bugfix: tweak systemd unit, update the tests

trombik · Oct 24, 2021 · e132dc5 · e132dc5
1 parent 51f3ead
commit e132dc5
Show file tree

Hide file tree

Showing 3 changed files with 28 additions and 13 deletions.
diff --git a/templates/systemd.unit.j2 b/templates/systemd.unit.j2
@@ -6,7 +6,12 @@ After=network-online.target
 Documentation=https://github.com/trombik/ansible-role-opensearch
 
 [Service]
-EnvironmentFile={% if ansible_os_family == 'Debian' %}/etc/default/opensearch{% elif ansible_os_family == 'RedHat' %}/etc/sysconfig/opensearch{% endif %}
+WorkingDirectory={{ opensearch_root_dir }}
+{% if ansible_os_family == 'Debian' -%}
+EnvironmentFile=/etc/default/opensearch
+{% elif ansible_os_family == 'RedHat' -%}
+EnvironmentFile=/etc/sysconfig/opensearch
+{% endif -%}
 
 ExecStart={{ opensearch_root_dir }}/bin/opensearch
 ExecStop=/bin/kill -s QUIT $MAINPID
@@ -20,16 +25,19 @@ EnvironmentFile=/etc/default/{{ opensearch_service }}
 EnvironmentFile=/etc/sysconfig/{{ opensearch_service }}
 {% endif %}
 
+# these are handled by opensearch
 Environment=OPENSEARCH_PATH_CONF={{ opensearch_conf_dir }}
 Environment=OPENSEARCH_JAVA_OPTS=
 Environment=OPENSEARCH_TMPDIR=
-Environment=MAX_OPEN_FILES=65535
 Environment=ES_STARTUP_SLEEP_TIME=5
-Environment=MAX_LOCKED_MEMORY=unlimited
 Environment=OPENSEARCH_STARTUP_SLEEP_TIME=5
 
-LimitNOFILE=${MAX_OPEN_FILES}
-LimitMEMLOCK=${MAX_LOCKED_MEMORY}
+# systemd-specific
+LimitNOFILE=65535
+LimitNPROC=4096
+LimitAS=infinity
+LimitFSIZE=infinity
+LimitMEMLOCK=unlimited
 
 [Install]
 WantedBy=multi-user.target
diff --git a/tests/serverspec/default.yml b/tests/serverspec/default.yml
@@ -54,7 +54,8 @@
       Debian:
         # see https://opensearch.org/docs/latest/opensearch/install/important-settings/
         vm.max_map_count: 262144
-      RedHat: []
+      RedHat:
+        vm.max_map_count: 262144
     sysctl: "{{ os_sysctl[ansible_os_family] }}"
     opensearch_wait_for_cluster_status: yellow
     os_opensearch_package:
@@ -67,22 +68,23 @@
       Debian: |
         ES_PATH_CONF={{ opensearch_conf_dir }}
         ES_STARTUP_SLEEP_TIME=5
-        MAX_OPEN_FILES=65535
-        MAX_LOCKED_MEMORY=unlimited
       RedHat: |
         ES_PATH_CONF={{ opensearch_conf_dir }}
         ES_STARTUP_SLEEP_TIME=5
-        MAX_OPEN_FILES=65535
-        MAX_LOCKED_MEMORY=unlimited
     opensearch_flags: "{{ os_opensearch_flags[ansible_os_family] }}"
     os_opensearch_jvm_options:
       FreeBSD: ""
       Debian: |
+        # see opensearch-tar-install.sh
         # /usr/bin/getconf CLK_TCK`
         -Dclk.tck=100
+        -Djdk.attach.allowAttachSelf=true
+        -Djava.security.policy={{ opensearch_root_dir }}/plugins/opensearch-performance-analyzer/pa_config/opensearch_security.policy
       RedHat: |
         # /usr/bin/getconf CLK_TCK`
         -Dclk.tck=100
+        -Djdk.attach.allowAttachSelf=true
+        -Djava.security.policy={{ opensearch_root_dir }}/plugins/opensearch-performance-analyzer/pa_config/opensearch_security.policy
 
     os_opensearch_http_auth:
       FreeBSD:

diff --git a/tests/serverspec/default_spec.rb b/tests/serverspec/default_spec.rb
@@ -163,7 +163,6 @@
     it { should be_owned_by default_user }
     it { should be_grouped_into default_group }
     its(:content) { should match(/Managed by ansible/) }
-    its(:content) { should match(/MAX_OPEN_FILES=65535/) }
   end
 when "redhat"
   describe file("/etc/sysconfig/opensearch") do
@@ -172,7 +171,6 @@
     it { should be_owned_by default_user }
     it { should be_grouped_into default_group }
     its(:content) { should match(/Managed by ansible/) }
-    its(:content) { should match(/MAX_OPEN_FILES=65535/) }
   end
 when "openbsd"
   describe file("/etc/opensearch/jvm.in") do
@@ -312,6 +310,13 @@
   describe command "curl #{curl_flags} --request GET #{Shellwords.escape(api_url + '/_cluster/health')}" do
     its(:exit_status) { should eq 0 }
     its(:stderr) { should eq "" }
-    its(:stdout_as_json) { should include("status" => "green") }
+    its(:stdout_as_json) { should_not include("status" => "red") }
+  end
+end
+
+describe "Log" do
+  describe file es_log_file do
+    its(:content) { should_not match(/max virtual memory areas vm.max_map_count .* is too low/) }
+    its(:content) { should_not match(/max file descriptors .* is too low/) }
   end
 end