Merge branch '17609-diagnostics-cmd'
authorTom Clegg <tom@curii.com>
Fri, 18 Jun 2021 14:58:36 +0000 (10:58 -0400)
committerTom Clegg <tom@curii.com>
Fri, 18 Jun 2021 14:58:36 +0000 (10:58 -0400)
closes #17609

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@curii.com>

cmd/arvados-client/cmd.go
go.mod
go.sum
lib/cmd/cmd.go
lib/costanalyzer/cmd.go
lib/costanalyzer/costanalyzer.go
lib/deduplicationreport/command.go
lib/diagnostics/cmd.go [new file with mode: 0644]

index aefcce79a45a4eb65fbbed209801d684da6b4923..cb15462119d4d1d3368382e1cbbcceafba40464f 100644 (file)
@@ -11,6 +11,7 @@ import (
        "git.arvados.org/arvados.git/lib/cmd"
        "git.arvados.org/arvados.git/lib/costanalyzer"
        "git.arvados.org/arvados.git/lib/deduplicationreport"
+       "git.arvados.org/arvados.git/lib/diagnostics"
        "git.arvados.org/arvados.git/lib/mount"
 )
 
@@ -59,6 +60,7 @@ var (
                "costanalyzer":         costanalyzer.Command,
                "shell":                shellCommand{},
                "connect-ssh":          connectSSHCommand{},
+               "diagnostics":          diagnostics.Command{},
        })
 )
 
diff --git a/go.mod b/go.mod
index 0ff679a576e232d318bdc14873069115036967bc..b70f6f3b476789f69f1845bffb6bfd4fcac80885 100644 (file)
--- a/go.mod
+++ b/go.mod
@@ -55,12 +55,14 @@ require (
        github.com/prometheus/common v0.7.0
        github.com/satori/go.uuid v1.2.1-0.20180103174451-36e9d2ebbde5 // indirect
        github.com/sergi/go-diff v1.0.0 // indirect
-       github.com/sirupsen/logrus v1.4.2
+       github.com/sirupsen/logrus v1.8.1
        github.com/src-d/gcfg v1.3.0 // indirect
        github.com/xanzy/ssh-agent v0.1.0 // indirect
        golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
        golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4
        golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45
+       golang.org/x/sys v0.0.0-20210603125802-9665404d3644
+       golang.org/x/tools v0.1.0 // indirect
        golang.org/x/sys v0.0.0-20210510120138-977fb7262007
        golang.org/x/tools v0.1.2 // indirect
        google.golang.org/api v0.13.0
diff --git a/go.sum b/go.sum
index c28ab4624038a143a4d9adf8a9e2593d123183c0..1fd37ed11ce411e625518eb3189c225e80b74616 100644 (file)
--- a/go.sum
+++ b/go.sum
@@ -234,6 +234,8 @@ github.com/shabbyrobe/gocovmerge v0.0.0-20180507124511-f6ea450bfb63/go.mod h1:n+
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
+github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/spf13/afero v1.2.1 h1:qgMbHoJbPbw579P+1zVY+6n4nIFuIchaIjzZ/I/Yq8M=
 github.com/spf13/afero v1.2.1/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
 github.com/src-d/gcfg v1.3.0 h1:2BEDr8r0I0b8h/fOqwtxCEiq2HJu8n2JGZJQFGXWLjg=
@@ -309,10 +311,13 @@ golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191010194322-b09406accb47/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4 h1:myAQVi0cGEoqQVR5POX+8RR2mrocKqNN1hmeMqhX27k=
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210603125802-9665404d3644 h1:CA1DEQ4NdKphKeL70tvsWNdT5oFh1lOjihRcEDROi0I=
+golang.org/x/sys v0.0.0-20210603125802-9665404d3644/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007 h1:gG67DSER+11cZvqIMb8S8bt0vZtiN6xWYARwirrOSfE=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
index b7d918739b86de347b0960e785bbd27dea477fba..63d7576b4cc1964b11b29a8ac199730660325f2e 100644 (file)
@@ -16,6 +16,8 @@ import (
        "runtime"
        "sort"
        "strings"
+
+       "github.com/sirupsen/logrus"
 )
 
 type Handler interface {
@@ -153,3 +155,9 @@ func SubcommandToFront(args []string, flagset FlagSet) []string {
        copy(newargs[flagargs+1:], args[flagargs+1:])
        return newargs
 }
+
+type NoPrefixFormatter struct{}
+
+func (NoPrefixFormatter) Format(entry *logrus.Entry) ([]byte, error) {
+       return []byte(entry.Message + "\n"), nil
+}
index 525ec619b5e4aeeb0b4e271704f13385a41bcefd..6065ad2c0b2cb934607826d8500215bbabf0d868 100644 (file)
@@ -8,8 +8,8 @@ import (
        "io"
        "time"
 
+       "git.arvados.org/arvados.git/lib/cmd"
        "git.arvados.org/arvados.git/sdk/go/ctxlog"
-       "github.com/sirupsen/logrus"
 )
 
 var Command = command{}
@@ -22,24 +22,17 @@ type command struct {
        end        time.Time
 }
 
