Moon - A cross browser Selenium solution for Kubernetes or Openshift cluster

This reference for version: 1.5.0

Moon is a browser automation solution compatible with Selenium Webdriver protocol and using Kubernetes to launch browsers.

1. Getting Started

1.1. Quick Start Guide

1.1.1. Installing to Kubernetes

Option 1: you have a running Kubernetes cluster

Prerequisites:

Running Kubernetes cluster

kubectl client installed and pointing to the cluster

If you are running Kubernetes cluster on virtual machines, we usually recommend having bigger VMs instead of smaller ones. This allows to avoid available CPUs and memory fragmentation issues. For example having 24 CPU cores overall it is better to start 3 x 8 CPU core VMs instead of 12 x 2 CPU core.

Clone an example configuration repository:

$ git clone https://github.com/aerokube/moon-deploy.git
$ cd moon-deploy

Run one command to start Moon and Moon API:

$ kubectl apply -f moon.yaml

By default Moon is started in a separate namespace called moon so we append -n moon to the next commands.

In Google Cloud you may also need to give cluster admin permissions to your Google account as follows:

$ kubectl create clusterrolebinding cluster-admin-binding --clusterrole=cluster-admin --user=username@example.com # Use you real Google account email

Wait for LoadBalancer IP to allocate:

$ kubectl get svc -n moon
NAME      TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)                         AGE
browsers  ClusterIP      None            <none>        <none>                          51s
moon      LoadBalancer   10.63.242.109   <pending>     4444:31894/TCP,8080:30625/TCP   17s

It will look like this when finished:

$ kubectl get svc -n moon
NAME      TYPE           CLUSTER-IP      EXTERNAL-IP      PORT(S)                         AGE
browsers  ClusterIP      None            <none>           <none>                          51s
moon      LoadBalancer   10.63.242.109   104.154.161.58   4444:31894/TCP,8080:30625/TCP   1m

Now you can optionally point a domain name to this IP address:

$ host moon.example.com
moon.example.com has address 104.154.161.58

Run your tests against moon like you do with regular Selenium:

http://104.154.161.58:4444/wd/hub

When running your tests for the first time for every browser version Kubernetes will download and cache requested browser image. This can take several minutes depending on your network connection.

Same address using domain name:

http://moon.example.com:4444/wd/hub

Moon web interface is available at:
```
http://104.154.161.58:8080/
```

Option 2: you have DigitalOcean or Google Cloud

We deliver ready to use configurations for these cloud platforms. Take a look at Cloud Platforms section for more details.

1.1.2. Installing to Openshift

Prerequisites:
- Running Openshift cluster
- oc client installed and pointing to the cluster

Clone an example configuration repository:

$ git clone https://github.com/aerokube/moon-deploy.git
$ cd moon-deploy

Add edit policy to default account so Moon could read project pod quota:
```
$ oc policy add-role-to-user edit system:serviceaccount:moon:default
```
Here we assume that Openshift project for Moon is called moon.
Start Moon with Openshift UI or oc client using moon-openshift.yaml file:
```
$ oc create -f moon-openshift.yaml -n moon
```
Run Selenium tests against moon service listening on port 4444:
```
http://<moon-ip-or-hostname>:4444/wd/hub
```

1.1.3. Moon Checklist

Although Moon installation is as simple as deploying one YAML manifest - there are some well-known issues you may encounter while running your tests. The following checklist will help you to have everything running smoothly from the beginning:

Make sure you turned off DNS cache for Moon namespace as described in Browser pods are freezing section.
For Moon 1.4.0+ make sure you have a required Kubernetes service described in Sessions are not starting section.
While using Moon for the first time - make sure you are not suffering from various Kubernetes issues described in No space left on device and DNS lookup timeouts sections as well as some Github issues: kubernetes/kops#5916.

1.2. Recommended Cluster Settings

Use the biggest possible cluster node sizes. For example having 100 CPUs overall it is better to launch 5 nodes with 20 CPUs each than 50 nodes with 2 CPUs each. Browser pods can in some cases require more than 2 CPUs and this can lead to preliminary cluster fragmentation.
Avoid cluster nodes with RedHat \ CentOS if possible. Nodes using these distributions are known to suffer from issues related to firewall \ SeLinux and can be more complicated to configure correctly.
Use Calico container network interface instead of Flannel if possible. Calico has better performance than Flannel especially on big clusters.
Turn off DNS cache at least for Moon namespace. Being a completely stateless solution, Moon significantly depends on cluster DNS stability. One of the known Kubernetes issues is occasional DNS inconsistency - when somew browser pods are not accessible using domain name (it does not resolve). Such inconsistency can lead to frozen browser pods and cluster exhaustion. Possible way to turn off DNS cache is described in Browser pods are freezing section.
Use more than 1 Kubernetes API replica if needed. Moon is using Kubernetes API to create and delete browser pods. If you plan to run hundreds of browsers in parallel - take a look at Kubernetes API (Kubernetes master) host system metrics. Overloaded master can stop responding to requests properly and this can lead to frozen browser pods.

1.3. Frequently Asked Questions

1.3.1. Where are Moon logs?

See Log Files section.

1.3.2. Where are recorded videos stored?

Moon automatically saves session logs and recorded video files to S3 compatible storage. If S3 storage is not configured - then video recording will not work.

1.3.3. How to update configuration of a running Moon cluster?

Just update respective config maps (config, quota) or secrets (users, credentials) with standard Kubernetes commands (kubectl edit or kubectl replace). For example:

$ kubectl edit configmap config -n moon # Updating global Moon configuration
$ kubectl edit configmap quota -n moon # Updating Moon quota
$ kubectl edit secret users -n moon # Updating Moon users
$ kubectl edit secret credentials -n moon # Updating Moon credentials (e.g. S3 access keypair)

These commands will open your preferred editor with respective data: do any desired modifications, save and exit. Changes are applied immediately but how fast Moon will see them depends on Kubernetes caching settings (default is 1 minute).

1.3.4. Is it possible to configure Kubernetes service account for Moon?

Yes, Moon has -service-account-name flag described in Moon Container Flags section.

1.3.5. Sessions are not starting

In recent Moon versions (1.4.0+) you may encounter an issue when browser sessions are not starting at all. Moon logs will show something like this:

2019/12/26 13:33:16 [POD_CREATED] [browsers] [172.26.213.8] [chrome-78-0-77632dac-b46c-4e6e-af24-8a160251e931] [0.03s]
2019/12/26 13:33:16 [AWAITING_DRIVER] [browsers] [172.26.213.8] [chrome-78-0-77632dac-b46c-4e6e-af24-8a160251e931]
2019/12/26 13:49:14 [CLIENT_DISCONNECTED] [browsers] [172.26.213.8] [chrome-78-0-77632dac-b46c-4e6e-af24-8a160251e931] [] [957.78s]

In the majority of cases this is because you did not create a special Kubernetes service like the following:

apiVersion: v1
kind: Service
metadata:
  name: browsers
  namespace: moon
spec:
  selector:
    moon: browser
  clusterIP: None
  publishNotReadyAddresses: true

This service is required for successful network communication between Moon and created browser pods and is included to our official deployment manifests by default.

1.3.6. Connection was closed unexpectedly

If your HTTP requests are randomly hanging - this can mean that you can have too low HTTP request timeout value on your network load balancer (LoadBalancer, Ingress, Openshift Route). Very often default value is about 30 seconds and this can lead to closed connections when a lot of new Selenium session requests are being sent to Moon. How to set timeout setting usually depends on cloud platform you are using. For example in AWS this can look like:

kind: Service
apiVersion: v1
metadata:
  name: moon
  namespace: moon
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "60" # AWS load balancer timeout setting
spec:
  type: LoadBalancer
  # The rest of spec goes here...

1.3.7. Browser pods are freezing

This is a known issue in Kubernetes CoreDNS server settings. Current fix is to turn off DNS caching for Moon namespace. To do this:

Open DNS configuration map for editing (this will open an editor):
```
$ kubectl edit cm coredns -n kube-system
```

You will see YAML content like the following:

apiVersion: v1
data:
  Corefile: |
    .:53 {
        errors
        health
        kubernetes cluster.local in-addr.arpa ip6.arpa {
           pods insecure
           upstream
           fallthrough in-addr.arpa ip6.arpa
        }
        prometheus :9153
        proxy . /etc/resolv.conf
        cache 30
        loop
        reload
        loadbalance
    }
kind: ConfigMap
metadata:
  creationTimestamp: 2019-01-17T10:32:38Z
  name: coredns
  namespace: kube-system
  resourceVersion: "206"
  selfLink: /api/v1/namespaces/kube-system/configmaps/coredns
  uid: 3668d0fe-1a43-11e9-ad0b-025000000001

Update Corefile section as follows:

apiVersion: v1
data:
  Corefile: |
    moon.svc.cluster.local:53 {
        errors
        kubernetes cluster.local {
          namespaces moon
        }
    }
    .:53 {
        errors
        health
        ready
        kubernetes cluster.local in-addr.arpa ip6.arpa {
           pods insecure
           fallthrough in-addr.arpa ip6.arpa
           ttl 30
        }
        cache 30
        prometheus :9153
        forward . /etc/resolv.conf
        loop
        reload
        loadbalance
    }
# ... the rest of the file

Save changes and exit the editor.

1.3.8. No space left on device

If you are getting the following error…

2019/01/23 13:47:11 [INIT] [Failed to init quota reloader: unable to watch directory: no space left on device]

…and have sufficient disk space then it can be caused by insufficient number of inotify watchers. Moon is using inotify to automatically reload configuration files when they change. To fix this execute one command on Kubernetes hosts:

$ echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf && sudo sysctl -p

1.3.9. DNS lookup timeouts

If you are using Flannel as Kubernetes networking engine and receiving DNS lookup timeouts like the following…

2019/02/21 08:37:32 [VNC_ERROR] [10.244.1.1] [dial tcp: lookup chrome-71-0-686efb96-eabe-4435-af31-21a33c8a4c8b on 10.96.0.10:53: read udp 10.244.1.11:40603->10.96.0.10:53: i/o timeout]

…then you may need to set the following kernel property on Kubernetes nodes:

$ sysctl net.bridge.bridge-nf-call-iptables=1

1.3.10. No such host messages

If you are seeing messages like this…

[PROXY_ERROR] [unknown] [10.240.6.76] [POST http://chrome-60-0-1ae4b9f3-5b5c-441a-af0b-b1f24b39c252.browsers:4545/session] [dial tcp: lookup chrome-60-0-1ae4b9f3-5b5c-441a-af0b-b1f24b39c252.browsers on 10.0.0.10:53: no such host]

then check that you disabled DNS cache for Moon namespace as shown in Browser pods are freezing section.

1.4. Required Permissions

Moon requires very limited set of permissions and should work with default Kubernetes settings. The following table summarizes what needs to be accessible.

Table 1. Required Moon Permissions
Permission	Purpose
To start and stop pods	Used to start pods with browsers
To start and stop services	Used to provide network connectivity to browser pods
To read data from config maps	Used to share various configuration data among Moon replicas: S3 configuration, custom images configuration and so on
To read data from secrets	Used to share S3 credentials among Moon replicas
To read resource quota information	Used to verify that Moon can run no more than total number of browser pods allowed by license
To create and update resource quota information	Optional. Used only in case when no resource quota was configured
To create and delete secrets	Optional. Used only in case when no resource quota was configured

All these permissions are normally enabled by default when running Moon and its browser pods in the same Kubernetes namespace. To configure a namespace for browser pods - use -namespace flag for Moon and Moon API. If you are starting Moon in one namespace and specify -namespace flag pointing to another namespace, then you may require additional Kubernetes permissions to be enabled.

1.5. Cluster Architecture

1.5.1. Moon Components

Moon Cluster Architecture

architecture

Moon cluster consists of several important components:

One or more Moon application instances. Their main purpose is to start and stop browser containers. These replicas are usually exposed as Kubernetes service available on standard Selenium port 4444. You should run all the tests against this service.
One or more Moon API application instances. This API collects and returns various data about running browsers. Moon API can be optionally exposed as Kubernetes service available on HTTP port 8888. By default it is only accessible inside Kubernetes cluster.
One or more Moon UI application instances. Moon UI collects information from Moon API and visualizes it. It is usually available on HTTP port 8080.
Running browser pods. Moon is using exactly the same browser images as Selenoid.

1.5.2. Why Moon is Stateless

Moon is completely stateless and does not require any external database to run browser sessions.

Why Moon is Stateless

moon-stateless

When user requests a new browser session - a Kubernetes pod containing desired browser version is created. Moon also creates a Kubernetes service (with generated name like chrome-71-0-<UUID>) to deliver network connectivity to browser pod. Having a running pod and service - a standard new Selenium session request is sent to it. After receiving unique session identifier (so called Selenium session ID) Moon replaces it with the generated Kubernetes service name and returns the response to user. Subsequent Selenium requests are just proxied to respective service by using Selenium session ID as service name.

1.5.3. Browser Pod Contents

In addition to container with browser every pod created by Moon contains one or more service images.

Table 2. Service Images
Name	Purpose	Started
defender	Allows only one browser session to be created in the pod, handles session timeouts	Always
logger	Uploads sessions logs to S3 storage	When S3 storage is configured
video-recorder	Captures running browser session video and uploads it to S3 storage	When S3 storage is configured and video recording is requested by test

1.6. Moon vs Selenoid

Moon takes all the best practices and features from Selenoid and adds many more:

Unlimited automatic scalability. You always have enough browsers of any desired version available in the cluster. When running the cluster in cloud platforms such as Google Cloud you can adjust settings to automatically scale depending on current load. This allows to combine efficiency with competitive cost.
Completely stateless. Selenoid stores in memory information about currently running browser sessions. If for some reason its process crashes - then all running sessions are lost. Moon contrarily has no internal state and can be replicated across datacenters. Browser sessions remain alive even if one or more replicas go down.
Uniform load distribution. Load balancers like Ggr are using random load distribution across available browser hosts. This makes them inefficient when overall load is above 80% of cluster capacity. Moon delivers exactly uniform distribution working good even under 100% load.
Fully graceful. Any maintenance operations with the cluster do not interrupt running browser sessions. Every cluster component shuts down gracefully.

2. Configuration

2.1. Users List

Moon is a multi-user application allowing different users access different browser versions. A single htpasswd file is used to store users information. This file is saved to Kubernetes Secret and mounted to Moon container as a volume. A typical users file is a text file with user names and their encrypted passwords separated by colon:

$ cat users.htpasswd
test:$apr1$.dZyHlKN$jdoZkin/kPviFNArx/cVL1 # User is test, password is encrypted
alice:$apr1$mLYJAC4y$VYeJstWjWP/4iVlH/TNcD.
bob:$apr1$gyqzbSpt$RBNcxrsQaolPZCQZW0VQW1

2.1.1. Updating Users List

To add or remove users:

Modify users.htpasswd with htpasswd command:

$ htpasswd -Bbn new-user new-user-password >> users.htpasswd # Adding new user
$ htpasswd -Bb users.htpasswd some-user new-password # Updating password
$ htpasswd -D users.htpasswd test-user # Deleting existing user

Update users secret:

$ kubectl replace secret users --from-file=./users.htpasswd -n moon

Changes are applied immediately without Moon restart.

2.2. Browsers List

Moon is using a simple JSON-based configuration to store available browsers list. A typical browsers list file looks like the following:

Typical Browsers List File

{
  "firefox": {                                      (1)
    "default": "62.0",                              (2)
    "versions": {                                   (3)
      "62.0": {                                     (4)
        "image": "selenoid/firefox:62.0",           (5)
        "port": "4444",                             (6)
        "path": "/wd/hub",                          (7)
        "resources": {                              (8)
          "limits": {
            "cpu": "2",
            "memory": "2Gi"
          },
          "requests": {
            "cpu": "200m",
            "memory": "1Gi"
          }
        },
        "privileged": true,                         (9)
        "nodeSelector": {                           (10)
          "node-type": "hardware"
        },
        "env": ["TZ=Europe/Moscow", "LANG=ru"],     (11)
        "hosts": ["example.com:192.168.0.1"],       (12)
      },
      "60.0": {
        //...
      }
    }
  },
  "chrome": {
    //...
  },
  "opera": {
    "default": "56.0",
    "versions": {
        //...
    }
  }
}

1	Browser name
2	Default browser version
3	A list of available browser versions
4	Version name
5	Image name
6	Port to proxy connections to. In the majority of cases should be 4444.
7	Path relative to / where we request a new session, see below
8	Resource configuration for browser container (CPU and memory)
9	Whether to run browser pod in privileged mode (default is false)
10	Kubernetes node selector (allows to run pods on particular hosts only)
11	Environment variables passed to browser container
12	Custom `/etc/hosts` entries to be passed to browser container in `hostname:ip` format

2.2.1. Per-user Browser Lists

As you already know Moon is a multi-user application. For every user you need to create one file - <username>.json. For example for user alice from users.htpasswd you should create alice.json. All JSON files should be stored in the same directory specified by -quota-dir flag:

Per-user browser lists

\---quota
    |---- alice.json
    |---- browsers.json
    |---- bob.json
    |---- test.json

Such directory is then uploaded to Kubernetes ConfigMap and mounted to Moon container as a volume.

2.2.2. Guest Quota

In some cases you may need anonymous Selenium access - without username and password. In terms of Moon this is called guest quota and is configured with -guest-user flag (default value is browsers). Any browser versions specified in <guest-user>.json file will be available without username and password:

Guest quota file name

-guest-user browsers ====> browsers.json # This is the default
-guest-user guest-user ====> guest-user.json

2.2.3. Updating Browsers List

To add or remove browsers:

Having configuration files stored in quota directory apply desired modifications.

Update quota ConfigMap using contents of quota directory:

$ kubectl replace configmap quota --from-file=quota -n moon

Changes are applied immediately without Moon restart. All running user sessions will continue to work without any interruption.

2.2.4. Using External Selenium

Moon expects to run the majority of browsers in pods inside Kubernetes or Openshift cluster. However sometimes you may need to run Selenium tests on some external hosts: hardware servers or virtual machines. Mainly this could be needed in two situations:

Running Selenium tests on some complicated platforms such as MacOS or iOS. According to license agreement these platforms require Apple hardware devices and it is complicated to run Kubernetes on top of these devices.
Using Selenium online platforms (e.g. Aerokube Browsers) for some browsers. In that case you can run the majority of browsers (e.g. Firefox, Chrome, Opera) in Moon and complicated browsers (don’t work on standard virtual machines) such as Chrome Mobile in external Selenium platform.

Using External Hosts

For this case you should have the following:

A set of hosts with Selenium-compatible solution (Selenoid, Appium, Selenium Grid, etc.): host1.example.com:4444, host1.example.com:4444 and so on.
A VNC server listening on every such host on standard port 5900.

Every VNC server should be password protected with the same password having 8+ characters.

For every browser version supported on the hosts you need to add the following to browsers list file:

Typical Browsers List File

"safari": {
  "default": "13.0",
  "versions": {
    "77": {
      "image": "aerokube/moon-external-host:1.0.0",                                         (1)
      "port": "4444",
      "path": "/",
      "env": [
        "URLS=[\"http://host1.example.com:4444/\", \"http://host2.example.com:4444/\"]",    (2)
        "VNC_PASSWORD=myvncpassword", // At least 8 symbols                                 (3)
        "SCREEN_RESOLUTION=1921x1080x24" // This is optional                                (4)
      ]
    }
  }
}

1	Special proxy image for external hosts
2	A list of external hosts
3	VNC password value for the hosts
4	Optional. Screen resolution of remote host to use for VNC.

With such configuration Selenium session requests with be randomly load-balanced across the hosts specified in URLS environment variable. VNC feature should also work - you should be seeing remote host screen in Moon UI.

2.3. Configuration File

Moon stores all advanced configuration options (e.g. S3 settings) in a special JSON file called service.json:

Typical service.json file

{
  "s3": {                                          (1)
    "endpoint": "https://storage.googleapis.com",  (2)
    "bucketName": "moon-test",                     (3)
    "version": "S3v2",                             (4)
    "keyPattern": "$quota/$date"                   (5)
  },
  "images": {                                      (6)
    "logger": {                                    (7)
      "image": "my-reg.com/moon/logger:1.2.0",     (8)
      "resources": {                               (9)
        "limits": {                                (10)
          "cpu": "0.3",                            (11)
          "memory": "1024Mi"                       (12)
        },
        "requests": {                              (13)
          "cpu": "0.3",                            (14)
          "memory": "1024Mi"                       (15)
        }
      }
    }
  },
  "annotations": {                                 (16)
    "key1": "value1",                              (17)
    "key2": "value2"
  },
  "labels": {                                      (18)
    "key1": "value1",                              (19)
    "key2": "value2"
  }
}

1	S3 configuration section
2	S3 endpoint URL
3	S3 bucket name
4	S3 signature version (should be `S3v2` or `S3v4`)
5	S3 key pattern
6	Custom Moon system images section (to use Moon with private Docker registries)
7	Custom Moon image definition (one of `logger`, `defender`, `videoRecorder`)
8	Custom Moon image reference
9	Custom Moon image resources definition
10	Custom Moon image limits section
11	Custom Moon image CPU limit
12	Custom Moon image memory limit
13	Custom Moon image requests section
14	Custom Moon image CPU request
15	Custom Moon image memory request
16	Custom pod annotations section (applies globally to all browser versions)
17	Custom pod annotation key and value
18	Custom pod labels section (applies globally to all browser versions)
19	Custom pod label key and value

service.json is mounted to Moon container as a regular file using Kubernetes config map. Path to configuration file is specified with -config-file Moon flag. Any changes to configuration file are applied immediately - no need to restart Moon.

Adding service.json file to Moon

apiVersion: v1
kind: ConfigMap
metadata:
  name: config
  namespace: moon
data:
  service.json: |
    {
      "s3": {
        "endpoint": "https://storage.googleapis.com",
        "bucketName": "moon-test",
        "version": "S3v2"
      }
    }
---
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: moon
  namespace: moon
spec:
  template:
    metadata:
      labels:
        app: moon
    spec:
      containers:
      - name: moon
        image: aerokube/moon:latest-release
        args: ["-config-file", "/config/service.json"]
        volumeMounts:
        - name: config
          mountPath: /config
          readOnly: true
    volumes:
      - name: config
        configMap:
          name: config

2.4. Credentials Secret

Moon reads all credentials (e.g. S3 keys) from an optional Kubernetes secret called credentials. This secret is mounted to Moon container as a regular directory with distinct files corresponding to different keys. Path to credentials directory is specified with -credentials-dir Moon flag. Any changes to credentials secret are applied immediately - no need to restart Moon.

Adding credentials secret to Moon

apiVersion: v1
kind: Secret
metadata:
  name: credentials
  namespace: moon
stringData:
  s3.accessKey: "access-key-value"
  s3.secretKey: "secret-key-value"
---
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: moon
  namespace: moon
spec:
  template:
    metadata:
      labels:
        app: moon
    spec:
      containers:
      - name: moon
        image: aerokube/moon:latest-release
        args: ["-credentials-dir", "/credentials"]
        volumeMounts:
        - name: credentials
          mountPath: /credentials
          readOnly: true
    volumes:
    - name: credentials
      secret:
        secretName: credentials

The following keys are supported:

Table 3. Supported Credentials Secret Keys
Key	Meaning
s3.accessKey	S3 access key value
s3.secretKey	S3 secret key value

2.5. Installing License

According to license agreement you can use up to 4 parallel sessions without a license. If you wish to have more parallel sessions - order a license and follow this section steps to install the license. A trial license key with 50 parallel sessions can be generated on Moon website.

To install a license you should have a license key file. A typical license file looks like this:

$ cat license.key
Ti90a3ljSWpvV3hicU5ZY3U3ZVNMUzdzalVjU29nSVU2a3lmWDdENmhOSEs4SFJVVE5LNEpKL2oxRGhWTnRhZVBEQmx5cm1SM0dFWlVpbGIwOWhBSUpvWmlQMnNtYmtoZVRDbnJ3UTlIV3grMUMzaXFJalU3L0NIZDJuSzN3QUpIS0lyV2VoVjlRVUh5NzNCMFg0NEV5KzFSVXg1elhvaC9RUkNjTlBIOHR4WWtrRFBmTFhxYTFESlI0aXNObGtobWpXY2VJNVdna1lsWHFFOUp0OUxValZPN05hb2pCcHJzY0pvZjBrZys2YkhWUDR3cUJvYVFoSFJTYzMzZzNRSTkrWVd4dlZCeExmdTVxM2k2ZnluMDRHSEhGc21Fd2owVHdVa1Z3MmI5Z2FyVXlaVFF4RDdCRjVSVjBmSUVrU1pEQ0ZQdmIvMHZoKythY1V4OVRrR2FBREZzbWR3dExxRlU4NHF3MzBVdE5nTGhnNWYxRXRCQ215R1BHR0wyK2NpR0RDZDBTSXg4K1RsRGNWVzUyVVY4MUt6bkdOanJhTklOeXVtYjVPVXF6aVVpdmJZeVJNVVBSMWF3NUJRVGJDaHVycWVVdGtMMWFRZDgwOCtoWGRxODFOakxRNEJlVENNQTdPL2FneHBTUE1nL0J2QmVQKy84ZGhJeXd5Y0lxQVJhVWxocUdmUko2K05tbkFYV0hzZ2RjTng1dUVHU0w5VWF5TU1rR3RkZEZKQ1FiWmF0RnJMaDFHbHhKTndBRHFWcXIvQ0oxSzBQL2p6K2NFSWpsSG82TktvM3pudVFlanhYT2tGU1p1bWZrS1krZmF3VkVRZWlvcFlmZFk0TU9tc3U5TThsbng3T2VXQXZmOTFUQ2w1NUhBK1ZsQTMzN3VFOG1WV3ZlS0E1Tlk9O2V5SnNhV05sYm5ObFpTSTZJa0ZqYldVZ1RFeERJaXdpY0hKdlpIVmpkQ0k2SWsxdmIyNGlMQ0p0WVhoVFpYTnphVzl1Y3lJNk1qQXNJblJ2SWpveE5UTTRNelV5TURBd2ZRPT0=

Moon container is expecting to find license key file in the path specified by -license-file parameter. You need to mount license key file as a volume to every Moon container.

Having a license key file - create a Kubernetes secret:

$ kubectl create secret generic license-key --from-file /path/to/license.key -n moon

If you prefer YAML - this will look like:

Creating a secret for license key

apiVersion: v1
kind: Secret
metadata:
  name: license-key
  namespace: moon
stringData:
  license.key: Ti90a3ljSWpvV3hicU5ZY3U3ZVNMUzdzalVjU29nSVU2a3lmWDdENmhOSEs4SFJVVE5LNEpKL2oxRGhWTnRhZVBEQmx5cm1SM0dFWlVpbGIwOWhBSUpvWmlQMnNtYmtoZVRDbnJ3UTlIV3grMUMzaXFJalU3L0NIZDJuSzN3QUpIS0lyV2VoVjlRVUh5NzNCMFg0NEV5KzFSVXg1elhvaC9RUkNjTlBIOHR4WWtrRFBmTFhxYTFESlI0aXNObGtobWpXY2VJNVdna1lsWHFFOUp0OUxValZPN05hb2pCcHJzY0pvZjBrZys2YkhWUDR3cUJvYVFoSFJTYzMzZzNRSTkrWVd4dlZCeExmdTVxM2k2ZnluMDRHSEhGc21Fd2owVHdVa1Z3MmI5Z2FyVXlaVFF4RDdCRjVSVjBmSUVrU1pEQ0ZQdmIvMHZoKythY1V4OVRrR2FBREZzbWR3dExxRlU4NHF3MzBVdE5nTGhnNWYxRXRCQ215R1BHR0wyK2NpR0RDZDBTSXg4K1RsRGNWVzUyVVY4MUt6bkdOanJhTklOeXVtYjVPVXF6aVVpdmJZeVJNVVBSMWF3NUJRVGJDaHVycWVVdGtMMWFRZDgwOCtoWGRxODFOakxRNEJlVENNQTdPL2FneHBTUE1nL0J2QmVQKy84ZGhJeXd5Y0lxQVJhVWxocUdmUko2K05tbkFYV0hzZ2RjTng1dUVHU0w5VWF5TU1rR3RkZEZKQ1FiWmF0RnJMaDFHbHhKTndBRHFWcXIvQ0oxSzBQL2p6K2NFSWpsSG82TktvM3pudVFlanhYT2tGU1p1bWZrS1krZmF3VkVRZWlvcFlmZFk0TU9tc3U5TThsbng3T2VXQXZmOTFUQ2w1NUhBK1ZsQTMzN3VFOG1WV3ZlS0E1Tlk9O2V5SnNhV05sYm5ObFpTSTZJa0ZqYldVZ1RFeERJaXdpY0hKdlpIVmpkQ0k2SWsxdmIyNGlMQ0p0WVhoVFpYTnphVzl1Y3lJNk1qQXNJblJ2SWpveE5UTTRNelV5TURBd2ZRPT0=

License key file contains raw (NOT Base64-encoded) license key data. In some cases (e.g. when using data field in YAML) you may need to encode key data contents yourself.
When using YAML with stringData field - you don’t need to Base64-encode license key one more time.
If you are using Moon started from Google Cloud Marketplace then secret name can differ, e.g. moon-marketplace-license-key instead of license-key.

When starting Moon - mount this secret as a volume and point -license-file to mounted file:

Starting Moon with license key

apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: moon
  namespace: moon
spec:
  replicas: 3
  template:
    metadata:
      labels:
        app: moon
    spec:
      containers:
      - name: moon
        image: aerokube/moon:latest-release
        args: ["-license-file", "/license/license.key"] # Pointing to license key file
        resources:
            # Resources here
        ports:
            # Ports here
        volumeMounts:
        # Other mounts here
        - name: license-key # Mounting volume with license key
          mountPath: /license
          readOnly: true
    volumes:
    # Other volumes here
    - name: license-key # Creating volume from secret
      secret:
        secretName: license-key

If you update an existing secret with license key (already present in default deployment manifests) then settings are applied immediately without Moon restart. How fast Moon pods will "see" an updated license key depends on Kubernetes cache propagation delay (default value is 1 minute).

2.5.1. How Licenses Work

Every license key gives you an ability to run fixed number of parallel browser sessions. To limit maximum number of browser sessions Moon is using built-in Kubernetes resource quota feature. Every browser session in Moon is a separate Kubernetes pod. When started Moon checks that respective pod resource quota exists (that is to say total number of pods is limited). If not found such resource quota is automatically created. You can have any desired number of Moon, Moon API and Moon UI replicas (i.e. pods) in your cluster. These pods are added to total number of parallel browser sessions from license key. For example:

Your license key covers 100 parallel sessions
You have 5 pods with Moon, Moon API and Moon UI (Moon pods)
Correct pods quota is no more than 100 + 5 = 105 pods

Having such pods quota and 5 running Moon pods, Kubernetes will allow to start 100 browser pods maximum. New browser session requests exceeding the quota will wait for previous sessions to finish, i.e. previous pods to be removed by Moon. To determine that a running pod is a Moon pod its labels are analysed. Any pod is considered a Moon pod if the following label selector matches:

app in (moon, moon-api, moon-ui)

So when starting Moon - you should add a label app with value: moon, moon-api or moon-ui to respective pod definitions.

2.6. Monitoring

Moon has a dedicated microservice moon-monitor allowing to easily visualize browsers consumption with Prometheus and Grafana.

An example Grafana dashboard

grafana

moon-monitor (distributed as aerokube/moon-monitor image) exposes browsers consumption information in Prometheus text format via /metrics HTTP API. One of the most simple ways of deploying Prometheus in Kubernetes is using Prometheus Operator. When using it monitoring solution could work like the following:

Moon should be already running (e.g. in moon namespace).

Deploy Prometheus and Grafana using Prometheus Operator (e.g. to monitoring namespace).

An example Prometheus Operator installation command using Helm 3 is:

$ helm repo add stable https://kubernetes-charts.storage.googleapis.com/
$ helm install prometheus-operator stable/prometheus-operator --create-namespace --namespace monitoring

Deploy moon-monitor to the same monitoring namespace (optionally using a service account with permissions to access moon namespace):

Deploying moon-monitor with Kubernetes Service and Deployment

apiVersion: v1
kind: ServiceAccount
metadata:
  name: moon-monitor
  namespace: monitoring
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: moon-monitor
  namespace: moon
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - resourcequotas
  verbs:
  - get
  - watch
  - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: moon-monitor
  namespace: moon
roleRef:
  kind: Role
  name: moon-monitor
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: moon-monitor
  namespace: monitoring
---
kind: Service
apiVersion: v1
metadata:
  name: moon-monitor
  namespace: monitoring
  labels:
    app: moon-monitor
spec:
  selector:
    app: moon-monitor
  ports:
  - name: metrics
    port: 8080
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: moon-monitor
  namespace: monitoring
spec:
  replicas: 1
  selector:
    matchLabels:
      app: moon-monitor
  template:
    metadata:
      labels:
        app: moon-monitor
    spec:
      serviceAccountName: moon-monitor
      containers:
      - name: moon-monitor
        image: aerokube/moon-monitor:latest
        args:
        - -namespace
        - moon
        imagePullPolicy: IfNotPresent
        ports:
        - name: metrics
          containerPort: 8080

Create a ServiceMonitor object to start fetching Moon metrics:

Creating ServiceMonitor for Moon

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: moon-monitor
  namespace: monitoring
  labels:
    release: prometheus-operator
spec:
  selector:
    matchLabels:
      app: moon-monitor
  endpoints:
  - port: metrics
    interval: 15s

To fetch browser consumption information from Prometheus, query it like the following:
```
sum(moon_browser_count{browserName="chrome"}) by (version)
```
To create a Grafana dashboard you can import and customize our example configuration. An example YAML manifest for deploying moon-monitor could be found here.

2.7. Advanced Configuration

2.7.1. Uploading Files to S3

How to Configure S3 Support

You can configure Moon to send sessions logs and recorded video files to S3-compatible storage. Such type of storage is supported by AWS, Google Cloud, Microsoft Azure, Digital Ocean and many other cloud providers. To deploy a private S3-compatible storage you can use Minio. To enable S3 support in Moon:

Create an S3 bucket. In this example bucket name is moon-test. You will get an access key and a secret key for the bucket. Also you need to know supported S3 protocol version (usually specified in documentation).

Create a service.json file with the following contents:

$ cat service.json
{
  "s3": {
    "endpoint": "https://storage.googleapis.com",
    "bucketName": "moon-test",
    "version": "S3v2"
  }
}

You can create an S3-compatible bucket in the majority of public cloud platforms. How to configure Moon with these platforms in shown in the table below:

Table 4. S3 settings for popular cloud platforms
Platform Name	Service Name	Endpoint	Signature Version
AWS	AWS S3	Depends on region, e.g. `https://s3.us-east-2.amazonaws.com`. See AWS documentation for detailed list of endpoints.	S3v4
DigitalOcean	DigitalOcean Spaces	Depends on region, e.g. `https://nyc3.digitaloceanspaces.com`. See documentation for more details.	S3v4
Google Cloud	Google Cloud Storage	`https://storage.googleapis.com`	S3v2
Microsoft Azure	Azure Blob Storage	No built-in S3 support. Need to deploy additional software like Minio.	S3v4

Save service.json to a Kubernetes config map, mount it as a file to Moon container and then specify path to the file using -config-file flag as shown in Configuration File section.
Create a Kubernetes credentials secret, mount it as a directory to Moon container and then specify path to this directory using -credentials-dir flag as shown in Credentials Secret section.
S3 credentials secret
```
apiVersion: v1
kind: Secret
metadata:
  name: credentials
  namespace: moon
stringData:
  s3.accessKey: "access-key-value"
  s3.secretKey: "secret-key-value"
```
When you update already mounted config map with service.json or a credentials secret - settings are applied immediately without Moon restart.

Custom S3 Layout

By default files are uploaded to S3 bucket as follows:

Default S3 bucket layout

\---my-bucket
    \---- <session-id>
        |---- video.mp4
        |---- session.log

Moon allows to organize any custom S3 keys layout using S3 key pattern with placeholders. A typical S3 key pattern looks like the following:

Typical S3 key pattern

$quota/$browserName/$browserVersion/$platformName/$sessionId

Here every placeholder such as $quota, $browserName, $browserVersion and so on will be replaced by corresponding information: user name, browser name, browser version. The resulting S3 key will be used as a directory to save log and video files. A list of supported placeholders is shown in the table below:

Table 5. S3 Key Placeholders
Placeholder	Meaning
$sessionId	Replaced by Selenium session ID
$browserName	Replaced by Selenium browser name capability value
$browserVersion	Replaced by Selenium browser version capability value
$platformName	Replaced by Selenium platform capability value
$date	Replaced by current date, e.g. `2018-11-01`
$quota	Replaced by quota name (i.e. user name provided in Selenium URL)

Default S3 key pattern is just $sessionId:

Default video and log paths

my-bucket/chrome-71-0-686efb96-eabe-4435-af31-21a33c8a4c8b/video.mp4
my-bucket/chrome-71-0-686efb96-eabe-4435-af31-21a33c8a4c8b/session.log

You change S3 key pattern in service.json file as follows:

Setting custom S3 key pattern in service.json

{
  "s3": {
    // The rest of S3 settings go here...
    "keyPattern": "$quota/$browserName/$browserVersion/$platformName/$sessionId"  (1)
  },
  "images": {
    //...
  },
  "annotations": {
    //...
  }
}

1	Custom S3 key pattern

To define S3 key pattern for every browser session independently - use s3KeyPattern capability described in Special Capabilities section.

2.7.2. Using Custom Docker Registry

By default Moon downloads all images (aerokube/defender, aerokube/logger and so on) from public Docker registry. If in your environment due to security restrictions Docker images can only be downloaded from private registry you need to configure Moon to work with this registry. To do this:

Configure Kubernetes authentication to your private registry:

$ kubectl create secret docker-registry my-registry.example.com --docker-server=my-registry.example.com --docker-username=some-user --docker-password=registry-password --docker-email=some-user@example.com
$ kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "my-registry.example.com"}]}' # Use correct service account name here

Copy all desired browser images to your registry:

selenoid/chrome:73.0 => my-registry.example.com/moon/chrome:73.0

Update Browsers List file (browsers.json) to use new browser images:

Browsers List File with Custom Images

{
  "chrome": {
    "default": "73.0",
    "versions": {
        "73.0": {
            "image": "my-registry.example.com/moon/chrome:73.0",
            "port": "4444"
        },
        "72.0": {
            "image": "my-registry.example.com/moon/chrome:72.0",
            "port": "4444"
        }
    }
  }
}

Copy desired version of the Moon service images to your registry:

aerokube/moon-video-recorder:1.3.4 => my-registry.example.com/moon/moon-video-recorder:1.3.4
aerokube/defender:1.3.4 => my-registry.example.com/moon/defender:1.3.4
aerokube/logger => my-registry.example.com/moon/logger:1.3.4

Override Moon service images, create a service.json file with the following contents:

$ cat service.json
{
  "images": {
    "videoRecorder": {
        "image": "my-registry.example.com/moon/moon-video-recorder:latest-release"
    },
    "defender": {
        "image": "my-registry.example.com/moon/defender:latest-release"
    },
    "logger": {
        "image": "my-registry.example.com/moon/logger:latest-release"
    }
  }
}

If you already have S3 configuration in service.json file - just append new images key to it.

Save service.json to a Kubernetes config map, mount it as a file to Moon container and then specify path to the file using -config-file flag as shown in Configuration File section. When you update a config map with service.json - settings are applied immediately without Moon restart.

Copy desired version of Moon main images to your registry:

aerokube/moon:1.3.4 => my-registry.example.com/moon/moon:1.3.4
aerokube/moon-api:1.3.4 => my-registry.example.com/moon/moon-api:1.3.4
aerokube/selenoid-ui:1.6.5 => my-registry.example.com/moon/selenoid-ui:1.6.5

Use new main Moon images from the previous step in Kubernetes YAML definitions to start Moon, Moon API and Moon UI.

2.7.3. Adjusting Timeouts

Sometimes things go wrong: user can unexpectedly disconnect or browser session starts longer than needed. This can lead to overall cluster degradation because of broken browser pods occupying all available hardware. To prevent such cases Moon automatically detects and closes suspicious browser sessions. Several flags allow to adjust timeout settings:

Table 6. Available Timeout Flags
Flag	Default Value	Meaning	Notes
-timeout	1 minute	Maximum browser session idle time - measured as maximum time between separate HTTP requests corresponding to a running session.	When this timeout expires - session is automatically closed. You may need to increase this timeout when tested application pages load too slowly.
-session-attempt-timeout	10 minutes	Maximum time to start browser pod.	This time includes Kubernetes scheduling time and browser image download duration.

2.7.4. Adjusting Resources Consumption

Browser Resources Consumption

Moon has reasonable defaults for resources consumed by every browser pod. Sometimes you may need to override these settings. To override resource settings globally for every browser image use one of the following flags:

Table 7. Resources Consumption Flags
Flag	Default Value	Meaning
-cpu-limit	1	Hard CPU limit for browser container (no more than this limit is given)
-cpu-request	1	Soft (guaranteed) CPU limit for browser container
-memory-limit	1Gi	Hard memory limit for browser container
-memory-request	512Mi	Soft memory limit for browser container

You can also override the same values for every browser image in browsers list file:

Overriding Resources in Browsers List File

{
  "firefox": {
    "default": "62.0",
    "versions": {
      "62.0": {
        "image": "selenoid/firefox:62.0",
        "port": "4444",
        "path": "/wd/hub",
        "resources": {                              (1)
          "limits": {                               (2)
            "cpu": "2",                             (3)
            "memory": "2Gi"                         (4)
          },
          "requests": {                             (5)
            "cpu": "200m",                          (6)
            "memory": "1Gi"                         (7)
          }
        }
      }
    }
  }
}

1	Resources definition section
2	Limits definition section
3	CPU limit field
4	Memory limit field
5	Requests definition section
6	CPU request field
7	Memory request field

In some installations you may also want to completely disable CPU or memory limits for all browsers pods. This can be achieved with one of the following flags:

Table 8. Disabling Memory and CPU limits
Flag	Meaning
-disable-cpu-limits	Completely disables CPU limits for all browser pods
-disable-memory-limits	Completely disables memory limits for all browser pods

Service Images Resources Consumption

By default service images have the following resources requirements:

Table 9. Service Images Default Resources Limits
Name	CPU Limit	Memory Limit
defender	0.25	128Mi
logger	0.25	128Mi
videoRecorder	1.0	1024Mi

You can optionally adjust CPU and memory consumption for each service image in service.json configuration file similarly to browser images:

Adjusting memory and CPU limits for service images

{
  "images": {
    "logger": {
      "image": "my-registry.example.com/moon/logger:latest-release",
      "resources": {
        "limits": {
          "cpu": "0.3",
          "memory": "1024Mi"
        },
        "requests": {
          "cpu": "0.3",
          "memory": "1024Mi"
        }
      }
    }
  }
}

Pods Quality of Service

Browser automation stability and speed highly depends on how many computing resources are actually available to browser pods. Kubernetes has so-called Quality of Service (QoS) defining how many resources are assigned to pods being started. For stable browser automation we recommend always setting Guaranteed QoS class to Moon browser pods. To deliver this you have to make sure that requests and limits values for CPU and memory have equal values:

Moon by default sets requests equal to limits for service images like defender, logger and videoRecorder. But in recent releases you can override them independently if you wish.
For browser containers you can override requests and limits independently as shown above. Anyway we also recommend setting them to equal values. Only this way you will be sure that browsers are always getting the same computing resources. Otherwise you may encounter randomly failing browser tests caused by insufficient computing resources assigned to some browser pods.

2.7.5. Using Volumes

This was initially created for mounting really big files cached on Kubernetes nodes to browser containers. We do not recommend using the feature for uploading files to browser. Instead use standard Selenium file upload capability.

