Andrew Bogott has submitted this change and it was merged.
Change subject: Add sysctlfile module and one use case.
......................................................................
Add sysctlfile module and one use case.
Change-Id: I7f114d47a965014003d2042578bbe0c6091a51f4
---
M manifests/generic-definitions.pp
M manifests/role/ceph.pp
M manifests/role/memcached.pp
M manifests/role/protoproxy.pp
M manifests/squid.pp
M manifests/swift.pp
M manifests/webserver.pp
A modules/sysctlfile/files/50-advanced-routing-ipv6.conf
A modules/sysctlfile/files/50-advanced-routing.conf
A modules/sysctlfile/files/50-ipv6-disable-ra.conf
A modules/sysctlfile/files/50-lvs.conf
A modules/sysctlfile/files/50-wikimedia-base.conf
A modules/sysctlfile/files/60-high-bandwidth-rsync.conf
A modules/sysctlfile/files/60-high-http-performance.conf
A modules/sysctlfile/files/99-big-rmem.conf
A modules/sysctlfile/manifests/high-http-performance.pp
A modules/sysctlfile/manifests/init.pp
M modules/varnish/manifests/common.pp
18 files changed, 207 insertions(+), 29 deletions(-)
Approvals:
Andrew Bogott: Looks good to me, approved
jenkins-bot: Verified
diff --git a/manifests/generic-definitions.pp b/manifests/generic-definitions.pp
index c10fc31..c27a219 100644
--- a/manifests/generic-definitions.pp
+++ b/manifests/generic-definitions.pp
@@ -786,22 +786,6 @@
}
}
-class generic::sysctl::high-http-performance($ensure="present") {
- if $::lsbdistid == "Ubuntu" and versioncmp($::lsbdistrelease, "10.04")
>= 0 {
- file { high-http-performance-sysctl:
- name => "/etc/sysctl.d/60-high-http-performance.conf",
- owner => root,
- group => root,
- mode => 0444,
- notify => Exec["/sbin/start procps"],
- source =>
"puppet:///files/misc/60-high-http-performance.conf.sysctl",
- ensure => $ensure
- }
- } else {
- alert("Distribution on $hostname does not support
/etc/sysctl.d/ files yet.")
- }
-}
-
class generic::sysctl::advanced-routing($ensure="present") {
if $::lsbdistid == "Ubuntu" and versioncmp($::lsbdistrelease, "10.04")
>= 0 {
file { advanced-routing-sysctl:
diff --git a/manifests/role/ceph.pp b/manifests/role/ceph.pp
index 11229e6..bf79d54 100644
--- a/manifests/role/ceph.pp
+++ b/manifests/role/ceph.pp
@@ -82,7 +82,7 @@
class { "lvs::realserver": realserver_ips => [ "10.2.2.27" ] }
- include generic::sysctl::high-http-performance
+ include sysctlfile::high-http-performance
class { 'ceph::radosgw':
servername => 'ms-fe.eqiad.wmnet',
diff --git a/manifests/role/memcached.pp b/manifests/role/memcached.pp
index f4696d4..e588349 100644
--- a/manifests/role/memcached.pp
+++ b/manifests/role/memcached.pp
@@ -10,7 +10,7 @@
system_role { "role::memcached": description => "memcached server" }
include standard,
- generic::sysctl::high-http-performance
+ sysctlfile::high-http-performance
class { "::memcached":
memcached_size => '89088',
diff --git a/manifests/role/protoproxy.pp b/manifests/role/protoproxy.pp
index f416502..5b884da 100644
--- a/manifests/role/protoproxy.pp
+++ b/manifests/role/protoproxy.pp
@@ -20,7 +20,7 @@
include protoproxy::package
# Tune kernel settings
- include generic::sysctl::high-http-performance
+ include sysctlfile::high-http-performance
$nginx_worker_connections = '32768'
$nginx_use_ssl = true
diff --git a/manifests/squid.pp b/manifests/squid.pp
index 0316fef..bd05398 100644
--- a/manifests/squid.pp
+++ b/manifests/squid.pp
@@ -110,7 +110,7 @@
include aufs
# Tune kernel settings
- include generic::sysctl::high-http-performance
+ include sysctlfile::high-http-performance
}
class squid::redirector {
diff --git a/manifests/swift.pp b/manifests/swift.pp
index c396b08..c71f60b 100644
--- a/manifests/swift.pp
+++ b/manifests/swift.pp
@@ -7,7 +7,7 @@
# include tcp settings
include swift::sysctl::tcp-improvements
- include generic::sysctl::high-http-performance
+ include sysctlfile::high-http-performance
# this is on purpose not a >=. the cloud archive only exists for
# precise right now, and will perhaps exist for the next LTS, but
diff --git a/manifests/webserver.pp b/manifests/webserver.pp
index 67c034e..605024a 100644
--- a/manifests/webserver.pp
+++ b/manifests/webserver.pp
@@ -5,7 +5,7 @@
# Installs a generic, static web server (lighttpd) with default config, which
serves /var/www
class webserver::static {
- include generic::sysctl::high-http-performance,
+ include sysctlfile::high-http-performance,
firewall
package { lighttpd:
@@ -33,7 +33,8 @@
}
class webserver::php5( $ssl = 'false' ) {
- include generic::sysctl::high-http-performance
+
+ include sysctlfile::high-http-performance
package { [ "apache2-mpm-prefork", "libapache2-mod-php5" ]:
ensure => present;
@@ -59,7 +60,7 @@
class webserver::modproxy {
- include generic::sysctl::high-http-performance
+ include sysctlfile::high-http-performance
package { libapache2-mod-proxy-html:
ensure => present;
@@ -70,7 +71,7 @@
# include mysql and apache via dependencies.
class webserver::php5-mysql {
- include generic::sysctl::high-http-performance
+ include sysctlfile::high-http-performance
package { php5-mysql:
ensure => present;
@@ -79,7 +80,7 @@
class webserver::php5-gd {
- include generic::sysctl::high-http-performance
+ include sysctlfile::high-http-performance
package { "php5-gd":
ensure => present;
@@ -89,7 +90,7 @@
# Install the 'apache2' package
class webserver::apache2 {
- include generic::sysctl::high-http-performance
+ include sysctlfile::high-http-performance
package { apache2:
ensure => present;
@@ -325,5 +326,5 @@
include packages,
config,
service,
- generic::sysctl::high-http-performance
+ sysctlfile::high-http-performance
}
diff --git a/modules/sysctlfile/files/50-advanced-routing-ipv6.conf
b/modules/sysctlfile/files/50-advanced-routing-ipv6.conf
new file mode 100644
index 0000000..0e8b410
--- /dev/null
+++ b/modules/sysctlfile/files/50-advanced-routing-ipv6.conf
@@ -0,0 +1,12 @@
+# This file is managed by Puppet!
+
+# Enable router advertisements even when forwarding is enabled
+# ("all" doesn't work with accept_ra, add eth0 here as a hack)
+net.ipv6.conf.eth0.accept_ra=2
+net.ipv6.conf.default.accept_ra=2
+
+# Turn on ip forwarding
+net.ipv4.conf.all.forwarding=1
+net.ipv4.conf.default.forwarding=1
+net.ipv6.conf.all.forwarding=1
+net.ipv6.conf.default.forwarding=1
diff --git a/modules/sysctlfile/files/50-advanced-routing.conf
b/modules/sysctlfile/files/50-advanced-routing.conf
new file mode 100644
index 0000000..ec9cb6b
--- /dev/null
+++ b/modules/sysctlfile/files/50-advanced-routing.conf
@@ -0,0 +1,9 @@
+# This file is managed by Puppet!
+
+# Turn OFF RP filter
+net.ipv4.conf.default.rp_filter=0
+net.ipv4.conf.all.rp_filter=0
+
+# Turn on ip forwarding
+net.ipv4.ip_forward=1
+net.ipv6.conf.all.forwarding=1
diff --git a/modules/sysctlfile/files/50-ipv6-disable-ra.conf
b/modules/sysctlfile/files/50-ipv6-disable-ra.conf
new file mode 100644
index 0000000..fafb130
--- /dev/null
+++ b/modules/sysctlfile/files/50-ipv6-disable-ra.conf
@@ -0,0 +1,4 @@
+# This file is managed by Puppet!
+
+# Turn off ra
+net.ipv6.conf.all.accept_ra=0
diff --git a/modules/sysctlfile/files/50-lvs.conf
b/modules/sysctlfile/files/50-lvs.conf
new file mode 100644
index 0000000..50198d2
--- /dev/null
+++ b/modules/sysctlfile/files/50-lvs.conf
@@ -0,0 +1,11 @@
+# This file is managed by Puppet!
+
+# Turn OFF RP filter
+net.ipv4.conf.default.rp_filter=0
+net.ipv4.conf.all.rp_filter=0
+
+# Turn off ip forwarding for security - LVS servers sit on all subnets
+net.ipv4.ip_forward=0
+
+# disable the route cache. prone to DDoS attacks and was even removed in >=
3.6 kernels
+net.ipv4.rt_cache_rebuild_count = -1
diff --git a/modules/sysctlfile/files/50-wikimedia-base.conf
b/modules/sysctlfile/files/50-wikimedia-base.conf
new file mode 100644
index 0000000..7bf1f80
--- /dev/null
+++ b/modules/sysctlfile/files/50-wikimedia-base.conf
@@ -0,0 +1,31 @@
+#####################################################################
+### THIS FILE IS MANAGED BY PUPPET
+### puppet:///files/misc/50-wikimedia-base.conf.sysctl
+#####################################################################
+
+# increase TCP max buffer size
+net.core.rmem_max = 16777216
+net.core.wmem_max = 16777216
+
+# increase Linux autotuning TCP buffer limits
+# min, default, and max number of bytes to use
+net.ipv4.tcp_rmem = 4096 87380 16777216
+net.ipv4.tcp_wmem = 4096 65536 16777216
+
+# don't cache ssthresh from previous connection
+net.ipv4.tcp_no_metrics_save = 1
+# recommended to increase this for 1000 BT or higher
+net.core.netdev_max_backlog = 2500
+
+# Increase the queue size of new TCP connections
+net.core.somaxconn = 1024
+net.ipv4.tcp_max_syn_backlog = 4096
+
+# Swapping makes things too slow and should be done rarely
+# 0 = only swap in oom conditions (does not disable swap)
+vm.swappiness = 0
+
+# The default TCP keepalive time of 2H is too long
+net.ipv4.tcp_keepalive_time = 300
+net.ipv4.tcp_keepalive_intvl = 1
+net.ipv4.tcp_keepalive_probes = 2
diff --git a/modules/sysctlfile/files/60-high-bandwidth-rsync.conf
b/modules/sysctlfile/files/60-high-bandwidth-rsync.conf
new file mode 100644
index 0000000..cbcd8bb
--- /dev/null
+++ b/modules/sysctlfile/files/60-high-bandwidth-rsync.conf
@@ -0,0 +1,12 @@
+#####################################################################
+### THIS FILE IS MANAGED BY PUPPET
+### puppet:///files/misc/60-high-bandwidth-rsync.conf.sysctl
+#####################################################################
+
+
+# Sysctl settings for high bandwidth rsyncs
+
+# start reclaiming memory sooner than the default, in order to keep
+# pace with gigabit eth drivers requesting buffer allocations
+vm.min_free_kbytes = 262144
+
diff --git a/modules/sysctlfile/files/60-high-http-performance.conf
b/modules/sysctlfile/files/60-high-http-performance.conf
new file mode 100644
index 0000000..9300682
--- /dev/null
+++ b/modules/sysctlfile/files/60-high-http-performance.conf
@@ -0,0 +1,25 @@
+#####################################################################
+### THIS FILE IS MANAGED BY PUPPET
+### puppet:///modules/sysctlfile/60-high-http-performance.conf.sysctl
+#####################################################################
+
+
+# Sysctl settings for high-load HTTP caches
+
+# Increase the number of ephemeral ports
+net.ipv4.ip_local_port_range = 1024 65535
+
+# recommended to increase this for 1000 BT or higher
+net.core.netdev_max_backlog = 30000
+
+
+# Increase the queue size of new TCP connections
+net.core.somaxconn = 4096
+net.ipv4.tcp_max_syn_backlog = 262144
+net.ipv4.tcp_max_tw_buckets = 360000
+
+# Decrease FD usage
+net.ipv4.tcp_fin_timeout = 3
+net.ipv4.tcp_max_orphans = 262144
+net.ipv4.tcp_synack_retries = 2
+net.ipv4.tcp_syn_retries = 2
diff --git a/modules/sysctlfile/files/99-big-rmem.conf
b/modules/sysctlfile/files/99-big-rmem.conf
new file mode 100644
index 0000000..d5c38f4
--- /dev/null
+++ b/modules/sysctlfile/files/99-big-rmem.conf
@@ -0,0 +1,3 @@
+net.core.rmem_max = 536870912
+net.core.rmem_default = 4194304
+
diff --git a/modules/sysctlfile/manifests/high-http-performance.pp
b/modules/sysctlfile/manifests/high-http-performance.pp
new file mode 100644
index 0000000..4fb3805
--- /dev/null
+++ b/modules/sysctlfile/manifests/high-http-performance.pp
@@ -0,0 +1,7 @@
+# sysctl values for http high performance
+class sysctlfile::high-http-performance($ensure="present") {
+ sysctlfile {'high-http-performance':
+ source => 'puppet:///modules/sysctlfile/60-high-http-performance.conf',
+ ensure => $ensure
+ }
+}
diff --git a/modules/sysctlfile/manifests/init.pp
b/modules/sysctlfile/manifests/init.pp
new file mode 100644
index 0000000..189b4e7
--- /dev/null
+++ b/modules/sysctlfile/manifests/init.pp
@@ -0,0 +1,79 @@
+# Sysctlfile
+
+# Creates a file in /etc/sysctl.d to set sysctl settings, and reloads
+# sysctl with the new settings.
+#
+# There are three ways to use this define. You must specify one of
+# $value, $content, or $source. Not specifying one of these results
+# in a parse failure.
+#
+# Usage 1: $value
+# sysctlfile { "net.core.rmem_max": value => 16777218 }
+#
+# Usage 2: $content
+# $rmem_max = 536870912
+# sysctlfile { "custom_rmem_max": content =>
template("sysctl/sysctl_rmemmax.erb") }
+#
+# Usage 3: $source
+# sysctlfile { "custom_rmem_max": source =>
"puppet:///files/misc/rmem_max.sysctl.conf" }
+#
+# Parameters:
+# $key
+# $value - Puts "$key = $value" in the sysctl.d file.
+# $content - Puts this exact content in the sysctl.d file.
+# $source - Puts the $source file at the sysctl.d file.
+# $ensure - Either 'present' or 'absent'. Default: 'present'.
+# $number_prefix - The load order prefix number in the sysctl.d filename.
Default '60'. You probably don't need to change this.
+#
+define sysctlfile($value = undef,
+ $key = $title,
+ $content = undef,
+ $source = undef,
+ $ensure = 'present',
+ $number_prefix = '60') {
+ $sysctl_file = "/etc/sysctl.d/${number_prefix}-${key}.conf"
+
+ file { $sysctl_file:
+ mode => '0444',
+ owner => 'root',
+ group => 'root',
+ ensure => $ensure,
+ }
+
+ # if using $value, then set $key = $value in the sysctl.d file
+ if $value {
+ File[$sysctl_file] { content => "${key} = ${value}" }
+ }
+ # else just set the content
+ elsif $content {
+ File[$sysctl_file] { content => $content }
+ }
+ # else put the file in place from a source file.
+ elsif $source {
+ File[$sysctl_file] { source => $source }
+ }
+ # if none of the above are defined, then throw a parse failure.
+ else {
+ fail("sysctl '${title}' must specify one of \$content, \$source or
\$value.")
+ }
+
+ # Refresh sysctl if we are ensuring the sysctl.d file
+ # exists. NOTE: I'm not sure how to reset the sysctl
+ # value to its original if we ensure => absent. For now,
+ # that will have to wait until a reboot happens. This
+ # probably won't be a real problem anyway. Anyone
+ # using this define can just explicitly set the value
+ # back to what it should be, rather than using ensure => 'absent'.
+ if $ensure == 'present' {
+ # refresh sysctl when the sysctl file changes
+ exec { "sysctl_reload_${key}":
+ command => "/sbin/sysctl -p $sysctl_file",
+ subscribe => File[$sysctl_file],
+ refreshonly => true,
+ }
+ }
+
+ if !($::lsbdistid == "Ubuntu" and versioncmp($::lsbdistrelease, "10.04")
>= 0) {
+ alert("Distribution on $hostname does not support /etc/sysctl.d/ files
yet.")
+ }
+}
diff --git a/modules/varnish/manifests/common.pp
b/modules/varnish/manifests/common.pp
index 045a5db..b8ae8d7 100644
--- a/modules/varnish/manifests/common.pp
+++ b/modules/varnish/manifests/common.pp
@@ -2,7 +2,7 @@
require varnish::packages
# Tune kernel settings
- include generic::sysctl::high-http-performance
+ include sysctlfile::high-http-performance
# Mount /var/lib/ganglia as tmpfs to avoid Linux flushing mlocked
# shm memory to disk
--
To view, visit https://gerrit.wikimedia.org/r/73888
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I7f114d47a965014003d2042578bbe0c6091a51f4
Gerrit-PatchSet: 3
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Andrew Bogott <[email protected]>
Gerrit-Reviewer: Andrew Bogott <[email protected]>
Gerrit-Reviewer: Lcarr <[email protected]>
Gerrit-Reviewer: Ori.livneh <[email protected]>
Gerrit-Reviewer: Ottomata <[email protected]>
Gerrit-Reviewer: Ryan Lane <[email protected]>
Gerrit-Reviewer: jenkins-bot
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