-type NoPrefixFormatter struct{}
-
-func (f *NoPrefixFormatter) Format(entry *logrus.Entry) ([]byte, error) {
-       return []byte(entry.Message), nil
-}
-
 // RunCommand implements the subcommand "costanalyzer <collection> <collection> ..."
 func (c command) RunCommand(prog string, args []string, stdin io.Reader, stdout, stderr io.Writer) int {
        var err error
        logger := ctxlog.New(stderr, "text", "info")
+       logger.SetFormatter(cmd.NoPrefixFormatter{})
        defer func() {
                if err != nil {
-                       logger.Error("\n" + err.Error() + "\n")
+                       logger.Error("\n" + err.Error())
                }
        }()
 
-       logger.SetFormatter(new(NoPrefixFormatter))
-
        exitcode, err := c.costAnalyzer(prog, args, logger, stdout, stderr)
 
        return exitcode
index edaaa5bd178243f2c9044d32398c5ddccc67b5dc..dfe3d584cec7a7f07d16ec2e3c267e760201d8dc 100644 (file)
@@ -9,9 +9,6 @@ import (
        "errors"
        "flag"
        "fmt"
-       "git.arvados.org/arvados.git/sdk/go/arvados"
-       "git.arvados.org/arvados.git/sdk/go/arvadosclient"
-       "git.arvados.org/arvados.git/sdk/go/keepclient"
        "io"
        "io/ioutil"
        "net/http"
@@ -20,6 +17,9 @@ import (
        "strings"
        "time"
 
+       "git.arvados.org/arvados.git/sdk/go/arvados"
+       "git.arvados.org/arvados.git/sdk/go/arvadosclient"
+       "git.arvados.org/arvados.git/sdk/go/keepclient"
        "github.com/sirupsen/logrus"
 )
 
@@ -169,7 +169,7 @@ Options:
        }
        logger.SetLevel(lvl)
        if !c.cache {
-               logger.Debug("Caching disabled\n")
+               logger.Debug("Caching disabled")
        }
        return
 }
@@ -249,12 +249,12 @@ func loadCachedObject(logger *logrus.Logger, file string, uuid string, object in
        case *arvados.ContainerRequest:
                if v.State == arvados.ContainerRequestStateFinal {
                        reload = false
-                       logger.Debugf("Loaded object %s from local cache (%s)\n", uuid, file)
+                       logger.Debugf("Loaded object %s from local cache (%s)", uuid, file)
                }
        case *arvados.Container:
                if v.State == arvados.ContainerStateComplete || v.State == arvados.ContainerStateCancelled {
                        reload = false
-                       logger.Debugf("Loaded object %s from local cache (%s)\n", uuid, file)
+                       logger.Debugf("Loaded object %s from local cache (%s)", uuid, file)
                }
        }
        return
@@ -384,7 +384,7 @@ func handleProject(logger *logrus.Logger, uuid string, arv *arvadosclient.Arvado
                return nil, fmt.Errorf("error querying container_requests: %s", err.Error())
        }
        if value, ok := childCrs["items"]; ok {
-               logger.Infof("Collecting top level container requests in project %s\n", uuid)
+               logger.Infof("Collecting top level container requests in project %s", uuid)
                items := value.([]interface{})
                for _, item := range items {
                        itemMap := item.(map[string]interface{})
@@ -397,7 +397,7 @@ func handleProject(logger *logrus.Logger, uuid string, arv *arvadosclient.Arvado
                        }
                }
        } else {
-               logger.Infof("No top level container requests found in project %s\n", uuid)
+               logger.Infof("No top level container requests found in project %s", uuid)
        }
        return
 }
@@ -410,7 +410,7 @@ func generateCrCsv(logger *logrus.Logger, uuid string, arv *arvadosclient.Arvado
        var tmpCsv string
        var tmpTotalCost float64
        var totalCost float64
-       fmt.Printf("Processing %s\n", uuid)
+       logger.Debugf("Processing %s", uuid)
 
        var crUUID = uuid
        if strings.Contains(uuid, "-4zz18-") {
@@ -438,7 +438,7 @@ func generateCrCsv(logger *logrus.Logger, uuid string, arv *arvadosclient.Arvado
        }
        if len(cr.ContainerUUID) == 0 {
                // Nothing to do! E.g. a CR in 'Uncommitted' state.
-               logger.Infof("No container associated with container request %s, skipping\n", crUUID)
+               logger.Infof("No container associated with container request %s, skipping", crUUID)
                return nil, nil
        }
        var container arvados.Container
@@ -473,14 +473,20 @@ func generateCrCsv(logger *logrus.Logger, uuid string, arv *arvadosclient.Arvado
                return nil, fmt.Errorf("error querying container_requests: %s", err.Error())
        }
        logger.Infof("Collecting child containers for container request %s (%s)", crUUID, container.FinishedAt)
-       for _, cr2 := range childCrs.Items {
-               logger.Info(".")
+       progressTicker := time.NewTicker(5 * time.Second)
+       defer progressTicker.Stop()
+       for i, cr2 := range childCrs.Items {
+               select {
+               case <-progressTicker.C:
+                       logger.Infof("... %d of %d", i+1, len(childCrs.Items))
+               default:
+               }
                node, err := getNode(arv, ac, kc, cr2)
                if err != nil {
                        logger.Errorf("Skipping container request %s: error getting node %s: %s", cr2.UUID, cr2.UUID, err)
                        continue
                }
-               logger.Debug("\nChild container: " + cr2.ContainerUUID + "\n")
+               logger.Debug("Child container: " + cr2.ContainerUUID)
                var c2 arvados.Container
                err = loadObject(logger, ac, cr.UUID, cr2.ContainerUUID, cache, &c2)
                if err != nil {
@@ -491,7 +497,7 @@ func generateCrCsv(logger *logrus.Logger, uuid string, arv *arvadosclient.Arvado
                csv += tmpCsv
                totalCost += tmpTotalCost
        }
-       logger.Info(" done\n")
+       logger.Debug("Done collecting child containers")
 
        csv += "TOTAL,,,,,,,,," + strconv.FormatFloat(totalCost, 'f', 8, 64) + "\n"
 
@@ -502,7 +508,7 @@ func generateCrCsv(logger *logrus.Logger, uuid string, arv *arvadosclient.Arvado
                if err != nil {
                        return nil, fmt.Errorf("error writing file with path %s: %s", fName, err.Error())
                }
-               logger.Infof("\nUUID report in %s\n\n", fName)
+               logger.Infof("\nUUID report in %s", fName)
        }
 
        return
@@ -562,7 +568,7 @@ func (c *command) costAnalyzer(prog string, args []string, logger *logrus.Logger
 
                                err := ac.RequestAndDecode(&list, "GET", "arvados/v1/container_requests", nil, params)
                                if err != nil {
-                                       logger.Errorf("Error getting container request list from Arvados API: %s\n", err)
+                                       logger.Errorf("Error getting container request list from Arvados API: %s", err)
                                        break
                                }
                                if len(list.Items) == 0 {
@@ -581,7 +587,7 @@ func (c *command) costAnalyzer(prog string, args []string, logger *logrus.Logger
        cost := make(map[string]float64)
 
        for uuid := range uuidChannel {
-               fmt.Printf("Considering %s\n", uuid)
+               logger.Debugf("Considering %s", uuid)
                if strings.Contains(uuid, "-j7d0g-") {
                        // This is a project (group)
                        cost, err = handleProject(logger, uuid, arv, ac, kc, c.resultsDir, c.cache)
@@ -611,14 +617,14 @@ func (c *command) costAnalyzer(prog string, args []string, logger *logrus.Logger
                        // keep going.
                        logger.Errorf("cost analysis is not supported for the 'Home' project: %s", uuid)
                } else {
-                       logger.Errorf("this argument does not look like a uuid: %s\n", uuid)
+                       logger.Errorf("this argument does not look like a uuid: %s", uuid)
                        exitcode = 3
                        return
                }
        }
 
        if len(cost) == 0 {
-               logger.Info("Nothing to do!\n")
+               logger.Info("Nothing to do!")
                return
        }
 
@@ -646,7 +652,7 @@ func (c *command) costAnalyzer(prog string, args []string, logger *logrus.Logger
                        exitcode = 1
                        return
                }
-               logger.Infof("Aggregate cost accounting for all supplied uuids in %s\n", aFile)
+               logger.Infof("Aggregate cost accounting for all supplied uuids in %s", aFile)
        }
 
        // Output the total dollar amount on stdout
index 93cdb61d3b86a8bae2dce3dee1a3be2e5fbacbc0..39bbbc9498c2b10055dff1d24227275ec6ae1fba 100644 (file)
@@ -7,20 +7,14 @@ package deduplicationreport
 import (
        "io"
 
+       "git.arvados.org/arvados.git/lib/cmd"
        "git.arvados.org/arvados.git/sdk/go/ctxlog"
-       "github.com/sirupsen/logrus"
 )
 
 var Command command
 
 type command struct{}
 
-type NoPrefixFormatter struct{}
-
-func (f *NoPrefixFormatter) Format(entry *logrus.Entry) ([]byte, error) {
-       return []byte(entry.Message + "\n"), nil
-}
-
 // RunCommand implements the subcommand "deduplication-report <collection> <collection> ..."
 func (command) RunCommand(prog string, args []string, stdin io.Reader, stdout, stderr io.Writer) int {
        var err error
@@ -31,7 +25,7 @@ func (command) RunCommand(prog string, args []string, stdin io.Reader, stdout, s
                }
        }()
 
