
            - 'model*'
        'aws.edgeml.dda.LocalServer.arm64:cli:2':
          policyDescription: 'Allows access to list and get details for greengrass components on device'
          operations:
            - 'aws.greengrass#ListComponents'
            - 'aws.greengrass#GetComponentDetails'
          resources:
            - '*'
Manifests:
  - Platform:
      os: linux
      architecture: aarch64
    Lifecycle:
      Install:
        RequiresPrivilege: true
        Script: |
          docker images --quiet --filter=dangling=true | xargs --no-run-if-empty docker rmi -f || true; docker load -i {artifacts:decompressedPath}/aws.edgeml.dda.LocalServer.arm64-aarch64/custom-build/aws.edgeml.dda.LocalServer.arm64/flask-app.tar && docker load -i {artifacts:decompressedPath}/aws.edgeml.dda.LocalServer.arm64-aarch64/custom-build/aws.edgeml.dda.LocalServer.arm64/react-webapp.tar
          chmod +x {artifacts:decompressedPath}/aws.edgeml.dda.LocalServer.arm64-aarch64/custom-build/aws.edgeml.dda.LocalServer.arm64/host_scripts/*.sh
      # Health-gated lifecycle (edge-deploy-reliability, Defect B): Startup
      # replaces the attached Run. `up -d --wait` exits 0 only when all
      # started services pass their compose healthchecks, so Greengrass
      # reports RUNNING only over a healthy backend; a retried Startup's
      # `compose up` also starts existing stopped containers (the recovery
      # path for a container the restart race managed to kill). Timeout 900s:
      # Greengrass's 120s Startup default is far below a cold device boot.
      # Adoption-proof Startup (Defect E): STARTUP_EPOCH is recorded first;
      # --force-recreate ensures the compose up never adopts a previous
      # incarnation's (possibly still-dying) container; verify-fresh (NOT
      # best-effort) fails Startup non-zero if any project container's
      # StartedAt predates this Startup, so Greengrass retries instead of
      # reporting RUNNING over a stale container.
      Startup:
        RequiresPrivilege: true
        Timeout: 900
        SetEnv:
          COMPONENT_WORK_PATH: "{work:path}"
          KERNEL_ROOT_PATH: "{kernel:rootPath}"
          INFERENCE_COMPONENT_DECOMPRESED_PATH: "{aws.edgeml.dda.InferenceApp:artifacts:decompressedPath}"
          LOCAL_SERVER_COMPONENT_DECOMPRESSED_PATH: "{artifacts:decompressedPath}/aws.edgeml.dda.LocalServer.arm64-aarch64"
        Script: |
          STARTUP_EPOCH=$(date +%s)
          bash {artifacts:decompressedPath}/aws.edgeml.dda.LocalServer.arm64-aarch64/custom-build/aws.edgeml.dda.LocalServer.arm64/host_scripts/setup_dda_users.sh ;
          bash {artifacts:decompressedPath}/aws.edgeml.dda.LocalServer.arm64-aarch64/custom-build/aws.edgeml.dda.LocalServer.arm64/host_scripts/get_nvidia_libs_versions.sh;
          bash {artifacts:decompressedPath}/aws.edgeml.dda.LocalServer.arm64-aarch64/custom-build/aws.edgeml.dda.LocalServer.arm64/host_scripts/setup_paths.sh;
          bash {artifacts:decompressedPath}/aws.edgeml.dda.LocalServer.arm64-aarch64/custom-build/aws.edgeml.dda.LocalServer.arm64/host_scripts/configure_usb.sh;
          export $(grep -v '^#' /tmp/.dda.env | xargs) ;
          docker compose --profile $DOCKER_PROFILE -f {artifacts:decompressedPath}/aws.edgeml.dda.LocalServer.arm64-aarch64/custom-build/aws.edgeml.dda.LocalServer.arm64/docker-compose.yaml up -d --no-build --force-recreate --wait --wait-timeout 600 ;
          bash {artifacts:decompressedPath}/aws.edgeml.dda.LocalServer.arm64-aarch64/custom-build/aws.edgeml.dda.LocalServer.arm64/host_scripts/compose_lifecycle.sh verify-fresh $STARTUP_EPOCH -- --profile $DOCKER_PROFILE -f {artifacts:decompressedPath}/aws.edgeml.dda.LocalServer.arm64-aarch64/custom-build/aws.edgeml.dda.LocalServer.arm64/docker-compose.yaml
      # Shutdown exports /tmp/.dda.env the same way Startup does: Greengrass
      # gives Shutdown a fresh environment, so without the export
      # $DOCKER_PROFILE expanded empty and `--profile` consumed `-f`, making
      # every `docker compose down` fail with "no configuration file
      # provided: not found". ${DOCKER_PROFILE:-generic} keeps the down
      # working even if /tmp/.dda.env is missing (generic is what
      # get_nvidia_libs_versions.sh selects on this non-Jetson arm64 CPU
      # target).
      # Synchronous teardown (edge-deploy-reliability, Defect E): after the
      # down, wait-empty blocks (bounded, best-effort) until the project
      # reports zero containers, so Shutdown does not return while a
      # slow-dying backend still exists for the next Startup to adopt.
      # Timeout 300s: Greengrass's 15s default would truncate the wait; 300
      # covers the 120s stop grace plus the dying window with margin, and
      # sits above the 240s wait bound.
      Shutdown:
        RequiresPrivilege: true
        Timeout: 300
        Script: |
          export $(grep -v '^#' /tmp/.dda.env | xargs) || true
          docker compose --profile ${DOCKER_PROFILE:-generic} -f {artifacts:decompressedPath}/aws.edgeml.dda.LocalServer.arm64-aarch64/custom-build/aws.edgeml.dda.LocalServer.arm64/docker-compose.yaml down
          bash {artifacts:decompressedPath}/aws.edgeml.dda.LocalServer.arm64-aarch64/custom-build/aws.edgeml.dda.LocalServer.arm64/host_scripts/compose_lifecycle.sh wait-empty 240 -- --profile ${DOCKER_PROFILE:-generic} -f {artifacts:decompressedPath}/aws.edgeml.dda.LocalServer.arm64-aarch64/custom-build/aws.edgeml.dda.LocalServer.arm64/docker-compose.yaml || true
    Artifacts:
      - URI: s3://BUCKET_NAME/COMPONENT_NAME/COMPONENT_VERSION/aws.edgeml.dda.LocalServer.arm64-aarch64.zip
        Unarchive: ZIP