fix(cli): stop managed EC2 demo starting zero containers (#298) (#302)

Signed-off-by: Kyle Hounslow <kylhouns@amazon.com>

Author: kylehounslow

.env

@@ -11,6 +11,12 @@ INCLUDE_COMPOSE_EXAMPLES=docker-compose.examples.yml
 INCLUDE_COMPOSE_LOCAL_OPENSEARCH=docker-compose.local-opensearch.yml
 INCLUDE_COMPOSE_LOCAL_OPENSEARCH_DASHBOARDS=docker-compose.local-opensearch-dashboards.yml
 
+# Activates services that require a local backend (eval canary, otel-demo
+# monitors). These hardcode http://prometheus:9090 / https://opensearch:9200
+# with no managed-backend path. Managed-mode deploys leave COMPOSE_PROFILES
+# unset to prune them.
+COMPOSE_PROFILES=local-backends
+
 # TODO: Change to opensearchproject after 3.7.0 official release
 OPENSEARCH_DOCKER_REPO=opensearchstaging
 

aws/cli-installer/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensearch-project/observability-stack",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "CLI for the Observability Stack",
   "type": "module",
   "bin": "./bin/cli-installer.mjs",

aws/cli-installer/package.json

@@ -19,11 +19,20 @@ import {
 import {
   SSMClient, GetParameterCommand,
 } from '@aws-sdk/client-ssm';
+import { createRequire } from 'node:module';
 import { printStep, printSuccess, printWarning, printInfo, createSpinner } from './ui.mjs';
 
+const require = createRequire(import.meta.url);
+const { version: PKG_VERSION } = require('../package.json');
+
 const TAG_KEY = 'observability-stack:pipeline-name';
 const INSTANCE_TYPE = 't3.xlarge';
 
+// The stack revision the EC2 instance clones. Defaults to the git tag matching
+// this CLI release so a pinned CLI deploys a pinned stack (no drift from main
+// HEAD at boot time). Override with OBS_STACK_REF for development.
+const STACK_REF = process.env.OBS_STACK_REF || `cli-installer-v${PKG_VERSION}`;
+
 function tags(pipelineName, extra = {}) {
   return [
     { Key: TAG_KEY, Value: pipelineName },
@@ -127,7 +136,13 @@ curl -SL "https://github.com/docker/buildx/releases/download/\${BUILDX_VERSION}/
   -o /usr/local/lib/docker/cli-plugins/docker-buildx
 chmod +x /usr/local/lib/docker/cli-plugins/docker-buildx
 
-git clone --depth 1 https://github.com/opensearch-project/observability-stack.git /opt/obs-stack
+# Clone the stack at the pinned ref (see STACK_REF). Fall back to the default
+# branch if the ref is absent (e.g. an untagged dev build).
+OBS_STACK_REF="${STACK_REF}"
+if ! git clone --depth 1 --branch "\$OBS_STACK_REF" https://github.com/opensearch-project/observability-stack.git /opt/obs-stack; then
+  echo "WARNING: ref \$OBS_STACK_REF not found, falling back to default branch"
+  git clone --depth 1 https://github.com/opensearch-project/observability-stack.git /opt/obs-stack
+fi
 cd /opt/obs-stack
 
 cat > docker-compose/otel-collector/config.yaml << 'COLLECTOREOF'
@@ -185,6 +200,11 @@ services:
     logging: *logging
 MANAGEDEOF
 
+# Managed mode has no local opensearch/prometheus. Clear COMPOSE_PROFILES
+# (overriding the local-backends value committed in .env) to prune the services
+# that require those backends.
+export COMPOSE_PROFILES=
+
 # Kafka's healthcheck can exceed compose's dependency grace window on first boot,
 # leaving kafka-dependent services in 'Created' state. Retry once — second pass
 # finds kafka healthy and starts the stragglers.

aws/cli-installer/src/ec2-demo.mjs

@@ -159,6 +159,79 @@ describe('EC2 demo buildUserData', () => {
     assert.ok(decoded.includes('docker-compose'));
     assert.ok(decoded.includes('docker-buildx'));
   });
+
+  it('pins the stack clone to a ref instead of tracking main HEAD', () => {
+    const decoded = Buffer.from(_buildUserData(cfg), 'base64').toString();
+    assert.ok(decoded.includes('--branch "$OBS_STACK_REF"'));
+    assert.ok(decoded.includes('cli-installer-v'));
+  });
+
+  it('clears COMPOSE_PROFILES so local-backend services are pruned in managed mode', () => {
+    const decoded = Buffer.from(_buildUserData(cfg), 'base64').toString();
+    assert.ok(decoded.includes('export COMPOSE_PROFILES='));
+  });
+});
+
+// ── managed-mode compose project resolution ──────────────────────────────────
+// Regression guard for #298: the generated docker-compose.managed.yml must
+// resolve as a valid project with COMPOSE_PROFILES empty, with every
+// local-backend service pruned (managed mode defines no opensearch/prometheus).
+
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { writeFileSync, rmSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+
+function dockerComposeAvailable() {
+  try {
+    execFileSync('docker', ['compose', 'version'], { stdio: 'ignore' });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// Extract the docker-compose.managed.yml heredoc body from generated user-data.
+function extractManagedCompose(userDataB64) {
+  const decoded = Buffer.from(userDataB64, 'base64').toString();
+  const m = decoded.match(/docker-compose\.managed\.yml << .MANAGEDEOF.\n([\s\S]*?)\nMANAGEDEOF/);
+  if (!m) throw new Error('managed compose heredoc not found in user-data');
+  return m[1];
+}
+
+describe('EC2 demo managed compose project', { skip: !dockerComposeAvailable() }, () => {
+  const cfg = {
+    pipelineName: 'test-pipeline',
+    region: 'us-west-2',
+    ingestEndpoints: ['test-pipeline-abc123.us-west-2.osis.amazonaws.com'],
+  };
+  // Repo root holds the included compose files; managed.yml's relative
+  // include: paths resolve against the file's own directory.
+  const repoRoot = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+  const managedPath = join(repoRoot, 'docker-compose.managed.yml');
+
+  function configServices(profiles) {
+    return execFileSync(
+      'docker', ['compose', '-f', managedPath, 'config', '--services'],
+      { cwd: repoRoot, env: { ...process.env, COMPOSE_PROFILES: profiles }, encoding: 'utf8' },
+    ).split('\n').filter(Boolean);
+  }
+
+  it('validates and prunes local-backend services when COMPOSE_PROFILES is empty', () => {
+    writeFileSync(managedPath, extractManagedCompose(_buildUserData(cfg)));
+    try {
+      const services = configServices('');
+      assert.ok(services.length > 0, 'expected the managed project to resolve to a non-empty service list');
+      assert.ok(!services.includes('example-agent-eval-canary'),
+        'eval canary should be pruned in managed mode (no local opensearch)');
+      assert.ok(!services.includes('otel-demo-alerting-rules-monitors-init'),
+        'otel-demo monitors-init should be pruned in managed mode (no local prometheus/opensearch)');
+      assert.ok(services.includes('otel-collector'),
+        'otel-collector should always be present');
+    } finally {
+      rmSync(managedPath, { force: true });
+    }
+  });
 });
 
 // ── renderPipeline tests ─────────────────────────────────────────────────────

aws/cli-installer/test/unit.test.mjs

@@ -177,8 +177,11 @@ services:
           memory: 128M
     logging: *logging
 
-  # Agent Eval Canary: periodically scores un-evaluated agent traces
+  # Agent Eval Canary: periodically scores un-evaluated agent traces.
+  # Requires a local OpenSearch backend; gated behind the local-backends
+  # profile (see COMPOSE_PROFILES in .env).
   example-agent-eval-canary:
+    profiles: ["local-backends"]
     build:
       context: ./docker-compose/agent-eval-canary
       dockerfile: Dockerfile

docker-compose.examples.yml

@@ -774,7 +774,10 @@ services:
   # failure. Named separately from the base container rather than overlaying it
   # because Docker Compose >= v2.38 rejects service-name overlays on
   # `include:`-imported resources. Both containers hit idempotent upsert APIs.
+  # Requires local Cortex (prometheus) and OpenSearch backends; gated behind
+  # the local-backends profile (see COMPOSE_PROFILES in .env).
   otel-demo-alerting-rules-monitors-init:
+    profiles: ["local-backends"]
     image: python:3.11-alpine
     container_name: otel-demo-alerting-rules-monitors-init
     command: