Skip to content

Initial changes for the ICPC World Finals in Baku #189

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Initial changes for the ICPC World Finals in Baku #189

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
2e9458d
Initial changes for the ICPC World Finals in Baku
nickygerritsen Jul 24, 2025
5320220
Store disabled CPUs
vmcj Jul 30, 2025
6dea67e
Store the isolated cores for ansible
vmcj Jul 30, 2025
ad7f722
Clarify the package/socket usage
vmcj Jul 30, 2025
b3a9d8d
Consider ARM processors
vmcj Jul 29, 2025
4a523b8
Disable efficiency cores
vmcj Jul 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions provision-contest/ansible/roles/base_packages/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ INSTALLED_PACKAGES:
- php-mysql
- php-xml
- php-zip
- php-bcmath
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nitpick: let's keep this list sorted.

- pv
- python3-sphinx
- python3-sphinx-rtd-theme
Expand Down
51 changes: 47 additions & 4 deletions provision-contest/ansible/roles/judgedaemon/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,26 +33,69 @@
src: chroot-list
dest: /tmp/dj_ansible/

- name: Check if pc2packages key is already in ubuntu-archive-keyring.gpg
ansible.builtin.shell: |
gpg --no-default-keyring --keyring /usr/share/keyrings/ubuntu-archive-keyring.gpg --list-keys --with-colons | \
grep -q "$(gpg --show-keys --with-colons /etc/apt/trusted.gpg.d/pc2packages.asc | grep '^fpr:' | head -1 | cut -d: -f10)"
register: key_exists
failed_when: false
changed_when: false
check_mode: false
when: ICPC_IMAGE
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's put this in a block? All the next statements depend on the ICPC_IMAGE boolean.


- name: Add pc2packages key to ubuntu-archive-keyring.gpg
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't the whole idea of the apt-key deprecation to not do this anymore? Why would this (https://stackoverflow.com/a/73805885) not work?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need this for the chroot, not for apt directly. If you can find a way to prevent this, I'm open to it.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So it should be passed to the dj_make_chroot as another flag? We now have something for the old way and I think we should do both there?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we can create a gpg store with all needed keys (maybe it's only the pc2 one), sure.

I don't have time to fix this in the next couple of weeks so feel free to try and improve. At least this works for now.

ansible.builtin.shell: |
gpg --no-default-keyring --keyring /usr/share/keyrings/ubuntu-archive-keyring.gpg --import /etc/apt/trusted.gpg.d/pc2packages.asc
when:
- ICPC_IMAGE
- key_exists.rc != 0

- name: Create chroot
shell: "set -o pipefail &&
{{ DJ_DIR }}/misc-tools/dj_make_chroot -y -H
-i icpc-kotlinc,openjdk-17-jdk-headless
-i openjdk-21-jdk-headless
-l \"$(ls /tmp/dj_ansible/install-chroot/*.deb 2>/dev/null | tr '\n' ',')\"
-s \"$(ls /tmp/dj_ansible/chroot-list/*.list 2>/dev/null | tr '\n' ',')\"
2>&1 | tee /tmp/dj_make_chroot.log;
grep '^Done building chroot in' /tmp/dj_make_chroot.log"
environment:
DEBMIRROR: "{%- if WF_RESTRICTED_NETWORK and ICPC_IMAGE -%}https://packages/ubuntu
{%- elif ICPC_IMAGE -%}https://sysopspackages.icpc.global/ubuntu
DEBMIRROR: "{%- if WF_RESTRICTED_NETWORK and ICPC_IMAGE -%}https://packages/ubuntu-noble
{%- elif ICPC_IMAGE -%}https://sysopspackages.icpc.global/ubuntu-noble
{%- else -%}
{%- endif -%}"
args:
executable: /bin/bash
creates: "/chroot/domjudge"

- name: Create kotlinc directory in chroot
ansible.builtin.file:
path: /chroot/domjudge/usr/lib/kotlinc
state: directory
mode: '0755'
when: ICPC_IMAGE

- name: Sync kotlinc folder to chroot
ansible.posix.synchronize:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is "expensive" on next runs, maybe add an explicit tag for this (I was already planning that so a remark here should be good enough).

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The folder is very small and it runs about instant on my test VM. Feel free to change it later if you really want.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It starts another SSH session, so on a noop it delays the overall playbook. So my problem isn't really the size.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok so what do you propose? We could also add a check first if some file in it already exists and then don't do this (like the kotinc binary). I prefer that over a tag

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe tar/gzip the file locally and make sure that's present and if changed unzip remotely? Not sure this is ideal, but adding a tag that manually needs to be triggered (if I understand @vmcj correctly) I think has the risk of forgetting to update things.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

They are not really local. They are on the server but just need to be copied.

My thought was adding a check if /chroot/domjudge/usr/lib/kotlinc/bin/Kolton exists and if so, don't do anything. A bit similar to how we don't rebuild the chroot if /chroot/DOMjudge exists.

src: /opt/kotlinc/
dest: /chroot/domjudge/usr/lib/kotlinc/
delete: false
recursive: true
delegate_to: "{{ inventory_hostname }}"
when: ICPC_IMAGE

- name: Create symlinks for kotlin binaries in chroot
ansible.builtin.file:
src: ../../lib/kotlinc/bin/{{ item }}
dest: /chroot/domjudge/usr/local/bin/{{ item }}
state: link
loop:
- kotlin
- kotlinc
when: ICPC_IMAGE

- name: Pre-generate the kernel flags for ansible usage
set_fact:
procline: "apparmor=0 systemd.unified_cgroup_hierarchy=0 cgroup_enable=memory swapaccount=1 isolcpus={{ cpucore | join(',') }}"
procline: "apparmor=0 cgroup_enable=memory swapaccount=1 isolcpus={{ cpucore | join(',') }}"

- name: Add cgroup kernel parameters
lineinfile:
Expand Down