Skip to content

Commit 8a5b6c6

Browse files
author
Paas Bot
committed
merge upstream v21.0.0
2 parents 2de9049 + bc342b9 commit 8a5b6c6

File tree

9 files changed

+125
-5
lines changed

9 files changed

+125
-5
lines changed

‎jobs/limits/monit‎

Whitespace-only changes.

‎jobs/limits/spec‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
name: limits
3+
4+
templates:
5+
pre-start.sh.erb: bin/pre-start
6+
7+
properties:
8+
nofile.soft:
9+
description: |
10+
Modifies the soft max number of open files. Linux defaults to 1024.
11+
example: 16384
12+
default: 16384
13+
nofile.hard:
14+
description: |
15+
Modifies the hard max number of open files. Linux defaults to 4096.
16+
It needs to be greater or equal to the soft limit
17+
example: 16384
18+
default: 16384

‎jobs/limits/templates/pre-start.sh.erb‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/usr/bin/env bash
2+
3+
set -ex
4+
5+
if pidof systemd >/dev/null 2>&1; then
6+
NEW_NOFILE="DefaultLimitNOFILE=<%= p("nofile.soft") %>:<%= p("nofile.hard") %>"
7+
LINE=$(grep -nE '^DefaultLimitNOFILE=' /etc/systemd/system.conf | tail -1 | awk -F: '{print $1}')
8+
if [[ -n "$LINE" ]]; then
9+
sed -i "${LINE}s/.*/$NEW_NOFILE/" /etc/systemd/system.conf
10+
else
11+
echo "$NEW_NOFILE" >> /etc/systemd/system.conf
12+
fi
13+
systemctl daemon-reload
14+
else
15+
>&2 echo "Failed to update systemd configuration because systemd is not running"
16+
fi
17+
18+
pid=$(pgrep monit | awk '{print $1}')
19+
20+
if command -v prlimit >/dev/null 2>&1; then
21+
while [[ $pid -gt 1 ]]; do
22+
prlimit --pid "$pid" --nofile=<%= p("nofile.soft") %>:<%= p("nofile.hard") %>
23+
pid=$(ps -o ppid:1= -p "$pid")
24+
done
25+
else
26+
>&2 echo "Failed to set limits because command 'prlimit' is not available"
27+
fi

‎jobs/limits_not_recommended/spec‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@ templates:
1414
limits.conf.erb: etc/limits.conf
1515

1616
properties:
17+
limits_systemd_default_nofile:
18+
description: |
19+
Ubuntu xenial needs this set for systemd.conf, DefaultLimitNOFILE
20+
All limits.conf and limit.d settings are ignored.
1721
limits_conf:
1822
description: |
1923
Linux `limits.conf` file https://linux.die.net/man/5/limits.conf'

‎jobs/limits_not_recommended/templates/pre-start.sh.erb‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,7 @@
33
set -ex
44

55
cp -f /var/vcap/jobs/limits_not_recommended/etc/limits.conf /etc/security/limits.d/61-bosh-os-conf.conf
6+
7+
<% if_p("limits_systemd_default_nofile") do | limit_nofile| %>
8+
echo "DefaultLimitNOFILE=<%= p("limits_systemd_default_nofile") %>" >> /etc/systemd/system.conf
9+
<% end %>

‎jobs/user_add/templates/pre-start.sh.erb‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,6 @@ set -ex
1919
raise "User must be configured with a 'name' attribute. '#{user_hash}'"
2020
end
2121

22-
if !crypted_password.nil? && !public_key.nil?
23-
raise "User: '#{user}' is configured with both 'crypted_password' and 'public_key'. Choose one."
24-
end
25-
2622
if crypted_password.nil? && public_key.nil?
2723
raise "User: '#{user}' must contain one of 'crypted_password' or 'public_key' key/values."
2824
end
@@ -58,7 +54,9 @@ set -ex
5854

5955
<% if !crypted_password.nil? %>
6056
echo '<%=user%>:<%=crypted_password%>' | chpasswd -e
61-
<% elsif !public_key.nil? %>
57+
<% end %>
58+
59+
<% if !public_key.nil? %>
6260
echo '<%=public_key%>' > ~<%=user%>/.ssh/authorized_keys
6361
chmod 600 ~<%=user%>/.ssh/authorized_keys
6462
chown -R <%=user%> ~<%=user%>/.ssh

‎src/os-conf-acceptance-tests/assets/manifest.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,12 @@ instance_groups:
7979
limits_conf: |
8080
* soft nofile 60000
8181
* hard nofile 100000
82+
- name: limits
83+
release: os-conf
84+
properties:
85+
nofile:
86+
soft: 60000
87+
hard: 100000
8288
- name: login_banner
8389
release: os-conf
8490
properties:
@@ -134,6 +140,11 @@ instance_groups:
134140
shell: /bin/rbash
135141
- name: test-user-key
136142
public_key: test-user-public-key
143+
- name: test-user-key-and-password
144+
sudo: false
145+
crypted_password: $6$kMBogqsbx$70Y2m/mwYR8vKZqR9RD2UUPoWz8mJoBiH8IAbvH2v6LCjxJgB3kDtwR8QttqtI/WSqCsFy4qXZaKPM64sZMwK.
146+
shell: /bin/rbash
147+
public_key: test-user-public-key
137148
vm_type: default
138149
stemcell: default
139150
networks:

‎src/os-conf-acceptance-tests/limits_test.go‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
package os_conf_acceptance_tests_test
2+
3+
import (
4+
"time"
5+
6+
. "github.com/onsi/ginkgo"
7+
. "github.com/onsi/gomega"
8+
"github.com/onsi/gomega/gbytes"
9+
"github.com/onsi/gomega/gexec"
10+
)
11+
12+
var _ = Describe("Limits", func() {
13+
BeforeEach(func() {
14+
if boshStemcell == "ubuntu-trusty" {
15+
Skip("Trusty Stemcells are not supported.")
16+
}
17+
})
18+
19+
Context("when limits are configured", func() {
20+
It("sets the limits for the monit process", func() {
21+
session := boshSSH("os-conf/0", "pid=$(ps -e | grep monit | awk '{print $1}'); cat /proc/$pid/limits | grep 'Max open files' | awk '{print $4}'")
22+
Eventually(session, 30*time.Second).Should(gbytes.Say("60000"))
23+
Eventually(session, 30*time.Second).Should(gexec.Exit(0))
24+
25+
session = boshSSH("os-conf/0", "pid=$(ps -e | grep monit | awk '{print $1}'); cat /proc/$pid/limits | grep 'Max open files' | awk '{print $5}'")
26+
Eventually(session, 30*time.Second).Should(gbytes.Say("100000"))
27+
Eventually(session, 30*time.Second).Should(gexec.Exit(0))
28+
})
29+
30+
It("sets the limits for the parent process", func() {
31+
session := boshSSH("os-conf/0", "pid=$(ps -e | grep monit | awk '{print $1}'); pid_parent=$(ps -o ppid:1= -p $pid); cat /proc/$pid_parent/limits | grep 'Max open files' | awk '{print $4}'")
32+
Eventually(session, 30*time.Second).Should(gbytes.Say("60000"))
33+
Eventually(session, 30*time.Second).Should(gexec.Exit(0))
34+
35+
session = boshSSH("os-conf/0", "pid=$(ps -e | grep monit | awk '{print $1}'); pid_parent=$(ps -o ppid:1= -p $pid); cat /proc/$pid_parent/limits | grep 'Max open files' | awk '{print $5}'")
36+
Eventually(session, 30*time.Second).Should(gbytes.Say("100000"))
37+
Eventually(session, 30*time.Second).Should(gexec.Exit(0))
38+
})
39+
40+
It("sets the limits for the systemd process", func() {
41+
session := boshSSH("os-conf/0", "systemctl show | grep 'DefaultLimitNOFILESoft=' | awk -F= '{print $2}'")
42+
Eventually(session, 30*time.Second).Should(gbytes.Say("60000"))
43+
Eventually(session, 30*time.Second).Should(gexec.Exit(0))
44+
45+
session = boshSSH("os-conf/0", "systemctl show | grep 'DefaultLimitNOFILE=' | awk -F= '{print $2}'")
46+
Eventually(session, 30*time.Second).Should(gbytes.Say("100000"))
47+
Eventually(session, 30*time.Second).Should(gexec.Exit(0))
48+
})
49+
})
50+
})

‎src/os-conf-acceptance-tests/user_add_test.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,15 @@ var _ = Describe("UserAdd", func() {
1515
session := boshSSH("os-conf/0", "sudo cat /etc/passwd")
1616
Eventually(session, 30*time.Second).Should(gbytes.Say(`test-user-password:x:\d+:\d+::/home/test-user-password:/bin/rbash`))
1717
Eventually(session, 30*time.Second).Should(gbytes.Say(`test-user-key:x:\d+:\d+::/home/test-user-key:/bin/bash`))
18+
Eventually(session, 30*time.Second).Should(gbytes.Say(`test-user-key-and-password:x:\d+:\d+::/home/test-user-key-and-password:/bin/rbash`))
1819
Eventually(session, 30*time.Second).Should(gexec.Exit(0))
1920
})
2021

2122
By("adding a password for the password user", func() {
2223
session := boshSSH("os-conf/0", "sudo cat /etc/shadow")
2324
Eventually(session, 30*time.Second).Should(gbytes.Say(`test-user-password:\$6\$kMBogqsbx\$70Y2m/mwYR8vKZqR9RD2UUPoWz8mJoBiH8IAbvH2v6LCjxJgB3kDtwR8QttqtI/WSqCsFy4qXZaKPM64sZMwK\.:\d+:1:99999:7:::`))
2425
Eventually(session, 30*time.Second).Should(gbytes.Say(`test-user-key::\d+:1:99999:7:::`))
26+
Eventually(session, 30*time.Second).Should(gbytes.Say(`test-user-key-and-password:\$6\$kMBogqsbx\$70Y2m/mwYR8vKZqR9RD2UUPoWz8mJoBiH8IAbvH2v6LCjxJgB3kDtwR8QttqtI/WSqCsFy4qXZaKPM64sZMwK\.:\d+:1:99999:7:::`))
2527
Eventually(session, 30*time.Second).Should(gexec.Exit(0))
2628
})
2729

@@ -35,6 +37,12 @@ var _ = Describe("UserAdd", func() {
3537
Eventually(session, 30*time.Second).Should(gexec.Exit(0))
3638
})
3739

40+
By("adding an authorized key for the key-and-password user", func() {
41+
session := boshSSH("os-conf/0", "sudo cat /home/test-user-key-and-password/.ssh/authorized_keys")
42+
Eventually(session, 30*time.Second).Should(gbytes.Say("test-user-public-key"))
43+
Eventually(session, 30*time.Second).Should(gexec.Exit(0))
44+
})
45+
3846
By("adding them to the bosh_sshers group", func() {
3947
session := boshSSH("os-conf/0", "sudo grep bosh_sshers /etc/group")
4048
Eventually(session, 30*time.Second).Should(gbytes.Say("test-user-password,test-user-key"))

0 commit comments

Comments
 (0)