dmwm-alma9-base

docker/pypi/dmwm-alma9-base/Dockerfile

@@ -0,0 +1,23 @@
+FROM registry.cern.ch/cmsweb/exporters AS exporters
+FROM cern/alma9-base:latest
+LABEL org.opencontainers.image.authors="Alan Malta alan.malta@cern.ch"
+
+# Required OS packages
+RUN dnf -y upgrade && \
+    dnf -y install --skip-broken curl libcurl && \
+    dnf -y install sudo vim less procps && \
+    dnf -y install python3.12 python3.12-pip python3-pycurl pip && \
+    dnf clean all
+RUN ln -s /usr/bin/python3.12 /usr/bin/python
+
+# base image stuff: certificates, monitoring, exporters, etc
+COPY --from=exporters /data/cmsweb-ping /usr/bin/cmsweb-ping
+COPY --from=exporters /data/process_exporter /usr/bin/process_exporter
+COPY --from=exporters /data/cpy_exporter /usr/bin/cpy_exporter
+
+
+ENV WDIR=/data
+ADD run.sh $WDIR/run.sh
+ADD monitor.sh $WDIR/monitor.sh
+ADD manage $WDIR/manage
+WORKDIR /data

docker/pypi/dmwm-alma9-base/README.md

@@ -0,0 +1,11 @@
+# DMWM-alma9-base Image
+
+This image may be used for dmwm services as a base image.
+
+## Building
+```
+docker buildx build -t registry.cern.ch/cmsweb/dmwm-base:<preferred-tag-here> .
+```
+
+## Certificates
+/etc/grid-security/certificates and /etc/grid-security/vomsdir need to be mounted

docker/pypi/dmwm-alma9-base/manage

@@ -0,0 +1,105 @@
+#!/bin/bash
+##H Usage: manage ACTION [ATTRIBUTE] [SECURITY-STRING]
+##H
+##H Available actions:
+##H   help        show this help
+##H   version     get current version of the service
+##H   status      show current service's status
+##H   restart     (re)start the service
+##H   start       (re)start the service
+##H   stop        stop the service
+
+# common settings to prettify output
+echo_e=-e
+COLOR_OK="\\033[0;32m"
+COLOR_WARN="\\033[0;31m"
+COLOR_NORMAL="\\033[0;39m"
+
+# service settings
+srv=`echo $USER | sed -e "s,_,,g" | sed -e "s,t0req,t0_req,g"`
+LOGDIR=/data/srv/logs/$srv
+AUTHDIR=/data/srv/current/auth/$srv
+STATEDIR=/data/srv/state/$srv
+CFGDIR=/data/srv/current/config/$srv
+CFGFILE=$CFGDIR/config.py
+# some MS services uses different config naming convention, therefore we'll
+# adjust CFGFILE assingment
+for c in monitor output ruleCleaner transferor unmerged; do
+    if [ -f $CFGDIR/config-${c}.py ]; then
+        CFGFILE=$CFGDIR/config-${c}.py
+    fi
+done
+
+# necessary env settings for all WM services
+export PYTHONPATH=$PYTHONPATH:/etc/secrets:/data/srv/current/config/$srv
+export X509_USER_KEY=$AUTHDIR/dmwm-service-key.pem
+export X509_USER_CERT=$AUTHDIR/dmwm-service-cert.pem
+export REQMGR_CACHE_DIR=$STATEDIR
+export WMCORE_CACHE_DIR=$STATEDIR
+# MSUnmerged also needs to access a proxy with additional voms roles
+if [ -f $AUTHDIR/proxy.cert ]; then
+    export X509_USER_PROXY=$AUTHDIR/proxy.cert
+fi
+
+# by default Rucio relies on /opt/rucio/etc/config.cfg
+# if necessary we may setup RUCIO_HOME which should provide this location
+# but in k8s we mount rucio config.cfg under /opt/rucio/etc area
+
+usage()
+{
+    cat $0 | grep "^##H" | sed -e "s,##H,,g"
+}
+
+start_srv()
+{
+    wmc-httpd -r -d $STATEDIR -l "$LOGDIR/$srv-`hostname -s`.log" $CFGFILE
+}
+
+stop_srv()
+{
+    local pid=`ps auxwww | egrep "wmc-httpd" | grep -v grep | awk 'BEGIN{ORS=" "} {print $2}'`
+    echo "Stop $srv service... ${pid}"
+    if [ -n "${pid}" ]; then
+        kill -9 ${pid}
+    fi
+}
+
+status_srv()
+{
+    local pid=`ps auxwww | egrep "wmc-httpd" | grep -v grep | awk 'BEGIN{ORS=" "} {print $2}'`
+    if  [ -z "${pid}" ]; then
+        echo "$srv service is not running"
+        return
+    fi
+    if [ ! -z "${pid}" ]; then
+        echo $echo_e "$srv service is ${COLOR_OK}RUNNING${COLOR_NORMAL}, PID=${pid}"
+        ps -f -wwww -p ${pid}
+    else
+        echo $echo_e "$srv service is ${COLOR_WARN}NOT RUNNING${COLOR_NORMAL}"
+    fi
+}
+
+# Main routine, perform action requested on command line.
+case ${1:-status} in
+  start | restart )
+    stop_srv
+    start_srv
+    ;;
+
+  status )
+    status_srv
+    ;;
+
+  stop )
+    stop_srv
+    ;;
+
+  help )
+    usage
+    ;;
+
+  * )
+    echo "$0: unknown action '$1', please try '$0 help' or documentation." 1>&2
+    exit 1
+    ;;
+esac

docker/pypi/dmwm-alma9-base/monitor.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+echo -e "\nTrying to start process_exporter..."
+# start process exporter
+configs="config config-monitor config-output config-transferor config-ruleCleaner config-unmerged"
+for p in $configs; do
+    if [ -f /etc/secrets/${p}.py ]; then
+        echo "  Using configuration file: /etc/secrets/${p}.py"
+        pat="wmc-httpd.*$p"
+        pid=`ps axjfwww | grep "$pat" | grep -v grep | grep -v process_monitor | grep -v " 1 " | awk '{print $1}'`
+        if [ -n "$pid" ]; then
+            app=`grep ^main.application /etc/secrets/${p}.py | grep -v application_dir | sed -e 's,#.*,,g' | awk '{split($0,a,"="); print a[2]}' | sed -e "s, ,,g" -e 's,",,g' -e "s,-,_,g"`
+            echo "  Using PID: $pid and app name: '$app'"
+            if [ -n "$app" ]; then
+                prefix=${app}
+                port=`grep main.port /etc/secrets/${p}.py | sed -e 's,#.*,,g' | awk '{split($0,a,"="); print a[2]}' | sed -e "s, ,,g"`
+                address=":1${port}"
+                echo "  Starting process_exporter with prefix ${prefix} on ${address}"
+                nohup process_exporter -pid $pid -prefix $prefix -address "$address" 2>&1 1>& ${prefix}.log < /dev/null &
+                #cpyAddr=`echo ${address} | sed "s,8,9,g"`
+                #echo "Start cpy_exporter on ${cpyAddr}"
+                #nohup cpy_exporter -address "$address" 2>&1 1>& cpy_${prefix}.log < /dev/null &
+            fi
+        fi
+    fi
+done

docker/pypi/dmwm-alma9-base/run.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+# script to start ReqMgr2
+
+srv=`echo $USER | sed -e "s,_,,g"`
+STATEDIR=/data/srv/state/$srv
+LOGDIR=/data/srv/logs/$srv
+AUTHDIR=/data/srv/current/auth/$srv
+CONFIGDIR=/data/srv/current/config/$srv
+CONFIGFILE=${CONFIGFILE:-config.py}
+CFGFILE=/etc/secrets/$CONFIGFILE
+
+### permission update to workaround issues with mounting logs volume
+sudo chown -R $USER.$USER /data
+
+mkdir -p $LOGDIR
+mkdir -p $STATEDIR
+mkdir -p $AUTHDIR
+mkdir -p $CONFIGDIR
+mkdir -p $AUTHDIR/../wmcore-auth
+
+# environment variables required to run some of the WMCore services
+export REQMGR_CACHE_DIR=$STATEDIR
+export WMCORE_CACHE_DIR=$STATEDIR
+
+# overwrite host PEM files in /data/srv area by the robot certificate
+# Note that the proxy file is not required and used
+if [ -f /etc/robots/robotkey.pem ]; then
+    sudo cp /etc/robots/robotkey.pem $AUTHDIR/dmwm-service-key.pem
+    sudo cp /etc/robots/robotcert.pem $AUTHDIR/dmwm-service-cert.pem
+    sudo chown $USER.$USER $AUTHDIR/dmwm-service-key.pem
+    sudo chown $USER.$USER $AUTHDIR/dmwm-service-cert.pem
+    sudo chmod 0400 $AUTHDIR/dmwm-service-key.pem
+fi
+
+if [ -e $AUTHDIR/dmwm-service-cert.pem ] && [ -e $AUTHDIR/dmwm-service-key.pem ]; then
+    export X509_USER_CERT=$AUTHDIR/dmwm-service-cert.pem
+    export X509_USER_KEY=$AUTHDIR/dmwm-service-key.pem
+fi
+
+# overwrite header-auth key file with one from secrets
+if [ -f /etc/hmac/hmac ]; then
+    sudo cp /etc/hmac/hmac $AUTHDIR/../wmcore-auth/header-auth-key
+    sudo chown $USER.$USER $AUTHDIR/../wmcore-auth/header-auth-key
+    sudo chmod 0600 $AUTHDIR/../wmcore-auth/header-auth-key
+fi
+
+# use service configuration files from /etc/secrets if they are present
+files=`ls /etc/secrets`
+for fname in $files; do
+    if [ -f /etc/secrets/$fname ]; then
+        if [ -f $CONFIGDIR/$fname ]; then
+            rm $CONFIGDIR/$fname
+        fi
+        sudo cp /etc/secrets/$fname $CONFIGDIR/$fname
+        sudo chown $USER.$USER $CONFIGDIR/$fname
+        if [ "$fname" == "$CONFIGFILE" ]; then
+            CFGFILE=$CONFIGDIR/$CONFIGFILE
+        fi
+    fi
+done
+files=`ls /etc/secrets`
+for fname in $files; do
+    if [ ! -f $CONFIGDIR/$fname ]; then
+        sudo cp /etc/secrets/$fname $AUTHDIR/$fname
+        sudo chown $USER.$USER $AUTHDIR/$fname
+    fi
+done
+
+export PYTHONPATH=$PYTHONPATH:/etc/secrets:$AUTHDIR/$fname
+
+# backward compatible changes for RPM based deployment location of aux files
+if [ -d /usr/local/data ] && [ "$USER" == "_reqmgr2" ]; then
+   sudo mkdir -p /data/srv/current/apps/reqmgr2
+   sudo ln -s /usr/local/data /data/srv/current/apps/reqmgr2
+fi
+
+# start the service
+wmc-httpd -r -d $STATEDIR -l "|rotatelogs $LOGDIR/$srv-%Y%m%d-`hostname -s`.log 86400" $CFGFILE
+
+# start monitor.sh script
+if [ -f /data/monitor.sh ]; then
+    /data/monitor.sh
+fi
+
+# hack to keep the container running
+tail -f /etc/hosts