X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/d7c8ef4e435b88e9a45e5cd9fc2365fb82c9ab36..2ca9ee944a0bbeeb7226ea6fb6cd535b9ca8cbdb:/lib/service/cmd.go diff --git a/lib/service/cmd.go b/lib/service/cmd.go index dbafc89fe4..1073f421df 100644 --- a/lib/service/cmd.go +++ b/lib/service/cmd.go @@ -12,17 +12,21 @@ import ( "io" "net" "net/http" + "net/http/httptest" _ "net/http/pprof" "net/url" "os" "strings" + "time" "git.arvados.org/arvados.git/lib/cmd" "git.arvados.org/arvados.git/lib/config" "git.arvados.org/arvados.git/sdk/go/arvados" "git.arvados.org/arvados.git/sdk/go/ctxlog" + "git.arvados.org/arvados.git/sdk/go/health" "git.arvados.org/arvados.git/sdk/go/httpserver" "github.com/coreos/go-systemd/daemon" + "github.com/julienschmidt/httprouter" "github.com/prometheus/client_golang/prometheus" "github.com/sirupsen/logrus" ) @@ -30,6 +34,8 @@ import ( type Handler interface { http.Handler CheckHealth() error + // Done returns a channel that closes when the handler shuts + // itself down, or nil if this never happens. Done() <-chan struct{} } @@ -41,6 +47,8 @@ type command struct { ctx context.Context // enables tests to shutdown service; no public API yet } +var requestQueueDumpCheckInterval = time.Minute + // Command returns a cmd.Handler that loads site config, calls // newHandler with the current cluster and node configs, and brings up // an http server with the returned handler. @@ -70,6 +78,13 @@ func (c *command) RunCommand(prog string, args []string, stdin io.Reader, stdout loader := config.NewLoader(stdin, log) loader.SetupFlags(flags) + + // prog is [keepstore, keep-web, git-httpd, ...] but the + // legacy config flags are [-legacy-keepstore-config, + // -legacy-keepweb-config, -legacy-git-httpd-config, ...] + legacyFlag := "-legacy-" + strings.Replace(prog, "keep-", "keep", 1) + "-config" + args = loader.MungeLegacyConfigArgs(log, args, legacyFlag) + versionFlag := flags.Bool("version", false, "Write version information to stdout and exit 0") pprofAddr := flags.String("pprof", "", "Serve Go profile data at `[addr]:port`") if ok, code := cmd.ParseFlags(flags, prog, args, "", stderr); !ok { @@ -110,13 +125,24 @@ func (c *command) RunCommand(prog string, args []string, stdin io.Reader, stdout }) ctx := ctxlog.Context(c.ctx, logger) - listenURL, err := getListenAddr(cluster.Services, c.svcName, log) + listenURL, internalURL, err := getListenAddr(cluster.Services, c.svcName, log) if err != nil { return 1 } - ctx = context.WithValue(ctx, contextKeyURL{}, listenURL) + ctx = context.WithValue(ctx, contextKeyURL{}, internalURL) reg := prometheus.NewRegistry() + loader.RegisterMetrics(reg) + + // arvados_version_running{version="1.2.3~4"} 1.0 + mVersion := prometheus.NewGaugeVec(prometheus.GaugeOpts{ + Namespace: "arvados", + Name: "version_running", + Help: "Indicated version is running.", + }, []string{"version"}) + mVersion.WithLabelValues(cmd.Version.String()).Set(1) + reg.MustRegister(mVersion) + handler := c.newHandler(ctx, cluster, cluster.SystemRootToken, reg) if err = handler.CheckHealth(); err != nil { return 1 @@ -125,17 +151,23 @@ func (c *command) RunCommand(prog string, args []string, stdin io.Reader, stdout instrumented := httpserver.Instrument(reg, log, httpserver.HandlerWithDeadline(cluster.API.RequestTimeout.Duration(), httpserver.AddRequestIDs( - httpserver.LogRequests( - httpserver.NewRequestLimiter(cluster.API.MaxConcurrentRequests, handler, reg))))) + httpserver.Inspect(reg, cluster.ManagementToken, + httpserver.LogRequests( + interceptHealthReqs(cluster.ManagementToken, handler.CheckHealth, + &httpserver.RequestLimiter{ + Handler: handler, + MaxConcurrent: cluster.API.MaxConcurrentRequests, + MaxQueue: cluster.API.MaxQueuedRequests, + Registry: reg})))))) srv := &httpserver.Server{ Server: http.Server{ - Handler: instrumented.ServeAPI(cluster.ManagementToken, instrumented), + Handler: ifCollectionInHost(instrumented, instrumented.ServeAPI(cluster.ManagementToken, instrumented)), BaseContext: func(net.Listener) context.Context { return ctx }, }, Addr: listenURL.Host, } - if listenURL.Scheme == "https" { - tlsconfig, err := tlsConfigWithCertUpdater(cluster, logger) + if listenURL.Scheme == "https" || listenURL.Scheme == "wss" { + tlsconfig, err := makeTLSConfig(cluster, logger) if err != nil { logger.WithError(err).Errorf("cannot start %s service on %s", c.svcName, listenURL.String()) return 1 @@ -150,6 +182,7 @@ func (c *command) RunCommand(prog string, args []string, stdin io.Reader, stdout "URL": listenURL, "Listen": srv.Addr, "Service": c.svcName, + "Version": cmd.Version.String(), }).Info("listening") if _, err := daemon.SdNotify(false, "READY=1"); err != nil { logger.WithError(err).Errorf("error notifying init daemon") @@ -164,6 +197,7 @@ func (c *command) RunCommand(prog string, args []string, stdin io.Reader, stdout <-handler.Done() srv.Close() }() + go c.requestQueueDumpCheck(cluster, prog, reg, &srv.Server, logger) err = srv.Wait() if err != nil { return 1 @@ -171,28 +205,149 @@ func (c *command) RunCommand(prog string, args []string, stdin io.Reader, stdout return 0 } -func getListenAddr(svcs arvados.Services, prog arvados.ServiceName, log logrus.FieldLogger) (arvados.URL, error) { +// If SystemLogs.RequestQueueDumpDirectory is set, monitor the +// server's incoming HTTP request queue size. When it exceeds 90% of +// API.MaxConcurrentRequests, write the /_inspect/requests data to a +// JSON file in the specified directory. +func (c *command) requestQueueDumpCheck(cluster *arvados.Cluster, prog string, reg *prometheus.Registry, srv *http.Server, logger logrus.FieldLogger) { + outdir := cluster.SystemLogs.RequestQueueDumpDirectory + if outdir == "" || cluster.ManagementToken == "" { + return + } + logger = logger.WithField("worker", "RequestQueueDump") + outfile := outdir + "/" + prog + "-requests.json" + for range time.NewTicker(requestQueueDumpCheckInterval).C { + mfs, err := reg.Gather() + if err != nil { + logger.WithError(err).Warn("error getting metrics") + continue + } + dump := false + for _, mf := range mfs { + if mf.Name != nil && *mf.Name == "arvados_concurrent_requests" && len(mf.Metric) == 1 { + n := int(mf.Metric[0].GetGauge().GetValue()) + if n > 0 && n >= cluster.API.MaxConcurrentRequests*9/10 { + dump = true + break + } + } + } + if dump { + req, err := http.NewRequest("GET", "/_inspect/requests", nil) + if err != nil { + logger.WithError(err).Warn("error in http.NewRequest") + continue + } + req.Header.Set("Authorization", "Bearer "+cluster.ManagementToken) + resp := httptest.NewRecorder() + srv.Handler.ServeHTTP(resp, req) + if code := resp.Result().StatusCode; code != http.StatusOK { + logger.WithField("StatusCode", code).Warn("error getting /_inspect/requests") + continue + } + err = os.WriteFile(outfile, resp.Body.Bytes(), 0777) + if err != nil { + logger.WithError(err).Warn("error writing file") + continue + } + } + } +} + +// If an incoming request's target vhost has an embedded collection +// UUID or PDH, handle it with hTrue, otherwise handle it with +// hFalse. +// +// Facilitates routing "http://collections.example/metrics" to metrics +// and "http://{uuid}.collections.example/metrics" to a file in a +// collection. +func ifCollectionInHost(hTrue, hFalse http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if arvados.CollectionIDFromDNSName(r.Host) != "" { + hTrue.ServeHTTP(w, r) + } else { + hFalse.ServeHTTP(w, r) + } + }) +} + +func interceptHealthReqs(mgtToken string, checkHealth func() error, next http.Handler) http.Handler { + mux := httprouter.New() + mux.Handler("GET", "/_health/ping", &health.Handler{ + Token: mgtToken, + Prefix: "/_health/", + Routes: health.Routes{"ping": checkHealth}, + }) + mux.NotFound = next + return