Set Puma Process Tag #2291

micahlee · 2021-06-23T21:26:38Z

What does this PR do?

This PR updates the puma config to explicitly set the process tag, rather than defaulting to the directory name of the application. This allows us to reliably identify the process to restart it when reloading the Conjur configuration.

What ticket does this PR close?

Resolves ONYX-9564

Checklists

Change log

The CHANGELOG has been updated, or
This PR does not include user-facing changes and doesn't require a CHANGELOG update

Test coverage

This PR includes new unit and integration tests to go with the code changes, or
The changes in this PR do not require new tests

Documentation

Docs (e.g. READMEs) were updated in this PR, and/or there is a follow-on issue to update docs, or
This PR does not require updating any documentation

API Changes

The OpenAPI spec has been updated to meet new API changes (or an issue has been opened), or
The changes in this PR do not affect the Conjur API

codeclimate · 2021-06-23T21:52:05Z

bin/conjur-cli/commands/configuration/apply.rb

- cmd = "ps -ef | grep puma | grep -v grep | grep -v cluster | " \
- "grep conjur | awk '{print $2}' | tr -d '\n'"
- stdout, _ = @command_runner.capture2(cmd)
+ cmd ="ps -ef | " +


Prefer string interpolation to string concatenation.

i think this is ok because it lets us add comments on each line to explain it.

You may be able to use backslashes at the end of each line to make this go away. I don't think code climate counts this as concatenation.

@jtuttle, I couldn't figure out how to use \ and have comments in between. Is there a trick to this I couldn't find?

Ah shoot, no you're right that probably doesn't work. Might just have to approve the CC warning on this one.

orenbm · 2021-06-24T06:43:11Z

bin/conjur-cli/commands/configuration/apply.rb

+ "grep puma | " +
+ # Filter to only puma process for the Conjur API Server. This tag
+ # is defined in the `config/puma.rb`.
+ "grep '[Conjur API Server]' | " + 


this worked for me only like this "grep '\\[Conjur API Server\\]' | ". The current grep will catch any line that has any letter of Conjur API Server as the brackets act as regex square brackets.

@micahlee i pushed this change so i can build a Conjur on RHEL instance and verified that updating /etc/conjur/config/conjur.yml and adding authenticators works:

➜ dap-package git:(verify-puma-tag) ✗ ssh -i ~/oren-aws.pem ec2-user@ec2-18-206-81-135.compute-1.amazonaws.com This system is not registered to Red Hat Insights. See https://cloud.redhat.com/ To register this system, run: insights-client --register Last login: Thu Jun 24 09:02:40 2021 from 194.90.225.101 [ec2-user@ip-172-31-70-43 ~]$ [ec2-user@ip-172-31-70-43 ~]$ [ec2-user@ip-172-31-70-43 ~]$ sudo su [root@ip-172-31-70-43 ec2-user]# evoke configuration apply Conjur server reboot initiated. New configuration will be applied. [root@ip-172-31-70-43 ec2-user]# [root@ip-172-31-70-43 ec2-user]# [root@ip-172-31-70-43 ec2-user]# curl -k https://localhost/info { "release": "12.2.0+Conjur.RHEL.CA", "version": "5.14.1", "services": { "possum": { "name": "conjur-possum", "version": "1.11.7.32_f060df58", "arch": "x86_64" }, "evoke": { "name": "conjur-evoke", "version": "5.21.0.0_8546dc3", # ----------------------------- "arch": "x86_64" }, "ui": { "name": "conjur-ui", "version": "2.13.1.0_204e265c", "arch": "x86_64" } }, "container": "ip-172-31-70-43.ec2.internal", "role": "master", "configuration": { "conjur": { "role": "master", "account": "oren", "hostname": "Oren-oren-1-lb-93042339.us-east-1.elb.amazonaws.com", "master_altnames": [ "Oren-oren-1-lb-93042339.us-east-1.elb.amazonaws.com", "ec2-18-206-81-135.compute-1.amazonaws.com", "ec2-44-192-19-138.compute-1.amazonaws.com", "ec2-35-175-120-54.compute-1.amazonaws.com" ], "debug": true, "cluster_name": "cluster_oren", "cluster_master": "ec2-18-206-81-135.compute-1.amazonaws.com", "cluster_members": "ec2-18-206-81-135.compute-1.amazonaws.com=http://ec2-18-206-81-135.compute-1.amazonaws.com:2380,ec2-35-175-120-54.compute-1.amazonaws.com=http://ec2-35-175-120-54.compute-1.amazonaws.com:2380,ec2-44-192-19-138.compute-1.amazonaws.com=http://ec2-44-192-19-138.compute-1.amazonaws.com:2380", "cluster_machine_name": "ec2-18-206-81-135.compute-1.amazonaws.com", "cluster_machine_address": "ec2-18-206-81-135.compute-1.amazonaws.com", "cluster_ttl": 300, "cluster_interval": 1 } }, "authenticators": { "installed": [ "authn", "authn-azure", "authn-gcp", "authn-iam", "authn-k8s", "authn-ldap", "authn-oidc" ], "configured": [ "authn" ], "enabled": [ "authn" ] } }[root@ip-172-31-70-43 ec2-user]# vi /etc/conjur/config/conjur.yml [root@ip-172-31-70-43 ec2-user]# evoke configuration apply Conjur server reboot initiated. New configuration will be applied. [root@ip-172-31-70-43 ec2-user]# curl -k https://localhost/info { "release": "12.2.0+Conjur.RHEL.CA", "version": "5.14.1", "services": { "possum": { "name": "conjur-possum", "version": "1.11.7.32_f060df58", "arch": "x86_64" }, "evoke": { "name": "conjur-evoke", "version": "5.21.0.0_8546dc3", "arch": "x86_64" }, "ui": { "name": "conjur-ui", "version": "2.13.1.0_204e265c", "arch": "x86_64" } }, "container": "ip-172-31-70-43.ec2.internal", "role": "master", "configuration": { "conjur": { "role": "master", "account": "oren", "hostname": "Oren-oren-1-lb-93042339.us-east-1.elb.amazonaws.com", "master_altnames": [ "Oren-oren-1-lb-93042339.us-east-1.elb.amazonaws.com", "ec2-18-206-81-135.compute-1.amazonaws.com", "ec2-44-192-19-138.compute-1.amazonaws.com", "ec2-35-175-120-54.compute-1.amazonaws.com" ], "debug": true, "cluster_name": "cluster_oren", "cluster_master": "ec2-18-206-81-135.compute-1.amazonaws.com", "cluster_members": "ec2-18-206-81-135.compute-1.amazonaws.com=http://ec2-18-206-81-135.compute-1.amazonaws.com:2380,ec2-35-175-120-54.compute-1.amazonaws.com=http://ec2-35-175-120-54.compute-1.amazonaws.com:2380,ec2-44-192-19-138.compute-1.amazonaws.com=http://ec2-44-192-19-138.compute-1.amazonaws.com:2380", "cluster_machine_name": "ec2-18-206-81-135.compute-1.amazonaws.com", "cluster_machine_address": "ec2-18-206-81-135.compute-1.amazonaws.com", "cluster_ttl": 300, "cluster_interval": 1 } }, "authenticators": { "installed": [ "authn", "authn-azure", "authn-gcp", "authn-iam", "authn-k8s", "authn-ldap", "authn-oidc" ], "configured": [ "authn" ], "enabled": [ "authn-oidc/oren" ] } } [root@ip-172-31-70-43 ec2-user]# cat /etc/conjur/config/conjur.yml # ----------------------------- # Conjur configuration file # ----------------------------- # # This file configures Conjur settings in YAML format. These settings generally # consist of lines in the form: # # name: value # # Comments are introduced with "#" anywhere on a line. # # The commented-out settings shown in this file represent the default values. # # These configuration values are loaded by the Conjur process at startup and can # be overridden by providing environment variables of the same name prefixed by # CONJUR. For example, you can override the trusted_proxies value from this # file by setting CONJUR_TRUSTED_PROXIES in the environment. # Trusted proxies ensures that DAP can properly source client IP addresses. # # This setting should be a list of IP addresses and/or IP address ranges in CIDR # notation. For example: # # trusted_proxies: # - 192.168.1.1 # - 127.0.0.1 # trusted_proxies: [] authenticators: - authn-oidc/oren # This is a placeholder key to allow AnywayConfig to parse this sample config # file consisting only of comments. Once the following PR is merged and # released, this will no longer be necessary: # https://github.com/palkan/anyway_config/pull/83 _:

orenbm

left a comment for fixing the grep but this is great!

jtuttle

Looks like a much more reliable way to do this. Thanks for cleaning it up!