Currently Moon supports only mounting volumes from the Kubernetes node (hostPath volumes). Volumes are mounted only to browser container within browser pod. To add such volume - modify browsers list file as follows:

Mounting HostPath Volumes

{
  "firefox": {
    "default": "62.0",
    "versions": {
      "62.0": {
        "image": "selenoid/firefox:62.0",
        "port": "4444",
        "path": "/wd/hub",
        "volumes": ["/host/path:/mount/path/inside/container"]   (1)
      }
    }
  }
}

1	A list of hostPath volumes to mount

2.7.6. Running Browser Pods in Privileged Mode

In some cases like running Android emulators browser container should be run in privileged mode. This setting can be applied separately to each browser version in browsers list file as follows:

Starting Container in Privileged Mode

{
  "firefox": {
    "default": "62.0",
    "versions": {
      "62.0": {
        "image": "selenoid/firefox:62.0",
        "port": "4444",
        "path": "/wd/hub",
        "privileged": true                  (1)
      }
    }
  }
}

1	Launch container in privileged mode

2.7.7. Using Node Selectors

Sometimes you may need to run browser pods on particular Kubernetes nodes (i.e. hardware hosts) only. Kubernetes allows to do this by specifying so called node selectors. To provide such selector to Moon browser pods update browsers list as shown below:

Adding Node Selectors

{
  "firefox": {
    "default": "62.0",
    "versions": {
      "62.0": {
        "image": "selenoid/firefox:62.0",
        "port": "4444",
        "path": "/wd/hub",
        "nodeSelector": {                    (1)
          "node-type": "hardware"
        }
      }
    }
  }
}

1	Node selector for this browser version

2.7.8. Using Tolerations

Kubernetes has a cool feature called Taints allowing to fine tune pods scheduling across nodes. If you wish to run browser pods on tainted nodes - you have to adjust so-called tolerations, that is to say a number of conditions to match against tainted nodes. Moon is using exactly the same format as Kubernetes to define tolerations:

Adding Tolerations

{
  "firefox": {
    "default": "62.0",
    "versions": {
      "62.0": {
        "image": "selenoid/firefox:62.0",
        "port": "4444",
        "path": "/wd/hub",
        "tolerations": [                    (1)
            {
                "key": "key1",
                "operator": "Exists",
                "value": "value1",
                "effect": "NoExecute",
                "tolerationSeconds": 3600
            }
        ]
      }
    }
  }
}

1	A list of tolerations for this browser version

2.7.9. Using Custom Kubernetes Annotations

In some cases you may need to add custom Kubernetes annotations to started browser pods. Moon allows to configure custom annotations globally or individually for every browser version. Global annotations are configured in Configuration File (aka service.json) as follows:

Adding global annotations to service.json file

{
  "s3": {
    //...
  },
  "images": {
    //...
  },
  "annotations": {                                 (1)
    "key1": "value1",
    "key2": "value2"
  }
}

1	A list of global Kubernetes annotations

To configure Kubernetes annotations for single desired browser version - just add the same annotations section to Browsers List file as follows:

Adding annotations to browser version

{
  "firefox": {
    "default": "62.0",
    "versions": {
      "62.0": {
        "image": "selenoid/firefox:62.0",
        "port": "4444",
        "path": "/wd/hub",
        "annotations": {                           (1)
          "key1": "value1",
          "key2": "value2"
        }
      }
    }
  }
}

1	A list of Kubernetes annotations for this browser version

Moon adds some annotations by default to browser pods and their names are reserved:

Table 10. Moon Reserved Annotation Names
Key	Meaning
name	Custom session label passed in `name` capability
timeZone	Custom time zone value passed in `timeZone` capability

2.7.10. Using Custom Kubernetes Labels

In some cases you may need to add custom Kubernetes labels to started browser pods. Moon allows to configure custom labels globally or individually for every browser version. Similarly to annotations global labels are configured in Configuration File (aka service.json) as follows:

Adding global labels to service.json file

{
  "s3": {
    //...
  },
  "images": {
    //...
  },
  "labels": {           (1)
    "key1": "value1",
    "key2": "value2"
  }
}

1	A list of global Kubernetes labels

To configure Kubernetes labels for single desired browser version - just add the same labels section to Browsers List file as follows:

Adding labels to browser version

{
  "chrome": {
    "default": "77.0",
    "versions": {
      "77.0": {
        "image": "selenoid/chrome:77.0",
        "port": "4444",
        "labels": {                           (1)
          "key1": "value1",
          "key2": "value2"
        }
      }
    }
  }
}

1	A list of Kubernetes labels for this browser version

Moon adds some labels by default to browser pods and their names are reserved:

Table 11. Moon Reserved Label Names
Key	Meaning
app	Stores unique name for every pod
browserName	Stores `browserName` capability value
enableVideo	Stores `enableVideo` capability value
enableVNC	Stores `enableVNC` capability value
moon	System label, always equal to `browsers`
quota	Stores user quota name
screenResolution	Stores screen resolution requested by user
version	Stores `version` or `browserVersion` capability value

2.7.11. Using Custom Linux Kernel Capabilities

By default Moon starts all browser pods without any explicit Linux kernel capabilities. In some cases you may need to set custom Linux capabilities to started browser pods (e.g. SYS_ADMIN). Full list of such capabilities is available in Linux kernel source. Linux capabilities are configured in Configuration File (aka service.json) as follows:

Adding global Linux capabilities to service.json file

{
  "s3": {
    //...
  },
  "images": {
    //...
  },
  "kernelCaps": [ "NET_ADMIN", "KILL" ]   (1)
}

1	A list of global Linux capabilities

2.7.12. Using Custom Service Account

By default Moon is using service account named default to access Kubernetes API. In some cases you only have permissions for another service account, e.g. named moon. To use this service account with Moon you need to change deployment as follows:

Optionally create a service account as follows:

Creating custom service account

apiVersion: v1
kind: ServiceAccount
metadata:
  name: custom-moon-service-account # <== Insert desired service account name
  namespace: moon

Make sure you have respective Kubernetes Role and RoleBinding for desired service account:

Assigning roles to custom service account

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: moon
  name: moon
rules:
- apiGroups:
  - "*"
  resources:
  - "*"
  verbs:
  - "*"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: moon
  namespace: moon
roleRef:
  kind: Role
  name: moon
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  namespace: moon
  name: custom-moon-service-account # <== Insert name of service account to assign roles

Use your custom service account when deploying Moon pods:

Using custom service account for Mood pods

apiVersion: apps/v1
kind: Deployment
metadata:
    # ... deployment metadata definition
spec:
  replicas: 2
  selector:
    # ... selector definition
  template:
    metadata:
        # ... spec metadata definition
    spec:
      serviceAccountName: custom-moon-service-account # <== Insert name of service account here
      containers:
      - name: moon
        image: aerokube/moon:1.4.1
    # ... the rest of spec

2.7.13. Setting Custom User and Group Identifier to Browser Pods

Starting from release 1.4.2 by default Moon starts all browser pods with fixed UID 106 (selenium) and GID 65534 (nogroup). This allows to run browser pods even in restricted clusters without root permissions allowed. In order to change UID and GID values being set - use the following syntax in Browsers List file:

Setting customer user and group identifier

{
  "chrome": {
    "versions": {
    "default": "80.0",
      "80.0": {
        "image": "selenoid/chrome:80.0",
        "port": "4444",
        "runAs": {
          "user": 1000,                  (1)
          "group": 2000                  (2)
        }
      }
    }
  }
}

1	Custom user identifier (UID)
2	Custom group identifier (GID)

2.8. Log Files

Although Moon should just work out of the box, sometimes you may need the log output. Every Moon component is outputting logs to standard output (stdout) so you can use well-known kubectl commands to see the log:

$ kubectl get pods -n moon
NAME                    READY     STATUS    RESTARTS   AGE
moon-58f8b57966-s648q   1/1       Running   0          1m

Everything related to Selenium sessions is being output by moon container:

$ kubectl logs moon-58f8b57966-s648q -c moon -n moon
2019/05/03 11:20:37 [INIT] [Loading quota files from: quota]
2019/05/03 11:20:37 [INIT] [Quota configuration updated]
2019/05/03 11:20:37 [INIT] [Loading users from: users/users.htpasswd]
...

To follow the logs while running the tests add -f flag:

$ kubectl logs -f moon-58f8b57966-s648q -c moon -n moon

Every log line contains:

Table 12. Log entry contents
Field	Example	Notes
Time	2017/11/01 19:12:42	-
Status	[SESSION_ATTEMPTED]	See table below for complete list of statuses.
Additional fields	[my-user]	One or more sections showing additional information such as browser name, user name, IP address or error message
Duration	[4.15s]	For some log entries this field shows how much time operation took

The following statuses are available:

Table 13. Log entry statuses
Status	Description
AWAITING_DRIVER	Waiting for webdriver binary to start
BAD_LABEL	Wrong pod label is requested
BAD_REQUEST	Failed to process user request
BAD_RESOURCES	User incorrectly configured browser container resources
BAD_SCREEN_RESOLUTION	User requested to set wrong custom screen resolution
BAD_TIMEZONE	User requested to set wrong custom time zone inside container
BAD_TIMEOUT	User requested to set wrong session timeout
BAD_VIDEO_FRAME_RATE	User requested to capture video with wrong frame rate
BAD_VIDEO_SCREEN_SIZE	User requested to capture video with wrong screen size
CLIENT_DISCONNECTED	User disconnected and session was interrupted
CREATING_POD	Starting to create pod with browser
DELETING_POD	Starting to delete pod with browser
DELETING_SESSION	Received request to delete browser session
EMPTY_REQUEST	Received empty request from user
FAILED_TO_CREATE_POD	Failed to create browser pod
FAILED_TO_DELETE_POD	Failed to delete browser pod
FAILED_TO_DELETE_SESSION	Failed to delete browser session
FAILED_TO_GET_LOGS	Failed to get session logs
FORBIDDEN_TO_CREATE_POD	Kubernetes return forbidden status when creating pod
INIT	Service initialization messages
LOGS	Requested session logs
LOGS_CLIENT_DISCONNECTED	Client disconnected while streaming session logs
MALFORMED_VOLUME	Moon skipped malformed volume specification from `browsers.json`
POD_CREATED	Browser pod created
POD_DELETED	Browser pod deleted
PROXYING	Proxying requests to specified URL
PROXY_ERROR	Failed to proxy requests to specified URL
SERVER_ERROR	Failed to create pod or service due to internal server error (probably a bug)
DRIVER_IS_UP	Webdriver binary successfully started
SESSION_CREATED	Browser session successfully created
SESSION_DELETED	Session successfully deleted
SESSION_FAILED	Failed to create new session
SESSION_TIMED_OUT	Existing session timed out
SESSION_NOT_FOUND	Received request with empty session ID
SHUTTING_DOWN	Shutting down the service
STATUS_ERROR	Failed to refresh Moon status
STATUS_REQUEST	Received Moon status request
STATUS_REQUEST_ERROR	Failed to return Moon status
STOP_AWAITING_DRIVER	Stopped waiting for webdriver binary to start
UNSUPPORTED_BROWSER	User requested unsupported browser
USER_NOT_FOUND	Trying to request session with unknown user
VNC_CLIENT_DISCONNECTED	User disconnected while proxying VNC traffic
VNC_ERROR	An error occurred while proxying VNC traffic
VNC_SESSION	User requested VNC session
VNC_SESSION_CLOSED	User closed VNC session

You can also take a look at moon-api and moon-ui logs as follows:

$ kubectl logs -f moon-58f8b57966-s648q -c moon-api -n moon
$ kubectl logs -f moon-58f8b57966-s648q -c moon-ui -n moon

If you are encountering browser pods not being deleted - then take a look at defender container logs for every frozen browser pod:

$ kubectl logs chrome-73-0-ac15ffaa-e641-4c7f-a54c-f25b5be1f135 -c defender -n moon # Here chrome-73-0-ac15ffaa-e641-4c7f-a54c-f25b5be1f135 is Selenium session ID equal to browser pod name

2.9. CLI Flags

These flags should be specified in Kubernetes YAML files when starting the cluster.

2.9.1. Moon Container Flags

The following flags are supported:

-config-file string
    optional configuration file (default "config/service.json")
-cpu-limit string
    browser container cpu limit (default "1")
-cpu-request string
    browser container cpu request (default "0.5")
-credentials-dir string
    directory where credentials are mounted (default "credentials")
-disable-cpu-limits
    disable cpu limits for pods
-disable-memory-limits
    disable memory limits for pods
-domain-name string
    browsers service domain name (default "browsers")
-grace-period duration
    graceful shutdown (default 30s)
-guest-user string
    guest quota user name (default "browsers")
-license-file string
    path to license file (default "license/license.key")
-listen string
    address to bind (default ":4444")
-memory-limit string
    browser container memory limit (default "1Gi")
-memory-request string
    browser container memory request (default "512Mi")
-moon-url string
    moon service url (default "http://moon:4444/wd/hub")
-namespace string
    namespace
-quota-dir string
    quota directory (default "quota")
-service-account-name string
    service account name (default "default")
-session-attempt-timeout duration
    new session attempt timeout (default 30m0s)
-timeout duration
    override session timeout (default 1m0s)
-users-file string
    path to users file (default "users/users.htpasswd")
-version
    show version and exit

2.9.2. Moon API Container Flags

The following flags are supported:

-domain-name string
    browsers service domain name (default "browsers")
-grace-period duration
    graceful shutdown period (default 30s)
-guest-user string
    guest quota user name (default "browsers")
-license-file string
    path to license file (default "license/license.key")
-listen string
    address to bind (default ":8080")
-namespace string
    namespace
-quota-dir string
    quota directory (default "quota")
-sse-period duration
    sse refresh period (default 5s)
-version
    Show version and exit

3. Main Features

3.1. Special Capabilities

Moon supports a set of custom capabilities. You can pass them in tests to enable or disable some features.

3.1.1. Live Browser Screen: enableVNC

Moon supports showing browser screen during test execution. To see browser screen add capability:

Type: boolean

enableVNC: true

Browser screen will be shown in Selenoid UI.

3.1.2. Custom Screen Resolution: screenResolution

Moon allows you to set custom screen resolution in containers being run:

Type: string, format: <width>x<height>

screenResolution: "1280x1024"

You can optionally add colors depth:

Type: string, format: <width>x<height>x<colors-depth>

screenResolution: "1280x1024x24"

This capability sets only screen resolution - not browser window size. Most of browsers have some default window size value this is why your screenshot size can be smaller than screen resolution specified in capability. You should manually resize window to desired width and height or use Selenium maximize operation.

3.1.3. Android Skin: skin

When testing for Android platform you can select emulator skin with capabilities. List of available skins:

Table 14. Available Android Skins
Skin	Screen Resolution	DPI
QVGA	240x320	120
WQVGA400	240x400	120
WQVGA432	240x432	120
HVGA	320x480	160
WVGA800	480x800	240
WVGA854	480x854	240
WSVGA	1024x600	160
WXGA720	720x1280	320
WXGA800	1280x800	160
WXGA800-7in	800x1280	213

To select a skin - set skin capability:

Type: string, format: <desired-skin>

skin: "WXGA720"

You can also pass desired screen resolution as follows:

Type: string, format: <desired-screen-resolution>

skin: "720x1280"

3.1.4. Video Recording: enableVideo, videoName, videoScreenSize, videoFrameRate, videoCodec

To enable video recording for session, add:

Type: boolean

enableVideo: true

By default saved video files are named <session-id>.mp4 where <session-id> is a unique identifier of Selenium session. To provide custom video name specify:
Type: string
```
videoName: "my-cool-video.mp4"
```
It is important to add mp4 file extension.
By default the entire screen picture is being recorded. Specifying screenResolution capability changes recorded video size (width and height) accordingly. You can override video screen size by passing a capability. In case of videoScreenSize resolution is less than actual, screen on video will be trimmed starting from top-left corner:
Type: string
```
videoScreenSize: "1024x768"
```
Default video frame rate is 12 frames per second. Specifying videoFrameRate capability changes this value:
Type: int
```
videoFrameRate: 24
```
By default Moon is using libx264 codec for video output. If this codec is consuming too much CPU, you can change it using videoCodec capability:
Type: string
```
videoCodec: "mpeg4"
```

3.1.5. Custom Test Name: name

For debugging purposes it is often useful to give a distinct name to every test case. You can set test case name by passing the following capability:

Type: string

name: "myCoolTestName"

The main application of this capability - is debugging tests in the UI which is showing specified name for every running session.

3.1.6. Per-session Time Zone: timeZone

Some tests require particular time zone to be set in operating system.

Type: string

timeZone: "Europe/Moscow"

You can find most of available time zones here. Without this capability launched browser containers will have Moon timezone.

3.1.7. Per-session Environment Variables: env

Sometimes you may want to set some environment variables for every test case (for example to test with different default locales). To achieve this pass one more capability:

Type: array, format: <key>=<value>

env: ["LANG=ru_RU.UTF-8", "LANGUAGE=ru:en", "LC_ALL=ru_RU.UTF-8"]

Environment variables from this capability are appended to variables from configuration file.

3.1.8. Hosts Entries: hostsEntries

Although you can configure a separate list of /etc/hosts entries for every browser image in Browsers List sometimes you may need to add more entries for particular test cases. This can be easily achieved with:

Type: array, format: <hostname>:<ip-address>

hostsEntries: ["example.com:192.168.0.1", "test.com:192.168.0.2"]

Entries from this capability will be override /etc/hosts entries from browsers list file.

3.1.9. Custom Session Timeout: sessionTimeout

Sometimes you may want to change idle timeout for selected browser session. To achieve this - pass the following capability:

Type: string

sessionTimeout: "1m30s"

Timeout is always specified in Golang duration format, e.g. 30s or 2m or 1h2m30s and so on.

3.1.10. S3 Key Pattern: s3KeyPattern

This capability allows to override S3 key pattern (specified by s3 > keyPattern key in service.json) used when uploading files to S3.

Type: string

s3KeyPattern: "$quota/$browserName/$sessionId"

The same key placeholders are supported. Please refer to [Uploading Files To S3] section for more details.

3.1.11. Specifying Capabilities via Protocol Extensions

Some Selenium clients allow passing only a limited number of capabilities specified in WebDriver specification. For such cases Moon supports reading capabilities using WebDriver protocol extensions feature. The following two examples deliver the same result. Usually capabilities are passed like this:

Passing Capabilities as Usually

{"browserName": "firefox", "version": "62.0", "screenResolution": "1280x1024x24"}

Moon is using moon:options key to read protocol extension capabilities:

Passing Capabilities using Protocol Extensions

{"browserName": "firefox", "version": "62.0", "moon:options": {"screenResolution": "1280x1024x24"}}

3.2. Accessing Files Downloaded with Browser

Files are accessible only when browser session is running.

Your tests may need to download files with browsers. To analyze these files a common requirement is then to somehow extract downloaded files from browser containers. Moon provides a /download API dramatically simplifying downloading such files. To work with it:

Start a new session, for example with ID firefox-61-0-f2bcd32b-d932-4cdc-a639-687ab8e4f840.
In tests code save all files to ~/Downloads directory.

Access all downloaded files using an URL:

http://moon-host.example.com:4444/download/firefox-61-0-f2bcd32b-d932-4cdc-a639-687ab8e4f840/myfile.txt

Close the session

3.3. Accessing Clipboard

Clipboard is accessible only when browser session is running.

Sometimes you may need to interact with the clipboard to check that your application copy-paste feature works. Moon has a dedicated API to interact with the clipboard. To use it:

Start a new session, for example with ID firefox-61-0-f2bcd32b-d932-4cdc-a639-687ab8e4f840.

To get clipboard value send the following HTTP request:

$ curl http://moon-host.example.com:4444/clipboard/firefox-61-0-f2bcd32b-d932-4cdc-a639-687ab8e4f840

some-clipboard-value

To update clipboard value:

$ curl -X POST --data 'some-clipboard-value' http://moon-host.example.com:4444/clipboard/firefox-61-0-f2bcd32b-d932-4cdc-a639-687ab8e4f840

3.4. Accessing Browser Developer Tools

Currently only Chrome Developer Tools are supported.
This feature will work only for Chrome 63+.
We recommend to use the most recent Chrome version possible.

Moon is proxying Chrome Developer Tools API to browser container. For every running Selenium session to access the API just use the following URL:

<ws or http>://moon.example.com:4444/devtools/<session-id>/<method>

Here <method> is one of the following:

Table 15. Supported Developer Tools Methods
Method	Protocol	Meaning
/browser	WebSocket	Developer Tools browser websocket
/	WebSocket	An alias for /browser
/page	WebSocket	Developer Tools current page (target) websocket - mainly useful when only one browser tab is open
/page/<target-id>	WebSocket	Developer Tools specified page (target) websocket - allows to connect to concrete browser tab
/protocol/json	HTTP	A list of supported Developer Tools protocol methods in JSON format (some client libraries are using it)

For example an URL to connect to current page websocket would be:

ws://moon.example.com:4444/devtools/<session-id>/page

Accessing Developer Tools API with Webdriver.io and Puppeteer

const { remote } = require('webdriverio');
const puppeteer = require('puppeteer-core');
const host = 'moon.example.com';
(async () => {
    const browser = await remote({
        hostname: host,
        capabilities: {
            browserName: 'chrome',
            browserVersion: '75.0'
        }
    });

    const devtools = await puppeteer.connect(
        { browserWSEndpoint: `ws://${host}:4444/devtools/${browser.sessionId}` }
    );
    const page = await devtools.newPage();
    await page.goto('https://aerokube.com');
    await page.screenshot({path: 'screenshot.png'});
    const title = await page.title();

    console.log(title);

    await devtools.close();
    await browser.deleteSession();

})().catch((e) => console.error(e));

3.5. Changing Browser Locale

In some test cases you may need to override preferred browser locale. You can do this with standard Selenium capabilities. How to override locale depends on browser.

3.5.1. Firefox

Overriding Browser Locale in Firefox

FirefoxOptions options = new FirefoxOptions();
options.setCapability("browserVersion", "75.0");
options.addPreference("intl.accept_languages", "de");
WebDriver driver = new RemoteWebDriver(new URL("http://moon.example.com:4444/wd/hub"), options);

3.5.2. Chromium-based Browsers

Overriding Browser Locale in Chromium-base Browsers

ChromeOptions options = new ChromeOptions();
options.setCapability("browserVersion", "81.0");
options.setCapability("env", Arrays.asList("LANG=de_AT.UTF-8", "LANGUAGE=at:de", "LC_ALL=de_AT.UTF-8"));
WebDriver driver = new RemoteWebDriver(new URL("http://moon.example.com:4444/wd/hub"), options);

4. License Agreement

Last updated February 17th, 2019. Replaces the prior version in its entirety.

This is a legal agreement. By downloading, installing, copying, saving on Customer’s computer, or otherwise using Aerokube software, support or products Customer becomes a party to this Agreement and Customer consents to be bound by all the terms and conditions set forth below.

Parties
1. "Aerokube", "Licensor" or "We" means Aerokube Software OÜ, having its principal place of business at Harju maakond, Tallinn, Kesklinna linnaosa, Estonia pst 5-309B, 10143, Estonia, registered in the Commercial Register of Estonia, registry code: 14653208.
2. "Customer", "Licensee" or "You" means the sole proprietor or legal entity specified in the Subscription Confirmation. For legal entities, "Customer" includes any entity which controls, is controlled by, or is under common control with Customer. For the purposes of this definition, "control" means one of the following:
  1. The power, directly or indirectly, to direct or manage such entity, whether by contract or otherwise.
  2. Ownership of fifty percent (50%) or more of the outstanding shares or beneficial ownership of such entity.
Definitions
1. "Agreement" means this License Agreement.
2. "Product" means any generally available Licensor’s software product identified by Licensor as a software developer tool. For the avoidance of doubt, the Product is not produced to the specifications of Customer nor customized through modification or personalization, is intended for mass distribution, and no software code will be provided to Customer.
3. "User" means any employee, independent contractor or other personnel obtaining access to the Product(s) from Customer.
4. "Number of Concurrent Sessions" means maximum number of software testing processes being run using the Product in parallel. This can be for example browsers executing User’s tests.
5. "License Key" means a unique key-code that enables a Licensee to use the Product by unlocking the fixed Number of Concurrent Sessions. Only Licensor and/or its representatives are permitted to produce License Keys for the Product.
6. "Subscription" means an arrangement for making use of the Product of periodic nature on a prepayment plan. For the purpose of clarity, Subscription includes the subscription term, Products provided to Customer, subscription fees, payment schedules and fixed number of License Keys.
7. "Product Evaluation" means using the Product without a valid License Key.
8. "Subscription Confirmation" means an email confirming Customer’s rights to access and use Products, including total Number of Concurrent Sessions.
9. "Product Installation" means a Product copy running on Customer’s computer device, hardware server or virtual machine.
10. "Product Version" means a release, update, or upgrade of a particular Product that is not identified by Licensor as being made for the purpose of fixing software bugs.
11. "Bug Fix Update" for a particular Product Version means a software update or release that is specifically identified by Licensor as a bug fix for that Product Version.
12. "Fallback Date" means the date that was 12 months prior to the date of expiration of the Subscription.
13. "Fallback Version" means the most recent Product Version that Licensor made available for public purchase prior to the Fallback Date, along with any Bug Fix Updates for that Product Version. For the purpose of clarity, Fallback Version does not include any Product updates or upgrades other than Bug Fix Updates that Customer may have used in the period between the Fallback Date and the date of expiration of the Subscription.
14. "E-mail Support" means a form of customer support provided by the Licensor. At the time of writing, the corresponding e-mail address is support@aerokube.com; should the address be changed, the new address will be referred to on the Licensor’s web site.
15. "Instant Messaging Support" means a form of customer support provided by the Licensor. At the time of writing, the corresponding address to support channel is https://t.me/aerokube_moon; should the address be changed, the new address will be referred to on the Licensor’s web site.
16. "Affiliate" means any entity belonging to the same group as the Licensor.
How this Agreement Works
1. Entire Agreement. This Agreement, including the Third-Party Software license terms, constitutes the entire agreement between the parties concerning its subject matter and supersedes any prior agreements between Customer and Licensor regarding Customer’s use of any Products. No purchase order, other ordering document or any handwritten or typewritten text which purports to modify or supplement the printed text of this Agreement or any schedule will add to or vary the terms of this Agreement unless signed by both Customer and Licensor.
2. Reservation of Rights. Aerokube reserves the right at any time to cease the support of the Product and to alter prices, features, specifications, capabilities, functions, terms of use, release dates, general availability or other characteristics of the Product.
3. Changes to this Agreement. We may update or modify this Agreement from time to time, including any referenced policies and other documents. If a revision meaningfully reduces Customer’s rights, we will use reasonable efforts to notify Customer. If we modify this Agreement, the modified version of the Agreement will be effective from the start of the next Subscription term. In this case, if Customer objects to the updated Agreement terms, as Customer’s exclusive remedy, Customer may cancel the Subscription. Customer may be required to click through the updated Agreement to show its acceptance. For the avoidance of doubt, each Subscription Confirmation is subject to the version of the Agreement in effect on the Subscription Confirmation date.
4. Opportunity to Review. Customer hereby declares that Customer has had sufficient opportunity to review this Agreement, understand the content of all of its clauses, negotiate its terms, and seek independent professional legal advice in that respect before entering into it. Consequently, any statutory "form contract" ("adhesion contract") regulations shall not be applicable to this Agreement.
5. Severability. If a particular term of this Agreement is not enforceable, the unenforceability of that term will not affect any other terms of this Agreement.
6. Headings. Headings and titles are for convenience only and do not affect the interpretation of this Agreement.
7. No Waiver. Our failure to enforce or exercise any part of this Agreement is not a waiver of that section.
8. Notice. Aerokube may deliver any notice to Customer via electronic mail to an email address provided by Customer, registered mail, personal delivery or renowned express courier (such as DHL, FedEx or UPS). Any such notice will be deemed to be effective:
  1. On the day the notice is sent to Customer via email.
  2. Upon personal delivery.
  3. One (1) day after deposit with an express courier or five (5) days after deposit in the mail, whichever occurs first.
9. Governing Law. This Agreement will be governed by the laws of the Estonia, without reference to conflict of laws principles. Customer agrees that any litigation relating to this Agreement may only be brought in, and will be subject to the jurisdiction of, any competent court of the Estonia. The parties agree that the United Nations Convention on Contracts for the International Sale of Goods does not apply to this Agreement.
10. Exceptions or Modifications. For exceptions or modifications to this Agreement, please contact Aerokube at: support@aerokube.com In case the terms of this Agreement are in conflict with the terms of any agreement individually negotiated and agreed between Aerokube and Customer, the terms of the latter shall prevail.
11. Force Majeure. Except with respect to Customer’s payment obligations, neither party shall be liable to the other for any delay or failure to perform any obligation under this Agreement (except for a failure to pay fees) if the delay or failure is due to unforeseen events which occur after the signing of this Agreement and which are beyond the reasonable control of such party ("Force Majeure Event"), such as a strike, blockade, war, act of terrorism, riot, natural disaster, failure or diminishment of power or telecommunications or data networks or services, or refusal of a license by a government agency. In the event of a Force Majeure Event that prevents one part from substantially performing its obligations hereunder for a period of ten (10) days or more, either party may terminate this Agreement on five (5) days written notice.
Grant of Rights
1. The Product include code and libraries licensed to Licensor by third parties, including open source software.
2. The Product is provided basing on the Number of Concurrent Sessions. If Customer complies with the terms of this Agreement, Customer has the rights stipulated hereunder for each Subscription that Customer acquires. Customer’s rights acquired in relation to the Product are limited to those necessary to enable Customer and its Users to effectively operate the Product(s). All other rights remain reserved to Licensor.
3. Unless the Subscription has expired or this Agreement is terminated in accordance with respective section, and subject to the terms and conditions specified herein, Licensor grants Customer a non-exclusive and non-transferable right to use each Product covered by the Subscription as stipulated below.
4. Customer may:
  1. For each License Key included to Subscription have one Product Installation of any version covered by the Subscription on any operating system supported by the Product.
  2. Make one backup copy of the Product solely for archival/security backup purposes.
5. Customer may not:
  1. Allow the same Product Installation to be used concurrently by more than the Number of Concurrent Sessions specified for used License Key in Subscription Confirmation.
  2. Rent, lease, reproduce, modify, adapt, create derivative works of, distribute, sell, or transfer the Product.
  3. Provide access to the Product or the right to use the Product to a third party.
  4. Reverse engineer, decompile, disassemble, modify, translate, make any attempt to discover the source code of the Product.
  5. Remove or obscure any proprietary or other notices contained in the Product.
6. Following the expiration of this Agreement, the rights stipulated in "Grant of Rights" section shall continue on a perpetual, royalty-free, non-exclusive, and non-transferable basis for the continued use of a Fallback Version of each Product covered by the Subscription. The limitations set forth in this section apply to the usage of the Fallback Version. The rights granted in this section are expressly contingent upon Customer not being in breach of this Agreement, including having paid in full the applicable Subscription fees for the preceding 12 months or longer without interruption.
7. Customer acknowledges that no ownership right is conveyed to Customer under this Agreement, irrespective of the use of terms such as "purchase" or "sale". Licensor has and retains all rights, title and interest, including all intellectual property rights, in and to the Products and any and all related or underlying technology, and any modifications or derivative works thereof, including without limitation as they may incorporate Feedback (as defined below).
8. This Agreement applies whether Customer purchases a Subscription directly from Licensor or through resellers. If Customer purchases through a reseller, the Subscription details shall be as stated in the Subscription Confirmation issued by the reseller to Customer, and the reseller is responsible for the accuracy of any such Subscription Confirmation. Resellers are not authorized to make any promises or commitments on Licensor behalf, and Customer understands and agrees that Licensor is not bound by any obligations to Customer other than as specified in this Agreement.
Access to Products
1. All deliveries under this Agreement will be electronic. Customer and its Users must have an Internet connection in order to receive any deliveries. For the avoidance of doubt, Customer is responsible for downloading and installing the Products. Download instructions are made available on Licensor website at https://aerokube.com.
2. Customer enables full access to Product Installation by specifying a License Key from Subscription Confirmation.
3. Subject to the terms of this Agreement, Customer is granted a right to install and use the Product for evaluation purposes without charge for unlimited amount of time. The Product contains a feature that will automatically limit allowed Number of Concurrent Sessions. Licensor reserves the right at any time to change that limit in new Product versions.
Fees
1. Customer shall pay its Subscription fees in accordance with Licensor Terms of Purchase or the reseller’s terms of purchase, whichever are applicable.
2. The Subscription fees shall be paid in full, and any levies, duties and/or taxes imposed by Customer’s jurisdiction (including, but not limited to, value added tax, sales tax and withholding tax), shall be borne solely by Customer.
3. Customer may not deduct any amounts from fees payable to Licensor or the reseller, unless otherwise specified in the applicable terms of purchase.
Feedback
1. Customer has no obligation to provide Licensor with ideas, suggestions, or proposals ("Feedback").
2. If Customer or Users submit Feedback to Licensor, then Customer grants Licensor a non-exclusive, worldwide, royalty-free license that is sub-licensable and transferable, to make, use, sell, have made, offer to sell, import, reproduce, publicly display, distribute, modify, or publicly perform the Feedback in any manner without any obligation, royalty or restriction based on intellectual property rights or otherwise.
LIMITED WARRANTY

ALL PRODUCTS ARE PROVIDED TO CUSTOMER ON AN "AS IS" AND "AS AVAILABLE" BASIS WITHOUT WARRANTIES. USE OF THE PRODUCTS IS AT YOUR OWN RISK. AEROKUBE MAKES NO WARRANTY AS TO THEIR USE OR PERFORMANCE. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AEROKUBE, AND ITS SUPPLIERS (WHICH SHALL INCLUDE THE PROVIDERS OF THE THIRD PARTY SOFTWARE) AND RESELLERS, DISCLAIM ALL WARRANTIES AND CONDITIONS, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, WITH REGARD TO THE PRODUCTS, AND THE PROVISION OF OR FAILURE TO PROVIDE SUPPORT SERVICES. THIS LIMITED WARRANTY GIVES CUSTOMER SPECIFIC LEGAL RIGHTS. CUSTOMER MAY HAVE OTHER RIGHTS, WHICH VARY FROM STATE/JURISDICTION TO STATE/JURISDICTION. AEROKUBE (AND ITS AFFILIATES, AGENTS, DIRECTORS AND EMPLOYEES) DOES NOT WARRANT:
1. THAT THE PRODUCTS ARE ACCURATE, RELIABLE OR CORRECT
2. THAT THE PRODUCTS WILL MEET YOUR REQUIREMENTS
3. THAT THE PRODUCTS WILL BE AVAILABLE AT ANY PARTICULAR TIME OR LOCATION, UNINTERRUPTED OR SECURE
4. THAT ANY DEFECTS OR ERRORS WILL BE CORRECTED
5. THAT THE PRODUCTS ARE FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS
ANY CONTENT OR DATA DOWNLOADED OR OTHERWISE OBTAINED THROUGH THE USE OF THE PRODUCTS ARE DOWNLOADED AT YOUR OWN RISK AND YOU WILL BE SOLELY RESPONSIBLE FOR ANY DAMAGE TO YOUR PROPERTY OR LOSS OF DATA THAT RESULTS FROM SUCH DOWNLOAD. NO WARRANTY OR LIABILITY AT ALL IS GIVEN TO PRODUCTS UNDER EVALUATION.
DISCLAIMER OF DAMAGES
1. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL AEROKUBE (OR ITS AFFILIATES, AGENTS, DIRECTORS, OR EMPLOYEES), OR AEROKUBE LICENSORS, SUPPLIERS OR RESELLERS BE LIABLE TO CUSTOMER OR ANYONE ELSE FOR:
  1. ANY LOSS OF USE, DATA, GOODWILL, OR PROFITS, WHETHER OR NOT FORESEEABLE
  2. ANY LOSS OR DAMAGES IN CONNECTION WITH TERMINATION OR SUSPENSION OF CUSTOMER’S ACCESS TO OUR PRODUCTS IN ACCORDANCE WITH THIS AGREEMENT
  3. ANY SPECIAL, INCIDENTAL, INDIRECT, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES WHATSOEVER (EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF THESE DAMAGES), INCLUDING THOSE:
    
    RESULTING FROM LOSS OF USE, DATA, OR PROFITS, WHETHER OR NOT FORESEEABLE
    
    BASED ON ANY THEORY OF LIABILITY, INCLUDING BREACH OF CONTRACT OR WARRANTY, STRICT LIABILITY, NEGLIGENCE OR OTHER TORTIOUS ACTION
    
    ARISING FROM ANY OTHER CLAIM ARISING OUT OF OR IN CONNECTION WITH CUSTOMER’S USE OF OR ACCESS TO THE PRODUCTS OR SUPPORT.
2. THE FOREGOING LIMITATION OF LIABILITY SHALL APPLY TO THE FULLEST EXTENT PERMITTED BY LAW IN THE APPLICABLE JURISDICTION.
3. THE TOTAL LIABILITY IN ANY MATTER ARISING OUT OF OR IN RELATION TO THIS AGREEMENT IS LIMITED TO ONE HUNDRED (100) US DOLLARS OR THE AGGREGATE AMOUNT PAID OR PAYABLE BY THE CUSTOMER FOR PRODUCTS DURING THE THREE-MONTH PERIOD PRECEDING THE EVENT GIVING RISE TO THE LIABILITY, WHICHEVER IS GREATER. THIS LIMITATION WILL APPLY EVEN IF WE OR YOU HAVE BEEN ADVISED OF THE POSSIBILITY OF LIABILITY EXCEEDING SUCH AMOUNT AND NOTWITHSTANDING ANY FAILURE OF THE ESSENTIAL PURPOSE OF ANY LIMITED REMEDY.
Term and Termination
1. The term of this Agreement will commence upon acceptance of this Agreement by Customer as set forth in the preamble above, and will continue for each Product through the end of the applicable subscription period specified in the respective Subscription Confirmation. This Agreement will automatically renew with respect to each Product for a successive subscription term, unless terminated as set forth herein.
2. Customer may terminate this Agreement at any time by cancelling its Product subscription. If such termination occurs during a then-current subscription period, this Agreement will continue to be effective until the end of that subscription period. Such termination does not relieve Customer of the obligation to pay any outstanding subscription fees owed to Licensor, and no credits or refunds will be issued to Customer for prepaid subscription fees (except as specified in the Licensor Terms of Purchase, if applicable).
3. Licensor may terminate this agreement if:
  1. Customer has materially breached this Agreement and fails to cure such breach within thirty (30) days of written notice thereof.
  2. Customer fails to make the timely payment of subscription fees in accordance with "Fees" Section of this Agreement.
  3. Licensor is required to do so by law (for example, where the provision of the Product to Customer is, or becomes, unlawful).
  4. Licensor elects to discontinue providing the Product, in whole or in part.
4. Licensor will make reasonable efforts to notify Customer via email as follows:
  1. Thirty (30) days prior to termination of the Agreement when required to terminate by law or because of discontinued Product. In such events Customer will be entitled to a refund of the unused portion of prepaid subscription fees, if applicable.
  2. Three (3) days prior to termination of the Agreement in other cases. In such events Customer will not be entitled to any refund of the unused portion of prepaid subscription fees.
5. Survival. Upon the expiration or termination of this Agreement by Customer and if Customer elects to use the Fallback Version of the Product this Agreement statements will also survive with respect to said Fallback Version.
Temporary Suspension for Non-payment
Licensor reserves the right to suspend or limit Customer’s access to Aerokube Products if Customer fails to pay subscription fees on time.
If Licensor suspends or limits Customer’s access to Aerokube Products for non-payment according, Customer must pay all past due amounts in order to restore full access to Aerokube Products.
Customer hereby agrees that Licensor is entitled to charge Customer for the time period during which Customer has access to Aerokube Products until Customer or Licensor terminates or suspends Customer’s subscription in accordance with this Agreement.
Export Regulations

Customer shall comply with all applicable laws and regulations with regards to economic sanctions, export controls, import regulations, and trade embargoes (all herein referred to as "Sanctions"), including those of the European Union and United States (specifically the Export Administration Regulations (EAR)). Customer declares that it is not a person targeted by Sanctions nor is it otherwise owned or controlled by or acting on behalf of any person targeted by Sanctions. Further, Customer warrants that it will not download or otherwise export or re-export the Product or any related technical data directly or indirectly to any person targeted by Sanctions or download or otherwise use the Product for any end-use prohibited or restricted by Sanctions.
Customer Support
1. Licensor provides Email Support as well as Instant Messaging Support. The response time will be reasonable, but no specific response time guarantees are given.
2. Customer may request additional paid support from Licensor which is subject of a supplementary individually negotiated Agreement between Customer and Licensor.
3. Any guarantees of support availability only apply to the latest version of Licensed Software available in Customer Subscription.
Customer Data
1. Use of Name and Logo. Customer agrees that Licensor may identify it as a customer of Aerokube and may refer to it by name, trade name and trademark, if applicable. Licensor may also briefly describe Customer’s business in Licensor marketing materials, on the Aerokube website and/or in public or legal documents. Customer hereby grants Licensor a worldwide, non-exclusive and royalty-free license to use Customer’s name and any of Customer’s trade names and trademarks solely pursuant to this marketing section. Notwithstanding anything to the contrary herein, Licensor acknowledges that in some cases Customer licenses and does not own marks or logos (for example, marks or logos of the Affiliates) and cannot permit Licensor to use such marks.
2. Gathering of Usage Statistics. Customer acknowledges and agrees that the Product may contain a feature that reports the usage statistics, diagnostics information and usage meta-information of the Product back to the Licensor. Customer may opt out of the gathering of usage statistics by turning off this feature in the Product settings.

5. Pricing

Last updated August 7th, 2019. Replaces the prior version in its entirety.

Moon price is calculated using so-called Number of Concurrent Sessions that is to say total number of browser sessions being run in parallel. We control this by limiting total number of simultaneously running browser pods to the value you are purchasing.
When no license key is provided 4 (four) parallel browser sessions maximum are allowed. If such limit is sufficient for you - you are allowed use Moon without license key for unlimited period of time.
If free limit is insufficient - you need a paid license. Such license can include any desired number of parallel browser sessions (yes, even 42).
Every parallel session has a fixed cost - $5 USD (five United States dollars). If you are a EU-based company - then we convert the price to euro (€) and an additional VAT 20% applies.
An example price calculation
```
42 sessions * $5/month = $210/month
```

For simplicity we calculated monthly prices for some frequent cases:

Table 16. Moon License Pricing
Number of Parallel Sessions	Price per Month, USD
0-4	free
5	$25
10	$50
15	$75
20	$100
25	$125
30	$150
40	$200
50	$250
75	$375
100	$500
150	$750
200	$1000
250	$1250
500	$2500
750	$3750
1000	$5000

Appendix A: Cloud Platforms

Moon ready-to-use configurations are present in popular cloud platforms and can be run in a few clicks. This section contains step-by-step instructions on launching Moon in these platforms.

A.1. DigitalOcean

Moon can be run from DigitalOcean Marketplace as follows:

Go to Moon page:
Click on Create Moon button.
Choose a data center region near you:
Select a name for your cluster:
Click on Create Cluster button.
Wait for Kubernetes cluster to start. Follow instructions on the screen to configure access to cluster.
Go to Manage > Networking > Load Balancers and find IP address of Moon load balancer:
Moon user interface is available at http://<load-balancer-ip-address>:8080/. Selenium tests should be run against http://<load-balancer-ip-address>:4444/wd/hub.

A.2. Google Cloud

Moon can be run from Google Cloud Marketplace as follows:

Go to Moon page and click the Configure button:
Select a zone near you for a new Kubernetes cluster to be created and click on Create cluster button:
Wait for cluster to be created and click on Deploy button.
Wait for Moon to start (mainly you are waiting for the load balancer to initialize). You may need to refresh the page several times until correct URLs appear in Moon info section.
Click on Moon UI access URL to open Moon user interface. Use Moon Selenium access URL in your tests.