ifCollectionInHost(next, mux) +} + +// Determine listenURL (addr:port where server should bind) and +// internalURL (target url that client should connect to) for a +// service. +// +// If the config does not specify ListenURL, we check all of the +// configured InternalURLs. If there is exactly one that matches our +// hostname, or exactly one that matches a local interface address, +// then we use that as listenURL. +// +// Note that listenURL and internalURL may use different protocols +// (e.g., listenURL is http, but the service sits behind a proxy, so +// clients connect using https). +func getListenAddr(svcs arvados.Services, prog arvados.ServiceName, log logrus.FieldLogger) (arvados.URL, arvados.URL, error) { svc, ok := svcs.Map()[prog] if !ok { - return arvados.URL{}, fmt.Errorf("unknown service name %q", prog) + return arvados.URL{}, arvados.URL{}, fmt.Errorf("unknown service name %q", prog) } - if want := os.Getenv("ARVADOS_SERVICE_INTERNAL_URL"); want == "" { - } else if url, err := url.Parse(want); err != nil { - return arvados.URL{}, fmt.Errorf("$ARVADOS_SERVICE_INTERNAL_URL (%q): %s", want, err) - } else { + if want := os.Getenv("ARVADOS_SERVICE_INTERNAL_URL"); want != "" { + url, err := url.Parse(want) + if err != nil { + return arvados.URL{}, arvados.URL{}, fmt.Errorf("$ARVADOS_SERVICE_INTERNAL_URL (%q): %s", want, err) + } if url.Path == "" { url.Path = "/" } - return arvados.URL(*url), nil + for internalURL, conf := range svc.InternalURLs { + if internalURL.String() == url.String() { + listenURL := conf.ListenURL + if listenURL.Host == "" { + listenURL = internalURL + } + return listenURL, internalURL, nil + } + } + log.Warnf("possible configuration error: listening on %s (from $ARVADOS_SERVICE_INTERNAL_URL) even though configuration does not have a matching InternalURLs entry", url) + internalURL := arvados.URL(*url) + return internalURL, internalURL, nil } errors := []string{} - for url := range svc.InternalURLs { - listener, err := net.Listen("tcp", url.Host) + for internalURL, conf := range svc.InternalURLs { + listenURL := conf.ListenURL + if listenURL.Host == "" { + // If ListenURL is not specified, assume + // InternalURL is also usable as the listening + // proto/addr/port (i.e., simple case with no + // intermediate proxy/routing) + listenURL = internalURL + } + listenAddr := listenURL.Host + if _, _, err := net.SplitHostPort(listenAddr); err != nil { + // url "https://foo.example/" (with no + // explicit port name/number) means listen on + // the well-known port for the specified + // protocol, "foo.example:https". + port := listenURL.Scheme + if port == "ws" || port == "wss" { + port = "http" + port[2:] + } + listenAddr = net.JoinHostPort(listenAddr, port) + } + listener, err := net.Listen("tcp", listenAddr) if err == nil { listener.Close() - return url, nil + return listenURL, internalURL, nil } else if strings.Contains(err.Error(), "cannot assign requested address") { // If 'Host' specifies a different server than // the current one, it'll resolve the hostname @@ -200,13 +355,13 @@ func getListenAddr(svcs arvados.Services, prog arvados.ServiceName, log logrus.F // can't bind an IP address it doesn't own. continue } else { - errors = append(errors, fmt.Sprintf("tried %v, got %v", url, err)) + errors = append(errors, fmt.Sprintf("%s: %s", listenURL, err)) } } if len(errors) > 0 { - return arvados.URL{}, fmt.Errorf("could not enable the %q service on this host: %s", prog, strings.Join(errors, "; ")) + return arvados.URL{}, arvados.URL{}, fmt.Errorf("could not enable the %q service on this host: %s", prog, strings.Join(errors, "; ")) } - return arvados.URL{}, fmt.Errorf("configuration does not enable the %q service on this host", prog) + return arvados.URL{}, arvados.URL{}, fmt.Errorf("configuration does not enable the %q service on this host", prog) } type contextKeyURL struct{}