The oVirt API server no longer runs under Apache/Passenger but as a
dedicated opennebula-ovirtapi.service on top of Puma (from
opennebula-rubygems), listening on ports 80/443 as oneadmin with
CAP_NET_BIND_SERVICE:
- share/pkgs/services/systemd/opennebula-ovirtapi.service
- etc/ovirtapi-puma.rb: Puma configuration (threads, binds, TLS cert),
installed to /etc/one
- config.ru: the HTTP to HTTPS redirect (except for the PKI resource)
that the Apache vhost used to do is now a Rack middleware
- logs go to /var/log/one/ovirtapi.log, logrotate entry added
The PStore databases are opened thread safe, Puma serves requests from
multiple threads (Passenger used one process per request).
Apache/Passenger only files (apache/, bin/, scripts/configure_apache.sh)
are dropped and config/ is renamed to etc/. Certificate generation is
unchanged.
Extend the FireEdge log fix to oned, oneflow, oneform, onegate and
onehem so they share the same rotation behavior:
- Add compress / compressoptions -9 / delaycompress to the logrotate
configs. With copytruncate, delaycompress avoids gzipping the
freshly-rotated file in the same pass and keeps service restarts
fast even when ExecStartPre runs logrotate -f.
- Drop the synchronous gzip ExecStartPre loops from each unit. The
glob (e.g. oneflow*.log) does not match files rotated with
dateformat -%Y%m%d-%s, so the loop was ineffective, and running
gzip without backgrounding blocked startup.
- Ship a logrotate config for oneform; the unit was pointing at
/etc/logrotate.d/opennebula-form but no such file existed, so
oneform.log was never rotated.
- src/hem/bin/onehem-server: use >> instead of > so restarts via the
shell wrapper do not truncate the log, matching oneflow / onegate /
oneform / fireedge wrappers (originally fixed in #6034).
Signed-off-by: Mikalai Kutouski <mkutouski@opennebula.io>
Co-authored-by: Jan Orel <jorel@opennebula.io>
This commits introduces a new framework for OpenNebula, it is based on
standard the OpenNebula middleware access driver (mad) model. Benefits
compared to the current implementation:
* Less overhead on API server and streamlined communications
* Ease integration with third party schedulers
* New "optimize" action to balance the workload of a cluster
* Embedded Plan Manager to apply optimization and deployment plans with
custom parameters for the scheduling window
* Custom optimization policies per cluster
This commits introduces 2 schedulers:
* Rank scheduler based on the match-making algorithm present in 6.x
series
* OpenNebula DRS an optimization algorithm based on an ILP solver for
placement and cluster optimization
Also new API calls has been added for onecluster as well as the CLI
updates to expose them.
co-authored-by: MarioRobres <mrobres@opennebula.io>
co-authored-by: Pavel Czerny <pczerny@opennebula.io>
co-authored-by: Mirko Stojiljkovic <mstojiljkovic@opennebula.io>
co-authored-by: Valentyn Bohdan <vbohdan@opennebula.io>
This commit implements a transparent proxy for OneGate service (as well as any other TCP service)
* #6281: Disable legacy OneGateProxy
* Implement OneGateProxy in VN drivers
* Revert "F #5328: Update logrotate behavior to avoid long restarts (#2275)". This reverts commit 6b1127f180.
* B #5328: Don't wait for log compressing
* B #6034: Don't overwrite logs
While having already `copytruncate` in logroate we don't need to implement signaling and re-openning files.
* L #-: Linting
When (for whatever reason) opennebula-ssh-agent gets killed
it leaves existing socket and following start fails with
opennebula-ssh-agent[2333]: unix_listener: cannot bind to path /var/run/one/ssh-agent.sock: Address already in use
* F #5257: Remove econe server
Also, disable hybrid section by default in Sunstone
* F #5257: Revert onecfg change
* remove amazon-ec2 unneeded gem
* remove file no longer present from install.sh
Enforce logrotate before the start of any opennebula's supervisor
service - as is done similarly in the systemd services.
Signed-off-by: Petr Ospalý <pospaly@opennebula.io>
Each supervisord service (where missing or usable) can use its own
config file which will be sourced. Thanks to this services do not rely
on properly populated environment with all needed variables.
Useful when supervisord is run like this:
% env -i /usr/bin/supervisord
Signed-off-by: Petr Ospalý <pospaly@opennebula.io>
This commit solves issues with creating new VM images based on the
docker images inside a container environment.
If fuse2fs command is present then prefer its use instead of the default
mount command which will work only under root or otherwise privileged
user.
This commit solves the mounting issue inside the rootless container
environment.
Also add a new environment file to the oned supervisord service so we
can start oned process with some additional env. variables - notably
DOCKER_HOST.
Signed-off-by: Petr Ospalý <pospaly@opennebula.io>
- New supervisord service containerd
- New supervisord service docker
- Small fix in function.sh to pick up also socket files
Signed-off-by: Petr Ospalý <pospaly@opennebula.io>
By default supervisord waits only 10s before it sends SIGKILL to its
services. This commit raises this limit to 90s in all services -
matching the default in systemd (DefaultTimeoutStopSec).
Signed-off-by: Petr Ospalý <pospaly@opennebula.io>
* M #-: Add supervisord services definition
Currently only for CentOS 8 but there should be needed only few changes
to make it work on other systems: crond, apache/httpd, mysql/mariadb...
The rest is pretty much system agnostic.
Signed-off-by: Petr Ospalý <pospaly@opennebula.io>
* M #-: Adjust supervisor directories
Co-authored-by: Vlastimil Holer <vholer@opennebula.io>
* F #1473: Update SSH config and sockets
- install files via install.sh script
- replace crontab with systemd timer
- update opennebula.service dependency
- move ssh master sockets from ~oneadmin to /run/one/ssh-socks
- modify ssh wrapper to not use external programs but only bash builtins
- update ssh configs
Signed-off-by: Petr Ospalý <pospaly@opennebula.io>
* F #1473: Update SSH config and sockets
* F #1473: Update SSH config and sockets
* F #1473: Update SSH wrapper
- rename SSH_USE_MASTER_SOCK to SSH_OPT_CONTROL_MASTER
- change the logic of this directive to be a value of the SSH
'ControlMaster' option (default is 'auto')
- delete the SSH_USE_MASTER_SOCK from opennebula.service (not needed
anymore)
Signed-off-by: Petr Ospalý <pospaly@opennebula.io>
Co-authored-by: Vlastimil Holer <vholer@opennebula.io>
- add ssh wrapper which is used only on the fronted
- disable SSH master socket on the nodes
- add new PATH and SSH_USE_MASTER_SOCK into opennebula.service
Signed-off-by: Petr Ospalý <pospaly@opennebula.io>
- change /run/one to /var/run/one - /run/one is either bind-mount or
symlink and can be changed while /var/run/one is configured via
tmpfiles.d/opennebula*.conf - it is more consistent now
- add a dependency to SSH agent unit for remote-fs in the cases when
/var/lib/one (oneadmin's home) is on a network filesystem
- add SSH agent support to opennebula-hem service
Signed-off-by: Petr Ospalý <pospaly@opennebula.io>
Jan Orel