-       logger.SetFormatter(new(NoPrefixFormatter))
+       logger.SetFormatter(cmd.NoPrefixFormatter{})
 
        exitcode := report(prog, args, logger, stdout, stderr)
 
diff --git a/lib/diagnostics/cmd.go b/lib/diagnostics/cmd.go
new file mode 100644 (file)
index 0000000..b0241b3
--- /dev/null
@@ -0,0 +1,612 @@
+// Copyright (C) The Arvados Authors. All rights reserved.
+//
+// SPDX-License-Identifier: AGPL-3.0
+
+package diagnostics
+
+import (
+       "bytes"
+       "context"
+       "flag"
+       "fmt"
+       "io"
+       "io/ioutil"
+       "net"
+       "net/http"
+       "net/url"
+       "strings"
+       "time"
+
+       "git.arvados.org/arvados.git/sdk/go/arvados"
+       "git.arvados.org/arvados.git/sdk/go/ctxlog"
+       "github.com/sirupsen/logrus"
+)
+
+type Command struct{}
+
+func (cmd Command) RunCommand(prog string, args []string, stdin io.Reader, stdout, stderr io.Writer) int {
+       var diag diagnoser
+       f := flag.NewFlagSet(prog, flag.ContinueOnError)
+       f.StringVar(&diag.projectName, "project-name", "scratch area for diagnostics", "name of project to find/create in home project and use for temporary/test objects")
+       f.StringVar(&diag.logLevel, "log-level", "info", "logging level (debug, info, warning, error)")
+       f.BoolVar(&diag.checkInternal, "internal-client", false, "check that this host is considered an \"internal\" client")
+       f.BoolVar(&diag.checkExternal, "external-client", false, "check that this host is considered an \"external\" client")
+       f.IntVar(&diag.priority, "priority", 500, "priority for test container (1..1000, or 0 to skip)")
+       f.DurationVar(&diag.timeout, "timeout", 10*time.Second, "timeout for http requests")
+       err := f.Parse(args)
+       if err == flag.ErrHelp {
+               return 0
+       } else if err != nil {
+               fmt.Fprintln(stderr, err)
+               return 2
+       }
+       diag.logger = ctxlog.New(stdout, "text", diag.logLevel)
+       diag.logger.SetFormatter(&logrus.TextFormatter{DisableTimestamp: true, DisableLevelTruncation: true, PadLevelText: true})
+       diag.runtests()
+       if len(diag.errors) == 0 {
+               diag.logger.Info("--- no errors ---")
+               return 0
+       } else {
+               if diag.logger.Level > logrus.ErrorLevel {
+                       fmt.Fprint(stdout, "\n--- cut here --- error summary ---\n\n")
+                       for _, e := range diag.errors {
+                               diag.logger.Error(e)
+                       }
+               }
+               return 1
+       }
+}
+
+type diagnoser struct {
+       stdout        io.Writer
+       stderr        io.Writer
+       logLevel      string
+       priority      int
+       projectName   string
+       checkInternal bool
+       checkExternal bool
+       timeout       time.Duration
+       logger        *logrus.Logger
+       errors        []string
+       done          map[int]bool
+}
+
+func (diag *diagnoser) debugf(f string, args ...interface{}) {
+       diag.logger.Debugf("  ... "+f, args...)
+}
+
+func (diag *diagnoser) infof(f string, args ...interface{}) {
+       diag.logger.Infof("  ... "+f, args...)
+}
+
+func (diag *diagnoser) warnf(f string, args ...interface{}) {
+       diag.logger.Warnf("  ... "+f, args...)
+}
+
+func (diag *diagnoser) errorf(f string, args ...interface{}) {
+       diag.logger.Errorf(f, args...)
+       diag.errors = append(diag.errors, fmt.Sprintf(f, args...))
+}
+
+// Run the given func, logging appropriate messages before and after,
+// adding timing info, etc.
+//
+// The id argument should be unique among tests, and shouldn't change
+// when other tests are added/removed.
+func (diag *diagnoser) dotest(id int, title string, fn func() error) {
+       if diag.done == nil {
+               diag.done = map[int]bool{}
+       } else if diag.done[id] {
+               diag.errorf("(bug) reused test id %d", id)
+       }
+       diag.done[id] = true
+
+       diag.logger.Infof("%4d: %s", id, title)
+       t0 := time.Now()
+       err := fn()
+       elapsed := fmt.Sprintf("%d ms", time.Now().Sub(t0)/time.Millisecond)
+       if err != nil {
+               diag.errorf("%4d: %s (%s): %s", id, title, elapsed, err)
+       } else {
+               diag.logger.Debugf("%4d: %s (%s): ok", id, title, elapsed)
+       }
+}
+
+func (diag *diagnoser) runtests() {
+       client := arvados.NewClientFromEnv()
+
+       if client.APIHost == "" || client.AuthToken == "" {
+               diag.errorf("ARVADOS_API_HOST and ARVADOS_API_TOKEN environment variables are not set -- aborting without running any tests")
+               return
+       }
+
+       var dd arvados.DiscoveryDocument
+       ddpath := "discovery/v1/apis/arvados/v1/rest"
+       diag.dotest(10, fmt.Sprintf("getting discovery document from https://%s/%s", client.APIHost, ddpath), func() error {
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
+               err := client.RequestAndDecodeContext(ctx, &dd, "GET", ddpath, nil, nil)
+               if err != nil {
+                       return err
+               }
+               diag.debugf("BlobSignatureTTL = %d", dd.BlobSignatureTTL)
+               return nil
+       })
+
+       var cluster arvados.Cluster
+       cfgpath := "arvados/v1/config"
+       diag.dotest(20, fmt.Sprintf("getting exported config from https://%s/%s", client.APIHost, cfgpath), func() error {
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
+               err := client.RequestAndDecodeContext(ctx, &cluster, "GET", cfgpath, nil, nil)
+               if err != nil {
+                       return err
+               }
+               diag.debugf("Collections.BlobSigning = %v", cluster.Collections.BlobSigning)
+               return nil
+       })
+
+       var user arvados.User
