From: Eric Biagiotti Date: Wed, 14 Aug 2019 14:49:48 +0000 (-0400) Subject: Merge branch 'master' into 14715-keepprox-config X-Git-Tag: 2.0.0~215^2~5 X-Git-Url: https://git.arvados.org/arvados.git/commitdiff_plain/d4ed3e6460469f2766e1f1676c538d6c86e000b6 Merge branch 'master' into 14715-keepprox-config refs #14715 Arvados-DCO-1.1-Signed-off-by: Eric Biagiotti --- d4ed3e6460469f2766e1f1676c538d6c86e000b6 diff --cc doc/admin/upgrading.html.textile.liquid index 7ea1b10fae,8c2ca76576..28f08db4dd --- a/doc/admin/upgrading.html.textile.liquid +++ b/doc/admin/upgrading.html.textile.liquid @@@ -39,15 -39,21 +39,25 @@@ table(table table-bordered table-conden |"v1.1.4":#v1_1_4|"v1.1.3":#v1_1_3|"v1.1.2":#v1_1_2|"v1.1.1":#v1_1_1|"v1.1.0":#v1_1_0| |\5. "older":#older| - h3(#master). development master (as of 2019-06-07) + h3(#master). development master (as of 2019-08-12) + + h4. Keep-web dropped support on command line flags configuration + + As we're migrating to a central cluster configuration file, the already deprecated way of getting configurations via environment variables and command line flags isn't valid anymore. Current keep-web supports both the now legacy @keep-web.yml@ config format (used by Arvados 1.4) and the new cluster config file format. Please check "keep-web's install guide":{{site.baseurl}}/install/install-keep-web.html for more details. + + h4. Jobs API is read-only + + (task "#15133":https://dev.arvados.org/issues/15133 ) The legacy 'jobs' API is now read-only. It has long been superceded by containers / container_requests (aka crunch v2). Arvados installations since the end of 2017 (v1.1.0) have probably only used containers, and are unaffected by this change. + + So that older Arvados sites don't lose access to legacy records, the API has been converted to read-only. Creating and updating jobs (and related types job_task, pipeline_template and pipeline_instance) is disabled and much of the business logic related has been removed, along with various other code specific to the jobs API. Specifically, the following programs associated with the jobs API have been removed: @crunch-dispatch.rb@, @crunch-job@, @crunchrunner@, @arv-run-pipeline-instance@, @arv-run@. +h4. Keepproxy configuration migration + +Keepproxy can now be configured using the centralized config at @/etc/arvados/config.yml@. Some configuration options are no longer supported. Please see "keepproxy's config migration guide":{{site.baseurl}}/admin/config-migration.html#keepproxy for more details. + h4. No longer stripping ':' from strings in serialized database columns - (bug #15311) Strings read from serialized columns in the database with a leading ':' would have the ':' stripped after loading the record. This behavior existed due to legacy serialization behavior which stored Ruby symbols with a leading ':'. Unfortunately this corrupted fields where the leading ":" was intentional. This behavior has been removed. + (bug "#15311":https://dev.arvados.org/issues/15311 ) Strings read from serialized columns in the database with a leading ':' would have the ':' stripped after loading the record. This behavior existed due to legacy serialization behavior which stored Ruby symbols with a leading ':'. Unfortunately this corrupted fields where the leading ":" was intentional. This behavior has been removed. You can test if any records in your database are affected by going to the API server directory and running @bundle exec rake symbols:check@. This will report which records contain fields with a leading ':' that would previously have been stripped. If there are records to be updated, you can update the database using @bundle exec rake symbols:stringify@. diff --cc lib/config/deprecated.go index 4e7b85ec5d,019979d39f..df872111db --- a/lib/config/deprecated.go +++ b/lib/config/deprecated.go @@@ -327,74 -327,72 +327,144 @@@ func (ldr *Loader) loadOldWebsocketConf return nil } +type oldKeepProxyConfig struct { + Client *arvados.Client + Listen *string + DisableGet *bool + DisablePut *bool + DefaultReplicas *int + Timeout *arvados.Duration + PIDFile *string + Debug *bool + ManagementToken *string +} + +const defaultKeepproxyConfigPath = "/etc/arvados/keepproxy/keepproxy.yml" + +func (ldr *Loader) loadOldKeepproxyConfig(cfg *arvados.Config) error { + if ldr.KeepproxyPath == "" { + return nil + } + var oc oldKeepProxyConfig + err := ldr.loadOldConfigHelper("keepproxy", ldr.KeepproxyPath, &oc) + if os.IsNotExist(err) && ldr.KeepproxyPath == defaultKeepproxyConfigPath { + return nil + } else if err != nil { + return err + } + + cluster, err := cfg.GetCluster("") + if err != nil { + return err + } + + loadOldClientConfig(cluster, oc.Client) + + if oc.Listen != nil { + cluster.Services.Keepproxy.InternalURLs[arvados.URL{Host: *oc.Listen}] = arvados.ServiceInstance{} + } + if oc.DefaultReplicas != nil { + cluster.Collections.DefaultReplication = *oc.DefaultReplicas + } + if oc.Timeout != nil { + cluster.API.KeepServiceRequestTimeout = *oc.Timeout + } + if oc.Debug != nil { + if *oc.Debug && cluster.SystemLogs.LogLevel != "debug" { + cluster.SystemLogs.LogLevel = "debug" + } else if !*oc.Debug && cluster.SystemLogs.LogLevel != "info" { + cluster.SystemLogs.LogLevel = "info" + } + } + if oc.ManagementToken != nil { + cluster.ManagementToken = *oc.ManagementToken + } + + // The following legacy options are no longer supported. If they are set to + // true or PIDFile has a value, error out and notify the user + unsupportedEntry := func(cfgEntry string) error { + return fmt.Errorf("the keepproxy %s configuration option is no longer supported, please remove it from your configuration file", cfgEntry) + } + if oc.DisableGet != nil && *oc.DisableGet { + return unsupportedEntry("DisableGet") + } + if oc.DisablePut != nil && *oc.DisablePut { + return unsupportedEntry("DisablePut") + } + if oc.PIDFile != nil && *oc.PIDFile != "" { + return unsupportedEntry("PIDFile") + } + + cfg.Clusters[cluster.ClusterID] = *cluster + return nil +} ++ + const defaultKeepWebConfigPath = "/etc/arvados/keep-web/keep-web.yml" + + type oldKeepWebConfig struct { + Client *arvados.Client + + Listen string + + AnonymousTokens []string + AttachmentOnlyHost string + TrustAllContent bool + + Cache struct { + TTL arvados.Duration + UUIDTTL arvados.Duration + MaxCollectionEntries int + MaxCollectionBytes int64 + MaxPermissionEntries int + MaxUUIDEntries int + } + + // Hack to support old command line flag, which is a bool + // meaning "get actual token from environment". + deprecatedAllowAnonymous bool + + // Authorization token to be included in all health check requests. + ManagementToken string + } + + func (ldr *Loader) loadOldKeepWebConfig(cfg *arvados.Config) error { + if ldr.KeepWebPath == "" { + return nil + } + var oc oldKeepWebConfig + err := ldr.loadOldConfigHelper("keep-web", ldr.KeepWebPath, &oc) + if os.IsNotExist(err) && ldr.KeepWebPath == defaultKeepWebConfigPath { + return nil + } else if err != nil { + return err + } + + cluster, err := cfg.GetCluster("") + if err != nil { + return err + } + + loadOldClientConfig(cluster, oc.Client) + + cluster.Services.WebDAV.InternalURLs[arvados.URL{Host: oc.Listen}] = arvados.ServiceInstance{} + cluster.Services.WebDAVDownload.InternalURLs[arvados.URL{Host: oc.Listen}] = arvados.ServiceInstance{} + cluster.Services.WebDAVDownload.ExternalURL = arvados.URL{Host: oc.AttachmentOnlyHost} + cluster.TLS.Insecure = oc.Client.Insecure + cluster.ManagementToken = oc.ManagementToken + cluster.Collections.TrustAllContent = oc.TrustAllContent + cluster.Collections.WebDAVCache.TTL = oc.Cache.TTL + cluster.Collections.WebDAVCache.UUIDTTL = oc.Cache.UUIDTTL + cluster.Collections.WebDAVCache.MaxCollectionEntries = oc.Cache.MaxCollectionEntries + cluster.Collections.WebDAVCache.MaxCollectionBytes = oc.Cache.MaxCollectionBytes + cluster.Collections.WebDAVCache.MaxPermissionEntries = oc.Cache.MaxPermissionEntries + cluster.Collections.WebDAVCache.MaxUUIDEntries = oc.Cache.MaxUUIDEntries + if len(oc.AnonymousTokens) > 0 { + cluster.Users.AnonymousUserToken = oc.AnonymousTokens[0] + if len(oc.AnonymousTokens) > 1 { + ldr.Logger.Warn("More than 1 anonymous tokens configured, using only the first and discarding the rest.") + } + } + + cfg.Clusters[cluster.ClusterID] = *cluster + return nil + } diff --cc lib/config/load.go index 309c0a615d,3413e3bec3..c0b44c17eb --- a/lib/config/load.go +++ b/lib/config/load.go @@@ -31,9 -31,9 +31,10 @@@ type Loader struct Path string KeepstorePath string + KeepWebPath string CrunchDispatchSlurmPath string WebsocketPath string + KeepproxyPath string configdata []byte } @@@ -61,9 -61,9 +62,10 @@@ func NewLoader(stdin io.Reader, logger func (ldr *Loader) SetupFlags(flagset *flag.FlagSet) { flagset.StringVar(&ldr.Path, "config", arvados.DefaultConfigFile, "Site configuration `file` (default may be overridden by setting an ARVADOS_CONFIG environment variable)") flagset.StringVar(&ldr.KeepstorePath, "legacy-keepstore-config", defaultKeepstoreConfigPath, "Legacy keepstore configuration `file`") + flagset.StringVar(&ldr.KeepWebPath, "legacy-keepweb-config", defaultKeepWebConfigPath, "Legacy keep-web configuration `file`") flagset.StringVar(&ldr.CrunchDispatchSlurmPath, "legacy-crunch-dispatch-slurm-config", defaultCrunchDispatchSlurmConfigPath, "Legacy crunch-dispatch-slurm configuration `file`") flagset.StringVar(&ldr.WebsocketPath, "legacy-ws-config", defaultWebsocketConfigPath, "Legacy arvados-ws configuration `file`") + flagset.StringVar(&ldr.KeepproxyPath, "legacy-keepproxy-config", defaultKeepproxyConfigPath, "Legacy keepproxy configuration `file`") flagset.BoolVar(&ldr.SkipLegacy, "skip-legacy", false, "Don't load legacy config files") } @@@ -135,9 -135,9 +137,12 @@@ func (ldr *Loader) MungeLegacyConfigArg if legacyConfigArg != "-legacy-ws-config" { ldr.WebsocketPath = "" } + if legacyConfigArg != "-legacy-keepweb-config" { + ldr.KeepWebPath = "" + } + if legacyConfigArg != "-legacy-keepproxy-config" { + ldr.WebsocketPath = "" + } return munged } @@@ -235,9 -235,9 +240,10 @@@ func (ldr *Loader) Load() (*arvados.Con // legacy config file for the current component for _, err := range []error{ ldr.loadOldKeepstoreConfig(&cfg), + ldr.loadOldKeepWebConfig(&cfg), ldr.loadOldCrunchDispatchSlurmConfig(&cfg), ldr.loadOldWebsocketConfig(&cfg), + ldr.loadOldKeepproxyConfig(&cfg), } { if err != nil { return nil, err diff --cc tools/arvbox/lib/arvbox/docker/cluster-config.sh index 3444e61e17,58bedd2841..34a0c2d752 --- a/tools/arvbox/lib/arvbox/docker/cluster-config.sh +++ b/tools/arvbox/lib/arvbox/docker/cluster-config.sh @@@ -76,12 -79,10 +79,14 @@@ Clusters ExternalURL: "https://$localip:${services[workbench2-ssl]}" SSO: ExternalURL: "https://$localip:${services[sso]}" + Keepproxy: + InternalURLs: + "http://localhost:${services[keepproxy]}/": {} + ExternalURL: "http://$localip:${services[keepproxy-ssl]}/" Websocket: ExternalURL: "wss://$localip:${services[websockets-ssl]}/websocket" + InternalURLs: + "http://localhost:${services[websockets]}": {} GitSSH: ExternalURL: "ssh://git@$localip:" GitHTTP: