X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/604f652987e7200f24eec4e31393238ec3960989..refs/heads/20755-ec2-multiple-subnets:/lib/config/config.default.yml diff --git a/lib/config/config.default.yml b/lib/config/config.default.yml index cf9406b2bd..8260224ab7 100644 --- a/lib/config/config.default.yml +++ b/lib/config/config.default.yml @@ -223,9 +223,22 @@ Clusters: # parameter higher than this value, this value is used instead. MaxItemsPerResponse: 1000 - # Maximum number of concurrent requests to accept in a single - # service process, or 0 for no limit. - MaxConcurrentRequests: 64 + # Maximum number of concurrent requests to process concurrently + # in a single service process, or 0 for no limit. + MaxConcurrentRequests: 4 + + # Maximum number of incoming requests to hold in a priority + # queue waiting for one of the MaxConcurrentRequests slots to be + # free. When the queue is longer than this, respond 503 to the + # lowest priority request. + # + # If MaxQueuedRequests is 0, respond 503 immediately to + # additional requests while at the MaxConcurrentRequests limit. + MaxQueuedRequests: 128 + + # Maximum time a "lock container" request is allowed to wait in + # the incoming request queue before returning 503. + MaxQueueTimeForLockRequests: 2s # Fraction of MaxConcurrentRequests that can be "log create" # messages at any given time. This is to prevent logging @@ -399,6 +412,48 @@ Clusters: # Use 0 to disable activity logging. ActivityLoggingPeriod: 24h + # The SyncUser* options control what system resources are managed by + # arvados-login-sync on shell nodes. They correspond to: + # * SyncUserAccounts: The user's Unix account on the shell node + # * SyncUserGroups: The group memberships of that account + # * SyncUserSSHKeys: Whether to authorize the user's Arvados SSH keys + # * SyncUserAPITokens: Whether to set up the user's Arvados API token + # All default to true. + SyncUserAccounts: true + SyncUserGroups: true + SyncUserSSHKeys: true + SyncUserAPITokens: true + + # If SyncUserGroups=true, then arvados-login-sync will ensure that all + # managed accounts are members of the Unix groups listed in + # SyncRequiredGroups, in addition to any groups listed in their Arvados + # login permission. The default list includes the "fuse" group so + # users can use arv-mount. You can require no groups by specifying an + # empty list (i.e., `SyncRequiredGroups: []`). + SyncRequiredGroups: + - fuse + + # SyncIgnoredGroups is a list of group names. arvados-login-sync will + # never modify these groups. If user login permissions list any groups + # in SyncIgnoredGroups, they will be ignored. If a user's Unix account + # belongs to any of these groups, arvados-login-sync will not remove + # the account from that group. The default is a set of particularly + # security-sensitive groups across Debian- and Red Hat-based + # distributions. + SyncIgnoredGroups: + - adm + - disk + - kmem + - mem + - root + - shadow + - staff + - sudo + - sys + - utempter + - utmp + - wheel + AuditLogs: # Time to keep audit logs, in seconds. (An audit log is a row added # to the "logs" table in the PostgreSQL database each time an @@ -442,6 +497,15 @@ Clusters: # params_truncated. MaxRequestLogParamsSize: 2000 + # In all services except RailsAPI, periodically check whether + # the incoming HTTP request queue is nearly full (see + # MaxConcurrentRequests) and, if so, write a snapshot of the + # request queue to {service}-requests.json in the specified + # directory. + # + # Leave blank to disable. + RequestQueueDumpDirectory: "" + Collections: # Enable access controls for data stored in Keep. This should @@ -1010,7 +1074,7 @@ Clusters: # Number of times a container can be unlocked before being # automatically cancelled. - MaxDispatchAttempts: 5 + MaxDispatchAttempts: 10 # Default value for container_count_max for container requests. This is the # number of times Arvados will create a new container to satisfy a container @@ -1042,6 +1106,10 @@ Clusters: # cloud dispatcher for executing containers on worker VMs. # Begins with "-----BEGIN RSA PRIVATE KEY-----\n" # and ends with "\n-----END RSA PRIVATE KEY-----\n". + # + # Use "file:///absolute/path/to/key" to load the key from a + # separate file instead of embedding it in the configuration + # file. DispatchPrivateKey: "" # Maximum time to wait for workers to come up before abandoning @@ -1146,6 +1214,8 @@ Clusters: # Maximum bytes that may be logged by a single job. Log bytes that are # silenced by throttling are not counted against this total. + # If you set this to zero, each container will only create a single + # log on the API server, noting for users that logging is throttled. LimitLogBytesPerJob: 67108864 LogPartialLineThrottlePeriod: 5s @@ -1343,10 +1413,30 @@ Clusters: # down. MaxInstances: 64 - # Maximum fraction of CloudVMs.MaxInstances allowed to run - # "supervisor" containers at any given time. A supervisor is a - # container whose purpose is mainly to submit and manage other - # containers, such as arvados-cwl-runner workflow runner. + # The minimum number of instances expected to be runnable + # without reaching a provider-imposed quota. + # + # This is used as the initial value for the dispatcher's + # dynamic instance limit, which increases (up to MaxInstances) + # as containers start up successfully and decreases in + # response to high API load and cloud quota errors. + # + # Setting this too high creates a risk that the dispatcher + # will cause deadlock by starting so many supervisor + # containers (based on SupervisorFraction and MaxInstances) + # that the cloud quota prevents them from running any child + # containers. + # + # Setting this too low causes the dispatcher to be + # unnecessarily slow to start up new instances after a + # restart. + InitialQuotaEstimate: 16 + + # Maximum fraction of available instance capacity allowed to + # run "supervisor" containers at any given time. A supervisor + # is a container whose purpose is mainly to submit and manage + # other containers, such as arvados-cwl-runner workflow + # runner. # # If there is a hard limit on the amount of concurrent # containers that the cluster can run, it is important to @@ -1388,6 +1478,12 @@ Clusters: # https://xxxxx.blob.core.windows.net/system/Microsoft.Compute/Images/images/xxxxx.vhd ImageID: "" + # Shell script to run on new instances using the cloud + # provider's UserData (EC2) or CustomData (Azure) feature. + # + # It is not necessary to include a #!/bin/sh line. + InstanceInitCommand: "" + # An executable file (located on the dispatcher host) to be # copied to cloud instances at runtime and used as the # container runner/supervisor. The default value is the @@ -1398,6 +1494,12 @@ Clusters: # version of crunch-run installed; see CrunchRunCommand above. DeployRunnerBinary: "/proc/self/exe" + # Install the Dispatcher's SSH public key (derived from + # DispatchPrivateKey) when creating new cloud + # instances. Change this to false if you are using a different + # mechanism to pre-install the public key on new instances. + DeployPublicKey: true + # Tags to add on all resources (VMs, NICs, disks) created by # the container dispatcher. (Arvados's own tags -- # InstanceType, IdleBehavior, and InstanceSecret -- will also @@ -1429,10 +1531,23 @@ Clusters: SecretAccessKey: "" # (ec2) Instance configuration. + + # (ec2) Region, like "us-east-1". + Region: "" + + # (ec2) Security group IDs. Omit or use {} to use the + # default security group. SecurityGroupIDs: "SAMPLE": {} + + # (ec2) One or more subnet IDs. Omit or leave empty to let + # AWS choose a default subnet from your default VPC. If + # multiple subnets are configured here (enclosed in brackets + # like [subnet-abc123, subnet-def456]) the cloud dispatcher + # will detect subnet-related errors and retry using a + # different subnet. Most sites specify one subnet. SubnetID: "" - Region: "" + EBSVolumeType: gp2 AdminUsername: debian # (ec2) name of the IAMInstanceProfile for instances started by