+       diag.dotest(30, "getting current user record", func() error {
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
+               err := client.RequestAndDecodeContext(ctx, &user, "GET", "arvados/v1/users/current", nil, nil)
+               if err != nil {
+                       return err
+               }
+               diag.debugf("user uuid = %s", user.UUID)
+               return nil
+       })
+
+       // uncomment to create some spurious errors
+       // cluster.Services.WebDAVDownload.ExternalURL.Host = "0.0.0.0:9"
+
+       // TODO: detect routing errors here, like finding wb2 at the
+       // wb1 address.
+       for i, svc := range []*arvados.Service{
+               &cluster.Services.Keepproxy,
+               &cluster.Services.WebDAV,
+               &cluster.Services.WebDAVDownload,
+               &cluster.Services.Websocket,
+               &cluster.Services.Workbench1,
+               &cluster.Services.Workbench2,
+       } {
+               diag.dotest(40+i, fmt.Sprintf("connecting to service endpoint %s", svc.ExternalURL), func() error {
+                       ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+                       defer cancel()
+                       u := svc.ExternalURL
+                       if strings.HasPrefix(u.Scheme, "ws") {
+                               // We can do a real websocket test elsewhere,
+                               // but for now we'll just check the https
+                               // connection.
+                               u.Scheme = "http" + u.Scheme[2:]
+                       }
+                       if svc == &cluster.Services.WebDAV && strings.HasPrefix(u.Host, "*") {
+                               u.Host = "d41d8cd98f00b204e9800998ecf8427e-0" + u.Host[1:]
+                       }
+                       req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+                       if err != nil {
+                               return err
+                       }
+                       resp, err := http.DefaultClient.Do(req)
+                       if err != nil {
+                               return err
+                       }
+                       resp.Body.Close()
+                       return nil
+               })
+       }
+
+       for i, url := range []string{
+               cluster.Services.Controller.ExternalURL.String(),
+               cluster.Services.Keepproxy.ExternalURL.String() + "d41d8cd98f00b204e9800998ecf8427e+0",
+               cluster.Services.WebDAVDownload.ExternalURL.String(),
+       } {
+               diag.dotest(50+i, fmt.Sprintf("checking CORS headers at %s", url), func() error {
+                       ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+                       defer cancel()
+                       req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+                       if err != nil {
+                               return err
+                       }
+                       req.Header.Set("Origin", "https://example.com")
+                       resp, err := http.DefaultClient.Do(req)
+                       if err != nil {
+                               return err
+                       }
+                       if hdr := resp.Header.Get("Access-Control-Allow-Origin"); hdr != "*" {
+                               return fmt.Errorf("expected \"Access-Control-Allow-Origin: *\", got %q", hdr)
+                       }
+                       return nil
+               })
+       }
+
+       var keeplist arvados.KeepServiceList
+       diag.dotest(60, "checking internal/external client detection", func() error {
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
+               err := client.RequestAndDecodeContext(ctx, &keeplist, "GET", "arvados/v1/keep_services/accessible", nil, arvados.ListOptions{Limit: 999999})
+               if err != nil {
+                       return fmt.Errorf("error getting keep services list: %s", err)
+               } else if len(keeplist.Items) == 0 {
+                       return fmt.Errorf("controller did not return any keep services")
+               }
+               found := map[string]int{}
+               for _, ks := range keeplist.Items {
+                       found[ks.ServiceType]++
+               }
+               isInternal := found["proxy"] == 0 && len(keeplist.Items) > 0
+               isExternal := found["proxy"] > 0 && found["proxy"] == len(keeplist.Items)
+               if isExternal {
+                       diag.debugf("controller returned only proxy services, this host is treated as \"external\"")
+               } else if isInternal {
+                       diag.debugf("controller returned only non-proxy services, this host is treated as \"internal\"")
+               }
+               if (diag.checkInternal && !isInternal) || (diag.checkExternal && !isExternal) {
+                       return fmt.Errorf("expecting internal=%v external=%v, but found internal=%v external=%v", diag.checkInternal, diag.checkExternal, isInternal, isExternal)
+               }
+               return nil
+       })
+
+       for i, ks := range keeplist.Items {
+               u := url.URL{
+                       Scheme: "http",
+                       Host:   net.JoinHostPort(ks.ServiceHost, fmt.Sprintf("%d", ks.ServicePort)),
+                       Path:   "/",
+               }
+               if ks.ServiceSSLFlag {
+                       u.Scheme = "https"
+               }
+               diag.dotest(61+i, fmt.Sprintf("reading+writing via keep service at %s", u.String()), func() error {
+                       ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+                       defer cancel()
+                       req, err := http.NewRequestWithContext(ctx, "PUT", u.String()+"d41d8cd98f00b204e9800998ecf8427e", nil)
