Jcrespo has uploaded a new change for review.
https://gerrit.wikimedia.org/r/259233
Change subject: Enabling ssl on dbstores, disabling peformance_schema for now
......................................................................
Enabling ssl on dbstores, disabling peformance_schema for now
It will not take effect until they are rebooted.
Change-Id: I3bfb6358dfe027f97321a8b0012b4a51f3eadade
References: T111654 T120122
---
M manifests/role/mariadb.pp
M templates/mariadb/dbstore.my.cnf.erb
2 files changed, 52 insertions(+), 4 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/33/259233/1
diff --git a/manifests/role/mariadb.pp b/manifests/role/mariadb.pp
index 1e465a4..d7016aa 100644
--- a/manifests/role/mariadb.pp
+++ b/manifests/role/mariadb.pp
@@ -309,6 +309,8 @@
password => $passwords::misc::scripts::mysql_root_pass,
datadir => '/srv/sqldata',
tmpdir => '/srv/tmp',
+ ssl => 'on',
+ p_s => 'off',
}
mariadb::monitor_replication {
diff --git a/templates/mariadb/dbstore.my.cnf.erb
b/templates/mariadb/dbstore.my.cnf.erb
index b728246..0ff4702 100644
--- a/templates/mariadb/dbstore.my.cnf.erb
+++ b/templates/mariadb/dbstore.my.cnf.erb
@@ -1,10 +1,19 @@
-# destore delayed slaves
+# dbstore delayed and analytic slaves
# Please use separate .cnf templates for each type of server.
[client]
port = 3306
socket = /tmp/mysql.sock
+<% if @ssl == 'on' %>
+# ssl
+ssl-ca=/etc/mysql/ssl/cacert.pem
+ssl-cert=/etc/mysql/ssl/server-cert.pem
+ssl-key=/etc/mysql/ssl/server-key.pem
+# skip server cert validation until we generate one cert per server
+# it would check the cert's common name against the host
+# ssl-verify-server-cert
+<% end %>
[mysqld]
@@ -27,7 +36,6 @@
query_cache_size = 0
query_cache_type = 0
event_scheduler = 1
-userstat = 1
table_open_cache = 50000
table_definition_cache = 50000
@@ -47,8 +55,6 @@
innodb_flush_method = O_DIRECT
innodb_thread_concurrency = 0
innodb_io_capacity = 1000
-innodb_read_io_threads = 16
-innodb_write_io_threads = 8
innodb_stats_sample_pages = 16
innodb_stats_method = nulls_unequal
innodb_locks_unsafe_for_binlog = 1
@@ -80,6 +86,46 @@
m4.replicate-wild-do-table = log.%
x1.replicate-wild-do-table = flowdb.%
+<% if @kernelversion < "3.19" %>
+# Until kernel 3.16 http://www.spinics.net/lists/stable/msg61873.html
+# At least, I think so. For now we need to avoid the an assertion failure on
Trusty w/ 3.13
+innodb_use_native_aio = 0
+innodb_read_io_threads = 16
+innodb_write_io_threads = 8
+<% end %>
+
+# ssl
+ssl-ca=/etc/mysql/ssl/cacert.pem
+ssl-cert=/etc/mysql/ssl/server-cert.pem
+ssl-key=/etc/mysql/ssl/server-key.pem
+ssl-cipher=TLSv1.2
+<% end %>
+
+<% if @p_s == 'on' %>
+# Enabling performance_schema (disabled by default in MariaDB10)
+performance_schema = 1
+# downsizing performance schema memory usage: T99485
+performance_schema_digests_size = -1
+performance_schema_max_thread_instances = 500
+performance_schema_max_cond_instances = 1000
+performance_schema_accounts_size = 300
+performance_schema_hosts_size = 300
+performance_schema_events_statements_history_size = 10
+performance_schema_events_statements_history_long_size = 1000
+performance_schema_events_waits_history_size = 10
+performance_schema_events_waits_history_long_size = 1000
+performance_schema_events_stages_history_size = 10
+performance_schema_events_stages_history_long_size = 1000
+performance_schema_max_mutex_instances = 5000
+performance_schema_max_rwlock_instances = 2000
+performance_schema_max_socket_instances = 500
+performance_schema_max_table_instances = 1000
+<% else %>
+# only enable userstat if p_s is disabled
+performance_schema = 0
+userstat = 1
+<% end %>
+
[mysqldump]
quick
--
To view, visit https://gerrit.wikimedia.org/r/259233
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I3bfb6358dfe027f97321a8b0012b4a51f3eadade
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Jcrespo <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
