jaxxstorm's questions

I am trying to set the max open files on CentOS 7 for elasticsearch. I've read over and over again how to set this but it doesn't seem to be working. As I understand it:

• limits.conf is irrelevant because elasticsearch user is set to /sbin/nologin and we're starting the daemon with system
• I need to set LimitNOFILE=65535 in the systemd unit file.

So, I went ahead and did that, here's my unit file, it's provided by the elasticsearch puppet module:

[Unit]
Description=Starts and stops a single elasticsearch instance on this system
Documentation=http://www.elasticsearch.org

[Service]
Type=forking
EnvironmentFile=/etc/sysconfig/elasticsearch-graylog2
User=elasticsearch
Group=elasticsearch
PIDFile=/var/run/elasticsearch/elasticsearch-graylog2.pid
ExecStart=/usr/share/elasticsearch/bin/elasticsearch -d -p /var/run/elasticsearch/elasticsearch-graylog2.pid -Des.default.path.home=${ES_HOME} -Des.default.path.logs=${LOG_DIR} -Des.default.path.data=${DATA_DIR} -Des.default.path.work=${WORK_DIR} -Des.default.path.conf=${CONF_DIR}
# See MAX_OPEN_FILES in sysconfig
LimitNOFILE=65535
# See MAX_LOCKED_MEMORY in sysconfig, use "infinity" when MAX_LOCKED_MEMORY=unlimited and using bootstrap.mlockall: true

# Shutdown delay in seconds, before process is tried to be killed with KILL (if configured)
TimeoutStopSec=20

[Install]
WantedBy=multi-user.target

Note how limitNOFILE is set here. I have also set MAX_OPEN_FILES in my EnvironmentFile:

CONF_DIR=/etc/elasticsearch/graylog2
CONF_FILE=/etc/elasticsearch/graylog2/elasticsearch.yml
ES_GROUP=elasticsearch
ES_HOME=/usr/share/elasticsearch
ES_USER=elasticsearch
LOG_DIR=/var/log/elasticsearch/graylog2
MAX_OPEN_FILES=65535

However, elasticsearch still reports that the max open files are 4096, both from within the app itself, and from with /proc/<pid>/limits

Does anyone know what I'm doing wrong here? I even tried setting this from within limits.conf but as I expected, no luck.

I have a kubernetes setup running nicely, but I can't seem to expose services externally. I'm thinking my networking is not set up correctly:

• kubernetes services addresses: --service-cluster-ip-range=172.16.0.1/16

• flannel network config: etcdctl get /test.lan/network/config {"Network":"172.17.0.0/16"}

• docker subnet setting: --bip=10.0.0.1/24

• Hostnode IP: 192.168.4.57

I've got the nginx service running and I've tried to expose it like so:

[root@kubemaster ~]# kubectl get pods
NAME          READY     STATUS    RESTARTS   AGE
nginx-px6uy   1/1       Running   0          4m
[root@kubemaster ~]# kubectl get services
NAME         LABELS                                    SELECTOR    IP(S)           PORT(S)    AGE
kubernetes   component=apiserver,provider=kubernetes   <none>      172.16.0.1      443/TCP    31m
nginx        run=nginx                                 run=nginx   172.16.84.166   9000/TCP   3m

and then I exposed the service like this:

kubectl expose rc nginx --port=9000 --target-port=9000 --type=NodePort
NAME      LABELS      SELECTOR    IP(S)     PORT(S)    AGE
nginx     run=nginx   run=nginx             9000/TCP   292y

I'm expecting now to be able to get to the nginx container on the hostnodes IP (192.168.4.57) - have I misunderstood the networking? If I have, can explanation would be appreciated :(

Note: This is on physical hardware with no cloud provider provided load balancer, so NodePort is the only option I have, I think?

I'm having trouble getting PXE working with the foreman. It dl's pxelinux.0 fine, find the correct pxelinux.cfg for the mac address and then tried to download the kernel. Then we have a failure:

Could not find kernel image: boot/CentOS-6.3-x86_64-vmlinuz boot:

I can download the file manually from another box via TFTP.

The errors logs look like this:

http://pastebin.com/Mps4TDM2

what could I be doing wrong?

I'm currently in the process of setting up winbind/samba and getting a few issues.

I can test connectivity with wbinfo fine:

[root@buildmirror ~]# wbinfo -u
hostname     username
administrator
guest
krbtgt
username


[root@buildmirror ~]# wbinfo -a username%password
plaintext password authentication succeeded
challenge/response password authentication succeeded

however when I do a getent I don't get any AD accounts returned

[root@buildmirror ~]# getent passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
puppet:x:52:52:Puppet:/var/lib/puppet:/sbin/nologin

my nsswitch looks like this:

passwd:     files winbind
shadow:     files winbind
group:      files winbind

#hosts:     db files nisplus nis dns
hosts:      files dns

and I'm definitely joined to the domain:

[root@buildmirror ~]# net ads info
LDAP server: 192.168.4.4
LDAP server name: pdc.domain.local
Realm: domain.local
Bind Path: dc=DOMAIN,dc=LOCAL
LDAP port: 389
Server time: Sun, 05 Aug 2012 17:11:27 BST
KDC server: 192.168.4.4
Server time offset: -1

So what am I missing?

I'm trying to set up an initial puppet config but struggling to get it working due to failures on my first file inside the file bucket. Everything seems fine at first glance, I'm thinking I need a second opinion just to catch the issue. So I've defined the node in nodes.pp as follows:

# cat /etc/puppet/manifests/nodes.pp
node defaultclass  {
    include baseconfig
}
node 'buildmirror.briggs.uk.to' {
    include ntp
    include packages
}

My filebucket resides here:

# cat /etc/puppet/modules/baseconfig/manifests/ntp.pp
class ntp {
file { "/etc/ntp.conf":
source => "puppet:////modules/baseconfig/ntp.conf",
        owner => root,
        group => root,
        mode => 644,
        require => Package ["ntp"]
}

#file { "/var/log/ntp":
#ensure => directory,
#owner => ntp,
#group => ntp,
#mode => 755,
#}
service { "ntpd":
require => File["/etc/ntp.conf"],
subscribe => File["/etc/ntp.conf"],
ensure => running,
enable => true,
}
}

and the file exists in the correct directory (I think)

# ls -al /etc/puppet/modules/baseconfig/files/ntp.conf
-rwxr-xr-x 1 root root 1862 Jul 20 15:50 /etc/puppet/modules/baseconfig/files/ntp.conf

The problem I have is that when I run puppetd --test I get the following errors:

# puppetd --test
info: Retrieving plugin
info: Caching catalog for hostname
info: Applying configuration version '1342971406'
err: /Stage[main]/Ntp/File[/etc/ntp.conf]: Could not evaluate:     Could not retrieve     information from   environment production source(s) puppet:////modules/baseconfig/ntp.conf  at         /etc/puppet/modules/baseconfig/manifests/ntp.pp:8
 notice: /Stage[main]/Ntp/Service[ntpd]: Dependency File[/etc/ntp.conf] has failures: true
 warning: /Stage[main]/Ntp/Service[ntpd]: Skipping because of failed dependencies
 notice: Finished catalog run in 0.34 seconds

What could be causing this? I've verified the permissions on the file in the filebucket (and even tried setting them to 777 to ensure it's not a perms issue) Any help appreciated!