+                       if err != nil {
+                               return err
+                       }
+                       req.Header.Set("Authorization", "Bearer "+client.AuthToken)
+                       resp, err := http.DefaultClient.Do(req)
+                       if err != nil {
+                               return err
+                       }
+                       defer resp.Body.Close()
+                       body, err := ioutil.ReadAll(resp.Body)
+                       if err != nil {
+                               return fmt.Errorf("reading response body: %s", err)
+                       }
+                       loc := strings.TrimSpace(string(body))
+                       if !strings.HasPrefix(loc, "d41d8") {
+                               return fmt.Errorf("unexpected response from write: %q", body)
+                       }
+
+                       req, err = http.NewRequestWithContext(ctx, "GET", u.String()+loc, nil)
+                       if err != nil {
+                               return err
+                       }
+                       req.Header.Set("Authorization", "Bearer "+client.AuthToken)
+                       resp, err = http.DefaultClient.Do(req)
+                       if err != nil {
+                               return err
+                       }
+                       defer resp.Body.Close()
+                       body, err = ioutil.ReadAll(resp.Body)
+                       if err != nil {
+                               return fmt.Errorf("reading response body: %s", err)
+                       }
+                       if len(body) != 0 {
+                               return fmt.Errorf("unexpected response from read: %q", body)
+                       }
+
+                       return nil
+               })
+       }
+
+       var project arvados.Group
+       diag.dotest(80, fmt.Sprintf("finding/creating %q project", diag.projectName), func() error {
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
+               var grplist arvados.GroupList
+               err := client.RequestAndDecodeContext(ctx, &grplist, "GET", "arvados/v1/groups", nil, arvados.ListOptions{
+                       Filters: []arvados.Filter{
+                               {"name", "=", diag.projectName},
+                               {"group_class", "=", "project"},
+                               {"owner_uuid", "=", user.UUID}},
+                       Limit: 999999})
+               if err != nil {
+                       return fmt.Errorf("list groups: %s", err)
+               }
+               if len(grplist.Items) > 0 {
+                       project = grplist.Items[0]
+                       diag.debugf("using existing project, uuid = %s", project.UUID)
+                       return nil
+               }
+               diag.debugf("list groups: ok, no results")
+               err = client.RequestAndDecodeContext(ctx, &project, "POST", "arvados/v1/groups", nil, map[string]interface{}{"group": map[string]interface{}{
+                       "name":        diag.projectName,
+                       "group_class": "project",
+               }})
+               if err != nil {
+                       return fmt.Errorf("create project: %s", err)
+               }
+               diag.debugf("created project, uuid = %s", project.UUID)
+               return nil
+       })
+
+       var collection arvados.Collection
+       diag.dotest(90, "creating temporary collection", func() error {
+               if project.UUID == "" {
+                       return fmt.Errorf("skipping, no project to work in")
+               }
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
+               err := client.RequestAndDecodeContext(ctx, &collection, "POST", "arvados/v1/collections", nil, map[string]interface{}{
+                       "ensure_unique_name": true,
+                       "collection": map[string]interface{}{
+                               "owner_uuid": project.UUID,
+                               "name":       "test collection",
+                               "trash_at":   time.Now().Add(time.Hour)}})
+               if err != nil {
+                       return err
+               }
+               diag.debugf("ok, uuid = %s", collection.UUID)
+               return nil
+       })
+
+       if collection.UUID != "" {
+               defer func() {
+                       diag.dotest(9990, "deleting temporary collection", func() error {
+                               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+                               defer cancel()
+                               return client.RequestAndDecodeContext(ctx, nil, "DELETE", "arvados/v1/collections/"+collection.UUID, nil, nil)
+                       })
+               }()
+       }
+
+       diag.dotest(100, "uploading file via webdav", func() error {
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
+               if collection.UUID == "" {
+                       return fmt.Errorf("skipping, no test collection")
+               }
+               req, err := http.NewRequestWithContext(ctx, "PUT", cluster.Services.WebDAVDownload.ExternalURL.String()+"c="+collection.UUID+"/testfile", bytes.NewBufferString("testfiledata"))
+               if err != nil {
+                       return fmt.Errorf("BUG? http.NewRequest: %s", err)
+               }
+               req.Header.Set("Authorization", "Bearer "+client.AuthToken)
+               resp, err := http.DefaultClient.Do(req)
+               if err != nil {
+                       return fmt.Errorf("error performing http request: %s", err)
+               }
+               resp.Body.Close()
+               if resp.StatusCode != http.StatusCreated {
+                       return fmt.Errorf("status %s", resp.Status)
+               }
+               diag.debugf("ok, status %s", resp.Status)
+               err = client.RequestAndDecodeContext(ctx, &collection, "GET", "arvados/v1/collections/"+collection.UUID, nil, nil)
+               if err != nil {
+                       return fmt.Errorf("get updated collection: %s", err)
+               }
+               diag.debugf("ok, pdh %s", collection.PortableDataHash)
+               return nil
+       })
+
+       davurl := cluster.Services.WebDAV.ExternalURL
+       diag.dotest(110, fmt.Sprintf("checking WebDAV ExternalURL wildcard (%s)", davurl), func() error {
+               if davurl.Host == "" {
+                       return fmt.Errorf("host missing - content previews will not work")
+               }
+               if !strings.HasPrefix(davurl.Host, "*--") && !strings.HasPrefix(davurl.Host, "*.") && !cluster.Collections.TrustAllContent {
+                       diag.warnf("WebDAV ExternalURL has no leading wildcard and TrustAllContent==false - content previews will not work")
+               }
+               return nil
+       })
+
+       for i, trial := range []struct {
+               needcoll bool
+               status   int
+               fileurl  string
+       }{
+               {false, http.StatusNotFound, strings.Replace(davurl.String(), "*", "d41d8cd98f00b204e9800998ecf8427e-0", 1) + "foo"},
+               {false, http.StatusNotFound, strings.Replace(davurl.String(), "*", "d41d8cd98f00b204e9800998ecf8427e-0", 1) + "testfile"},
+               {false, http.StatusNotFound, cluster.Services.WebDAVDownload.ExternalURL.String() + "c=d41d8cd98f00b204e9800998ecf8427e+0/_/foo"},
+               {false, http.StatusNotFound, cluster.Services.WebDAVDownload.ExternalURL.String() + "c=d41d8cd98f00b204e9800998ecf8427e+0/_/testfile"},
+               {true, http.StatusOK, strings.Replace(davurl.String(), "*", strings.Replace(collection.PortableDataHash, "+", "-", -1), 1) + "testfile"},
+               {true, http.StatusOK, cluster.Services.WebDAVDownload.ExternalURL.String() + "c=" + collection.UUID + "/_/testfile"},
+       } {
+               diag.dotest(120+i, fmt.Sprintf("downloading from webdav (%s)", trial.fileurl), func() error {
+                       ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+                       defer cancel()
+                       if trial.needcoll && collection.UUID == "" {
+                               return fmt.Errorf("skipping, no test collection")
+                       }
+                       req, err := http.NewRequestWithContext(ctx, "GET", trial.fileurl, nil)
+                       if err != nil {
+                               return err
+                       }
+                       req.Header.Set("Authorization", "Bearer "+client.AuthToken)
+                       resp, err := http.DefaultClient.Do(req)
+                       if err != nil {
+                               return err
+                       }
+                       defer resp.Body.Close()
+                       body, err := ioutil.ReadAll(resp.Body)
+                       if err != nil {
+                               return fmt.Errorf("reading response: %s", err)
+                       }
+                       if resp.StatusCode != trial.status {
+                               return fmt.Errorf("unexpected response status: %s", resp.Status)
+                       }
+                       if trial.status == http.StatusOK && string(body) != "testfiledata" {
+                               return fmt.Errorf("unexpected response content: %q", body)
+                       }
+                       return nil
+               })
+       }
+
+       var vm arvados.VirtualMachine
+       diag.dotest(130, "getting list of virtual machines", func() error {
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
+               var vmlist arvados.VirtualMachineList
+               err := client.RequestAndDecodeContext(ctx, &vmlist, "GET", "arvados/v1/virtual_machines", nil, arvados.ListOptions{Limit: 999999})
+               if err != nil {
+                       return err
+               }
+               if len(vmlist.Items) < 1 {
+                       return fmt.Errorf("no VMs found")
+               }
+               vm = vmlist.Items[0]
+               return nil
+       })
+
+       diag.dotest(140, "getting workbench1 webshell page", func() error {
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
+               if vm.UUID == "" {
+                       return fmt.Errorf("skipping, no vm available")
+               }
+               webshelltermurl := cluster.Services.Workbench1.ExternalURL.String() + "virtual_machines/" + vm.UUID + "/webshell/testusername"
+               diag.debugf("url %s", webshelltermurl)
+               req, err := http.NewRequestWithContext(ctx, "GET", webshelltermurl, nil)
+               if err != nil {
+                       return err
+               }
+               req.Header.Set("Authorization", "Bearer "+client.AuthToken)
+               resp, err := http.DefaultClient.Do(req)
+               if err != nil {
+                       return err
+               }
+               defer resp.Body.Close()
+               body, err := ioutil.ReadAll(resp.Body)
+               if err != nil {
+                       return fmt.Errorf("reading response: %s", err)
+               }
+               if resp.StatusCode != http.StatusOK {
+                       return fmt.Errorf("unexpected response status: %s %q", resp.Status, body)
+               }
+               return nil
+       })
+
+       diag.dotest(150, "connecting to webshell service", func() error {
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
+               if vm.UUID == "" {
+                       return fmt.Errorf("skipping, no vm available")
+               }
