adamruzicka

Foreman, EL* and yggdrasil

Since we introduced the pull provider, we carried both yggdrasil and our own worker (foreman_ygg_worker) in our client repos. Starting with EL 9.5, yggdrasil is going to be included in EL repos. The version there (0.4.1) is much newer than the one we ship, and therefore "wins" when yggdrasil is being installed. This causes a problem, because our own worker is not compatible with this newer version of yggdrasil and because of architectural changes in yggdrasil itself.

This issue may pop up on other currently supported distributions, but for the purpose of this document we’ll limit ourselves on distributions from the EL family.

Problem statement

yggdrasil <-> worker communication

In the 0.2.z line, yggdrasil talked with workers over grpc.

In the 0.4.z line, yggdrasil talks with workers over dbus.

adamruzicka

Remote execution flow

When running a REX job, the flow is roughly as follows:

1. The user triggers a job, under the hood this trigger a "parent task"
2. The parent task goes in batches of 100 and creates a sub-task for each host in the job. The batches are processed sequentially. Inside the batches the sub-tasks are also created sequentially.
3. After each batch from step 2 is prepared, the prepared sub-tasks are delegated to the smart proxy.
4. The smart proxy unwraps the batch and spawns a single ssh process for each, all of these run completely independently from each other.
5. The smart proxy reports back to Foreman as the per-host jobs finish with one request per host.
6. When the reports come to Foreman, Foreman dispatches them to the relevant per-host sub-tasks from 2. These sub-tasks process the updates and exit.

adamruzicka

#!/usr/bin/env ruby
# Place this into ${dynflow_checkout}/examples/cancellation.rb
# run with ruby examples/cancellation.rb

# frozen_string_literal: true

require_relative 'example_helper'

class SequentialParent < Dynflow::Action
  def plan(klass, count = 10, args: [])

adamruzicka

def bar(a, b, c)
  puts [a, b, c]
end

def foo(...)
  bar(1, ...)
end

foo(1, 2)

adamruzicka

Outline

• Install Asahi
• Add cryptsetup into initrd
• Make initrd spawn a shell before mounting disk
• Reencrypt the partition in-place
• Configure grub and rebuild initramfs to open LUKS device during startup.
• Cleanup

Steps

Install Asahi

adamruzicka

From what I've seen, strings are not getting translated in pure React pages coming from plugins. Translations work as long they are being done on the backend, but if they are done on the frontend, they end up not translated.

When updated translations are pulled in Foreman, a po_to_json rake task is called which converts the *.po files into javascript files under app/assets/javascripts/locale/$lang/app.js. These files usually look like this

var locales = locales || {}
locales['it'] = {
  "domain": "app",
  "locale_data": {
 "Failed to fetch: ": ["Recupero fallito:"],

adamruzicka

# Save this script as $LOCATION/queues.rb
# Run with foreman-rake console < $LOCATION/queues.rb
# Kill with C-c

# It collects sidekiq statistics every $INTERVAL seconds
# The statistics are saved into three CSV files

INTERVAL = (ENV['interval'] || 15).to_i

stats_csv = CSV.open(ENV['STATS'] || '/tmp/stats.csv', 'wb')

adamruzicka

#!/usr/bin/env ruby
# frozen_string_literal: true

# examples/excessive_logging.rb

# Reproducer for https://bugzilla.redhat.com/show_bug.cgi?id=1877917
# Run with something like
# for i in 1 2 5 10 50 100 500 1000; do echo -n "$i: "; COUNT=$i bundle exec ruby examples/excessive_logging.rb >/dev/null 2>&1 | wc -l -c | column -t; done

require_relative 'example_helper'

adamruzicka

Memory recycler in the age of Sidekiq

Starting with the move to sidekiq, the memory recycler is gone. Luckily, by splitting the executor into several systemd services, we can leverage the resource control features[1] provided by systemd and cgroups to fill the feature gap created by removal of the memory recycler.

Prerequisites

Before we can get to the memory limiting, let's take a look at how the default state looks. There are the orchestrator, worker and worker-hosts-queue processes running as instances of the [email protected] template

adamruzicka

From 81cb056aaa972a0c1ad9a49b7c4887d0df8111d6 Mon Sep 17 00:00:00 2001
From: Adam Ruzicka <[email protected]>
Date: Wed, 22 Jul 2020 12:26:17 +0200
Subject: [PATCH] Workaround undefined method singleton_class? error

NoMethodError: undefined method `singleton_class?' for #<Class:0x0000556b7d6b69b0>
/tmp/foreman/app/models/operatingsystem.rb:91:in `<class:Jail>'
/tmp/foreman/app/models/operatingsystem.rb:90:in `<class:Operatingsystem>'
/tmp/foreman/app/models/operatingsystem.rb:4:in `<main>'
/tmp/foreman/app/models/concerns/audit_search.rb:82:in `block in audited_classes_without_sti'