This allows us to reliably identify the Conjur API server process to restart when reloading the Conjur config.

codeclimate · 2021-06-24T14:59:05Z

Code Climate has analyzed commit 1747480 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 90.6% (0.0% change).

View more on Code Climate.

micahlee requested a review from a team as a code owner June 23, 2021 21:26

micahlee force-pushed the onyx-9564-puma-process-id branch from 2888597 to ed45f02 Compare June 23, 2021 21:27

micahlee requested a review from orenbm June 23, 2021 21:28

micahlee mentioned this pull request Jun 23, 2021

Fix "evoke configuration apply" error in RHEL #2289

Closed

8 tasks

codeclimate bot reviewed Jun 23, 2021

View reviewed changes

orenbm reviewed Jun 24, 2021

View reviewed changes

orenbm suggested changes Jun 24, 2021

View reviewed changes

jtuttle previously approved these changes Jun 24, 2021

View reviewed changes

orenbm dismissed jtuttle’s stale review via d6488b2 June 24, 2021 13:14

orenbm force-pushed the onyx-9564-puma-process-id branch 2 times, most recently from d6488b2 to 2965092 Compare June 24, 2021 13:14

orenbm previously approved these changes Jun 24, 2021

View reviewed changes

Set the puma process tag

1747480

This allows us to reliably identify the Conjur API server process to restart when reloading the Conjur config.

micahlee dismissed orenbm’s stale review via 1747480 June 24, 2021 13:37

micahlee force-pushed the onyx-9564-puma-process-id branch from 2965092 to 1747480 Compare June 24, 2021 13:37

micahlee requested review from orenbm and jtuttle June 24, 2021 13:37

orenbm approved these changes Jun 24, 2021

View reviewed changes

jtuttle approved these changes Jun 24, 2021

View reviewed changes

micahlee merged commit 1eedac0 into master Jun 24, 2021

micahlee deleted the onyx-9564-puma-process-id branch June 24, 2021 15:09

jtuttle mentioned this pull request Aug 13, 2021

Update suite.yml for v1.13.0+suite.1 release cyberark/conjur-oss-suite-release#230

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Set Puma Process Tag #2291

Set Puma Process Tag #2291

micahlee commented Jun 23, 2021

codeclimate bot Jun 23, 2021

orenbm Jun 24, 2021

jtuttle Jun 24, 2021

micahlee Jun 24, 2021

jtuttle Jun 24, 2021

orenbm Jun 24, 2021 •

edited

Loading

orenbm Jun 24, 2021 •

edited

Loading

orenbm left a comment

jtuttle left a comment

codeclimate bot commented Jun 24, 2021

Set Puma Process Tag #2291

Set Puma Process Tag #2291

Conversation

micahlee commented Jun 23, 2021

What does this PR do?

What ticket does this PR close?

Checklists

Change log

Test coverage

Documentation

API Changes

codeclimate bot Jun 23, 2021

Choose a reason for hiding this comment

orenbm Jun 24, 2021

Choose a reason for hiding this comment

jtuttle Jun 24, 2021

Choose a reason for hiding this comment

micahlee Jun 24, 2021

Choose a reason for hiding this comment

jtuttle Jun 24, 2021

Choose a reason for hiding this comment

orenbm Jun 24, 2021 • edited Loading

Choose a reason for hiding this comment

orenbm Jun 24, 2021 • edited Loading

Choose a reason for hiding this comment

orenbm left a comment

Choose a reason for hiding this comment

jtuttle left a comment

Choose a reason for hiding this comment

codeclimate bot commented Jun 24, 2021

orenbm Jun 24, 2021 •

edited

Loading

orenbm Jun 24, 2021 •

edited

Loading