+               u := cluster.Services.WebShell.ExternalURL
+               webshellurl := u.String() + vm.Hostname + "?"
+               if strings.HasPrefix(u.Host, "*") {
+                       u.Host = vm.Hostname + u.Host[1:]
+                       webshellurl = u.String() + "?"
+               }
+               diag.debugf("url %s", webshellurl)
+               req, err := http.NewRequestWithContext(ctx, "POST", webshellurl, bytes.NewBufferString(url.Values{
+                       "width":   {"80"},
+                       "height":  {"25"},
+                       "session": {"xyzzy"},
+                       "rooturl": {webshellurl},
+               }.Encode()))
+               if err != nil {
+                       return err
+               }
+               req.Header.Set("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8")
+               resp, err := http.DefaultClient.Do(req)
+               if err != nil {
+                       return err
+               }
+               defer resp.Body.Close()
+               diag.debugf("response status %s", resp.Status)
+               body, err := ioutil.ReadAll(resp.Body)
+               if err != nil {
+                       return fmt.Errorf("reading response: %s", err)
+               }
+               diag.debugf("response body %q", body)
+               // We don't speak the protocol, so we get a 400 error
+               // from the webshell server even if everything is
+               // OK. Anything else (404, 502, ???) indicates a
+               // problem.
+               if resp.StatusCode != http.StatusBadRequest {
+                       return fmt.Errorf("unexpected response status: %s, %q", resp.Status, body)
+               }
+               return nil
+       })
+
+       diag.dotest(160, "running a container", func() error {
+               if diag.priority < 1 {
+                       diag.infof("skipping (use priority > 0 if you want to run a container)")
+                       return nil
+               }
+               if project.UUID == "" {
+                       return fmt.Errorf("skipping, no project to work in")
+               }
+
+               var cr arvados.ContainerRequest
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
+
+               timestamp := time.Now().Format(time.RFC3339)
+               err := client.RequestAndDecodeContext(ctx, &cr, "POST", "arvados/v1/container_requests", nil, map[string]interface{}{"container_request": map[string]interface{}{
+                       "owner_uuid":      project.UUID,
+                       "name":            fmt.Sprintf("diagnostics container request %s", timestamp),
+                       "container_image": "arvados/jobs",
+                       "command":         []string{"echo", timestamp},
+                       "use_existing":    false,
+                       "output_path":     "/mnt/output",
+                       "output_name":     fmt.Sprintf("diagnostics output %s", timestamp),
+                       "priority":        diag.priority,
+                       "state":           arvados.ContainerRequestStateCommitted,
+                       "mounts": map[string]map[string]interface{}{
+                               "/mnt/output": {
+                                       "kind":     "collection",
+                                       "writable": true,
+                               },
+                       },
+                       "runtime_constraints": arvados.RuntimeConstraints{
+                               VCPUs:        1,
+                               RAM:          1 << 26,
+                               KeepCacheRAM: 1 << 26,
+                       },
+               }})
+               if err != nil {
+                       return err
+               }
+               diag.debugf("container request uuid = %s", cr.UUID)
+               diag.debugf("container uuid = %s", cr.ContainerUUID)
+
+               timeout := 10 * time.Minute
+               diag.infof("container request submitted, waiting up to %v for container to run", arvados.Duration(timeout))
+               ctx, cancel = context.WithDeadline(context.Background(), time.Now().Add(timeout))
+               defer cancel()
+
+               var c arvados.Container
+               for ; cr.State != arvados.ContainerRequestStateFinal; time.Sleep(2 * time.Second) {
+                       ctx, cancel := context.WithDeadline(ctx, time.Now().Add(diag.timeout))
+                       defer cancel()
+
+                       crStateWas := cr.State
+                       err := client.RequestAndDecodeContext(ctx, &cr, "GET", "arvados/v1/container_requests/"+cr.UUID, nil, nil)
+                       if err != nil {
+                               return err
+                       }
+                       if cr.State != crStateWas {
+                               diag.debugf("container request state = %s", cr.State)
+                       }
+
+                       cStateWas := c.State
+                       err = client.RequestAndDecodeContext(ctx, &c, "GET", "arvados/v1/containers/"+cr.ContainerUUID, nil, nil)
+                       if err != nil {
+                               return err
+                       }
+                       if c.State != cStateWas {
+                               diag.debugf("container state = %s", c.State)
+                       }
+               }
+
+               if c.State != arvados.ContainerStateComplete {
+                       return fmt.Errorf("container request %s is final but container %s did not complete: container state = %q", cr.UUID, cr.ContainerUUID, c.State)
+               } else if c.ExitCode != 0 {
+                       return fmt.Errorf("container exited %d", c.ExitCode)
+               }
+               return nil
+       })
+}